@oj-module/cli 0.2.54 → 0.2.56

package/templates/tests/lifecycle/verify-report.spec.ts

@@ -1,8 +1,8 @@
 // BDD：P2-8 深检报告结构 + 留存 N=10 + 可信性项（trust_state）+ i18n 降级项 + 设值不进报告。
 // 纯模块单测（verify-report.ts）+ 端点编排（persist-on-POST / GET verify/last / 降级项 / secret 不泄漏）。
 /* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（verify-checks.spec 同约定） */
-import type { FsFace } from "../../src/_platform/api/_lifecycle/atomic";
-import type { VerifyReport } from "../../src/_platform/api/_lifecycle/verify-report";
+import type { FsFace } from "../../src/app/api/_platform/_lifecycle/atomic";
+import type { VerifyReport } from "../../src/app/api/_platform/_lifecycle/verify-report";
 import * as fsp from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -12,8 +12,8 @@ import {
 	persistReport,
 	VERIFY_REPORTS_KEEP,
 	verifyReportsDirOf,
-} from "../../src/_platform/api/_lifecycle/verify-report";
-import { createSolutionsApi, solutionsEnv } from "../../src/_platform/api/solutions/api";
+} from "../../src/app/api/_platform/_lifecycle/verify-report";
+import { createSolutionsApi, solutionsEnv } from "../../src/app/api/_platform/solutions/api";
 import { installDb } from "../fixture";
 
 const g = globalThis as any;

package/templates/tests/org-departments.spec.ts

@@ -1,4 +1,4 @@
-import type { OrgDeps } from "../src/_platform/api/_shared/service/domain/org";
+import type { OrgDeps } from "../src/app/api/_platform/_shared/service/domain/org";
 
 // BDD：组织架构领域（0016，方案 A1+A2）——CRUD 基线 + 归属权（D13）+ 保底出口（D14）。
 //
@@ -23,8 +23,8 @@ import {
 	updateDepartment,
 	updateMember,
 	upsertDepartment,
-} from "../src/_platform/api/_shared/service/domain/org";
-import { deleteUser, listUsers, updateUserProfile } from "../src/_platform/api/_shared/service/domain/users";
+} from "../src/app/api/_platform/_shared/service/domain/org";
+import { deleteUser, listUsers, updateUserProfile } from "../src/app/api/_platform/_shared/service/domain/users";
 import { ADMIN, installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -263,12 +263,16 @@ describe("用户侧（改资料 / 删号）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) c FROM sys_refresh_token WHERE user_id = ?").get(uid)).toMatchObject({ c: 0 });
 	});
 
-	it("删号：禁止删自己；最后一个 superadmin 拒删", async () => {
+	it("删号：禁止删自己；非 superadmin 删 superadmin → 403（最后超管的实际防线）", async () => {
 		await expect(deleteUser(ADMIN, ADMIN)).rejects.toMatchObject({ status: 400 });
 		const solo = mkUser("u_sup");
 		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, 'superadmin')").run(solo);
-		await expect(deleteUser(ADMIN, solo)).rejects.toMatchObject({ status: 400 });
-		// 有两个 superadmin 时允许删（兜底只保最后一个）
+		// 目标门禁先于「最后一个 superadmin」计数：普通 admin 连碰都碰不到它。
+		// 计数兜底（400）因此在真实路径上不可达——操作者本身是 superadmin 时，
+		// 库里必然已有 ≥2 个 superadmin——保留它只为挡住未来的新写路径。
+		await expect(deleteUser(ADMIN, solo)).rejects.toMatchObject({ status: 403 });
+		expect(dbo.prepare("SELECT COUNT(*) c FROM users WHERE id = ?").get(solo)).toMatchObject({ c: 1 });
+		// 操作者升为 superadmin 后允许删（第二个超管在场）
 		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, 'superadmin')").run(ADMIN);
 		await deleteUser(ADMIN, solo);
 		expect(dbo.prepare("SELECT COUNT(*) c FROM users WHERE id = ?").get(solo)).toMatchObject({ c: 0 });

