feat: improve account deletion and Agent authorization review
This commit is contained in:
陈煜 committed
1 parent
5ad64460f7
commit
91365ee315
21 files changed
+2276
-713
No files matched your search
@@ -0,0 +1,249 @@
|
||||
import 'dotenv/config';
|
||||
import { test } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { randomUUID, randomBytes, createHash } from 'node:crypto';
|
||||
import { PrismaClient } from '@prisma/client';
|
||||
import { today } from '../src/validation';
|
||||
const base = process.env.TEST_API_URL || 'http://127.0.0.1:3100/api';
|
||||
const origin = process.env.WEB_ORIGIN === '*' ? 'http://localhost:5173' : process.env.WEB_ORIGIN!;
|
||||
test('real REST account deletion preserves paired balances, blocks schedules, cascades own history and isolates users', async () => {
|
||||
const db = new PrismaClient(),
|
||||
users: string[] = [];
|
||||
async function fixture() {
|
||||
const u = await db.user.create({
|
||||
data: { username: 'delete_' + randomUUID(), passwordHash: 'unused', idleMinutes: 0 },
|
||||
});
|
||||
users.push(u.id);
|
||||
const token = randomBytes(32).toString('hex');
|
||||
const sessionId = createHash('sha256').update(token).digest('hex');
|
||||
await db.session.create({
|
||||
data: { id: sessionId, userId: u.id, expiresAt: new Date(Date.now() + 3600000) },
|
||||
});
|
||||
return { id: u.id, cookie: 'wp_session=' + token, sessionId };
|
||||
}
|
||||
async function call(u: any, path: string, method = 'GET', data?: unknown) {
|
||||
const r = await fetch(base + path, {
|
||||
method,
|
||||
headers: {
|
||||
Cookie: u.cookie,
|
||||
Origin: origin,
|
||||
...(data ? { 'Content-Type': 'application/json' } : {}),
|
||||
},
|
||||
body: data ? JSON.stringify(data) : undefined,
|
||||
});
|
||||
return { status: r.status, data: await r.json() };
|
||||
}
|
||||
try {
|
||||
const a = await fixture(),
|
||||
b = await fixture();
|
||||
const input = {
|
||||
kind: 'account',
|
||||
side: 'asset',
|
||||
category: 'cash',
|
||||
name: '删除测试账户',
|
||||
currency: 'CNY',
|
||||
amount: '100',
|
||||
date: today(),
|
||||
};
|
||||
const first = await call(a, '/positions', 'POST', input);
|
||||
assert.equal(first.status, 201);
|
||||
const id = first.data.id;
|
||||
assert.equal((await call(b, '/positions/' + id + '/deletion')).status, 404);
|
||||
assert.equal(
|
||||
(await call(b, '/positions/' + id, 'DELETE', { confirmation: input.name })).status,
|
||||
404,
|
||||
);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + id, 'DELETE', { confirmation: '错误名称' })).status,
|
||||
400,
|
||||
);
|
||||
assert.equal(
|
||||
(
|
||||
await call(a, '/positions/' + id + '/revisions', 'POST', {
|
||||
amount: '125.87654321',
|
||||
date: today(),
|
||||
})
|
||||
).status,
|
||||
201,
|
||||
);
|
||||
const debt = await call(a, '/positions', 'POST', {
|
||||
...input,
|
||||
kind: 'debt',
|
||||
side: 'liability',
|
||||
name: '关联债务',
|
||||
amount: '10',
|
||||
});
|
||||
assert.equal(debt.status, 201);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + debt.data.id + '/links', 'PUT', { targetIds: [id] })).status,
|
||||
200,
|
||||
);
|
||||
const impact = await call(a, '/positions/' + id + '/deletion');
|
||||
assert.equal(impact.data.historyCount, 2);
|
||||
assert.equal(impact.data.linkCount, 1);
|
||||
assert.equal(impact.data.canDelete, true);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + id, 'DELETE', { confirmation: input.name })).status,
|
||||
200,
|
||||
);
|
||||
assert.equal((await call(a, '/positions/' + id)).status, 404);
|
||||
assert.equal(await db.revision.count({ where: { positionId: id } }), 0);
|
||||
assert.equal(await db.positionLink.count({ where: { targetId: id } }), 0);
|
||||
const overview = await call(a, '/overview');
|
||||
assert.equal(overview.data.assets, '0.00');
|
||||
assert.equal(overview.data.liabilities, '10.00');
|
||||
assert.ok(!(await call(a, '/history')).data.items.some((h: any) => h.positionId === id));
|
||||
assert.ok(
|
||||
!(await call(a, '/calendar/day?date=' + today())).data.items.some(
|
||||
(h: any) => h.positionId === id,
|
||||
),
|
||||
);
|
||||
|
||||
const source = (await call(a, '/positions', 'POST', input)).data.id;
|
||||
const target = (
|
||||
await call(a, '/positions', 'POST', { ...input, name: '收款测试账户', amount: '0' })
|
||||
).data.id;
|
||||
const movement = await call(a, '/transfers', 'POST', {
|
||||
sourceId: source,
|
||||
targetId: target,
|
||||
amount: '20',
|
||||
received: '20',
|
||||
date: today(),
|
||||
});
|
||||
assert.equal(movement.status, 201);
|
||||
assert.equal((await call(a, '/positions/' + source + '/deletion')).data.canDelete, false);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + source, 'DELETE', { confirmation: input.name })).status,
