QA验收 #20
open三方员工密码验证与企业微信账号精确查询｜测试环境API验收
Added by Redmine Admin 20 days ago. Updated 19 days ago.
0%
Description
QA-TPAUTH-20261022：第三方员工邮箱密码验证与企业微信账号精确查询验收计划。
需求主线程：01a16384-db38-7983-9ca3-f310dfbbec8c。
目标仓库projects/ndb/backend，feature/third-party-password-verification；本地基线HEAD c2240364af37e9c307cb9e145a58608651c3e331，候选含未提交修改，以outputs/third-party-password-verification-20261022/release/candidate-files.json的11文件哈希冻结为准，不能只按HEAD判断部署候选。
接口：
- POST /internal/v1/users/authenticate/：应用AK/SK及独立user:authenticate；仅返回八个员工基本字段，不生成、返回或更新员工令牌，不改变密码及登录元数据。
- GET /internal/v1/users/：新增wecom_user_id精确区分大小写过滤，与其他条件AND、默认active；不构成企微身份认证，不增加返回字段。
复用本地105项一次性PostgreSQL与最终53项聚焦通过、独立安全审查无发现；不重跑、不相加，不提升成已部署测试服务结论。来源delivery.md、postgres-tests.log、wecom-filter-tests.log。
本阶段仅QA计划和记录准备，尚未执行测试环境用例，不记Pass。正式验收等待测试部署身份及合成fixture/应用授权方案确认。拟补：版本/候选核对，严格八字段/no-store，统一身份失败，签名/独立Scope/重放/IP/应用状态，输入及路由，既有会话与员工记录不变，共享Redis跨应用/进程限流，限定窗口脱敏日志，企微精确过滤/AND/状态/无效参数，真实服务接入文档复核。
仅测试环境；使用唯一QA标记无联系方式合成员工与专用应用，不用真实员工密码、不修改现有账号角色/应用、不触发通知。当前不授权QA发起正式API请求或创建fixture；共享缓存故障不靠停Redis制造，完整员工快照仅由Ops提供脱敏相等断言。凭据经bw且只内存使用，不打印或落盘。
纯API无UI，不强制截图手册；测试环境接入文档复核及逐用例Redmine追加、读回仍为门禁。QA不改源码/spec、不commit/push/部署；后续阶段由主Agent另行释放。
RA Updated by Redmine Admin 20 days ago Actions #1
QA-TPAUTH-PREP-20261022-FIXTURE：准备阶段只读发现（非正式测试轮次，新增Pass/Fail均0）。
已继承用户允许仅测试环境最多2合成员工＋2短期最小权限应用、验收后停用的授权；尚未创建任何对象，也未读取账号密码/密钥。正式新接口验收仍等测试v1.20.6b0精确SHA及主Agent释放。
创建前静态安全阻碍：
- config/middleware.py:9-19请求脱敏键未含password_confirmation；:61-69把/v1/带正文POST/PUT/PATCH的响应内容原样纳入日志，:105-112写日志，base.py:97启用。
- /v1/accounts/创建需要确认密码；/v1/api-applications/创建返回secret_key（application_auth/views.py:13-16、46-55）；正常登录返回token。按当前源码上述准备操作存在明文日志风险，因此未发送请求，不声称已在运行态观察到泄漏。需主Agent安排Backend/Ops确认测试服务的安全日志处理或批准受控替代fixture路径；QA不修源码、不关闭日志、不DB直写。
- bw已锁定，本环境找不到规定bw-login入口（command-v/whence均无），未换凭据或自行安装。需主Agent给可执行入口。
所见账号/应用create及登录路径无邮件/短信/企微/回调调用，保存信号搜索无匹配；仅为源码观察，不替代部署环境核验。
STATE-01先建立合成会话，再Ops基线→新internal认证→Ops字段后快照，最后才探测原会话仍可用；既有员工JWT请求会更新last_sign_in_at/IP，必须与“不变”快照窗口分开。
详见outputs/third-party-password-verification-20261022/qa/acceptance-plan.md追加章节。无测试环境请求、fixture写入、生产操作或凭据泄漏。
RA Updated by Redmine Admin 20 days ago Actions #2
QA-TPAUTH-PREP-20261022-RUNNER：准备进展与journal215边界修正，非正式测试轮次，新增API执行/Pass均0。
- 已用交互zsh确认bw-login为function；此前普通shell找不到不代表工具缺失。未打印定义、未解锁或读取凭据，当前受控fixture方案不需管理员登录。
- journal215日志观察来自main基线；主任务确认实际preview已对response_body递归脱敏，token键被遮罩，password_confirmation和secret_key风险仍在。并非已确认运行泄漏；不通过风险管理API创建fixture。
- 主任务安排Ops在核实测试身份后ORM事务建立最多2合成员工＋2短期最小权限应用、0600私密文件受控交接、验收后停用。QA不DB写、不管理创建、不自行发消息或改环境。尚无fixture ID，未创建任何对象。
- 无秘密api-runner.mjs及fixture-handoff-and-revocation.md已存QA目录；runner仅导出、无自动请求，限定测试域名和两个internal端点、显式部署/主任务释放门禁、不跟重定向/不自动重试，只输出脱敏布尔值。node --check通过，仅语法检查，不记业务Pass。
- 主任务提交3164550cf96ee3552fdb86be3ae648c44f2d75af，base.py仅格式换行/AST相同，candidate-files.json更新；不重跑业务测试。Ops部署中，正式API实测仍等待实际v1.20.6b0＋精确部署SHA及主任务释放。
STATE-01顺序及Ops字段/共享Redis/进程/日志配合方式见计划；合成会话登录只在实际runtime token脱敏确认后执行。未改业务源码、Git或环境。
RA Updated by Redmine Admin 20 days ago Actions #3
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-ENV-01
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-ENV-01",
"at": "2026-10-22T13:14:04.961Z",
"expected": "200 / 1.20.6b0 and candidate identity from Ops receipt",
"status": 200,
"version": "1.20.6b0",
"result": "Pass",
"directVersionObserved": true,
"candidateIdentitySource": "main-agent/Ops receipt",
"businessEndpointRequests": 0
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-ENV-01.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #4
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-AUTH-01
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-AUTH-01",
"at": "2026-10-22T13:14:05.751Z",
"requestId": "152aee8d-506c-4aad-b915-08e5343ddd7e",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 1,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": true,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "200 / eight fields / no-store / no echo",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-AUTH-01.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #5
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-AUTH-CASE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-AUTH-CASE",
"at": "2026-10-22T13:14:06.337Z",
"requestId": "cd486a53-0714-44c8-ba45-13a866bee689",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 2,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": true,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "case-insensitive email and unchanged eight-field projection",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-AUTH-CASE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #6
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-AUTH-WRONG
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-AUTH-WRONG",
"at": "2026-10-22T13:14:06.946Z",
"requestId": "1805db42-9d6e-4ade-b0c3-3c03d1788d45",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 3,
"status": 401,
"contentType": "application/json",
"code": "INVALID_CREDENTIALS",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "401 INVALID_CREDENTIALS",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-AUTH-WRONG.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #7
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-AUTH-NOTRIM
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-AUTH-NOTRIM",
"at": "2026-10-22T13:14:07.815Z",
"requestId": "983edf8c-aa72-4294-865a-8fa40567cee0",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 4,
"status": 401,
"contentType": "application/json",
"code": "INVALID_CREDENTIALS",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "trimmed password rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-AUTH-NOTRIM.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #8
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-AUTH-INACTIVE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-AUTH-INACTIVE",
"at": "2026-10-22T13:14:08.491Z",
"requestId": "62981789-567e-48db-9c4d-b278f6a8a9b9",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 5,
"status": 401,
"contentType": "application/json",
"code": "INVALID_CREDENTIALS",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "inactive indistinguishable failure",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-AUTH-INACTIVE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #9
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-AUTH-UNKNOWN
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-AUTH-UNKNOWN",
"at": "2026-10-22T13:14:09.075Z",
"requestId": "ddb3df47-a68e-4e44-80ab-c1c1237b69ec",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 6,
"status": 401,
"contentType": "application/json",
"code": "INVALID_CREDENTIALS",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "unknown indistinguishable failure",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-AUTH-UNKNOWN.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #10
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-PERM-SCOPE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-PERM-SCOPE",
"at": "2026-10-22T13:14:09.495Z",
