feat: persist account group display order and backup preferences

apps/api/test/group-order.test.ts

@@ -0,0 +1,107 @@
+import 'dotenv/config';
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { randomUUID, randomBytes, createHash } from 'node:crypto';
+import { PrismaClient } from '@prisma/client';
+import { readBackupZip } from '../src/zip';
+const base = process.env.TEST_API_URL || 'http://127.0.0.1:3100/api';
+test('group order persists per user, validates input and survives ZIP and legacy imports', async () => {
+  const db = new PrismaClient(),
+    ids: string[] = [];
+  const origin = process.env.WEB_ORIGIN === '*' ? 'http://localhost:5173' : process.env.WEB_ORIGIN!;
+  async function user() {
+    const u = await db.user.create({
+      data: { username: 'wp_groups_' + randomUUID(), passwordHash: 'unused' },
+    });
+    ids.push(u.id);
+    const token = randomBytes(32).toString('hex');
+    await db.session.create({
+      data: {
+        id: createHash('sha256').update(token).digest('hex'),
+        userId: u.id,
+        expiresAt: new Date(Date.now() + 3600000),
+      },
+    });
+    return { id: u.id, cookie: 'wp_session=' + token };
+  }
+  async function call(path: string, cookie: string, method = 'GET', body?: unknown) {
+    const res = await fetch(base + path, {
+      method,
+      headers: {
+        Cookie: cookie,
+        Origin: origin,
+        ...(body ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    return { status: res.status, data: await res.json() };
+  }
+  try {
+    const a = await user(),
+      b = await user(),
+      c = await user();
+    assert.deepEqual((await call('/auth/me', a.cookie)).data.accountGroupOrder, []);
+    const order = ['理财', '', '未分组', '日常'];
+    assert.equal(
+      (await call('/settings', a.cookie, 'PATCH', { accountGroupOrder: order })).status,
+      200,
+    );
+    assert.deepEqual(
+      (await db.user.findUniqueOrThrow({ where: { id: a.id } })).accountGroupOrder,
+      order,
+    );
+    assert.deepEqual((await call('/auth/me', a.cookie)).data.accountGroupOrder, order);
+    assert.deepEqual((await call('/settings', a.cookie)).data.accountGroupOrder, order);
+    assert.deepEqual((await call('/settings', b.cookie)).data.accountGroupOrder, []);
+    for (const invalid of [['日常', '日常'], [' 日常 ', '日常'], [42], ['x'.repeat(61)]]) {
+      assert.equal(
+        (await call('/settings', a.cookie, 'PATCH', { accountGroupOrder: invalid })).status,
+        400,
+      );
+    }
+    assert.deepEqual((await call('/settings', a.cookie)).data.accountGroupOrder, order);
+    assert.equal(
+      (
+        await call('/positions', a.cookie, 'POST', {
+          name: 'Daily',
+          kind: 'account',
+          side: 'asset',
+          category: 'cash',
+          groupName: '日常',
+          currency: 'CNY',
+          amount: '20',
+          date: '2026-09-01T10:00',
+        })
+      ).status,
+      201,
+    );
+    const zip = await fetch(base + '/backup', { headers: { Cookie: a.cookie } });
+    assert.equal(zip.status, 200);
+    const backup: any = await readBackupZip(Buffer.from(await zip.arrayBuffer()));
+    assert.deepEqual(backup.preferences.accountGroupOrder, order);
+    assert.equal(
+      (await call('/backup/import', b.cookie, 'POST', { confirmed: true, backup })).status,
+      201,
+    );
+    assert.deepEqual((await call('/auth/me', b.cookie)).data.accountGroupOrder, order);
+    await call('/settings', b.cookie, 'PATCH', { accountGroupOrder: ['日常'] });
+    assert.equal(
+      (await call('/backup/import', b.cookie, 'POST', { confirmed: true, backup })).status,
+      409,
+    );
+    assert.deepEqual((await call('/settings', b.cookie)).data.accountGroupOrder, ['日常']);
+    delete backup.preferences.accountGroupOrder;
+    assert.equal(
+      (await call('/backup/import', c.cookie, 'POST', { confirmed: true, backup })).status,
+      201,
+    );
+    assert.deepEqual((await call('/auth/me', c.cookie)).data.accountGroupOrder, []);
+    const comments: any[] = await db.$queryRawUnsafe(
+      "SELECT COLUMN_COMMENT AS comment FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'User' AND COLUMN_NAME = 'accountGroupOrder'",
+    );
+    assert.ok(comments[0].comment.includes('分组'));
+  } finally {
+    await db.user.deleteMany({ where: { id: { in: ids } } });
+    await db.$disconnect();
+  }
+});