trustbase-seller-backend 0.2.8 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/payments/wechat/profitsharing.js

@@ -107,16 +107,15 @@ async function addReceivers(receivers) {
     return results.length === 1 ? results[0] : results;
 }
 
-/** 接收方名称加密: 微信支付公钥 RSA-OAEP → base64。
- *  ⚠️ 2026-09-26 实测坑: 微信"OAEPWithSHA-256AndMGF1Padding"是 Java 语义 — MGF1 实际用 SHA-1。
- *  Node crypto.publicEncrypt 的 oaepHash 会把 OAEP+MGF1 都设成同一 hash → 微信"平台私钥解密失败"。
- *  必须用 openssl 子进程分开指定 (rsa_oaep_md:sha256 + rsa_mgf1_md:sha1)。 */
+/** 接收方名称加密: 微信支付公钥 RSAES-OAEP → base64。
+ *  ⚠️ 2026-09-26 实测枚举锁定: 微信的 RSAES-OAEP = OAEP-SHA1 + MGF1-SHA1 (全线 SHA-1)。
+ *  sha256/sha256、sha256/sha1 都被微信拒 ("平台私钥解密失败"), sha1/sha1 通过。openssl 子进程实现。 */
 function encryptReceiverName(name) {
     const p = process.env.WXPAY_SP_PUBLIC_KEY_PATH || process.env.WXPAY_PUBLIC_KEY_PATH;
     if (!p) throw new Error("WXPAY_(SP_)PUBLIC_KEY_PATH 未配置, 接收方名称无法加密");
     const { execSync } = require("child_process");
     const b64 = execSync(
-        `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(p)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
+        `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(p)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
         { input: Buffer.from(name, "utf8"), maxBuffer: 1024 * 1024 }
     ).toString("utf8").trim();
     return b64;

package/routes/onboard.html

@@ -196,12 +196,13 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
           <div class="afield"><label for="a_merchant_name">营业执照名称</label><input id="a_merchant_name" placeholder="全称, 与执照一致"></div>
           <div class="afield"><label for="a_license_number">统一社会信用代码</label><input id="a_license_number" placeholder="18 位, 9 开头"></div>
           <div class="afield"><label for="a_service_phone">客服电话</label><input id="a_service_phone" placeholder="交易记录向买家展示"></div>
-          <div class="afield"><label for="a_settlement_id">经营类目</label>
+          <div class="afield"><label for="a_settlement_id">经营类目 (微信行业编码 MCC)</label>
+            <input id="a_settlement_filter" placeholder="搜索: 编码或名称 (如 5732 / 电子)" style="margin-bottom:6px">
             <select id="a_settlement_id">
-              <option value="719">719 · 个体户通用（餐饮/零售/生活服务，0.6% T+1）</option>
-              <option value="716">716 · 企业通用（餐饮/零售/网上商城/生活服务，0.6% T+1）</option>
-              <option value="727">727 · 其他组织通用（咨询/社区服务/娱乐票务，0.6% T+1）</option>
-            </select></div>
+              <option value="">请选择经营类目</option>
+              <option value="__MANUAL__">手动输入编码</option>
+            </select>
+            <input id="a_settlement_manual" class="amanual" placeholder="4 位 MCC 编码, 如: 5311" style="display:none"></div>
           <div class="afield afield-full"><label for="a_qualification_type">类目资质描述 <span class="aopt">通用类目留空</span></label><input id="a_qualification_type" placeholder="通用零售/餐饮留空即可；特殊行业(医疗/教育/食品)需对应资质"></div>
         </div>
       </div>
@@ -932,12 +933,47 @@ async function restoreIdentity(){
    (证件缩略图预览已于二重框修复时并入主脚本 mountApplyUpload 槽位双态) ===== */
 (function(){
   // ⓪ 编码字段下拉 (2026-10-03 xiaomu: 手填编码易被微信秒拒 → 下拉)
-  // 经营类目 ↔ 主体类型联动 (企业默认 716 / 个体户默认 719, 可手改)
+  // 经营类目 ↔ 主体类型联动 — MCC 真实编码 (V3 进件 settlement_id 用《商户行业编码》4 位 MCC,
+  //  之前 716/719/727 是 V2 结算规则 ID, 被微信拒 "所属行业不存在"。编码主体通用,
+  //  联动只影响默认选中: 企业→5311 百货, 个体户→5331 杂货便利店)
+  var MCC=[['5311','百货商店'],['5331','各类杂货店便利店'],['5411','大型仓储式超级市场'],
+    ['5611','男装店'],['5621','妇女成衣店'],['5641','婴儿儿童服装店'],['5651','家庭服装商店'],
+    ['5655','运动服饰商店'],['5661','鞋店'],['5691','成人成衣店'],['5699','各类服装及饰物店'],
+    ['5712','家具家用设备零售商'],['5722','家用电器商店'],['5732','电子设备商店'],['5734','计算机软件商店'],
+    ['5921','瓶装酒零售店'],['5942','书店'],['5943','文具办公用品商店'],['5944','珠宝钟表银器店'],
+    ['5945','玩具游戏店'],['5948','箱包皮具店'],['5949','纺织品针织品零售'],['5970','工艺美术商店'],
+    ['5977','化妆品商店'],['5995','宠物商店及用品'],['5999','其他专门零售店'],
+    ['5812','就餐场所和餐馆'],['5814','快餐店'],['5499','各类食品店'],['5441','糖果坚果商店'],
+    ['5451','乳制品冷饮店'],['5462','面包房糕点商店'],['5422','各类肉类零售商'],['5912','药店药房'],
+    ['4816','计算机网络信息服务'],['7011','住宿服务'],['4722','旅行社'],['4733','票务'],
+    ['7230','美容理发店'],['7298','保健美容SPA'],['7295','家政服务'],['7699','各类维修店'],
+    ['8249','贸易职业学校(职业技能培训)'],['8299','其他学校和教育服务']];
   var subj=document.getElementById('a_subject_type');
   var stl=document.getElementById('a_settlement_id');
+  if(stl){
+    // 填充 MCC 选项 (手动输入项保持在最后)
+    var manualOpt=stl.querySelector('option[value="__MANUAL__"]');
+    MCC.forEach(function(c){
+      var o=document.createElement('option');
+      o.value=c[0];o.textContent=c[0]+' · '+c[1];
+      stl.insertBefore(o,manualOpt);
+    });
+    stl.value='5311'; // 默认 百货商店 (综合电商最高频)
+    // 搜索过滤 (45 个选项手翻太长)
+    var filt=document.getElementById('a_settlement_filter');
+    if(filt) filt.addEventListener('input',function(){
+      var q=filt.value.trim().toLowerCase();
+      Array.prototype.forEach.call(stl.options,function(o){
+        if(o.value===''||o.value==='__MANUAL__') return;
+        o.hidden = !!(q && o.textContent.toLowerCase().indexOf(q)<0);
+      });
+    });
+    // 手动输入接管 (沿用 id 移交逻辑)
+    linkSelectManual('a_settlement_id','a_settlement_manual','__MANUAL__');
+  }
   if(subj&&stl){
     subj.addEventListener('change',function(){
-      stl.value = subj.value==='SUBJECT_TYPE_ENTERPRISE' ? '716' : '719';
+      stl.value = subj.value==='SUBJECT_TYPE_ENTERPRISE' ? '5311' : '5331';
       // F4: 企业主体显示身份证居住地址(必填) + UBO 说明; 个体户隐藏
       var ent = subj.value==='SUBJECT_TYPE_ENTERPRISE';
       var ia=document.getElementById('afield_idaddr'); if(ia) ia.style.display=ent?'':'none';

package/routes/sp-applyment.js

@@ -110,12 +110,30 @@ function wxPubKeyPem() {
     throw new HttpError(500, "wx_pubkey_missing", "WXPAY_SP_PUBLIC_KEY_PATH 未配置, 敏感字段无法加密");
 }
 
-/** 敏感字段加密: RSA-OAEP-SHA256 → base64 (微信敏感信息加密口径) */
+/** 敏感字段加密: 微信支付公钥 RSAES-OAEP → base64。
