@oj-module/cli 0.2.66 → 0.2.68

package/templates/tests/publish-credential.spec.ts

@@ -0,0 +1,354 @@
+// BDD：发布凭证端点族（申请 / 列表 / 撤销 / 兑换）。
+//
+// 这一层要钉的是**跨请求才看得见的语义**，纯函数测不到：
+//   · 一次性：兑换成功后同票再兑必拒（并发双花只有一个赢家）
+//   · 时效：过期即拒，且拒绝发生在「已经拿到身份」之前
+//   · 隔离：普通用户看不到别人的凭证，超管看得到；归属租户来自 users 行而非请求头
+//   · 不留痕：明文只在申请响应里出现一次，库里只有 sha256
+/* eslint-disable test/prefer-lowercase-title -- 用例标题带端点路径，保留原样更易检索 */
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { invalidateUser } from "../src/app/api/_platform/_shared/service/infra/access";
+import { CREDENTIAL_TTL_SECS } from "../src/app/api/publish/_shared/identity";
+import { createPublishApi } from "../src/app/api/publish/api";
+import { installDb } from "./fixture";
+
+const g = globalThis as any;
+let dbo: ReturnType<typeof installDb>;
+
+interface Captured { status: number | null, body: any }
+let out: Captured;
+
+/** 固定令牌：必须是 64 位 hex，才过得了兑换端点的形状闸门 */
+const TOKEN_1 = "a".repeat(64);
+const TOKEN_2 = "b".repeat(64);
+
+let clock: number;
+
+/** 假摘要：短、确定性、且**不含原文**（否则「明文不落库」的断言会被夹具自己污染） */
+function digest(input: string): string {
+	let acc = 7;
+	for (const ch of input)
+		acc = (acc * 33 + ch.charCodeAt(0)) >>> 0;
+	return `h${acc.toString(16)}`;
+}
+
+function installJson(): void {
+	out = { status: null, body: null };
+	g.json = {
+		ok: (data?: unknown) => {
+			out.status = 200;
+			out.body = data;
+		},
+		fail: (code: number, msg: string, extra?: unknown) => {
+			out.status = code;
+			out.body = { code, msg, extra };
+		},
+	};
+}
+
+function api(tokens: string[] = [TOKEN_1, TOKEN_2]) {
+	const queue = [...tokens];
+	return createPublishApi({
+		now: () => clock,
+		randomHex: () => queue.shift() ?? "c".repeat(64),
+		sha256Hex: digest,
+	});
+}
+
+function mkUser(username: string, opts: { tenant?: string, displayName?: string, superadmin?: boolean } = {}): number {
+	const tenant = opts.tenant ?? "default";
+	dbo.prepare("INSERT INTO users (username, password_hash, display_name, tenant_id) VALUES (?, 'x', ?, ?)")
+		.run(username, opts.displayName ?? null, tenant);
+	const uid = (dbo.prepare("SELECT id FROM users WHERE username = ? AND tenant_id = ?").get(username, tenant) as { id: number }).id;
+	if (opts.superadmin)
+		dbo.prepare("INSERT INTO sys_user_role (user_id, role_name, tenant_id) VALUES (?, 'superadmin', ?)").run(uid, tenant);
+	return uid;
+}
+
+/** 以某个登录用户身份发请求 */
+function as(uid: number, extra: Record<string, unknown> = {}): void {
+	g.http = { user: { id: uid }, tenantId: "default", headers: { "x-real-ip": "10.0.0.1" }, ...extra };
+}
+
+function rowOf(token: string): Record<string, unknown> | undefined {
+	return dbo.prepare("SELECT * FROM publish_credential WHERE token_hash = ?").get(digest(token)) as Record<string, unknown> | undefined;
+}
+
+beforeAll(() => {
+	dbo = installDb();
+});
+
+afterEach(() => {
+	g.http = {};
+	clock = 1_700_000_000;
+	dbo.exec("DELETE FROM publish_credential");
+});
+
+describe("POST /api/publish/credential（申请）", () => {
+	it("given 登录用户填合法产品名 When 申请 Then 返回 64 位明文、身份已定，库里只有 hash", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_apply", { displayName: "张三" });
+		as(uid, { body: { product: "demo-solution" } });
+
+		await api().credential.post();
+
+		expect(out.status).toBe(200);
+		expect(out.body.token).toBe(TOKEN_1);
+		expect(out.body.key_id).toBe("demo-solution.p-apply");
+		expect(out.body.expires_at).toBe(clock + CREDENTIAL_TTL_SECS);
+		expect(out.body.token_hint).toBe(TOKEN_1.slice(0, 8));
+
+		const row = rowOf(TOKEN_1)!;
+		expect(row.token_hash).toBe(digest(TOKEN_1));