package/templates/tests/org-read.spec.ts

@@ -8,15 +8,15 @@
 //      反过来也钉住：返回字段与 scope 无关，消费模块不该按档位分支解析。
 //
 // 另外钉住 §9.1 阻断项：通讯录只出 activated=1，同步灌进来的「从未登录」账号不得被检索到。
-import type { OrgDeps } from "../src/_platform/api/_shared/service/domain/org";
+import type { OrgDeps } from "../src/app/api/_platform/_shared/service/domain/org";
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { contactDetail, searchContacts } from "../src/_platform/api/_shared/service/domain/contacts";
+import { contactDetail, searchContacts } from "../src/app/api/_platform/_shared/service/domain/contacts";
 import {
 	addMember,
 	createDepartment,
 	deleteDepartment,
-} from "../src/_platform/api/_shared/service/domain/org";
+} from "../src/app/api/_platform/_shared/service/domain/org";
 import {
 	isMemberOf,
 	pageDepartments,
@@ -28,10 +28,10 @@ import {
 	resolveReader,
 	resolveReadFace,
 	resolveUserIds,
-} from "../src/_platform/api/_shared/service/domain/org-read";
-import { createUser } from "../src/_platform/api/_shared/service/domain/users";
-import { invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
-import { ensureWecomUser } from "../src/auth/api/_shared/wecom/login";
+} from "../src/app/api/_platform/_shared/service/domain/org-read";
+import { createUser } from "../src/app/api/_platform/_shared/service/domain/users";
+import { invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
+import { ensureWecomUser } from "../src/app/api/auth/_shared/wecom/login";
 import { ADMIN, installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/query-utils.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { beforeAll, describe, expect, it } from "vitest";
 
-import { likePattern, paged, pagedFactory } from "../src/_platform/api/_shared/service/infra/query";
+import { likePattern, paged, pagedFactory } from "../src/app/api/_platform/_shared/service/infra/query";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-audit.spec.ts

@@ -3,7 +3,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/_platform/api/_shared/service/infra/audit";
+import { auditDeny, auditOp, recordOp, resetDenyAudit } from "../src/app/api/_platform/_shared/service/infra/audit";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-contacts.spec.ts

@@ -5,7 +5,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { contactDetail, searchContacts } from "../src/_platform/api/_shared/service/domain/contacts";
+import { contactDetail, searchContacts } from "../src/app/api/_platform/_shared/service/domain/contacts";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -84,7 +84,7 @@ describe("详情与限速", () => {
 	it("接口级限速：同用户突发超限 → 429", async () => {
 		const uid = mkUser("c_rate");
 		g.http = { user: { id: uid } };
-		const { rateLimit } = await import("../src/_platform/api/_shared/service/infra/rate");
+		const { rateLimit } = await import("../src/app/api/_platform/_shared/service/infra/rate");
 		// 窗口 60s / 限额 3（测试参数；生产端点各自定额）
 		for (let i = 0; i < 3; i++)
 			await rateLimit(`contacts:${uid}`, 3, 60_000);

package/templates/tests/rbac-guard.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 
-import { assertPermission, assertSuperAdmin, assertSystemAdmin, currentAccess, invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
+import { assertPermission, assertSuperAdmin, assertSystemAdmin, currentAccess, invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-roles.spec.ts

