1

src/services/apiClient.test.ts

@@ -1,33 +1,12 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import {
+  AUTH_STATE_EVENT,
   ApiClientError,
-  clearStoredAccessToken,
   fetchWithApiAuth,
-  getStoredAccessToken,
   requestJson,
-  setStoredAccessToken,
 } from './apiClient';
 
-function createMemoryStorage() {
-  const values = new Map<string, string>();
-
-  return {
-    getItem(key: string) {
-      return values.has(key) ? values.get(key)! : null;
-    },
-    setItem(key: string, value: string) {
-      values.set(key, value);
-    },
-    removeItem(key: string) {
-      values.delete(key);
-    },
-    clear() {
-      values.clear();
-    },
-  };
-}
-
 function createResponseMock(params: {
   status: number;
   body?: string;
@@ -54,50 +33,18 @@ function createResponseMock(params: {
 
 describe('apiClient', () => {
   const fetchMock = vi.fn();
+  const dispatchEventMock = vi.fn();
 
   beforeEach(() => {
     vi.stubGlobal('fetch', fetchMock);
     vi.stubGlobal('window', {
-      localStorage: createMemoryStorage(),
-      dispatchEvent: vi.fn(),
+      dispatchEvent: dispatchEventMock,
     });
     fetchMock.mockReset();
-    clearStoredAccessToken();
+    dispatchEventMock.mockReset();
   });
 
-  it('attaches auth headers and clears stale tokens on unauthorized responses', async () => {
-    setStoredAccessToken('jwt-token');
-    fetchMock
-      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
-      .mockResolvedValueOnce(createResponseMock({ status: 401 }));
-
-    const response = await fetchWithApiAuth('/api/protected', { method: 'GET' });
-
-    expect(response.status).toBe(401);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(fetchMock).toHaveBeenCalledWith(
-      '/api/protected',
-      expect.objectContaining({
-        credentials: 'same-origin',
-        headers: expect.objectContaining({
-          Authorization: 'Bearer jwt-token',
-          'x-genarrative-response-envelope': 'v1',
-        }),
-      }),
-    );
-    expect(fetchMock).toHaveBeenNthCalledWith(
-      2,
-      '/api/auth/refresh',
-      expect.objectContaining({
-        method: 'POST',
-        credentials: 'same-origin',
-      }),
-    );
-    expect(getStoredAccessToken()).toBe('');
-  });
-
-  it('refreshes the access token once and retries the original request', async () => {
-    setStoredAccessToken('expired-token');
+  it('refreshes cookie session once and retries the original request', async () => {
     fetchMock
       .mockResolvedValueOnce(createResponseMock({ status: 401 }))
       .mockResolvedValueOnce(
@@ -106,7 +53,7 @@ describe('apiClient', () => {
           body: JSON.stringify({
             ok: true,
             data: {
-              token: 'fresh-token',
+              ok: true,
             },
             error: null,
             meta: {
@@ -138,41 +85,115 @@ describe('apiClient', () => {
     );
 
     expect(result).toEqual({ value: 7 });
-    expect(getStoredAccessToken()).toBe('fresh-token');
+    expect(fetchMock).toHaveBeenCalledTimes(3);
+    expect(fetchMock).toHaveBeenNthCalledWith(
+      1,
+      '/api/runtime/protected',
+      expect.objectContaining({
+        credentials: 'same-origin',
+        headers: expect.objectContaining({
+          'x-genarrative-response-envelope': 'v1',
+        }),
+      }),
+    );
     expect(fetchMock).toHaveBeenNthCalledWith(
       2,
       '/api/auth/refresh',
       expect.objectContaining({
         method: 'POST',
+        credentials: 'same-origin',
       }),
     );
     expect(fetchMock).toHaveBeenNthCalledWith(
       3,
       '/api/runtime/protected',
       expect.objectContaining({
-        headers: expect.objectContaining({
-          Authorization: 'Bearer fresh-token',
-        }),
+        credentials: 'same-origin',
+      }),
+    );
+    expect(dispatchEventMock).toHaveBeenCalledTimes(1);
+    expect(dispatchEventMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: AUTH_STATE_EVENT,
       }),
     );
   });
 
-  it('does not refresh or emit auth changes for 401 responses without auth context', async () => {
+  it('does not emit auth change events when 401 probe requests opt into silent mode', async () => {
     fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
 
+    const response = await fetchWithApiAuth(
+      '/api/auth/me',
+      {
+        method: 'GET',
+      },
+      {
+        notifyAuthStateChange: false,
+        skipRefresh: true,
+      },
+    );
+
+    expect(response.status).toBe(401);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(dispatchEventMock).not.toHaveBeenCalled();
+  });
+
+  it('emits auth change events when refresh fails on protected requests', async () => {
+    fetchMock
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }));
+
     const response = await fetchWithApiAuth('/api/runtime/protected', {
       method: 'GET',
     });
 
     expect(response.status).toBe(401);
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(fetchMock).toHaveBeenCalledWith(
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(dispatchEventMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('accepts refresh responses that only acknowledge renewed cookie state', async () => {
+    fetchMock
+      .mockResolvedValueOnce(createResponseMock({ status: 401 }))
+      .mockResolvedValueOnce(
+        createResponseMock({
+          status: 200,
+          body: JSON.stringify({
+            ok: true,
+            data: {
+              ok: true,
+            },
+            error: null,
+            meta: {
+              apiVersion: '2026-04-08',
+            },
+          }),
+        }),
+      )
+      .mockResolvedValueOnce(
+        createResponseMock({
+          status: 200,
+          body: JSON.stringify({
+            ok: true,
+            data: {
+              value: 9,
+            },
+            error: null,
+            meta: {
+              apiVersion: '2026-04-08',
+            },
+          }),
+        }),
+      );
+
+    const result = await requestJson<{ value: number }>(
       '/api/runtime/protected',
-      expect.objectContaining({
-        credentials: 'same-origin',
-      }),
+      { method: 'GET' },
+      '读取受保护数据失败',
     );
-    expect(window.dispatchEvent).not.toHaveBeenCalled();
+
+    expect(result).toEqual({ value: 9 });
+    expect(fetchMock).toHaveBeenCalledTimes(3);
   });
 
   it('retries transient get requests before unwrapping the response envelope', async () => {