From f1d61f337aa3e9b55a8b128867f1b5d9044ad294 Mon Sep 17 00:00:00 2001
From: wecom-project <hermes-ci@sxbh.ltd>
Date: Tue, 15 Sep 2026 16:52:15 +0800
Subject: [PATCH] =?UTF-8?q?ci(deploy):=20=E9=89=B4=E6=9D=83=E9=9D=A2?=
 =?UTF-8?q?=E5=AE=A1=E8=AE=A1=E6=8E=A5=E5=85=A5=E9=83=A8=E7=BD=B2=E9=97=B8?=
 =?UTF-8?q?=E9=97=A8=20=E2=80=94=20B=E7=B1=BB=E7=BC=BA=E5=8F=A3=E5=AD=98?=
 =?UTF-8?q?=E5=9C=A8=E5=8D=B3=E4=B8=AD=E6=AD=A2=E9=83=A8=E7=BD=B2=20(t1-cm?=
 =?UTF-8?q?a-audit-gate-deployhook-20260915)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/deploy.sh b/deploy.sh
index 9ebe4f05..b43d68e0 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -25,6 +25,17 @@ echo "[1/5] 拉取最新代码..."
 git pull origin main
 echo "    ✓ 代码已更新"
 
+# 1b. 鉴权面审计闸门（T1, 2026-09-15）：B 类缺口(用户端点无鉴权)存在即中止部署
+echo "[1b/5] 鉴权面审计闸门..."
+cd "$SCRIPT_DIR/backend"
+if ! ./venv/bin/python3 scripts/audit_api_auth_surface.py > /tmp/cma-auth-audit.log 2>&1; then
+  echo "❌ 鉴权面审计发现 B 类缺口（用户端点缺鉴权），中止部署。详见 /tmp/cma-auth-audit.log"
+  tail -20 /tmp/cma-auth-audit.log
+  exit 1
+fi
+cd "$SCRIPT_DIR"
+echo "    ✓ 鉴权面审计通过（无 B 类缺口）"
+
 # 2. 构建前端
 echo "[2/5] 构建前端..."
 cd "$SCRIPT_DIR/frontend"