create-ssnode-cli 0.1.0 → 0.2.2

package/templates/backend/node_modules/.bin/js-yaml

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.1.0/node_modules/js-yaml/bin/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.1.0/node_modules/js-yaml/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.1.0/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.3.2/node_modules/js-yaml/bin/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.3.2/node_modules/js-yaml/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.3.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.1.0/node_modules/js-yaml/bin/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.1.0/node_modules/js-yaml/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.1.0/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.3.2/node_modules/js-yaml/bin/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.3.2/node_modules/js-yaml/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/js-yaml@4.3.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../js-yaml/bin/js-yaml.js" "$@"

package/templates/backend/node_modules/.bin/typeorm

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../typeorm/cli.js" "$@"

package/templates/backend/node_modules/.bin/typeorm-ts-node-commonjs

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../typeorm/cli-ts-node-commonjs.js" "$@"

package/templates/backend/node_modules/.bin/typeorm-ts-node-esm

@@ -6,9 +6,9 @@ case `uname` in
 esac
 
 if [ -z "$NODE_PATH" ]; then
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules"
 else
-  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.20_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
+  export NODE_PATH="/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules/typeorm/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/typeorm@0.3.31_better-sqlite3@13.0.3_ts-node@10.9.2/node_modules:/Users/sunset/Desktop/YunZhiHuiProgram/fullstack-template/node_modules/.pnpm/node_modules:$NODE_PATH"
 fi
 if [ -x "$basedir/node" ]; then
   exec "$basedir/node"  "$basedir/../typeorm/cli-ts-node-esm.js" "$@"

package/templates/backend/ops/docker/.env.example

@@ -32,3 +32,7 @@ LOG_LEVEL=warn
 ADMIN_PASSWORD=
 APP_SIGN_KEY=
 APP_SIGN_TS_WINDOW=300
+# 单点登录(默认关闭;接入时改 true 并配 ticketKey,见 README「单点登录」)
+SSO_ENABLED=false
+SSO_TICKET_KEY=
+SSO_TS_WINDOW=300

package/templates/backend/ops/docker/config.sh

@@ -33,6 +33,8 @@ CONTAINER_PORT="$PORT"
 CONTAINER_DATA_DIR="${CONTAINER_DATA_DIR:-/app/data}"
 # 重启策略
 RESTART_POLICY="${RESTART_POLICY:-unless-stopped}"
+# 版本轮转保留数(docker = 本镜像仓库历史 tag 数,即回滚窗口;顶层 install.sh 轮转时读)
+KEEP_VERSIONS="${KEEP_VERSIONS:-3}"
 
 # 读 current 的 version + .build-ts 作镜像 tag(<version>-<14位ts>,与 systemd/pm2 releases/<ver>-<ts> 同口径)。
 # .build-ts 由 buildops 写入;缺则回退纯 version(兼容旧 release,但同 version 重发会覆盖,留意回滚)。

package/templates/backend/ops/docker/install.sh

@@ -67,4 +67,39 @@ docker run -d \
   "$IMAGE_TAG"
 
