diff --git a/apps/web/lib/api/server.test.ts b/apps/web/lib/api/server.test.ts index 2fc3a0a..93706b7 100644 --- a/apps/web/lib/api/server.test.ts +++ b/apps/web/lib/api/server.test.ts @@ -66,3 +66,21 @@ describe("fetchDraft", () => { expect(await fetchDraft("p1", 9)).toBeNull(); }); }); + +// parseJsonBody 边界校验：防御被代理/网关污染的非对象或非 JSON 响应。 +describe("parseJsonBody structural validation", () => { + it("throws on a 200 body that is not a JSON object (primitive)", async () => { + mockFetch(200, "surprise-string"); + + await expect(fetchDraft("p1", 1)).rejects.toThrow("响应体形状异常"); + }); + + it("throws when the 200 body is not valid JSON", async () => { + vi.stubGlobal( + "fetch", + vi.fn(async () => new Response("not json", { status: 200 })), + ); + + await expect(fetchDraft("p1", 1)).rejects.toThrow("响应非 JSON"); + }); +});