feat(admin): add draft task creation

admin/README.md

@@ -0,0 +1,25 @@
+# 采购服务
+
+启动前必须显式设置下列环境变量；服务不提供默认管理员账号、密码或会话密钥。
+
+| 变量 | 要求 |
+| --- | --- |
+| `CMBUYER_ADMIN_USERNAME` | 非空管理员账号。 |
+| `CMBUYER_ADMIN_PASSWORD_BCRYPT` | 非空 bcrypt 密码哈希，不接受明文密码。 |
+| `CMBUYER_SESSION_SECRET` | 至少 32 字节的会话签名密钥。 |
+| `CMBUYER_COOKIE_SECURE` | 可选；存在时只能精确为 `true` 或 `false`。HTTPS 部署应设为 `true`。 |
+| `CMBUYER_DATABASE_SOURCE` | 已迁移 SQLite 的显式 data source。 |
+
+示例仅展示变量名，不提供可运行凭据：
+
+```powershell
+$env:CMBUYER_ADMIN_USERNAME = '<管理员账号>'
+$env:CMBUYER_ADMIN_PASSWORD_BCRYPT = '<bcrypt 密码哈希>'
+$env:CMBUYER_SESSION_SECRET = '<至少 32 字节的随机密钥>'
+$env:CMBUYER_COOKIE_SECURE = 'true'
+$env:CMBUYER_DATABASE_SOURCE = '<SQLite data source>'
+go run ./cmd/migrate -database $env:CMBUYER_DATABASE_SOURCE up
+go run ./cmd/server
+```
+
+采购服务会话仅保存在当前进程内；进程重启后既有登录会话会安全失效。

admin/cmd/server/main.go

@@ -5,7 +5,11 @@ import (
 	"log"
 	"net/http"
 
+	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/config"
 	"cmbuyer/admin/internal/server"
+	"cmbuyer/admin/internal/storage/sqlite"
+	"cmbuyer/admin/internal/tasks"
 )
 
 const listenAddress = ":8080"
@@ -17,7 +21,31 @@ func main() {
 }
 
 func run() error {
-	err := http.ListenAndServe(listenAddress, server.NewRouter())
+	configuration, err := config.LoadFromEnv()
+	if err != nil {
+		return err
+	}
+	database, err := sqlite.Open(configuration.DatabaseSource)
+	if err != nil {
+		return err
+	}
+	defer database.Close()
+	taskStore, err := tasks.NewSQLiteStore(database)
+	if err != nil {
+		return err
+	}
+
+	router, err := server.NewRouter(server.Options{
+		AdminUsername:       configuration.AdminUsername,
+		AdminPasswordBcrypt: configuration.AdminPasswordBcrypt,
+		Sessions:            auth.NewManager(configuration.SessionSecret, configuration.CookieSecure),
+		Tasks:               taskStore,
+	})
+	if err != nil {
+		return err
+	}
+
+	err = http.ListenAndServe(listenAddress, router)
 	if errors.Is(err, http.ErrServerClosed) {
 		return nil
 	}

admin/go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/gin-gonic/gin v1.11.0
 	github.com/mattn/go-sqlite3 v1.14.49
 	github.com/pressly/goose/v3 v3.24.0
+	golang.org/x/crypto v0.40.0
 )
 
 require (
@@ -35,7 +36,6 @@ require (
 	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect

admin/internal/auth/session.go

@@ -0,0 +1,198 @@
+// Package auth 提供内存会话与 CSRF 防护。会话不落库，服务重启会安全地使所有登录失效。
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	CookieName        = "cmbuyer_session"
+	SessionLifetime   = 8 * time.Hour
+	csrfTokenByteSize = 32
+)
+
+type session struct {
+	csrfToken     string
+	authenticated bool
+	expiresAt     time.Time
+}
+
+// Manager 签发、验证并撤销进程内会话。cookie 仅承载经过 HMAC 签名的随机 session ID。
+type Manager struct {
+	secret       []byte
+	cookieSecure bool
+	now          func() time.Time
+	random       io.Reader
+
+	mu       sync.Mutex
+	sessions map[string]session
+}
+
+// NewManager 创建会话管理器。secret 在启动时已由 config 验证为足够长度。
+func NewManager(secret []byte, cookieSecure bool) *Manager {
+	return &Manager{
+		secret:       append([]byte(nil), secret...),
+		cookieSecure: cookieSecure,
+		now:          time.Now,
+		random:       rand.Reader,
+		sessions:     make(map[string]session),
+	}
+}
+
+// Ensure 返回当前有效会话；不存在或过期时签发匿名会话，以保护登录表单本身的 POST。
+func (manager *Manager) Ensure(writer http.ResponseWriter, request *http.Request) (csrfToken string, authenticated bool) {
+	if id, current, ok := manager.current(request); ok {
+		return current.csrfToken, current.authenticated
+	} else if id != "" {
+		manager.delete(id)
+	}
+
+	id, current := manager.create(false)
+	manager.writeCookie(writer, id, current.expiresAt)
+	return current.csrfToken, false
+}
+
+// VerifyCSRF 只接受当前未过期会话中以恒定时间比较匹配的 token。
+func (manager *Manager) VerifyCSRF(request *http.Request, token string) (authenticated bool, ok bool) {
+	_, current, found := manager.current(request)
+	if !found || token == "" {
+		return false, false
+	}
+
+	if subtle.ConstantTimeCompare([]byte(current.csrfToken), []byte(token)) != 1 {
+		return false, false
+	}
+
+	return current.authenticated, true
+}
+
+// RotateAuthenticated 在登录成功后撤销旧会话并签发全新认证会话，避免 session fixation 与 CSRF 复用。
+func (manager *Manager) RotateAuthenticated(writer http.ResponseWriter, request *http.Request) string {
+	if id, _, ok := manager.current(request); ok {
+		manager.delete(id)
+	}
+
+	id, current := manager.create(true)
+	manager.writeCookie(writer, id, current.expiresAt)
+	return current.csrfToken
+}
+
+// Logout 撤销当前会话并立即清除浏览器 cookie。
+func (manager *Manager) Logout(writer http.ResponseWriter, request *http.Request) {
+	if id, _, ok := manager.current(request); ok {
+		manager.delete(id)
+	}
+	http.SetCookie(writer, &http.Cookie{
+		Name:     CookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   manager.cookieSecure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (manager *Manager) current(request *http.Request) (string, session, bool) {
+	cookie, err := request.Cookie(CookieName)
+	if err != nil {
+		return "", session{}, false
+	}
+
+	id, expiresAt, ok := manager.verifyCookie(cookie.Value)
+	if !ok || !manager.now().Before(expiresAt) {
+		return id, session{}, false
+	}
+
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	current, found := manager.sessions[id]
+	if !found || !manager.now().Before(current.expiresAt) {
+		return id, session{}, false
+	}
+
+	return id, current, true
+}
+
+func (manager *Manager) create(authenticated bool) (string, session) {
+	id := manager.randomToken()
+	current := session{
+		csrfToken:     manager.randomToken(),
+		authenticated: authenticated,
+		expiresAt:     manager.now().Add(SessionLifetime),
+	}
+
+	manager.mu.Lock()
+	manager.sessions[id] = current
+	manager.mu.Unlock()
+	return id, current
+}
+
+func (manager *Manager) delete(id string) {
+	manager.mu.Lock()
+	delete(manager.sessions, id)
+	manager.mu.Unlock()
+}
+
+func (manager *Manager) randomToken() string {
+	bytes := make([]byte, csrfTokenByteSize)
+	if _, err := io.ReadFull(manager.random, bytes); err != nil {
+		panic("crypto/rand failed while creating a session token")
+	}
+	return base64.RawURLEncoding.EncodeToString(bytes)
+}
+
+func (manager *Manager) writeCookie(writer http.ResponseWriter, id string, expiresAt time.Time) {
+	http.SetCookie(writer, &http.Cookie{
+		Name:     CookieName,
+		Value:    manager.signCookie(id, expiresAt),
+		Path:     "/",
+		MaxAge:   int(expiresAt.Sub(manager.now()).Seconds()),
+		Expires:  expiresAt,
+		HttpOnly: true,
+		Secure:   manager.cookieSecure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (manager *Manager) signCookie(id string, expiresAt time.Time) string {
+	payload := id + "." + strconv.FormatInt(expiresAt.Unix(), 10)
+	mac := hmac.New(sha256.New, manager.secret)
+	_, _ = mac.Write([]byte(payload))
+	return payload + "." + base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+func (manager *Manager) verifyCookie(value string) (string, time.Time, bool) {
+	parts := strings.Split(value, ".")
+	if len(parts) != 3 || parts[0] == "" {
+		return "", time.Time{}, false
+	}
+
+	expiresUnix, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return "", time.Time{}, false
+	}
+	provided, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return "", time.Time{}, false
+	}
+
+	payload := parts[0] + "." + parts[1]
+	mac := hmac.New(sha256.New, manager.secret)
+	_, _ = mac.Write([]byte(payload))
+	if !hmac.Equal(provided, mac.Sum(nil)) {
+		return "", time.Time{}, false
+	}
+
+	return parts[0], time.Unix(expiresUnix, 0), true
+}

admin/internal/auth/session_test.go

@@ -0,0 +1,49 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestManagerRejectsTamperedAndExpiredCookies(t *testing.T) {
+	manager := NewManager([]byte(strings.Repeat("s", 32)), true)
+	request := httptest.NewRequest(http.MethodGet, "/login", nil)
+	response := httptest.NewRecorder()
+	csrf, authenticated := manager.Ensure(response, request)
+	if csrf == "" || authenticated {
+		t.Fatalf("Ensure = (%q, %t), want anonymous CSRF session", csrf, authenticated)
+	}
+	cookie := response.Result().Cookies()[0]
+	if !cookie.HttpOnly || !cookie.Secure || cookie.SameSite != http.SameSiteLaxMode || cookie.Path != "/" {
+		t.Fatalf("session cookie is missing security attributes: %#v", cookie)
+	}
+
+	tampered := *cookie
+	tampered.Value = flipCookieValue(t, cookie.Value)
+	tamperedRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
+	tamperedRequest.AddCookie(&tampered)
+	if _, ok := manager.VerifyCSRF(tamperedRequest, csrf); ok {
+		t.Fatal("tampered signed cookie passed CSRF verification")
+	}
+
+	manager.now = func() time.Time { return time.Now().Add(9 * time.Hour) }
+	expiredRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
+	expiredRequest.AddCookie(cookie)
+	if _, ok := manager.VerifyCSRF(expiredRequest, csrf); ok {
+		t.Fatal("expired cookie passed CSRF verification")
+	}
+}
+
+func flipCookieValue(t *testing.T, value string) string {
+	t.Helper()
+	if value == "" {
+		t.Fatal("cannot tamper with an empty cookie")
+	}
+	if value[0] == 'A' {
+		return "B" + value[1:]
+	}
+	return "A" + value[1:]
+}

admin/internal/config/config.go

@@ -0,0 +1,91 @@
+// Package config 读取采购服务的启动配置。凭据只允许来自显式环境变量，避免把秘密写入代码或仓库。
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+const (
+	adminUsernameEnv       = "CMBUYER_ADMIN_USERNAME"
+	adminPasswordBcryptEnv = "CMBUYER_ADMIN_PASSWORD_BCRYPT"
+	sessionSecretEnv       = "CMBUYER_SESSION_SECRET"
+	cookieSecureEnv        = "CMBUYER_COOKIE_SECURE"
+	databaseSourceEnv      = "CMBUYER_DATABASE_SOURCE"
+	minimumSecretLength    = 32
+)
+
+// Config 是启动采购服务所需的最小安全配置。
+type Config struct {
+	AdminUsername       string
+	AdminPasswordBcrypt string
+	SessionSecret       []byte
+	CookieSecure        bool
+	DatabaseSource      string
+}
+
+// LoadFromEnv 从进程环境读取配置。错误只指出缺失或非法的变量名，绝不回显秘密。
+func LoadFromEnv() (Config, error) {
+	return Load(os.LookupEnv)
+}
+
+// Load 使用 lookup 读取配置，以便在不污染进程环境的情况下测试启动边界。
+func Load(lookup func(string) (string, bool)) (Config, error) {
+	username, err := required(lookup, adminUsernameEnv)
+	if err != nil {
+		return Config{}, err
+	}
+
+	passwordHash, err := required(lookup, adminPasswordBcryptEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if _, err := bcrypt.Cost([]byte(passwordHash)); err != nil {
+		return Config{}, fmt.Errorf("%s is not a valid bcrypt hash", adminPasswordBcryptEnv)
+	}
+
+	secret, err := required(lookup, sessionSecretEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if len([]byte(secret)) < minimumSecretLength {
+		return Config{}, fmt.Errorf("%s must be at least %d bytes", sessionSecretEnv, minimumSecretLength)
+	}
+
+	cookieSecure := false
+	if value, present := lookup(cookieSecureEnv); present {
+		switch value {
+		case "true":
+			cookieSecure = true
+		case "false":
+			cookieSecure = false
+		default:
+			return Config{}, fmt.Errorf("%s must be exactly true or false", cookieSecureEnv)
+		}
+	}
+	databaseSource, err := required(lookup, databaseSourceEnv)
+	if err != nil {
+		return Config{}, err
+	}
+
+	return Config{
+		AdminUsername:       username,
+		AdminPasswordBcrypt: passwordHash,
+		SessionSecret:       []byte(secret),
+		CookieSecure:        cookieSecure,
+		DatabaseSource:      databaseSource,
+	}, nil
+}
+
+func required(lookup func(string) (string, bool), name string) (string, error) {
+	value, present := lookup(name)
+	if !present || strings.TrimSpace(value) == "" {
+		return "", errors.New(name + " must be set")
+	}
+
+	return value, nil
+}

admin/internal/config/config_test.go

@@ -0,0 +1,85 @@
+package config_test
+
+import (
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/config"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestLoad(t *testing.T) {
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+
+	values := map[string]string{
+		"CMBUYER_ADMIN_USERNAME":        "admin",
+		"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
+		"CMBUYER_SESSION_SECRET":        strings.Repeat("s", 32),
+		"CMBUYER_COOKIE_SECURE":         "true",
+		"CMBUYER_DATABASE_SOURCE":       ":memory:",
+	}
+
+	got, err := config.Load(lookup(values))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if got.AdminUsername != "admin" || !got.CookieSecure {
+		t.Fatalf("Load returned unexpected public configuration: %#v", got)
+	}
+}
+
+func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+
+	base := map[string]string{
+		"CMBUYER_ADMIN_USERNAME":        "admin",
+		"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
+		"CMBUYER_SESSION_SECRET":        strings.Repeat("s", 32),
+		"CMBUYER_DATABASE_SOURCE":       ":memory:",
+	}
+
+	tests := []struct {
+		name   string
+		mutate func(map[string]string)
+		want   string
+	}{
+		{"missing username", func(values map[string]string) { delete(values, "CMBUYER_ADMIN_USERNAME") }, "CMBUYER_ADMIN_USERNAME"},
+		{"invalid bcrypt", func(values map[string]string) { values["CMBUYER_ADMIN_PASSWORD_BCRYPT"] = "not-a-bcrypt-hash" }, "CMBUYER_ADMIN_PASSWORD_BCRYPT"},
+		{"short secret", func(values map[string]string) { values["CMBUYER_SESSION_SECRET"] = "short" }, "CMBUYER_SESSION_SECRET"},
+		{"invalid secure flag", func(values map[string]string) { values["CMBUYER_COOKIE_SECURE"] = "1" }, "CMBUYER_COOKIE_SECURE"},
+		{"missing database", func(values map[string]string) { delete(values, "CMBUYER_DATABASE_SOURCE") }, "CMBUYER_DATABASE_SOURCE"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			values := copyValues(base)
+			test.mutate(values)
+			_, err := config.Load(lookup(values))
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("Load error = %v, want mention of %s", err, test.want)
+			}
+		})
+	}
+}
+
+func lookup(values map[string]string) func(string) (string, bool) {
+	return func(key string) (string, bool) {
+		value, ok := values[key]
+		return value, ok
+	}
+}
+
+func copyValues(values map[string]string) map[string]string {
+	copy := make(map[string]string, len(values))
+	for key, value := range values {
+		copy[key] = value
+	}
+	return copy
+}

admin/internal/server/router.go

@@ -2,18 +2,293 @@
 package server
 
 import (
+	"crypto/subtle"
+	"errors"
 	"net/http"
+	"net/url"
+	"strings"
+
+	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/tasks"
+	"cmbuyer/admin/internal/transport/webui"
 
