@deepstorm/cli 0.1.0

package/dist/skills/reef-style-backend/fragments/java/security-redlines/quick-reference.md

@@ -0,0 +1,197 @@
+# 安全红线
+
+## 🔴 红线速查
+
+| 红线 | 禁止行为 | 正确做法 | 违反后果 |
+|------|---------|---------|---------|
+| 密码存储 | 明文存储密码 | `BCryptPasswordEncoder`（Spring Security） | P0 — 安全漏洞 |
+| SQL 拼接 | 字符串拼接 SQL | JPA `@Query` + 命名参数，或 QueryDSL/JPA Criteria | P0 — SQL 注入 |
+| 危险初始化 | `@PostConstruct` 中触发写操作 | 延迟到首次调用或独立 `@EventListener(ApplicationReadyEvent.class)` | P1 — 非预期行为 |
+| 硬编码密钥 | 代码中硬编码 API Key / Secret | 环境变量或 `application-{profile}.yml`（.env 不提交） | P0 — 凭据泄露 |
+| 敏感信息打印 | `System.out.println` 敏感数据 | 用 SLF4J，生产日志级别过滤敏感字段 | P1 — 信息泄露 |
+| 文件上传验证 | 无限制的文件上传 | 限制类型 + 大小 + 重命名 + 非 webroot 存储 | P1 — 任意文件上传 |
+| 不安全的反序列化 | 信任外部反序列化数据 | 验证输入类型 + 数字签名 + 白名单 | P1 — 远程代码执行 |
+
+## 🔴 红线详情
+
+### 1. 密码存储 — 禁止明文 （P0）
+
+```java
+// ❌ 坏：明文存储
+user.setPassword(plainPassword);
+
+// ✅ 好：使用 BCryptPasswordEncoder
+@Service
+public class UserService {
+    private final PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
+
+    public User createUser(CreateUserRequest request) {
+        User user = new User();
+        user.setPassword(passwordEncoder.encode(request.password()));
+        return userRepository.save(user);
+    }
+}
+
+// ✅ 验证密码
+boolean matches = passwordEncoder.matches(rawPassword, user.getPassword());
+```
+
+### 2. SQL 拼接 — 禁止字符串拼接 （P0）
+
+```java
+// ❌ 坏：字符串拼接 — SQL 注入
+@Query("SELECT u FROM User u WHERE u.name = '" + name + "'")
+List<User> findByName(String name);
+
+// ✅ 好：命名参数
+@Query("SELECT u FROM User u WHERE u.name = :name")
+List<User> findByName(@Param("name") String name);
+
+// ✅ 好：Spring Data 派生查询（简单场景）
+List<User> findByName(String name);
+
+// ❌ 坏：原生 SQL 拼接
+@Query(value = "SELECT * FROM users WHERE name = '" + name + "'", nativeQuery = true)
+List<User> findByRawSQL(String name);
+
+// ✅ 好：原生 SQL + 命名参数
+@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)
+List<User> findByRawSQL(@Param("name") String name);
+```
+
+**红线规则：**
+- Repository 中禁止使用 `+ name +` 拼接查询条件
+- 禁止 `createNativeQuery`（也绕过多租户过滤）
+- `@Query` 必须使用命名参数 `:paramName`，禁止使用 `?1` 位置参数
+- Service 层禁止 `entityManager.createQuery(sqlString)` 传参拼接字符串
+
+### 3. 危险初始化 — 禁止 @PostConstruct 触发写操作 （P1）
+
+```java
+// ❌ 坏：@PostConstruct 中操作数据库
+@Component
+public class DataInitializer {
+    @PostConstruct  // ← 启动时必然执行，测试和回滚场景无法控制
+    public void init() {
+        userRepository.save(new User("admin", "admin"));
+    }
+}
+
+// ✅ 好：按需初始化或 EventListener（可控制执行时机）
+@Component
+public class DataInitializer {
+    @EventListener(ApplicationReadyEvent.class)  // ← 应用完全启动后执行
+    @Profile("!test")                              // ← 测试环境跳过
+    public void init() {
+        log.info("Initializing default data...");
+        if (userRepository.count() == 0) {
+            userRepository.save(new User("admin", encodePassword("admin")));
+        }
