fix(data): 清理旧数据并保护服务端写入

apps/web/lib/auth-user.test.ts

@@ -1,16 +1,17 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 
-import { resolveAuthUserFromMembers, toAuthUser, type AuthUser } from './auth-user';
+import { findMemberByUsernameCredentials, resolveAuthUserFromMembers, toAuthUser, type AuthUser } from './auth-user';
 import type { Member } from './members';
 
 const member: Member = {
   id: 'm-8',
   name: '超级管理员',
-  departmentId: 'dept-1',
+  username: 'admin',
+  departmentId: '',
   roleId: 'role-admin',
   phone: '13200132008',
-  email: 'admin@company.com',
+  email: '',
   password: 'Ftb@2024',
   createdAt: '2024-01-01',
 };
@@ -19,10 +20,10 @@ test('toAuthUser removes password and keeps stable member identity', () => {
   assert.deepEqual(toAuthUser(member), {
     id: 'm-8',
     name: '超级管理员',
-    departmentId: 'dept-1',
+    username: 'admin',
+    departmentId: '',
     roleId: 'role-admin',
-    phone: '13200132008',
-    email: 'admin@company.com',
+    email: '',
   });
 });
 
@@ -30,9 +31,9 @@ test('resolveAuthUserFromMembers refreshes stale display names by member id', ()
   const staleUser: AuthUser = {
     id: 'm-8',
     name: '陈十',
-    departmentId: 'dept-1',
+    username: 'chenshi',
+    departmentId: '',
     roleId: 'role-admin',
-    phone: '13200132008',
     email: 'old@company.com',
   };
 
@@ -40,18 +41,26 @@ test('resolveAuthUserFromMembers refreshes stale display names by member id', ()
 
   assert.equal(resolved?.id, 'm-8');
   assert.equal(resolved?.name, '超级管理员');
-  assert.equal(resolved?.email, 'admin@company.com');
+  assert.equal(resolved?.username, 'admin');
+  assert.equal(resolved?.email, '');
 });
 
 test('resolveAuthUserFromMembers returns null when the account no longer exists', () => {
   const staleUser: AuthUser = {
     id: 'm-9',
     name: '离职用户',
+    username: 'lizhiyonghu',
     departmentId: 'dept-2',
     roleId: 'role-dev',
-    phone: '13900139000',
     email: 'old@company.com',
   };
 
   assert.equal(resolveAuthUserFromMembers(staleUser, [member]), null);
 });
+
+test('findMemberByUsernameCredentials uses username instead of phone for login', () => {
+  const matched = findMemberByUsernameCredentials('admin', 'Ftb@2024', [member]);
+
+  assert.equal(matched?.id, 'm-8');
+  assert.equal(findMemberByUsernameCredentials('13200132008', 'Ftb@2024', [member]), null);
+});