+		expect(row.display_name).toBe("张三");
+		expect(row.owner_tenant).toBe("default");
+		// 明文绝不落库
+		expect(JSON.stringify(row)).not.toContain(TOKEN_1);
+	});
+
+	it("given 产品名是保留名 When 申请 Then 400 且不产生记录", async () => {
+		installJson();
+		const uid = mkUser("p_bad");
+		as(uid, { body: { product: "market" } });
+
+		await api().credential.post();
+
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("保留名");
+		expect(dbo.prepare("SELECT count(*) AS c FROM publish_credential").get()).toEqual({ c: 0 });
+	});
+
+	it("given 同一产品名已被他人占用 When 另一用户申请 Then 409（同一人重复申请放行）", async () => {
+		installJson();
+		clock = 1_700_000_000;
+
+		// 同名账号在不同租户：唯一键是 (tenant_id, username)，故可共存
+		const a = mkUser("p_dup", { tenant: "default" });
+		const b = mkUser("p_dup", { tenant: "t2" });
+
+		as(a, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+		expect(out.status).toBe(200);
+
+		as(b, { tenantId: "t2", body: { product: "demo-solution" } });
+		await api([TOKEN_2]).credential.post();
+		expect(out.status).toBe(409);
+		expect(out.body.msg).toContain("已被其他用户占用");
+	});
+});
+
+describe("POST /api/publish/credential/exchange（兑换）", () => {
+	it("given 有效凭证 When 兑换 Then 返回申请时定下的 key_id 且该票作废", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex1");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+		const issued = out.body;
+
+		// 兑换是匿名的：不带 user
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: issued.token } };
+		await p.credential.exchange.post();
+
+		expect(out.status).toBe(200);
+		expect(out.body).toMatchObject({ key_id: issued.key_id, product: "demo-solution", username: "p_ex1" });
+
+		const row = rowOf(TOKEN_1)!;
+		expect(Number(row.used)).toBe(1);
+		expect(Number(row.used_at)).toBe(clock);
+
+		// 再兑：同票必拒
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: issued.token } };
+		await p.credential.exchange.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("发布管理");
+	});
+
+	it("given 凭证已过期 When 兑换 Then 400（过期判定在签发身份之前）", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex2");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+
+		clock += CREDENTIAL_TTL_SECS + 1;
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+
+		expect(out.status).toBe(400);
+		expect(Number(rowOf(TOKEN_1)!.used)).toBe(0);
+	});
+
+	it("given 凭证已撤销 When 兑换 Then 400", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex3");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+		const id = Number(rowOf(TOKEN_1)!.id);
+
+		as(uid, { body: { id } });
+		await p.credential.revoke.post();
+		expect(out.status).toBe(200);
+
+		g.http = { headers: { "x-real-ip": "10.0.0.9" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+		expect(out.status).toBe(400);
+	});
+
+	it("given 同一张票连续兑换 3 次 When 依次到达 Then 只有第一次成功，used_at 停在首次时间", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_ex4");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+
+		// 原子性来自那一条 `update ... where used = 0`：并发双花只可能有一个 changes=1。
+		// Node 侧 sqlite 是同步的，真并发无法复现，故钉「重复到达只有一次生效」这一可观测面。
+		const firstAt = clock;
+		const statuses: number[] = [];
+		for (let i = 0; i < 3; i++) {
+			g.http = { headers: { "x-real-ip": `10.0.0.${i + 1}` }, body: { token: TOKEN_1 } };
+			await p.credential.exchange.post();
+			statuses.push(out.status!);
+			clock += 5;
+		}
+
+		expect(statuses).toEqual([200, 400, 400]);
+		expect(Number(rowOf(TOKEN_1)!.used_at)).toBe(firstAt);
+	});
+
+	it("given 令牌形状不对 When 兑换 Then 400 且不触库（不打日志也不落审计）", async () => {
+		installJson();
+		g.http = { headers: { "x-real-ip": "10.0.0.6" }, body: { token: "not-a-token" } };