"requestId": "94288098-6595-463f-8633-f81fe2bedf81",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 7,
"status": 403,
"contentType": "application/json",
"code": "permission_denied",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "B initial read-only scope must not authenticate",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-PERM-SCOPE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #11
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-PERM-MISSING
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-PERM-MISSING",
"at": "2026-10-22T13:14:09.971Z",
"requestId": "f96151d6-bce6-4bba-a566-3e09249aa1a9",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 8,
"status": 401,
"contentType": "application/json",
"code": "authentication_failed",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "missing application credentials rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-PERM-MISSING.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #12
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-PERM-SIGNATURE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-PERM-SIGNATURE",
"at": "2026-10-22T13:14:10.403Z",
"requestId": "967992d4-67c7-4983-8952-2ac012923d48",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 9,
"status": 401,
"contentType": "application/json",
"code": "authentication_failed",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "bad signature rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-PERM-SIGNATURE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #13
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-INPUT-EXTRA
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-INPUT-EXTRA",
"at": "2026-10-22T13:14:10.820Z",
"requestId": "e8a872f1-0f5b-49e5-99bb-1c1d14431b78",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 10,
"status": 400,
"contentType": "application/json",
"code": "INVALID_REQUEST",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "extra field rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-INPUT-EXTRA.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #14
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-INPUT-QUERY
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-INPUT-QUERY",
"at": "2026-10-22T13:14:11.260Z",
"requestId": "d58221de-8e09-4b5b-abee-a14f20d58d40",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 11,
"status": 400,
"contentType": "application/json",
"code": "INVALID_REQUEST",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "URL query rejected without putting password in URL",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-INPUT-QUERY.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #15
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-INPUT-TYPE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-INPUT-TYPE",
"at": "2026-10-22T13:14:11.748Z",
"requestId": "1a1b6f34-93fa-472f-a520-19337b97b7b0",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 12,
"status": 400,
"contentType": "application/json",
"code": "INVALID_REQUEST",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "non-string password rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-INPUT-TYPE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #16
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-INPUT-MEDIA
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-INPUT-MEDIA",
"at": "2026-10-22T13:14:12.167Z",
"requestId": "bbbc1585-7f4f-4952-bb33-153c6650bd58",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 13,
"status": 415,
"contentType": "application/json",
"code": "unsupported_media_type",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "non-JSON rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-INPUT-MEDIA.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #17
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-INPUT-METHOD
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-INPUT-METHOD",
"at": "2026-10-22T13:14:12.605Z",
"requestId": "69db33d5-65bf-41df-9f55-1c911d201c3e",
"method": "GET",
"path": "/internal/v1/users/authenticate/",
"sent": 14,
"status": 405,
"contentType": "application/json",
"code": "method_not_allowed",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "authentication endpoint is POST only",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-INPUT-METHOD.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #18
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-EXACT
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-EXACT",
"at": "2026-10-22T13:14:13.050Z",
"requestId": "c98723ba-4a54-4888-a7b7-5cb47b58f505",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 15,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "exact active match / eight fields",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-EXACT.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #19
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-CASE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-CASE",
"at": "2026-10-22T13:14:13.502Z",
"requestId": "c45d28ec-6b3f-4fc3-89c7-a2348d55637c",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 16,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "different case is no match",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-CASE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #20
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-AND
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-AND",
"at": "2026-10-22T13:14:13.983Z",
"requestId": "eba312a6-7f33-4932-8550-00414b2d0676",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 17,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "filters combine with AND",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-AND.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #21
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-DEFAULT
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-DEFAULT",
"at": "2026-10-22T13:14:14.461Z",
"requestId": "4d311a6c-71db-4219-9281-26f524024e31",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 18,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "inactive hidden by default",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-DEFAULT.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #22
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-INACTIVE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-INACTIVE",
"at": "2026-10-22T13:14:14.929Z",
"requestId": "e74b8f3a-56b0-4dee-b622-0cec3c344343",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 19,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "explicit inactive found",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-INACTIVE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #23
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-PERM-READ
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-PERM-READ",
"at": "2026-10-22T13:14:15.391Z",
"requestId": "31f08700-6498-40e7-baa8-4defe15572f6",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 20,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "B read-only scope can query directory",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-PERM-READ.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #24
