@oj-module/cli 0.1.21 → 0.2.1

package/templates/api/src/system/users/api.ts

@@ -0,0 +1,58 @@
+import { respond } from "../../_platform/_shared/respond";
+// 管理域端点组 /api/system/users（AC1-7~10）：handler 只编排——assertSystemAdmin 守卫 → service → json。
+// 保护红线在 service 层硬 enforcement：禁止操作自己、admin 不碰成员资格、最后 superadmin 兜底。
+// 子端点：roles/password/forbidden 各为独立目录（wiki per-endpoint 先例）。
+import { assertSystemAdmin } from "../../_platform/_shared/service/access";
+import { createUser, listUsers } from "../../_platform/_shared/service/users";
+
+const bcryptDeps = { bcryptHash: (pw: string) => bcrypt.hash(pw) };
+
+// GET /api/system/users —— 用户列表（C1 页面数据源；无口令哈希，service 已排除）。
+async function get() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		return listUsers();
+	});
+}
+get.response = {
+	type: "array",
+	items: {
+		type: "object",
+		required: ["id", "username", "display_name", "email", "is_forbidden", "must_change", "roles"],
+		properties: {
+			id: { type: "number" },
+			username: { type: "string" },
+			display_name: { type: ["string", "null"] },
+			email: { type: ["string", "null"] },
+			// service 已做 Number(x)===1 布尔归一，此处是真 boolean
+			is_forbidden: { type: "boolean" },
+			must_change: { type: "boolean" },
+			roles: { type: "array", items: { type: "string" } },
+		},
+	},
+};
+
+// POST /api/system/users —— 建号（B6 加固；默认 must_change=1 首登改密）。
+async function post() {
+	await assertSystemAdmin();
+	json.ok({ id: await createUser(http.body || {}, bcryptDeps) });
+}
+post.schema = {
+	body: {
+		type: "object",
+		required: ["username", "password"],
+		properties: {
+			username: { type: "string", minLength: 1 },
+			password: { type: "string", minLength: 6 },
+			displayName: { type: "string" },
+			email: { type: "string" },
+		},
+	},
+};
+post.response = {
+	type: "object",
+	required: ["id"],
+	properties: { id: { type: "number" } },
+};
+
+export default { get, post };

package/templates/api/src/system/users/forbidden/api.ts

@@ -0,0 +1,26 @@
+import { respond } from "../../../_platform/_shared/respond";
+// PUT /api/system/users/forbidden?uid= —— 禁用/解禁（禁用即删 refresh，撤销即强退）。
+import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
+import { setForbidden } from "../../../_platform/_shared/service/users";
+
+async function put() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		const q = http.query as Record<string, unknown>;
+		return setForbidden(Number(http.user?.id), Number(q.uid), Boolean(http.body?.forbidden));
+	});
+}
+put.schema = {
+	query: {
+		type: "object",
+		required: ["uid"],
+		properties: { uid: { type: "number" } },
+	},
+	body: {
+		type: "object",
+		required: ["forbidden"],
+		properties: { forbidden: { type: "boolean" } },
+	},
+};
+
+export default { put };

package/templates/api/src/system/users/password/api.ts

@@ -0,0 +1,26 @@
+import { respond } from "../../../_platform/_shared/respond";
+// PUT /api/system/users/password?uid= —— 管理员重置口令（must_change=1 + 级联吊销 refresh）。
+import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
+import { changePasswordByAdmin } from "../../../_platform/_shared/service/users";
+
+async function put() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		const q = http.query as Record<string, unknown>;
+		return changePasswordByAdmin(Number(http.user?.id), Number(q.uid), String(http.body?.password ?? ""), { bcryptHash: (pw: string) => bcrypt.hash(pw) });
+	});
+}
+put.schema = {
+	query: {
+		type: "object",
+		required: ["uid"],
+		properties: { uid: { type: "number" } },
+	},
+	body: {
+		type: "object",
+		required: ["password"],
+		properties: { password: { type: "string", minLength: 6 } },
+	},
+};
+
+export default { put };

