From a2e32f8e737f47580ba0f222fb89069201db91ba Mon Sep 17 00:00:00 2001 From: wumingzhinu Date: Fri, 25 Sep 2026 10:00:36 +0800 Subject: [PATCH 1/2] test(auth): isolate default credential cases --- .../server/default_credentials.test.ts | 53 ++++++++++++++----- 1 file changed, 41 insertions(+), 12 deletions(-) diff --git a/src/backend/server/default_credentials.test.ts b/src/backend/server/default_credentials.test.ts index 507d4b1a..de6a50ab 100644 --- a/src/backend/server/default_credentials.test.ts +++ b/src/backend/server/default_credentials.test.ts @@ -1,20 +1,49 @@ import assert from "node:assert/strict" -import { test } from "node:test" +import { test as nodeTest } from "node:test" import { Hono } from "hono" -import { getDb, saveDb } from "../internal/model/db" import { - getOrInitUsers, - verifyUserPassword, - hashPasswordSHA256, -} from "./auth" + getDb, + saveDb, + __resetDbCacheForTest, + __setStoreBackendLoaderForTest, +} from "../internal/model/db" +import { getOrInitUsers, verifyUserPassword, hashPasswordSHA256 } from "./auth" import { isHex64 } from "../pkg/password" import { userRouter } from "./user" const env: any = {} const ADMIN_TOKEN = "ADMIN_STATIC_TOKEN" -const seed = (users: any[], settings: any[] = []) => - saveDb({ settings, users, storages: [], shares: [] }, env) +const resetState = () => { + __resetDbCacheForTest() + delete process.env.ADMIN_PASS + let stored: any = null + __setStoreBackendLoaderForTest(async () => ({ + name: "test", + isConfigured: async () => true, + load: async () => (stored ? JSON.parse(JSON.stringify(stored)) : null), + save: async (next: any) => { + stored = JSON.parse(JSON.stringify(next)) + return true + }, + })) +} + +const test = (name: string, fn: () => Promise) => + nodeTest(name, { concurrency: false }, async () => { + resetState() + try { + await fn() + } finally { + resetState() + } + }) + +const seed = ( + users: any[], + settings: any[] = [], + options?: { force?: boolean }, +) => saveDb({ settings, users, storages: [], shares: [] }, env, options) const adminUser = (password: string) => ({ id: 1, @@ -26,15 +55,15 @@ const adminUser = (password: string) => ({ disabled: false, }) -const currentAdmin = async () => { - const db: any = await getDb(env) +const currentAdmin = async (envCtx = env) => { + const db: any = await getDb(envCtx) return db.users.find((u: any) => u.username === "admin") } test("Initialization: a fresh deployment stays uninitialized without ADMIN_PASS", async () => { // 隔离 CI/宿主机环境变量，避免影响“未初始化”断言 delete process.env.ADMIN_PASS - await seed([]) + await seed([], [], { force: true }) await getOrInitUsers(env) const admin = await currentAdmin() assert.equal( @@ -80,7 +109,7 @@ test("Security(F-11): ADMIN_PASS still forces an explicit reset (to salted doubl await seed([adminUser("pbkdf2:100000:somesalt:deadbeef")]) const envWithPass: any = { ...env, ADMIN_PASS: "operator-chosen" } await getOrInitUsers(envWithPass) - const admin = await currentAdmin() + const admin = await currentAdmin(envWithPass) assert.ok(isHex64(admin.password), "reset must store a 64-hex SHA-256 value") assert.ok(admin.salt, "reset must assign a per-user salt (Go two-step hash)") assert.equal( From f4b936d16dd8d257dac461470c805e4d6c85fba8 Mon Sep 17 00:00:00 2001 From: wumingzhinu Date: Fri, 25 Sep 2026 10:38:54 +0800 Subject: [PATCH 2/2] test(auth): make credential seed assertions explicit --- .../server/default_credentials.test.ts | 57 +++++++++++-------- 1 file changed, 33 insertions(+), 24 deletions(-) diff --git a/src/backend/server/default_credentials.test.ts b/src/backend/server/default_credentials.test.ts index de6a50ab..366490ac 100644 --- a/src/backend/server/default_credentials.test.ts +++ b/src/backend/server/default_credentials.test.ts @@ -14,36 +14,45 @@ import { userRouter } from "./user" const env: any = {} const ADMIN_TOKEN = "ADMIN_STATIC_TOKEN" -const resetState = () => { - __resetDbCacheForTest() - delete process.env.ADMIN_PASS - let stored: any = null - __setStoreBackendLoaderForTest(async () => ({ - name: "test", - isConfigured: async () => true, - load: async () => (stored ? JSON.parse(JSON.stringify(stored)) : null), - save: async (next: any) => { - stored = JSON.parse(JSON.stringify(next)) - return true - }, - })) +const run = async (fn: () => Promise) => { + const originalAdminPass = process.env.ADMIN_PASS + try { + __resetDbCacheForTest() + delete process.env.ADMIN_PASS + let stored: any = null + __setStoreBackendLoaderForTest(async () => ({ + name: "test", + isConfigured: async () => true, + load: async () => (stored ? JSON.parse(JSON.stringify(stored)) : null), + save: async (next: any) => { + stored = JSON.parse(JSON.stringify(next)) + return true + }, + })) + await fn() + } finally { + __resetDbCacheForTest() + if (originalAdminPass === undefined) { + delete process.env.ADMIN_PASS + } else { + process.env.ADMIN_PASS = originalAdminPass + } + } } const test = (name: string, fn: () => Promise) => - nodeTest(name, { concurrency: false }, async () => { - resetState() - try { - await fn() - } finally { - resetState() - } - }) + nodeTest(name, { concurrency: false }, () => run(fn)) -const seed = ( +const seed = async ( users: any[], settings: any[] = [], options?: { force?: boolean }, -) => saveDb({ settings, users, storages: [], shares: [] }, env, options) +) => { + assert.equal( + await saveDb({ settings, users, storages: [], shares: [] }, env, options), + true, + ) +} const adminUser = (password: string) => ({ id: 1, @@ -95,7 +104,7 @@ test("Security(F-11): a legacy-format hash is left untouched (no silent reset on test("Initialization: an empty admin password stays empty (uninitialized), not a random one", async () => { delete process.env.ADMIN_PASS - await seed([adminUser("")]) + await seed([adminUser("")], [], { force: true }) await getOrInitUsers(env) const admin = await currentAdmin() assert.equal(