feat(client): 实时授权状态与会话失效处理

- 心跳读取 /auth/ping 回带的授权概况,直接刷新横幅/状态栏/只读门禁,省去单独轮询 /license/info
- 账号被停用/删除(401 USER_DISABLED)即强制重新登录
- 令牌持久化经串行队列 + 会话代号守卫,杜绝续期写入与登出交叉把失效 token 写回
- 写操作门禁(write_guard)+ 授权文案(license_copy)按 grace/readonly/locked 分阶段降级

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
wangjia
2026-06-19 07:34:07 +08:00
parent e41085a878
commit 32bd64d676
23 changed files with 1319 additions and 408 deletions
+83
View File
@@ -0,0 +1,83 @@
import 'package:dio/dio.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:http_mock_adapter/http_mock_adapter.dart';
import 'package:jiu_client/core/api/api_client.dart';
void main() {
TestWidgetsFlutterBinding.ensureInitialized();
group('ApiClient 403 拦截 → onForbidden 回调', () {
test('写请求收到 403 时,onForbidden 收到响应体(code=READONLY_USER', () async {
dynamic captured;
final client = ApiClient(
token: 'test-token',
onForbidden: (body) => captured = body,
);
final adapter = DioAdapter(
dio: client.dioForTest,
matcher: const FullHttpRequestMatcher(),
);
adapter.onPost(
'/products',
(server) => server.reply(403, {'error': 'readonly user', 'code': 'READONLY_USER'}),
data: {'name': '测试'},
);
await expectLater(
client.post('/products', data: {'name': '测试'}),
throwsA(isA<DioException>()),
);
expect(captured, isA<Map>());
expect(captured['code'], 'READONLY_USER');
});
test('授权过期 403phase=readonly)时,onForbidden 收到 phase 字段', () async {
dynamic captured;
final client = ApiClient(
token: 'test-token',
onForbidden: (body) => captured = body,
);
final adapter = DioAdapter(
dio: client.dioForTest,
matcher: const FullHttpRequestMatcher(),
);
adapter.onPost(
'/stock-in',
(server) => server.reply(403, {'error': 'license expired', 'phase': 'readonly'}),
data: {'x': 1},
);
await expectLater(
client.post('/stock-in', data: {'x': 1}),
throwsA(isA<DioException>()),
);
expect(captured, isA<Map>());
expect(captured['phase'], 'readonly');
});
test('非 403 错误不触发 onForbidden', () async {
var called = false;
final client = ApiClient(
token: 'test-token',
onForbidden: (_) => called = true,
);
final adapter = DioAdapter(
dio: client.dioForTest,
matcher: const FullHttpRequestMatcher(),
);
adapter.onGet(
'/products',
(server) => server.reply(404, {'error': 'not found'}),
);
await expectLater(
client.get('/products'),
throwsA(isA<DioException>()),
);
expect(called, isFalse);
});
});
}
+74
View File
@@ -0,0 +1,74 @@
import 'package:flutter_test/flutter_test.dart';
import 'package:jiu_client/core/config/license_copy.dart';
import 'package:jiu_client/models/license.dart';
LicenseInfo _lic(String phase, {int expiredDays = 0, bool permanent = false}) =>
LicenseInfo(
id: 1,
type: 'annual',
isActive: true,
maxDevices: 3,
phase: phase,
expiresAt:
permanent ? null : DateTime.now().subtract(Duration(days: expiredDays)),
);
void main() {
group('writeBlockedToast', () {
test('readonly 阶段文案含过期天数并引导续费', () {
final s = LicenseCopy.writeBlockedToast(_lic('readonly', expiredDays: 10));
expect(s, contains('10'));
expect(s, contains('只读'));
expect(s, contains('设置 → 授权'));
});
test('locked 阶段文案标注已锁定', () {
final s = LicenseCopy.writeBlockedToast(_lic('locked', expiredDays: 20));
expect(s, contains('20'));
expect(s, contains('锁定'));
});
});
group('banner', () {
test('normal 阶段返回空串', () {
expect(LicenseCopy.banner(_lic('normal', permanent: true)), isEmpty);
});
test('grace/readonly/locked 各阶段含过期天数', () {
expect(LicenseCopy.banner(_lic('grace', expiredDays: 2)), contains('2'));
expect(
LicenseCopy.banner(_lic('readonly', expiredDays: 9)), contains('只读'));
expect(
LicenseCopy.banner(_lic('locked', expiredDays: 30)), contains('锁定'));
});
});
group('statusText / statusBar', () {
test('normal 永久授权', () {
