@oj-module/cli 0.1.21 → 0.2.1

package/templates/api/tests/fixture.ts

@@ -0,0 +1,50 @@
+// 后端 BDD 夹具：node:sqlite 内存库 + **真实迁移文件**建表，装到 globalThis.db——
+// 与 oj 运行时注入的全局同名同面（query/exec/tx/dialect），service 代码不改一行即可被测。
+// 夹具直接读 api/src/<模块>/migrations/*.sql，与迁移不可能漂移（沿用 oj-wiki 先例）。
+import { createRequire } from "node:module";
+
+const req = createRequire(import.meta.url);
+const { DatabaseSync } = req("node:sqlite");
+const { readdirSync, readFileSync, existsSync } = req("node:fs");
+const { join, dirname } = req("node:path");
+const { fileURLToPath } = req("node:url");
+
+const SRC = join(dirname(fileURLToPath(import.meta.url)), "..", "src");
+
+export const ADMIN = 1;
+
+/** 建内存库 + 注入全局；返回 DatabaseSync 供用例直插数据/断言。 */
+export function installDb(): any {
+	const dbo = new DatabaseSync(":memory:");
+	// 重放 src 下全部模块的迁移（方言专属文件除外）
+	for (const mod of readdirSync(SRC)) {
+		const dir = join(SRC, mod, "migrations");
+		if (!existsSync(dir))
+			continue;
+		for (const f of readdirSync(dir).filter((f: string) => f.endsWith(".sql") && !/\.(?:mysql|pg)\.sql$/.test(f)).sort())
+			dbo.exec(readFileSync(join(dir, f), "utf8"));
+	}
+
+	dbo.prepare("INSERT INTO users (id, username, password_hash) VALUES (?, ?, 'x')").run(ADMIN, "admin");
+
+	const query = async (sql: string, params: unknown[] = []) => dbo.prepare(sql).all(...(params as never[]));
+	const exec = async (sql: string, params: unknown[] = []) => Number(dbo.prepare(sql).run(...(params as never[])).changes);
+	const txInstance = { query, exec, isTx: true };
+	// db.tx 镜像运行时面：BEGIN/COMMIT/ROLLBACK 包裹回调（versions.ts 注释同语义）
+	const tx = async (fn: (t: typeof txInstance) => unknown) => {
+		dbo.exec("BEGIN");
+		try {
+			const r = await fn(txInstance);
+			dbo.exec("COMMIT");
+			return r;
+		}
+		catch (e) {
+			dbo.exec("ROLLBACK");
+			throw e;
+		}
+	};
+
+	const g = globalThis as any;
+	g.db = { query, exec, tx, dialect: () => "sqlite" };
+	return dbo;
+}