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-EMPTY
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-EMPTY",
"at": "2026-10-22T13:14:15.855Z",
"requestId": "54b71006-595d-4083-825a-9001e513215e",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 21,
"status": 400,
"contentType": "application/json",
"code": "INVALID_REQUEST",
"noStore": false,
"retryAfter": null,
"rowCount": null,
"strictEightFields": false,
"onlyExpectedEmployeeIds": false,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "invalid wecom filter rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-EMPTY.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #25
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-SPACE
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-SPACE",
"at": "2026-10-22T13:14:16.322Z",
"requestId": "ec5ac0b8-9b7e-4585-8f31-8df59c03ff04",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 22,
"status": 400,
"contentType": "application/json",
"code": "INVALID_REQUEST",
"noStore": false,
"retryAfter": null,
"rowCount": null,
"strictEightFields": false,
"onlyExpectedEmployeeIds": false,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "invalid wecom filter rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-SPACE.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #26
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-WECOM-LONG
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-WECOM-LONG",
"at": "2026-10-22T13:14:17.753Z",
"requestId": "bc6a83d4-db02-44d2-8093-b945203f0730",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 23,
"status": 400,
"contentType": "application/json",
"code": "INVALID_REQUEST",
"noStore": false,
"retryAfter": null,
"rowCount": null,
"strictEightFields": false,
"onlyExpectedEmployeeIds": false,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "invalid wecom filter rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-WECOM-LONG.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #27
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-NONCE-FIRST
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-NONCE-FIRST",
"at": "2026-10-22T13:14:18.226Z",
"requestId": "41eaec5c-aecf-4089-9ddf-2654cea39e27",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 24,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": false,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "first nonce accepted",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-NONCE-FIRST.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #28
QA-TPAUTH-HTTP-R1-20261022 TPAUTH-NONCE-REPLAY
环境：仅tcrm-api；实际版本1.20.6b0；部署SHA818daa716fd035349460872b2c5afcca5cedb8fe。
角色：本轮应用A(3)/B(4)；仅合成员工17/18。API实际执行，非105/53复用计数。
{
"caseId": "TPAUTH-NONCE-REPLAY",
"at": "2026-10-22T13:14:19.162Z",
"requestId": "80e7f6d6-847b-4fc1-b43d-6ac474583d6f",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 25,
"status": 401,
"contentType": "application/json",
"code": "authentication_failed",
"noStore": false,
"retryAfter": null,
"rowCount": null,
"strictEightFields": false,
"onlyExpectedEmployeeIds": false,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "same nonce rejected",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-one-results/TPAUTH-NONCE-REPLAY.json
无管理员/业务管理API、普通员工登录、生产或外发操作。
RA Updated by Redmine Admin 20 days ago Actions #29
QA-TPAUTH-HTTP-R1-20261022 SUMMARY
第一阶段实际执行26 Pass / 0 Fail / 0 Blocked / 0 Skipped（1项版本＋25项internal API），不是完整需求验收。测试1.20.6b0；部署候选818daa716fd035349460872b2c5afcca5cedb8fe由主任务/Ops收据关联；QA直接GET版本200。逐项journals217–242均已精确读回，脱敏证据在outputs/third-party-password-verification-20261022/qa/stage-one-results/，摘要stage-one-summary.md。
仅员工17/18和应用3/4。正确密码／大小写邮箱、八字段/no-store、错误/去空白/inactive/不存在401、B仅read认证403但目录成功、缺鉴权/错签名、参数/媒体/方法、WeCom精确大小写/AND/状态/边界、Nonce重放均符合对应断言。错误同一性本轮仅证HTTP/code/信封一致，未保存message逐字比较；空团队字段值尚无本轮HTTP独立断言，不扩称覆盖。
另关联Ops实测RATE跨进程helper共享证据：release/ops/cross-process-throttle.json，PID30计数5、PID37续至11且第11次Throttled，同固定分钟/cacheConfigSHA、仅唯一probe键且TTL自动过期。不是HTTPworkerPID观测；不是本QA新增HTTP执行，外部API60/10阈值仍待测。原105/53本地通过复用不计新Pass。
两internal端点已用25/160请求，剩135；后续按证据恢复累计预算，禁止重建client/进程重置。正式普通登录/STATE仍未调用，待ALLOW_PASSWORD_LOGIN及runtime token脱敏布尔确认。IP/disabled/expiry/B增权需主任务安排Ops受控变化，无管理API写入。
下一步精确动作：应用4改仅user:authenticate、保持active/IP空/未来过期并读回，再验证目录权限反向隔离与跨应用限流；后续状态变化串行安排。fixture过期UTC15:10=上海23:10。
无源码/Git/部署/生产/真实员工密码/通知/管理API/DB写入。私密临时文件与私钥受限保留供后续测试，最终精确清理及fixture停用尚待收尾。
RA Updated by Redmine Admin 20 days ago Actions #30
QA-TPAUTH-STATE-PREP-20261022：STATE已获主任务追加放行，但尚未发起login/profile（非执行Fail，不改变R1的26 Pass）。
QA已读release/ops/login-safety-read.json：ALLOW_PASSWORD_LOGIN=true、responseBodyUsesRecursiveMask=true、tokenKeyInSensitiveSet=true。允许范围为合成17登录1次、profile最多2次，原始JWT不加Bearer；baseline/compare之间禁止旧JWT请求。
新的具体fixture冲突：api/authentication/serializers.py的AuthLoginSerializer.password使用默认CharField（trim_whitespace=true）；合成17密码首尾各2空格。第一阶段新接口已验证原密码成功、去空白后401。因此在未确认runtime差异前，不消耗唯一登录请求盲试，不改账号或业务代码。
请主任务安排Ops只读核对runtime登录serializer trim_whitespace；若仍true，最小恢复方式为仅对现有合成17受控换无首尾空格随机密码并重新密封交接，再进行正常登录/profile和Ops baseline。无需新增账号/应用，不自行DB写或生成token。已通过不trim历史保留。
目前STATE登录使用0/1、profile0/2；两internal端点累计25/160。私密文件受限保留，未输出秘密。
RA Updated by Redmine Admin 20 days ago Actions #31
QA-TPAUTH-STAGE-TWO-20261022 TPAUTH-B-AUTH-ONLY
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-B-AUTH-ONLY",
"at": "2026-10-22T13:20:35.167Z",
"requestId": "2c47753e-ee1f-409e-a3bd-25b795cca8cb",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 26,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": true,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"emptyTeamValues": true,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "B authenticate-only succeeds, strict envelope/eight fields, null team, no forbidden keys",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-two-results/TPAUTH-B-AUTH-ONLY.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #32
QA-TPAUTH-STAGE-TWO-20261022 TPAUTH-B-DIRECTORY-DENIED
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-B-DIRECTORY-DENIED",
"at": "2026-10-22T13:20:35.614Z",
"requestId": "a3f089c8-48b5-4270-aab9-ed4f7f070da2",
"method": "GET",
"path": "/internal/v1/users/",
"sent": 27,
"status": 403,
"contentType": "application/json",
"code": "permission_denied",
"noStore": false,
"retryAfter": null,
"rowCount": null,
"strictEightFields": false,
"emptyTeamValues": false,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": false,
"onlyExpectedEmployeeIds": false,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "B authenticate-only does not imply user:read",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-two-results/TPAUTH-B-DIRECTORY-DENIED.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #33
QA-TPAUTH-STAGE-TWO-20261022 TPAUTH-STATE-LOGIN-PREP
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-STATE-LOGIN-PREP",
"requestId": "7de1c1b9-fd73-44a4-9e79-159b3686db4a",