final lic = _lic('normal', permanent: true);
expect(LicenseCopy.statusText(lic), contains('永久'));
expect(LicenseCopy.statusBar(lic, '2099-01-01'), contains('永久'));
});
test('readonly 阶段标注只读', () {
final lic = _lic('readonly', expiredDays: 9);
expect(LicenseCopy.statusText(lic), contains('只读'));
expect(LicenseCopy.statusBar(lic, '2024-01-01'), contains('只读'));
});
});
group('degradationNotes', () {
test('三条说明随阈值联动(含 7 与 15', () {
final notes = LicenseCopy.degradationNotes();
expect(notes.length, 3);
expect(notes.join(), contains('${LicenseCopy.graceDays}'));
expect(notes.join(), contains('${LicenseCopy.readonlyDays}'));
});
});
group('readonlyUserToast', () {
test('只读账号提示固定文案', () {
expect(LicenseCopy.readonlyUserToast, contains('只读'));
});
});
}
+17
View File
@@ -4,10 +4,25 @@ import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:jiu_client/core/models/page_result.dart';
import 'package:jiu_client/models/license.dart';
import 'package:jiu_client/models/partner.dart';
import 'package:jiu_client/providers/license_provider.dart';
import 'package:jiu_client/providers/partner_provider.dart';
import 'package:jiu_client/screens/partners/partners_screen.dart';
/// WriteGuard 内层会 watch licenseProvider;测试里覆写成同步返回 normal 授权,
/// 避免触发真实网络请求(否则留下 pending timer 导致测试失败)。
class _FakeLicenseNotifier extends LicenseNotifier {
@override
Future<LicenseInfo?> build() async => const LicenseInfo(
id: 1,
type: 'annual',
isActive: true,
maxDevices: 3,
phase: 'normal',
);
}
// ---------------------------------------------------------------------------
// Fake notifier
// ---------------------------------------------------------------------------
@@ -80,6 +95,7 @@ Widget _buildApp({
}) {
return ProviderScope(
overrides: [
licenseProvider.overrideWith(() => _FakeLicenseNotifier()),
supplierListProvider.overrideWith(
() => _FakePartnerNotifier('supplier', supplierState),
),
@@ -94,6 +110,7 @@ Widget _buildApp({
Widget _buildLoadingApp() {
return ProviderScope(
overrides: [
licenseProvider.overrideWith(() => _FakeLicenseNotifier()),
supplierListProvider.overrideWith(
() => _FakeLoadingPartnerNotifier('supplier'),
),
+126 -39
View File
@@ -1,69 +1,156 @@
import 'package:dio/dio.dart';
import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:jiu_client/core/exceptions.dart';
import 'package:http_mock_adapter/http_mock_adapter.dart';
import 'package:shared_preferences/shared_preferences.dart';
import 'package:jiu_client/core/api/api_client.dart';
import 'package:jiu_client/core/auth/auth_state.dart';
import 'package:jiu_client/core/config/license_copy.dart';
import 'package:jiu_client/core/models/page_result.dart';
import 'package:jiu_client/models/product.dart';
import 'package:jiu_client/providers/product_provider.dart';
import 'package:jiu_client/screens/products/products_screen.dart';
import 'package:jiu_client/models/license.dart';
import 'package:jiu_client/models/partner.dart';
import 'package:jiu_client/providers/license_provider.dart';
import 'package:jiu_client/providers/partner_provider.dart';
import 'package:jiu_client/screens/partners/partners_screen.dart';
// 只读角色:写按钮(新建/编辑/删除)应被 WriteGuard 隐藏。
// 替换原先因 ProductsScreen 重构而 skip 的旧用例,改测稳定的 PartnersScreen。
class _FakePartnerNotifier extends PartnerListNotifier {
final AsyncValue<PageResult<Partner>> _fixed;
_FakePartnerNotifier(String type, this._fixed) : super(type: type);
class _ReadonlyProductNotifier extends ProductListNotifier {
@override
Future<PageResult<Product>> build() async {
return const PageResult(data: [], total: 0, page: 1, pageSize: 20);
Future<PageResult<Partner>> build() async {
state = _fixed;
return state.value ??
