@oj-module/cli 0.2.46 → 0.2.48

package/templates/tests/wecom-admin.spec.ts

@@ -15,7 +15,7 @@ import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import { assertSuperAdmin, invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
 import { listApps, setAppStatus } from "../src/auth/api/_shared/wecom/admin";
 import { createWecomClient, runtimeCache, runtimeHttp } from "../src/auth/api/_shared/wecom/client";
-import { installUrlOf, readWecomConfig, siteRootOf } from "../src/auth/api/_shared/wecom/config";
+import { readWecomConfig } from "../src/auth/api/_shared/wecom/config";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -51,6 +51,8 @@ function installVars(overrides: Record<string, string> = {}): void {
 	const base: Record<string, string> = {
 		wecom_suite_id: SUITE,
 		wecom_suite_secret: "suite_secret",
+		wecom_provider_id: "provider_1",
+		wecom_provider_secret: "provider_secret",
 		wecom_callback_token: "cb_token",
 		wecom_encoding_aes_key: AES_KEY_B64.replace(/=$/, ""),
 		wecom_enc_key: "0123456789abcdef0123456789abcdef",
@@ -97,10 +99,6 @@ function seedCorp(corpId = "ww_corp_a", agentId = "100001", env = "prod", status
 		.run(SUITE, corpId, agentId, authCorpId, env, `企业 ${corpId}`, status, `gcm(perm_${corpId}_${agentId})`, NOW, NOW);
 }
 
-function seedTicket(ticket = "tk_9", expiresAt = NOW + 1800): void {
-	dbo.prepare("INSERT INTO wecom_suite_ticket (suite_id, suite_ticket, expires_at, update_time) VALUES (?, ?, ?, ?)").run(SUITE, ticket, expiresAt, NOW);
-}
-
 function mkUser(username: string, roles: string[] = []): number {
 	dbo.prepare("INSERT INTO users (username, password_hash) VALUES (?, 'x')").run(username);
 	const id = (dbo.prepare("SELECT id FROM users WHERE username = ?").get(username) as { id: number }).id;
@@ -124,10 +122,10 @@ function fakeClient(): { client: any, invalidated: string[] } {
 
 const deps = { store: { encrypt: (p: string) => `gcm(${p})`, decrypt: (b: string) => b, now: () => NOW } };
 
-/** createInstall 的薄包装：store.now 固定，避免用例依赖真实时钟 */
+/** createInstall 的薄包装：省掉动态 import 的样板 */
 async function createInstallForTest(cfg: ReturnType<typeof readWecomConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
 	const { createInstall } = await import("../src/auth/api/_shared/wecom/admin");
-	return createInstall(cfg, client, deps.store, state);
+	return createInstall(cfg, client, state);
 }
 
 const api = async () => (await import("../src/auth/api/wecom/admin/api")).default;
@@ -251,70 +249,94 @@ describe("P3-B：启停（setAppStatus）", () => {
 	});
 });
 
-describe("P3-C：开通入口（createInstall）", () => {
-	function stubUpstream(preAuth = "PRE_1", expiresIn = 600): string[] {
+describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_url）", () => {
+	// 代开发**不支持** get_pre_auth_code（48002）：本段钉死调用链走 provider_access_token +
+	// get_customized_auth_url，绝不回退到第三方应用的预授权码接口。
+	function stubUpstream(qrcodeUrl = "https://open.work.weixin.qq.com/3rdservice/QR_1", expiresIn = 7200): { calls: string[], bodies: any[] } {
 		const calls: string[] = [];
-		g.fetch = async (url: string) => {
+		const bodies: any[] = [];
+		g.fetch = async (url: string, init?: any) => {
 			calls.push(url);
+			bodies.push(init?.body ? JSON.parse(init.body) : null);
 			return {
 				ok: true,
 				json: async () => {
-					if (url.includes("get_suite_token"))
-						return { suite_access_token: "suite_tk", expires_in: 7200 };
-					if (url.includes("get_pre_auth_code"))
-						return { pre_auth_code: preAuth, expires_in: expiresIn };
+					if (url.includes("get_provider_token"))
+						return { provider_access_token: "prov_tk", expires_in: 7200 };
+					if (url.includes("get_customized_auth_url"))
+						return { qrcode_url: qrcodeUrl, expires_in: expiresIn };
 					throw new Error(`stub fetch 未预期：${url}`);
 				},
 			};
 		};
-		return calls;
+		return { calls, bodies };
 	}
 
