@oj-module/cli 0.2.66 → 0.2.67

package/templates/tests/lifecycle/preflight.spec.ts

@@ -305,3 +305,71 @@ describe("preflight · C2 夹具（双端唯一真源）", () => {
 		}
 	});
 });
+
+describe("p0 §3.9 宿主能力门禁（写锁前失败，零痕迹）", () => {
+	it("老 oj（capabilities 不含所需）+ 新模板声明 requiresCapabilities → 写锁前 failed(host_capability)，retryable=false", async () => {
+		const m = structuredClone(VALID);
+		m.requiresCapabilities = ["reload.modules_in_key", "anon.per_generation"];
+		const r = await preflight(ctx({ manifest: m, capabilities: [] }));
+		expect(r.ok).toBe(false);
+		expect(r.code).toBe("host_capability");
+		expect(r.retryable).toBe(false);
+		expect(r.message).toContain("reload.modules_in_key");
+	});
+
+	it("宿主 capability 未上报（undefined）+ 模板声明 → fail-closed 同拒", async () => {
+		const m = structuredClone(VALID);
+		m.requiresCapabilities = ["reload.api"];
+		const r = await preflight(ctx({ manifest: m })); // 无 capabilities
+		expect(r.ok).toBe(false);
+		expect(r.code).toBe("host_capability");
+	});
+
+	it("宿主具备所需能力 → 放行", async () => {
+		const m = structuredClone(VALID);
+		m.requiresCapabilities = ["reload.api", "reload.modules_in_key"];
+		const r = await preflight(ctx({ manifest: m, capabilities: ["reload.api", "reload.modules_in_key", "anon.per_generation"] }));
+		expect(r.ok).toBe(true);
+	});
+
+	it("既有模板不声明 requiresCapabilities → 门禁恒放行（不依赖上游 US-1 即先落地）", async () => {
+		const r = await preflight(ctx({ capabilities: [] }));
+		expect(r.ok).toBe(true);
+	});
+});
+
+describe("p0 §3.2 质辩1 / E7·E8 匿名保留段与残留检测（写锁前拒装）", () => {
+	it("e7 方案声明保留段匿名条目 → 拒装（C2-26）", async () => {
+		const m = structuredClone(VALID);
+		m.api.anonymous = ["_platform/health"];
+		const r = await preflight(ctx({ manifest: m }));
+		expect(r.ok).toBe(false);
+		expect(r.message).toContain("C2-26");
+		expect(r.message).toContain("_platform");
+	});
+
+	it("e8 config 存在未被本 manifest 声明的同 prefix 匿名残留 → 拒装（anonymous_residual）", async () => {
+		const m = structuredClone(VALID);
+		m.api.anonymous = ["demo-solution/ping"];
+		const r = await preflight(ctx({ manifest: m, existingAnonymousPaths: ["/demo-solution/legacy"] }));
+		expect(r.ok).toBe(false);
+		expect(r.code).toBe("anonymous_residual");
+		expect(r.message).toContain("/demo-solution/legacy");
+	});
+
+	it("e8 config 残留条目恰为本 manifest 已声明 → 不误伤放行", async () => {
+		const m = structuredClone(VALID);
+		m.api.anonymous = ["demo-solution/ping"];
+		const r = await preflight(ctx({ manifest: m, existingAnonymousPaths: ["/demo-solution/ping"] }));
+		expect(r.ok).toBe(true);
+	});
+
+	it("e8 config 残留指向保留段 → 不误伤放行（保留段属宿主内建，方案无法注入，非方案残留）", async () => {
+		const m = structuredClone(VALID);
+		m.api.anonymous = ["demo-solution/ping"];
+		// /_platform/health 是宿主内建匿名端点（如 /auth/login），方案 C2-26 已挡住声明保留段匿名，
+		// 故 config 里的保留段条目绝不会是方案残留——纳入比对只会误伤宿主内建，须放行。
+		const r = await preflight(ctx({ manifest: m, existingAnonymousPaths: ["/_platform/health", "/auth/login"] }));
+		expect(r.ok).toBe(true);
+	});
+});

