阶段性修改

yelaymaths_api/tools/legacy/transform.test.ts

@@ -88,7 +88,7 @@ describe('buildDataset（真实旧库数据）', () => {
   const ds = buildDataset(loadLegacyDump(DEFAULT_DUMP_PATH), 'https://data.example.com');
 
   it('行数与旧库一致', () => {
-    expect(ds.users).toHaveLength(284);
+    expect(ds.users).toHaveLength(189);
     expect(ds.courses).toHaveLength(10);
     expect(ds.lessons).toHaveLength(841);
     expect(ds.entitlements).toHaveLength(48);
@@ -105,6 +105,24 @@ describe('buildDataset（真实旧库数据）', () => {
     expect(ds.diagnostics.skippedLessonOrphans).toEqual([]);
     expect(ds.diagnostics.duplicateEntitlements).toEqual([]);
     expect(ds.diagnostics.unmappedHomeCourses).toEqual([]);
+    expect(ds.diagnostics.droppedEntitlements).toEqual([]);
+  });
+
+  it('过滤掉旧库混入的攻击载荷，只保留真实用户', () => {
+    // 旧接口对 openid 无校验，用户表被写入了 95 条安全扫描探针（SQL 注入、Log4Shell 等）
+    expect(ds.diagnostics.skippedUsers).toHaveLength(95);
+    expect(ds.users).toHaveLength(189);
+    for (const u of ds.users) {
+      expect(u.openid).toMatch(/^[A-Za-z0-9_-]{20,64}$/);
+    }
+  });
+
+  it('过滤不影响真实用户：购买记录一条不少且都能对应到用户', () => {
+    expect(ds.entitlements).toHaveLength(48);
+    const userIds = new Set(ds.users.map((_, i) => i + 1));
+    for (const e of ds.entitlements) {
+      expect(userIds.has(e.user_id)).toBe(true);
+    }
   });
 
   it('课程 code 是 64 位十六进制且无重复（视频路径依赖它）', () => {