-	it("suite_ticket → suite_token → 预授权码 → install URL（redirect_uri 落站点根登录页）", async () => {
-		seedTicket();
-		const calls = stubUpstream();
+	it("provider_token → get_customized_auth_url → qrcode_url（即开通链接），且绝不调 get_pre_auth_code", async () => {
+		const { calls, bodies } = stubUpstream();
 		const cfg = readWecomConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 
 		const r = await createInstallForTest(cfg, client, "st_1");
-		expect(calls.some(u => u.includes("get_suite_token"))).toBe(true);
-		expect(calls.some(u => u.includes("get_pre_auth_code"))).toBe(true);
+		expect(calls.some(u => u.includes("get_provider_token"))).toBe(true);
+		expect(calls.some(u => u.includes("get_customized_auth_url"))).toBe(true);
+		// 代开发 48002 的根因就是错用了 get_pre_auth_code——这条断言防止回归
+		expect(calls.some(u => u.includes("get_pre_auth_code"))).toBe(false);
+
+		const body = bodies.find(b => b && b.templateid_list) as any;
+		expect(body).toBeTruthy();
+		// get_customized_auth_url 要求 state 必填（errcode 40058 state missing）：本系统必传、非空
+		expect(body.state).toBe("st_1");
+		expect(body.templateid_list).toEqual([SUITE]);
+
+		expect(r.installUrl).toBe("https://open.work.weixin.qq.com/3rdservice/QR_1");
+		// 下发给管理员的就是文档里的地址（不带 callback_format=json，依据见 config.ts::eventUrlOf）
 		expect(r.callbackUrl).toBe("https://site.example.com/api/auth/wecom/event");
-		expect(r.expiresIn).toBe(600);
-
-		const url = new URL(r.installUrl);
-		expect(`${url.origin}${url.pathname}`).toBe("https://open.work.weixin.qq.com/3rdapp/install");
-		expect(url.searchParams.get("suite_id")).toBe(SUITE);
-		expect(url.searchParams.get("pre_auth_code")).toBe("PRE_1");
-		expect(url.searchParams.get("redirect_uri")).toBe("https://site.example.com/login?wecom_installed=1");
-		expect(url.searchParams.get("state")).toBe("st_1");
+		expect(r.expiresIn).toBe(7200);
 	});
 
-	it("子路径部署：redirect_uri 保留 /oj（回跳不落到宿主机根）", () => {
-		installVars({ wecom_base_url: "https://site.example.com/oj/api/auth/wecom" });
+	it("调用方没传 state 时仍发默认 state（避免 40058 state missing）", async () => {
+		const { bodies } = stubUpstream();
 		const cfg = readWecomConfig();
-		expect(siteRootOf(cfg)).toBe("https://site.example.com/oj");
-		const url = new URL(installUrlOf(cfg, "PRE_1", ""));
-		expect(url.searchParams.get("redirect_uri")).toBe("https://site.example.com/oj/login?wecom_installed=1");
-		// state 为空时不出现在 URL 里（不塞空串进去骗企微后台）
-		expect(url.searchParams.has("state")).toBe(false);
+		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
+		await createInstallForTest(cfg, client, "");
+		const body = bodies.find(b => b && b.templateid_list) as any;
+		expect(body.state).toBeTruthy();
+		expect(body.state.length).toBeLessThanOrEqual(32);
 	});
 
-	it("缺 suite_ticket（回调未打通/已过期）→ 503，不白跑一趟上游", async () => {
-		const calls = stubUpstream();
+	it("缺 provider 凭证（wecom_provider_id / wecom_provider_secret）→ 400 并点名缺哪两个 vars", async () => {
+		installVars({ wecom_provider_id: "", wecom_provider_secret: "" });
 		const cfg = readWecomConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
-		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 503 });
-		expect(calls).toEqual([]);
+		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 400 });
 	});
 
