feat: v0.7.0 四阶段全量迭代 — 修复面收口 · 安全纵深 · 架构还债 · 能力演进
P1 修复面收口: v0.6.3 截断自愈推全量(Anthropic/Ollama/非流式/引擎兜底); SSE 上游错误帧检测进重试通道; clearMessages 摘要游标根治; truncateResult 内联图片白名单统一; 前端四 bug(确认弹窗锁死/MemoryViewer/ Virtuoso Footer/abort 尾部过滤) + reasoning 缓冲跨迭代污染; 托盘通知过滤与新建会话死链接线 P2 安全纵深: MCP 审批闭环(ConfirmationHook×PolicyEngine 联动+重名拒注册); SSRF 收敛 ssrf-guard 共享模块 (web_fetch 双通道校验+重定向终态复检); Electron 加固(preload CJS 化→sandbox:true/CSP/权限白名单/will-navigate); run_command cmd.exe 白名单通道元字符守门; diff_viewer 10MB 预检; Anthropic thinking 预算下限; Agnes 思考显式关闭 P3 架构还债: OpenAICompatibleAdapter 中间基类收敛四家样板; 错误分类单轨化(删 mapError/getFetchSignal, 超时显式 ETIMEDOUT); PRAGMA user_version 迁移版本化; 死代码清理专项(cn.ts/SHORTCUTS/ContextMenu 分支/ getWindowState/modifiedArgs/sandbox 空壳); i18next 引入; a11y 第一轮; SearXNG 页批量草稿模型统一 P4 能力演进: Ollama pull 可取消/capabilities 探测/num_ctx 实测缓存; UpdateService feed 比对式自动更新 (app:updateCheck IPC + StatusBar 入口); MiMo providerOptions(web_search 服务端工具/strict JSON); web_fetch extract_mode=markdown(turndown); network.proxyUrl 全局代理(Chromium sessions+undici dispatcher) 测试: 264 → 507 用例(Electron ABI 全绿零跳过), 覆盖引擎压缩管线/重试竞速/MEMORY.md 闸门/file_editor 五操作/ filesystem 七工具实体夹具/git 真实仓库/SSE 错误帧/全线截断自愈/Provider 请求形态矩阵/SSRF 表测/钩子分级矩阵/ OutputValidator 全量/SLO 指标/MCP 安全纯函数/task_manager 链路/渲染层纯域/i18n 桥契约
This commit is contained in:
@@ -0,0 +1,67 @@
|
||||
/**
|
||||
* 数据库 schema 版本化测试（v0.6.4 P3-3）
|
||||
*
|
||||
* 契约：
|
||||
* 1. 全新库 initialize() 后 PRAGMA user_version 盖章为 DatabaseService.SCHEMA_VERSION；
|
||||
* 2. 已盖章的库再次 initialize（新实例、同文件）→ 走快速路径，探测批次跳过，
|
||||
* 且版本号保持不变；
|
||||
* 3. user_version 与数据共存：盖章不会丢失/改变已有数据。
|
||||
*
|
||||
* 运行要求：better-sqlite3 需为 Electron ABI 构建（test:electron 模式），
|
||||
* 系统 Node 下自动跳过。
|
||||
*/
|
||||
|
||||
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
||||
import { mkdtempSync, rmSync } from 'fs';
|
||||
import { tmpdir } from 'os';
|
||||
import { join } from 'path';
|
||||
|
||||
let dbAvailable = true;
|
||||
try {
|
||||
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
||||
const probe = require('better-sqlite3');
|
||||
const p = new probe(':memory:');
|
||||
p.close();
|
||||
} catch {
|
||||
dbAvailable = false;
|
||||
}
|
||||
|
||||
import type { DatabaseService } from '../database.service';
|
||||
|
||||
describe.skipIf(!dbAvailable)('DatabaseService — PRAGMA user_version 版本化', () => {
|
||||
let dir: string;
|
||||
let svc1: DatabaseService;
|
||||
let svc2: DatabaseService;
|
||||
|
||||
beforeAll(async () => {
|
||||
dir = mkdtempSync(join(tmpdir(), 'metona-dbmig-'));
|
||||
const mod = await import('../database.service');
|
||||
const Svc = mod.DatabaseService;
|
||||
svc1 = new Svc(dir);
|
||||
svc1.initialize();
|
||||
