zkr/shz-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

✨ feat: 添加微信小程序调试工具和完整参数参考文档

Browse Source
This commit is contained in:
lapuda
2026-07-24 09:09:15 +08:00
parent 773679c292
commit 6bc4d64c6b
20 changed files with 1449 additions and 240 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
.codex/skills/shz-pc-debug/references/authenticated-api.md
View File

@@ -1,25 +1,25 @@
# Protected API Calls in the Test Environment
# 测试环境中的受保护接口调用
## Use this workflow only when needed
## 仅在需要时使用此流程
Use this workflow only when the user explicitly asks to call a protected API and identifies the test role, endpoint, and purpose. Default to test endpoints and a read-only request. Require separate explicit user approval for any protected request that creates, updates, deletes, submits, publishes, or otherwise changes business data.
只有当用户明确要求调用受保护接口，并说明测试角色、接口和用途时，才能使用此流程。默认使用测试接口和只读请求。任何会创建、更新、删除、提交、发布或以其他方式修改业务数据的受保护请求，都需要用户单独明确批准。
## Obtain and handle the test Token
## 获取和处理测试 Token
1. Read [test-environment.md](test-environment.md) and select only the configured test account and role needed for the request.
2. Locate the login request contract in project source or approved API documentation. Prefer source investigation over repeatedly opening Chrome DevTools.
3. Perform a direct test-login request and capture its short-lived Token only into a process-scoped shell variable or equivalent in-memory credential store. Suppress login-response output that could reveal the Token.
4. Use the Token only in the authorization header of the one or closely related user-requested test API calls. Do not request additional endpoints merely because the Token permits them.
5. Clear the variable or in-memory credential immediately after the calls complete or fail.
1. 阅读 [test-environment.md](test-environment.md)，只选择请求所需的已配置测试账号和角色。
2. 在项目源代码或批准的 API 文档中定位登录请求契约。优先调查源代码，避免反复打开 Chrome DevTools。
3. 直接发起测试登录请求，并且只将短生命周期 Token 保存到进程范围的 shell 变量或等效的内存凭据存储中。抑制可能泄露 Token 的登录响应输出。
4. 只在用户请求的一个或一组密切相关的测试 API 调用的授权请求头中使用 Token。不得仅因为 Token 允许访问就请求额外接口。
5. 请求成功或失败后立即清除变量或内存凭据。
Never obtain a Token by reading browser cookies, local storage, session storage, or browser-exposed credentials. Never copy a Token from Chrome DevTools into another tool. Never print, log, persist, commit, screenshot, or report a Token or authorization header.
不得通过读取浏览器 cookies、local storage、session storage 或浏览器暴露的凭据获取 Token。不得将 Token 从 Chrome DevTools 复制到其他工具。不得打印、记录、持久化、提交、截图或报告 Token 或授权请求头。
## Choose the right tool
## 选择正确的工具
- Use Chrome DevTools for page interaction, DOM/UI failures, one representative request when the browser contract is unknown, and final visual verification.
- Use a narrow direct HTTP client for the explicitly requested protected API call after the endpoint and contract are known. This avoids the overhead of repeatedly driving Chrome DevTools.
- Do not use page JavaScript to make direct API requests or to access credentials.
- 使用 Chrome DevTools 进行页面交互、DOM/UI 故障检查、浏览器契约未知时的一个代表性请求捕获以及最终视觉验证。
- 在已知接口和契约后，使用范围狭窄的直接 HTTP 客户端调用用户明确要求的受保护接口，避免反复驱动 Chrome DevTools 的开销。
- 不得使用页面 JavaScript 直接发起 API 请求或访问凭据。
## Report safely
## 安全报告
Report the test environment, selected role, endpoint path, HTTP method, status code, duration, and a redacted response summary. Omit the login payload, Token, authorization header, cookies, and personally identifiable fields not needed to establish the result.
报告测试环境、所选角色、接口路径、HTTP 方法、状态码、耗时以及脱敏后的响应摘要。省略登录负载、Token、授权请求头、cookies 以及与证明结果无关的个人身份信息。