+		await api().credential.exchange.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("重新申请");
+	});
+});
+
+describe("GET /api/publish/credential（列表）", () => {
+	it("given 普通用户 When 查列表 Then 只看到自己的且响应不含 token/hash", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const a = mkUser("p_list_a");
+		const b = mkUser("p_list_b");
+
+		as(a, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+		as(b, { body: { product: "other-solution" } });
+		await api([TOKEN_2]).credential.post();
+
+		as(a);
+		await api().credential.get();
+
+		expect(out.status).toBe(200);
+		expect(out.body.total).toBe(1);
+		expect(out.body.list[0]).toMatchObject({ product: "demo-solution", key_id: "demo-solution.p-list-a", status: "active" });
+		// 明文与哈希都不出现在列表里
+		const serialized = JSON.stringify(out.body);
+		expect(serialized).not.toContain(TOKEN_1);
+		expect(serialized).not.toContain("token_hash");
+		expect(out.body.list[0].owner_tenant).toBeUndefined();
+	});
+
+	it("given 超管 When 查列表 Then 能看到全部并带归属租户", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const a = mkUser("p_list_c");
+		const boss = mkUser("p_boss", { superadmin: true });
+
+		as(a, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+
+		as(boss);
+		await api().credential.get();
+
+		expect(out.status).toBe(200);
+		expect(out.body.total).toBe(1);
+		expect(out.body.list[0].owner_tenant).toBe("default");
+	});
+
+	it("given 状态演进 When 兑换/撤销后查列表 Then 状态字段随之变化", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_list_d");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+
+		g.http = { headers: { "x-real-ip": "10.0.0.5" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+
+		as(uid);
+		await p.credential.get();
+		expect(out.body.list[0].status).toBe("used");
+		expect(out.body.list[0].used_at).toBe(clock);
+	});
+});
+
+describe("POST /api/publish/credential/revoke（撤销）", () => {
+	it("given 别人的凭证 When 撤销 Then 404（与不存在同一句话，不泄露存在性）", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const owner = mkUser("p_rev_a");
+		const stranger = mkUser("p_rev_b");
+
+		as(owner, { body: { product: "demo-solution" } });
+		await api([TOKEN_1]).credential.post();
+		const id = Number(rowOf(TOKEN_1)!.id);
+
+		as(stranger, { body: { id } });
+		await api().credential.revoke.post();
+
+		expect(out.status).toBe(404);
+		expect(Number(rowOf(TOKEN_1)!.revoked)).toBe(0);
+	});
+
+	it("given 已兑换的凭证 When 撤销 Then 400 并说明发布身份不能撤回", async () => {
+		installJson();
+		clock = 1_700_000_000;
+		const uid = mkUser("p_rev_c");
+		as(uid, { body: { product: "demo-solution" } });
+		const p = api([TOKEN_1]);
+		await p.credential.post();
+		const id = Number(rowOf(TOKEN_1)!.id);
+
+		g.http = { headers: { "x-real-ip": "10.0.0.4" }, body: { token: TOKEN_1 } };
+		await p.credential.exchange.post();
+
+		as(uid, { body: { id } });
+		await p.credential.revoke.post();
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toContain("发布身份");
+	});
+});
+
+describe("门禁", () => {
+	it("given 未登录 When 访问列表/申请 Then 403", async () => {
+		installJson();
+		as(0);
+		g.http = {};
+		await api().credential.get();
+		expect(out.status).toBe(403);
+
+		installJson();
+		g.http = { body: { product: "demo-solution" } };
+		await api().credential.post();
+		expect(out.status).toBe(403);
+	});
+
+	it("given 伪造租户头 When 访问列表 Then 403（sub 在当前租户查无此人）", async () => {
+		installJson();
+		const uid = mkUser("p_forge");
+		invalidateUser(uid);
+		g.http = { user: { id: uid }, tenantId: "other-tenant" };
+		await api().credential.get();
+		expect(out.status).toBe(403);
+	});
+});