 echo "✓ 容器已起: $CONTAINER_NAME (宿主 $HOST_PORT → $CONTAINER_PORT, tag $TAG)"
+
+# ── 镜像轮转:对齐 systemd/pm2 的 rotate_releases 口径 ──
+# docker 模式版本靠镜像 tag、不进 releases/,故轮转对象 = 本镜像仓库的历史 tag:
+# 按末段 14 位时间戳降序保留 KEEP_VERSIONS 个(缺省见 config.sh),其余 rmi(回滚窗口=保留数)。
+# KEEP_VERSIONS 优先级:顶层 --keep/env 显式 export > config.sh 持久值(运维改这处)。
+# 不删运行中容器在用的 tag(防御);versionswitch.sh 切版本不经过本脚本,不受影响。
+rotate_images() {
+  # 半成品兜底:经典 builder 多阶段构建的 deps 阶段成品(711MB 级 <none>)无 tag、无子层,轮转清不到;
+  # 按 Dockerfile 烙进各层的 app label 定向 prune(仅本应用,不碰宿主其他镜像)。
+  # 但该 <none> 同时是经典 builder 的构建缓存(删掉 = 下次全量重跑 apt+npm ci),故加 until=72h:
+  # 只清 72h 前的陈年残留,当天/周末内刚生成的缓存保住(发版即刷新存活期);放在 tag 轮转前,
+  # 不受 ≤KEEP_VERSIONS 提前 return 影响。
+  docker image prune -f --filter "label=app=$IMAGE" --filter "until=72h" >/dev/null 2>&1 || true
+  local running_ref
+  running_ref="$(docker inspect "$CONTAINER_NAME" --format '{{.Config.Image}}' 2>/dev/null || true)"
+  local list=() t
+  # tag 形如 <version>-<14位ts>;awk 提取末段时间戳做 sort 键降序(与顶层 sort_releases 同构)
+  while IFS= read -r t; do
+    [[ -n "$t" ]] || continue
+    list+=("$t")
+  done < <(docker images "$IMAGE" --format '{{.Tag}}' | grep -E -- '-[0-9]{14}$' \
+    | awk '{ts=$0; sub(/.*-/,"",ts); print ts" "$0}' | sort -r | awk '{print $2}')
+  [[ ${#list[@]} -le $KEEP_VERSIONS ]] && return 0
+  local del=("${list[@]:$KEEP_VERSIONS}")
+  for t in "${del[@]}"; do
+    [[ -n "$t" ]] || continue
+    [[ "$IMAGE:$t" = "$running_ref" ]] && continue
+    docker rmi "$IMAGE:$t" >/dev/null 2>&1 \
+      && echo "  ↳ 清理旧镜像: $IMAGE:$t" \
+      || echo "  ⚠ rmi 失败(可能被退出容器引用,清理残留容器后重试): $IMAGE:$t"
+  done
+  echo "✓ 镜像轮转:保留 $KEEP_VERSIONS 个 tag"
+}
+rotate_images
+
 echo "  状态: ./status.sh | 日志: ./logs.sh"

package/templates/backend/ops/install.sh

@@ -31,7 +31,9 @@ set -euo pipefail
 # ── baked 字段(首次为空;bootstrap 拷自身到 APP_ROOT 时 sed 改写为字面量) ──
 APP_ROOT="${APP_ROOT:-}"
 MODE="${MODE:-}"
-KEEP_VERSIONS="${KEEP_VERSIONS:-3}"
+# 轮转保留数:此处只存显式值(--keep / env),不预设缺省 —— 缺省在轮转前由
+# resolve_keep_versions 从 ops/<mode>/config.sh 取(运维改那处,跨版本保留)。
+KEEP_VERSIONS="${KEEP_VERSIONS:-}"
 
 # 脚本所在目录(首次=release 包根,即 install.sh 所在的包根;二次=APP_ROOT)
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -417,12 +419,24 @@ dispatch_install() {
   local mode_install="$APP_ROOT/ops/$MODE/install.sh"   # 共享 ops(releases 不放 ops)
   [[ -f "$mode_install" ]] || die "缺 mode 安装脚本: $mode_install(先跑 lay_out_ops 或检查后台服务目录/ops)"
   say "派发 $MODE 安装: $mode_install"
-  export APP_ROOT MODE
+  export APP_ROOT MODE KEEP_VERSIONS
   bash "$mode_install"
 }
 
+# ── 轮转保留数解析:--keep/env 显式 > ops/<mode>/config.sh 持久值 > 3 ──
+#    KEEP_VERSIONS 不 bake(区别 APP_ROOT/MODE):运维的保留数放 mode config.sh,
+#    lay_out_ops 跨版本保留(不 overlay);--keep 仅当次部署生效。
+#    source 无名冲突(config.sh 只设 mode 专属变量 + APP_ROOT 校验,顶层变量不被覆盖)。
+resolve_keep_versions() {
+  [[ -n "$KEEP_VERSIONS" ]] && return 0
+  local cfg="$APP_ROOT/ops/$MODE/config.sh"
+  if [[ -f "$cfg" ]]; then source "$cfg"; fi   # bootstrap 时 lay_out_ops 已先于轮转就位
+  KEEP_VERSIONS="${KEEP_VERSIONS:-3}"           # 旧部署 config.sh 无此项 → 回落 3(与历史行为一致)
+}
+
 rotate_releases() {
-  [[ "$IS_SYMLINK" = 0 ]] && return 0   # docker 不用 releases
+  resolve_keep_versions
+  [[ "$IS_SYMLINK" = 0 ]] && return 0   # docker 不用 releases(镜像轮转在 ops/docker/install.sh::rotate_images)
   local list=()
   while IFS= read -r d; do list+=("$d"); done < <(sort_releases "$APP_ROOT/releases")
   [[ ${#list[@]} -le $KEEP_VERSIONS ]] && return 0

