699d2bd951
- 生产环境未配置 ADMIN_PASSWORD（或仍为 admin/admin123）时，后台登录直接 503 拒绝 - 启动自检新增两条告警：未配有效 ADMIN_PASSWORD、非 production 身份校验放宽 - 部署文档补充 ADMIN_PASSWORD/ADMIN_USERNAME 必配说明 - 新增回归护栏 admin-credential-hardening.spec.ts（88 套件/642 用例全绿）；冒烟 5/5
29 行
1.2 KiB
TypeScript
29 行
1.2 KiB
TypeScript
// 已读取AGENTS.md
|
||
import * as fs from 'fs';
|
||
import * as path from 'path';
|
||
|
||
/**
|
||
* 第七十二批回归闸门：后台默认口令生产 fail-closed。
|
||
* 背景：ADMIN_PASSWORD 未配置时默认 admin/admin123，公网部署等于开放后台。
|
||
*/
|
||
describe('第七十二批后台凭证闸门', () => {
|
||
const root = path.resolve(__dirname, '../../');
|
||
const indexCode = fs.readFileSync(path.join(root, 'server/src/index.ts'), 'utf-8');
|
||
const doc = fs.readFileSync(path.join(root, 'docs/部署验收与1分钱支付闭环.md'), 'utf-8');
|
||
|
||
it('生产未配置 ADMIN_PASSWORD 时禁用后台登录（fail-closed）', () => {
|
||
expect(indexCode).toContain('ADMIN_PASSWORD_CONFIGURED');
|
||
expect(indexCode).toContain('if (IS_PRODUCTION && !ADMIN_PASSWORD_CONFIGURED)');
|
||
expect(indexCode).toContain('生产环境未配置后台登录口令');
|
||
});
|
||
|
||
it('启动自检提示默认口令与非生产放宽风险', () => {
|
||
expect(indexCode).toContain('未设置有效的 ADMIN_PASSWORD');
|
||
expect(indexCode).toContain('用户身份校验已放宽');
|
||
});
|
||
|
||
it('部署文档包含 ADMIN_PASSWORD', () => {
|
||
expect(doc).toContain('ADMIN_PASSWORD');
|
||
});
|
||
});
|