chore: harden production readiness gates

2026-07-01 06:09:23 +08:00
parent f3f6028633
commit bb938cf6e2
13 changed files with 695 additions and 63 deletions
--- a/scripts/production-readiness-check.js
+++ b/scripts/production-readiness-check.js
@@ -10,6 +10,21 @@ const DEFAULT_AUTH_SESSION_SECRET = 'development-session-secret-change-me';
 const DEFAULT_AUTH_JWT_SECRET = 'development-jwt-secret-change-me';
 const DEFAULT_PLATFORM_ADMIN_API_KEY = 'local-platform-admin-key';
 const HARD_MAX_JSON_BODY_BYTES = 50 * 1024 * 1024;
+const PRODUCTION_SMS_PROVIDERS = new Set(['aliyun', 'aliyun-sms', 'aliyun_sms', 'tencent', 'tencent-sms', 'tencent_sms']);
+const PRODUCTION_STORAGE_PROVIDERS = new Set(['aliyun_oss', 'tencent_cos', 'supabase_storage']);
+const AUTH_PROVIDER_ALIASES = {
+  sms: new Set(['aliyun', 'aliyun-sms', 'aliyun_sms', 'tencent', 'tencent-sms', 'tencent_sms']),
+  aliyun: new Set(['aliyun', 'aliyun-sms', 'aliyun_sms']),
+  tencent: new Set(['tencent', 'tencent-sms', 'tencent_sms']),
+  wechatMiniapp: new Set(['wechat-miniapp', 'wechat_miniapp', 'wechat-mini', 'wx-miniapp', 'wx_miniapp']),
+  wechatWeb: new Set(['wechat-web', 'wechat_web', 'wechat', 'wechat-oauth', 'wechat_oauth']),
+  qq: new Set(['qq', 'qq-oauth', 'qq_oauth']),
+};
+const PAYMENT_PROVIDER_ALIASES = {
+  wechatPay: new Set(['wechat_pay', 'wechat-pay', 'wechatpay', 'wxpay', 'wx_pay']),
+  alipay: new Set(['alipay', 'ali_pay']),
+  manual: new Set(['manual']),
+};

 const args = new Set(process.argv.slice(2));
 const argValues = new Map();
@@ -25,6 +40,7 @@ const jsonOutput = args.has('--json');
 const checkDb = args.has('--check-db');
 const skipDb = args.has('--skip-db') || !checkDb;
 const envFile = argValues.get('--env-file') || path.resolve(process.cwd(), '.env');
+const providerConfigFixture = argValues.get('--provider-config-fixture') || '';
 const checks = [];

 function loadEnvFile(filePath) {
@@ -101,10 +117,322 @@ function hostFromUrl(value) {
  }
 }

+function urlFromValue(value) {
+  try {
+    return new URL(String(value || ''));
+  } catch {
+    return null;
+  }
+}
+
 function isLocalHost(hostname) {
  return ['localhost', '127.0.0.1', '::1', '0.0.0.0'].includes(hostname);
 }

