fix: complete platform admin audit remediation

backend/api/cmd/resource-contract/main.go

@@ -17,6 +17,7 @@ type route struct {
 type contract struct {
 	Domain   string `json:"domain"`
 	Name     string `json:"name"`
+	Path     string `json:"path"`
 	PageKind string `json:"pageKind"`
 	Mode     string `json:"mode"`
 }
@@ -36,7 +37,7 @@ func main() {
 	expected := platform.ExpectedResources()
 	contracts := make([]contract, 0, len(expected))
 	for _, item := range expected {
-		contracts = append(contracts, contract{Domain: item.Domain, Name: item.Name, PageKind: item.PageKind, Mode: string(item.Mode)})
+		contracts = append(contracts, contract{Domain: item.Domain, Name: item.Name, Path: item.Path, PageKind: item.PageKind, Mode: string(item.Mode)})
 	}
 	if err := json.NewEncoder(os.Stdout).Encode(manifest{Resources: contracts, Routes: routes}); err != nil {
 		panic(err)

backend/api/internal/logic/platform/resource.go

@@ -19,6 +19,7 @@ const (
 type ResourceContract struct {
 	Domain   string
 	Name     string
+	Path     string
 	PageKind string
 	Mode     ResourceMode
 }
@@ -69,51 +70,42 @@ func filterFields(values map[string]any, allowedFields []string) gin.H {
 // ExpectedResources returns the complete platform-admin resource catalogue.
 func ExpectedResources() []ResourceContract {
 	return []ResourceContract{
-		{Domain: "gas", Name: "gas_basic", Mode: Writable, PageKind: "list"},
+		resourceContract("gas", "gas_basic", Writable, "list"), resourceContract("gas", "gas_account", Writable, "list"),
-		{Domain: "gas", Name: "gas_account", Mode: Writable, PageKind: "list"},
+		resourceContract("delivery", "delivery_basic", Writable, "list"), resourceContract("delivery", "delivery_account", Writable, "list"),
-		{Domain: "delivery", Name: "delivery_basic", Mode: Writable, PageKind: "list"},
+		resourceContract("staff", "staff_account", Writable, "list"), resourceContract("staff", "staff_credential", Writable, "list"),
-		{Domain: "delivery", Name: "delivery_account", Mode: Writable, PageKind: "list"},
+		resourceContract("user", "user_account", Writable, "list"), resourceContract("user", "user_address", Writable, "list"), resourceContract("user", "user_service_relation", Writable, "list"),
-		{Domain: "staff", Name: "staff_account", Mode: Writable, PageKind: "list"},
+		resourceContract("device", "dev_smart_cylinder_valve", Writable, "list"), resourceContract("device", "dev_device_binding", Writable, "list"), resourceContract("device", "dev_telemetry", ReadOnly, "list"),
-		{Domain: "staff", Name: "staff_credential", Mode: Writable, PageKind: "list"},
+		resourceContract("safety", "saf_rule", Writable, "list"), resourceContract("safety", "saf_event", Writable, "list"), resourceContract("safety", "saf_inspection", Writable, "list"), resourceContract("safety", "saf_event_disposal", AppendOnly, "list"),
-		{Domain: "user", Name: "user_account", Mode: Writable, PageKind: "list"},
+		resourceContract("ec", "ec_category", Writable, "list"), resourceContract("ec", "ec_product", Writable, "list"), resourceContract("ec", "ec_product_attribute", Writable, "list"), resourceContract("ec", "ec_product_image", Writable, "list"), resourceContract("ec", "ec_cart", Writable, "list"), resourceContract("ec", "ec_order", Writable, "list"), resourceContract("ec", "ec_order_item", Writable, "list"), resourceContract("ec", "ec_review", Writable, "list"),
-		{Domain: "user", Name: "user_address", Mode: Writable, PageKind: "list"},
+		resourceContract("delivery", "delivery_task", Writable, "list"), resourceContract("delivery", "delivery_track", Writable, "list"), resourceContract("delivery", "delivery_track_point", Writable, "list"),
-		{Domain: "user", Name: "user_service_relation", Mode: Writable, PageKind: "list"},
+		resourceContract("finance", "fin_payment", Writable, "list"), resourceContract("finance", "fin_settlement", Writable, "list"), resourceContract("finance", "fin_reconciliation", Writable, "list"),
-		{Domain: "device", Name: "dev_smart_cylinder_valve", Mode: Writable, PageKind: "list"},
+		resourceContract("content", "cnt_content", Writable, "list"), resourceContract("notification", "ntf_template", Writable, "list"), resourceContract("customer_service", "cs_ticket", Writable, "list"),
-		{Domain: "device", Name: "dev_device_binding", Mode: Writable, PageKind: "list"},
