hermes-ui/tests/client/login-view.test.ts

// @vitest-environment jsdom
import { beforeEach, describe, expect, it, vi } from 'vitest'
import { mount } from '@vue/test-utils'

const mockReplace = vi.hoisted(() => vi.fn())
const mockFetchAuthStatus = vi.hoisted(() => vi.fn())
const mockLoginWithPassword = vi.hoisted(() => vi.fn())
const mockSetApiKey = vi.hoisted(() => vi.fn())
const mockClearApiKey = vi.hoisted(() => vi.fn())
const mockHasApiKey = vi.hoisted(() => vi.fn())

vi.mock('vue-router', () => ({
  useRouter: () => ({
    replace: mockReplace,
  }),
}))

vi.mock('vue-i18n', () => ({
  useI18n: () => ({
    t: (key: string) => key,
  }),
}))

vi.mock('@/api/client', () => ({
  setApiKey: mockSetApiKey,
  clearApiKey: mockClearApiKey,
  hasApiKey: mockHasApiKey,
}))

vi.mock('@/api/auth', () => ({
  fetchAuthStatus: mockFetchAuthStatus,
  loginWithPassword: mockLoginWithPassword,
}))

import LoginView from '@/views/LoginView.vue'
import { config } from '@vue/test-utils'

// Arco components are registered globally in main.ts; stub a-input as a
// real <input> so v-model setValue still works in tests.
config.global.stubs = {
  'a-input': {
    props: ['modelValue'],
    emits: ['update:modelValue'],
    methods: {
      // Real a-input exposes focus(); LoginView calls it on mount.
      focus() {},
    },
    template:
      '<input :value="modelValue" @input="$emit(\'update:modelValue\', $event.target.value)" />',
  },
  'a-button': {
    template: '<button type="button" v-bind="$attrs"><slot /></button>',
  },
}

describe('LoginView password login', () => {
  beforeEach(() => {
    delete (window as any).__LOGIN_TOKEN__
    vi.clearAllMocks()
    mockHasApiKey.mockReturnValue(false)
    mockFetchAuthStatus.mockResolvedValue({ hasPasswordLogin: true, username: 'admin' })
  })

  it('keeps the web login redirect when a token already exists', () => {
    mockHasApiKey.mockReturnValue(true)

    mount(LoginView)

    expect(mockClearApiKey).not.toHaveBeenCalled()
    expect(mockReplace).toHaveBeenCalledWith('/hermes/chat')
  })

  it('logs in with username and password', async () => {
    mockLoginWithPassword.mockResolvedValue('jwt-token')
    const wrapper = mount(LoginView)

    const inputs = wrapper.findAll('input.login-input')
    await inputs[0].setValue('admin')
    await inputs[1].setValue('123456')
    await wrapper.find('form.login-form').trigger('submit')

    expect(mockLoginWithPassword).toHaveBeenCalledWith('admin', '123456')
    expect(mockSetApiKey).toHaveBeenCalledWith('jwt-token')
    expect(mockReplace).toHaveBeenCalledWith('/hermes/chat')
  })

  it('does not expose the default credentials, but keeps the fill shortcut', async () => {
    const wrapper = mount(LoginView)

    // 默认账号密码不再直接印在页面上（生产环境不该展示登录凭据）。
    expect(wrapper.text()).not.toContain('login.defaultCredentialsHint')
    expect(wrapper.text()).not.toContain('admin')
    expect(wrapper.text()).not.toContain('123456')

    // 但保留一键填入入口，方便本地开发。
    const fill = wrapper.find('.login-copy')
    expect(fill.exists()).toBe(true)
    await fill.trigger('click')

    const inputs = wrapper.findAll('input.login-input')
    expect(inputs[0].element.value).toBe('admin')
    expect(inputs[1].element.value).toBe('123456')
  })

  it('shows an error when password login fails', async () => {
    mockLoginWithPassword.mockRejectedValue(new Error('Invalid username or password'))
    const wrapper = mount(LoginView)

    const inputs = wrapper.findAll('input.login-input')
    await inputs[0].setValue('admin')
    await inputs[1].setValue('bad-password')
    await wrapper.find('form.login-form').trigger('submit')

    expect(wrapper.find('.login-error').text()).toBe('Invalid username or password')
    expect(mockSetApiKey).not.toHaveBeenCalled()
    expect(mockReplace).not.toHaveBeenCalled()
  })

  it('shows the reset command hint when the login IP is locked', async () => {
    const err: any = new Error('Too many login attempts')
    err.status = 429
    mockLoginWithPassword.mockRejectedValue(err)
    const wrapper = mount(LoginView)

    const inputs = wrapper.findAll('input.login-input')
    await inputs[0].setValue('admin')
    await inputs[1].setValue('123456')
    await wrapper.find('form.login-form').trigger('submit')

    expect(wrapper.find('.login-error').text()).toBe('login.tooManyAttempts')
    expect(wrapper.find('.login-lock-hint').text()).toContain('login.lockResetHint')
    expect(wrapper.find('.login-lock-hint').text()).toContain('login.defaultLoginResetHint')
    const commands = wrapper.findAll('.login-lock-hint code').map(command => command.text())
    expect(commands).toEqual([
      'hermes-ui clear-login-locks --restart',
      'hermes-ui reset-default-login',
    ])
  })
})