"start": "2026-10-22T13:20:36.003Z",
"at": "2026-10-22T13:20:36.247Z",
"method": "POST",
"path": "/v1/auth/login",
"status": 200,
"acceptedEmployee18": true,
"tokenPersistedOnlyPrivate0600": true,
"expected": "One normal synthetic18 login before baseline; not full STATE verdict",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-two-results/TPAUTH-STATE-LOGIN-PREP.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #34
QA-TPAUTH-STAGE-TWO-20261022 TPAUTH-STATE-PROFILE-BEFORE
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-STATE-PROFILE-BEFORE",
"requestId": "c2c237ce-a020-4d06-b215-a755e08f2026",
"start": "2026-10-22T13:20:36.679Z",
"at": "2026-10-22T13:20:36.753Z",
"method": "GET",
"path": "/v1/accounts/user-profile/",
"status": 200,
"authenticatedEmployee18": true,
"expected": "Existing raw JWT accepted via persistent-token authentication before baseline",
"result": "Pass"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/stage-two-results/TPAUTH-STATE-PROFILE-BEFORE.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #35
QA-TPAUTH-STATE-INTERVAL-20261022 TPAUTH-STATE-AUTH-SUCCESS
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-STATE-AUTH-SUCCESS",
"at": "2026-10-22T13:23:06.164Z",
"requestId": "4647b375-4c9f-41fa-a941-873043bf400c",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 28,
"status": 200,
"contentType": "application/json",
"code": 200,
"noStore": true,
"retryAfter": null,
"rowCount": 1,
"strictEightFields": true,
"emptyTeamValues": true,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": true,
"errorHasNoData": false,
"exactSuccessEnvelope": true,
"exactErrorEnvelope": false,
"noCredentialEcho": true,
"expected": "200, exact envelope/eight fields, null team, recursively no forbidden keys, no-store",
"result": "Pass",
"opsBaselineReceivedViaMainAgent": true,
"jwtRequestsDuringInterval": 0
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/state-interval-results/TPAUTH-STATE-AUTH-SUCCESS.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #36
QA-TPAUTH-STATE-INTERVAL-20261022 TPAUTH-STATE-AUTH-WRONG
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-STATE-AUTH-WRONG",
"at": "2026-10-22T13:23:06.818Z",
"requestId": "bb281774-906e-405f-beac-36af1df525c5",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 29,
"status": 401,
"contentType": "application/json",
"code": "INVALID_CREDENTIALS",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"emptyTeamValues": false,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "401 INVALID_CREDENTIALS, exact generic-message boolean true, no data/forbidden keys",
"result": "Pass",
"opsBaselineReceivedViaMainAgent": true,
"jwtRequestsDuringInterval": 0
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/state-interval-results/TPAUTH-STATE-AUTH-WRONG.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #37
QA-TPAUTH-STATE-INTERVAL-20261022 TPAUTH-MESSAGE-NONEXISTENT
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-MESSAGE-NONEXISTENT",
"at": "2026-10-22T13:23:07.496Z",
"requestId": "878db17a-66b3-4b55-8467-5ce9d87dff00",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 30,
"status": 401,
"contentType": "application/json",
"code": "INVALID_CREDENTIALS",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"emptyTeamValues": false,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": true,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "Same 401/code/message exact-match boolean and error envelope as wrong password",
"result": "Pass",
"opsBaselineReceivedViaMainAgent": true,
"jwtRequestsDuringInterval": 0
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/state-interval-results/TPAUTH-MESSAGE-NONEXISTENT.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #38
QA-TPAUTH-STATE-CLOSE-20261022 TPAUTH-STATE-COMPLETE
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-STATE-COMPLETE",
"requestId": "000f6c14-382d-4dba-936e-9d6d737b72b9",
"start": "2026-10-22T13:25:31.214Z",
"at": "2026-10-22T13:25:31.426Z",
"method": "GET",
"path": "/v1/accounts/user-profile/",
"status": 200,
"sameOriginalSessionEmployee18": true,
"opsAll33FieldsEqualFor17And18": true,
"expected": "Original persistent JWT still works after new auth; all 33 employee fields unchanged",
"evidence": [
"release/ops/state-baseline.json",
"release/ops/state-comparison.json",
"qa/stage-two-results/",
"qa/state-interval-results/"
],
"result": "Pass",
"oldSessionLoginUsed": 1,
"profileProbesUsed": 2,
"internalRequestsTotal": 30,
"rawCredentialsPersistedOnlyPrivate": true
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/state-close-results/TPAUTH-STATE-COMPLETE.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #39
QA-TPAUTH-RATE-WINDOWS-20261022 TPAUTH-RATE-EMAIL
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-RATE-EMAIL",
"start": "2026-10-22T13:27:01.502Z",
"at": "2026-10-22T13:27:04.012Z",
"expected": "One fixed minute: two apps and email case variants share 10; 11th429, valid Retry-After",
"fixedWindowUtc": "2026-10-22T13:27:00.000Z",
"crossedWindow": false,
"expectedSteps": 11,
"actualSteps": 11,
"steps": [
{
"i": 1,
"applicationId": 3,
"start": "2026-10-22T13:27:01.504Z",
"at": "2026-10-22T13:27:01.882Z",
"requestId": "5f2d7366-e80c-44e3-8120-5968e362d3a5",
"sent": 31,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 2,
"applicationId": 4,
"start": "2026-10-22T13:27:01.884Z",
"at": "2026-10-22T13:27:02.127Z",
"requestId": "79a8080b-1ba8-4429-a495-dd6bc14a2f5c",
"sent": 32,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 3,
"applicationId": 3,
"start": "2026-10-22T13:27:02.128Z",
"at": "2026-10-22T13:27:02.448Z",
"requestId": "c3f719b1-4956-4e4a-8adb-d69668188ba8",
"sent": 33,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 4,
"applicationId": 4,
"start": "2026-10-22T13:27:02.449Z",
"at": "2026-10-22T13:27:02.702Z",
"requestId": "60ecc1e6-005f-42eb-bf21-4e33dc6de49b",
"sent": 34,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 5,
"applicationId": 3,
"start": "2026-10-22T13:27:02.704Z",
"at": "2026-10-22T13:27:02.913Z",
"requestId": "81e8277b-8d1d-4d08-b7d7-af7f885bec02",
"sent": 35,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 6,
"applicationId": 4,
"start": "2026-10-22T13:27:02.915Z",
"at": "2026-10-22T13:27:03.122Z",
"requestId": "797f1686-073a-4265-917f-b096a36e7d46",
"sent": 36,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 7,
"applicationId": 3,
"start": "2026-10-22T13:27:03.123Z",
"at": "2026-10-22T13:27:03.326Z",
"requestId": "e4ac69ad-bfb4-4a19-bcb1-b4ce7997f9f5",
"sent": 37,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 8,
"applicationId": 4,
"start": "2026-10-22T13:27:03.328Z",
"at": "2026-10-22T13:27:03.534Z",
"requestId": "815b5122-8bdc-4139-a112-d121c0788044",
"sent": 38,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 9,
"applicationId": 3,
"start": "2026-10-22T13:27:03.535Z",
"at": "2026-10-22T13:27:03.750Z",
"requestId": "34f0b49b-4258-4816-9573-aebb7ab37adb",
"sent": 39,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 10,
"applicationId": 4,
