Run nested UI checks and align authentication assertions with public workspace routes

2026-10-30 18:13:58 +08:00
parent 33405b7d8b
commit cad84f8a67
3 changed files with 8 additions and 4 deletions
@@ -47,13 +47,15 @@ async function main() {
 if (command === 'verify' || command === 'exercise') {
  const request = (path:string,init:RequestInit={}) => fetch(base+path,{...init,redirect:'manual'});
  const buildId = readFileSync('.next/BUILD_ID','utf8').trim();
-  assert.equal((await request('/')).status,200,'Public knowledge homepage');
+  for(const path of ['/','/workspace','/documents','/account'])assert.equal((await request(path)).status,200,'Public shell '+path);
+  const studio=await request('/studio');assert.equal(studio.status,307);assert.equal(studio.headers.get('location'),'/workspace');
+  for(const [from,to] of [['/studio/graphic','/graphic'],['/studio/infinite_canvas','/infinite_canvas']]){const r=await request(from);assert.equal(r.status,308);assert.equal(r.headers.get('location'),to)}
  assert.equal((await request('/account')).status,200,'Public account page');
  const homeData = await request(`/_next/data/${buildId}/index.json`);
  assert.ok([200,404].includes(homeData.status),'Public homepage data is readable or absent for static pages');
  assert.ok(!isLoginRedirect(homeData.headers.get('location') || homeData.headers.get('x-nextjs-redirect'),base));
  assert.equal((await request('/api/posts',{method:'POST',headers:{Cookie:'wiki_account='+ 'a'.repeat(64)},body:'{}'})).status,401,'Account cookies never grant admin rights');
-  for (const path of ['/library/import','/skills/shadow-puppet/egret-example.png','/studio',`/_next/data/${buildId}/library/import.json`]) {
+  for (const path of ['/library/import','/skills/shadow-puppet/egret-example.png','/studio/layouts/ref-01',`/_next/data/${buildId}/library/import.json`]) {
   const response = await request(path); assert.equal(response.status,307,path); const destination = response.headers.get('location') || response.headers.get('x-nextjs-redirect'); assert.ok(isLoginRedirect(destination,base),path+' must redirect to login: '+destination);
  }
  for (const path of ['/api/feed','/api/upload','/studio/api/export/test','/api/media/missing']) assert.equal((await request(path)).status,401,path);