fix(backend): harden final MVP invariants

backend/internal/logic/projects/service_test.go

@@ -3,6 +3,9 @@ package projects
 import (
 	"errors"
 	"fmt"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -11,6 +14,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gorm.io/driver/postgres"
 	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
 	"senlinai-agent/backend/internal/models"
 )
 
@@ -106,36 +110,6 @@ func TestCreateProjectPersistsWorkspaceMetadata(t *testing.T) {
 	require.Equal(t, "RSS 采集和线索沉淀", workspace.Project.Description)
 }
 
-func TestDashboardCountsOnlyRequestedProject(t *testing.T) {
-	database := newTestDB(t)
-	service := NewService()
-	first, err := service.CreateProject(1, "Alpha", "")
-	require.NoError(t, err)
-	second, err := service.CreateProject(1, "Beta", "")
-	require.NoError(t, err)
-	require.NoError(t, database.Create(&models.SenlinAgentInboxItem{ProjectID: first.ID, CreatedBy: 1, SourceType: "text", Status: "open"}).Error)
-	require.NoError(t, database.Create(&models.SenlinAgentInboxItem{ProjectID: second.ID, CreatedBy: 1, SourceType: "text", Status: "open"}).Error)
-	require.NoError(t, database.Create(&models.SenlinAgentTask{ProjectID: first.ID, CreatedBy: 1, Title: "A", Status: "open"}).Error)
-	require.NoError(t, database.Create(&models.SenlinAgentTask{ProjectID: second.ID, CreatedBy: 1, Title: "B", Status: "open"}).Error)
-
-	dashboard, err := service.Dashboard(1, first.ID)
-
-	require.NoError(t, err)
-	require.Equal(t, int64(1), dashboard.PendingInboxCount)
-	require.Equal(t, int64(1), dashboard.OpenTaskCount)
-}
-
-func TestDashboardRejectsProjectOwnedByAnotherUser(t *testing.T) {
-	newTestDB(t)
-	service := NewService()
-	project, err := service.CreateProject(2, "Beta", "")
-	require.NoError(t, err)
-
-	_, err = service.Dashboard(1, project.ID)
-
-	require.Error(t, err)
-}
-
 func TestWorkspaceMatchesFrontendContract(t *testing.T) {
 	database := newTestDB(t)
 	service := NewService()
@@ -230,6 +204,64 @@ func TestCreateProjectTagRejectsProjectOwnedByAnotherUser(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestCreateProjectTagConcurrentlyReturnsOneProjectScopedTag(t *testing.T) {
+	databasePath := filepath.ToSlash(filepath.Join(t.TempDir(), "tags.db"))
+	database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL)", databasePath)), &gorm.Config{TranslateError: true, Logger: logger.Default.LogMode(logger.Silent)})
+	require.NoError(t, err)
+	sqlDB, err := database.DB()
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, sqlDB.Close()) })
+	require.NoError(t, models.AutoMigrate(database))
+	models.DBService = database
+	service := NewService()
+	project, err := service.CreateProjectWithInput(1, CreateProjectRequest{Name: "Concurrent", Identifier: "CONCURRENT"})
+	require.NoError(t, err)
+
+	arrived := make(chan struct{}, 2)
+	release := make(chan struct{})
+	var synchronizedQueries atomic.Int32
+	require.NoError(t, database.Callback().Create().Before("gorm:create").Register("test:synchronize_tag_inserts", func(tx *gorm.DB) {
+		if tx.Statement.Schema == nil || tx.Statement.Schema.Table != (models.SenlinAgentTag{}).TableName() {
+			return
+		}
+		if synchronizedQueries.Add(1) <= 2 {
+			arrived <- struct{}{}
+			<-release
+		}
+	}))
+
+	type result struct {
+		tag *models.SenlinAgentTag
+		err error
+	}
+	results := make(chan result, 2)
+	var workers sync.WaitGroup
+	workers.Add(2)
+	for range 2 {
+		go func() {
+			defer workers.Done()
+			tag, err := service.CreateProjectTag(1, project.ID, "UI")
+			results <- result{tag: tag, err: err}
+		}()
+	}
+	<-arrived
+	<-arrived
+	close(release)
+	workers.Wait()
+	close(results)
+
+	identities := map[string]struct{}{}
+	for value := range results {
+		require.NoError(t, value.err)
+		require.NotNil(t, value.tag)
+		identities[value.tag.Identity] = struct{}{}
+	}
+	require.Len(t, identities, 1)
+	var count int64
+	require.NoError(t, database.Model(&models.SenlinAgentTag{}).Where("project_id = ? AND name = ?", project.ID, "UI").Count(&count).Error)
+	require.Equal(t, int64(1), count)
+}
+
 func TestCreateCronPlanAddsPlanToOwnedProject(t *testing.T) {
 	database := newTestDB(t)
 	service := NewService()
@@ -252,6 +284,7 @@ func TestCreateCronPlanAddsPlanToOwnedProject(t *testing.T) {
 	require.Equal(t, "0 9 * * *", plan.Schedule)
 	require.True(t, plan.Enabled)
 	require.NotNil(t, plan.NextRunAt)
+	require.Empty(t, plan.LastResult, "创建计划只保存元数据，不能伪造执行结果")
 	workspace, err := service.Workspace(1, project.Identity)
 	require.NoError(t, err)
 	require.Len(t, workspace.CronPlans, 1)