Merge remote-tracking branch 'web/master' into feat/five_min_design

scripts/check-preview-deployer.mjs

@@ -21,6 +21,10 @@ const systemd = readFileSync(
   'deploy/systemd/genarrative-preview-deployer.service',
   'utf8',
 );
+const environmentExample = readFileSync(
+  'deploy/env/preview-deployer.env.example',
+  'utf8',
+);
 const server = readFileSync(
   'server-rs/crates/preview-deployer-server/src/lib.rs',
   'utf8',
@@ -121,6 +125,16 @@ assertIncludes(
   'restart: on-failure',
   '预览外部生成 worker 必须在运行时身份初始化竞态后自动重启。',
 );
+assertIncludes(
+  deployer,
+  'GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED=true',
+  '预览独立空库必须允许首次密码登录自动创建预览账号。',
+);
+assertIncludes(
+  deployer,
+  "'SMS_AUTH_ENABLED=true',\n  'SMS_AUTH_PROVIDER=mock',\n  'SMS_AUTH_MOCK_VERIFY_CODE=123456'",
+  '预览短信登录必须使用固定 mock 验证码，不得继承生产短信密钥。',
+);
 assertIncludes(
   deployer,
   '^preview-[0-9a-f]{16}$',
@@ -162,6 +176,21 @@ assertIncludes(
   '.nest_service("/build/assets", ServeDir::new(static_dir.join("assets")))',
   '控制服务必须原生托管 /build 子路径，不能依赖 Nginx 隐式改写。',
 );
+assertIncludes(
+  server,
+  'FAILED_RECORD_TTL_SECS',
+  '控制服务必须清理过期且不可卸载的失败/取消记录。',
+);
+assertIncludes(
+  server,
+  'STOPPED_RECORD_TTL_SECS',
+  '控制服务必须为已卸载记录配置有限审计保留期。',
+);
+assertIncludes(
+  environmentExample,
+  'GENARRATIVE_PREVIEW_DEPLOYER_JENKINS_PUBLIC_BASE_URL=http://192.168.35.82:8080/jenkins/',
+  '构建详情必须使用局域网 Jenkins 地址而非 loopback。',
+);
 assertIncludes(
   jobConfig,
   '<scriptPath>jenkins/Jenkinsfile.preview-deployer</scriptPath>',

scripts/jenkins-preview-deployer.sh

@@ -336,6 +336,15 @@ const [file, internalSecret, jwtSecret] = process.argv.slice(2);
 let content = fs.readFileSync(file, 'utf8');
 content = content.replace(/^GENARRATIVE_INTERNAL_API_SECRET=.*$/mu, `GENARRATIVE_INTERNAL_API_SECRET=${internalSecret}`);
 content = content.replace(/^GENARRATIVE_JWT_SECRET=.*$/mu, `GENARRATIVE_JWT_SECRET=${jwtSecret}`);
+content += [
+  '',
+  '# Jenkins 分支预览使用隔离数据库和预览专用认证，不继承生产账号或短信凭据。',
+  'GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED=true',
+  'SMS_AUTH_ENABLED=true',
+  'SMS_AUTH_PROVIDER=mock',
+  'SMS_AUTH_MOCK_VERIFY_CODE=123456',
+  '',
+].join('\n');
 fs.writeFileSync(file, content, {encoding: 'utf8', mode: 0o600});
 NODE
   unset internal_secret jwt_secret