 	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 )
 
-// NewRouter 返回当前服务范围内的完整 HTTP 路由。
-func NewRouter() *gin.Engine {
-	router := gin.New()
+const maxFormBytes = 8 << 10
 
-	router.GET("/healthz", func(context *gin.Context) {
-		context.JSON(http.StatusOK, gin.H{"status": "ok"})
-	})
+// Options 是路由层需要的安全依赖。凭据由启动配置注入，不能在路由中设置默认值。
+type Options struct {
+	AdminUsername       string
+	AdminPasswordBcrypt string
+	Sessions            *auth.Manager
+	Tasks               tasks.Store
+}
 
-	return router
+// NewRouter 返回当前服务范围内的完整 HTTP 路由。
+func NewRouter(options Options) (*gin.Engine, error) {
+	if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil || options.Tasks == nil {
+		return nil, errors.New("server authentication options are incomplete")
+	}
+
+	router := gin.New()
+	router.Use(gin.Recovery())
+	router.Use(securityHeaders())
+	router.GET("/healthz", healthz)
+	router.GET("/login", loginPage(options))
+	router.POST("/login", login(options))
+	router.POST("/logout", logout(options))
+	router.GET("/tasks", tasksPage(options))
+	router.GET("/tasks/new", newTaskPage(options))
+	router.POST("/tasks", createTask(options))
+
+	return router, nil
+}
+
+func healthz(context *gin.Context) {
+	context.JSON(http.StatusOK, gin.H{"status": "ok"})
+}
+
+func securityHeaders() gin.HandlerFunc {
+	return func(context *gin.Context) {
+		context.Header("Cache-Control", "no-store")
+		context.Header("X-Content-Type-Options", "nosniff")
+		context.Header("Referrer-Policy", "no-referrer")
+		context.Header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'")
+		context.Next()
+	}
+}
+
+func loginPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if authenticated {
+			context.Redirect(http.StatusSeeOther, "/tasks")
+			return
+		}
+
+		renderLogin(context, http.StatusOK, csrfToken, returnTo(context.Query("return_to")), "", "")
+	}
+}
+
+func login(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !parseForm(context) {
+			return
+		}
+		form := context.Request.PostForm
+		csrfToken := form.Get("csrf_token")
+		returnPath := returnTo(form.Get("return_to"))
+		username := form.Get("username")
+		password := form.Get("password")
+
+		if _, ok := options.Sessions.VerifyCSRF(context.Request, csrfToken); !ok {
+			newCSRF, _ := options.Sessions.Ensure(context.Writer, context.Request)
+			renderLogin(context, http.StatusForbidden, newCSRF, returnPath, "", "请求已过期，请重新登录。")
+			return
+		}
+
+		usernameMatches := subtle.ConstantTimeCompare([]byte(options.AdminUsername), []byte(username)) == 1
+		passwordMatches := bcrypt.CompareHashAndPassword([]byte(options.AdminPasswordBcrypt), []byte(password)) == nil
+		if !usernameMatches || !passwordMatches {
+			csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
+			renderLogin(context, http.StatusUnauthorized, csrf, returnPath, "", "账号或密码不正确，请检查后重试。")
+			return
+		}
+
+		options.Sessions.RotateAuthenticated(context.Writer, context.Request)
+		context.Redirect(http.StatusSeeOther, returnPath)
+	}
+}
+
+func logout(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !parseForm(context) {
+			return
+		}
+		authenticated, ok := options.Sessions.VerifyCSRF(context.Request, context.Request.PostForm.Get("csrf_token"))
+		if !ok || !authenticated {
+			context.Status(http.StatusForbidden)
+			return
+		}
+
+		options.Sessions.Logout(context.Writer, context.Request)
+		context.Redirect(http.StatusSeeOther, "/login")
+	}
+}
+
+func tasksPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if !authenticated {
+			context.Redirect(http.StatusSeeOther, "/login?return_to="+url.QueryEscape(context.Request.URL.RequestURI()))
+			return
+		}
+
+		drafts, err := options.Tasks.ListDrafts(context.Request.Context())
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		data := webui.TasksData{CSRFToken: csrfToken, Drafts: drafts}
+		for _, draft := range drafts {
+			if draft.ID == context.Query("created") {
+				data.Success = true
+				break
+			}
+		}
+		if context.Query("create") == "1" {
+			form, err := newTaskForm()
+			if err != nil {
+				context.Status(http.StatusInternalServerError)
+				return
+			}
+			data.OpenForm = true
+			data.Form = form
+			data.FocusField = "title"
+		}
+		renderTasks(context, http.StatusOK, data)
+	}
+}
+
+func newTaskPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrf, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if !authenticated {
+			context.Redirect(http.StatusSeeOther, "/login?return_to=%2Ftasks%2Fnew")
+			return
+		}
+		form, err := newTaskForm()
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		renderTasks(context, http.StatusOK, webui.TasksData{CSRFToken: csrf, Form: form, FullPage: true, FocusField: "title"})
+	}
+}
+func createTask(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !parseForm(context) {
+			return
+		}
+		requestForm := context.Request.PostForm
+		authenticated, csrfOK := options.Sessions.VerifyCSRF(context.Request, requestForm.Get("csrf_token"))
+		if !csrfOK || !authenticated {
+			context.Status(http.StatusForbidden)
+			return
+		}
+		form := taskForm(requestForm)
+		draft, validation := tasks.Validate(form)
+		if draft.GoodsID != "" {
+			form.ProductURL = tasks.CanonicalURL(draft.GoodsID)
+		}
+		fullPage := requestForm.Get("form_mode") == "full"
+		if !validation.Valid() {
+			drafts, err := options.Tasks.ListDrafts(context.Request.Context())
+			if err != nil {
+				context.Status(http.StatusInternalServerError)
+				return
+			}
+			renderTasks(context, http.StatusBadRequest, webui.TasksData{CSRFToken: csrfFor(context, options), Drafts: drafts, Form: form, Errors: validation, OpenForm: !fullPage, FullPage: fullPage, FocusField: firstError(validation)})
+			return
+		}
+		created, err := options.Tasks.CreateDraft(context.Request.Context(), draft)
+		if err != nil {
+			if errors.Is(err, tasks.ErrCreateKeyConflict) {
+				validation["create_key"] = "该创建请求已用于另一条任务，请重新打开表单。"
+				drafts, listErr := options.Tasks.ListDrafts(context.Request.Context())
+				if listErr != nil {
+					context.Status(http.StatusInternalServerError)
+					return
+				}
+				renderTasks(context, http.StatusConflict, webui.TasksData{CSRFToken: csrfFor(context, options), Drafts: drafts, Form: form, Errors: validation, OpenForm: !fullPage, FullPage: fullPage, FocusField: firstError(validation)})
+				return
+			}
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		context.Redirect(http.StatusSeeOther, "/tasks?created="+url.QueryEscape(created.ID))
+	}
+}
+
+func newTaskForm() (tasks.Form, error) {
+	key, err := tasks.NewCreateKey()
+	if err != nil {
+		return tasks.Form{}, err
+	}
+	return tasks.Form{CreateKey: key}, nil
+}
+func taskForm(form url.Values) tasks.Form {
+	return tasks.Form{CreateKey: form.Get("create_key"), Title: form.Get("title"), ProductURL: form.Get("product_url"), SKUColor: form.Get("sku_color"), SKUSize: form.Get("sku_size"), Quantity: form.Get("quantity"), MaxTotalPrice: form.Get("max_total_price")}
+}
+func csrfFor(context *gin.Context, options Options) string {
+	csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
+	return csrf
+}
+func renderTasks(context *gin.Context, status int, data webui.TasksData) {
+	context.Header("Content-Type", "text/html; charset=utf-8")
+	context.Status(status)
+	if err := webui.RenderTasks(context.Writer, data); err != nil {
+		_ = context.Error(err)
+	}
+}
+
+func renderLogin(context *gin.Context, status int, csrfToken, returnPath, username, message string) {
+	context.Header("Content-Type", "text/html; charset=utf-8")
+	context.Status(status)
+	if err := webui.RenderLogin(context.Writer, webui.LoginData{
+		CSRFToken: csrfToken,
+		ReturnTo:  returnPath,
+		Username:  username,
+		Error:     message,
+	}); err != nil {
+		_ = context.Error(err)
+	}
+}
+
+func parseForm(context *gin.Context) bool {
+	context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxFormBytes)
+	if err := context.Request.ParseForm(); err != nil {
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			context.Status(http.StatusRequestEntityTooLarge)
+		} else {
+			context.Status(http.StatusBadRequest)
+		}
+		return false
+	}
+	return true
+}
+
+func firstError(validation tasks.Errors) string {
+	for _, field := range []string{"title", "product_url", "sku_color", "sku_size", "quantity", "max_total_price"} {
+		if _, ok := validation[field]; ok {
+			return field
+		}
+	}
+	return "title"
+}
+
+func returnTo(value string) string {
+	if value == "/tasks" || strings.HasPrefix(value, "/tasks/") || strings.HasPrefix(value, "/tasks?") {
+		if strings.Contains(value, "\\") || strings.Contains(value, "%") || strings.HasPrefix(value, "//") {
+			return "/tasks"
+		}
+		parsed, err := url.ParseRequestURI(value)
+		if err == nil && parsed.IsAbs() == false && parsed.Host == "" && hasSafeTaskPath(parsed.Path) {
+			return value
+		}
+	}
+
+	return "/tasks"
+}
+
+func hasSafeTaskPath(path string) bool {
+	for _, segment := range strings.Split(path, "/") {
+		if segment == "." || segment == ".." {
+			return false
+		}
+	}
+	return true
 }

admin/internal/server/router_test.go

@@ -1,28 +1,481 @@
 package server_test
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"strings"
 	"testing"
 
+	"cmbuyer/admin/internal/auth"
 	"cmbuyer/admin/internal/server"
+	"cmbuyer/admin/internal/tasks"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 )
 
-func TestHealthz(t *testing.T) {
+var csrfPattern = regexp.MustCompile(`name="csrf_token" value="([^"]+)"`)
+var createKeyPattern = regexp.MustCompile(`name="create_key" value="([^"]+)"`)
+
+func TestHealthzIsPublic(t *testing.T) {
+	router, _ := newRouter(t)
 	request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
 	response := httptest.NewRecorder()
 
-	server.NewRouter().ServeHTTP(response, request)
+	router.ServeHTTP(response, request)
 
