create-fullstack-scaffold 0.5.6 → 0.6.0

package/template/src/server/db/test-setup.ts

@@ -11,6 +11,7 @@ export async function setupTestDatabase(): Promise<void> {
   const migrationSQL = `
     CREATE TABLE IF NOT EXISTS todos (
       id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+      tenant_id INTEGER,
       title TEXT NOT NULL,
       description TEXT,
       status TEXT DEFAULT 'pending' NOT NULL,
@@ -298,6 +299,43 @@ export async function setupTestDatabase(): Promise<void> {
       updated_at INTEGER DEFAULT (unixepoch() * 1000) NOT NULL
     );
 
+    CREATE TABLE IF NOT EXISTS tenant_roles (
+      id TEXT PRIMARY KEY NOT NULL,
+      tenant_id INTEGER NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+      code TEXT NOT NULL,
+      name TEXT NOT NULL,
+      label TEXT NOT NULL,
+      description TEXT,
+      permissions TEXT NOT NULL,
+      is_system INTEGER NOT NULL DEFAULT 0,
+      is_active INTEGER NOT NULL DEFAULT 1,
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS tenant_members (
+      id TEXT PRIMARY KEY NOT NULL,
+      tenant_id INTEGER NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+      user_id TEXT NOT NULL,
+      role_id TEXT NOT NULL REFERENCES tenant_roles(id) ON DELETE CASCADE,
+      status TEXT NOT NULL DEFAULT 'active',
+      invited_by TEXT,
+      invited_at TEXT,
+      joined_at TEXT NOT NULL,
+      last_active_at TEXT
+    );
+    CREATE TABLE IF NOT EXISTS tenant_invitations (
+      id TEXT PRIMARY KEY NOT NULL,
+      tenant_id INTEGER NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+      email TEXT NOT NULL,
+      role_id TEXT NOT NULL REFERENCES tenant_roles(id) ON DELETE CASCADE,
+      inviter_id TEXT NOT NULL,
+      token TEXT NOT NULL UNIQUE,
+      status TEXT NOT NULL DEFAULT 'pending',
+      expires_at TEXT NOT NULL,
+      accepted_at TEXT,
+      created_at TEXT NOT NULL
+    );
     CREATE TABLE IF NOT EXISTS merchants (
       id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
       user_id TEXT NOT NULL,
@@ -799,6 +837,93 @@ async function seedTestData(client: Client): Promise<void> {
     }
   }
 
+  // Seed tenant roles + owner member（与 app 启动种子 seedTenantsIfEmpty 对齐，demo 租户 id=1）
+  const tenantNowIso = new Date().toISOString()
+  const tenantRoleSeed = [
+    {
+      id: 'tr_seed_admin',
+      code: 'tenant_admin',
+      label: '租户管理员',
+      perms: JSON.stringify([
+        'tenant:member:view',
+        'tenant:member:invite',
+        'tenant:member:remove',
+        'tenant:member:role:assign',
+        'tenant:role:view',
+        'tenant:role:create',
+        'tenant:role:edit',
+        'tenant:role:delete',
+        'tenant:settings:view',
+        'tenant:settings:edit',
+        'tenant:data:view',
+        'tenant:data:create',
+        'tenant:data:edit',
+        'tenant:data:delete',
+        'tenant:data:export',
+        'tenant:data:import',
+        'tenant:billing:view',
+        'tenant:billing:manage',
+        'tenant:audit:view',
+      ]),
+      sortOrder: 0,
+    },
+    {
+      id: 'tr_seed_member',
+      code: 'tenant_member',
+      label: '普通成员',
+      perms: JSON.stringify([
+        'tenant:member:view',
+        'tenant:role:view',
+        'tenant:settings:view',
+        'tenant:data:view',
+        'tenant:data:create',
+        'tenant:data:edit',
+        'tenant:data:delete',
+        'tenant:data:export',
+      ]),
+      sortOrder: 1,
+    },
+    {
+      id: 'tr_seed_guest',
+      code: 'tenant_guest',
+      label: '访客',
+      perms: JSON.stringify([
+        'tenant:member:view',
+        'tenant:role:view',
+        'tenant:settings:view',
+        'tenant:data:view',
+      ]),
+      sortOrder: 2,
+    },
+  ]
+  for (const role of tenantRoleSeed) {
+    try {
+      await client.execute({
+        sql: `INSERT OR IGNORE INTO tenant_roles (id, tenant_id, code, name, label, description, permissions, is_system, is_active, sort_order, created_at, updated_at) VALUES (?, 1, ?, ?, ?, NULL, ?, 1, 1, ?, ?, ?)`,
+        args: [
+          role.id,
+          role.code,
+          role.code,
+          role.label,
+          role.perms,
+          role.sortOrder,
+          tenantNowIso,
+          tenantNowIso,
+        ],
+      })
+    } catch {
+      // Ignore duplicate errors
+    }
+  }
+  try {
+    await client.execute({
+      sql: `INSERT OR IGNORE INTO tenant_members (id, tenant_id, user_id, role_id, status, invited_by, invited_at, joined_at, last_active_at) VALUES ('tm_seed_owner', 1, 'test-super-admin-1', 'tr_seed_admin', 'active', NULL, NULL, ?, ?)`,
+      args: [tenantNowIso, tenantNowIso],
+    })
+  } catch {
+    // Ignore duplicate errors
+  }
+
   // Seed products for testing
   const products = [
     {
@@ -968,6 +1093,9 @@ export async function cleanupTestDatabase(): Promise<void> {
     } catch {
       // Plugin tables may not exist in all test environments
     }
+    await client.execute('DELETE FROM tenant_invitations')
+    await client.execute('DELETE FROM tenant_members')
+    await client.execute('DELETE FROM tenant_roles')
     await client.execute('DELETE FROM tenants')
     await client.execute('DELETE FROM merchants')
     await client.execute('DELETE FROM products')

