+
@foreach ($errors->all() as $error)
{{ $error }}
@endforeach
@endif
-
diff --git a/tests/Feature/SystemSettings/UpstreamDatabasesTest.php b/tests/Feature/SystemSettings/UpstreamDatabasesTest.php
index d1db8540..775e6716 100644
--- a/tests/Feature/SystemSettings/UpstreamDatabasesTest.php
+++ b/tests/Feature/SystemSettings/UpstreamDatabasesTest.php
@@ -6,6 +6,7 @@ use App\Models\Auth\Permission;
use App\Models\Auth\Role;
use App\Models\Settings\DatabaseConnection;
use App\Utilities\SystemDatabaseConfiguration;
+use App\Utilities\TeamSystemDatabaseProfile;
use App\Utilities\UpstreamCredentialCipher;
use Illuminate\Encryption\Encrypter;
use Illuminate\Support\Facades\DB;
@@ -250,7 +251,11 @@ class UpstreamDatabasesTest extends FeatureTestCase
$this->get(route('system-settings.databases.system.edit'))
->assertOk()
- ->assertSeeText('测试并安全切换');
+ ->assertSeeText('连接系统数据库')
+ ->assertSee('name="password"', false)
+ ->assertDontSee('name="host"', false)
+ ->assertDontSeeText('要求 TLS 加密连接')
+ ->assertDontSeeText('CA 证书路径');
}
public function test_database_page_separates_system_and_cloud_database_configuration(): void
@@ -272,7 +277,9 @@ class UpstreamDatabasesTest extends FeatureTestCase
$this->get(route('system-settings.databases.system.edit'))
->assertOk()
- ->assertSeeText('测试并安全切换')
+ ->assertSeeText('连接系统数据库')
+ ->assertDontSee('name="host"', false)
+ ->assertDontSee('name="tls_required"', false)
->assertDontSee('system-database-test-secret');
}
@@ -324,42 +331,37 @@ class UpstreamDatabasesTest extends FeatureTestCase
->assertDontSeeText('添加云数据库');
}
- public function test_first_switch_requires_password_when_connection_identity_changes(): void
+ public function test_first_switch_only_requires_system_database_password(): void
{
config(['system_database.mode' => 'bootstrap']);
$this->withExceptionHandling();
$this->loginAs()
->patch(route('system-settings.databases.system.update'), [
- 'host' => 'shared-db.test',
- 'port' => 3306,
- 'database' => 'shared_system',
- 'username' => 'shared_writer',
'password' => '',
- 'tls_required' => '1',
- 'tls_verify_server_cert' => '0',
])
->assertSessionHasErrors('password');
}
+ public function test_wrong_system_database_password_stays_on_the_form(): void
+ {
+ config(['system_database.mode' => 'bootstrap']);
+ $this->withExceptionHandling();
+
+ $this->loginAs()
+ ->from(route('system-settings.databases.system.edit'))
+ ->patch(route('system-settings.databases.system.update'), [
+ 'password' => 'definitely-not-the-team-password',
+ ])
+ ->assertRedirect(route('system-settings.databases.system.edit'))
+ ->assertSessionHasErrors([
+ 'password' => '系统数据库密码不正确，请重新输入。',
+ ]);
+ }
+
public function test_successful_system_database_switch_invalidates_bootstrap_session(): void
{
- $current = [
- 'connection' => 'sqlite',
- 'driver' => 'sqlite',
- 'host' => 'local-bootstrap',
- 'port' => 3306,
- 'database' => 'bootstrap',
- 'username' => 'bootstrap',
- 'password' => 'bootstrap-secret',
- 'prefix' => '',
- 'mode' => 'bootstrap',
- 'tls_required' => false,
- 'tls_verify_server_cert' => false,
- 'tls_ca' => '',
- ];
$configuration = Mockery::mock(SystemDatabaseConfiguration::class);
- $configuration->shouldReceive('current')->once()->andReturn($current);
$configuration->shouldReceive('probe')->once()->andReturn([
