@oj-module/cli 0.2.42 → 0.2.45

package/templates/tests/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, currentAccess, invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -151,6 +151,23 @@ describe("禁用与未认证", () => {
 		asUser(undefined);
 		await expect(assertPermission("wiki.page.edit")).rejects.toMatchObject({ status: 403 });
 	});
+
+	it("伪造租户头：token 的 sub 在本租户查无此人 → 403（不能只靠「角色为空」兜底）", async () => {
+		// 租户化后 `users` 的查询自动带 `tenant_id = 当前头值`，于是「A 企业的人带 B 企业的头」
+		// 等价于「这一行查不到」。夹具不模拟租户注入（fixture.ts 头注释已声明），
+		// 故用「行不存在」直接钉住这条分支——它就是伪造头在 SQL 层的表现。
+		asUser(987_654_321);
+		await expect(currentAccess()).rejects.toMatchObject({ status: 403 });
+		// 只要求登录态的端点（不走 assertPermission）也必须被挡住
+		await expect(assertSystemAdmin()).rejects.toMatchObject({ status: 403 });
+	});
+
+	it("用户行存在才放行登录态（对照组：同一断言换个真实 uid 即通过）", async () => {
+		const uid = mkUser("u9x");
+		bindRole(uid, "superadmin");
+		asUser(uid);
+		await expect(currentAccess()).resolves.toMatchObject({ exists: true });
+	});
 });
 
 describe("AC1-9：系统管理员断言（D11）", () => {

package/templates/tests/tenant-access-cache.spec.ts

@@ -0,0 +1,99 @@
+// BDD：判权快照缓存的租户边界（多租户 2026-10，`_platform/.../infra/access.ts`）。
+//
+// 攻击/故障形态：`access.ts` 的判权快照按 **uid 单键**缓存时，「A 企业的张三」判过权之后
+// 同一个进程再处理「B 企业的张三」的请求——后者的 `users` 行按 B 租户查不到（构造器自动
+// 注入 `tenant_id` 谓词），本应 403，但缓存里还留着 A 租户那张 `exists: true` 的快照，
+// 于是**放行**。
+//
+// oj 目前每请求重建模块实例，缓存恒不命中，所以线上看不到；但只要有一次复用
+// （常驻进程、或本工程自己的测试宿主）就是静默的跨租户放行——而这一层是伪造
+// `X-TENANT-ID` 的**唯一**服务端拦截点，它一旦放行就没有第二道了。
+// 这里把「同一 uid 换租户必须重查」钉死，顺手钉住写时失效不得漏掉别的租户。
+import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
+
+import { currentAccess, invalidateAllUsers, invalidateUser, isSelfTenant } from "../src/_platform/api/_shared/service/infra/access";
+import { installDb } from "./fixture";
+
+const g = globalThis as any;
+let dbo: ReturnType<typeof installDb>;
+
+/** 模拟一次请求的租户头（`X-TENANT-ID` → http.tenantId）与登录态 */
+function as(tenant: string, uid?: number): void {
+	g.http = tenant ? { tenantId: tenant, user: uid == null ? {} : { id: uid } } : { user: uid == null ? {} : { id: uid } };
+}
+
+/** 在指定租户里建一个用户（业务侧永不自己写 tenant_id，这里是造数据） */
+function mkUser(tenant: string, username: string): number {
+	dbo.prepare("INSERT INTO users (tenant_id, username, password_hash) VALUES (?, ?, 'x')").run(tenant, username);
+	return (dbo.prepare("SELECT id FROM users WHERE username = ? AND tenant_id = ?").get(username, tenant) as { id: number }).id;
+}
+
+function bind(tenant: string, uid: number, role: string): void {
+	dbo.prepare("INSERT OR IGNORE INTO sys_user_role (tenant_id, user_id, role_name) VALUES (?, ?, ?)").run(tenant, uid, role);
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+beforeEach(() => {
+	invalidateAllUsers();
+});
+
+afterEach(() => {
+	g.http = {};
+	dbo.exec("DELETE FROM sys_role_permission");
+	dbo.exec("DELETE FROM sys_user_role");
+	dbo.exec("DELETE FROM users WHERE username LIKE 'tk_%'");
