fix: CSP blocking inline onclick - use addEventListener instead; fix cloudLogin/Register return types

Author: zcj220

_check_db.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+cd /opt/testpilot/app
+source venv/bin/activate
+python3 -c "
+from src.auth.database import engine
+from sqlalchemy import text
+with engine.connect() as conn:
+    r = conn.execute(text('SHOW TABLES'))
+    tables = [row[0] for row in r]
+    print('Tables:', tables)
+    print('Count:', len(tables))
+"

_db_check2.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+import sys, os
+sys.path.insert(0, '/opt/testpilot/app')
+os.chdir('/opt/testpilot/app')
+from src.auth.database import engine
+from sqlalchemy import text, inspect
+
+with engine.connect() as conn:
+    r = conn.execute(text('SHOW TABLES'))
+    tables = sorted([row[0] for row in r])
+    print('=== 数据库中的表 (%d个) ===' % len(tables))
+    for t in tables:
+        print(' ', t)
+
+print()
+print('=== 检查关键表是否存在 ===')
+required = ['users','api_keys','credit_transactions','shared_experiences',
+            'experience_votes','user_badges','user_profiles','teams','team_members',
+            'projects','debug_snapshots','usage_records',
+            'login_attempts','refresh_tokens','email_verifications']
+insp = inspect(engine)
+existing = insp.get_table_names()
+for t in required:
+    status = '✅' if t in existing else '❌ 缺失!'
+    print(f'  {status} {t}')

_test_auth.py

@@ -0,0 +1,56 @@
+"""临时测试脚本：验证注册/登录/JWT 在 MySQL RDS 上工作正常"""
+import traceback
+import sys
+
+try:
+    from dotenv import load_dotenv
+    load_dotenv()
+    print("1. dotenv loaded")
+
+    from src.auth.database import get_db
+    print("2. database imported")
+
+    from src.auth.service import register_user, authenticate_user, create_access_token
+    print("3. service imported")
+
+    db = next(get_db())
+    print("4. db session OK")
+
+    # 注册（已存在则跳过）
+    try:
+        user = register_user(db, "test@testpilot.com", "testuser", "Test123456")
+        print(f"5. 注册成功: id={user.id}, username={user.username}, role={user.role}")
+    except ValueError as e:
+        print(f"5. 注册跳过（已存在）: {e}")
+
+    # 用户名登录
+    u = authenticate_user(db, "testuser", "Test123456")
+    status = "成功" if u else "失败"
+    print(f"6. 用户名登录: {status}")
+
+    # 邮箱登录
+    u2 = authenticate_user(db, "test@testpilot.com", "Test123456")
+    status2 = "成功" if u2 else "失败"
+    print(f"7. 邮箱登录: {status2}")
+
+    # 错误密码
+    u3 = authenticate_user(db, "testuser", "wrongpass")
+    status3 = "正确拒绝" if not u3 else "未拒绝!"
+    print(f"8. 错误密码: {status3}")
+
+    # JWT
+    if u:
+        token = create_access_token(u.id, u.username, u.role)
+        print(f"9. JWT: {token[:60]}...")
+
+    # MySQL 持久化验证
+    from sqlalchemy import text
+    row = db.execute(text("SELECT id, email, username, role FROM users WHERE username='testuser'")).fetchone()
+    print(f"10. MySQL 持久化: {row}")
+
+    db.close()
+    print("\nALL PASSED!")
+
+except Exception:
+    traceback.print_exc()
+    sys.exit(1)

deploy_package.zip

@@ -15,10 +15,10 @@ esbuild.build({
 }).then(() => {
   // 自动同步到所有已安装的 IDE 扩展目录（开发便利）
   const home = process.env.USERPROFILE || "";
-  const extName = "testpilot-ai.testpilot-ai-1.3.0";
+  const extName = "wenzhouxinzao.testpilot-ai-1.3.0";
   const ideDirs = [
     path.join(home, ".vscode", "extensions", extName),
-    path.join(home, ".trae", "extensions", extName),
+    path.join(home, ".trae-cn", "extensions", extName),
     path.join(home, ".cursor", "extensions", extName),
     path.join(home, ".windsurf", "extensions", extName),
     path.join(home, ".vscodium", "extensions", extName),

