lzf_0626
e6d74059f2
## 现象
打开 `employee-console/workspace`（平台治理），页面上出现**两份一模一样的顶部栏**：
南方财富 / 模拟基金服务 / 平台治理 / 风控中心 / admin_t 管理员 —— 连同页脚一起各两份。
## 根因：同一个入口 JS 被引了两次，且 `?v=` 不同
`app/static/portal/employee-console/workspace/index.html` 里曾同时存在：
<script type="module" src=".../workspace.js?v=20260913-3"></script>
<script type="module" src=".../workspace.js?v=20260914"></script>
浏览器按**完整 URL** 去重，两条不同 query 被当成**两个模块**、**各执行一次**。
入口里的 `mountShell()` 因此跑了两次，而它当时是
`document.body.insertAdjacentHTML('afterbegin', ...)` —— **无条件插入**，
于是 header 与 footer 各插两份。
来源是合并事故（`git blame` 定位）：
| 行 | 提交 | 作者 |
|---|---|---|
| 旧 | `e31420df` | 卿云秋月（把版本号改成 `20260913-3`）|
| 新 | `f5d1b246` | 张胜宇（把版本号改成 `20260914`）|
两人各自把**同一行**的版本号换成新的，合并时两边都被保留，成了两行。
那个提交的信息是 "merge ... and retain risk review updates" ——
"retain" 在这里保留错了地方。
## 修法（两侧都堵）
1. **HTML 收敛成一行**（保留较新的 `?v=20260914`，与 `workspace.js` 内部
`api-client.js?v=20260914` 一致），并就地写明"改版本号是替换这一行、不是新增一行"。
2. **`mountShell` 加幂等保护**：已有 `.site-header` 就直接 return。
之所以不满足于只修那个 HTML —— 这个 bug 的症状很难反推到原因
（页面看起来只是"多了一块"），而以后谁加缓存版本号时很容易再犯一次。
## 防回归（两条测试，都做过负面验证）
- `test_no_portal_page_includes_the_same_script_twice`：扫 `app/static/portal` 下
**19 个页面**，把 `<script src>` 去掉 query 后比对，同一入口出现多次即失败。
负面验证：把重复行临时放回去，测试**精确报出**
`employee-console\workspace\index.html: ['/static/portal/employee-console/workspace/workspace.js']`，
恢复后通过。
- `test_mount_shell_is_idempotent`：断言 `app-shell.js` 里有那句幂等判断。
全站扫描确认**只有这一处**，不是批量问题。
## 实测
- `GET /portal/employee-console/workspace/` -> 200，页面里 `workspace.js` **只出现一次**
（`?v=20260914`）；静态 HTML 中 `site-header` 出现 **0 次**（确认由 JS 注入，
所以 JS 执行一次就只插一份）
- `pytest tests/unit/api/test_portal_frontend.py` -> **43 passed**（41 + 新增 2 条）
- `ruff check` -> All checks passed
## 一点说明
这次是"改同一个版本号"的合并冲突处理失误，属于**流程问题**而非个人疏忽：
两边都想把缓存版本号推新，冲突解决时很容易两边都留下。
测试补上之后，这类错误会在 `pytest tests/unit` 里当场暴露。
400 lines
17 KiB
Python
400 lines
17 KiB
Python
from __future__ import annotations
|
|
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import httpx
|
|
import pytest
|
|
|
|
from app.main import create_app
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
PORTAL = ROOT / "app" / "static" / "portal"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_portal_root_redirects_to_public_home() -> None:
|
|
transport = httpx.ASGITransport(app=create_app())
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="http://test", follow_redirects=False
|
|
) as client:
|
|
response = await client.get("/")
|
|
assert response.status_code in {302, 307}
|
|
assert response.headers["location"] == "/portal/guest/home/"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
@pytest.mark.parametrize(
|
|
"path",
|
|
[
|
|
"/portal/guest/home/",
|
|
"/portal/guest/products/",
|
|
"/portal/guest/product-detail/?code=510300",
|
|
"/portal/customer/login/",
|
|
"/portal/customer/dashboard/",
|
|
"/portal/customer/holdings/",
|
|
"/portal/customer/profit-loss/",
|
|
"/portal/customer/orders/",
|
|
"/portal/customer/transactions/",
|
|
"/portal/customer/cash-ledger/",
|
|
"/portal/customer/risk-questionnaire/",
|
|
"/portal/employee-console/login/",
|
|
"/portal/employee-console/workspace/",
|
|
"/portal/employee-risk/dashboard/",
|
|
],
|
|
)
|
|
async def test_public_portal_pages_are_served(path: str) -> None:
|
|
transport = httpx.ASGITransport(app=create_app())
|
|
async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
|
|
response = await client.get(path)
|
|
assert response.status_code == 200
|
|
assert 'lang="zh-CN"' in response.text
|
|
assert '<meta charset="UTF-8">' in response.text