package/template/src/server/entries/node.ts

@@ -1,5 +1,5 @@
 /**
- * @framework-baseline 159d5e23f19e9793
+ * @framework-baseline 91c7b6f83b7c9913
  * @framework-modify
  * @reason 添加 SPA 前端路由处理，区分开发/生产环境
  * @impact 新增前端路由处理逻辑，/admin/* 返回 admin.html，其他路由返回 index.html
@@ -17,22 +17,10 @@ import { logger } from '../utils/logger'
 import { createApp } from '../app'
 import { getDb, runMigrations } from '../db'
 import { createISRCache, isISRRoute } from '@server/core/isr-cache'
+// Side-effect: 注册 ISR 路由到全局 registry（Node 入口此前漏了这一行——
+// registry 空 → isISRRoute 恒 false → ISR 永远不触发，SSR 壳照旧）
+import '@server/isr-modules'
 import { renderISRPage } from '@server/core/isr-renderer'
-// @client/entry-server 仅含 client 的 preset 存在；cli-only 会因静态
-// 导入悬空（verify 链已拦过一次）。运行时按需加载，缺省回退壳渲染。
-type RenderSSRFn = (pathname: string, data: never) => { html: string }
-
-async function loadRenderSSR(): Promise<RenderSSRFn | null> {
-  try {
-    // 变量说明符：tsc 不做模块解析（cli-only 无 client 目录时字面量
-    // 动态导入也会被 tsc 拦——与 vitest.config 的 react 插件同法）
-    const mod = '@client/entry-server'
-    const m = (await import(/* @vite-ignore */ mod)) as { renderSSR: RenderSSRFn }
-    return m.renderSSR
-  } catch {
-    return null
-  }
-}
 import { isrRegistry, type ISRRouterContext } from '@server/core/isr-registry'
 import { setISRCache } from '@server/core/isr-invalidation'
 import { setRuntimeAdapter } from '@server/core/runtime'
@@ -50,6 +38,9 @@ const indexHtmlPath = hasDist
 const adminHtmlPath = hasDist
   ? resolve(distPath, 'admin.html')
   : resolve(process.cwd(), 'admin.html')
+const tenantHtmlPath = hasDist
+  ? resolve(distPath, 'tenant.html')
+  : resolve(process.cwd(), 'tenant.html')
 
 const indexHtml = existsSync(indexHtmlPath)
   ? readFileSync(indexHtmlPath, 'utf-8')
@@ -57,6 +48,8 @@ const indexHtml = existsSync(indexHtmlPath)
 const adminHtml = existsSync(adminHtmlPath)
   ? readFileSync(adminHtmlPath, 'utf-8')
   : '<html><body>admin.html not found</body></html>'
+// saas 等含 tenant 模块的 preset 才有 tenant.html；缺失回落 index
+const tenantHtml = existsSync(tenantHtmlPath) ? readFileSync(tenantHtmlPath, 'utf-8') : indexHtml
 
 const log = logger.api()
 
