@oj-module/cli 0.2.54 → 0.2.57

package/templates/tests/rbac-settings.spec.ts

@@ -2,8 +2,9 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { listLoginMethods, listSettings, updateSetting } from "../src/_platform/api/_shared/service/domain/settings";
-import { searchOplog } from "../src/_platform/api/_shared/service/infra/oplog";
+import { listLoginMethods, listSettings, updateSetting } from "../src/app/api/_platform/_shared/service/domain/settings";
+import { recordOp } from "../src/app/api/_platform/_shared/service/infra/audit";
+import { searchOplog } from "../src/app/api/_platform/_shared/service/infra/oplog";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -27,6 +28,8 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 	// 按 api-manual §1153 契约建模（引擎语义的忠实复刻，非新逻辑）。
 	function fakeTable() {
 		const conds: Array<{ test: unknown, cond: any }> = [];
+		// 分页同样只记录不执行：count 查询不该带 limit/offset，list 查询必须带上
+		const paging: { limit: number | null, offset: number | null } = { limit: null, offset: null };
 		const b: any = {
 			whereIf: (test: unknown, cond: any) => {
 				if (test !== undefined && test !== null && test !== false && !(Array.isArray(test) && test.length === 0))
@@ -35,17 +38,23 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 			},
 			select: () => b,
 			orderBy: () => b,
-			limit: () => b,
-			offset: () => b,
+			limit: (n: number) => {
+				paging.limit = n;
+				return b;
+			},
+			offset: (n: number) => {
+				paging.offset = n;
+				return b;
+			},
 			// 固定非零 total：保证 count/list 两条路径都构造（total=0 跳过 list 的行为
 			// 由 query-utils.spec 的 pagedFactory 用例覆盖，这里只关心条件发射）
 			all: async () => [{ c: 42 }],
 		};
-		return { b, conds };
+		return { b, conds, paging };
 	}
 
-	/** 以假构造器跑 searchOplog，回传 count 构造发射的条件（并校验 count/list 同条件） */
-	async function captureConds(filter: Parameters<typeof searchOplog>[0]) {
+	/** 以假构造器跑 searchOplog，回传 count/list 两次构造（[0]=count，[1]=list） */
+	async function captureBuilt(filter: Parameters<typeof searchOplog>[0]) {
 		const built: Array<ReturnType<typeof fakeTable>> = [];
 		const prevDb = g.db;
 		g.db = {
@@ -63,6 +72,12 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 		}
 		expect(built).toHaveLength(2); // count + list 各构造一次
 		expect(built[1].conds).toEqual(built[0].conds); // mk 工厂：两组条件一致
+		return built;
+	}
+
+	/** 回传 count 构造发射的条件 */
+	async function captureConds(filter: Parameters<typeof searchOplog>[0]) {
+		const built = await captureBuilt(filter);
 		return built[0].conds;
 	}
 