package/templates/tests/lifecycle/role-title-translate.spec.ts

@@ -1,20 +1,11 @@
 // BDD：solution 角色 title 落库时同步翻译（R1–R6，计划 docs/plans/20261103-0948-role-title-translate）。
 // title = 解析文本（站点默认语言）、title_key = 原文（UI 实时翻译锚）；解析失败回退裸 key，
-// 绝不失败安装（R1）；升级元数据覆盖 = 重解析（R3）；迁移 0018 对存量 solution 角色回填、
-// builtin 不动（R2/AC4）；sys_permission 不变（R5）；name/code/绑定不变（R6）。
+// 绝不失败安装（R1）；升级元数据覆盖 = 重解析（R3）；title_key 列由 0001 基线建表即带（R2/AC4）；sys_permission 不变（R5）；name/code/绑定不变（R6）。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写（register.spec 同约定） */
-import { createRequire } from "node:module";
-import { fileURLToPath } from "node:url";
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 import { registerSolution, resolveDeclTitles, siteLanguage } from "../../src/app/api/_platform/_lifecycle/steps/register";
 import { installDb } from "../fixture";
 
-const req = createRequire(import.meta.url);
-const { DatabaseSync } = req("node:sqlite");
-const { readFileSync } = req("node:fs");
-const { dirname, join } = req("node:path");
-
-const HERE = dirname(fileURLToPath(import.meta.url));
 const enc = new TextEncoder();
 
 let dbo: ReturnType<typeof installDb>;
@@ -142,30 +133,9 @@ describe("R1–R3 落库（registerSolution 消费解析后的 decl）", () => {
 	});
 });
 
-describe("R2 迁移 0018（sys_role.title_key 回填）", () => {
+describe("R2 sys_role.title_key 列（基线建表即带）", () => {
 	it("AC4 夹具真实迁移后 sys_role 带 title_key 列（列进库 ↔ schema.yaml 一致守卫的库侧半边）", () => {
 		const cols = (dbo.prepare("PRAGMA table_info(sys_role)").all() as Array<{ name: string }>).map(c => c.name);
 		expect(cols).toContain("title_key");
 	});
-
-	it("AC4 存量 solution 角色按 key 形状回填，builtin 角色不动、title 原文不改", () => {
-		const raw = new DatabaseSync(":memory:");
-		raw.exec(`
-			CREATE TABLE sys_role (
-				name TEXT PRIMARY KEY, module TEXT NOT NULL, title TEXT, description TEXT,
-				builtin INTEGER NOT NULL DEFAULT 0, deprecated INTEGER NOT NULL DEFAULT 0
-			);
-			INSERT INTO sys_role (name, module, title, builtin) VALUES
-				('pm.sales', 'pm', 'pm:role.sales', 0),
-				('wiki.admin', 'wiki', 'wiki:role.admin', 0),
-				('admin', 'framework', '系统管理员', 1);
-		`);
-		raw.exec(readFileSync(join(HERE, "../../src/app/api/_platform/migrations/0018__sys_role_title_key.sql"), "utf8"));
-		const rows = raw.prepare("SELECT name, title, title_key FROM sys_role ORDER BY name").all() as Array<{ name: string, title: string, title_key: string | null }>;
-		expect(rows).toEqual([
-			{ name: "admin", title: "系统管理员", title_key: null },
-			{ name: "pm.sales", title: "pm:role.sales", title_key: "pm:role.sales" },
-			{ name: "wiki.admin", title: "wiki:role.admin", title_key: "wiki:role.admin" },
-		]);
-	});
 });

package/templates/tests/lifecycle/text-edit.spec.ts

@@ -5,7 +5,7 @@
 import * as fsp from "node:fs/promises";
 import { describe, expect, it } from "vitest";
 
-import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/app/api/_platform/_lifecycle/text-edit";
+import { appendAnonymousPaths, ensureReloadApi, hasAnchor, insertAnchor, removeAnonymousPaths } from "../../src/app/api/_platform/_lifecycle/text-edit";
 
 describe("insertAnchor（R18）", () => {
 	it("带注释的 config.yaml 插入后注释/缩进/空行/键序逐字保留", () => {
@@ -105,32 +105,6 @@ describe("ensureReloadApi（P1-10，D3 一次性注入集收口：S1-1 定稿无
 	});
 });
 