-	it("上游 errcode → 502（可重试语义，不是 500）", async () => {
-		seedTicket();
-		g.fetch = async () => ({ ok: true, json: async () => ({ errcode: 40001, errmsg: "invalid credential" }) });
+	it("上游 errcode（如 provider_secret 错）→ 502（可重试语义，不是 500）", async () => {
+		g.fetch = async () => ({ ok: true, json: async () => ({ errcode: 40001, errmsg: "invalid provider secret" }) });
 		const cfg = readWecomConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 502 });
 	});
+
+	it("get_customized_auth_url 返回 842002（模板未上架/上线）→ 502 且提示去后台提交上线（运营动作，非代码缺陷）", async () => {
+		g.fetch = async (url: string) => ({
+			ok: true,
+			json: async () => {
+				if (url.includes("get_provider_token"))
+					return { provider_access_token: "prov_tk", expires_in: 7200 };
+				if (url.includes("get_customized_auth_url"))
+					return { errcode: 842002, errmsg: "template not on shelves" };
+				throw new Error(`stub fetch 未预期：${url}`);
+			},
+		});
+		const cfg = readWecomConfig();
+		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
+		await expect(createInstallForTest(cfg, client, "st_1")).rejects.toMatchObject({
+			status: 502,
+			message: expect.stringContaining("代开发模板尚未上架/上线"),
+		});
+	});
 });
 
 describe("P3-D：端点接线（/auth/wecom/admin/*）", () => {

package/templates/tests/wecom-client-timeout.spec.ts

@@ -0,0 +1,99 @@
+// 回归：企微 API 客户端在「服务端 isolate」下的超时与崩溃防护。
+//
+// 真实 oj 服务端 isolate 没有 `AbortSignal` 全局，也没有 `setTimeout`
+// （oj-api-dev global.d.ts：「本运行时无 timer 全局，setTimeout 不可用」）。
+// 旧实现 `fetch(url, { signal: AbortSignal.timeout(ms) })` 会直接 ReferenceError
+// → 所有企微调用（换 token / 生成开通链接 / 登录）一律 502。
+// 这里在测试里**模拟**该 isolate（删掉 AbortSignal、tasks 视情况），断言：
+//   1. 无 AbortSignal 时调用照常工作（不抛 `AbortSignal is not defined`）；
+//   2. 不再把 `signal` 传给 fetch（旧 bug 的根）；
+//   3. tasks.sleep 存在 → 慢请求被软超时拦截并抛「超时」文案；
+//   4. tasks 缺失 → 安全降级为「不超时」，快速请求正常返回。
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { runtimeHttp } from "../src/auth/api/_shared/wecom/client";
+
+const g = globalThis as any;
+
+let savedAbortSignal: unknown;
+let savedTasks: unknown;
+let savedFetch: unknown;
+
+beforeEach(() => {
+	savedAbortSignal = (globalThis as { AbortSignal?: unknown }).AbortSignal;
+	savedTasks = g.tasks;
+	savedFetch = g.fetch;
+});
+
+afterEach(() => {
+	Object.defineProperty(globalThis, "AbortSignal", { value: savedAbortSignal, configurable: true, writable: true });
+	g.tasks = savedTasks;
+	g.fetch = savedFetch;
+});
+
+describe("wecom client：无 AbortSignal 的 isolate 不崩（回归）", () => {
+	it("abortSignal 被删掉时，getJson/postJson 仍能调用企微接口", async () => {
+		// 模拟服务端 isolate：把 AbortSignal 强制为 undefined（兼覆盖「整类不存在」与「.timeout 缺失」两种形态）
+		Object.defineProperty(globalThis, "AbortSignal", { value: undefined, configurable: true, writable: true });
+		g.tasks = undefined;
+
+		const fetchMock = vi.fn(async () => ({
+			ok: true,
+			json: async () => ({ errcode: 0, suite_access_token: "TOK", expires_in: 7200 }),
+		}));
+		g.fetch = fetchMock;
+
+		const http = runtimeHttp();
+		const data = await http.postJson("https://qyapi.weixin.qq.com/cgi-bin/service/get_suite_token", { a: 1 });
+		expect(data.errcode).toBe(0);
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+	});
+
+	it("不再把 signal 传给 fetch（旧实现传 AbortSignal.timeout 的结果）", async () => {
+		Object.defineProperty(globalThis, "AbortSignal", { value: undefined, configurable: true, writable: true });
+		g.tasks = undefined;
+
+		const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ errcode: 0 }) }));
+		g.fetch = fetchMock;
+
+		await runtimeHttp().getJson("https://qyapi.weixin.qq.com/x");
+		const [, init] = fetchMock.mock.calls[0];
+		expect(init.signal).toBeUndefined();
+	});
+
+	it("abortSignal.timeout 绝不被调用（防止旧 bug 回潮）", async () => {
+		const spy = vi.spyOn(globalThis.AbortSignal as { timeout: (ms: number) => unknown }, "timeout");
+		g.tasks = undefined;
+		g.fetch = vi.fn(async () => ({ ok: true, json: async () => ({ errcode: 0 }) }));
+
+		await runtimeHttp().getJson("https://qyapi.weixin.qq.com/x");
+		expect(spy).not.toHaveBeenCalled();
+		spy.mockRestore();
+	});
+});
+
+describe("wecom client：软超时（tasks.sleep）", () => {
+	it("tasks.sleep 存在时，慢请求被软超时拦截并抛出「超时」文案", async () => {
+		// 用立即 resolve 的 sleep 模拟（不真的等 TIMEOUT_MS，测试秒级完成）
+		g.tasks = { sleep: () => Promise.resolve() };
+		let resolveFetch: (v: unknown) => void = () => {};
+		const fetchMock = vi.fn(() => new Promise<unknown>((resolve) => {
+			resolveFetch = resolve;
+		}));
+		g.fetch = fetchMock;
+
+		const p = runtimeHttp().getJson("https://qyapi.weixin.qq.com/x");
+		await expect(p).rejects.toThrow(/超时/);
+		// 收尾挂起的 fetch，避免 open handle
+		resolveFetch({ ok: true, json: async () => ({ errcode: 0 }) });
+	});
+
+	it("tasks 缺失时降级为不超时：快速请求正常返回", async () => {
+		g.tasks = undefined;
+		const fetchMock = vi.fn(async () => ({ ok: true, json: async () => ({ errcode: 0 }) }));
+		g.fetch = fetchMock;
+
+		const data = await runtimeHttp().getJson("https://qyapi.weixin.qq.com/x");
+		expect(data.errcode).toBe(0);
+	});
+});

