提供独立路径的国内PDA测试H5部署

.dockerignore

@@ -0,0 +1,10 @@
+# Only compiled H5 assets and image configuration enter the build context.
+**
+!deploy/
+!deploy/Dockerfile.h5
+!deploy/nginx.conf
+!unpackage/
+!unpackage/dist/
+!unpackage/dist/build/
+!unpackage/dist/build/web/
+!unpackage/dist/build/web/**

README.md

@@ -106,3 +106,19 @@ Android App 启动后会读取 `VITE_PDA_UPDATE_URL` 并检查国内 PDA 的独
 2. wgt 发布至少递增 `versionName`，并使用与已安装原生包兼容的 uni-app 编译器生成；新增原生模块、权限或不兼容运行时能力时必须发布 APK，不能只发 wgt。
 3. 更新清单与下载地址使用 HTTPS，先在测试设备验证可选更新、强制更新、断网重试、APK 覆盖安装、wgt 重启及扫码作业回归，再切换正式清单。
 4. 国内和海外更新记录、文件目录及发布权限保持隔离，服务端必须按请求中的 `appid` 拒绝跨应用更新包。
+
+## TEST H5 静态托管
+
+发布构建使用 `/pda-domestic/` 资源 base 与 hash 路由；开发服务仍使用根路径。浏览器入口为 `/pda-domestic/#/`，不能将 Vite 开发代理当作静态服务器配置。
+
+国内使用本机已安装 HBuilderX：`cli.exe project open --path <本仓库绝对路径>` 后执行 `cli.exe publish web --project <本仓库绝对路径> --webHosting false --sourceMap false`，仅导出本地 Web 静态文件；本次验证编译器 5.26，不上传云托管。
+
+`deploy/Dockerfile.h5` 只复制已构建 `unpackage/dist/build/web/` 及静态 Nginx 配置，不在镜像中复制源码、依赖或重新编译。`.dockerignore` 只放行这两类输入。容器静态目录为 `/srv/pda-h5/pda-domestic/`。
+
+从本仓库执行 `docker compose -f deploy/docker-compose.h5.test.yml build --pull=false`，再由获授权的部署流程执行 `docker compose -f deploy/docker-compose.h5.test.yml up -d --wait --wait-timeout 120`。必须设置 `IMAGE_TAG`，`NGINX_BASE_IMAGE` 可指定已缓存的兼容 Alpine Nginx 镜像。容器名及网络别名为 `pda-domestic-h5-test`，仅在外部 `firstleg-test-network` 暴露容器 80，不发布宿主端口。健康检查同时请求 `/healthz` 与 `/pda-domestic/` 的实际首页。
+
+Admin Nginx 将 `/pda-domestic/` 原样代理至 `http://pda-domestic-h5-test:80`，不去掉路径前缀；无尾斜杠入口重定向为 `/pda-domestic/`。PDA 容器只提供本应用静态目录，其他路径返回 404，缺失资源不回退首页，HTML 使用 `Cache-Control: no-store`。API 全部由 Admin 入口代理：国内 `/gateway-api/` 转统一 Gateway `/api/`，海外同源 `/api/` 保持路径。入口须保留 Authorization，支持文件上传下载及至少 11m 请求体。环境域名与上游只在部署侧配置，不修改宿主 Nginx 权限，也不编入 PDA 源码。
+
+部署配置检查：`node --test tests/h5-deployment.test.mjs`。没有 Docker 运行时的本地合同检查不能替代目标主机 `docker compose config`、Nginx 启动与真实 HTTP 验收。
+
+构建后执行 `node scripts/verify-h5.mjs`，核对 HTML/JS/CSS 资源路径、同源 API 和无本机/旧海外配置泄漏。该检查与本地构建仅证明产物；TEST 页面登录、仓权限、业务操作和 Android 真机另行验收。

config/runtime.js

@@ -1,5 +1,7 @@
-const configuredApiRoot = import.meta.env.VITE_API_BASE_URL || ''
+let selectedApiRoot = ''
-let selectedApiRoot = configuredApiRoot || '/api'
+// #ifndef H5
+selectedApiRoot = import.meta.env.VITE_API_BASE_URL || '/api'
+// #endif
 
