368b1d5b47
Task 12 + Task 7 quality-review carryovers: Part A - password hashing & controlled initial admin: - src/auth/password.ts: hashPassword/verifyPassword over @node-rs/argon2 (napi prebuilt, argon2id default); empty plain rejected at the door - src/scripts/seed-admin.ts: idempotent admin seed (ADMIN_ACCOUNT/ ADMIN_PASSWORD env, walk-up root .env load); existing account -> skip, never overwrites the password; no audit_logs (system op, no actor) - pnpm seed script (build + node dist/scripts/seed-admin.js); .env.example dev defaults admin/admin-secret-change-me - tests: test/password.spec.ts (5), test/seed.spec.ts real-DB idempotency (4) Part B - Task 7 carryovers (all 8): - ApiException(apiCode, message, httpStatus, details?) recognized first by the filter; unmapped-status rule: >=500 -> INTERNAL_ERROR + generic message, <500 -> VALIDATION_FAILED keeping original status (warn-logged) - 5xx/INTERNAL_ERROR responses forced to generic message (leak fix) - pino redact adds req.headers.cookie / res.headers.set-cookie - x-request-id echo capped at 128 chars (fresh UUID beyond, no log) - LOG_LEVEL validated against pino levels at module wiring -> fail fast - shared/ constants (API_PREFIX), request-with-id, log-level (+spec) - jest ts-jest reuses tsconfig.json; unit testMatch includes test/*.spec.ts - build:watch script (no concurrently dep; dev = build:watch + node --watch) api: 35 unit + 10 e2e tests green; root lint/typecheck/test green. Co-Authored-By: Claude Code <noreply@anthropic.com>
30 lines
1.0 KiB
TypeScript
30 lines
1.0 KiB
TypeScript
// services/api/src/shared/log-level.ts —— LOG_LEVEL 启动期校验(Task 7 遗留项⑤)。
|
|
// 此前非法 LOG_LEVEL 由 pino 在首次写日志时才隐式抛错(或更糟:被当成自定义
|
|
// level 静默吞掉全部输出)。改为模块装配(LoggerModule.forRoot 前)即快速失败,
|
|
// 错误信息列出全部合法值。合法值即 pino 内建 level 集合(pino.Level 类型)。
|
|
import type { Level } from 'pino';
|
|
|
|
export const VALID_LOG_LEVELS: readonly Level[] = [
|
|
'fatal',
|
|
'error',
|
|
'warn',
|
|
'info',
|
|
'debug',
|
|
'trace',
|
|
];
|
|
|
|
/**
|
|
* 解析进程环境 LOG_LEVEL:缺省 'info';非法值抛错(调用点在模块装配期,
|
|
* 即应用启动即失败,不带半残日志配置上线)。
|
|
*/
|
|
export function resolveLogLevel(raw: string | undefined): Level {
|
|
const level = raw ?? 'info';
|
|
if (!VALID_LOG_LEVELS.includes(level as Level)) {
|
|
throw new Error(
|
|
`Invalid LOG_LEVEL "${level}". Valid levels: ${VALID_LOG_LEVELS.join(', ')} ` +
|
|
'(see .env.example).',
|
|
);
|
|
}
|
|
return level as Level;
|
|
}
|