API 接口上线前要查什么：鉴权、越权、限流、幂等和错误返回

rg -n "router\\.|app\\.(get|post|put|patch|delete)|@Get|@Post|@Put|@Patch|@Delete|defineEventHandler|server/api" src server apps

curl.exe -i https://api.example.com/api/orders

curl.exe -i https://api.example.com/api/orders -H "Authorization: Bearer invalid-token"

用户 A：创建订单 order_a
用户 B：创建订单 order_b

curl.exe -i https://api.example.com/api/orders/order_a `
  -H "Authorization: Bearer user-b-token"

curl.exe -i -X PATCH https://api.example.com/api/orders/order_a `
  -H "Authorization: Bearer user-b-token" `
  -H "Content-Type: application/json" `
  -d "{\"status\":\"cancelled\"}"

从 request.body.userId 读取用户 ID，然后查询订单。

从 token/session 得到 currentUserId。
查询订单时同时带上 resourceId 和 currentUserId / tenantId。
写操作前检查当前用户对资源的 action 权限。

1. 用普通用户 token 调管理员接口。
2. 用只读用户 token 调写接口。
3. 用同租户低权限用户调高权限接口。
4. 用跨租户用户调同名资源接口。
5. 用系统服务 token 调用户接口，确认 scope 不过宽。

1..30 | ForEach-Object {
  curl.exe -s -o NUL -w "%{http_code}`n" https://api.example.com/api/sms/send `
    -H "Authorization: Bearer user-a-token"
}

POST /api/orders
Idempotency-Key: 7f0e2d0e-3c9b-4a2c-8a61-7a0f1e0a1111

$key = "11111111-1111-4111-8111-111111111111"

curl.exe -i -X POST https://api.example.com/api/orders `
  -H "Authorization: Bearer user-a-token" `
  -H "Idempotency-Key: $key" `
  -H "Content-Type: application/json" `
  -d "{\"sku\":\"basic\",\"quantity\":1}"

curl.exe -i -X POST https://api.example.com/api/orders `
  -H "Authorization: Bearer user-a-token" `
  -H "Idempotency-Key: $key" `
  -H "Content-Type: application/json" `
  -d "{\"sku\":\"basic\",\"quantity\":1}"

{
  "type": "https://api.example.com/problems/forbidden",
  "title": "Forbidden",
  "status": 403,
  "detail": "You do not have permission to access this resource.",
  "instance": "/request/req_123456"
}

request_id
user_id_hash
tenant_id
method
path_template
resource_type
resource_id_hash
action
status_code
auth_result
rate_limit_result
idempotency_key_hash
duration_ms

API release check:
- [ ] All private endpoints reject anonymous requests
- [ ] Invalid and expired tokens return 401
- [ ] Normal user cannot access admin endpoints
- [ ] User B cannot read/update/delete User A resources
- [ ] Tenant boundary is checked on every tenant resource
- [ ] Request body userId / tenantId is not trusted directly
- [ ] List endpoints have pagination and maximum page size
- [ ] Costly operations have per-user and global limits
- [ ] Retry-sensitive POST endpoints support idempotency
- [ ] Duplicate payment/order/refund/webhook requests do not repeat side effects
- [ ] Errors return stable codes and requestId
- [ ] Errors do not expose SQL, stack trace, token or internal path
- [ ] Logs can trace requestId without storing secrets
- [ ] Old, debug and internal endpoints are not publicly routable

账号 A：普通用户，有自己的资源
账号 B：普通用户，有自己的资源
管理员 C：只用于管理接口测试

必须验证：
1. A 不能操作 B 的资源。
2. B 不能操作 A 的资源。
3. A / B 不能访问管理员接口。
4. 管理员接口也要记录审计日志。
5. 重复提交创建、支付、退款，不会重复生效。