@oj-module/cli 0.2.47 → 0.2.49

package/templates/tests/wecom-connector.spec.ts

@@ -37,6 +37,7 @@ import {
 	putLoginState,
 	takeLoginState,
 } from "../src/auth/api/_shared/wecom/login";
+import { callbackFields, field } from "../src/auth/api/_shared/wecom/payload";
 import {
 	claimLoginTicket,
 	ensureTenant,
@@ -425,17 +426,46 @@ describe("P1-F：凭证链（client：缓存 + 失效重试 + 错误两态）",
 		await expect(client.userIdByCode("c", "a", "p", "CODE")).rejects.toMatchObject({ status: 502 });
 	});
 
-	it("get_permanent_code 缺 corpid / agent 列表为空 → 502（不静默落一行空 profile）", async () => {
+	it("get_permanent_code 缺 corpid / agent 列表为空且复核也没有 → 502（不静默落一行空 profile）", async () => {
 		const noAgent = createWecomClient({
+			// suite_access_token 由调用方传入，所以这里的应答从 get_permanent_code 开始
 			http: stubHttp([
-				{ suite_access_token: "sat", expires_in: 7200 },
 				{ permanent_code: "perm", auth_corp_info: { corpid: "ww_x" }, auth_info: { agent: [] } },
+				// 回源复核（get_auth_info）同样没有应用 → 这时才判死
+				{ auth_info: { agent: [] } },
 			]),
 			cache: fakeCache(),
 		});
 		await expect(noAgent.permanentCodeByAuthCode("sat", "AUTH")).rejects.toMatchObject({ status: 502 });
 	});
 
+	// 2026-11-01 生产日志：create_auth 拿到永久码，但 auth_info.agent 是空的 → 上一版直接 502，
+	// 企业管理员看到「应用安装失败」，而永久码白白作废（auth_code 一次有效）。
+	it("get_permanent_code 的 agent 为空 → 拿刚换到的永久码回源 get_auth_info 补齐", async () => {
+		const http = stubHttp([
+			{ permanent_code: "perm", auth_corp_info: { corpid: "ww_x" }, auth_info: { agent: [] } },
+			{ auth_info: { agent: [{ agentid: 1000012, auth_mode: 1 }] } },
+		]);
+		const client = createWecomClient({ http, cache: fakeCache() });
+
+		const granted = await client.permanentCodeByAuthCode("sat", "AUTH");
+
+		expect(granted.agentIds).toEqual(["1000012"]);
+		expect(granted.authModes["1000012"]).toBe(1);
+		expect(http.calls.some(u => u.includes("/service/get_auth_info"))).toBe(true);
+	});
+
+	it("auth_info.agent 给成单个对象（不是数组）也认——少一次「明明有应用却判成没授权」", async () => {
+		const client = createWecomClient({
+			http: stubHttp([
+				{ permanent_code: "perm", auth_corp_info: { corpid: "ww_x" }, auth_info: { agent: { agentid: 1000011, auth_mode: 0 } } },
+			]),
+			cache: fakeCache(),
+		});
+
+		expect((await client.permanentCodeByAuthCode("sat", "AUTH")).agentIds).toEqual(["1000011"]);
+	});
+
 	it("userNameById 拿到真名（去首尾空白）", async () => {
 		const http = stubHttp([{ access_token: "t", expires_in: 7200 }, { errcode: 0, name: " 张三 " }]);
 		const client = createWecomClient({ http, cache: fakeCache() });
@@ -493,7 +523,7 @@ describe("P1-G：事件分发（suite_ticket / 授权 / 解绑）", () => {
 				return "sat";
 			},
 			async permanentCodeByAuthCode() {
-				return { permanentCode: "perm_new", corpId: "ww_corp_a", corpName: "测试企业", agentIds: ["100001", "100002"], state: null, ...overrides };
+				return { permanentCode: "perm_new", corpId: "ww_corp_a", corpName: "测试企业", agentIds: ["100001", "100002"], authModes: { 100001: 0, 100002: 0 }, state: null, ...overrides };
 			},
 			async corpAccessToken() {
 				return "ct";
@@ -510,14 +540,39 @@ describe("P1-G：事件分发（suite_ticket / 授权 / 解绑）", () => {
 	const deps = (client: unknown) => ({ cfg: CFG, client: client as never, store: storeDeps() });
 
 	it("suite_ticket：落库并给 30 分钟有效期（企微 10 分钟推一次，过期即拒发 API）", async () => {
-		await handleSuiteEvent("<xml><InfoType>suite_ticket</InfoType><SuiteId>suite_1</SuiteId><SuiteTicket>tk_1</SuiteTicket></xml>", deps(fakeClient()));
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "suite_ticket", SuiteTicket: "tk_1" }, deps(fakeClient()));
 		expect(await getSuiteTicket(CFG.suiteId, storeDeps())).toEqual({ ticket: "tk_1", expiresAt: clock + 1800 });
 	});
 
