feat: harden CMPP delivery and platform workflows

api/src/tenants/tenants.service.spec.ts

@@ -1,4 +1,4 @@
-import { NotFoundException } from '@nestjs/common';
+import { BadRequestException, NotFoundException } from '@nestjs/common';
 import { TenantsService } from './tenants.service';
 
 function createPrismaMock() {
@@ -81,6 +81,14 @@ describe('TenantsService', () => {
     expect(prisma.tenant.update).not.toHaveBeenCalled();
   });
 
+  it('rejects enterprise credit codes containing non-alphanumeric characters', async () => {
+    const prisma = createPrismaMock();
+    const service = new TenantsService(prisma as never);
+
+    await expect(service.create({ name: '测试企业', creditCode: '9137-中文' })).rejects.toBeInstanceOf(BadRequestException);
+    expect(prisma.tenant.create).not.toHaveBeenCalled();
+  });
+
   it('lists management rows with real account, today spend and actual refund fields', async () => {
     const prisma = createPrismaMock();
     const service = new TenantsService(prisma as never);

api/src/tenants/tenants.service.ts

@@ -1,4 +1,4 @@
-import { Injectable, NotFoundException } from '@nestjs/common';
+import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
 import { Prisma } from '@prisma/client';
 import { moneyToNumber } from '../common/money';
 import { PrismaService } from '../prisma/prisma.service';
@@ -90,6 +90,7 @@ export class TenantsService {
   }
 
   async create(data: CreateTenantDto) {
+    assertCreditCode(data.creditCode);
     const code = data.code?.trim() || generateTenantCode(data);
     const tenant = await this.prisma.tenant.create({
       data: { name: data.name, code, status: data.status ?? 'active' },
@@ -99,6 +100,7 @@ export class TenantsService {
   }
 
   async update(id: string, data: UpdateTenantDto) {
+    assertCreditCode(data.creditCode);
     await this.ensureTenant(id);
     await this.prisma.tenant.update({
       where: { id },
@@ -204,6 +206,12 @@ function startOfToday() {
   return date;
 }
 
+function assertCreditCode(value?: string) {
+  if (value !== undefined && value.trim() && !/^[A-Za-z0-9]+$/.test(value.trim())) {
+    throw new BadRequestException('统一社会信用代码只能包含英文字母和数字');
+  }
+}
+
 function returnedTransactionWhere(since: Date): Prisma.AccountTransactionWhereInput {
   return {
     createdAt: { gte: since },