release: harden Android network security

mobile-uni/tests/app-packaging.test.mjs

@@ -42,6 +42,38 @@ test('Android 自定义基座显式面向 Android 15 权限模型', async () =>
 
   assert.equal(android?.packagename, 'com.yincheng.wygj');
   assert.equal(android?.targetSdkVersion, 35, '不得回退到 DCloud 默认的 targetSdkVersion 28 兼容模式');
+  assert.equal(android?.usesCleartextTraffic, false, '发布配置不得允许明文 HTTP');
+});
+
+test('Android 原生网络安全配置拒绝明文流量且只信任系统证书', async () => {
+  const androidManifest = await readFile(
+    new URL('../AndroidManifest.xml', import.meta.url),
+    'utf8'
+  );
+  const networkSecurity = await readFile(
+    new URL('../nativeResources/android/res/xml/network_security_config.xml', import.meta.url),
+    'utf8'
+  );
+
+  assert.match(androidManifest, /android:usesCleartextTraffic="false"/);
+  assert.match(androidManifest, /android:networkSecurityConfig="@xml\/network_security_config"/);
+  assert.match(networkSecurity, /cleartextTrafficPermitted="false"/);
+  assert.match(networkSecurity, /<certificates src="system" \/>/);
+  assert.doesNotMatch(networkSecurity, /cleartextTrafficPermitted="true"/);
+  assert.doesNotMatch(networkSecurity, /<certificates src="user"/);
+  assert.doesNotMatch(networkSecurity, /<debug-overrides\b/);
+});
+
+test('App 构建链将 Android 原生网络安全资源同步到云打包输入目录', async () => {
+  const pkg = await readJson('../package.json');
+  const syncScript = await readFile(
+    new URL('../scripts/sync-app-native-resources.mjs', import.meta.url),
+    'utf8'
+  );
+
+  assert.match(pkg.scripts?.['build:app'] || '', /sync-app-native-resources\.mjs/);
+  assert.match(syncScript, /dist\/build\/app\/AndroidManifest\.xml/);
+  assert.match(syncScript, /dist\/build\/app\/nativeResources\/android\/res\/xml\/network_security_config\.xml/);
 });
 
 test('Android 启动阶段不主动索取设备信息或外部存储权限', async () => {
@@ -146,6 +178,12 @@ test('APK 门禁区分自定义调试基座与内置业务资源的测试包', a
   assert.match(verifier, /dist\\build\\app-plus\\app-service\.js/);
   assert.match(verifier, /fixed test SMS code/);
   assert.match(verifier, /'mobile number'\s*=/);
+  assert.match(verifier, /dcloud-test.*release.*usesCleartextTraffic/s);
+  assert.match(verifier, /res\\xml\\network_security_config\.xml/);
+  assert.match(verifier, /network security config must trust system certificates only/);
+  assert.match(verifier, /must not contain a cleartext exception/);
+  assert.match(verifier, /must not trust user or bundled certificates/);
+  assert.match(verifier, /must not contain debug trust overrides/);
 });
 
 test('8 月 1 日 RC 脚本默认拒绝脏工作区且记录完整构建证据', async () => {