// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第七十二批回归闸门：后台默认口令生产 fail-closed。
 * 背景：ADMIN_PASSWORD 未配置时默认 admin/admin123，公网部署等于开放后台。
 */
describe('第七十二批后台凭证闸门', () => {
  const root = path.resolve(__dirname, '../../');
  const indexCode = fs.readFileSync(path.join(root, 'server/src/index.ts'), 'utf-8');
  const doc = fs.readFileSync(path.join(root, 'docs/部署验收与1分钱支付闭环.md'), 'utf-8');

  it('未配置 ADMIN_PASSWORD 时禁用后台登录（fail-closed，不依赖 NODE_ENV）', () => {
    expect(indexCode).toContain('ADMIN_PASSWORD_CONFIGURED');
    expect(indexCode).toContain('if (SECURE_MODE && !ADMIN_PASSWORD_CONFIGURED)');
    expect(indexCode).toContain('后台登录口令未配置');
  });

  it('启动自检提示默认口令与非生产放宽风险', () => {
    expect(indexCode).toContain('未设置有效的 ADMIN_PASSWORD');
    expect(indexCode).toContain('ALLOW_INSECURE_DEV_AUTH');
  });

  it('部署文档包含 ADMIN_PASSWORD', () => {
    expect(doc).toContain('ADMIN_PASSWORD');
  });
});