xcbyy 699d2bd951 security: 后台默认口令生产 fail-closed（修复 admin/admin 可登录的高危漏洞） ...

- 生产环境未配置 ADMIN_PASSWORD（或仍为 admin/admin123）时，后台登录直接 503 拒绝
- 启动自检新增两条告警：未配有效 ADMIN_PASSWORD、非 production 身份校验放宽
- 部署文档补充 ADMIN_PASSWORD/ADMIN_USERNAME 必配说明
- 新增回归护栏 admin-credential-hardening.spec.ts（88 套件/642 用例全绿）；冒烟 5/5

2026-10-19 13:36:36 +08:00

..

activity-create-validation.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

activity-detail-privacy.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

activity-identity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

activity-join-payment.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

activity-list-content.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

activity.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

adjust-price-integrity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

admin-credential-hardening.spec.ts

security: 后台默认口令生产 fail-closed（修复 admin/admin 可登录的高危漏洞）

2026-10-19 13:36:36 +08:00

admin-demo-data-cleanup.spec.ts

chore(admin): 清理后台静态演示数据（我的团队/最新动态/通知中心返回空）

2026-10-19 09:08:21 +08:00

admin-features.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

admin-observability.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

admin-transfer-config.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

admin-write-authz.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

auth-role.spec.ts

feat(core): 按照严格TDD模式完成活动项目(4位核销码)、订单状态机、财务分销与双身份切换核心领域服务及30项单元测试

2026-09-16 15:30:23 +08:00

auth-secret-guard.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

backfill-ownership.spec.ts

feat(data): 新增历史数据归属订正脚本（默认 dry-run，--apply 写库）

2026-10-19 08:58:24 +08:00

banner-manage.spec.ts

feat(banner): support dynamic banner management in admin and sync with miniprogram

2026-10-10 08:51:34 +08:00

barcode-qrcode.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

buyer-cancel-order.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

claim-status-gate.spec.ts

fix(order): 抢单收紧为仅「待接单」可抢，抢单池同步过滤

2026-10-19 08:54:28 +08:00

client-features.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

code2session-hardening.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

companion-apply-ownership.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

companion-category.spec.ts

feat(companion): 全面确立以陪吃·陪喝·陪唱为主的核心架构，重构首屏推荐阵容与歌声试听

2026-09-16 20:16:56 +08:00

companion-detail-privacy.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

companion-order.spec.ts

feat(order): complete 7.1 order full lifecycle state transitions, 15m/30m/48h auto-timeouts, expert reject/apply-complete, and partial refund arbitration

2026-10-14 15:52:56 +08:00

companion-profile-honesty.spec.ts

fix(companion): 去除合成虚拟大神的假评分/价格/服务（改为诚实档案）

2026-10-19 09:19:15 +08:00

companions-directory-privacy.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

content-check-auth.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

content-security.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

cors-security-headers.spec.ts

security: CORS 收敛为白名单 + 基础安全响应头 + 隐藏技术栈

2026-10-19 09:31:44 +08:00

dashboard-reality.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

distribution-no-fake.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

expert-stats-scope.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

faq-config-repair.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

finance.spec.ts

feat(core): 按照严格TDD模式完成活动项目(4位核销码)、订单状态机、财务分销与双身份切换核心领域服务及30项单元测试

2026-09-16 15:30:23 +08:00

funds-identity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

help-faq-page.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

identity-binding-hardening.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

identity-hardening.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

list-pagination-index.spec.ts

perf(db): 高频查询补索引 + 大列表加合理上限（避免全表下发）

2026-10-19 09:28:02 +08:00

login-hardening.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

marketing.spec.ts

feat(marketing): implement recharge tiers and coupon management across admin, server, and uniapp

2026-10-10 09:22:46 +08:00

mini-program-expert-grab.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

mini-program-identity-and-referral.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

mini-program-no-fake-success.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

nav-category.spec.ts

feat(nav-category): support dynamic home grid categories in admin and uniapp

2026-10-10 09:08:18 +08:00

no-emoji.spec.ts

fix(theme): 修复浅色主题下大神昵称白底白字及标签对比度过低问题，消除黑底黑字与样式失效缺陷

2026-09-16 20:39:02 +08:00

order-activity-integrity.spec.ts

fix(order): 抢单收紧为仅「待接单」可抢，抢单池同步过滤

2026-10-19 08:54:28 +08:00

order-amount-integrity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

order-lifecycle-hardening.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

order-progress-gates.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

order-state-machine.spec.ts

feat(core): 按照严格TDD模式完成活动项目(4位核销码)、订单状态机、财务分销与双身份切换核心领域服务及30项单元测试

2026-09-16 15:30:23 +08:00

order-timeout-scheduler.spec.ts

feat(order): 订单超时自动流转改为后台定时任务

2026-10-19 09:22:52 +08:00

orders-pool-filter.spec.ts

fix(order): 抢单收紧为仅「待接单」可抢，抢单池同步过滤

2026-10-19 08:54:28 +08:00

ownership-hardening.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

payment-amount-integrity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

phone-login-identity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

platform-config.spec.ts

feat(auth): compact agreement layout to single-line and support flexible backend configuration for user agreement and privacy policy

2026-10-12 09:20:40 +08:00

protocol-page.spec.ts

feat(mini): 平台规范与服务协议页面化（页内切换，替代弹窗）

2026-10-17 18:04:33 +08:00

rbac-permission.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

read-access-contract.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

read-scope.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

recharge-bonus-authority.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

request-and-checkin-lookup.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

review-comment.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

review-post-identity.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

safety-places.spec.ts

feat(safety): support full CRUD for approved commercial places and dynamic sync to uniapp

2026-10-10 09:52:42 +08:00

security-hardening.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

settings-file-location.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

settlement-credit-user.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

settlement-gate.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

skeleton.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

startup-selfcheck.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

subscribe-authorization.spec.ts

feat(mini): 下单/提现/报名前补订阅消息授权（提升微信服务通知到达率）

2026-10-19 09:01:36 +08:00

subscribe-message.spec.ts

fix(subscribe): 订阅消息未下发原因可见 + 小程序真实授权

2026-10-19 10:02:57 +08:00

subscription-message-diagnose.spec.ts

fix(subscribe): 修复小程序授权"未获得提醒授权"——避免授权弹窗与公告弹窗重叠

2026-10-19 11:36:12 +08:00

theme.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

upload-auth.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

upload.spec.ts

feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据

2026-10-09 17:18:14 +08:00

user-detail-scope.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

user-read-privacy.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

verify-pool-hardening.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

wallet-records-scope.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00

wechat-appid-config-hardening.spec.ts

fix(config): 占位凭证清理改为一次性(标记位保护)，避免误清管理员填写的真实 AppID

2026-10-19 11:00:23 +08:00

wechat-pay-v3.spec.ts

feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

2026-10-16 17:38:17 +08:00

wechat-refund.spec.ts

feat(pay): 接入微信支付V3原路退款（按支付渠道分流 + 幂等 + 退款回调）

2026-10-19 08:47:08 +08:00

withdrawal-transfer.spec.ts

feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地

2026-10-17 18:00:09 +08:00