package/templates/tests/publish-identity.spec.ts

@@ -0,0 +1,44 @@
+// BDD：发布身份推导规则（publish/_shared/identity.ts）。
+// 这条规则同时决定 ~/.ojm/keys/<id>/ 的目录名、.sig 的 key_id 与市场卡片上的「发布者」，
+// 一旦漂移就是「签出来的身份查不到凭证」这类跨端问题，故用固定用例表钉死。
+import { describe, expect, it } from "vitest";
+import { assertKeyId, assertProduct, deriveKeyId, encodePerson, KEY_ID_RE } from "../src/app/api/publish/_shared/identity";
+
+describe("发布身份推导", () => {
+	it("given 用户名 wecom:everpan 且产品 demo-solution When 推导 Then key_id 用连字符替换冒号", () => {
+		expect(deriveKeyId({ product: "demo-solution", username: "wecom:everpan", uid: 7 }))
+			.toBe("demo-solution.wecom-everpan");
+	});
+
+	it("given 用户名含大写/下划线/连续符号 When 推导 Then 全小写、非白名单字符替换为 - 并折叠", () => {
+		expect(encodePerson("WeCom:Ever_Pan", 7)).toBe("wecom-ever-pan");
+		expect(encodePerson("--a__b--", 7)).toBe("a-b");
+	});
+
+	it("given 用户名归一化后为空（纯中文）When 推导 Then 退化为 u<uid> 且仍是合法 key_id", () => {
+		const keyId = deriveKeyId({ product: "demo-solution", username: "张三", uid: 42 });
+		expect(keyId).toBe("demo-solution.u42");
+		expect(KEY_ID_RE.test(keyId)).toBe(true);
+	});
+
+	it("given 产品名为保留名 When 校验 Then 拒绝并提示换成自己的解决方案名", () => {
+		for (const reserved of ["oj", "market", "system", "registry"])
+			expect(() => assertProduct(reserved)).toThrowError(/保留名/);
+	});
+
+	it("given 产品名形状非法 When 校验 Then 拒绝并给出可用示例", () => {
+		for (const bad of ["", "  ", "Demo", "1demo", "demo_solution", "demo solution", "a".repeat(65)])
+			expect(() => assertProduct(bad)).toThrowError(/400|产品名/);
+	});
+
+	it("given 合法产品名带首尾空格 When 校验 Then 去空格后通过", () => {
+		expect(assertProduct("  demo-solution  ")).toBe("demo-solution");
+	});
+
+	it("given 推导结果 When 自检 Then 满足 C2-37 的 key_id 形状（≥2 段、小写、仅 [a-z0-9-]）", () => {
+		const keyId = assertKeyId(deriveKeyId({ product: "demo-solution", username: "wecom:everpan", uid: 7 }));
+		expect(keyId.split(".")).toHaveLength(2);
+		expect(KEY_ID_RE.test(keyId)).toBe(true);
+		expect(() => assertKeyId("nodot")).toThrowError(/不符合 key_id 规则/);
+	});
+});

package/templates/tests/rbac-solution-perms.spec.ts

@@ -132,6 +132,51 @@ describe("AC2-3/4：声明消失与重命名 → deprecated 保留（判决不
 	});
 });
 
