xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

test: lock PNVS SMS verification boundary

Browse Source
This commit is contained in:
Codex
2026-07-03 23:22:18 +08:00
parent f8f83168b4
commit 27ee85bc94
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
scripts/aliyun-pnvs-provider-contract-test.js
View File

@@ -10,6 +10,7 @@ const providerDoc = fs.readFileSync(path.join(process.cwd(), 'docs/refactor/auth
const launchChecklist = fs.readFileSync(path.join(process.cwd(), 'docs/refactor/web-launch-acceptance-checklist.md'), 'utf8');
const readinessSource = fs.readFileSync(path.join(process.cwd(), 'scripts/production-readiness-check.js'), 'utf8');
const tenantProviderConfigSource = fs.readFileSync(path.join(process.cwd(), 'apps/api/src/core/tenant-provider-config.ts'), 'utf8');
const platformDunningNotificationWorker = fs.readFileSync(path.join(process.cwd(), 'apps/worker/src/jobs/platform-dunning-notifications.ts'), 'utf8');
assert.match(providerSource, /class AliyunPnvsSmsProvider/, 'PNVS provider class should exist');
assert.match(providerSource, /SendSmsVerifyCode/, 'PNVS provider should call SendSmsVerifyCode');
@@ -19,12 +20,16 @@ assert.match(providerSource, /##code##/, 'PNVS provider should preserve Aliyun-g
assert.match(routeSource, /aliyun-pnvs/, 'auth routes should recognize aliyun-pnvs aliases');
assert.match(routeSource, /verification.*provider/s, 'auth routes should store provider verification mode');
assert.match(routeSource, /provider\.verify/, 'auth routes should delegate PNVS verification to provider');
assert.match(routeSource, /export async function bindPhoneRoute[\s\S]*activeSmsProvider[\s\S]*consumeSmsCode/, 'phone binding should reuse active SMS provider verification');
assert.match(routeSource, /purpose !== 'bind_phone'/, 'phone binding should require bind_phone purpose');
assert.match(tenantProviderConfigSource, /normalized === 'aliyun-pnvs'[\s\S]*return 'sms'/, 'PNVS secrets should default to sms scope');
assert.match(tenantAdminRouteSource, /normalized === 'aliyun-pnvs'[\s\S]*return 'sms'/, 'tenant admin PNVS secrets should default to sms scope');
assert.match(deployEnvExample, /AUTH_SMS_PROVIDER=aliyun-pnvs/, 'deploy env example should prefer aliyun-pnvs');
assert.match(readinessSource, /aliyunPnvs/, 'production readiness should validate aliyun-pnvs public config');
assert.match(providerDoc, /SendSmsVerifyCode/, 'provider doc should document PNVS send action');
assert.match(providerDoc, /CheckSmsVerifyCode/, 'provider doc should document PNVS verify action');
assert.match(providerDoc, /PNVS 只用于手机号登录和 `bind_phone`/, 'provider doc should constrain PNVS to verification-code auth flows');
assert.doesNotMatch(platformDunningNotificationWorker, /aliyun-pnvs|SendSmsVerifyCode|CheckSmsVerifyCode/, 'platform dunning notifications must not use PNVS verification APIs');
assert.match(launchChecklist, /AUTH_SMS_PROVIDER=aliyun-pnvs/, 'launch checklist should allow aliyun-pnvs');
console.log('[PASS] Aliyun PNVS provider contract');

2
scripts/deploy/README.md
View File

@@ -149,7 +149,7 @@ Taro H5 构建存在 webpack asset size warning，这是前端包体优化事项
2026-07-03 最新接管状态：
- Gitea `main` 已包含 PNVS 短信认证、后台登录修复和旧题库视觉对齐版本，最新提交应至少是 `8f69838`。
- Gitea `main` 已包含 PNVS 短信认证、后台登录修复、PNVS provider 配置脚本和旧题库视觉对齐版本，最新提交应至少是 `f8f8316`。
- 服务器仓库仍在 `/opt/tiku-saas/repo`，归属用户应为 `deploy:deploy`。
- 生产 API 已能启动，`https://api.tjszsb.com/api/tenant/resolve?host=app.tjszsb.com` 已返回 `master` 租户。
- Supabase self-hosted 运行在 `/opt/tiku-saas/supabase-project`，Kong 通过 Nginx 暴露到 `https://supabase.tjszsb.com`。