-describe("bumpInstallSeq（B-11 reload 触发面：vars 安装序号自增，PRD E5 实测 vars 改动可热生效）", () => {
-	it("0 → 1 自增，其余行（注释/缩进/键序）逐字保留", () => {
-		const content = "mounts: []\nvars:\n  ojm_install_seq: 0\n# 尾注释保留";
-		const r = bumpInstallSeq(content);
-		expect(r.seq).toBe(1);
-		expect(r.content).toBe("mounts: []\nvars:\n  ojm_install_seq: 1\n# 尾注释保留");
-	});
-
-	it("多次调用累加（N → N+1），行内尾注释原样保留", () => {
-		const content = "vars:\n  ojm_install_seq: 41 # 安装序号";
-		const r1 = bumpInstallSeq(content);
-		expect(r1.seq).toBe(42);
-		expect(r1.content).toBe("vars:\n  ojm_install_seq: 42 # 安装序号");
-		const r2 = bumpInstallSeq(r1.content);
-		expect(r2.seq).toBe(43);
-	});
-
-	it("键缺失 → 可读报错（用户删行 = 显式退出热更触发，安装器不猜位置）", () => {
-		expect(() => bumpInstallSeq("vars:\n  other: 1")).toThrowError(/ojm_install_seq/);
-	});
-
-	it("值非数字（行存在但形状不符）→ 视同缺失，可读报错不猜", () => {
-		expect(() => bumpInstallSeq("vars:\n  ojm_install_seq: abc")).toThrowError(/ojm_install_seq/);
-	});
-});
-
 describe("模板 config.yaml 随发锚点（P1-16 接线②：ensureReloadApi 键缺失插入路径的闭环依据）", () => {
 	it("模板 config.yaml 带整行 # ojm:reload 锚点；键在 → ensureReloadApi no-op", async () => {
 		const cfg = await fsp.readFile(new URL("../../config.yaml", import.meta.url), "utf8");
@@ -175,3 +149,47 @@ describe("p2-15③ C2-26 anonymous 运行时接线（appendAnonymousPaths：conf
 		expect(() => appendAnonymousPaths("server:\n  reload_api: true\n", ["x/y"])).toThrow(/anonymous_paths/);
 	});
 });
+
+describe("removeAnonymousPaths（P0 §3.5 补偿清单：appendAnonymousPaths 逆操作）", () => {
+	const BASE = "auth:\n  anonymous_paths:\n    - /auth/login\n    # 行内注释保留\n    - /system/login-methods\n";
+
+	it("追加后移除 = 还原到追加前形态（注释/缩进/既有项逐字保留）", () => {
+		const added = appendAnonymousPaths(BASE, ["demo-solution/ping", "demo-solution/health"]);
+		const r = removeAnonymousPaths(added.content, ["demo-solution/ping", "demo-solution/health"]);
+		expect(r.removed).toEqual(["/demo-solution/ping", "/demo-solution/health"]);
+		expect(r.content).toBe(BASE);
+	});
+
+	it("只移除指定项，其余匿名条目不动", () => {
+		const added = appendAnonymousPaths(BASE, ["demo-solution/ping", "demo-solution/health"]);
+		const r = removeAnonymousPaths(added.content, ["demo-solution/ping"]);
+		expect(r.removed).toEqual(["/demo-solution/ping"]);
+		expect(r.content).toContain("- /demo-solution/health");
+		expect(r.content).toContain("- /auth/login");
+		expect(r.content).toContain("- /system/login-methods");
+	});
+
+	it("幂等：未含的路径不在列表内 → removed=[] 且内容不变", () => {
+		const added = appendAnonymousPaths(BASE, ["demo-solution/ping"]);
+		const r = removeAnonymousPaths(added.content, ["other/not-present"]);
+		expect(r.removed).toEqual([]);
+		expect(r.content).toBe(added.content);
+	});
+
+	it("连续两次移除同一批路径，第二次为 no-op（防重复副作用）", () => {
+		const added = appendAnonymousPaths(BASE, ["demo-solution/ping"]);
+		const once = removeAnonymousPaths(added.content, ["demo-solution/ping"]);
+		const twice = removeAnonymousPaths(once.content, ["demo-solution/ping"]);
+		expect(twice.removed).toEqual([]);
+		expect(twice.content).toBe(once.content);
+	});
+
+	it("键缺失 = 没东西可删，no-op（不报错）", () => {
+		const r = removeAnonymousPaths("server:\n  reload_api: true\n", ["x/y"]);
+		expect(r.removed).toEqual([]);
+	});
+
+	it("空路径列表 = no-op", () => {
+		expect(removeAnonymousPaths(BASE, []).removed).toEqual([]);
+	});
+});

package/templates/tests/lifecycle/uninstall.spec.ts

@@ -196,6 +196,42 @@ describe("POST uninstall 卸载编排（superadmin，R9）", () => {
 	});
 });
 
