@oj-module/cli 0.2.20 → 0.2.23

package/templates/src/oj-market/web/components/RollbackDialog.tsx

@@ -1,6 +1,6 @@
 import type { IndexRow } from "../types";
 import { Alert, Modal, Radio, Space, Spin, Typography } from "antd";
-import React, { useEffect, useMemo, useState } from "react";
+import React, { useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useMarketHistory } from "../hooks/useMarket";
 import { compareVersions } from "../utils/semver";
@@ -34,9 +34,13 @@ export function RollbackDialog({ row, open, onClose, onRollback }: RollbackDialo
 		return [...versions].sort((a, b) => compareVersions(b, a)); // 较新的旧版在前
 	}, [row, status, data]);
 
-	useEffect(() => {
+	// 候选集变化（历史加载完成/切换方案）时默认选中最新旧版；
+	// 渲染期同步派生重置，替代 effect 内同步 set（react/set-state-in-effect）
+	const [prevCandidates, setPrevCandidates] = useState(candidates);
+	if (prevCandidates !== candidates) {
+		setPrevCandidates(candidates);
 		setSelected(candidates.length ? candidates[0] : null);
-	}, [candidates]);
+	}
 
 	const loading = status === "loading";
 

package/templates/src/oj-market/web/components/UninstallConfirm.tsx

@@ -19,22 +19,33 @@ export function UninstallConfirm({ row, open, onClose, onConfirmed }: UninstallC
 	const { t } = useTranslation();
 	const client = useMarketClient();
 	const [impact, setImpact] = useState<UninstallImpact | null>(null);
-	const [loading, setLoading] = useState(false);
 	const [error, setError] = useState<string | null>(null);
 
+	// 打开（或切换方案）即清场上一轮结果；渲染期同步派生重置，替代 effect 内同步 set
+	const rowKey = open && row ? row.name : null;
+	const [prevRowKey, setPrevRowKey] = useState(rowKey);
+	if (prevRowKey !== rowKey) {
+		setPrevRowKey(rowKey);
+		setImpact(null);
+		setError(null);
+	}
+
 	useEffect(() => {
 		if (!open || !row)
 			return;
-		setLoading(true);
-		setError(null);
-		setImpact(null);
+		let active = true;
 		client
 			.uninstallImpact(row.name)
-			.then(setImpact)
-			.catch(e => setError(e instanceof Error ? e.message : String(e)))
-			.finally(() => setLoading(false));
+			.then(i => active && setImpact(i))
+			.catch(e => active && setError(e instanceof Error ? e.message : String(e)));
+		return () => {
+			active = false;
+		};
 	}, [open, row, client]);
 
+	// 加载态派生：已打开且尚无结果/错误即视为预检中（替代原 effect 同步 setLoading）
+	const loading = rowKey !== null && impact === null && error === null;
+
 	return (
 		<Modal
 			title={t("oj-market:confirm:uninstallTitle")}

package/templates/src/oj-market/web/hooks/useMarket.ts

@@ -12,10 +12,12 @@ export type LoadState<T> = { status: "loading", data?: undefined } | { status: "
 export function useMarketIndex(): LoadState<IndexRow[]> & { retry: () => void } {
 	const client = useMarketClient();
 	const [state, setState] = useState<LoadState<IndexRow[]>>({ status: "loading" });
+	// 重试不复跑「先同步 set loading 再拉取」的加载函数（effect 内同步 set 触发
+	// react/set-state-in-effect），改为事件里置 loading + 递增 nonce 驱动 effect 重跑。
+	const [nonce, setNonce] = useState(0);
 
-	const load = useCallback(() => {
+	useEffect(() => {
 		let active = true;
-		setState({ status: "loading" });
 		client
 			.index()
 			.then(data => active && setState({ status: "ok", data }))
@@ -23,11 +25,14 @@ export function useMarketIndex(): LoadState<IndexRow[]> & { retry: () => void }
 		return () => {
 			active = false;
 		};
-	}, [client]);
+	}, [client, nonce]);
 
-	useEffect(() => load(), [load]);
+	const retry = useCallback(() => {
+		setState({ status: "loading" });
+		setNonce(n => n + 1);
+	}, []);
 