@@ -87,6 +102,61 @@ describe("AC1-29/D13：操作日志查询（admin 可查）", () => {
 		]);
 		expect(conds.some(c => (c.cond as { field?: string }).field === "level")).toBe(false);
 	});
+
+	it("page/limit 只作用在 list 查询：limit=size、offset=(page-1)*size，count 不带分页", async () => {
+		const [count, list] = await captureBuilt({ action: "user.create", page: 3, limit: 10 });
+		expect(count!.paging).toEqual({ limit: null, offset: null });
+		expect(list!.paging).toEqual({ limit: 10, offset: 20 });
+	});
+
+	it("缺省/非法分页参数：第 1 页 20 条，size 静默钳 200", async () => {
+		expect((await captureBuilt({}))[1]!.paging).toEqual({ limit: 20, offset: 0 });
+		expect((await captureBuilt({ page: 0, limit: "abc" }))[1]!.paging).toEqual({ limit: 20, offset: 0 });
+		expect((await captureBuilt({ page: 2, limit: 10_000 }))[1]!.paging).toEqual({ limit: 200, offset: 200 });
+	});
+});
+
+// 真库分页语义：上面用假构造器只钉「参数怎么发」，这里钉「切片/总数/还剩多少」算得对——
+// 页导航能否正确显示页数全靠 total，靠 truncated 提示「结果被截断」的旧交互已删除。
+describe("AC1-29：操作日志分页（真库切片 + total）", () => {
+	async function seedOplog(n: number) {
+		for (let i = 1; i <= n; i++)
+			await recordOp({ action: "test.page", module: "framework", target: `t${i}` });
+	}
+
+	it("按 id 倒序切页：total 是全量而不是本页条数", async () => {
+		await seedOplog(5);
+		const p1 = await searchOplog({ page: 1, limit: 2 });
+		expect(p1.total).toBe(5);
+		expect(p1.list.map(r => r.target)).toEqual(["t5", "t4"]);
+		expect(p1.truncated).toBe(true);
+
+		const p2 = await searchOplog({ page: 2, limit: 2 });
+		expect(p2.list.map(r => r.target)).toEqual(["t3", "t2"]);
+		expect(p2.truncated).toBe(true);
+
+		// 末页：5 条 / 每页 2 → 第 3 页只剩 1 条，truncated=false（页导航据此停在第 3 页）
+		const p3 = await searchOplog({ page: 3, limit: 2 });
+		expect(p3.list.map(r => r.target)).toEqual(["t1"]);
+		expect(p3.truncated).toBe(false);
+	});
+
+	it("越界页：list 为空但 total 仍为全量（前端据此纠正页码，而不是显示 0 条）", async () => {
+		await seedOplog(3);
+		const far = await searchOplog({ page: 99, limit: 20 });
+		expect(far.list).toEqual([]);
+		expect(far.total).toBe(3);
+		expect(far.truncated).toBe(false);
+	});
+
+	it("过滤与分页叠加：total 按过滤后的集合算", async () => {
+		await seedOplog(5);
+		await recordOp({ action: "other.act", module: "framework", target: "x" });
+		const r = await searchOplog({ action: "test.page", page: 1, limit: 2 });
+		expect(r.total).toBe(5);
+		expect(r.list).toHaveLength(2);
+		expect(r.list.every(x => x.action === "test.page")).toBe(true);
+	});
 });
 
 describe("PRD §4.3：系统设置", () => {

package/templates/tests/rbac-solution-perms.spec.ts

@@ -4,7 +4,7 @@
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { uninstallSolution, upsertSolutionPerms } from "../src/_platform/api/_shared/service/domain/solution-perms";
+import { uninstallSolution, upsertSolutionPerms } from "../src/app/api/_platform/_shared/service/domain/solution-perms";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/rbac-tables.spec.ts

@@ -61,3 +61,32 @@ describe("users 表扩展（PRD §4.2 数据模型）", () => {
 		expect(String(source?.dflt_value)).toContain("local");
 	});
 });
+
+// 回归：0017 给 users 加工号列。事故形态是「列进了库、schema.yaml 白名单漏了」，
+// 构造器在发 SQL 前就拒成 `unknown column 'employee_no' in on 'users'`，日志里没有 SQL 可查。
+// 白名单那半边在 packages/cli/src/__tests__/templates-schema-columns.test.ts 钉；
+// 这里钉库侧语义：列真的落库、租户内唯一、NULL 不占位、跨租户可重复。
+describe("users.employee_no（0017 工号列）", () => {
+	function addUser(username: string, tenant: string, employeeNo: string | null) {
+		dbo.prepare("INSERT INTO users (username, password_hash, tenant_id, employee_no) VALUES (?, 'x', ?, ?)")
+			.run(username, tenant, employeeNo);
+	}
+
+	it("迁移落出 employee_no 列", () => {
+		expect(colsOf("users")).toContain("employee_no");
+	});
+
+	it("唯一索引按 (tenant_id, employee_no) 且是部分索引（NULL 不占位）", () => {
+		const idx = dbo.prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'uk_users_employee_no'").get() as { sql: string | null } | undefined;
+		expect(idx?.sql).toContain("tenant_id");
+		expect(idx?.sql).toContain("employee_no IS NOT NULL");
+	});
+
+	it("同租户工号重复被拒，跨租户可重复，NULL 可多行", () => {
+		addUser("eno-a", "acme", "E-100");
+		expect(() => addUser("eno-b", "acme", "E-100")).toThrow(/UNIQUE/);
+		expect(() => addUser("eno-c", "globex", "E-100")).not.toThrow();
+		expect(() => addUser("eno-d", "acme", null)).not.toThrow();
+		expect(() => addUser("eno-e", "acme", null)).not.toThrow();
+	});
+});

package/templates/tests/rbac-users.spec.ts

@@ -3,11 +3,11 @@
 // 禁止操作自己（AC1-10 注）；roles 写 sys_user_role 唯一权威源 + 写时失效（AC1-7/D10）；
 // 禁用/重置口令级联删 refresh（§3.1 吊销联动）。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import type { SessionDeps } from "../src/auth/api/_shared/session";
+import type { SessionDeps } from "../src/app/api/auth/_shared/session";
 