svc2 = new Svc(dir); // 模拟第二次启动
|
||||
svc2.initialize();
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
try {
|
||||
svc2?.close();
|
||||
svc1?.close();
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
rmSync(dir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
it('initialize 后 user_version 已盖章为 SCHEMA_VERSION', () => {
|
||||
const version = svc2.getDB().pragma('user_version', { simple: true }) as number;
|
||||
expect(version).toBe(1);
|
||||
});
|
||||
|
||||
it('盖章库的探测批次被跳过（重复 initialize 不报错且配置 seed 保持存在）', () => {
|
||||
// 核心断言在日志侧难以捕获 —— 这里验证幂等性的可观察结果：
|
||||
// 种子默认值仍然存在（INSERT OR IGNORE），表结构与首次一致
|
||||
const row = svc2.getDB().prepare(`SELECT COUNT(*) AS n FROM app_config`).get() as { n: number };
|
||||
expect(row.n).toBeGreaterThan(0);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,187 @@
|
||||
/**
|
||||
* MCP 命令安全面 + SLO 监控契约测试（v0.7.0 覆盖补齐）
|
||||
*
|
||||
* mcp-manager 的三个安全纯函数此前零测试（命令白名单/参数元字符检测/
|
||||
* env 敏感变量剥离），是 MCP 攻击面的第一道防线 —— 逐条表测锁定。
|
||||
* HealthChecker/SLOMonitor 此前为"活代码无契约"，本文件锁定其健康判定与
|
||||
* SLO 指标计算（percentile/burnRate/violated/窗口淘汰）。
|
||||
*/
|
||||
|
||||
import { describe, it, expect, vi } from 'vitest';
|
||||
|
||||
vi.mock('electron-log', () => ({
|
||||
default: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
|
||||
}));
|
||||
|
||||
import { safeParseArgs, validateMcpCommand, buildSafeEnv } from '../mcp-manager.service';
|
||||
import { SLOMonitor, HealthChecker } from '../../utils/slo';
|
||||
import type { Database } from 'better-sqlite3';
|
||||
|
||||
// better-sqlite3 的 ABI 可用性在模块顶层探测（describe.skipIf 在注册期求值）
|
||||
let dbAvailable = false;
|
||||
try {
|
||||
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
||||
const DatabaseProbe = require('better-sqlite3');
|
||||
const p = new DatabaseProbe(':memory:');
|
||||
p.close();
|
||||
dbAvailable = true;
|
||||
} catch {
|
||||
dbAvailable = false;
|
||||
}
|
||||
|
||||
// ===== MCP：safeParseArgs =====
|
||||
|
||||
describe('safeParseArgs — JSON args 解析', () => {
|
||||
it('合法 JSON 数组 → string[]', () => {
|
||||
expect(safeParseArgs('["--flag","value"]')).toEqual(['--flag', 'value']);
|
||||
});
|
||||
|
||||
it('非数组/坏 JSON/空输入 → 空数组兜底', () => {
|
||||
expect(safeParseArgs('{"a":1}')).toEqual([]);
|
||||
expect(safeParseArgs('not json')).toEqual([]);
|
||||
expect(safeParseArgs('')).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
// ===== MCP：validateMcpCommand =====
|
||||
|
||||
describe('validateMcpCommand — stdio 命令白名单防线', () => {
|
||||
it('白名单内命令正常放行；目录前缀剥除后匹配 basename，但扩展名不剥除', () => {
|
||||
for (const cmd of ['npx', 'node', 'npm', 'python', 'python3', 'uv', 'uvx', 'bun', 'deno']) {
|
