@oj-module/cli 0.2.20 → 0.2.25

package/templates/tests/lifecycle/market-api.spec.ts

@@ -331,6 +331,36 @@ describe("POST install（cdn：Form B 索引解析属市场侧，安装器不拼
 	});
 });
 
+describe("相对基址（feature：/cdn = 本站点自供，按请求源补全同源绝对 URL）", () => {
+	const REL = "/cdn";
+	const HOST = "127.0.0.1:9778";
+	const relEnv = () => makeEnv({ cdnBase: async () => REL });
+
+	it("index：索引与 .sig/manifests 拉取按请求 Host 补全为同源绝对 URL", async () => {
+		const api = createMarketApi(relEnv());
+		g.http = { user: { id: 1 }, headers: { host: HOST } };
+		await api.index.get();
+		expect(last?.status).toBe(200);
+		expect(fetchCalls).toContain(`http://${HOST}/cdn/bundles.yaml`);
+		expect(fetchCalls).toContain(`http://${HOST}/cdn/manifests.yaml`);
+	});
+
+	it("install：archive 分发包同样补全同源绝对 URL", async () => {
+		const api = createMarketApi(relEnv());
+		g.http = { user: { id: 1 }, body: { name: "demo-solution", version: "0.1.0", source: "cdn" }, headers: { host: HOST } };
+		await api.install.post();
+		expect(last?.status).toBe(200);
+		expect(fetchCalls).toContain(`http://${HOST}/cdn/demo-solution-0.1.0.tgz`);
+	});
+
+	it("无请求上下文（无 Host）：不猜原点，原样透传相对 URL", async () => {
+		const api = createMarketApi(relEnv());
+		g.http = { user: { id: 1 } };
+		await api.index.get();
+		expect(fetchCalls).toContain("/cdn/bundles.yaml");
+	});
+});
+
 describe("POST install/cancel（P3-12 端点接线，U5/P3-8 令牌的消费面）", () => {
 	it("无进行中安装 → 404（取消只对 running 态有效，任务终态后信号已注销）", async () => {
 		const api = createMarketApi(makeEnv());
@@ -858,12 +888,12 @@ describe("hostVersions 缺省接线（B-11：C2-09 比对真源 = <dist>/version
 });
 
 describe("P1-16 接线：marketEnv 生产口径 / exec opts 转发 / operator 通道 / 账本真源 / index 即对账入口", () => {
-	it("marketEnv() 缺省 = 布局 v2 生产口径：版本目录与 versions.json 在 release 根 api/dist，站点 modules 在 web/dist；暂存/任务/sidecar 留 jail 根", () => {
+	it("marketEnv() 缺省 = 布局 v3 生产口径：版本目录与 versions.json 在 release 根 dist/api，站点 modules 在 dist/web；暂存/任务/sidecar 留 jail 根", () => {
 		const env = marketEnv();
-		expect(env.sharedRoot).toBe("api/dist");
-		expect(env.siteModulesDir).toBe("web/dist/modules");
-		expect(env.modulesJsonPath).toBe("web/dist/modules.json");
-		expect(versionsJsonPathOf(env.sharedRoot)).toBe("api/dist/versions.json");
+		expect(env.sharedRoot).toBe("dist/api");
+		expect(env.siteModulesDir).toBe("dist/web/modules");
+		expect(env.modulesJsonPath).toBe("dist/web/modules.json");
+		expect(versionsJsonPathOf(env.sharedRoot)).toBe("dist/api/versions.json");
 		expect(env.staging).toBe("modules/.staging");
 		expect(env.taskDir).toBe("modules/.install-tasks");
 		expect(env.statePath).toBe("modules/.solutions/state.yaml");

package/templates/tests/lifecycle/verify-checks.spec.ts

@@ -278,7 +278,7 @@ function setHttp(over: Record<string, unknown>) {
 }
 
 function makeEnv() {
-	// modulesJsonPath 钉进临时目录（readFile 失败 → 不打 web 项）：默认值 `web/dist/modules.json`
+	// modulesJsonPath 钉进临时目录（readFile 失败 → 不打 web 项）：默认值 `dist/web/modules.json`
 	// 是相对 cwd 的，会把模板本机构建产物卷进用例，全绿用例随「模板 build 过没有」摇摆。
 	// P4-2 两条 integrity 用例显式覆盖它。
 	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), modulesJsonPath: join(root, "modules.json") };

package/templates/tests/lifecycle/verify-report.spec.ts

@@ -128,7 +128,7 @@ function setHttp(over: Record<string, unknown> = {}) {
 
 function makeEnv() {
 	// modulesJsonPath 同 verify-checks.spec：钉进临时目录（缺文件 → 跳过 web 项），
-	// 不吃模板本机 `web/dist/modules.json`。
+	// 不吃模板本机 `dist/web/modules.json`。
 	return { ...solutionsEnv(), sharedRoot: root, statePath: join(root, "state.yaml"), modulesJsonPath: join(root, "modules.json"), verifyReportsDir: reportsDir };
 }
 