+describe("R2/R3：权限点 title_key 落库（多语言展示锚）与重声明复位", () => {
+	it("R2 title_key 随声明落库：permissions[{code,title_key}] → sys_permission.title_key（缺省→null）", async () => {
+		const r = await upsertSolutionPerms({
+			module: "wiki",
+			roles: [{ name: "wiki.reader", title: "wiki:role.reader", title_key: "wiki:role.reader", permissions: ["wiki.doc.read"] }],
+			permissions: [
+				{ code: "wiki.doc.read", title_key: "wiki:perm.doc_read" },
+				{ code: "wiki.doc.export" }, // 无角色引用的独立声明点；title_key 缺省 → null（宽松态合法）
+			],
+		});
+		expect(r.deprecated).toEqual([]);
+		expect(rows("SELECT title_key FROM sys_permission WHERE code = 'wiki.doc.read'")[0].title_key).toBe("wiki:perm.doc_read");
+		expect(rows("SELECT title_key FROM sys_permission WHERE code = 'wiki.doc.export'")[0].title_key).toBeNull();
+		// 角色侧同口径（既有行为再钉一次，防回归）
+		expect(rows("SELECT title_key FROM sys_role WHERE name = 'wiki.reader'")[0].title_key).toBe("wiki:role.reader");
+	});
+
+	it("R3 既有权限点行 title_key 元数据随升级覆盖（新包 locale 改进随升级传播）", async () => {
+		await upsertSolutionPerms({ module: "wiki", roles: [], permissions: [{ code: "wiki.doc.read", title_key: "wiki:perm.old" }] });
+		await upsertSolutionPerms({ module: "wiki", roles: [], permissions: [{ code: "wiki.doc.read", title_key: "wiki:perm.new" }] });
+		expect(rows("SELECT title_key FROM sys_permission WHERE code = 'wiki.doc.read'")[0].title_key).toBe("wiki:perm.new");
+	});
+
+	it("AC2-3 重声明复位 deprecated=0：权限点与角色行回归声明态（对齐 settings/routes 注册面同纪律）", async () => {
+		await installWikiV019();
+		await upsertSolutionPerms({
+			module: "wiki",
+			roles: [{ name: "wiki.admin", title: "管理员", permissions: ["wiki.doc.create"] }], // space.create 与 editor 消失
+		});
+		expect(Number(rows("SELECT deprecated FROM sys_permission WHERE code = 'wiki.space.create'")[0].deprecated)).toBe(1);
+		expect(Number(rows("SELECT deprecated FROM sys_role WHERE name = 'wiki.editor'")[0].deprecated)).toBe(1);
+		// 下一版本把两者重新声明回来 → deprecated 必须复位，装机告警消停
+		const r = await upsertSolutionPerms({
+			module: "wiki",
+			roles: [
+				{ name: "wiki.admin", title: "管理员", permissions: ["wiki.doc.create", "wiki.space.create"] },
+				{ name: "wiki.editor", title: "编辑", permissions: ["wiki.doc.create"] },
+			],
+		});
+		expect(r.deprecated).toEqual([]);
+		expect(Number(rows("SELECT deprecated FROM sys_permission WHERE code = 'wiki.space.create'")[0].deprecated)).toBe(0);
+		expect(Number(rows("SELECT deprecated FROM sys_role WHERE name = 'wiki.editor'")[0].deprecated)).toBe(0);
+	});
+});
+
 describe("AC2-6：卸载级联清理（唯一减法出口）", () => {
 	it("双维度删除：wiki 角色及其绑定 + 属 wiki 的权限点绑定（含 custom 角色上的）；custom 角色本体保留", async () => {
 		await installWikiV019();
@@ -177,7 +222,7 @@ describe("顶层 permissions[]：无角色的权限点也要落库", () => {
 		await upsertSolutionPerms({
 			module: "oj-registry",
 			roles: [],
-			permissions: ["oj-registry.publish", "oj-registry.admin"],
+			permissions: [{ code: "oj-registry.publish" }, { code: "oj-registry.admin", title_key: "oj-registry:perm.admin" }],
 		});
 
 		expect(rows("SELECT code, module FROM sys_permission ORDER BY code")).toEqual([
@@ -187,7 +232,7 @@ describe("顶层 permissions[]：无角色的权限点也要落库", () => {
 	});
 
 	it("AC2-6 卸载后无角色的权限点一并摘干净（含 custom 角色上的绑定）", async () => {
-		await upsertSolutionPerms({ module: "oj-registry", roles: [], permissions: ["oj-registry.publish"] });
+		await upsertSolutionPerms({ module: "oj-registry", roles: [], permissions: [{ code: "oj-registry.publish" }] });
 		dbo.exec("INSERT INTO sys_role (name, module, title) VALUES ('custom.dev', 'custom', '开发者')");
 		dbo.exec("INSERT INTO sys_role_permission (role_name, permission_code) VALUES ('custom.dev', 'oj-registry.publish')");
 