||||
expect(() => validateMcpCommand(cmd, [])).not.toThrow();
|
||||
}
|
||||
// 目录前缀被剥除 → basename 命中白名单
|
||||
expect(() => validateMcpCommand('/usr/local/bin/npx', ['-y', '@modelcontextprotocol/server'])).not.toThrow();
|
||||
// 现状锁定（比预期更严）：扩展名不参与剥除 —— 'npx.cmd' 不在名单，直接拒绝。
|
||||
// 这是当前安全基线的一部分：宁可收紧也不放过任何可执行变体。
|
||||
expect(() => validateMcpCommand('C:\tools\npx.cmd', [])).toThrow(/allowed list/);
|
||||
});
|
||||
|
||||
it('白名单外命令直接拒绝', () => {
|
||||
for (const cmd of ['curl', 'bash', 'sh', 'pwsh', 'cmd', 'powershell.exe', './unknown-server']) {
|
||||
expect(() => validateMcpCommand(cmd, [])).toThrow(/not in the allowed list/);
|
||||
}
|
||||
});
|
||||
|
||||
it('args 中携带 shell 元字符（; & | 反引号 $ 等）拒绝；普通参数放行', () => {
|
||||
const evil: Array<string[]> = [
|
||||
[';whoami'],
|
||||
['a&b'],
|
||||
['x|cat'],
|
||||
['`id`'],
|
||||
['$HOME'],
|
||||
['<in'],
|
||||
['>out'],
|
||||
['line\nbreak'],
|
||||
];
|
||||
for (const args of evil) {
|
||||
expect(() => validateMcpCommand('node', ['server.js', ...args])).toThrow();
|
||||
}
|
||||
expect(() => validateMcpCommand('node', ['server.js', '--port', '3000'])).not.toThrow();
|
||||
});
|
||||
});
|
||||
|
||||
// ===== MCP：buildSafeEnv =====
|
||||
|
||||
describe('buildSafeEnv — 子进程环境净化', () => {
|
||||
it('命中后缀黑名单的敏感键被剔除，其余保留', () => {
|
||||
const baseEnv = {
|
||||
PATH: '/usr/bin',
|
||||
HOME: '/home/u',
|
||||
MY_API_KEY: 'sk-secret',
|
||||
ACCESS_TOKEN: 'tok',
|
||||
DB_PASSWORD: 'p@ss',
|
||||
AWS_SECRET_ACCESS_KEY2: 'k',
|
||||
DEPLOY_PRIVATE_KEY: '----', // 后缀 _PRIVATE_KEY 命中
|
||||
GITEA_CREDENTIALS: '{"u":"x"}', // 后缀 _CREDENTIALS 命中（真实 CI/部署泄漏形态）
|
||||
SAFE_NAME: 'keepme',
|
||||
};
|
||||
vi.stubGlobal('process', { ...process, env: baseEnv as NodeJS.ProcessEnv });
|
||||
const env = buildSafeEnv();
|
||||
expect(env.PATH).toBe('/usr/bin');
|
||||
expect(env.SAFE_NAME).toBe('keepme');
|
||||
expect(env.MY_API_KEY).toBeUndefined();
|
||||
expect(env.ACCESS_TOKEN).toBeUndefined();
|
||||
expect(env.DB_PASSWORD).toBeUndefined();
|
||||
expect(env.DEPLOY_PRIVATE_KEY).toBeUndefined();
|
||||
expect(env.GITEA_CREDENTIALS).toBeUndefined();
|
||||
vi.unstubAllGlobals();
|
||||
});
|
||||
});
|
||||
|
||||
// ===== SLOMonitor =====
|
||||
|
||||
describe('SLOMonitor — 窗口指标 / 分位数 / 燃烧率', () => {
|
||||
function makeMonitor(): SLOMonitor {
|
||||
return new SLOMonitor({ target: 0.99, windowMs: 60_000, latencyPercentiles: [0.5, 0.95], latencyThresholdMs: 5_000 });
|
||||
}
|
||||
|
||||
it('空窗口：totalRequests=0、errorRate=0、violated=false、burnRate=0', () => {
|
||||
const s = makeMonitor().getStatus();
|
||||
expect(s.totalRequests).toBe(0);
|
||||
expect(s.errorRate).toBe(0);
