# 审计 — 2026-06-04 Code Review P0/P1 修复

## Step 3 规则扫描（H）

| H | 规则 | 文件 | 结论 |
|---|------|------|------|
| H1 | PY-08 静默吞错 | sync_engine_v2, auth_service | SAFE — 保留 logger，无空 pass |
| H2 | SEC 安装无 JWT | install.py | FIXED — install_token + compare_digest |
| H3 | SEC 路径遍历 | posix_paths.py | FIXED — 统一 resolve_nexus_push_source_path |
| H4 | CONC AsyncSession | sync_engine_v2.py | FIXED — _db_lock 串行 DB |
| H5 | CONC refresh 双花 | auth_service.py | FIXED — Redis Lua SREM+SADD |
| H6 | FE 开放重定向 | LoginPage.vue | FIXED |
| H7 | FE WS 泄漏 | usePushProgress.ts | FIXED |

## Closure

| H | 判定 | 依据 |
|---|------|------|
| H1 | SAFE | except 均 logging |
| H2 | FIXED | install.py:572+ `_verify_install_token` |
| H3 | FIXED | posix_paths.py:103-114 |
| H4 | FIXED | sync_engine_v2.py `_db_lock` |
| H5 | FIXED | auth_service `_rotate_refresh_token` Lua |
| H6 | FIXED | LoginPage redirect 校验 |
| H7 | FIXED | disconnectProgressWs + 4001 logout |

## 改动文件清单

- server/application/services/sync_engine_v2.py
- server/application/services/auth_service.py
- server/api/install.py
- server/api/sync_v2.py
- server/utils/posix_paths.py
- server/main.py
- server/background/schedule_runner.py
- web/app/install.html
- frontend/src/pages/LoginPage.vue
- frontend/src/composables/push/usePushProgress.ts
- tests/test_security_unit.py

## DoD

- [x] ruff 零错误（改动文件）
- [x] import server.main 成功
- [x] pytest test_security_unit 通过
- [x] frontend type-check 通过
- [x] changelog ≥10 行
- [ ] 生产部署与健康检查（待用户推送后执行）