+});
+
+describe("判权快照按 (租户, uid) 缓存", () => {
+	it("同一 uid 换到别家租户 → 查无此人（不吃上一家留下的快照）", async () => {
+		const uid = mkUser("acme", "tk_zhangsan");
+		as("acme", uid);
+		expect(await isSelfTenant()).toBe(true);
+
+		as("globex", uid);
+		expect(await isSelfTenant()).toBe(false);
+	});
+
+	it("逆时针顺序同样成立（先访问别人家，回自己家不能被判没）", async () => {
+		const uid = mkUser("acme", "tk_lisi");
+		as("globex", uid);
+		expect(await isSelfTenant()).toBe(false);
+
+		as("acme", uid);
+		expect(await isSelfTenant()).toBe(true);
+	});
+
+	it("两个租户各自的同 uid 快照互不覆盖：角色也不串台", async () => {
+		const uid = mkUser("acme", "tk_wangwu");
+		bind("acme", uid, "wiki.editor");
+		bind("globex", uid, "crm.viewer");
+
+		as("acme", uid);
+		expect((await currentAccess()).roles).toEqual(["wiki.editor"]);
+		as("globex", uid);
+		expect(await isSelfTenant()).toBe(false);
+	});
+});
+
+describe("写时失效覆盖该 uid 的全部租户快照", () => {
+	it("在别家上下文里 invalidateUser，回原租户也必须重查", async () => {
+		const uid = mkUser("acme", "tk_zhaoliu");
+		as("acme", uid);
+		expect((await currentAccess()).roles).toEqual([]);
+
+		// 直接改库（模拟别处写路径），此 uid 在 acme 的旧快照此刻已过期
+		bind("acme", uid, "wiki.editor");
+		as("acme", uid);
+		expect((await currentAccess()).roles, "未失效前读到旧快照（TTL 内缓存命中，符合预期）").toEqual([]);
+
+		// 失效发生在**别家**的上下文里 —— 不得只清当前租户那一张
+		as("globex", uid);
+		invalidateUser(uid);
+
+		as("acme", uid);
+		expect((await currentAccess()).roles).toEqual(["wiki.editor"]);
+	});
+});

package/templates/tests/tenant-forgery.spec.ts

@@ -0,0 +1,152 @@
+// BDD：伪造 `X-TENANT-ID` 的拦截面（计划 §5.7 第 1 项）。
+//
+// 攻击形态：攻击者持 A 企业的合法 token（JWT 只带 sub，不带租户），请求时把
+// `X-TENANT-ID` 改成 B 企业。oj 构造器按当前头值注入 `tenant_id`，于是「A 企业的人
+// 查 B 企业的 users」等价于**查无此行**——这是服务端唯一能看见的异常。
+//
+// 为什么必须单独钉这一层：`assertPermission` / `currentAccess()` 覆盖的是挂了权限点的
+// 端点；而通知、我的资料、人员目录这些「登录即可」的端点根本不走它们。少了这一步，
+// 伪造头的人能读到别家企业的广播通知、改别家企业的个人资料。
+//
+// 夹具自此已模拟租户注入（fixture.ts 头注释），跨租户「查不到、改不动」的地基语义由
+// tenant-isolation.spec.ts 单独钉；本文件仍用「sub 在库中不存在」来钉端点级拦截——
+// 它就是伪造头在 SQL 层的表现，且不依赖构造器能力。对照组用真实 uid 证明同一路径照常放行。
+/* eslint-disable test/prefer-lowercase-title -- 用例标题带端点路径，保留原样更易检索 */
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+
+import { invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
+import notification from "../src/notification/api/api";
+import notificationDel from "../src/notification/api/del/api";
+import profile from "../src/personal-center/api/profile/api";
+import upload from "../src/personal-center/api/upload/api";
+import { installDb } from "./fixture";
+
+const g = globalThis as any;
+let dbo: ReturnType<typeof installDb>;
+
+interface Captured { status: number | null, body: any }
+
+let out: Captured;
+
+function installJson(): void {
+	out = { status: null, body: null };
+	g.json = {
+		ok: (data?: unknown) => {
+			out.status = 200;
+			out.body = data;
+		},
+		fail: (code: number, msg: string) => {
+			out.status = code;
+			out.body = { code, msg };
+		},
+	};