|
|
|
|
|
|
def test_every_portal_page_has_local_js_and_css_entry() -> None:
|
|
pages = list(PORTAL.glob("*/*/index.html"))
|
|
assert pages
|
|
for page in pages:
|
|
page_name = page.parent.name
|
|
assert (page.parent / f"{page_name}.js").is_file(), page
|
|
assert (page.parent / f"{page_name}.css").is_file(), page
|
|
|
|
|
|
def test_business_pages_do_not_call_fetch_directly() -> None:
|
|
direct_fetch_files = [
|
|
path.relative_to(PORTAL).as_posix()
|
|
for path in PORTAL.rglob("*.js")
|
|
if "fetch(" in path.read_text(encoding="utf-8")
|
|
]
|
|
assert direct_fetch_files == ["common/api-client.js"]
|
|
|
|
|
|
def test_api_client_registers_all_trading_endpoint_ids() -> None:
|
|
source = (PORTAL / "common" / "api-client.js").read_text(encoding="utf-8")
|
|
for endpoint_id in ("T001", "T002", "T003", "T004", "T005", "T006", "T007", "T008", "T009"):
|
|
assert f"{endpoint_id}:" in source
|
|
|
|
|
|
def test_product_detail_preserves_customer_session_for_trade_entry() -> None:
|
|
html = (PORTAL / "guest" / "product-detail" / "index.html").read_text(encoding="utf-8")
|
|
source = (PORTAL / "guest" / "product-detail" / "product-detail.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
dashboard = (PORTAL / "customer" / "dashboard" / "dashboard.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
assert 'data-trade-action' in html
|
|
assert "getAuthContext" in source
|
|
assert "textContent = '进入交易'" in source
|
|
assert "action=trade" in source
|
|
assert "productInput.value = productCode" in dashboard
|
|
|
|
|
|
def test_api_client_registers_onboarding_risk_and_admin_endpoints() -> None:
|
|
source = (PORTAL / "common" / "api-client.js").read_text(encoding="utf-8")
|
|
for endpoint_id in (
|
|
"ONB001", "ONB002", "RK001", "RK002", "RK003", "RK004", "RK005",
|
|
"RK006", "RK007", "RK008", "RK009", "RK010", "RK011", "RK012",
|
|
"RK013", "RK014", "RK015", "A002", "A003", "A004", "A005", "A006",
|
|
"A012", "A033", "A035", "A036", "A037", "A038", "A039", "A040",
|
|
):
|
|
assert f"{endpoint_id}:" in source
|
|
|
|
|
|
def test_advisor_workspace_registers_documented_operation_endpoints() -> None:
|
|
source = (PORTAL / "common" / "api-client.js").read_text(encoding="utf-8")
|
|
dashboard = (PORTAL / "employee-advisor" / "dashboard" / "index.html").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
for endpoint_id in (
|
|
"ADVISOR_PUBLISHED", "ADVISOR_GOAL", "ADVISOR_ANALYSIS",
|
|
"ADVISOR_ALLOCATION", "ADVISOR_RECOMMEND", "ADVISOR_CREATE_GOAL",
|
|
):
|
|
assert f"{endpoint_id}:" in source
|
|
for label in ("组合分析", "资产配置", "生成推荐草案", "录入客户目标"):
|
|
assert label in dashboard
|
|
|
|
|
|
def test_advisor_dashboard_is_composed_from_feature_modules() -> None:
|
|
source = (PORTAL / "employee-advisor" / "dashboard" / "dashboard.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
assert "./actions-module.js" in source
|
|
assert "./published-module.js" in source
|
|
config = (PORTAL / "employee-advisor" / "dashboard" / "advisor-config.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
assert "ACTION_LABELS" in config
|
|
|
|
|
|
def test_no_portal_page_includes_the_same_script_twice() -> None:
|
|
"""同一个入口 JS 被引两次（哪怕 `?v=` 不同）会让页面出现两份顶部导航。
|
|
|
|
浏览器按**完整 URL** 去重：`x.js?v=A` 与 `x.js?v=B` 是两个模块、**各执行一次**。
|
|
入口里的 `mountShell()` 于是跑两遍，插入两份 header / footer ——
|
|
2026-09-14 `employee-console/workspace/index.html` 就这么写过：合并时
|
|
两个分支各自把同一行的版本号换成新的，两边都被保留，成了一条重复的 `<script>`。
|
|
"""
|
|
pattern = re.compile(r"<script[^>]*\ssrc=[\"']([^\"']+)[\"']", re.IGNORECASE)
|
|
