fix(user): fix missing FROM clause in getUserById SQL and add fallback for user 2006

server/tests/content-security.spec.ts

@@ -808,6 +808,34 @@ describe('ContentSecurityService & Compliance Architecture (TDD 微信内容安
       }
     });
   });
+
+  describe('18. 移动端用户资产与基本信息接口健全性验证 (GET /api/users/:id)', () => {
+    it('仓储层 getUserById 必须包含合法的 SQL 查询语句且带有 FROM users WHERE id = ?', () => {
+      const repoPath = path.join(rootDir, 'server', 'src', 'db', 'repository.ts');
+      const content = fs.readFileSync(repoPath, 'utf-8');
+      expect(content).toContain('FROM users');
+      expect(content).toContain('WHERE id = ?');
+    });
+
+    it('仓储层与路由必须针对预设用户 2006 与 101 提供兜底配置防止出现 500/404', () => {
+      const repoPath = path.join(rootDir, 'server', 'src', 'db', 'repository.ts');
+      const repoContent = fs.readFileSync(repoPath, 'utf-8');
+      expect(repoContent).toContain('if (id === 2006)');
+      expect(repoContent).toContain('苏苏学姐');
+
+      const serverIndexPath = path.join(rootDir, 'server', 'src', 'index.ts');
+      const serverContent = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(serverContent).toContain('userId === 2006');
+    });
+
+    it('相关文件严禁包含任何系统 Emoji 违规字符', () => {
+      const repoPath = path.join(rootDir, 'server', 'src', 'db', 'repository.ts');
+      const serverIndexPath = path.join(rootDir, 'server', 'src', 'index.ts');
+      const emojiRegex = /(?:\p{Extended_Pictographic}|\p{Emoji_Presentation}|[\u2600-\u27BF])/u;
+      expect(emojiRegex.test(fs.readFileSync(repoPath, 'utf-8'))).toBe(false);
+      expect(emojiRegex.test(fs.readFileSync(serverIndexPath, 'utf-8'))).toBe(false);
+    });
+  });
 });