From c3a67377c7c1bdab2bb4f223074a13c9dec89c3d Mon Sep 17 00:00:00 2001
From: CieanYau <ltd@crash.work>
Date: Sat, 7 Nov 2026 02:32:07 +0800
Subject: [PATCH] exercise nested mobile navigation through its API boundary

---
 tests/fixtures/api-server.mjs           | 2 ++
 tests/review-ui-foundation.e2e.test.mjs | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/tests/fixtures/api-server.mjs b/tests/fixtures/api-server.mjs
index 659690d..a02a59f 100644
--- a/tests/fixtures/api-server.mjs
+++ b/tests/fixtures/api-server.mjs
@@ -148,6 +148,8 @@ const server = createServer(async (request, response) => {
     if (options.hangLogout) return;
     return reply(response);
   }
+  if (path === "/security_group" && request.method === "GET")
+    return reply(response, { list: [], count: 0 });
   if (path === "/ssh_key" && request.method === "GET") {
     if (options.hangSshBody) {
       // 只发送响应头和不完整JSON，保持连接以复现“响应体解码永不结束”。
diff --git a/tests/review-ui-foundation.e2e.test.mjs b/tests/review-ui-foundation.e2e.test.mjs
index ca674fa..15c165d 100644
--- a/tests/review-ui-foundation.e2e.test.mjs
+++ b/tests/review-ui-foundation.e2e.test.mjs
@@ -68,6 +68,10 @@ test(
         "Closing navigation restores the opener",
       );
       await opener.click();
+      // 当前后台菜单把 SSH 放在独立入口；目标安全组位于尚未展开的安全分组。
+      await navigation(page)
+        .getByRole("button", { name: "安全", exact: true })
+        .click();
       await navigation(page)
         .getByRole("link", { name: "安全组", exact: true })
         .click();