package/templates/api/tests/guard.spec.ts

@@ -0,0 +1,62 @@
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+// BDD：判权四级链（设计文档 §4，验收锚点 AC1-1~6）+ spike 夹具冒烟
+// （真实迁移建表 / 运行时全局 db 同面 / 事务往返）——S0 spike 的「一条真实判权 AC + 形态证明」。
+import { beforeAll, describe, expect, it } from "vitest";
+
+import { decideAccess, moduleOf } from "../src/_platform/_shared/service/guard";
+import { ADMIN, installDb } from "./fixture";
+
+const as = (roles: string[], bindings: Record<string, string[]> = {}) => ({ roles, bindings });
+
+describe("判权四级链（AC1-1~6 判定矩阵）", () => {
+	it("AC1-1 平台超集：superadmin 未绑定任何权限点 → 通过", () => {
+		expect(decideAccess(as(["superadmin"]), "wiki.doc.create")).toBe(true);
+	});
+	it("AC1-2 系统超集：admin 未绑定任何权限点 → 通过", () => {
+		expect(decideAccess(as(["admin"]), "wiki.doc.create")).toBe(true);
+	});
+	it("AC1-3 模块超集（零配置推导）：wiki.admin 过 wiki.*", () => {
+		expect(decideAccess(as(["wiki.admin"]), "wiki.doc.create")).toBe(true);
+	});
+	it("AC1-4 模块超集不外溢：wiki.admin 不过 crm.*", () => {
+		expect(decideAccess(as(["wiki.admin"]), "crm.contact.create")).toBe(false);
+	});
+	it("AC1-5 精确命中：wiki.editor 经绑定过 wiki.doc.create", () => {
+		expect(decideAccess(as(["wiki.editor"], { "wiki.editor": ["wiki.doc.create"] }), "wiki.doc.create")).toBe(true);
+	});
+	it("AC1-6 无权限：viewer 无绑定 → false（handler 层转 403）", () => {
+		expect(decideAccess(as(["viewer"]), "wiki.doc.create")).toBe(false);
+	});
+	it("code 首段推导：无点 code 整体即模块名", () => {
+		expect(moduleOf("wiki")).toBe("wiki");
+		expect(moduleOf("wiki.doc.create")).toBe("wiki");
+	});
+});
+
+describe("spike 夹具冒烟：真实迁移 + 运行时全局面 + 事务", () => {
+	let dbo: ReturnType<typeof installDb>;
+	beforeAll(() => {
+		dbo = installDb();
+	});
+	it("真实迁移建 users 表（夹具与迁移不漂移）", () => {
+		const row = dbo.prepare("SELECT username FROM users WHERE id = ?").get(ADMIN) as { username: string };
+		expect(row.username).toBe("admin");
+	});
+	it("全局 db.query/exec 与运行时同面可用", async () => {
+		const rows = await db.query("SELECT id, username FROM users");
+		expect(rows.length).toBeGreaterThan(0);
+	});
+	it("db.tx 事务往返：提交持久化 / 回滚不留痕", async () => {
+		await db.tx(async (t) => {
+			await t.exec("INSERT INTO users (username, password_hash) VALUES ('tx-ok', 'x')");
+		});
+		const ok = dbo.prepare("SELECT COUNT(*) AS n FROM users WHERE username = 'tx-ok'").get() as { n: number };
+		expect(Number(ok.n)).toBe(1);
+		await expect(db.tx(async (t) => {
+			await t.exec("INSERT INTO users (username, password_hash) VALUES ('tx-bad', 'x')");
+			throw new Error("rollback");
+		})).rejects.toThrow("rollback");
+		const bad = dbo.prepare("SELECT COUNT(*) AS n FROM users WHERE username = 'tx-bad'").get() as { n: number };
+		expect(Number(bad.n)).toBe(0);
+	});
+});

package/templates/api/tests/query-utils.spec.ts

@@ -0,0 +1,68 @@
+// BDD：查询工具——paginate（limit 钳 200 / truncated）+ likePattern（keyword≥2、LIKE 转义）。
+// AC 锚点：AC1-24（钳制与截断）、AC1-22（keyword<2 → 400）。ESCAPE '!' 三方言同语义（sqlite/mysql/pg）。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import { beforeAll, describe, expect, it } from "vitest";
+
+import { likePattern, paged } from "../src/_platform/_shared/service/query";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+
+beforeAll(() => {
+	dbo = installDb();
+	for (let i = 1; i <= 300; i++)
+		dbo.prepare("INSERT INTO users (username, password_hash) VALUES (?, 'x')").run(`u${String(i).padStart(3, "0")}`);
+});
+
+const LIST = "select id, username from users where 1=1";
+const COUNT = "select count(*) as c from users where 1=1";
+
+describe("AC1-24：limit 钳制与截断标记", () => {
+	it("size 静默钳 200，truncated=true（库 301 人=夹具 admin+300）", async () => {
+		const r = await paged<any>(LIST, COUNT, [], { page: 1, size: 500 });
+		expect(r.size).toBe(200);
+		expect(r.list.length).toBe(200);
+		expect(r.total).toBe(301);
+		expect(r.truncated).toBe(true);
+	});
+
+	it("末页 truncated=false", async () => {
+		const r = await paged<any>(LIST, COUNT, [], { page: 2, size: 200 });
+		expect(r.list.length).toBe(101);
+		expect(r.truncated).toBe(false);
+	});
+
+	it("缺省 page=1 / size=20；页码/尺寸非法值回落（0/负数/非数）", async () => {
+		const d = await paged<any>(LIST, COUNT, [], {});
+		expect(d.page).toBe(1);
+		expect(d.size).toBe(20);
+		const bad = await paged<any>(LIST, COUNT, [], { page: 0, size: -3 });
+		expect(bad.page).toBe(1);
+		expect(bad.size).toBe(20);
+	});
+});
+
+describe("AC1-22：LIKE 模式与 keyword 长度红线", () => {
+	it("keyword <2 字符 → 400", () => {
+		expect(() => likePattern("张")).toThrowError(expect.objectContaining({ status: 400 }));
+	});
+
+	it("keyword >64 字符 → 400", () => {
+		expect(() => likePattern("x".repeat(65))).toThrowError(expect.objectContaining({ status: 400 }));
+	});
+
+	it("LIKE 元字符转义：% _ ! 原样匹配不泛化", async () => {
+		dbo.prepare("INSERT INTO users (username, password_hash) VALUES ('a%b_c!d', 'x')").run();
+		const r = await paged<any>(
+			"select id, username from users where username like ? escape '!'",
+			"select count(*) as c from users where username like ? escape '!'",
+			[likePattern("a%b_c!d")],
+			{ size: 10 },
+		);
+		expect(r.list.map((x: any) => x.username)).toEqual(["a%b_c!d"]);
+	});
+
+	it("正常 keyword 两侧包裹 %", () => {
+		expect(likePattern("张三")).toBe("%张三%");
+	});
+});