package/templates/api/src/system/users/roles/api.ts

@@ -0,0 +1,27 @@
+import { respond } from "../../../_platform/_shared/respond";
+// PUT /api/system/users/roles?uid= —— 整集替换用户角色（AC1-7；sys_user_role 权威源 + 写时失效）。
+import { assertSystemAdmin } from "../../../_platform/_shared/service/access";
+import { updateUserRoles } from "../../../_platform/_shared/service/users";
+
+async function put() {
+	await respond(async () => {
+		await assertSystemAdmin();
+		const q = http.query as Record<string, unknown>;
+		const roles = Array.isArray(http.body?.roles) ? http.body.roles.map(String) : [];
+		return updateUserRoles(Number(http.user?.id), Number(q.uid), roles);
+	});
+}
+put.schema = {
+	query: {
+		type: "object",
+		required: ["uid"],
+		properties: { uid: { type: "number" } },
+	},
+	body: {
+		type: "object",
+		required: ["roles"],
+		properties: { roles: { type: "array", items: { type: "string" } } },
+	},
+};
+
+export default { put };

package/templates/api/src/web/user-info/api.ts

@@ -1,8 +1,7 @@
 // GET /api/web/user-info —— 前端登录链用户信息端点（Bearer 守卫保护）。
-// 按 http.user.id 查 users 表，snake_case → camelCase 映射；
-// 响应一律走 json.ok/json.fail 信封（oj 红线）；前端 runtime 适配层（D10）
-// 负责把 {code:0,data} 转成前端 {code:200,result}。
-// avatar 读 avatar_base64（personal-center 头像上传回写，_platform 0002 迁移）。
+// B4：roles 出自 sys_user_role 权威源（users.roles JSON 列已被 0003 移除，D10）——
+// 体验层角色走本资料接口，不进 JWT claims；avatar 读 avatar_base64，email 读 0007 迁移列。
+// 响应一律走 json.ok/json.fail 信封（oj 红线）。
 export default {
 	async get() {
 		const uid = http.user?.id;
@@ -12,7 +11,7 @@ export default {
 		}
 		try {
 			const rows = await db.query(
-				"SELECT id, username, roles, avatar_base64 FROM users WHERE id = ?",
+				"SELECT id, username, display_name, avatar_base64, email, must_change FROM users WHERE id = ?",
 				[Number(uid)],
 			);
 			const row = rows[0];
@@ -20,23 +19,15 @@ export default {
 				json.fail(404, "user not found");
 				return;
 			}
-			let roles: string[] = [];
-			try {
-				const parsed = JSON.parse(String(row.roles ?? "[]"));
-				if (Array.isArray(parsed))
-					roles = parsed as string[];
-			}
-			catch {
-				roles = [];
-			}
+			const roleRows = await db.query("SELECT role_name FROM sys_user_role WHERE user_id = ?", [Number(uid)]) as Array<{ role_name: string }>;
 			json.ok({
 				id: String(row.id),
 				avatar: String(row.avatar_base64 ?? ""),
 				username: String(row.username),
-				email: "",
-				phoneNumber: "",
-				description: "",
-				roles,
+				displayName: row.display_name == null ? "" : String(row.display_name),
+				email: String(row.email ?? ""),
+				roles: roleRows.map(r => r.role_name),
+				mustChange: Number(row.must_change) === 1,
 				permissions: [],
 			});
 		}