@@ -130,6 +123,14 @@ app.get('/admin/*', c => {
   return c.html(adminHtml)
 })
 
+// 租户控制台独立 SPA（basename=/tenant）
+app.get('/tenant', c => {
+  return c.html(tenantHtml)
+})
+app.get('/tenant/*', c => {
+  return c.html(tenantHtml)
+})
+
 // 其他非 API 路由返回 index.html（ISR 路由尝试缓存）
 app.get('*', async c => {
   if (c.req.path.startsWith('/api/') || c.req.path.startsWith('/files/')) {
@@ -217,9 +218,28 @@ export async function createServer() {
  * 页面级渲染 → renderISRPage 注入 body + meta + __SSR_DATA__。
  * 返回 null 表示无注册路由/渲染失败，调用方回退 SPA index.html。
  */
+type SSRRenderer = (pathname: string, data: unknown) => { html: string } | null
+
+// 渲染桥按需加载：静态 import 会把整个 React SSR 图（react-router-dom 等
+// CJS 依赖）拉进 vite dev 的 SSR 模块图，dev server 全路由 500；动态加载
+// 只在生产渲染 ISR 路由时触发，dev 下失败则回退 SPA 壳。
+let cachedRenderer: SSRRenderer | null | undefined
+async function loadSSRRenderer(): Promise<SSRRenderer | null> {
+  if (cachedRenderer !== undefined) return cachedRenderer
+  try {
+    const mod = await import('@server/ssr-bridge')
+    cachedRenderer = mod.renderSSR
+  } catch {
+    cachedRenderer = null
+  }
+  return cachedRenderer
+}
+
 async function renderISRForRoute(pathname: string): Promise<string | null> {
   const entry = isrRegistry.match(pathname)
   if (!entry) return null
+  const renderSSR = await loadSSRRenderer()
+  if (!renderSSR) return null // 无 client 的 preset（cli-only 等）回退 SPA 壳
   const ctx: ISRRouterContext = { db: await getDb(), env: {} }
   let data: unknown = {}
   let meta = { title: 'App', description: '' }
@@ -229,10 +249,9 @@ async function renderISRForRoute(pathname: string): Promise<string | null> {
   } catch {
     // DB 错误——回退默认 meta 继续渲染壳
   }
-  const renderSSR = await loadRenderSSR()
-  if (!renderSSR) return null // 无 client（cli-only 等）——调用方回退 SPA
   try {
-    const ssr = renderSSR(pathname, data as never)
+    const ssr = renderSSR(pathname, data)
+    if (!ssr) return null // 渲染桥返回 null（无 client 变体）
     return renderISRPage({ template: indexHtml, body: ssr.html, meta, data })
   } catch (e) {
     console.warn('ISR render failed:', e)

package/template/src/server/index.ts

@@ -24,6 +24,7 @@ setRuntimeAdapter(runtimeAdapter)
 // HTML 文件路径（开发环境直接读取根目录）
 const indexHtmlPath = resolve(process.cwd(), 'index.html')
 const adminHtmlPath = resolve(process.cwd(), 'admin.html')
+const tenantHtmlPath = resolve(process.cwd(), 'tenant.html')
 
 const indexHtml = existsSync(indexHtmlPath)
   ? readFileSync(indexHtmlPath, 'utf-8')
@@ -31,6 +32,8 @@ const indexHtml = existsSync(indexHtmlPath)
 const adminHtml = existsSync(adminHtmlPath)
   ? readFileSync(adminHtmlPath, 'utf-8')
   : '<html><body>admin.html not found</body></html>'
+// saas 等含 tenant 模块的 preset 才有 tenant.html；缺失时回落 index
+const tenantHtml = existsSync(tenantHtmlPath) ? readFileSync(tenantHtmlPath, 'utf-8') : indexHtml
 