+	it("suite_ticket 顺势预热 suite token（授权路径只剩一次出网），换票失败也不影响票据落库", async () => {
+		const seen: string[] = [];
+		const warm = {
+			...fakeClient(),
+			async suiteAccessToken(suiteId: string, secret: string, ticket: string) {
+				seen.push(`${suiteId}/${secret}/${ticket}`);
+				return "sat";
+			},
+		} as never;
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "suite_ticket", SuiteTicket: "tk_9" }, deps(warm));
+		expect(seen).toEqual(["suite_1/secret_1/tk_9"]);
+
+		// suite_secret 配错时只是预热失败：票据必须照旧落库，否则 create_auth 连门都进不去
+		const broken = {
+			...fakeClient(),
+			async suiteAccessToken() {
+				throw new Error("企微 get_suite_token 失败：errcode=40001");
+			},
+		} as never;
+		await expect(handleSuiteEvent({ SuiteId: "suite_1", InfoType: "suite_ticket", SuiteTicket: "tk_10" }, deps(broken)))
+			.resolves
+			.toBe("suite_ticket");
+		expect((await getSuiteTicket(CFG.suiteId, storeDeps())).ticket).toBe("tk_10");
+	});
+
 	it("create_auth：AuthCode 换永久码 → 每个 agent 一行 profile，并作废旧 corp token", async () => {
 		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
 		const client = fakeClient();
-		await handleSuiteEvent("<xml><InfoType>create_auth</InfoType><SuiteId>suite_1</SuiteId><AuthCode>AC_1</AuthCode><State>env=test</State></xml>", deps(client));
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_1", State: "env=test" }, deps(client));
 		const rows = dbo.prepare("SELECT agent_id, env, status FROM wecom_app_profile ORDER BY agent_id").all();
 		expect(rows).toEqual([
 			{ agent_id: "100001", env: "test", status: "active" },
@@ -528,31 +583,111 @@ describe("P1-G：事件分发（suite_ticket / 授权 / 解绑）", () => {
 		expect(dbo.prepare("SELECT action FROM sys_oplog WHERE action = 'wecom.auth.apply'").all()).toHaveLength(1);
 	});
 
+	// 回归：线上「应用安装失败，联系服务商」的正因——回调是匿名请求（无 X-TENANT-ID），
+	// sys_oplog 是租户表，sql_guard: deny 下不绑租户就写会被守卫拒；而它发生在 profile 已落库之后，
+	// 于是「授权其实成功了，企微却判失败」。鉴据：审计行必须落在该企业自己的租户下。
+	it("create_auth 匿名回调（无租户头）：审计前先按企业绑租户，行落进该企业 oplog", async () => {
+		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
+		g.http = {};
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_1" }, deps(fakeClient()));
+		expect(g.http.tenantId).toBe("ww_corp_a");
+		expect(dbo.prepare("SELECT tenant_id, target FROM sys_oplog WHERE action = 'wecom.auth.apply'").get())
+			.toMatchObject({ tenant_id: "ww_corp_a", target: "ww_corp_a" });
+	});
+
+	it("审计写失败不得把 create_auth 打成失败（授权已落库，企微必须拿到 success）", async () => {
+		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
+		const orig = g.db.table;
+		g.db.table = (name: string) => {
+			if (name === "sys_oplog")
+				throw new Error("tenant guard: table(s) [\"sys_oplog\"] require tenant context (missing tenant header)");
+			return orig(name);
+		};
+		try {
+			await expect(handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_1" }, deps(fakeClient())))
+				.resolves
+				.toBe("create_auth");
+		}
+		finally {
+			g.db.table = orig;
+		}
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_app_profile").get()).toMatchObject({ n: 2 });
+	});
+
 	it("cancel_auth：profile 全部停用 + 该租户 refresh 串清空（解绑后旧会话不得续命）", async () => {
 		await saveProfile(profile({ agent: "100001" }), storeDeps());
 		await saveProfile(profile({ agent: "100002" }), storeDeps());
 		dbo.prepare("INSERT INTO sys_refresh_token (token_hash, tenant_id, user_id, expires_at, revoked, created_at) VALUES ('h', 'ww_corp_a', 1, ?, 0, ?)").run(clock + 100, clock);
 