package/templates/api/tests/auth-ldap.spec.ts

@@ -0,0 +1,173 @@
+// BDD：LDAP 登录（D1/AC1-12/PRD §4.5）——esc RFC 4515 红线 + ldapLogin 服务九步流程。
+// axis("ldap") 是 oj 运行时全局（search/bind 无参数绑定面），gateway 注入可测；
+// session 注入假实现，断言 JIT/禁用/签发编排，不触真 token。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+
+import { esc, firstAttr } from "../src/auth/_shared/ldap";
+import { createLdapLogin } from "../src/auth/_shared/ldap-login";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	dbo.exec("DELETE FROM users WHERE username LIKE 'ldap:%'");
+	dbo.exec("DELETE FROM sys_setting WHERE key LIKE 'ldap%'");
+});
+
+function seedLdapSettings(overrides: Record<string, string> = {}) {
+	const base = { "ldap.enabled": "1", "ldap_base_dn": "ou=people,dc=example,dc=com", "ldap_uid_attr": "uid", "ldap_email_attr": "mail" };
+	for (const [k, v] of Object.entries({ ...base, ...overrides }))
+		dbo.prepare("INSERT OR REPLACE INTO sys_setting (key, module, \"group\", type, value, default_value, secret, update_time) VALUES (?, 'ldap', 'ldap', 'string', ?, '', 0, 0)").run(k, v);
+}
+
+interface FakeEntry { dn: string, attrs: Record<string, string[]> }
+
+function fakeGateway(behavior: {
+	search?: (filter: string) => FakeEntry[] | Promise<FakeEntry[]>
+	bind?: (dn: string, password: string) => boolean | Promise<boolean>
+} = {}) {
+	return {
+		searches: [] as string[],
+		binds: [] as Array<{ dn: string, password: string }>,
+		async search(_base: string, opts: { filter: string }) {
+			this.searches.push(opts.filter);
+			const r = behavior.search?.(opts.filter);
+			if (r instanceof Promise)
+				return await r;
+			return r ?? [{ dn: "uid=x,ou=people,dc=example,dc=com", attrs: { uid: ["alice"], mail: ["alice@example.com"] } }];
+		},
+		async bind(dn: string, password: string) {
+			this.binds.push({ dn, password });
+			const r = behavior.bind?.(dn, password);
+			return r instanceof Promise ? await r : (r ?? true);
+		},
+	};
+}
+
+function fakeSession() {
+	return {
+		issued: [] as number[],
+		async issueExternal(uid: number) {
+			this.issued.push(uid);
+			return { access_token: "a", refresh_token: "r", expires_in: 900, restricted: false, user: { id: uid, username: `u${uid}`, display_name: null, avatar_base64: null, must_change: false, roles: [] } };
+		},
+	};
+}
+
+describe("esc：RFC 4515 转义红线（filter 无参数绑定，注入即目录查询篡改）", () => {
+	it.each([
+		["*", "\\2a"],
+		["(", "\\28"],
+		[")", "\\29"],
+		["\\", "\\5c"],
+		["\0", "\\00"],
+		["alice*", "alice\\2a"],
+		["a)(uid=x", "a\\29\\28uid=x"],
+		[" Plain ", " Plain "], // 空格不转义（RFC 4515 无此要求）
+		["中文明文", "中文明文"],
+	])("%j → %j", (input, expected) => {
+		expect(esc(input)).toBe(expected);
+	});
+});
+
+describe("firstAttr：多值取首 / 缺失取空串", () => {
+	it("首值与缺省", () => {
+		expect(firstAttr({ mail: ["a@x.com", "b@x.com"] }, "mail")).toBe("a@x.com");
+		expect(firstAttr({}, "mail")).toBe("");
+		expect(firstAttr(undefined, "mail")).toBe("");
+	});
+});
+
+describe("AC1-12：LDAP 登录九步流程（D1）", () => {
+	it("① ldap.enabled=0 → 400（未启用）", async () => {
+		seedLdapSettings({ "ldap.enabled": "0" });
+		const g = fakeGateway();
+		const login = createLdapLogin(fakeSession(), g);
+		await expect(login("alice", "pw")).rejects.toMatchObject({ status: 400 });
+		expect(g.searches.length).toBe(0); // 闸住，不触上游
+	});
+
+	it("③ base_dn 空 → 400", async () => {
+		seedLdapSettings({ ldap_base_dn: "" });
+		const g = fakeGateway();
+		const login = createLdapLogin(fakeSession(), g);
+		await expect(login("alice", "pw")).rejects.toMatchObject({ status: 400 });
+		expect(g.searches.length).toBe(0);
+	});
+
