trustbase-seller-backend 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/sp-applyment.js

@@ -595,8 +595,8 @@ function renderSlots(){
     return '<div class="slot"><div class="t">'+kk[1]+'</div>'
       +(mid?'<div class="mid">✓ '+esc(maskMid(mid))+'</div>':'')
       +'<img id="img-'+kk[0]+'" style="display:none">'
-      +'<label class="upbtn">'+(mid?'替换':'点击上传')+'<input type="file" accept="image/*" style="display:none" onchange="upFormAsset(event,\x27'+kk[0]+'\x27)"></label>'
-      +(mid?'<button class="upbtn del" onclick="formAssets[\x27'+kk[0]+'\x27]=\x27\x27;renderSlots()">删除</button>':'')
+      +'<label class="upbtn">'+(mid?'替换':'点击上传')+'<input type="file" accept="image/*" style="display:none" onchange="upFormAsset(event,\\x27'+kk[0]+'\\x27)"></label>'
+      +(mid?'<button class="upbtn del" onclick="formAssets[\\x27'+kk[0]+'\\x27]=\\x27\\x27;renderSlots()">删除</button>':'')
       +'</div>';
   }).join('');
 }

package/test-sp-applyment.js

@@ -435,7 +435,13 @@ test("SP 配置页后端: config 读写 (表优先 env) + 配齐度 + info 立
         // 页面: Accept text/html 无 key 也 200 (admin key 页面内输入)
         r = await fetch(base + "/sp/config", { headers: { Accept: "text/html" } });
         assert.strictEqual(r.status, 200);
-        assert.ok((await r.text()).includes("服务商配置"));
+        const pageHtml = await r.text();
+        assert.ok(pageHtml.includes("服务商配置"));
+        // 回归 (0.4.2): 页面内联脚本必须可编译 — 模板里 \x27 会被服务端提前求值成双引号导致整页 JS 死掉 (保存按钮无反应),
+        //  必须用 \\x27 让浏览器拿到字面 \x27 再自行求值
+        const scriptMatch = pageHtml.match(/<script>([\s\S]*?)<\/script>/);
+        assert.ok(scriptMatch, "配置页应有内联脚本");
+        new Function(scriptMatch[1]); // 语法错误会抛
         // 读默认 (env 兜底)
         let j = await (await fetch(base + "/api/sp/config", { headers: { ...H, Accept: "application/json" } })).json();
         assert.strictEqual(j.ok, true);