-		await handleSuiteEvent("<xml><InfoType>cancel_auth</InfoType><SuiteId>suite_1</SuiteId><AuthCorpId>ww_corp_a</AuthCorpId></xml>", deps(fakeClient()));
+		g.http = {};
+		await handleSuiteEvent({ SuiteId: "suite_1", InfoType: "cancel_auth", AuthCorpId: "ww_corp_a" }, deps(fakeClient()));
 
 		expect(dbo.prepare("SELECT DISTINCT status FROM wecom_app_profile").all()).toEqual([{ status: "disabled" }]);
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM sys_refresh_token").get()).toMatchObject({ n: 0 });
 		expect(dbo.prepare("SELECT level FROM sys_oplog WHERE action = 'wecom.auth.cancel'").get()).toMatchObject({ level: 4 });
+		// 清会话是裸 SQL，deny 档下同样要租户上下文
+		expect(g.http.tenantId).toBe("ww_corp_a");
 	});
 
 	it("SuiteId 与本部署不一致 → 400（不同套件的回调不得互相污染）", async () => {
-		await expect(handleSuiteEvent("<xml><InfoType>suite_ticket</InfoType><SuiteId>other</SuiteId><SuiteTicket>t</SuiteTicket></xml>", deps(fakeClient())))
+		await expect(handleSuiteEvent({ SuiteId: "other", InfoType: "suite_ticket", SuiteTicket: "t" }, deps(fakeClient())))
 			.rejects
 			.toMatchObject({ status: 400 });
 	});
 
-	it("不消费的事件（通讯录变更等）回 success 语义的 InfoType，不抛错（否则企微重推三次）", async () => {
-		expect(await handleSuiteEvent("<xml><InfoType>change_contact</InfoType><SuiteId>suite_1</SuiteId></xml>", deps(fakeClient()))).toBe("change_contact");
+	it("不消费的事件回 success 语义的 InfoType，不抛错（否则企微重推三次）", async () => {
+		expect(await handleSuiteEvent({ InfoType: "change_contact", SuiteId: "suite_1" }, deps(fakeClient()))).toBe("change_contact");
+	});
+
+	// 数据回调没有 InfoType，只有 MsgType=event + Event=change_contact：分流靠 Event 认，
+	// 认不出就会落进 default 被记成「不消费的事件」——而这条正是轨三的全部输入。
+	it("数据回调形态（无 InfoType）也能分流到轨三，且日志只留 ChangeType 不留值", async () => {
+		const dataCallback = {
+			ToUserName: "ww_corp_a",
+			CreateTime: 1700000000,
+			MsgType: "event",
+			Event: "change_contact",
+			ChangeType: "update_party",
+			Id: 2,
+		};
+		const logged: unknown[][] = [];
+		const orig = g.log;
+		const push = (...args: unknown[]) => void logged.push(args);
+		// 失败那条是 warn（成功才是 info）：两个都要抓，否则「没抛错」会掩盖「根本没走到轨三」
+		g.log = { ...orig, info: push, warn: push };
+		try {
+			// 返回值是 ChangeType（日志只用它记一行），不是事件名
+			expect(await handleSuiteEvent(dataCallback, deps(fakeClient()))).toBe("update_party");
+		}
+		finally {
+			g.log = orig;
+		}
+		// 这家企业在本用例里没授权：失败只记一笔，绝不抛（抛了企微就重推三次）
+		const line = logged.find(args => args[0] === "wecom change_contact ignored");
+		expect(line).toBeDefined();
+		// ChangeType 是协议枚举，记下来才有排查价值；姓名/工号这类明文值一个都不许进日志
+		expect(line).toContain("update_party");
+		expect(JSON.stringify(line)).toContain("未授权");
+	});
+
+	// 兜底口径（payload.ts 头的说明）：部分回调业务没有 JSON 文档，收到 XML 也必须能处理。
+	// 同一个事件两种格式走出来的效果必须一模一样，否则「换个格式就静默不认」会在真机上才暴露。
+	it("XML（文档形态）与 JSON 归一化结果一致：两种包体走同一条路径", async () => {
+		const asJson = { SuiteId: "suite_1", InfoType: "create_auth", AuthCode: "AC_xml" };
+		const asXml = [
+			"<xml><SuiteId><![CDATA[suite_1]]></SuiteId><InfoType><![CDATA[create_auth]]></InfoType>",
+			"<AuthCode><![CDATA[AC_xml]]></AuthCode></xml>",
+		].join("");
+		const fromJson = callbackFields(asJson);
+		const fromXml = callbackFields(asXml);
+		expect([...fromXml.values.entries()].sort()).toEqual([...fromJson.values.entries()].sort());
+		// 信封小写、明文大写都认：上游 JSON 信封是 {"tousername","encrypt"}
+		expect(field(callbackFields({ tousername: "ww_corp_a", encrypt: "abc" }), "Encrypt")).toBe("abc");
 	});
 