+		resourceContract("platform", "platfrom_account", Writable, "list"), resourceContract("platform", "platform_role", Writable, "list"), resourceContract("platform", "platform_menu", Writable, "tree"),
-		{Domain: "safety", Name: "saf_rule", Mode: Writable, PageKind: "list"},
+		resourceContract("wallet", "wallet", ReadOnly, "list"), resourceContract("wallet", "wallet_ledger", ReadOnly, "list"), resourceContract("wallet", "wallet_recharge", ReadOnly, "list"), resourceContract("wallet", "wallet_withdrawal", ReadOnly, "list"),
-		{Domain: "safety", Name: "saf_event", Mode: Writable, PageKind: "list"},
+		resourceContract("report", "report", ReadOnly, "list"), resourceContract("report", "report_item", ReadOnly, "list"), resourceContract("report", "report_metric_snapshot", ReadOnly, "list"),
-		{Domain: "safety", Name: "saf_inspection", Mode: Writable, PageKind: "list"},
+		resourceContract("audit", "aud_operation_log", ReadOnly, "list"), resourceContract("audit", "aud_export_log", ReadOnly, "list"), resourceContract("audit", "aud_approval", ReadOnly, "list"),
-		{Domain: "ec", Name: "ec_category", Mode: Writable, PageKind: "list"},
+	}
-		{Domain: "ec", Name: "ec_product", Mode: Writable, PageKind: "list"},
+}
-		{Domain: "ec", Name: "ec_product_attribute", Mode: Writable, PageKind: "list"},
+
-		{Domain: "ec", Name: "ec_product_image", Mode: Writable, PageKind: "list"},
+func resourceContract(domain, name string, mode ResourceMode, pageKind string) ResourceContract {
-		{Domain: "ec", Name: "ec_cart", Mode: Writable, PageKind: "list"},
+	return ResourceContract{Domain: domain, Name: name, Path: resourcePath(domain, name), Mode: mode, PageKind: pageKind}
-		{Domain: "ec", Name: "ec_order", Mode: Writable, PageKind: "list"},
+}
-		{Domain: "ec", Name: "ec_order_item", Mode: Writable, PageKind: "list"},
+
-		{Domain: "ec", Name: "ec_review", Mode: Writable, PageKind: "list"},
+func resourcePath(domain, name string) string {
-		{Domain: "delivery", Name: "delivery_task", Mode: Writable, PageKind: "list"},
+	switch name {
-		{Domain: "delivery", Name: "delivery_track", Mode: Writable, PageKind: "list"},
+	case "staff_account":
-		{Domain: "delivery", Name: "delivery_track_point", Mode: Writable, PageKind: "list"},
+		return "/staff/account"
-		{Domain: "finance", Name: "fin_payment", Mode: Writable, PageKind: "list"},
+	case "staff_credential":
-		{Domain: "finance", Name: "fin_settlement", Mode: Writable, PageKind: "list"},
+		return "/staff/credential"
-		{Domain: "finance", Name: "fin_reconciliation", Mode: Writable, PageKind: "list"},
+	case "user_account":
-		{Domain: "content", Name: "cnt_content", Mode: Writable, PageKind: "list"},
+		return "/user/account"
-		{Domain: "notification", Name: "ntf_template", Mode: Writable, PageKind: "list"},
+	case "user_address":
-		{Domain: "customer_service", Name: "cs_ticket", Mode: Writable, PageKind: "list"},
+		return "/user/address"
-		{Domain: "platform", Name: "platfrom_account", Mode: Writable, PageKind: "list"},
+	case "user_service_relation":
-		{Domain: "platform", Name: "platform_role", Mode: Writable, PageKind: "list"},
+		return "/user/service_relation"
-		{Domain: "platform", Name: "platform_menu", Mode: Writable, PageKind: "tree"},
+	case "saf_event_disposal":
-		{Domain: "device", Name: "dev_telemetry", Mode: ReadOnly, PageKind: "list"},
+		return "/safety/saf_event/:identity/disposals"
-		{Domain: "wallet", Name: "wallet", Mode: ReadOnly, PageKind: "list"},
+	default:
-		{Domain: "wallet", Name: "wallet_ledger", Mode: ReadOnly, PageKind: "list"},
+		return "/" + domain + "/" + name
-		{Domain: "wallet", Name: "wallet_recharge", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "wallet", Name: "wallet_withdrawal", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "report", Name: "report", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "report", Name: "report_item", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "report", Name: "report_metric_snapshot", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "audit", Name: "aud_operation_log", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "audit", Name: "aud_export_log", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "audit", Name: "aud_approval", Mode: ReadOnly, PageKind: "list"},
-		{Domain: "safety", Name: "saf_event_disposal", Mode: AppendOnly, PageKind: "list"},
 	}
 }