+ *  ⚠️ 2026-09-26 实测枚举锁定: 微信 RSAES-OAEP = OAEP-SHA1 + MGF1-SHA1 (全线 SHA-1),
+ *  sha256 系全部"平台私钥解密失败"。openssl 子进程, pem 参数保留兼容旧调用签名。 */
 function encryptSensitive(plain, pem) {
-    return crypto.publicEncrypt(
-        { key: pem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
-        Buffer.from(String(plain), "utf8")
-    ).toString("base64");
+    const { execSync } = require("child_process");
+    const fs = require("fs");
+    const os = require("os");
+    const path = require("path");
+    // openssl 需要文件路径: pem 已是路径直接用; 是内容则写临时文件
+    let keyPath = pem;
+    let tmp = null;
+    if (String(pem).includes("BEGIN")) {
+        tmp = path.join(os.tmpdir(), `wxpk-${process.pid}-${Date.now()}.pem`);
+        fs.writeFileSync(tmp, pem, { mode: 0o600 });
+        keyPath = tmp;
+    }
+    try {
+        return execSync(
+            `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(keyPath)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
+            { input: Buffer.from(String(plain), "utf8"), maxBuffer: 1024 * 1024 }
+        ).toString("utf8").trim();
+    } finally {
+        if (tmp) { try { fs.unlinkSync(tmp); } catch (_) {} }
+    }
 }
 
 /** 业务申请编号: TB{毫秒}{6位随机} (微信要求仅数字/字母/下划线) */

package/test-onboard-applyment.js

@@ -1,451 +1,457 @@
-"use strict";
-/**
- * test-onboard-applyment.js — 卖家本机进件链路 离线单测 (2026-10-03 架构纠偏)
- * node --test test-onboard-applyment.js
- *
- * 数据流: 卖家页面 → 卖家本机 seller-backend (敏感字段本地 RSA-OAEP 加密)
- *   → 假 SP 网关 (本测试起的 mock HTTP 服务, 捕获转发体断言无明文) → (真环境再到微信)
- * SP 不可达: SP_GATEWAY_URL 指到关闭端口, 断言 503 友好提示 + 台账 PENDING_PUSH 可重试。
- */
-const test = require("node:test");
-const assert = require("node:assert");
-const crypto = require("crypto");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const express = require("express");
-const Database = require("better-sqlite3");
-
-const MERCHANT_TOKEN = "test-sp-merchant-token";
-
-// 测试 SP 微信支付公钥对 (卖家本机加密用; 私钥断言密文可还原)
-const wxPub = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "onboard-apply-test-"));
-const pubKeyPath = path.join(tmpDir, "wx_sp_pub.pem");
-fs.writeFileSync(pubKeyPath, wxPub.publicKey.export({ type: "spki", format: "pem" }));
-
-process.env.WXPAY_SP_PUBLIC_KEY_PATH = pubKeyPath;
-process.env.TB_BASE_DIR = tmpDir; // M2: applyment submit 会读本机 seller 身份 (tb_address 贯通), 隔离到临时目录
-process.env.SP_MERCHANT_TOKEN = MERCHANT_TOKEN;
-
-const onboard = require("./routes/onboard");
-const spApplymentLib = require("./routes/sp-applyment"); // buildApplymentBody 场景结构断言用
-
-// ---------- 假 SP 网关 (捕获请求体) ----------
-const spCapture = { uploads: [], submits: [], statusQueries: [] };
-let spSrv = null;
-let spBase = "";
-let submitCounter = 0;
-
-async function startFakeSp() {
-    const app = express();
-    app.use(express.json());
-    // 凭证校验 (卖家带 x-sp-admin-key = SP_MERCHANT_TOKEN)
-    app.use((req, res, next) => {
-        if (req.path === "/api/sp/info") return next();
-        if (req.headers["x-sp-admin-key"] !== MERCHANT_TOKEN) {
-            return res.status(401).json({ error: "unauthorized", message: "x-sp-admin-key 无效" });
-        }
-        next();
-    });
-    app.get("/api/sp/info", (req, res) => {
-        spCapture.infoQueries = (spCapture.infoQueries || 0) + 1;
-        res.json({ name: "无锡小播鼠网络科技", desc: "TrustBase 官方支付服务商", commission_rate_bp: 100, rate_pct: "1.00%", gateway: "fake-sp" });
-    });
-    app.post("/api/sp/applyment/upload", (req, res) => {
-        spCapture.uploads.push(req.body);
-        res.json({ media_id: "FAKE_MEDIA_" + crypto.randomBytes(6).toString("hex") });
-    });
-    app.post("/api/sp/applyment/submit", (req, res) => {
-        spCapture.submits.push(req.body);
-        submitCounter++;
-        // F3: 卖家侧生成 business_code, SP 回显同号 (不带号才兜底生成)
-        res.json({ applyment_id: "200000212477" + String(5690 + submitCounter), business_code: req.body.business_code || ("TBFAKE" + String(submitCounter).padStart(6, "0")) });
-    });
-    app.get("/api/sp/applyment/status/:bc", (req, res) => {
-        spCapture.statusQueries.push(req.params.bc);
-        const ov = spCapture.statusOverride || {};
-        res.json({
-            business_code: req.params.bc, status: ov.status || "APPLYMENT_STATE_FINISHED", state_msg: ov.state_msg || "已完成",
-            sign_url: "https://pay.weixin.qq.com/public/apply4ec_sign/s?fake=1", sub_mchid: "1600000888",
-        });
-    });
-    spSrv = app.listen(0);
-    await new Promise((r) => spSrv.once("listening", r));
-    spBase = `http://127.0.0.1:${spSrv.address().port}`;
-}
-
-/** 起被测卖家后端 (新内存库) */
-async function startSeller() {
-    const db = new Database(":memory:");
-    const app = express();
-    app.use(express.json());
-    const router = onboard.createOnboardRouter({ db });
-    app.use("/api/onboard", router);
-    app.use("/onboard", router);
-    const srv = app.listen(0);
-    await new Promise((r) => srv.once("listening", r));
-    return { db, srv, base: `http://127.0.0.1:${srv.address().port}` };
-}
-
-const PLAINTEXT = { id: "440300199001011234", card: "6225880212345678", mobile: "13800001111" };
-
-/** 合法表单 (5 张图先走 upload 代理拿 media_id) */
-async function fillForm(base) {
-    const media = {};
-    for (const k of ["license_media_id", "legal_id_front_media_id", "legal_id_back_media_id", "store_entrance_media_id", "store_indoor_media_id"]) {
-        const r = await fetch(base + "/api/onboard/applyment/upload", {
-            method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-jpeg-" + k).toString("base64") }),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, "upload " + k + ": " + JSON.stringify(j));
-        media[k] = j.media_id;
-    }
-    return {
-        subject_type: "SUBJECT_TYPE_INDIVIDUAL",
-        contact_name: "张三", contact_mobile: PLAINTEXT.mobile, contact_email: "zs@example.com",
-        merchant_shortname: "张三餐饮店", merchant_name: "深圳市张三餐饮店", license_number: "92440300MA5F00000X",