+describe("Phase 4：卸载 reload 失败回滚（P0 §3.4 第5步，依赖 US-1 manifests 摘要驱动的装配面，本仓先落编排）", () => {
+	it("卸载摘锁后 reload 失败 → 锁写回(模块仍挂载) + ok:false + 版本目录不删（fail-closed 一致回滚）", async () => {
+		await seedInstalled();
+		const api = createMarketApi(makeEnv({
+			reload: {
+				reloadConfig: async () => {
+					throw new Error("reload boom");
+				},
+			},
+		}));
+		g.http = { user: { id: 1 }, body: { name: "demo-solution" } };
+		await api.uninstall.post();
+		// 锁写回：模块仍挂载（other 保留 + demo-solution 恢复）
+		expect(await readLock(join(sharedRoot, "manifests.yaml"))).toEqual({ "demo-solution": "0.1.0", "other": "1.0.0" });
+		// 版本目录未删（先失可达性再失文件；reload 失败即停，不删文件）
+		await expect(fsp.readdir(join(sharedRoot, "demo-solution-0.1.0"))).resolves.toBeDefined();
+		// sidecar 未删（元数据一致回滚，非半卸）
+		const state = await createStateStore(statePath);
+		expect(state.read().solutions["demo-solution"]).toBeDefined();
+		expect(last?.status).toBe(200);
+		expect(last?.data).toMatchObject({ ok: false });
+		expect(String((last?.data as { message?: string } | undefined)?.message)).toContain("reload 失败");
+	});
+
+	it("卸载 reload 成功 → 版本目录正常移除、锁摘除（既有行为不破坏）", async () => {
+		await seedInstalled();
+		const api = createMarketApi(makeEnv({ reload: { reloadConfig: async () => ({ generation: 1, unchanged: false, applied: ["-demo-solution@0.1.0"], restart_pending: [] }) } }));
+		g.http = { user: { id: 1 }, body: { name: "demo-solution" } };
+		await api.uninstall.post();
+		expect(last?.status).toBe(200);
+		expect(last?.data).toMatchObject({ ok: true });
+		expect(await readLock(join(sharedRoot, "manifests.yaml"))).toEqual({ other: "1.0.0" });
+		await expect(fsp.readdir(join(sharedRoot, "demo-solution-0.1.0"))).rejects.toBeTruthy();
+	});
+});
+
 describe("P3-3 卸载级联单一事务（fail-closed：中段失败整段回滚、锁不摘、无半残）", () => {
 	it("权限级联中段失败 → 事务回滚（route/角色/权限零残）、锁/sidecar/modules/版本目录原样保留", async () => {
 		await seedInstalled();