backend/api/internal/routers/platform_test.go

@@ -4,9 +4,36 @@ import (
 	"net/http"
 	"testing"
 
+	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/platform"
 	"github.com/gin-gonic/gin"
 )
 
+func TestEveryContractHasRegisteredRoute(t *testing.T) {
+	engine := gin.New()
+	RegisterPlatform("heqi", engine)
+	routes := make(map[string]map[string]bool)
+	for _, route := range engine.Routes() {
+		if routes[route.Path] == nil {
+			routes[route.Path] = make(map[string]bool)
+		}
+		routes[route.Path][route.Method] = true
+	}
+	for _, contract := range platform.ExpectedResources() {
+		path := "/heqi/platform/v1" + contract.Path
+		switch contract.Mode {
+		case platform.ReadOnly:
+			assertRouteMethods(t, routes, path, http.MethodGet)
+			assertRouteMethods(t, routes, path+"/:identity", http.MethodGet)
+		case platform.AppendOnly:
+			assertRouteMethods(t, routes, path, http.MethodPost)
+		default:
+			assertRouteMethods(t, routes, path, http.MethodGet, http.MethodPost)
+			assertRouteMethods(t, routes, path+"/:identity", http.MethodGet, http.MethodPut, http.MethodDelete)
+			assertRouteMethods(t, routes, path+"/:identity/status", http.MethodPatch)
+		}
+	}
+}
+
 func TestPlatformGasRouteUsesGasBasic(t *testing.T) {
 	engine := gin.New()
 	RegisterPlatform("heqi", engine)