package/templates/tests/wecom-connector.spec.ts

@@ -19,7 +19,6 @@ import { createWecomClient, runtimeCache } from "../src/auth/api/_shared/wecom/c
 import {
 	assertEncKey,
 	eventUrlOf,
-	installUrlOf,
 	loginRedirectOf,
 	readCallbackConfig,
 	readWecomConfig,
@@ -38,6 +37,7 @@ import {
 	putLoginState,
 	takeLoginState,
 } from "../src/auth/api/_shared/wecom/login";
+import { callbackFields, field } from "../src/auth/api/_shared/wecom/payload";
 import {
 	claimLoginTicket,
 	ensureTenant,
@@ -494,7 +494,7 @@ describe("P1-G：事件分发（suite_ticket / 授权 / 解绑）", () => {
 				return "sat";
 			},
 			async permanentCodeByAuthCode() {
-				return { permanentCode: "perm_new", corpId: "ww_corp_a", corpName: "测试企业", agentIds: ["100001", "100002"], state: null, ...overrides };
+				return { permanentCode: "perm_new", corpId: "ww_corp_a", corpName: "测试企业", agentIds: ["100001", "100002"], authModes: { 100001: 0, 100002: 0 }, state: null, ...overrides };
 			},
 			async corpAccessToken() {
 				return "ct";
@@ -511,14 +511,39 @@ describe("P1-G：事件分发（suite_ticket / 授权 / 解绑）", () => {
 	const deps = (client: unknown) => ({ cfg: CFG, client: client as never, store: storeDeps() });
 
 	it("suite_ticket：落库并给 30 分钟有效期（企微 10 分钟推一次，过期即拒发 API）", async () => {
-		await handleSuiteEvent("<xml><InfoType>suite_ticket</InfoType><SuiteId>suite_1</SuiteId><SuiteTicket>tk_1</SuiteTicket></xml>", deps(fakeClient()));
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "suite_ticket", SuiteTicket: "tk_1" }, deps(fakeClient()));
 		expect(await getSuiteTicket(CFG.suiteId, storeDeps())).toEqual({ ticket: "tk_1", expiresAt: clock + 1800 });
 	});
 