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
-import { changePasswordByAdmin, createUser, listUsers, setForbidden, updateUserRoles } from "../src/_platform/api/_shared/service/domain/users";
-import { createSession } from "../src/auth/api/_shared/session";
+import { changePasswordByAdmin, createUser, deleteUser, listUsers, setForbidden, updateUserProfile, updateUserRoles } from "../src/app/api/_platform/_shared/service/domain/users";
+import { createSession } from "../src/app/api/auth/_shared/session";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;
@@ -150,6 +150,58 @@ describe("B7：口令重置与禁用（级联吊销）", () => {
 	});
 });
 
+describe("红线：只有 superadmin 能改 superadmin 账号", () => {
+	function mkUserWithRole(username: string, role: string): number {
+		seedRole(role);
+		const uid = mkUser(username);
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name) VALUES (?, ?)").run(uid, role);
+		return uid;
+	}
+
+	it("admin 重置 superadmin 口令 / 启停 / 改资料 / 删除 → 403，且库里一个字段都没动", async () => {
+		seedRole("admin");
+		const actor = mkUserWithRole("u_admin1", "admin");
+		const target = mkUserWithRole("u_super1", "superadmin");
+		await expect(changePasswordByAdmin(actor, target, "newpw123", bcryptDeps)).rejects.toMatchObject({ status: 403 });
+		await expect(setForbidden(actor, target, true)).rejects.toMatchObject({ status: 403 });
+		await expect(updateUserProfile(actor, target, { displayName: "renamed", email: "x@y.z" })).rejects.toMatchObject({ status: 403 });
+		await expect(deleteUser(actor, target)).rejects.toMatchObject({ status: 403 });
+		const row = dbo.prepare("SELECT password_hash, is_forbidden, display_name, email FROM users WHERE id = ?").get(target) as { password_hash: string, is_forbidden: number, display_name: string | null, email: string | null };
+		expect(row.password_hash).toBe("x");
+		expect(Number(row.is_forbidden)).toBe(0);
+		expect(row.display_name).toBeNull();
+		expect(row.email).toBeNull();
+	});
+
+	it("admin 清空 superadmin 的角色 → 403（成员资格只拦授予方向，反向降级靠这条）", async () => {
+		seedRole("admin");
+		const actor = mkUserWithRole("u_admin2", "admin");
+		const target = mkUserWithRole("u_super2", "superadmin");
+		await expect(updateUserRoles(actor, target, [])).rejects.toMatchObject({ status: 403 });
+		await expect(updateUserRoles(actor, target, ["viewer"])).rejects.toMatchObject({ status: 403 });
+		expect(rolesOf(target)).toEqual(["superadmin"]);
+	});
+
+	it("superadmin 操作 superadmin → 放行（红线不是禁止改超管，而是限定谁能改）", async () => {
+		const actor = mkUserWithRole("u_super3", "superadmin");
+		const target = mkUserWithRole("u_super4", "superadmin");
+		await changePasswordByAdmin(actor, target, "newpw123", bcryptDeps);
+		await setForbidden(actor, target, true);
+		const row = dbo.prepare("SELECT password_hash, is_forbidden FROM users WHERE id = ?").get(target) as { password_hash: string, is_forbidden: number };
+		expect(row.password_hash).toBe("hashed:newpw123");
+		expect(Number(row.is_forbidden)).toBe(1);
+	});
+
+	it("admin 操作普通用户照旧放行（门禁只盯 superadmin 目标，不能把整页封死）", async () => {
+		seedRole("admin");
+		const actor = mkUserWithRole("u_admin3", "admin");
+		const target = mkUser("u_plain");
+		await changePasswordByAdmin(actor, target, "newpw123", bcryptDeps);
+		await setForbidden(actor, target, true);
+		expect(Number((dbo.prepare("SELECT is_forbidden FROM users WHERE id = ?").get(target) as { is_forbidden: number }).is_forbidden)).toBe(1);
+	});
+});
+
 describe("B7：列表（用户管理页数据源）", () => {
 	it("listUsers 带角色数组，排除口令哈希", async () => {
 		seedRole("editor");

