开启后端严格空值检查

apps/backend/src/routes/admin/orders.ts

@@ -19,7 +19,7 @@ router.get('/orders', createJsonHandler(
 ))
 
 router.get('/orders/:orderId', createJsonHandler(
-  (req) => getAdminOrderDetail((req.params as AdminOrderRouteParams).orderId),
+  (req) => getAdminOrderDetail(String((req.params as AdminOrderRouteParams).orderId || '')),
   {
     successMessage: 'ok',
     errorMessage: '读取订单详情失败',

apps/backend/src/routes/admin/platform-config/ninetyone.ts

@@ -23,7 +23,7 @@ router.get(
 router.post(
   "/ninetyone/orders/:id/retry",
   createJsonHandler(
-    (req) => retryAdminNinetyoneOrder((req.params as AdminEntityRouteParams).id),
+    (req) => retryAdminNinetyoneOrder(String((req.params as AdminEntityRouteParams).id || "")),
     {
       successMessage: "91卡券订单已重试",
       errorMessage: "重试 91卡券订单失败",
@@ -49,7 +49,7 @@ router.post(
   createJsonHandler(
     (req) =>
       failAdminNinetyoneOrder(
-        (req.params as AdminEntityRouteParams).id,
+        String((req.params as AdminEntityRouteParams).id || ""),
         req.body as { reason?: string }
       ),
     {

apps/backend/src/routes/admin/shared.ts

@@ -73,6 +73,17 @@ export function requireAdminRoles(allowedRoles: string[]) {
   }
 }
 
+export function getRequiredAdminSession(req: Request): AdminSession {
+  if (req.adminSession) {
+    return req.adminSession
+  }
+
+  throw createHttpError('未登录或登录已失效', {
+    statusCode: 401,
+    errorCode: 'admin_auth_required',
+  })
+}
+
 async function recordAdminAudit(
   session: AdminSession | null | undefined,
   req: Request,

apps/backend/src/routes/admin/tasks.ts

@@ -24,8 +24,8 @@ import type { AdminTaskActionResponse } from "../../types/admin-write-models.js"
 
 const router = Router();
 
-function getTaskId(req: Request): string | undefined {
-  return (req.params as AdminTaskRouteParams).taskId;
+function getTaskId(req: Request): string {
+  return String((req.params as AdminTaskRouteParams).taskId || "");
 }
 
 router.get(

apps/backend/src/routes/admin/users.ts

@@ -7,7 +7,7 @@ import {
   updateManagedAdminUserRole,
   updateManagedAdminUserStatus,
 } from '../../services/admin/admin-auth-service.js'
-import { createJsonHandler, requireAdminRoles } from './shared.js'
+import { createJsonHandler, getRequiredAdminSession, requireAdminRoles } from './shared.js'
 
 type AdminUserMutationResult = {
   user: {
@@ -54,7 +54,7 @@ router.post('/users', createJsonHandler(
 ))
 
 router.post('/users/:userId/role', createJsonHandler(
-  (req) => updateManagedAdminUserRole(String(req.params.userId), req.body, req.adminSession),
+  (req) => updateManagedAdminUserRole(String(req.params.userId || ''), req.body, getRequiredAdminSession(req)),
   {
     successMessage: '用户角色已更新',
     errorMessage: '更新用户角色失败',
@@ -75,7 +75,7 @@ router.post('/users/:userId/role', createJsonHandler(
 ))
 
 router.post('/users/:userId/status', createJsonHandler(
-  (req) => updateManagedAdminUserStatus(String(req.params.userId), req.body, req.adminSession),
+  (req) => updateManagedAdminUserStatus(String(req.params.userId || ''), req.body, getRequiredAdminSession(req)),
   {
     successMessage: '用户状态已更新',
     errorMessage: '更新用户状态失败',
@@ -96,7 +96,7 @@ router.post('/users/:userId/status', createJsonHandler(
 ))
 
 router.post('/users/:userId/reset-password', createJsonHandler(
-  (req) => resetManagedAdminUserPassword(String(req.params.userId), req.body),
+  (req) => resetManagedAdminUserPassword(String(req.params.userId || ''), req.body),
   {
     successMessage: '用户密码已重置',
     errorMessage: '重置用户密码失败',