package/templates/api/tests/rbac-audit.spec.ts

@@ -0,0 +1,105 @@
+// BDD：审计出口——recordOp 落 sys_oplog 契约、auditOp fire-and-forget、403 分钟窗口聚合（AC1-29）。
+// 夹具即真实库：断言 sys_oplog 行内容；fire-and-forget 用「DB 损坏也不抛出」验证。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/_shared/service/audit";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+const g = globalThis as any;
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	vi.restoreAllMocks();
+	vi.useRealTimers();
+	g.http = {};
+	resetDenyAudit();
+	dbo.exec("DELETE FROM sys_oplog");
+});
+
+function rows() {
+	return dbo.prepare("SELECT * FROM sys_oplog ORDER BY id").all() as Record<string, unknown>[];
+}
+
+describe("recordOp：sys_oplog 落表契约", () => {
+	it("写全字段：action/module/version/target/detail(level=6 默认)", async () => {
+		g.http = { user: { id: 1 } }; // fixture admin（username='admin'）
+		await recordOp({
+			action: "role.create",
+			module: "framework",
+			version: "0.2.0",
+			target: "custom.ops",
+			detail: { title: "运维" },
+		});
+		const [r] = rows();
+		expect(r.action).toBe("role.create");
+		expect(r.module).toBe("framework");
+		expect(r.version).toBe("0.2.0");
+		expect(r.target).toBe("custom.ops");
+		expect(JSON.parse(String(r.detail))).toEqual({ title: "运维" });
+		expect(Number(r.level)).toBe(6);
+		expect(Number(r.user_id)).toBe(1);
+		expect(r.username).toBe("admin");
+		expect(Number(r.create_time)).toBeGreaterThan(0);
+	});
+
+	it("无用户（系统动作）→ username='system'、user_id=0", async () => {
+		await recordOp({ action: "solution.uninstall", module: "framework" });
+		const [r] = rows();
+		expect(r.username).toBe("system");
+		expect(Number(r.user_id)).toBe(0);
+	});
+});
+
+describe("auditOp：fire-and-forget", () => {
+	it("正常落表", async () => {
+		g.http = { user: { id: 1 } };
+		auditOp({ action: "user.roles.update", module: "framework", target: "u2" });
+		await vi.waitFor(() => expect(rows().length).toBe(1));
+	});
+
+	it("DB 失败也不抛出（不阻断业务主链）", async () => {
+		g.http = { user: { id: 1 } };
+		vi.spyOn(g.db, "exec").mockRejectedValueOnce(new Error("db down"));
+		expect(() => auditOp({ action: "x.y", module: "framework" })).not.toThrow();
+		await new Promise(r => setImmediate(r));
+	});
+});
+
+describe("AC1-29：403 失败审计分钟窗口聚合（首条 + 计数，不逐条落表）", () => {
+	it("同 (user, code) 连续拒绝 3 次 → 1 行，detail.count=3", async () => {
+		g.http = { user: { id: 1 } };
+		auditDeny("wiki.page.delete");
+		auditDeny("wiki.page.delete");
+		auditDeny("wiki.page.delete");
+		await vi.waitFor(() => {
+			const rs = rows();
+			if (rs.length === 1 && JSON.parse(String(rs[0].detail)).count === 3)
+				return;
+			throw new Error("not yet");
+		});
+		expect(rows().length).toBe(1);
+	});
+
+	it("窗口过期（>60s）后首条另起一行", async () => {
+		g.http = { user: { id: 1 } };
+		auditDeny("wiki.page.delete");
+		await vi.waitFor(() => expect(rows().length).toBe(1));
+		vi.setSystemTime(Date.now() + 61_000);
+		auditDeny("wiki.page.delete");
+		await vi.waitFor(() => expect(rows().length).toBe(2));
+	});
+
+	it("不同 code / 不同用户各自独立聚合", async () => {
+		g.http = { user: { id: 1 } };
+		auditDeny("wiki.page.delete");
+		auditDeny("wiki.page.edit");
+		g.http = { user: { id: 2 } };
+		auditDeny("wiki.page.delete");
+		await vi.waitFor(() => expect(rows().length).toBe(3));
+	});
+});