 	it("create_auth 缺 AuthCode → 400（宁可拒也不落半行 profile）", async () => {
 		await putSuiteTicket(CFG.suiteId, "tk_1", clock + 1800, storeDeps());
-		await expect(handleSuiteEvent("<xml><InfoType>create_auth</InfoType><SuiteId>suite_1</SuiteId></xml>", deps(fakeClient())))
+		await expect(handleSuiteEvent({ SuiteId: "suite_1", InfoType: "create_auth" }, deps(fakeClient())))
 			.rejects
 			.toMatchObject({ status: 400 });
 	});
@@ -656,6 +791,7 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 		installVars();
 		const cfg = readWecomConfig();
 		expect(cfg.baseUrl).toBe("https://site.example.com/api/auth/wecom");
+		// 不带 callback_format=json：官方文档只给「对外收款」写了这个参数，代开发的通用回调配置只有 XML
 		expect(eventUrlOf(cfg)).toBe("https://site.example.com/api/auth/wecom/event");
 		expect(loginRedirectOf(cfg)).toBe("https://site.example.com/api/auth/wecom/callback");
 		expect(siteRootOf(cfg)).toBe("https://site.example.com");

package/templates/tests/wecom-crypt.spec.ts

@@ -80,14 +80,23 @@ describe("aes256CbcDecrypt 对 WebCrypto", () => {
 
 	it("pKCS#7 非法填充硬失败（不返回半截明文）", () => {
 		expect(() => pkcs7Unpad(new Uint8Array(16))).toThrow(/bad padding/); // 全 0 填充
-		const tooBig = new Uint8Array(16).fill(0);
-		tooBig[15] = 17;
-		expect(() => pkcs7Unpad(tooBig)).toThrow(/bad padding/);
+		const tooBig = new Uint8Array(64).fill(33);
+		expect(() => pkcs7Unpad(tooBig)).toThrow(/bad padding/); // 33 > 企微的 32 字节补位块
 		const inconsistent = new Uint8Array(16).fill(0);
 		inconsistent[14] = 3;
 		inconsistent[15] = 3;
 		expect(() => pkcs7Unpad(inconsistent)).toThrow(/bad padding/);
 	});
+
+	it("企微的补位块是 32 字节：补位 17~32 必须能去掉（按 16 卡上限会误杀一半真实报文）", () => {
+		// 90968「概述」：数据采用 PKCS#7 填充至 **32 字节**的倍数。官方 demo 的 block_size 也是 32，
+		// 所以末字节可能取到 17~32；只认 1~16 会让这些报文全判 bad padding。
+		for (const pad of [1, 16, 17, 20, 31, 32]) {
+			const block = new Uint8Array(64).fill(0x41);
+			block.fill(pad, 64 - pad);
+			expect(pkcs7Unpad(block).length).toBe(64 - pad);
+		}
+	});
 });
 
 describe("wecomSignature：字典序排序后 sha1", () => {

package/templates/tests/wecom-endpoints.spec.ts

@@ -5,12 +5,13 @@
 //   2. 企微事件端点必须回**纯文本** success / echostr（JSON 信封 = 企微判失败 → 重推三次）；
 //   3. 回调链的租户来自服务端推导（state→profile → db.asTenant），且票据只能兑换一次。
 //
-// json / vars / kv / fetch / crypto 全部桩掉（oj 运行时全局同名同面）；密文用 WebCrypto 现造，
+// json / vars / kv / fetch / crypto 全部桩掉（oj 运行时全局同名同面）；密文用 node:crypto 现造，
 // 与 wecom-crypt.spec.ts 同一对照物，不拿自实现给自己背书。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import { webcrypto } from "node:crypto";
+import { Buffer } from "node:buffer";
+import { createCipheriv, webcrypto } from "node:crypto";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { bytesToB64, utf8Bytes, wecomSignature } from "../src/auth/api/_shared/wecom/crypt";
+import { bytesToB64, sha1Hex, utf8Bytes, wecomSignature } from "../src/auth/api/_shared/wecom/crypt";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -110,21 +111,24 @@ function installCrypto(): void {
 	Object.defineProperty(globalThis, "crypto", { value: c, configurable: true });
 }
 