+}
+
+function mkUser(username: string): number {
+	dbo.prepare("INSERT INTO users (username, password_hash) VALUES (?, 'x')").run(username);
+	return (dbo.prepare("SELECT id FROM users WHERE username = ?").get(username) as { id: number }).id;
+}
+
+/** 本租户查无此人的 sub —— 伪造租户头在 SQL 层就是这个样子 */
+const FORGED = 987_654_321;
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	invalidateUser(FORGED);
+	g.http = {};
+});
+
+describe("伪造租户头：通知族全部 403（6 个入口无一漏网）", () => {
+	it("GET /api/notification/notifications → 403", async () => {
+		installJson();
+		g.http = { user: { id: FORGED } };
+		await notification.notifications.get();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/notification/notifications/read → 403（先于 body 校验）", async () => {
+		installJson();
+		g.http = { user: { id: FORGED }, body: { id: "u:1" } };
+		await notification.notifications.read.post();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/notification/notifications/read-all → 403", async () => {
+		installJson();
+		g.http = { user: { id: FORGED } };
+		await notification.notifications["read-all"].post();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/notification/notifications/clear → 403", async () => {
+		installJson();
+		g.http = { user: { id: FORGED } };
+		await notification.notifications.clear.post();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/notification/push → 403（不能先按 body 回 400）", async () => {
+		installJson();
+		g.http = { user: { id: FORGED }, body: { title: "t", message: "m" } };
+		await notification.push.post();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/notification/push-broadcast → 403（否则可向别家企业广播）", async () => {
+		installJson();
+		g.http = { user: { id: FORGED }, body: { title: "t", message: "m" } };
+		await notification["push-broadcast"].post();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/notification/del → 403（否则可按 id 删别家企业的通知）", async () => {
+		installJson();
+		g.http = { user: { id: FORGED }, body: { id: "u:1" } };
+		await notificationDel.post();
+		expect(out.status).toBe(403);
+	});
+});
+
+describe("伪造租户头：个人中心写端点 403", () => {
+	it("POST /api/personal-center/profile → 403（否则「更新 0 行回 200」）", async () => {
+		installJson();
+		g.http = { user: { id: FORGED }, body: { email: "x@example.com" } };
+		await profile.post();
+		expect(out.status).toBe(403);
+	});
+
+	it("POST /api/personal-center/upload → 403（且不落 blob 垃圾文件）", async () => {
+		installJson();
+		g.http = { user: { id: FORGED }, files: [{ key: "", content_type: "image/png" }] };
+		await upload.post();
+		expect(out.status).toBe(403);
+	});
+});
+
+describe("对照组：同一路径换真实 uid 照常放行（证明 403 来自租户自洽而非误伤）", () => {
+	// 对照组不取通知列表：'noticesFor' 走 UNION，夹具渲染成 `(SELECT …) UNION ALL (SELECT …)`，
+	// sqlite 的 compound select 不接受括号（真 oj 构造器无此问题）——那是夹具的能力边界，
+	// 与本层要钉的租户拦截无关，故换同一护栏下的 read-all 作对照。
+	it("read-all 与我的资料：真实 uid → 200", async () => {
+		const uid = mkUser("tf_ok");
+		installJson();