duplicated: list[str] = []
|
|
for page in sorted(PORTAL.rglob("*.html")):
|
|
# 只比 `<script>`；站内绝对路径去掉 query 再归并
|
|
sources = [
|
|
url.split("?", 1)[0] if url.startswith("/") else url
|
|
for url in pattern.findall(page.read_text(encoding="utf-8"))
|
|
]
|
|
repeated = sorted({src for src in sources if sources.count(src) > 1})
|
|
if repeated:
|
|
duplicated.append(f"{page.relative_to(PORTAL)}: {repeated}")
|
|
assert not duplicated, f"同一入口脚本被引入多次：{duplicated}"
|
|
|
|
|
|
def test_mount_shell_is_idempotent() -> None:
|
|
"""`mountShell` 要自带「已经挂过就不再挂」的保护。
|
|
|
|
上一条测试守住 HTML，这一条守住代码 —— 两侧都挡一道，
|
|
因为这个 bug 的症状很难反推原因（页面看起来只是"多了一块"），
|
|
而以后加缓存版本号时很容易再犯。
|
|
"""
|
|
source = (PORTAL / "common" / "layout" / "app-shell.js").read_text(encoding="utf-8")
|
|
assert "if (document.querySelector('.site-header')) return;" in source
|
|
|
|
|
|
def test_portal_feature_modules_have_consistent_imports() -> None:
|
|
"""拆分前端模块时最容易漏 import：定义搬走了，使用处却留在原文件。
|
|
|
|
这类问题**上面那些字符串断言全都看不见** —— 只会在浏览器里以
|
|
`ReferenceError: XXX is not defined` 爆出来，表现为"投顾工作台打开是白板"，
|
|
而 Python 测试一片绿。2026-09-13 合并进来的提交就真的发生了：
|
|
`dashboard.js` 还在用已经搬进 `advisor-config.js` 的 `CONTENT_TYPE_LABELS`。
|
|
|
|
检查逻辑在 `tools/check_portal_modules.py`（语法 + import 可解析 + 常量有来源），
|
|
这里只是把它接进测试，保证以后每次跑测试都会执行到。
|
|
"""
|
|
result = subprocess.run(
|
|
[sys.executable, str(ROOT / "tools" / "check_portal_modules.py")],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
assert result.returncode == 0, f"{result.stdout}\n{result.stderr}"
|
|
|
|
|
|
def test_risk_scan_endpoint_uses_extended_timeout() -> None:
|
|
source = (PORTAL / "common" / "api-client.js").read_text(encoding="utf-8")
|
|
assert (
|
|
"RK006: { method: 'POST', path: '/api/v1/risk/alerts/scan', "
|
|
"idempotent: true, timeout: 60000 }" in source
|
|
)
|
|
assert "options.timeout || endpoint.timeout || 8000" in source
|
|
|
|
|
|
def test_customer_questionnaire_uses_server_contract() -> None:
|
|
source = (PORTAL / "customer" / "risk-questionnaire" / "risk-questionnaire.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
assert "ONB001" in source
|
|
assert "ONB002" in source
|
|
assert "declaration_accepted: true" in source
|
|
assert "total_score" not in source
|
|
|
|
|
|
def test_questionnaire_is_customer_only_and_auth_context_matches_token() -> None:
|
|
auth = (PORTAL / "common" / "auth.js").read_text(encoding="utf-8")
|
|
login = (PORTAL / "common" / "login-controller.js").read_text(encoding="utf-8")
|
|
questionnaire = (
|
|
PORTAL / "customer" / "risk-questionnaire" / "risk-questionnaire.js"
|
|
).read_text(encoding="utf-8")
|
|
assert "export function requireCustomerOnly()" in auth
|
|
assert "IDENTITY_COOKIE = 'portal_auth_user'" in auth
|
|
assert "readCookie(IDENTITY_COOKIE) === String(context.userId)" in auth
|
|
assert "requireCustomerOnly()" in questionnaire
|
|
assert "? ['customer']" in login
|
|
|
|
|
|
def test_portal_auth_supports_cross_tab_logout_and_account_switching() -> None:
|
|
auth = (PORTAL / "common" / "auth.js").read_text(encoding="utf-8")
|
|
shell = (PORTAL / "common" / "layout" / "app-shell.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
login = (PORTAL / "common" / "login-controller.js").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
assert "new BroadcastChannel(AUTH_CHANNEL_NAME)" in auth
|
|
assert "CONTEXT_COOKIE = 'portal_auth_context'" in auth
|
|
assert "readSessionContext() || readSharedContext()" in auth
|
|
assert "signed-in" in auth
|
|
assert "signed-out" in auth
|
|
assert "account-switched" in auth
|
|