'cipher' => 'TLS_AES_256_GCM_SHA384',
'user_count' => 7,
@@ -369,23 +371,58 @@ class UpstreamDatabasesTest extends FeatureTestCase
]);
$configuration->shouldReceive('persist')->once();
$this->app->instance(SystemDatabaseConfiguration::class, $configuration);
+ $teamProfile = Mockery::mock(TeamSystemDatabaseProfile::class);
+ $teamProfile->shouldReceive('settings')->once()->with('new-shared-secret')->andReturn([
+ 'driver' => 'mysql',
+ 'host' => 'shared-db.test',
+ 'port' => 3306,
+ 'database' => 'shared_system',
+ 'username' => 'shared_writer',
+ 'password' => 'new-shared-secret',
+ 'tls_required' => true,
+ 'tls_verify_server_cert' => false,
+ 'tls_ca' => '',
+ ]);
+ $this->app->instance(TeamSystemDatabaseProfile::class, $teamProfile);
$this->loginAs()
->patch(route('system-settings.databases.system.update'), [
- 'host' => 'shared-db.test',
- 'port' => 3306,
- 'database' => 'shared_system',
- 'username' => 'shared_writer',
'password' => 'new-shared-secret',
- 'tls_required' => '1',
- 'tls_verify_server_cert' => '0',
- 'tls_ca' => '',
])
->assertRedirect(route('login'));
$this->assertGuest();
}
+ public function test_unexpected_system_database_error_returns_to_form_instead_of_500(): void
+ {
+ $this->withExceptionHandling();
+ $configuration = Mockery::mock(SystemDatabaseConfiguration::class);
+ $configuration->shouldReceive('probe')->once()->andThrow(new \LogicException('internal detail'));
+ $this->app->instance(SystemDatabaseConfiguration::class, $configuration);
+ $teamProfile = Mockery::mock(TeamSystemDatabaseProfile::class);
+ $teamProfile->shouldReceive('settings')->once()->andReturn([
+ 'driver' => 'mysql',
+ 'host' => 'shared-db.test',
+ 'port' => 3306,
+ 'database' => 'shared_system',
+ 'username' => 'shared_writer',
+ 'password' => 'new-shared-secret',
+ 'tls_required' => true,
+ 'tls_verify_server_cert' => false,
+ 'tls_ca' => '',
+ ]);
+ $this->app->instance(TeamSystemDatabaseProfile::class, $teamProfile);
+
+ $this->loginAs()
+ ->from(route('system-settings.databases.system.edit'))
+ ->patch(route('system-settings.databases.system.update'), [
+ 'password' => 'new-shared-secret',
+ ])
+ ->assertRedirect(route('system-settings.databases.system.edit'))
+ ->assertSessionHasErrors('password');
+ }
+
private function payload(array $overrides = []): array
{
return array_merge([
diff --git a/tests/Unit/Deployment/WebProcessOwnershipTest.php b/tests/Unit/Deployment/WebProcessOwnershipTest.php
new file mode 100644
index 00000000..5279382e
--- /dev/null
+++ b/tests/Unit/Deployment/WebProcessOwnershipTest.php
@@ -0,0 +1,47 @@
+assertIsString($entrypoint);
+ $this->assertStringContainsString(
+ 'runuser -u www-data -- php artisan "$@"',
+ $entrypoint
+ );
+ $this->assertStringContainsString('assert_web_writable', $entrypoint);
+ $this->assertDoesNotMatchRegularExpression('/^\s*php artisan /m', $entrypoint);
+ }
+
+ public function test_local_worker_healthcheck_and_initialization_use_web_user(): void
+ {
+ $compose = file_get_contents(base_path('docker-compose.local.yml'));
+ $initializer = file_get_contents(base_path('deploy/local-init.sh'));
+
+ $this->assertIsString($compose);
+ $this->assertStringContainsString(
+ 'test: ["CMD", "runuser", "-u", "www-data", "--", "php", "artisan", "app:ready", "--quiet"]',