+    }
+}
+
+// 或者更安全的模式：显式调用 + 幂等检查
+@Component
+public class DataInitializer {
+    private boolean initialized = false;
+
+    public synchronized void initializeIfNeeded() {
+        if (!initialized && userRepository.count() == 0) {
+            userRepository.save(new User("admin", encodePassword("admin")));
+            initialized = true;
+        }
+    }
+}
+```
+
+### 4. 硬编码密钥 — 禁止代码中内联 （P0）
+
+```java
+// ❌ 坏：硬编码 API Key
+private static final String API_KEY = "sk-abc123...";
+
+// ✅ 好：环境变量
+@Value("${app.api-key}")
+private String apiKey;
+
+// ✅ 好：Spring Cloud Config / Vault
+@Value("${app.api-key}")
+private String apiKey;
+```
+
+```yaml
+# ❌ 坏：提交到 Git
+api-key: sk-abc123...
+
+# ✅ 好：application.yml 中只声明占位
+app:
+  api-key: ${APP_API_KEY}
+```
+
+```properties
+# ✅ .env 本地开发（不提交 Git）
+APP_API_KEY=sk-abc123...
+```
+
+### 5. 敏感脱敏 — 日志中禁止打印敏感信息 （P1）
+
+```java
+// ❌ 坏：直接打印敏感信息
+log.info("User login: {} {}", user.getEmail(), user.getPassword());   // ← 密码泄露
+log.info("Token: {}", authToken);                                      // ← Token 泄露
+
+// ✅ 好：脱敏后打印
+log.info("User login: {}", maskEmail(user.getEmail()));
+log.info("User [id={}] logged in", user.getId());
+
+// 脱敏工具方法
+public static String maskEmail(String email) {
+    int at = email.indexOf('@');
+    if (at <= 1) return email;
+    return email.charAt(0) + "***" + email.substring(at);
+}
+
+public static String maskPhone(String phone) {
+    if (phone == null || phone.length() < 7) return phone;
+    return phone.substring(0, 3) + "****" + phone.substring(phone.length() - 4);
+}
+```
+
+**红线规则：**
+- 禁止打印密码、Token、完整手机号、完整身份证号
+- DTO 中密码字段加 `@JsonIgnore` 或从响应 DTO 中排除
+- 禁止 `System.out.println` — 必须通过 SLF4J 日志框架
+
+### 6. 文件上传验证 （P1）
+
+```java
+// ✅ 好：文件上传安全检查
+public class FileUploadService {
+    private static final List<String> ALLOWED_TYPES = List.of("image/jpeg", "image/png", "application/pdf");
+    private static final long MAX_SIZE = 10 * 1024 * 1024;  // 10MB
+    private static final Path UPLOAD_DIR = Path.of("/var/data/uploads");  // ← 非 webroot
+
+    public void upload(MultipartFile file) {
+        // 1. 校验文件类型
+        String contentType = file.getContentType();
+        if (contentType == null || !ALLOWED_TYPES.contains(contentType)) {
+            throw new InvalidArgumentException(ErrorCode.VALIDATION_001, "不支持的文件类型");
+        }
+
+        // 2. 校验文件大小
+        if (file.getSize() > MAX_SIZE) {
+            throw new InvalidArgumentException(ErrorCode.VALIDATION_001, "文件大小超限");
+        }
+
+        // 3. 重命名防止路径穿越
+        String safeName = UUID.randomUUID() + "-" + cleanFileName(file.getOriginalFilename());
+
+        // 4. 存储到非 webroot 目录
+        file.transferTo(UPLOAD_DIR.resolve(safeName).toFile());
+    }
+
+    private String cleanFileName(String name) {
+        return name.replaceAll("[^a-zA-Z0-9._-]", "_");
+    }
+}
+```