+		g.http = { user: { id: uid }, tenantId: "default" };
+		await notification.notifications["read-all"].post();
+		expect(out.status).toBe(200);
+
+		installJson();
+		g.http = { user: { id: uid }, body: { description: "hi" } };
+		await profile.post();
+		expect(out.status).toBe(200);
+	});
+
+	it("未认证（无 http.user）仍是 401，不是 403", async () => {
+		installJson();
+		g.http = {};
+		await notification.notifications.get();
+		expect(out.status).toBe(401);
+	});
+});

package/templates/tests/tenant-isolation.spec.ts

@@ -0,0 +1,133 @@
+// BDD：多租户地基的运行时语义（计划 §5.7 第 2/3/4/6 项）。
+//
+// 这一层此前只能在真 oj 上验证：夹具的构造器垫片不模拟租户注入。夹具补上之后（见
+// tests/fixture.ts 头注释），四件事才能在 L2 钉住：
+//   3 构造器 insert 自动落当前租户（业务代码不该自己写 tenant_id）
+//   6 读写自动按当前租户过滤（跨租户 update/delete 落 0 行，refresh 查不到别家行）
+//   4 同一 username 在不同租户各一行（UNIQUE(tenant_id, username)）
+//   2 裸 SQL 触碰租户表却不写 tenant_id → 拒（`sql_guard: deny` 的近似；样例在 guard.spec.ts）
+//
+// 为什么不测业务 handler：那在 tenant-forgery.spec.ts（伪造头的端点级拦截）。本文件只钉地基——
+// 地基错了，上层所有「读不到别家数据」的断言都可能是假绿。
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+
+import { DEFAULT_TENANT, installDb } from "./fixture";
+
+const g = globalThis as any;
+let dbo: ReturnType<typeof installDb>;
+
+/** 模拟一次请求带 `X-TENANT-ID`（oj 侧由构造器读同一个值） */
+function asTenant(tenant?: string): void {
+	g.http = tenant ? { tenantId: tenant } : {};
+}
+
+function rows(sql: string, params: unknown[] = []): Array<Record<string, any>> {
+	return dbo.prepare(sql).all(...params) as Array<Record<string, any>>;
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	asTenant();
+});
+
+describe("§5.7-3 insert 自动落当前租户", () => {
+	it("构造器不写 tenant_id 也落到当前租户", async () => {
+		asTenant("acme");
+		await db.table("users").insert({ username: "iso-alice", password_hash: "x" }).run();
+		expect(rows("SELECT tenant_id FROM users WHERE username = 'iso-alice'")[0]!.tenant_id).toBe("acme");
+	});
+
+	it("无请求上下文时落部署默认租户（运维脚本/迁移的形态）", async () => {
+		asTenant();
+		await db.table("users").insert({ username: "iso-bob", password_hash: "x" }).run();
+		expect(rows("SELECT tenant_id FROM users WHERE username = 'iso-bob'")[0]!.tenant_id).toBe(DEFAULT_TENANT);
+	});
+
+	it("显式给了 tenant_id 就按给的落，不被当前租户覆盖", async () => {
+		asTenant("acme");
+		await db.table("users").insert({ username: "iso-carol", password_hash: "x", tenant_id: "globex" }).run();
+		expect(rows("SELECT tenant_id FROM users WHERE username = 'iso-carol'")[0]!.tenant_id).toBe("globex");
+	});
+});
+
+describe("§5.7-6 读写自动按当前租户过滤", () => {
+	it("select 只看得到本租户的行", async () => {
+		asTenant("globex");
+		const names = (await db.table("users").all() as Array<Record<string, unknown>>).map(u => String(u.username));
+		expect(names).not.toContain("iso-alice");
+		expect(names).toContain("iso-carol"); // 前一个用例显式落在 globex 的那行
+	});
+
+	it("update 跨租户落 0 行，目标行不被改", async () => {
+		const changed = await db.table("users")
+			.where({ field: "username", op: "eq", value: "iso-alice" })
