feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

server/tests/client-features.spec.ts

@@ -159,6 +159,24 @@ describe('ClientFeatures (TDD 测试套件: 用户端功能闭环)', () => {
       expect(content).toContain('signature');
       expect(content).toContain('contentSecurityService.checkText');
     });
+
+    it('后端 index.ts POST /api/users/:id/profile 必须校验手机号与微信号格式并拦截非法输入', () => {
+      const indexPath = path.join(serverSrcDir, 'index.ts');
+      const content = fs.readFileSync(indexPath, 'utf-8');
+
+      expect(content).toContain('1[3-9]');
+      expect(content).toContain('a-zA-Z');
+      expect(content).toContain('联系方式格式不正确');
+    });
+
+    it('前端 user/index.vue 必须集成联系方式格式校验与非法标点过滤', () => {
+      const userVuePath = path.join(uniPagesDir, 'user', 'index.vue');
+      const content = fs.readFileSync(userVuePath, 'utf-8');
+
+      expect(content).toContain('validateContact');
+      expect(content).toContain('onPhoneInput');
+      expect(content).toContain('field-label-row');
+    });
   });
 
   describe('4. 前端核心页面规范与结构完整性校验', () => {
@@ -488,8 +506,26 @@ describe('ClientFeatures (TDD 测试套件: 用户端功能闭环)', () => {
       const indexContent = fs.readFileSync(indexVuePath, 'utf-8');
       expect(indexContent).toContain('PENDING_INVITER_CODE');
     });
+
+    it('3.4 已封禁用户核心业务防线：后端仓储与路由必须全面拦截发单、报名、下单与动态评论', () => {
+      const serverIndexPath = path.join(serverSrcDir, 'index.ts');
+      const indexContent = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(indexContent).toContain('assertUserNotBanned');
+      expect(indexContent).toContain('您的账号已被管理员封禁');
+
+      const repoPath = path.join(serverSrcDir, 'db', 'repository.ts');
+      const repoContent = fs.readFileSync(repoPath, 'utf-8');
+      expect(repoContent).toContain("WHERE (u.status IS NULL OR u.status != '已封禁')");
+      expect(repoContent).toContain("UPDATE activities SET status = 'CANCELLED' WHERE creator_id = ? AND status = 'RECRUITING'");
+
+      const rolePath = path.join(rootDir, 'pwuniapp', 'common', 'role.js');
+      const roleContent = fs.readFileSync(rolePath, 'utf-8');
+      expect(roleContent).toContain('isUserBanned');
+      expect(roleContent).toContain("uInfo.status === '已封禁'");
+    });
   });
 });
 
 
 
+