package/templates/api/tests/rbac-contacts.spec.ts

@@ -0,0 +1,85 @@
+// BDD：通讯录——searchContacts 目录（AC1-22/23）+ contactDetail 详情 + 接口级限速。
+// 读模型红线：目录只出 id/username/display_name（无 email/avatar/roles，安全评审 P2）；
+// 禁用用户不出目录（AC1-23）；keyword≥2（AC1-22）；limit 钳 200（AC1-24）。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+import { contactDetail, searchContacts } from "../src/_platform/_shared/service/contacts";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+const g = globalThis as any;
+
+function mkUser(username: string, opts: { displayName?: string, email?: string, forbidden?: boolean } = {}): number {
+	dbo.prepare("INSERT INTO users (username, password_hash, display_name, email, is_forbidden) VALUES (?, 'x', ?, ?, ?)")
+		.run(username, opts.displayName ?? null, opts.email ?? null, opts.forbidden ? 1 : 0);
+	return (dbo.prepare("SELECT id FROM users WHERE username = ?").get(username) as { id: number }).id;
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	vi.useRealTimers();
+	g.http = {};
+	dbo.exec("DELETE FROM users WHERE username LIKE 'c%'");
+});
+
+describe("AC1-22：登录可读的字段最小集", () => {
+	it("keyword 命中 username/display_name；返回仅 id/username/display_name", async () => {
+		mkUser("c_zhang", { displayName: "张三" });
+		mkUser("c_li", { displayName: "张三丰" });
+		mkUser("c_wang", { displayName: "王五" });
+		const byName = await searchContacts("c_zhang");
+		expect(byName.length).toBe(1);
+		expect(byName[0]).toEqual({ id: byName[0].id, username: "c_zhang", display_name: "张三" });
+		const byDisplay = await searchContacts("张三");
+		expect(byDisplay.map(u => u.username).sort()).toEqual(["c_li", "c_zhang"]);
+	});
+
+	it("keyword <2 字符 → 400", async () => {
+		await expect(searchContacts("张")).rejects.toMatchObject({ status: 400 });
+	});
+});
+
+describe("AC1-23：禁用用户不出目录", () => {
+	it("is_forbidden=1 不出现在结果中", async () => {
+		mkUser("c_carol", { displayName: "卡罗" });
+		mkUser("c_dave", { displayName: "卡罗 dave", forbidden: true });
+		const r = await searchContacts("卡罗");
+		expect(r.map(u => u.username)).toEqual(["c_carol"]);
+	});
+});
+
+describe("AC1-24：limit 钳制", () => {
+	it("默认钳 200；传 500 静默钳 200", async () => {
+		for (let i = 0; i < 210; i++)
+			mkUser(`c_bulk${i}`);
+		const r = await searchContacts("c_bulk", { limit: 500 });
+		expect(r.length).toBe(200);
+	});
+});
+
+describe("详情与限速", () => {
+	it("contactDetail 含 email/avatar（目录不带的字段详情给）", async () => {
+		const uid = mkUser("c_eve", { email: "eve@example.com" });
+		dbo.prepare("UPDATE users SET avatar_base64 = 'aGVsbG8=' WHERE id = ?").run(uid);
+		const d = await contactDetail(uid);
+		expect(d.username).toBe("c_eve");
+		expect(d.email).toBe("eve@example.com");
+		expect(d.avatar_base64).toBe("aGVsbG8=");
+	});
+
+	it("接口级限速：同用户突发超限 → 429", async () => {
+		const uid = mkUser("c_rate");
+		g.http = { user: { id: uid } };
+		const { rateLimit } = await import("../src/_platform/_shared/service/rate");
+		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
+		for (let i = 0; i < 3; i++)
+			await rateLimit(`contacts:${uid}`, 3, 60_000);
+		await expect(rateLimit(`contacts:${uid}`, 3, 60_000)).rejects.toMatchObject({ status: 429 });
+		vi.setSystemTime(Date.now() + 61_000);
+		await rateLimit(`contacts:${uid}`, 3, 60_000); // 窗口过期放行
+	});
+});

