GuDingZiChan/backend/scripts/__tests__/legacyRemoteScriptSafety.test.js

74 lines
2.7 KiB
JavaScript

const test = require('node:test')
const assert = require('node:assert/strict')
const backfillScript = require('../backfillImportedEquipmentLocations')
const exportScript = require('../exportAdminManualReviewWorkbook')
const importScript = require('../importConfirmedEquipmentToLive')
const prepareScript = require('../prepareEquipmentMigrationDryRun')
const scripts = [backfillScript, exportScript, importScript, prepareScript]
const writerScripts = [backfillScript, importScript]
const explicitConnectionArgs = [
'--plink-path', 'plink-test.exe',
'--ssh-host', 'deploy@example.invalid',
'--ssh-hostkey', 'SHA256:test-host-key',
'--ssh-password', 'test-secret-value'
]
test('两个旧写入脚本默认只预览,必须显式 --apply 才允许写入', () => {
for (const script of writerScripts) {
const preview = script.parseArgs([])
assert.equal(preview.apply, false)
assert.equal(preview.dryRun, true)
const apply = script.parseArgs(['--apply'])
assert.equal(apply.apply, true)
assert.equal(apply.dryRun, false)
assert.throws(() => script.parseArgs(['--apply', '--dry-run']), /不能同时使用/)
assert.throws(() => script.parseArgs(['--aply']), /不支持的参数/)
}
})
test('四个旧脚本缺少连接参数时在联网前失败且不回显密码', () => {
for (const script of scripts) {
const options = script.parseArgs(['--ssh-password', 'test-secret-value'])
assert.throws(
() => script.resolveRemoteConnection(options, {}),
(error) => {
assert.match(error.message, /缺少固定资产远程连接参数/)
assert.match(error.message, /未发起网络连接/)
assert.doesNotMatch(error.message, /test-secret-value/)
return true
}
)
}
})
test('四个旧脚本仅接受显式连接配置且 CLI 优先于环境变量', () => {
const env = {
FIXED_ASSET_PLINK_PATH: 'env-plink.exe',
FIXED_ASSET_SSH_HOST: 'env@example.invalid',
FIXED_ASSET_SSH_HOSTKEY: 'SHA256:env-key',
FIXED_ASSET_SSH_PASSWORD: 'env-secret'
}
for (const script of scripts) {
const options = script.parseArgs(explicitConnectionArgs)
assert.deepEqual(script.resolveRemoteConnection(options, env), {
plinkPath: 'plink-test.exe',
sshHost: 'deploy@example.invalid',
sshHostkey: 'SHA256:test-host-key',
sshPassword: 'test-secret-value'
})
}
})
test('两个旧只读脚本拒绝未知参数且不暴露写入开关', () => {
for (const script of [exportScript, prepareScript]) {
const options = script.parseArgs([])
assert.equal(Object.prototype.hasOwnProperty.call(options, 'apply'), false)
assert.throws(() => script.parseArgs(['--apply']), /不支持的参数/)
}
})