@@ -202,7 +247,7 @@ describe("顶层 permissions[]：无角色的权限点也要落库", () => {
 	it("G7 攻击者视角：声明权限点不等于拿到权限——落库不产生任何绑定", async () => {
 		// 使坏路径：以为「把 code 写进 manifest 就自动获权」。落库的只是权限点标签行，
 		// 判定仍要角色绑定；没有绑定，decideAccess 对该 code 恒 false。
-		await upsertSolutionPerms({ module: "oj-registry", roles: [], permissions: ["oj-registry.publish"] });
+		await upsertSolutionPerms({ module: "oj-registry", roles: [], permissions: [{ code: "oj-registry.publish" }] });
 
 		expect(rows("SELECT * FROM sys_role_permission WHERE permission_code = 'oj-registry.publish'").length).toBe(0);
 	});

package/templates/tests/wecom-client-timeout.spec.ts

@@ -8,7 +8,10 @@
 //   1. 无 AbortSignal 时调用照常工作（不抛 `AbortSignal is not defined`）；
 //   2. 不再把 `signal` 传给 fetch（旧 bug 的根）；
 //   3. tasks.sleep 存在 → 慢请求被软超时拦截并抛「超时」文案；
-//   4. tasks 缺失 → 安全降级为「不超时」，快速请求正常返回。
+//   4. tasks 缺失 → 安全降级为「不超时」，快速请求正常返回；
+//   5. 软超时只按短步长 sleep（企微工作台 5-6s 白屏回归）——早期实现挂一条
+//      sleep(5000) 做竞态，上游秒回时那条 sleep 仍在飞，oj 运行时要等请求上下文里
+//      所有异步任务结束才 flush 响应，于是每个调企微接口的请求都被白拖到 5s。
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { runtimeHttp } from "../src/app/api/auth/_shared/wecom/client";
@@ -26,6 +29,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+	vi.restoreAllMocks();
 	Object.defineProperty(globalThis, "AbortSignal", { value: savedAbortSignal, configurable: true, writable: true });
 	g.tasks = savedTasks;
 	g.fetch = savedFetch;
@@ -74,8 +78,16 @@ describe("wecom client：无 AbortSignal 的 isolate 不崩（回归）", () =>
 
 describe("wecom client：软超时（tasks.sleep）", () => {
 	it("tasks.sleep 存在时，慢请求被软超时拦截并抛出「超时」文案", async () => {
-		// 用立即 resolve 的 sleep 模拟（不真的等 TIMEOUT_MS，测试秒级完成）
-		g.tasks = { sleep: () => Promise.resolve() };
+		// 假时钟：sleep 不真的等，只推进 Date.now()。软超时按墙钟 deadline 判定、
+		// 50ms 一个步长，故 100 步后到点抛超时（测试秒级完成）。
+		let now = 0;
+		vi.spyOn(Date, "now").mockImplementation(() => now);
+		g.tasks = {
+			sleep: (ms: number) => {
+				now += ms;
+				return Promise.resolve();
+			},
+		};
 		let resolveFetch: (v: unknown) => void = () => {};
 		const fetchMock = vi.fn(() => new Promise<unknown>((resolve) => {
 			resolveFetch = resolve;
@@ -96,4 +108,22 @@ describe("wecom client：软超时（tasks.sleep）", () => {
 		const data = await runtimeHttp().getJson("https://qyapi.weixin.qq.com/x");
 		expect(data.errcode).toBe(0);
 	});
+
+	it("快速上游只按短步长 sleep，不留 5s 悬挂任务拖住响应（企微工作台白屏回归）", async () => {
+		const sleeps: number[] = [];
+		g.tasks = {
+			sleep: (ms: number) => {
+				sleeps.push(ms);
+				return Promise.resolve();
+			},
+		};
+		g.fetch = vi.fn(async () => ({ ok: true, json: async () => ({ errcode: 0 }) }));
+
+		const data = await runtimeHttp().getJson("https://qyapi.weixin.qq.com/x");
+		expect(data.errcode).toBe(0);
+		// 旧实现这里会是 [5000]：race 由 fetch 赢，但那条 sleep 仍在请求上下文里飞，
+		// 响应只能等它走完才发出去。短步长后每次请求都 <=50ms，主链路结束即收尾。
+		expect(sleeps.length).toBeGreaterThan(0);
+		expect(Math.max(...sleeps)).toBeLessThanOrEqual(50);
+	});
 });