"start": "2026-10-22T13:27:03.751Z",
"at": "2026-10-22T13:27:03.952Z",
"requestId": "019d05e4-b8ab-4aea-9c4b-83255b7396ef",
"sent": 40,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 11,
"applicationId": 3,
"start": "2026-10-22T13:27:03.953Z",
"at": "2026-10-22T13:27:04.011Z",
"requestId": "7ece8e17-dc20-4f55-82fb-ca503f74eccf",
"sent": 41,
"status": 429,
"code": "throttled",
"retryAfter": 56,
"safeResponse": true,
"expectedBehavior": true
}
],
"result": "Pass",
"internalRequestsTotal": 41,
"evidenceLayer": "external HTTPS API fixed-window threshold; not HTTP worker PID observation",
"explanation": "No other QA traffic during this window; no Redis clear/config changes"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/rate-windows-results/TPAUTH-RATE-EMAIL.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #40
QA-TPAUTH-RATE-WINDOWS-20261022 TPAUTH-RATE-APPLICATION
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-RATE-APPLICATION",
"start": "2026-10-22T13:28:01.502Z",
"at": "2026-10-22T13:28:15.452Z",
"expected": "Separate fixed minute: A across unique nonexistent emails allows60, 61st429",
"fixedWindowUtc": "2026-10-22T13:28:00.000Z",
"crossedWindow": false,
"expectedSteps": 61,
"actualSteps": 61,
"steps": [
{
"i": 1,
"applicationId": 3,
"start": "2026-10-22T13:28:01.502Z",
"at": "2026-10-22T13:28:01.799Z",
"requestId": "83224428-a03a-4563-9e40-762426399c29",
"sent": 42,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 2,
"applicationId": 3,
"start": "2026-10-22T13:28:01.800Z",
"at": "2026-10-22T13:28:01.999Z",
"requestId": "8251e089-ff69-4ccb-9a84-e5af3b3bbd64",
"sent": 43,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 3,
"applicationId": 3,
"start": "2026-10-22T13:28:02.000Z",
"at": "2026-10-22T13:28:02.204Z",
"requestId": "5d4db563-94b9-4232-b98f-98d7fa3ae31e",
"sent": 44,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 4,
"applicationId": 3,
"start": "2026-10-22T13:28:02.205Z",
"at": "2026-10-22T13:28:02.403Z",
"requestId": "25e358dd-e460-47cc-b40e-96dbcbcecfe7",
"sent": 45,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 5,
"applicationId": 3,
"start": "2026-10-22T13:28:02.404Z",
"at": "2026-10-22T13:28:02.616Z",
"requestId": "909bf352-c2b9-4e0e-b5bd-75eb19ee6e06",
"sent": 46,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 6,
"applicationId": 3,
"start": "2026-10-22T13:28:02.617Z",
"at": "2026-10-22T13:28:02.822Z",
"requestId": "40aa6d15-e751-4ddd-8a6b-02b92ca02f7f",
"sent": 47,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 7,
"applicationId": 3,
"start": "2026-10-22T13:28:02.824Z",
"at": "2026-10-22T13:28:03.024Z",
"requestId": "0f21bf2d-2473-4ff2-b835-f7ddc16b0e16",
"sent": 48,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 8,
"applicationId": 3,
"start": "2026-10-22T13:28:03.025Z",
"at": "2026-10-22T13:28:03.231Z",
"requestId": "596139ac-e3ad-43a0-8f8c-a8828e72b50d",
"sent": 49,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 9,
"applicationId": 3,
"start": "2026-10-22T13:28:03.232Z",
"at": "2026-10-22T13:28:03.486Z",
"requestId": "fcb45460-ba50-41e0-807f-6415a5bdf020",
"sent": 50,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 10,
"applicationId": 3,
"start": "2026-10-22T13:28:03.486Z",
"at": "2026-10-22T13:28:03.872Z",
"requestId": "56413f1c-f375-406a-a8f9-60eea63ef416",
"sent": 51,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 11,
"applicationId": 3,
"start": "2026-10-22T13:28:03.872Z",
"at": "2026-10-22T13:28:04.238Z",
"requestId": "9efc7e97-6a49-456a-9f3b-143e2826be3a",
"sent": 52,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 12,
"applicationId": 3,
"start": "2026-10-22T13:28:04.239Z",
"at": "2026-10-22T13:28:04.664Z",
"requestId": "85ef405f-ab7f-417f-9c67-c2f7e9532172",
"sent": 53,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 13,
"applicationId": 3,
"start": "2026-10-22T13:28:04.664Z",
"at": "2026-10-22T13:28:04.930Z",
"requestId": "d61d994c-e392-45b2-8dfb-6eee9061ea7f",
"sent": 54,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 14,
"applicationId": 3,
"start": "2026-10-22T13:28:04.931Z",
"at": "2026-10-22T13:28:05.251Z",
"requestId": "e4ad485c-a915-45ec-ab79-48ca157d09f9",
"sent": 55,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 15,
"applicationId": 3,
"start": "2026-10-22T13:28:05.251Z",
"at": "2026-10-22T13:28:05.471Z",
"requestId": "ef66dc6a-7f91-4836-9300-023ed5206a37",
"sent": 56,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 16,
"applicationId": 3,
"start": "2026-10-22T13:28:05.472Z",
"at": "2026-10-22T13:28:05.691Z",
"requestId": "102dc864-f2d2-4478-b5ea-7daa8efbfdf0",
"sent": 57,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 17,
"applicationId": 3,
"start": "2026-10-22T13:28:05.692Z",
"at": "2026-10-22T13:28:05.939Z",
"requestId": "f3fe5d12-306f-4a23-9e1c-e6ceb0e2e2dc",
"sent": 58,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 18,
"applicationId": 3,
"start": "2026-10-22T13:28:05.941Z",
"at": "2026-10-22T13:28:06.158Z",
"requestId": "18d2817b-e901-4a55-ba6f-01c3f57654f1",
"sent": 59,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 19,
"applicationId": 3,
"start": "2026-10-22T13:28:06.159Z",
"at": "2026-10-22T13:28:06.377Z",
"requestId": "b02f1c27-5c1b-4ac8-b988-f0e2977163c7",
"sent": 60,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 20,
"applicationId": 3,
"start": "2026-10-22T13:28:06.378Z",
"at": "2026-10-22T13:28:06.647Z",
"requestId": "c99434e0-629c-4735-8772-4d8de000bd4c",
"sent": 61,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 21,
"applicationId": 3,
"start": "2026-10-22T13:28:06.648Z",
"at": "2026-10-22T13:28:06.867Z",
"requestId": "c00c6a63-60e2-4d71-8e01-bcb70e585726",
"sent": 62,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 22,
"applicationId": 3,
"start": "2026-10-22T13:28:06.869Z",
"at": "2026-10-22T13:28:07.069Z",
"requestId": "11d6ec45-d250-4b50-ad04-69388a03e1ff",
"sent": 63,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 23,
"applicationId": 3,
"start": "2026-10-22T13:28:07.069Z",
"at": "2026-10-22T13:28:07.271Z",
"requestId": "e5a9f2b7-fd0d-48bd-9990-52602970dc0e",
"sent": 64,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 24,
"applicationId": 3,
"start": "2026-10-22T13:28:07.272Z",
"at": "2026-10-22T13:28:07.487Z",
"requestId": "7a3cb733-73da-48f6-8440-3f55a3e4e63b",
"sent": 65,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 25,
"applicationId": 3,
"start": "2026-10-22T13:28:07.488Z",
"at": "2026-10-22T13:28:07.684Z",
"requestId": "a72dab37-f7ff-4ef1-a5ae-4a10b0e79bba",
"sent": 66,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 26,
"applicationId": 3,
"start": "2026-10-22T13:28:07.685Z",
"at": "2026-10-22T13:28:07.894Z",
"requestId": "203dbf73-955e-49dd-b364-b24f8a0fb888",
"sent": 67,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 27,
"applicationId": 3,
"start": "2026-10-22T13:28:07.895Z",
"at": "2026-10-22T13:28:08.093Z",
"requestId": "9e3f1dc3-1968-4672-b29a-3a40d6258542",
"sent": 68,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 28,
"applicationId": 3,