+function isProductionHttpsUrl(value) {
+  const url = urlFromValue(value);
+  return Boolean(url && url.protocol === 'https:' && !isLocalHost(url.hostname.toLowerCase()));
+}
+
+function isAllowedHost(hostname, allowedHosts) {
+  const normalized = String(hostname || '').toLowerCase();
+  return allowedHosts.some(host => normalized === host || normalized.endsWith(`.${host}`));
+}
+
+function publicString(configPublic, keys) {
+  for (const key of keys) {
+    const value = configPublic?.[key];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return '';
+}
+
+function missingPublicKeys(configPublic, keys) {
+  return keys.filter(key => !publicString(configPublic, [key]));
+}
+
+function normalizeProvider(value) {
+  return String(value || '').trim().toLowerCase();
+}
+
+function providerIn(provider, aliases) {
+  return aliases.has(normalizeProvider(provider));
+}
+
+function validateProviderUrl({
+  id,
+  value,
+  message,
+  allowedHosts = [],
+  required = false,
+  details = {},
+}) {
+  const raw = String(value || '').trim();
+  if (!raw) {
+    if (required) block(`${id}.missing`, message || 'Production URL is required', details);
+    return;
+  }
+  const url = urlFromValue(raw);
+  if (!url || url.protocol !== 'https:' || isLocalHost(url.hostname.toLowerCase())) {
+    block(`${id}.unsafe`, message || 'Production URL must use HTTPS and must not point to localhost', details);
+    return;
+  }
+  if (allowedHosts.length > 0 && !isAllowedHost(url.hostname, allowedHosts)) {
+    block(`${id}.host`, 'Provider endpoint host is not allowed for production', {
+      ...details,
+      host: url.hostname,
+      allowedHosts,
+    });
+  }
+}
+
+function missingPublicKeyGroups(configPublic, groups) {
+  return groups
+    .filter(group => !publicString(configPublic, group.keys))
+    .map(group => group.label);
+}
+
+function blockMissingPublicConfig(row, missing) {
+  if (missing.length === 0) return;
+  block(
+    `db.${row.source}.${safeProviderName(row.provider)}.public_required`,
+    'Provider public config is missing production-required fields',
+    {
+      tenantId: row.tenant_id,
+      provider: row.provider,
+      missing,
+    },
+  );
+}
+
+function validateAuthProviderPublicConfig(row) {
+  const provider = normalizeProvider(row.provider);
+  const configPublic = row.config_public || {};
+  const details = { tenantId: row.tenant_id, provider: row.provider };
+
+  if (provider === 'mock') {
+    block('db.auth.mock_provider', 'Active/testing mock auth provider is not allowed in production', details);
+    return;
+  }
+
+  if (providerIn(provider, AUTH_PROVIDER_ALIASES.aliyun)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'signName', keys: ['signName'] },
+      { label: 'templateCode', keys: ['templateCode'] },
+    ]));
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.endpoint`,
+      value: publicString(configPublic, ['endpoint']),
+      allowedHosts: ['aliyuncs.com'],
+      details,
+    });
+    if (!publicString(configPublic, ['regionId'])) {
+      warn(`db.auth.${safeProviderName(row.provider)}.region`, 'Aliyun SMS regionId is not set; default cn-hangzhou will be used', details);
+    }
+    return;
+  }
+
+  if (providerIn(provider, AUTH_PROVIDER_ALIASES.tencent)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'smsSdkAppId/appId', keys: ['smsSdkAppId', 'appId'] },
+      { label: 'signName', keys: ['signName'] },
+      { label: 'templateId', keys: ['templateId'] },
+    ]));
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.endpoint`,
+      value: publicString(configPublic, ['endpoint']),
+      allowedHosts: ['tencentcloudapi.com'],
+      details,
+    });
+    if (!publicString(configPublic, ['region'])) {
+      warn(`db.auth.${safeProviderName(row.provider)}.region`, 'Tencent SMS region is not set; default ap-guangzhou will be used', details);
+    }
+    return;
+  }
+
+  if (providerIn(provider, AUTH_PROVIDER_ALIASES.wechatMiniapp)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'appId', keys: ['appId'] },
+    ]));
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.endpoint`,
+      value: publicString(configPublic, ['endpoint']),
+      allowedHosts: ['weixin.qq.com'],
+      details,
+    });
+    return;
+  }
+
+  if (providerIn(provider, AUTH_PROVIDER_ALIASES.wechatWeb)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'appId', keys: ['appId'] },
+    ]));
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.token_endpoint`,
+      value: publicString(configPublic, ['tokenEndpoint', 'accessTokenEndpoint', 'endpoint']),
+      allowedHosts: ['weixin.qq.com'],
+      details,
+    });
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.userinfo_endpoint`,
+      value: publicString(configPublic, ['userInfoEndpoint', 'userinfoEndpoint']),
+      allowedHosts: ['weixin.qq.com'],
+      details,
+    });
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.redirect_uri`,
+      value: publicString(configPublic, ['redirectUri', 'callbackUrl']),
+      details,
+    });
+    return;
+  }
+
+  if (providerIn(provider, AUTH_PROVIDER_ALIASES.qq)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'appId/clientId', keys: ['appId', 'clientId'] },
+      { label: 'redirectUri/callbackUrl', keys: ['redirectUri', 'callbackUrl'] },
+    ]));
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.redirect_uri`,
+      value: publicString(configPublic, ['redirectUri', 'callbackUrl']),
