feat: 将 Gateway Web 迁移到 BFF 会话

浏览器只通过 HttpOnly Cookie 恢复统一认证状态，不再访问认证中心 Token Endpoint 或保存 OIDC Token。同步更新错误提示、部署配置和接入文档。
2026-07-13 19:09:57 +08:00
parent c5c82bb528
commit 46bac51703
15 changed files with 143 additions and 287 deletions
@@ -0,0 +1,40 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+describe('OIDC BFF navigation', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.unstubAllGlobals();
+    vi.resetModules();
+  });
+
+  it('sends only returnTo to the Gateway login endpoint', async () => {
+    vi.stubEnv('VITE_OIDC_ENABLED', 'true');
+    vi.stubEnv('VITE_GATEWAY_API_BASE_URL', 'https://gateway.example.com/gateway-api');
+    const assign = vi.fn();
+    vi.stubGlobal('window', {
+      location: { pathname: '/workspace', search: '?tab=wallet', hash: '#balance', assign },
+    });
+    const { startOIDCLogin } = await import('./oidc');
+    await startOIDCLogin();
+    const target = new URL(String(assign.mock.calls[0]?.[0]));
+    expect(target.pathname).toBe('/gateway-api/api/v1/auth/oidc/login');
+    expect(target.searchParams.get('returnTo')).toBe('/workspace?tab=wallet#balance');
+    expect(target.searchParams.has('client_id')).toBe(false);
+    expect(target.searchParams.has('code_challenge')).toBe(false);
+  });
+
+  it('submits logout as a top-level POST without exposing tokens', async () => {
+    vi.stubEnv('VITE_OIDC_ENABLED', 'true');
+    vi.stubEnv('VITE_GATEWAY_API_BASE_URL', 'https://gateway.example.com/gateway-api');
+    const submit = vi.fn();
+    const form = { method: '', action: '', style: { display: '' }, submit };
+    const appendChild = vi.fn();
+    vi.stubGlobal('document', { createElement: vi.fn(() => form), body: { appendChild } });
+    const { startOIDCLogout } = await import('./oidc');
+    await expect(startOIDCLogout()).resolves.toBe(true);
+    expect(form.method).toBe('POST');
+    expect(form.action).toBe('https://gateway.example.com/gateway-api/api/v1/auth/oidc/logout');
+    expect(Object.keys(form)).not.toContain('accessToken');
+    expect(submit).toHaveBeenCalledOnce();
+  });
+});