package/templates/tests/rbac-seed.spec.ts

@@ -1,7 +1,8 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-// BDD：seed 契约——框架内置角色 + seed 超管绑定 + must_change 首登改密（D12/AC1-27）。
+// BDD：seed 契约——框架内置角色 + 内置角色开发账号（账号名=角色名，must_change=0，
+// 2026-10-22 口径，替代原「admin 绑 superadmin + must_change=1」的 D12 旧钉）。
 // 夹具重放真实 migrations + seed.sql 文件，本 spec 即「seed 与文件不漂移」的钉子。
 import { beforeAll, describe, expect, it } from "vitest";
 
@@ -38,17 +39,18 @@ describe("框架内置角色（ROLES 常量单一真相，PRD §4.2）", () => {
 	});
 });
 
-describe("seed 超管（D12）", () => {
-	// AUTOINCREMENT 不复用 id（sqlite_sequence 语义），统一按 username 动态解析，不钉死 id
-	const adminId = () => (dbo.prepare("SELECT id FROM users WHERE username = 'admin'").get() as { id: number }).id;
-
-	it("admin 账号绑定 superadmin 角色（sys_user_role 权威源）", () => {
-		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = 'superadmin'").get(adminId());
+describe("seed 内置角色开发账号（账号名=角色名，2026-10-22 口径）", () => {
+	it.each(["superadmin", "admin", "editor", "viewer"])("账号 %s 绑定同名角色且 must_change=0", (name) => {
+		const uid = (dbo.prepare("SELECT id FROM users WHERE username = ?").get(name) as { id: number }).id;
+		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = ?").get(uid, name);
 		expect(row).toBeDefined();
+		const mc = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(uid) as { must_change: number };
+		expect(Number(mc.must_change)).toBe(0);
 	});
 
-	it("must_change=1：首登强制改密（AC1-27 前提）", () => {
-		const row = dbo.prepare("SELECT must_change FROM users WHERE id = ?").get(adminId()) as { must_change: number };
-		expect(Number(row.must_change)).toBe(1);
+	it("admin 不再绑 superadmin（旧 D12 绑定已被幂等 DELETE 收敛）", () => {
+		const uid = (dbo.prepare("SELECT id FROM users WHERE username = 'admin'").get() as { id: number }).id;
+		const row = dbo.prepare("SELECT * FROM sys_user_role WHERE user_id = ? AND role_name = 'superadmin'").get(uid);
+		expect(row).toBeUndefined();
 	});
 });

