xiaoxia-saas/apps/web/e2e/test_project.spec.ts

/**
 * 项目流程 E2E 测试
 *
 * 覆盖：创建项目、列出项目、获取项目详情
 * 每个测试独立，先注册登录获取 auth token。
 */
import { expect, test, type APIRequestContext } from "@playwright/test"

const PASSWORD = "Test123456!"
const apiBase = process.env.E2E_API_BASE || "/api/v1"

function uniqueEmail(prefix: string): string {
  return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 8)}@example.com`
}

function uniqueUsername(prefix: string): string {
  return `${prefix}_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`
}

/** 登录操作，遇到 429 限流自动等待重试 */
async function loginWithRetry(
  request: APIRequestContext,
  email: string,
  password: string,
  maxRetries = 2,
) {
  for (let i = 0; i <= maxRetries; i++) {
    const response = await request.post(`${apiBase}/auth/login`, {
      data: { email, password },
    })
    if (response.status() !== 429) return response
    console.log(`[login] 触发限流，等待 65s 后重试 (${i + 1}/${maxRetries})`)
    await new Promise((r) => setTimeout(r, 65000))
  }
  return request.post(`${apiBase}/auth/login`, {
    data: { email, password },
  })
}

/** 注册并登录，返回 { headers, email, username, userId } */
async function createAuthedUser(request: APIRequestContext, label: string) {
  const email = uniqueEmail(label)
  const username = uniqueUsername(label)

  const reg = await request.post(`${apiBase}/auth/register`, {
    data: { email, password: PASSWORD, username, display_name: `E2E ${label}` },
  })
  expect(reg.ok(), `注册应成功: ${await reg.text()}`).toBeTruthy()
  const regData = await reg.json()

  const login = await loginWithRetry(request, email, PASSWORD)
  expect(login.ok(), `登录应成功: ${await login.text()}`).toBeTruthy()
  const loginData = await login.json()

  return {
    headers: { Authorization: `Bearer ${loginData.access_token}` },
    email,
    username,
    userId: regData.user_id,
  }
}

test.describe("项目流程", () => {
  // 登录限流 10次/60s，测试可能触发限流等待，给足够超时
  test.describe.configure({ timeout: 180_000 })

  test("创建项目", async ({ request }) => {
    const { headers } = await createAuthedUser(request, "proj-create")
    const projectName = `E2E 测试项目 ${Date.now()}`

    const response = await request.post(`${apiBase}/projects`, {
      headers,
      data: {
        name: projectName,
        description: "Playwright E2E 回归测试创建",
      },
    })

    expect(
      response.ok(),
      `创建项目应返回 2xx，实际: ${response.status()} ${await response.text()}`,
    ).toBeTruthy()

    const data = await response.json()
    expect(data.id, "应返回项目 ID").toBeTruthy()
    expect(data.name).toBe(projectName)
    expect(data.owner_user_id, "应返回所有者 ID").toBeTruthy()
  })

  test("创建项目名称为空 - 反向", async ({ request }) => {
    const { headers } = await createAuthedUser(request, "proj-empty")

    const response = await request.post(`${apiBase}/projects`, {
      headers,
      data: { name: "", description: "Should fail" },
    })

    // name 有 min_length=1 约束，应返回 422
    expect([400, 422]).toContain(response.status())
  })

  test("列出项目", async ({ request }) => {
    const { headers } = await createAuthedUser(request, "proj-list")

    // 先创建 2 个项目
    await request.post(`${apiBase}/projects`, {
      headers,
      data: { name: `List Proj A ${Date.now()}` },
    })
    await request.post(`${apiBase}/projects`, {
      headers,
      data: { name: `List Proj B ${Date.now()}` },
    })

    // 列出
    const response = await request.get(`${apiBase}/projects`, { headers })

    expect(
      response.ok(),
      `列出项目应返回 2xx，实际: ${response.status()} ${await response.text()}`,
    ).toBeTruthy()

    const data = await response.json()
    const items = data.items || data.projects || data || []
    expect(Array.isArray(items)).toBeTruthy()
    expect(items.length, "应至少有 2 个项目").toBeGreaterThanOrEqual(2)
  })

  test("获取项目详情", async ({ request }) => {
    const { headers } = await createAuthedUser(request, "proj-detail")

    // 先创建
    const created = await request.post(`${apiBase}/projects`, {
      headers,
      data: { name: `Detail Proj ${Date.now()}`, description: "Detail test" },
    })
    expect(created.ok(), `创建应成功: ${await created.text()}`).toBeTruthy()
    const { id: projectId } = await created.json()

    // 获取详情
    const response = await request.get(`${apiBase}/projects/${projectId}`, {
      headers,
    })

    expect(
      response.ok(),
      `获取详情应返回 2xx，实际: ${response.status()} ${await response.text()}`,
    ).toBeTruthy()

    const data = await response.json()
    expect(data.id).toBe(projectId)
    expect(data.name).toBeTruthy()
    expect(data.owner_user_id).toBeTruthy()
  })

  test("获取不存在的项目 - 反向", async ({ request }) => {
    const { headers } = await createAuthedUser(request, "proj-404")

    const response = await request.get(`${apiBase}/projects/nonexistent-project-id-999`, {
      headers,
    })

    expect(response.status(), "不存在的项目应返回 404").toBe(404)
  })

  test("未登录列出项目 - 反向", async ({ request }) => {
    const response = await request.get(`${apiBase}/projects`)

    expect([401, 403]).toContain(response.status())
  })

  test("未授权访问他人项目 - 反向", async ({ request }) => {
    // 用户 A 创建项目
    const { headers: headersA } = await createAuthedUser(request, "proj-owner")
    const created = await request.post(`${apiBase}/projects`, {
      headers: headersA,
      data: { name: `Owner Proj ${Date.now()}`, description: "Owner test" },
    })
    expect(created.ok(), "用户 A 创建项目应成功").toBeTruthy()
    const { id: projectId } = await created.json()

    // 用户 B 尝试访问用户 A 的项目
    const { headers: headersB } = await createAuthedUser(request, "proj-intruder")
    const response = await request.get(`${apiBase}/projects/${projectId}`, {
      headers: headersB,
    })

    // 应返回 403 (Forbidden) 或 404 (Not Found) — 不应泄露资源存在性
    expect([403, 404]).toContain(response.status())
  })

  test("未授权删除他人项目 - 反向", async ({ request }) => {
    // 用户 A 创建项目
    const { headers: headersA } = await createAuthedUser(request, "proj-del-owner")
    const created = await request.post(`${apiBase}/projects`, {
      headers: headersA,
      data: { name: `Delete Test Proj ${Date.now()}` },
    })
    expect(created.ok(), "用户 A 创建项目应成功").toBeTruthy()
    const { id: projectId } = await created.json()

    // 用户 B 尝试删除用户 A 的项目
    const { headers: headersB } = await createAuthedUser(request, "proj-del-attempt")
    const response = await request.delete(`${apiBase}/projects/${projectId}`, {
      headers: headersB,
    })

    expect([403, 404]).toContain(response.status())
  })

  test("使用无效项目 ID 获取详情 - 反向", async ({ request }) => {
    const { headers } = await createAuthedUser(request, "proj-badid")

    const response = await request.get(`${apiBase}/projects/`, { headers })

    // 空 ID 或无效格式应返回 404 或 422
    expect([400, 404, 422]).toContain(response.status())
  })
})