package/templates/tests/roles-page.spec.ts

@@ -0,0 +1,40 @@
+// BDD：/system/roles 展示页隐去 superadmin（事故：角色页把平台级角色当成站点可分配角色列出）。
+//
+// 过滤只发生在**展示层**，所以这里测纯函数而不是整页：页面本身只做 query + 渲染，
+// 真正会回归的是「哪些行算可见」。后端那半边（listRoles 必须原样返回 superadmin）在
+// tests/rbac-roles.spec.ts 里钉，两处合起来才防住「顺手把后端也过滤掉」的改法。
+import { describe, expect, it } from "vitest";
+
+import { HIDDEN_ROLE, visibleRoles } from "../src/app/web/system/pages/roles/visible-roles";
+
+const ROWS = [
+	{ name: "superadmin", module: "_platform" },
+	{ name: "admin", module: "_platform" },
+	{ name: "custom.wiki", module: "wiki" },
+];
+
+describe("角色展示页：隐去 superadmin、其余原样", () => {
+	it("不列 superadmin，其余顺序不变", () => {
+		expect(visibleRoles(ROWS).map(r => r.name)).toEqual(["admin", "custom.wiki"]);
+	});
+
+	it("只按名字精确匹配：superadmin.* / 前缀相近的角色照常显示", () => {
+		const rows = [...ROWS, { name: "superadmin.readonly", module: "_platform" }, { name: "Admin", module: "_platform" }];
+		expect(visibleRoles(rows).map(r => r.name)).toEqual(["admin", "custom.wiki", "superadmin.readonly", "Admin"]);
+	});
+
+	it("不改入参（useQuery 缓存对象不能被就地改写）", () => {
+		const input = ROWS.map(r => ({ ...r }));
+		const before = input.map(r => r.name);
+		visibleRoles(input);
+		expect(input.map(r => r.name)).toEqual(before);
+	});
+
+	it("空列表不炸（查询未返回时的形态）", () => {
+		expect(visibleRoles([])).toEqual([]);
+	});
+
+	it("隐藏项与后端保留角色名同值（改名必须两处一起改）", () => {
+		expect(HIDDEN_ROLE).toBe("superadmin");
+	});
+});

package/templates/tests/seed-role-accounts.spec.ts

@@ -16,7 +16,7 @@ import { beforeAll, describe, expect, it } from "vitest";
 const req = createRequire(import.meta.url);
 const { DatabaseSync: Db } = req("node:sqlite") as { DatabaseSync: typeof DatabaseSync };
 
-const PLATFORM_API = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "_platform", "api");
+const PLATFORM_API = join(dirname(fileURLToPath(import.meta.url)), "..", "src", "app", "api", "_platform");
 
 let dbo: InstanceType<typeof DatabaseSync>;
 

package/templates/tests/tenant-access-cache.spec.ts

@@ -11,7 +11,7 @@
 // 这里把「同一 uid 换租户必须重查」钉死，顺手钉住写时失效不得漏掉别的租户。
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 
-import { currentAccess, invalidateAllUsers, invalidateUser, isSelfTenant } from "../src/_platform/api/_shared/service/infra/access";
+import { currentAccess, invalidateAllUsers, invalidateUser, isSelfTenant } from "../src/app/api/_platform/_shared/service/infra/access";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;

package/templates/tests/tenant-forgery.spec.ts

@@ -14,11 +14,11 @@
 /* eslint-disable test/prefer-lowercase-title -- 用例标题带端点路径，保留原样更易检索 */
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
-import { invalidateUser } from "../src/_platform/api/_shared/service/infra/access";
-import notification from "../src/notification/api/api";
-import notificationDel from "../src/notification/api/del/api";
-import profile from "../src/personal-center/api/profile/api";
-import upload from "../src/personal-center/api/upload/api";
+import { invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
+import notification from "../src/app/api/notification/api";
+import notificationDel from "../src/app/api/notification/del/api";
+import profile from "../src/app/api/personal-center/profile/api";
+import upload from "../src/app/api/personal-center/upload/api";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;