 // 创建 Hono 应用
 const app = createApp()
@@ -40,6 +43,15 @@ app.get('/admin/*', c => {
   return c.html(adminHtml)
 })
 
+// 租户控制台（basename=/tenant 的独立 SPA）——无此入口时 /tenant/* 会
+// 落进客户端 SPA fallback 渲染成 404
+app.get('/tenant/*', c => {
+  return c.html(tenantHtml)
+})
+app.get('/tenant', c => {
+  return c.html(tenantHtml)
+})
+
 // SPA fallback - 使用中间件方式，确保 API 路由已经注册后才添加
 app.use('*', async (c, next) => {
   await next()

package/template/src/server/middleware/__tests__/tenant-isolation.test.ts

@@ -58,23 +58,37 @@ describe('tenantIsolationMiddleware', () => {
     return app
   }
 
-  it('should return error when no tenant header or subdomain', async () => {
+  // P2 起中间件为"可选上下文"语义：无租户标识 → 放行且不设上下文
+  //（全局模式：dev token / 平台级 API / 无 tenant 模块 preset 不受影响）
+  it('should pass through without context when no tenant header or subdomain', async () => {
     const app = createApp()
     const res = await app.request('/api/test')
-    expect(res.status).toBe(404)
+    // /api/test 无路由 → 404 来自路由缺失而非中间件；断言响应不是
+    // tenant-not-found 错误体即可证明中间件放行
+    const body = (await res.json()) as { error?: string }
+    expect(String(body.error)).not.toContain('Tenant')
   })
 
-  it('should return error when tenant header is empty string', async () => {
+  it('should pass through without context when tenant header is empty string', async () => {
     const app = createApp()
     const res = await app.request('/api/test', {
       headers: { 'X-Tenant-Slug': '' },
     })
-    expect(res.status).toBe(404)
+    const body = (await res.json()) as { error?: string }
+    expect(String(body.error)).not.toContain('Tenant')
   })
 
   it('should pass with valid tenant from header', async () => {
     mockDbResult([
-      { id: 1, slug: 'test-tenant', name: 'Test', status: 'active', plan: 'free', maxUsers: 10, settings: null },
+      {
+        id: 1,
+        slug: 'test-tenant',
+        name: 'Test',
+        status: 'active',
+        plan: 'free',
+        maxUsers: 10,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -98,7 +112,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should extract tenant from subdomain when no header', async () => {
     mockDbResult([
-      { id: 2, slug: 'acme', name: 'Acme', status: 'active', plan: 'pro', maxUsers: 100, settings: null },
+      {
+        id: 2,
+        slug: 'acme',
+        name: 'Acme',
+        status: 'active',
+        plan: 'pro',
+        maxUsers: 100,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -111,7 +133,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should prefer X-Tenant-Slug header over subdomain', async () => {
     mockDbResult([
-      { id: 3, slug: 'header-tenant', name: 'Header', status: 'active', plan: 'free', maxUsers: 5, settings: null },
+      {
+        id: 3,
+        slug: 'header-tenant',
+        name: 'Header',
+        status: 'active',
+        plan: 'free',
+        maxUsers: 5,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -124,7 +154,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should parse tenant settings JSON', async () => {
     mockDbResult([
-      { id: 4, slug: 'with-settings', name: 'Settings', status: 'active', plan: 'pro', maxUsers: 50, settings: '{"theme":"dark"}' },
+      {
+        id: 4,
+        slug: 'with-settings',
+        name: 'Settings',
+        status: 'active',
+        plan: 'pro',
+        maxUsers: 50,
+        settings: '{"theme":"dark"}',
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -137,7 +175,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should handle null settings gracefully', async () => {
     mockDbResult([
-      { id: 5, slug: 'no-settings', name: 'NoSettings', status: 'active', plan: 'free', maxUsers: 5, settings: null },
+      {
+        id: 5,
+        slug: 'no-settings',
+        name: 'NoSettings',
+        status: 'active',
+        plan: 'free',
+        maxUsers: 5,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {

package/template/src/server/middleware/auth.ts

@@ -131,27 +131,25 @@ function verifyToken(token: string, key: string): AuthUser | null {
     }
   }
 