|
||||
expect(s.violated).toBe(false);
|
||||
expect(s.burnRate).toBe(0);
|
||||
});
|
||||
|
||||
it('统计请求成功率/平均延迟/吞吐量、分位数字段齐全且单调', async () => {
|
||||
const m = makeMonitor();
|
||||
const t0 = Date.now();
|
||||
const latencies = [100, 200, 400, 800, 1600]; // 全成功
|
||||
latencies.forEach((ms, i) => {
|
||||
m.recordRequest(ms, true);
|
||||
void i;
|
||||
});
|
||||
void t0;
|
||||
const s = m.getStatus();
|
||||
expect(s.totalRequests).toBe(5);
|
||||
expect(s.errorRequests).toBe(0);
|
||||
expect(s.avgLatencyMs).toBe(620);
|
||||
expect(Object.keys(s.percentiles)).toEqual(['P50', 'P95']);
|
||||
expect(s.percentiles['P50']).toBeGreaterThanOrEqual(200);
|
||||
expect(s.percentiles['P95']).toBeLessThanOrEqual(1600);
|
||||
expect(s.burnRate).toBe(0);
|
||||
expect(s.target).toBeCloseTo(0.99);
|
||||
expect(s.errorBudget).toBeCloseTo(0.01);
|
||||
});
|
||||
|
||||
it('错误率超预算 → burnRate>1 且 violated=true（全错样本：burnRate=100）', async () => {
|
||||
const m = new SLOMonitor({ target: 0.99, windowMs: 60_000, latencyPercentiles: [0.5], latencyThresholdMs: 10_000 });
|
||||
for (let i = 0; i < 4; i++) m.recordRequest(50 + i, false);
|
||||
const s = m.getStatus();
|
||||
expect(s.errorRate).toBe(1);
|
||||
expect(s.burnRate).toBeGreaterThan(1);
|
||||
expect(s.violated).toBe(true);
|
||||
});
|
||||
|
||||
it('窗口外记录被淘汰：回到基线 totalRequests=0（真实短窗口计时）', async () => {
|
||||
const m = new SLOMonitor({ target: 0.99, windowMs: 50, latencyPercentiles: [0.5], latencyThresholdMs: 10_000 });
|
||||
m.recordRequest(100, true);
|
||||
m.recordRequest(120, false);
|
||||
expect(m.getStatus().totalRequests).toBe(2);
|
||||
|
||||
// 越过 50ms 窗口后读取
|
||||
await new Promise((r) => setTimeout(r, 70));
|
||||
expect(m.getStatus().totalRequests).toBe(0);
|
||||
});
|
||||
});
|
||||
|
||||
// ===== HealthChecker =====
|
||||
|
||||
describe.skipIf(!dbAvailable)('HealthChecker — 三项健康检查', () => {
|
||||
// 注：真实库连通性由 database-migration.test.ts（PRAGMA user_version 套件）以
|
||||
// 完整 DatabaseService.initialize() 覆盖；此处仅保留纯依赖注入的确定性用例。
|
||||
|
||||
it('DB ping 失败 → database check 不健康、healthy=false', async () => {
|
||||
const broken = { prepare: () => { throw new Error('disk I/O error'); } } as unknown as import('better-sqlite3').Database;
|
||||
const hc = new HealthChecker(
|
||||
() => broken,
|
||||
':memory:',
|
||||
);
|
||||
const report = await hc.check();
|
||||
const dbCheck = report.checks.find((c) => c.name === 'database');
|
||||
expect(dbCheck?.healthy).toBe(false);
|
||||
expect(String(dbCheck?.error ?? '')).toContain('I/O');
|
||||
expect(report.healthy).toBe(false);
|
||||
});
|
||||
});
|
||||
@@ -256,6 +256,115 @@ describe.skipIf(!dbAvailable)('SessionSummary 分层上下文 × 截断交互',