package/templates/backend/ops/pm2/config.sh

@@ -16,6 +16,8 @@ APP_ROOT="${APP_ROOT:-}"
 PM2_BIN="${PM2_BIN:-pm2}"
 # 实例数(单实例 fork;SQLite 单文件写串行,不建议 cluster 多实例)
 INSTANCES="${INSTANCES:-1}"
+# 版本轮转保留数(releases 目录数,即回滚窗口;顶层 install.sh::rotate_releases 读)
+KEEP_VERSIONS="${KEEP_VERSIONS:-3}"
 
 # ── 派生路径(APP_ROOT 定下来后才能算;由 resolve_app_root 调用) ──
 derive_paths() {

package/templates/backend/ops/systemd/config.sh

@@ -16,6 +16,8 @@ APP_ROOT="${APP_ROOT:-}"
 NODE_BIN="${NODE_BIN:-/usr/bin/node}"
 # 运行用户
 RUN_USER="${RUN_USER:-root}"
+# 版本轮转保留数(releases 目录数,即回滚窗口;顶层 install.sh::rotate_releases 读)
+KEEP_VERSIONS="${KEEP_VERSIONS:-3}"
 
 # ── 派生路径(APP_ROOT 定下来后才能算;由 resolve_app_root 调用) ──
 derive_paths() {

package/templates/backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend",
-  "version": "1.0.2",
+  "version": "1.0.7",
   "description": "全栈模板 - 后台服务(NestJS + SQLite + TypeORM)",
   "private": true,
   "engines": {
@@ -20,7 +20,6 @@
     "migration:generate": "TS_NODE_PROJECT=tsconfig.migration.json typeorm-ts-node-commonjs migration:generate --pretty -d scripts/data-source.ts"
   },
   "dependencies": {
-    "@nestjs/axios": "4.0.1",
     "@nestjs/common": "11.1.28",
     "@nestjs/config": "4.0.4",
     "@nestjs/core": "11.1.28",
@@ -37,16 +36,16 @@
     "better-sqlite3": "13.0.3",
     "class-transformer": "0.5.1",
     "class-validator": "0.15.1",
-    "js-yaml": "4.1.0",
-    "multer": "1.4.5-lts.1",
+    "js-yaml": "4.3.2",
+    "multer": "2.4.0",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "passport-local": "1.0.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
-    "socket.io": "4.8.3",
+    "socket.io": "4.8.4",
     "svg-captcha": "1.4.0",
-    "typeorm": "0.3.20"
+    "typeorm": "0.3.31"
   },
   "devDependencies": {
     "@nestjs/cli": "11.0.24",
@@ -69,5 +68,13 @@
     "ts-node": "10.9.2",
     "tsconfig-paths": "4.2.0",
     "typescript": "5.4.3"
+  },
+  "overrides": {
+    "proxy-addr": "^2.0.8",
+    "multer": "$multer",
+    "engine.io": "^6.6.10",
+    "@nestjs/swagger": {
+      "js-yaml": "^5.4.3"
+    }
   }
 }

package/templates/backend/scripts/build.cjs

@@ -32,6 +32,7 @@
  */
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const readline = require('readline');
 
 const BACKEND = path.resolve(__dirname, '..');
@@ -265,6 +266,70 @@ function cleanAppleDoubles(dir) {
   return removed;
 }
 