-  if (key !== defaultSecretKey) {
-    try {
-      const decoded = jwt.verify(token, key) as {
-        userId: string
-        role: string
-        username: string
-        email: string
-      }
-      return {
-        id: decoded.userId,
-        username: decoded.username,
-        email: decoded.email,
-        role: decoded.role as UserRole,
-        permissions: getPermissionsByRole(decoded.role as UserRole),
-      }
-    } catch {
-      return null
+  // 真实 JWT 验证对默认/自定义 key 均启用——此前仅非默认 key 才走此分支，
+  // 导致 dev 未设 AUTH_SECRET_KEY 时所有注册账号的登录 token 恒 401
+  try {
+    const decoded = jwt.verify(token, key) as {
+      userId: string
+      role: string
+      username: string
+      email: string
+    }
+    return {
+      id: decoded.userId,
+      username: decoded.username,
+      email: decoded.email,
+      role: decoded.role as UserRole,
+      permissions: getPermissionsByRole(decoded.role as UserRole),
     }
+  } catch {
+    return null
   }
-
-  return null
 }
 
 export function authMiddleware(options: AuthMiddlewareOptions = {}): MiddlewareHandler {

package/template/src/server/middleware/tenant-isolation.ts

@@ -41,9 +41,11 @@ export function tenantIsolationMiddleware(): MiddlewareHandler {
     const hostname = c.req.header('host') || ''
     const tenantSlug = extractTenantSlug(hostname, c.req.header('X-Tenant-Slug'))
 
+    // 无租户标识 → 不设上下文继续（全局模式：dev token、平台级 API、
+    // 无 tenant 模块 preset 的既有行为都不受影响）
     if (!tenantSlug) {
-      log.warn({ hostname, path: c.req.path }, 'No tenant slug found')
-      throw NotFoundError.tenant()
+      await next()
+      return
     }
 
     const db = await getDb()

package/template/src/server/module-auth/module.ts

@@ -33,7 +33,8 @@ const authManifest: ModuleManifest = {
 
   dbSchemas: {
     files: ['developers'],
-    hasSeed: false,
+    hasSeed: true,
+    seed: { serviceFile: 'auth-service', functionName: 'seedDevelopersIfEmpty' },
   },
 
   cliModule: { dir: 'auth', registerFunction: 'registerAuthCommands' },

package/template/src/server/module-auth/services/auth-service.ts

@@ -6,6 +6,7 @@ import { developers, type DeveloperTable } from '@server/db/schema'
 import { ConflictError, AuthenticationError } from '@server/utils/app-error'
 import { generateUUID } from '@server/utils/uuid'
 import { toISOString } from '@server/utils/date'
+import { createModuleLoggerSync } from '@server/utils/logger'
 
 // eslint-disable-next-line local-rules/no-util-functions-in-service -- module-specific row-to-profile mapping
 function toProfile(row: DeveloperTable): DeveloperProfile {
@@ -98,3 +99,41 @@ export async function getDeveloperById(id: string): Promise<DeveloperProfile | n
 
   return toProfile(rows[0])
 }
+
+/**
+ * 认证种子（首启空库）：demo 开发者 + 平台超管。
+ * superadmin 必须是 super_admin 角色——requireSuperAdminMiddleware 只认这个值。
+ * 凭据 superadmin/admin123，首启日志打印一次，上线前必须改密。
+ */
+export async function seedDevelopersIfEmpty(): Promise<void> {
+  const db = await getDb()
+  const existing = await db.select().from(developers)
+  if (existing.length > 0) return
+
+  const log = createModuleLoggerSync('auth-service')
+  log.info({}, 'Seeding developers...')
+  const demoPasswordHash = hashSync('demo123', 10)
+  const adminPasswordHash = hashSync('admin123', 10)
+  await db.insert(developers).values([
+    {
+      id: generateUUID(),
+      username: 'demo',
+      email: 'demo@biomimic.app',
+      passwordHash: demoPasswordHash,
+      role: 'developer' as const,
+      apiKey: generateUUID(),
+    },
+    {
+      id: generateUUID(),
+      username: 'superadmin',
+      email: 'admin@biomimic.app',
+      passwordHash: adminPasswordHash,
+      role: 'super_admin' as const,
+      apiKey: generateUUID(),
+    },
+  ])
+  log.warn(
+    { account: 'superadmin', password: 'admin123', note: 'CHANGE IMMEDIATELY' },
+    'Platform super admin seeded (first boot only) — change the password before any real deployment'
+  )
+}

