feat(desktop): embed BoosAPI Desktop client as a subproject

Vendor the rebranded BoosAPI Desktop client (Tauri + Vue) into metapi as a monorepo subdirectory under desktop/. Source only — node_modules, dist, Cargo target and the upstream .git history are excluded. desktop/ keeps its own independent Cargo workspace (desktop/src-tauri with crates/*); it is not part of the backend boosapi crate, so a `cargo check` at the metapi root still compiles only the backend. Build the desktop app from desktop/src-tauri per desktop/README.md. Note: app icons are still placeholder assets pending the final BoosAPI logo. The updater signing keys live outside the repo and are not included.
2026-06-22 11:32:57 +08:00
parent d9c78ecc73
commit e0a5f57793
2305 changed files with 449355 additions and 0 deletions
@@ -0,0 +1,90 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import NodeRenderer from '../src/components/NodeRenderer'
+import { flushAll } from './setup/flush-all'
+
+describe('linkNode attrs passthrough', () => {
+  it('binds node.attrs onto the rendered anchor element', async () => {
+    const wrapper = mount(NodeRenderer, {
+      props: {
+        typewriter: false,
+        batchRendering: false,
+        nodes: [
+          {
+            type: 'paragraph',
+            raw: '',
+            children: [
+              {
+                type: 'link',
+                href: 'https://example.com',
+                title: null,
+                text: 'Example',
+                raw: '[Example](https://example.com)',
+                attrs: [
+                  ['target', '_self'],
+                  ['rel', 'nofollow'],
+                  ['data-track', 'cta'],
+                ],
+                children: [
+                  {
+                    type: 'text',
+                    content: 'Example',
+                    raw: 'Example',
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    })
+
+    await flushAll()
+    const a = wrapper.get('a.link-node')
+    expect(a.attributes('target')).toBe('_self')
+    expect(a.attributes('rel')).toBe('nofollow')
+    expect(a.attributes('data-track')).toBe('cta')
+  })
+
+  it('sanitizes dangerous node.attrs before binding', async () => {
+    const wrapper = mount(NodeRenderer, {
+      props: {
+        typewriter: false,
+        batchRendering: false,
+        nodes: [
+          {
+            type: 'paragraph',
+            raw: '',
+            children: [
+              {
+                type: 'link',
+                href: 'https://example.com',
+                title: null,
+                text: 'Example',
+                raw: '[Example](https://example.com)',
+                attrs: [
+                  ['onclick', 'alert(1)'],
+                  ['href', 'javascript:alert(1)'],
+                  ['data-safe', '1'],
+                ],
+                children: [
+                  {
+                    type: 'text',
+                    content: 'Example',
+                    raw: 'Example',
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+    })
+
+    await flushAll()
+    const a = wrapper.get('a.link-node')
+    expect(a.attributes('onclick')).toBeUndefined()
+    expect(a.attributes('href')).toBe('https://example.com')
+    expect(a.attributes('data-safe')).toBe('1')
+  })
+})