-        legal_name: "张三", legal_id_number: PLAINTEXT.id,
-        legal_id_period_begin: "2015-01-01", legal_id_period_end: "2035-01-01",
-        account_type: "BANK_ACCOUNT_TYPE_PERSONAL",
-        account_name: "张三", account_number: PLAINTEXT.card, account_bank: "招商银行",
-        store_name: "张三餐饮店南山店", store_address_code: "440300", store_address: "南山区xx路1号",
-        service_phone: "0755-12345678", settlement_id: "719", qualification_type: "零售",
-        ...media,
-    };
-}
-
-test.before(async () => {
-    await startFakeSp();
-    process.env.SP_GATEWAY_URL = spBase;
-});
-test.after(() => { if (spSrv) spSrv.close(); });
-
-test("upload 代理: 转发假 SP 拿 media_id, 凭证头正确", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const before = spCapture.uploads.length;
-        const r = await fetch(base + "/api/onboard/applyment/upload", {
-            method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filename: "id_front.jpg", content_b64: Buffer.from("fake-jpeg").toString("base64") }),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200);
-        assert.match(j.media_id, /^FAKE_MEDIA_/);
-        assert.strictEqual(spCapture.uploads.length, before + 1);
-        assert.strictEqual(spCapture.uploads[before].filename, "id_front.jpg");
-    } finally { srv.close(); }
-});
-
-test("submit: 本地加密转发 (转发体无明文, 密文可还原) + 台账落行 + 幂等", async () => {
-    const { db, srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        const submitsBefore = spCapture.submits.length;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        assert.match(j.business_code, /^TB\d{19}$/, "business_code 卖家侧本地生成 (F3)");
-        assert.ok(j.applyment_id);
-
-        // 转发体: already_encrypted + 无明文敏感
-        assert.strictEqual(spCapture.submits.length, submitsBefore + 1);
-        const fwd = spCapture.submits[submitsBefore];
-        assert.strictEqual(fwd.already_encrypted, true);
-        assert.match(fwd.tb_address || "", /^tct1[a-z0-9]{20,60}$/, "M2: payload 带商户链上地址 (引导金 recipient)");
-        const fwdStr = JSON.stringify(fwd);
-        assert.ok(!fwdStr.includes(PLAINTEXT.id), "转发体不含明文身份证");
-        assert.ok(!fwdStr.includes(PLAINTEXT.card), "转发体不含明文卡号");
-        assert.ok(!fwdStr.includes(PLAINTEXT.mobile), "转发体不含明文手机");
-        // 密文可用测试私钥还原 (证明用的是 SP 公钥 RSA-OAEP-SHA256)
-        const dec = crypto.privateDecrypt(
-            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
-            Buffer.from(fwd.legal_id_number, "base64")
-        ).toString("utf8");
-        assert.strictEqual(dec, PLAINTEXT.id);
-        // media_id 透传
-        assert.strictEqual(fwd.license_media_id, form.license_media_id);
-
-        // 台账: business_code 落行, 快照无明文, 暂存 payload 是密文
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.business_code, j.business_code);
-        assert.strictEqual(row.status, "SUBMITTED");
-        assert.ok(!row.form_snapshot.includes(PLAINTEXT.id), "快照无明文身份证");
-        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存 payload 无 plaintext");
-
-        // 幂等: 同表单再提交 → 同 business_code, 不重复调 SP
-        const r2 = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j2 = await r2.json();
-        assert.strictEqual(j2.idempotent, true);
-        assert.strictEqual(j2.business_code, j.business_code);
-        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "SP 未被重复调用");
-    } finally { srv.close(); }
-});
-
-test("status 代理: FINISHED + sign_url + sub_mchid 回页面, 台账同步", async () => {
-    const { db, srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        const sr = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const { business_code } = await sr.json();
-        const r = await fetch(base + "/api/onboard/applyment/status");
-        const j = await r.json();
-        assert.strictEqual(r.status, 200);
-        assert.strictEqual(j.status, "APPLYMENT_STATE_FINISHED");
-        assert.ok(j.sign_url.includes("pay.weixin.qq.com"));
-        assert.strictEqual(j.sub_mchid, "1600000888");
-        assert.ok(spCapture.statusQueries.includes(business_code), "按 business_code 查 SP");
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.sub_mchid, "1600000888");
-        assert.ok(row.sign_url.includes("pay.weixin.qq.com"));
-    } finally { srv.close(); }
-});
-
-test("SP 不可达: 503 友好提示 + 台账 PENDING_PUSH, 恢复后空 body 重试成功", async () => {
-    const { db, srv, base } = await startSeller();
-    try {
-        // 先上传 (SP 还在线)
-        const form = await fillForm(base);
-        // 掐断 SP
-        process.env.SP_GATEWAY_URL = "http://127.0.0.1:1";
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 503);
-        assert.strictEqual(j.error, "sp_unavailable");
-        assert.ok(j.message.includes("服务商暂时不可用"), j.message);
-        assert.strictEqual(j.pending, true);
-        // 台账 PENDING_PUSH + 密文暂存
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.status, "PENDING_PUSH");
-        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存的是密文");
-        // 状态查询如实回 PENDING_PUSH
-        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
-        assert.strictEqual(st.status, "PENDING_PUSH");
-        // 恢复 SP → 空 body 重试
-        process.env.SP_GATEWAY_URL = spBase;
-        const submitsBefore = spCapture.submits.length;
-        const r2 = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
-        });
-        const j2 = await r2.json();
-        assert.strictEqual(r2.status, 200, JSON.stringify(j2));
-        assert.match(j2.business_code, /^TB\d{19}$/);
-        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "用暂存密文重试转发了一次");
-        const row2 = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row2.status, "SUBMITTED");
-    } finally { srv.close(); }
-});
-
-test("缺必填字段 → 400; 缺 media_id → 400 指明哪张图", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        // 空表单
-        let r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