package/templates/tests/wecom-landing.spec.ts

@@ -4,9 +4,27 @@
 //   · 落地参数解析必须区分「企微回跳」与「普通打开登录页」（后者不能触发换票）；
 //   · 参数要裁剪、要能容忍少了 tenant（此时沿用本地租户，不是登录失败）；
 //   · 授权入口即使没填企业代码也要跳（后端会回 400 说明缺什么，比前端静默不动好排查）。
-import { describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getWecomBootError, onInit } from "../src/app/web/login/routes";
 import { parseWecomLanding, wecomAuthorizePath } from "../src/app/web/login/wecom";
 
+// p2-C：企微回跳的换票必须发生在首帧 render 之前，且成功后把 URL 改到首页——
+// 否则宿主 shell（无 AuthGuard）会先把登录页画出来再跳，工作台进入时「闪一下」。
+// 这里把 runtime 全部桩掉，只锁 onInit 的编排：谁被调用、顺序、URL 改没改。
+const mocks = vi.hoisted(() => ({
+	login: vi.fn(),
+	setTenant: vi.fn(),
+	registerAuthProvider: vi.fn(),
+	replaceState: vi.fn(),
+}));
+
+vi.mock("@oj-module/runtime", () => ({
+	useAuthStore: { getState: () => ({ login: mocks.login }), subscribe: vi.fn() },
+	useTenantStore: { getState: () => ({ setTenant: mocks.setTenant, clear: vi.fn() }) },
+	getRedirectPath: () => "/home",
+	resolveSiteBase: () => "/",
+}));
+
 describe("p2-A：回跳落地参数解析", () => {
 	it("带齐 ticket 与 tenant → 解析出两者", () => {
 		expect(parseWecomLanding("?wecom_ticket=tk_1&tenant=ww_corp_a")).toEqual({ ticket: "tk_1", tenant: "ww_corp_a" });
@@ -34,6 +52,50 @@ describe("p2-A：回跳落地参数解析", () => {
 	});
 });
 
+describe("p2-C：回跳换票提前到 onInit（登录页不闪）", () => {
+	const ctx = { register: { authProvider: mocks.registerAuthProvider } } as never;
+	const g = globalThis as any;
+
+	beforeEach(() => {
+		vi.clearAllMocks();
+		g.window = { location: { search: "" }, history: { replaceState: mocks.replaceState } };
+	});
+
+	it("无 ticket：不换票、不改 URL", async () => {
+		await onInit(ctx);
+		expect(mocks.login).not.toHaveBeenCalled();
+		expect(mocks.replaceState).not.toHaveBeenCalled();
+	});
+
+	it("带 ticket：首帧前换票成功，URL 改到首页（登录页不挂载）", async () => {
+		g.window.location.search = "?wecom_ticket=tk_1&tenant=ww_corp_a";
+		mocks.login.mockResolvedValue(undefined);
+		await onInit(ctx);
+		expect(mocks.setTenant).toHaveBeenCalledWith("ww_corp_a");
+		expect(mocks.login).toHaveBeenCalledTimes(1);
+		expect(mocks.login).toHaveBeenCalledWith(expect.objectContaining({ method: "wecom", ticket: "tk_1" }));
+		expect(mocks.replaceState).toHaveBeenCalledWith(null, "", "/home");
+		expect(getWecomBootError()).toBe("");
+	});
+
+	it("换票失败：错误留给登录页首帧显示表单，不改写 URL", async () => {
+		g.window.location.search = "?wecom_ticket=bad&tenant=ww_corp_a";
+		mocks.login.mockRejectedValue(new Error("登录票据无效或已使用"));
+		await onInit(ctx);
+		expect(mocks.replaceState).not.toHaveBeenCalled();
+		expect(getWecomBootError()).toContain("登录票据无效或已使用");
+	});
+});
+
+describe("p2-D：一键扫码登录路径（不要求用户填企业代码）", () => {
+	it("不带 corp/agent 时是纯入口路径，由后端 corpSelf() 自动解析本企业", () => {
+		// 登录页「企业微信一键登录」按钮走这条：点一次即跳，用户不必输企业代码。
+		// 带上 corp 就退回「先填企业代码再点」的两步式，锁住这个契约。
+		expect(wecomAuthorizePath("", "")).toBe("/auth/wecom/login");
+		expect(wecomAuthorizePath("", "")).not.toContain("corp=");
+	});
+});
+
 describe("p2-B：授权入口拼装", () => {
 	it("企业代码 → 站内路径（部署前缀由调用方 withSiteBase 拼）", () => {
 		expect(wecomAuthorizePath("ww_corp_a")).toBe("/auth/wecom/login?corp=ww_corp_a");

