xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

chore: harden production readiness gates

Browse Source
This commit is contained in:
Codex
2026-07-01 06:09:23 +08:00
parent f3f6028633
commit bb938cf6e2
13 changed files with 695 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
scripts/production-config-failfast-test.js
View File

@@ -62,6 +62,50 @@ assert.notEqual(unsafeApi.status, 0, 'production API config should reject local_
assert.match(unsafeApi.output, /Invalid production API configuration/, 'API config should explain production config failure');
assert.match(unsafeApi.output, /STORAGE_DEFAULT_PROVIDER=local_dev/, 'API config should name unsafe storage provider');
const unsafeApiSmsProvider = runImport(apiConfigUrl, {
...safeApiEnv,
AUTH_SMS_PROVIDER: 'mocked-production',
});
assert.notEqual(unsafeApiSmsProvider.status, 0, 'production API config should reject unsupported SMS provider');
assert.match(
unsafeApiSmsProvider.output,
/AUTH_SMS_PROVIDER must be aliyun\/aliyun-sms or tencent\/tencent-sms/,
'API config should name supported production SMS providers',
);
const unsafeApiStoragePublicBaseUrl = runImport(apiConfigUrl, {
...safeApiEnv,
STORAGE_PUBLIC_BASE_URL: 'http://127.0.0.1:9000/assets',
});
assert.notEqual(unsafeApiStoragePublicBaseUrl.status, 0, 'production API config should reject unsafe storage public base URL');
assert.match(
unsafeApiStoragePublicBaseUrl.output,
/STORAGE_PUBLIC_BASE_URL must be a production HTTPS URL/,
'API config should require HTTPS storage public base URL',
);
const unsafeApiAliyunInternal = runImport(apiConfigUrl, {
...safeApiEnv,
ALIYUN_OSS_INTERNAL: 'true',
});
assert.notEqual(unsafeApiAliyunInternal.status, 0, 'production API config should reject internal OSS signed URL mode');
assert.match(
unsafeApiAliyunInternal.output,
/ALIYUN_OSS_INTERNAL=true is not allowed/,
'API config should name unsafe internal OSS mode',
);
const unsafeApiAliyunEndpoint = runImport(apiConfigUrl, {
...safeApiEnv,
ALIYUN_OSS_ENDPOINT: 'https://oss-cn-hangzhou.example.com',
});
assert.notEqual(unsafeApiAliyunEndpoint.status, 0, 'production API config should reject non-Aliyun OSS endpoints');
assert.match(
unsafeApiAliyunEndpoint.output,
/ALIYUN_OSS_ENDPOINT must be a production HTTPS aliyuncs\.com endpoint/,
'API config should require official Aliyun OSS endpoint host',
);
const safeApi = runImport(apiConfigUrl, safeApiEnv);
assert.equal(safeApi.status, 0, `safe production API config should load: ${safeApi.output}`);
@@ -80,6 +124,28 @@ const unsafeWorkerScanner = runImport(workerConfigUrl, {
assert.notEqual(unsafeWorkerScanner.status, 0, 'production worker config should require external scanner');
assert.match(unsafeWorkerScanner.output, /WORKER_ASSET_SECURITY_SCANNER must include http/, 'worker config should require http scanner');
const unsafeWorkerStorageBaseUrl = runImport(workerConfigUrl, {
...safeBaseEnv,
STORAGE_PUBLIC_BASE_URL: 'http://localhost:9000/assets',
});
assert.notEqual(unsafeWorkerStorageBaseUrl.status, 0, 'production worker config should reject unsafe storage public base URL');
assert.match(
unsafeWorkerStorageBaseUrl.output,
/STORAGE_PUBLIC_BASE_URL must be a production HTTPS URL/,
'worker config should require HTTPS storage public base URL',
);
const unsafeWorkerAliyunInternal = runImport(workerConfigUrl, {
...safeBaseEnv,
ALIYUN_OSS_INTERNAL: 'true',
});
assert.notEqual(unsafeWorkerAliyunInternal.status, 0, 'production worker config should reject internal OSS signed URL mode');
assert.match(
unsafeWorkerAliyunInternal.output,
/ALIYUN_OSS_INTERNAL=true is not allowed/,
'worker config should name unsafe internal OSS mode',
);
const unsafeWorkerPlatformAuditNotification = runImport(workerConfigUrl, {
...safeBaseEnv,
WORKER_PLATFORM_AUDIT_NOTIFICATION_ALLOW_INSECURE_LOCALHOST: 'true',