docs/平台总后台审计报告-2026-07-27.md

@@ -0,0 +1,54 @@
+# 平台总后台审计报告（2026-07-27）
+
+## 范围与结论
+
+本次审计覆盖 46 个平台后台资源：34 个可写资源、11 个只读资源和 1 个仅追加的安全事件处置资源。后端资源契约现同时声明领域、资源名、HTTP 路径、页面类型和读写模式，并由运行时注册路由生成清单。前端审计据此逐项校验后端路由、前端资源声明、实际加载的页面组件和带菜单元数据的路由；任一层缺失均以 `领域/资源: missing <layer>` 失败。
+
+## 发现与处置
+
+| 发现 | 处置 | 验证 |
+| --- | --- | --- |
+| 只读页面的静态检查未覆盖状态变更调用 | 将 `resourceApi.updateStatus` 纳入只读页的变更操作集合，同时覆盖 create、update、archive | `audit-check.test.mjs` 的只读页用例 |
+| 前端资源与后端路由只按资源名和文件名进行粗略匹配 | `ResourceContract.Path` 成为唯一后端路径声明；审计逐项校验 GET/POST/PUT/PATCH/DELETE（按资源模式）以及资源路径一致性 | Go 的 `TestEveryContractHasRegisteredRoute` 和 `pnpm audit:platform` |
+| 页面存在但未被菜单路由实际加载时可能漏检 | 审计读取全部路由模块，解析页面动态导入，再确认页面通过 `getResource(契约路径)` 使用对应资源且路由具有 `menu.platform.*` 元数据 | `audit-check.test.mjs` 的菜单映射用例 |
+| API 或页面可能展示、提交数据库自增 `id` / `*_id` | 对 `src/api` 与 `src/views` 全量扫描；详情页的显式过滤逻辑被识别为防护而非泄漏 | `pnpm audit:platform` |
+
+## 身份字段与保留理由
+
+- 对外 HTTP 仅使用 `identity` 及关联的 `*_identity`；数据库主键 `id` 和关系外键 `*_id` 仍用于 GORM 关联、索引和内部查询，并由响应投影剔除，不能删除。
+- `status`、`version`、`created_at`、`updated_at` 是归档、乐观并发和审计所需实体元数据，予以保留。
+- `product_snapshot`、`report_metric_snapshot` 保留历史商品及报表快照，避免后续主数据变更影响历史记录。
+- 审计的 `before_data`、`after_data`、`operator_identity`，以及审批的 `handler_identity`、`handled_at` 用于追踪处置人和决策，不可作为冗余清除。
+
+## 冗余清理
+
+未删除模型字段或页面。审计没有找到同时满足“不在需求、无后端调用、无前端消费者、无测试或迁移依赖”的候选项；为避免移除潜在兼容入口，保留现有非契约文件，且不将它们纳入菜单与资源契约。
+
+## 验证命令
+
+以下命令在提交前执行：
+
+```powershell
+cd backend/api
+go test ./...
+go build ./cmd/main
+go test ./internal/routers -run '^TestEveryContractHasRegisteredRoute$' -v
+
+cd ../../frontend/platform_admin
+node --test scripts/audit-check.test.mjs
+pnpm type:check
+pnpm lint
+pnpm audit:platform
+pnpm build
+```
+
+| 命令 | 退出码 | 结果 |
+| --- | --- | --- |
+| `go test ./...` | 0 | 通过 |
+| `go build ./cmd/main` | 0 | 通过 |
+| `go test ./internal/routers -run '^TestEveryContractHasRegisteredRoute$' -v` | 0 | 通过 |
+| `node --test scripts/audit-check.test.mjs` | 0 | 通过，3 个审计用例 |
+| `pnpm type:check` | 0 | 通过 |
+| `pnpm audit:platform` | 0 | 通过 |
+| `pnpm build` | 0 | 通过 |
+| `pnpm lint` | 1 | 阻塞：Biome 配置在本目录要求 `.gitignore`。以 `--vcs-root=../..` 启动后发现 187 个既有全仓格式/未使用变量错误；未将无关全仓格式化混入本次审计修复。 |

frontend/platform_admin/scripts/audit-check.mjs

@@ -4,50 +4,106 @@ import path from 'node:path';
 import vm from 'node:vm';
 import ts from 'typescript';
 
