feat: 增加演示身份下拉并保留令牌权限边界

scripts/test_chat_stream.cjs

@@ -62,6 +62,7 @@ function responder(chunks) {return async()=>new Response(new ReadableStream({sta
     assert.equal((await route.GET(request,{params:{path:['unknown']}})).status,404);
     process.env.NODE_ENV='production';
     assert.equal((await route.GET(request,{params:{path:['sessions']}})).status,401);
+    assert.equal((await route.GET({...request,headers:new Headers({Host:'cloud.example:3200','X-Xingbang-Demo-Role':'admin'})},{params:{path:['sessions']}})).status,401);
     for (const identity of [{id:'a',role:'admin'},{id:'r',role:'reviewer'},{id:'m',role:'manager'},{id:'p',role:'admin',preview:true},{}]) {
       let forwarded=false;
       global.fetch=async(url,opts)=>{
@@ -78,6 +79,12 @@ function responder(chunks) {return async()=>new Response(new ReadableStream({sta
       const secured=load('src/app/api/core/[...path]/route.ts',{'next/server':{NextResponse}});
       assert.equal((await secured.GET({...request,headers:new Headers({Authorization:'Bearer invalid'})},{params:{path:['sessions']}})).status,status===500?503:status);
     }
+    let riskHeaders;
+    global.fetch=async(_url,opts)=>{riskHeaders=opts.headers;return Response.json({role:'reviewer'});};
+    const riskRoute=load('src/app/api/risk-agent/[...path]/route.ts',{'next/server':{NextResponse}});
+    const riskResponse=await riskRoute.GET({...request,headers:new Headers({Host:'cloud.example:3200','X-Xingbang-Demo-Role':'reviewer'})},{params:{path:['access','context']}});
+    assert.equal(riskResponse.status,200);
+    assert.equal(riskHeaders['X-Xingbang-Demo-Role'],'reviewer');
     let forwardedHeaders;
     global.fetch=async(_url,opts)=>{forwardedHeaders=opts.headers;return Response.json({sessions:[]});};
     const {coreFetch}=load('src/lib/core-fetch.ts',{}, {window:{sessionStorage:{getItem:key=>key==='xingbang-access-token'?'existing-token':null}}});