@oj-module/cli 0.2.47 → 0.2.48

package/shell-dist/versions.json

@@ -7,9 +7,9 @@
   "react-router": "7.18.2",
   "react-router/dom": "7.18.2",
   "@tanstack/react-query": "5.102.8",
-  "@oj-module/runtime": "0.2.47",
-  "@oj-module/runtime/contract": "0.2.47",
-  "@oj-module/runtime/contract/errors": "0.2.47",
+  "@oj-module/runtime": "0.2.48",
+  "@oj-module/runtime/contract": "0.2.48",
+  "@oj-module/runtime/contract/errors": "0.2.48",
   "@plane/kit": "0.1.20",
   "@plane/editor": "0.1.20",
   "antd": "6.6.1",

package/src/__tests__/templates-tenant-scope.test.ts

@@ -115,11 +115,16 @@ describe("templates 租户定性（A 租户表 / B 共享表）", () => {
 		expect(unknown).toEqual([]);
 	});
 
-	it("t-4 24 张表的 A/B 分组与方案 v3 §5.2 一致（新增表须先定性）", () => {
+	it("t-4 28 张表的 A/B 分组与方案 v3 §5.2 一致（新增表须先定性）", () => {
 		const { tables } = loadSchemaTables();
 		const shared = [...tables].filter(([, d]) => d.tenant === false).map(([n]) => n).sort();
 		// Phase 0 落地 21 张（11 A + 10 B）；Phase 1 加企微三表，全部 B 组（D9：查它们时必然还没有租户上下文）
-		expect(tables.size).toBe(24);
+		// 0016 组织架构加 sys_department / sys_dept_member 两张，均 A 组租户表（组织架构天然按租户隔离，
+		// 企微部署下 tenant_id = corp_id；只在有租户上下文时被读写，与 users / sys_oplog 同口径）。
+		// auth/0002 加 wecom_sync_job / wecom_sync_lock 两张，同属 A 组：同步只在调用方自己的租户内跑
+		// （D7 不接受 corpId 参数），故不进 shared_allow——跨租户读元数据那条另走显式 tenant_id 的裸 SQL。
+		// 改这张表清单 = 改租户隔离边界，必须同步 config.yaml 的 tenant.shared_allow（t-2/t-3 会把关）。
+		expect(tables.size).toBe(28);
 		expect(shared).toEqual([
 			"_oj_migrations",
 			"market_history",

package/src/init.ts

@@ -245,7 +245,7 @@ export async function initProject(destDir: string, opts: InitOptions = {}): Prom
 		console.log(`[ojm]   · 跳过 ${item}`);
 	for (const item of report.warnings)
 		console.warn(`[ojm]   ! ${item}`);
-	console.log("[ojm] 下一步：pnpm install && pnpm dev（登录 superadmin / 123456，角色账号见 devkit 手册 §1.1）");
+	console.log("[ojm] 下一步：pnpm install && pnpm dev（登录 superadmin / aA123456，角色账号见 devkit 手册 §1.1）");
 }
 
 /** 默认密封器：bin/oj secret keygen + seal（失败返回 null，不抛） */

package/src/market/__tests__/bootstrap.test.ts

@@ -120,7 +120,7 @@ describe("given 一个装了 oj 二进制的源工程 When 自举隔离站点",
 		const site = await bootstrapIsolatedSite({ projectRoot: src, starter });
 
 		expect(site.admin.user).toBe("superadmin");
-		expect(site.admin.pass).toBe("123456");
+		expect(site.admin.pass).toBe("aA123456");
 		await site.cleanup();
 	});
 

package/src/market/__tests__/setup.test.ts

@@ -62,7 +62,7 @@ describe("given 站点可直连且凭据未悬挂 When setup", () => {
 		const root = newProject();
 		const site = fakeSite();
 
-		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
+		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "aA123456", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
 
 		expect(result.cdnBaseUrl).toBe("http://127.0.0.1:9778/cdn");
 		const put = site.calls.find(c => c.url.endsWith("/api/system/settings"))!;
@@ -77,12 +77,12 @@ describe("given seed admin 处于 must_change 悬挂期 When setup", () => {
 		const root = newProject();
 		const site = fakeSite({ restricted: true });
 
