fix(t235): validate ERP user session by id

backend-api/internal/platform/shunyunbao/session.go

@@ -78,12 +78,18 @@ type SessionManager struct {
 	diagnosticLog  DiagnosticLogger
 	diagnosticsOn  bool
 	authenticated  bool
+	identity       sessionIdentity
 	captchaTicket  string
 	captchaContent []byte
 	captchaType    string
 	captchaExpires time.Time
 }
 
+type sessionIdentity struct {
+	ID       string
+	Username string
+}
+
 func NewSessionManager(config SessionConfig) (*SessionManager, error) {
 	baseURL := strings.TrimRight(strings.TrimSpace(config.BaseURL), "/")
 	headers, err := RequestHeaders(baseURL)
@@ -259,7 +265,7 @@ func (manager *SessionManager) Login(
 		return manager.statusLocked(), ErrCaptchaTicketInvalid
 	}
 	defer manager.clearCaptchaLocked()
-	manager.authenticated = false
+	manager.clearAuthenticatedLocked()
 	payload, err := json.Marshal(map[string]string{
 		"username": manager.username,
 		"password": manager.password,
@@ -274,17 +280,18 @@ func (manager *SessionManager) Login(
 		LoginPath,
 		payload,
 		true,
-		false,
 	)
 	if err != nil {
 		return manager.statusLocked(), err
 	}
-	if !hasUser(data) {
+	identity, err := sessionIdentityFrom(data)
+	if err != nil {
 		return manager.statusLocked(), domain.ErrFreightSourceProtocol
 	}
-	if _, err := manager.validateLocked(ctx); err != nil {
+	if _, err := manager.validateIdentityLocked(ctx, identity); err != nil {
 		return manager.statusLocked(), err
 	}
+	manager.identity = identity
 	manager.authenticated = true
 	manager.clearCaptchaLocked()
 	return manager.statusLocked(), nil
@@ -308,18 +315,35 @@ func (manager *SessionManager) Validate(
 }
 
 func (manager *SessionManager) validateLocked(ctx context.Context) (any, error) {
+	if manager.identity.ID == "" || manager.identity.Username == "" {
+		manager.clearAuthenticatedLocked()
+		return nil, domain.ErrFreightSourceProtocol
+	}
+	return manager.validateIdentityLocked(ctx, manager.identity)
+}
+
+func (manager *SessionManager) validateIdentityLocked(
+	ctx context.Context,
+	expected sessionIdentity,
+) (any, error) {
+	query := url.Values{}
+	query.Set("id", expected.ID)
 	data, err := manager.requestJSONLocked(
 		ctx,
 		http.MethodGet,
-		UserPath,
+		UserPath+"?"+query.Encode(),
 		nil,
 		false,
-		true,
 	)
 	if err != nil {
+		if errors.Is(err, domain.ErrFreightSourceProtocol) {
+			manager.clearAuthenticatedLocked()
+		}
 		return nil, err
 	}
-	if !hasUser(data) {
+	actual, err := sessionIdentityFrom(data)
+	if err != nil || actual != expected {
+		manager.clearAuthenticatedLocked()
 		return nil, domain.ErrFreightSourceProtocol
 	}
 	return data, nil
@@ -330,7 +354,6 @@ func (manager *SessionManager) requestJSONLocked(
 	method, path string,
 	body []byte,
 	loginRequest bool,
-	requireSession bool,
 ) (any, error) {
 	var content io.Reader
 	if body != nil {
@@ -387,8 +410,8 @@ func (manager *SessionManager) requestJSONLocked(
 		if loginRequest {
 			return nil, ErrLoginRejected
 		}
-		if requireSession || unauthenticatedCode(envelope.Code) {
-			manager.authenticated = false
+		if unauthenticatedCode(envelope.Code) {
+			manager.clearAuthenticatedLocked()
 			return nil, domain.ErrFreightSourceSessionNeeded
 		}
 		return nil, domain.ErrFreightSourceProtocol
@@ -430,12 +453,17 @@ func (manager *SessionManager) applyHeaders(request *http.Request) {
 
 func (manager *SessionManager) responseErrorLocked(status int) error {
 	if status == http.StatusUnauthorized || status == http.StatusForbidden {
-		manager.authenticated = false
+		manager.clearAuthenticatedLocked()
 		return domain.ErrFreightSourceSessionNeeded
 	}
 	return domain.ErrFreightSourceUnavailable
 }
 
+func (manager *SessionManager) clearAuthenticatedLocked() {
+	manager.authenticated = false
+	manager.identity = sessionIdentity{}
+}
+
 func (manager *SessionManager) configuredLocked() bool {
 	return manager.username != "" && manager.password != ""
 }
@@ -693,16 +721,28 @@ func redactDiagnosticString(value string) string {
 	return string(characters)
 }
 