+// 生成/刷新 backend/package-lock.json(Dockerfile `npm ci` 用的真 npm lockfile)。
+// 生成必须在隔离目录(一次性 mkdtemp),直接在 backend/ 下跑 npm 会踩两个雷(实测):
+//   ① 根 package.json 声明 workspaces → npm 自动爬到 workspace 根解析整个 monorepo,
+//      撞上 pnpm 符号链 node_modules → 崩溃/hang(Cannot read properties of null / 长时间无输出);
+//   ② 加 --workspaces=false 钉住单包后,npm 又会读 backend/node_modules 的 pnpm 符号链
+//      实际树,把 resolved 写成 "../node_modules/.pnpm/..." 伪路径(即 validateLockfile
+//      防的污染,进 Docker npm ci 建出断链 node_modules)。
+// 隔离目录无父 workspace、无 node_modules → npm 只能按 registry 解析 → 真 lockfile,
+// 产物拷回 backend/package-lock.json(落位与 README「第 4 步」手工配方一致)。触发条件:
+//   ① lock 不存在 → 生成(免手工);
+//   ② package.json 的 dependencies 与 lock packages[""].dependencies 不同步 → 刷新
+//     (pnpm install 改依赖后自动跟上,防 Dockerfile 按旧 lock 装出旧树;syncLockVersion
+//     只对 version 字段管不了依赖树)。devDependencies 不比对:lock 以 --omit=dev 生成,
+//     不含 dev 树,devDeps 变更不影响容器安装。
+// 失败 throw 附手工兜底命令(与 README「第 4 步」同款)。
+function sameDeps(a, b) {
+  const ka = Object.keys(a).sort();
+  const kb = Object.keys(b).sort();
+  return ka.length === kb.length && ka.every((k) => a[k] === b[k]);
+}
+
+function lockDepsOutOfSync(lockPath, pkg) {
+  try {
+    const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    const lockDeps = (lock.packages && lock.packages[''] && lock.packages[''].dependencies) || {};
+    return !sameDeps(lockDeps, pkg.dependencies || {});
+  } catch {
+    return true; // lock 损坏/不可解析 → 视为不同步,重生成
+  }
+}
+
+function ensureLockfile() {
+  const lockPath = path.join(BACKEND, 'package-lock.json');
+  const missing = !fs.existsSync(lockPath);
+  if (!missing && !lockDepsOutOfSync(lockPath, readPkg())) return;
+  console.log(
+    missing
+      ? '▶ backend/package-lock.json 不存在(Dockerfile npm ci 依赖它),自动生成 ...'
+      : '▶ package.json 依赖与 lock 不同步,自动刷新 backend/package-lock.json ...'
+  );
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'be-lock-'));
+  try {
+    fs.copyFileSync(PKG_PATH, path.join(tmp, 'package.json'));
+    const r = require('child_process').spawnSync(
+      'npm',
+      ['install', '--package-lock-only', '--omit=dev', '--legacy-peer-deps'],
+      { cwd: tmp, stdio: 'inherit', shell: true }
+    );
+    const tmpLock = path.join(tmp, 'package-lock.json');
+    if (r.error || r.status !== 0 || !fs.existsSync(tmpLock)) {
+      throw new Error(
+        `npm install --package-lock-only 生成 lockfile 失败(status=${r.status})。手工兜底:\n` +
+        '  mkdir -p /tmp/be-lock && cp backend/package.json /tmp/be-lock/ \\\n' +
+        '    && (cd /tmp/be-lock && npm install --package-lock-only --omit=dev --legacy-peer-deps \\\n' +
+        '    && cp package-lock.json <repo>/backend/)'
+      );
+    }
+    fs.copyFileSync(tmpLock, lockPath);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+  console.log('  ✓ backend/package-lock.json 已生成/刷新');
+}
+
 // 防御:package-lock.json 必须是真 npm lockfile(resolved = registry URL)。
 // pnpm workspace 下误跑 `npm install` 会把现有 pnpm 符号链当 resolved 路径写进 lock
 // (resolved = "../node_modules/.pnpm/..."),Dockerfile `npm ci` 据此建出指向容器内不存在的
@@ -272,7 +337,7 @@ function cleanAppleDoubles(dir) {
 // buildops 时拦此污染,提示重生路径。
 function validateLockfile() {
   const lockPath = path.join(BACKEND, 'package-lock.json');
-  if (!fs.existsSync(lockPath)) return; // 未生成时跳过(Dockerfile npm ci 另因缺 lock 报错)
+  if (!fs.existsSync(lockPath)) return; // 正常已被上方 ensureLockfile 生成,此处纯防御
   const raw = fs.readFileSync(lockPath, 'utf8');
   if (raw.includes('node_modules/.pnpm')) {
     throw new Error(
@@ -287,6 +352,7 @@ function validateLockfile() {
 