const PageResult(data: [], total: 0, page: 1, pageSize: 20);
}
@override
void reload() {}
@override
void setKeyword(String keyword) {}
@override
void setPage(int page) {}
@override
Future<void> createProduct(Map<String, dynamic> data) async {
throw const AppException('readonly user', statusCode: 403);
}
Future<void> createPartner(Map<String, dynamic> data) async {}
@override
Future<void> updateProduct(int id, Map<String, dynamic> data) async {}
Future<void> updatePartner(int id, Map<String, dynamic> data) async {}
@override
Future<void> deleteProduct(int id) async {}
Future<void> deletePartner(int id) async {}
}
class _FakeLicenseNotifier extends LicenseNotifier {
@override
Future<LicenseInfo?> build() async => const LicenseInfo(
id: 1,
type: 'annual',
isActive: true,
maxDevices: 3,
phase: 'normal',
);
}
const _suppliers = PageResult<Partner>(
data: [Partner(id: 1, code: 'S001', name: '茅台供应商', type: 'supplier')],
total: 1,
page: 1,
pageSize: 20,
);
Widget _buildApp({required bool readonly}) {
return ProviderScope(
overrides: [
isReadonlyProvider.overrideWithValue(readonly),
licenseProvider.overrideWith(() => _FakeLicenseNotifier()),
supplierListProvider.overrideWith(
() => _FakePartnerNotifier('supplier', const AsyncValue.data(_suppliers)),
),
customerListProvider.overrideWith(
() => _FakePartnerNotifier(
'customer',
const AsyncValue.data(
PageResult(data: [], total: 0, page: 1, pageSize: 20)),
),
),
],
child: const MaterialApp(home: Scaffold(body: PartnersScreen())),
);
}
void main() {
// TODO: 新建按钮位置已变更,测试待更新
testWidgets('write operation shows forbidden error for readonly user',
skip: true, (tester) async {
TestWidgetsFlutterBinding.ensureInitialized();
// 仅隐藏按钮不够:只读账号若绕过 UI(或后端授权过期)直接提交写操作,
// 必须验证 403 真的被 apiClientProvider 的 onForbidden 捕获并浮出只读提示。
test('只读账号提交写操作:后端 403(READONLY_USER) 经 apiClientProvider 浮出只读提示',
() async {
SharedPreferences.setMockInitialValues({});
final container = ProviderContainer();
addTearDown(container.dispose);
// 登录一个只读账号,使 apiClientProvider 携带 token 并构建真实客户端。
await container.read(authStateProvider.notifier).login(const AuthUser(
accessToken: 'ro-token',
refreshToken: 'ro-refresh',
username: 'viewer',
realName: '只读用户',
shopNo: 'S001',
shopId: 1,
role: 'readonly',
));
final client = container.read(apiClientProvider);
final adapter = DioAdapter(
dio: client.dioForTest,
matcher: const FullHttpRequestMatcher(),
);
adapter.onPost(
'/partners',
(server) =>
server.reply(403, {'error': 'readonly user', 'code': 'READONLY_USER'}),
data: {'name': '新供应商'},
);
// 写请求被后端拒绝。
await expectLater(
client.post('/partners', data: {'name': '新供应商'}),
throwsA(isA<DioException>()),
);
// provider 的 onForbidden 把只读提示浮到全局消息通道(用户可见的「403 浮出」)。
expect(container.read(apiMessageProvider), LicenseCopy.readonlyUserToast);
});
testWidgets('只读角色:新建/编辑/删除按钮全部隐藏', (tester) async {
tester.view.physicalSize = const Size(1280, 800);
tester.view.devicePixelRatio = 1.0;
addTearDown(tester.view.resetPhysicalSize);
await tester.pumpWidget(
ProviderScope(
overrides: [
productListProvider.overrideWith(() => _ReadonlyProductNotifier()),
],
child: const MaterialApp(