+	it("suite_ticket 顺势预热 suite token（授权路径只剩一次出网），换票失败也不影响票据落库", async () => {
+		const seen: string[] = [];
+		const warm = {
+			...fakeClient(),
+			async suiteAccessToken(suiteId: string, secret: string, ticket: string) {
+				seen.push(`${suiteId}/${secret}/${ticket}`);
+				return "sat";
+			},
+		} as never;
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "suite_ticket", SuiteTicket: "tk_9" }, deps(warm));
+		expect(seen).toEqual(["suite_1/secret_1/tk_9"]);
+
+		// suite_secret 配错时只是预热失败：票据必须照旧落库，否则 create_auth 连门都进不去
+		const broken = {
+			...fakeClient(),
+			async suiteAccessToken() {
+				throw new Error("企微 get_suite_token 失败：errcode=40001");
+			},
+		} as never;
+		await expect(handleSuiteEvent({ SuiteId: "suite_1", InfoType: "suite_ticket", SuiteTicket: "tk_10" }, deps(broken)))
+			.resolves
+			.toBe("suite_ticket");
+		expect((await getSuiteTicket(CFG.suiteId, storeDeps())).ticket).toBe("tk_10");
+	});
+
 	it("create_auth：AuthCode 换永久码 → 每个 agent 一行 profile，并作废旧 corp token", async () => {
 		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
 		const client = fakeClient();
-		await handleSuiteEvent("<xml><InfoType>create_auth</InfoType><SuiteId>suite_1</SuiteId><AuthCode>AC_1</AuthCode><State>env=test</State></xml>", deps(client));
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_1", State: "env=test" }, deps(client));
 		const rows = dbo.prepare("SELECT agent_id, env, status FROM wecom_app_profile ORDER BY agent_id").all();
 		expect(rows).toEqual([
 			{ agent_id: "100001", env: "test", status: "active" },
@@ -529,31 +554,111 @@ describe("P1-G：事件分发（suite_ticket / 授权 / 解绑）", () => {
 		expect(dbo.prepare("SELECT action FROM sys_oplog WHERE action = 'wecom.auth.apply'").all()).toHaveLength(1);
 	});
 
+	// 回归：线上「应用安装失败，联系服务商」的正因——回调是匿名请求（无 X-TENANT-ID），
+	// sys_oplog 是租户表，sql_guard: deny 下不绑租户就写会被守卫拒；而它发生在 profile 已落库之后，
+	// 于是「授权其实成功了，企微却判失败」。鉴据：审计行必须落在该企业自己的租户下。
+	it("create_auth 匿名回调（无租户头）：审计前先按企业绑租户，行落进该企业 oplog", async () => {
+		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
+		g.http = {};
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_1" }, deps(fakeClient()));
+		expect(g.http.tenantId).toBe("ww_corp_a");
+		expect(dbo.prepare("SELECT tenant_id, target FROM sys_oplog WHERE action = 'wecom.auth.apply'").get())
+			.toMatchObject({ tenant_id: "ww_corp_a", target: "ww_corp_a" });
+	});
+
+	it("审计写失败不得把 create_auth 打成失败（授权已落库，企微必须拿到 success）", async () => {
+		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
+		const orig = g.db.table;
+		g.db.table = (name: string) => {
+			if (name === "sys_oplog")
+				throw new Error("tenant guard: table(s) [\"sys_oplog\"] require tenant context (missing tenant header)");
+			return orig(name);
+		};
+		try {
+			await expect(handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_1" }, deps(fakeClient())))
+				.resolves
+				.toBe("create_auth");
+		}
+		finally {
+			g.db.table = orig;
+		}
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_app_profile").get()).toMatchObject({ n: 2 });
+	});
+
 	it("cancel_auth：profile 全部停用 + 该租户 refresh 串清空（解绑后旧会话不得续命）", async () => {
 		await saveProfile(profile({ agent: "100001" }), storeDeps());
 		await saveProfile(profile({ agent: "100002" }), storeDeps());
 		dbo.prepare("INSERT INTO sys_refresh_token (token_hash, tenant_id, user_id, expires_at, revoked, created_at) VALUES ('h', 'ww_corp_a', 1, ?, 0, ?)").run(clock + 100, clock);
 
