@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.130

package/src/mcp-write-network-resolution.test.ts

@@ -0,0 +1,432 @@
+// #517 — MCP write-path network resolution (utok single-network fallback).
+//
+// Root cause (issue #517): utok_ token rows are created with network_id=null
+// BY DESIGN (auth.ts login), and the MCP write path (tools.ts canWrite) had
+// no single-network fallback — unlike REST POST /api/task (server.ts), which
+// auto-resolves via singleNetworkId(restScope) when the user belongs to
+// exactly one network. Result: a utok node could READ everything
+// (resolveReadScope falls back to all memberships) but could not WRITE
+// anything, and the error mislabeled the failure as permission_denied.
+//
+// Fix under test:
+//  - getNetworkId falls back to the user's single membership via the SAME
+//    shared singleNetworkId/getUserNetworkIds used by REST (network-scope.ts)
+//  - canWrite delegates to the shared canRestWriteNetwork
+//  - the 7 write tools that had NO network_id input gain an optional one:
+//    send_message / send_reply / ack_inbox / send_ack / retry_task /
+//    cancel_task / reassign_task
+//  - writeDeniedReply names the REAL cause: network_id_required (0 or ≥2
+//    memberships) / access_denied (not a member of the requested network) /
+//    permission_denied (viewer role)
+//  - ntok_ (network-bound) behavior: ZERO change — pinned below
+//
+// Assertion discipline: error replies are asserted with toEqual (accepted
+// set == spec-allowed set, no not.toBe / toContain wideners).
+//
+// Run: COMMHUB_DB=/tmp/517-net-scope-test.db bun test src/mcp-write-network-resolution.test.ts
+
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db, uuidv4 } from "./db.js";
+import { deleteNetwork } from "./auth.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerTools } from "./tools.js";
+
+const NET_A = "net_517_a";
+const NET_B = "net_517_b";
+const U_SINGLE = "u517_single";    // owner of NET_A only → fallback resolves
+const U_MULTI = "u517_multi";      // member of NET_A + NET_B → ambiguous
+const U_VIEWER = "u517_viewer";    // viewer of NET_A only → resolves, then role-denied
+const U_NONE = "u517_none";        // no memberships
+const U_OUTSIDER = "u517_outsider"; // member of NET_B only, targets NET_A
+const A1 = "peer-517-a1";
+const A2 = "peer-517-a2";
+const ALL_USERS = [U_SINGLE, U_MULTI, U_VIEWER, U_NONE, U_OUTSIDER];
+
+interface ToolHandler {
+  (args: any, extra?: any): Promise<{ content: Array<{ type: "text"; text: string }> }>;
+}
+interface Reply { ok?: boolean; error?: string; message?: string; [k: string]: unknown }
+
+function cleanup() {
+  for (const t of ["tasks", "inbox", "task_events"]) {
+    try { db.run(`DELETE FROM ${t} WHERE network_id IN (?1, ?2)`, [NET_A, NET_B]); } catch {}
+    try { db.run(`DELETE FROM ${t} WHERE content LIKE 'x517%'`); } catch {}
+  }
+  try { db.run("DELETE FROM sessions WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM nodes WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM network_members WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  try { db.run("DELETE FROM networks WHERE network_id IN (?1, ?2)", [NET_A, NET_B]); } catch {}
+  for (const u of ALL_USERS) {
+    try { db.run("DELETE FROM users WHERE user_id = ?1", [u]); } catch {}
+  }
+}
+
+function seed() {
+  for (const u of ALL_USERS) {
+    db.run(
+      `INSERT INTO users (user_id, username, password_hash, role, created_at)
+       VALUES (?1, ?2, 'x', 'user', datetime('now'))`,
+      [u, u],
+    );
+  }
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_A, U_SINGLE]);
+  db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_B, U_MULTI]);
