From 99c3454ce85e9e9759bd62e75abdc039140345bc Mon Sep 17 00:00:00 2001
From: uncle6me-web <uncle6.me@gmail.com>
Date: Sat, 6 Jun 2026 17:41:38 +0800
Subject: [PATCH] =?UTF-8?q?feat(recipes):=20auth=20recipe=20help=5Furl=20?=
 =?UTF-8?q?=E4=B8=80=E5=BE=8B=E5=BF=85=E5=A1=AB=EF=BC=88=E4=B8=8D=E5=88=86?=
 =?UTF-8?q?=E5=86=B7=E7=86=B1=E9=96=80=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

每個 required_secret 必須有 help_url（官方文件連結 http(s)://），POST /auth-recipes
驗證缺則 400。讓 AI/使用者設定 credential 時直接讀官方來源，不必猜/不會搜錯。
薄殼原則：驗證在 API，CLI/MCP 等介面 push auth recipe 自動受約束。
種子 23/23 已含 help_url。SDD: auth-recipe.md「help_url 一律必填」。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 cypher-executor/src/routes/recipes.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/cypher-executor/src/routes/recipes.ts b/cypher-executor/src/routes/recipes.ts
index 511099f..6c0a776 100644
--- a/cypher-executor/src/routes/recipes.ts
+++ b/cypher-executor/src/routes/recipes.ts
@@ -209,6 +209,17 @@ recipesRouter.post('/auth-recipes', async (c) => {
   if (!body.required_secrets?.length) return c.json({ success: false, error: 'required_secrets 必填' }, 400);
   if (!body.inject) return c.json({ success: false, error: 'inject 必填' }, 400);
 
+  // help_url 一律必填（不分冷熱門服務）：每個 secret 都要留官方文件連結，
+  // 讓 AI/使用者不必猜該去哪設定、也不會搜到錯誤來源（壓測 §recipe 設定說明）。
+  const missingHelp = body.required_secrets.filter(s => !s.help_url || !/^https?:\/\//.test(s.help_url));
+  if (missingHelp.length > 0) {
+    return c.json({
+      success: false,
+      error: `每個 required_secret 必須有 help_url（官方文件連結，http(s)://）。缺：${missingHelp.map(s => s.key).join(', ')}`,
+      requires: 'help_url',
+    }, 400);
+  }
+
   const now = Date.now();
   const existing = await c.env.RECIPES.get(`auth_recipe:${service}`, 'json') as AuthRecipeDefinition | null;