fix: 清零 flutter analyze 问题并修复隐私红线正则缺陷（CI 门禁）

- 修复真实缺陷：隐私红线 RegExp 使用 Dart 不支持的 (?i) 内联标志，构造即抛异常导致带 props 的事件被静默丢弃；改为 caseSensitive: false - 清理埋点模块未用 import/字段/变量（4 warning） - 构造函数改用初始化形参（含 Dart 3.12 私有具名参数） - E2E 手动脚本声明 ignore avoid_print + library 指令 - 门禁：format 0 changed / analyze No issues / flutter test 34 passed
2026-09-04 19:44:46 +08:00
parent 45f94d2558
commit 3f8388e5d4
3 changed files with 61 additions and 45 deletions
@@ -1,8 +1,12 @@
 #!/usr/bin/env dart
+
+// ignore_for_file: avoid_print  — 手动 E2E 脚本，print 即输出。
 /// E2E 手动测试脚本：对真实后端的完整登录纵切流程（独立脚本，无 Flutter 运行时）。
 ///
 /// 前置条件：patbond-api 目录执行 `docker compose up -d`
 /// 运行方式：dart run test_e2e_manual.dart
+library;
+
 ///
 /// 本脚本直接通过 HTTP 客户端验证契约实现，不依赖 Flutter widget。

@@ -33,13 +37,13 @@ void main() async {
  try {
    // 1. 注册
    print('[1/7] POST /api/v1/auth/register');
-    final registerReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/register'));
+    final registerReq = await client.postUrl(
+      Uri.parse('$baseUrl/api/v1/auth/register'),
+    );
    registerReq.headers.contentType = ContentType.json;
-    registerReq.write(jsonEncode({
-      'username': username,
-      'phone': phone,
-      'password': password,
-    }));
+    registerReq.write(
+      jsonEncode({'username': username, 'phone': phone, 'password': password}),
+    );
    final registerResp = await registerReq.close();
    final registerBody = await utf8.decodeStream(registerResp);
    print('  Status: ${registerResp.statusCode}');
@@ -67,7 +71,9 @@ void main() async {
    print('    accessToken: ${accessToken.substring(0, 20)}...<REDACTED>');
    print('    refreshToken: ${refreshToken.substring(0, 20)}...<REDACTED>');
    print('    accessTokenExpiresAt: ${registerData['accessTokenExpiresAt']}');
-    print('    refreshTokenExpiresAt: ${registerData['refreshTokenExpiresAt']}');
+    print(
+      '    refreshTokenExpiresAt: ${registerData['refreshTokenExpiresAt']}',
+    );
    print('');

    // 2. 获取当前用户 (me)
@@ -106,7 +112,9 @@ void main() async {
    // 3. 刷新 token
    print('[3/7] POST /api/v1/auth/refresh');
    final oldRefreshToken = refreshToken;
-    final refreshReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/refresh'));
+    final refreshReq = await client.postUrl(
+      Uri.parse('$baseUrl/api/v1/auth/refresh'),
+    );
    refreshReq.headers.contentType = ContentType.json;
    refreshReq.write(jsonEncode({'refreshToken': refreshToken}));
    final refreshResp = await refreshReq.close();
@@ -131,7 +139,9 @@ void main() async {

    print('  ✓ Token 刷新成功');
    print('    新 accessToken: ${newAccessToken.substring(0, 20)}...<REDACTED>');
-    print('    新 refreshToken: ${newRefreshToken.substring(0, 20)}...<REDACTED>');
+    print(
+      '    新 refreshToken: ${newRefreshToken.substring(0, 20)}...<REDACTED>',
+    );

    if (newAccessToken == accessToken) {
      print('  ✗ access token 未轮换');
@@ -148,7 +158,9 @@ void main() async {

    // 4. 验证旧 refresh token 不可用（轮换生效）
    print('[4/7] POST /api/v1/auth/refresh（用已轮换的旧 token，应 401）');
-    final oldRefreshReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/refresh'));
+    final oldRefreshReq = await client.postUrl(
+      Uri.parse('$baseUrl/api/v1/auth/refresh'),
+    );
    oldRefreshReq.headers.contentType = ContentType.json;
    oldRefreshReq.write(jsonEncode({'refreshToken': oldRefreshToken}));
    final oldRefreshResp = await oldRefreshReq.close();
@@ -168,7 +180,9 @@ void main() async {