-		await handleSuiteEvent("<xml><InfoType>cancel_auth</InfoType><SuiteId>suite_1</SuiteId><AuthCorpId>ww_corp_a</AuthCorpId></xml>", deps(fakeClient()));
+		g.http = {};
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "cancel_auth", AuthCorpId: "ww_corp_a" }, deps(fakeClient()));
 
 		expect(dbo.prepare("SELECT DISTINCT status FROM wecom_app_profile").all()).toEqual([{ status: "disabled" }]);
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM sys_refresh_token").get()).toMatchObject({ n: 0 });
 		expect(dbo.prepare("SELECT level FROM sys_oplog WHERE action = 'wecom.auth.cancel'").get()).toMatchObject({ level: 4 });
+		// 清会话是裸 SQL，deny 档下同样要租户上下文
+		expect(g.http.tenantId).toBe("ww_corp_a");
 	});
 
 	it("SuiteId 与本部署不一致 → 400（不同套件的回调不得互相污染）", async () => {
-		await expect(handleSuiteEvent("<xml><InfoType>suite_ticket</InfoType><SuiteId>other</SuiteId><SuiteTicket>t</SuiteTicket></xml>", deps(fakeClient())))
+		await expect(handleSuiteEvent({ SuiteId: "other", InfoType: "suite_ticket", SuiteTicket: "t" }, deps(fakeClient())))
 			.rejects
 			.toMatchObject({ status: 400 });
 	});
 
-	it("不消费的事件（通讯录变更等）回 success 语义的 InfoType，不抛错（否则企微重推三次）", async () => {
-		expect(await handleSuiteEvent("<xml><InfoType>change_contact</InfoType><SuiteId>suite_1</SuiteId></xml>", deps(fakeClient()))).toBe("change_contact");
+	it("不消费的事件回 success 语义的 InfoType，不抛错（否则企微重推三次）", async () => {
+		expect(await handleSuiteEvent({ InfoType: "change_contact", SuiteId: "suite_1" }, deps(fakeClient()))).toBe("change_contact");
+	});
+
+	// 数据回调没有 InfoType，只有 MsgType=event + Event=change_contact：分流靠 Event 认，
+	// 认不出就会落进 default 被记成「不消费的事件」——而这条正是轨三的全部输入。
+	it("数据回调形态（无 InfoType）也能分流到轨三，且日志只留 ChangeType 不留值", async () => {
+		const dataCallback = {
+			ToUserName: "ww_corp_a",
+			CreateTime: 1700000000,
+			MsgType: "event",
+			Event: "change_contact",
+			ChangeType: "update_party",
+			Id: 2,
+		};
+		const logged: unknown[][] = [];
+		const orig = g.log;
+		const push = (...args: unknown[]) => void logged.push(args);
+		// 失败那条是 warn（成功才是 info）：两个都要抓，否则「没抛错」会掩盖「根本没走到轨三」
+		g.log = { ...orig, info: push, warn: push };
+		try {
+			// 返回值是 ChangeType（日志只用它记一行），不是事件名
+			expect(await handleSuiteEvent(dataCallback, deps(fakeClient()))).toBe("update_party");
+		}
+		finally {
+			g.log = orig;
+		}
+		// 这家企业在本用例里没授权：失败只记一笔，绝不抛（抛了企微就重推三次）
+		const line = logged.find(args => args[0] === "wecom change_contact ignored");
+		expect(line).toBeDefined();
+		// ChangeType 是协议枚举，记下来才有排查价值；姓名/工号这类明文值一个都不许进日志
+		expect(line).toContain("update_party");
+		expect(JSON.stringify(line)).toContain("未授权");
+	});
+
+	// 兜底口径（payload.ts 头的说明）：部分回调业务没有 JSON 文档，收到 XML 也必须能处理。
+	// 同一个事件两种格式走出来的效果必须一模一样，否则「换个格式就静默不认」会在真机上才暴露。
+	it("XML（文档形态）与 JSON 归一化结果一致：两种包体走同一条路径", async () => {
+		const asJson = { SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_xml" };
+		const asXml = [
+			"<xml><SuiteId><![CDATA[suite_1]]></SuiteId><InfoType><![CDATA[create_auth]]></InfoType>",
+			"<AuthCode><![CDATA[AC_xml]]></AuthCode></xml>",
+		].join("");
+		const fromJson = callbackFields(asJson);
+		const fromXml = callbackFields(asXml);
+		expect([...fromXml.values.entries()].sort()).toEqual([...fromJson.values.entries()].sort());
+		// 信封小写、明文大写都认：上游 JSON 信封是 {"tousername","encrypt"}
+		expect(field(callbackFields({ tousername: "ww_corp_a", encrypt: "abc" }), "Encrypt")).toBe("abc");
 	});
 