@@ -4,8 +4,8 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/_platform/api/_shared/service/domain/roles";
-import { assertPermission } from "../src/_platform/api/_shared/service/infra/access";
+import { createRole, deleteRole, listPermissions, listRoles, updateBindings } from "../src/app/api/_platform/_shared/service/domain/roles";
+import { assertPermission } from "../src/app/api/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -156,4 +156,12 @@ describe("列表支撑（C2 页面数据源）", () => {
 		expect(perms.find(p => p.code === "wiki.old")?.deprecated).toBe(true);
 		expect(perms.find(p => p.code === "wiki.new")?.deprecated).toBe(false);
 	});
+
+	it("listRoles 原样返回 superadmin（只在 /system/roles 展示层隐去）", async () => {
+		// 成员资格页（users/roles.tsx）把 superadmin 当可授予项（仅 superadmin 可勾选），
+		// 页面数据源里少了它会让「授予超级管理员」直接不可用。过滤只做在展示层。
+		dbo.prepare("INSERT INTO sys_role (name, module, builtin) VALUES ('superadmin', 'framework', 1)").run();
+		const roles = await listRoles();
+		expect(roles.map(r => r.name)).toContain("superadmin");
+	});
 });

package/templates/tests/rbac-seed.spec.ts

@@ -8,7 +8,7 @@ import { beforeAll, describe, expect, it } from "vitest";
 
 import { installDb } from "./fixture";
 
-const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api", "seed.sql");
+const SEED = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "app", "api", "_platform", "seed.sql");
 let dbo: ReturnType<typeof installDb>;
 
 beforeAll(() => {

package/templates/tests/rbac-settings.spec.ts

@@ -2,8 +2,9 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/api/_shared/service/domain/settings";
-import { searchOplog } from "../src/_platform/api/_shared/service/infra/oplog";
+import { listLoginMethods, listSettings, updateSetting } from "../src/app/api/_platform/_shared/service/domain/settings";
+import { recordOp } from "../src/app/api/_platform/_shared/service/infra/audit";
+import { searchOplog } from "../src/app/api/_platform/_shared/service/infra/oplog";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -27,6 +28,8 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 	// 按 api-manual §1153 契约建模（引擎语义的忠实复刻，非新逻辑）。
 	function fakeTable() {
 		const conds: Array<{ test: unknown, cond: any }> = [];
+		// 分页同样只记录不执行：count 查询不该带 limit/offset，list 查询必须带上
+		const paging: { limit: number | null, offset: number | null } = { limit: null, offset: null };
 		const b: any = {
 			whereIf: (test: unknown, cond: any) => {
 				if (test !== undefined && test !== null && test !== false && !(Array.isArray(test) && test.length === 0))
@@ -35,17 +38,23 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 			},
 			select: () => b,
 			orderBy: () => b,
-			limit: () => b,
-			offset: () => b,
+			limit: (n: number) => {
+				paging.limit = n;
+				return b;
+			},
+			offset: (n: number) => {
+				paging.offset = n;
+				return b;
+			},
 			// 固定非零 total：保证 count/list 两条路径都构造（total=0 跳过 list 的行为
 			// 由 query-utils.spec 的 pagedFactory 用例覆盖，这里只关心条件发射）
 			all: async () => [{ c: 42 }],
 		};
-		return { b, conds };
+		return { b, conds, paging };
 	}
 
-	/** 以假构造器跑 searchOplog，回传 count 构造发射的条件（并校验 count/list 同条件） */
-	async function captureConds(filter: Parameters<typeof searchOplog>[0]) {
+	/** 以假构造器跑 searchOplog，回传 count/list 两次构造（[0]=count，[1]=list） */
+	async function captureBuilt(filter: Parameters<typeof searchOplog>[0]) {
 		const built: Array<ReturnType<typeof fakeTable>> = [];
 		const prevDb = g.db;
 		g.db = {
@@ -63,6 +72,12 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 		}
 		expect(built).toHaveLength(2); // count + list 各构造一次
 		expect(built[1].conds).toEqual(built[0].conds); // mk 工厂：两组条件一致
+		return built;
+	}
+
+	/** 回传 count 构造发射的条件 */
+	async function captureConds(filter: Parameters<typeof searchOplog>[0]) {
+		const built = await captureBuilt(filter);
 		return built[0].conds;
 	}
 
