feat: bind public vestibules to domain login gates

product-source/guanghu-knowledge-base/src/domain-entry-state.test.ts

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { canEnterSelectedDomainRuntime, createDomainEntryTarget, projectDomainRuntimeBoundary } from './domain-entry-state.js';
+
+const ready = (domainId: string) => ({ blockers: [], domainId, runtimeReady: true, stage: 'runtime-ready' as const });
+
+test('a generic login request does not silently target the Fifth Domain', () => {
+  assert.equal(canEnterSelectedDomainRuntime(null, ready('DOM-FIFTH-0001')), false);
+  assert.match(projectDomainRuntimeBoundary(null, ready('DOM-FIFTH-0001')), /先选择目标域/);
+});
+
+test('the selected stable domain id must match the returned access evidence', () => {
+  const fifth = createDomainEntryTarget('fifth', 'cloud-resident');
+  assert.equal(canEnterSelectedDomainRuntime(fifth, ready('DOMAIN-MAIN')), false);
+  assert.match(projectDomainRuntimeBoundary(fifth, ready('DOMAIN-MAIN')), /另一个域/);
+});
+
+test('enterprise vestibules cannot reuse the Fifth Domain renderer', () => {
+  const main = createDomainEntryTarget('main');
+  assert.equal(main.domain.stableDomainId, 'DOMAIN-MAIN');
+  assert.equal(main.nodeType, 'local-terminal');
+  assert.equal(canEnterSelectedDomainRuntime(main, ready('DOMAIN-MAIN')), false);
+  assert.match(projectDomainRuntimeBoundary(main, ready('DOMAIN-MAIN')), /独立运行端点与主题包尚未登记/);
+});
+
+test('the Fifth Domain opens only with matching runtime-ready evidence', () => {
+  const fifth = createDomainEntryTarget('fifth', 'cloud-resident');
+  assert.equal(canEnterSelectedDomainRuntime(fifth, ready('DOM-FIFTH-0001')), true);
+  assert.match(projectDomainRuntimeBoundary(fifth, ready('DOM-FIFTH-0001')), /已经匹配/);
+});