+  const member = (u: string, net: string, role: string) =>
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, ?3, datetime('now'))`, [u, net, role]);
+  member(U_SINGLE, NET_A, "owner");
+  member(U_MULTI, NET_A, "member");
+  member(U_MULTI, NET_B, "owner");
+  member(U_VIEWER, NET_A, "viewer");
+  member(U_OUTSIDER, NET_B, "member");
+  for (const alias of [A1, A2]) {
+    db.run(
+      `INSERT INTO nodes (node_id, node_name, alias, network_id, hostname, created_at, updated_at, lifecycle_state)
+       VALUES (?1, ?2, ?2, ?3, ?4, datetime('now'), datetime('now'), 'active')`,
+      [`node_${alias}`, alias, NET_A, `host-${alias}`],
+    );
+    db.run(
+      `INSERT INTO sessions (resume_id, alias, status, node_id, network_id, updated_at, last_seen_at)
+       VALUES (?1, ?2, 'idle', ?3, ?4, datetime('now'), datetime('now'))`,
+      [`res_${alias}`, alias, `node_${alias}`, NET_A],
+    );
+  }
+}
+
+beforeEach(() => { cleanup(); seed(); });
+afterAll(cleanup);
+
+type HandlerMap = { tools: Record<string, ToolHandler>; schemas: Record<string, Record<string, unknown>> };
+
+function buildHandlers(opts: { netId?: string | null; userId?: string | null; alias?: string | null; isNetwork?: boolean }): HandlerMap {
+  const server = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, ToolHandler> = {};
+  const schemas: Record<string, Record<string, unknown>> = {};
+  const origTool = server.tool.bind(server);
+  server.tool = (name: string, _desc: string, schema: any, handler: ToolHandler) => {
+    tools[name] = handler;
+    schemas[name] = schema;
+    return origTool(name, _desc, schema, handler);
+  };
+  registerTools(
+    server,
+    undefined,
+    opts.netId ?? null,
+    opts.userId ?? null,
+    opts.alias ?? opts.userId ?? null,
+    opts.isNetwork ?? false,
+    null,
+  );
+  return { tools, schemas };
+}
+
+async function call(handler: ToolHandler, args: any): Promise<Reply> {
+  const r = await handler(args);
+  return JSON.parse(r.content[0].text) as Reply;
+}
+
+function makeTask(to: string, status: string, content: string, net: string | null = NET_A): string {
+  const id = uuidv4();
+  db.run(
+    `INSERT INTO tasks (task_id, from_name, to_name, priority, status, content, requires_response, created_at, network_id)
+     VALUES (?1, 'dispatcher', ?2, 'normal', ?3, ?4, 'reply', datetime('now'), ?5)`,
+    [id, to, status, content, net],
+  );
+  return id;
+}
+
+function makeInbox(to: string, content: string, net: string | null = NET_A): string {
+  const id = uuidv4();
+  db.run(
+    `INSERT INTO inbox (id, session_name, node_id, type, priority, content, from_session, network_id)
+     VALUES (?1, ?2, ?3, 'message', 'normal', ?4, 'dispatcher', ?5)`,
+    [id, to, `node_${to}`, content, net],
+  );
+  return id;
+}
+
+const taskRow = (content: string) =>
+  db.get<{ task_id: string; status: string; to_name: string; network_id: string | null }>(
+    "SELECT task_id, status, to_name, network_id FROM tasks WHERE content = ?1", content);
+const taskById = (id: string) =>
+  db.get<{ status: string; to_name: string; network_id: string | null }>(
+    "SELECT status, to_name, network_id FROM tasks WHERE task_id = ?1", id);
+const inboxRow = (content: string) =>
+  db.get<{ id: string; acked: number; network_id: string | null }>(
+    "SELECT id, acked, network_id FROM inbox WHERE content = ?1", content);
+
+// ─────────────────────────────────────────────────────────────────────
+// Group 1 — utok, single network, NO network_id argument anywhere.
+// The hub must auto-resolve to the user's only membership (REST parity
+// with server.ts POST /api/task → singleNetworkId fallback).
