photo-live/services/api/test/seed.spec.ts

// services/api/test/seed.spec.ts —— 初始管理员种子幂等性集成测试（真实 DB）。
// 直接调用导出的 seedAdmin 函数（非 CLI）：第一次创建、第二次跳过且不改写密码；
// 全程不写 audit_logs（系统运维操作，无 actor，计划 Task 12 明确排除审计）。
import { PrismaClient } from '@photo/db-cn';
import { seedAdmin } from '../src/scripts/seed-admin';
import { verifyPassword } from '../src/auth/password';
import { resetDb } from './reset';

describe('seedAdmin (real DB, idempotent)', () => {
  let prisma: PrismaClient;

  beforeAll(async () => {
    await resetDb();
    prisma = new PrismaClient();
    await prisma.$connect();
  });

  afterAll(async () => {
    await prisma.$disconnect();
  });

  it('creates the admin on first run', async () => {
    const result = await seedAdmin(prisma, 'admin', 'admin-secret-change-me');
    expect(result.created).toBe(true);
    const rows = await prisma.users.findMany({ where: { account: 'admin' } });
    expect(rows).toHaveLength(1);
    expect(rows[0]).toMatchObject({
      account: 'admin',
      role: 'admin',
      credentialStatus: 'active',
      sourceStatus: 'local',
      localLocked: false,
      displayName: 'admin',
    });
    // 存的是 argon2 哈希而非明文。
    expect(rows[0].passwordHash.startsWith('$argon2')).toBe(true);
    expect(rows[0].passwordHash).not.toBe('admin-secret-change-me');
  });

  it('skips on second run without touching the stored password', async () => {
    const before = await prisma.users.findUniqueOrThrow({
      where: { account: 'admin' },
    });
    const result = await seedAdmin(prisma, 'admin', 'a-different-password');
    expect(result.created).toBe(false);
    const rows = await prisma.users.findMany();
    expect(rows).toHaveLength(1);
    const after = rows[0];
    expect(after.passwordHash).toBe(before.passwordHash);
    // 原密码仍然有效（未被第二个口令替换）。
    await expect(
      verifyPassword(after.passwordHash, 'admin-secret-change-me'),
    ).resolves.toBe(true);
    await expect(
      verifyPassword(after.passwordHash, 'a-different-password'),
    ).resolves.toBe(false);
  });

  it('writes no audit_logs rows (system op, not a user action)', async () => {
    expect(await prisma.audit_logs.count()).toBe(0);
  });

  it('rejects an empty account before touching the DB', async () => {
    await expect(seedAdmin(prisma, '  ', 'whatever')).rejects.toThrow(
      /ADMIN_ACCOUNT/,
    );
    expect(await prisma.users.count()).toBe(1);
  });
});