package/dist/skills/reef-style-backend/fragments/java/test/data-jpa-test/examples/user-repository-test.md

@@ -0,0 +1,69 @@
+```java
+@DataJpaTest
+@ActiveProfiles("test")
+@Testcontainers
+class UserRepositoryTest {
+
+    @Container @ServiceConnection
+    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine");
+
+    @Autowired private UserRepository userRepository;
+    @Autowired private TestEntityManager entityManager;
+
+    // ──── 基本查询 ────
+
+    @Test
+    void should_findByEmail() {
+        entityManager.persistAndFlush(new User("alice@test.com", "Alice"));
+        assertThat(userRepository.findByEmail("alice@test.com")).isPresent();
+    }
+
+    @Test
+    void should_returnEmpty_when_notFound() {
+        assertThat(userRepository.findByEmail("missing@test.com")).isEmpty();
+    }
+
+    // ──── 多租户 ────
+
+    @Test
+    void should_findByIdAndAppId() {
+        User user = entityManager.persistAndFlush(
+            new User("multi@test.com", "Multi").setAppId(1L));
+        assertThat(userRepository.findByIdAndAppId(user.getId(), 1L)).isPresent();
+        assertThat(userRepository.findByIdAndAppId(user.getId(), 999L)).isEmpty();
+    }
+
+    @Test @Sql("/user-repository-test-data.sql")
+    void should_findAllByAppId() {
+        assertThat(userRepository.findAllByAppId(1L)).hasSize(2);
+        assertThat(userRepository.findAllByAppId(2L)).hasSize(1);
+    }
+
+    // ──── 存在性 & 计数 ────
+
+    @Test
+    void should_checkEmailExists() {
+        entityManager.persistAndFlush(new User("exists@test.com", "Exists"));
+        assertThat(userRepository.existsByEmail("exists@test.com")).isTrue();
+        assertThat(userRepository.existsByEmail("nobody@test.com")).isFalse();
+    }
+
+    @Test
+    void should_countByAppId() {
+        entityManager.persistAndFlush(new User("a@test.com", "A").setAppId(1L));
+        entityManager.persistAndFlush(new User("b@test.com", "B").setAppId(1L));
+        assertThat(userRepository.countByAppId(1L)).isEqualTo(2);
+        assertThat(userRepository.countByAppId(2L)).isZero();
+    }
+
+    // ──── @Query ────
+
+    @Test @Sql("/user-repository-test-data.sql")
+    void should_findActiveUsers() {
+        assertThat(userRepository.findActiveUsers())
+            .extracting(User::getEmail)
+            .contains("alice@test.com", "bob@test.com")
+            .doesNotContain("inactive@test.com");
+    }
+}
+```

package/dist/skills/reef-style-backend/fragments/java/test/data-jpa-test/quick-reference.md

@@ -0,0 +1,101 @@
+# DataJPA 测试规范
+
+`@DataJpaTest` + Testcontainers：只加载 JPA 切片（Repository / Entity / DataSource），不加载 Service/Controller。
+
+## 基础结构
+
+```java
+@DataJpaTest
+@ActiveProfiles("test")
+@Testcontainers
+class UserRepositoryTest {
+    @Container @ServiceConnection
+    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine");
+    @Autowired private UserRepository userRepository;
+    @Autowired private TestEntityManager entityManager;
+}
+```
+
+> **💡 Testcontainers vs H2：** Testcontainers 使用真实数据库容器，避免 H2 与 PostgreSQL/MySQL 的方言差异。简单项目可用 H2 兼容模式：`@AutoConfigureTestDatabase(replace = ANY)`
+
+## 测试模式
+
+### 基本查询
+
+```java
+@Test
+void should_findByEmail() {
+    entityManager.persistAndFlush(new User("alice@test.com", "Alice"));
+    Optional<User> result = userRepository.findByEmail("alice@test.com");
+    assertThat(result).isPresent();
+}
+
+@Test
+void should_returnEmpty_when_notFound() {
+    assertThat(userRepository.findByEmail("missing@test.com")).isEmpty();
+}
+```
+
+### `@Query` 自定义查询
+
+```java
+@Test
+void should_findActiveUsers() {
+    entityManager.persistAndFlush(new User("active@test.com", "Active").setActive(true));
+    entityManager.persistAndFlush(new User("inactive@test.com", "Inactive").setActive(false));
+
+    assertThat(userRepository.findActiveUsers())
+        .extracting(User::getEmail)
+        .containsExactly("active@test.com");
+}
+```
+
+### `@Modifying` 写操作
+
+```java
+@Test
+void should_deactivateUser() {
+    entityManager.persistAndFlush(new User("leave@test.com", "Leaving"));
+    assertThat(userRepository.deactivateByEmail("leave@test.com")).isEqualTo(1);
+}
+```
+
+### 多租户查询
+
+```java
+@Test
+void should_findByAppId() {
+    entityManager.persistAndFlush(new User("a@test.com", "A").setAppId(1L));
+    entityManager.persistAndFlush(new User("b@test.com", "B").setAppId(2L));
+
+    assertThat(userRepository.findAllByAppId(1L)).hasSize(1);
+    // 必须传 appId 过滤，禁止裸 findById
+    assertThat(userRepository.findByIdAndAppId(id, 1L)).isPresent();
+    assertThat(userRepository.findByIdAndAppId(id, 999L)).isEmpty();
+}
+```
+
+## 数据准备
+
+```java
+// 方式一：@Sql 加载脚本（适合多数据）
+@Test @Sql("/user-test-data.sql")
+void should_findAll() { ... }
+
+// 方式二：entityManager（适合少量）
+@Test
+void should_findByEmail() {
+    entityManager.persistAndFlush(new User("test@test.com", "Test"));
+    ...
+}
+```
+
+## 关键规则
+
+| 场景 | 做法 |
+|------|------|
+| Repository 测试 | `@DataJpaTest` |
+| 测试数据库 | Testcontainers + `@ServiceConnection` |
+| 数据准备 | `entityManager.persistAndFlush()` 或 `@Sql` |
+| 多租户 | `findByIdAndAppId(id, appId)` **禁止裸 `findById`** |
+| 写操作 | `@Modifying` + 验证 `int updated` 返回值 |