package/templates/tests/publish-credential.spec.ts

@@ -0,0 +1,354 @@
+// BDD：发布凭证端点族（申请 / 列表 / 撤销 / 兑换）。
+//
+// 这一层要钉的是**跨请求才看得见的语义**，纯函数测不到：
+//   · 一次性：兑换成功后同票再兑必拒（并发双花只有一个赢家）
+//   · 时效：过期即拒，且拒绝发生在「已经拿到身份」之前
+//   · 隔离：普通用户看不到别人的凭证，超管看得到；归属租户来自 users 行而非请求头
+//   · 不留痕：明文只在申请响应里出现一次，库里只有 sha256
+/* eslint-disable test/prefer-lowercase-title -- 用例标题带端点路径，保留原样更易检索 */
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
+import { CREDENTIAL_TTL_SECS } from "../src/app/api/publish/_shared/identity";
+import { createPublishApi } from "../src/app/api/publish/api";
+import { installDb } from "./fixture";
+
+const g = globalThis as any;
+let dbo: ReturnType<typeof installDb>;
+
+interface Captured { status: number | null, body: any }
+let out: Captured;
+
+/** 固定令牌：必须是 64 位 hex，才过得了兑换端点的形状闸门 */
+const TOKEN_1 = "a".repeat(64);
+const TOKEN_2 = "b".repeat(64);
+
+let clock: number;
+
+/** 假摘要：短、确定性、且**不含原文**（否则「明文不落库」的断言会被夹具自己污染） */
+function digest(input: string): string {
+	let acc = 7;
+	for (const ch of input)
+		acc = (acc * 33 + ch.charCodeAt(0)) >>> 0;
+	return `h${acc.toString(16)}`;
+}
+
+function installJson(): void {
+	out = { status: null, body: null };
+	g.json = {
+		ok: (data?: unknown) => {
+			out.status = 200;
+			out.body = data;
+		},
+		fail: (code: number, msg: string, extra?: unknown) => {
+			out.status = code;
+			out.body = { code, msg, extra };
+		},
+	};
+}
+
+function api(tokens: string[] = [TOKEN_1, TOKEN_2]) {
+	const queue = [...tokens];
+	return createPublishApi({
+		now: () => clock,
+		randomHex: () => queue.shift() ?? "c".repeat(64),
+		sha256Hex: digest,
+	});
+}
+
+function mkUser(username: string, opts: { tenant?: string, displayName?: string, superadmin?: boolean } = {}): number {
+	const tenant = opts.tenant ?? "default";
+	dbo.prepare("INSERT INTO users (username, password_hash, display_name, tenant_id) VALUES (?, 'x', ?, ?)")
+		.run(username, opts.displayName ?? null, tenant);
+	const uid = (dbo.prepare("SELECT id FROM users WHERE username = ? AND tenant_id = ?").get(username, tenant) as { id: number }).id;
+	if (opts.superadmin)
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name, tenant_id) VALUES (?, 'superadmin', ?)").run(uid, tenant);
+	return uid;
+}
+
+/** 以某个登录用户身份发请求 */
+function as(uid: number, extra: Record<string, unknown> = {}): void {
+	g.http = { user: { id: uid }, tenantId: "default", headers: { "x-real-ip": "10.0.0.1" }, ...extra };
+}
+
+function rowOf(token: string): Record<string, unknown> | undefined {
+	return dbo.prepare("SELECT * FROM publish_credential WHERE token_hash = ?").get(digest(token)) as Record<string, unknown> | undefined;
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	g.http = {};
+	clock = 1_700_000_000;
+	dbo.exec("DELETE FROM publish_credential");
+});
+
+describe("POST /api/publish/credential（申请）", () => {
+	it("given 登录用户填合法产品名 When 申请 Then 返回 64 位明文、身份已定，库里只有 hash", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_apply", { displayName: "张三" });
+		as(uid, { body: { product: "demo-solution" } });
+
+		await api().credential.post();
+
+		expect(out.status).toBe(200);
+		expect(out.body.token).toBe(TOKEN_1);
+		expect(out.body.key_id).toBe("demo-solution.p-apply");
+		expect(out.body.expires_at).toBe(clock + CREDENTIAL_TTL_SECS);
+		expect(out.body.token_hint).toBe(TOKEN_1.slice(0, 8));
+
+		const row = rowOf(TOKEN_1)!;
+		expect(row.token_hash).toBe(digest(TOKEN_1));
+		expect(row.display_name).toBe("张三");
+		expect(row.owner_tenant).toBe("default");
+		// 明文绝不落库
+		expect(JSON.stringify(row)).not.toContain(TOKEN_1);
+	});
+
+	it("given 产品名是保留名 When 申请 Then 400 且不产生记录", async () => {
+		installJson();
+		const uid = mkUser("p_bad");
+		as(uid, { body: { product: "market" } });
+
+		await api().credential.post();
+
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("保留名");
+		expect(dbo.prepare("SELECT count(*) AS c FROM publish_credential").get()).toEqual({ c: 0 });
+	});
+
+	it("given 同一产品名已被他人占用 When 另一用户申请 Then 409（同一人重复申请放行）", async () => {
+		installJson();
+		clock = 1_700_000_000;
+
+		// 同名账号在不同租户：唯一键是 (tenant_id, username)，故可共存
+		const a = mkUser("p_dup", { tenant: "default" });
+		const b = mkUser("p_dup", { tenant: "t2" });
+
+		as(a, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+		expect(out.status).toBe(200);
+
+		as(b, { tenantId: "t2", body: { product: "demo-solution" } });
+		await api([TOKEN_2]).credential.post();
+		expect(out.status).toBe(409);
+		expect(out.body.msg).toContain("已被其他用户占用");
+	});
+});
+
+describe("POST /api/publish/credential/exchange（兑换）", () => {
+	it("given 有效凭证 When 兑换 Then 返回申请时定下的 key_id 且该票作废", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex1");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+		const issued = out.body;
+
+		// 兑换是匿名的：不带 user
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: issued.token } };
+		await p.credential.exchange.post();
+
+		expect(out.status).toBe(200);
+		expect(out.body).toMatchObject({ key_id: issued.key_id, product: "demo-solution", username: "p_ex1" });
+
+		const row = rowOf(TOKEN_1)!;
+		expect(Number(row.used)).toBe(1);
+		expect(Number(row.used_at)).toBe(clock);
+