 	if response.Code != http.StatusOK {
 		t.Fatalf("healthz status = %d, want %d", response.Code, http.StatusOK)
 	}
-
 	if contentType := response.Header().Get("Content-Type"); contentType != "application/json; charset=utf-8" {
 		t.Fatalf("healthz content type = %q, want application/json; charset=utf-8", contentType)
 	}
-
 	if body := response.Body.String(); body != "{\"status\":\"ok\"}" {
 		t.Fatalf("healthz body = %q, want {\"status\":\"ok\"}", body)
 	}
+	assertSecurityHeaders(t, response)
+}
+
+func TestTasksRequiresLoginAndBlocksOpenRedirects(t *testing.T) {
+	router, _ := newRouter(t)
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, nil)
+	if tasks.Code != http.StatusSeeOther {
+		t.Fatalf("GET /tasks status = %d, want %d", tasks.Code, http.StatusSeeOther)
+	}
+	if location := tasks.Header().Get("Location"); location != "/login?return_to=%2Ftasks" {
+		t.Fatalf("GET /tasks location = %q, want login return path", location)
+	}
+
+	for _, target := range []string{"https://example.invalid", "//example.invalid", `\\example.invalid`, "/other", "/tasks/..", "/tasks/../other", "/tasks/%2e%2e", "%2F%2Fevil.invalid", "%252F%252Fevil.invalid"} {
+		response := serve(router, http.MethodGet, "/login?return_to="+url.QueryEscape(target), nil, nil)
+		if response.Code != http.StatusOK {
+			t.Fatalf("GET /login return_to=%q status = %d, want 200", target, response.Code)
+		}
+		if strings.Contains(response.Body.String(), target) || !strings.Contains(response.Body.String(), `name="return_to" value="/tasks"`) {
+			t.Fatalf("GET /login accepted unsafe return_to %q", target)
+		}
+	}
+
+	encodedPath := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%252F..", nil, nil)
+	if !strings.Contains(encodedPath.Body.String(), `name="return_to" value="/tasks"`) {
+		t.Fatal("encoded parent path was accepted as return_to")
+	}
+	encodedQuery := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fnext%3D%252Ftasks%252F..", nil, nil)
+	if !strings.Contains(encodedQuery.Body.String(), `name="return_to" value="/tasks"`) {
+		t.Fatal("encoded query bypass was accepted as return_to")
+	}
+}
+
+func TestLoginRotatesSessionAndCSRF(t *testing.T) {
+	router, _ := newRouter(t)
+	initial := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fview%3Dmine", nil, nil)
+	oldCookie := sessionCookie(t, initial)
+	oldCSRF := csrfToken(t, initial.Body.String())
+
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {oldCSRF},
+		"return_to":  {"/tasks?view=mine"},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, oldCookie)
+	if login.Code != http.StatusSeeOther || login.Header().Get("Location") != "/tasks?view=mine" {
+		t.Fatalf("successful login = (%d, %q), want 303 /tasks?view=mine", login.Code, login.Header().Get("Location"))
+	}
+	newCookie := sessionCookie(t, login)
+	if newCookie.Value == oldCookie.Value {
+		t.Fatal("successful login reused the anonymous session cookie")
+	}
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, newCookie)
+	if tasks.Code != http.StatusOK {
+		t.Fatalf("GET /tasks after login status = %d, want 200", tasks.Code)
+	}
+	if newCSRF := csrfToken(t, tasks.Body.String()); newCSRF == oldCSRF {
+		t.Fatal("successful login reused the anonymous CSRF token")
+	}
+	for _, forbidden := range []string{"建单", "试选", "拼多多", "规格", "单价", "证据"} {
+		if strings.Contains(tasks.Body.String(), forbidden) {
+			t.Fatalf("task shell must not expose deferred feature content %q", forbidden)
+		}
+	}
+	assertSecurityHeaders(t, initial)
+	assertSecurityHeaders(t, tasks)
+}
+
+func TestLoginPageIncludesAccessibleFormBasics(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	body := page.Body.String()
+	for _, want := range []string{
+		`<label for="username">`,
+		`<label for="password">`,
+		`autocomplete="username"`,
+		`autocomplete="current-password"`,
+		`min-height:44px`,
+		`:focus-visible`,
+		`prefers-reduced-motion`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("login page is missing %q", want)
+		}
+	}
+	if strings.Contains(body, "http://") || strings.Contains(body, "https://") || strings.Contains(body, "<script") {
+		t.Fatal("login page must not load external resources or require client-side JavaScript")
+	}
+
+	failure := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, body)},
+		"username":   {"admin"},
+		"password":   {"wrong"},
+	}, sessionCookie(t, page))
+	if !strings.Contains(failure.Body.String(), `role="alert"`) {
+		t.Fatal("login failure must announce its error")
+	}
+}
+
+func TestLoginCSRFAndCredentialFailuresAreSafe(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	cookie := sessionCookie(t, page)
+
+	withoutCSRF := serve(router, http.MethodPost, "/login", url.Values{
+		"username": {"admin"},
+		"password": {"test-password"},
+	}, cookie)
+	if withoutCSRF.Code != http.StatusForbidden || !strings.Contains(withoutCSRF.Body.String(), "请求已过期") {
+		t.Fatalf("login without CSRF = (%d, %q), want rejected form", withoutCSRF.Code, withoutCSRF.Body.String())
+	}
+
+	page = serve(router, http.MethodGet, "/login", nil, cookie)
+	badCredentials := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, page.Body.String())},
+		"username":   {"unknown"},
+		"password":   {"wrong"},
+	}, cookie)
+	if badCredentials.Code != http.StatusUnauthorized {
+		t.Fatalf("login with invalid credentials status = %d, want 401", badCredentials.Code)
+	}
+	if body := badCredentials.Body.String(); !strings.Contains(body, "账号或密码不正确") || strings.Contains(body, "unknown") {
+		t.Fatalf("invalid login leaked account detail: %q", body)
+	}
+}
+
+func TestTamperedCookieCannotAccessTasks(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	cookie := sessionCookie(t, page)
+
+	tampered := *cookie
+	tampered.Value = flipCookieValue(t, cookie.Value)
+	response := serve(router, http.MethodGet, "/tasks", nil, &tampered)
+	if response.Code != http.StatusSeeOther {
+		t.Fatalf("tampered cookie status = %d, want 303", response.Code)
+	}
+
+}
+
+func TestTaskCreationRendersSharedFormsAndPersistsOnlyDraft(t *testing.T) {
+	router, _ := newRouter(t)
+	cookie := authenticate(t, router)
+
+	modal := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
+	if modal.Code != http.StatusOK {
+		t.Fatalf("GET dialog form status = %d, want 200", modal.Code)
+	}
+	fullPage := serve(router, http.MethodGet, "/tasks/new", nil, cookie)
+	if fullPage.Code != http.StatusOK {
+		t.Fatalf("GET full form status = %d, want 200", fullPage.Code)
+	}
+	for _, want := range []string{`<div class="modal-scrim"`, `<dialog open`, `aria-modal="true"`, `name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `type="url" inputmode="url" maxlength="2048"`, `type="number" inputmode="numeric" min="1" step="1"`, `inputmode="decimal" pattern="[0-9]+(\.[0-9]{1,2})?"`, `maxlength="120"`, `maxlength="80"`, `required`, `autofocus`, `导入</button><a class="button primary"`, `type="search" disabled`, `disabled>筛选</button>`, `disabled>清除</button>`, `min-height:44px`, `overflow-x:auto`, `prefers-reduced-motion`} {
+		if !strings.Contains(modal.Body.String(), want) {
+			t.Fatalf("dialog form is missing %q", want)
+		}
+	}
+	for _, want := range []string{`name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `name="form_mode" value="full"`} {
+		if !strings.Contains(fullPage.Body.String(), want) {
+			t.Fatalf("full-page form is missing %q", want)
+		}
+	}
+
+	invalid := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, modal.Body.String())},
+		"create_key":      {createKey(t, modal.Body.String())},
+		"title":           {`<script>alert(1)</script>`},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&uin=discard"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"0"},
+		"max_total_price": {"12.80"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if invalid.Code != http.StatusBadRequest || !strings.Contains(invalid.Body.String(), `<dialog open`) || !strings.Contains(invalid.Body.String(), "数量必须是正整数") || !strings.Contains(invalid.Body.String(), `role="alert"`) || !strings.Contains(invalid.Body.String(), `href="#quantity"`) || !strings.Contains(invalid.Body.String(), `aria-describedby="quantity-error"`) || !strings.Contains(invalid.Body.String(), `autofocus`) {
+		t.Fatalf("invalid create = (%d, %q), want dialog validation response", invalid.Code, invalid.Body.String())
+	}
+	if strings.Contains(invalid.Body.String(), `<script>alert(1)</script>`) || !strings.Contains(invalid.Body.String(), `&lt;script&gt;alert(1)&lt;/script&gt;`) {
+		t.Fatalf("invalid create did not safely preserve title: %q", invalid.Body.String())
+	}
+	if strings.Contains(invalid.Body.String(), "uin=discard") || !strings.Contains(invalid.Body.String(), `value="https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"`) {
+		t.Fatalf("invalid create did not canonicalize product URL: %q", invalid.Body.String())
+	}
+
+	createPage := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
+	key := createKey(t, createPage.Body.String())
+	created := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, createPage.Body.String())},
+		"create_key":      {key},
+		"title":           {"<b>夏季上衣</b>"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"2"},
+		"max_total_price": {"12.8"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if created.Code != http.StatusSeeOther || !strings.HasPrefix(created.Header().Get("Location"), "/tasks?created=") {
+		t.Fatalf("valid create = (%d, %q), want 303 to a created-task acknowledgement", created.Code, created.Header().Get("Location"))
+	}
+	replay := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, createPage.Body.String())},
+		"create_key":      {key},
+		"title":           {"<b>夏季上衣</b>"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"2"},
+		"max_total_price": {"12.8"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if replay.Code != http.StatusSeeOther {
+		t.Fatalf("idempotent replay status = %d, want 303", replay.Code)
+	}
+	conflict := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, createPage.Body.String())},
+		"create_key":      {key},
+		"title":           {"different task"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"2"},
+		"max_total_price": {"12.80"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if conflict.Code != http.StatusConflict || !strings.Contains(conflict.Body.String(), "该创建请求已用于另一条任务") {
+		t.Fatalf("conflicting create = (%d, %q), want a 409 form error", conflict.Code, conflict.Body.String())
+	}
+
+	list := serve(router, http.MethodGet, created.Header().Get("Location"), nil, cookie)
+	if list.Code != http.StatusOK {
+		t.Fatalf("GET /tasks status = %d, want 200", list.Code)
+	}
+	body := list.Body.String()
+	for _, want := range []string{`任务已创建，已显示在列表首行。`, `&lt;b&gt;夏季上衣&lt;/b&gt;`, `https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`, `target="_blank"`, `rel="noopener noreferrer"`, `¥12.80`, `待开始`, `选择全部任务`, `选择任务`} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("task list is missing %q", want)
+		}
+	}
+	for _, forbidden := range []string{"utm_source", "试选", "PENDING", "支付", "订单确认", "真机", "提交订单"} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("task list exposed deferred scope %q", forbidden)
+		}
+	}
+}
+
+func TestTaskCreationRequiresAuthenticationAndCSRF(t *testing.T) {
+	router, _ := newRouter(t)
+	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, nil); response.Code != http.StatusForbidden {
+		t.Fatalf("anonymous POST /tasks = %d, want 403", response.Code)
+	}
+	cookie := authenticate(t, router)
+	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, cookie); response.Code != http.StatusForbidden {
+		t.Fatalf("POST /tasks without CSRF = %d, want 403", response.Code)
+	}
+}
+
+func TestTaskCreationFailsClosedForMalformedOrOversizedForms(t *testing.T) {
+	router, _ := newRouter(t)
+	cookie := authenticate(t, router)
+	page := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
+	base := url.Values{
+		"csrf_token":      {csrfToken(t, page.Body.String())},
+		"create_key":      {createKey(t, page.Body.String())},
+		"title":           {"title"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=malformed"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"1"},
+		"max_total_price": {"1.00"},
+		"form_mode":       {"dialog"},
+	}
+	malformed := serve(router, http.MethodPost, "/tasks", base, cookie)
+	if malformed.Code != http.StatusBadRequest || !strings.Contains(malformed.Body.String(), "canonical 商品链接") {
+		t.Fatalf("malformed URL create = (%d, %q), want validation failure", malformed.Code, malformed.Body.String())
+	}
+
+	oversized := url.Values{"csrf_token": {csrfToken(t, page.Body.String())}, "title": {strings.Repeat("x", 9<<10)}}
+	if response := serve(router, http.MethodPost, "/tasks", oversized, cookie); response.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("oversized form status = %d, want 413", response.Code)
+	}
+}
+
+func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) {
+	t.Helper()
+	want := map[string]string{
+		"Cache-Control":           "no-store",
+		"X-Content-Type-Options":  "nosniff",
+		"Referrer-Policy":         "no-referrer",
+		"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+	}
+	for name, expected := range want {
+		if got := response.Header().Get(name); got != expected {
+			t.Fatalf("%s = %q, want %q", name, got, expected)
+		}
+	}
+}
+
+func flipCookieValue(t *testing.T, value string) string {
+	t.Helper()
+	if value == "" {
+		t.Fatal("cannot tamper with an empty cookie")
+	}
+	if value[0] == 'A' {
+		return "B" + value[1:]
+	}
+	return "A" + value[1:]
+}
+
+func TestLogoutRequiresCSRFAndRevokesSession(t *testing.T) {
+	router, _ := newRouter(t)
+	loginPage := serve(router, http.MethodGet, "/login", nil, nil)
+	loginCookie := sessionCookie(t, loginPage)
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, loginPage.Body.String())},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, loginCookie)
+	authenticatedCookie := sessionCookie(t, login)
+
+	missingCSRF := serve(router, http.MethodPost, "/logout", url.Values{}, authenticatedCookie)
+	if missingCSRF.Code != http.StatusForbidden {
+		t.Fatalf("logout without CSRF status = %d, want 403", missingCSRF.Code)
+	}
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
+	logout := serve(router, http.MethodPost, "/logout", url.Values{
+		"csrf_token": {csrfToken(t, tasks.Body.String())},
+	}, authenticatedCookie)
+	if logout.Code != http.StatusSeeOther || logout.Header().Get("Location") != "/login" {
+		t.Fatalf("logout = (%d, %q), want 303 /login", logout.Code, logout.Header().Get("Location"))
+	}
+	if cookie := sessionCookie(t, logout); cookie.MaxAge >= 0 {
+		t.Fatalf("logout cookie MaxAge = %d, want a deletion cookie", cookie.MaxAge)
+	}
+
+	reused := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
+	if reused.Code != http.StatusSeeOther {
+		t.Fatalf("revoked session status = %d, want 303", reused.Code)
+	}
+}
+
+func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+	manager := auth.NewManager([]byte(strings.Repeat("s", 32)), false)
+	router, err := server.NewRouter(server.Options{
+		AdminUsername:       "admin",
+		AdminPasswordBcrypt: string(hash),
+		Sessions:            manager,
+		Tasks:               &memoryStore{},
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return router, manager
+}
+
+type memoryStore struct{ drafts []tasks.Draft }
+
+func (store *memoryStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) {
+	for _, existing := range store.drafts {
+		if existing.ID == draft.ID {
+			if existing.Title != draft.Title || existing.GoodsID != draft.GoodsID || existing.SKUColor != draft.SKUColor || existing.SKUSize != draft.SKUSize || existing.Quantity != draft.Quantity || existing.MaxTotalPrice != draft.MaxTotalPrice {
+				return tasks.Draft{}, tasks.ErrCreateKeyConflict
+			}
+			return existing, nil
+		}
+	}
+	store.drafts = append(store.drafts, draft)
+	return draft, nil
+}
+func (store *memoryStore) ListDrafts(_ context.Context) ([]tasks.Draft, error) {
+	return append([]tasks.Draft(nil), store.drafts...), nil
+}
+
+func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
+	var body *strings.Reader
+	if form == nil {
+		body = strings.NewReader("")
+	} else {
+		body = strings.NewReader(form.Encode())
+	}
+	request := httptest.NewRequest(method, target, body)
+	if form != nil {
+		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	}
+	if cookie != nil {
+		request.AddCookie(cookie)
+	}
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	return response
+}
+
+func sessionCookie(t *testing.T, response *httptest.ResponseRecorder) *http.Cookie {
+	t.Helper()
+	for _, cookie := range response.Result().Cookies() {
+		if cookie.Name == auth.CookieName {
+			return cookie
+		}
+	}
+	t.Fatalf("response did not set %s cookie", auth.CookieName)
+	return nil
+}
+
+func csrfToken(t *testing.T, body string) string {
+	t.Helper()
+	matches := csrfPattern.FindStringSubmatch(body)
+	if len(matches) != 2 || matches[1] == "" {
+		t.Fatalf("no CSRF token in response body: %q", body)
+	}
+	return matches[1]
+}
+
+func createKey(t *testing.T, body string) string {
+	t.Helper()
+	matches := createKeyPattern.FindStringSubmatch(body)
+	if len(matches) != 2 || matches[1] == "" {
+		t.Fatalf("no create key in response body: %q", body)
+	}
+	return matches[1]
+}
+
+func authenticate(t *testing.T, router http.Handler) *http.Cookie {
+	t.Helper()
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, page.Body.String())},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, sessionCookie(t, page))
+	if login.Code != http.StatusSeeOther {
+		t.Fatalf("authenticate status = %d, want 303", login.Code)
+	}
+	return sessionCookie(t, login)
 }

admin/internal/tasks/store.go

@@ -0,0 +1,129 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+const sqliteWriteTimeout = 2 * time.Second
+
+type Store interface {
+	CreateDraft(context.Context, Draft) (Draft, error)
+	ListDrafts(context.Context) ([]Draft, error)
+}
+type SQLiteStore struct {
+	database   *sql.DB
+	now        func() time.Time
+	createGate chan struct{}
+}
+
+func NewSQLiteStore(database *sql.DB) (*SQLiteStore, error) {
+	if database == nil {
+		return nil, errors.New("database is required")
+	}
+	if _, err := database.Exec("SELECT 1 FROM tasks LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("tasks migration is not available: %w", err)
+	}
+	return &SQLiteStore{database: database, now: time.Now, createGate: make(chan struct{}, 1)}, nil
+}
+
+func (store *SQLiteStore) CreateDraft(ctx context.Context, draft Draft) (Draft, error) {
+	writeContext, cancel := context.WithTimeout(ctx, sqliteWriteTimeout)
+	defer cancel()
+	// SQLite permits one writer at a time. Serializing this store's short create
+	// transaction prevents concurrent retries of one create key from surfacing as busy.
+	select {
+	case store.createGate <- struct{}{}:
+		defer func() { <-store.createGate }()
+	case <-writeContext.Done():
+		return Draft{}, writeContext.Err()
+	}
+	draft.CreatedAt = store.now().UTC()
+	transaction, err := store.database.BeginTx(writeContext, nil)
+	if err != nil {
+		return Draft{}, err
+	}
+	defer transaction.Rollback()
+	_, err = transaction.ExecContext(writeContext, `INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', ?, ?, ?, ?, ?, ?, 'DRAFT', 1, ?, ?)`, draft.ID, draft.Title, draft.GoodsID, draft.SKUColor, draft.SKUSize, draft.Quantity, draft.MaxTotalPrice, draft.CreatedAt.Format(time.RFC3339Nano), draft.CreatedAt.Format(time.RFC3339Nano))
+	if err == nil {
+		if err := transaction.Commit(); err != nil {
+			return Draft{}, err
+		}
+		return draft, nil
+	}
+	existing, found, currentPhase, lookupErr := findDraft(writeContext, transaction, draft.ID)
+	if lookupErr != nil {
+		return Draft{}, lookupErr
+	}
+	if found && currentPhase && samePayload(existing, draft) {
+		if err := transaction.Commit(); err != nil {
+			return Draft{}, err
+		}
+		return existing, nil
+	}
+	if found {
+		return Draft{}, ErrCreateKeyConflict
+	}
+	return Draft{}, err
+}
+
+func (store *SQLiteStore) ListDrafts(ctx context.Context) ([]Draft, error) {
+	// rowid makes equal timestamps deterministic: SQLite assigns it in insertion order,
+	// whereas UUID v4 is deliberately not time-sortable.
+	rows, err := store.database.QueryContext(ctx, `SELECT id, title, goods_id, sku_color, sku_size, quantity, max_total_price, created_at FROM tasks WHERE source = 'MANUAL' AND status = 'DRAFT' ORDER BY created_at DESC, rowid DESC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Draft{}
+	for rows.Next() {
+		draft, err := scanDraft(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, draft)
+	}
+	return result, rows.Err()
+}
+
+func findDraft(ctx context.Context, transaction *sql.Tx, id string) (Draft, bool, bool, error) {
+	row := transaction.QueryRowContext(ctx, `SELECT id, title, goods_id, sku_color, sku_size, quantity, max_total_price, created_at, source, status, version FROM tasks WHERE id = ?`, id)
+	var draft Draft
+	var created, source, status string
+	var version int
+	err := row.Scan(&draft.ID, &draft.Title, &draft.GoodsID, &draft.SKUColor, &draft.SKUSize, &draft.Quantity, &draft.MaxTotalPrice, &created, &source, &status, &version)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Draft{}, false, false, nil
+	}
+	if err != nil {
+		return Draft{}, false, false, err
+	}
+	parsed, err := time.Parse(time.RFC3339Nano, created)
+	if err != nil {
+		return Draft{}, false, false, err
+	}
+	draft.CreatedAt = parsed
+	return draft, true, source == "MANUAL" && status == "DRAFT" && version == 1, nil
+}
+
+type scanner interface{ Scan(...any) error }
+
+func scanDraft(row scanner) (Draft, error) {
+	var draft Draft
+	var created string
+	if err := row.Scan(&draft.ID, &draft.Title, &draft.GoodsID, &draft.SKUColor, &draft.SKUSize, &draft.Quantity, &draft.MaxTotalPrice, &created); err != nil {
+		return Draft{}, err
+	}
+	parsed, err := time.Parse(time.RFC3339Nano, created)
+	if err != nil {
+		return Draft{}, err
+	}
+	draft.CreatedAt = parsed
+	return draft, nil
+}
+func samePayload(left, right Draft) bool {
+	return left.ID == right.ID && left.Title == right.Title && left.GoodsID == right.GoodsID && left.SKUColor == right.SKUColor && left.SKUSize == right.SKUSize && left.Quantity == right.Quantity && left.MaxTotalPrice == right.MaxTotalPrice
+}