-	return { ...state, retry: load };
+	return { ...state, retry };
 }
 
 /** 任务轮询：给定 task_id，800ms 轮询至终态（done/failed/partial）；超时不抛，返回当前值 */
@@ -39,17 +44,20 @@ export function useInstallTask(taskId: string | null): {
 	const [record, setRecord] = useState<TaskRecord | null>(null);
 	const [done, setDone] = useState(false);
 
+	// 无任务 id / 切换任务 = 尚无任务：清空上一次任务的记录，避免「重新安装/信任后重试」时
+	// 旧终态（可能是 needs_trust）残留在弹窗里被误读成本次结果。
+	// （渲染期同步派生重置，替代 effect 内同步 set，规避 react/set-state-in-effect）
+	const [prevTaskId, setPrevTaskId] = useState(taskId);
+	if (prevTaskId !== taskId) {
+		setPrevTaskId(taskId);
+		setRecord(null);
+		setDone(false);
+	}
+
 	useEffect(() => {
-		// 无任务 id = 尚无任务：清空上一次任务的记录，避免「重新安装/信任后重试」时
-		// 旧终态（可能是 needs_trust）残留在弹窗里被误读成本次结果。
-		if (!taskId) {
-			setRecord(null);
-			setDone(false);
+		if (!taskId)
 			return;
-		}
 		let active = true;
-		setRecord(null);
-		setDone(false);
 		poll(
 			() => client.task(taskId),
 			r => r.status !== "running",
@@ -80,10 +88,11 @@ export function useInstallTask(taskId: string | null): {
 export function useMarketHistory(): LoadState<MarketHistory[]> & { retry: () => void } {
 	const client = useMarketClient();
 	const [state, setState] = useState<LoadState<MarketHistory[]>>({ status: "loading" });
+	// 同 useMarketIndex：重试走 nonce 驱动，不在 effect 链路里同步 set
+	const [nonce, setNonce] = useState(0);
 
-	const load = useCallback(() => {
+	useEffect(() => {
 		let active = true;
-		setState({ status: "loading" });
 		client
 			.history()
 			.then(data => active && setState({ status: "ok", data }))
@@ -91,9 +100,12 @@ export function useMarketHistory(): LoadState<MarketHistory[]> & { retry: () =>
 		return () => {
 			active = false;
 		};
-	}, [client]);
+	}, [client, nonce]);
 
-	useEffect(() => load(), [load]);
+	const retry = useCallback(() => {
+		setState({ status: "loading" });
+		setNonce(n => n + 1);
+	}, []);
 
-	return { ...state, retry: load };
+	return { ...state, retry };
 }

package/templates/src/system/web/locales/en-US.json

@@ -30,7 +30,7 @@
 			"displayName": "Display Name",
 			"email": "Email",
 			"roles": "Roles",
-			"status": "Status",
+			"status": "Account status (forbidden / password change)",
 			"actions": "Actions"
 		}
 	},

package/templates/src/system/web/locales/zh-CN.json

@@ -30,7 +30,7 @@
 			"displayName": "显示名",
 			"email": "邮箱",
 			"roles": "角色",
-			"status": "状态",
+			"status": "账号状态（禁用/首登改密）",
 			"actions": "操作"
 		}
 	},

package/templates/tests/l1-builder.test.ts

@@ -11,8 +11,8 @@
 //   ③ notification：join ON 值条件 + UNION ALL + 字面量列 {lit,as} 的真渲染（场景 41 同款）。
 //
 // 登录账号：fixtures 的 l1tester（src/_platform/fixtures/l1-test-user.sql，仅 oj test 灌入）。
-// 不用 seed 的 admin：其 must_change=1（判权端点恒 403）且初始口令 123456 会随用户
-// 首登改密漂移——L1 绑 admin 曾实测 401。l1tester 为 additive 专用账号（must_change=0）。
+// 不用 seed 的 admin 等开发账号：初始口令 123456 会随用户在 dev 库改密漂移——
+// L1 绑 seed 账号曾实测 401。l1tester 为 additive 专用账号（must_change=0）。
 //
 // 运行：cd packages/cli/templates/api && ~/.local/share/oj/oj test -c config.yaml -d src -t tests
 

package/templates/tests/rbac-seed.spec.ts

@@ -1,7 +1,8 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-// BDD：seed 契约——框架内置角色 + seed 超管绑定 + must_change 首登改密（D12/AC1-27）。
+// BDD：seed 契约——框架内置角色 + 内置角色开发账号（账号名=角色名，must_change=0，
+// 2026-10-22 口径，替代原「admin 绑 superadmin + must_change=1」的 D12 旧钉）。
 // 夹具重放真实 migrations + seed.sql 文件，本 spec 即「seed 与文件不漂移」的钉子。
 import { beforeAll, describe, expect, it } from "vitest";
 