-const backendDirectory = path.resolve('../..', 'backend/api');
-const manifest = JSON.parse(execFileSync('go', ['run', './cmd/resource-contract'], { cwd: backendDirectory, encoding: 'utf8' }));
-let responseShapeVerified = true;
-try {
-  execFileSync('go', ['test', '-count=1', './internal/logic/platform', '-run', '^TestListGasAccountProjectsGasBasicIdentityAndNeverReturnsRelationID$'], { cwd: backendDirectory, stdio: 'pipe' });
-} catch {
-  responseShapeVerified = false;
-}
-const compiled = ts.transpileModule(fs.readFileSync('src/api/resources.ts', 'utf8'), { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020 } }).outputText;
-const resourceModule = { exports: {} };
-vm.runInNewContext(compiled, { module: resourceModule, exports: resourceModule.exports });
-const resources = resourceModule.exports.resources;
 const files = (dir) => fs.existsSync(dir) ? fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() ? files(path.join(dir, entry.name)) : [path.join(dir, entry.name)]) : [];
-const failures = [];
+const sourceFiles = (dir, extensions = ['.ts', '.vue']) => new Map(files(dir).filter((file) => extensions.includes(path.extname(file))).map((file) => [file.replaceAll('\\', '/'), fs.readFileSync(file, 'utf8')]));
-if (!responseShapeVerified) failures.push('backend list response shape is not identity-only');
+const mutationActions = (source) => [...source.matchAll(/resourceApi\.(create|update|updateStatus|archive)\b/g)].map((match) => match[1]);
-const expected = manifest.resources;
+
-if (resources.length !== expected.length) failures.push(`catalogue count: ${resources.length}/${expected.length}`);
+function requiredBackendRoutes(contract) {
-for (const contract of expected) {
+  if (contract.mode === 'append_only') return [{ method: 'POST', path: contract.path }];
-  const resource = resources.find((item) => item.name === contract.name);
+  const resource = contract.path;
-  const pageKind = contract.name === 'ec_category' ? 'tree' : contract.pageKind;
+  const detail = `${resource}/:identity`;
-  if (!resource || resource.mode !== contract.mode || resource.pageKind !== pageKind) { failures.push(`${contract.name}: contract mismatch`); continue; }
+  if (contract.mode === 'readonly') return [{ method: 'GET', path: resource }, { method: 'GET', path: detail }];
-  if (!/^[\u4e00-\u9fff]/.test(resource.title) || resource.fields.some((field) => !/^[\u4e00-\u9fff]/.test(field.label))) failures.push(`${contract.name}: missing Chinese business labels`);
+  return [
-  if (resource.fields.length === 0 || resource.fields.some((field) => field.key === 'id' || field.key.endsWith('_id'))) failures.push(`${contract.name}: invalid allowlist`);
+    { method: 'GET', path: resource }, { method: 'POST', path: resource }, { method: 'GET', path: detail },
-  const method = resource.mode === 'append_only' ? 'POST' : 'GET';
+    { method: 'PUT', path: detail }, { method: 'PATCH', path: `${detail}/status` }, { method: 'DELETE', path: detail },
-  if (!manifest.routes.some((route) => route.method === method && route.path === resource.resource)) failures.push(`${contract.name}: resource route mismatch`);
+  ];
-  if (resource.mode === 'readonly') {
+}
-    const view = files('src/views').find((file) => file.includes(resource.name) && file.endsWith('ListPage.vue'));
+
-    if (!view || !fs.readFileSync(view, 'utf8').includes('ReadOnlyListPage')) failures.push(`${contract.name}: readonly UI`);
+function routeCoverage(contract, routeSources, viewSources) {
+  const expectedView = new RegExp(`getResource\\(\\s*['\"]${escapeRegExp(contract.path)}['\"]\\s*\\)`);
+  let hasPage = false;
+  let hasMenu = false;
+  for (const source of routeSources) {
+    for (const match of source.matchAll(/component:\s*\(\)\s*=>\s*import\(['\"]@\/views\/([^'\"]+)['\"]\)([\s\S]{0,260}?meta:\s*\{[^}]*\})?/g)) {
+      const view = viewSources.get(`src/views/${match[1]}`);
+      if (!view || !expectedView.test(view)) continue;
+      hasPage = true;
+      if (/locale:\s*['\"]menu\.platform\./.test(match[2] ?? '')) hasMenu = true;
+    }
   }
+  return { hasPage, hasMenu };
 }
-if (JSON.stringify(resources.map((item) => item.name).sort()) !== JSON.stringify(expected.map((item) => item.name).sort())) failures.push('catalogue names differ from backend ExpectedResources');
+
-for (const name of ['ec_category', 'platform_menu']) { const view = files('src/views').find((file) => file.includes(name) && file.endsWith('TreePage.vue')); if (!view) failures.push(`${name}: tree page missing`); }
+function escapeRegExp(value) {
-const tree = fs.readFileSync('src/views/shared/TreePage.vue', 'utf8');
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-if (!tree.includes('parent_identity') || !tree.includes('canWrite') || !tree.includes('resourceApi.create') || !tree.includes('resourceApi.update')) failures.push('tree: writable identity actions missing');
-if (/(?:['"`]id['"`]|\bparent_id\b|\.id\b)/.test(tree)) failures.push('tree: internal id key leaked');
-const readOnlyPage = fs.readFileSync('src/views/shared/ReadOnlyListPage.vue', 'utf8');
-if (/resourceApi\.(?:create|update|archive)\b/.test(readOnlyPage)) failures.push('readonly: mutation action exposed');
-for (const detailPage of ['src/views/shared/CrudListPage.vue', 'src/views/shared/ReadOnlyListPage.vue']) {
-  const source = fs.readFileSync(detailPage, 'utf8');