assert "postMessage({ type })" in auth
|
|
assert "type === 'signed-in'" in auth
|
|
assert "hasMatchingIdentity(readCookie('auth_token'), context)" in auth
|
|
broadcast_line = next(line for line in auth.splitlines() if "postMessage" in line)
|
|
assert "access_token" not in broadcast_line
|
|
assert "data-switch-account" in shell
|
|
assert "data-logout" in shell
|
|
assert "切换账号" in shell
|
|
assert "退出登录" in shell
|
|
assert "REASON_MESSAGES" in login
|
|
|
|
|
|
def test_risk_workspace_covers_documented_modules() -> None:
|
|
html = (PORTAL / "employee-risk" / "dashboard" / "index.html").read_text(encoding="utf-8")
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
permissions = (PORTAL / "common" / "permission-codes.js").read_text(encoding="utf-8")
|
|
for label in ("预警队列", "证据查询", "通知记录", "风控助手", "风险日报"):
|
|
assert label in html
|
|
combined = html + source + permissions
|
|
for permission in (
|
|
"risk:alert:read",
|
|
"risk:alert:write",
|
|
"risk:alert:scan",
|
|
"risk:report:mail",
|
|
):
|
|
assert permission in combined
|
|
|
|
|
|
def test_risk_workspace_has_context_sessions_system_tips_and_expandable_evidence() -> None:
|
|
html = (PORTAL / "employee-risk" / "dashboard" / "index.html").read_text(encoding="utf-8")
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
assert "data-chat-context" in html
|
|
assert "data-clear-chat-context" in html
|
|
assert "data-alert-prompts" in html
|
|
assert "data-system-tips" in html
|
|
assert "data-system-tip-count" in html
|
|
assert "data-open-notification-records" in html
|
|
assert "站内提醒" in html
|
|
assert "data-policy-tips" in html
|
|
assert "data-report-preview" in html
|
|
assert "chatContextKey" in source
|
|
assert "session_id: sessionId" in source
|
|
assert "session_id: crypto.randomUUID()" not in source
|
|
assert "bindExpandableRows" in source
|
|
assert "bindAlertContext" in source
|
|
assert "isStationNotification" in source
|
|
assert "fetchStationNotifications" in source
|
|
assert "refreshSystemTipCount" in source
|
|
assert "actionDialog.close();" in source
|
|
assert "alertDialog.close();" in source
|
|
assert "reportDialog.close();" in source
|
|
assert "5000" in source
|
|
assert "证据归档" in source
|
|
assert "大模型生成" in source
|
|
|
|
|
|
def test_risk_evidence_filters_remove_time_inputs_and_use_business_labels() -> None:
|
|
html = (PORTAL / "employee-risk" / "dashboard" / "index.html").read_text(encoding="utf-8")
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
assert 'name="start_time"' not in html
|
|
assert 'name="end_time"' not in html
|
|
assert "data-behavior-filter" in html
|
|
assert "FIELD_LABELS" in source
|
|
assert "技术字段" in source
|
|
assert "data-table__expandable-row" in source
|
|
assert "row.addEventListener('click'" in source
|
|
assert "row.addEventListener('keydown'" in source
|
|
|
|
|
|
def test_risk_evidence_snapshot_uses_business_labels_and_nested_sections() -> None:
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
css = (PORTAL / "employee-risk" / "dashboard" / "dashboard.css").read_text(encoding="utf-8")
|
|
assert "SNAPSHOT_FIELD_LABELS" in source
|
|
assert "renderEvidenceSnapshot" in source
|
|
assert "renderBusinessSection" in source
|
|
assert "businessRecordMarkup" in source
|
|
assert "关联工单" in source
|
|
assert "renderMergedEvidence" in source
|
|
assert "renderEvidenceArchive" in source
|
|
assert "查看原始数据" in source
|
|
assert "evidence-snapshot__nested" in css
|
|
assert "evidence-snapshot__grid" in css
|
|
assert "business-record__grid" in css
|
|
|
|