package/dist/skills/reef-style-backend/fragments/java/test/junit5/examples/user-service-test.md

@@ -0,0 +1,61 @@
+```java
+@ExtendWith(MockitoExtension.class)
+class UserServiceTest {
+
+    @Mock private UserRepository userRepository;
+    @Mock private UserMapper userMapper;
+    @InjectMocks private UserService userService;
+
+    private User userEntity;
+    private UserDTO userDTO;
+
+    @BeforeEach
+    void setUp() {
+        userEntity = new User(1L, "test@example.com", "Test User");
+        userDTO = new UserDTO(1L, "test@example.com", "Test User");
+    }
+
+    @Test
+    void should_returnUser_when_findById() {
+        when(userRepository.findById(1L)).thenReturn(Optional.of(userEntity));
+        when(userMapper.toDTO(userEntity)).thenReturn(userDTO);
+
+        UserDTO result = userService.findById(1L);
+
+        assertThat(result)
+            .extracting(UserDTO::id, UserDTO::email)
+            .containsExactly(1L, "test@example.com");
+    }
+
+    @Test
+    void should_throw_when_userNotFound() {
+        when(userRepository.findById(999L)).thenReturn(Optional.empty());
+
+        assertThatThrownBy(() -> userService.findById(999L))
+            .isInstanceOf(NotFoundException.class)
+            .hasMessageContaining("User");
+    }
+
+    @ParameterizedTest
+    @CsvSource({"''", "'   '", "null"})
+    void should_throw_when_nameIsBlank(String name) {
+        assertThatThrownBy(() -> userService.create(
+            new CreateUserRequest(name, "a@test.com")))
+            .isInstanceOf(InvalidArgumentException.class);
+    }
+
+    @Test
+    void should_createUser_andReturnDTO() {
+        when(userMapper.toEntity(any())).thenReturn(new User(null, "new@test.com", "New"));
+        when(userRepository.save(any())).thenReturn(new User(2L, "new@test.com", "New"));
+        when(userMapper.toDTO(any())).thenReturn(new UserDTO(2L, "new@test.com", "New"));
+
+        UserDTO result = userService.create(
+            new CreateUserRequest("New User", "new@test.com"));
+
+        assertThat(result).usingRecursiveComparison()
+            .isEqualTo(new UserDTO(2L, "new@test.com", "New"));
+        verify(userRepository).save(any());
+    }
+}
+```

package/dist/skills/reef-style-backend/fragments/java/test/junit5/quick-reference.md