+      required: true,
+      details,
+    });
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.token_endpoint`,
+      value: publicString(configPublic, ['tokenEndpoint', 'accessTokenEndpoint', 'endpoint']),
+      allowedHosts: ['graph.qq.com'],
+      details,
+    });
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.openid_endpoint`,
+      value: publicString(configPublic, ['openIdEndpoint', 'openidEndpoint']),
+      allowedHosts: ['graph.qq.com'],
+      details,
+    });
+    validateProviderUrl({
+      id: `db.auth.${safeProviderName(row.provider)}.userinfo_endpoint`,
+      value: publicString(configPublic, ['userInfoEndpoint', 'userinfoEndpoint']),
+      allowedHosts: ['graph.qq.com'],
+      details,
+    });
+    return;
+  }
+
+  block('db.auth.unsupported_provider', 'Active/testing auth provider is not in the supported production provider list', details);
+}
+
+function validatePaymentProviderPublicConfig(row) {
+  const provider = normalizeProvider(row.provider);
+  const configPublic = row.config_public || {};
+  const details = { tenantId: row.tenant_id, provider: row.provider };
+
+  if (providerIn(provider, PAYMENT_PROVIDER_ALIASES.manual)) {
+    warn('db.payment.manual_provider', 'Manual payment account is active; use only for offline collection or migration operations', details);
+    return;
+  }
+
+  if (providerIn(provider, PAYMENT_PROVIDER_ALIASES.wechatPay)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'appId', keys: ['appId'] },
+      { label: 'merchantId/mchId', keys: ['merchantId', 'mchId'] },
+      { label: 'merchantSerialNo', keys: ['merchantSerialNo'] },
+      { label: 'notifyUrl', keys: ['notifyUrl'] },
+    ]));
+    validateProviderUrl({
+      id: `db.payment.${safeProviderName(row.provider)}.notify_url`,
+      value: publicString(configPublic, ['notifyUrl']),
+      required: true,
+      details,
+    });
+    validateProviderUrl({
+      id: `db.payment.${safeProviderName(row.provider)}.refund_notify_url`,
+      value: publicString(configPublic, ['refundNotifyUrl']),
+      details,
+    });
+    for (const [key, allowedHosts] of [
+      ['endpoint', ['api.mch.weixin.qq.com']],
+      ['refundEndpoint', ['api.mch.weixin.qq.com']],
+      ['refundQueryEndpoint', ['api.mch.weixin.qq.com']],
+    ]) {
+      validateProviderUrl({
+        id: `db.payment.${safeProviderName(row.provider)}.${key}`,
+        value: publicString(configPublic, [key]),
+        allowedHosts,
+        details,
+      });
+    }
+    return;
+  }
+
+  if (providerIn(provider, PAYMENT_PROVIDER_ALIASES.alipay)) {
+    blockMissingPublicConfig(row, missingPublicKeyGroups(configPublic, [
+      { label: 'appId', keys: ['appId'] },
+      { label: 'notifyUrl', keys: ['notifyUrl'] },
+    ]));
+    validateProviderUrl({
+      id: `db.payment.${safeProviderName(row.provider)}.notify_url`,
+      value: publicString(configPublic, ['notifyUrl']),
+      required: true,
+      details,
+    });
+    validateProviderUrl({
+      id: `db.payment.${safeProviderName(row.provider)}.return_url`,
+      value: publicString(configPublic, ['returnUrl']),
+      details,
+    });
+    validateProviderUrl({
+      id: `db.payment.${safeProviderName(row.provider)}.quit_url`,
+      value: publicString(configPublic, ['quitUrl']),
+      details,
+    });
+    for (const [key, allowedHosts] of [
+      ['endpoint', ['openapi.alipay.com']],
+      ['refundEndpoint', ['openapi.alipay.com']],
+      ['refundQueryEndpoint', ['openapi.alipay.com']],
+    ]) {
+      validateProviderUrl({
+        id: `db.payment.${safeProviderName(row.provider)}.${key}`,
+        value: publicString(configPublic, [key]),
+        allowedHosts,
+        details,
+      });
+    }
+    return;
+  }
+
+  block('db.payment.unsupported_provider', 'Active payment account is not in the supported production provider list', details);
+}
+
+function validateProviderConfigRows(inputRows) {
+  const rows = inputRows.map(row => ({
+    source: row.source,
+    tenant_id: row.tenant_id || row.tenantId || 'fixture-tenant',
+    provider: row.provider,
+    config_public: row.config_public || row.configPublic || {},
+  }));
+  if (rows.length === 0) {
+    warn('db.provider_fixture.empty', 'Provider config fixture did not contain any rows');
+    return;
+  }
+  for (const row of rows) {
+    const secretPaths = findSecretLikePaths(row.config_public || {});
+    if (secretPaths.length > 0) {
+      block(`db.${row.source}.${safeProviderName(row.provider)}.public_secret`, 'Provider public config contains secret-like keys', {
+        tenantId: row.tenant_id,
+        provider: row.provider,
+        secretPathCount: secretPaths.length,
+      });
+    }
+    if (row.source === 'auth') validateAuthProviderPublicConfig(row);
+    else if (row.source === 'payment') validatePaymentProviderPublicConfig(row);
+    else block('db.provider_fixture.source', 'Provider config fixture row source must be auth or payment', { source: row.source });
+  }
+  if (rows.every(row => findSecretLikePaths(row.config_public || {}).length === 0)) {
+    pass('db.provider_public_config', 'Active provider public configs do not contain secret-like keys');
+  }
+}
+
 function isSecretLikeKey(key) {
  const normalized = key.toLowerCase().replace(/[-_\s]/g, '');
  const allowedSecretRef = normalized === 'secretref' || normalized.endsWith('secretref');
@@ -177,9 +505,14 @@ function validateEnv() {
    }
  }