home: Scaffold(body: ProductsScreen()),
),
),
);
await tester.pumpWidget(_buildApp(readonly: true));
await tester.pumpAndSettle();
await tester.tap(find.text('新建'));
// 供应商已渲染,证明列表确实加载。
expect(find.text('茅台供应商'), findsOneWidget);
// 写按钮被 WriteGuard 隐藏。
expect(find.text('新建'), findsNothing);
expect(find.byKey(const Key('btn_edit_1')), findsNothing);
expect(find.byKey(const Key('btn_delete_1')), findsNothing);
});
testWidgets('普通角色(normal 授权):写按钮可见', (tester) async {
tester.view.physicalSize = const Size(1280, 800);
tester.view.devicePixelRatio = 1.0;
addTearDown(tester.view.resetPhysicalSize);
await tester.pumpWidget(_buildApp(readonly: false));
await tester.pumpAndSettle();
await tester.enterText(find.byType(TextFormField).at(0), '测试商品');
await tester.enterText(find.byType(TextFormField).at(1), 'P999');
await tester.tap(find.text('保存'));
await tester.pump();
await tester.pumpAndSettle();
expect(find.textContaining('保存失败:readonly user'), findsOneWidget);
expect(find.text('茅台供应商'), findsOneWidget);
expect(find.text('新建'), findsWidgets);
expect(find.byKey(const Key('btn_edit_1')), findsOneWidget);
expect(find.byKey(const Key('btn_delete_1')), findsOneWidget);
});
}
+16
View File
@@ -5,10 +5,24 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:go_router/go_router.dart';
import 'package:jiu_client/core/models/page_result.dart';
import 'package:jiu_client/models/license.dart';
import 'package:jiu_client/models/stock_in.dart';
import 'package:jiu_client/providers/license_provider.dart';
import 'package:jiu_client/providers/stock_in_provider.dart';
import 'package:jiu_client/screens/stock_in/stock_in_list_screen.dart';
/// WriteGuard 内层会 watch licenseProvider;覆写成同步 normal 授权,避免真实网络请求。
class _FakeLicenseNotifier extends LicenseNotifier {
@override
Future<LicenseInfo?> build() async => const LicenseInfo(
id: 1,
type: 'annual',
isActive: true,
maxDevices: 3,
phase: 'normal',
);
}
// ---------------------------------------------------------------------------
// Fake notifier
// ---------------------------------------------------------------------------
@@ -102,6 +116,7 @@ Widget _buildApp(AsyncValue<PageResult<StockInOrder>> state) {
return ProviderScope(
overrides: [
licenseProvider.overrideWith(() => _FakeLicenseNotifier()),
stockInListProvider.overrideWith(() => _FakeStockInNotifier(state)),
],
child: MaterialApp.router(routerConfig: router),
@@ -125,6 +140,7 @@ Widget _buildLoadingApp() {
return ProviderScope(
overrides: [
licenseProvider.overrideWith(() => _FakeLicenseNotifier()),
stockInListProvider.overrideWith(() => _FakeLoadingStockInNotifier()),
],
child: MaterialApp.router(routerConfig: router),
+132
View File
@@ -0,0 +1,132 @@
import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:flutter_test/flutter_test.dart';
import 'package:jiu_client/core/auth/auth_state.dart';
import 'package:jiu_client/core/config/license_copy.dart';
import 'package:jiu_client/models/license.dart';
import 'package:jiu_client/providers/license_provider.dart';
import 'package:jiu_client/widgets/write_guard.dart';
/// 用固定 LicenseInfo(含指定 phase)填充 licenseProvider 的 Fake Notifier。