package/templates/tests/tenant-isolation.spec.ts

@@ -80,14 +80,15 @@ describe("§5.7-6 读写自动按当前租户过滤", () => {
 	});
 
 	it("truncate 只清本租户（A 组表）", async () => {
+		// 用 home_pie 而非旧 demo 的 todos：后者已随示例模块删除，迁移里没有这张表。
 		asTenant("acme");
-		await db.table("todos").insert({ title: "acme-todo" }).run();
+		await db.table("home_pie").insert({ category: "acme-pie", value: 1 }).run();
 		asTenant("globex");
-		await db.table("todos").insert({ title: "globex-todo" }).run();
+		await db.table("home_pie").insert({ category: "globex-pie", value: 2 }).run();
 
 		asTenant("acme");
-		await db.table("todos").truncate().run();
-		expect(rows("SELECT title FROM todos")).toEqual([{ title: "globex-todo" }]);
+		await db.table("home_pie").truncate().run();
+		expect(rows("SELECT category FROM home_pie")).toEqual([{ category: "globex-pie" }]);
 	});
 
 	it("refresh token 换票：别家的 token_hash 在本租户查不到", async () => {

package/templates/tests/username-namespace.spec.ts

@@ -16,9 +16,9 @@
 //   · 端到端：改名被拒之后，真正的外部成员 JIT 登录拿到的是**新建**的那一行。
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
-import { ensureWecomUser, externalUsername } from "../src/auth/api/_shared/wecom/login";
-import profile from "../src/personal-center/api/profile/api";
+import { invalidateAllUsers } from "../src/app/api/_platform/_shared/service/infra/access";
+import { ensureWecomUser, externalUsername } from "../src/app/api/auth/_shared/wecom/login";
+import profile from "../src/app/api/personal-center/profile/api";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;

package/templates/tests/users-page.spec.ts

@@ -0,0 +1,39 @@
+// BDD：/system/users 行级门禁——只有 superadmin 能改 superadmin 账号。
+//
+// 与 tests/rbac-users.spec.ts 的 assertCanManageTarget 用例互为两面：那边钉服务端 403，
+// 这边钉「前端不给会 403 的按钮」（置灰）。两处都测同一个判定口径，改名必须一起改。
+import { describe, expect, it } from "vitest";
+
+import { canManageUser, PLATFORM_ROLE } from "../src/app/web/system/pages/users/can-manage";
+
+describe("用户管理页：superadmin 行对非超管置灰", () => {
+	it("admin 看普通用户 → 可操作", () => {
+		expect(canManageUser(["admin"], ["editor"])).toBe(true);
+		expect(canManageUser(["admin"], [])).toBe(true);
+	});
+
+	it("admin 看 superadmin → 灰（口令/状态/成员资格一律禁用）", () => {
+		expect(canManageUser(["admin"], ["superadmin"])).toBe(false);
+		// 兼有 admin + editor 也不够：这条红线只认 superadmin
+		expect(canManageUser(["admin", "editor", "viewer"], ["superadmin", "editor"])).toBe(false);
+	});
+
+	it("superadmin 看 superadmin → 可操作（红线是限定谁能改，不是禁止改）", () => {
+		expect(canManageUser(["superadmin"], ["superadmin"])).toBe(true);
+		expect(canManageUser(["superadmin"], ["admin"])).toBe(true);
+	});
+
+	it("不看自己：本人行的禁用由页面另外用 uid 判，别混进来", () => {
+		// 空角色 + 空目标 = 可操作，说明本函数不承担 assertNotSelf 的职责
+		expect(canManageUser([], [])).toBe(true);
+	});
+
+	it("角色名精确匹配：superadmin.readonly 不是平台超管", () => {
+		expect(canManageUser(["admin"], ["superadmin.readonly"])).toBe(true);
+		expect(canManageUser(["SuperAdmin"], ["superadmin"])).toBe(false);
+	});
+
+	it("门禁常量与后端保留角色名同值（改名必须两处一起改）", () => {
+		expect(PLATFORM_ROLE).toBe("superadmin");
+	});
+});

