@oj-module/cli 0.2.48 → 0.2.50

package/templates/tests/wecom-endpoints.spec.ts

@@ -179,19 +179,44 @@ afterEach(() => {
 
 describe("P1-I：GET /auth/wecom/login（发起授权）", () => {
 	it("部署常量缺失 → 400 信封并点出缺哪几个 vars（不是 500）", async () => {
-		installVars({ wecom_suite_id: "", wecom_enc_key: "" });
+		// 登录只依赖「与来源无关」的两项（落库密钥 + 基址）：suite/corp 凭据不进必填集合，
+		// 否则自建应用的部署会在读 wecom_suite_id 处直接 400（两种来源就没法共存了）。
+		installVars({ wecom_enc_key: "", wecom_base_url: "" });
 		request({ query: { corp: "ww_corp_a" } });
 		await (await api()).login.get();
 		expect(out.status).toBe(400);
-		expect(out.body.msg).toMatch(/wecom_suite_id/);
+		expect(out.body.msg).toMatch(/wecom_enc_key/);
+		expect(out.body.msg).toMatch(/wecom_base_url/);
 		expect(out.location).toBeNull();
 	});
 
-	it("缺企业代码 → 400，引导去登录页填（不猜默认企业）", async () => {
+	// 代开发模板常只服务一家企业：corp 缺省时从已安装档案自动解析，好让「应用主页」直接填
+	// `https://<域名>/login`（企微后台会因 URL 里的 `${corpid}` 占位符字符拒收）。三种情形分开钉。
+	it("缺企业代码且一家都没装 → 400，同时给出两种来源的下一步（不猜默认企业）", async () => {
 		request({ query: {} });
 		await (await api()).login.get();
 		expect(out.status).toBe(400);
-		expect(out.body.msg).toMatch(/企业代码/);
+		expect(out.body.msg).toMatch(/尚未完成企业微信接入/);
+		// 文案要能分诊：代开发去扫码开通，自建应用去后台点「验证并接入」
+		expect(out.body.msg).toMatch(/代开发/);
+		expect(out.body.msg).toMatch(/验证并接入/);
+	});
+
+	it("缺企业代码但只装了一家 → 302 到该企业的授权地址（省掉手填企业代码）", async () => {
+		seedCorp();
+		request({ query: {}, headers: { "user-agent": "Mozilla/5.0 Chrome/120" } });
+		await (await api()).login.get();
+		expect(out.status).toBe(302);
+		expect(out.location).toContain("appid=ww_corp_a");
+	});
+
+	it("缺企业代码且装了多家 → 400，要求链接里带 corp 参数区分", async () => {
+		seedCorp("ww_corp_a");
+		seedCorp("ww_corp_b");
+		request({ query: {} });
+		await (await api()).login.get();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/corp/);
 	});
 
 	it("未授权企业 → 400（文案不区分「没装」与「已停用」）", async () => {
@@ -565,6 +590,42 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
 	});
 
+	// 2026-11-01 生产时序：create_auth → 上游 502 → 企微 5 秒后重推 → 被「nonce 重复」挡回。
+	// 重推是瞬态故障唯一的恢复路径，让它废在重放守卫上等于把恢复路径拆了。
+	it("处理失败的 nonce 会被放回：重推按真实原因重试，不被判成重放", async () => {
+		const plain = "<xml><InfoType>suite_ticket</InfoType><SuiteId>other_suite</SuiteId><SuiteTicket>tk_x</SuiteTicket></xml>";
+		const encrypted = await seal(plain);
+		const query = signedQuery(encrypted, { nonce: "retry_once" });
+		const body = `<xml><Encrypt>${encrypted}</Encrypt></xml>`;
+
+		request({ query, body });
+		await (await api()).event.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/SuiteId/);
+
+		// 同一条报文重推（企微的语义）：仍按真实原因失败，而不是 400「nonce 重复」
+		request({ query, body });
+		await (await api()).event.post();
+		expect(out.body.msg).toMatch(/SuiteId/);
+		expect(out.body.msg).not.toMatch(/nonce 重复/);
+	});
+
+	// 重放闸门的本体：同 nonce 已被占用、而首推还没标「已落库」——此刻重复投递必须挡下
+	// （可能是真重放，也可能是首推仍在处理中；两种都不该并发出第二份副作用）。
+	it("同 nonce 已被占用且未标已落库 → 400「nonce 重复」（重放闸门本体）", async () => {
+		const encrypted = await seal(TICKET_XML);
+		const query = signedQuery(encrypted, { nonce: "inflight" });
+		const body = `<xml><Encrypt>${encrypted}</Encrypt></xml>`;
+		// 模拟「首推正在处理」：计数已到 1，但没有 applied 标记
+		await g.kv.incr("wecom:nonce:inflight");
+
+		request({ query, body });
+		await (await api()).event.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/nonce 重复/);
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
+	});
+
 	it("EncodingAESKey 与后台不一致（签名过、解密爆 pkcs7）→ 400，日志点名是哪一侧配错", async () => {
 		// 用户实报的原样症状：WARN reason=pkcs7: bad padding。签名先过说明后台 Token 与本部署一致，
 		// 所以只回一句 bad padding 等于没给线索——日志必须带「外层 ToUserName / 配置套件 / 实际加载的密钥指纹」。
@@ -605,19 +666,24 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
 	});
 
