开启后端严格空值检查

apps/backend/src/services/admin/admin-auth-service.ts

@@ -171,8 +171,8 @@ export async function getAdminSessionSummary(token: unknown): Promise<JsonObject
   }
 }
 
-export function requireAdminRole(session: { role?: string }, allowedRoles: string[]): void {
-  if (allowedRoles.includes(session.role)) {
+export function requireAdminRole(session: { role?: string } | null | undefined, allowedRoles: string[]): void {
+  if (session && allowedRoles.includes(session.role || '')) {
     return
   }
 
@@ -236,6 +236,12 @@ export async function createManagedAdminUser(payload: JsonObject = {}): Promise<
     createdAt: now,
     updatedAt: now,
   })
+  if (!created) {
+    throw createHttpError('后台用户创建失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_create_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(created),
@@ -262,6 +268,12 @@ export async function updateManagedAdminUserRole(
     session_version: nextAdminSessionVersion(user),
     updated_at: nowIso(),
   })
+  if (!updated) {
+    throw createHttpError('后台用户更新失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_update_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(updated),
@@ -288,6 +300,12 @@ export async function updateManagedAdminUserStatus(
     session_version: nextAdminSessionVersion(user),
     updated_at: nowIso(),
   })
+  if (!updated) {
+    throw createHttpError('后台用户更新失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_update_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(updated),
@@ -311,6 +329,12 @@ export async function resetManagedAdminUserPassword(userId: number | string, pay
     session_version: nextAdminSessionVersion(user),
     updated_at: nowIso(),
   })
+  if (!updated) {
+    throw createHttpError('后台用户更新失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_update_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(updated),
@@ -490,7 +514,7 @@ async function ensureAdminUserChangeAllowed(
   }
 }
 
-function mapAdminUser(user: AdminUserRow | null): JsonObject {
+function mapAdminUser(user: AdminUserRow): JsonObject {
   return {
     userId: Number(user.id),
     username: String(user.username || ''),

apps/backend/src/services/admin/admin-read-service.ts

@@ -158,9 +158,10 @@ export async function getAdminTaskDetail(
     })
   }
 
+  const primaryClaimTokenId = getTaskPrimaryClaimTokenId(task)
   const [order, claimToken, taskEvents] = await Promise.all([
     getOrderById(task.order_id),
-    getTaskPrimaryClaimTokenId(task) ? getClaimTokenById(getTaskPrimaryClaimTokenId(task)) : Promise.resolve(null),
+    primaryClaimTokenId ? getClaimTokenById(primaryClaimTokenId) : Promise.resolve(null),
     listTaskEventsByTaskId(task.id),
   ])
   const orderItems = order ? await listOrderItemsByOrderId(order.id) : []

apps/backend/src/services/admin/admin-read-shared-helpers.ts

@@ -269,7 +269,7 @@ export function canRegenerateClaimLinkForViewer(task: TaskLike, viewerContext: A
     return false
   }
 
-  const baseAllowed = ['link_generated', 'claimed', 'role_confirmed', 'retry_pending', 'manual_review'].includes(task.task_status)
+  const baseAllowed = ['link_generated', 'claimed', 'role_confirmed', 'retry_pending', 'manual_review'].includes(String(task.task_status || '').trim())
 
   if (!baseAllowed) {
     return false

apps/backend/src/services/admin/platform-config/cloudtentacles-service.ts

@@ -134,7 +134,7 @@ export function updateAdminCloudtentaclesSourceConfig(
   });
   const saved = saveCloudtentaclesSourceByKey(sourceKey, normalized);
   const shouldClearSession = hasCloudtentaclesCredentialContextChanged(
-    current,
+    current || undefined,
     saved
   );
   const session = shouldClearSession
@@ -146,7 +146,7 @@ export function updateAdminCloudtentaclesSourceConfig(
     filePath: getCloudtentaclesSourcesFilePath(),
     sessionFilePath: getCloudtentaclesSessionFilePath(),
     source: mapAdminCloudtentaclesSourceConfig(saved),
-    session: mapAdminCloudtentaclesSession(session),
+    session: mapAdminCloudtentaclesSession(session || undefined),
   };
 }