@@ -87,6 +102,61 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 		]);
 		expect(conds.some(c => (c.cond as { field?: string }).field === "level")).toBe(false);
 	});
+
+	it("page/limit 只作用在 list 查询：limit=size、offset=(page-1)*size，count 不带分页", async () => {
+		const [count, list] = await captureBuilt({ action: "user.create", page: 3, limit: 10 });
+		expect(count!.paging).toEqual({ limit: null, offset: null });
+		expect(list!.paging).toEqual({ limit: 10, offset: 20 });
+	});
+
+	it("缺省/非法分页参数：第 1 页 20 条，size 静默钳 200", async () => {
+		expect((await captureBuilt({}))[1]!.paging).toEqual({ limit: 20, offset: 0 });
+		expect((await captureBuilt({ page: 0, limit: "abc" }))[1]!.paging).toEqual({ limit: 20, offset: 0 });
+		expect((await captureBuilt({ page: 2, limit: 10_000 }))[1]!.paging).toEqual({ limit: 200, offset: 200 });
+	});
+});
+
+// 真库分页语义：上面用假构造器只钉「参数怎么发」，这里钉「切片/总数/还剩多少」算得对——
+// 页导航能否正确显示页数全靠 total，靠 truncated 提示「结果被截断」的旧交互已删除。
+describe("AC1-29：操作日志分页（真库切片 + total）", () => {
+	async function seedOplog(n: number) {
+		for (let i = 1; i <= n; i++)
+			await recordOp({ action: "test.page", module: "framework", target: `t${i}` });
+	}
+
+	it("按 id 倒序切页：total 是全量而不是本页条数", async () => {
+		await seedOplog(5);
+		const p1 = await searchOplog({ page: 1, limit: 2 });
+		expect(p1.total).toBe(5);
+		expect(p1.list.map(r => r.target)).toEqual(["t5", "t4"]);
+		expect(p1.truncated).toBe(true);
+
+		const p2 = await searchOplog({ page: 2, limit: 2 });
+		expect(p2.list.map(r => r.target)).toEqual(["t3", "t2"]);
+		expect(p2.truncated).toBe(true);
+
+		// 末页：5 条 / 每页 2 → 第 3 页只剩 1 条，truncated=false（页导航据此停在第 3 页）
+		const p3 = await searchOplog({ page: 3, limit: 2 });
+		expect(p3.list.map(r => r.target)).toEqual(["t1"]);
+		expect(p3.truncated).toBe(false);
+	});
+
+	it("越界页：list 为空但 total 仍为全量（前端据此纠正页码，而不是显示 0 条）", async () => {
+		await seedOplog(3);
+		const far = await searchOplog({ page: 99, limit: 20 });
+		expect(far.list).toEqual([]);
+		expect(far.total).toBe(3);
+		expect(far.truncated).toBe(false);
+	});
+
+	it("过滤与分页叠加：total 按过滤后的集合算", async () => {
+		await seedOplog(5);
+		await recordOp({ action: "other.act", module: "framework", target: "x" });
+		const r = await searchOplog({ action: "test.page", page: 1, limit: 2 });
+		expect(r.total).toBe(5);
+		expect(r.list).toHaveLength(2);
+		expect(r.list.every(x => x.action === "test.page")).toBe(true);
+	});
 });
 
 describe("PRD §4.3：系统设置", () => {

package/templates/tests/rbac-solution-perms.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/api/_shared/service/domain/solution-perms";
+import { uninstallSolution, upsertSolutionPerms } from "../src/app/api/_platform/_shared/service/domain/solution-perms";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-tables.spec.ts

