chore: add PNVS provider diagnostics

scripts/diagnose-aliyun-pnvs-provider-test.js

@@ -0,0 +1,101 @@
+import assert from 'node:assert/strict';
+import {
+  diagnoseAliyunPnvsProvider,
+  parseSecretRef,
+  summarizeSecret,
+} from './diagnose-aliyun-pnvs-provider.js';
+
+const tenantId = '00000000-0000-0000-0000-000000000001';
+
+function queryFixture({ providerRows = [], secretRows = [] }) {
+  return async (sql, params) => {
+    if (sql.includes('from public.tenant_auth_providers')) {
+      assert.equal(params[0], tenantId);
+      return { rows: providerRows };
+    }
+    if (sql.includes('from app_private.tenant_secrets')) {
+      assert.equal(params[0], tenantId);
+      return {
+        rows: secretRows.filter(row => row.scope === params[1] && row.key === params[2]),
+      };
+    }
+    throw new Error(`Unexpected SQL: ${sql}`);
+  };
+}
+
+const goodProviderRows = [
+  {
+    tenantId,
+    provider: 'aliyun-pnvs',
+    status: 'active',
+    displayName: '阿里云短信认证',
+    updatedAt: '2026-07-03T00:00:00.000Z',
+    configPublic: {
+      signName: '升本刷题通',
+      templateCode: 'SMS_123456789',
+      endpoint: 'https://dypnsapi.aliyuncs.com',
+      regionId: 'cn-hangzhou',
+      countryCode: '86',
+      codeType: '1',
+      codeLength: '6',
+      validTime: '300',
+      interval: '60',
+      templateParam: { code: '##code##', min: '5' },
+      secretRef: 'app_private.tenant_secrets:sms:aliyun-pnvs',
+    },
+  },
+];
+const goodSecretRows = [
+  {
+    scope: 'sms',
+    key: 'aliyun-pnvs',
+    provider: 'aliyun-pnvs',
+    accessKeyId: 'LTAI5tExampleId',
+    accessKeySecret: 'very-long-secret-value-that-must-not-leak',
+    lastRotatedAt: '2026-07-03T00:00:00.000Z',
+  },
+];
+
+const ok = await diagnoseAliyunPnvsProvider(
+  { databaseUrl: 'postgresql://example', tenantId, authSmsProvider: 'aliyun-pnvs' },
+  { query: queryFixture({ providerRows: goodProviderRows, secretRows: goodSecretRows }) },
+);
+
+assert.equal(ok.ok, true);
+assert.equal(ok.provider.found, true);
+assert.equal(ok.provider.publicConfig.templateParamHasCodePlaceholder, true);
+assert.equal(ok.secret.found, true);
+assert.equal(ok.secret.accessKeySecretLength, goodSecretRows[0].accessKeySecret.length);
+assert.ok(!JSON.stringify(ok).includes(goodSecretRows[0].accessKeySecret), 'diagnostic output must not include AccessKeySecret plaintext');
+assert.ok(!JSON.stringify(ok).includes(goodSecretRows[0].accessKeyId), 'diagnostic output should mask AccessKeyId plaintext');
+assert.match(ok.secret.accessKeyIdMasked, /^LTAI\.\.\./);
+
+const missingSecret = await diagnoseAliyunPnvsProvider(
+  { databaseUrl: 'postgresql://example', tenantId, authSmsProvider: 'aliyun-pnvs' },
+  { query: queryFixture({ providerRows: goodProviderRows, secretRows: [] }) },
+);
+assert.equal(missingSecret.ok, false);
+assert.ok(missingSecret.checks.some(item => item.id === 'db.tenant_secret' && item.status === 'blocker'));
+
+const wrongEnvProvider = await diagnoseAliyunPnvsProvider(
+  { databaseUrl: 'postgresql://example', tenantId, authSmsProvider: 'aliyun' },
+  { query: queryFixture({ providerRows: goodProviderRows, secretRows: goodSecretRows }) },
+);
+assert.equal(wrongEnvProvider.ok, false);
+assert.ok(wrongEnvProvider.checks.some(item => item.id === 'env.auth_sms_provider' && item.status === 'blocker'));
+
+const invalidSecretRef = parseSecretRef('plain-secret');
+assert.equal(invalidSecretRef.valid, false);
+assert.equal(invalidSecretRef.scope, 'sms');
+assert.equal(invalidSecretRef.key, 'aliyun-pnvs');
+
+const secretSummary = summarizeSecret({
+  provider: 'aliyun-pnvs',
+  accessKeyId: '  LTAI5tExampleId',
+  accessKeySecret: 'secret-value  ',
+});
+assert.equal(secretSummary.accessKeyIdHasEdgeWhitespace, true);
+assert.equal(secretSummary.accessKeySecretHasEdgeWhitespace, true);
+assert.ok(!JSON.stringify(secretSummary).includes('secret-value  '));
+
+console.log('[PASS] diagnose Aliyun PNVS provider script');