@@ -0,0 +1,100 @@
+# JUnit 5 测试规范
+
+## 文件与命名规范
+
+- 文件位置：`src/test/java/`，包路径与被测类一致
+- 类名：`XxxTest.java`（`Test` 后缀）
+- 方法名：`should_expectedBehavior_when_condition`
+  - 例：`should_returnUser_when_findById`
+
+## 基本注解
+
+| 注解 | 用途 |
+|------|------|
+| `@Test` | 标记测试方法，每个方法一个独立场景 |
+| `@BeforeEach` | 每个测试前执行（初始化、Mock 设置） |
+| `@AfterEach` | 每个测试后执行（清理资源） |
+| `@BeforeAll` | 所有测试前（static） |
+| `@AfterAll` | 所有测试后（static） |
+
+## AAA 模式
+
+```java
+@Test
+void should_returnUser_when_findById() {
+    // Arrange
+    when(userRepository.findById(userId)).thenReturn(Optional.of(user));
+    // Act
+    UserDTO result = userService.findById(userId);
+    // Assert
+    assertThat(result).extracting(UserDTO::id, UserDTO::email)
+        .containsExactly(1L, "test@example.com");
+}
+```
+
+## 断言（AssertJ 流畅 API）
+
+```java
+// 基本
+assertThat(actual).isEqualTo(expected).isNotNull();
+// 集合
+assertThat(list).hasSize(3).containsExactly(a, b, c);
+assertThat(list).extracting(User::id).containsExactly(1L, 2L, 3L);
+assertThat(list).extracting(User::id, User::email)
+    .containsExactly(tuple(1L, "a@test.com"), tuple(2L, "b@test.com"));
+// 异常
+assertThatThrownBy(() -> service.findById(999L))
+    .isInstanceOf(NotFoundException.class)
+    .hasMessageContaining("User");
+```
+
+## 参数化测试
+
+```java
+@ParameterizedTest
+@ValueSource(strings = {"", "  "})
+void should_throw_when_nameIsBlank(String name) {
+    assertThatThrownBy(() -> validator.validateName(name))
+        .isInstanceOf(InvalidArgumentException.class);
+}
+
+@ParameterizedTest
+@CsvSource({"user@test.com, true", "invalid-email, false"})
+void should_validateEmail(String email, boolean expected) {
+    assertThat(validator.isValidEmail(email)).isEqualTo(expected);
+}
+
+@ParameterizedTest
+@MethodSource("invalidUserProvider")
+void should_throw_when_userInvalid(CreateUserRequest request) { ... }
+
+static Stream<CreateUserRequest> invalidUserProvider() { ... }
+```
+
+## Mock（Mockito）
+
+```java
+@ExtendWith(MockitoExtension.class)
+class UserServiceTest {
+    @Mock private UserRepository userRepository;
+    @InjectMocks private UserService userService;
+    @Captor private ArgumentCaptor<User> userCaptor;
+
+    @Test
+    void should_createUser() {
+        when(userMapper.toEntity(request)).thenReturn(entity);
+        when(userRepository.save(entity)).thenReturn(saved);
+        when(userMapper.toDTO(saved)).thenReturn(expected);
+        UserDTO result = userService.create(request);
+        assertThat(result).isEqualTo(expected);
+        verify(userRepository).save(entity);
+    }
+
+    @Test
+    void should_throw_when_userNotFound() {
+        when(userRepository.findById(999L)).thenReturn(Optional.empty());
+        assertThatThrownBy(() -> userService.findById(999L))
+            .isInstanceOf(NotFoundException.class);
+    }
+}
+```

package/dist/skills/reef-style-backend/fragments/java/test/spring-mvc-test/examples/user-controller-test.md