@@ -61,3 +61,32 @@ describe("users 表扩展（PRD §4.2 数据模型）", () => {
 		expect(String(source?.dflt_value)).toContain("local");
 	});
 });
+
+// 回归：0017 给 users 加工号列。事故形态是「列进了库、schema.yaml 白名单漏了」，
+// 构造器在发 SQL 前就拒成 `unknown column 'employee_no' in on 'users'`，日志里没有 SQL 可查。
+// 白名单那半边在 packages/cli/src/__tests__/templates-schema-columns.test.ts 钉；
+// 这里钉库侧语义：列真的落库、租户内唯一、NULL 不占位、跨租户可重复。
+describe("users.employee_no（0017 工号列）", () => {
+	function addUser(username: string, tenant: string, employeeNo: string | null) {
+		dbo.prepare("INSERT INTO users (username, password_hash, tenant_id, employee_no) VALUES (?, 'x', ?, ?)")
+			.run(username, tenant, employeeNo);
+	}
+
+	it("迁移落出 employee_no 列", () => {
+		expect(colsOf("users")).toContain("employee_no");
+	});
+
+	it("唯一索引按 (tenant_id, employee_no) 且是部分索引（NULL 不占位）", () => {
+		const idx = dbo.prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'uk_users_employee_no'").get() as { sql: string | null } | undefined;
+		expect(idx?.sql).toContain("tenant_id");
+		expect(idx?.sql).toContain("employee_no IS NOT NULL");
+	});
+
+	it("同租户工号重复被拒，跨租户可重复，NULL 可多行", () => {
+		addUser("eno-a", "acme", "E-100");
+		expect(() => addUser("eno-b", "acme", "E-100")).toThrow(/UNIQUE/);
+		expect(() => addUser("eno-c", "globex", "E-100")).not.toThrow();
+		expect(() => addUser("eno-d", "acme", null)).not.toThrow();
+		expect(() => addUser("eno-e", "acme", null)).not.toThrow();
+	});
+});

package/templates/tests/rbac-users.spec.ts

@@ -3,11 +3,11 @@
 // 禁止操作自己（AC1-10 注）；roles 写 sys_user_role 唯一权威源 + 写时失效（AC1-7/D10）；
 // 禁用/重置口令级联删 refresh（§3.1 吊销联动）。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import type { SessionDeps } from "../src/auth/api/_shared/session";
+import type { SessionDeps } from "../src/app/api/auth/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/api/_shared/service/domain/users";
-import { createSession } from "../src/auth/api/_shared/session";
+import { changePasswordByAdmin, createUser, deleteUser, listUsers, setForbidden, updateUserProfile, updateUserRoles } from "../src/app/api/_platform/_shared/service/domain/users";
+import { createSession } from "../src/app/api/auth/_shared/session";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -150,6 +150,58 @@ describe("B7：口令重置与禁用（级联吊销）", () => {
 	});
 });
 
