trustbase-seller-backend 0.4.2 → 0.4.4

package/audit-page-scripts.js

@@ -0,0 +1,59 @@
+// 全页面 JS 体检: 抓取所有 HTML 页面的内联脚本并逐一编译 (抓 0.4.1 那类模板转义回归)
+const express = require("express");
+const Database = require("better-sqlite3");
+const path = require("path");
+const fs = require("fs");
+
+function compileScripts(name, html) {
+    const blocks = [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi)];
+    if (!blocks.length) { console.log(`-- ${name}: 无内联脚本`); return 0; }
+    let bad = 0;
+    blocks.forEach((b, i) => {
+        try { new Function(b[1]); console.log(`OK ${name} script#${i + 1} (${b[1].length} chars)`); }
+        catch (e) {
+            bad++;
+            console.log(`FAIL ${name} script#${i + 1}: ${e.message}`);
+            const lines = b[1].split("\n");
+            // 用 node --check 精确定位
+            fs.writeFileSync(path.join(__dirname, `audit-${name}-${i + 1}.js`), b[1]);
+        }
+    });
+    return bad;
+}
+
+(async () => {
+    let fails = 0;
+    const db = new Database(":memory:");
+    process.env.SP_ADMIN_API_KEY = process.env.SP_ADMIN_API_KEY || "audit-key";
+
+    // 1) onboard.html (磁盘直读)
+    const onboardHtml = fs.readFileSync(path.join(__dirname, "routes", "onboard.html"), "utf8");
+    fails += compileScripts("onboard.html", onboardHtml);
+
+    // 2) 起 mock server 抓动态页
+    const app = express();
+    app.use(express.json({ limit: "20mb" }));
+    app.use("/api/sp", require("./routes/sp-applyment").createSpApplymentRouter({ db }));
+    app.use("/m2m", require("./routes/m2m-viewer").createM2MViewerRouter({ db }));
+    const srv = await new Promise((r) => { const s = app.listen(0, () => r(s)); });
+    const base = `http://127.0.0.1:${srv.address().port}`;
+    const H = { Accept: "text/html" };
+
+    for (const [name, url] of [
+        ["sp-config", base + "/api/sp/config"],
+        ["sp-apply", base + "/api/sp/apply"],
+        ["m2m-viewer", base + "/m2m"],
+    ]) {
+        try {
+            const r = await fetch(url, { headers: H });
+            const html = await r.text();
+            console.log(`\n== ${name}: HTTP ${r.status} (${html.length} chars)`);
+            if (r.status === 200 && html.includes("<")) fails += compileScripts(name, html);
+        } catch (e) { console.log(`\n== ${name}: FETCH FAIL ${e.message}`); }
+    }
+    srv.close();
+
+    // 3) run-unified.js 里可能还有别的内联 HTML — 搜 res.send 模板
+    console.log(`\n== 总计: ${fails} 个脚本块编译失败`);
+    process.exit(fails ? 1 : 0);
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/sp-applyment.js

@@ -458,6 +458,8 @@ h1{font-size:20px;margin-bottom:4px}
 .chips{display:flex;gap:8px;flex-wrap:wrap;margin-bottom:16px}
 .chip{font-size:12px;border-radius:999px;padding:5px 12px;border:1px solid #EAE3D6;background:#FCFAF4;color:#8A857B}
 .chip.ok{background:#F0FDF4;border-color:#BBF7D0;color:#166534}
+.hd{display:flex;justify-content:space-between;align-items:flex-start;gap:12px}
+.hd .upbtn{margin-top:6px}
 .box{background:#FCFAF4;border:1px solid #EAE3D6;border-radius:14px;padding:18px;margin-bottom:14px}
 .box h3{font-size:15px;color:#C4633C;margin-bottom:10px}
 label{display:block;font-size:13px;color:#6B655B;margin:10px 0 4px}
@@ -490,8 +492,10 @@ input:focus,select:focus{outline:none;border-color:#C4633C;box-shadow:0 0 0 3px
 </head>
 <body>
 <div class="wrap">
+<div class="hd"><div>
 <h1>服务商配置</h1>
 <div class="sub">TrustBase 服务商运营台 · 应用/名片/状态 一屏三件事</div>
+</div><button class="upbtn" onclick="logout()" title="清除本机保存的管理密钥，下次进入需重新输入">退出登录</button></div>
 