 // 组装运维包
 function buildOps(version) {
+  ensureLockfile();
   validateLockfile();
   const pkg = readPkg();
   // name 路径安全化:backend → backend

package/templates/backend/src/config/config.interface.ts

@@ -48,6 +48,15 @@ export interface AppConfig {
     username: string;
     password: string;
   };
+  /** 单点登录 /api/ssologin(演示接入范式,默认关闭) */
+  sso: {
+    /** 是否开启;false 时接口返回 404(对外不暴露该能力) */
+    enabled: boolean;
+    /** 票据校验密钥(HMAC-SHA256),与接入方(门户/统一认证)共享 */
+    ticketKey: string;
+    /** 时间戳允许偏差(秒),默认 300 */
+    tsWindow: number;
+  };
   /** 大屏 API 签名加密配置(无 token、无过期) */
   appSign: {
     /** HMAC-SHA256 签名密钥,永不过期 */

package/templates/backend/src/config/configuration.ts

@@ -27,6 +27,11 @@ const envInt = (k: string, fallback?: number): number | undefined => {
   const n = Number(v);
   return Number.isFinite(n) ? n : fallback;
 };
+const envBool = (k: string, fallback?: boolean): boolean | undefined => {
+  const v = process.env[k];
+  if (v === undefined || v === '') return fallback;
+  return v === 'true' || v === '1';
+};
 const envList = (k: string, fallback?: string[]): string[] | undefined => {
   const v = process.env[k];
   if (v === undefined || v === '') return fallback;
@@ -102,6 +107,12 @@ export default (): AppConfig => {
       ...config.appSign,
       signKey: envStr('APP_SIGN_KEY', config.appSign.signKey) as string,
       tsWindow: envInt('APP_SIGN_TS_WINDOW', config.appSign.tsWindow) as number
+    },
+    sso: {
+      ...config.sso,
+      enabled: envBool('SSO_ENABLED', config.sso.enabled) as boolean,
+      ticketKey: envStr('SSO_TICKET_KEY', config.sso.ticketKey) as string,
+      tsWindow: envInt('SSO_TS_WINDOW', config.sso.tsWindow) as number
     }
   };
 };

package/templates/backend/src/modules/auth/auth.service.ts

@@ -1,16 +1,20 @@
-import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { Injectable, UnauthorizedException, NotFoundException, Logger } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import * as bcrypt from 'bcryptjs';
+import * as crypto from 'crypto';
 import { UserEntity } from '../../entities/user.entity';
 import { CaptchaService } from './captcha.service';
 import { AuditService } from '../audit/audit.service';
+import { safeEqualHex } from '../../common/app-crypto';
 import type { AppConfig } from '../../config/config.interface';
 
 @Injectable()
 export class AuthService {
+  private readonly logger = new Logger(AuthService.name);
+
   constructor(
     @InjectRepository(UserEntity)
     private readonly userRepo: Repository<UserEntity>,
@@ -56,10 +60,14 @@ export class AuthService {
       });
       throw new UnauthorizedException('用户名或密码错误');
     }
-    const ok = user.password.startsWith('$2')
-      ? await bcrypt.compare(params.password, user.password)
-      : params.password === user.password;
+    // 非 bcrypt 哈希(历史明文/手工改库)一律拒绝,不做明文比对回退;
+    // 存量明文用户走 /api/user/resetPassword 恢复,超管走「改配置+重启」reconcile。
+    const hashed = user.password.startsWith('$2');
+    const ok = hashed && (await bcrypt.compare(params.password, user.password));
     if (!ok) {
+      if (!hashed) {
+        this.logger.warn(`用户 ${user.username} 密码非 bcrypt 哈希,请管理员重置`);
+      }
       await this.auditService.record({
         actorName: params.username,
         action: 'login_fail',
@@ -88,23 +96,60 @@ export class AuthService {
   }
 