+describe("红线：只有 superadmin 能改 superadmin 账号", () => {
+	function mkUserWithRole(username: string, role: string): number {
+		seedRole(role);
+		const uid = mkUser(username);
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, ?)").run(uid, role);
+		return uid;
+	}
+
+	it("admin 重置 superadmin 口令 / 启停 / 改资料 / 删除 → 403，且库里一个字段都没动", async () => {
+		seedRole("admin");
+		const actor = mkUserWithRole("u_admin1", "admin");
+		const target = mkUserWithRole("u_super1", "superadmin");
+		await expect(changePasswordByAdmin(actor, target, "newpw123", bcryptDeps)).rejects.toMatchObject({ status: 403 });
+		await expect(setForbidden(actor, target, true)).rejects.toMatchObject({ status: 403 });
+		await expect(updateUserProfile(actor, target, { displayName: "renamed", email: "x@y.z" })).rejects.toMatchObject({ status: 403 });
+		await expect(deleteUser(actor, target)).rejects.toMatchObject({ status: 403 });
+		const row = dbo.prepare("SELECT password_hash, is_forbidden, display_name, email FROM users WHERE id = ?").get(target) as { password_hash: string, is_forbidden: number, display_name: string | null, email: string | null };
+		expect(row.password_hash).toBe("x");
+		expect(Number(row.is_forbidden)).toBe(0);
+		expect(row.display_name).toBeNull();
+		expect(row.email).toBeNull();
+	});
+
+	it("admin 清空 superadmin 的角色 → 403（成员资格只拦授予方向，反向降级靠这条）", async () => {
+		seedRole("admin");
+		const actor = mkUserWithRole("u_admin2", "admin");
+		const target = mkUserWithRole("u_super2", "superadmin");
+		await expect(updateUserRoles(actor, target, [])).rejects.toMatchObject({ status: 403 });
+		await expect(updateUserRoles(actor, target, ["viewer"])).rejects.toMatchObject({ status: 403 });
+		expect(rolesOf(target)).toEqual(["superadmin"]);
+	});
+
+	it("superadmin 操作 superadmin → 放行（红线不是禁止改超管，而是限定谁能改）", async () => {
+		const actor = mkUserWithRole("u_super3", "superadmin");
+		const target = mkUserWithRole("u_super4", "superadmin");
+		await changePasswordByAdmin(actor, target, "newpw123", bcryptDeps);
+		await setForbidden(actor, target, true);
+		const row = dbo.prepare("SELECT password_hash, is_forbidden FROM users WHERE id = ?").get(target) as { password_hash: string, is_forbidden: number };
+		expect(row.password_hash).toBe("hashed:newpw123");
+		expect(Number(row.is_forbidden)).toBe(1);
+	});
+
+	it("admin 操作普通用户照旧放行（门禁只盯 superadmin 目标，不能把整页封死）", async () => {
+		seedRole("admin");
+		const actor = mkUserWithRole("u_admin3", "admin");
+		const target = mkUser("u_plain");
+		await changePasswordByAdmin(actor, target, "newpw123", bcryptDeps);
+		await setForbidden(actor, target, true);
+		expect(Number((dbo.prepare("SELECT is_forbidden FROM users WHERE id = ?").get(target) as { is_forbidden: number }).is_forbidden)).toBe(1);
+	});
+});
+
 describe("B7：列表（用户管理页数据源）", () => {
 	it("listUsers 带角色数组，排除口令哈希", async () => {
 		seedRole("editor");

package/templates/tests/roles-page.spec.ts

@@ -0,0 +1,40 @@
+// BDD：/system/roles 展示页隐去 superadmin（事故：角色页把平台级角色当成站点可分配角色列出）。
+//
+// 过滤只发生在**展示层**，所以这里测纯函数而不是整页：页面本身只做 query + 渲染，
+// 真正会回归的是「哪些行算可见」。后端那半边（listRoles 必须原样返回 superadmin）在
+// tests/rbac-roles.spec.ts 里钉，两处合起来才防住「顺手把后端也过滤掉」的改法。
+import { describe, expect, it } from "vitest";
+
+import { HIDDEN_ROLE, visibleRoles } from "../src/app/web/system/pages/roles/visible-roles";
+
+const ROWS = [
+	{ name: "superadmin", module: "_platform" },
+	{ name: "admin", module: "_platform" },
+	{ name: "custom.wiki", module: "wiki" },
+];
+
+describe("角色展示页：隐去 superadmin、其余原样", () => {
+	it("不列 superadmin，其余顺序不变", () => {
+		expect(visibleRoles(ROWS).map(r => r.name)).toEqual(["admin", "custom.wiki"]);
+	});
+
+	it("只按名字精确匹配：superadmin.* / 前缀相近的角色照常显示", () => {
+		const rows = [...ROWS, { name: "superadmin.readonly", module: "_platform" }, { name: "Admin", module: "_platform" }];
+		expect(visibleRoles(rows).map(r => r.name)).toEqual(["admin", "custom.wiki", "superadmin.readonly", "Admin"]);
+	});
+
+	it("不改入参（useQuery 缓存对象不能被就地改写）", () => {
+		const input = ROWS.map(r => ({ ...r }));
+		const before = input.map(r => r.name);
+		visibleRoles(input);
+		expect(input.map(r => r.name)).toEqual(before);
+	});
+
+	it("空列表不炸（查询未返回时的形态）", () => {
+		expect(visibleRoles([])).toEqual([]);
+	});
+
+	it("隐藏项与后端保留角色名同值（改名必须两处一起改）", () => {
+		expect(HIDDEN_ROLE).toBe("superadmin");
+	});
+});

package/templates/tests/seed-role-accounts.spec.ts

@@ -16,7 +16,7 @@ import { beforeAll, describe, expect, it } from "vitest";
 const req = createRequire(import.meta.url);
 const { DatabaseSync: Db } = req("node:sqlite") as { DatabaseSync: typeof DatabaseSync };
 