package/template/src/server/module-tenant/__tests__/tenant-routes.test.ts

@@ -140,3 +140,100 @@ describe('Tenant Routes', () => {
     })
   })
 })
+
+describe('membership & invitation routes (P1)', () => {
+  const authHeaders = { Authorization: 'Bearer test-super-admin-1' }
+
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  it('GET /api/tenants/mine 返回当前用户租户', async () => {
+    const client = createTestClient(undefined, { headers: authHeaders })
+    const res = await client.api.tenants.mine.$get()
+    expect(res.status).toBe(200)
+    const data = await res.json()
+    if (data.success) {
+      expect(Array.isArray(data.data)).toBe(true)
+      expect(data.data.length).toBeGreaterThanOrEqual(1) // demo 种子 owner
+    }
+  })
+
+  it('非成员访问租户成员列表 403', async () => {
+    const client = createTestClient(undefined, {
+      headers: { Authorization: 'Bearer test-user-2' },
+    })
+    const res = await client.api.tenants[':tenantId'].members.$get({ param: { tenantId: '1' } })
+    expect(res.status).toBe(403)
+  })
+
+  it('owner 邀请→公开查详情→接受→列表可见→移除', async () => {
+    const owner = createTestClient(undefined, { headers: authHeaders })
+
+    // demo 租户（id=1，seed owner=test-super-admin-1）
+    const rolesRes = await owner.api.tenants[':tenantId'].roles.$get({ param: { tenantId: '1' } })
+    expect(rolesRes.status).toBe(200)
+    const rolesData = await rolesRes.json()
+    if (!rolesData.success) throw new Error('roles failed')
+    const guestRole = rolesData.data.find(r => r.code === 'tenant_guest')!
+
+    const inviteRes = await owner.api.tenants[':tenantId'].members.invite.$post({
+      param: { tenantId: '1' },
+      json: { email: 'route-newbie@example.com', roleId: guestRole.id },
+    })
+    expect(inviteRes.status).toBe(201)
+    const inviteData = await inviteRes.json()
+    if (!inviteData.success) throw new Error('invite failed')
+    const token = inviteData.data.token
+
+    // 公开接口（无认证）可查脱敏详情
+    const pub = createTestClient(undefined)
+    const pubRes = await pub.api.tenants.invitations[':token'].$get({ param: { token } })
+    expect(pubRes.status).toBe(200)
+    const pubData = await pubRes.json()
+    if (pubData.success) {
+      expect(pubData.data.tenantSlug).toBe('demo')
+      expect(pubData.data.roleLabel).toBe('访客')
+      expect(pubData.data).not.toHaveProperty('inviterId')
+    }
+
+    // 被邀人接受
+    const newbie = createTestClient(undefined, {
+      headers: { Authorization: 'Bearer test-user-2' },
+    })
+    const acceptRes = await newbie.api.tenants.invitations[':token'].accept.$post({
+      param: { token },
+    })
+    expect(acceptRes.status).toBe(200)
+
+    // owner 视角成员列表可见新人
+    const membersRes = await owner.api.tenants[':tenantId'].members.$get({
+      param: { tenantId: '1' },
+    })
+    const membersData = await membersRes.json()
+    if (membersData.success) {
+      const newbieRow = membersData.data.find((m: { userId: string }) => m.userId === 'test-user-2')
+      expect(newbieRow).toBeDefined()
+      expect(newbieRow!.role?.code).toBe('tenant_guest')
+    }
+
+    // 移除后新人 403
+    if (membersData.success) {
+      const newbieRow = membersData.data.find(
+        (m: { userId: string }) => m.userId === 'test-user-2'
+      )!
+      const delRes = await owner.api.tenants[':tenantId'].members[':memberId'].$delete({
+        param: { tenantId: '1', memberId: newbieRow.id },
+      })
+      expect(delRes.status).toBe(200)
+      const denied = await newbie.api.tenants[':tenantId'].members.$get({
+        param: { tenantId: '1' },
+      })
+      expect(denied.status).toBe(403)
+    }
+  })
+})