-        });
-        assert.strictEqual(r.status, 400);
-        // 缺一张图
-        const form = await fillForm(base);
-        delete form.store_indoor_media_id;
-        r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 400);
-        assert.strictEqual(j.error, "media_missing");
-        assert.ok(j.message.includes("门店内部照片"), j.message);
-    } finally { srv.close(); }
-});
-
-test("onboard 页面含进件表单 (btn-apply-submit) 且第③步状态机元素齐", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const r = await fetch(base + "/onboard/");
-        const html = await r.text();
-        assert.strictEqual(r.status, 200);
-        assert.ok(html.includes("btn-apply-submit"), "进件提交按钮");
-        assert.ok(html.includes("apply-status"), "状态框");
-        assert.ok(html.includes("/api/onboard/applyment"), "页面打新端点");
-        // 2026-10-03: 三场景选择器 + 错误红卡
-        assert.ok(html.includes('name="sales_scene"'), "场景单选");
-        assert.ok(html.includes("SALES_SCENES_WEB") && html.includes("SALES_SCENES_MP"), "WEB/MP 场景");
-        assert.ok(html.includes("apply-err"), "错误红卡容器");
-        // 2026-10-03 二重框修复: 上传槽双态 (替换/删除按钮 + _aSlots 注册 + 删除清 media_id)
-        assert.ok(html.includes("upops") && html.includes("updel"), "替换/删除按钮结构");
-        assert.ok(html.includes("替换") && html.includes("删除"), "替换/删除文案");
-        assert.ok(html.includes("_aSlots"), "槽位双态注册表");
-        assert.ok(html.includes("delete _aMedia[field]"), "删除清 media_id");
-        assert.ok(!html.includes("slot.insertBefore(img"), "旧增强脚本预览补丁已删 (二重框根因)");
+"use strict";
+/**
+ * test-onboard-applyment.js — 卖家本机进件链路 离线单测 (2026-10-03 架构纠偏)
+ * node --test test-onboard-applyment.js
+ *
+ * 数据流: 卖家页面 → 卖家本机 seller-backend (敏感字段本地 RSA-OAEP 加密)
+ *   → 假 SP 网关 (本测试起的 mock HTTP 服务, 捕获转发体断言无明文) → (真环境再到微信)
+ * SP 不可达: SP_GATEWAY_URL 指到关闭端口, 断言 503 友好提示 + 台账 PENDING_PUSH 可重试。
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const crypto = require("crypto");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const express = require("express");
+const Database = require("better-sqlite3");
+
+const MERCHANT_TOKEN = "test-sp-merchant-token";
+
+// 测试 SP 微信支付公钥对 (卖家本机加密用; 私钥断言密文可还原)
+const wxPub = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "onboard-apply-test-"));
+const pubKeyPath = path.join(tmpDir, "wx_sp_pub.pem");
+fs.writeFileSync(pubKeyPath, wxPub.publicKey.export({ type: "spki", format: "pem" }));
+
+process.env.WXPAY_SP_PUBLIC_KEY_PATH = pubKeyPath;
+process.env.TB_BASE_DIR = tmpDir; // M2: applyment submit 会读本机 seller 身份 (tb_address 贯通), 隔离到临时目录
+process.env.SP_MERCHANT_TOKEN = MERCHANT_TOKEN;
+
+const onboard = require("./routes/onboard");
+const spApplymentLib = require("./routes/sp-applyment"); // buildApplymentBody 场景结构断言用
+
+// ---------- 假 SP 网关 (捕获请求体) ----------
+const spCapture = { uploads: [], submits: [], statusQueries: [] };
+let spSrv = null;
+let spBase = "";
+let submitCounter = 0;
+
+async function startFakeSp() {
+    const app = express();
+    app.use(express.json());
+    // 凭证校验 (卖家带 x-sp-admin-key = SP_MERCHANT_TOKEN)
+    app.use((req, res, next) => {
+        if (req.path === "/api/sp/info") return next();
+        if (req.headers["x-sp-admin-key"] !== MERCHANT_TOKEN) {
+            return res.status(401).json({ error: "unauthorized", message: "x-sp-admin-key 无效" });
+        }
+        next();
+    });
+    app.get("/api/sp/info", (req, res) => {
+        spCapture.infoQueries = (spCapture.infoQueries || 0) + 1;
+        res.json({ name: "无锡小播鼠网络科技", desc: "TrustBase 官方支付服务商", commission_rate_bp: 100, rate_pct: "1.00%", gateway: "fake-sp" });
+    });
+    app.post("/api/sp/applyment/upload", (req, res) => {
+        spCapture.uploads.push(req.body);
+        res.json({ media_id: "FAKE_MEDIA_" + crypto.randomBytes(6).toString("hex") });
+    });
+    app.post("/api/sp/applyment/submit", (req, res) => {
+        spCapture.submits.push(req.body);
+        submitCounter++;
+        // F3: 卖家侧生成 business_code, SP 回显同号 (不带号才兜底生成)
+        res.json({ applyment_id: "200000212477" + String(5690 + submitCounter), business_code: req.body.business_code || ("TBFAKE" + String(submitCounter).padStart(6, "0")) });
+    });
+    app.get("/api/sp/applyment/status/:bc", (req, res) => {
+        spCapture.statusQueries.push(req.params.bc);
+        const ov = spCapture.statusOverride || {};
+        res.json({
+            business_code: req.params.bc, status: ov.status || "APPLYMENT_STATE_FINISHED", state_msg: ov.state_msg || "已完成",
+            sign_url: "https://pay.weixin.qq.com/public/apply4ec_sign/s?fake=1", sub_mchid: "1600000888",
+        });
+    });
+    spSrv = app.listen(0);
+    await new Promise((r) => spSrv.once("listening", r));
+    spBase = `http://127.0.0.1:${spSrv.address().port}`;
+}
+
+/** 起被测卖家后端 (新内存库) */
+async function startSeller() {
+    const db = new Database(":memory:");
+    const app = express();
+    app.use(express.json());
+    const router = onboard.createOnboardRouter({ db });
+    app.use("/api/onboard", router);
+    app.use("/onboard", router);
+    const srv = app.listen(0);
+    await new Promise((r) => srv.once("listening", r));
+    return { db, srv, base: `http://127.0.0.1:${srv.address().port}` };
+}
+
+const PLAINTEXT = { id: "440300199001011234", card: "6225880212345678", mobile: "13800001111" };
+
+/** 合法表单 (5 张图先走 upload 代理拿 media_id) */
+async function fillForm(base) {
+    const media = {};
+    for (const k of ["license_media_id", "legal_id_front_media_id", "legal_id_back_media_id", "store_entrance_media_id", "store_indoor_media_id"]) {
+        const r = await fetch(base + "/api/onboard/applyment/upload", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-jpeg-" + k).toString("base64") }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, "upload " + k + ": " + JSON.stringify(j));
+        media[k] = j.media_id;