-  const authSmsProvider = env('AUTH_SMS_PROVIDER', 'mock');
-  if (authSmsProvider === 'mock') block('env.auth_sms_provider', 'AUTH_SMS_PROVIDER=mock is not allowed in production');
-  else pass('env.auth_sms_provider', 'AUTH_SMS_PROVIDER is not mock');
+  const authSmsProvider = env('AUTH_SMS_PROVIDER', 'mock').trim().toLowerCase();
+  if (!PRODUCTION_SMS_PROVIDERS.has(authSmsProvider)) {
+    block('env.auth_sms_provider', 'AUTH_SMS_PROVIDER must be aliyun/aliyun-sms or tencent/tencent-sms in production', {
+      provider: authSmsProvider || '(empty)',
+    });
+  } else {
+    pass('env.auth_sms_provider', 'AUTH_SMS_PROVIDER is a supported production SMS provider', { provider: authSmsProvider });
+  }

  if (isUnsafeSecret(env('AUTH_CODE_PEPPER', DEFAULT_AUTH_CODE_PEPPER), DEFAULT_AUTH_CODE_PEPPER)) {
    block('env.auth_code_pepper', 'AUTH_CODE_PEPPER must be a strong production secret');
@@ -239,9 +572,13 @@ function validateEnv() {
    pass('env.body_size', 'JSON body limits are bounded');
  }