package/templates/tests/wecom-admin.spec.ts

@@ -12,10 +12,10 @@
 import { Buffer } from "node:buffer";
 import { webcrypto } from "node:crypto";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { assertSuperAdmin, invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
-import { listApps, setAppStatus } from "../src/auth/api/_shared/wecom/admin";
-import { createWecomClient, runtimeCache, runtimeHttp } from "../src/auth/api/_shared/wecom/client";
-import { readSuiteConfig } from "../src/auth/api/_shared/wecom/config";
+import { assertSuperAdmin, invalidateAllUsers } from "../src/app/api/_platform/_shared/service/infra/access";
+import { listApps, setAppStatus } from "../src/app/api/auth/_shared/wecom/admin";
+import { createWecomClient, runtimeCache, runtimeHttp } from "../src/app/api/auth/_shared/wecom/client";
+import { readSuiteConfig } from "../src/app/api/auth/_shared/wecom/config";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -124,11 +124,11 @@ const deps = { store: { encrypt: (p: string) => `gcm(${p})`, decrypt: (b: string
 
 /** createInstall 的薄包装：省掉动态 import 的样板 */
 async function createInstallForTest(cfg: ReturnType<typeof readSuiteConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
-	const { createInstall } = await import("../src/auth/api/_shared/wecom/admin");
+	const { createInstall } = await import("../src/app/api/auth/_shared/wecom/admin");
 	return createInstall(cfg, client, state);
 }
 
-const api = async () => (await import("../src/auth/api/wecom/admin/api")).default;
+const api = async () => (await import("../src/app/api/auth/wecom/admin/api")).default;
 
 beforeAll(() => {
 	dbo = installDb();

package/templates/tests/wecom-client-timeout.spec.ts

@@ -11,7 +11,7 @@
 //   4. tasks 缺失 → 安全降级为「不超时」，快速请求正常返回。
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { runtimeHttp } from "../src/auth/api/_shared/wecom/client";
+import { runtimeHttp } from "../src/app/api/auth/_shared/wecom/client";
 
 const g = globalThis as any;
 

package/templates/tests/wecom-connector.spec.ts

@@ -10,12 +10,12 @@
 // deps 全注入：store 用 `enc:` 前后缀假加密（Node 侧 crypto 只读，设计 §9.1），
 // client 的 http/kv 用内存桩——真实网络与 AES 已由 wecom-crypt.spec / 运行时保证。
 /* eslint-disable test/prefer-lowercase-title -- D/AC 编号是验收锚点，保留大写 */
-import type { WecomCache, WecomHttp } from "../src/auth/api/_shared/wecom/client";
-import type { WecomConfig } from "../src/auth/api/_shared/wecom/config";
-import type { WecomStoreDeps } from "../src/auth/api/_shared/wecom/store";
+import type { WecomCache, WecomHttp } from "../src/app/api/auth/_shared/wecom/client";
+import type { WecomConfig } from "../src/app/api/auth/_shared/wecom/config";
+import type { WecomStoreDeps } from "../src/app/api/auth/_shared/wecom/store";
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { createWecomClient, runtimeCache } from "../src/auth/api/_shared/wecom/client";
+import { createWecomClient, runtimeCache } from "../src/app/api/auth/_shared/wecom/client";
 import {
 	assertEncKey,
 	eventUrlOf,
@@ -23,8 +23,8 @@ import {
 	readCallbackConfig,
 	readSuiteConfig,
 	siteRootOf,
-} from "../src/auth/api/_shared/wecom/config";
-import { envOfState, handleSuiteEvent } from "../src/auth/api/_shared/wecom/events";
+} from "../src/app/api/auth/_shared/wecom/config";
+import { envOfState, handleSuiteEvent } from "../src/app/api/auth/_shared/wecom/events";
 import {
 	assertUserActive,
 	buildAuthorizeUrl,
@@ -36,8 +36,8 @@ import {
 	loginLandingUrl,
 	putLoginState,
 	takeLoginState,
-} from "../src/auth/api/_shared/wecom/login";
-import { callbackFields, field } from "../src/auth/api/_shared/wecom/payload";
+} from "../src/app/api/auth/_shared/wecom/login";
+import { callbackFields, field } from "../src/app/api/auth/_shared/wecom/payload";
 import {
 	claimLoginTicket,
 	ensureTenant,
@@ -48,7 +48,7 @@ import {
 	saveProfile,
 	setProfileStatus,
 	tenantOfCorp,
-} from "../src/auth/api/_shared/wecom/store";
+} from "../src/app/api/auth/_shared/wecom/store";
 import { installDb } from "./fixture";
 