   /**
-   * 单点登录 /api/ssologin
+   * 单点登录 /api/ssologin(演示接入范式,默认关闭)
+   *
+   * 未开启(yaml sso.enabled=false)时返回 404,对外不暴露该能力。
+   * 开启后校验接入方票据:
+   *   GET /api/ssologin?username=xxx&ts=<unix秒>&sign=<hex>
+   *   sign = HMAC-SHA256(`${username}\n${ts}`, sso.ticketKey) hex
+   * 接入方(门户/统一认证)持 ticketKey 生成跳转 URL,票据时效由 tsWindow 约束。
+   * role 固定 'web'(最小权限),勿给该角色挂敏感路由。
    */
-  async ssoLogin(params: { [key: string]: any }, ip?: string) {
-    if (!params || Object.keys(params).length === 0) {
+  async ssoLogin(
+    params: { username?: string; ts?: string; sign?: string },
+    ip?: string
+  ) {
+    const ssoCfg = this.config.get<AppConfig['sso']>('sso');
+    const username = params?.username || '';
+
+    if (!ssoCfg.enabled) {
+      throw new NotFoundException('接口不存在');
+    }
+
+    const fail = async (reason: string) => {
       await this.auditService.record({
-        actorName: params?.username || 'sso',
+        actorName: username || 'sso',
         action: 'login_fail',
-        detail: { reason: '缺少 sso 参数' },
+        detail: { reason },
         ip
       });
-      throw new UnauthorizedException('缺少 sso 参数');
+      throw new UnauthorizedException(reason);
+    };
+
+    const tsNum = Number(params.ts);
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (!username || !params.ts || !params.sign) {
+      await fail('缺少单点登录票据参数');
+    }
+    if (!Number.isFinite(tsNum) || tsNum <= 0) {
+      await fail('票据时间戳非法');
+    }
+    if (Math.abs(nowSec - tsNum) > ssoCfg.tsWindow) {
+      await fail('票据已过期');
     }
-    const username = params.username || 'sso';
+
+    const expected = crypto
+      .createHmac('sha256', ssoCfg.ticketKey)
+      .update(`${username}\n${params.ts}`, 'utf8')
+      .digest('hex');
+    if (!safeEqualHex(expected, String(params.sign).toLowerCase())) {
+      await fail('票据校验失败');
+    }
+
     await this.auditService.record({
       actorName: username,
       action: 'login_success',
-      detail: { sso: true, params: Object.keys(params) },
+      detail: { sso: true },
       ip
     });
     const payload = { sub: 0, username, role: 'web' };

package/templates/backend/src/modules/page-data/page-data.controller.ts

@@ -8,49 +8,72 @@ import {
   Query,
   Request,
   UploadedFile,
-  UseInterceptors
+  UseGuards,
+  UseInterceptors,
+  ForbiddenException
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
-import { ApiTags, ApiConsumes, ApiBody } from '@nestjs/swagger';
+import { ApiTags, ApiConsumes, ApiBody, ApiBearerAuth } from '@nestjs/swagger';
 import { PageDataService } from './page-data.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 
 @ApiTags('page-data 大屏页面数据')
 @Controller()
 export class PageDataController {
   constructor(private readonly service: PageDataService) {}
 
-  /** 列表 /api/getList */
+  /** 仅管理员可写(与 user.controller 的 ensureAdmin 同模式) */
+  private ensureAdmin(req: any) {
+    if (req.user?.role !== 'admin' && req.user?.role !== 'superadmin') {
+      throw new ForbiddenException('仅管理员可操作大屏页面数据');
+    }
+    return { id: req.user.id, username: req.user.username };
+  }
+
+  /**
+   * 列表 /api/getList
+   * 保持公开:docs/api-security.md §1.1/§6 已拍板「暂不纳入签名保护」(大屏消费接口)。
+   */
   @Get('getList')
   getList(@Query() query: any) {
     return this.service.getList(query);
   }
 
-  /** 新增 /api/add */
+  /** 新增 /api/add(需登录,admin-only) */
+  @UseGuards(JwtAuthGuard)
   @Post('add')
   add(@Body() body: any, @Request() req: any) {
+    this.ensureAdmin(req);
     return this.service.add(body, req.user);
   }
 
-  /** 修改 /api/edit */
+  /** 修改 /api/edit(需登录,admin-only) */
+  @UseGuards(JwtAuthGuard)
   @Put('edit')
-  edit(@Body() body: any) {
+  edit(@Body() body: any, @Request() req: any) {
+    this.ensureAdmin(req);
     return this.service.update(body);
   }
 
-  /** 删除 /api/deleteById */
+  /** 删除 /api/deleteById(需登录,admin-only) */
+  @UseGuards(JwtAuthGuard)
   @Delete('deleteById')
-  deleteById(@Query('id') id: string) {
+  deleteById(@Query('id') id: string, @Request() req: any) {
+    this.ensureAdmin(req);
     return this.service.deleteById(Number(id));
   }
 