-/** 企微侧 webhook 的密文包（random|len|msg|receiveid → AES-256-CBC/PKCS#7） */
+/**
+ * 企微侧 webhook 的密文包（random|len|msg|receiveid → AES-256-CBC，PKCS#7 **补到 32 字节**）。
+ *
+ * 补到 32 而不是 16：企微（90968）就是这么补的，补位值会落在 1~32——用 WebCrypto 的默认补位
+ * （固定 16 字节块）会永远只覆盖到 1~16，正好把线上约一半的报文排除在测试之外（真踩过）。
+ * 所以这里用 node:crypto 并关掉自动补位，自己按 32 补。
+ */
 async function seal(plain: string, receiveId = SUITE): Promise<string> {
 	const msg = utf8Bytes(plain);
 	const head = webcrypto.getRandomValues(new Uint8Array(16));
 	const len = new Uint8Array(4);
 	new DataView(len.buffer).setUint32(0, msg.length);
 	const recv = utf8Bytes(receiveId);
-	const buf = new Uint8Array(20 + msg.length + recv.length);
-	buf.set(head, 0);
-	buf.set(len, 16);
-	buf.set(msg, 20);
-	buf.set(recv, 20 + msg.length);
-	const key = await webcrypto.subtle.importKey("raw", AES_KEY, { name: "AES-CBC" }, false, ["encrypt"]);
-	const cipher = new Uint8Array(await webcrypto.subtle.encrypt({ name: "AES-CBC", iv: AES_KEY.subarray(0, 16) }, key, buf));
-	return bytesToB64(cipher);
+	const body = Buffer.concat([Buffer.from(head), Buffer.from(len), Buffer.from(msg), Buffer.from(recv)]);
+	const pad = 32 - (body.length % 32);
+	const cipher = createCipheriv("aes-256-cbc", Buffer.from(AES_KEY), Buffer.from(AES_KEY.subarray(0, 16)));
+	cipher.setAutoPadding(false);
+	return Buffer.concat([cipher.update(Buffer.concat([body, Buffer.alloc(pad, pad)])), cipher.final()]).toString("base64");
 }
 
 function request(opts: { query?: Record<string, string>, body?: unknown, headers?: Record<string, string>, tenantId?: string } = {}): void {
@@ -163,7 +167,7 @@ beforeEach(() => {
 	installKv();
 	installCrypto();
 	g.fetch = async () => ({ ok: true, json: async () => ({}) });
-	for (const t of ["wecom_app_profile", "wecom_suite_ticket", "wecom_login_ticket", "sys_refresh_token", "sys_login_throttle", "sys_rate_window", "sys_oplog"])
+	for (const t of ["wecom_app_profile", "wecom_suite_ticket", "wecom_login_ticket", "sys_refresh_token", "sys_login_throttle", "sys_rate_window", "sys_oplog", "sys_dept_member", "sys_department"])
 		dbo.exec(`DELETE FROM ${t}`);
 	// JIT 建号是跨用例污染源：每个用例都从「本企业还没建过号」起步
 	dbo.exec("DELETE FROM users WHERE source = 'wecom'");
@@ -183,11 +187,30 @@ describe("P1-I：GET /auth/wecom/login（发起授权）", () => {
 		expect(out.location).toBeNull();
 	});
 
-	it("缺企业代码 → 400，引导去登录页填（不猜默认企业）", async () => {
+	// 代开发模板常只服务一家企业：corp 缺省时从已安装档案自动解析，好让「应用主页」直接填
+	// `https://<域名>/login`（企微后台会因 URL 里的 `${corpid}` 占位符字符拒收）。三种情形分开钉。
+	it("缺企业代码且一家都没装 → 400，指向「生成开通链接」（不猜默认企业）", async () => {
 		request({ query: {} });
 		await (await api()).login.get();
 		expect(out.status).toBe(400);
-		expect(out.body.msg).toMatch(/企业代码/);
+		expect(out.body.msg).toMatch(/尚未完成企业微信授权/);
+	});
+
+	it("缺企业代码但只装了一家 → 302 到该企业的授权地址（省掉手填企业代码）", async () => {
+		seedCorp();
+		request({ query: {}, headers: { "user-agent": "Mozilla/5.0 Chrome/120" } });
+		await (await api()).login.get();
+		expect(out.status).toBe(302);
+		expect(out.location).toContain("appid=ww_corp_a");
+	});
+
+	it("缺企业代码且装了多家 → 400，要求链接里带 corp 参数区分", async () => {
+		seedCorp("ww_corp_a");
+		seedCorp("ww_corp_b");
+		request({ query: {} });
+		await (await api()).login.get();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/corp/);
 	});
 
 	it("未授权企业 → 400（文案不区分「没装」与「已停用」）", async () => {
@@ -374,6 +397,28 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		return { ...query, msg_signature: wecomSignature(TOKEN, query.timestamp, query.nonce, encrypted) };
 	}
 