+			.update({ email: "hijacked@evil" })
+			.run();
+		expect(changed).toBe(0);
+		expect(rows("SELECT email FROM users WHERE username = 'iso-alice'")[0]!.email).toBeNull();
+	});
+
+	it("delete 跨租户落 0 行，目标行仍在", async () => {
+		const deleted = await db.table("users")
+			.where({ field: "username", op: "eq", value: "iso-alice" })
+			.delete()
+			.run();
+		expect(deleted).toBe(0);
+		expect(rows("SELECT id FROM users WHERE username = 'iso-alice'")).toHaveLength(1);
+	});
+
+	it("truncate 只清本租户（A 组表）", async () => {
+		asTenant("acme");
+		await db.table("todos").insert({ title: "acme-todo" }).run();
+		asTenant("globex");
+		await db.table("todos").insert({ title: "globex-todo" }).run();
+
+		asTenant("acme");
+		await db.table("todos").truncate().run();
+		expect(rows("SELECT title FROM todos")).toEqual([{ title: "globex-todo" }]);
+	});
+
+	it("refresh token 换票：别家的 token_hash 在本租户查不到", async () => {
+		asTenant("acme");
+		await db.table("sys_refresh_token").insert({
+			token_hash: "iso-h1",
+			user_id: 1,
+			expires_at: 9_999_999_999,
+			created_at: 0,
+		}).run();
+
+		asTenant("globex");
+		const other = await db.table("sys_refresh_token")
+			.where({ field: "token_hash", op: "eq", value: "iso-h1" })
+			.all();
+		expect(other).toHaveLength(0);
+
+		asTenant("acme");
+		const own = await db.table("sys_refresh_token")
+			.where({ field: "token_hash", op: "eq", value: "iso-h1" })
+			.all();
+		expect(own).toHaveLength(1);
+	});
+});
+
+describe("§5.7-4 同一 username 在不同租户各一行", () => {
+	it("唯一约束收敛为 (tenant_id, username)：同工号两家企业互不冲突", async () => {
+		asTenant("acme");
+		await db.table("users").insert({ username: "wecom:zhangsan", password_hash: "x" }).run();
+		asTenant("globex");
+		await db.table("users").insert({ username: "wecom:zhangsan", password_hash: "x" }).run();
+
+		expect(rows("SELECT tenant_id FROM users WHERE username = 'wecom:zhangsan' ORDER BY tenant_id"))
+			.toEqual([{ tenant_id: "acme" }, { tenant_id: "globex" }]);
+	});
+
+	it("同租户内重复用户名仍被唯一约束挡住", async () => {
+		asTenant("acme");
+		await expect(
+			db.table("users").insert({ username: "wecom:zhangsan", password_hash: "x" }).run(),
+		).rejects.toThrow(/UNIQUE/i);
+	});
+});

package/templates/tests/username-namespace.spec.ts

@@ -0,0 +1,118 @@
+// BDD：外来号命名空间抢占（B6 红线）在**改名路径**上的延伸。
+//
+// 背景：外部身份（ldap/sso/wecom）的本地用户名是 `ldap:<uid>` / `sso:<sub>` / `wecom:<userid>`
+// 这种带前缀的形式，JIT 建档时按用户名反查——查到就复用，查不到才新建。于是「用户名」本身
+// 就是外部身份的认领凭据。
+//
+// 攻击：我从本地建号起家（比如 `mario`），自助改名为 `wecom:boss`。此时企微侧那位
+// `boss` 还没登录过，库里没有真行，于是我的行成了唯一的匹配者——他第一次扫码登录时
+// `ensureWecomUser` 查到的就是**我的 uid**，服务端给真正的 boss 签发了我的会话，
+// 我的角色、我的数据、我的操作日志，全部对他敞开。
+//
+// 建号侧早挡了这条红线（rbac-users.spec.ts「B6：建号加固」），但改名侧漏了——同一条红线
+// 必须钉在所有写 `users.username` 的入口上，本文件就是把「漏了会怎样」钉死：
+//   · 自助改名拒 `wecom:` 前缀（401/403 之后的第三道：不给你改）；
+//   · 对照组：普通改名照旧放行（红线不能误伤正常用户）；
+//   · 端到端：改名被拒之后，真正的外部成员 JIT 登录拿到的是**新建**的那一行。
+
+import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
