fix(verify): validate tenant-owned application routes

scripts/verify.sh

@@ -232,8 +232,14 @@ fi
 section "3. 核心服务"
 
 # actuator/health
-HEALTH_BODY=$(http_body "$BASE_URL/actuator/health")
-HEALTH_STATUS=$(echo "$HEALTH_BODY" | grep -o '"status":"[^"]*"' | head -1 || true)
+HEALTH_BODY=""
+HEALTH_STATUS=""
+for _attempt in 1 2 3 4 5; do
+  HEALTH_BODY=$(http_body "$BASE_URL/actuator/health")
+  HEALTH_STATUS=$(echo "$HEALTH_BODY" | grep -o '"status":"[^"]*"' | head -1 || true)
+  [ "$HEALTH_STATUS" = '"status":"UP"' ] && break
+  sleep 2
+done
 if [ "$HEALTH_STATUS" = '"status":"UP"' ]; then
   pass "tenant-service actuator/health = UP"
 else
@@ -447,23 +453,32 @@ check_optional_service() {
   fi
 }
 
-# 使用数据库中第一个 IM 类型 App（或任意 App）的 key 测试 IM 服务
+# 应用级接口必须使用当前登录租户真正拥有的 App。直接从全库挑第一个 App 会把
+# 正确的租户隔离误报为 500/403，也无法证明当前租户的业务链路可用。
 _IM_APP_KEY=""
-if [ -n "$MYSQL_CTR" ]; then
+if [ -n "$TOKEN" ]; then
+  _OWNED_APPS="$(http_body_auth "$BASE_URL/api/apps" "$TOKEN")"
+  _IM_APP_KEY="$(printf '%s' "$_OWNED_APPS" |
+    grep -o '"appKey":"[^"]*"' | head -1 | cut -d'"' -f4 || true)"
+fi
+if [ -z "$_IM_APP_KEY" ] && [ "$LOGIN_OK" != "true" ] && [ -n "$MYSQL_CTR" ]; then
   _IM_APP_KEY=$(docker exec "$MYSQL_CTR" sh -c \
     "mysql -u${MYSQL_USERNAME:-xuqm} -p${MYSQL_PASSWORD:-} ${MYSQL_DATABASE:-xuqm_private} -N \
      -e \"SELECT app_key FROM t_app WHERE is_default=1 LIMIT 1;\"" 2>/dev/null | tr -d '\r\n' || true)
 fi
-[ -z "$_IM_APP_KEY" ] && _IM_APP_KEY="${APP_KEYS%% *}"  # 降级到第一个 App Key
 
-check_optional_service "IM 服务" \
-  "$BASE_URL/api/im/platform-events/token?appKey=${_IM_APP_KEY:-test}" "$TOKEN"
+if [ -n "$_IM_APP_KEY" ]; then
+  check_optional_service "IM 服务" \
+    "$BASE_URL/api/im/platform-events/token?appKey=${_IM_APP_KEY}" "$TOKEN"
 
-check_optional_service "版本管理 (update)" \
-  "$BASE_URL/api/v1/updates/app/list?appKey=${_IM_APP_KEY:-test}&platform=ANDROID" "$TOKEN"
+  check_optional_service "版本管理 (update)" \
+    "$BASE_URL/api/v1/updates/app/list?appKey=${_IM_APP_KEY}&platform=ANDROID" "$TOKEN"
 
-check_optional_service "RN 热更新 (rn)" \
-  "$BASE_URL/api/v1/rn/list?appKey=${_IM_APP_KEY:-test}" "$TOKEN"
+  check_optional_service "RN 热更新 (rn)" \
+    "$BASE_URL/api/v1/rn/list?appKey=${_IM_APP_KEY}" "$TOKEN"
+else
+  warn "当前租户没有应用，跳过 IM/update/RN 的应用级接口验证"
+fi
 
 # 文件服务
 FILE_CODE=$(http_get "$BASE_URL/file/")