开启后端严格空值检查

apps/backend/src/services/admin/admin-auth-service.ts

@@ -171,8 +171,8 @@ export async function getAdminSessionSummary(token: unknown): Promise<JsonObject
   }
 }
 
-export function requireAdminRole(session: { role?: string }, allowedRoles: string[]): void {
-  if (allowedRoles.includes(session.role)) {
+export function requireAdminRole(session: { role?: string } | null | undefined, allowedRoles: string[]): void {
+  if (session && allowedRoles.includes(session.role || '')) {
     return
   }
 
@@ -236,6 +236,12 @@ export async function createManagedAdminUser(payload: JsonObject = {}): Promise<
     createdAt: now,
     updatedAt: now,
   })
+  if (!created) {
+    throw createHttpError('后台用户创建失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_create_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(created),
@@ -262,6 +268,12 @@ export async function updateManagedAdminUserRole(
     session_version: nextAdminSessionVersion(user),
     updated_at: nowIso(),
   })
+  if (!updated) {
+    throw createHttpError('后台用户更新失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_update_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(updated),
@@ -288,6 +300,12 @@ export async function updateManagedAdminUserStatus(
     session_version: nextAdminSessionVersion(user),
     updated_at: nowIso(),
   })
+  if (!updated) {
+    throw createHttpError('后台用户更新失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_update_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(updated),
@@ -311,6 +329,12 @@ export async function resetManagedAdminUserPassword(userId: number | string, pay
     session_version: nextAdminSessionVersion(user),
     updated_at: nowIso(),
   })
+  if (!updated) {
+    throw createHttpError('后台用户更新失败', {
+      statusCode: 500,
+      errorCode: 'admin_user_update_failed',
+    })
+  }
 
   return {
     user: mapAdminUser(updated),
@@ -490,7 +514,7 @@ async function ensureAdminUserChangeAllowed(
   }
 }
 
-function mapAdminUser(user: AdminUserRow | null): JsonObject {
+function mapAdminUser(user: AdminUserRow): JsonObject {
   return {
     userId: Number(user.id),
     username: String(user.username || ''),