OSMOKE1 修复 OA-only smoke 账号治理

server/tests/unit/scripts/audit-wecom-oa-user-consistency.test.js

@@ -64,6 +64,28 @@ describe("audit-wecom-oa-user-consistency", () => {
     });
   });
 
+  it("exempts default OA-only smoke accounts from WeCom-missing findings", () => {
+    const report = buildConsistencyReport({
+      oaEmployees: [
+        employee({
+          employeeNo: "T0001",
+          name: "OA smoke admin",
+          email: "[email protected]",
+          wecomExternalUserId: "",
+        }),
+      ],
+      wecomProfiles: [],
+    });
+
+    expect(report.status).toBe("PASS_NO_DRIFT");
+    expect(count(report, "oaOnlySmokeExempted")).toBe(1);
+    expect(count(report, "oaActiveMissingInWecom")).toBe(0);
+    expect(report.findings.oaOnlySmokeExempted[0]).toMatchObject({
+      employeeNo: "T0001",
+      reason: "oa_only_smoke_no_wecom_account_required",
+    });
+  });
+
   it("classifies WeCom active profiles missing from OA", () => {
     const report = buildConsistencyReport({
       oaEmployees: [],

server/tests/unit/scripts/repair-oa-only-smoke-accounts.test.js

@@ -0,0 +1,88 @@
+const {
+  isSafeOaOnlySmokeTarget,
+  isSmokeLikeValue,
+  normalizeRoleList,
+  parseArgs,
+  planForTarget,
+} = require("../../../src/scripts/repair-oa-only-smoke-accounts");
+
+function target(overrides = {}) {
+  return {
+    key: overrides.key ?? "admin",
+    identifier: overrides.identifier ?? "[email protected]",
+    maskedIdentifier: "sm***@***.com",
+    roles: overrides.roles ?? ["admin", "employee"],
+  };
+}
+
+function row(overrides = {}) {
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    employeeNo: overrides.employeeNo ?? "T0001",
+    name: overrides.name ?? "OA试运行测试管理员",
+    email: overrides.email ?? "[email protected]",
+    phone: overrides.phone ?? "",
+    status: overrides.status ?? "archived",
+    employmentStatus: overrides.employmentStatus ?? "inactive",
+    archived: overrides.archived ?? true,
+    roles: overrides.roles ?? ["employee"],
+    loginFailedCount: overrides.loginFailedCount ?? 3,
+    hasLoginFailedFirstAt: overrides.hasLoginFailedFirstAt ?? true,
+    loginLocked: overrides.loginLocked ?? true,
+    activeAuthSessions: overrides.activeAuthSessions ?? 0,
+  };
+}
+
+describe("repair-oa-only-smoke-accounts", () => {
+  afterEach(() => {
+    delete process.env.OA_ONLY_SMOKE_REPAIR_APPLY;
+  });
+
+  it("recognizes only smoke-like identifiers as safe targets", () => {
+    expect(isSmokeLikeValue("[email protected]")).toBe(true);
+    expect(isSmokeLikeValue("SMOKE002")).toBe(true);
+    expect(isSmokeLikeValue("OA试运行测试管理员")).toBe(true);
+    expect(isSmokeLikeValue("[email protected]")).toBe(false);
+  });
+
+  it("blocks non-smoke employee matches before planning role repair", () => {
+    const plan = planForTarget(
+      target({ identifier: "[email protected]", roles: ["admin", "employee"] }),
+      row({
+        employeeNo: "HYD000100",
+        name: "真实员工",
+        email: "[email protected]",
+        status: "archived",
+        employmentStatus: "inactive",
+        archived: true,
+      }),
+    );
+
+    expect(isSafeOaOnlySmokeTarget(target({ identifier: "[email protected]" }), plan.before)).toBe(false);
+    expect(plan.status).toBe("BLOCKED");
+    expect(plan.reason).toBe("unsafe_non_smoke_target");
+    expect(plan.actions).toEqual([]);
+  });
+
+  it("plans only state, lock, and missing-role repairs for safe OA-only smoke rows", () => {
+    const plan = planForTarget(target(), row());
+
+    expect(plan.status).toBe("PLANNED");
+    expect(plan.actions).toEqual(["restore_active_employee", "clear_login_lock", "add_missing_roles"]);
+    expect(plan.missingRoles).toEqual(["admin"]);
+    expect(JSON.stringify(plan)).not.toContain("[email protected]");
+  });
+
+  it("normalizes roles and parses apply mode without enabling apply by itself", () => {
+    const options = parseArgs(["--apply", "--target=admin:[email protected]:admin+employee", "--format=json"]);
+
+    expect(options.mode).toBe("apply");
+    expect(options.targets[0]).toMatchObject({
+      key: "admin",
+      identifier: "[email protected]",
+      roles: ["admin", "employee"],
+    });
+    expect(normalizeRoleList(["admin", "admin", "invalid", "employee"])).toEqual(["admin", "employee"]);
+    expect(process.env.OA_ONLY_SMOKE_REPAIR_APPLY).toBeUndefined();
+  });
+});