+// ─────────────────────────────────────────────────────────────────────
+describe("utok single-network auto-resolve (no network_id argument)", () => {
+  test("send_task resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 g1 send_task", priority: "normal" });
+    expect(r.ok).toBe(true);
+    expect(taskRow("x517 g1 send_task")?.network_id).toBe(NET_A);
+  });
+
+  test("send_message resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const r = await call(tools["send_message"], { alias: A1, message: "x517 g1 send_message" });
+    expect(r.ok).toBe(true);
+    expect(inboxRow("x517 g1 send_message")?.network_id).toBe(NET_A);
+  });
+
+  test("send_reply resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const t = makeTask(A1, "delivered", "x517 g1 send_reply parent");
+    const r = await call(tools["send_reply"], { alias: A1, text: "x517 g1 send_reply", in_reply_to: t, status: "replied" });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("replied");
+  });
+
+  test("ack_inbox resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const ib = makeInbox(A1, "x517 g1 ack_inbox");
+    const r = await call(tools["ack_inbox"], { alias: A1, message_id: ib });
+    expect(r.ok).toBe(true);
+    expect(inboxRow("x517 g1 ack_inbox")?.acked).toBe(1);
+  });
+
+  test("send_ack resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const t = makeTask(A1, "delivered", "x517 g1 send_ack");
+    const r = await call(tools["send_ack"], { task_id: t });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("acked");
+  });
+
+  test("retry_task resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const t = makeTask(A1, "failed", "x517 g1 retry_task");
+    const r = await call(tools["retry_task"], { task_id: t });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("delivered");
+  });
+
+  test("cancel_task resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const t = makeTask(A1, "delivered", "x517 g1 cancel_task");
+    const r = await call(tools["cancel_task"], { task_id: t });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("cancelled");
+  });
+
+  test("reassign_task resolves to the only membership", async () => {
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const t = makeTask(A1, "delivered", "x517 g1 reassign_task");
+    const r = await call(tools["reassign_task"], { task_id: t, new_alias: A2 });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.to_name).toBe(A2);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────
+// Group 2 — utok, MULTI network. Without network_id: precise
+// network_id_required error (not permission_denied). With explicit
+// network_id: every formerly param-less tool must thread it through.
+// One case per changed tool (通信龙 acceptance rule: 改了三个只测一个,
+// 剩下两个等于没验).
+// ─────────────────────────────────────────────────────────────────────
+describe("utok multi-network", () => {
+  test("send_task without network_id → exact network_id_required error", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 g2 ambiguous", priority: "normal" });
+    expect(r).toEqual({
+      ok: false,
+      error: "network_id_required",
+      message: "user token spans 2 networks; pass network_id explicitly (see /api/auth/me networks[].network_id)",
+    });
+    expect(taskRow("x517 g2 ambiguous")).toBeNull();
+  });
+
+  test("send_message threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const r = await call(tools["send_message"], { alias: A1, message: "x517 g2 send_message", network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(inboxRow("x517 g2 send_message")?.network_id).toBe(NET_A);
+  });
+
+  test("send_reply threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const t = makeTask(A1, "delivered", "x517 g2 send_reply parent");
+    const r = await call(tools["send_reply"], { alias: A1, text: "x517 g2 send_reply", in_reply_to: t, status: "replied", network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("replied");
+  });
+
+  test("ack_inbox threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    // This tests network selection with an authorized recipient. Acting as
+    // another owner's recipient is covered by the HTTP identity suite.
+    db.run("UPDATE nodes SET owner_user_id = ?1 WHERE alias = ?2 AND network_id = ?3", [U_MULTI, A1, NET_A]);
+    const ib = makeInbox(A1, "x517 g2 ack_inbox");
+    const r = await call(tools["ack_inbox"], { alias: A1, message_id: ib, network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(inboxRow("x517 g2 ack_inbox")?.acked).toBe(1);
+  });
+
+  test("send_ack threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const t = makeTask(A1, "delivered", "x517 g2 send_ack");
+    const r = await call(tools["send_ack"], { task_id: t, network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("acked");
+  });
+
+  test("retry_task threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const t = makeTask(A1, "failed", "x517 g2 retry_task");
+    const r = await call(tools["retry_task"], { task_id: t, network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("delivered");
+  });
+
+  test("cancel_task threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const t = makeTask(A1, "delivered", "x517 g2 cancel_task");
+    const r = await call(tools["cancel_task"], { task_id: t, network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.status).toBe("cancelled");
+  });
+
+  test("reassign_task threads explicit network_id", async () => {
+    const { tools } = buildHandlers({ userId: U_MULTI });
+    const t = makeTask(A1, "delivered", "x517 g2 reassign_task");
+    const r = await call(tools["reassign_task"], { task_id: t, new_alias: A2, network_id: NET_A });
+    expect(r.ok).toBe(true);
+    expect(taskById(t)?.to_name).toBe(A2);
+  });
+
+  test("all 7 formerly param-less write tools expose network_id in their input schema", () => {
+    const { schemas } = buildHandlers({ userId: U_MULTI });
+    for (const name of ["send_message", "send_reply", "ack_inbox", "send_ack", "retry_task", "cancel_task", "reassign_task"]) {
+      expect(Object.keys(schemas[name] ?? {})).toContain("network_id");
+    }
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────
+// Group 3 — precise causes replace the old catch-all message.
