From 27ee85bc946af552d3739821c2d7b3c754e303ee Mon Sep 17 00:00:00 2001 From: Codex Date: Fri, 3 Jul 2026 23:22:18 +0800 Subject: [PATCH] test: lock PNVS SMS verification boundary --- scripts/aliyun-pnvs-provider-contract-test.js | 5 +++++ scripts/deploy/README.md | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/scripts/aliyun-pnvs-provider-contract-test.js b/scripts/aliyun-pnvs-provider-contract-test.js index 0af6598f..024a8625 100644 --- a/scripts/aliyun-pnvs-provider-contract-test.js +++ b/scripts/aliyun-pnvs-provider-contract-test.js @@ -10,6 +10,7 @@ const providerDoc = fs.readFileSync(path.join(process.cwd(), 'docs/refactor/auth const launchChecklist = fs.readFileSync(path.join(process.cwd(), 'docs/refactor/web-launch-acceptance-checklist.md'), 'utf8'); const readinessSource = fs.readFileSync(path.join(process.cwd(), 'scripts/production-readiness-check.js'), 'utf8'); const tenantProviderConfigSource = fs.readFileSync(path.join(process.cwd(), 'apps/api/src/core/tenant-provider-config.ts'), 'utf8'); +const platformDunningNotificationWorker = fs.readFileSync(path.join(process.cwd(), 'apps/worker/src/jobs/platform-dunning-notifications.ts'), 'utf8'); assert.match(providerSource, /class AliyunPnvsSmsProvider/, 'PNVS provider class should exist'); assert.match(providerSource, /SendSmsVerifyCode/, 'PNVS provider should call SendSmsVerifyCode'); @@ -19,12 +20,16 @@ assert.match(providerSource, /##code##/, 'PNVS provider should preserve Aliyun-g assert.match(routeSource, /aliyun-pnvs/, 'auth routes should recognize aliyun-pnvs aliases'); assert.match(routeSource, /verification.*provider/s, 'auth routes should store provider verification mode'); assert.match(routeSource, /provider\.verify/, 'auth routes should delegate PNVS verification to provider'); +assert.match(routeSource, /export async function bindPhoneRoute[\s\S]*activeSmsProvider[\s\S]*consumeSmsCode/, 'phone binding should reuse active SMS provider verification'); +assert.match(routeSource, /purpose !== 'bind_phone'/, 'phone binding should require bind_phone purpose'); assert.match(tenantProviderConfigSource, /normalized === 'aliyun-pnvs'[\s\S]*return 'sms'/, 'PNVS secrets should default to sms scope'); assert.match(tenantAdminRouteSource, /normalized === 'aliyun-pnvs'[\s\S]*return 'sms'/, 'tenant admin PNVS secrets should default to sms scope'); assert.match(deployEnvExample, /AUTH_SMS_PROVIDER=aliyun-pnvs/, 'deploy env example should prefer aliyun-pnvs'); assert.match(readinessSource, /aliyunPnvs/, 'production readiness should validate aliyun-pnvs public config'); assert.match(providerDoc, /SendSmsVerifyCode/, 'provider doc should document PNVS send action'); assert.match(providerDoc, /CheckSmsVerifyCode/, 'provider doc should document PNVS verify action'); +assert.match(providerDoc, /PNVS 只用于手机号登录和 `bind_phone`/, 'provider doc should constrain PNVS to verification-code auth flows'); +assert.doesNotMatch(platformDunningNotificationWorker, /aliyun-pnvs|SendSmsVerifyCode|CheckSmsVerifyCode/, 'platform dunning notifications must not use PNVS verification APIs'); assert.match(launchChecklist, /AUTH_SMS_PROVIDER=aliyun-pnvs/, 'launch checklist should allow aliyun-pnvs'); console.log('[PASS] Aliyun PNVS provider contract'); diff --git a/scripts/deploy/README.md b/scripts/deploy/README.md index 4b4930b9..da012604 100644 --- a/scripts/deploy/README.md +++ b/scripts/deploy/README.md @@ -149,7 +149,7 @@ Taro H5 构建存在 webpack asset size warning，这是前端包体优化事项 2026-07-03 最新接管状态： -- Gitea `main` 已包含 PNVS 短信认证、后台登录修复和旧题库视觉对齐版本，最新提交应至少是 `8f69838`。 +- Gitea `main` 已包含 PNVS 短信认证、后台登录修复、PNVS provider 配置脚本和旧题库视觉对齐版本，最新提交应至少是 `f8f8316`。 - 服务器仓库仍在 `/opt/tiku-saas/repo`，归属用户应为 `deploy:deploy`。 - 生产 API 已能启动，`https://api.tjszsb.com/api/tenant/resolve?host=app.tjszsb.com` 已返回 `master` 租户。 - Supabase self-hosted 运行在 `/opt/tiku-saas/supabase-project`，Kong 通过 Nginx 暴露到 `https://supabase.tjszsb.com`。