+import { ensureWecomUser, externalUsername } from "../src/auth/api/_shared/wecom/login";
+import profile from "../src/personal-center/api/profile/api";
+import { installDb } from "./fixture";
+
+const g = globalThis as any;
+let dbo: ReturnType<typeof installDb>;
+
+interface Captured { status: number | null, body: any }
+
+let out: Captured;
+
+function installJson(): void {
+	out = { status: null, body: null };
+	g.json = {
+		ok: (data?: unknown) => {
+			out.status = 200;
+			out.body = data;
+		},
+		fail: (code: number, msg: string) => {
+			out.status = code;
+			out.body = { code, msg };
+		},
+	};
+}
+
+function mkUser(username: string): number {
+	dbo.prepare("INSERT INTO users (username, password_hash) VALUES (?, 'x')").run(username);
+	return (dbo.prepare("SELECT id FROM users WHERE username = ?").get(username) as { id: number }).id;
+}
+
+function usernameOf(uid: number): string {
+	const row = dbo.prepare("SELECT username FROM users WHERE id = ?").get(uid) as { username: string } | undefined;
+	return row ? String(row.username) : "";
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+beforeEach(() => {
+	installJson();
+	invalidateAllUsers();
+});
+
+afterEach(() => {
+	g.http = {};
+	dbo.exec("DELETE FROM sys_user_role");
+	dbo.exec("DELETE FROM users WHERE username LIKE 'u_%' OR username LIKE 'wecom:%' OR username LIKE 'mario%'");
+});
+
+describe("自助改名不得抢占外部身份命名空间", () => {
+	it("改名为 wecom:boss → 400，且自己的用户名原样不动", async () => {
+		const uid = mkUser("u_mario");
+		g.http = { user: { id: uid }, body: { username: "wecom:boss" } };
+
+		await profile.post();
+
+		expect(out.status).toBe(400);
+		expect(String(out.body.msg)).toMatch(/reserved/i);
+		expect(usernameOf(uid)).toBe("u_mario");
+	});
+
+	it("三个前缀全覆盖（ldap:/sso:/wecom:），大小写不敏感", async () => {
+		const uid = mkUser("u_every");
+		for (const name of ["ldap:alice", "sso:bob", "wecom:carol", "WeCom:Dave"]) {
+			g.http = { user: { id: uid }, body: { username: name } };
+			await profile.post();
+			expect(out.status, name).toBe(400);
+		}
+		expect(usernameOf(uid)).toBe("u_every");
+	});
+
+	it("对照组：普通改名照旧放行", async () => {
+		const uid = mkUser("u_plain");
+		g.http = { user: { id: uid }, body: { username: "u_renamed" } };
+
+		await profile.post();
+
+		expect(out.status).toBe(200);
+		expect(usernameOf(uid)).toBe("u_renamed");
+	});
+});
+
+describe("端到端：抢占不成，真正的外部成员拿到的是自己那一行", () => {
+	it("wecom:boss 首次 JIT 登录 → 新建独立 uid，不是抢名者的 uid", async () => {
+		const attackerUid = mkUser("u_squatter");
+		g.http = { user: { id: attackerUid }, body: { username: externalUsername("boss") } };
+		await profile.post();
+		expect(out.status).toBe(400); // 抢占被拒是前提
+
+		g.http = {};
+		const { uid } = await ensureWecomUser("ww_corp", "boss");
+
+		expect(uid).not.toBe(attackerUid);
+		expect(usernameOf(uid)).toBe("wecom:boss");
+		// 幂等：boss 再登一次仍是同一行
+		expect((await ensureWecomUser("ww_corp", "boss")).uid).toBe(uid);
+	});
+});