+	/** 抓这一段里所有 log.info / log.warn 的 (msg, kv)：验收看的是日志，不是只看 HTTP 200 */
+	async function captureLogs(fn: () => Promise<void>): Promise<unknown[][]> {
+		const lines: unknown[][] = [];
+		const orig = g.log;
+		const push = (msg: string, ...kv: unknown[]) => void lines.push([msg, kv]);
+		g.log = { ...orig, info: push, warn: push };
+		try {
+			await fn();
+		}
+		finally {
+			g.log = orig;
+		}
+		return lines;
+	}
+
+	/** 取某条日志的 kv 片段；没这条就当场失败，别让后面的断言在 undefined 上跑 */
+	function logOf(lines: unknown[][], msg: string): unknown {
+		const line = lines.find(a => a[0] === msg);
+		expect(line, `没抓到日志：${msg}`).toBeDefined();
+		return line![1];
+	}
+
 	it("URL 验证：验签通过 → 以 text/plain 原样回解出的 echostr（不套信封）", async () => {
 		const echo = await seal("echo_12345");
 		request({ query: { ...signedQuery(echo), echostr: echo } });
@@ -403,7 +448,8 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(out.body.msg).toMatch(/签名/);
 	});
 
-	it("指令回调：验签+解密 → 落 suite_ticket → 回纯文本 success", async () => {
+	it("指令回调（文档形态：XML）→ 落 suite_ticket → 回纯文本 success", async () => {
+		// 96238 §3.2 的报文就是这个形状，也是线上真正会到的形态
 		const plain = "<xml><InfoType>suite_ticket</InfoType><SuiteId>suite_1</SuiteId><SuiteTicket>tk_9</SuiteTicket></xml>";
 		const encrypted = await seal(plain);
 		request({ query: signedQuery(encrypted), body: `<xml><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>` });
@@ -413,6 +459,117 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_9" });
 	});
 