class _FakeLicenseNotifier extends LicenseNotifier {
final LicenseInfo? _value;
_FakeLicenseNotifier(this._value);
@override
Future<LicenseInfo?> build() async => _value;
}
LicenseInfo _lic(String phase, {int expiredDays = 0}) => LicenseInfo(
id: 1,
type: 'annual',
isActive: true,
maxDevices: 3,
phase: phase,
expiresAt: DateTime.now().subtract(Duration(days: expiredDays)),
);
/// 把一个带 onPressed 的按钮包进 WriteGuard,按 role + license phase 覆写 provider。
Widget _harness({
required bool readonly,
LicenseInfo? lic,
required VoidCallback onPressed,
}) {
return ProviderScope(
overrides: [
isReadonlyProvider.overrideWithValue(readonly),
licenseProvider.overrideWith(() => _FakeLicenseNotifier(lic)),
],
child: MaterialApp(
home: Scaffold(
body: WriteGuard(
child: ElevatedButton(
onPressed: onPressed,
child: const Text('新建'),
),
),
),
),
);
}
void main() {
testWidgets('只读角色:按钮隐藏(findsNothing', (tester) async {
var tapped = false;
await tester.pumpWidget(
_harness(readonly: true, lic: _lic('normal'), onPressed: () => tapped = true),
);
await tester.pumpAndSettle();
expect(find.text('新建'), findsNothing);
expect(tapped, isFalse);
});
testWidgets('operator + normal:按钮可见且可点', (tester) async {
var tapped = false;
await tester.pumpWidget(
_harness(readonly: false, lic: _lic('normal'), onPressed: () => tapped = true),
);
await tester.pumpAndSettle();
expect(find.text('新建'), findsOneWidget);
await tester.tap(find.text('新建'));
await tester.pump();
expect(tapped, isTrue);
});
testWidgets('operator + grace(宽限期):按钮可见且可点', (tester) async {
var tapped = false;
await tester.pumpWidget(
_harness(
readonly: false,
lic: _lic('grace', expiredDays: 3),
onPressed: () => tapped = true,
),
);
await tester.pumpAndSettle();
expect(find.text('新建'), findsOneWidget);
await tester.tap(find.text('新建'));
await tester.pump();
expect(tapped, isTrue);
});
testWidgets('operator + readonly(过期>7天):按钮可见但禁用,点击弹提示且不触发 onPressed',
(tester) async {
var tapped = false;
final lic = _lic('readonly', expiredDays: 10);
await tester.pumpWidget(
_harness(readonly: false, lic: lic, onPressed: () => tapped = true),
);
await tester.pumpAndSettle();
// 按钮仍渲染(不隐藏),但被 IgnorePointer + Opacity 包裹禁用。
expect(find.text('新建'), findsOneWidget);
expect(find.byType(IgnorePointer), findsWidgets);
expect(find.byType(Opacity), findsWidgets);
// 点击覆盖层弹出原因提示,且 onPressed 未被调用。
// 覆盖层(GestureDetector)盖在按钮上,命中的是覆盖层而非按钮文字,故 warnIfMissed:false。
await tester.tap(find.text('新建'), warnIfMissed: false);
await tester.pumpAndSettle();
expect(tapped, isFalse);
expect(find.text(LicenseCopy.writeBlockedToast(lic)), findsOneWidget);
});
testWidgets('operator + locked(过期>15天):按钮可见但禁用,弹锁定提示', (tester) async {
var tapped = false;
final lic = _lic('locked', expiredDays: 20);
await tester.pumpWidget(
_harness(readonly: false, lic: lic, onPressed: () => tapped = true),
);
await tester.pumpAndSettle();
expect(find.text('新建'), findsOneWidget);
await tester.tap(find.text('新建'), warnIfMissed: false);
await tester.pumpAndSettle();
expect(tapped, isFalse);
expect(find.text(LicenseCopy.writeBlockedToast(lic)), findsOneWidget);
});
}