admin/internal/tasks/tasks.go

@@ -0,0 +1,159 @@
+// Package tasks 定义手工 DRAFT 任务的校验与窄仓储边界。
+package tasks
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const (
+	maxTitleLength = 120
+	maxSKUText     = 80
+)
+
+var ErrCreateKeyConflict = errors.New("create key conflicts with a different task")
+
+type Draft struct {
+	ID            string
+	Title         string
+	GoodsID       string
+	SKUColor      string
+	SKUSize       string
+	Quantity      int
+	MaxTotalPrice string
+	CreatedAt     time.Time
+}
+
+type Form struct{ CreateKey, Title, ProductURL, SKUColor, SKUSize, Quantity, MaxTotalPrice string }
+type Errors map[string]string
+
+func (errors Errors) Valid() bool { return len(errors) == 0 }
+
+// Validate trims and normalizes a user form. It never reads a product page or derives price data.
+func Validate(form Form) (Draft, Errors) {
+	draft := Draft{ID: strings.TrimSpace(form.CreateKey), Title: strings.TrimSpace(form.Title), SKUColor: strings.TrimSpace(form.SKUColor), SKUSize: strings.TrimSpace(form.SKUSize)}
+	errors := Errors{}
+	if !validUUID(draft.ID) {
+		errors["create_key"] = "创建请求已过期，请重新打开表单。"
+	}
+	if draft.Title == "" || len([]rune(draft.Title)) > maxTitleLength {
+		errors["title"] = "任务名称不能为空，且不能超过 120 个字符。"
+	}
+	if draft.SKUColor == "" || len([]rune(draft.SKUColor)) > maxSKUText {
+		errors["sku_color"] = "颜色分类不能为空，且不能超过 80 个字符。"
+	}
+	if draft.SKUSize == "" || len([]rune(draft.SKUSize)) > maxSKUText {
+		errors["sku_size"] = "尺码不能为空，且不能超过 80 个字符。"
+	}
+	goodsID, ok := CanonicalGoodsID(strings.TrimSpace(form.ProductURL))
+	if !ok {
+		errors["product_url"] = "请输入唯一的 canonical 商品链接。"
+	} else {
+		draft.GoodsID = goodsID
+	}
+	quantity, err := strconv.ParseInt(strings.TrimSpace(form.Quantity), 10, 0)
+	if err != nil || quantity < 1 {
+		errors["quantity"] = "数量必须是正整数。"
+	} else {
+		draft.Quantity = int(quantity)
+	}
+	money, ok := normalizeMoney(strings.TrimSpace(form.MaxTotalPrice))
+	if !ok {
+		errors["max_total_price"] = "价格上限必须大于零，且最多两位小数。"
+	} else {
+		draft.MaxTotalPrice = money
+	}
+	return draft, errors
+}
+
+// CanonicalGoodsID only accepts the one verified manual-entry URL shape; untrusted query data is discarded.
+func CanonicalGoodsID(value string) (string, bool) {
+	if value == "" || strings.Contains(value, "\\") || strings.Contains(value, "%") {
+		return "", false
+	}
+	parsed, err := url.ParseRequestURI(value)
+	if err != nil || parsed.Scheme != "https" || parsed.Host != "mobile.yangkeduo.com" || parsed.User != nil || parsed.Port() != "" || parsed.Path != "/goods.html" || parsed.Fragment != "" {
+		return "", false
+	}
+	values, err := url.ParseQuery(parsed.RawQuery)
+	if err != nil {
+		return "", false
+	}
+	goodsIDs := values["goods_id"]
+	if len(goodsIDs) != 1 || goodsIDs[0] == "" {
+		return "", false
+	}
+	for _, character := range goodsIDs[0] {
+		if character < '0' || character > '9' {
+			return "", false
+		}
+	}
+	return goodsIDs[0], true
+}
+
+func CanonicalURL(goodsID string) string {
+	return "https://mobile.yangkeduo.com/goods.html?goods_id=" + goodsID
+}
+
+func NewCreateKey() (string, error) {
+	bytes := make([]byte, 16)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	bytes[6] = (bytes[6] & 0x0f) | 0x40
+	bytes[8] = (bytes[8] & 0x3f) | 0x80
+	hexValue := hex.EncodeToString(bytes)
+	return hexValue[0:8] + "-" + hexValue[8:12] + "-" + hexValue[12:16] + "-" + hexValue[16:20] + "-" + hexValue[20:32], nil
+}
+
+func validUUID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}
+
+func normalizeMoney(value string) (string, bool) {
+	parts := strings.Split(value, ".")
+	if len(parts) > 2 || parts[0] == "" || len(parts) == 2 && (len(parts[1]) == 0 || len(parts[1]) > 2) {
+		return "", false
+	}
+	for _, character := range parts[0] {
+		if character < '0' || character > '9' {
+			return "", false
+		}
+	}
+	fraction := ""
+	if len(parts) == 2 {
+		fraction = parts[1]
+		for _, character := range fraction {
+			if character < '0' || character > '9' {
+				return "", false
+			}
+		}
+	}
+	whole := strings.TrimLeft(parts[0], "0")
+	if whole == "" {
+		whole = "0"
+	}
+	if whole == "0" && strings.Trim(fraction, "0") == "" {
+		return "", false
+	}
+	return whole + "." + (fraction + "00")[:2], true
+}

admin/internal/tasks/tasks_test.go

@@ -0,0 +1,300 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const testKey = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+
+func TestValidateNormalizesManualDraft(t *testing.T) {
+	draft, validation := Validate(Form{
+		CreateKey:     " " + testKey + " ",
+		Title:         "  夏季上衣  ",
+		ProductURL:    "https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=untrusted",
+		SKUColor:      " 黑色CHA(纯棉) ",
+		SKUSize:       " M(建议100-115) ",
+		Quantity:      "2",
+		MaxTotalPrice: "00012.8",
+	})
+	if !validation.Valid() {
+		t.Fatalf("Validate errors = %#v", validation)
+	}
+	if draft.ID != testKey || draft.GoodsID != "937122477375" || draft.Title != "夏季上衣" || draft.SKUColor != "黑色CHA(纯棉)" || draft.SKUSize != "M(建议100-115)" || draft.Quantity != 2 || draft.MaxTotalPrice != "12.80" {
+		t.Fatalf("normalized draft = %#v", draft)
+	}
+}
+
+func TestValidateRejectsInvalidFieldsAndURLs(t *testing.T) {
+	base := Form{CreateKey: testKey, Title: "title", ProductURL: "https://mobile.yangkeduo.com/goods.html?goods_id=1", SKUColor: "black", SKUSize: "M", Quantity: "1", MaxTotalPrice: "1"}
+	for name, update := range map[string]func(*Form){
+		"empty title":       func(form *Form) { form.Title = "  " },
+		"long color":        func(form *Form) { form.SKUColor = string(make([]rune, maxSKUText+1)) },
+		"fraction quantity": func(form *Form) { form.Quantity = "1.5" },
+		"zero quantity":     func(form *Form) { form.Quantity = "0" },
+		"too many decimals": func(form *Form) { form.MaxTotalPrice = "1.234" },
+		"trailing decimal":  func(form *Form) { form.MaxTotalPrice = "1." },
+		"zero money":        func(form *Form) { form.MaxTotalPrice = "0.00" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			form := base
+			update(&form)
+			if _, validation := Validate(form); validation.Valid() {
+				t.Fatal("invalid form was accepted")
+			}
+		})
+	}
+
+	for _, value := range []string{
+		"http://mobile.yangkeduo.com/goods.html?goods_id=1",
+		"https://yangkeduo.com/goods.html?goods_id=1",
+		"https://mobile.yangkeduo.com:443/goods.html?goods_id=1",
+		"https://user@mobile.yangkeduo.com/goods.html?goods_id=1",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1#fragment",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1&goods_id=2",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=one",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=%31",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1%26goods_id%3D2",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=bad",
+		"https://mobile.yangkeduo.com/other.html?goods_id=1",
+	} {
+		if _, ok := CanonicalGoodsID(value); ok {
+			t.Fatalf("CanonicalGoodsID accepted %q", value)
+		}
+	}
+}
+
+func TestNormalizeMoneyBoundaries(t *testing.T) {
+	for value, want := range map[string]string{"1": "1.00", "1.2": "1.20", "000.01": "0.01", "999999999999999999": "999999999999999999.00"} {
+		got, ok := normalizeMoney(value)
+		if !ok || got != want {
+			t.Fatalf("normalizeMoney(%q) = (%q, %t), want (%q, true)", value, got, ok, want)
+		}
+	}
+	for _, value := range []string{"0", "0.0", "0.00", "1.", ".1", "1.000", "-1", "1e2", " 1"} {
+		if got, ok := normalizeMoney(value); ok {
+			t.Fatalf("normalizeMoney(%q) = %q, want rejection", value, got)
+		}
+	}
+}
+
+func TestNewCreateKeyIsUUIDv4(t *testing.T) {
+	key, err := NewCreateKey()
+	if err != nil {
+		t.Fatalf("NewCreateKey: %v", err)
+	}
+	if !regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$`).MatchString(key) {
+		t.Fatalf("create key %q is not UUID v4", key)
+	}
+}
+
+func TestSQLiteStoreRequiresMigratedDatabase(t *testing.T) {
+	database := openDatabase(t)
+	if _, err := NewSQLiteStore(database); err == nil {
+		t.Fatal("NewSQLiteStore accepted an unmigrated database")
+	}
+}
+
+func TestSQLiteStoreCreatesListsAndHandlesIdempotency(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	baseTime := time.Date(2026, 8, 4, 9, 0, 0, 0, time.UTC)
+	call := 0
+	store.now = func() time.Time {
+		result := baseTime.Add(time.Duration(call) * time.Minute)
+		call++
+		return result
+	}
+	first := testDraft(testKey, "first")
+	created, err := store.CreateDraft(context.Background(), first)
+	if err != nil {
+		t.Fatalf("create first draft: %v", err)
+	}
+	replayed, err := store.CreateDraft(context.Background(), first)
+	if err != nil {
+		t.Fatalf("replay first draft: %v", err)
+	}
+	if replayed.CreatedAt != created.CreatedAt {
+		t.Fatalf("replayed CreatedAt = %s, want original %s", replayed.CreatedAt, created.CreatedAt)
+	}
+	second := testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "second")
+	if _, err := store.CreateDraft(context.Background(), second); err != nil {
+		t.Fatalf("create second draft: %v", err)
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list drafts: %v", err)
+	}
+	if len(drafts) != 2 || drafts[0].ID != second.ID || drafts[1].ID != first.ID {
+		t.Fatalf("draft order = %#v, want second then first", drafts)
+	}
+	var source, status string
+	var version int
+	if err := database.QueryRow(`SELECT source, status, version FROM tasks WHERE id = ?`, first.ID).Scan(&source, &status, &version); err != nil {
+		t.Fatalf("read stored task: %v", err)
+	}
+	if source != "MANUAL" || status != "DRAFT" || version != 1 {
+		t.Fatalf("stored metadata = (%q, %q, %d)", source, status, version)
+	}
+
+	conflicting := first
+	conflicting.Title = "different"
+	if _, err := store.CreateDraft(context.Background(), conflicting); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("conflicting create error = %v, want ErrCreateKeyConflict", err)
+	}
+}
+
+func TestSQLiteStoreRollsBackFailedCreate(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	if _, err := database.Exec(`CREATE TRIGGER reject_task BEFORE INSERT ON tasks BEGIN SELECT RAISE(ABORT, 'reject test insert'); END`); err != nil {
+		t.Fatalf("create trigger: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), testDraft(testKey, "blocked")); err == nil {
+		t.Fatal("CreateDraft succeeded despite rejecting trigger")
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list after failed create: %v", err)
+	}
+	if len(drafts) != 0 {
+		t.Fatalf("failed create persisted drafts: %#v", drafts)
+	}
+}
+
+func TestSQLiteStoreUsesInsertionOrderForEqualTimesAndFiltersPhase(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	store.now = func() time.Time { return time.Date(2026, 8, 4, 9, 0, 0, 0, time.UTC) }
+	first := testDraft(testKey, "first")
+	second := testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "second")
+	for _, draft := range []Draft{first, second} {
+		if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+			t.Fatalf("create %s: %v", draft.Title, err)
+		}
+	}
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES ('excel-draft', 'EXCEL', 'other', '1', 'black', 'M', 1, '1.00', 'DRAFT', 1, '2026-08-04T10:00:00Z', '2026-08-04T10:00:00Z'), ('manual-pending', 'MANUAL', 'other', '2', 'black', 'M', 1, '1.00', 'PENDING', 1, '2026-08-04T10:00:00Z', '2026-08-04T10:00:00Z')`); err != nil {
+		t.Fatalf("insert out-of-scope tasks: %v", err)
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list drafts: %v", err)
+	}
+	if len(drafts) != 2 || drafts[0].ID != second.ID || drafts[1].ID != first.ID {
+		t.Fatalf("equal-time draft order/filter = %#v, want second then first only", drafts)
+	}
+	if _, err := database.Exec(`UPDATE tasks SET status = 'PENDING' WHERE id = ?`, first.ID); err != nil {
+		t.Fatalf("move draft outside current phase: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), first); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("replay of non-DRAFT record error = %v, want conflict", err)
+	}
+	third := testDraft("c3c9f507-7473-4fa6-8d71-8786c34c6301", "third")
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'EXCEL', ?, ?, ?, ?, ?, ?, 'DRAFT', 1, '2026-08-04T09:00:00Z', '2026-08-04T09:00:00Z')`, third.ID, third.Title, third.GoodsID, third.SKUColor, third.SKUSize, third.Quantity, third.MaxTotalPrice); err != nil {
+		t.Fatalf("insert same-payload EXCEL record: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), third); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("replay of non-MANUAL record error = %v, want conflict", err)
+	}
+	if _, err := database.Exec(`UPDATE tasks SET version = 2, source = 'MANUAL' WHERE id = ?`, third.ID); err != nil {
+		t.Fatalf("change replay record version: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), third); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("replay of non-v1 record error = %v, want conflict", err)
+	}
+}
+
+func TestSQLiteStoreConcurrentIdenticalCreateIsOneDraft(t *testing.T) {
+	store, err := NewSQLiteStore(migratedDatabase(t))
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	const callers = 20
+	start := make(chan struct{})
+	errors := make(chan error, callers)
+	results := make(chan Draft, callers)
+	var group sync.WaitGroup
+	for range callers {
+		group.Add(1)
+		go func() {
+			defer group.Done()
+			<-start
+			draft, err := store.CreateDraft(context.Background(), testDraft(testKey, "same"))
+			if err != nil {
+				errors <- err
+				return
+			}
+			results <- draft
+		}()
+	}
+	close(start)
+	group.Wait()
+	close(errors)
+	close(results)
+	for err := range errors {
+		t.Fatalf("concurrent create: %v", err)
+	}
+	for result := range results {
+		if result.ID != testKey {
+			t.Fatalf("concurrent result = %#v", result)
+		}
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list after concurrent create: %v", err)
+	}
+	if len(drafts) != 1 || drafts[0].ID != testKey {
+		t.Fatalf("concurrent creates persisted %#v, want exactly one", drafts)
+	}
+}
+
+func testDraft(id, title string) Draft {
+	return Draft{ID: id, Title: title, GoodsID: "937122477375", SKUColor: "black", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80"}
+}
+
+func openDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "tasks.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	return database
+}
+
+func migratedDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+	database := openDatabase(t)
+	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	return database
+}
+
+func migrationDirectory(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate test source")
+	}
+	return filepath.Join(filepath.Dir(file), "..", "..", "migrations")
+}