"start": "2026-10-22T13:28:08.094Z",
"at": "2026-10-22T13:28:08.291Z",
"requestId": "dfc02ff8-7cb8-4121-a8c0-5bf07742350c",
"sent": 69,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 29,
"applicationId": 3,
"start": "2026-10-22T13:28:08.293Z",
"at": "2026-10-22T13:28:08.526Z",
"requestId": "db2d4ee5-350f-4e35-adab-9d65b20f2c9e",
"sent": 70,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 30,
"applicationId": 3,
"start": "2026-10-22T13:28:08.527Z",
"at": "2026-10-22T13:28:08.735Z",
"requestId": "c92ce961-3359-467a-b9d4-ca6dd0edc7a6",
"sent": 71,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 31,
"applicationId": 3,
"start": "2026-10-22T13:28:08.737Z",
"at": "2026-10-22T13:28:08.946Z",
"requestId": "c40dc38b-e1e8-4a68-b8d8-a3c0d2dc7bb9",
"sent": 72,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 32,
"applicationId": 3,
"start": "2026-10-22T13:28:08.947Z",
"at": "2026-10-22T13:28:09.145Z",
"requestId": "052ac8d0-c8eb-4980-b278-d7fe33507f11",
"sent": 73,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 33,
"applicationId": 3,
"start": "2026-10-22T13:28:09.146Z",
"at": "2026-10-22T13:28:09.351Z",
"requestId": "208c2a2b-5f86-4bac-b47c-ed92ad26a8dd",
"sent": 74,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 34,
"applicationId": 3,
"start": "2026-10-22T13:28:09.352Z",
"at": "2026-10-22T13:28:09.561Z",
"requestId": "92a894eb-b7d0-4771-b09e-30068a4da1c0",
"sent": 75,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 35,
"applicationId": 3,
"start": "2026-10-22T13:28:09.563Z",
"at": "2026-10-22T13:28:09.777Z",
"requestId": "56bf5c51-4207-4e0d-81ee-ea6574128657",
"sent": 76,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 36,
"applicationId": 3,
"start": "2026-10-22T13:28:09.779Z",
"at": "2026-10-22T13:28:10.013Z",
"requestId": "40d9c3e4-1a14-44a4-bf4e-6371b15b1029",
"sent": 77,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 37,
"applicationId": 3,
"start": "2026-10-22T13:28:10.014Z",
"at": "2026-10-22T13:28:10.218Z",
"requestId": "e7b7df59-8041-4209-b9b1-4ebcaa5bc670",
"sent": 78,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 38,
"applicationId": 3,
"start": "2026-10-22T13:28:10.219Z",
"at": "2026-10-22T13:28:10.531Z",
"requestId": "9f64c85a-e8bd-4fa0-985f-8f1c54db308b",
"sent": 79,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 39,
"applicationId": 3,
"start": "2026-10-22T13:28:10.533Z",
"at": "2026-10-22T13:28:10.781Z",
"requestId": "122281f2-7e77-4133-a659-f49ced155519",
"sent": 80,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 40,
"applicationId": 3,
"start": "2026-10-22T13:28:10.782Z",
"at": "2026-10-22T13:28:11.015Z",
"requestId": "f00139fe-035f-4d4c-bf29-2b4722460f06",
"sent": 81,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 41,
"applicationId": 3,
"start": "2026-10-22T13:28:11.015Z",
"at": "2026-10-22T13:28:11.237Z",
"requestId": "e8113b5f-cf82-4f10-abaa-a02b7e6dbe5b",
"sent": 82,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 42,
"applicationId": 3,
"start": "2026-10-22T13:28:11.239Z",
"at": "2026-10-22T13:28:11.631Z",
"requestId": "ca3b84ff-18ea-4a78-99b4-86eb1626e82e",
"sent": 83,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 43,
"applicationId": 3,
"start": "2026-10-22T13:28:11.631Z",
"at": "2026-10-22T13:28:11.906Z",
"requestId": "d77a03ef-c8dc-4179-8fda-98d324407376",
"sent": 84,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 44,
"applicationId": 3,
"start": "2026-10-22T13:28:11.907Z",
"at": "2026-10-22T13:28:12.108Z",
"requestId": "d5e42458-668a-4f1c-8cf1-27c62ae21004",
"sent": 85,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 45,
"applicationId": 3,
"start": "2026-10-22T13:28:12.109Z",
"at": "2026-10-22T13:28:12.308Z",
"requestId": "047df9f2-f90d-45fc-9aa8-daf24630b8a3",
"sent": 86,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 46,
"applicationId": 3,
"start": "2026-10-22T13:28:12.309Z",
"at": "2026-10-22T13:28:12.506Z",
"requestId": "a896abfa-04b4-48bd-8bbd-22087d7326b0",
"sent": 87,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 47,
"applicationId": 3,
"start": "2026-10-22T13:28:12.507Z",
"at": "2026-10-22T13:28:12.720Z",
"requestId": "1f3ded8d-1af1-49e0-a96b-f526382a9a28",
"sent": 88,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 48,
"applicationId": 3,
"start": "2026-10-22T13:28:12.721Z",
"at": "2026-10-22T13:28:12.930Z",
"requestId": "6573dbb2-d81f-4d13-bf96-6d2f23455cda",
"sent": 89,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 49,
"applicationId": 3,
"start": "2026-10-22T13:28:12.931Z",
"at": "2026-10-22T13:28:13.146Z",
"requestId": "f22b6221-c18b-4a0a-a752-37db82673228",
"sent": 90,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 50,
"applicationId": 3,
"start": "2026-10-22T13:28:13.147Z",
"at": "2026-10-22T13:28:13.346Z",
"requestId": "3d19797f-fcaf-4f99-a4c4-61698857d0c0",
"sent": 91,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 51,
"applicationId": 3,
"start": "2026-10-22T13:28:13.347Z",
"at": "2026-10-22T13:28:13.571Z",
"requestId": "3e10f06a-ef2e-436f-9446-4d5837effaf7",
"sent": 92,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 52,
"applicationId": 3,
"start": "2026-10-22T13:28:13.572Z",
"at": "2026-10-22T13:28:13.779Z",
"requestId": "be7dea75-3f5b-4336-8778-d21176a86ce0",
"sent": 93,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 53,
"applicationId": 3,
"start": "2026-10-22T13:28:13.779Z",
"at": "2026-10-22T13:28:13.977Z",
"requestId": "35cc7296-cde4-422b-a899-659b25c266b4",
"sent": 94,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 54,
"applicationId": 3,
"start": "2026-10-22T13:28:13.979Z",
"at": "2026-10-22T13:28:14.181Z",
"requestId": "07fdffc3-6ad9-4a67-a47d-dbde2663d616",
"sent": 95,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 55,
"applicationId": 3,
"start": "2026-10-22T13:28:14.182Z",
"at": "2026-10-22T13:28:14.384Z",
"requestId": "043b03d6-6ca6-41ff-a213-c98348b22388",
"sent": 96,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 56,
"applicationId": 3,
"start": "2026-10-22T13:28:14.389Z",
"at": "2026-10-22T13:28:14.589Z",
"requestId": "905300e1-b807-44ae-a545-a30a86750777",
"sent": 97,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 57,
"applicationId": 3,
"start": "2026-10-22T13:28:14.590Z",
"at": "2026-10-22T13:28:14.792Z",
"requestId": "ea1dbbcb-f0f0-4826-8603-9fe42ddfdf90",
"sent": 98,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 58,
"applicationId": 3,
"start": "2026-10-22T13:28:14.794Z",
"at": "2026-10-22T13:28:14.992Z",
"requestId": "7b45009c-f127-43d9-aea7-4931748c56fc",
"sent": 99,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 59,
"applicationId": 3,
"start": "2026-10-22T13:28:14.993Z",
"at": "2026-10-22T13:28:15.190Z",
"requestId": "db56fc95-caca-4642-bc65-b77a6a951313",
"sent": 100,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 60,
"applicationId": 3,
"start": "2026-10-22T13:28:15.190Z",
"at": "2026-10-22T13:28:15.389Z",
"requestId": "f4595798-bc82-42a4-b63f-834878c9393f",
"sent": 101,
"status": 401,
"code": "INVALID_CREDENTIALS",
"retryAfter": null,
"safeResponse": true,