-func hasUser(value any) bool {
+func sessionIdentityFrom(value any) (sessionIdentity, error) {
 	data, ok := value.(map[string]any)
 	if !ok {
-		return false
+		return sessionIdentity{}, errInvalidProtocolInput
 	}
 	if user, exists := data["user"]; exists {
-		_, ok := user.(map[string]any)
-		return ok
+		data, ok = user.(map[string]any)
+		if !ok {
+			return sessionIdentity{}, errInvalidProtocolInput
 		}
-	return data["id"] != nil || data["username"] != nil
+	}
+	id, err := externalID(data["id"])
+	if err != nil {
+		return sessionIdentity{}, errInvalidProtocolInput
+	}
+	username, ok := data["username"].(string)
+	username = strings.TrimSpace(username)
+	if !ok || username == "" || len([]byte(username)) > 512 ||
+		!utf8.ValidString(username) || hasControl(username) {
+		return sessionIdentity{}, errInvalidProtocolInput
+	}
+	return sessionIdentity{ID: id, Username: username}, nil
 }
 
 func validCaptchaCode(value string) bool {

backend-api/internal/platform/shunyunbao/session_test.go

@@ -38,13 +38,16 @@ func TestSessionManagerCaptchaLoginAndValidationShareCookieJar(t *testing.T) {
 				t.Fatalf("login body = %s", content)
 			}
 			http.SetCookie(writer, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"})
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12},"token":"never-exposed"}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"test-user"},"token":"never-exposed"}}`))
 		case UserPath:
 			userCalls++
+			if request.URL.Query().Get("id") != "12" {
+				t.Fatalf("user query = %q", request.URL.RawQuery)
+			}
 			if cookie, err := request.Cookie("authenticated"); err != nil || cookie.Value != "yes" {
 				t.Fatalf("user cookie = %v / %v", cookie, err)
 			}
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"test-user"}}`))
 		default:
 			writer.WriteHeader(http.StatusNotFound)
 		}
@@ -118,12 +121,62 @@ func TestSessionManagerMapsAnonymousFailuresAndExpiresState(t *testing.T) {
 		t.Fatalf("expired captcha error = %v", err)
 	}
 	manager.authenticated = true
+	manager.identity = sessionIdentity{ID: "12", Username: "test-user"}
 	if _, err := manager.Validate(context.Background()); !errors.Is(err, domain.ErrFreightSourceSessionNeeded) ||
 		manager.Status().Authenticated {
 		t.Fatalf("expired session error/status = %v / %+v", err, manager.Status())
 	}
 }
 
+func TestSessionManagerUserValidationClassifiesResponses(t *testing.T) {
+	testCases := []struct {
+		name     string
+		response string
+		want     error
+	}{
+		{
+			name:     "ordinary ERP failure is protocol error",
+			response: `{"status":false,"code":0,"data":null,"msg":"没有任何操作"}`,
+			want:     domain.ErrFreightSourceProtocol,
+		},
+		{
+			name:     "unauthenticated code expires session",
+			response: `{"status":false,"code":-2,"data":null,"msg":"未登录"}`,
+			want:     domain.ErrFreightSourceSessionNeeded,
+		},
+		{
+			name:     "different user is protocol error",
+			response: `{"status":true,"code":0,"data":{"id":13,"username":"other-user"}}`,
+			want:     domain.ErrFreightSourceProtocol,
+		},
+	}
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(
+				writer http.ResponseWriter,
+				request *http.Request,
+			) {
+				if request.URL.Path != UserPath {
+					writer.WriteHeader(http.StatusNotFound)
+					return
+				}
+				if request.URL.Query().Get("id") != "12" {
+					t.Fatalf("user query = %q", request.URL.RawQuery)
+				}
+				_, _ = writer.Write([]byte(testCase.response))
+			}))
+			defer server.Close()
+			manager := testSessionManager(t, server.URL, "test-user", "test-password")
+			manager.authenticated = true
+			manager.identity = sessionIdentity{ID: "12", Username: "test-user"}
+			_, err := manager.Validate(context.Background())
+			if !errors.Is(err, testCase.want) || manager.Status().Authenticated {
+				t.Fatalf("Validate() error/status = %v / %+v", err, manager.Status())
+			}
+		})
+	}
+}
+
 func TestSessionManagerSerializesCaptchaRequests(t *testing.T) {
 	var mutex sync.Mutex
 	inFlight, maximum := 0, 0
@@ -178,9 +231,12 @@ func TestSessionManagerEnsureAuthenticatedUsesRecognizerOnce(t *testing.T) {
 		case LoginPath:
 			loginCalls++
 			http.SetCookie(w, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"})
-			_, _ = w.Write([]byte(`{"status":true,"data":{"user":{"id":12}}}`))
+			_, _ = w.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"test-user"}}}`))
 		case UserPath:
-			_, _ = w.Write([]byte(`{"status":true,"data":{"id":12}}`))
+			if r.URL.Query().Get("id") != "12" {
+				t.Fatalf("user query = %q", r.URL.RawQuery)
+			}
+			_, _ = w.Write([]byte(`{"status":true,"data":{"id":12,"username":"test-user"}}`))
 		default:
 			w.WriteHeader(http.StatusNotFound)
 		}
@@ -332,6 +388,46 @@ func TestSessionManagerDiagnosticLogsHideInvalidOCRResults(t *testing.T) {
 	}
 }
 