@@ -0,0 +1,61 @@
+```java
+@WebMvcTest(UserController.class)
+class UserControllerTest {
+
+    @Autowired private MockMvc mockMvc;
+    @Autowired private ObjectMapper objectMapper;
+    @MockitoBean private UserService userService;
+
+    // ──────── GET ────────
+
+    @Test
+    void should_returnAllUsers() throws Exception {
+        when(userService.findAll()).thenReturn(List.of(
+            new UserDTO(1L, "a@test.com", "Alice"),
+            new UserDTO(2L, "b@test.com", "Bob")));
+
+        mockMvc.perform(get("/api/v1/users"))
+            .andExpect(status().isOk())
+            .andExpect(jsonPath("$", hasSize(2)))
+            .andExpect(jsonPath("$[0].email").value("a@test.com"));
+    }
+
+    @Test
+    void should_return404_when_userNotFound() throws Exception {
+        when(userService.findById(999L)).thenThrow(new NotFoundException("User", 999L));
+
+        mockMvc.perform(get("/api/v1/users/{id}", 999L))
+            .andExpect(status().isNotFound());
+    }
+
+    // ──────── POST ────────
+
+    @Test
+    @WithMockUser(authorities = "USER_CREATE")
+    void should_createUser() throws Exception {
+        when(userService.create(any())).thenReturn(new UserDTO(3L, "carol@test.com", "Carol"));
+
+        mockMvc.perform(post("/api/v1/users")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content(objectMapper.writeValueAsString(new CreateUserRequest("carol@test.com", "Carol"))))
+            .andExpect(status().isCreated())
+            .andExpect(jsonPath("$.id").value(3L));
+    }
+
+    @Test
+    void should_return403_when_notAuthorized() throws Exception {
+        mockMvc.perform(post("/api/v1/users")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content(objectMapper.writeValueAsString(new CreateUserRequest("carol@test.com", "Carol"))))
+            .andExpect(status().isForbidden());
+    }
+
+    @Test
+    void should_return400_when_invalidInput() throws Exception {
+        mockMvc.perform(post("/api/v1/users")
+                .contentType(MediaType.APPLICATION_JSON)
+                .content(objectMapper.writeValueAsString(new CreateUserRequest("", ""))))
+            .andExpect(status().isBadRequest());
+    }
+}
+```

package/dist/skills/reef-style-backend/fragments/java/test/spring-mvc-test/quick-reference.md

@@ -0,0 +1,85 @@
+# Spring MVC 测试规范
+
+`@WebMvcTest` + `MockMvc`：只加载 Web 切片，不加载完整 Spring 上下文。
+
+## 基础结构
+
+```java
+@WebMvcTest(UserController.class)
+class UserControllerTest {
+    @Autowired private MockMvc mockMvc;
+    @MockitoBean private UserService userService;        // 注入 Mock Service
+}
+```
+
+## 测试模式
+
+### GET 列表 / 详情 / 404
+
+```java
+@Test
+void should_returnAllUsers() throws Exception {
+    when(userService.findAll()).thenReturn(List.of(new UserDTO(1L, "a@test.com")));
+
+    mockMvc.perform(get("/api/v1/users"))
+        .andExpect(status().isOk())
+        .andExpect(jsonPath("$", hasSize(1)))
+        .andExpect(jsonPath("$[0].email").value("a@test.com"));
+}
+
+@Test
+void should_return404_when_userNotFound() throws Exception {
+    when(userService.findById(999L)).thenThrow(new NotFoundException("User", 999L));
+
+    mockMvc.perform(get("/api/v1/users/{id}", 999L))
+        .andExpect(status().isNotFound())
+        .andExpect(jsonPath("$.message").value(containsString("User")));
+}
+```
+
+### POST 创建（含权限）
+
+```java
+@Test
+@WithMockUser(authorities = "USER_CREATE")
+void should_createUser() throws Exception {
+    when(userService.create(any(CreateUserRequest.class))).thenReturn(new UserDTO(...));
+
+    mockMvc.perform(post("/api/v1/users")
+            .contentType(MediaType.APPLICATION_JSON)
+            .content(objectMapper.writeValueAsString(request)))
+        .andExpect(status().isCreated())
+        .andExpect(jsonPath("$.id").value(1L));
+}
+
+@Test
+void should_return403_when_noPermission() throws Exception {
+    mockMvc.perform(post("/api/v1/users")
+            .contentType(MediaType.APPLICATION_JSON)
+            .content(objectMapper.writeValueAsString(request)))
+        .andExpect(status().isForbidden());
+}
+```
+
+### 参数校验失败
+
+```java
+@Test
+void should_return400_when_invalidInput() throws Exception {
+    mockMvc.perform(post("/api/v1/users")
+            .contentType(MediaType.APPLICATION_JSON)
+            .content(objectMapper.writeValueAsString(new CreateUserRequest("", ""))))
+        .andExpect(status().isBadRequest());
+}
+```
+
+## 关键规则
+
+| 场景 | 做法 |
+|------|------|
+| Controller 测试 | `@WebMvcTest` + `MockMvc` |
+| Service Mock | `@MockitoBean` |
+| 权限测试 | `@WithMockUser` + `authorities` |
+| JSON 验证 | `jsonPath("$.field").value(...)` |
+| 请求体 | `objectMapper.writeValueAsString(dto)` |
+| 异常路径 | Service 抛出异常，验证状态码 + message |