36
.codex/skills/shz-pc-debug/references/deployment.md
View File

@@ -1,36 +0,0 @@
# SHZ Test Deployment
## Authorization gate
Run a commit or deployment only if the user's **current request** explicitly authorizes it, names the test environment, and identifies the backend, PC frontend, or both. A request to complete a task, verify a fix, or describe deployment is not authorization to run these commands.
Before running a deployment command:
1. Inspect the selected repository's `git status` and diff.
2. Stage and commit only the files required for the task after focused local validation succeeds.
3. Do not include credentials, unrelated changes, or generated artifacts unless the user explicitly includes them in scope.
4. Do not push unless the user explicitly requests a push.
## Backend test deployment
Use only for an explicitly authorized `shz-backend` **test** deployment:
```bash
ssh root@47.111.103.66 sh /data/code/shz-backend/buildAndStart-test.sh
```
This command changes the remote test environment and can restart its backend service. After it finishes, inspect the requested test route and, on a failure, read a bounded test-log window with `$inspect-shz-logs`.
## PC frontend deployment
Use only for an explicitly authorized `shz-admin` PC frontend deployment:
```bash
sh /Users/lapuda/code/shz-admin/scripts/deploy-frontend.sh
```
Run the command locally. After it finishes, use Chrome DevTools to reload and verify the requested PC test route.
## Production
No production deployment command is configured in this skill. The production base URL is not deployment authority. Require a separate, explicit current-request authorization and the exact command before any production deployment.

30
.codex/skills/shz-pc-debug/references/project-topology.md
View File

@@ -1,21 +1,21 @@
# SHZ Project Topology
# SHZ 项目结构
| Workspace | Responsibility | Use during debugging |
| 工作区 | 职责 | 调试时的用途 |
| --- | --- | --- |
| `/Users/lapuda/code/shz-backend` | Backend project | Investigate API routing, authorization, business services, scheduled work, persistence, and server errors. Use the project's log and guarded database skills here. |
| `/Users/lapuda/code/shz-admin` | PC frontend | Investigate PC job-seeker, supervisory-admin, and enterprise UI routes, components, client state, request construction, and browser interaction. |
| `/Users/lapuda/code/shz-employment-service` | Mini-program | Investigate only mini-program-specific behavior, or a suspected interface/authentication/business-logic concern shared with the PC application. |
| `/Users/lapuda/code/shz-backend` | 后端项目 | 调查 API 路由、授权、业务服务、定时任务、持久化和服务器错误。在此使用项目日志和受保护的数据库 skill。 |
| `/Users/lapuda/code/shz-admin` | PC 前端 | 调查 PC 求职者、监管管理员和企业 UI 路由、组件、客户端状态、请求构造和浏览器交互。 |
| `/Users/lapuda/code/shz-employment-service` | 小程序 | 仅调查小程序特有行为，或与 PC 应用共用的接口/认证/业务逻辑问题。 |
## Select the minimum scope
## 选择最小范围
1. Start a PC visual, interaction, navigation, or missing-request investigation in `shz-admin` after capturing browser evidence.
2. Start an API status, response, permission, server exception, or database-data investigation in `shz-backend`.
3. Investigate both `shz-admin` and `shz-backend` when the browser request or response shows that the failure crosses the client/server boundary.
4. Add `shz-employment-service` only after evidence indicates the same endpoint or business behavior is involved. Do not change mini-program code for a PC-only issue.
1. 捕获浏览器证据后，在 `shz-admin` 中开始 PC 视觉、交互、导航或请求缺失问题的调查。
2. 在 `shz-backend` 中开始 API 状态、响应、权限、服务器异常或数据库数据问题的调查。
3. 当浏览器请求或响应表明故障跨越客户端/服务器边界时，同时调查 `shz-admin` 和 `shz-backend`。
4. 只有证据表明涉及同一个接口或业务行为时，才加入 `shz-employment-service`。PC 独有问题不得修改小程序代码。
## Work safely across repositories
## 跨仓库安全工作
1. Change into the selected workspace before using CodeGraph, running checks, or editing files.
2. Check each repository's working tree independently and preserve unrelated changes.
3. Attempt CodeGraph in the selected workspace before broad text search. If its index is unavailable, do not create one; use `rg` as the fallback.
4. Run focused verification in every repository changed. Do not deploy, restart services, or alter a remote environment unless the current user request explicitly authorizes committing and deploying; then follow [deployment.md](deployment.md).
1. 使用 CodeGraph、运行检查或编辑文件前，先进入选定的工作区。
2. 独立检查每个仓库的工作树，并保留无关改动。
3. 广泛文本搜索前，在选定工作区尝试使用 CodeGraph。如果索引不可用，不得创建索引；改用 `rg`。
4. 对每个发生变更的仓库运行聚焦验证。除非当前用户请求明确授权提交和部署，否则不得部署、重启服务或修改远程环境；获得授权后遵循 [deployment.md](deployment.md)。