+	it("② username/password 空 → 400", async () => {
+		seedLdapSettings();
+		const login = createLdapLogin(fakeSession(), fakeGateway());
+		await expect(login("", "pw")).rejects.toMatchObject({ status: 400 });
+		await expect(login("alice", "")).rejects.toMatchObject({ status: 400 });
+	});
+
+	it("⑤ search 抛 → 502；0 条/多条 → 401（不猜）", async () => {
+		seedLdapSettings();
+		const s = fakeSession();
+		const searchThrow = fakeGateway({ search: () => Promise.reject(new Error("conn reset")) });
+		await expect(createLdapLogin(s, searchThrow)("alice", "pw")).rejects.toMatchObject({ status: 502 });
+		await expect(createLdapLogin(s, fakeGateway({ search: () => [] }))("alice", "pw")).rejects.toMatchObject({ status: 401 });
+		await expect(createLdapLogin(s, fakeGateway({ search: () => [{ dn: "a", attrs: {} }, { dn: "b", attrs: {} }] }))("alice", "pw")).rejects.toMatchObject({ status: 401 });
+		expect(s.issued.length).toBe(0);
+	});
+
+	it("⑤ filter 必含转义后的用户名（esc 红线在真实调用路径上）", async () => {
+		seedLdapSettings();
+		const g = fakeGateway();
+		await createLdapLogin(fakeSession(), g)("ali(*)", "pw").catch(() => {});
+		expect(g.searches[0]).toBe("(uid=ali\\28\\2a\\29)");
+	});
+
+	it("⑥ bind false → 401；bind 抛 → 502", async () => {
+		seedLdapSettings();
+		const s = fakeSession();
+		await expect(createLdapLogin(s, fakeGateway({ bind: () => false }))("alice", "pw")).rejects.toMatchObject({ status: 401 });
+		const bindThrow = fakeGateway({ bind: () => Promise.reject(new Error("tls")) });
+		await expect(createLdapLogin(s, bindThrow)("alice", "pw")).rejects.toMatchObject({ status: 502 });
+		expect(s.issued.length).toBe(0);
+	});
+
+	it("⑦ JIT 建号：ldap:<uid> / !ldap / source=ldap / must_change=0 / email 映射 / 零角色", async () => {
+		seedLdapSettings();
+		const s = fakeSession();
+		await createLdapLogin(s, fakeGateway())("alice", "pw");
+		const row = dbo.prepare("SELECT username, password_hash, source, must_change, email, is_forbidden FROM users WHERE username = 'ldap:alice'").get() as Record<string, unknown>;
+		expect(row.password_hash).toBe("!ldap");
+		expect(row.source).toBe("ldap");
+		expect(row.must_change).toBe(0); // 外来号无本地旧口令，悬挂期会 brick（设计 §9.4）
+		expect(row.email).toBe("alice@example.com");
+		expect(row.is_forbidden).toBe(0);
+		expect(dbo.prepare("SELECT COUNT(*) n FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = 'ldap:alice')").get().n).toBe(0);
+		expect(s.issued.length).toBe(1);
+	});
+
+	it("⑦ 撞 UNIQUE 竞态 → 回查复用，不重复建号", async () => {
+		seedLdapSettings();
+		dbo.prepare("INSERT INTO users (username, password_hash, source, must_change) VALUES ('ldap:alice', '!ldap', 'ldap', 0)").run();
+		const s = fakeSession();
+		await createLdapLogin(s, fakeGateway())("alice", "pw");
+		expect(dbo.prepare("SELECT COUNT(*) n FROM users WHERE username = 'ldap:alice'").get().n).toBe(1);
+		expect(s.issued.length).toBe(1);
+	});
+
+	it("⑧ is_forbidden=1 → 403 不签发（禁号闭环三处之二；bind 成功也不放行）", async () => {
+		seedLdapSettings();
+		dbo.prepare("INSERT INTO users (username, password_hash, source, must_change, is_forbidden) VALUES ('ldap:alice', '!ldap', 'ldap', 0, 1)").run();
+		const s = fakeSession();
+		await expect(createLdapLogin(s, fakeGateway())("alice", "pw")).rejects.toMatchObject({ status: 403 });
+		expect(s.issued.length).toBe(0);
+	});
+
+	it("④ 映射缺省：uid_attr/mail  attr 缺省 uid/mail", async () => {
+		seedLdapSettings({ ldap_uid_attr: "", ldap_email_attr: "" });
+		const g = fakeGateway();
+		await createLdapLogin(fakeSession(), g)("alice", "pw");
+		expect(g.searches[0]).toBe("(uid=alice)");
+	});
+});