+    }
+    return {
+        subject_type: "SUBJECT_TYPE_INDIVIDUAL",
+        contact_name: "张三", contact_mobile: PLAINTEXT.mobile, contact_email: "zs@example.com",
+        merchant_shortname: "张三餐饮店", merchant_name: "深圳市张三餐饮店", license_number: "92440300MA5F00000X",
+        legal_name: "张三", legal_id_number: PLAINTEXT.id,
+        legal_id_period_begin: "2015-01-01", legal_id_period_end: "2035-01-01",
+        account_type: "BANK_ACCOUNT_TYPE_PERSONAL",
+        account_name: "张三", account_number: PLAINTEXT.card, account_bank: "招商银行",
+        store_name: "张三餐饮店南山店", store_address_code: "440300", store_address: "南山区xx路1号",
+        service_phone: "0755-12345678", settlement_id: "719", qualification_type: "零售",
+        ...media,
+    };
+}
+
+test.before(async () => {
+    await startFakeSp();
+    process.env.SP_GATEWAY_URL = spBase;
+});
+test.after(() => { if (spSrv) spSrv.close(); });
+
+test("upload 代理: 转发假 SP 拿 media_id, 凭证头正确", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const before = spCapture.uploads.length;
+        const r = await fetch(base + "/api/onboard/applyment/upload", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ filename: "id_front.jpg", content_b64: Buffer.from("fake-jpeg").toString("base64") }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200);
+        assert.match(j.media_id, /^FAKE_MEDIA_/);
+        assert.strictEqual(spCapture.uploads.length, before + 1);
+        assert.strictEqual(spCapture.uploads[before].filename, "id_front.jpg");
+    } finally { srv.close(); }
+});
+
+test("submit: 本地加密转发 (转发体无明文, 密文可还原) + 台账落行 + 幂等", async () => {
+    const { db, srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        const submitsBefore = spCapture.submits.length;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.match(j.business_code, /^TB\d{19}$/, "business_code 卖家侧本地生成 (F3)");
+        assert.ok(j.applyment_id);
+
+        // 转发体: already_encrypted + 无明文敏感
+        assert.strictEqual(spCapture.submits.length, submitsBefore + 1);
+        const fwd = spCapture.submits[submitsBefore];
+        assert.strictEqual(fwd.already_encrypted, true);
+        assert.match(fwd.tb_address || "", /^tct1[a-z0-9]{20,60}$/, "M2: payload 带商户链上地址 (引导金 recipient)");
+        const fwdStr = JSON.stringify(fwd);
+        assert.ok(!fwdStr.includes(PLAINTEXT.id), "转发体不含明文身份证");
+        assert.ok(!fwdStr.includes(PLAINTEXT.card), "转发体不含明文卡号");
+        assert.ok(!fwdStr.includes(PLAINTEXT.mobile), "转发体不含明文手机");
+        // 密文可用测试私钥还原 (证明用的是 SP 公钥 RSA-OAEP-SHA256)
+        const dec = crypto.privateDecrypt(
+            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
+            Buffer.from(fwd.legal_id_number, "base64")
+        ).toString("utf8");
+        assert.strictEqual(dec, PLAINTEXT.id);
+        // media_id 透传
+        assert.strictEqual(fwd.license_media_id, form.license_media_id);
+
+        // 台账: business_code 落行, 快照无明文, 暂存 payload 是密文
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.business_code, j.business_code);
+        assert.strictEqual(row.status, "SUBMITTED");
+        assert.ok(!row.form_snapshot.includes(PLAINTEXT.id), "快照无明文身份证");
+        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存 payload 无 plaintext");
+
+        // 幂等: 同表单再提交 → 同 business_code, 不重复调 SP
+        const r2 = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j2 = await r2.json();
+        assert.strictEqual(j2.idempotent, true);
+        assert.strictEqual(j2.business_code, j.business_code);
+        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "SP 未被重复调用");
+    } finally { srv.close(); }
+});
+
+test("status 代理: FINISHED + sign_url + sub_mchid 回页面, 台账同步", async () => {
+    const { db, srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        const sr = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const { business_code } = await sr.json();
+        const r = await fetch(base + "/api/onboard/applyment/status");
+        const j = await r.json();
+        assert.strictEqual(r.status, 200);
+        assert.strictEqual(j.status, "APPLYMENT_STATE_FINISHED");
+        assert.ok(j.sign_url.includes("pay.weixin.qq.com"));
+        assert.strictEqual(j.sub_mchid, "1600000888");
+        assert.ok(spCapture.statusQueries.includes(business_code), "按 business_code 查 SP");
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.sub_mchid, "1600000888");
+        assert.ok(row.sign_url.includes("pay.weixin.qq.com"));
+    } finally { srv.close(); }
+});
+
+test("SP 不可达: 503 友好提示 + 台账 PENDING_PUSH, 恢复后空 body 重试成功", async () => {
+    const { db, srv, base } = await startSeller();
+    try {
+        // 先上传 (SP 还在线)
+        const form = await fillForm(base);
+        // 掐断 SP
+        process.env.SP_GATEWAY_URL = "http://127.0.0.1:1";
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 503);
+        assert.strictEqual(j.error, "sp_unavailable");
+        assert.ok(j.message.includes("服务商暂时不可用"), j.message);
+        assert.strictEqual(j.pending, true);
+        // 台账 PENDING_PUSH + 密文暂存
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.status, "PENDING_PUSH");
+        assert.ok(!row.encrypted_payload.includes(PLAINTEXT.id), "暂存的是密文");
+        // 状态查询如实回 PENDING_PUSH
+        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
+        assert.strictEqual(st.status, "PENDING_PUSH");
+        // 恢复 SP → 空 body 重试
+        process.env.SP_GATEWAY_URL = spBase;
+        const submitsBefore = spCapture.submits.length;
+        const r2 = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+        });
+        const j2 = await r2.json();
+        assert.strictEqual(r2.status, 200, JSON.stringify(j2));
+        assert.match(j2.business_code, /^TB\d{19}$/);
+        assert.strictEqual(spCapture.submits.length, submitsBefore + 1, "用暂存密文重试转发了一次");
+        const row2 = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row2.status, "SUBMITTED");