+func TestSessionManagerDiagnosticLogOmitsUserIdentityQuery(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(
+		writer http.ResponseWriter,
+		request *http.Request,
+	) {
+		if request.URL.Path != UserPath || request.URL.Query().Get("id") != "12" {
+			writer.WriteHeader(http.StatusNotFound)
+			return
+		}
+		writer.Header().Set("Content-Type", "application/json")
+		_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"test-user"}}`))
+	}))
+	defer server.Close()
+	var events []string
+	manager, err := NewSessionManager(SessionConfig{
+		BaseURL:           server.URL,
+		Username:          "test-user",
+		Password:          "test-password",
+		Timeout:           time.Second,
+		AllowInsecureHTTP: true,
+		DiagnosticLogger: func(event string) {
+			events = append(events, event)
+		},
+	})
+	if err != nil {
+		t.Fatalf("NewSessionManager() error = %v", err)
+	}
+	manager.authenticated = true
+	manager.identity = sessionIdentity{ID: "12", Username: "test-user"}
+	if _, err := manager.Validate(context.Background()); err != nil {
+		t.Fatalf("Validate() error = %v", err)
+	}
+	actual := strings.Join(events, "\n")
+	if !strings.Contains(actual, "erp_request method=GET path=/am/user/get") ||
+		strings.Contains(actual, "?id=") || strings.Contains(actual, "test-user") ||
+		strings.Contains(actual, `"id":12`) {
+		t.Fatalf("diagnostic log leaked user identity: %s", actual)
+	}
+}
+
 type fixedRecognizer struct {
 	code  string
 	err   error

backend-api/internal/platform/shunyunbao/source.go

@@ -120,7 +120,6 @@ func (manager *SessionManager) queryStocksLocked(
 		StockListTotalPath,
 		firstBody,
 		false,
-		false,
 	)
 	if err != nil {
 		return nil, err
@@ -154,7 +153,6 @@ func (manager *SessionManager) queryStocksLocked(
 			StockListPath,
 			body,
 			false,
-			false,
 		)
 		if err != nil {
 			return nil, err
@@ -223,7 +221,6 @@ func (manager *SessionManager) queryDetailsLocked(
 			StockDetailPath+"?hist=0",
 			body,
 			false,
-			false,
 		)
 		if err != nil {
 			return nil, err

backend-api/internal/platform/shunyunbao/source_test.go

@@ -31,12 +31,15 @@ func TestSessionManagerQueryOrderUsesVerifiedSessionAndAllowlist(t *testing.T) {
 				t.Fatalf("login captcha cookie = %v / %v", cookie, err)
 			}
 			http.SetCookie(writer, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"})
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1}}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1,"username":"test-user"}}}`))
 		case UserPath:
+			if request.URL.Query().Get("id") != "1" {
+				t.Fatalf("user query = %q", request.URL.RawQuery)
+			}
 			if cookie, err := request.Cookie("authenticated"); err != nil || cookie.Value != "yes" {
 				t.Fatalf("user cookie = %v / %v", cookie, err)
 			}
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":1}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":1,"username":"test-user"}}`))
 		case StockListTotalPath:
 			assertStockPayload(t, request, "SOURCE-12", 0, 1, 20)
 			_, _ = writer.Write([]byte(`{"status":true,"data":1}`))
@@ -100,9 +103,12 @@ func TestSessionManagerQueryCreatedRangePaginatesAndDeduplicates(t *testing.T) {
 			_, _ = writer.Write([]byte("captcha"))
 		case LoginPath:
 			http.SetCookie(writer, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"})
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1}}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1,"username":"test-user"}}}`))
 		case UserPath:
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":1}}`))
+			if request.URL.Query().Get("id") != "1" {
+				t.Fatalf("user query = %q", request.URL.RawQuery)
+			}
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":1,"username":"test-user"}}`))
 		case StockListTotalPath:
 			assertStockPayload(t, request, "2026-07-22,2026-07-28", 0, 1, 20)
 			_, _ = writer.Write([]byte(`{"status":true,"data":21}`))