package/templates/api/tests/auth-session.spec.ts

@@ -0,0 +1,194 @@
+// BDD：登录链——B1 登录顺序（D14 统一 401）、B2 首登改密（AC1-27）、B3 refresh 轮换/reuse 检测（AC1-13）、B4 JWT 仅 sub。
+// deps 全注入（Node 侧 crypto 只读不可 stub，设计 §9.1）；fake bcrypt 以 `hashed:<pw>` 为口令哈希约定。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import type { SessionDeps } from "../src/auth/_shared/session";
+
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { assertPermission } from "../src/_platform/_shared/service/access";
+import { createSession } from "../src/auth/_shared/session";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+const g = globalThis as any;
+
+let clock: number;
+let signedSubs: string[];
+let randomSeq: string[];
+
+function deps(): SessionDeps {
+	return {
+		randomHex: () => randomSeq.shift() ?? "rnd-fallback",
+		sha256Hex: (s: string) => `h(${s})`,
+		signAccess: (sub: string) => {
+			signedSubs.push(sub);
+			return `jwt(${sub})`;
+		},
+		accessTtlSecs: 900,
+		refreshTtlSecs: 30 * 24 * 3600,
+		bcryptHash: async (pw: string) => `hashed:${pw}`,
+		bcryptVerify: async (pw: string, h: string) => h === `hashed:${pw}`,
+		now: () => clock,
+	};
+}
+
+/** 建用户；password_hash 走 fake bcrypt 约定。 */
+function mkUser(username: string, opts: { pw?: string, forbidden?: boolean, mustChange?: boolean } = {}): number {
+	dbo.prepare("INSERT INTO users (username, password_hash, is_forbidden, must_change) VALUES (?, ?, ?, ?)")
+		.run(username, `hashed:${opts.pw ?? "pw"}`, opts.forbidden ? 1 : 0, opts.mustChange ? 1 : 0);
+	return (dbo.prepare("SELECT id FROM users WHERE username = ?").get(username) as { id: number }).id;
+}
+
+function refreshRow(token: string) {
+	return dbo.prepare("SELECT * FROM sys_refresh_token WHERE token_hash = ?").get(`h(${token})`) as Record<string, unknown> | undefined;
+}
+
+beforeAll(() => {
+	dbo = installDb();
+	clock = 0;
+	signedSubs = [];
+	randomSeq = [];
+});
+
+afterEach(() => {
+	g.http = {};
+	dbo.exec("DELETE FROM sys_refresh_token");
+	dbo.exec("DELETE FROM sys_user_role");
+	dbo.exec("DELETE FROM users WHERE username LIKE 's%'");
+});
+
+describe("B1/D14：本地登录顺序与统一 401", () => {
+	it("口令正确未禁用 → 签发 + profile roles 来自 sys_user_role JOIN", async () => {
+		const uid = mkUser("s_alice", { pw: "secret1" });
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, 'editor')").run(uid);
+		const s = createSession(deps());
+		const r = await s.localLogin("s_alice", "secret1");
+		expect(r.access_token).toBe(`jwt(${uid})`);
+		expect(r.user.roles).toEqual(["editor"]);
+		expect(r.restricted).toBe(false);
+	});
+
+	it("错误口令 → 401 invalid credentials", async () => {
+		mkUser("s_bob", { pw: "secret1" });
+		await expect(createSession(deps()).localLogin("s_bob", "wrong"))
+			.rejects
+			.toMatchObject({ status: 401, message: "invalid credentials" });
+	});
+
+	it("号不存在 → 401 同文案（不泄露存在性）", async () => {
+		await expect(createSession(deps()).localLogin("s_ghost", "x"))
+			.rejects
+			.toMatchObject({ status: 401, message: "invalid credentials" });
+	});
+
+	it("口令对但 is_forbidden=1 → 401 同文案（禁用状态不泄露，D14）", async () => {
+		mkUser("s_carol", { pw: "secret1", forbidden: true });
+		await expect(createSession(deps()).localLogin("s_carol", "secret1"))
+			.rejects
+			.toMatchObject({ status: 401, message: "invalid credentials" });
+	});
+
+	it("B4：signAccess 仅收到 sub（roles 不进 claims）", async () => {
+		signedSubs = [];
+		const uid = mkUser("s_dave", { pw: "secret1" });
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, 'admin')").run(uid);
+		await createSession(deps()).localLogin("s_dave", "secret1");
+		expect(signedSubs).toEqual([String(uid)]);
+	});
+});
+
+describe("B2/AC1-27：must_change 首登改密闭环", () => {
+	it("must_change=1 → 登录响应 restricted=true，判权出口 403 must_change", async () => {
+		const uid = mkUser("s_eve", { pw: "oldpass", mustChange: true });