"expectedBehavior": true
},
{
"i": 61,
"applicationId": 3,
"start": "2026-10-22T13:28:15.389Z",
"at": "2026-10-22T13:28:15.452Z",
"requestId": "c900d419-4951-4838-aae9-bb214b5899d3",
"sent": 102,
"status": 429,
"code": "throttled",
"retryAfter": 44,
"safeResponse": true,
"expectedBehavior": true
}
],
"result": "Pass",
"internalRequestsTotal": 102,
"evidenceLayer": "external HTTPS API fixed-window threshold; not HTTP worker PID observation",
"explanation": "No other QA traffic during this window; no Redis clear/config changes"
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/rate-windows-results/TPAUTH-RATE-APPLICATION.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #41
QA-TPAUTH-LOG-01-20261022
用例LOG-01：Pass（Ops真实限定日志证据关联，新增QA HTTP=0）。来源outputs/third-party-password-verification-20261022/release/ops/final-log-review.json。
UTC13:20:30–13:25:40：3/3指定旧会话Request ID匹配，missing空；2处敏感键值均masked、unmasked0；应用3/4的4条认证审计白名单全匹配，无额外字段。verificationStatus=verified、无配置变更、无原始日志或秘密输出。
仅覆盖精确QA Request IDs及指定应用审计，不涵盖任意自由文本、缺失记录、其他员工或其他窗口；不涵盖其后的13:27/13:28限流窗口。不因复用Ops证据重复计HTTP或扫描。
本地记录qa/log-and-document-review.md；全部HTTP暂停，累计internal102/160。
RA Updated by Redmine Admin 20 days ago Actions #42
QA-TPAUTH-DOC-01-20261022
DOC-01最终确认：Blocked（待文档状态/schema对齐；不是API运行失败）。本次只读对照真实测试结果与两spec、release/apifox-two-endpoints.Users.draft.json、apifox-guide-after-qa.draft.md及before/diff，没有新HTTP。
核心契约一致：两paths/Users目录、独立Scope双向、八字段/null团队、STATE不变、wecom精确过滤、签名/错误/60与10固定窗口/no-store、测试1.20.6b0及生产待1.20.6。
待主任务精确修订：
1）密码spec第3/97行仍写本地未部署/未测试；目录spec第3/128行仍写未部署/真实PG和部署后联调未做。请按证据区分已部署测试/合成API及STATE限流已验，与生产/真实员工/真实第三方未测；不能把测试结论升级成生产或抹去历史。
2）Users草稿components.schemas.InternalUser.properties的name_cn/name_en/title均缺nullable:true，与目录spec允许null及模型定义不符。团队字段已nullable，无需重改。静态schema差异不等于本轮已造空姓名fixture实测。
QA不修改spec/schema，不重跑26项；收到修订delta仅复核这两类。无截图手册要求，接入文档最终通过仍须闭环。详情qa/log-and-document-review.md。internal仍102/160，HTTP暂停；IP/disabled/expiry待Ops受控收据。
RA Updated by Redmine Admin 20 days ago Actions #43
QA-TPAUTH-IP-DENY-20261022 TPAUTH-PERM-IP-DENY
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-PERM-IP-DENY",
"at": "2026-10-22T13:32:18.822Z",
"requestId": "ee48250c-f0c8-4176-ac96-3e4641aeda8d",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 103,
"status": 403,
"contentType": "application/json",
"code": "permission_denied",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"emptyTeamValues": false,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "403 permission_denied, no data/no-store, no credential echo",
"result": "Pass",
"receipt": "release/ops/app4-ip-deny.json",
"serverStateChangedByQa": false
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/ip-deny-results/TPAUTH-PERM-IP-DENY.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #44
QA-TPAUTH-DOC-01-DELTA-20261022
DOC-01定向复核：Pass（仅精确发布文档候选内容审核）。关闭journal256的文档内容阻塞，保留其历史Blocked；无新HTTP/业务重测。
已读approved-release-docs两spec/backlog精确diff、release-docs-manifest.json、apifox-schema-normalization.json。三文件3164550基线hash与目标hash全部独立核对一致。
密码spec目标160f7b7a52694284e79403af60fcd2a7c953b4ce2cf485c91330973b36ae6115；
目录spec目标9fc550fc18033b991d2e7f997eff2a809ffe3bc8ba4e83fafe7f7d7167c220d5；
backlog目标b55a5ca4b0ba3bb8f9aac9822ac412bc0d12b48fb966b40f0117103bfd6068e0。
Users分发schema SHA48d73bb72b94a845537985664799b7b5e5bd0d4d8420db6cca2aa40fd29430f6，前后递归比较恰name_cn/name_en/title的nullable新增true，其余路径/字段/Users标签不变。
状态文案正确区分测试1.20.6b0合成API/STATE/限流已验与生产/真实员工/真实上游未测；raw server schema nullable遗漏明确留backlog，不声称原server输出已相同或新增null姓名fixture实测。
源repo当前尚未应用这些稿，Apifox也未正式同步：由主任务在生产发布元数据提交时按manifest机械应用并精确读回；这不是重开业务QA或新beta前置。最终相关内容若变，仅复核delta。无须先物理写回repo才认可本次内容审核。
证据qa/log-and-document-review.md。QA未改业务代码/spec/schema；internal仍103/160，HTTP暂停待应用4disabled收据。
RA Updated by Redmine Admin 20 days ago Actions #45
QA-TPAUTH-DISABLED-20261022 TPAUTH-PERM-DISABLED
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-PERM-DISABLED",
"at": "2026-10-22T13:39:01.896Z",
"requestId": "14fb25f4-0b06-4e2c-814f-a2487237327c",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 104,
"status": 401,
"contentType": "application/json",
"code": "authentication_failed",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"emptyTeamValues": false,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "401 authentication_failed, no employee data/no-store",
"result": "Pass",
"receipt": "release/ops/app4-disabled.json",
"serverStateChangedByQa": false
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/disabled-results/TPAUTH-PERM-DISABLED.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #46
QA-TPAUTH-EXPIRED-20261022 TPAUTH-PERM-EXPIRED
仅测试tcrm-api；1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；本轮合成员工17/18、应用3/4，不涉及真实员工或生产。
{
"caseId": "TPAUTH-PERM-EXPIRED",
"at": "2026-10-22T13:41:55.210Z",
"requestId": "784c08a9-4714-46d9-93f6-c23c201dbccc",
"method": "POST",
"path": "/internal/v1/users/authenticate/",
"sent": 105,
"status": 401,
"contentType": "application/json",
"code": "authentication_failed",
"noStore": true,
"retryAfter": null,
"rowCount": 0,
"strictEightFields": false,
"emptyTeamValues": false,
"noForbiddenResponseKeys": true,
"genericCredentialMessageExact": false,
"onlyExpectedEmployeeIds": true,
"idsMatchInOrder": false,
"errorHasNoData": true,
"exactSuccessEnvelope": false,
"exactErrorEnvelope": true,
"noCredentialEcho": true,
"expected": "Active application with past expiry returns401, no data/no-store",
"result": "Pass",
"receipt": "release/ops/app4-expired.json",
"serverStateChangedByQa": false
}
脱敏证据：outputs/third-party-password-verification-20261022/qa/expired-results/TPAUTH-PERM-EXPIRED.json
此为独立子项，不表示完整STATE/全量QA通过；105/53本地证据不计新执行。
RA Updated by Redmine Admin 20 days ago Actions #47
QA-TPAUTH-ACCEPTANCE-SUMMARY-20261022
测试环境QA验收汇总（收尾前）¶
日期：2026-10-22 Asia/Shanghai；Redmine NDB #20。
测试1.20.6b0，部署818daa716fd035349460872b2c5afcca5cedb8fe；版本由QA直接GET核实，SHA/镜像/数据源由主任务和Ops精确收据关联。无生产、真实员工密码、第三方外发或管理API写入。
结论及计数¶
批准范围内实际接口／会话矩阵 39 Pass / 0 Fail / 0 Blocked / 0 Skipped，39条执行结果均有本地脱敏证据及精确Redmine读回。另列 LOG-01 Pass（Ops限定证据关联）、DOC-01 Pass（精确发布文档候选内容审核），不混算成新HTTP执行。
| 执行分组 | 结果条目 | 说明 |
|---|---|---|
| ENV直接版本 | 1 Pass | 独立GET version，非业务完整流程 |
| 第一阶段internal契约 | 25 Pass | 严格投影、正反例、协议、权限、WeCom参数、Nonce |
| phase2权限反向 | 2 Pass | B仅authenticate认证成功、目录403 |
| STATE定向AUTH/补断言 | 3 Pass | 成功、wrong、nonexistent；精确信封/null团队/递归禁止键/message布尔 |
| STATE旧会话步骤与最终组合 | 3 Pass | 正常login、profile-before、profile-after＋Ops33字段全部相等；组合不再另外累计一条 |
| RATE外部阈值 | 2 Pass | 11及61步骤是两个完整用例，不是72条Pass |
| IP／disabled／expired | 3 Pass | 每个阶段Ops受控读回后仅一次签名请求 |
| 合计 | 39 Pass | 与final-case-index.json逐条一致 |
请求预算：两个internal端点合计 105/160（25＋2＋3＋72＋3），剩55；额外普通合成login1/1、profile2/2全用完，另version1次。因此HTTP总请求109次；不是105个测试用例，也不能与原105本地PG测试数量相加。所有HTTP停止，不再补场景。
关键通过证据¶
- 仅返回严格八字段及code/message/data；无团队时两值null，递归无token/password/hash/secret等禁止键；密码不trim、邮箱大小写不敏感。
- wrong/nonexistent message精确匹配只保存布尔，统一401/code/无data；原inactive18负例在阶段一通过，之后Ops将同一18激活仅作STATE前置，保留历史，不改变停用规则。
- user:read／user:authenticate双向独立，缺鉴权/错签名/Nonce重放及参数媒体方法按契约拒绝；WeCom精确大小写、AND、默认active/显式inactive及无效参数通过。