+    } finally { srv.close(); }
+});
+
+test("缺必填字段 → 400; 缺 media_id → 400 指明哪张图", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 空表单
+        let r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+        });
+        assert.strictEqual(r.status, 400);
+        // 缺一张图
+        const form = await fillForm(base);
+        delete form.store_indoor_media_id;
+        r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.error, "media_missing");
+        assert.ok(j.message.includes("门店内部照片"), j.message);
+    } finally { srv.close(); }
+});
+
+test("onboard 页面含进件表单 (btn-apply-submit) 且第③步状态机元素齐", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const r = await fetch(base + "/onboard/");
+        const html = await r.text();
+        assert.strictEqual(r.status, 200);
+        assert.ok(html.includes("btn-apply-submit"), "进件提交按钮");
+        assert.ok(html.includes("apply-status"), "状态框");
+        assert.ok(html.includes("/api/onboard/applyment"), "页面打新端点");
+        // 2026-10-03: 三场景选择器 + 错误红卡
+        assert.ok(html.includes('name="sales_scene"'), "场景单选");
+        assert.ok(html.includes("SALES_SCENES_WEB") && html.includes("SALES_SCENES_MP"), "WEB/MP 场景");
+        assert.ok(html.includes("apply-err"), "错误红卡容器");
+        // 2026-10-03 二重框修复: 上传槽双态 (替换/删除按钮 + _aSlots 注册 + 删除清 media_id)
+        assert.ok(html.includes("upops") && html.includes("updel"), "替换/删除按钮结构");
+        assert.ok(html.includes("替换") && html.includes("删除"), "替换/删除文案");
+        assert.ok(html.includes("_aSlots"), "槽位双态注册表");
+        assert.ok(html.includes("delete _aMedia[field]"), "删除清 media_id");
+        assert.ok(!html.includes("slot.insertBefore(img"), "旧增强脚本预览补丁已删 (二重框根因)");
         assert.ok(html.includes("prefill:function(mediaId)"), "预填走双态 (无第二个空框)");
-        assert.ok(html.includes("maybeAutoKyc"), "M2: 进件受理后自动 KYC 提交");
-        assert.ok(!html.includes("btn-verify"), "手动实名按钮已删 (自动触发)");
-    } finally { srv.close(); }
-});
-
-/** 场景表单变体: 去掉门店字段, 换场景专属字段+照片 */
-async function fillSceneForm(base, scene) {
-    const form = await fillForm(base);
-    delete form.store_name; delete form.store_address_code; delete form.store_address;
-    delete form.store_entrance_media_id; delete form.store_indoor_media_id;
-    form.sales_scene = scene;
-    if (scene === "SALES_SCENES_WEB") {
-        form.website_url = "https://shop.example.com";
-        for (const k of ["web_home_media_id", "web_product_media_id"]) {
-            const r = await fetch(base + "/api/onboard/applyment/upload", {
-                method: "POST", headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-" + k).toString("base64") }),
-            });
-            form[k] = (await r.json()).media_id;
-        }
-    } else if (scene === "SALES_SCENES_MP") {
-        form.appid = "wx1234567890abcdef";
-        form.appid_type = "mp";
-        const r = await fetch(base + "/api/onboard/applyment/upload", {
-            method: "POST", headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filename: "mp.jpg", content_b64: Buffer.from("fake-mp").toString("base64") }),
-        });
-        form.mp_media_id = (await r.json()).media_id;
-    }
-    return form;
-}
-
-test("错误提示: 缺 store_address → 中文 message + field 定位 (2026-10-03 实测 fix)", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        delete form.store_address;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 400);
-        assert.strictEqual(j.error, "invalid_param");
-        assert.strictEqual(j.field, "store_address", "field 回传供前端高亮");
-        assert.ok(j.message.includes("门店详细地址"), "中文文案: " + j.message);
-        assert.ok(j.message.includes("(store_address)"), "带字段名: " + j.message);
-    } finally { srv.close(); }
-});
-
-test("qualification_type 留空可提交 (后端默认 '无', 2026-10-03 实测秒拒 fix)", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const form = await fillForm(base);
-        delete form.qualification_type;
-        const before = spCapture.submits.length;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        assert.strictEqual(spCapture.submits[before].qualification_type, "无", "留空默认 '无'");
-    } finally { srv.close(); }
-});
-
-test("WEB 场景: 不带门店字段可提交, SP 侧组装 web_info", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        const form = await fillSceneForm(base, "SALES_SCENES_WEB");
-        const before = spCapture.submits.length;
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        const fwd = spCapture.submits[before];
-        assert.strictEqual(fwd.sales_scene, "SALES_SCENES_WEB");
-        assert.strictEqual(fwd.website_url, "https://shop.example.com");
-        assert.ok(!fwd.store_name, "不带门店字段");
-        // SP 侧结构: sales_info.web_info.domain (F2: 微信官方字段是 domain, 无 web_pics)
-        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
-        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_WEB"]);
-        assert.strictEqual(wxBody.business_info.sales_info.web_info.domain, "https://shop.example.com");
-        assert.ok(!("web_pics" in wxBody.business_info.sales_info.web_info), "微信 web_info 无 pics 字段");
-        assert.ok(!wxBody.business_info.sales_info.biz_store_info, "无门店结构");
-        // 网址不带协议 → SP 拒
-        assert.throws(() => spApplymentLib.buildApplymentBody({ ...fwd, website_url: "shop.example.com" }, (s) => s, { alreadyEncrypted: true }), /http/);
-    } finally { srv.close(); }
-});
-
-test("MP 场景: mp_media_id 必传 + appid_type=mini 走 mini_program_info", async () => {
-    const { srv, base } = await startSeller();
-    try {
-        // 缺公众号截图 → 400 中文提示
-        const form = await fillSceneForm(base, "SALES_SCENES_MP");
-        delete form.mp_media_id;
-        let r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        let j = await r.json();
-        assert.strictEqual(r.status, 400);
-        assert.strictEqual(j.error, "media_missing");