backend-api/internal/transport/httpapi/admin_handlers_test.go

@@ -76,12 +76,15 @@ func TestERPAdminAPIUsesCaptchaTicketWithoutExposingCredentials(t *testing.T) {
 				t.Fatalf("login did not retain captcha cookie: %v", err)
 			}
 			http.SetCookie(writer, &http.Cookie{Name: "erp", Value: "login", Path: "/"})
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12},"token":"private-token"}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"private-user"},"token":"private-token"}}`))
 		case shunyunbao.UserPath:
+			if request.URL.Query().Get("id") != "12" {
+				t.Fatalf("user query = %q", request.URL.RawQuery)
+			}
 			if cookie, err := request.Cookie("erp"); err != nil || cookie.Value != "login" {
 				t.Fatalf("user session cookie = %v / %v", cookie, err)
 			}
-			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12}}`))
+			_, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"private-user"}}`))
 		default:
 			writer.WriteHeader(http.StatusNotFound)
 		}

docs/api.md

@@ -203,6 +203,9 @@ T-203 成功返回 `201`。使用相同 `Idempotency-Key` 和相同图片内容
 `/erp`、`/erp/captcha`、`/erp/login` 和 `/api/v1/erp-session*` 不再暴露。创建货运同步
 前，单一 API 进程在未认证时以同一 Cookie jar 获取验证码、调用受控 OCR、登录并校验用户。
 验证码图片、OCR 文字、Cookie、JWT、账号、密码和原始响应都不返回浏览器/API，也不写 SQLite。
+登录成功后从 `data.user` 严格读取 id/username，并请求
+`GET /am/user/get?id=<user.id>`；返回身份必须一致。只有 HTTP 401/403 或 ERP code `-2` 被视为
+会话失效，其他 `status=false` 返回 `ERP_RESPONSE_INVALID`。
 
 ERP 配置来源：
 

docs/current-state.md

@@ -5,7 +5,7 @@
 ## 当前快照
 
 - 日期：2026-07-29
-- 阶段：T-235 计划修复顺运宝登录后用户会话校验协议
+- 阶段：T-235 已修复顺运宝登录后用户会话校验协议
 - Git：当前分支为 `main`；T-001 至 T-004、T-101 至 T-104、T-201 至 T-219
   均按文档提交、实现提交的顺序纳入历史
 - 生产代码：`android-buyer/` 已接入 Roubao Android 源码
@@ -193,6 +193,7 @@
 | `docs/tasks/T-232.md` | DONE | 记录 ERP/OCR 导入预检安全诊断日志 |
 | `docs/tasks/T-233.md` | DONE | 修复预检错误映射并增加受控 ERP 诊断日志 |
 | `docs/tasks/T-234.md` | DONE | 在受控诊断模式输出 OCR 验证码文本 |
+| `docs/tasks/T-235.md` | DONE | 修复顺运宝登录后用户会话校验协议 |
 | `docs/design/` | 已确认 | T-202 原型索引、4 个管理页和 7 个 Android 页面 |
 | `deepseek总结.txt` | 已有 | 历史讨论摘要，不是正式需求权威 |
 | `android-buyer/` | 已有 | Roubao `main` 固定 commit 的 Android 基线 |
@@ -204,12 +205,12 @@
 ## 任务摘要
 
 - 已完成：T-001 至 T-004、T-101 至 T-104、T-201 至 T-219。
-- 已完成：另含 T-220 至 T-234 ERP 契约、货运存储、采购需求生成、日期增量同步、Go
+- 已完成：另含 T-220 至 T-235 ERP 契约、货运存储、采购需求生成、日期增量同步、Go
  直连协议、OCR 会话预检、稳定预检错误、安全诊断日志、直连 `FreightSource`、旧 Connector
  清理和受控本地凭证加载。
-- 进行中：T-235 将保存登录响应的受控用户身份，使用 `GET /am/user/get?id=<user.id>` 校验
-  同一会话，并收紧 ERP session error 分类。
-- 下一步：实现并验证 T-235 后，使用 `start-backend.bat --erp-debug` 重新执行受控单号 smoke。
+- 进行中：无。
+- 下一步：使用 `start-backend.bat --erp-debug` 重启 API 并重新执行受控单号 smoke；确认用户
+  校验成功后继续观察 listTotal/list/detail 请求和同步结果。
 