+	it("指令回调（JSON 包体）：信封小写键 + 明文字段照常落库", async () => {
+		// 回调地址不带 callback_format=json（文档没覆盖这个参数，见 config.ts::eventUrlOf），
+		// 但归一化那层两种都认：万一上游改发 JSON，上下两层分别是
+		// {"tousername","encrypt","agentid"}（小写）与 {"InfoType",…}（大写）。
+		// 这条钉的是「大小写不敏感」这一层，别再让人回头改一次字段名。
+		const plain = JSON.stringify({ InfoType: "suite_ticket", SuiteId: SUITE, SuiteTicket: "tk_json" });
+		const encrypted = await seal(plain);
+		request({ query: signedQuery(encrypted), body: { tousername: SUITE, encrypt: encrypted, agentid: "100001" } });
+		await (await api()).event.post();
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_json" });
+	});
+
+	it("指令回调（JSON 字符串包体）：未经框架解析的原始串也能归一", async () => {
+		const plain = JSON.stringify({ InfoType: "suite_ticket", SuiteId: SUITE, SuiteTicket: "tk_str" });
+		const encrypted = await seal(plain);
+		request({ query: signedQuery(encrypted), body: JSON.stringify({ tousername: SUITE, encrypt: encrypted }) });
+		await (await api()).event.post();
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_str" });
+	});
+
+	it("数据回调 change_contact（应用侧形态：MsgType/Event，无 InfoType）→ 走轨三建档", async () => {
+		// 90970「成员变更通知」的原样字段：ToUserName/FromUserName/CreateTime/MsgType=event/
+		// Event=change_contact/ChangeType/UserID/Name/Department。
+		// 这条钉的是整条接线：解密 → 按 Event 分流（InfoType 为空）→ 绑租户 → 落库。
+		seedCorp();
+		const plain = [
+			"<xml>",
+			"<ToUserName><![CDATA[ww_corp_a]]></ToUserName>",
+			"<FromUserName><![CDATA[sys]]></FromUserName>",
+			"<CreateTime>1700000000</CreateTime>",
+			"<MsgType><![CDATA[event]]></MsgType>",
+			"<Event><![CDATA[change_contact]]></Event>",
+			"<ChangeType><![CDATA[create_user]]></ChangeType>",
+			"<UserID><![CDATA[zhangsan]]></UserID>",
+			"<Name><![CDATA[张三]]></Name>",
+			"<Department>1</Department>",
+			"</xml>",
+		].join("");
+		// 应用回调的 receiveid 是 **corpid**（90968 附注），不是 suiteid——信封 ToUserName 也是它
+		const encrypted = await seal(plain, "ww_corp_a");
+		const lines = await captureLogs(async () => {
+			request({
+				query: signedQuery(encrypted),
+				body: `<xml><ToUserName><![CDATA[ww_corp_a]]></ToUserName><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>`,
+			});
+			await (await api()).event.post();
+		});
+
+		// 无论处理成没成，都必须回 success：否则企微 5 秒后重推三次
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(logOf(lines, "wecom change_contact applied")).toEqual(["changeType", "create_user", "corpId", "ww_corp_a"]);
+
+		// 上游在本用例里拿不到 token（user/get 取不到）→ 退回事件自带字段：
+		// 姓名落库、**activated 保持 0**（建档 ≠ 用过本站，§9.1 的通讯录目录只收登录过的人）
+		expect(dbo.prepare("SELECT display_name, source, activated FROM users WHERE username = ?").get("wecom:zhangsan"))
+			.toMatchObject({ display_name: "张三", source: "wecom", activated: 0 });
+		// 值一律不进日志（姓名、工号都在明文里）
+		expect(JSON.stringify(lines)).not.toContain("张三");
+		expect(JSON.stringify(lines)).not.toContain("zhangsan");
+	});
+
+	it("数据回调 change_contact（代开发形态：InfoType）→ 同样进轨三，只给 Id 也能落库", async () => {
+		// 91134「成员通知事件」走的是模板指令回调，字段是 SuiteId/AuthCorpId/InfoType=change_contact，
+		// 没有 MsgType/Event。它与 suite_ticket 同用 InfoType 那一列，分流必须在 switch 之前——
+		// 落进 default 只会被记成「不消费的事件」，页面永远等不到部门。
+		seedCorp();
+		const plain = [
+			"<xml>",
+			"<SuiteId><![CDATA[suite_1]]></SuiteId>",
+			"<AuthCorpId><![CDATA[ww_corp_a]]></AuthCorpId>",
+			"<InfoType><![CDATA[change_contact]]></InfoType>",
+			"<ChangeType><![CDATA[update_party]]></ChangeType>",
+			"<Id>2</Id>",
+			"<Name><![CDATA[研发部]]></Name>",
+			"<ParentId>1</ParentId>",
+			"</xml>",
+		].join("");
+		const encrypted = await seal(plain);
+		const lines = await captureLogs(async () => {
+			request({ query: signedQuery(encrypted), body: `<xml><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>` });
+			await (await api()).event.post();
+		});
+
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(logOf(lines, "wecom change_contact applied")).toEqual(["changeType", "update_party", "corpId", "ww_corp_a"]);
+		expect(dbo.prepare("SELECT origin, origin_id, name, deleted FROM sys_department WHERE origin = 'wecom'").get())
+			.toMatchObject({ origin: "wecom", origin_id: "2", name: "研发部", deleted: 0 });
+		expect(JSON.stringify(lines)).not.toContain("研发部");
+	});
+
+	it("未授权企业的通讯录事件：只记一笔，照旧回 success（事件是加速器不是权威）", async () => {
+		// 没 seedCorp：企业没授权、没有永久码，什么都不该写——但也不能抛，
+		// 否则企微重推三次，而重推补不回「这家企业没授权」。
+		const plain = "<xml><ToUserName><![CDATA[ww_corp_z]]></ToUserName><MsgType>event</MsgType><Event>change_contact</Event><ChangeType>delete_user</ChangeType><UserID>lisi</UserID></xml>";
+		const encrypted = await seal(plain, "ww_corp_z");
+		const lines = await captureLogs(async () => {
+			request({ query: signedQuery(encrypted), body: `<xml><ToUserName><![CDATA[ww_corp_z]]></ToUserName><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>` });
+			await (await api()).event.post();
+		});
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(JSON.stringify(logOf(lines, "wecom change_contact ignored"))).toContain("未授权");
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM users WHERE source = 'wecom'").get()).toMatchObject({ n: 0 });
+	});
+
 	it("报文缺 Encrypt → 400", async () => {
 		request({ query: signedQuery("x"), body: "<xml></xml>" });
 		await (await api()).event.post();
@@ -427,6 +584,72 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
 	});
 
