Nexus/docs/audit/2026-06-01-bug-remediation.md

审计记录 — 2026-06-01 全量 Bug 修复

审计信息

• 日期: 2026-06-01
• 触发: 交接 P0～P3 全量修复
• 范围: 见 changelog docs/changelog/2026-06-01-bug-remediation.md

Step 3 规则扫描 H

H	规则	文件
H1	批量 server_ids 须为整数	ServersPage + normalizeServerIds
H2	Access JWT 15–60min	auth_service + config
H3	Refresh Cookie + credentials	api/index.ts, auth store
H4	script-callback API Key	agent.py + script_jobs curl
H5	心跳不写 MySQL 实时	agent.py 移除 update_heartbeat
H6	未知 server 200 discarded	agent.py
H7	Admin 废弃列 DROP	migrations + model

Closure 表

H	判定	依据
H1	✅ SAFE	normalizeServerIds 过滤非正整数
H2	✅ SAFE	_access_token_expire_minutes() clamp 15–60
H3	✅ SAFE	401 刷新一次；login 路径不 forceLogout
H4	✅ SAFE	shlex.quote(api_key) + Depends 校验
H5	✅ SAFE	仅 Redis；flush 任务已有
H6	✅ SAFE	不泄露存在性（先验 Key 再查库）
H7	✅ SAFE	DROP 迁移可重复跳过

改动文件清单

• frontend/src/pages/ServersPage.vue
• frontend/src/api/index.ts
• frontend/src/stores/auth.ts
• frontend/src/router/index.ts
• frontend/src/pages/TerminalPage.vue
• frontend/src/utils/serverSelection.ts
• frontend/src/utils/apiError.ts
• server/api/agent.py
• server/application/services/auth_service.py
• server/config.py
• server/application/services/script_jobs.py
• server/application/services/script_service.py
• server/domain/models/__init__.py
• server/infrastructure/database/admin_repo.py
• server/domain/repositories/__init__.py
• server/infrastructure/database/migrations.py
• server/main.py
• server/api/settings.py
• tests/test_api.py
• tests/test_nexus_v6.py
• tests/test_step1to5_features.py

DoD

• len(H) == Closure 行数 (7)
• ruff check server/ 通过
• import server.main 通过
• pytest 模型/认证单元 35 passed
• changelog ≥10 行