admin/internal/transport/webui/templates/login.html

@@ -0,0 +1,63 @@
+{{define "login.html"}}
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>登录 · 采购服务</title>
+  <style>
+    :root { color-scheme: light; --bg:#f4f7fb; --surface:#fff; --text:#172033; --muted:#526079; --border:#cfd8e6; --primary:#155eef; --primary-hover:#0b4ed1; --primary-soft:#eaf1ff; --danger:#b42318; --danger-soft:#fef3f2; --focus:#ffbf47; --shadow:0 12px 30px rgba(23,32,51,.1); font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif; }
+    * { box-sizing:border-box; }
+    html { min-width:320px; background:var(--bg); }
+    body { min-height:100dvh; margin:0; color:var(--text); background:var(--bg); font-size:16px; line-height:1.55; }
+    button,input { font:inherit; }
+    :focus-visible { outline:3px solid var(--focus); outline-offset:3px; }
+    .skip-link { position:fixed; z-index:10; top:8px; left:8px; padding:10px 14px; color:#fff; background:var(--text); transform:translateY(-160%); }
+    .skip-link:focus { transform:translateY(0); }
+    main { display:grid; min-height:100dvh; place-items:center; padding:24px 16px; }
+    .card { width:min(100%,440px); padding:32px; border:1px solid var(--border); border-radius:14px; background:var(--surface); box-shadow:var(--shadow); }
+    .brand { display:flex; align-items:center; gap:10px; margin:0 0 24px; font-size:1rem; font-weight:700; }
+    .brand-mark { display:grid; width:32px; height:32px; place-items:center; border-radius:8px; color:#fff; background:var(--primary); font-size:.82rem; }
+    h1 { margin:0; font-size:clamp(1.6rem,5vw,2rem); line-height:1.25; }
+    .intro { margin:8px 0 24px; color:var(--muted); }
+    .field { margin-top:16px; }
+    label { display:block; margin-bottom:6px; font-weight:700; }
+    input { width:100%; min-height:44px; padding:10px 12px; border:1px solid #9ba9bc; border-radius:8px; color:var(--text); background:#fff; }
+    input[aria-invalid="true"] { border-color:var(--danger); box-shadow:0 0 0 1px var(--danger); }
+    .hint { margin:5px 0 0; color:var(--muted); font-size:.875rem; }
+    .error { margin:0 0 18px; padding:12px 14px; border-left:4px solid var(--danger); border-radius:6px; color:var(--danger); background:var(--danger-soft); font-weight:650; }
+    .submit { width:100%; min-height:44px; margin-top:24px; padding:10px 16px; border:1px solid transparent; border-radius:8px; color:#fff; background:var(--primary); font-weight:700; cursor:pointer; transition:background-color 180ms ease-out; }
+    .submit:hover { background:var(--primary-hover); }
+    .notice { margin:20px 0 0; padding:12px 14px; border:1px solid #b9cffc; border-radius:8px; color:#29466f; background:var(--primary-soft); font-size:.9rem; }
+    @media (max-width:420px) { main { padding-inline:12px; } .card { padding:24px 16px; } }
+    @media (prefers-reduced-motion:reduce) { *,*::before,*::after { transition-duration:.01ms !important; animation-duration:.01ms !important; } }
+  </style>
+</head>
+<body>
+  <a class="skip-link" href="#main">跳到主要内容</a>
+  <main id="main">
+    <section class="card" aria-labelledby="login-title">
+      <p class="brand"><span class="brand-mark" aria-hidden="true">采</span><span>采购服务</span></p>
+      <h1 id="login-title">管理端登录</h1>
+      <p class="intro">登录后进入采购任务工作台。设备身份不能使用此入口。</p>
+      {{if .Error}}<p class="error" role="alert">{{.Error}}</p>{{end}}
+      <form method="post" action="/login">
+        <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+        <input type="hidden" name="return_to" value="{{.ReturnTo}}">
+        <div class="field">
+          <label for="username">账号</label>
+          <input id="username" name="username" type="text" value="{{.Username}}" autocomplete="username" required aria-invalid="{{if .Error}}true{{else}}false{{end}}" aria-describedby="username-hint">
+          <p class="hint" id="username-hint">使用采购管理员账号登录。</p>
+        </div>
+        <div class="field">
+          <label for="password">密码</label>
+          <input id="password" name="password" type="password" autocomplete="current-password" required aria-invalid="{{if .Error}}true{{else}}false{{end}}">
+        </div>
+        <button class="submit" type="submit">登录并继续</button>
+      </form>
+      <p class="notice">系统只创建待付款订单，付款始终由人完成。</p>
+    </section>
+  </main>
+</body>
+</html>
+{{end}}

admin/internal/transport/webui/templates/tasks.html

@@ -0,0 +1,19 @@
+{{define "tasks.html"}}
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>采购任务 · 采购服务</title>
+  <style>
+    :root{--bg:#f4f7fb;--surface:#fff;--text:#172033;--muted:#526079;--border:#cfd8e6;--primary:#155eef;--danger:#b42318;--success:#067647;--focus:#ffbf47;font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif}*{box-sizing:border-box}html{min-width:320px;background:var(--bg)}body{min-height:100dvh;margin:0;color:var(--text);background:var(--bg);font-size:16px;line-height:1.55}button,input{font:inherit}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:fixed;z-index:100;top:8px;left:8px;padding:10px;color:#fff;background:#172033;transform:translateY(-160%)}.skip:focus{transform:translateY(0)}header{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:64px;padding:10px clamp(16px,4vw,40px);border-bottom:1px solid var(--border);background:var(--surface)}.brand{font-weight:700}.brand b{display:inline-grid;place-items:center;width:32px;height:32px;margin-right:8px;border-radius:8px;background:var(--primary);color:#fff;font-size:.82rem}.logout,.button{display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:9px 14px;border:1px solid var(--border);border-radius:8px;color:var(--text);background:#fff;font-weight:700;text-decoration:none;cursor:pointer}.button.primary{border-color:var(--primary);background:var(--primary);color:#fff}.button:disabled,.filter input:disabled{opacity:.5;cursor:not-allowed}main{width:min(100% - 32px,1200px);margin:32px auto}.toolbar{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:16px}.toolbar-actions,.filters,.actions{display:flex;flex-wrap:wrap;gap:10px}.muted,.placeholder{color:var(--muted)}.filters{align-items:end;margin:0 0 16px}.filters label{display:grid;gap:4px;font-weight:700}.filters input{min-height:44px;min-width:180px;padding:8px 10px;border:1px solid var(--border);border-radius:8px;background:#fff}.table-wrap{overflow-x:auto;border:1px solid var(--border);border-radius:12px;background:var(--surface)}table{width:100%;min-width:880px;border-collapse:collapse}th,td{padding:12px 14px;border-bottom:1px solid var(--border);text-align:left;vertical-align:top}th{background:#f8fafc;font-size:.88rem}td a{color:#124cc5;font-weight:700;text-underline-offset:3px}.status{display:inline-block;padding:3px 8px;border-radius:999px;background:#eaf1ff;color:#173d8f;font-size:.85rem;font-weight:700}.empty,.success{padding:20px;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.success{margin:0 0 16px;border-color:#9dd9b8;background:#ecfdf3;color:var(--success)}.modal-scrim{position:fixed;z-index:20;inset:0;background:rgba(23,32,51,.52)}dialog[open]{position:fixed;z-index:30;top:50%;left:50%;width:min(calc(100% - 24px),640px);max-height:calc(100dvh - 24px);margin:0;padding:28px;overflow-y:auto;border:1px solid var(--border);border-radius:14px;box-shadow:0 18px 48px rgba(23,32,51,.24);transform:translate(-50%,-50%);background:var(--surface)}.form-page{width:min(100% - 32px,640px);margin:32px auto;padding:28px;border:1px solid var(--border);border-radius:14px;background:var(--surface)}.form-grid{display:grid;gap:16px}.field label{display:block;margin-bottom:6px;font-weight:700}.required{color:var(--danger)}.field input{width:100%;min-height:44px;padding:10px 12px;border:1px solid #9ba9bc;border-radius:8px}.field input[aria-invalid=true]{border-color:var(--danger)}.error{margin:5px 0 0;color:var(--danger);font-size:.9rem}.summary{margin:0 0 16px;padding:12px;border-left:4px solid var(--danger);background:#fef3f2;color:var(--danger)}.summary p{margin:0}.summary ul{margin:8px 0 0;padding-left:20px}.summary a{color:inherit}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}@media(max-width:420px){main,.form-page{width:calc(100% - 24px);margin:24px auto}.toolbar{align-items:stretch;flex-direction:column}.toolbar-actions,.toolbar .button{width:100%}.toolbar-actions .button{flex:1}.filters{align-items:stretch;flex-direction:column}.filters input,.filters .button{width:100%}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{transition-duration:.01ms!important;animation-duration:.01ms!important}}</style>
+</head>
+<body>
+  <a class="skip" href="#main">跳到主要内容</a>
+  <header><div class="brand"><b aria-hidden="true">采</b>采购服务</div><form method="post" action="/logout"><input type="hidden" name="csrf_token" value="{{.CSRFToken}}"><button class="logout" type="submit">退出登录</button></form></header>
+  {{if .FullPage}}<main class="form-page" id="main">{{template "form" .}}</main>{{else}}<main id="main"><div class="toolbar"><div><h1>采购任务</h1><p class="muted">只显示待开始的手工任务。</p></div><div class="toolbar-actions"><button class="button" type="button" disabled>导入</button><a class="button primary" href="/tasks?create=1">创建任务</a></div></div><div class="filters" aria-label="暂不可用的列表条件"><label>关键词<input type="search" disabled></label><button class="button" type="button" disabled>筛选</button><button class="button" type="button" disabled>清除</button></div>{{if .Success}}<p class="success" role="status">任务已创建，已显示在列表首行。</p>{{end}}{{if .Drafts}}<div class="table-wrap"><table><thead><tr><th scope="col"><input type="checkbox" disabled aria-label="选择全部任务"></th><th scope="col">标题</th><th scope="col">颜色分类</th><th scope="col">尺码</th><th scope="col">价格上限</th><th scope="col">数量</th><th scope="col">采购结果</th><th scope="col">状态</th><th scope="col">创建时间</th></tr></thead><tbody>{{range .Drafts}}<tr><td><input type="checkbox" disabled aria-label="选择任务 {{.Title}}"></td><td><a href="https://mobile.yangkeduo.com/goods.html?goods_id={{.GoodsID}}" target="_blank" rel="noopener noreferrer">{{.Title}}</a></td><td>{{.SKUColor}}</td><td>{{.SKUSize}}</td><td>¥{{.MaxTotalPrice}}</td><td>{{.Quantity}}</td><td>—</td><td><span class="status">待开始</span></td><td><time datetime="{{.CreatedAt.Format "2006-01-02T15:04:05Z07:00"}}">{{.CreatedAt.Format "2006-01-02 15:04 UTC"}}</time></td></tr>{{end}}</tbody></table></div>{{else}}<section class="empty"><h2>还没有待开始任务</h2><p>创建一条手工任务后会显示在这里。</p></section>{{end}}</main>{{if .OpenForm}}<div class="modal-scrim" aria-hidden="true"></div><dialog open aria-modal="true" aria-labelledby="form-title">{{template "form" .}}</dialog>{{end}}{{end}}
+</body>
+</html>
+{{end}}
+{{define "form"}}<h1 id="form-title">创建采购任务</h1><p class="muted">保存后仅生成待开始任务，不会执行其他动作。</p>{{if .Errors}}<div class="summary" role="alert" aria-live="assertive"><p>请修正下列字段后再保存。</p><ul>{{with index .Errors "title"}}<li><a href="#title">任务名称：{{.}}</a></li>{{end}}{{with index .Errors "product_url"}}<li><a href="#product_url">商品链接：{{.}}</a></li>{{end}}{{with index .Errors "sku_color"}}<li><a href="#sku_color">颜色分类：{{.}}</a></li>{{end}}{{with index .Errors "sku_size"}}<li><a href="#sku_size">尺码：{{.}}</a></li>{{end}}{{with index .Errors "quantity"}}<li><a href="#quantity">数量：{{.}}</a></li>{{end}}{{with index .Errors "max_total_price"}}<li><a href="#max_total_price">价格上限：{{.}}</a></li>{{end}}{{with index .Errors "create_key"}}<li>{{.}}</li>{{end}}</ul></div>{{end}}<form method="post" action="/tasks" class="form-grid"><input type="hidden" name="csrf_token" value="{{.CSRFToken}}"><input type="hidden" name="create_key" value="{{.Form.CreateKey}}"><input type="hidden" name="form_mode" value="{{if .FullPage}}full{{else}}dialog{{end}}">{{template "field" (list "title" "任务名称" .Form.Title .Errors .FocusField)}}{{template "field" (list "product_url" "商品链接" .Form.ProductURL .Errors .FocusField)}}{{template "field" (list "sku_color" "颜色分类" .Form.SKUColor .Errors .FocusField)}}{{template "field" (list "sku_size" "尺码" .Form.SKUSize .Errors .FocusField)}}{{template "field" (list "quantity" "数量" .Form.Quantity .Errors .FocusField)}}{{template "field" (list "max_total_price" "价格上限" .Form.MaxTotalPrice .Errors .FocusField)}}<div class="actions"><button class="button primary" type="submit">保存任务</button><a class="button" href="/tasks">取消</a></div></form>{{end}}
+{{define "field"}}{{$name:=index . 0}}{{$label:=index . 1}}{{$value:=index . 2}}{{$errors:=index . 3}}{{$focus:=index . 4}}<div class="field"><label for="{{$name}}">{{$label}} <span class="required" aria-hidden="true">*</span><span class="sr-only">（必填）</span></label><input id="{{$name}}" name="{{$name}}" value="{{$value}}" required {{if eq $focus $name}}autofocus{{end}} aria-invalid="{{if index $errors $name}}true{{else}}false{{end}}"{{with index $errors $name}} aria-describedby="{{$name}}-error"{{end}} {{if eq $name "product_url"}}type="url" inputmode="url" maxlength="2048"{{else if eq $name "quantity"}}type="number" inputmode="numeric" min="1" step="1"{{else if eq $name "max_total_price"}}type="text" inputmode="decimal" pattern="[0-9]+(\.[0-9]{1,2})?" maxlength="64"{{else if eq $name "title"}}type="text" maxlength="120"{{else}}type="text" maxlength="80"{{end}}>{{with index $errors $name}}<p class="error" id="{{$name}}-error">{{.}}</p>{{end}}</div>{{end}}

admin/internal/transport/webui/webui.go

@@ -0,0 +1,45 @@
+// Package webui 渲染采购服务当前可用的服务端页面。
+package webui
+
+import (
+	"embed"
+	"html/template"
+	"io"
+
+	"cmbuyer/admin/internal/tasks"
+)
+
+//go:embed templates/*.html
+var templateFiles embed.FS
+
+var templates = template.Must(template.New("webui").Funcs(template.FuncMap{"list": func(values ...any) []any { return values }}).ParseFS(templateFiles, "templates/*.html"))
+
+// LoginData 是登录页面所需的非敏感展示数据。
+type LoginData struct {
+	CSRFToken string
+	ReturnTo  string
+	Username  string
+	Error     string
+}
+
+// TasksData 是受保护的 DRAFT 建单与列表页面所需数据。
+type TasksData struct {
+	CSRFToken  string
+	Drafts     []tasks.Draft
+	Form       tasks.Form
+	Errors     tasks.Errors
+	OpenForm   bool
+	FullPage   bool
+	FocusField string
+	Success    bool
+}
+
+// RenderLogin 写入登录页。
+func RenderLogin(writer io.Writer, data LoginData) error {
+	return templates.ExecuteTemplate(writer, "login.html", data)
+}
+
+// RenderTasks 写入登录后的受保护任务页。
+func RenderTasks(writer io.Writer, data TasksData) error {
+	return templates.ExecuteTemplate(writer, "tasks.html", data)
+}

client/src/cmbuyer_client/device/sku_evidence_sanitizer.py

@@ -1,6 +1,7 @@
 """T-103 原始规格面板证据的本机确定性隐私脱敏。
 
-此模块只处理人工采集的本地文件：不连接设备、不理解拼多多页面，也不识别规格或价格。
+此模块只处理人工采集的本地文件：不连接设备、不识别规格；仅可按已取证的固定
+几何和严格格式，将跨隐私边界的价格叶节点投影到派生 XML。
 """
 
 from __future__ import annotations
@@ -21,7 +22,7 @@ from ..pdd.product_url import ProductUrl, ProductUrlError, parse_product_url
 from ..pdd.sku_panel_state import HUMAN_DECLARED_STATES
 
