trustbase-seller-backend 0.4.1 → 0.4.3

package/audit-page-scripts.js

@@ -0,0 +1,59 @@
+// 全页面 JS 体检: 抓取所有 HTML 页面的内联脚本并逐一编译 (抓 0.4.1 那类模板转义回归)
+const express = require("express");
+const Database = require("better-sqlite3");
+const path = require("path");
+const fs = require("fs");
+
+function compileScripts(name, html) {
+    const blocks = [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi)];
+    if (!blocks.length) { console.log(`-- ${name}: 无内联脚本`); return 0; }
+    let bad = 0;
+    blocks.forEach((b, i) => {
+        try { new Function(b[1]); console.log(`OK ${name} script#${i + 1} (${b[1].length} chars)`); }
+        catch (e) {
+            bad++;
+            console.log(`FAIL ${name} script#${i + 1}: ${e.message}`);
+            const lines = b[1].split("\n");
+            // 用 node --check 精确定位
+            fs.writeFileSync(path.join(__dirname, `audit-${name}-${i + 1}.js`), b[1]);
+        }
+    });
+    return bad;
+}
+
+(async () => {
+    let fails = 0;
+    const db = new Database(":memory:");
+    process.env.SP_ADMIN_API_KEY = process.env.SP_ADMIN_API_KEY || "audit-key";
+
+    // 1) onboard.html (磁盘直读)
+    const onboardHtml = fs.readFileSync(path.join(__dirname, "routes", "onboard.html"), "utf8");
+    fails += compileScripts("onboard.html", onboardHtml);
+
+    // 2) 起 mock server 抓动态页
+    const app = express();
+    app.use(express.json({ limit: "20mb" }));
+    app.use("/api/sp", require("./routes/sp-applyment").createSpApplymentRouter({ db }));
+    app.use("/m2m", require("./routes/m2m-viewer").createM2MViewerRouter({ db }));
+    const srv = await new Promise((r) => { const s = app.listen(0, () => r(s)); });
+    const base = `http://127.0.0.1:${srv.address().port}`;
+    const H = { Accept: "text/html" };
+
+    for (const [name, url] of [
+        ["sp-config", base + "/api/sp/config"],
+        ["sp-apply", base + "/api/sp/apply"],
+        ["m2m-viewer", base + "/m2m"],
+    ]) {
+        try {
+            const r = await fetch(url, { headers: H });
+            const html = await r.text();
+            console.log(`\n== ${name}: HTTP ${r.status} (${html.length} chars)`);
+            if (r.status === 200 && html.includes("<")) fails += compileScripts(name, html);
+        } catch (e) { console.log(`\n== ${name}: FETCH FAIL ${e.message}`); }
+    }
+    srv.close();
+
+    // 3) run-unified.js 里可能还有别的内联 HTML — 搜 res.send 模板
+    console.log(`\n== 总计: ${fails} 个脚本块编译失败`);
+    process.exit(fails ? 1 : 0);
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/sp-applyment.js

@@ -595,8 +595,8 @@ function renderSlots(){
     return '<div class="slot"><div class="t">'+kk[1]+'</div>'
       +(mid?'<div class="mid">✓ '+esc(maskMid(mid))+'</div>':'')
       +'<img id="img-'+kk[0]+'" style="display:none">'
-      +'<label class="upbtn">'+(mid?'替换':'点击上传')+'<input type="file" accept="image/*" style="display:none" onchange="upFormAsset(event,\x27'+kk[0]+'\x27)"></label>'
-      +(mid?'<button class="upbtn del" onclick="formAssets[\x27'+kk[0]+'\x27]=\x27\x27;renderSlots()">删除</button>':'')
+      +'<label class="upbtn">'+(mid?'替换':'点击上传')+'<input type="file" accept="image/*" style="display:none" onchange="upFormAsset(event,\\x27'+kk[0]+'\\x27)"></label>'
+      +(mid?'<button class="upbtn del" onclick="formAssets[\\x27'+kk[0]+'\\x27]=\\x27\\x27;renderSlots()">删除</button>':'')
       +'</div>';
   }).join('');
 }
@@ -1064,7 +1064,8 @@ adminKey(); // 打开即要 key (后续 API 都要带)
 function createSpApplymentRouter(deps) {
     const router = express.Router();
     const { db } = deps;
-    ensureApplymentTables(db);
+    ensureApplymentTables(db);
+    ensureSpApps(db); // 0.4.2: 路由创建即建表 — 修 POST /apps 在 GET 之前调用时 "no such table: sp_apps" (node-c 实测)
 
     /** admin 鉴权: env 未配置 → 全部拒绝 (401); 配置了 → header 精确比对 (同 sp-commission 口径) */
     function checkAdmin(req, res) {

package/test-sp-applyment.js

@@ -435,7 +435,13 @@ test("SP 配置页后端: config 读写 (表优先 env) + 配齐度 + info 立
         // 页面: Accept text/html 无 key 也 200 (admin key 页面内输入)
         r = await fetch(base + "/sp/config", { headers: { Accept: "text/html" } });
         assert.strictEqual(r.status, 200);
-        assert.ok((await r.text()).includes("服务商配置"));
+        const pageHtml = await r.text();
+        assert.ok(pageHtml.includes("服务商配置"));
+        // 回归 (0.4.2): 页面内联脚本必须可编译 — 模板里 \x27 会被服务端提前求值成双引号导致整页 JS 死掉 (保存按钮无反应),
+        //  必须用 \\x27 让浏览器拿到字面 \x27 再自行求值
+        const scriptMatch = pageHtml.match(/<script>([\s\S]*?)<\/script>/);
+        assert.ok(scriptMatch, "配置页应有内联脚本");
+        new Function(scriptMatch[1]); // 语法错误会抛
         // 读默认 (env 兜底)
         let j = await (await fetch(base + "/api/sp/config", { headers: { ...H, Accept: "application/json" } })).json();
         assert.strictEqual(j.ok, true);
@@ -541,6 +547,22 @@ test("多应用: CRUD + 默认唯一 + 旧配置自动迁移 + /info apps 列表
     } finally { srv.close(); }
 });
 
+test("回归 0.4.2: 全新库直接 POST /apps (不先 GET) 不能报 no such table — node-c 实测坑", async () => {
+    const { srv, base } = await startServer();
+    try {
+        // startServer 每次新起 :memory: 库; 直接写, 不允许依赖 GET 懒建表
+        const r = await fetch(base + "/api/sp/apps", {
+            method: "POST", headers: H,
+            body: JSON.stringify({ name: "首个应用", appid: "wx_fresh_001", type: "app" }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.strictEqual(j.ok, true);
+        assert.strictEqual(j.apps.length, 1);
+        assert.strictEqual(j.apps[0].is_default, true, "首个应用自动默认");
+    } finally { srv.close(); }
+});
+
 test("配置页操作反馈: toast 组件 + 成功/失败文案 + 保存中禁用 (页面断言)", async () => {
     const { srv, base } = await startServer();
     try {