fix: 为失效 OIDC 事务提供安全重试

细分回调事务、状态和授权响应错误，提供脱敏诊断编号与显式重新登录入口，避免失效事务形成重试循环。
2026-07-13 22:50:09 +08:00
parent 6e0a5fe397
commit 8ca68eb3cd
8 changed files with 314 additions and 15 deletions
@@ -37,4 +37,59 @@ describe('OIDC BFF navigation', () => {
    expect(Object.keys(form)).not.toContain('accessToken');
    expect(submit).toHaveBeenCalledOnce();
  });
+
+  it('turns an invalid login transaction callback into an explicit retry action', async () => {
+    vi.stubEnv('VITE_OIDC_ENABLED', 'true');
+    const replaceState = vi.fn();
+    vi.stubGlobal('window', {
+      location: { pathname: '/', search: '?oidcError=OIDC_LOGIN_INVALID', hash: '#top' },
+      history: { replaceState },
+    });
+    const { consumeOIDCCallbackError } = await import('./oidc');
+
+    expect(consumeOIDCCallbackError()).toEqual({
+      code: 'OIDC_LOGIN_INVALID',
+      message: '统一认证登录事务无效或已过期，请重新登录',
+      retryable: true,
+    });
+    expect(replaceState).toHaveBeenCalledWith({}, '', '/#top');
+  });
+
+  it('explains a missing transaction cookie without retaining diagnostic query parameters', async () => {
+    vi.stubEnv('VITE_OIDC_ENABLED', 'true');
+    const replaceState = vi.fn();
+    vi.stubGlobal('window', {
+      location: {
+        pathname: '/',
+        search: '?tab=login&oidcError=OIDC_LOGIN_INVALID&oidcErrorReason=COOKIE_MISSING&oidcDiagnosticId=diag-123',
+        hash: '',
+      },
+      history: { replaceState },
+    });
+    const { consumeOIDCCallbackError } = await import('./oidc');
+
+    expect(consumeOIDCCallbackError()).toEqual({
+      code: 'OIDC_LOGIN_INVALID',
+      reason: 'COOKIE_MISSING',
+      diagnosticId: 'diag-123',
+      message: '浏览器未携带统一认证登录事务 Cookie，请允许 localhost Cookie 后重新登录',
+      retryable: true,
+    });
+    expect(replaceState).toHaveBeenCalledWith({}, '', '/?tab=login');
+  });
+
+  it('does not offer transaction retry for a token exchange failure', async () => {
+    vi.stubEnv('VITE_OIDC_ENABLED', 'true');
+    vi.stubGlobal('window', {
+      location: { pathname: '/', search: '?oidcError=OIDC_TOKEN_EXCHANGE_FAILED', hash: '' },
+      history: { replaceState: vi.fn() },
+    });
+    const { consumeOIDCCallbackError } = await import('./oidc');
+
+    expect(consumeOIDCCallbackError()).toEqual({
+      code: 'OIDC_TOKEN_EXCHANGE_FAILED',
+      message: '统一认证登录结果无效，请重新登录',
+      retryable: false,
+    });
+  });
 });