|
||||
});
|
||||
});
|
||||
|
||||
/**
|
||||
* B-2 回归：clearMessages 必须同步删除滚动摘要
|
||||
*
|
||||
* 缺陷根因（v0.6.4 审计）：messages 使用隐式 rowid，非 AUTOINCREMENT 表全表
|
||||
* DELETE 后新消息的 rowid 从 1 重新分配。若清空消息时保留 session_summaries
|
||||
* 的 summarized_until_rowid 游标（如 =500），则：
|
||||
* (1) buildHistoryMessages 的 `rowid > 500` 过滤令所有新消息落空 →
|
||||
* 新对话永远不进入 LLM 历史（直到重新攒满 500 条）；
|
||||
* (2) maybeSummarize 的 `rowid > lastSummarized` 增量判定长期误报"无增量"。
|
||||
*/
|
||||
describe.skipIf(!dbAvailable)('clearMessages × 摘要游标交互（B-2）', () => {
|
||||
let db: any;
|
||||
let sessionService: any;
|
||||
let summaryService: any;
|
||||
|
||||
beforeAll(async () => {
|
||||
const { SessionService } = await import('../session.service');
|
||||
const { SessionSummaryService } = await import('../session-summary.service');
|
||||
db = new Database(':memory:');
|
||||
db.exec(`
|
||||
CREATE TABLE sessions (
|
||||
id TEXT PRIMARY KEY,
|
||||
title TEXT DEFAULT '新会话',
|
||||
created_at INTEGER NOT NULL,
|
||||
updated_at INTEGER NOT NULL,
|
||||
message_count INTEGER DEFAULT 0,
|
||||
pinned INTEGER DEFAULT 0,
|
||||
archived INTEGER DEFAULT 0,
|
||||
metadata TEXT DEFAULT '{}'
|
||||
);
|
||||
CREATE TABLE messages (
|
||||
id TEXT PRIMARY KEY,
|
||||
session_id TEXT NOT NULL,
|
||||
role TEXT NOT NULL,
|
||||
content TEXT,
|
||||
reasoning_content TEXT,
|
||||
tool_calls TEXT,
|
||||
tool_result TEXT,
|
||||
attachments TEXT,
|
||||
iteration INTEGER,
|
||||
created_at INTEGER NOT NULL
|
||||
);
|
||||
CREATE TABLE session_summaries (
|
||||
session_id TEXT PRIMARY KEY,
|
||||
summary TEXT NOT NULL,
|
||||
summarized_until_rowid INTEGER NOT NULL,
|
||||
updated_at INTEGER NOT NULL DEFAULT (unixepoch() * 1000)
|
||||
);
|
||||
`);
|
||||
db.prepare(
|
||||
'INSERT INTO sessions (id, created_at, updated_at, message_count) VALUES (?, ?, ?, ?)',
|
||||
).run('s_clear', Date.now(), Date.now(), 0);
|
||||
|
||||
sessionService = new SessionService(() => db);
|
||||
summaryService = new SessionSummaryService(
|
||||
() => db,
|
||||
sessionService,
|
||||
() => null as unknown as Parameters<typeof Object>[0],
|
||||
);
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
try {
|
||||
db?.close();
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
});
|
||||
|
||||
it('清空消息后摘要与游标一并清除；rowid 重分配后新对话正常进入历史', () => {
|
||||
const ins = (id: string, content: string): void => {
|
||||
db.prepare(
|
||||
`INSERT INTO messages (id, session_id, role, content, created_at) VALUES (?, ?, 'user', ?, ?)`,
|
||||
).run(id, 's_clear', content, Date.now());
|
||||
};
|
||||
|
||||
// 阶段一：5 条历史 + 摘要游标远超当前 rowid（模拟旧会话曾积累大量已摘要消息：
|
||||