+		const s = createSession(deps());
+		const r = await s.localLogin("s_eve", "oldpass");
+		expect(r.restricted).toBe(true);
+		expect(r.user.must_change).toBe(true);
+		g.http = { user: { id: uid } };
+		await expect(assertPermission("wiki.page.edit")).rejects.toMatchObject({ status: 403, code: "must_change" });
+	});
+
+	it("旧口令错 → 401；新口令 <6 → 400", async () => {
+		const uid = mkUser("s_frank", { pw: "oldpass", mustChange: true });
+		const s = createSession(deps());
+		await expect(s.changePassword(uid, "nope", "newpass1")).rejects.toMatchObject({ status: 401 });
+		await expect(s.changePassword(uid, "oldpass", "123")).rejects.toMatchObject({ status: 400 });
+	});
+
+	it("改密成功：must_change 清 0、旧 refresh 全删、换发 unrestricted 正式 token", async () => {
+		const uid = mkUser("s_gina", { pw: "oldpass", mustChange: true });
+		const s = createSession(deps());
+		randomSeq = ["rt-old"];
+		await s.localLogin("s_gina", "oldpass");
+		expect(refreshRow("rt-old")).toBeDefined();
+		randomSeq = ["rt-new"];
+		const r = await s.changePassword(uid, "oldpass", "newpass1");
+		expect(refreshRow("rt-old")).toBeUndefined();
+		expect(refreshRow("rt-new")).toBeDefined();
+		expect(r.restricted).toBe(false);
+		const after = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(uid) as { must_change: number };
+		expect(Number(after.must_change)).toBe(0);
+	});
+});
+
+describe("B3/AC1-13：refresh 轮换、reuse 检测、TTL", () => {
+	it("轮换作旧：旧串 revoked=1，新串可用且 access/refresh 均更新", async () => {
+		mkUser("s_hank", { pw: "secret1" });
+		const s = createSession(deps());
+		randomSeq = ["rt-1"];
+		const t1 = await s.localLogin("s_hank", "secret1");
+		randomSeq = ["rt-2"];
+		clock = 1000;
+		const t2 = await s.refresh(t1.refresh_token);
+		expect(t2.refresh_token).toBe("rt-2");
+		expect(t2.access_token).toBe(t1.access_token); // 同 sub，签名恒定（fake）
+		expect(Number(refreshRow("rt-1")?.revoked)).toBe(1);
+		expect(Number(refreshRow("rt-2")?.revoked)).toBe(0);
+	});
+
+	it("reuse 检测：已吊销串二次出现 → 全族吊销 + 审计 auth.refresh.reuse + 401", async () => {
+		mkUser("s_ivy", { pw: "secret1" });
+		const s = createSession(deps());
+		randomSeq = ["rt-a"];
+		const t1 = await s.localLogin("s_ivy", "secret1");
+		randomSeq = ["rt-b"];
+		await s.refresh(t1.refresh_token); // rt-a 作旧，rt-b 活跃
+		randomSeq = ["rt-c"];
+		await expect(s.refresh(t1.refresh_token)).rejects.toMatchObject({ status: 401 }); // 重放 rt-a
+		// 全族吊销：rt-b 也被删
+		expect(refreshRow("rt-b")).toBeUndefined();
+		const audit = dbo.prepare("SELECT * FROM sys_oplog WHERE action = 'auth.refresh.reuse'").all();
+		expect(audit.length).toBe(1);
+	});
+
+	it("过期串 → 401（now 推进过 expires_at）", async () => {
+		mkUser("s_jack", { pw: "secret1" });
+		clock = 0;
+		const s = createSession(deps());
+		randomSeq = ["rt-x"];
+		const t1 = await s.localLogin("s_jack", "secret1");
+		clock = 31 * 24 * 3600;
+		await expect(s.refresh(t1.refresh_token)).rejects.toMatchObject({ status: 401 });
+	});
+
+	it("滑动窗口封顶：新 exp = min(旧 exp, now + 30d)", async () => {
+		mkUser("s_kate", { pw: "secret1" });
+		clock = 0;
+		const s = createSession(deps());
+		randomSeq = ["rt-p"];
+		const t1 = await s.localLogin("s_kate", "secret1");
+		clock = 10 * 24 * 3600; // 第 10 天刷新
+		randomSeq = ["rt-q"];
+		await s.refresh(t1.refresh_token);
+		const cap = 30 * 24 * 3600; // 旧 exp（绝对 30d）
+		expect(Number(refreshRow("rt-q")?.expires_at)).toBe(Math.min(cap, clock + 30 * 24 * 3600));
+	});
+
+	it("吊销联动：revokeAll 后旧串失效（禁用/改密级联的底层）", async () => {
+		const uid = mkUser("s_leo", { pw: "secret1" });
+		const s = createSession(deps());
+		randomSeq = ["rt-m"];
+		const t1 = await s.localLogin("s_leo", "secret1");
+		await s.revokeAll(uid);
+		await expect(s.refresh(t1.refresh_token)).rejects.toMatchObject({ status: 401 });
+	});
+});