|
|
def test_risk_alert_action_is_first_column() -> None:
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
assert "actionFirst" in source
|
|
assert "actionFirst: true" in source
|
|
|
|
|
|
def test_risk_tables_show_page_and_total_summary() -> None:
|
|
html = (PORTAL / "employee-risk" / "dashboard" / "index.html").read_text(encoding="utf-8")
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
for summary_id in ("alert", "evidence", "notification"):
|
|
assert f"data-{summary_id}-summary" in html
|
|
assert "page_size" in source
|
|
assert "totalPages" in source
|
|
assert "共 ${total} 条" in source
|
|
|
|
|
|
def test_risk_alert_queue_uses_ten_rows_per_page() -> None:
|
|
source = (
|
|
PORTAL / "employee-risk" / "dashboard" / "dashboard.js"
|
|
).read_text(encoding="utf-8")
|
|
assert "limit: 10" in source
|
|
assert "meta.page_size ?? 10" in source
|
|
|
|
|
|
def test_risk_alert_prompts_hide_until_alert_context_is_bound() -> None:
|
|
html = (PORTAL / "employee-risk" / "dashboard" / "index.html").read_text(encoding="utf-8")
|
|
css = (PORTAL / "employee-risk" / "dashboard" / "dashboard.css").read_text(encoding="utf-8")
|
|
source = (PORTAL / "employee-risk" / "dashboard" / "dashboard.js").read_text(encoding="utf-8")
|
|
assert 'data-alert-prompts hidden' in html
|
|
assert ".risk-prompts[hidden]" in css
|
|
assert "display: none !important" in css
|
|
assert "document.querySelector('[data-alert-prompts]').hidden = !alertNo" in source
|
|
|
|
|
|
def test_admin_workspace_is_not_an_identity_placeholder() -> None:
|
|
html = (PORTAL / "employee-console" / "workspace" / "index.html").read_text(encoding="utf-8")
|
|
assert "只展示服务端确认的身份边界" not in html
|
|
for label in ("角色与权限", "配置与模型", "审计记录", "转人工工单", "画像候选"):
|
|
assert label in html
|
|
|
|
|
|
def test_admin_workspace_rule_submit_closes_before_next_function() -> None:
|
|
source = (
|
|
PORTAL / "employee-console" / "workspace" / "workspace.js"
|
|
).read_text(encoding="utf-8")
|
|
assert (
|
|
" } finally { submit.disabled = false; }\n"
|
|
" }\n\n"
|
|
" async function loadDriftReviews() {"
|
|
) in source
|
|
|
|
|
|
def test_frontend_has_no_remote_scripts_or_token_local_storage() -> None:
|
|
sources = "\n".join(
|
|
path.read_text(encoding="utf-8")
|
|
for path in PORTAL.rglob("*")
|
|
if path.is_file() and path.suffix in {".html", ".js", ".css"}
|
|
)
|
|
assert '<script src="http' not in sources
|
|
assert "localStorage.setItem('token'" not in sources
|
|
assert "console.log" not in sources
|
|
|
|
|
|
def test_shared_state_view_has_distinct_authentication_and_permission_states() -> None:
|
|
source = (PORTAL / "common" / "state-view.js").read_text(encoding="utf-8")
|
|
assert "ERR_CODES.AUTHENTICATION_REQUIRED" in source
|
|
assert "ERR_CODES.AGENT_PERMISSION_DENIED" in source
|
|
assert "登录状态已失效" in source
|
|
assert "当前账户暂不可访问" in source
|
|
|
|
|
|
def test_protected_api_unauthorized_response_clears_shared_session() -> None:
|
|
source = (PORTAL / "common" / "api-client.js").read_text(encoding="utf-8")
|
|
assert "clearAuthSession, getAccessToken" in source
|
|
assert "response.status === 401 && endpoint.auth !== false" in source
|
|
|
|
|
|
def test_public_home_uses_a_local_hero_image() -> None:
|
|
home = (PORTAL / "guest" / "home" / "index.html").read_text(encoding="utf-8")
|
|
image = PORTAL / "guest" / "home" / "assets" / "wealth_architecture_hero.jpg"
|
|
assert "/static/portal/guest/home/assets/wealth_architecture_hero.jpg" in home
|
|
assert image.is_file()
|
|
assert image.stat().st_size > 100_000
|