-		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
+		const result = await setupMarketUrl({ projectRoot: root, user: "admin", pass: "aA123456", newPass: "newpass-123", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn });
 
 		expect(result.changedPassword).toBe(true);
 		const pwd = site.calls.find(c => c.url.endsWith("/api/auth/password"))!;
 		expect(pwd.method).toBe("PUT");
-		expect(pwd.body).toEqual({ old_password: "123456", new_password: "newpass-123" });
+		expect(pwd.body).toEqual({ old_password: "aA123456", new_password: "newpass-123" });
 		const put = site.calls.find(c => c.url.endsWith("/api/system/settings"))!;
 		expect(put.auth).toBe("Bearer token-full");
 	});
@@ -96,7 +96,7 @@ describe("given 站点不可达 When setup", () => {
 		};
 		const fetchFn = failing as unknown as typeof fetch;
 
-		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", siteUrl: "http://127.0.0.1:9778", fetchFn }))
+		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "aA123456", siteUrl: "http://127.0.0.1:9778", fetchFn }))
 			.rejects
 			.toThrow(/ojm dev/);
 	});
@@ -107,7 +107,7 @@ describe("given 改密后写设置仍被拒 When setup", () => {
 		const root = newProject();
 		const site = fakeSite({ restricted: true, rejectSettings: true });
 
-		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "123456", newPass: "newpass-123", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn }))
+		await expect(setupMarketUrl({ projectRoot: root, user: "admin", pass: "aA123456", newPass: "newpass-123", siteUrl: "http://127.0.0.1:9778", fetchFn: site.fetchFn }))
 			.rejects
 			.toThrow(/must_change|权限|设置/);
 	});
@@ -115,7 +115,7 @@ describe("given 改密后写设置仍被拒 When setup", () => {
 
 describe("given setup 返回 changedPassword When 选 setup 后的登录口令", () => {
 	it("then 改密已发生用 newPass，未改密用原种子口令（must_change=0 是当前 seed 常态）", () => {
-		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: true }, "new-pass", "123456")).toBe("new-pass");
-		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: false }, "new-pass", "123456")).toBe("123456");
+		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: true }, "new-pass", "aA123456")).toBe("new-pass");
+		expect(loginPasswordAfterSetup({ siteUrl: "", cdnBaseUrl: "", changedPassword: false }, "new-pass", "aA123456")).toBe("aA123456");
 	});
 });

package/src/market/bootstrap.ts

@@ -39,7 +39,7 @@ import { publishPackage } from "./publish";
 // 种子管理员 = superadmin：模板 seed 账号名=角色名（3d93063f 起 admin 被幂等解绑 superadmin
 // 角色），写 market 安全设置要求 actor 持 superadmin 角色——用 admin 会 403（2026-10-23 演练实踩）。
 const SEED_ADMIN_USER = "superadmin";
-const SEED_ADMIN_PASS = "123456";
+const SEED_ADMIN_PASS = "aA123456";
 
 /** Ed25519 PKCS#8 DER 前缀（RFC 8410 固定头；与 gen-signed-fixtures.mjs 同一手法） */
 const ED25519_PKCS8_PREFIX = "302e020100300506032b657004220420";

package/templates/README.md

@@ -11,7 +11,7 @@ pnpm build      # 构建：oj build + 前端全站合并到 dist/web
 pnpm preview    # 预览：oj migrate + server（release 产物）
 ```
 
-登录账号：`admin` / `123456`（见 `api/src/_platform/seed.sql`）。
+登录账号：`admin` / `aA123456`（见 `api/src/_platform/seed.sql`）。
 
 ## 系统管理模块
 

package/templates/init.include.yaml

@@ -59,6 +59,8 @@ include:
   - tests/auth-throttle.spec.ts
   - tests/guard.spec.ts
   - tests/l1-builder.test.ts
+  - tests/org-departments.spec.ts
+  - tests/org-read.spec.ts
   - tests/query-utils.spec.ts
   - tests/rbac-audit.spec.ts
   - tests/rbac-contacts.spec.ts
@@ -70,6 +72,16 @@ include:
   - tests/rbac-tables.spec.ts
   - tests/rbac-users.spec.ts
   - tests/seed-role-accounts.spec.ts
+  # 企微连接器与组织同步：源码本就分发（src/auth/api），对应回归也必须跟着走，
+  # 否则用户工程升级后改配置/换套件时没有任何本地自检手段。
+  - tests/wecom-admin.spec.ts
+  - tests/wecom-client-timeout.spec.ts
+  - tests/wecom-connector.spec.ts
+  - tests/wecom-crypt.spec.ts
+  - tests/wecom-endpoints.spec.ts
+  - tests/wecom-landing.spec.ts
+  - tests/wecom-org-sync.spec.ts
+  - tests/wecom-sync.spec.ts
   - tests/lifecycle/atomic-state.spec.ts
   - tests/lifecycle/deploy-smoke.spec.ts
   - tests/lifecycle/migrate.spec.ts