xcbyy
d06bf11740
security: 危险兜底默认关闭(secure by default)——修复 NODE_ENV 未设导致的身份伪造/沙箱支付/隐私泄露
根因：线上 NODE_ENV 未设为 production 时，以下"开发兜底"全部自动生效：
- resolveSecureUserId 信任客户端声明的 userId → 任意用户身份伪造
- ALLOW_SANDBOX_PAY = ... || !IS_PRODUCTION → 无真实收款即可推进订单（资损）
- GET /api/users/:id 按"本人"返回余额/佣金/手机号 → 隐私泄露
修复（兜底改为必须显式开启）：
- 新增 ALLOW_INSECURE_DEV_AUTH（默认 false）；resolveSecureUserId 改为 `if (IS_PRODUCTION || !ALLOW_INSECURE_DEV_AUTH) 401`
- ALLOW_SANDBOX_PAY 改为仅 `process.env.ALLOW_SANDBOX_PAY === '1'`
- assertCompanionActor 与用户资料"本人视角"兜底加 ALLOW_INSECURE_DEV_AUTH 限制
- /api/health 新增 mode 与 sandboxPayAllowed；启动自检打印两个危险开关并告警
- 文档补充危险开关说明（生产禁止开启）
验证：本地模拟 NODE_ENV 未设 → 通知/订单/下单 均 401、用户资料不泄露隐私、沙箱支付关闭；
开启 ALLOW_INSECURE_DEV_AUTH=1 后联调能力保留；production 模式行为一致。（冒烟 13/13）
新增 secure-default-auth.spec.ts（103 套件/696 用例全绿）
2026-10-20 16:35:04 +08:00
..
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-09 17:18:14 +08:00
2026-10-09 17:18:14 +08:00
2026-10-17 18:00:09 +08:00
2026-10-20 16:35:04 +08:00
2026-10-20 15:52:04 +08:00
2026-10-16 17:38:17 +08:00
2026-10-16 17:38:17 +08:00
2026-10-20 15:52:04 +08:00
2026-10-19 14:08:58 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-09-16 15:30:23 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 08:58:24 +08:00
2026-10-10 08:51:34 +08:00
2026-10-09 17:18:14 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 08:54:28 +08:00
2026-10-16 17:38:17 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-09-16 20:16:56 +08:00
2026-10-17 18:00:09 +08:00
2026-10-14 15:52:56 +08:00
2026-10-19 09:19:15 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 15:05:56 +08:00
2026-10-19 09:31:44 +08:00
2026-10-20 15:01:50 +08:00
2026-10-19 15:16:32 +08:00
2026-10-19 16:00:37 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 14:46:05 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-09-16 15:30:23 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-16 17:38:17 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 09:28:02 +08:00
2026-10-17 18:00:09 +08:00
2026-10-10 09:22:46 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-10 09:08:18 +08:00
2026-09-16 20:39:02 +08:00
2026-10-19 14:31:11 +08:00
2026-10-19 15:51:23 +08:00
2026-10-19 08:54:28 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-09-16 15:30:23 +08:00
2026-10-19 09:22:52 +08:00
2026-10-19 08:54:28 +08:00
2026-10-16 17:38:17 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-12 09:20:40 +08:00
2026-10-17 18:04:33 +08:00
2026-10-19 13:39:04 +08:00
2026-10-19 13:50:51 +08:00
2026-10-16 17:38:17 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-09 17:18:14 +08:00
2026-10-17 18:00:09 +08:00
2026-10-20 16:04:09 +08:00
2026-10-10 09:52:42 +08:00
2026-10-19 15:10:11 +08:00
2026-10-20 16:35:04 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-09 17:18:14 +08:00
2026-10-20 16:35:04 +08:00
2026-10-19 09:01:36 +08:00
2026-10-19 10:02:57 +08:00
2026-10-19 11:36:12 +08:00
2026-10-20 15:01:50 +08:00
2026-10-20 14:00:27 +08:00
2026-10-09 17:18:14 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 13:50:51 +08:00
2026-10-19 15:05:56 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-17 18:00:09 +08:00
2026-10-19 11:00:23 +08:00
2026-10-16 17:38:17 +08:00
2026-10-19 08:47:08 +08:00
2026-10-17 18:00:09 +08:00