-const PLATFORM_API = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api");
+const PLATFORM_API = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "app", "api", "_platform");
 
 let dbo: InstanceType<typeof DatabaseSync>;
 

package/templates/tests/tenant-access-cache.spec.ts

@@ -11,7 +11,7 @@
 // 这里把「同一 uid 换租户必须重查」钉死，顺手钉住写时失效不得漏掉别的租户。
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 
-import { currentAccess, invalidateAllUsers, invalidateUser, isSelfTenant } from "../src/_platform/api/_shared/service/infra/access";
+import { currentAccess, invalidateAllUsers, invalidateUser, isSelfTenant } from "../src/app/api/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;

package/templates/tests/tenant-forgery.spec.ts

@@ -14,11 +14,11 @@
 /* eslint-disable test/prefer-lowercase-title -- 用例标题带端点路径，保留原样更易检索 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
-import notification from "../src/notification/api/api";
-import notificationDel from "../src/notification/api/del/api";
-import profile from "../src/personal-center/api/profile/api";
-import upload from "../src/personal-center/api/upload/api";
+import { invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
+import notification from "../src/app/api/notification/api";
+import notificationDel from "../src/app/api/notification/del/api";
+import profile from "../src/app/api/personal-center/profile/api";
+import upload from "../src/app/api/personal-center/upload/api";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;

package/templates/tests/tenant-isolation.spec.ts

@@ -80,14 +80,15 @@ describe("§5.7-6 读写自动按当前租户过滤", () => {
 	});
 
 	it("truncate 只清本租户（A 组表）", async () => {
+		// 用 home_pie 而非旧 demo 的 todos：后者已随示例模块删除，迁移里没有这张表。
 		asTenant("acme");
-		await db.table("todos").insert({ title: "acme-todo" }).run();
+		await db.table("home_pie").insert({ category: "acme-pie", value: 1 }).run();
 		asTenant("globex");
-		await db.table("todos").insert({ title: "globex-todo" }).run();
+		await db.table("home_pie").insert({ category: "globex-pie", value: 2 }).run();
 
 		asTenant("acme");
-		await db.table("todos").truncate().run();
-		expect(rows("SELECT title FROM todos")).toEqual([{ title: "globex-todo" }]);
+		await db.table("home_pie").truncate().run();
+		expect(rows("SELECT category FROM home_pie")).toEqual([{ category: "globex-pie" }]);
 	});
 
 	it("refresh token 换票：别家的 token_hash 在本租户查不到", async () => {

package/templates/tests/username-namespace.spec.ts

@@ -16,9 +16,9 @@
 //   · 端到端：改名被拒之后，真正的外部成员 JIT 登录拿到的是**新建**的那一行。
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
-import { ensureWecomUser, externalUsername } from "../src/auth/api/_shared/wecom/login";
-import profile from "../src/personal-center/api/profile/api";
+import { invalidateAllUsers } from "../src/app/api/_platform/_shared/service/infra/access";
+import { ensureWecomUser, externalUsername } from "../src/app/api/auth/_shared/wecom/login";
+import profile from "../src/app/api/personal-center/profile/api";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;