38
.codex/skills/shz-pc-debug/references/test-environment.md
View File

@@ -1,30 +1,30 @@
# SHZ Web Test Environment
# SHZ 网页测试环境
## Environment selection
## 环境选择
- Default environment: **test**. Use the exact HTTPS URLs below.
- Production base: `http://39.98.44.136:6024/`. Use it only when the user explicitly requests production in the current conversation. Compose the requested route after this base; do not infer production availability from a test URL.
- Do not deploy, restart a service, alter configuration, or write business data in either environment as part of debugging unless the user explicitly requests it.
- 默认环境：**test**。使用下方完全一致的 HTTPS URL。
- 生产基地址：`http://39.98.44.136:6024/`。只有当用户在当前对话中明确要求生产环境时才能使用。将请求的路由拼接在此基地址后，不得从测试 URL 推断生产环境可用性。
- 调试过程中，除非用户明确要求，否则不得在任一环境部署、重启服务、修改配置或写入业务数据。
## Test entries
## 测试入口
| Role / purpose | Test URL | Use |
| 角色/用途 | 测试 URL | 用途 |
| --- | --- | --- |
| PC job seeker | `https://test.xjshzly.longbiosphere.com/shihezi` | Reproduce public job-search, job-fair, resume, policy, and message flows. |
| Authenticated PC job seeker | `https://test.xjshzly.longbiosphere.com/shihezi/backDoor` | Use the testing back door to select the one user required by the scenario. When it prompts for image verification, enter `820820`. Do not enumerate unrelated users. |
| Supervisory admin | `https://test.xjshzly.longbiosphere.com/shihezi/user/login` | Use the admin role on the shared login page. |
| Enterprise | `https://test.xjshzly.longbiosphere.com/shihezi/user/login` | Use the enterprise role on the shared login page. |
| PC 求职者 | `https://test.xjshzly.longbiosphere.com/shihezi` | 复现公开求职、招聘会、简历、政策和消息流程。 |
| 已认证 PC 求职者 | `https://test.xjshzly.longbiosphere.com/shihezi/backDoor` | 使用测试后门选择场景所需的一个用户。如果提示图形验证码，输入 `820820`。不得枚举无关用户。 |
| 监管管理员 | `https://test.xjshzly.longbiosphere.com/shihezi/user/login` | 在共用登录页使用管理员角色。 |
| 企业 | `https://test.xjshzly.longbiosphere.com/shihezi/user/login` | 在共用登录页使用企业角色。 |
The public job-seeker root can redirect to a feature route; capture the final URL in the debug evidence instead of treating that redirect as a failure by itself.
公开求职者根路径可能重定向到功能路由；应在调试证据中记录最终 URL，不要仅因发生重定向就将其视为失败。
## Test login details
## 测试登录信息
Use these only on the test endpoints above and only when role authentication is required to reproduce the reported issue.
仅当复现报告问题需要角色认证时，才在上述测试端点使用以下信息。
| Role | Account / selection | Password | Image verification code |
| 角色 | 账号/选择方式 | 密码 | 图形验证码 |
| --- | --- | --- | --- |
| Test-user back door | Select only the user required by the scenario | Not applicable | `820820` |
| Supervisory admin | `admin` | `admin123` | `820820` |
| Enterprise | `阿里巴巴` | `820820` | `820820` |
| 测试用户后门 | 只选择场景所需的用户 | 不适用 | `820820` |
| 监管管理员 | `admin` | `admin123` | `820820` |
| 企业 | `阿里巴巴` | `820820` | `820820` |
Do not put these credentials into code, commits, screenshots, browser logs, test fixtures, or final reports. If a login attempt fails, report the role and failure symptom without echoing the credential values.
不得将这些凭据写入代码、提交记录、截图、浏览器日志、测试夹具或最终报告。如果登录失败，只报告角色和失败现象，不得复述凭据值。