fix: stabilize admin tracking event display

server-rs/crates/api-server/src/admin.rs

@@ -1,5 +1,6 @@
 use std::{
     collections::BTreeSet,
+    fs,
     net::{IpAddr, Ipv4Addr, Ipv6Addr},
 };
 
@@ -516,11 +517,13 @@ async fn fetch_admin_tracking_events(
         .spacetime_token
         .as_deref()
         .map(str::trim)
-        .filter(|value| !value.is_empty());
+        .filter(|value| !value.is_empty())
+        .map(str::to_string)
+        .or_else(load_local_spacetime_cli_token);
     let sql = build_admin_tracking_events_sql(&query)
         .map_err(|error| AppError::from_status(StatusCode::BAD_REQUEST).with_message(error))?;
 
-    let payload = fetch_spacetime_sql_json(&client, server_root, database, token, &sql)
+    let payload = fetch_spacetime_sql_json(&client, server_root, database, token.as_deref(), &sql)
         .await
         .map_err(|error| {
             AppError::from_status(StatusCode::BAD_GATEWAY)
@@ -555,7 +558,7 @@ fn build_admin_tracking_events_sql(query: &AdminTrackingEventListQuery) -> Resul
     };
     let limit = clamp_admin_tracking_event_limit(query.limit);
     Ok(format!(
-        "SELECT event_id, event_key, scope_kind, scope_id, day_key, user_id, owner_user_id, profile_id, module_key, metadata_json, occurred_at FROM tracking_event{where_clause} ORDER BY occurred_at DESC LIMIT {limit}"
+        "SELECT event_id, event_key, scope_kind, scope_id, day_key, user_id, owner_user_id, profile_id, module_key, metadata_json, occurred_at FROM tracking_event{where_clause} LIMIT {limit}"
     ))
 }
 
@@ -563,6 +566,17 @@ fn normalized_non_empty(value: Option<&str>) -> Option<&str> {
     value.map(str::trim).filter(|value| !value.is_empty())
 }
 
+fn load_local_spacetime_cli_token() -> Option<String> {
+    // 本地开发清库后会通过 `/v1/identity` 重新登录 CLI；这里复用 CLI token，确保 SQL 可读取 private 表。
+    let content = fs::read_to_string(".spacetimedb/local/config/cli.toml")
+        .or_else(|_| fs::read_to_string("server-rs/.spacetimedb/local/config/cli.toml"))
+        .ok()?;
+    content.lines().find_map(|line| {
+        let value = line.trim().strip_prefix("spacetimedb_token = ")?;
+        Some(value.trim().trim_matches('"').to_string()).filter(|token| !token.is_empty())
+    })
+}
+
 fn quote_sql_string(value: &str) -> String {
     format!("'{}'", value.replace('\'', "''"))
 }
@@ -621,6 +635,11 @@ fn parse_admin_tracking_events_sql_response(
     rows.iter()
         .map(parse_admin_tracking_event_row)
         .collect::<Result<Vec<_>, _>>()
+        .map(|mut entries| {
+            // SpacetimeDB 2.2 的 HTTP SQL 暂不支持 ORDER BY；后台在 API 层按发生时间倒序收口。
+            entries.sort_by(|left, right| right.occurred_at.cmp(&left.occurred_at));
+            entries
+        })
 }
 
 fn extract_first_sql_rows(payload: Value) -> Result<Vec<Value>, String> {
@@ -651,7 +670,12 @@ fn parse_admin_tracking_event_row(row: &Value) -> Result<AdminTrackingEventEntry
         event_id: required_string_column(columns, 0, "event_id")?,
         event_title: admin_tracking_event_title(&event_key).to_string(),
         event_key,
-        scope_kind: required_string_column(columns, 2, "scope_kind")?,
+        scope_kind: tracking_scope_kind_to_string(
+            columns
+                .get(2)
+                .ok_or_else(|| "埋点行缺少 scope_kind".to_string())?,
+        )
+        .ok_or_else(|| "埋点行 scope_kind 类型非法".to_string())?,
         scope_id: required_string_column(columns, 3, "scope_id")?,
         day_key: required_i64_column(columns, 4, "day_key")?,
         user_id: optional_string_column(columns, 5),
@@ -659,7 +683,12 @@ fn parse_admin_tracking_event_row(row: &Value) -> Result<AdminTrackingEventEntry
         profile_id: optional_string_column(columns, 7),
         module_key: optional_string_column(columns, 8),
         metadata_json: required_string_column(columns, 9, "metadata_json")?,
-        occurred_at: required_string_column(columns, 10, "occurred_at")?,
+        occurred_at: timestamp_to_display_string(
+            columns
+                .get(10)
+                .ok_or_else(|| "埋点行缺少 occurred_at".to_string())?,
+        )
+        .ok_or_else(|| "埋点行 occurred_at 不是字符串".to_string())?,
     })
 }
 