package/templates/tests/users-page.spec.ts

@@ -0,0 +1,39 @@
+// BDD：/system/users 行级门禁——只有 superadmin 能改 superadmin 账号。
+//
+// 与 tests/rbac-users.spec.ts 的 assertCanManageTarget 用例互为两面：那边钉服务端 403，
+// 这边钉「前端不给会 403 的按钮」（置灰）。两处都测同一个判定口径，改名必须一起改。
+import { describe, expect, it } from "vitest";
+
+import { canManageUser, PLATFORM_ROLE } from "../src/app/web/system/pages/users/can-manage";
+
+describe("用户管理页：superadmin 行对非超管置灰", () => {
+	it("admin 看普通用户 → 可操作", () => {
+		expect(canManageUser(["admin"], ["editor"])).toBe(true);
+		expect(canManageUser(["admin"], [])).toBe(true);
+	});
+
+	it("admin 看 superadmin → 灰（口令/状态/成员资格一律禁用）", () => {
+		expect(canManageUser(["admin"], ["superadmin"])).toBe(false);
+		// 兼有 admin + editor 也不够：这条红线只认 superadmin
+		expect(canManageUser(["admin", "editor", "viewer"], ["superadmin", "editor"])).toBe(false);
+	});
+
+	it("superadmin 看 superadmin → 可操作（红线是限定谁能改，不是禁止改）", () => {
+		expect(canManageUser(["superadmin"], ["superadmin"])).toBe(true);
+		expect(canManageUser(["superadmin"], ["admin"])).toBe(true);
+	});
+
+	it("不看自己：本人行的禁用由页面另外用 uid 判，别混进来", () => {
+		// 空角色 + 空目标 = 可操作，说明本函数不承担 assertNotSelf 的职责
+		expect(canManageUser([], [])).toBe(true);
+	});
+
+	it("角色名精确匹配：superadmin.readonly 不是平台超管", () => {
+		expect(canManageUser(["admin"], ["superadmin.readonly"])).toBe(true);
+		expect(canManageUser(["SuperAdmin"], ["superadmin"])).toBe(false);
+	});
+
+	it("门禁常量与后端保留角色名同值（改名必须两处一起改）", () => {
+		expect(PLATFORM_ROLE).toBe("superadmin");
+	});
+});

package/templates/tests/wecom-admin.spec.ts

@@ -12,10 +12,10 @@
 import { Buffer } from "node:buffer";
 import { webcrypto } from "node:crypto";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { assertSuperAdmin, invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
-import { listApps, setAppStatus } from "../src/auth/api/_shared/wecom/admin";
-import { createWecomClient, runtimeCache, runtimeHttp } from "../src/auth/api/_shared/wecom/client";
-import { readSuiteConfig } from "../src/auth/api/_shared/wecom/config";
+import { assertSuperAdmin, invalidateAllUsers } from "../src/app/api/_platform/_shared/service/infra/access";
+import { listApps, setAppStatus } from "../src/app/api/auth/_shared/wecom/admin";
+import { createWecomClient, runtimeCache, runtimeHttp } from "../src/app/api/auth/_shared/wecom/client";
+import { readSuiteConfig } from "../src/app/api/auth/_shared/wecom/config";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -124,11 +124,11 @@ const deps = { store: { encrypt: (p: string) => `gcm(${p})`, decrypt: (b: string
 
 /** createInstall 的薄包装：省掉动态 import 的样板 */
 async function createInstallForTest(cfg: ReturnType<typeof readSuiteConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
-	const { createInstall } = await import("../src/auth/api/_shared/wecom/admin");
+	const { createInstall } = await import("../src/app/api/auth/_shared/wecom/admin");
 	return createInstall(cfg, client, state);
 }
 
-const api = async () => (await import("../src/auth/api/wecom/admin/api")).default;
+const api = async () => (await import("../src/app/api/auth/wecom/admin/api")).default;
 
 beforeAll(() => {
 	dbo = installDb();

package/templates/tests/wecom-client-timeout.spec.ts

@@ -11,7 +11,7 @@
 //   4. tasks 缺失 → 安全降级为「不超时」，快速请求正常返回。
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { runtimeHttp } from "../src/auth/api/_shared/wecom/client";
+import { runtimeHttp } from "../src/app/api/auth/_shared/wecom/client";
 
 const g = globalThis as any;