- STATE：先正常登录18和profile前探针→Ops17/18各33字段baseline→新认证正确/错误/不存在→Ops字段全部相等→原JWT profile后探针200/id18。不在baseline/compare之间插入旧JWT；详情state-complete.md。
- RATE：UTC13:27固定分钟跨A/B和邮箱大小写10×401后第11次429，Retry-After56；独立13:28固定分钟A跨邮箱60×401后第61次429，Retry-After44。未跨窗口；Ops两个独立进程共享Redis helper证据作为支持，不声称HTTP worker PID观测。
- 应用4IP拒绝403、disabled401、active但expired401，均无data/no-store；其他对象由Ops保护，QA不操作server状态。
- LOG-01 journal255：指定UTC13:20:30–13:25:40窗口，3/3旧会话Request ID、2处敏感键均masked、unmasked0、4条审计白名单符合。不是任意自由文本／其他窗口／限流窗口全日志证明。
- DOC-01 journal258：approved-release-docs三文件基线/目标SHA符合manifest；分发Users schema仅3 nullable规范化，hash48d73bb72b94a845537985664799b7b5e5bd0d4d8420db6cca2aa40fd29430f6。原journal256 Blocked由精确修订内容审核关闭、历史保留。
- 纯API无UI，不强制截图手册。实际测试接入核对见test-integration-verification.md；不以截图或mock替代接口验收。
本地证据复用与未升级范围¶
原一次性PostgreSQL105项、最终53聚焦及独立安全审查复用，不重跑、不相加，仍为原开发层级。旧bcrypt/超长/Unicode/歧义邮箱/缓存异常等相关隔离覆盖不冒充本轮测试站逐项运行；未停共享Redis制造503、未DB造额外账号、未改运行配置。
生产、真实员工密码、真实第三方上游系统业务联调未测，不转Pass；本轮仅最多两合成员工17/18、应用3/4。raw server schema的3字段nullable遗漏作为backlog保留，分发文档规范化不等于运行实现已更改或新增null姓名fixture实测。此前管理API日志风险未通过调用风险API来复现，不声称发生真实秘密泄漏。
文档候选与发布边界¶
两spec状态及backlog的精确审核目标见release/release-docs-manifest.json、qa/log-and-document-review.md。源repo尚待主任务在发布元数据提交时按manifest应用并精确读回；这是已审文档机械应用，不要求新beta/重跑业务QA。Apifox正式同步、Git/生产发布由主任务统一执行，本QA未执行或宣称已完成。
唯一剩余QA收尾¶
等待主任务安排Ops仅停用员工17/18及应用3/4并读回；不删除业务历史、不清Redis、不动真实对象。随后按明确授权精确删除本QA私密凭据临时文件、session临时文件和传输私钥，记录删除布尔；不提前清理，以防收尾需安全核对。当前私密材料受限保留，QA收尾尚未完成，不宣称fixture已停用或秘密已清理。
QA仅写指定outputs/qa及#20；无业务代码/spec修改、分支切换、commit/push、部署或生产动作。
执行结果逐条索引¶
steps为单用例实际步骤数，不增计case。每条完整脱敏JSON、journal正文SHA及精确读回收据见final-case-index.json所列evidence和对应.redmine.json。
| 编号 | 结果 | steps | journal |
|---|---|---|---|
| TPAUTH-ENV-01 | Pass | 1 | 217 |
| TPAUTH-AUTH-01 | Pass | 1 | 218 |
| TPAUTH-AUTH-CASE | Pass | 1 | 219 |
| TPAUTH-AUTH-WRONG | Pass | 1 | 220 |
| TPAUTH-AUTH-NOTRIM | Pass | 1 | 221 |
| TPAUTH-AUTH-INACTIVE | Pass | 1 | 222 |
| TPAUTH-AUTH-UNKNOWN | Pass | 1 | 223 |
| TPAUTH-PERM-SCOPE | Pass | 1 | 224 |
| TPAUTH-PERM-MISSING | Pass | 1 | 225 |
| TPAUTH-PERM-SIGNATURE | Pass | 1 | 226 |
| TPAUTH-INPUT-EXTRA | Pass | 1 | 227 |
| TPAUTH-INPUT-QUERY | Pass | 1 | 228 |
| TPAUTH-INPUT-TYPE | Pass | 1 | 229 |
| TPAUTH-INPUT-MEDIA | Pass | 1 | 230 |
| TPAUTH-INPUT-METHOD | Pass | 1 | 231 |
| TPAUTH-WECOM-EXACT | Pass | 1 | 232 |
| TPAUTH-WECOM-CASE | Pass | 1 | 233 |
| TPAUTH-WECOM-AND | Pass | 1 | 234 |
| TPAUTH-WECOM-DEFAULT | Pass | 1 | 235 |
| TPAUTH-WECOM-INACTIVE | Pass | 1 | 236 |
| TPAUTH-PERM-READ | Pass | 1 | 237 |
| TPAUTH-WECOM-EMPTY | Pass | 1 | 238 |
| TPAUTH-WECOM-SPACE | Pass | 1 | 239 |
| TPAUTH-WECOM-LONG | Pass | 1 | 240 |
| TPAUTH-NONCE-FIRST | Pass | 1 | 241 |
| TPAUTH-NONCE-REPLAY | Pass | 1 | 242 |
| TPAUTH-B-AUTH-ONLY | Pass | 1 | 245 |
| TPAUTH-B-DIRECTORY-DENIED | Pass | 1 | 246 |
| TPAUTH-STATE-LOGIN-PREP | Pass | 1 | 247 |
| TPAUTH-STATE-PROFILE-BEFORE | Pass | 1 | 248 |
| TPAUTH-STATE-AUTH-SUCCESS | Pass | 1 | 249 |
| TPAUTH-STATE-AUTH-WRONG | Pass | 1 | 250 |
| TPAUTH-MESSAGE-NONEXISTENT | Pass | 1 | 251 |
| TPAUTH-STATE-COMPLETE | Pass | 1 | 252 |
| TPAUTH-RATE-EMAIL | Pass | 11 | 253 |
| TPAUTH-RATE-APPLICATION | Pass | 61 | 254 |
| TPAUTH-PERM-IP-DENY | Pass | 1 | 257 |
| TPAUTH-PERM-DISABLED | Pass | 1 | 259 |
| TPAUTH-PERM-EXPIRED | Pass | 1 | 260 |
RA Updated by Redmine Admin 20 days ago Actions #48
QA-TPAUTH-FINAL-CLOSE-20261022
测试环境QA最终收尾完成¶
候选：测试1.20.6b0／818daa716fd035349460872b2c5afcca5cedb8fe；仅tcrm-api及本轮合成对象。不是生产部署/生产验收或Apifox同步完成声明。
批准矩阵39条执行结果均Pass、0 Fail/Blocked/Skipped：1 ENV、35 internal接口场景（其中2个限流场景含72循环步骤）、3旧会话步骤/STATE组合。另列LOG-01限定Ops证据Pass、DOC-01精确发布文档候选内容审核Pass，不混算新增HTTP。全部逐项写回并精确读回；原journal256文档Blocked历史保留，journal258已闭环。
请求数：两个internal端点累计105/160，额外login1次/profile2次/版本1次，总HTTP109次。105请求不是105用例，也与原一次性PG105项、最终53聚焦覆盖无关；原105/53独立复用不重跑、不相加。HTTP已全部停止。
已读Ops fixture-revoked.json：员工17/18均inactive、应用3/4均disabled，测试身份/精确ID标记通过，其余密码/token/SK/Scope/IP/expiry等字段保持，无删行、无真实/其他对象写入。
已读remote-private-cleanup.json：远端本轮HMAC快照及空目录精确删除，无DB/Redis操作。
本地UTC2026-10-22T13:45:15.697Z：按释放授权核对owner/0600普通文件、0700目录及精确清单后，仅删除本轮解密凭据JSON、session.json、RSA private.pem共3文件及2空目录，五路径均验证不存在。未输出明文；公钥、ciphertext、路径引用及所有脱敏证据保留；未删其他/tmp或旧数据。永久unlink，不声称安全擦除/可恢复。证据qa/private-cleanup-receipt.json。
最终总表qa/qa-acceptance-summary.md、逐项索引qa/final-case-index.json（cleanupComplete=true）；各执行json及精确Redmine正文hash收据保留。
限制沿用：LOG只证明精确Request IDs/指定窗口及审计白名单，不覆盖任意自由文本/其他窗口；Redis helper双进程不是HTTPworkerPID观测；raw server nullable遗漏留backlog，分发schema规范化不是新实现/null姓名fixture实测。真实员工密码、真实第三方上游、生产有效签名业务未测，不转Pass。
DOC已审目标由主任务按release-docs-manifest.json机械应用并读回；QA不宣称source repo已应用或Apifox已正式同步。不需因文档状态更新重跑业务QA/新beta。
纯API无UI不强制截图手册，实际测试环境接入文档已复核。本QA无业务源码/spec/环境修改、Git/提交推送/部署/生产动作；fixture状态与远端清理由Ops在已授权范围执行。QA侧收尾完成，后续发布由主任务按既有授权继续。
RA Updated by Redmine Admin 20 days ago Actions #49
QA-TPAUTH-DELIVERY-CLOSURE-20261022
最终交付闭环（发布证据引用，非新QA轮次）¶
依据既有发布/统筹独立读回/Apifox收据记录，不执行新测试、业务HTTP、Git、源码修改或部署；不改变issue状态。
| 项目 | 收据实际结果 | 证据（outputs/third-party-password-verification-20261022/release/） |
|---|---|---|
| 生产候选与CI | main/tag v1.20.6，833485c7f88d338519272debef59dc35ca33b68d；来源3164550；CNB cnb-3gi-1k5hu0vc0 success，指定生产触发确认、测试阶段skip | ops/production-delivery.json |
| 实际运行 | 四角色均1.20.6，新digest sha256:a0bccdaa73c51eb2504b16808a8f17d24399cc0c0d9dec139774f703fca036c0，源码hash符合候选；compose/正式DB/cache身份不变；默认应用60/邮箱10 | ops/production-delivery.json |
| 迁移 | migrate exit0，无迁移待应用，ledger129完全不变 | ops/production-delivery.json |
| 生产定向smoke | 版本200/1.20.6；schema存在认证POST和wecom_user_id参数；两个匿名保护入口401，认证POST no-store | ops/production-delivery.json |
| 统筹独立在线读回 | 生产1.20.6、测试1.20.6b0均200；认证POST及wecom_user_id schema存在 | coordinator-production-live-readback.json |
| 已审文档物理落盘 | 生产HEAD833485c的两spec/backlog与已审manifest目标hash全部匹配；原.aoci/config.json保留、版本一致 | coordinator-production-candidate-readback.json；ops/production-delivery.json |
| Apifox正式同步 | Users目录Method&Path精确1增1改，模型2增1改/4跳过；无环境/鉴权组件导入、不删除缺失接口、不生成调试用例；原目录/根签名继承保持 | apifox-sync-final.json |
| Apifox公开读回 | 指南及新端点生产状态已保存并公开读回；指南生产1.20.6/测试1.20.6b0，目录新增企微参数、认证端点存在；无凭据调用 | apifox-sync-final.json |
原DOC机械应用/同步待办现已由主任务/Ops完成，不再沿用为未完成；此前稿件审核与最终结果历史保留。raw server schema的3字段nullable生成遗漏仍为已记录backlog，分发schema规范化不冒称运行实现修复。
测试环境39条QA执行结果Pass，以及LOG-01限定证据Pass／DOC-01精确候选审核Pass保持原结论；生产上述为定向发布smoke证据引用，新增QA case计数0，不重跑、不重拍、不增计39，也不把105/53本地复用相加。匿名401仅证明鉴权保护，不代表有效凭据业务成功。
真实生产员工密码、真实第三方上游/有效凭据业务联调未执行，继续NotRun，不转Pass。生产未造fixture/应用/凭据或其他测试业务数据；没有真实通知、付款、审批。本QA此前已完成两员工/两应用停用及精确私密文件清理，journal262与qa/private-cleanup-receipt.json有效。
公开接入文档：
- 员工目录：https://s.apifox.cn/bb842d4f-b365-47eb-a864-3cb75d422f82/524605753e0
- 密码验证：https://s.apifox.cn/bb842d4f-b365-47eb-a864-3cb75d422f82/527832203e0
- 接入指南：https://s.apifox.cn/bb842d4f-b365-47eb-a864-3cb75d422f82/9548569m0
交付记录闭环完成。本条仅追加记录；issue工作流状态保持原值，不猜状态ID或自行关闭。Git提交/main及tag推送/生产部署由主任务与Ops在用户授权下执行，不声称QA执行了这些操作。
RA Updated by Redmine Admin 19 days ago Actions #50
2026-10-23 按用户要求关闭已完成测试。依据 journal262 测试环境39条全部Pass、LOG/DOC复核及清理完成，journal263最终发布与文档交付闭环。仅收口工作流状态，不新增测试计数；真实生产员工密码及第三方有效凭据联调未测范围保持NotRun，历史记录保留。