70 lines
2.5 KiB
TypeScript
70 lines
2.5 KiB
TypeScript
|
// services/api/test/seed.spec.ts —— 初始管理员种子幂等性集成测试（真实 DB）。
|
||
|
|
// 直接调用导出的 seedAdmin 函数（非 CLI）：第一次创建、第二次跳过且不改写密码；
|
||
|
|
// 全程不写 audit_logs（系统运维操作，无 actor，计划 Task 12 明确排除审计）。
|
||
|
|
import { PrismaClient } from '@photo/db-cn';
|
||
|
|
import { seedAdmin } from '../src/scripts/seed-admin';
|
||
|
|
import { verifyPassword } from '../src/auth/password';
|
||
|
|
import { resetDb } from './reset';
|
||
|
|
|
||
|
|
describe('seedAdmin (real DB, idempotent)', () => {
|
||
|
|
let prisma: PrismaClient;
|
||
|
|
|
||
|
|
beforeAll(async () => {
|
||
|
|
await resetDb();
|
||
|
|
prisma = new PrismaClient();
|
||
|
|
await prisma.$connect();
|
||
|
|
});
|
||
|
|
|
||
|
|
afterAll(async () => {
|
||
|
|
await prisma.$disconnect();
|
||
|
|
});
|
||
|
|
|
||
|
|
it('creates the admin on first run', async () => {
|
||
|
|
const result = await seedAdmin(prisma, 'admin', 'admin-secret-change-me');
|
||
|
|
expect(result.created).toBe(true);
|
||
|
|
const rows = await prisma.users.findMany({ where: { account: 'admin' } });
|
||
|
|
expect(rows).toHaveLength(1);
|
||
|
|
expect(rows[0]).toMatchObject({
|
||
|
|
account: 'admin',
|
||
|
|
role: 'admin',
|
||
|
|
credentialStatus: 'active',
|
||
|
|
sourceStatus: 'local',
|
||
|
|
localLocked: false,
|
||
|
|
displayName: 'admin',
|
||
|
|
});
|
||
|
|
// 存的是 argon2 哈希而非明文。
|
||
|
|
expect(rows[0].passwordHash.startsWith('$argon2')).toBe(true);
|
||
|
|
expect(rows[0].passwordHash).not.toBe('admin-secret-change-me');
|
||
|
|
});
|
||
|
|
|
||
|
|
it('skips on second run without touching the stored password', async () => {
|
||
|
|
const before = await prisma.users.findUniqueOrThrow({
|
||
|
|
where: { account: 'admin' },
|
||
|
|
});
|
||
|
|
const result = await seedAdmin(prisma, 'admin', 'a-different-password');
|
||
|
|
expect(result.created).toBe(false);
|
||
|
|
const rows = await prisma.users.findMany();
|
||
|
|
expect(rows).toHaveLength(1);
|
||
|
|
const after = rows[0];
|
||
|
|
expect(after.passwordHash).toBe(before.passwordHash);
|
||
|
|
// 原密码仍然有效（未被第二个口令替换）。
|
||
|
|
await expect(
|
||
|
|
verifyPassword(after.passwordHash, 'admin-secret-change-me'),
|
||
|
|
).resolves.toBe(true);
|
||
|
|
await expect(
|
||
|
|
verifyPassword(after.passwordHash, 'a-different-password'),
|
||
|
|
).resolves.toBe(false);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('writes no audit_logs rows (system op, not a user action)', async () => {
|
||
|
|
expect(await prisma.audit_logs.count()).toBe(0);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('rejects an empty account before touching the DB', async () => {
|
||
|
|
await expect(seedAdmin(prisma, ' ', 'whatever')).rejects.toThrow(
|
||
|
|
/ADMIN_ACCOUNT/,
|
||
|
|
);
|
||
|
|
expect(await prisma.users.count()).toBe(1);
|
||
|
|
});
|
||
|
|
});
|