@@ -38,17 +39,18 @@ describe("框架内置角色（ROLES 常量单一真相，PRD §4.2）", () => {
 	});
 });
 
-describe("seed 超管（D12）", () => {
-	// AUTOINCREMENT 不复用 id（sqlite_sequence 语义），统一按 username 动态解析，不钉死 id
-	const adminId = () => (dbo.prepare("SELECT id FROM users WHERE username = 'admin'").get() as { id: number }).id;
-
-	it("admin 账号绑定 superadmin 角色（sys_user_role 权威源）", () => {
-		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = 'superadmin'").get(adminId());
+describe("seed 内置角色开发账号（账号名=角色名，2026-10-22 口径）", () => {
+	it.each(["superadmin", "admin", "editor", "viewer"])("账号 %s 绑定同名角色且 must_change=0", (name) => {
+		const uid = (dbo.prepare("SELECT id FROM users WHERE username = ?").get(name) as { id: number }).id;
+		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = ?").get(uid, name);
 		expect(row).toBeDefined();
+		const mc = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(uid) as { must_change: number };
+		expect(Number(mc.must_change)).toBe(0);
 	});
 
-	it("must_change=1：首登强制改密（AC1-27 前提）", () => {
-		const row = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(adminId()) as { must_change: number };
-		expect(Number(row.must_change)).toBe(1);
+	it("admin 不再绑 superadmin（旧 D12 绑定已被幂等 DELETE 收敛）", () => {
+		const uid = (dbo.prepare("SELECT id FROM users WHERE username = 'admin'").get() as { id: number }).id;
+		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = 'superadmin'").get(uid);
+		expect(row).toBeUndefined();
 	});
 });