@@ -703,7 +732,53 @@ fn value_to_string(value: &Value) -> Option<String> {
         Value::Object(object) => object.get("some").and_then(value_to_string),
         Value::Number(number) => Some(number.to_string()),
         Value::Bool(value) => Some(value.to_string()),
-        _ => Some(value.to_string()),
+        Value::Array(items) => value_array_to_string(items),
+    }
+}
+
+fn value_array_to_string(items: &[Value]) -> Option<String> {
+    if items.len() == 2 {
+        if let Some(index) = items.first().and_then(Value::as_u64) {
+            if index == 0 {
+                return items.get(1).and_then(value_to_string);
+            }
+            if index == 1 && items.get(1).and_then(Value::as_array).is_some() {
+                return None;
+            }
+        }
+    }
+    Some(Value::Array(items.to_vec()).to_string())
+}
+
+fn tracking_scope_kind_to_string(value: &Value) -> Option<String> {
+    match value {
+        Value::String(text) => Some(text.clone()),
+        Value::Object(object) => object
+            .get("tag")
+            .or_else(|| object.get("variant"))
+            .or_else(|| object.get("name"))
+            .and_then(value_to_string),
+        Value::Array(items) => {
+            let index = items.first().and_then(Value::as_u64)?;
+            Some(
+                match index {
+                    0 => "site",
+                    1 => "work",
+                    2 => "module",
+                    3 => "user",
+                    _ => return Some(Value::Array(items.to_vec()).to_string()),
+                }
+                .to_string(),
+            )
+        }
+        _ => value_to_string(value),
+    }
+}
+
+fn timestamp_to_display_string(value: &Value) -> Option<String> {
+    match value {
+        Value::Array(items) if items.len() == 1 => items.first().and_then(value_to_string),
+        _ => value_to_string(value),
     }
 }
 
@@ -1059,6 +1134,7 @@ mod tests {
         assert!(sql.contains("user_id = 'user-1'"));
         assert!(sql.contains("scope_kind = 'user'"));
         assert!(sql.contains("scope_id = 'scope-1'"));
+        assert!(!sql.contains("ORDER BY"));
         assert!(sql.ends_with("LIMIT 1000"));
     }
 
@@ -1097,6 +1173,80 @@ mod tests {
         assert_eq!(entries[0].event_title, "每日登录");
         assert_eq!(entries[0].user_id.as_deref(), Some("user-1"));
         assert_eq!(entries[0].profile_id.as_deref(), Some("profile-1"));
+        assert_eq!(entries[0].module_key.as_deref(), Some("profile"));
+    }
+
+    #[test]
+    fn parse_admin_tracking_events_sql_response_normalizes_sats_values() {
+        let payload = json!([
+            {
+                "rows": [[
+                    "event-1",
+                    "daily_login",
+                    [3, []],
+                    "user-1",
+                    20580,
+                    [0, "user-1"],
+                    [1, []],
+                    [0, "profile-1"],
+                    [0, "profile"],
+                    "{}",
+                    [1778207451731746i64]
+                ]]
+            }
+        ]);
+
+        let entries =
+            parse_admin_tracking_events_sql_response(payload).expect("tracking rows should parse");
+
+        assert_eq!(entries[0].scope_kind, "user");
+        assert_eq!(entries[0].user_id.as_deref(), Some("user-1"));
+        assert_eq!(entries[0].owner_user_id, None);
+        assert_eq!(entries[0].profile_id.as_deref(), Some("profile-1"));
+        assert_eq!(entries[0].module_key.as_deref(), Some("profile"));
+        assert_eq!(entries[0].occurred_at, "1778207451731746");
+    }
+
+    #[test]
+    fn parse_admin_tracking_events_sql_response_sorts_by_occurred_at_desc() {
+        let payload = json!([
+            {
+                "rows": [
+                    [
+                        "event-old",
+                        "daily_login",
+                        "user",
+                        "user-1",
+                        20580,
+                        {"some": "user-1"},
+                        null,
+                        {"some": "profile-1"},
+                        "profile",
+                        "{}",
+                        "2026-05-07T00:00:00Z"
+                    ],
+                    [
+                        "event-new",
+                        "daily_login",
+                        "user",
+                        "user-1",
+                        20580,
+                        {"some": "user-1"},
+                        null,
+                        {"some": "profile-1"},
+                        "profile",
+                        "{}",
+                        "2026-05-07T01:00:00Z"
+                    ]
+                ]
+            }
+        ]);
+
+        let entries =
+            parse_admin_tracking_events_sql_response(payload).expect("tracking rows should parse");
+
+        assert_eq!(entries[0].event_id, "event-new");
+        assert_eq!(entries[1].event_id, "event-old");
     }
 