    // 5. 退出登录
    print('[5/7] POST /api/v1/auth/logout');
-    final logoutReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/logout'));
+    final logoutReq = await client.postUrl(
+      Uri.parse('$baseUrl/api/v1/auth/logout'),
+    );
    logoutReq.headers.contentType = ContentType.json;
    logoutReq.headers.set('Authorization', 'Bearer $accessToken');
    logoutReq.write(jsonEncode({'refreshToken': refreshToken}));
@@ -193,15 +207,20 @@ void main() async {

    // 6. 验证退出后 refresh token 不可用
    print('[6/7] POST /api/v1/auth/refresh（退出后，应 401）');
-    final postLogoutRefreshReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/refresh'));
+    final postLogoutRefreshReq = await client.postUrl(
+      Uri.parse('$baseUrl/api/v1/auth/refresh'),
+    );
    postLogoutRefreshReq.headers.contentType = ContentType.json;
    postLogoutRefreshReq.write(jsonEncode({'refreshToken': refreshToken}));
    final postLogoutRefreshResp = await postLogoutRefreshReq.close();
-    final postLogoutRefreshBody = await utf8.decodeStream(postLogoutRefreshResp);
+    final postLogoutRefreshBody = await utf8.decodeStream(
+      postLogoutRefreshResp,
+    );
    print('  Status: ${postLogoutRefreshResp.statusCode}');

    if (postLogoutRefreshResp.statusCode == 401) {
-      final postLogoutJson = jsonDecode(postLogoutRefreshBody) as Map<String, dynamic>;
+      final postLogoutJson =
+          jsonDecode(postLogoutRefreshBody) as Map<String, dynamic>;
      print('  ✓ 退出后 refresh token 已失效');
      print('    code: ${postLogoutJson['code']}');
      print('    message: ${postLogoutJson['message']}');
@@ -217,17 +236,20 @@ void main() async {
    print('[7/7] POST /api/v1/auth/login（5 次错误密码 → 第 6 次触发 423/42300）');
    for (int i = 1; i <= 5; i++) {
      print('  错误密码尝试 $i/5...');
-      final badLoginReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/login'));
+      final badLoginReq = await client.postUrl(
+        Uri.parse('$baseUrl/api/v1/auth/login'),
+      );
      badLoginReq.headers.contentType = ContentType.json;
-      badLoginReq.write(jsonEncode({
-        'username': username,
-        'password': 'WrongPassword$i',
-      }));
+      badLoginReq.write(
+        jsonEncode({'username': username, 'password': 'WrongPassword$i'}),
+      );
      final badLoginResp = await badLoginReq.close();
      final badLoginBody = await utf8.decodeStream(badLoginResp);
      final badLoginJson = jsonDecode(badLoginBody) as Map<String, dynamic>;
-      print('    → HTTP ${badLoginResp.statusCode} / code ${badLoginJson['code']}: '
-          '${badLoginJson['message']}');
+      print(
+        '    → HTTP ${badLoginResp.statusCode} / code ${badLoginJson['code']}: '
+        '${badLoginJson['message']}',
+      );
      if (badLoginResp.statusCode == 423) {
        // 之前的失败计数已触发锁定（本脚本重复运行时会出现），也算验证通过
        print('  ✓ 账号已处于锁定状态（423/42300）');
@@ -238,12 +260,13 @@ void main() async {

    // 第 6 次：用正确密码验证「锁定期间即使密码正确也返回 423/42300」
    print('  第 6 次尝试（正确密码，应因锁定被拒绝）...');
-    final lockedLoginReq = await client.postUrl(Uri.parse('$baseUrl/api/v1/auth/login'));
+    final lockedLoginReq = await client.postUrl(
+      Uri.parse('$baseUrl/api/v1/auth/login'),
+    );
    lockedLoginReq.headers.contentType = ContentType.json;
-    lockedLoginReq.write(jsonEncode({
-      'username': username,
-      'password': password,
-    }));
+    lockedLoginReq.write(
+      jsonEncode({'username': username, 'password': password}),
+    );
    final lockedLoginResp = await lockedLoginReq.close();
    final lockedLoginBody = await utf8.decodeStream(lockedLoginResp);
    print('  Status: ${lockedLoginResp.statusCode}');