OSMOKE1 修复 OA-only smoke 账号治理

server/tests/unit/scripts/repair-oa-only-smoke-accounts.test.js

@@ -0,0 +1,88 @@
+const {
+  isSafeOaOnlySmokeTarget,
+  isSmokeLikeValue,
+  normalizeRoleList,
+  parseArgs,
+  planForTarget,
+} = require("../../../src/scripts/repair-oa-only-smoke-accounts");
+
+function target(overrides = {}) {
+  return {
+    key: overrides.key ?? "admin",
+    identifier: overrides.identifier ?? "[email protected]",
+    maskedIdentifier: "sm***@***.com",
+    roles: overrides.roles ?? ["admin", "employee"],
+  };
+}
+
+function row(overrides = {}) {
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    employeeNo: overrides.employeeNo ?? "T0001",
+    name: overrides.name ?? "OA试运行测试管理员",
+    email: overrides.email ?? "[email protected]",
+    phone: overrides.phone ?? "",
+    status: overrides.status ?? "archived",
+    employmentStatus: overrides.employmentStatus ?? "inactive",
+    archived: overrides.archived ?? true,
+    roles: overrides.roles ?? ["employee"],
+    loginFailedCount: overrides.loginFailedCount ?? 3,
+    hasLoginFailedFirstAt: overrides.hasLoginFailedFirstAt ?? true,
+    loginLocked: overrides.loginLocked ?? true,
+    activeAuthSessions: overrides.activeAuthSessions ?? 0,
+  };
+}
+
+describe("repair-oa-only-smoke-accounts", () => {
+  afterEach(() => {
+    delete process.env.OA_ONLY_SMOKE_REPAIR_APPLY;
+  });
+
+  it("recognizes only smoke-like identifiers as safe targets", () => {
+    expect(isSmokeLikeValue("[email protected]")).toBe(true);
+    expect(isSmokeLikeValue("SMOKE002")).toBe(true);
+    expect(isSmokeLikeValue("OA试运行测试管理员")).toBe(true);
+    expect(isSmokeLikeValue("[email protected]")).toBe(false);
+  });
+
+  it("blocks non-smoke employee matches before planning role repair", () => {
+    const plan = planForTarget(
+      target({ identifier: "[email protected]", roles: ["admin", "employee"] }),
+      row({
+        employeeNo: "HYD000100",
+        name: "真实员工",
+        email: "[email protected]",
+        status: "archived",
+        employmentStatus: "inactive",
+        archived: true,
+      }),
+    );
+
+    expect(isSafeOaOnlySmokeTarget(target({ identifier: "[email protected]" }), plan.before)).toBe(false);
+    expect(plan.status).toBe("BLOCKED");
+    expect(plan.reason).toBe("unsafe_non_smoke_target");
+    expect(plan.actions).toEqual([]);
+  });
+
+  it("plans only state, lock, and missing-role repairs for safe OA-only smoke rows", () => {
+    const plan = planForTarget(target(), row());
+
+    expect(plan.status).toBe("PLANNED");
+    expect(plan.actions).toEqual(["restore_active_employee", "clear_login_lock", "add_missing_roles"]);
+    expect(plan.missingRoles).toEqual(["admin"]);
+    expect(JSON.stringify(plan)).not.toContain("[email protected]");
+  });
+
+  it("normalizes roles and parses apply mode without enabling apply by itself", () => {
+    const options = parseArgs(["--apply", "--target=admin:[email protected]:admin+employee", "--format=json"]);
+
+    expect(options.mode).toBe("apply");
+    expect(options.targets[0]).toMatchObject({
+      key: "admin",
+      identifier: "[email protected]",
+      roles: ["admin", "employee"],
+    });
+    expect(normalizeRoleList(["admin", "admin", "invalid", "employee"])).toEqual(["admin", "employee"]);
+    expect(process.env.OA_ONLY_SMOKE_REPAIR_APPLY).toBeUndefined();
+  });
+});