-        assert.strictEqual(j.field, "mp_media_id");
-        assert.ok(j.message.includes("公众号/小程序页面截图"), j.message);
-        // 补齐 → 200; mini 类型 → mini_program_info
-        const form2 = await fillSceneForm(base, "SALES_SCENES_MP");
-        form2.appid_type = "mini";
-        r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form2),
-        });
-        j = await r.json();
-        assert.strictEqual(r.status, 200, JSON.stringify(j));
-        const fwd = spCapture.submits[spCapture.submits.length - 1];
-        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
-        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_MINI_PROGRAM"]);
-        assert.strictEqual(wxBody.business_info.sales_info.mini_program_info.mini_program_sub_appid, "wx1234567890abcdef");
-        // 公众号类型 → mp_info.mp_sub_appid
-        const wxBody2 = spApplymentLib.buildApplymentBody({ ...fwd, appid_type: "mp", business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
-        assert.strictEqual(wxBody2.business_info.sales_info.mp_info.mp_sub_appid, "wx1234567890abcdef");
-    } finally { srv.close(); }
-});
-
-test("端到端兼容: 卖家本机 → 真 sp-applyment 路由 (mock 微信), already_encrypted 直通成功", async () => {
-    // 起真 SP 网关代码 (微信调用 mock), admin key = 商户 token
-    process.env.SP_APPLYMENT_MOCK = "1";
-    process.env.SP_ADMIN_API_KEY = MERCHANT_TOKEN;
-    const spApplyment = require("./routes/sp-applyment");
-    const spDb = new Database(":memory:");
-    const spApp = express();
-    spApp.use(express.json());
-    spApp.use("/api/sp", spApplyment.createSpApplymentRouter({ db: spDb }));
-    const realSp = spApp.listen(0);
-    await new Promise((r) => realSp.once("listening", r));
-    const { db, srv, base } = await startSeller();
-    try {
-        process.env.SP_GATEWAY_URL = `http://127.0.0.1:${realSp.address().port}`;
-        const form = await fillForm(base);
-        const r = await fetch(base + "/api/onboard/applyment", {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
-        });
-        const j = await r.json();
-        assert.strictEqual(r.status, 200, "真 SP 路由应接受密文直通: " + JSON.stringify(j));
-        assert.match(j.business_code, /^TB\d{19}$/, "business_code 由真 SP 生成");
-        assert.strictEqual(j.applyment_id, "2000002124775691", "mock applyment_id");
-        // SP 侧台账落行
-        const spRow = spDb.prepare("SELECT * FROM sp_applyments WHERE business_code = ?").get(j.business_code);
-        assert.ok(spRow, "SP 台账落行");
-        // 状态端到端: 卖家 → 真 SP (mock FINISHED)
-        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
-        assert.strictEqual(st.status, "APPLYMENT_STATE_FINISHED");
-        assert.ok(st.sign_url);
-        // 本地台账同步 sub_mchid
-        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
-        assert.strictEqual(row.sub_mchid, "1600000999");
-    } finally {
-        srv.close(); realSp.close();
-        delete process.env.SP_APPLYMENT_MOCK;
-        delete process.env.SP_ADMIN_API_KEY;
-        process.env.SP_GATEWAY_URL = spBase;
-    }
-});
+        // 2026-10-03 MCC 修正: 经营类目下拉是真实 MCC 编码 (716/719/727 是 V2 结算规则 ID, 被微信拒)
+        assert.ok(html.includes("5311") && html.includes("5732"), "MCC 编码选项");
+        assert.ok(html.includes("百货商店") && html.includes("就餐场所和餐馆"), "MCC 名称");
+        assert.ok(!html.includes('value="719"') && !html.includes('value="716"') && !html.includes('value="727"'), "V2 错误编码已清除");
+        assert.ok(html.includes("a_settlement_filter"), "类目搜索过滤");
+        assert.ok(html.includes("a_settlement_manual") && html.includes("__MANUAL__"), "手动输入接管保留");
+        assert.ok(html.includes("maybeAutoKyc"), "M2: 进件受理后自动 KYC 提交");
+        assert.ok(!html.includes("btn-verify"), "手动实名按钮已删 (自动触发)");
+    } finally { srv.close(); }
+});
+
+/** 场景表单变体: 去掉门店字段, 换场景专属字段+照片 */
+async function fillSceneForm(base, scene) {
+    const form = await fillForm(base);
+    delete form.store_name; delete form.store_address_code; delete form.store_address;
+    delete form.store_entrance_media_id; delete form.store_indoor_media_id;
+    form.sales_scene = scene;
+    if (scene === "SALES_SCENES_WEB") {
+        form.website_url = "https://shop.example.com";
+        for (const k of ["web_home_media_id", "web_product_media_id"]) {
+            const r = await fetch(base + "/api/onboard/applyment/upload", {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ filename: k + ".jpg", content_b64: Buffer.from("fake-" + k).toString("base64") }),
+            });
+            form[k] = (await r.json()).media_id;
+        }
+    } else if (scene === "SALES_SCENES_MP") {
+        form.appid = "wx1234567890abcdef";
+        form.appid_type = "mp";
+        const r = await fetch(base + "/api/onboard/applyment/upload", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ filename: "mp.jpg", content_b64: Buffer.from("fake-mp").toString("base64") }),
+        });
+        form.mp_media_id = (await r.json()).media_id;
+    }
+    return form;
+}
+
+test("错误提示: 缺 store_address → 中文 message + field 定位 (2026-10-03 实测 fix)", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        delete form.store_address;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.error, "invalid_param");
+        assert.strictEqual(j.field, "store_address", "field 回传供前端高亮");
+        assert.ok(j.message.includes("门店详细地址"), "中文文案: " + j.message);
+        assert.ok(j.message.includes("(store_address)"), "带字段名: " + j.message);
+    } finally { srv.close(); }
+});
+
+test("qualification_type 留空可提交 (后端默认 '无', 2026-10-03 实测秒拒 fix)", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillForm(base);
+        delete form.qualification_type;
+        const before = spCapture.submits.length;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.strictEqual(spCapture.submits[before].qualification_type, "无", "留空默认 '无'");
+    } finally { srv.close(); }
+});
+
