From 8f69838007ee9a2f22113a714ab2c3d003087421 Mon Sep 17 00:00:00 2001
From: Codex <codex@gongxue100.local>
Date: Fri, 3 Jul 2026 23:02:36 +0800
Subject: [PATCH] test: warn on PNVS template placeholder drift

---
 scripts/production-readiness-check-test.js | 48 ++++++++++++++++++++++
 scripts/production-readiness-check.js      | 13 ++++++
 2 files changed, 61 insertions(+)

diff --git a/scripts/production-readiness-check-test.js b/scripts/production-readiness-check-test.js
index a96856bd..1b6b87fc 100644
--- a/scripts/production-readiness-check-test.js
+++ b/scripts/production-readiness-check-test.js
@@ -165,6 +165,54 @@ WORKER_PUBLIC_BANK_SYNC_BATCH_SIZE=5
 assert.equal(safeAliyunPnvs.status, 0, `aliyun-pnvs readiness should pass without blockers: ${safeAliyunPnvs.stdout} ${safeAliyunPnvs.stderr}`);
 assert.equal(safeAliyunPnvs.payload.summary?.blocker, 0, 'aliyun-pnvs readiness should have no blockers');
 
+const pnvsTemplateParamWarning = runReadiness(
+  `
+NODE_ENV=production
+DATABASE_URL=postgresql://prod_user:prod_password@db.prod.internal:5432/tiku
+CORS_ORIGIN=https://student.gongxue100.com,https://tenant-admin.gongxue100.com,https://platform-admin.gongxue100.com
+AUTH_SMS_PROVIDER=aliyun-pnvs
+AUTH_CODE_PEPPER=${strongSecretA}
+AUTH_SESSION_SECRET=${strongSecretB}
+AUTH_JWT_JWKS_URL=https://auth.gongxue100.com/auth/v1/.well-known/jwks.json
+AUTH_JWT_ISSUER=https://auth.gongxue100.com/auth/v1
+ALLOW_LEGACY_AUTH_HEADERS=false
+ALLOW_PLATFORM_ADMIN_KEY=false
+PLATFORM_ADMIN_API_KEY=${strongSecretC}
+STORAGE_DEFAULT_PROVIDER=aliyun_oss
+STORAGE_DEFAULT_BUCKET=tiku-assets
+STORAGE_REQUIRE_TENANT_PREFIX=true
+ALIYUN_OSS_REGION=cn-hangzhou
+ALIYUN_OSS_ENDPOINT=https://oss-cn-hangzhou.aliyuncs.com
+ALIYUN_OSS_ACCESS_KEY_ID=LTAI_READINESS_TEST_ONLY
+ALIYUN_OSS_ACCESS_KEY_SECRET=aliyun-readiness-secret-placeholder
+WORKER_ASSET_SECURITY_SCANNER=metadata_rules,http
+WORKER_ASSET_SECURITY_SCAN_HTTP_ENDPOINT=https://scanner.gongxue100.com/api/scan
+WORKER_ASSET_SECURITY_SCAN_HTTP_TOKEN=s3cure-asset-scanner-token-2026-06-29-stuvwx
+WORKER_ASSET_SECURITY_SCAN_FAIL_OPEN=false
+`,
+  {
+    providerRows: [
+      {
+        source: 'auth',
+        tenantId: 'tenant-pnvs',
+        provider: 'aliyun-pnvs',
+        configPublic: {
+          signName: '短信签名',
+          templateCode: 'SMS_123456789',
+          endpoint: 'https://dypnsapi.aliyuncs.com',
+          templateParam: { min: '5' },
+        },
+      },
+    ],
+  },
+);
+
+assert.equal(pnvsTemplateParamWarning.status, 0, 'PNVS templateParam warning should not block readiness');
+assert.ok(
+  pnvsTemplateParamWarning.payload.checks?.some(item => item.id === 'db.auth.aliyun-pnvs.template_param' && item.status === 'warn'),
+  'readiness should warn when PNVS templateParam lacks ##code##',
+);
+
 const unsafeProviderFixture = runReadiness(
   `
 NODE_ENV=production
diff --git a/scripts/production-readiness-check.js b/scripts/production-readiness-check.js
index 0e099fe4..90047d65 100644
--- a/scripts/production-readiness-check.js
+++ b/scripts/production-readiness-check.js
@@ -204,6 +204,12 @@ function missingPublicKeyGroups(configPublic, groups) {
     .map(group => group.label);
 }
 
+function pnvsTemplateParamHasCodePlaceholder(configPublic) {
+  const value = configPublic?.templateParam;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return true;
+  return Object.values(value).some(item => String(item) === '##code##');
+}
+
 function blockMissingPublicConfig(row, missing) {
   if (missing.length === 0) return;
   block(
@@ -258,6 +264,13 @@ function validateAuthProviderPublicConfig(row) {
     if (!publicString(configPublic, ['regionId'])) {
       warn(`db.auth.${safeProviderName(row.provider)}.region`, 'Aliyun PNVS regionId is not set; default cn-hangzhou will be used', details);
     }
+    if (!pnvsTemplateParamHasCodePlaceholder(configPublic)) {
+      warn(
+        `db.auth.${safeProviderName(row.provider)}.template_param`,
+        'Aliyun PNVS templateParam should include ##code##; backend will add code placeholder automatically',
+        details,
+      );
+    }
     return;
   }