-  if (!source.includes("key !== 'id'") || !source.includes("key.endsWith('_id')")) failures.push(`${detailPage}: internal ids shown in detail`);
 }
-const event = resources.find((resource) => resource.name === 'saf_event');
+
-const disposal = resources.find((resource) => resource.name === 'saf_event_disposal');
+/** Scans user-facing API and view sources for auto-increment primary or relation IDs. */
-if (!event?.detailActions?.some((action) => action.name === 'saf_event_disposal' && action.resource.includes(':identity/disposals'))) failures.push('saf_event_disposal: detail action missing');
+export function scanInternalIdLeaks(sources) {
-if (!disposal || disposal.resource !== '/safety/saf_event/:identity/disposals' || files('src/views').some((file) => file.includes('saf_event_disposal'))) failures.push('saf_event_disposal: independent page exposed');
+  const failures = [];
-for (const failure of failures) console.log(failure);
+  for (const [file, source] of sources) {
-if (failures.length) process.exitCode = 1;
+    for (const line of source.split(/\r?\n/)) {
+      // These are defensive filters that explicitly remove IDs from details, not leaks.
+      if (line.includes("key !== 'id'") || line.includes("key.endsWith('_id')")) continue;
+      const relation = line.match(/\b([A-Za-z][A-Za-z0-9_]*_id)\b/);
+      if (relation) failures.push(`${file}: internal identifier ${relation[1]}`);
+      else if (/\bdata-index\s*=\s*['\"]id['\"]|\.id\b|[,{]\s*id\s*:/.test(line)) failures.push(`${file}: internal identifier id`);
+    }
+  }
+  return failures;
+}
+
+/** Evaluates every platform contract against its backend route, UI definition, page and menu route. */
+export function auditPlatform({ manifest, resources, readOnlyPage, routeSources, viewSources, apiSources, responseShapeVerified = true }) {
+  const failures = [];
+  if (!responseShapeVerified) failures.push('backend list response shape is not identity-only');
+  if (resources.length !== manifest.resources.length) failures.push(`catalogue count: ${resources.length}/${manifest.resources.length}`);
+  for (const contract of manifest.resources) {
+    const resource = resources.find((item) => item.name === contract.name);
+    const pageKind = contract.name === 'ec_category' ? 'tree' : contract.pageKind;
+    const label = `${contract.domain}/${contract.name}`;
+    if (!resource || resource.resource !== contract.path || resource.mode !== contract.mode || resource.pageKind !== pageKind) {
+      failures.push(`${label}: missing frontend resource`);
+      continue;
+    }
+    if (!/^[\u4e00-\u9fff]/.test(resource.title) || resource.fields.length === 0 || resource.fields.some((field) => field.key === 'id' || field.key.endsWith('_id')) || resource.fields.some((field) => !/^[\u4e00-\u9fff]/.test(field.label))) failures.push(`${label}: invalid frontend allowlist`);
+    for (const expected of requiredBackendRoutes(contract)) if (!manifest.routes.some((route) => route.method === expected.method && route.path === expected.path)) failures.push(`${label}: missing backend ${expected.method}`);
+    if (contract.mode === 'append_only') continue;
+    const coverage = routeCoverage(contract, routeSources, viewSources);
+    if (!coverage.hasPage) failures.push(`${label}: missing page`);
+    if (!coverage.hasMenu) failures.push(`${label}: missing menu route`);
+  }
+  if (JSON.stringify(resources.map((item) => item.name).sort()) !== JSON.stringify(manifest.resources.map((item) => item.name).sort())) failures.push('catalogue names differ from backend ExpectedResources');
+  const readonlyMutations = mutationActions(readOnlyPage);
+  if (readonlyMutations.length) failures.push(`readonly: mutation action exposed (${readonlyMutations.join(', ')})`);
+  failures.push(...scanInternalIdLeaks(new Map([...apiSources, ...viewSources])));
+  return failures;
+}
+
+function loadResources() {
+  const compiled = ts.transpileModule(fs.readFileSync('src/api/resources.ts', 'utf8'), { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2020 } }).outputText;
+  const resourceModule = { exports: {} };
+  vm.runInNewContext(compiled, { module: resourceModule, exports: resourceModule.exports });
+  return resourceModule.exports.resources;
+}
+
+function runAudit() {
+  const backendDirectory = path.resolve('../..', 'backend/api');
+  const manifest = JSON.parse(execFileSync('go', ['run', './cmd/resource-contract'], { cwd: backendDirectory, encoding: 'utf8' }));
+  let responseShapeVerified = true;
+  try { execFileSync('go', ['test', '-count=1', './internal/logic/platform', '-run', '^TestListGasAccountProjectsGasBasicIdentityAndNeverReturnsRelationID$'], { cwd: backendDirectory, stdio: 'pipe' }); } catch { responseShapeVerified = false; }
+  const viewSources = sourceFiles('src/views', ['.vue']);
+  const failures = auditPlatform({
+    manifest,
+    resources: loadResources(),
+    readOnlyPage: fs.readFileSync('src/views/shared/ReadOnlyListPage.vue', 'utf8'),
+    routeSources: [...sourceFiles('src/router/routes/modules', ['.ts']).values()],
+    viewSources,
+    apiSources: sourceFiles('src/api', ['.ts']),
+    responseShapeVerified,
+  });
+  for (const failure of failures) console.log(failure);
+  if (failures.length) process.exitCode = 1;
+}
+
+if (import.meta.url === `file://${process.argv[1]?.replaceAll('\\', '/')}`) runAudit();