+		// 再兑：同票必拒
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: issued.token } };
+		await p.credential.exchange.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("发布管理");
+	});
+
+	it("given 凭证已过期 When 兑换 Then 400（过期判定在签发身份之前）", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex2");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+
+		clock += CREDENTIAL_TTL_SECS + 1;
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+
+		expect(out.status).toBe(400);
+		expect(Number(rowOf(TOKEN_1)!.used)).toBe(0);
+	});
+
+	it("given 凭证已撤销 When 兑换 Then 400", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex3");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+		const id = Number(rowOf(TOKEN_1)!.id);
+
+		as(uid, { body: { id } });
+		await p.credential.revoke.post();
+		expect(out.status).toBe(200);
+
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+		expect(out.status).toBe(400);
+	});
+
+	it("given 同一张票连续兑换 3 次 When 依次到达 Then 只有第一次成功，used_at 停在首次时间", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex4");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+
+		// 原子性来自那一条 `update ... where used = 0`：并发双花只可能有一个 changes=1。
+		// Node 侧 sqlite 是同步的，真并发无法复现，故钉「重复到达只有一次生效」这一可观测面。
+		const firstAt = clock;
+		const statuses: number[] = [];
+		for (let i = 0; i < 3; i++) {
+			g.http = { headers: { "x-real-ip": `10.0.0.${i + 1}` }, body: { token: TOKEN_1 } };
+			await p.credential.exchange.post();
+			statuses.push(out.status!);
+			clock += 5;
+		}
+
+		expect(statuses).toEqual([200, 400, 400]);
+		expect(Number(rowOf(TOKEN_1)!.used_at)).toBe(firstAt);
+	});
+
+	it("given 令牌形状不对 When 兑换 Then 400 且不触库（不打日志也不落审计）", async () => {
+		installJson();
+		g.http = { headers: { "x-real-ip": "10.0.0.6" }, body: { token: "not-a-token" } };
+		await api().credential.exchange.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("重新申请");
+	});
+});
+
+describe("GET /api/publish/credential（列表）", () => {
+	it("given 普通用户 When 查列表 Then 只看到自己的且响应不含 token/hash", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const a = mkUser("p_list_a");
+		const b = mkUser("p_list_b");
+
+		as(a, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+		as(b, { body: { product: "other-solution" } });
+		await api([TOKEN_2]).credential.post();
+
+		as(a);
+		await api().credential.get();
+
+		expect(out.status).toBe(200);
+		expect(out.body.total).toBe(1);
+		expect(out.body.list[0]).toMatchObject({ product: "demo-solution", key_id: "demo-solution.p-list-a", status: "active" });
+		// 明文与哈希都不出现在列表里
+		const serialized = JSON.stringify(out.body);
+		expect(serialized).not.toContain(TOKEN_1);
+		expect(serialized).not.toContain("token_hash");
+		expect(out.body.list[0].owner_tenant).toBeUndefined();
+	});
+
+	it("given 超管 When 查列表 Then 能看到全部并带归属租户", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const a = mkUser("p_list_c");
+		const boss = mkUser("p_boss", { superadmin: true });
+
+		as(a, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+
+		as(boss);
+		await api().credential.get();
+
+		expect(out.status).toBe(200);
+		expect(out.body.total).toBe(1);
+		expect(out.body.list[0].owner_tenant).toBe("default");
+	});
+
+	it("given 状态演进 When 兑换/撤销后查列表 Then 状态字段随之变化", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_list_d");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+
+		g.http = { headers: { "x-real-ip": "10.0.0.5" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+
+		as(uid);
+		await p.credential.get();
+		expect(out.body.list[0].status).toBe("used");
+		expect(out.body.list[0].used_at).toBe(clock);
+	});
+});
+
+describe("POST /api/publish/credential/revoke（撤销）", () => {
+	it("given 别人的凭证 When 撤销 Then 404（与不存在同一句话，不泄露存在性）", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const owner = mkUser("p_rev_a");
+		const stranger = mkUser("p_rev_b");
+
+		as(owner, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+		const id = Number(rowOf(TOKEN_1)!.id);
+
+		as(stranger, { body: { id } });
+		await api().credential.revoke.post();
+
+		expect(out.status).toBe(404);
+		expect(Number(rowOf(TOKEN_1)!.revoked)).toBe(0);
+	});
+
+	it("given 已兑换的凭证 When 撤销 Then 400 并说明发布身份不能撤回", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_rev_c");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+		const id = Number(rowOf(TOKEN_1)!.id);
+
+		g.http = { headers: { "x-real-ip": "10.0.0.4" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+
+		as(uid, { body: { id } });
+		await p.credential.revoke.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("发布身份");
+	});
+});
+
+describe("门禁", () => {
+	it("given 未登录 When 访问列表/申请 Then 403", async () => {
+		installJson();
+		as(0);
+		g.http = {};
+		await api().credential.get();
+		expect(out.status).toBe(403);
+
+		installJson();
+		g.http = { body: { product: "demo-solution" } };
+		await api().credential.post();
+		expect(out.status).toBe(403);
+	});
+
+	it("given 伪造租户头 When 访问列表 Then 403（sub 在当前租户查无此人）", async () => {
+		installJson();
+		const uid = mkUser("p_forge");
+		invalidateUser(uid);
+		g.http = { user: { id: uid }, tenantId: "other-tenant" };
+		await api().credential.get();
+		expect(out.status).toBe(403);
+	});
+});

