release: 1.1.12

2026-09-02 20:23:46 +08:00
parent c518890fc3
commit 344985f514
13 changed files with 597 additions and 58 deletions
@@ -0,0 +1,111 @@
+import { describe, expect, it } from "vitest";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import Database from "better-sqlite3";
+
+const root = path.resolve(process.cwd());
+const cli = path.join(root, "server", "cli", "admin-init.ts");
+const tsx = path.join(root, "node_modules", "tsx", "dist", "cli.mjs");
+
+function runAdmin(dataDir: string, args: string[]) {
+  return spawnSync(process.execPath, [tsx, cli, ...args], {
+    cwd: root,
+    env: {
+      ...process.env,
+      NODE_ENV: "test",
+      TALLYNOTE_DATA_DIR: dataDir,
+      TALLYNOTE_PUBLIC_ORIGIN: "http://127.0.0.1:3999",
+      TALLYNOTE_COOKIE_SECURE: "false",
+      TALLYNOTE_UPDATE_STRATEGY: "disabled",
+    },
+    encoding: "utf8",
+  });
+}
+
+describe("生产管理员初始化 CLI", () => {
+  it("--check 是只读的，空数据目录不会被创建", () => {
+    const parent = mkdtempSync(path.join(tmpdir(), "tallynote-admin-check-"));
+    const dataDir = path.join(parent, "data");
+    try {
+      const result = runAdmin(dataDir, ["--check"]);
+      expect(result.status).toBe(0);
+      expect(result.stdout.trim()).toBe("empty");
+      expect(existsSync(dataDir)).toBe(false);
+      expect(existsSync(path.join(dataDir, "tallynote.db"))).toBe(false);
+    } finally {
+      rmSync(parent, { recursive: true, force: true });
+    }
+  });
+
+  it("--check 不会执行迁移或创建 schema_migrations", () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-admin-check-"));
+    const database = new Database(path.join(dataDir, "tallynote.db"));
+    database.exec("CREATE TABLE admins (id TEXT PRIMARY KEY)");
+    database.close();
+    try {
+      const result = runAdmin(dataDir, ["--check"]);
+      expect(result.status).toBe(0);
+      expect(result.stdout.trim()).toBe("empty");
+      const verify = new Database(path.join(dataDir, "tallynote.db"), { readonly: true });
+      const schemaMigrations = verify
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'")
+        .get();
+      expect(schemaMigrations).toBeUndefined();
+      verify.close();
+    } finally {
+      rmSync(dataDir, { recursive: true, force: true });
+    }
+  });
+
+  it("只允许初始化首位管理员，并写入一次性密码和审计记录", () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-admin-init-"));
+    try {
+      const first = runAdmin(dataDir, ["--username", "admin", "--display-name", "管理员", "--generate"]);
+      expect(first.status).toBe(0);
+      expect(first.stdout).toMatch(/已创建首位管理员。一次性密码：\S+/);
+
+      const database = new Database(path.join(dataDir, "tallynote.db"));
+      const admin = database.prepare("SELECT username, display_name, must_change_password FROM admins").get() as { username: string; display_name: string; must_change_password: number };
+      const audit = database.prepare("SELECT action, actor_username FROM audit_events ORDER BY occurred_at DESC LIMIT 1").get() as { action: string; actor_username: string };
+      expect(admin).toEqual({ username: "admin", display_name: "管理员", must_change_password: 1 });
+      expect(audit).toEqual({ action: "admin.initialized", actor_username: "cli" });
+      database.close();
+
+      const check = runAdmin(dataDir, ["--check"]);
+      expect(check.status).toBe(0);
+      expect(check.stdout.trim()).toBe("initialized");
+
+      const second = runAdmin(dataDir, ["--username", "other", "--display-name", "其他", "--generate"]);
+      expect(second.status).not.toBe(0);
+      expect(`${second.stdout}${second.stderr}`).toContain("INITIAL_ADMIN_EXISTS");
+    } finally {
+      rmSync(dataDir, { recursive: true, force: true });
+    }
+  }, 15_000);
+
+  it("密码输入不是 TTY 时明确拒绝通过管道传入", () => {
+    const dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-admin-init-"));
+    try {
+      const result = spawnSync(process.execPath, [tsx, cli], {
+        cwd: root,
+        input: "admin\n管理员\npassword-password\npassword-password\n",
+        env: {
+          ...process.env,
+          NODE_ENV: "test",
+          TALLYNOTE_DATA_DIR: dataDir,
+          TALLYNOTE_PUBLIC_ORIGIN: "http://127.0.0.1:3999",
+          TALLYNOTE_COOKIE_SECURE: "false",
+          TALLYNOTE_UPDATE_STRATEGY: "disabled",
+        },
+        encoding: "utf8",
+      });
+      expect(result.status).not.toBe(0);
+      expect(`${result.stdout}${result.stderr}`).toContain("交互式 TTY");
+      expect(readFileSync(path.join(dataDir, "tallynote.db"))).toBeTruthy();
+    } finally {
+      rmSync(dataDir, { recursive: true, force: true });
+    }
+  });
+});