package/templates/tsconfig.paths.json

@@ -11,6 +11,7 @@
 			"#/home/*": ["./src/app/api/home/*"],
 			"#/notification/*": ["./src/app/api/notification/*"],
 			"#/personal-center/*": ["./src/app/api/personal-center/*"],
+			"#/publish/*": ["./src/app/api/publish/*"],
 			"#/system/*": ["./src/app/api/system/*"],
 			"#/web/*": ["./src/app/api/web/*"]
 		}

package/templates/web.config.ts

@@ -20,7 +20,9 @@ const allModules = [
 	{ name: "app", entry: "src/app/web/entry.ts" },
 	// 解决方案市场：第一方能力（消费 _platform 编排面 /api/_platform/market/*，
 	// R29：第三方方案不得仿照此调用面），默认随脚手架下发。保持独立模块——
-	// 可选能力，删目录即可下线。
+	// 可选能力，不想要就改 `enabled: false`（不要删目录：src/app、src/oj-market
+	// 受完整性门禁保护，删改会让 ojm build 失败，见 src/README.md）；
+	// 发布管理页（/publish）也在这个模块里。
 	{ name: "oj-market", entry: "src/oj-market/web/entry.ts" },
 	// #region demo-only
 	// 以下为模板内置的演示模块（about/access/exception/outside/route-nest），
@@ -45,15 +47,17 @@ export default {
 	/**
 	 * 生成 client 的归属模块：`api 前缀 → 承载其 __client 的 web 模块`。
 	 *
-	 * 框架内置后端全部收在 `src/app/api/<前缀>`（模块名即 URL 前缀），前端页面收在
-	 * `src/app/web`；生成物统一落 `src/app/web/<api 前缀>/__client`，页面相对导入不变。
-	 * 不配则回落同名模块（`src/<api 前缀>/web/__client`，历史行为）。
+	 * 框架内置后端收在 `src/app/api/<前缀>`（模块名即 URL 前缀），页面多数收在
+	 * `src/app/web`；发布管理页已迁到方案市场，故 `publish` 的生成物跟页面一起落
+	 * `src/oj-market/web/publish/__client`。不配则回落同名模块
+	 * （`src/<api 前缀>/web/__client`，历史行为）。
 	 */
 	clientOwners: {
 		"_platform": "app",
 		"auth": "app",
 		"home": "app",
 		"personal-center": "app",
+		"publish": "oj-market",
 		"notification": "app",
 		"system": "app",
 		"web": "app",

package/vendor/host-versions.json

@@ -8,9 +8,9 @@
 		"react-router": "7.18.2",
 		"react-router/dom": "7.18.2",
 		"@tanstack/react-query": "5.102.8",
-		"@oj-module/runtime": "0.2.66",
-		"@oj-module/runtime/contract": "0.2.66",
-		"@oj-module/runtime/contract/errors": "0.2.66",
+		"@oj-module/runtime": "0.2.68",
+		"@oj-module/runtime/contract": "0.2.68",
+		"@oj-module/runtime/contract/errors": "0.2.68",
 		"@plane/kit": "0.1.20",
 		"@plane/editor": "0.1.20",
 		"antd": "6.6.1",