extension/esbuild.js

@@ -446,8 +446,9 @@ export class EngineClient {
   /** 云端登录 */
   async cloudLogin(emailOrUsername: string, password: string): Promise<{
     access_token: string;
+    refresh_token?: string;
     token_type: string;
-    user: { id: number; email: string; username: string; role: string };
+    user: { id: number; email: string; username: string; role: string; plan?: string; credits?: number };
   }> {
     return this._cloudPost("/auth/login", {
       email_or_username: emailOrUsername,
@@ -458,8 +459,9 @@ export class EngineClient {
   /** 云端注册 */
   async cloudRegister(email: string, username: string, password: string): Promise<{
     access_token: string;
+    refresh_token?: string;
     token_type: string;
-    user: { id: number; email: string; username: string; role: string };
+    user: { id: number; email: string; username: string; role: string; plan?: string; credits?: number };
   }> {
     return this._cloudPost("/auth/register", { email, username, password });
   }

extension/src/engineClient.ts

@@ -1679,7 +1679,7 @@ ${commonRules}`;
           <div class="sdrop-section">个性化设置</div>
           <div class="sdrop-item" id="settingsThemeRow">
             <span>🌓 界面主题</span>
-            <label class="toggle-switch" onclick="event.stopPropagation()">
+            <label class="toggle-switch" id="themeToggleLabel">
               <input type="checkbox" id="themeToggle" />
               <span class="toggle-slider"></span>
             </label>
@@ -1695,24 +1695,24 @@ ${commonRules}`;
             <span class="badge-soon">即将推出</span>
           </div>
           <div class="sdrop-divider"></div>
-          <div class="sdrop-item" id="settingsAuthRow" onclick="toggleSettingsAuth()">
+          <div class="sdrop-item" id="settingsAuthRow">
             <span id="settingsAuthLabel">🔑 账户登录</span>
             <span id="settingsAuthArrow" style="font-size:10px;color:var(--muted)">▾</span>
           </div>
           <div id="settingsAuthPanel" class="sdrop-auth-panel">
             <div id="authError" class="auth-error"></div>
             <input id="authUser" type="text" placeholder="用户名或邮箱" autocomplete="username" />
-            <input id="authPass" type="password" placeholder="密码" autocomplete="current-password" onkeydown="if(event.key==='Enter')doAuth()" />
+            <input id="authPass" type="password" placeholder="密码" autocomplete="current-password" />
             <div style="display:flex;gap:6px;margin-top:4px">
-              <button class="sdrop-login-btn" onclick="doAuth()">登录</button>
-              <button class="sdrop-register-btn" onclick="openRegister()">前往注册 ↗</button>
+              <button class="sdrop-login-btn" id="authLoginBtn">登录</button>
+              <button class="sdrop-register-btn" id="authRegisterBtn">前往注册 ↗</button>
             </div>
           </div>
           <div id="settingsUserRow" class="sdrop-user-row" style="display:none">
             <div style="display:flex;align-items:center;justify-content:space-between">
               <span style="color:var(--success);font-weight:600">👤 <span id="authUsername"></span>
                 <span style="color:var(--muted)" id="authPlan"></span></span>
-              <button onclick="doLogout()" style="background:none;border:none;color:var(--muted);cursor:pointer;font-size:11px;text-decoration:underline">退出</button>
+              <button id="authLogoutBtn" style="background:none;border:none;color:var(--muted);cursor:pointer;font-size:11px;text-decoration:underline">退出</button>
             </div>
             <div id="authCredits" style="font-size:11px;color:var(--muted);margin-top:2px"></div>
           </div>
@@ -1956,6 +1956,19 @@ ${commonRules}`;
       vscode.postMessage({ command: 'logout' });
     }
 
+    // ── 认证相关事件绑定（CSP 禁止内联 onclick，必须用 addEventListener） ──
+    const settingsAuthRow = document.getElementById('settingsAuthRow');
+    if (settingsAuthRow) settingsAuthRow.addEventListener('click', toggleSettingsAuth);
+    if (authPass) authPass.addEventListener('keydown', (e) => { if (e.key === 'Enter') doAuth(); });
+    const authLoginBtn = document.getElementById('authLoginBtn');
+    if (authLoginBtn) authLoginBtn.addEventListener('click', doAuth);
+    const authRegisterBtn = document.getElementById('authRegisterBtn');
+    if (authRegisterBtn) authRegisterBtn.addEventListener('click', openRegister);
+    const authLogoutBtn = document.getElementById('authLogoutBtn');
+    if (authLogoutBtn) authLogoutBtn.addEventListener('click', doLogout);
+    const themeToggleLabel = document.getElementById('themeToggleLabel');
+    if (themeToggleLabel) themeToggleLabel.addEventListener('click', (e) => e.stopPropagation());
+
     function setAuthState(loggedIn, user) {
       const authPanel = document.getElementById('settingsAuthPanel');
       const userRow = document.getElementById('settingsUserRow');