package/templates/tests/seed-role-accounts.spec.ts

@@ -0,0 +1,87 @@
+// BDD：脚手架 seed 内置角色开发账号——账号名=角色名一一对应（superadmin/admin/editor/viewer），
+// 口令均 123456，must_change=0 免首登改密（纯开发便利，生产部署须改密/删除）。
+// 旧库收敛：历史 seed 把 admin 绑在 superadmin 且 must_change=1，seed 幂等重放即收敛
+// （DELETE 旧绑定 + UPDATE must_change=0），无需手工迁移。
+// 直接重放 _platform 迁移 + seed.sql 到内存 sqlite（installDb 不 replay seed，故自给自足）。
+// 方言对齐：seed.mysql.sql / seed.pg.sql 与基线同构，人工对齐不受本 spec 钉守——
+// 首条用例对三份文件做 INSERT 语法冒烟，防「INSERT IGNORE 错位」类事故回归。
+import type { DatabaseSync } from "node:sqlite";
+
+import { readdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { beforeAll, describe, expect, it } from "vitest";
+
+const req = createRequire(import.meta.url);
+const { DatabaseSync: Db } = req("node:sqlite") as { DatabaseSync: typeof DatabaseSync };
+
+const PLATFORM_API = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api");
+
+let dbo: InstanceType<typeof DatabaseSync>;
+
+/** 重放迁移 + seed（seed 按英文分号朴素切分，同 oj 运行时口径） */
+function replaySeed(): void {
+	for (const stmt of readFileSync(join(PLATFORM_API, "seed.sql"), "utf8").split(";")) {
+		const sql = stmt.trim();
+		if (sql)
+			dbo.exec(sql);
+	}
+}
+
+beforeAll(() => {
+	dbo = new Db(":memory:");
+	for (const f of readdirSync(join(PLATFORM_API, "migrations")).filter(f => f.endsWith(".sql") && !/\.(?:mysql|pg)\.sql$/.test(f)).sort())
+		dbo.exec(readFileSync(join(PLATFORM_API, "migrations", f), "utf8"));
+	replaySeed();
+});
+
+describe("seed 内置角色开发账号", () => {
+	it("方言文件 INSERT 语法冒烟：mysql 为 INSERT IGNORE 前缀、pg 为 ON CONFLICT 后缀", () => {
+		const mysql = readFileSync(join(PLATFORM_API, "seed.mysql.sql"), "utf8");
+		const pg = readFileSync(join(PLATFORM_API, "seed.pg.sql"), "utf8");
+		expect(mysql).not.toMatch(/INSERT INTO .*INSERT IGNORE/);
+		expect(mysql.match(/INSERT IGNORE INTO/g)!.length).toBeGreaterThanOrEqual(12);
+		expect(pg).not.toMatch(/INSERT IGNORE/);
+		expect(pg.match(/ON CONFLICT DO NOTHING/g)!.length).toBeGreaterThanOrEqual(12);
+	});
+
+	it.each(["superadmin", "admin", "editor", "viewer"])("账号 %s：must_change=0 且只绑定同名角色", (username) => {
+		const row = dbo.prepare("SELECT must_change FROM users WHERE username = ?").get(username) as { must_change: number };
+		expect(row).toBeDefined();
+		expect(Number(row.must_change)).toBe(0);
+		const roles = dbo.prepare("SELECT role_name FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = ?)").all(username) as Array<{ role_name: string }>;
+		expect(roles.map(r => r.role_name)).toEqual([username]);
+	});
+
+	it("四个角色账号口令一致（123456 的 bcrypt，复用 seed 既有哈希）", () => {
+		const hashes = dbo.prepare("SELECT username, password_hash h FROM users WHERE username IN ('superadmin','admin','editor','viewer')").all() as Array<{ username: string, h: string }>;
+		expect(new Set(hashes.map(r => r.h)).size).toBe(1);
+	});
+
+	it("旧库收敛：legacy admin(superadmin 绑定 + must_change=1) 经重放收敛为账号名=角色名", () => {
+		// 构造历史库状态：admin 绑 superadmin 且 must_change=1（旧 seed 口径），无 superadmin 账号
+		dbo.exec("DELETE FROM sys_user_role");
+		dbo.exec("DELETE FROM users");
+		dbo.prepare("INSERT INTO users (username, password_hash, must_change) VALUES ('admin', 'x', 1)").run();
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) SELECT id, 'superadmin' FROM users WHERE username = 'admin'").run();
+
+		replaySeed();
+
+		expect(Number((dbo.prepare("SELECT must_change m FROM users WHERE username = 'admin'").get() as { m: number }).m)).toBe(0);
+		const adminRoles = (dbo.prepare("SELECT role_name r FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = 'admin')").all() as Array<{ r: string }>).map(x => x.r);
+		expect(adminRoles).toEqual(["admin"]);
+		const superRoles = (dbo.prepare("SELECT role_name r FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = 'superadmin')").all() as Array<{ r: string }>).map(x => x.r);
+		expect(superRoles).toEqual(["superadmin"]);
+	});
+
+	it("幂等：重放两遍结果不变", () => {
+		const snap = () => JSON.stringify([
+			dbo.prepare("SELECT username, must_change FROM users ORDER BY username").all(),
+			dbo.prepare("SELECT user_id, role_name FROM sys_user_role ORDER BY user_id, role_name").all(),
+		]);
+		const before = snap();
+		replaySeed();
+		expect(snap()).toBe(before);
+	});
+});

package/vendor/host-versions.json

@@ -8,9 +8,9 @@
 		"react-router": "7.18.2",
 		"react-router/dom": "7.18.2",
 		"@tanstack/react-query": "5.102.8",
-		"@oj-module/runtime": "0.2.20",
-		"@oj-module/runtime/contract": "0.2.20",
-		"@oj-module/runtime/contract/errors": "0.2.20",
+		"@oj-module/runtime": "0.2.23",
+		"@oj-module/runtime/contract": "0.2.23",
+		"@oj-module/runtime/contract/errors": "0.2.23",
 		"@plane/kit": "0.1.20",
 		"@plane/editor": "0.1.20",
 		"antd": "6.6.1",