xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

feat: establish production SaaS foundation

Browse Source
This commit is contained in:
Codex
2026-07-12 19:26:57 +08:00
parent 1c2ce38cea
commit 39f7332f33
219 changed files with 20647 additions and 2628 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
scripts/production-config-failfast-test.js
View File

@@ -27,6 +27,7 @@ const safeBaseEnv = {
const safeApiEnv = {
...safeBaseEnv,
CORS_ORIGIN: 'https://student.gongxue100.com,https://tenant-admin.gongxue100.com,https://platform-admin.gongxue100.com',
CORS_TENANT_DOMAINS_ENABLED: 'true',
AUTH_SMS_PROVIDER: 'aliyun-pnvs',
AUTH_CODE_PEPPER: 's3cure-prod-code-pepper-2026-06-30-abcdef',
AUTH_SESSION_SECRET: 's3cure-prod-session-secret-2026-06-30-ghijkl',
@@ -73,6 +74,28 @@ assert.match(
'API config should require PNVS for production SMS',
);
const unsafeApiTenantCorsDisabled = runImport(apiConfigUrl, {
...safeApiEnv,
CORS_TENANT_DOMAINS_ENABLED: 'false',
});
assert.notEqual(unsafeApiTenantCorsDisabled.status, 0, 'production API config should require dynamic tenant CORS');
assert.match(
unsafeApiTenantCorsDisabled.output,
/CORS_TENANT_DOMAINS_ENABLED must be true in production/,
'API config should fail closed when dynamic tenant CORS is disabled',
);
const unsafeApiCorsPath = runImport(apiConfigUrl, {
...safeApiEnv,
CORS_ORIGIN: 'https://platform-admin.gongxue100.com/app',
});
assert.notEqual(unsafeApiCorsPath.status, 0, 'production API config should reject non-Origin CORS URLs');
assert.match(
unsafeApiCorsPath.output,
/CORS_ORIGIN must contain only production HTTPS origins without paths/,
'API config should reject CORS entries with URL paths',
);
const unsafeApiTraditionalSmsProvider = runImport(apiConfigUrl, {
...safeApiEnv,
AUTH_SMS_PROVIDER: 'aliyun',