extension/src/sidebarProvider.ts

@@ -35,6 +35,8 @@
 - **注册改为跳官网**：点击「前往注册」→ `openExternal` 打开 `https://testpilotai.pages.dev/register`，不再内嵌注册表单
 - **修复引擎未连接日志反复打印**：`extension.ts` 新增 `retainContextWhenHidden: true`，防止 WebView 被销毁/重建导致 `hasLoggedDisconnected` 变量重置
 - **修复 TRAE 显示旧版**：TRAE 扩展目录中存在两个版本（`testpilot-ai.testpilot-ai-1.2.9` 旧 publisher + `wenzhouxinzao.testpilot-ai-1.3.0`），将旧版目录 rename 为 `.bak`，安装新版
+- **修复 VS Code 双插件问题（2026-03-25）**：VS Code 扩展目录同时存在三个版本（`testpilot-ai.testpilot-ai-1.2.0`、`testpilot-ai.testpilot-ai-1.2.9` 旧 publisher + `wenzhouxinzao.testpilot-ai-1.3.0` 新 publisher），直接 `Remove-Item -Recurse -Force` 删除两个旧版目录，只保留新版。**根本原因：publisher 从 `testpilot-ai` 改成 `wenzhouxinzao` 后，VS Code 将其视为两个完全不同的插件。代码无需改动，只需删除旧目录。**
+- **修复账户登录点击无反应（2026-03-25）**：CSP 策略（`script-src 'nonce-xxx'`）阻止了所有内联 `onclick="..."` / `onkeydown="..."` 属性调用，导致设置菜单里的「账户登录」行及登录按钮/注册按钮/退出按钮/密码框回车键全部失效。修复：删除6处内联事件属性，给各元素加 id，在 nonce 脚本块里统一用 `addEventListener` 绑定。同步修复 `cloudLogin/cloudRegister` 返回类型缺少 `refresh_token?/plan?/credits?` 字段的 TypeScript 错误。
 - **服务器 alembic 分支冲突修复**：`stamp f03fbc681fc5` 跳过重复建表，再 `upgrade 3f8a9b2c1d47` 建 3 个安全表（login_attempts/refresh_tokens/email_verifications）
 
 ---
@@ -87,6 +89,23 @@ npx @vscode/vsce package --no-yarn
   --install-extension testpilot-ai-1.3.0.vsix --force
 ```
 
+**⚠️ 双Publisher问题说明（必读）：**
+> 历史上 publisher 从 `testpilot-ai` 改为 `wenzhouxinzao`，导致 VS Code / TRAE / Windsurf 将新旧版本视为**两个完全不同的插件**，搜索和安装时会出现两个。
+> 当前正确 publisher：**`wenzhouxinzao`**，旧 publisher `testpilot-ai` 的目录均需删除。
+
+**VS Code 清理旧版（⚠️ 重要）：**
+- VS Code 扩展目录（Windows）：`%USERPROFILE%\.vscode\extensions\`
+- 若存在旧版目录（`testpilot-ai.testpilot-ai-*`），需删除：
+  ```powershell
+  cd "$env:USERPROFILE\.vscode\extensions"
+  # 查看当前 testpilot 相关目录
+  Get-ChildItem | Where-Object { $_.Name -like "*testpilot*" }
+  # 删除所有旧 publisher 版本（保留 wenzhouxinzao.* 开头的）
+  Remove-Item -Recurse -Force testpilot-ai.testpilot-ai-1.2.0
+  Remove-Item -Recurse -Force testpilot-ai.testpilot-ai-1.2.9
+  ```
+- 删除后重启 VS Code 即可，无需重新安装新版
+
 **TRAE 注意事项（⚠️ 重要）：**
 - TRAE 扩展目录（Windows）：`C:\Users\%USERNAME%\.trae-cn\extensions\`
 - 目录名格式：`{publisher}.{extensionName}-{version}`，publisher 不同 = 完全不同的插件