+	// 2026-11-01 生产时序：create_auth → 上游 502 → 企微 5 秒后重推 → 被「nonce 重复」挡回。
+	// 重推是瞬态故障唯一的恢复路径，让它废在重放守卫上等于把恢复路径拆了。
+	it("处理失败的 nonce 会被放回：重推按真实原因重试，不被判成重放", async () => {
+		const plain = "<xml><InfoType>suite_ticket</InfoType><SuiteId>other_suite</SuiteId><SuiteTicket>tk_x</SuiteTicket></xml>";
+		const encrypted = await seal(plain);
+		const query = signedQuery(encrypted, { nonce: "retry_once" });
+		const body = `<xml><Encrypt>${encrypted}</Encrypt></xml>`;
+
+		request({ query, body });
+		await (await api()).event.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/SuiteId/);
+
+		// 同一条报文重推（企微的语义）：仍按真实原因失败，而不是 400「nonce 重复」
+		request({ query, body });
+		await (await api()).event.post();
+		expect(out.body.msg).toMatch(/SuiteId/);
+		expect(out.body.msg).not.toMatch(/nonce 重复/);
+	});
+
+	// 重放闸门的本体：同 nonce 已被占用、而首推还没标「已落库」——此刻重复投递必须挡下
+	// （可能是真重放，也可能是首推仍在处理中；两种都不该并发出第二份副作用）。
+	it("同 nonce 已被占用且未标已落库 → 400「nonce 重复」（重放闸门本体）", async () => {
+		const encrypted = await seal(TICKET_XML);
+		const query = signedQuery(encrypted, { nonce: "inflight" });
+		const body = `<xml><Encrypt>${encrypted}</Encrypt></xml>`;
+		// 模拟「首推正在处理」：计数已到 1，但没有 applied 标记
+		await g.kv.incr("wecom:nonce:inflight");
+
+		request({ query, body });
+		await (await api()).event.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/nonce 重复/);
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
+	});
+
+	it("EncodingAESKey 与后台不一致（签名过、解密爆 pkcs7）→ 400，日志点名是哪一侧配错", async () => {
+		// 用户实报的原样症状：WARN reason=pkcs7: bad padding。签名先过说明后台 Token 与本部署一致，
+		// 所以只回一句 bad padding 等于没给线索——日志必须带「外层 ToUserName / 配置套件 / 实际加载的密钥指纹」。
+		const warns: unknown[][] = [];
+		const orig = g.log;
+		g.log = { ...orig, warn: (msg: string, ...kv: unknown[]) => warns.push([msg, kv]) };
+		try {
+			const encrypted = await seal(TICKET_XML);
+			// 后台用真钥匙加密，本部署加载另一把 43 字符（仍解 32 字节，不会先撞长度校验）
+			installVars({ wecom_encoding_aes_key: "Q".repeat(43) });
+			request({
+				query: signedQuery(encrypted),
+				body: `<xml><ToUserName><![CDATA[${SUITE}]]></ToUserName><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>`,
+			});
+			await (await api()).event.post();
+		}
+		finally {
+			g.log = orig;
+		}
+
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/解密失败/);
+		const hit = warns.find(w => w[0] === "wecom callback decrypt failed");
+		expect(hit).toBeDefined();
+		const kv = hit![1] as unknown[];
+		expect(kv).toContain("pkcs7: bad padding");
+		expect(kv).toContain(SUITE); // envelopeToUser 与 configuredSuite 同值 → 指向「密钥不一致」而不是「套件不对」
+		expect(kv).toContain(sha1Hex("Q".repeat(43)).slice(0, 8));
+	});
+
 	it("timestamp 超出 ±5 分钟窗口 → 400（历史回调不得被无限期重放）", async () => {
 		const encrypted = await seal(TICKET_XML);
 		const stale = String(nowSecs() - 8 * 60);
@@ -437,19 +660,24 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
 	});
 
-	it("同一条回调连发两次（重放）→ 第二次 400 nonce 重复，票据只落一次", async () => {
+	// 处理成功后的重推：回 success 而不是 400——企微只在「拿不到 success」时重推，首推若因回包慢
+	// 被判超时，重推再被挡成 400，管理员端就会看到「应用安装失败」。副作用仍然只发生一次。
+	it("同一条回调连发两次（成功后的重推）→ 第二次幂等回 success，票据只落一次", async () => {
 		const encrypted = await seal(TICKET_XML);
 		const body = `<xml><Encrypt>${encrypted}</Encrypt></xml>`;
 		request({ query: signedQuery(encrypted), body });
 		await (await api()).event.post();
 		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
 
 		installJson();
 		request({ query: signedQuery(encrypted), body });
 		await (await api()).event.post();
-		expect(out.status).toBe(400);
-		expect(out.body.msg).toMatch(/nonce 重复/);
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		// 幂等成功不等于重放执行：库里仍是首推那次的值
 		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_9" });
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 1 });
 	});
 
 	it("换一个新 nonce 的同内容回调仍能落（重放闸门没把正常重试误伤）", async () => {