 ## 当前可运行内容
 

docs/integrations/shunyunbao-contract.md

@@ -7,8 +7,10 @@
 
 1. 同一 HTTP Session 获取 `GET /api/p/code1` 验证码。
 2. `POST /am/auth/login` 提交环境变量提供的账号/密码和受控验证码。
-3. `POST /am/stock/listTotal` 与 `/am/stock/list` 使用“全部单号”条件查询。
-4. `POST /am/stock/detail/listByStock?hist=0` 使用列表 `stock.id` 批量读取详情。
+3. 从登录 `data.user` 读取正整数 `id` 和非空 `username`，以同一 Cookie Session 调用
+   `GET /am/user/get?id=<user.id>`；返回身份必须完全一致。
+4. `POST /am/stock/listTotal` 与 `/am/stock/list` 使用“全部单号”条件查询。
+5. `POST /am/stock/detail/listByStock?hist=0` 使用列表 `stock.id` 批量读取详情。
 
 本地 HAR 结构确认：
 
@@ -39,7 +41,9 @@ T-225 至 T-227 在 `backend-api/internal/platform/shunyunbao` 用脱敏 fixture
 
 Go 直连的验证码、登录、Cookie jar 和查询 source 都在 API 进程内。T-230 在未认证时仅可将
 验证码图片一次提交给受控本机/HTTPS OCR endpoint，结果只用于当前登录请求；不得写入 Redis、
-SQLite、日志或浏览器，也不得轮询或重试。真实线上请求不属于自动化测试。
+SQLite、普通日志或浏览器，也不得轮询或重试。T-234 仅允许显式 diagnostics 进程短时输出有效
+OCR 文本；T-235 仅在受锁内存中保存已核验 user id/username，不保存登录 token。HTTP 401/403
+或 ERP code `-2` 才代表会话失效；其他 `status=false` 是协议错误。真实线上请求不属于自动化测试。
 
 ## 身份和规范字段
 

docs/tasks/T-235.md

@@ -4,7 +4,7 @@ title: 修复顺运宝登录后用户会话校验协议
 phase: 2
 deps:
   - T-234
-status: PLANNED
+status: DONE
 created: 2026-07-29
 context_ref: 4cf2151
 work_branch: null
@@ -14,6 +14,7 @@ write_paths:
   - docs/current-state.md
   - docs/integrations/shunyunbao-contract.md
   - backend-api/internal/platform/shunyunbao/**
+  - backend-api/internal/transport/httpapi/admin_handlers_test.go
 ---
 
 ## 问题 / 背景
@@ -39,13 +40,13 @@ write_paths:
 
 ## 验收要点
 
-- [ ] 登录成功后的用户校验请求包含登录响应中的唯一 `id`，且复用登录 Cookie。
-- [ ] 用户响应 ID/username 必须与登录身份一致；缺失、冲突或普通 `status=false` 返回
+- [x] 登录成功后的用户校验请求包含登录响应中的唯一 `id`，且复用登录 Cookie。
+- [x] 用户响应 ID/username 必须与登录身份一致；缺失、冲突或普通 `status=false` 返回
   `ERP_RESPONSE_INVALID`。
-- [ ] 仅 HTTP 401/403 或 ERP code `-2` 清除认证并返回 `ERP_SESSION_REQUIRED`。
-- [ ] Admin 不再因缺失 user id 得到 `freight_import_failed status=503`；该协议失败若重现应显示
+- [x] 仅 HTTP 401/403 或 ERP code `-2` 清除认证并返回 `ERP_SESSION_REQUIRED`。
+- [x] Admin 不再因缺失 user id 得到 `freight_import_failed status=503`；该协议失败若重现应显示
   `ERP_RESPONSE_INVALID`。
-- [ ] 标准 Go 测试、race、vet 和三个入口构建通过。
+- [x] 标准 Go 测试、race、vet 和三个入口构建通过。
 
 ## 边界
 
@@ -57,3 +58,6 @@ write_paths:
 - 2026-07-29：创建任务。真实日志已排除 OCR、网络和账号密码；对照
   `D:/chengma/shunyunbaoerp/shunyunbaoerp_single.py` 确认 Go 遗漏用户接口的 `id` query，
   并发现非 `-2` 响应被过度归类为会话失效。
+- 2026-07-29：实现受锁内存 session identity、结构化 user id query、ID/username 一致性校验
+  和精确 session error 分类；更新 source/Admin 脱敏 fixture，并验证 diagnostics 不输出 query
+  或用户身份。标准 Go 测试、race、vet 及 api/migrate/authctl 构建均通过。