refactor: strengthen client boundaries and quality gates

api/src/common/client-write.dto.spec.ts

@@ -1,5 +1,5 @@
 import { BadRequestException } from '@nestjs/common';
-import { ClientBatchTaskDto, ClientImportConfirmDto, ClientStatusChangeDto } from './client-write.dto';
+import { ClientBatchTaskDto, ClientDeleteResourceDto, ClientImportConfirmDto } from './client-write.dto';
 import { strictValidationPipe } from './strict-validation.pipe';
 
 function validate<T>(metatype: new () => T, value: unknown) {
@@ -8,10 +8,12 @@ function validate<T>(metatype: new () => T, value: unknown) {
 
 describe('strict client write DTOs', () => {
   it('accepts an import confirmation without a client-supplied phones array', async () => {
-    await expect(validate(ClientImportConfirmDto, {
-      content: '【测试】验证码 ${code}',
-      importContent: 'phone,code\n13800000001,1234',
-    })).resolves.toEqual(expect.objectContaining({ importContent: expect.any(String) }));
+    await expect(
+      validate(ClientImportConfirmDto, {
+        content: '【测试】验证码 ${code}',
+        importContent: 'phone,code\n13800000001,1234',
+      }),
+    ).resolves.toEqual(expect.objectContaining({ importContent: expect.any(String) }));
   });
 
   it('rejects a direct batch task without validated phone numbers', async () => {
@@ -19,7 +21,28 @@ describe('strict client write DTOs', () => {
   });
 
   it('rejects a client-supplied operator identity', async () => {
-    await expect(validate(ClientStatusChangeDto, { status: 'disabled', operatorId: 'another-user' }))
-      .rejects.toBeInstanceOf(BadRequestException);
+    await expect(
+      validate(ClientDeleteResourceDto, { status: 'deleted', operatorId: 'another-user' }),
+    ).rejects.toBeInstanceOf(BadRequestException);
+  });
+
+  it('rejects a client-supplied tenant identity', async () => {
+    await expect(
+      validate(ClientBatchTaskDto, {
+        tenantId: 'other-tenant',
+        content: '【测试】通知',
+        phones: ['13800000001'],
+      }),
+    ).rejects.toBeInstanceOf(BadRequestException);
+  });
+
+  it('rejects deeply nested or prototype-like dynamic values', async () => {
+    await expect(
+      validate(ClientBatchTaskDto, {
+        content: '【测试】通知',
+        phones: ['13800000001'],
+        variables: { safe: { nested: { too: { deep: { value: 'x' } } } } },
+      }),
+    ).rejects.toBeInstanceOf(BadRequestException);
   });
 });