fix(backend): harden write registrar boundaries

backend/internal/logic/projects/write_handlers_test.go

@@ -3,12 +3,14 @@ package projects
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/gin-gonic/gin"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
 	"senlinai-agent/backend/internal/config"
 	"senlinai-agent/backend/internal/httpx"
 	"senlinai-agent/backend/internal/models"
@@ -62,6 +64,75 @@ func TestTagRegistrarRejectsProjectOwnedByAnotherUser(t *testing.T) {
 	router.ServeHTTP(rec, req)
 
 	require.Equal(t, http.StatusNotFound, rec.Code, rec.Body.String())
+	var payload httpx.ErrorEnvelope
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &payload))
+	require.Equal(t, "not_found", payload.Error.Code)
+	require.Equal(t, "项目不存在", payload.Error.Message)
+}
+
+func TestTagAndCronServicesReturnTypedValidationErrors(t *testing.T) {
+	database := newTestDB(t)
+	require.NoError(t, database.Create(&models.SenlinAgentUser{Email: "owner@example.com", DisplayName: "Owner", PasswordHash: "hash"}).Error)
+	project := models.SenlinAgentProject{OwnerID: 1, Name: "Alpha", Identifier: "ALPHA"}
+	require.NoError(t, database.Create(&project).Error)
+	service := NewService()
+
+	_, err := service.CreateProjectTag(1, project.ID, " ")
+	require.ErrorIs(t, err, ErrTagNameRequired)
+	_, err = service.CreateCronPlan(1, project.ID, CreateCronPlanInput{Title: " ", Schedule: "0 9 * * *"})
+	require.ErrorIs(t, err, ErrCronTitleRequired)
+	_, err = service.CreateCronPlan(1, project.ID, CreateCronPlanInput{Title: "Daily", Schedule: " "})
+	require.ErrorIs(t, err, ErrCronScheduleRequired)
+}
+
+func TestTagRegistrarMapsDatabaseFailureToInternalError(t *testing.T) {
+	database := newTestDB(t)
+	require.NoError(t, database.Create(&models.SenlinAgentUser{Email: "owner@example.com", DisplayName: "Owner", PasswordHash: "hash"}).Error)
+	project := models.SenlinAgentProject{OwnerID: 1, Name: "Alpha", Identifier: "ALPHA"}
+	require.NoError(t, database.Create(&project).Error)
+	require.NoError(t, database.Callback().Create().Before("gorm:create").Register("test:fail_tag_create", func(tx *gorm.DB) {
+		if tx.Statement.Schema != nil && tx.Statement.Schema.Table == (models.SenlinAgentTag{}).TableName() {
+			tx.AddError(errors.New("forced tag create failure"))
+		}
+	}))
+	router := newProjectWriteHandlerRouter(t, 1, NewTagHandler(NewService()))
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/projects/"+project.Identity+"/tags", bytes.NewBufferString(`{"name":"设计"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer test-token")
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusInternalServerError, rec.Code, rec.Body.String())
+	var payload httpx.ErrorEnvelope
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &payload))
+	require.Equal(t, "internal_error", payload.Error.Code)
+	require.Equal(t, "标签创建失败", payload.Error.Message)
+}
+
+func TestCronRegistrarMapsDatabaseFailureToInternalError(t *testing.T) {
+	database := newTestDB(t)
+	require.NoError(t, database.Create(&models.SenlinAgentUser{Email: "owner@example.com", DisplayName: "Owner", PasswordHash: "hash"}).Error)
+	project := models.SenlinAgentProject{OwnerID: 1, Name: "Alpha", Identifier: "ALPHA"}
+	require.NoError(t, database.Create(&project).Error)
+	require.NoError(t, database.Callback().Create().Before("gorm:create").Register("test:fail_cron_create", func(tx *gorm.DB) {
+		if tx.Statement.Schema != nil && tx.Statement.Schema.Table == (models.SenlinAgentCronPlan{}).TableName() {
+			tx.AddError(errors.New("forced cron create failure"))
+		}
+	}))
+	router := newProjectWriteHandlerRouter(t, 1, NewCronHandler(NewService()))
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/projects/"+project.Identity+"/cron-plans", bytes.NewBufferString(`{"title":"每日整理","schedule":"0 9 * * *"}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer test-token")
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusInternalServerError, rec.Code, rec.Body.String())
+	var payload httpx.ErrorEnvelope
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &payload))
+	require.Equal(t, "internal_error", payload.Error.Code)
+	require.Equal(t, "计划任务创建失败", payload.Error.Message)
 }
 
 func TestCronRegistrarCreatesCamelCaseIdentityDTO(t *testing.T) {