// 用户在长会话里攒到 summarized_until_rowid=500 后执行"清空消息"）
|
||||
for (let i = 1; i <= 5; i++) ins(`old_m${i}`, `旧消息 ${i}`);
|
||||
const maxRowIdBefore = (
|
||||
db.prepare(`SELECT MAX(rowid) AS r FROM messages WHERE session_id='s_clear'`).get() as { r: number }
|
||||
).r;
|
||||
expect(maxRowIdBefore).toBe(5);
|
||||
summaryService.saveSummary('s_clear', '覆盖全部旧消息的摘要', 500);
|
||||
|
||||
// 复现缺陷前提（且暴露缺陷真实严重度）：rowid=6 < 游标 500，
|
||||
// 新消息全部被 `rowid > 500` 过滤落空；而摘要注入又要求"存在 tail"才生效
|
||||
// （buildHistoryMessages: existing && messages.length > 0）—— 结果历史恒为空：
|
||||
// 该会话从此刻起 LLM 完全失忆，直到新消息 rowid 涨过 500。
|
||||
ins('transition_m', '过渡期新消息');
|
||||
expect(summaryService.buildHistoryMessages('s_clear').length).toBe(0);
|
||||
|
||||
// 阶段二：用户点击"清空消息"
|
||||
expect(sessionService.clearMessages('s_clear')).toBe(true);
|
||||
expect(sessionService.getMessages('s_clear')).toHaveLength(0);
|
||||
|
||||
// 核心契约 1：摘要记录被同步删除（原实现此处残留 cursor=5）
|
||||
expect(summaryService.getSummary('s_clear')).toBeNull();
|
||||
|
||||
// 核心契约 2：全表 DELETE 后 rowid 从 1 重排（SQLite 非 AUTOINCREMENT 行为），
|
||||
// 若摘要未删，这些 rowid=1..n 的新消息将永远过不了 `rowid > 500` 过滤。
|
||||
for (let i = 1; i <= 2; i++) ins(`new_m${i}`, `新对话 ${i}`);
|
||||
const historyAfterClear = summaryService.buildHistoryMessages('s_clear');
|
||||
expect(historyAfterClear).toHaveLength(2);
|
||||
expect(historyAfterClear[0].content).toBe('新对话 1');
|
||||
expect(historyAfterClear[1].content).toBe('新对话 2');
|
||||
});
|
||||
});
|
||||
|
||||
/**
|
||||
* F-3 回归：session_summaries 级联删除
|
||||
*
|
||||
|
||||
@@ -0,0 +1,97 @@
|
||||
/**
|
||||
* UpdateService 测试（v0.6.4 P4-2）
|
||||
* 锁定：语义化版本比较表、feed 拉取/解析/状态映射、禁用态。
|
||||
*/
|
||||
|
||||
import { describe, it, expect, vi, afterEach } from 'vitest';
|
||||
|
||||
vi.mock('electron-log', () => ({
|
||||
default: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
|
||||
}));
|
||||
|
||||
import { UpdateService, isNewerVersion } from '../update.service';
|
||||
|
||||
describe('isNewerVersion 语义化比较', () => {
|
||||
it.each([
|
||||
['0.7.0', '0.6.4', true],
|
||||
['1.0.0', '0.9.9', true],
|
||||
['0.6.10', '0.6.9', true],
|
||||
['0.6.4', '0.6.4', false],
|
||||
['0.6.3', '0.6.4', false],
|
||||
['v0.7.0', '0.6.4', true], // 容忍 v 前缀
|
||||
['not-a-version', '0.6.4', false], // 非法输入宁可不提示
|
||||
['', '0.6.4', false],
|
||||
// 预发布：同号正式版 > 预发布；候选预发布不提示升级
|
||||
['0.6.5-beta', '0.6.4', true],
|
||||
['0.6.4-beta', '0.6.4', false],
|
||||
['0.6.4', '0.6.4-beta', true],
|
||||
])('%s vs %s → %s', (candidate, current, expected) => {
|
||||
expect(isNewerVersion(candidate, current)).toBe(expected);
|
||||
});
|
||||
});
|
||||
|
||||
describe('UpdateService.check 状态映射', () => {