|
||||
409,
|
||||
);
|
||||
assert.equal((await call(a, '/positions/' + target)).data.amount, '20');
|
||||
assert.equal((await call(a, '/transfers/' + movement.data.id, 'DELETE')).status, 200);
|
||||
assert.equal((await call(a, '/positions/' + target)).data.amount, '0');
|
||||
const schedule = await call(a, '/schedules', 'POST', {
|
||||
name: '未来计划',
|
||||
operation: 'expense',
|
||||
sourceId: source,
|
||||
amount: '5',
|
||||
nextAt: '2099-01-01T10:00',
|
||||
intervalDays: 0,
|
||||
});
|
||||
assert.equal(schedule.status, 201);
|
||||
assert.equal((await call(a, '/positions/' + source + '/deletion')).data.scheduleCount, 1);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + source, 'DELETE', { confirmation: input.name })).status,
|
||||
409,
|
||||
);
|
||||
assert.equal((await call(a, '/schedules/' + schedule.data.id, 'DELETE')).status, 200);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + source, 'DELETE', { confirmation: input.name })).status,
|
||||
200,
|
||||
);
|
||||
|
||||
const hidden = (await call(a, '/positions', 'POST', { ...input, hidden: true })).data.id;
|
||||
assert.equal((await call(a, '/positions/' + hidden + '/deletion')).status, 404);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + hidden, 'DELETE', { confirmation: input.name })).status,
|
||||
404,
|
||||
);
|
||||
await db.session.update({
|
||||
where: { id: a.sessionId },
|
||||
data: { revealUntil: new Date(Date.now() + 600000) },
|
||||
});
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + hidden, 'DELETE', { confirmation: input.name })).status,
|
||||
200,
|
||||
);
|
||||
assert.equal(
|
||||
(await call(a, '/positions/' + debt.data.id, 'DELETE', { confirmation: '关联债务' })).status,
|
||||
400,
|
||||
);
|
||||
} finally {
|
||||
await db.user.deleteMany({ where: { id: { in: users } } });
|
||||
await db.$disconnect();
|
||||
}
|
||||
});
|
||||
test('draft review resolves only referenced visible names and canonical standalone confirmation URL', async () => {
|
||||
const db = new PrismaClient();
|
||||
let userId = '';
|
||||
try {
|
||||
const u = await db.user.create({
|
||||
data: { username: 'review_' + randomUUID(), passwordHash: 'unused', idleMinutes: 0 },
|
||||
});
|
||||
userId = u.id;
|
||||
const token = randomBytes(32).toString('hex'),
|
||||
sid = createHash('sha256').update(token).digest('hex');
|
||||
await db.session.create({
|
||||
data: { id: sid, userId, expiresAt: new Date(Date.now() + 3600000) },
|
||||
});
|
||||
const grant = await db.agentGrant.create({
|
||||
data: {
|
||||
userId,
|
||||
name: '草稿审阅测试',
|
||||
scopes: ['read', 'draft'],
|
||||
resource: process.env.MCP_PUBLIC_URL || 'http://localhost:3100/mcp',
|
||||
sessionId: sid,
|
||||
accessDigest: createHash('sha256').update(randomUUID()).digest('hex'),
|
||||
expiresAt: new Date(Date.now() + 3600000),
|
||||
},
|
||||
});
|
||||
const visible = await db.position.create({
|
||||
data: {
|
||||
userId,
|
||||
name: '可见账户',
|
||||
kind: 'account',
|
||||
side: 'asset',
|
||||
category: 'cash',
|
||||
currency: 'CNY',
|
||||
notes: '',
|
||||
},
|
||||
});
|
||||
const hidden = await db.position.create({
|
||||
data: {
|
||||
userId,
|
||||
name: '隐藏名称不能泄露',
|
||||
hidden: true,
|
||||
kind: 'account',
|
||||
side: 'asset',
|
||||
category: 'cash',
|
||||
currency: 'CNY',
|
||||
notes: '',
|
||||
},
|
||||
});
|
||||
const unrelated = await db.position.create({
|
||||
data: {
|
||||
userId,
|
||||
name: '无关账户',
|
||||
kind: 'account',
|
||||
side: 'asset',
|
||||
category: 'cash',
|
||||
currency: 'CNY',
|
||||
notes: '',
|
||||
},
|
||||
});
|
||||
const op = await db.agentOperation.create({
|
||||
data: {
|
||||
userId,
|
||||
grantId: grant.id,
|
||||
key: randomUUID(),
|
||||
hash: '0'.repeat(64),
|
||||
snapshot: '0'.repeat(64),
|
||||
tool: 'debt_links_set',
|
||||
parameters: { id: visible.id, targetIds: [hidden.id] },
|
||||
expiresAt: new Date(Date.now() + 600000),
|
||||
},
|
||||
});
|
||||
const res = await fetch(base + '/agent/operations/' + op.id, {
|
||||
headers: { Cookie: 'wp_session=' + token },
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
const preview = await res.json();
|
||||
assert.equal(preview.connectionName, '草稿审阅测试');
|
||||
assert.equal(preview.impact.references[visible.id].name, '可见账户');
|
||||
assert.ok(!preview.impact.references[hidden.id]);
|
||||
assert.ok(!preview.impact.references[unrelated.id]);
|
||||
assert.equal(new URL(preview.confirmationUrl).pathname, '/agent/operation');
|
||||
} finally {
|
||||
if (userId) await db.user.deleteMany({ where: { id: userId } });
|
||||
await db.$disconnect();
|
||||
}
|
||||
});
|
||||
Reference in new issue
Block a user