诚实性修复: API限流Retry-After(wait=60s)+断言 / purge定时接线(04:00 cron+actor+测试) / Channel表单校验(ref+rules+validate) / README PG数字513

backend/apps/core/demo.py

@@ -30,7 +30,7 @@ async def enter_demo(request):
     from django.contrib.auth import get_user_model
     from rest_framework_simplejwt.tokens import RefreshToken
 
-    from apps.core.models import Tenant
+    from apps.core.models import Tenant, TenantMembership
 
     def _prepare():
         tenant = Tenant.objects.filter(code=DEMO_TENANT, is_active=True).first()
@@ -39,6 +39,12 @@ async def enter_demo(request):
         user = get_user_model().objects.filter(username=DEMO_USER).first()
         if user is None:
             return tenant, None
+        # The token flow bypasses the normal login path, so make sure the
+        # membership exists even when the demo tenant was built by hand.
+        TenantMembership.objects.get_or_create(
+            user=user, tenant=tenant,
+            defaults={"role": "owner", "is_active": True},
+        )
         return tenant, user
 
     tenant, user = await sync_to_async(_prepare)()