+test("WEB 场景: 不带门店字段可提交, SP 侧组装 web_info", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const form = await fillSceneForm(base, "SALES_SCENES_WEB");
+        const before = spCapture.submits.length;
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        const fwd = spCapture.submits[before];
+        assert.strictEqual(fwd.sales_scene, "SALES_SCENES_WEB");
+        assert.strictEqual(fwd.website_url, "https://shop.example.com");
+        assert.ok(!fwd.store_name, "不带门店字段");
+        // SP 侧结构: sales_info.web_info.domain (F2: 微信官方字段是 domain, 无 web_pics)
+        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_WEB"]);
+        assert.strictEqual(wxBody.business_info.sales_info.web_info.domain, "https://shop.example.com");
+        assert.ok(!("web_pics" in wxBody.business_info.sales_info.web_info), "微信 web_info 无 pics 字段");
+        assert.ok(!wxBody.business_info.sales_info.biz_store_info, "无门店结构");
+        // 网址不带协议 → SP 拒
+        assert.throws(() => spApplymentLib.buildApplymentBody({ ...fwd, website_url: "shop.example.com" }, (s) => s, { alreadyEncrypted: true }), /http/);
+    } finally { srv.close(); }
+});
+
+test("MP 场景: mp_media_id 必传 + appid_type=mini 走 mini_program_info", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 缺公众号截图 → 400 中文提示
+        const form = await fillSceneForm(base, "SALES_SCENES_MP");
+        delete form.mp_media_id;
+        let r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        let j = await r.json();
+        assert.strictEqual(r.status, 400);
+        assert.strictEqual(j.error, "media_missing");
+        assert.strictEqual(j.field, "mp_media_id");
+        assert.ok(j.message.includes("公众号/小程序页面截图"), j.message);
+        // 补齐 → 200; mini 类型 → mini_program_info
+        const form2 = await fillSceneForm(base, "SALES_SCENES_MP");
+        form2.appid_type = "mini";
+        r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form2),
+        });
+        j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        const fwd = spCapture.submits[spCapture.submits.length - 1];
+        const wxBody = spApplymentLib.buildApplymentBody({ ...fwd, business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.deepStrictEqual(wxBody.business_info.sales_info.sales_scenes_type, ["SALES_SCENES_MINI_PROGRAM"]);
+        assert.strictEqual(wxBody.business_info.sales_info.mini_program_info.mini_program_sub_appid, "wx1234567890abcdef");
+        // 公众号类型 → mp_info.mp_sub_appid
+        const wxBody2 = spApplymentLib.buildApplymentBody({ ...fwd, appid_type: "mp", business_code: "TBTEST" }, (s) => s, { alreadyEncrypted: true });
+        assert.strictEqual(wxBody2.business_info.sales_info.mp_info.mp_sub_appid, "wx1234567890abcdef");
+    } finally { srv.close(); }
+});
+
+test("端到端兼容: 卖家本机 → 真 sp-applyment 路由 (mock 微信), already_encrypted 直通成功", async () => {
+    // 起真 SP 网关代码 (微信调用 mock), admin key = 商户 token
+    process.env.SP_APPLYMENT_MOCK = "1";
+    process.env.SP_ADMIN_API_KEY = MERCHANT_TOKEN;
+    const spApplyment = require("./routes/sp-applyment");
+    const spDb = new Database(":memory:");
+    const spApp = express();
+    spApp.use(express.json());
+    spApp.use("/api/sp", spApplyment.createSpApplymentRouter({ db: spDb }));
+    const realSp = spApp.listen(0);
+    await new Promise((r) => realSp.once("listening", r));
+    const { db, srv, base } = await startSeller();
+    try {
+        process.env.SP_GATEWAY_URL = `http://127.0.0.1:${realSp.address().port}`;
+        const form = await fillForm(base);
+        const r = await fetch(base + "/api/onboard/applyment", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, "真 SP 路由应接受密文直通: " + JSON.stringify(j));
+        assert.match(j.business_code, /^TB\d{19}$/, "business_code 由真 SP 生成");
+        assert.strictEqual(j.applyment_id, "2000002124775691", "mock applyment_id");
+        // SP 侧台账落行
+        const spRow = spDb.prepare("SELECT * FROM sp_applyments WHERE business_code = ?").get(j.business_code);
+        assert.ok(spRow, "SP 台账落行");
+        // 状态端到端: 卖家 → 真 SP (mock FINISHED)
+        const st = await (await fetch(base + "/api/onboard/applyment/status")).json();
+        assert.strictEqual(st.status, "APPLYMENT_STATE_FINISHED");
+        assert.ok(st.sign_url);
+        // 本地台账同步 sub_mchid
+        const row = db.prepare("SELECT * FROM onboard_applyments ORDER BY id DESC LIMIT 1").get();
+        assert.strictEqual(row.sub_mchid, "1600000999");
+    } finally {
+        srv.close(); realSp.close();
+        delete process.env.SP_APPLYMENT_MOCK;
+        delete process.env.SP_ADMIN_API_KEY;
+        process.env.SP_GATEWAY_URL = spBase;
+    }
+});
 
 test("F1: REJECTED 后可同 business_code 覆盖重提 (卖家侧不幂等拦截)", async () => {
     const { db, srv, base } = await startSeller();
@@ -523,7 +529,7 @@ test("F4: 企业主体 id_card_address 必填 + 本机加密 + SP 组装进 id_c
         assert.notStrictEqual(fwd.legal_id_address, form.legal_id_address, "居住地址不是明文");
         assert.ok(!JSON.stringify(fwd).includes("xx路1号101室"), "转发体无明文居住地址");
         const dec = crypto.privateDecrypt(
-            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
             Buffer.from(fwd.legal_id_address, "base64")
         ).toString("utf8");
         assert.strictEqual(dec, form.legal_id_address);

package/test-sp-applyment.js

@@ -163,7 +163,7 @@ test("submit mock: 落台账 + 敏感字段加密 (非明文且可还原) + 重
         const encId = wxBody.subject_info.identity_info.id_card_info.id_card_number;
         assert.notStrictEqual(encId, form.legal_id_number, "身份证号不是明文");
         const dec = crypto.privateDecrypt(
-            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+            { key: wxPub.privateKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha1" },
             Buffer.from(encId, "base64")
         ).toString("utf8");
         assert.strictEqual(dec, form.legal_id_number, "密文可还原");