+// ─────────────────────────────────────────────────────────────────────
+describe("precise denial causes", () => {
+  test("utok with zero memberships → network_id_required naming the real cause", async () => {
+    const { tools } = buildHandlers({ userId: U_NONE });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 g3 none", priority: "normal" });
+    expect(r).toEqual({
+      ok: false,
+      error: "network_id_required",
+      message: "user token has no network memberships; join or create a network first",
+    });
+  });
+
+  test("utok explicitly targeting a network it is not a member of → access_denied", async () => {
+    const { tools } = buildHandlers({ userId: U_OUTSIDER });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 g3 outsider", priority: "normal", network_id: NET_A });
+    expect(r).toEqual({
+      ok: false,
+      error: "access_denied",
+      message: "access denied to requested network (not a member)",
+    });
+    expect(taskRow("x517 g3 outsider")).toBeNull();
+  });
+
+  test("viewer in a single network → permission_denied (send_task wording)", async () => {
+    const { tools } = buildHandlers({ userId: U_VIEWER });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 g3 viewer task", priority: "normal" });
+    expect(r).toEqual({
+      ok: false,
+      error: "permission_denied",
+      message: "Viewer role cannot send tasks",
+    });
+  });
+
+  test("viewer in a single network → permission_denied (generic write wording)", async () => {
+    const { tools } = buildHandlers({ userId: U_VIEWER });
+    const r = await call(tools["send_message"], { alias: A1, message: "x517 g3 viewer msg" });
+    expect(r).toEqual({
+      ok: false,
+      error: "permission_denied",
+      message: "Viewer role cannot write to this network",
+    });
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────
+// Group 3b — ghost memberships (PR #519 codex P2): deleteNetwork used to
+// leave network_members rows behind, so a stale membership to a deleted
+// network could (a) make a single-network user look multi-network, or
+// (b) auto-resolve a write INTO the deleted network, creating orphaned
+// rows. getUserNetworkIds now joins networks; deleteNetwork now removes
+// its membership rows.
+// ─────────────────────────────────────────────────────────────────────
+describe("ghost memberships (deleted networks)", () => {
+  const GHOST = "net_517_ghost";
+
+  test("membership to a deleted network does not break single-network auto-resolve", async () => {
+    // stale row: membership exists, networks row does not
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [U_SINGLE, GHOST]);
+    const { tools } = buildHandlers({ userId: U_SINGLE });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 ghost still-single", priority: "normal" });
+    expect(r.ok).toBe(true);
+    expect(taskRow("x517 ghost still-single")?.network_id).toBe(NET_A);
+    db.run("DELETE FROM network_members WHERE network_id = ?1", [GHOST]);
+  });
+
+  test("sole membership pointing at a deleted network → no-membership error, no orphaned write", async () => {
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [U_NONE, GHOST]);
+    const { tools } = buildHandlers({ userId: U_NONE });
+    const r = await call(tools["send_task"], { alias: A1, task: "x517 ghost orphan", priority: "normal" });
+    expect(r).toEqual({
+      ok: false,
+      error: "network_id_required",
+      message: "user token has no network memberships; join or create a network first",
+    });
+    expect(taskRow("x517 ghost orphan")).toBeNull();
+    db.run("DELETE FROM network_members WHERE network_id = ?1", [GHOST]);
+  });
+
+  test("deleteNetwork removes the network's membership rows (root cause)", () => {
+    const NET_DEL = "net_517_del";
+    db.run(`INSERT INTO networks (network_id, network_name, owner_id, created_at) VALUES (?1, ?1, ?2, datetime('now'))`, [NET_DEL, U_SINGLE]);
+    db.run(`INSERT INTO network_members (user_id, network_id, role, joined_at) VALUES (?1, ?2, 'owner', datetime('now'))`, [U_SINGLE, NET_DEL]);
+    const res = deleteNetwork(U_SINGLE, NET_DEL);
+    expect(res.ok).toBe(true);
+    const left = db.get<{ cnt: number }>("SELECT COUNT(*) as cnt FROM network_members WHERE network_id = ?1", NET_DEL);
+    expect(left?.cnt).toBe(0);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────
+// Group 4 — ntok_ pins: network-bound tokens must see ZERO change.