 
-SANITIZER_VERSION = "t103-privacy-v3"
+SANITIZER_VERSION = "t103-privacy-v4"
 EXPECTED_GOODS_ID = "937122477375"
 EXPECTED_PDD_VERSION = "8.17.0"
 EXPECTED_DEVICE_MODEL = "PKG110"
@@ -37,6 +38,27 @@ _FULL_PHONE_RE = re.compile(r"(?:\+?86)?1[3-9]\d{9}")
 _MASKED_PHONE_RE = re.compile(r"1[3-9]\d\*{4}\d{4}")
 _MASK_TRANSLATION = str.maketrans({"＊": "*", "•": "*", "·": "*", "×": "*", "x": "*", "X": "*"})
 _SEPARATOR_RE = re.compile(r"[\s\-‐‑‒–—―()（）]+")
+# 这两个槽位来自 T-103 当前第一态、1080×2376 XML 坐标的人工审查。它们不是通用
+# 页面判据；坐标、文本或结构任何变化都停止发布，交由人重新取证。
+_CROSSING_PRICE_SLOTS = {
+    (396, 503, 712, 570): "[396,503][712,570]",
+    (730, 503, 895, 570): "[730,503][895,570]",
+}
+_CROSSING_PRICE_BOUNDS = frozenset(_CROSSING_PRICE_SLOTS)
+_PRICE_PROJECTION_ATTRIBUTES = (
+    "bounds",
+    "text",
+    "package",
+    "class",
+    "clickable",
+    "enabled",
+    "visible-to-user",
+)
+# 仅接受普通 ASCII 空格，且每个可分隔位置最多一个；禁止换行、折扣、支付/提交文案和
+# 任何其它字符。前缀捕获组用于区分当前价与至多一个划线/原价候选。
+_CROSSING_PRICE_TEXT_RE = re.compile(r" {0,1}(?:(快卖光) {0,1})?[¥￥] {0,1}[1-9]\d*\.\d{2} {0,1}\Z")
+_CROSSING_PRICE_PREFIX_RE = re.compile(r" {0,1}(?:快卖光 {0,1})?[¥￥] {0,1}[1-9]\d*\.\d{2} {0,1}")
+_CROSSING_PRICE_ALLOWED_CHARACTERS = frozenset(" 快卖光¥￥0123456789.")
 
 
 class SkuEvidenceSanitizationError(RuntimeError):
@@ -49,9 +71,12 @@ class _CleanupStats:
 
     removed_nodes: int = 0
     cleared_crossing_nodes: int = 0
+    preserved_crossing_price_nodes: int = 0
     retained_below_nodes: int = 0
     max_right: int = 0
     max_bottom: int = 0
+    current_price_candidates: int = 0
+    original_price_candidates: int = 0
 
 
 @dataclass(frozen=True)
@@ -271,6 +296,7 @@ def _sanitize_hierarchy(source: Path, target: Path) -> _CleanupStats:
     _require_expected_xml_coordinate_space(stats)
     if stats.removed_nodes < 1 or stats.retained_below_nodes < 1:
         raise SkuEvidenceSanitizationError("原始节点树未满足隐私几何结构。")
+    _require_safe_crossing_price_projection(stats)
     if _contains_phone(root):
         raise SkuEvidenceSanitizationError("派生节点树仍包含手机号，拒绝发布。")
     ElementTree.ElementTree(root).write(target, encoding="utf-8", xml_declaration=True)
@@ -294,9 +320,12 @@ def _sanitize_node(parent: ElementTree.Element, node: ElementTree.Element, stats
         parent.remove(node)
         return
     if position == "crossing":
-        # 全屏/跨界容器可保留其下方子节点，但自身所有属性和文本都可能含地址或手机号。
-        _clear_node_text(node)
-        stats.cleared_crossing_nodes += 1
+        if bounds in _CROSSING_PRICE_BOUNDS and node.get("text"):
+            _project_crossing_price_node(node, bounds, stats)
+        else:
+            # 全屏/跨界容器可保留其下方子节点，但自身所有属性和文本都可能含地址或手机号。
+            _clear_node_text(node)
+            stats.cleared_crossing_nodes += 1
     else:
         stats.retained_below_nodes += 1
     for child in list(node):
@@ -340,6 +369,83 @@ def _vertical_position(bounds: tuple[int, int, int, int]) -> str:
     return "crossing"
 
 
+def _project_crossing_price_node(
+    node: ElementTree.Element,
+    bounds: tuple[int, int, int, int],
+    stats: _CleanupStats,
+) -> None:
+    """投影唯一允许的跨界价格叶节点；任何结构漂移一律拒绝发布。"""
+
+    if (
+        len(node) != 0
+        or node.get("package") != "com.xunmeng.pinduoduo"
+        or node.get("class") != "android.widget.TextView"
+        or node.get("clickable") != "false"
+        or node.get("enabled") != "true"
+        or node.get("visible-to-user") != "true"
+    ):
+        raise SkuEvidenceSanitizationError("跨界价格节点结构不匹配，拒绝发布。")
+    text = node.get("text")
+    if text is None:
+        raise SkuEvidenceSanitizationError("跨界价格节点文本不匹配，拒绝发布。")
+    match = _CROSSING_PRICE_TEXT_RE.fullmatch(text)
+    if match is None:
+        raise _crossing_price_text_mismatch_error(bounds, text)
+
+    # 只有这七项经上述检查后可进入派生 XML；尤其不复制 content-desc、resource-id 等原始属性。
+    node.attrib = {attribute: node.attrib[attribute] for attribute in _PRICE_PROJECTION_ATTRIBUTES}
+    node.text = None
+    node.tail = None
+    stats.preserved_crossing_price_nodes += 1
+    if match.group(1) is not None:
+        stats.current_price_candidates += 1
+    else:
+        stats.original_price_candidates += 1
+
+
+def _crossing_price_text_mismatch_error(
+    bounds: tuple[int, int, int, int],
+    text: str,
+) -> SkuEvidenceSanitizationError:
+    """仅输出固定槽位与 reason，避免将任意 raw 正文带入 CLI 或日志。"""
+
+    reason = _crossing_price_text_mismatch_reason(text)
+    slot = _CROSSING_PRICE_SLOTS[bounds]
+    return SkuEvidenceSanitizationError(f"跨界价格节点文本不匹配：slot={slot}；reason={reason}。")
+
+
+def _crossing_price_text_mismatch_reason(text: str) -> str:
+    """将未匹配文本归类为受控枚举；返回值绝不包含原始片段。"""
+
+    if "\r" in text or "\n" in text:
+        return "newline"
+    if any(character.isspace() and character != " " for character in text):
+        return "non_ascii_whitespace"
+    if any(marker in text for marker in ("提交订单", "支付", "下单", "优惠")):
+        return "extra_or_order"
+    without_leading_space = text.lstrip(" ")
+    if without_leading_space.startswith("快") and not without_leading_space.startswith("快卖光"):
+        return "known_prefix_missing"
+    if "¥" not in text and "￥" not in text:
+        return "currency_missing"
+    if _CROSSING_PRICE_PREFIX_RE.match(text) is not None:
+        return "extra_or_order"
+    if any(character not in _CROSSING_PRICE_ALLOWED_CHARACTERS for character in text):
+        return "forbidden_characters"
+    return "amount_shape"
+
+
+def _require_safe_crossing_price_projection(stats: _CleanupStats) -> None:
+    """当前价必须唯一；原价仅可选且唯一，避免把任意金额释放为价格证据。"""
+
+    if (
+        stats.current_price_candidates != 1
+        or stats.original_price_candidates > 1
+        or stats.preserved_crossing_price_nodes != stats.current_price_candidates + stats.original_price_candidates
+    ):
+        raise SkuEvidenceSanitizationError("跨界价格候选不唯一或缺失，拒绝发布。")
+
+
 def _clear_node_text(node: ElementTree.Element) -> None:
     node.attrib = {"bounds": node.attrib["bounds"]} if "bounds" in node.attrib else {}
     node.text = None
@@ -415,6 +521,7 @@ def _derived_manifest(
         "privacy_cleanup": {
             "removed_nodes": cleanup_stats.removed_nodes,
             "cleared_crossing_nodes": cleanup_stats.cleared_crossing_nodes,
+            "preserved_crossing_price_nodes": cleanup_stats.preserved_crossing_price_nodes,
             "retained_below_nodes": cleanup_stats.retained_below_nodes,
             "max_right": cleanup_stats.max_right,
             "max_bottom": cleanup_stats.max_bottom,

client/tests/device/test_sku_evidence_sanitizer.py

@@ -34,6 +34,10 @@ TEST_ADDRESS = "SYNTHETIC_ADDRESS_NEVER_PUBLISH"
 FULL_PHONE = "13800138000"
 MASKED_PHONE = "138****0000"
 SAFE_TEXT = "synthetic-safe-lower-content"
+CURRENT_PRICE = "快卖光 ¥12.88"
+ORIGINAL_PRICE = "¥29.00"
+PRICE_CURRENT_BOUNDS = "[396,503][712,570]"
+PRICE_ORIGINAL_BOUNDS = "[730,503][895,570]"
 
 
 def _hash(path: Path) -> str:
@@ -48,11 +52,56 @@ def _default_xml() -> str:
     return (
         "<hierarchy rotation='0'>"
         f"<node bounds='[0,0][1080,540]' text='{TEST_ADDRESS}' content-desc='{MASKED_PHONE} {FULL_PHONE}' />"
+        f"{_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS)}"
+        f"{_price_node(ORIGINAL_PRICE, PRICE_ORIGINAL_BOUNDS)}"
         f"<node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' />"
         "</hierarchy>"
     )
 
 
+def _price_node(
+    text: str,
+    bounds: str,
+    *,
+    package: str = "com.xunmeng.pinduoduo",
+    node_class: str = "android.widget.TextView",
+    clickable: str = "false",
+    enabled: str = "true",
+    visible: str = "true",
+    extra_attributes: str = "",
+    children: str = "",
+) -> str:
+    attributes = (
+        f"bounds='{bounds}' text='{text}' package='{package}' class='{node_class}' "
+        f"clickable='{clickable}' enabled='{enabled}' visible-to-user='{visible}'{extra_attributes}"
+    )
+    return f"<node {attributes}>{children}</node>"
+
+
+def _xml_with_prices(
+    current: str = CURRENT_PRICE,
+    original: str = ORIGINAL_PRICE,
+    *,
+    current_node: str | None = None,
+    original_node: str | None = None,
+    include_original: bool = True,
+    extra_nodes: str = "",
+) -> str:
+    current_markup = current_node if current_node is not None else _price_node(current, PRICE_CURRENT_BOUNDS)
+    original_markup = (
+        original_node if original_node is not None else _price_node(original, PRICE_ORIGINAL_BOUNDS)
+    ) if include_original else ""
+    return (
+        "<hierarchy>"
+        f"<node bounds='[0,0][1080,540]' text='{TEST_ADDRESS}' />"
+        f"{current_markup}"
+        f"{original_markup}"
+        f"{extra_nodes}"
+        f"<node bounds='[0,570][1080,2376]' text='{SAFE_TEXT}' />"
+        "</hierarchy>"
+    )
+
+
 def _write_raw(
     root: Path,
     *,
@@ -117,7 +166,7 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
                 self.assertNotIn(MASKED_PHONE, derived_xml)
                 self.assertIn(f'"human_declared_state": "{state}"', manifest)
                 self.assertIn('"privacy_tier": "SANITIZED"', manifest)
-                self.assertIn('"sanitizer_version": "t103-privacy-v3"', manifest)
+                self.assertIn('"sanitizer_version": "t103-privacy-v4"', manifest)
                 self.assertIn('"screenshot_space": {', manifest)
                 self.assertIn('"xml_coordinate_space": {', manifest)
                 self.assertIn('"height": 2376', manifest)
@@ -125,6 +174,7 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
                 self.assertIn('"privacy_mask_rectangle": [', manifest)
                 self.assertIn('"removed_nodes": 1', manifest)
                 self.assertIn('"cleared_crossing_nodes": 0', manifest)
+                self.assertIn('"preserved_crossing_price_nodes": 2', manifest)
                 self.assertIn('"retained_below_nodes": 1', manifest)
                 self.assertIn('"max_right": 1080', manifest)
                 self.assertIn('"max_bottom": 2376', manifest)
@@ -140,6 +190,8 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
             "<hierarchy>"
             f"<node bounds='[0,0][1080,2376]' text='{TEST_ADDRESS}' content-desc='{MASKED_PHONE}'>"
             f"<node bounds='[0,0][1080,540]' text='{FULL_PHONE}' />"
+            f"{_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS)}"
+            f"{_price_node(ORIGINAL_PRICE, PRICE_ORIGINAL_BOUNDS)}"
             f"<node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' />"
             "</node></hierarchy>"
         )
@@ -152,20 +204,245 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
             self.assertIsNotNone(crossing)
             assert crossing is not None
             self.assertEqual(crossing.attrib, {"bounds": "[0,0][1080,2376]"})
-            self.assertEqual(len(list(crossing)), 1)
-            self.assertEqual(list(crossing)[0].get("text"), SAFE_TEXT)
+            self.assertEqual(len(list(crossing)), 3)
+            self.assertEqual(list(crossing)[-1].get("text"), SAFE_TEXT)
             manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
             self.assertEqual(
                 manifest["privacy_cleanup"],
                 {
                     "removed_nodes": 1,
                     "cleared_crossing_nodes": 1,
+                    "preserved_crossing_price_nodes": 2,
                     "retained_below_nodes": 1,
                     "max_right": 1080,
                     "max_bottom": 2376,
                 },
             )
 