-	it("同一条回调连发两次（重放）→ 第二次 400 nonce 重复，票据只落一次", async () => {
+	// 处理成功后的重推：回 success 而不是 400——企微只在「拿不到 success」时重推，首推若因回包慢
+	// 被判超时，重推再被挡成 400，管理员端就会看到「应用安装失败」。副作用仍然只发生一次。
+	it("同一条回调连发两次（成功后的重推）→ 第二次幂等回 success，票据只落一次", async () => {
 		const encrypted = await seal(TICKET_XML);
 		const body = `<xml><Encrypt>${encrypted}</Encrypt></xml>`;
 		request({ query: signedQuery(encrypted), body });
 		await (await api()).event.post();
 		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
 
 		installJson();
 		request({ query: signedQuery(encrypted), body });
 		await (await api()).event.post();
-		expect(out.status).toBe(400);
-		expect(out.body.msg).toMatch(/nonce 重复/);
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		// 幂等成功不等于重放执行：库里仍是首推那次的值
 		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_9" });
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 1 });
 	});
 
 	it("换一个新 nonce 的同内容回调仍能落（重放闸门没把正常重试误伤）", async () => {

package/templates/tests/wecom-org-sync.spec.ts

@@ -184,6 +184,7 @@ describe("B1-B：授权模式（auth_mode）", () => {
 			agentId: "100001",
 			env: "prod",
 			corpName: "测试企业",
+			credentialKind: "suite",
 			permanentCode: "perm_a",
 			authMode: 1,
 		}, storeDeps());
@@ -199,6 +200,7 @@ describe("B1-B：授权模式（auth_mode）", () => {
 			agentId: "100001",
 			env: "prod",
 			corpName: null,
+			credentialKind: "suite",
 			permanentCode: "perm_a",
 		} as never, storeDeps());
 		expect((await findProfile("ww_corp_a", "100001", storeDeps())).authMode).toBe(0);
@@ -212,6 +214,7 @@ describe("B1-B：授权模式（auth_mode）", () => {
 			agentId: "100001",
 			env: "prod",
 			corpName: "测试企业",
+			credentialKind: "suite",
 			permanentCode: "perm_a",
 			authMode: 0,
 		}, storeDeps());
@@ -241,6 +244,7 @@ describe("B1-B：授权模式（auth_mode）", () => {
 			agentId: "100001",
 			env: "prod",
 			corpName: "测试企业",
+			credentialKind: "suite",
 			permanentCode: "perm_a",
 			authMode: 0,
 		}, storeDeps());
@@ -266,6 +270,7 @@ describe("B1-D：授权探针（同步入口的准入事实）", () => {
 		agentId,
 		env: "prod",
 		corpName: null,
+		credentialKind: "suite",
 		permanentCode: `perm_${agentId}`,
 		authMode,
 	}, storeDeps());
@@ -276,7 +281,7 @@ describe("B1-D：授权探针（同步入口的准入事实）", () => {
 
 	it("装了 → 拿得到 agent + 授权模式；带 agent 可收窄，指错应用 → null", async () => {
 		await profile("100001", 1);
-		expect(await probeProfile("ww_corp_a", null)).toEqual({ agentId: "100001", authMode: 1, status: "active" });
+		expect(await probeProfile("ww_corp_a", null)).toEqual({ agentId: "100001", authMode: 1, status: "active", credentialKind: "suite" });
 		expect(await probeProfile("ww_corp_a", "100001")).toMatchObject({ authMode: 1 });
 		expect(await probeProfile("ww_corp_a", "200002")).toBeNull();
 	});
@@ -447,6 +452,7 @@ describe("C1：通讯录事件增量（change_contact）", () => {
 			agentId: "100001",
 			env: "prod",
 			corpName: "测试企业",
+			credentialKind: "suite",
 			permanentCode: "perm_a",
 			authMode: 0,
 		}, storeDeps());

package/vendor/host-versions.json

@@ -8,9 +8,9 @@
 		"react-router": "7.18.2",
 		"react-router/dom": "7.18.2",
 		"@tanstack/react-query": "5.102.8",
-		"@oj-module/runtime": "0.2.48",
-		"@oj-module/runtime/contract": "0.2.48",
-		"@oj-module/runtime/contract/errors": "0.2.48",
+		"@oj-module/runtime": "0.2.50",
+		"@oj-module/runtime/contract": "0.2.50",
+		"@oj-module/runtime/contract/errors": "0.2.50",
 		"@plane/kit": "0.1.20",
 		"@plane/editor": "0.1.20",
 		"antd": "6.6.1",