     #[test]

server-rs/crates/api-server/src/assets.rs

@@ -1418,8 +1418,9 @@ mod tests {
         let object_path = object_key.map(str::trim).filter(|value| !value.is_empty());
         let canonical_uri = build_oss_v4_canonical_uri(bucket, object_path);
         let payload_hash = "UNSIGNED-PAYLOAD";
-        let canonical_headers =
-            format!("host:{bucket}.{endpoint}\nx-oss-content-sha256:{payload_hash}\nx-oss-date:{signed_at_text}\n");
+        let canonical_headers = format!(
+            "host:{bucket}.{endpoint}\nx-oss-content-sha256:{payload_hash}\nx-oss-date:{signed_at_text}\n"
+        );
         let additional_headers = "host";
         let canonical_request = format!(
             "{}\n{}\n\n{}\n{}\n{}",

server-rs/crates/platform-auth/src/lib.rs

@@ -1456,9 +1456,19 @@ fn build_aliyun_sms_url(endpoint: &str) -> Result<String, SmsProviderError> {
 }
 
 fn current_aliyun_timestamp() -> String {
-    OffsetDateTime::now_utc()
-        .format(&time::format_description::well_known::Rfc3339)
-        .unwrap_or_else(|_| "1970-01-01T00:00:00Z".to_string())
+    // 阿里云 OpenAPI ACS3 签名头 x-acs-date 要求使用不带小数秒的 UTC ISO 8601 格式，
+    // 即 yyyy-MM-dd'T'HH:mm:ss'Z'。time crate 的 Rfc3339 会保留纳秒，
+    // 形如 2026-05-07T14:23:59.364767Z，阿里云网关会判定为时间格式非法。
+    let now = OffsetDateTime::now_utc();
+    format!(
+        "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
+        now.year(),
+        u8::from(now.month()),
+        now.day(),
+        now.hour(),
+        now.minute(),
+        now.second()
+    )
 }
 
 fn canonicalize_aliyun_form_params(params: &BTreeMap<String, String>) -> String {
@@ -1480,8 +1490,9 @@ fn build_aliyun_form_body(params: &BTreeMap<String, String>) -> String {
 }
 
 fn hmac_sha256_hex(key: &[u8], content: &[u8]) -> Result<String, SmsProviderError> {
-    let mut signer = HmacSha256::new_from_slice(key)
-        .map_err(|error| SmsProviderError::InvalidConfig(format!("初始化短信签名器失败：{error}")))?;
+    let mut signer = HmacSha256::new_from_slice(key).map_err(|error| {
+        SmsProviderError::InvalidConfig(format!("初始化短信签名器失败：{error}"))
+    })?;
     signer.update(content);
     Ok(hex_lower(&signer.finalize().into_bytes()))
 }
@@ -2146,6 +2157,23 @@ mod tests {
         assert!(headers.get("x-acs-content-sha256").is_some());
     }
 
+    #[test]
+    fn current_aliyun_timestamp_uses_acs_iso8601_format_without_fractional_seconds() {
+        let timestamp = current_aliyun_timestamp();
+
+        assert_eq!(timestamp.len(), "2026-05-07T12:34:56Z".len());
+        assert_eq!(timestamp.as_bytes()[4], b'-');
+        assert_eq!(timestamp.as_bytes()[7], b'-');
+        assert_eq!(timestamp.as_bytes()[10], b'T');
+        assert_eq!(timestamp.as_bytes()[13], b':');
+        assert_eq!(timestamp.as_bytes()[16], b':');
+        assert!(timestamp.ends_with('Z'));
+        assert!(!timestamp.contains('.'));
+        assert!(timestamp.chars().enumerate().all(|(index, value)| {
+            matches!(index, 4 | 7 | 10 | 13 | 16 | 19) || value.is_ascii_digit()
+        }));
+    }
+
     #[test]
     fn aliyun_send_response_deserializes_pascal_case_fields() {
         let payload = serde_json::from_str::<AliyunSendSmsVerifyCodeResponse>(