+    def test_only_strict_crossing_price_leaves_are_projected_with_whitelisted_attributes(self) -> None:
+        xml = _xml_with_prices(
+            current_node=_price_node(
+                CURRENT_PRICE,
+                PRICE_CURRENT_BOUNDS,
+                extra_attributes=" content-desc='discard' resource-id='discard' focused='true'",
+            ),
+            original_node=_price_node(
+                ORIGINAL_PRICE,
+                PRICE_ORIGINAL_BOUNDS,
+                extra_attributes=" content-desc='discard-too' resource-id='discard-too'",
+            ),
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=xml)
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            root = ElementTree.parse(result.hierarchy_path).getroot()
+            prices = [node for node in root.findall("node") if node.get("text") in {CURRENT_PRICE, ORIGINAL_PRICE}]
+
+            self.assertEqual(len(prices), 2)
+            for node in prices:
+                self.assertEqual(
+                    set(node.attrib),
+                    {"bounds", "text", "package", "class", "clickable", "enabled", "visible-to-user"},
+                )
+                self.assertEqual(node.get("package"), "com.xunmeng.pinduoduo")
+                self.assertEqual(node.get("class"), "android.widget.TextView")
+                self.assertEqual(node.get("clickable"), "false")
+                self.assertEqual(node.get("enabled"), "true")
+                self.assertEqual(node.get("visible-to-user"), "true")
+
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+            self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 2)
+            self.assertNotIn("discard", result.hierarchy_path.read_text(encoding="utf-8"))
+
+    def test_crossing_price_window_rejects_text_and_structure_drift(self) -> None:
+        bad_texts = (
+            f"快卖光 ¥12.88 {TEST_ADDRESS}",
+            f"快卖光 ¥12.88 {FULL_PHONE}",
+            "快卖光 ¥12.88 使用微信支付",
+            "快卖光 ¥12.88 提交订单",
+            "快卖光 ¥12.88 优惠-11元",
+            "快要抢光 ¥12.88",
+            "快卖光 ¥0.00",
+            "快卖光 ¥12.8",
+            "快卖光 ¥12.880",
+            "快卖光　¥12.88",
+        )
+        for text in bad_texts:
+            with self.subTest(text=text), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_text_mismatch_reports_only_fixed_slot_and_reason(self) -> None:
+        newline_node = _price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS).replace(
+            "快卖光 ¥12.88", "快卖光&#10;¥12.88"
+        )
+        cases = (
+            ("newline", _xml_with_prices(current_node=newline_node), "newline", PRICE_CURRENT_BOUNDS),
+            (
+                "non-ascii-whitespace",
+                _xml_with_prices(current="快卖光　¥12.88"),
+                "non_ascii_whitespace",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "known-prefix-missing",
+                _xml_with_prices(current="快要抢光 ¥12.88"),
+                "known_prefix_missing",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "currency-missing",
+                _xml_with_prices(current="快卖光 12.88"),
+                "currency_missing",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "amount-shape",
+                _xml_with_prices(current="快卖光 ¥12.8"),
+                "amount_shape",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "extra-or-order",
+                _xml_with_prices(current="提交订单 ¥12.88"),
+                "extra_or_order",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "forbidden-characters",
+                _xml_with_prices(current="商品 ¥12.88"),
+                "forbidden_characters",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "right-slot-amount-shape",
+                _xml_with_prices(original="¥29.0"),
+                "amount_shape",
+                PRICE_ORIGINAL_BOUNDS,
+            ),
+        )
+        for name, xml, reason, bounds in cases:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                self.assertEqual(
+                    str(raised.exception),
+                    f"跨界价格节点文本不匹配：slot={bounds}；reason={reason}。",
+                )
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_text_mismatch_never_echoes_sensitive_or_order_text(self) -> None:
+        cases = (
+            f"快卖光 ¥12.88 {TEST_ADDRESS}",
+            f"快卖光 ¥12.88 {FULL_PHONE}",
+            "快卖光 ¥12.88 使用微信支付",
+            "快卖光 ¥12.88 提交订单",
+        )
+        for text in cases:
+            with self.subTest(text=text), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                message = str(raised.exception)
+                self.assertIn("slot=[396,503][712,570]", message)
+                self.assertIn("reason=extra_or_order", message)
+                for raw_fragment in (TEST_ADDRESS, FULL_PHONE, "使用微信支付", "提交订单", "¥12.88"):
+                    self.assertNotIn(raw_fragment, message)
+
+    def test_crossing_price_projection_allows_only_limited_ascii_spaces_and_yen_variants(self) -> None:
+        for current in ("快卖光 ¥12.88", " 快卖光 ¥ 12.88 ", "快卖光 ￥12.88"):
+            with self.subTest(current=current), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=current))
+                result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
+                self.assertIn(current, hierarchy)
+
+    def test_unique_current_price_without_original_price_is_published(self) -> None:
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(include_original=False))
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+
+            self.assertIn(CURRENT_PRICE, hierarchy)
+            self.assertNotIn(ORIGINAL_PRICE, hierarchy)
+            self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 1)
+
+    def test_crossing_price_projection_rejects_newline_and_structure_drift(self) -> None:
+        encoded_newline = _price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS).replace(
+            "快卖光 ¥12.88", "快卖光&#10;¥12.88"
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(current_node=encoded_newline))
+            with self.assertRaises(SkuEvidenceSanitizationError):
+                sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            self.assertFalse((raw.parent / "derived").exists())
+
+        bad_structure = (
+            ("package", {"package": "com.android.systemui"}),
+            ("class", {"node_class": "android.view.View"}),
+            ("clickable", {"clickable": "true"}),
+            ("disabled", {"enabled": "false"}),
+            ("hidden", {"visible": "false"}),
+            ("children", {"children": "<node bounds='[400,510][500,520]' />"}),
+        )
+        for name, kwargs in bad_structure:
+            with self.subTest(structure=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(
+                    Path(temporary),
+                    xml=_xml_with_prices(current_node=_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS, **kwargs)),
+                )
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_candidates_require_unique_current_and_at_most_one_original(self) -> None:
+        scenarios = (
+            (
+                "missing-current",
+                _xml_with_prices(current="¥12.88", original=ORIGINAL_PRICE),
+            ),
+            (
+                "duplicate-current",
+                _xml_with_prices(current=CURRENT_PRICE, original=f"快卖光 {ORIGINAL_PRICE}"),
+            ),
+            (
+                "multiple-original",
+                _xml_with_prices(
+                    extra_nodes=_price_node("¥39.88", PRICE_ORIGINAL_BOUNDS),
+                ),
+            ),
+        )
+        for name, xml in scenarios:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_outside_fixed_windows_is_cleared_and_submit_price_is_not_candidate(self) -> None:
+        outside_crossing = _price_node("快卖光 ¥99.99", "[396,498][712,570]")
+        submit = (
+            "<node bounds='[369,2225][710,2284]' text='提交订单 ¥12.88' "
+            "package='com.xunmeng.pinduoduo' class='android.widget.TextView' clickable='false' "
+            "enabled='true' visible-to-user='true' resource-id='submit-button' />"
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(extra_nodes=outside_crossing + submit))
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+
+            self.assertNotIn("快卖光 ¥99.99", hierarchy)
+            self.assertIn("提交订单 ¥12.88", hierarchy)
+            self.assertIn("submit-button", hierarchy)
+            self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 2)
+
     def test_same_raw_and_config_produce_identical_derived_files(self) -> None:
         with TemporaryDirectory() as temporary:
             root = Path(temporary)

docs/03-tech-stack.md

@@ -155,12 +155,20 @@ T-103 已在 `client/src/cmbuyer_client/device/sku_evidence_sanitizer.py` 实现
 `client/scripts/sanitize_sku_panel_evidence.py` 提供离线 CLI。第一组新 raw 的 PNG 头部由人确认实际为
 1080×2376，推翻了 v1 将截图和 XML 坐标空间都写成 1080×2400 的假设；v1 正确拒绝且原始证据未重采。
 随后 v2 在同一份 raw 上安全报告 XML `observed 1080x2376` 并拒绝发布，证明其独立配置的
-1080×2400 假设同样不成立。当前 `t103-privacy-v3` 配置精确绑定 PKG110 / Android 16 / 拼多多
-8.17.0 / goods_id `937122477375`；screenshot space 与 XML coordinate space 仍分别建模、分别校验，
-当前都精确为 1080×2376，且都把
+1080×2400 假设同样不成立。v3 用同一 raw 成功发布后，人已确认截图隐私带完整遮挡、派生 XML
+不含地址或手机号且目标颜色和尺码仍为预选；但顶部当前价节点横跨隐私带边界，v3 只留下断片，
+而下方完整的“提交订单 ¥12.88”属于第一趟硬拒绝区，不能作为 SKU 单价证据。
+
+当前 `t103-privacy-v4` 继续精确绑定 PKG110 / Android 16 / 拼多多 8.17.0 / goods_id
+`937122477375`；screenshot space 与 XML coordinate space 仍分别建模、分别校验，当前都精确为
+1080×2376，且都把
 `[0,0,1080,540)` 作为整宽隐私带。截图覆盖该区域；XML 递归移除区域内节点，跨界容器只清空自身
-敏感属性并保留下方子节点。地址依靠已确认的整块几何隔离而不是易漏的关键词表；完整、掩码、带分隔符
-或跨节点手机号残留会被自动复检拒绝。
+敏感属性并保留下方子节点。v4 **不改变或缩小截图遮罩**，只允许交界带两个已取证精确 bounds 中，
+属于拼多多包、不可点击、可见且启用的 `TextView` 叶节点投影最小价格属性；当前价必须唯一匹配
+可选“快卖光”前缀加人民币符号和两位小数，原价同格式且最多一个。包外、可点击、结构漂移、重复、
+零值、混杂文本或坐标变化一律拒绝。地址依靠已确认的整块几何隔离而不是易漏的关键词表；完整、
+掩码、带分隔符或跨节点手机号残留会被自动复检拒绝。v4 离线实现已通过合成测试，仍须由人用同一
+第一态 raw 重跑并确认派生结果，才构成真实价格证据。
 
 ```powershell
 .\client\.venv\Scripts\python.exe client\scripts\sanitize_sku_panel_evidence.py --raw-dir "<证据目录>\raw" --output-dir "<证据目录>\derived"
@@ -170,8 +178,8 @@ T-103 已在 `client/src/cmbuyer_client/device/sku_evidence_sanitizer.py` 实现
 节点观察到的最大 right/bottom 必须精确为 1080×2376，否则只报告非敏感 observed 尺寸并拒绝。它只允许发布到
 同级且尚不存在的 `derived`；失败或发布竞态不覆盖已有目录、不留下 staging。派生 manifest 记录
 `privacy_tier=SANITIZED`、sanitizer 版本、两个坐标空间、清理计数及本机 source/derived 哈希，不记录
-原始路径、serial 或页面正文。只有自动复检通过并经人确认状态对应性的派生物，agent 才能读取并提取
-最小 fixture、编写判据。
+原始路径、serial 或页面正文；v4 另记录 `preserved_crossing_price_nodes`，用于核对严格价格投影
+数量。只有自动复检通过并经人确认状态对应性的派生物，agent 才能读取并提取最小 fixture、编写判据。
 
 2026-08-04 的首轮旧证据只用于确认上述入口事实；其中旧 `initial` 不是规格面板，另两张原始截图含隐私
 区域，因此 XML 未读取、fixture 与选择器未生成。T-110 完成受控入口与脱敏契约后，T-103 重新取证；

docs/current-state.md

@@ -21,7 +21,7 @@
   `client/` 已有 Python 包、PySide6 最小入口、运行目录与日志脱敏策略，以及显式 serial 的 ADB
   连接边界、本地基线取证 CLI、受限商品链接打开取证 CLI、人工声明规格面板状态的只读取证 CLI，
   以及绑定 PKG110 / Android 16 / 拼多多 8.17.0 的规格证据确定性脱敏 CLI；尚无规格选择、价格读取或下单流程
-- 测试：采购服务已覆盖健康检查、核心模型、迁移与状态机等离线包级测试；采购工具 69 项离线单元测试
+- 测试：采购服务已覆盖健康检查、核心模型、迁移与状态机等离线包级测试；采购工具 78 项离线单元测试
   （全部 mock，不连接真机）
 - 数据：SQLite 核心表与迁移已落成；无业务实例数据
 - 标准启动路径：Windows PowerShell 运行 `./init.ps1`，Unix shell 运行 `./init.sh`。Windows 入口
@@ -32,10 +32,13 @@
 - 当前设备门禁：人工已确认拼多多 8.17.0、goods_id `937122477375` 的衣服商品只能通过“快要抢光”
   打开规格面板；T-110 已获项目所有者批准，只把该证据/版本绑定的精确唯一入口作为第一趟可逆导航，
   数量、确认页、提交订单、付款与通用点击能力仍不可达。T-103 的原始证据本机隔离与确定性脱敏器
-  已完成离线实现；人工确认面板刚打开时目标颜色和尺码已经自动选中，取证三态已据此修正。下一步
-  用 v3 对已采第一态 raw 重新脱敏；截图与 XML 已分别安全观测为 1080×2376，仍作为两个独立坐标
-  空间严格校验。第一态 derived 经人验收后，再采集“两个维度改为非目标 / 两个维度恢复目标”的 raw，
-  并由人只核对 derived。在派生证据验收前不写页面判据，Phase 2 仍不能抢跑。
+  已完成离线实现；第一态 v3 derived 已由人确认隐私安全，并证明目标颜色和尺码自动预选，派生哈希
+  复算一致。顶部规格价格横跨隐私遮罩边界，当前只保留了不可读断片；唯一完整金额位于禁触的
+  “提交订单 ¥12.88”区域，不能作为第一趟价格证据。v4 已在保持截图遮罩不变的前提下，只允许顶部
+  交界带中满足精确坐标、拼多多包、非点击叶节点和严格金额格式的文本投影到派生 XML，离线门禁已通过；
+  下一步由人保留已验收 v3 derived，并用同一 raw 重跑 v4。价格证据通过后才采集“两个维度改为非目标 /
+  两个维度恢复目标”两态。T-010 已允许不依赖真机字段的 T-201 和只创建 `DRAFT` 的 T-202 并行；
+  T-203 及后续会启动试选或依赖真机字段的 Phase 2 功能继续等待 T-103。
 
 ## 当前目录要点
 
@@ -59,9 +62,11 @@
 - 已完成：T-002（采购工具 Python 骨架）、T-003（双端统一初始化与验证入口）、
   T-004（核心数据模型）、T-101（真机环境盘点与 USB/WiFi 双通道人工验收）、T-102（canonical
   链接打开与目标商品/隐私人工验收）。
+- 已完成 T-010（安全并行门禁）；T-201（管理员登录与会话）已在独立写路径并行开发。T-202 可在
+  T-201 完成后继续，但只能创建和展示 `DRAFT`，不得启动试选或引入未经 T-103 证实的真机字段。
 - 已完成 T-110（第一趟受控规格入口与隐私脱敏边界）。T-103 是当前最高优先级和 MVP 生死线，
-  已补充 T-110 依赖并恢复 `DOING`；脱敏器已完成，三态派生证据和新真机验收完成前不开发依赖真机可读字段的
-  Phase 2 生产页面。
+  已补充 T-110 依赖并恢复 `DOING`；v4 脱敏器离线实现已完成，三态派生证据和新真机验收完成前不开发
+  T-203 及后续依赖真机可读字段或会启动试选的 Phase 2 生产页面。
 - 已确认原型继续只作信息架构依据；原型假数据不调用真实接口、不驱动真机。真机结论改变
   可读字段时必须先回修原型与交互清单。
 
@@ -161,11 +166,13 @@ T-103 已确认当前衣服商品只能从精确文案“快要抢光”进入
 .\client\.venv\Scripts\python.exe client\scripts\sanitize_sku_panel_evidence.py --raw-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-target-restored-<GOODS_ID>-v2\raw" --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-target-restored-<GOODS_ID>-v2\derived"
 ```
 
-原始 screenshot/XML 可能包含 PDD 固定展示的地址和掩码手机号，只能留在本机 `raw` 目录，不能由
-agent、fixture、业务或上传端消费。`t103-privacy-v3` 把截图与 XML 保持为两个独立坐标空间，
-并根据同一第一态 raw 的两次 fail-closed 安全观测将二者分别精确固定为 1080×2376；它校验源哈希、
-设备/App/商品/人工状态与隐私结构，在 sibling
-`derived` 目录原子发布 screenshot/XML 与 manifest；任何不匹配、手机号残留或已有目标均拒绝发布。
+PDD 现场显示地址和掩码手机号不阻塞真机流程；但原始 screenshot/XML 只能留在本机 `raw` 隔离目录，
+不能由 agent、fixture、业务或上传端消费。`t103-privacy-v4` 把截图与 XML 保持为两个独立坐标空间，
+并根据同一第一态 raw 的两次 fail-closed 安全观测将二者分别精确固定为 1080×2376；截图隐私带沿用
+v3，不扩大、不缩小。v4 只从两个精确交界 bounds 投影属于拼多多包、不可点击且格式严格唯一的价格
+叶节点，任何点击节点、包外节点、坐标/结构/文本漂移、重复或零值都 fail closed。它校验源哈希、
+设备/App/商品/人工状态与隐私结构，在 sibling `derived` 目录原子发布 screenshot/XML 与 manifest；
+任何不匹配、手机号残留或已有目标均拒绝发布。
 自动复检通过且人确认三态对应性后，agent 才能读取派生物并提取最小 fixture、编写判据。
 人工确认中还必须记录中间态实际选择的非目标颜色和尺码，不能只写“已切换”。
 

docs/tasks/T-103.md

@@ -25,7 +25,7 @@ write_paths:
   - docs/current-state.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-04T06:06:05Z sha256=9de2a35beba4cca7a29cf4dc6b5ff643d829f6467ff576da976589a8d1f3dcad -->
+<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-04T06:56:08Z sha256=1f5f8b30076531a859c0cada576c91206cbe20471694a53690231fbb031e816e -->
 ## 问题 / 背景
 
