From 927c4d5f4ebb2d09b4a7290b2a1b1dea2ee3c2fd Mon Sep 17 00:00:00 2001
From: kdletters <kdletters@qq.com>
Date: Sat, 20 Jun 2026 22:10:19 +0800
Subject: [PATCH] =?UTF-8?q?=E9=94=81=E5=AE=9A=E7=A7=BB=E5=8A=A8=E5=A3=B3?=
 =?UTF-8?q?=E6=B3=A8=E5=85=A5=E6=B6=88=E6=81=AF=E6=9D=A5=E6=BA=90=E5=AD=97?=
 =?UTF-8?q?=E6=AE=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

补充移动壳 HostBridge 注入 source 与 origin 断言

更新移动壳配置门禁反查注入来源测试
---
 apps/mobile-shell/scripts/check-config.mjs    | 3 +++
 apps/mobile-shell/src/shell/ShellApp.test.tsx | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/apps/mobile-shell/scripts/check-config.mjs b/apps/mobile-shell/scripts/check-config.mjs
index d63556caf..302338f2a 100644
--- a/apps/mobile-shell/scripts/check-config.mjs
+++ b/apps/mobile-shell/scripts/check-config.mjs
@@ -2612,6 +2612,9 @@ for (const snippet of [
   'mobile HostBridge message injection failed',
   "test('drops delayed HostBridge responses after shell unmount'",
   "id: 'network-request-1'",
+  'expectInjectedHostBridgeMessageSource',
+  "expect(script).toContain('origin: window.location.origin')",
+  "expect(script).toContain('source: window')",
   "type: 'genarrative.mobile.historyState'",
   'mobile host event failed for network.statusChanged',
   'external WebView navigation native failures stay outside the WebView',
diff --git a/apps/mobile-shell/src/shell/ShellApp.test.tsx b/apps/mobile-shell/src/shell/ShellApp.test.tsx
index 4d55bc739..0b88f00a1 100644
--- a/apps/mobile-shell/src/shell/ShellApp.test.tsx
+++ b/apps/mobile-shell/src/shell/ShellApp.test.tsx
@@ -245,6 +245,11 @@ function extractInjectedHostBridgeMessage(script: string) {
   return JSON.parse(JSON.parse(encodedMessage)) as unknown;
 }
 
+function expectInjectedHostBridgeMessageSource(script: string) {
+  expect(script).toContain('origin: window.location.origin');
+  expect(script).toContain('source: window');
+}
+
 function hostBridgeMessages() {
   return shellHarness.injectedScripts.map(extractInjectedHostBridgeMessage);
 }
@@ -322,6 +327,7 @@ describe('ShellApp QR scanner HostBridge flow', () => {
     const responseScript = shellHarness.injectedScripts.find((script) =>
       script.includes('scan-request-1'),
     );
+    expectInjectedHostBridgeMessageSource(responseScript ?? '');
     const response = extractInjectedHostBridgeMessage(responseScript ?? '');
 
     expect(response).toMatchObject({
@@ -446,6 +452,7 @@ describe('ShellApp HostBridge event injection', () => {
     shellHarness.appStateListeners[0]?.('background');
 
     const event = hostBridgeEvent('app.lifecycle');
+    expectInjectedHostBridgeMessageSource(shellHarness.injectedScripts[0] ?? '');
     expect(event).toMatchObject({
       event: 'app.lifecycle',
       payload: {