 // H5 必须请求同源地址，由 Vite 开发服务器代理到国内 Gateway，避免浏览器 CORS。
 // 前缀不能使用 /api，否则会截获本项目 api/ 目录下的前端模块请求。

deploy/Dockerfile.h5

@@ -0,0 +1,5 @@
+ARG NGINX_BASE_IMAGE=nginx:1.27-alpine
+FROM ${NGINX_BASE_IMAGE}
+COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY unpackage/dist/build/web/ /srv/pda-h5/pda-domestic/
+EXPOSE 80

deploy/docker-compose.h5.test.yml

@@ -0,0 +1,27 @@
+name: firstleg-test-pda-domestic-h5
+services:
+  pda-domestic-h5:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.h5
+      args:
+        NGINX_BASE_IMAGE: "${NGINX_BASE_IMAGE:-nginx:1.27-alpine}"
+    image: pda-domestic-h5-test:${IMAGE_TAG:?IMAGE_TAG is required}
+    container_name: pda-domestic-h5-test
+    restart: unless-stopped
+    expose:
+      - "80"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1/healthz && wget -qO /dev/null http://127.0.0.1/pda-domestic/"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 5s
+    networks:
+      test-backend:
+        aliases:
+          - pda-domestic-h5-test
+networks:
+  test-backend:
+    external: true
+    name: firstleg-test-network

deploy/nginx.conf

@@ -0,0 +1,18 @@
+server {
+    listen 80;
+    server_name _;
+    root /srv/pda-h5;
+
+    location = /healthz {
+        default_type text/plain;
+        add_header Cache-Control "no-store" always;
+        return 200 "ok\n";
+    }
+    location = /pda-domestic { return 302 /pda-domestic/; }
+    location ^~ /pda-domestic/ {
+        index index.html;
+        try_files $uri $uri/ =404;
+        add_header Cache-Control "no-store" always;
+    }
+    location / { return 404; }
+}

manifest.json

@@ -91,6 +91,9 @@
     },
     "vueVersion" : "3",
     "h5" : {
+        "router" : {
+            "mode" : "hash"
+        },
         "devServer" : {
             "port" : 5175
         }

scripts/verify-h5.mjs

@@ -0,0 +1,32 @@
+import assert from 'node:assert/strict'
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs'
+import { resolve, dirname, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createHash } from 'node:crypto'
+const project = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const output = resolve(project, 'unpackage/dist/build/web')
+const base = '/pda-domestic/'
+function walk(dir) { return readdirSync(dir).flatMap(name => { const path = resolve(dir, name); return statSync(path).isDirectory() ? walk(path) : [path] }) }
+assert.ok(existsSync(resolve(output, 'index.html')), 'Build H5 before verifying')
+const files = walk(output).sort()
+const html = readFileSync(resolve(output, 'index.html'), 'utf8')
+const refs = [...html.matchAll(/(?:src|href)="([^"]+)"/g)].map(match => match[1])
+assert.ok(refs.length >= 2, 'HTML must reference compiled assets')
+for (const ref of refs) {
+  assert.ok(ref.startsWith(base), `Asset must remain under ${base}: ${ref}`)
+  assert.ok(existsSync(resolve(output, ref.slice(base.length))), `Missing asset: ${ref}`)
+}
+const js = files.filter(path => path.endsWith('.js')).map(path => readFileSync(path, 'utf8')).join('\n')
+assert.ok(js.includes(base), 'Runtime router and assets must know the deployment base')
+assert.doesNotMatch(js, /VITE_ROOT_DIR|VITE_AUTH_API_BASE_URL|VITE_OVERSEAS_API_BASE_URL|overseas-api|overseasAccessToken/, 'Build contains broad local env or old overseas config')
+assert.doesNotMatch(js, /https?:\/\/(?:localhost|127\.0\.0\.1):\d+/, 'Build must not depend on a local dev server')
+assert.doesNotMatch(js, /https?:\/\/[^"'\s]+\/api["']/, 'API must be same-origin for this H5 deployment')
+for (const path of files.filter(path => /\.(?:js|css)$/.test(path))) {
+  const source = readFileSync(path, 'utf8')
+  for (const match of source.matchAll(/(?:from\s*|import\s*\(\s*)["'](\.[^"']+\.(?:js|css))["']/g)) {
+    assert.ok(existsSync(resolve(dirname(path), match[1])), `Missing chunk ${match[1]}`)
+  }
+}
+const digest = createHash('sha256')
+for (const path of files) { digest.update(relative(output,path).replaceAll('\\','/')); digest.update('\0'); digest.update(readFileSync(path)) }
+console.log(JSON.stringify({output, base, files: files.length, bytes: files.reduce((sum,path)=>sum+statSync(path).size,0), sha256: digest.digest('hex')}, null, 2))