server/tests/unit/scripts/resolve-wecom-oa-user-consistency.test.js

@@ -27,6 +27,7 @@ function auditReport(overrides = {}) {
         { employeeNo: "HRWDTEST-20260517214548", status: "archived", archived: true, roles: ["employee"] },
       ],
       matchedActive: [],
+      oaOnlySmokeExempted: [],
       wecomActiveMissingInOa: [],
       oaActiveMissingBinding: [],
       statusMismatch: [],
@@ -103,6 +104,27 @@ describe("resolve-wecom-oa-user-consistency", () => {
     expect(plan.excludedByAllowlist.map((item) => item.employeeNo)).toEqual(["TEST001"]);
   });
 
+  it("exempts source-classified OA-only smoke accounts from archive plans", () => {
+    const plan = buildFixPlan(auditReport({
+      findings: {
+        ...auditReport().findings,
+        oaOnlySmokeExempted: [
+          { employeeNo: "TEST001", status: "active", roles: ["admin", "employee"] },
+        ],
+      },
+    }));
+
+    expect(plan.archiveOaTestEmployees.map((item) => item.employeeNo)).toEqual(["TEST002"]);
+    expect(plan.oaOnlySmokeExempted.map((item) => item.employeeNo)).toEqual(["TEST001"]);
+  });
+
+  it("supports explicit OA-only smoke employee-no exemption for legacy reports", () => {
+    const plan = buildFixPlan(auditReport(), { oaOnlySmokeEmployeeNos: ["TEST002"] });
+
+    expect(plan.archiveOaTestEmployees.map((item) => item.employeeNo)).toEqual(["TEST001"]);
+    expect(plan.oaOnlySmokeExempted.map((item) => item.employeeNo)).toEqual(["TEST002"]);
+  });
+
   it("requires explicit environment approval for apply mode", () => {
     expect(() => assertApplyAllowed({ mode: "apply" })).toThrow(/WOUA_FIX_APPLY=1/);
     process.env.WOUA_FIX_APPLY = "1";
@@ -116,6 +138,7 @@ describe("resolve-wecom-oa-user-consistency", () => {
       "--allow-employee-no=TEST001,TEST002",
       "--allow-employee-no",
       "TEST001",
+      "--oa-only-smoke-employee-no=TEST003",
       "--repair-manager-effects",
       "--manager-fallback-employee-no=HYD000007",
       "--format=json",
@@ -125,6 +148,7 @@ describe("resolve-wecom-oa-user-consistency", () => {
     expect(options.reportPath).toBe("summary.json");
     expect(options.format).toBe("json");
     expect(options.allowEmployeeNos).toEqual(["TEST001", "TEST002"]);
+    expect(options.oaOnlySmokeEmployeeNos).toEqual(["TEST003"]);
     expect(options.repairManagerEffects).toBe(true);
     expect(options.managerFallbackEmployeeNo).toBe("HYD000007");
   });