 <div id="toast"></div>
 
@@ -562,6 +566,13 @@ function busy(btn,on,txtBusy){
   else{btn.disabled=false;btn.textContent=btn.dataset.txt||btn.textContent;}
 }
 
+// 退出登录: 清掉本机 localStorage 里的 admin key, 刷新后重新输入 (2026-09-28 xiaomu 实测: 页面无退出入口)
+function logout(){
+  localStorage.removeItem('spAdminKey');
+  showToast(true,'已退出，即将重新验证密钥');
+  setTimeout(function(){location.reload();},700);
+}
+
 function render(){
   var c=CFG, comp=c.completeness;
   document.getElementById('chips').innerHTML=
@@ -1064,7 +1075,8 @@ adminKey(); // 打开即要 key (后续 API 都要带)
 function createSpApplymentRouter(deps) {
     const router = express.Router();
     const { db } = deps;
-    ensureApplymentTables(db);
+    ensureApplymentTables(db);
+    ensureSpApps(db); // 0.4.2: 路由创建即建表 — 修 POST /apps 在 GET 之前调用时 "no such table: sp_apps" (node-c 实测)
 
     /** admin 鉴权: env 未配置 → 全部拒绝 (401); 配置了 → header 精确比对 (同 sp-commission 口径) */
     function checkAdmin(req, res) {

package/test-sp-applyment.js

@@ -547,6 +547,22 @@ test("多应用: CRUD + 默认唯一 + 旧配置自动迁移 + /info apps 列表
     } finally { srv.close(); }
 });
 
+test("回归 0.4.2: 全新库直接 POST /apps (不先 GET) 不能报 no such table — node-c 实测坑", async () => {
+    const { srv, base } = await startServer();
+    try {
+        // startServer 每次新起 :memory: 库; 直接写, 不允许依赖 GET 懒建表
+        const r = await fetch(base + "/api/sp/apps", {
+            method: "POST", headers: H,
+            body: JSON.stringify({ name: "首个应用", appid: "wx_fresh_001", type: "app" }),
+        });
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, JSON.stringify(j));
+        assert.strictEqual(j.ok, true);
+        assert.strictEqual(j.apps.length, 1);
+        assert.strictEqual(j.apps[0].is_default, true, "首个应用自动默认");
+    } finally { srv.close(); }
+});
+
 test("配置页操作反馈: toast 组件 + 成功/失败文案 + 保存中禁用 (页面断言)", async () => {
     const { srv, base } = await startServer();
     try {
@@ -563,6 +579,9 @@ test("配置页操作反馈: toast 组件 + 成功/失败文案 + 保存中禁
         assert.ok(html.includes("r.json.message"), "失败显示后端 message 原文");
         // 保存中禁用
         assert.ok(html.includes("busy(btn,true)") && html.includes("保存中…"), "保存中禁用+文案");
+        // 退出登录入口 (0.4.4): 清 localStorage 密钥 + 刷新
+        assert.ok(html.includes("退出登录") && html.includes("function logout()"), "退出登录按钮+函数");
+        assert.ok(html.includes("removeItem('spAdminKey')"), "logout 清密钥");
         // 所有 mutating 操作接入: 应用保存/设默认/删除/素材上传/名片保存
         for (const fn of ["saveApp", "setDefault", "delApp", "upFormAsset", "saveProfile"]) {
             assert.ok(html.includes(fn), fn + " 存在");