package/templates/tests/publish-identity.spec.ts

@@ -0,0 +1,44 @@
+// BDD：发布身份推导规则（publish/_shared/identity.ts）。
+// 这条规则同时决定 ~/.ojm/keys/<id>/ 的目录名、.sig 的 key_id 与市场卡片上的「发布者」，
+// 一旦漂移就是「签出来的身份查不到凭证」这类跨端问题，故用固定用例表钉死。
+import { describe, expect, it } from "vitest";
+import { assertKeyId, assertProduct, deriveKeyId, encodePerson, KEY_ID_RE } from "../src/app/api/publish/_shared/identity";
+
+describe("发布身份推导", () => {
+	it("given 用户名 wecom:everpan 且产品 demo-solution When 推导 Then key_id 用连字符替换冒号", () => {
+		expect(deriveKeyId({ product: "demo-solution", username: "wecom:everpan", uid: 7 }))
+			.toBe("demo-solution.wecom-everpan");
+	});
+
+	it("given 用户名含大写/下划线/连续符号 When 推导 Then 全小写、非白名单字符替换为 - 并折叠", () => {
+		expect(encodePerson("WeCom:Ever_Pan", 7)).toBe("wecom-ever-pan");
+		expect(encodePerson("--a__b--", 7)).toBe("a-b");
+	});
+
+	it("given 用户名归一化后为空（纯中文）When 推导 Then 退化为 u<uid> 且仍是合法 key_id", () => {
+		const keyId = deriveKeyId({ product: "demo-solution", username: "张三", uid: 42 });
+		expect(keyId).toBe("demo-solution.u42");
+		expect(KEY_ID_RE.test(keyId)).toBe(true);
+	});
+
+	it("given 产品名为保留名 When 校验 Then 拒绝并提示换成自己的解决方案名", () => {
+		for (const reserved of ["oj", "market", "system", "registry"])
+			expect(() => assertProduct(reserved)).toThrowError(/保留名/);
+	});
+
+	it("given 产品名形状非法 When 校验 Then 拒绝并给出可用示例", () => {
+		for (const bad of ["", "  ", "Demo", "1demo", "demo_solution", "demo solution", "a".repeat(65)])
+			expect(() => assertProduct(bad)).toThrowError(/400|产品名/);
+	});
+
+	it("given 合法产品名带首尾空格 When 校验 Then 去空格后通过", () => {
+		expect(assertProduct("  demo-solution  ")).toBe("demo-solution");
+	});
+
+	it("given 推导结果 When 自检 Then 满足 C2-37 的 key_id 形状（≥2 段、小写、仅 [a-z0-9-]）", () => {
+		const keyId = assertKeyId(deriveKeyId({ product: "demo-solution", username: "wecom:everpan", uid: 7 }));
+		expect(keyId.split(".")).toHaveLength(2);
+		expect(KEY_ID_RE.test(keyId)).toBe(true);
+		expect(() => assertKeyId("nodot")).toThrowError(/不符合 key_id 规则/);
+	});
+});