feat(audit): 收口领域写接口权限审计

apps/web/lib/api.test.ts

@@ -47,6 +47,44 @@ test('API requests use the resolved base path', async () => {
   }
 });
 
+test('API requests include current auth user headers when a session exists', async () => {
+  const originalFetch = globalThis.fetch;
+  const originalSessionStorage = Object.getOwnPropertyDescriptor(globalThis, 'sessionStorage');
+  const headers: HeadersInit[] = [];
+
+  Object.defineProperty(globalThis, 'sessionStorage', {
+    configurable: true,
+    value: {
+      getItem: (key: string) => key === 'ftb_auth_session'
+        ? JSON.stringify({ id: 'm-8', name: '超级管理员', username: 'admin', roleId: 'role-admin', email: 'admin@example.com' })
+        : null,
+    },
+  });
+
+  globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+    headers.push(init?.headers ?? {});
+    return new Response(JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }) as typeof fetch;
+
+  try {
+    __resetApiAvailabilityForTests();
+    await api.post('/products', { name: 'FTB' });
+    assert.equal((headers[1] as Record<string, string>)['x-ftb-user-id'], 'm-8');
+    assert.equal((headers[1] as Record<string, string>)['x-ftb-user-role-id'], 'role-admin');
+    assert.equal((headers[1] as Record<string, string>)['x-ftb-user-name'], encodeURIComponent('超级管理员'));
+  } finally {
+    globalThis.fetch = originalFetch;
+    if (originalSessionStorage) {
+      Object.defineProperty(globalThis, 'sessionStorage', originalSessionStorage);
+    } else {
+      delete (globalThis as any).sessionStorage;
+    }
+  }
+});
+
 test('API availability probe retries after a transient failure', async () => {
   const originalFetch = globalThis.fetch;
   const apiBase = resolveApiBase();