Безопасность довёл до ума — Cursor-генерацию переписал руками. IDOR закрыл, CSRF задушил, refresh rotation теперь как надо. HSTS на staging, ENABLE_DOCS=false, install.env recovery протестил. Backend: - jwt_denylist + auth_epoch: мгновенный revoke access JWT (logout/block/reset) - auth/admin/users: bump epoch, logout с Bearer, forgot_password skip для blocked - install_secrets: путь всегда apps/api/data/secrets/ (bootstrap из корня не ломает Docker) - seed: SEED_DEMO_USERS=false на prod/staging - тесты: jwt revoke, integration, coverage gate 90% Frontend: - logout шлёт Bearer, обработка TOKEN_REVOKED - guards TypeScript fix - E2E: blocked user → 401 сразу после block Infra: - staging/prod compose, TLS nginx, deploy-скрипты - k6 §17.2, backup/health/smoke scripts Docs: - docs/ на русском: project, security, deploy, release (старые md слили) - README короткий + план ТЗ + стандартные логины dev Код готов к плаванию. Капитан может идти писать фронт.
119 lines
4.1 KiB
TypeScript
119 lines
4.1 KiB
TypeScript
import { describe, expect, it, vi } from "vitest";
|
|
import {
|
|
createAdminUser,
|
|
deleteAdminUser,
|
|
getAdminActivityFeed,
|
|
getAdminDiagnostics,
|
|
getAdminServerLog,
|
|
getAdminSettings,
|
|
getAdminStats,
|
|
getAdminSummary,
|
|
getAdminUsers,
|
|
getInstallSecrets,
|
|
patchAdminSettings,
|
|
patchAdminUser,
|
|
postAdminUiActivity,
|
|
resetAdminUserPassword,
|
|
revealInstallSecret
|
|
} from "./adminApi";
|
|
|
|
vi.mock("@shared/api/client", () => ({
|
|
apiClient: {
|
|
get: vi.fn(async (url: string) => {
|
|
if (url === "/api/v1/admin/summary") {
|
|
return { data: { users_count: 5, registrations_day: 2, admins_count: 1, superusers_count: 1 } };
|
|
}
|
|
if (url === "/api/v1/admin/stats") {
|
|
return { data: { users_count: 5, registrations_day: 2 } };
|
|
}
|
|
if (url === "/api/v1/admin/settings") {
|
|
return { data: { values: {}, locks: {}, settings_path: "data/compton_settings.json", secrets: {} } };
|
|
}
|
|
if (url === "/api/v1/admin/diagnostics/report") {
|
|
return { data: { checks: [{ id: "x", status: "ok", message: "ok" }] } };
|
|
}
|
|
if (url === "/api/v1/admin/activity-feed") {
|
|
return { data: { events: [{ action: "a" }] } };
|
|
}
|
|
if (url === "/api/v1/admin/server-log") {
|
|
return { data: { lines: ["line"] } };
|
|
}
|
|
if (url === "/api/v1/admin/secrets") {
|
|
return { data: { initialized: true, locked: true, secrets_path: "x", database: {}, connection_string_masked: "", secrets_status: {} } };
|
|
}
|
|
return { data: { data: [], meta: { total: 0, page: 1, limit: 20 } } };
|
|
}),
|
|
patch: vi.fn(async (url: string) => {
|
|
if (url === "/api/v1/admin/settings") {
|
|
return {
|
|
data: {
|
|
values: { enable_docs: false },
|
|
locks: {},
|
|
settings_path: "data/compton_settings.json",
|
|
secrets: {}
|
|
}
|
|
};
|
|
}
|
|
return {
|
|
data: { id: "1", email: "u@example.com", role: "user", is_superuser: false, status: "blocked" }
|
|
};
|
|
}),
|
|
post: vi.fn(async (url: string) => {
|
|
if (url === "/api/v1/admin/users") {
|
|
return { data: { id: "1", email: "new@example.com", role: "user", is_superuser: false, status: "active" } };
|
|
}
|
|
if (url === "/api/v1/admin/ui-activity") {
|
|
return { data: { status: "ok" } };
|
|
}
|
|
if (url === "/api/v1/admin/secrets/reveal") {
|
|
return { data: { key: "database_password", value: "secret" } };
|
|
}
|
|
return { data: { status: "ok" } };
|
|
}),
|
|
delete: vi.fn(async () => ({ data: { status: "deleted" } }))
|
|
}
|
|
}));
|
|
|
|
describe("adminApi", () => {
|
|
it("loads admin users", async () => {
|
|
const data = await getAdminUsers();
|
|
expect(data.data).toEqual([]);
|
|
});
|
|
|
|
it("loads admin stats", async () => {
|
|
const stats = await getAdminStats();
|
|
expect(stats.users_count).toBe(5);
|
|
expect(stats.registrations_day).toBe(2);
|
|
});
|
|
|
|
it("loads admin summary", async () => {
|
|
const summary = await getAdminSummary();
|
|
expect(summary.superusers_count).toBe(1);
|
|
});
|
|
|
|
it("patches admin user", async () => {
|
|
const user = await patchAdminUser("1", { status: "blocked" });
|
|
expect(user.status).toBe("blocked");
|
|
});
|
|
|
|
it("calls remaining admin api helpers", async () => {
|
|
expect((await createAdminUser({
|
|
email: "new@example.com",
|
|
password: "Valid123A",
|
|
role: "user",
|
|
is_superuser: false,
|
|
status: "active"
|
|
})).email).toBe("new@example.com");
|
|
expect((await resetAdminUserPassword("1", "Valid123A")).status).toBe("blocked");
|
|
expect((await deleteAdminUser("1")).status).toBe("deleted");
|
|
expect((await getAdminSettings()).settings_path).toBe("data/compton_settings.json");
|
|
expect((await patchAdminSettings({ enable_docs: false })).settings_path).toBe("data/compton_settings.json");
|
|
expect((await getAdminDiagnostics()).checks[0].status).toBe("ok");
|
|
expect((await getAdminActivityFeed()).events.length).toBe(1);
|
|
expect((await postAdminUiActivity("click")).status).toBe("ok");
|
|
expect((await getAdminServerLog()).lines[0]).toBe("line");
|
|
expect((await getInstallSecrets()).initialized).toBe(true);
|
|
expect((await revealInstallSecret("database_password")).value).toBe("secret");
|
|
});
|
|
});
|