feat: add system disclosure policy gate

admin-routes.test.mjs

@@ -90,6 +90,79 @@ test('admin memory-v2 config routes expose config and runtime state', async () =
   }
 });
 
+test('admin system disclosure policy routes version config through the injected control-plane service', async () => {
+  const updates = [];
+  const config = {
+    enabled: true,
+    mode: 'shadow',
+    refusalText: '不提供内部技术信息。',
+    productNames: ['tkmind'],
+    selfReferences: ['本系统'],
+    categories: { architecture: true },
+  };
+  const router = createAdminApi({
+    jsonBody: express.json(),
+    getToken() {
+      return 'token-admin';
+    },
+    userAuth: {
+      async getMe() {
+        return { id: 'admin-1', role: 'admin' };
+      },
+    },
+    llmProviderService: null,
+    memoryV2ConfigService: null,
+    systemDisclosurePolicyService: {
+      async getAdminConfig() {
+        return { config, policyVersion: 2, source: 'admin-db' };
+      },
+      async updateAdminConfig(patch, context) {
+        updates.push({ patch, context });
+        return { config: patch, policyVersion: 3, source: 'admin-db' };
+      },
+      getRuntimeState() {
+        return { config, policyVersion: 2, source: 'admin-db', refreshedAt: 123 };
+      },
+    },
+    plazaPosts: null,
+    plazaOps: null,
+    wechatAdmin: null,
+    subscriptionService: null,
+  });
+
+  const server = await startTestServer(router);
+  try {
+    const getResponse = await fetch(`${server.baseUrl}/admin-api/system-disclosure-policy/config`, {
+      headers: { cookie: 'h5_user_session=token-admin' },
+    });
+    assert.equal(getResponse.status, 200);
+    assert.equal((await getResponse.json()).policyVersion, 2);
+
+    const updateResponse = await fetch(`${server.baseUrl}/admin-api/system-disclosure-policy/config`, {
+      method: 'PUT',
+      headers: {
+        'content-type': 'application/json',
+        cookie: 'h5_user_session=token-admin',
+      },
+      body: JSON.stringify({ config: { ...config, mode: 'enforce' } }),
+    });
+    assert.equal(updateResponse.status, 200);
+    assert.equal((await updateResponse.json()).policyVersion, 3);
+    assert.deepEqual(updates, [{
+      patch: { ...config, mode: 'enforce' },
+      context: { updatedBy: 'admin-1' },
+    }]);
+
+    const runtimeResponse = await fetch(`${server.baseUrl}/admin-api/system-disclosure-policy/runtime`, {
+      headers: { cookie: 'h5_user_session=token-admin' },
+    });
+    assert.equal(runtimeResponse.status, 200);
+    assert.equal((await runtimeResponse.json()).refreshedAt, 123);
+  } finally {
+    await server.close();
+  }
+});
+
 test('admin MindSearch routes persist only through injected control-plane service', async () => {
   const updates = [];
   const router = createAdminApi({