fix: block legacy SMS auth providers in readiness

scripts/production-readiness-check-test.js

@@ -340,6 +340,68 @@ assert.ok(
   mismatchedSmsProviderFixture.payload.checks?.some(item => item.id === 'db.auth_sms_provider_configured' && item.status === 'blocker'),
   'readiness should block env/provider mismatch',
 );
+assert.ok(
+  mismatchedSmsProviderFixture.payload.checks?.some(item => item.id === 'db.auth.aliyun.legacy_sms_provider' && item.status === 'blocker'),
+  'readiness should block active traditional Aliyun SMS auth provider rows',
+);
+
+const legacyTencentSmsProviderFixture = runReadiness(
+  `
+NODE_ENV=production
+DATABASE_URL=postgresql://prod_user:prod_password@db.prod.internal:5432/tiku
+CORS_ORIGIN=https://student.gongxue100.com,https://tenant-admin.gongxue100.com,https://platform-admin.gongxue100.com
+AUTH_SMS_PROVIDER=aliyun-pnvs
+AUTH_CODE_PEPPER=${strongSecretA}
+AUTH_SESSION_SECRET=${strongSecretB}
+AUTH_JWT_JWKS_URL=https://auth.gongxue100.com/auth/v1/.well-known/jwks.json
+AUTH_JWT_ISSUER=https://auth.gongxue100.com/auth/v1
+ALLOW_LEGACY_AUTH_HEADERS=false
+ALLOW_PLATFORM_ADMIN_KEY=false
+PLATFORM_ADMIN_API_KEY=${strongSecretC}
+STORAGE_DEFAULT_PROVIDER=aliyun_oss
+STORAGE_DEFAULT_BUCKET=tiku-assets
+STORAGE_REQUIRE_TENANT_PREFIX=true
+ALIYUN_OSS_REGION=cn-hangzhou
+ALIYUN_OSS_ENDPOINT=https://oss-cn-hangzhou.aliyuncs.com
+ALIYUN_OSS_ACCESS_KEY_ID=LTAI_READINESS_TEST_ONLY
+ALIYUN_OSS_ACCESS_KEY_SECRET=aliyun-readiness-secret-placeholder
+WORKER_ASSET_SECURITY_SCANNER=metadata_rules,http
+WORKER_ASSET_SECURITY_SCAN_HTTP_ENDPOINT=https://scanner.gongxue100.com/api/scan
+WORKER_ASSET_SECURITY_SCAN_HTTP_TOKEN=s3cure-asset-scanner-token-2026-06-29-stuvwx
+WORKER_ASSET_SECURITY_SCAN_FAIL_OPEN=false
+`,
+  {
+    providerRows: [
+      {
+        source: 'auth',
+        tenantId: 'tenant-tencent',
+        provider: 'tencent-sms',
+        configPublic: {
+          smsSdkAppId: '1400000000',
+          signName: '短信签名',
+          templateId: '123456',
+        },
+      },
+      {
+        source: 'auth',
+        tenantId: 'tenant-pnvs',
+        provider: 'aliyun-pnvs',
+        configPublic: {
+          signName: '短信签名',
+          templateCode: 'SMS_123456789',
+          endpoint: 'https://dypnsapi.aliyuncs.com',
+          templateParam: { code: '##code##', min: '5' },
+        },
+      },
+    ],
+  },
+);
+
+assert.notEqual(legacyTencentSmsProviderFixture.status, 0, 'readiness should fail when Tencent SMS auth provider rows remain active');
+assert.ok(
+  legacyTencentSmsProviderFixture.payload.checks?.some(item => item.id === 'db.auth.tencent-sms.legacy_sms_provider' && item.status === 'blocker'),
+  'readiness should block active Tencent SMS auth provider rows',
+);
 
 const unsafeProviderFixture = runReadiness(
   `

scripts/production-readiness-check.js

@@ -255,19 +255,11 @@ function validateAuthProviderPublicConfig(row) {
   }
 
   if (providerIn(provider, AUTH_PROVIDER_ALIASES.aliyun)) {
-    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+    block(
-      { label: 'signName', keys: ['signName'] },
+      `db.auth.${safeProviderName(row.provider)}.legacy_sms_provider`,
-      { label: 'templateCode', keys: ['templateCode'] },
+      'Traditional Aliyun SMS auth provider must not be active/testing in production; use aliyun-pnvs',
-    ]));
-    validateProviderUrl({
-      id: `db.auth.${safeProviderName(row.provider)}.endpoint`,
-      value: publicString(configPublic, ['endpoint']),
-      allowedHosts: ['aliyuncs.com'],
       details,
-    });
+    );
-    if (!publicString(configPublic, ['regionId'])) {
-      warn(`db.auth.${safeProviderName(row.provider)}.region`, 'Aliyun SMS regionId is not set; default cn-hangzhou will be used', details);
-    }
     return;
   }
 
@@ -296,20 +288,11 @@ function validateAuthProviderPublicConfig(row) {
   }
 
   if (providerIn(provider, AUTH_PROVIDER_ALIASES.tencent)) {
-    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+    block(
-      { label: 'smsSdkAppId/appId', keys: ['smsSdkAppId', 'appId'] },
+      `db.auth.${safeProviderName(row.provider)}.legacy_sms_provider`,
-      { label: 'signName', keys: ['signName'] },
+      'Tencent SMS auth provider must not be active/testing in production; use aliyun-pnvs',
-      { label: 'templateId', keys: ['templateId'] },
-    ]));
-    validateProviderUrl({
-      id: `db.auth.${safeProviderName(row.provider)}.endpoint`,
-      value: publicString(configPublic, ['endpoint']),
-      allowedHosts: ['tencentcloudapi.com'],
       details,
-    });
+    );
-    if (!publicString(configPublic, ['region'])) {
-      warn(`db.auth.${safeProviderName(row.provider)}.region`, 'Tencent SMS region is not set; default ap-guangzhou will be used', details);
-    }
     return;
   }