浅念
368b1d5b47
Task 12 + Task 7 quality-review carryovers: Part A - password hashing & controlled initial admin: - src/auth/password.ts: hashPassword/verifyPassword over @node-rs/argon2 (napi prebuilt, argon2id default); empty plain rejected at the door - src/scripts/seed-admin.ts: idempotent admin seed (ADMIN_ACCOUNT/ ADMIN_PASSWORD env, walk-up root .env load); existing account -> skip, never overwrites the password; no audit_logs (system op, no actor) - pnpm seed script (build + node dist/scripts/seed-admin.js); .env.example dev defaults admin/admin-secret-change-me - tests: test/password.spec.ts (5), test/seed.spec.ts real-DB idempotency (4) Part B - Task 7 carryovers (all 8): - ApiException(apiCode, message, httpStatus, details?) recognized first by the filter; unmapped-status rule: >=500 -> INTERNAL_ERROR + generic message, <500 -> VALIDATION_FAILED keeping original status (warn-logged) - 5xx/INTERNAL_ERROR responses forced to generic message (leak fix) - pino redact adds req.headers.cookie / res.headers.set-cookie - x-request-id echo capped at 128 chars (fresh UUID beyond, no log) - LOG_LEVEL validated against pino levels at module wiring -> fail fast - shared/ constants (API_PREFIX), request-with-id, log-level (+spec) - jest ts-jest reuses tsconfig.json; unit testMatch includes test/*.spec.ts - build:watch script (no concurrently dep; dev = build:watch + node --watch) api: 35 unit + 10 e2e tests green; root lint/typecheck/test green. Co-Authored-By: Claude Code <noreply@anthropic.com>
42 lines
1.6 KiB
TypeScript
42 lines
1.6 KiB
TypeScript
// services/api/test/password.spec.ts —— 密码哈希纯函数单测（Task 12 Part A）。
|
|
// 断言 @node-rs/argon2 语义：argon2id 编码格式（$argon2... 开头）、正确口令验证
|
|
// 通过、错误口令拒绝、同口令两次哈希不同（随机盐）、空口令直接拒绝。
|
|
import {
|
|
hashPassword,
|
|
verifyPassword,
|
|
} from '../src/auth/password';
|
|
|
|
describe('hashPassword / verifyPassword', () => {
|
|
const plain = 'correct-horse-battery-staple';
|
|
|
|
it('returns an argon2 hash distinct from the plain text', async () => {
|
|
const hashed = await hashPassword(plain);
|
|
expect(typeof hashed).toBe('string');
|
|
expect(hashed.length).toBeGreaterThan(0);
|
|
expect(hashed).not.toBe(plain);
|
|
expect(hashed.startsWith('$argon2')).toBe(true);
|
|
});
|
|
|
|
it('verifies the correct password', async () => {
|
|
const hashed = await hashPassword(plain);
|
|
await expect(verifyPassword(hashed, plain)).resolves.toBe(true);
|
|
});
|
|
|
|
it('rejects a wrong password', async () => {
|
|
const hashed = await hashPassword(plain);
|
|
await expect(verifyPassword(hashed, 'wrong-password')).resolves.toBe(false);
|
|
});
|
|
|
|
it('produces different hashes for the same password (random salt)', async () => {
|
|
const [a, b] = await Promise.all([hashPassword(plain), hashPassword(plain)]);
|
|
expect(a).not.toBe(b);
|
|
// 且两条哈希都能通过校验（各自携带自己的盐）。
|
|
await expect(verifyPassword(a, plain)).resolves.toBe(true);
|
|
await expect(verifyPassword(b, plain)).resolves.toBe(true);
|
|
});
|
|
|
|
it('rejects an empty password (never hash empty strings)', async () => {
|
|
await expect(hashPassword('')).rejects.toThrow(/empty/i);
|
|
});
|
|
});
|