package/templates/api/tests/rbac-guard.spec.ts

@@ -0,0 +1,192 @@
+// BDD：判权出口——assertPermission 四级链（DB 权威源）+ 撤销即强退 + is_forbidden + 系统管理员断言。
+// AC 锚点：AC1-1~6（判定矩阵走 DB 全链路）、AC1-9（assertSystemAdmin/assertSuperAdmin）、D10（缓存失效=撤销即强退）。
+// 夹具即真实库：角色/绑定/禁用态全部 INSERT 进 sqlite，断言走 service 公开出口（不 mock 判定）。
+/* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/_shared/service/access";
+import { installDb } from "./fixture";
+
+let dbo: ReturnType<typeof installDb>;
+const g = globalThis as any;
+
+/** 造用户（users 必填列最小集），返回 id。 */
+function mkUser(username: string, opts: { forbidden?: boolean } = {}): number {
+	dbo.prepare("INSERT INTO users (username, password_hash, is_forbidden) VALUES (?, 'x', ?)")
+		.run(username, opts.forbidden ? 1 : 0);
+	return (dbo.prepare("SELECT id FROM users WHERE username = ?").get(username) as { id: number }).id;
+}
+
+function bindRole(userId: number, role: string) {
+	dbo.prepare("INSERT OR IGNORE INTO sys_user_role (user_id, role_name) VALUES (?, ?)").run(userId, role);
+}
+
+function grant(role: string, code: string, module = "wiki") {
+	dbo.prepare("INSERT OR IGNORE INTO sys_permission (code, module) VALUES (?, ?)").run(code, module);
+	dbo.prepare("INSERT OR IGNORE INTO sys_role_permission (role_name, permission_code) VALUES (?, ?)").run(role, code);
+}
+
+function asUser(userId: number | undefined) {
+	g.http = userId === undefined ? {} : { user: { id: userId } };
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	invalidateAll();
+	asUser(undefined);
+	vi.useRealTimers();
+});
+
+/** 每用例清空缓存与 RBAC 数据（users 保留，fixture admin id=1 无角色）。 */
+function invalidateAll() {
+	for (const r of dbo.prepare("SELECT id FROM users").all() as { id: number }[])
+		invalidateUser(r.id);
+	dbo.exec("DELETE FROM sys_user_role");
+	dbo.exec("DELETE FROM sys_role_permission");
+	dbo.exec("DELETE FROM sys_permission");
+}
+
+describe("AC1-1~6：四级链经 DB 权威源判定", () => {
+	it("AC1-1 superadmin 通过任意 code（无需绑定）", async () => {
+		const uid = mkUser("u1");
+		bindRole(uid, "superadmin");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.delete")).resolves.toBeUndefined();
+	});
+
+	it("AC1-2 admin 通过任意 code（无需绑定）", async () => {
+		const uid = mkUser("u2");
+		bindRole(uid, "admin");
+		asUser(uid);
+		await expect(assertPermission("any.thing")).resolves.toBeUndefined();
+	});
+
+	it("AC1-3 持 <模块>.admin 通过该模块全部 code（零配置推导）", async () => {
+		const uid = mkUser("u3");
+		bindRole(uid, "wiki.admin");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.edit")).resolves.toBeUndefined();
+	});
+
+	it("AC1-3 负例：<模块>.admin 不越权其他模块", async () => {
+		const uid = mkUser("u3n");
+		bindRole(uid, "wiki.admin");
+		asUser(uid);
+		await expect(assertPermission("blog.page.edit")).rejects.toMatchObject({ status: 403 });
+	});
+
+	it("AC1-4 角色绑定精确命中 code 即通过", async () => {
+		const uid = mkUser("u4");
+		bindRole(uid, "editor");
+		grant("editor", "wiki.page.edit");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.edit")).resolves.toBeUndefined();
+	});
+
+	it("AC1-5 绑定未命中即 403", async () => {
+		const uid = mkUser("u5");
+		bindRole(uid, "editor");
+		grant("editor", "wiki.page.edit");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.delete")).rejects.toMatchObject({ status: 403 });
+	});
+
+	it("AC1-6 deprecated 权限点判权不过滤（已绑定角色照常通过）", async () => {