package/templates/tests/seed-role-accounts.spec.ts

@@ -0,0 +1,87 @@
+// BDD：脚手架 seed 内置角色开发账号——账号名=角色名一一对应（superadmin/admin/editor/viewer），
+// 口令均 123456，must_change=0 免首登改密（纯开发便利，生产部署须改密/删除）。
+// 旧库收敛：历史 seed 把 admin 绑在 superadmin 且 must_change=1，seed 幂等重放即收敛
+// （DELETE 旧绑定 + UPDATE must_change=0），无需手工迁移。
+// 直接重放 _platform 迁移 + seed.sql 到内存 sqlite（installDb 不 replay seed，故自给自足）。
+// 方言对齐：seed.mysql.sql / seed.pg.sql 与基线同构，人工对齐不受本 spec 钉守——
+// 首条用例对三份文件做 INSERT 语法冒烟，防「INSERT IGNORE 错位」类事故回归。
+import type { DatabaseSync } from "node:sqlite";
+
+import { readdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { beforeAll, describe, expect, it } from "vitest";
+
+const req = createRequire(import.meta.url);
+const { DatabaseSync: Db } = req("node:sqlite") as { DatabaseSync: typeof DatabaseSync };
+
+const PLATFORM_API = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api");
+
+let dbo: InstanceType<typeof DatabaseSync>;
+
+/** 重放迁移 + seed（seed 按英文分号朴素切分，同 oj 运行时口径） */
+function replaySeed(): void {
+	for (const stmt of readFileSync(join(PLATFORM_API, "seed.sql"), "utf8").split(";")) {
+		const sql = stmt.trim();
+		if (sql)
+			dbo.exec(sql);
+	}
+}
+
+beforeAll(() => {
+	dbo = new Db(":memory:");
+	for (const f of readdirSync(join(PLATFORM_API, "migrations")).filter(f => f.endsWith(".sql") && !/\.(?:mysql|pg)\.sql$/.test(f)).sort())
+		dbo.exec(readFileSync(join(PLATFORM_API, "migrations", f), "utf8"));
+	replaySeed();
+});
+
+describe("seed 内置角色开发账号", () => {
+	it("方言文件 INSERT 语法冒烟：mysql 为 INSERT IGNORE 前缀、pg 为 ON CONFLICT 后缀", () => {
+		const mysql = readFileSync(join(PLATFORM_API, "seed.mysql.sql"), "utf8");
+		const pg = readFileSync(join(PLATFORM_API, "seed.pg.sql"), "utf8");
+		expect(mysql).not.toMatch(/INSERT INTO .*INSERT IGNORE/);
+		expect(mysql.match(/INSERT IGNORE INTO/g)!.length).toBeGreaterThanOrEqual(12);
+		expect(pg).not.toMatch(/INSERT IGNORE/);
+		expect(pg.match(/ON CONFLICT DO NOTHING/g)!.length).toBeGreaterThanOrEqual(12);
+	});
+
+	it.each(["superadmin", "admin", "editor", "viewer"])("账号 %s：must_change=0 且只绑定同名角色", (username) => {
+		const row = dbo.prepare("SELECT must_change FROM users WHERE username = ?").get(username) as { must_change: number };
+		expect(row).toBeDefined();
+		expect(Number(row.must_change)).toBe(0);
+		const roles = dbo.prepare("SELECT role_name FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = ?)").all(username) as Array<{ role_name: string }>;
+		expect(roles.map(r => r.role_name)).toEqual([username]);
+	});
+
+	it("四个角色账号口令一致（123456 的 bcrypt，复用 seed 既有哈希）", () => {
+		const hashes = dbo.prepare("SELECT username, password_hash h FROM users WHERE username IN ('superadmin','admin','editor','viewer')").all() as Array<{ username: string, h: string }>;
+		expect(new Set(hashes.map(r => r.h)).size).toBe(1);
+	});
+
+	it("旧库收敛：legacy admin(superadmin 绑定 + must_change=1) 经重放收敛为账号名=角色名", () => {
+		// 构造历史库状态：admin 绑 superadmin 且 must_change=1（旧 seed 口径），无 superadmin 账号
+		dbo.exec("DELETE FROM sys_user_role");
+		dbo.exec("DELETE FROM users");
+		dbo.prepare("INSERT INTO users (username, password_hash, must_change) VALUES ('admin', 'x', 1)").run();
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) SELECT id, 'superadmin' FROM users WHERE username = 'admin'").run();
+
+		replaySeed();
+
+		expect(Number((dbo.prepare("SELECT must_change m FROM users WHERE username = 'admin'").get() as { m: number }).m)).toBe(0);
+		const adminRoles = (dbo.prepare("SELECT role_name r FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = 'admin')").all() as Array<{ r: string }>).map(x => x.r);
+		expect(adminRoles).toEqual(["admin"]);
+		const superRoles = (dbo.prepare("SELECT role_name r FROM sys_user_role WHERE user_id = (SELECT id FROM users WHERE username = 'superadmin')").all() as Array<{ r: string }>).map(x => x.r);
+		expect(superRoles).toEqual(["superadmin"]);
+	});
+
+	it("幂等：重放两遍结果不变", () => {
+		const snap = () => JSON.stringify([
+			dbo.prepare("SELECT username, must_change FROM users ORDER BY username").all(),
+			dbo.prepare("SELECT user_id, role_name FROM sys_user_role ORDER BY user_id, role_name").all(),
+		]);
+		const before = snap();
+		replaySeed();
+		expect(snap()).toBe(before);
+	});
+});

package/vendor/host-versions.json

@@ -8,9 +8,9 @@
 		"react-router": "7.18.2",
 		"react-router/dom": "7.18.2",
 		"@tanstack/react-query": "5.102.8",
-		"@oj-module/runtime": "0.2.20",
-		"@oj-module/runtime/contract": "0.2.20",
-		"@oj-module/runtime/contract/errors": "0.2.20",
+		"@oj-module/runtime": "0.2.25",
+		"@oj-module/runtime/contract": "0.2.25",
+		"@oj-module/runtime/contract/errors": "0.2.25",
 		"@plane/kit": "0.1.20",
 		"@plane/editor": "0.1.20",
 		"antd": "6.6.1",