-  const storageProvider = env('STORAGE_DEFAULT_PROVIDER', 'local_dev');
+  const storageProvider = env('STORAGE_DEFAULT_PROVIDER', 'local_dev').trim();
  if (storageProvider === 'local_dev') {
    block('env.storage_provider', 'STORAGE_DEFAULT_PROVIDER=local_dev is not allowed for production assets');
+  } else if (!PRODUCTION_STORAGE_PROVIDERS.has(storageProvider)) {
+    block('env.storage_provider.unsupported', 'STORAGE_DEFAULT_PROVIDER must be aliyun_oss, tencent_cos or supabase_storage in production', {
+      provider: storageProvider || '(empty)',
+    });
  } else {
    pass('env.storage_provider', 'STORAGE_DEFAULT_PROVIDER is production-capable', { provider: storageProvider });
  }
@@ -255,11 +592,24 @@ function validateEnv() {
  } else {
    pass('env.storage_tenant_prefix', 'tenant-prefixed object keys are required');
  }
+  if (env('STORAGE_PUBLIC_BASE_URL', '') && !isProductionHttpsUrl(env('STORAGE_PUBLIC_BASE_URL', ''))) {
+    block('env.storage_public_base_url', 'STORAGE_PUBLIC_BASE_URL must be a production HTTPS URL when configured');
+  }

  if (storageProvider === 'aliyun_oss') {
    for (const key of ['ALIYUN_OSS_REGION', 'ALIYUN_OSS_ENDPOINT', 'ALIYUN_OSS_ACCESS_KEY_ID', 'ALIYUN_OSS_ACCESS_KEY_SECRET']) {
      if (!env(key, '')) block(`env.${key.toLowerCase()}`, `${key} is required for aliyun_oss`);
    }
+    validateProviderUrl({
+      id: 'env.aliyun_oss_endpoint',
+      value: env('ALIYUN_OSS_ENDPOINT', ''),
+      message: 'ALIYUN_OSS_ENDPOINT must be a production HTTPS endpoint',
+      allowedHosts: ['aliyuncs.com'],
+      required: true,
+    });
+    if (envBool('ALIYUN_OSS_INTERNAL', false)) {
+      block('env.aliyun_oss_internal', 'ALIYUN_OSS_INTERNAL=true is not allowed for user-facing production signed URLs');
+    }
  }
  if (storageProvider === 'tencent_cos') {
    for (const key of ['TENCENT_COS_REGION', 'TENCENT_COS_APP_ID', 'TENCENT_COS_SECRET_ID', 'TENCENT_COS_SECRET_KEY']) {
@@ -270,6 +620,12 @@ function validateEnv() {
    for (const key of ['SUPABASE_STORAGE_URL', 'SUPABASE_STORAGE_SERVICE_KEY']) {
      if (!env(key, '')) block(`env.${key.toLowerCase()}`, `${key} is required for supabase_storage`);
    }
+    validateProviderUrl({
+      id: 'env.supabase_storage_url',
+      value: env('SUPABASE_STORAGE_URL', ''),
+      message: 'SUPABASE_STORAGE_URL must be a production HTTPS URL',
+      required: true,
+    });
  }

  if (envList('STORAGE_ALLOWED_MIME_TYPES').includes('application/octet-stream')) {
@@ -389,6 +745,8 @@ async function validateDatabase() {
          secretPathCount: secretPaths.length,
        });
      }
+      if (row.source === 'auth') validateAuthProviderPublicConfig(row);
+      if (row.source === 'payment') validatePaymentProviderPublicConfig(row);
    }
    if (publicSecretRows.rows.every(row => findSecretLikePaths(row.config_public || {}).length === 0)) {
      pass('db.provider_public_config', 'Active provider public configs do not contain secret-like keys');
@@ -721,6 +1079,12 @@ function printSummary() {
 async function main() {
  loadEnvFile(envFile);
  validateEnv();
+  if (providerConfigFixture) {
+    const fixturePath = path.resolve(process.cwd(), providerConfigFixture);
+    const fixture = JSON.parse(fs.readFileSync(fixturePath, 'utf8'));
+    const rows = Array.isArray(fixture) ? fixture : Array.isArray(fixture.rows) ? fixture.rows : [];
+    validateProviderConfigRows(rows);
+  }
  await validateDatabase();
  printSummary();