浅念
368b1d5b47
Task 12 + Task 7 quality-review carryovers: Part A - password hashing & controlled initial admin: - src/auth/password.ts: hashPassword/verifyPassword over @node-rs/argon2 (napi prebuilt, argon2id default); empty plain rejected at the door - src/scripts/seed-admin.ts: idempotent admin seed (ADMIN_ACCOUNT/ ADMIN_PASSWORD env, walk-up root .env load); existing account -> skip, never overwrites the password; no audit_logs (system op, no actor) - pnpm seed script (build + node dist/scripts/seed-admin.js); .env.example dev defaults admin/admin-secret-change-me - tests: test/password.spec.ts (5), test/seed.spec.ts real-DB idempotency (4) Part B - Task 7 carryovers (all 8): - ApiException(apiCode, message, httpStatus, details?) recognized first by the filter; unmapped-status rule: >=500 -> INTERNAL_ERROR + generic message, <500 -> VALIDATION_FAILED keeping original status (warn-logged) - 5xx/INTERNAL_ERROR responses forced to generic message (leak fix) - pino redact adds req.headers.cookie / res.headers.set-cookie - x-request-id echo capped at 128 chars (fresh UUID beyond, no log) - LOG_LEVEL validated against pino levels at module wiring -> fail fast - shared/ constants (API_PREFIX), request-with-id, log-level (+spec) - jest ts-jest reuses tsconfig.json; unit testMatch includes test/*.spec.ts - build:watch script (no concurrently dep; dev = build:watch + node --watch) api: 35 unit + 10 e2e tests green; root lint/typecheck/test green. Co-Authored-By: Claude Code <noreply@anthropic.com>
67 lines
2.4 KiB
TypeScript
67 lines
2.4 KiB
TypeScript
// services/api/src/request-id.middleware.spec.ts —— 请求 ID 解析单测：
|
|
// 透传上游值 / 缺省生成 UUID / 超长值拒收换新（Task 7 遗留项④）。
|
|
import type { ServerResponse } from 'node:http';
|
|
import {
|
|
MAX_REQUEST_ID_LENGTH,
|
|
resolveRequestId,
|
|
} from './request-id.middleware';
|
|
|
|
function fakeReq(header?: string): { headers: Record<string, string>; id?: string } {
|
|
return header === undefined ? { headers: {} } : { headers: { 'x-request-id': header } };
|
|
}
|
|
|
|
function fakeRes(): ServerResponse & { captured?: string } {
|
|
const res = { headers: {} } as unknown as ServerResponse & { captured?: string };
|
|
Object.defineProperty(res, 'setHeader', {
|
|
value: (name: string, value: string) => {
|
|
res.captured = value;
|
|
return res;
|
|
},
|
|
});
|
|
return res;
|
|
}
|
|
|
|
describe('resolveRequestId', () => {
|
|
it('echoes a reasonable upstream x-request-id', () => {
|
|
const req = fakeReq('upstream-id-1');
|
|
const res = fakeRes();
|
|
expect(resolveRequestId(req as never, res)).toBe('upstream-id-1');
|
|
expect(req.id).toBe('upstream-id-1');
|
|
expect(res.captured).toBe('upstream-id-1');
|
|
});
|
|
|
|
it('generates a UUID v4 when the header is absent', () => {
|
|
const req = fakeReq();
|
|
const id = resolveRequestId(req as never, fakeRes());
|
|
expect(id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
|
|
expect(req.id).toBe(id);
|
|
});
|
|
|
|
it('treats a blank header as absent', () => {
|
|
const id = resolveRequestId(fakeReq(' ') as never, fakeRes());
|
|
expect(id).not.toBe(' ');
|
|
});
|
|
|
|
it('replaces an over-long upstream id (>128 chars) with a fresh UUID', () => {
|
|
const overlong = 'x'.repeat(MAX_REQUEST_ID_LENGTH + 1);
|
|
const req = fakeReq(overlong);
|
|
const res = fakeRes();
|
|
const id = resolveRequestId(req as never, res);
|
|
expect(id).not.toBe(overlong);
|
|
expect(id.length).toBeLessThanOrEqual(MAX_REQUEST_ID_LENGTH);
|
|
expect(req.id).toBe(id);
|
|
expect(res.captured).toBe(id);
|
|
});
|
|
|
|
it('still echoes an id of exactly the cap (128 chars)', () => {
|
|
const exact = 'y'.repeat(MAX_REQUEST_ID_LENGTH);
|
|
const id = resolveRequestId(fakeReq(exact) as never, fakeRes());
|
|
expect(id).toBe(exact);
|
|
});
|
|
|
|
it('reuses req.id when already resolved (pino-http genReqId runs first)', () => {
|
|
const req = { ...fakeReq('ignored'), id: 'already-set' };
|
|
expect(resolveRequestId(req as never, fakeRes())).toBe('already-set');
|
|
});
|
|
});
|