frontend/platform_admin/scripts/audit-check.test.mjs

@@ -0,0 +1,48 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { auditPlatform, scanInternalIdLeaks } from './audit-check.mjs';
+
+test('只读页面将状态变更视为违规写操作', () => {
+  const failures = auditPlatform({
+    manifest: { resources: [], routes: [] },
+    resources: [],
+    readOnlyPage: '<script setup>resourceApi.updateStatus(resource, identity, status)</script>',
+    routeSources: [],
+    viewSources: new Map(),
+    apiSources: new Map(),
+  });
+
+  assert.deepEqual(failures, ['readonly: mutation action exposed (updateStatus)']);
+});
+
+test('扫描 API 和页面中用于展示或请求的内部 ID', () => {
+  const failures = scanInternalIdLeaks(new Map([
+    ['src/api/leak.ts', "resourceApi.create('/gas/gas_basic', { gas_basic_id: 7 })"],
+    ['src/views/leak.vue', '<a-table-column data-index="id" />'],
+  ]));
+
+  assert.deepEqual(failures, [
+    'src/api/leak.ts: internal identifier gas_basic_id',
+    'src/views/leak.vue: internal identifier id',
+  ]);
+});
+
+test('每个资源必须由带菜单元数据的路由实际加载对应页面', () => {
+  const failures = auditPlatform({
+    manifest: { resources: [{ domain: 'gas', name: 'gas_basic', path: '/gas/gas_basic', mode: 'writable', pageKind: 'list' }], routes: [
+      { method: 'GET', path: '/gas/gas_basic' },
+      { method: 'POST', path: '/gas/gas_basic' },
+      { method: 'GET', path: '/gas/gas_basic/:identity' },
+      { method: 'PUT', path: '/gas/gas_basic/:identity' },
+      { method: 'PATCH', path: '/gas/gas_basic/:identity/status' },
+      { method: 'DELETE', path: '/gas/gas_basic/:identity' },
+    ] },
+    resources: [{ name: 'gas_basic', resource: '/gas/gas_basic', mode: 'writable', pageKind: 'list', title: '气站管理', fields: [{ key: 'name', label: '名称' }] }],
+    readOnlyPage: '',
+    routeSources: ["{ component: () => import('@/views/gas/gas_basic/ListPage.vue') }"],
+    viewSources: new Map([['src/views/gas/gas_basic/ListPage.vue', "getResource('/gas/gas_basic')"]]),
+    apiSources: new Map(),
+  });
+
+  assert.deepEqual(failures, ['gas/gas_basic: missing menu route']);
+});