From 12ff0b56fba7e339ab334ae6af79e7b8d495b535 Mon Sep 17 00:00:00 2001
From: admin123 <wangshaoqing@intelligrow.cn>
Date: Wed, 22 Apr 2026 10:54:31 +0800
Subject: [PATCH] docs: add protected api mock verification steps

---
 README.md | 47 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index ce1a71a..2ff0b72 100644
--- a/README.md
+++ b/README.md
@@ -21,16 +21,53 @@ npm run build
 ## Current Scope
 
 - Adds two after-search-rate columns to the Xingtu market list
+- Adds a popup-based Logto auth entry
 - Hydrates the current page immediately
 - Provides plugin-owned filter, sort, and CSV export controls
+- Gates the market tools until auth is available
 - Triggers full-scan flow only when filter, sort, or export is used
 
+## Auth Configuration
+
+The Logto integration is wired with placeholder values in `src/shared/auth-config.ts`.
+Replace these before real sign-in testing:
+
+- `logtoEndpoint`
+- `appId`
+- `apiResource`
+- Any extra scopes beyond `openid`, `profile`, and `offline_access`
+
+The popup dev panel is controlled by `enableDevAuthPanel`.
+
+## Popup Behavior
+
+1. Load the unpacked extension from `dist/`
+2. Click the extension icon
+3. Confirm the popup shows `登录 Logto` when unauthenticated
+4. After real Logto config is added, use the popup to sign in and sign out
+
+## Protected API Mock Test
+
+1. Set `enableDevAuthPanel` to `true` in `src/shared/auth-config.ts`
+2. Run `npm run mock:protected-api`
+3. Run `npm run build`
+4. Reload the unpacked extension from `dist/`
+5. Open the popup and log in
+6. Click `测试受保护接口`
+7. Confirm the popup shows JSON containing `"source": "mock-protected-api"` and `"message": "authorized"`
+
+## Market Auth Gate
+
+When the market page is opened without a valid auth state, the content script renders
+`请先登录插件` and does not boot the filter, sort, or export toolbar.
+
 ## Manual Verification
 
 1. Load the unpacked extension from `dist/`
 2. Open `https://xingtu.cn/ad/creator/market`
-3. Confirm the two new columns appear
-4. Confirm current-page rows move through loading and then render values or failure states
-5. Apply a threshold filter and confirm the list hides unmatched rows
-6. Apply a sort and confirm row order changes
-7. Export CSV and confirm the file includes plugin status and after-search-rate fields
+3. Confirm the page shows the auth gate until login is available
+4. After authentication is wired, confirm the two new columns appear
+5. Confirm current-page rows move through loading and then render values or failure states
+6. Apply a threshold filter and confirm the list hides unmatched rows
+7. Apply a sort and confirm row order changes
+8. Export CSV and confirm the file includes plugin status and after-search-rate fields