+ $compose
+ );
+ $this->assertMatchesRegularExpression(
+ '/snapshot_worker:.*?user: www-data/s',
+ $compose
+ );
+
+ $this->assertIsString($initializer);
+ $this->assertStringContainsString(
+ 'exec -T -u www-data app',
+ $initializer
+ );
+ $this->assertDoesNotMatchRegularExpression(
+ '/exec -T app\s+(?:\\\\\s*)?php artisan/',
+ $initializer
+ );
+ }
+}
diff --git a/tests/Unit/Utilities/SystemDatabasePersistenceTest.php b/tests/Unit/Utilities/SystemDatabasePersistenceTest.php
index 32ea95f6..9bb7277a 100644
--- a/tests/Unit/Utilities/SystemDatabasePersistenceTest.php
+++ b/tests/Unit/Utilities/SystemDatabasePersistenceTest.php
@@ -49,4 +49,42 @@ class SystemDatabasePersistenceTest extends TestCase
@unlink($environmentPath);
}
}
+
+ public function test_root_owned_or_invalid_backup_directory_uses_writable_storage_fallback(): void
+ {
+ $environmentPath = storage_path('framework/testing-system-database-fallback.env');
+ $blockedBackupPath = storage_path('framework/testing-blocked-backup-path');
+ file_put_contents($environmentPath, "DB_HOST=mysql\nDB_DATABASE=akaunting\n");
+ file_put_contents($blockedBackupPath, 'not-a-directory');
+
+ $configuration = new class($environmentPath, $blockedBackupPath) extends SystemDatabaseConfiguration {
+ protected function runFreshVerification(string $command): void
+ {
+ }
+ };
+
+ try {
+ $backupPath = $configuration->persist([
+ 'host' => 'shared-db.test',
+ 'port' => 3306,
+ 'database' => 'shared_system',
+ 'username' => 'shared_writer',
+ 'password' => 'shared-secret',
+ 'prefix' => 'ak_',
+ 'tls_required' => true,
+ 'tls_verify_server_cert' => false,
+ 'tls_ca' => '',
+ ]);
+
+ $this->assertSame(storage_path('app'), dirname($backupPath));
+ $this->assertFileExists($backupPath);
+ } finally {
+ @unlink($environmentPath);
+ @unlink($blockedBackupPath);
+
+ if (isset($backupPath)) {
+ @unlink($backupPath);
+ }
+ }
+ }
}
diff --git a/tests/Unit/Utilities/TeamSystemDatabaseProfileTest.php b/tests/Unit/Utilities/TeamSystemDatabaseProfileTest.php
new file mode 100644
index 00000000..e2081d61
--- /dev/null
+++ b/tests/Unit/Utilities/TeamSystemDatabaseProfileTest.php
@@ -0,0 +1,46 @@
+ 'shared-db.test',
+ 'port' => 3306,
+ 'database' => 'shared_system',
+ 'username' => 'shared_writer',
+ ], 'correct-password');
+
+ $settings = (new TeamSystemDatabaseProfile($encoded))->settings('correct-password');
+
+ $this->assertSame('shared-db.test', $settings['host']);
+ $this->assertSame(3306, $settings['port']);
+ $this->assertSame('shared_system', $settings['database']);
+ $this->assertSame('shared_writer', $settings['username']);
+ $this->assertSame('correct-password', $settings['password']);
+ $this->assertTrue($settings['tls_required']);
+ $this->assertFalse($settings['tls_verify_server_cert']);
+ $this->assertSame('', $settings['tls_ca']);
+ }
+
+ public function test_wrong_password_does_not_reveal_connection_details(): void
+ {
+ $encoded = TeamSystemDatabaseProfile::seal([
+ 'host' => 'shared-db.test',
+ 'port' => 3306,
+ 'database' => 'shared_system',
+ 'username' => 'shared_writer',
+ ], 'correct-password');
+
+ $this->expectException(RuntimeException::class);
+ $this->expectExceptionMessage('系统数据库密码不正确，请重新输入。');
+
+ (new TeamSystemDatabaseProfile($encoded))->settings('wrong-password');
+ }
+}