feat: harden CMPP delivery and platform workflows

api/src/sms-config/sms-config.service.spec.ts

@@ -1,3 +1,4 @@
+import { BadRequestException } from '@nestjs/common';
 import { SmsConfigService } from './sms-config.service';
 
 function createPrismaMock() {
@@ -755,7 +756,7 @@ describe('SmsConfigService', () => {
     expect(serialized).not.toContain('channel-secret');
     expect(serialized).not.toContain('内部通道');
     expect(result[0]).not.toHaveProperty('reportTasks');
-    expect(result[0]).not.toHaveProperty('reportStatus');
+    expect(result[0]).toHaveProperty('reportStatus');
   });
 
   it('returns real client signature workspace counts from database grouping', async () => {
@@ -951,6 +952,17 @@ describe('SmsConfigService', () => {
     }));
   });
 
+  it('returns only approved templates from the client send-candidate view by default', async () => {
+    const prisma = createPrismaMock();
+    const service = new SmsConfigService(prisma as never);
+
+    await service.listClientTemplates('tenant-1');
+
+    expect(prisma.smsTemplate.findMany).toHaveBeenCalledWith(expect.objectContaining({
+      where: expect.objectContaining({ tenantId: 'tenant-1', auditStatus: 'approved' }),
+    }));
+  });
+
   it('creates admin enterprise templates as approved when requested', async () => {
     const prisma = createPrismaMock();
     const service = new SmsConfigService(prisma as never);
@@ -1038,4 +1050,20 @@ describe('SmsConfigService', () => {
 
     expect(prisma.smsTemplate.create).not.toHaveBeenCalled();
   });
+
+  it.each([
+    ['空变量', '【签名A】验证码${}'],
+    ['中文变量', '【签名A】验证码${中文}'],
+    ['未闭合变量', '【签名A】验证码${code'],
+    ['重复变量', '【签名A】${code}-${code}'],
+    ['超长变量', `【签名A】\${${'a'.repeat(33)}}`],
+  ])('rejects %s before persisting the template', async (_label, content) => {
+    const prisma = createPrismaMock();
+    const service = new SmsConfigService(prisma as never);
+
+    await expect(service.createTemplate({
+      tenantId: 'tenant-1', applicationId: 'app-1', signatureId: 'sig-1', name: '非法模板', content,
+    })).rejects.toBeInstanceOf(BadRequestException);
+    expect(prisma.smsTemplate.create).not.toHaveBeenCalled();
+  });
 });