+		const uid = mkUser("u6");
+		bindRole(uid, "editor");
+		grant("editor", "wiki.legacy");
+		dbo.prepare("UPDATE sys_permission SET deprecated = 1 WHERE code = 'wiki.legacy'").run();
+		asUser(uid);
+		await expect(assertPermission("wiki.legacy")).resolves.toBeUndefined();
+	});
+});
+
+describe("D10：撤销即强退（写时失效，TTL 不挡撤销）", () => {
+	it("撤销绑定 + invalidateUser → 下一次请求即 403", async () => {
+		const uid = mkUser("u7");
+		bindRole(uid, "editor");
+		grant("editor", "wiki.page.edit");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.edit")).resolves.toBeUndefined();
+		dbo.prepare("DELETE FROM sys_role_permission WHERE role_name = 'editor'").run();
+		invalidateUser(uid);
+		await expect(assertPermission("wiki.page.edit")).rejects.toMatchObject({ status: 403 });
+	});
+
+	it("TTL 兜底：写后未失效时缓存命中（10s 内不重复查库语义）", async () => {
+		const uid = mkUser("u8");
+		bindRole(uid, "editor");
+		grant("editor", "wiki.page.edit");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.edit")).resolves.toBeUndefined();
+		// 未失效：即使库中已撤销，缓存仍放行（写路径负责失效，TTL 只兜崩溃）
+		dbo.prepare("DELETE FROM sys_role_permission WHERE role_name = 'editor'").run();
+		await expect(assertPermission("wiki.page.edit")).resolves.toBeUndefined();
+	});
+
+	it("TTL 到期后重查库", async () => {
+		const uid = mkUser("u9");
+		bindRole(uid, "editor");
+		grant("editor", "wiki.page.edit");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.edit")).resolves.toBeUndefined();
+		dbo.prepare("DELETE FROM sys_role_permission WHERE role_name = 'editor'").run();
+		vi.setSystemTime(Date.now() + 11_000);
+		await expect(assertPermission("wiki.page.edit")).rejects.toMatchObject({ status: 403 });
+	});
+});
+
+describe("禁用与未认证", () => {
+	it("is_forbidden=1 即拒（持 superadmin 也不例外）", async () => {
+		const uid = mkUser("u10", { forbidden: true });
+		bindRole(uid, "superadmin");
+		asUser(uid);
+		await expect(assertPermission("wiki.page.edit")).rejects.toMatchObject({ status: 403 });
+	});
+
+	it("未认证（无 http.user）即拒", async () => {
+		asUser(undefined);
+		await expect(assertPermission("wiki.page.edit")).rejects.toMatchObject({ status: 403 });
+	});
+});
+
+describe("AC1-9：系统管理员断言（D11）", () => {
+	it("assertSystemAdmin：admin 通过、editor 403、superadmin 通过", async () => {
+		const admin = mkUser("u11a");
+		bindRole(admin, "admin");
+		asUser(admin);
+		await expect(assertSystemAdmin()).resolves.toBeUndefined();
+
+		const editor = mkUser("u11b");
+		bindRole(editor, "editor");
+		asUser(editor);
+		await expect(assertSystemAdmin()).rejects.toMatchObject({ status: 403 });
+
+		const sup = mkUser("u11c");
+		bindRole(sup, "superadmin");
+		asUser(sup);
+		await expect(assertSystemAdmin()).resolves.toBeUndefined();
+	});
+
+	it("assertSuperAdmin：admin 也 403（安全敏感项边界，D11）", async () => {
+		const admin = mkUser("u12a");
+		bindRole(admin, "admin");
+		asUser(admin);
+		await expect(assertSuperAdmin()).rejects.toMatchObject({ status: 403 });
+
+		const sup = mkUser("u12b");
+		bindRole(sup, "superadmin");
+		asUser(sup);
+		await expect(assertSuperAdmin()).resolves.toBeUndefined();
+	});
+
+	it("断言出口同样吃 is_forbidden（禁用超管立即全拒）", async () => {
+		const sup = mkUser("u13", { forbidden: true });
+		bindRole(sup, "superadmin");
+		asUser(sup);
+		await expect(assertSuperAdmin()).rejects.toMatchObject({ status: 403 });
+	});
+});