fix(server): 修复腐烂的集成测试套件 + devices 注册回填 last_seen

这批 -tags integration 测试(usage/auth/codes/devices/store)因依赖冲突
长期编译不过、从未进 CI 跑过,代码静默腐烂。本次逐层修复:

- 依赖:testcontainers-go v0.34→v0.43(原 v0.34 配 docker v28.3.3 编译失败:
  archive.Compression/sockets.DialPipe undefined)。
- auth: LoginOutcome 重构成 Tokens 嵌套后,测试仍引用扁平 RefreshToken;
  users 测试 schema 缺 totp_enabled 列 → GetUserByEmail 报错 → SendCode 500。
- usage/auth/codes/devices: DSN 里 time_zone='+00:00' 作 URL query 透传时 '+'
  被解码成空格 → MySQL Error 1298 ' 00:00';改百分号编码。
- store: 测试 DSN 缺 multiStatements=true → 多语句迁移 Error 1064;
  WithConfigFile("") 在 v0.43 被拒,改写真 my.cnf 设 +08:00 真正考验 UTC 覆盖。
- devices(产品 bug):insertDeviceTx 把 last_seen 写进库却没回填返回值,
  刚注册的设备 API 响应 last_seen=null 与库不一致;TestFullChain 据此把关。

修复后完整 integration 套件 -p 1 串行全绿(25 包 + 5 testcontainers 包)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/integration_test.go

@@ -31,7 +31,7 @@ func setupMySQL(t *testing.T) *sql.DB {
 	if err != nil {
 		t.Fatalf("mysql container: %v", err)
 	}
-	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone='+00:00'")
+	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone=%27%2B00%3A00%27")
 	if err != nil {
 		t.Fatalf("mysql dsn: %v", err)
 	}
@@ -84,6 +84,7 @@ func applyAuthSchema(db *sql.DB) error {
 			pw_hash     VARCHAR(255) NOT NULL,
 			dp_uuid     CHAR(36) NOT NULL,
 			status      ENUM('active','banned') NOT NULL DEFAULT 'active',
+			totp_enabled BOOLEAN NOT NULL DEFAULT FALSE,
 			created_at  DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6)
 		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`,
 		`CREATE TABLE IF NOT EXISTS subscriptions (
@@ -180,11 +181,11 @@ func TestIntegration_FullChain(t *testing.T) {
 	}
 
 	// 5. Refresh rotates.
-	rotated, apiErr := svc.Refresh(ctx, loginPair.RefreshToken)
+	rotated, apiErr := svc.Refresh(ctx, loginPair.Tokens.RefreshToken)
 	if apiErr != nil {
 		t.Fatalf("Refresh: %v", apiErr)
 	}
-	if _, e := svc.Refresh(ctx, loginPair.RefreshToken); e == nil {
+	if _, e := svc.Refresh(ctx, loginPair.Tokens.RefreshToken); e == nil {
 		t.Fatal("old refresh token must be rejected after rotation")
 	}
 

server/internal/codes/service_test.go

@@ -43,7 +43,7 @@ func setupMySQL(t *testing.T) *sql.DB {
 		t.Fatalf("mysql container: %v", err)
 	}
 
-	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone='+00:00'")
+	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone=%27%2B00%3A00%27")
 	if err != nil {
 		t.Fatalf("mysql dsn: %v", err)
 	}

server/internal/devices/devices_integration_test.go

@@ -38,7 +38,9 @@ func setupMySQL(t *testing.T) *sql.DB {
 		t.Fatalf("mysql container: %v", err)
 	}
 
-	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone='+00:00'")
+	// time_zone 必须百分号编码:作为 URL query 透传时 '+' 会被解码成空格,
+	// MySQL 收到 " 00:00" → Error 1298。%27=' %2B=+ %3A=:
+	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone=%27%2B00%3A00%27")
 	if err != nil {
 		t.Fatalf("mysql dsn: %v", err)
 	}

server/internal/devices/store.go

@@ -122,7 +122,13 @@ func (s *Store) insertDeviceTx(ctx context.Context, tx *sql.Tx, uuid string, use
 		return nil, fmt.Errorf("store.insertDeviceTx: %w", err)
 	}
 	id, _ := res.LastInsertId()
-	return &DeviceRow{ID: id, UUID: uuid, UserID: userID, Name: name, Platform: platform}, nil
+	// 回填 last_seen/created_at:库里已写入 now,返回值也要带上,否则刚注册的
+	// 设备 API 响应 last_seen=null 与库不一致(集成测试 TestFullChain 据此把关)。
+	return &DeviceRow{
+		ID: id, UUID: uuid, UserID: userID, Name: name, Platform: platform,
+		LastSeen:  sql.NullTime{Time: now, Valid: true},
+		CreatedAt: now,
+	}, nil
 }
 
 // touchLastSeenTx updates a device's last_seen to now inside tx.

server/internal/store/mysql_integration_test.go

@@ -4,6 +4,8 @@ package store_test
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"testing"
 
 	mysqlmodule "github.com/testcontainers/testcontainers-go/modules/mysql"
@@ -38,7 +40,7 @@ func TestIntegration_TimeZoneAssertionAndMigrateUp(t *testing.T) {
 	})
 
 	// ConnectionString returns e.g. root:secret@tcp(localhost:PORT)/pangolin
-	dsn, err := ctr.ConnectionString(ctx)
+	dsn, err := ctr.ConnectionString(ctx, "multiStatements=true")
 	if err != nil {
 		t.Fatalf("connection string: %v", err)
 	}
@@ -92,20 +94,26 @@ func TestIntegration_TimeZoneAssertionAndMigrateUp(t *testing.T) {
 func TestIntegration_NonUTCContainerStillPasses(t *testing.T) {
 	ctx := context.Background()
 
+	// Deliberately start MySQL with a non-UTC global timezone (+08:00) via a
+	// my.cnf, so this test genuinely exercises store.Open's session-level UTC
+	// override + assertion. (offset zone needs no tz tables loaded.)
+	cnf := filepath.Join(t.TempDir(), "tz.cnf")
+	if err := os.WriteFile(cnf, []byte("[mysqld]\ndefault-time-zone='+08:00'\n"), 0o644); err != nil {
+		t.Fatalf("write my.cnf: %v", err)
+	}
 	ctr, err := mysqlmodule.Run(ctx,
 		"mysql:8",
 		mysqlmodule.WithDatabase("pangolin"),
 		mysqlmodule.WithUsername("root"),
 		mysqlmodule.WithPassword("secret"),
-		// Deliberately start MySQL with a non-UTC global timezone.
-		mysqlmodule.WithConfigFile(""),
+		mysqlmodule.WithConfigFile(cnf),
 	)
 	if err != nil {
 		t.Fatalf("start mysql container: %v", err)
 	}
 	t.Cleanup(func() { _ = ctr.Terminate(ctx) })
 
-	dsn, err := ctr.ConnectionString(ctx)
+	dsn, err := ctr.ConnectionString(ctx, "multiStatements=true")
 	if err != nil {
 		t.Fatalf("connection string: %v", err)
 	}

server/internal/usage/usage_integration_test.go

@@ -36,7 +36,7 @@ func setupMySQL(t *testing.T) *sql.DB {
 	if err != nil {
 		t.Fatalf("mysql container: %v", err)
 	}
-	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone='+00:00'")
+	dsn, err := ctr.ConnectionString(ctx, "parseTime=true", "loc=UTC", "time_zone=%27%2B00%3A00%27")
 	if err != nil {
 		t.Fatalf("mysql dsn: %v", err)
 	}