修正权限

scripts/import-test-data.mjs

@@ -101,8 +101,20 @@ async function prepareMysql() {
     }
 
     const [metadataRows] = await connection.query('SELECT schema_version FROM schema_metadata WHERE id = 1');
-    if (Number(metadataRows[0]?.schema_version) !== 15) {
-      throw new Error(`MySQL 数据库结构版本不是 v15（当前 ${metadataRows[0]?.schema_version ?? '未知'}），请先完成结构初始化`);
+    if (Number(metadataRows[0]?.schema_version) !== 16) {
+      throw new Error(`MySQL 数据库结构版本不是 v16（当前 ${metadataRows[0]?.schema_version ?? '未知'}），请先完成结构初始化`);
+    }
+
+    const [examPartitionRows] = await connection.query(
+      'SELECT candidates_table, admissions_table, results_table, centers_table FROM exam_data_partitions'
+    );
+    const [schoolPartitionRows] = await connection.query('SELECT students_table FROM school_student_partitions');
+    const dynamicPartitionTables = [
+      ...examPartitionRows.flatMap(row => [row.candidates_table, row.admissions_table, row.results_table, row.centers_table]),
+      ...schoolPartitionRows.map(row => row.students_table)
+    ];
+    if (dynamicPartitionTables.some(table => !/^[a-z][a-z0-9_]{0,63}$/.test(table))) {
+      throw new Error('分表登记中存在非法表名，拒绝替换测试数据');
     }
 
     const nonEmpty = [];
@@ -148,6 +160,7 @@ async function prepareMysql() {
     } finally {
       await connection.query('SET FOREIGN_KEY_CHECKS = 1');
     }
+    for (const table of dynamicPartitionTables) await connection.query(`DROP TABLE IF EXISTS \`${table}\``);
     return { location: `MySQL database ${databaseName}`, initialized: true };
   } finally {
     connection?.release();