 let dbo: ReturnType<typeof installDb>;

package/templates/tests/wecom-corp.spec.ts

@@ -15,16 +15,16 @@
 //
 // 夹具即真实库（真迁移 + 真 sqlite）：0003__credential_kind 的默认值也一起被这层覆盖到。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import type { WecomStoreDeps } from "../src/auth/api/_shared/wecom/store";
+import type { WecomStoreDeps } from "../src/app/api/auth/_shared/wecom/store";
 import { Buffer } from "node:buffer";
 import { createCipheriv, webcrypto } from "node:crypto";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { connectCorp } from "../src/auth/api/_shared/wecom/admin";
-import { createWecomClient, runtimeCache, runtimeHttp } from "../src/auth/api/_shared/wecom/client";
-import { callbackCreds, configuredKinds, corpIdentity, readBase, readCorpConfig, readSuiteConfig, wecomKinds } from "../src/auth/api/_shared/wecom/config";
-import { bytesToB64, utf8Bytes, wecomSignature } from "../src/auth/api/_shared/wecom/crypt";
-import { handleSuiteEvent } from "../src/auth/api/_shared/wecom/events";
-import { findCorpAuth, findProfile, probeProfile, saveProfile } from "../src/auth/api/_shared/wecom/store";
+import { connectCorp } from "../src/app/api/auth/_shared/wecom/admin";
+import { createWecomClient, runtimeCache, runtimeHttp } from "../src/app/api/auth/_shared/wecom/client";
+import { callbackCreds, configuredKinds, corpIdentity, readBase, readCorpConfig, readSuiteConfig, wecomKinds } from "../src/app/api/auth/_shared/wecom/config";
+import { bytesToB64, utf8Bytes, wecomSignature } from "../src/app/api/auth/_shared/wecom/crypt";
+import { handleSuiteEvent } from "../src/app/api/auth/_shared/wecom/events";
+import { findCorpAuth, findProfile, probeProfile, saveProfile } from "../src/app/api/auth/_shared/wecom/store";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -209,8 +209,8 @@ function stubUpstream(opts: { depts?: Array<{ id: string, name?: string }>, memb
 	return { calls };
 }
 
-const wecomApi = async () => (await import("../src/auth/api/wecom/api")).default;
-const adminApi = async () => (await import("../src/auth/api/wecom/admin/api")).default;
+const wecomApi = async () => (await import("../src/app/api/auth/wecom/api")).default;
+const adminApi = async () => (await import("../src/app/api/auth/wecom/admin/api")).default;
 
 /** 回调 timestamp 必须新鲜：重放守卫拒 ±5 分钟以外的报文，用固定值会让整段用例假红 */
 const nowSecs = () => String(Math.floor(Date.now() / 1000));

package/templates/tests/wecom-crypt.spec.ts

@@ -17,7 +17,7 @@ import {
 	unwrapWecomMessage,
 	utf8Bytes,
 	wecomSignature,
-} from "../src/auth/api/_shared/wecom/crypt";
+} from "../src/app/api/auth/_shared/wecom/crypt";
 
 const req = createRequire(import.meta.url);
 const nodeCrypto = req("node:crypto") as typeof import("node:crypto");

package/templates/tests/wecom-endpoints.spec.ts

@@ -11,7 +11,7 @@
 import { Buffer } from "node:buffer";
 import { createCipheriv, webcrypto } from "node:crypto";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { bytesToB64, sha1Hex, utf8Bytes, wecomSignature } from "../src/auth/api/_shared/wecom/crypt";
+import { bytesToB64, sha1Hex, utf8Bytes, wecomSignature } from "../src/app/api/auth/_shared/wecom/crypt";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -147,7 +147,7 @@ function seedCorp(corpId = "ww_corp_a", agentId = "100001"): void {
 		.run(SUITE, corpId, agentId, corpId, `gcm(perm_${corpId})`);
 }
 
