fix: close sms scheduling and billing gaps

api/src/risk-review/risk-review.service.spec.ts

@@ -13,6 +13,12 @@ function createPrismaMock(overrides: Record<string, unknown> = {}) {
     enterpriseBlacklist: {
       findMany: jest.fn().mockResolvedValue([]),
     },
+    sensitiveWord: {
+      findMany: jest.fn().mockResolvedValue([]),
+    },
+    user: {
+      findUnique: jest.fn().mockResolvedValue({ id: 'user-1' }),
+    },
     smsApplication: {
       findUnique: jest.fn().mockResolvedValue(null),
     },
@@ -161,10 +167,13 @@ describe('RiskReviewService', () => {
     expect(prisma.smsSendTask.create).toHaveBeenCalledWith({
       data: expect.objectContaining({
         illegalRatio: 0.5,
-        variableIssues: expect.arrayContaining([
-          { type: 'missing_required_variable', name: 'code' },
-          { type: 'unexpected_variable', name: 'extra' },
-        ]),
+        variableIssues: {
+          variables: expect.arrayContaining([
+            { type: 'missing_required_variable', name: 'code' },
+            { type: 'unexpected_variable', name: 'extra' },
+          ]),
+          content: [],
+        },
       }),
     });
   });
@@ -210,4 +219,39 @@ describe('RiskReviewService', () => {
       ]),
     });
   });
+
+  it('rejects sensitive words and illegal control characters before sending', async () => {
+    const prisma = createPrismaMock();
+    prisma.sensitiveWord.findMany.mockResolvedValue([{ word: '违法词', level: 'block' }]);
+
+    const service = new RiskReviewService(prisma as never);
+    const result = await service.evaluateTask({
+      tenantId: 'tenant-1',
+      content: '包含违法词\u0001',
+      phones: ['13800000001'],
+    });
+
+    expect(result.status).toBe('rejected');
+    expect(prisma.riskHitRecord.createMany).toHaveBeenCalledWith({
+      data: expect.arrayContaining([
+        expect.objectContaining({ ruleCode: 'CONTENT_CONTROL_CHAR', action: 'block' }),
+        expect.objectContaining({ ruleCode: 'SENSITIVE_WORD', action: 'block' }),
+      ]),
+    });
+  });
+
+  it('returns a bad request for unknown optional creator ids', async () => {
+    const prisma = createPrismaMock();
+    prisma.user.findUnique.mockResolvedValue(null);
+    const service = new RiskReviewService(prisma as never);
+
+    await expect(
+      service.evaluateTask({
+        tenantId: 'tenant-1',
+        content: 'hello',
+        phones: ['13800000001'],
+        createdById: 'missing-user',
+      }),
+    ).rejects.toThrow('createdById does not reference an existing user');
+  });
 });