tests/h5-deployment.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test'
+import { runInNewContext } from 'node:vm'
+import assert from 'node:assert/strict'
+import { readFile } from 'node:fs/promises'
+const read = path => readFile(new URL(path, import.meta.url), 'utf8')
+test('H5 image copies only compiled assets and static nginx configuration', async () => {
+  const dockerfile = await read('../deploy/Dockerfile.h5')
+  const copies = dockerfile.split(/\r?\n/).filter(line => line.startsWith('COPY '))
+  assert.deepEqual(copies, ['COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf', 'COPY unpackage/dist/build/web/ /srv/pda-h5/pda-domestic/'])
+  assert.match(dockerfile, /ARG NGINX_BASE_IMAGE=/)
+  assert.match(dockerfile, /FROM \$\{NGINX_BASE_IMAGE\}/)
+  assert.doesNotMatch(dockerfile, /RUN |npm|node_modules|COPY \. /)
+  const ignore = await read('../.dockerignore')
+  assert.ok(ignore.split(/\r?\n/).includes('**'))
+  assert.ok(ignore.includes('!unpackage/dist/build/web/**'))
+  assert.doesNotMatch(ignore, /!\.env|!node_modules|!src/)
+})
+test('static server preserves the app prefix and returns genuine missing-resource errors', async () => {
+  const nginx = await read('../deploy/nginx.conf')
+  assert.match(nginx, /listen 80;/)
+  assert.ok(nginx.includes('location ^~ /pda-domestic/'))
+  assert.match(nginx, /root \/srv\/pda-h5;/)
+  assert.match(nginx, /try_files \$uri \$uri\/ =404;/)
+  assert.match(nginx, /Cache-Control "no-store" always/)
+  assert.match(nginx, /location \/ \{ return 404; \}/)
+  assert.match(nginx, /location = \/healthz/)
+  assert.doesNotMatch(nginx, /proxy_pass|gateway-api|try_files[^;]*index\.html/)
+})
+test('TEST H5 deployment has a required image tag and internal-only dual health checks', async () => {
+  const compose = await read('../deploy/docker-compose.h5.test.yml')
+  assert.ok(compose.includes('${IMAGE_TAG:?IMAGE_TAG is required}'))
+  assert.match(compose, /context: \.\./)
+  assert.match(compose, /dockerfile: deploy\/Dockerfile\.h5/)
+  assert.match(compose, /container_name: pda-domestic-h5-test/)
+  assert.match(compose, /aliases:\s*\n\s*- pda-domestic-h5-test/)
+  assert.match(compose, /external: true/)
+  assert.match(compose, /name: firstleg-test-network/)
+  assert.match(compose, /expose:\s*\n\s*- "80"/)
+  assert.ok(compose.includes('http://127.0.0.1/healthz && wget -qO /dev/null http://127.0.0.1/pda-domestic/'))
+  assert.doesNotMatch(compose, /\bports:|volumes:|API_UPSTREAM|privileged:|pid: host/)
+})
+
+test('only H5 production overrides the toolchain asset base', async () => {
+  const source = (await read('../vite.config.js'))
+    .replace(/^import .*$/gm, '')
+    .replace('export default ', '')
+  for (const platform of ['h5', 'app', 'app-plus', 'app-harmony', undefined]) {
+    for (const mode of ['production', 'development']) {
+      const factory = runInNewContext(source, {
+        defineConfig: value => value,
+        loadEnv: () => ({}),
+        uni: () => ({}),
+        process: { env: { UNI_PLATFORM: platform }, cwd: () => '/project' }
+      })
+      assert.equal(factory({ mode }).base,
+        platform === 'h5' && mode === 'production' ? '/pda-domestic/' : undefined,
+        `${platform}:${mode}`)
+    }
+  }
+})

vite.config.js

@@ -26,7 +26,11 @@ export default defineConfig(({ mode }) => {
 	const proxyTarget = env.API_PROXY_TARGET || 'http://127.0.0.1:9000'
 
 	return {
+		base: process.env.UNI_PLATFORM === 'h5' && mode === 'production' ? '/pda-domestic/' : undefined,
 		plugins: [uni()],
+		define: {
+			'import.meta.env.VITE_PDA_UPDATE_URL': JSON.stringify(env.VITE_PDA_UPDATE_URL || '')
+		},
 		server: {
 			proxy: {
 				'/gateway-api': loggedProxy({