+// ─────────────────────────────────────────────────────────────────────
+describe("ntok behavior pinned (zero change)", () => {
+  test("ntok send_task without network_id stays bound to token network", async () => {
+    const { tools } = buildHandlers({ netId: NET_A, userId: U_SINGLE, alias: A1, isNetwork: true });
+    const r = await call(tools["send_task"], { alias: A2, task: "x517 g4 ntok plain", priority: "normal" });
+    expect(r.ok).toBe(true);
+    expect(taskRow("x517 g4 ntok plain")?.network_id).toBe(NET_A);
+  });
+
+  test("ntok send_task ignores a client-supplied foreign network_id (enforced binding wins)", async () => {
+    const { tools } = buildHandlers({ netId: NET_A, userId: U_MULTI, alias: A1, isNetwork: true });
+    const r = await call(tools["send_task"], { alias: A2, task: "x517 g4 ntok override", priority: "normal", network_id: NET_B });
+    expect(r.ok).toBe(true);
+    expect(taskRow("x517 g4 ntok override")?.network_id).toBe(NET_A);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────
+// Group 5 — legacy global-token mode (no enforceUserId): the fallback
+// must NOT kick in; writes stay unscoped exactly as before.
+// ─────────────────────────────────────────────────────────────────────
+describe("legacy global-token mode pinned", () => {
+  test("send_message without auth context stays network-unscoped", async () => {
+    const { tools } = buildHandlers({ userId: null });
+    const r = await call(tools["send_message"], { alias: A1, message: "x517 g5 legacy" });
+    expect(r.ok).toBe(true);
+    expect(inboxRow("x517 g5 legacy")?.network_id).toBeNull();
+  });
+});

package/src/member-audit-network-id-http.test.ts

@@ -0,0 +1,93 @@
+// 成员增 / 改角色 / 移出 的审计行必须带 network_id —— HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。
+//
+// 之前这三条 logAudit 没传 networkId,audit_log.network_id 恒为 NULL:
+// 按网络归属审计时它们整批丢失,而同一组路由里的 member_agent_grants_changed 一直带着。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-member-audit-"));
+let BASE = "";
+let hub: any = null;
+
+const PW = "AuditTestPassw0rd!x";
+let ownerToken = "";
+let NET = "";
+let bobId = "";
+
+async function send(token: string, method: string, path: string, payload?: unknown): Promise<{ status: number; body: any }> {
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: payload === undefined ? undefined : JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let body: any = null;
+  try { body = JSON.parse(text); } catch {}
+  return { status: res.status, body };
+}
+
+const auditRow = (action: string) =>
+  db.get("SELECT network_id, target_id FROM audit_log WHERE action = ?1 ORDER BY id DESC LIMIT 1", action) as
+    { network_id: string | null; target_id: string | null } | null;
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+
+  const owner = register(`audit_owner_${Date.now()}`, PW, undefined, "Owner");
+  expect(owner.ok).toBe(true);
+  ownerToken = owner.token!;
+  NET = owner.network_id!;
+  const bob = register(`audit_bob_${Date.now()}`, PW, undefined, "Bob");
+  expect(bob.ok).toBe(true);
+  bobId = bob.user!.user_id;
+
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("成员审计行带 network_id", () => {
+  test("member_added", async () => {
+    const r = await send(ownerToken, "POST", `/api/networks/${NET}/members`, { user_id: bobId, role: "member" });
+    expect(r.status).toBe(200);
+    const row = auditRow("member_added");
+    expect(row).toBeTruthy();
+    expect(row!.network_id).toBe(NET);
+  });
+
+  test("member_role_changed", async () => {
+    const r = await send(ownerToken, "PUT", `/api/networks/${NET}/members/${bobId}`, { role: "viewer" });
+    expect(r.status).toBe(200);
+    const row = auditRow("member_role_changed");
+    expect(row).toBeTruthy();
+    expect(row!.network_id).toBe(NET);
+  });
+
+  test("member_removed", async () => {
+    const r = await send(ownerToken, "DELETE", `/api/networks/${NET}/members/${bobId}`);
+    expect(r.status).toBe(200);
+    const row = auditRow("member_removed");
+    expect(row).toBeTruthy();
+    expect(row!.network_id).toBe(NET);
+  });
+
+  test("GET /api/audit-log(本人的审计)里这三条的 network_id 都是该网络", async () => {
+    const r = await send(ownerToken, "GET", "/api/audit-log?limit=200");
+    expect(r.status).toBe(200);
+    const mine = (r.body.logs as any[]).filter(e => ["member_added", "member_role_changed", "member_removed"].includes(e.action));
+    expect(mine.map(e => e.action).sort()).toEqual(["member_added", "member_removed", "member_role_changed"]);
+    for (const e of mine) expect(e.network_id).toBe(NET);
+  });
+});