-const api = async () => (await import("../src/auth/api/wecom/api")).default;
+const api = async () => (await import("../src/app/api/auth/wecom/api")).default;
 
 beforeAll(() => {
 	dbo = installDb();

package/templates/tests/wecom-landing.spec.ts

@@ -5,7 +5,7 @@
 //   · 参数要裁剪、要能容忍少了 tenant（此时沿用本地租户，不是登录失败）；
 //   · 授权入口即使没填企业代码也要跳（后端会回 400 说明缺什么，比前端静默不动好排查）。
 import { describe, expect, it } from "vitest";
-import { parseWecomLanding, wecomAuthorizePath } from "../src/login/web/wecom";
+import { parseWecomLanding, wecomAuthorizePath } from "../src/app/web/login/wecom";
 
 describe("p2-A：回跳落地参数解析", () => {
 	it("带齐 ticket 与 tenant → 解析出两者", () => {

package/templates/tests/wecom-org-sync.spec.ts

@@ -9,15 +9,15 @@
 //   · **登录自更新节流**：上万员工每天登录，不节流就是把 user/get 打成常驻流量；
 //     但 `user/get` 拿不到（无权限/不在可见范围）时**不能**写节流键，否则这一整天都补不上资料。
 //   · **D10 不建占位部门**：登录路径若能顺手建部门，任何成员都能凭空造出组织节点。
-import type { WecomCache, WecomHttp } from "../src/auth/api/_shared/wecom/client";
-import type { WecomStoreDeps } from "../src/auth/api/_shared/wecom/store";
+import type { WecomCache, WecomHttp } from "../src/app/api/auth/_shared/wecom/client";
+import type { WecomStoreDeps } from "../src/app/api/auth/_shared/wecom/store";
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { upsertDepartment } from "../src/_platform/api/_shared/service/domain/org";
-import { createWecomClient, WecomApiError } from "../src/auth/api/_shared/wecom/client";
-import { handleSuiteEvent } from "../src/auth/api/_shared/wecom/events";
-import { SELF_UPDATE_TTL_SECS, selfUpdate } from "../src/auth/api/_shared/wecom/login";
-import { findProfile, probeProfile, putSuiteTicket, saveProfile, setProfileStatus } from "../src/auth/api/_shared/wecom/store";
+import { upsertDepartment } from "../src/app/api/_platform/_shared/service/domain/org";
+import { createWecomClient, WecomApiError } from "../src/app/api/auth/_shared/wecom/client";
+import { handleSuiteEvent } from "../src/app/api/auth/_shared/wecom/events";
+import { SELF_UPDATE_TTL_SECS, selfUpdate } from "../src/app/api/auth/_shared/wecom/login";
+import { findProfile, probeProfile, putSuiteTicket, saveProfile, setProfileStatus } from "../src/app/api/auth/_shared/wecom/store";
 import { installDb } from "./fixture";
 
 /* eslint-disable test/prefer-lowercase-title -- D/AC 编号是验收锚点，保留大写 */

package/templates/tests/wecom-sync.spec.ts

@@ -5,11 +5,11 @@
 //   · 权限类错码是「跳过并计数」——一旦有跳过就**不许回收**（否则一次上游抖会被读成「部门被删」）；
 //   · 限流/可恢复致命错要停在原部门（游标不前进），下一次重试同一部门；
 //   · 本地建的部门/成员一根毛都不碰（D13 归属权）。
-import type { WecomClient, WecomMember } from "../src/auth/api/_shared/wecom/client";
+import type { WecomClient, WecomMember } from "../src/app/api/auth/_shared/wecom/client";
 
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { WecomApiError } from "../src/auth/api/_shared/wecom/client";
-import { attachProfile, cancelSync, emptyView, startSync, syncStatus } from "../src/auth/api/_shared/wecom/sync";
+import { WecomApiError } from "../src/app/api/auth/_shared/wecom/client";
+import { attachProfile, cancelSync, emptyView, startSync, syncStatus } from "../src/app/api/auth/_shared/wecom/sync";
 import { installDb } from "./fixture";
 
 /* eslint-disable test/prefer-lowercase-title -- D/AC 编号是验收锚点，保留大写 */