package/templates/api/tests/auth-throttle.spec.ts

@@ -0,0 +1,74 @@
+// BDD：登录限速——AC1-26 同 (IP, username) 连败阈值 → 429 + 指数 backoff；
+// 阻塞期内尝试继续累加并指数延长（防阻断期无脑重试）；成功清零。
+// 反常识回归锚点：oj 每请求重建模块实例，进程内 Map 方案真实运行时恒失效——
+// 本用例跑真实迁移建出的 sys_login_throttle 表，断言落库语义。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+
+import { loginBlocked, loginFailed, loginSucceeded, resetLoginThrottle } from "../src/_platform/_shared/service/rate";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+let NOW = 0;
+
+const OPTS = { threshold: 6, baseBackoffMs: 15_000, now: () => NOW };
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(async () => {
+	await resetLoginThrottle();
+	NOW = 0;
+});
+
+describe("AC1-26：连败阈值与指数 backoff（DB 状态）", () => {
+	it("前 5 次失败不阻塞，第 6 次失败后第 7 次尝试 429（该次尝试即延长一档）", async () => {
+		for (let i = 0; i < 5; i++)
+			expect(await loginFailed("ip|bob", OPTS)).toBe(i + 1);
+		expect(await loginFailed("ip|bob", OPTS)).toBe(6); // 第 6 次失败 → 触发 base 阻断
+		NOW += 1;
+		// 第 7 次尝试：429；尝试本身累加失败并把 backoff 延长到 base×2
+		await expect(loginBlocked("ip|bob", OPTS)).rejects.toMatchObject({ status: 429, retryAfterMs: 30_000 });
+	});
+
+	it("指数延长：阻塞期内继续尝试 backoff ×2（30s → 60s）", async () => {
+		for (let i = 0; i < 6; i++)
+			await loginFailed("ip|amy", OPTS);
+		NOW += 1;
+		await expect(loginBlocked("ip|amy", OPTS)).rejects.toMatchObject({ retryAfterMs: 30_000 }); // 第 7 次尝试
+		NOW += 1000; // 仍在 30s 窗口内
+		await expect(loginBlocked("ip|amy", OPTS)).rejects.toMatchObject({ retryAfterMs: 60_000 });
+	});
+
+	it("backoff 窗口过后放行且计数保留（再败一次即重回阻断）", async () => {
+		for (let i = 0; i < 6; i++)
+			await loginFailed("ip|dan", OPTS);
+		NOW += 16_000; // 15s backoff 过期
+		await loginBlocked("ip|dan", OPTS); // 不抛（窗口已过，count=6 保留）
+		expect(await loginFailed("ip|dan", OPTS)).toBe(7); // 再来一次失败 → 立即重回阻断
+		await expect(loginBlocked("ip|dan", OPTS)).rejects.toMatchObject({ status: 429 });
+	});
+
+	it("成功清零：loginSucceeded 后同 key 不再阻塞", async () => {
+		for (let i = 0; i < 6; i++)
+			await loginFailed("ip|eve", OPTS);
+		await loginSucceeded("ip|eve");
+		await loginBlocked("ip|eve", OPTS); // 不抛
+	});
+
+	it("不同 (IP, username) 互不影响", async () => {
+		for (let i = 0; i < 6; i++)
+			await loginFailed("ip1|x", OPTS);
+		await loginBlocked("ip2|x", OPTS); // 不同 IP 不抛
+		await loginBlocked("ip1|y", OPTS); // 不同 username 不抛
+	});
+
+	it("状态落库：连败计数与阻断窗口在 sys_login_throttle 可查（跨请求语义的存证）", async () => {
+		for (let i = 0; i < 6; i++)
+			await loginFailed("ip|db", OPTS);
+		const row = dbo.prepare("SELECT fail_count, blocked_until FROM sys_login_throttle WHERE pair_key = 'ip|db'").get() as { fail_count: number, blocked_until: number };
+		expect(row.fail_count).toBe(6);
+		expect(row.blocked_until).toBe(15_000); // base × 2^0
+	});
+});