package/src/args.ts

@@ -1,122 +0,0 @@
-/**
- * 子命令参数解析（纯函数，可测）。
- *
- * 约定：位置参数取第一个不以 `--` 开头的参数；`--xxx` 一律是开关/选项。
- * 缺陷背景：`ojm init --yes` 曾把 argv[3]（即 `--yes`）当目标目录。
- */
-
-export function parseInitArgs(argv: string[]): { dest: string, yes: boolean } {
-	const yes = argv.includes("--yes");
-	const dest = argv.find(a => !a.startsWith("--")) ?? "";
-	return { dest, yes };
-}
-
-/**
- * `ojm api [dir] [--check] [--docs] [--exempt <path>]`：位置参数为项目目录
- * （缺省 cwd），与 parseInitArgs 同一约定（docs/prd/202609032019-ojm-api-cwd.md）。
- * 注意：`--exempt` 的「值」不得以 `--` 开头，否则会被误判为 dir——故逐项扫描，
- * 消费掉 `--exempt` 紧随的值，避免被 dir 解析吞噬（P6 同款坑）。
- */
-export function parseApiArgs(argv: string[]): { dir: string, check: boolean, docs: boolean, exempt?: string } {
-	const flags = new Set<string>();
-	const positionals: string[] = [];
-	let exempt: string | undefined;
-	for (let i = 0; i < argv.length; i++) {
-		const a = argv[i];
-		if (a === "--exempt") {
-			exempt = argv[i + 1];
-			i++; // 跳过紧随的值，不被当 dir
-			continue;
-		}
-		if (a.startsWith("--")) {
-			flags.add(a);
-			continue;
-		}
-		positionals.push(a);
-	}
-	const dir = positionals[0] ?? "";
-	return { dir, check: flags.has("--check"), docs: flags.has("--docs"), exempt };
-}
-
-/**
- * `ojm build [--bundle] [--out <dir>]`。
- * `--bundle`：方案包构建（manifest.yaml 契约校验 → 确定性 tgz + sha256），
- * 与站点级 `ojm build`（后端 oj build + 模块产物合并）互斥分工（devkit 手册「打包与分发」）。
- * `--out` 的值不得以 `--` 开头（同 parseApiArgs 的消费式扫描，P6 同款坑）。
- */
-export function parseBuildArgs(argv: string[]): { bundle: boolean, out?: string } {
-	const flags = new Set<string>();
-	let out: string | undefined;
-	for (let i = 0; i < argv.length; i++) {
-		const a = argv[i];
-		if (a === "--out") {
-			out = argv[i + 1];
-			i++; // 消费紧随的值，不被当 flag
-			continue;
-		}
-		if (a.startsWith("--")) {
-			flags.add(a);
-		}
-	}
-	return { bundle: flags.has("--bundle"), out };
-}
-
-/**
- * `ojm vendor [tag] [--force]`：下载/更新 oj vendor（npm 包 @oj-bin/oj）。
- * tag 缺省追 npm latest；形如 `v0.1.13` 或 `0.1.13`（自动补 v 前缀，装包时去掉）。
- * 非法 tag 形状即报错（防误把目录当版本）。
- */
-export function parseVendorArgs(argv: string[]): { force: boolean, tag?: string } {
-	const tag = argv.find(a => !a.startsWith("--") && a !== "--");
-	if (tag !== undefined && !/^v?\d+\.\d+\.\d+(?:-[\w.]+)?$/.test(tag)) {
-		throw new Error(`[ojm] 非法版本号：${tag}（形如 v0.1.11 或 0.1.11）`);
-	}
-	return {
-		force: argv.includes("--force"),
-		tag: tag === undefined ? undefined : (tag.startsWith("v") ? tag : `v${tag}`),
-	};
-}
-
-export interface LifecycleArgs {
-	positionals: string[]
-	url?: string
-	user?: string
-	pass?: string
-	locale?: string
-	name?: string
-	version?: string
-	task?: string
-}
-
-/**
- * `ojm install|enable|disable` 共用解析：位置参数（目标/方案名）+ 值式 flag。
- * 站点寻址三件套 --url/--user/--pass（环境变量 OJM_URL/OJM_USER/OJM_PASS 兜底，见 src/site.ts）；
- * install 专属 --name/--version（文件名身份覆盖）与 --locale（终态文案语言）；
- * trust 专属 --task（TOFU 确认目标任务 id，P2-3）。
- * 值式 flag 逐项消费紧随的值，不被当位置参数（P6 同款坑，parseApiArgs 同纪律）。
- */
-export function parseLifecycleArgs(argv: string[]): LifecycleArgs {
-	const valueFlags = new Set(["--url", "--user", "--pass", "--locale", "--name", "--version", "--task"]);
-	const values: Record<string, string> = {};
-	const positionals: string[] = [];
-	for (let i = 0; i < argv.length; i++) {
-		const a = argv[i]!;
-		if (valueFlags.has(a)) {
-			values[a] = argv[i + 1] ?? "";
-			i++; // 消费紧随的值
-			continue;
-		}
-		if (!a.startsWith("--"))
-			positionals.push(a);
-	}
-	return {
-		positionals,
-		url: values["--url"],
-		user: values["--user"],
-		pass: values["--pass"],
-		locale: values["--locale"],
-		name: values["--name"],
-		version: values["--version"],
-		task: values["--task"],
-	};
-}