xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

test: add remote SMS login smoke

Browse Source
This commit is contained in:
Codex
2026-07-03 22:51:14 +08:00
parent f5e449f34b
commit 9f4fd6530a
4 changed files with 284 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/refactor/web-launch-acceptance-checklist.md
View File

@@ -103,6 +103,16 @@ node scripts/taro-h5-release-guardrails-test.js --require-dist --require-runtime
npm run smoke:launch-persona -- --write docs/refactor/launch-artifacts/launch-persona-smoke.json --write-md docs/refactor/launch-artifacts/launch-persona-smoke.md > docs/refactor/launch-artifacts/launch-persona-smoke.log
```
PNVS 短信登录上线前要用真实手机号跑一次远程 smoke。脚本不会读取或输出密钥；它只调用公网 API，发送验证码后在终端输入收到的短信验证码，再确认 `/api/auth/me` 可用：
```bash
SMS_SMOKE_API_BASE_URL=https://api.tjszsb.com \
SMS_SMOKE_TENANT_ID=00000000-0000-0000-0000-000000000001 \
SMS_SMOKE_PHONE=13800138000 \
SMS_SMOKE_ORIGIN=https://admin.tjszsb.com \
npm run smoke:sms-login:remote
```
`security:repo` 是仓库自带的静态安全扫描，会拦截密钥形态、前端旧鉴权头、真实 runtime-config 和生产证据误入 Git。它不能替代真实 `@codex-security`；如插件在当前 Codex 环境暴露扫描工具，再补插件扫描结果。若工具不可用，不能把该项标记为已完成，只能在上线证据里标记为待补。
`readiness:production` 和 `readiness:production:db` 是生产阻断门禁：会拒绝 mock/未知短信 provider、弱密钥、`CORS=*`、旧身份头、local_dev 存储、非 HTTPS 对象存储公开 URL、阿里云 OSS 内网直签、未接外部资源扫描、localhost webhook，以及租户短信/OAuth/支付公开配置缺字段、OAuth redirectUri/支付 notifyUrl 非 HTTPS、公开配置混入密钥、active provider 缺私密 `tenant_secrets` 等问题。