-  /** 导入文件 /api/v1/import */
+  /** 导入文件 /api/v1/import(需登录,admin-only) */
+  @UseGuards(JwtAuthGuard)
   @Post('v1/import')
   @UseInterceptors(FileInterceptor('file'))
   @ApiConsumes('multipart/form-data')
+  @ApiBearerAuth()
   @ApiBody({
     schema: { type: 'object', properties: { file: { type: 'string', format: 'binary' } } }
   })
-  import(@UploadedFile() file: any) {
+  import(@UploadedFile() file: any, @Request() req: any) {
+    this.ensureAdmin(req);
     if (!file) {
       throw new Error('缺少 file');
     }

package/templates/backend/src/modules/screen-config/screen-config.controller.ts

@@ -1,22 +1,50 @@
-import { Controller, Get, Param, Body, Put } from '@nestjs/common';
-import { ApiTags } from '@nestjs/swagger';
+import {
+  Controller,
+  Get,
+  Param,
+  Body,
+  Put,
+  Request,
+  UseGuards,
+  ForbiddenException
+} from '@nestjs/common';
+import { ApiTags, ApiBearerAuth } from '@nestjs/swagger';
 import { ScreenConfigService } from './screen-config.service';
 import { ScreenConfigEntity } from '../../entities/screen-config.entity';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 
 @ApiTags('screen 大屏配置')
 @Controller('screen')
 export class ScreenConfigController {
   constructor(private readonly service: ScreenConfigService) {}
 
-  /** 大屏清单 /api/screen/list */
+  /** 仅管理员可写(与 user.controller 的 ensureAdmin 同模式) */
+  private ensureAdmin(req: any) {
+    if (req.user?.role !== 'admin' && req.user?.role !== 'superadmin') {
+      throw new ForbiddenException('仅管理员可操作大屏配置');
+    }
+    return { id: req.user.id, username: req.user.username };
+  }
+
+  /**
+   * 大屏清单 /api/screen/list
+   * 保持公开:docs/api-security.md §1.1/§6 已拍板「暂不纳入签名保护」(大屏消费接口)。
+   */
   @Get('list')
   list() {
     return this.service.list();
   }
 
-  /** 更新大屏配置 /api/screen/:key */
+  /** 更新大屏配置 /api/screen/:key(需登录,admin-only) */
+  @UseGuards(JwtAuthGuard)
+  @ApiBearerAuth()
   @Put(':key')
-  update(@Param('key') key: string, @Body() dto: Partial<ScreenConfigEntity>) {
+  update(
+    @Param('key') key: string,
+    @Body() dto: Partial<ScreenConfigEntity>,
+    @Request() req: any
+  ) {
+    this.ensureAdmin(req);
     return this.service.update(key, dto);
   }
 }

package/templates/root/AGENTS.md

@@ -50,7 +50,7 @@ scripts/                根级发布/回滚薄编排
 7. **两个请求实例禁止复用**:`request.ts`(后台,带 Authorization)与 `app-request.ts`(大屏,三头签名)独立,复用会互相头污染。
 8. **DB 文件名程序定死**:`template.prod.sqlite`/`template.dev.sqlite`,改名要同步 `sqlite.config.ts`、`configuration.ts`、`ops/sqlite/config.sh`、ops 探针四处。
 9. **better-sqlite3 v13 无预编译二进制**:需 python3/make/g++ 源码编译(Dockerfile 已装齐);本地装依赖报 node-gyp 错先查这个。
-10. **backend/package-lock.json 必须是真 npm lockfile**(Dockerfile `npm ci` 用;首次部署前按 README「第 4 步」重生,避开 pnpm 符号链污染)。
+10. **backend/package-lock.json 必须是真 npm lockfile**(Dockerfile `npm ci` 用;buildops 自动生成/刷新——缺失或依赖不同步时在隔离目录跑 `npm install --package-lock-only` 拷回,无需手工;在 `backend/` 下裸跑 npm 会撞 workspace 根探测/pnpm 符号链污染,详见 `build.cjs::ensureLockfile` 注释与 README「第 4 步」)。
 
 ## 编码与接口约定