trustbase-seller-backend 0.4.2 → 0.4.3

package/audit-page-scripts.js

@@ -0,0 +1,59 @@
+// 全页面 JS 体检: 抓取所有 HTML 页面的内联脚本并逐一编译 (抓 0.4.1 那类模板转义回归)
+const express = require("express");
+const Database = require("better-sqlite3");
+const path = require("path");
+const fs = require("fs");
+
+function compileScripts(name, html) {
+    const blocks = [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi)];
+    if (!blocks.length) { console.log(`-- ${name}: 无内联脚本`); return 0; }
+    let bad = 0;
+    blocks.forEach((b, i) => {
+        try { new Function(b[1]); console.log(`OK ${name} script#${i + 1} (${b[1].length} chars)`); }
+        catch (e) {
+            bad++;
+            console.log(`FAIL ${name} script#${i + 1}: ${e.message}`);
+            const lines = b[1].split("\n");
+            // 用 node --check 精确定位
+            fs.writeFileSync(path.join(__dirname, `audit-${name}-${i + 1}.js`), b[1]);
+        }
+    });
+    return bad;
+}
+
+(async () => {
+    let fails = 0;
+    const db = new Database(":memory:");
+    process.env.SP_ADMIN_API_KEY = process.env.SP_ADMIN_API_KEY || "audit-key";
+
+    // 1) onboard.html (磁盘直读)
+    const onboardHtml = fs.readFileSync(path.join(__dirname, "routes", "onboard.html"), "utf8");
+    fails += compileScripts("onboard.html", onboardHtml);
+
+    // 2) 起 mock server 抓动态页
+    const app = express();
+    app.use(express.json({ limit: "20mb" }));
+    app.use("/api/sp", require("./routes/sp-applyment").createSpApplymentRouter({ db }));
+    app.use("/m2m", require("./routes/m2m-viewer").createM2MViewerRouter({ db }));
+    const srv = await new Promise((r) => { const s = app.listen(0, () => r(s)); });
+    const base = `http://127.0.0.1:${srv.address().port}`;
+    const H = { Accept: "text/html" };
+
+    for (const [name, url] of [
+        ["sp-config", base + "/api/sp/config"],
+        ["sp-apply", base + "/api/sp/apply"],
+        ["m2m-viewer", base + "/m2m"],
+    ]) {
+        try {
+            const r = await fetch(url, { headers: H });
+            const html = await r.text();
+            console.log(`\n== ${name}: HTTP ${r.status} (${html.length} chars)`);
+            if (r.status === 200 && html.includes("<")) fails += compileScripts(name, html);
+        } catch (e) { console.log(`\n== ${name}: FETCH FAIL ${e.message}`); }
+    }
+    srv.close();
+
+    // 3) run-unified.js 里可能还有别的内联 HTML — 搜 res.send 模板
+    console.log(`\n== 总计: ${fails} 个脚本块编译失败`);
+    process.exit(fails ? 1 : 0);
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/sp-applyment.js

@@ -1064,7 +1064,8 @@ adminKey(); // 打开即要 key (后续 API 都要带)
 function createSpApplymentRouter(deps) {
     const router = express.Router();
     const { db } = deps;
-    ensureApplymentTables(db);
+    ensureApplymentTables(db);
+    ensureSpApps(db); // 0.4.2: 路由创建即建表 — 修 POST /apps 在 GET 之前调用时 "no such table: sp_apps" (node-c 实测)
 
     /** admin 鉴权: env 未配置 → 全部拒绝 (401); 配置了 → header 精确比对 (同 sp-commission 口径) */
     function checkAdmin(req, res) {

package/test-sp-applyment.js

@@ -547,6 +547,22 @@ test("多应用: CRUD + 默认唯一 + 旧配置自动迁移 + /info apps 列表
     } finally { srv.close(); }
 });
 
+test("回归 0.4.2: 全新库直接 POST /apps (不先 GET) 不能报 no such table — node-c 实测坑", async () => {
+    const { srv, base } = await startServer();
+    try {
+        // startServer 每次新起 :memory: 库; 直接写, 不允许依赖 GET 懒建表
+        const r = await fetch(base + "/api/sp/apps", {
+            method: "POST", headers: H,
+            body: JSON.stringify({ name: "首个应用", appid: "wx_fresh_001", type: "app" }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.strictEqual(j.ok, true);
+        assert.strictEqual(j.apps.length, 1);
+        assert.strictEqual(j.apps[0].is_default, true, "首个应用自动默认");
+    } finally { srv.close(); }
+});
+
 test("配置页操作反馈: toast 组件 + 成功/失败文案 + 保存中禁用 (页面断言)", async () => {
     const { srv, base } = await startServer();
     try {