forked from wangziqi/gongxue-base
84 lines
3.8 KiB
JavaScript
84 lines
3.8 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { pathToFileURL } from 'node:url';
|
|
|
|
const repoRoot = process.cwd();
|
|
const apiConfigUrl = pathToFileURL(`${repoRoot}/apps/api/src/core/config.ts`).href;
|
|
const workerConfigUrl = pathToFileURL(`${repoRoot}/apps/worker/src/config.ts`).href;
|
|
|
|
const safeBaseEnv = {
|
|
NODE_ENV: 'production',
|
|
DATABASE_URL: 'postgresql://prod_user:prod_password@db.prod.internal:5432/tiku',
|
|
STORAGE_DEFAULT_PROVIDER: 'aliyun_oss',
|
|
STORAGE_DEFAULT_BUCKET: 'tiku-assets',
|
|
STORAGE_REQUIRE_TENANT_PREFIX: 'true',
|
|
ALIYUN_OSS_REGION: 'cn-hangzhou',
|
|
ALIYUN_OSS_ENDPOINT: 'https://oss-cn-hangzhou.aliyuncs.com',
|
|
ALIYUN_OSS_ACCESS_KEY_ID: 'LTAI_PRODUCTION_CONFIG_TEST_ONLY',
|
|
ALIYUN_OSS_ACCESS_KEY_SECRET: 'aliyun-production-config-secret-placeholder',
|
|
WORKER_ASSET_SECURITY_SCANNER: 'metadata_rules,http',
|
|
WORKER_ASSET_SECURITY_SCAN_HTTP_ENDPOINT: 'https://scanner.gongxue100.com/api/scan',
|
|
WORKER_ASSET_SECURITY_SCAN_HTTP_TOKEN: 's3cure-asset-scanner-token-2026-06-30-abcdef',
|
|
WORKER_ASSET_SECURITY_SCAN_FAIL_OPEN: 'false',
|
|
};
|
|
|
|
const safeApiEnv = {
|
|
...safeBaseEnv,
|
|
CORS_ORIGIN: 'https://student.gongxue100.com,https://tenant-admin.gongxue100.com,https://platform-admin.gongxue100.com',
|
|
AUTH_SMS_PROVIDER: 'aliyun',
|
|
AUTH_CODE_PEPPER: 's3cure-prod-code-pepper-2026-06-30-abcdef',
|
|
AUTH_SESSION_SECRET: 's3cure-prod-session-secret-2026-06-30-ghijkl',
|
|
AUTH_JWT_JWKS_URL: 'https://auth.gongxue100.com/auth/v1/.well-known/jwks.json',
|
|
ALLOW_LEGACY_AUTH_HEADERS: 'false',
|
|
ALLOW_PLATFORM_ADMIN_KEY: 'false',
|
|
PLATFORM_ADMIN_API_KEY: 's3cure-platform-admin-key-2026-06-30-mnopqr',
|
|
};
|
|
|
|
function runImport(moduleUrl, env) {
|
|
const result = spawnSync(process.execPath, ['--import', 'tsx', '-e', `await import(${JSON.stringify(moduleUrl)})`], {
|
|
cwd: repoRoot,
|
|
encoding: 'utf8',
|
|
env: {
|
|
PATH: process.env.PATH || '',
|
|
Path: process.env.Path || '',
|
|
SystemRoot: process.env.SystemRoot || '',
|
|
ComSpec: process.env.ComSpec || '',
|
|
TEMP: process.env.TEMP || '',
|
|
TMP: process.env.TMP || '',
|
|
...env,
|
|
},
|
|
});
|
|
return { ...result, output: `${result.stdout || ''}${result.stderr || ''}` };
|
|
}
|
|
|
|
const unsafeApi = runImport(apiConfigUrl, {
|
|
...safeApiEnv,
|
|
STORAGE_DEFAULT_PROVIDER: 'local_dev',
|
|
});
|
|
assert.notEqual(unsafeApi.status, 0, 'production API config should reject local_dev storage');
|
|
assert.match(unsafeApi.output, /Invalid production API configuration/, 'API config should explain production config failure');
|
|
assert.match(unsafeApi.output, /STORAGE_DEFAULT_PROVIDER=local_dev/, 'API config should name unsafe storage provider');
|
|
|
|
const safeApi = runImport(apiConfigUrl, safeApiEnv);
|
|
assert.equal(safeApi.status, 0, `safe production API config should load: ${safeApi.output}`);
|
|
|
|
const unsafeWorker = runImport(workerConfigUrl, {
|
|
...safeBaseEnv,
|
|
STORAGE_DEFAULT_PROVIDER: 'local_dev',
|
|
});
|
|
assert.notEqual(unsafeWorker.status, 0, 'production worker config should reject local_dev storage');
|
|
assert.match(unsafeWorker.output, /Invalid production worker configuration/, 'worker config should explain production config failure');
|
|
assert.match(unsafeWorker.output, /STORAGE_DEFAULT_PROVIDER=local_dev/, 'worker config should name unsafe storage provider');
|
|
|
|
const unsafeWorkerScanner = runImport(workerConfigUrl, {
|
|
...safeBaseEnv,
|
|
WORKER_ASSET_SECURITY_SCANNER: 'metadata_rules',
|
|
});
|
|
assert.notEqual(unsafeWorkerScanner.status, 0, 'production worker config should require external scanner');
|
|
assert.match(unsafeWorkerScanner.output, /WORKER_ASSET_SECURITY_SCANNER must include http/, 'worker config should require http scanner');
|
|
|
|
const safeWorker = runImport(workerConfigUrl, safeBaseEnv);
|
|
assert.equal(safeWorker.status, 0, `safe production worker config should load: ${safeWorker.output}`);
|
|
|
|
console.log('[PASS] production config fail-fast');
|