# 审计记录 — 2026-06-01 全量 Bug 修复

## 审计信息

- **日期**: 2026-06-01
- **触发**: 交接 P0～P3 全量修复
- **范围**: 见 changelog `docs/changelog/2026-06-01-bug-remediation.md`

## Step 3 规则扫描 H

| H | 规则 | 文件 |
|---|------|------|
| H1 | 批量 server_ids 须为整数 | ServersPage + normalizeServerIds |
| H2 | Access JWT 15–60min | auth_service + config |
| H3 | Refresh Cookie + credentials | api/index.ts, auth store |
| H4 | script-callback API Key | agent.py + script_jobs curl |
| H5 | 心跳不写 MySQL 实时 | agent.py 移除 update_heartbeat |
| H6 | 未知 server 200 discarded | agent.py |
| H7 | Admin 废弃列 DROP | migrations + model |

## Closure 表

| H | 判定 | 依据 |
|---|------|------|
| H1 | ✅ SAFE | `normalizeServerIds` 过滤非正整数 |
| H2 | ✅ SAFE | `_access_token_expire_minutes()` clamp 15–60 |
| H3 | ✅ SAFE | 401 刷新一次；login 路径不 forceLogout |
| H4 | ✅ SAFE | `shlex.quote(api_key)` + Depends 校验 |
| H5 | ✅ SAFE | 仅 Redis；flush 任务已有 |
| H6 | ✅ SAFE | 不泄露存在性（先验 Key 再查库） |
| H7 | ✅ SAFE | DROP 迁移可重复跳过 |

## 改动文件清单

- frontend/src/pages/ServersPage.vue
- frontend/src/api/index.ts
- frontend/src/stores/auth.ts
- frontend/src/router/index.ts
- frontend/src/pages/TerminalPage.vue
- frontend/src/utils/serverSelection.ts
- frontend/src/utils/apiError.ts
- server/api/agent.py
- server/application/services/auth_service.py
- server/config.py
- server/application/services/script_jobs.py
- server/application/services/script_service.py
- server/domain/models/__init__.py
- server/infrastructure/database/admin_repo.py
- server/domain/repositories/__init__.py
- server/infrastructure/database/migrations.py
- server/main.py
- server/api/settings.py
- tests/test_api.py
- tests/test_nexus_v6.py
- tests/test_step1to5_features.py

## DoD

- [x] len(H) == Closure 行数 (7)
- [x] ruff check server/ 通过
- [x] import server.main 通过
- [x] pytest 模型/认证单元 35 passed
- [x] changelog ≥10 行