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals();
|
||||
vi.restoreAllMocks();
|
||||
});
|
||||
|
||||
it('未配置 feed → disabled（不发起任何请求）', async () => {
|
||||
const fetchSpy = vi.fn();
|
||||
vi.stubGlobal('fetch', fetchSpy);
|
||||
const svc = new UpdateService(() => '0.6.4', () => null);
|
||||
const result = await svc.check();
|
||||
expect(result.status).toBe('disabled');
|
||||
expect(fetchSpy).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('feed 声明更新版本 → available 并透传下载直链与 notes', async () => {
|
||||
vi.stubGlobal(
|
||||
'fetch',
|
||||
vi.fn().mockResolvedValue(
|
||||
new Response(JSON.stringify({ version: '0.7.0', url: 'https://dl.example/setup.exe', notes: '- fix x' }), { status: 200 }),
|
||||
),
|
||||
);
|
||||
const svc = new UpdateService(() => '0.6.4', () => 'https://update.example/feed.json');
|
||||
const result = await svc.check();
|
||||
expect(result.status).toBe('available');
|
||||
if (result.status === 'available') {
|
||||
expect(result.latestVersion).toBe('0.7.0');
|
||||
expect(result.downloadUrl).toBe('https://dl.example/setup.exe');
|
||||
expect(result.notes).toBe('- fix x');
|
||||
}
|
||||
});
|
||||
|
||||
it('同版本 / 更旧 → up-to-date', async () => {
|
||||
vi.stubGlobal(
|
||||
'fetch',
|
||||
vi.fn().mockResolvedValue(new Response(JSON.stringify({ version: '0.6.3' }), { status: 200 })),
|
||||
);
|
||||
const svc = new UpdateService(() => '0.6.4', () => 'https://u.example/f.json');
|
||||
const result = await svc.check();
|
||||
expect(result.status).toBe('up-to-date');
|
||||
if (result.status === 'up-to-date') expect(result.latestVersion).toBe('0.6.3');
|
||||
});
|
||||
|
||||
it('HTTP 失败与非法 JSON → error', async () => {
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('oops', { status: 500 })));
|
||||
const svc = new UpdateService(() => '0.6.4', () => 'https://u.example/f.json');
|
||||
expect((await svc.check()).status).toBe('error');
|
||||
|
||||
vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('<html/>', { status: 200 })));
|
||||
expect((await svc.check()).status).toBe('error');
|
||||
});
|
||||
|
||||
it('下载 URL 非 http(s) 时被剔除（防协议劫持）', async () => {
|
||||
vi.stubGlobal(
|
||||
'fetch',
|
||||
vi.fn().mockResolvedValue(
|
||||
new Response(JSON.stringify({ version: '9.9.9', url: 'file:///C:/evil.exe' }), { status: 200 }),
|
||||
),
|
||||
);
|
||||
const svc = new UpdateService(() => '0.6.4', () => 'https://u.example/f.json');
|
||||
const result = await svc.check();
|
||||
expect(result.status).toBe('available');
|
||||
if (result.status === 'available') expect(result.downloadUrl).toBeUndefined();
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user