 	it("create_auth 缺 AuthCode → 400（宁可拒也不落半行 profile）", async () => {
 		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
-		await expect(handleSuiteEvent("<xml><InfoType>create_auth</InfoType><SuiteId>suite_1</SuiteId></xml>", deps(fakeClient())))
+		await expect(handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth" }, deps(fakeClient())))
 			.rejects
 			.toMatchObject({ status: 400 });
 	});
@@ -657,6 +762,7 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 		installVars();
 		const cfg = readWecomConfig();
 		expect(cfg.baseUrl).toBe("https://site.example.com/api/auth/wecom");
+		// 不带 callback_format=json：官方文档只给「对外收款」写了这个参数，代开发的通用回调配置只有 XML
 		expect(eventUrlOf(cfg)).toBe("https://site.example.com/api/auth/wecom/event");
 		expect(loginRedirectOf(cfg)).toBe("https://site.example.com/api/auth/wecom/callback");
 		expect(siteRootOf(cfg)).toBe("https://site.example.com");
@@ -668,8 +774,6 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 		expect(siteRootOf(cfg)).toBe("https://site.example.com/oj");
 		expect(loginLandingUrl({ origin: siteRootOf(cfg), ticket: "tk", tenant: "ww_corp_a" }))
 			.toBe("https://site.example.com/oj/login?wecom_ticket=tk&tenant=ww_corp_a");
-		// 开通入口的 redirect_uri 同样要带子路径
-		expect(installUrlOf(cfg, "PAC1", "env=prod")).toContain(`redirect_uri=${encodeURIComponent("https://site.example.com/oj/login?wecom_installed=1")}`);
 	});
 
 	it("baseUrl 后缀不对 → 400（宁可拒，也不猜站点根拼出错误回跳）", () => {

package/templates/tests/wecom-crypt.spec.ts

@@ -80,14 +80,23 @@ describe("aes256CbcDecrypt 对 WebCrypto", () => {
 
 	it("pKCS#7 非法填充硬失败（不返回半截明文）", () => {
 		expect(() => pkcs7Unpad(new Uint8Array(16))).toThrow(/bad padding/); // 全 0 填充
-		const tooBig = new Uint8Array(16).fill(0);
-		tooBig[15] = 17;
-		expect(() => pkcs7Unpad(tooBig)).toThrow(/bad padding/);
+		const tooBig = new Uint8Array(64).fill(33);
+		expect(() => pkcs7Unpad(tooBig)).toThrow(/bad padding/); // 33 > 企微的 32 字节补位块
 		const inconsistent = new Uint8Array(16).fill(0);
 		inconsistent[14] = 3;
 		inconsistent[15] = 3;
 		expect(() => pkcs7Unpad(inconsistent)).toThrow(/bad padding/);
 	});
+
+	it("企微的补位块是 32 字节：补位 17~32 必须能去掉（按 16 卡上限会误杀一半真实报文）", () => {
+		// 90968「概述」：数据采用 PKCS#7 填充至 **32 字节**的倍数。官方 demo 的 block_size 也是 32，
+		// 所以末字节可能取到 17~32；只认 1~16 会让这些报文全判 bad padding。
+		for (const pad of [1, 16, 17, 20, 31, 32]) {
+			const block = new Uint8Array(64).fill(0x41);
+			block.fill(pad, 64 - pad);
+			expect(pkcs7Unpad(block).length).toBe(64 - pad);
+		}
+	});
 });
 
 describe("wecomSignature：字典序排序后 sha1", () => {