 T-102 已证明 canonical 链接可进入目标商品。T-103 随后在 PKG110 / Android 16 / 拼多多 8.17.0、衣服商品 goods_id `937122477375` 上确认：规格面板只能从详情页右下角精确文案“快要抢光”进入，面板固定显示收货区域和掩码手机号。T-110 经项目所有者批准，将该已取证点击定义为可逆、能力受限的规格面板导航；这不是通用购买入口豁免，不授权其他文案、数量、确认页、提交订单或支付。 项目所有者随后确认，面板刚打开时已自动选中目标颜色“黑色CHA(纯棉)”和尺码“M(建议100-115)”；因此本任务不再假设存在“未选择”或“只选择一个维度”的初始状态。
@@ -131,6 +131,22 @@ T-103 sanitizer v2 坐标修正与主审：提交 44c027a 将 screenshot space
 ### 2026-08-04T06:05:53Z · ila
 
 2026-08-04 T-103 sanitizer v3 坐标修正与主审：人用同一第一态 raw 运行 v2，脱敏器安全拒绝并仅报告 observed 1080x2376，证明 XML 实际坐标与截图相同；原始证据仍有效、未重采、未读取正文。提交 acf7e11 将 sanitizer_version 升为 t103-privacy-v3；截图与 XML 仍分别建模并分别严格校验，但当前均精确绑定 1080x2376，隐私带保持 [0,0,1080,540)。合成测试明确拒绝旧截图 1080x2400、旧 v2 XML 1080x2400，以及较小/较大坐标；手机号残留、哈希/状态/版本、确定性、原子发布和不覆盖门禁保持不变。主 agent 独立复跑 69 项 client 单测、compileall、CLI help、静态禁用能力检索与 diff-check，全部通过；未连接设备、未读取真实 raw。T-103 保持 DOING，等待人用同一第一态 raw 重跑 v3 并只核对 derived。
+
+### 2026-08-04T06:17:05Z · ila
+
+2026-08-04 第一态 derived 人工隐私验收与主审：项目所有者确认截图顶部隐私区完全遮黑、派生 XML 不含地址/手机号、目标颜色和尺码仍为预选；顶部价格因隐私带只显示一部分，最底部价格完整。人工确认后主 agent 才读取 derived，未访问 raw。路径 C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-panel-opened-target- 937122477375-v2\derived；manifest 为 privacy_tier=SANITIZED、sanitizer_version=t103-privacy-v3、state=panel-opened-target-preselected，派生 screenshot/XML SHA-256 分别为 f9e370747cbef4facf6ec4a20d5af72b36c7615e7be7038144b1834632cdbf57 / f2024b7bcc69a03b05f5e95610708c0dbd33001698f40a011ddc895cf0410fb1，复算一致。XML 中“黑色 CHA (纯棉）”与“M（建议100-115）”各有明确 selected=true，汇总文本一致。完整金额候选仅见“提交订单 ¥12.88”；该文本只能在不可点击的派生快照中用于离线价格语义验证，第一趟绝不能获得该控件或其可点击父节点。另观察到 com.android.systemui 的“肉包采购辅助”浮层节点，后续最小 fixture/判据必须限定 PDD package，并建议后两态采集前关闭该浮层。第一态隐私与状态证据通过，但价格语义仍需另两态交叉验证，T-103 保持 DOING。
+
+### 2026-08-04T06:20:03Z · ila
+
+主审补充澄清：上一条所述“提交订单 ¥12.88”只能证明面板中存在该禁触文本，不得作为第一趟 SKU 单价证据，也不得驱动任何控件解析或交互。原因是它属于可点击“提交订单”父区域，违反 T-110 硬拒绝区边界。v3 第一态因此只通过隐私与预选状态验收，价格证据仍不通过。下一步不缩小 [0,0,1080,540) 截图遮罩，而由 v4 脱敏器在顶部交界带仅保留严格白名单、PDD package、非点击叶节点的价格文本到派生 XML；任何混杂文本、点击节点、包外节点或非唯一候选均 fail closed。
+
+### 2026-08-04T06:43:53Z · ila
+
+2026-08-04 客户确认加速方案：手机规格面板显示地址/手机号不再作为真机流程阻塞条件；不再扩大或调整截图黑色遮罩。原始证据仍只留本机，agent/Git/服务端仍只消费派生物。提交 1e69d27 实现 t103-privacy-v4：截图遮罩与 1080x2376 双坐标校验完全不变，只把已取证的两个顶部交界价格槽中，PDD package、TextView、非点击、可见启用、叶节点且严格匹配“唯一快卖光当前价 + 至多一个原价”的七属性安全文本投影到派生 XML；结构/文本/候选数漂移均原子拒绝，底部“提交订单 ¥12.88”仍不是价格候选。主 agent 两轮退回测试职责问题后独立复跑 76 项 client 单测、compileall、CLI help、禁用能力检索与 diff-check，全部通过。下一步保留已验收 v3 derived，用同一 raw 生成 v4 derived；T-103 保持 DOING。
+
+### 2026-08-04T06:55:52Z · ila
+
+2026-08-04 项目所有者用同一第一态 raw 运行 v4，脱敏器按设计 fail closed：跨界价格节点文本不匹配，未发布 derived；raw 与已保留的 derived-v3-reviewed 未受损。提交 ef1ac60 增加最小安全诊断：失败只输出两个固定价格槽位和受控 reason 枚举，不回显原文、金额、数字串、字符码点、长度或原始属性，v4 成功白名单与原子不发布语义不变。主 agent 独立复跑 78 项 client 单测、compileall、CLI help 与 diff-check，全部通过。等待项目所有者用同一 raw 重跑并反馈 slot/reason；T-103 保持 DOING。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界

docs/tasks/T-201.md

@@ -0,0 +1,69 @@
+---
+id: T-201
+title: 管理员登录与会话
+phase: 2
+deps: [T-004, T-005]
+status: DONE
+created: 2026-08-04
+vikunja_task_id: 26
+context_ref: 80ed9b7
+work_branch: task/t-201-admin-session
+needs_device: false
+needs_human_review: false
+write_paths:
+  - docs/tasks/T-201.md
+  - admin/cmd/server/main.go
+  - admin/internal/config/**
+  - admin/internal/server/**
+  - admin/internal/auth/**
+  - admin/internal/transport/webui/**
+  - admin/go.mod
+  - admin/go.sum
+  - admin/README.md
+---
+
+<!-- BEGIN VIKUNJA EXPORT id=26 synced=2026-08-04T07:04:10Z sha256=25607da2b9c35781f56fdea1f399bdfb65b76fa9a5ca8210693714793f5ef5f4 -->
+## 问题 / 背景
+
+采购服务已有 Go/Gin/SQLite 骨架和核心模型，但没有管理员会话。T-201 与真机规格字段无关，可在 T-103 进行时并行。
+
+## 关联需求与交互
+
+F-013、US-007；路由 GET/POST /login、POST /logout、受保护的 GET /tasks 空壳；沿用已确认采购服务原型。
+
+## 方案
+
+1. 启动时从环境变量读取管理员用户名、bcrypt 密码哈希、至少 32 字节 session secret；缺失或无效时明确失败，不提供默认凭据，不打印秘密。
+2. 使用签名会话和 CSRF；登录成功轮换会话，Cookie 为 HttpOnly、SameSite，Secure 由显式配置控制。
+3. return_to 仅接受 /tasks 及其子路径，拒绝绝对 URL、双斜杠、反斜杠和其他站内路径。
+4. 实现登录、登出与受保护的任务空壳；/healthz 保持公开。
+5. 不改数据库 schema，不实现设备 Bearer、建单、试选、授权、提交或付款。
+
+## 验收要点
+
+- 覆盖未登录跳转、成功登录与会话轮换、统一失败错误、CSRF 拒绝、登出失效和开放重定向拦截。
+- 无默认账号/密码/密钥，日志与响应不泄露凭据。
+- go test ./...、go vet ./...、go build ./...、上下文校验与 diff-check 通过。
+
+## 执行记录
+
+### 2026-08-04T06:58:30Z · ila
+
+2026-08-04 T-201 实现与主审完成：提交 47c0844 新增强制环境配置、bcrypt 校验、HMAC-SHA256 签名进程内 session、随机 CSRF、登录轮换、登出撤销、受保护 /tasks 空壳和无外部资源的 SSR 登录页。主 agent 首轮退回 /tasks/.. 返回路径绕过、含 CSRF 页面缺安全响应头、Cookie 篡改测试概率失效三项；修正后独立复跑 go test ./...、go test -race ./...、go vet ./...、go build ./...、上下文校验与 diff-check，全部通过。实现未包含建单、试选、真机字段、授权、提交或付款；T-201 验收通过。
+
+### 2026-08-04T07:03:54Z · ila
+
+集成门禁补充：T-201 分支已合入 main@88d8f77（含 T-103 最新安全诊断），随后在独立 Windows worktree 运行完整 init.ps1，admin test/vet/build、client 78 项测试/compileall、editable install 与 agent-context 校验全部通过。首次运行因 120 秒工具超时中断在大体积 PySide6 依赖安装，未产生代码或证据问题；复用已建 venv 后完整成功。
+<!-- END VIKUNJA EXPORT -->
+
+## 边界
+
+- 启动配置只接受显式环境变量中的管理员用户名、bcrypt 密码哈希和至少 32 字节 session secret；
+  不得内置开发默认值、明文密码或密钥，不得打印、回显或提交凭据。
+- 本任务只实现 `/login`、`/logout`、受保护的 `/tasks` 空壳和保持公开的 `/healthz`；不实现建单、
+  查询、批量开始试选、设备 Bearer、真机自动化或任务状态流转。
+- 不增加或修改数据库 schema，不读写 `spec_trials`、授权或 `order_submissions`，不实现任何提交订单、
+  付款、免密支付、先用后付或资金控件代码。
+- 页面和测试不得夹带机器实际规格、规格面板价格、截图、证据哈希或任何 PDD 页面判据；这些仍等待
+  T-103 真机结论。
+- `return_to` 必须是 `/tasks` 或其子路径；绝对 URL、`//`、反斜杠、编码绕过和其他站内路径均拒绝。

docs/tasks/T-202.md

@@ -0,0 +1,75 @@
+---
+id: T-202
+title: 手工建单与 DRAFT 基础列表
+phase: 2
+deps: [T-201, T-004, T-005]
+status: DONE
+created: 2026-08-04
+vikunja_task_id: 27
+context_ref: 1c35155
+work_branch: task/t-202-admin-draft
+needs_device: false
+needs_human_review: false
+write_paths:
+  - docs/tasks/T-202.md
+  - admin/cmd/server/main.go
+  - admin/internal/config/**
+  - admin/internal/server/**
+  - admin/internal/tasks/**
+  - admin/internal/storage/sqlite/**
+  - admin/internal/transport/webui/**
+  - admin/README.md
+---
+
+<!-- BEGIN VIKUNJA EXPORT id=27 synced=2026-08-04T08:32:16Z sha256=39e3b06bab4ca86e97b961a4eb6bb0a4f1e88b29dae4d50f916779f7e761424c -->
+## 问题 / 背景
+
+T-201 已提供管理员会话；T-004 已提供 tasks 表。根据 T-010 加速门禁，T-103 尚未完成时只允许实现不启动试选的 DRAFT 手工建单与基础列表。
+
+## 关联需求与交互
+
+F-001、US-001、IX-002；GET /tasks、GET /tasks/new、POST /tasks；沿用已确认的传统表格与创建弹窗/直达页。
+
+## 方案
+
+1. 显式数据库配置并打开已迁移 SQLite；以仓储接口隔离 HTTP 和 SQL，创建事务只写 MANUAL、DRAFT、version=1。
+2. 表单校验任务名称、canonical 拼多多链接、颜色分类、尺码、正整数数量和正十进制总额上限；金额只用字符串并规范为两位小数。链接只接受 HTTPS mobile.yangkeduo.com/goods.html 且 goods_id 为唯一纯数字参数，额外查询参数不进入数据库。
+3. 以服务端生成的 create_key 同时作为任务 ID；重复相同 key 和相同内容返回原结果，不创建第二条，内容不同则冲突。
+4. GET /tasks 默认 created_at DESC 显示 DRAFT 基础表格；创建入口用服务端渲染的 modal 状态，/tasks/new 复用同一表单作为无脚本兜底；失败保留非密码输入并显示字段错误，成功 303 回列表且新任务第一行。
+5. 页面只显示需求字段、采购结果占位、DRAFT 状态与创建时间；不读取或伪造规格面板价格/证据，不提供勾选开始试选、状态推进、详情或设备接口。
+
+## 验收要点
+
+- 覆盖创建成功、倒序第一行、严格链接/goods_id、数量、金额、空白/长度、CSRF/未登录、幂等重放与冲突、SQL 错误 fail closed。
+- 弹窗与 /tasks/new 共享校验；错误保留输入并可访问；标题只链接到由 goods_id 重建的 canonical PDD URL并使用安全新标签属性。
+- go test ./...、go test -race ./...、go vet ./...、go build ./...、完整 init.ps1、上下文校验和 diff-check 通过。
+
+## 执行记录
+
+### 2026-08-04T08:30:47Z · ila
+
+已完成：DRAFT 手工建单与基础列表；已验证链接、金额、CSRF、幂等、SQLite 并发和 SSR 无障碍，Go 与上下文门禁均通过。
+<!-- END VIKUNJA EXPORT -->
+
+## 边界
+
+- 本任务只创建 `source=MANUAL`、`status=DRAFT`、`version=1` 的任务并显示 DRAFT 基础列表；不得
+  实现勾选、批量开始试选、`DRAFT → PENDING` 或任何其他状态流转，也不得新增设备领取接口。
+- 不增加或修改数据库 schema，不读写 `spec_trials`、`order_authorizations`、`order_submissions`，
+  不生成或展示机器实际规格、规格面板单价、截图、证据哈希或 PDD 页面判据。
+- 启动服务必须从显式 `CMBUYER_DATABASE_SOURCE` 读取 SQLite data source；缺失时明确失败，不提供
+  隐式内存库或仓库内默认数据库。服务不自动猜迁移目录；README 必须先给出显式迁移命令。
+- 商品链接只接受 `https://mobile.yangkeduo.com/goods.html`，且必须恰有一个纯数字 `goods_id`；
+  拒绝 userinfo、端口、fragment、重复参数、其他 host/scheme/path 和编码绕过。数据库只保存 goods_id，
+  展示链接由 goods_id 重建 canonical URL；`uin` 等额外查询参数既不保存也不回显。
+- 标题、颜色分类、尺码必须去除首尾空白后非空并受明确长度上限约束；数量必须是可表示的正整数；
+  总额上限必须是大于零、最多两位小数的十进制字符串并规范为两位小数。金额校验、保存与展示均不得
+  使用浮点数或从其他数字推测。
+- `create_key` 由服务端用 `crypto/rand` 生成并验证格式，同时作为任务 ID；相同 key 与相同规范化内容
+  重放只能返回原任务，不得二次 INSERT，相同 key 携带不同内容必须冲突。SQL 必须参数化，创建失败
+  不得留下半条或未知状态记录。
+- `GET /tasks`、`GET /tasks/new`、`POST /tasks` 都必须复用 T-201 管理会话；POST 必须验证 CSRF。
+  校验失败保留非敏感输入并逐字段提示，数据库内部错误只给通用响应，不泄露 SQL、路径或凭据。
+- 页面只使用服务端模板转义；标题商品链接在新标签打开时必须带 `noopener noreferrer`。导入按钮只作
+  禁用占位；不得加载外部资源或把原型假数据、真机数据、地址、手机号带进生产页面。
+- 不实现或引用试选、数量设置、订单确认、提交围栏、提交订单、付款、免密支付或先用后付能力。