fix: harden release gate and page delivery

2026-07-26 14:32:01 +08:00
parent d3141a3e91
commit b1577a16e9
61 changed files with 6017 additions and 89 deletions
@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  assertNonProductionTarget,
+  assertSafeGateEnvironment,
+  assertSafePortalBase,
+  isProductionTarget,
+} from './safety.mjs';
+
+test('production IP, public domains, and production paths are refused', () => {
+  for (const target of [
+    '58.38.22.103',
+    'ssh://58.38.22.103',
+    'https://m.tkmind.cn',
+    'https://plaza.tkmind.cn/page',
+    '/Users/john/Project/Memind',
+  ]) {
+    assert.equal(isProductionTarget(target), true, target);
+    assert.throws(() => assertNonProductionTarget(target), /refused production/);
+  }
+});
+
+test('scenario Portal target must be loopback', () => {
+  assert.equal(assertSafePortalBase('http://127.0.0.1:8081'), 'http://127.0.0.1:8081');
+  assert.equal(assertSafePortalBase('http://localhost:9000/'), 'http://localhost:9000');
+  assert.throws(() => assertSafePortalBase('http://192.168.1.9:8081'), /isolated loopback/);
+  assert.throws(() => assertSafePortalBase('https://m.tkmind.cn'), /production/);
+});
+
+test('unsafe environment keys are reported without exposing values', () => {
+  assert.throws(
+    () => assertSafeGateEnvironment({
+      env: {
+        DATABASE_URL: 'postgres://secret@58.38.22.103/prod',
+        STUDIO_HOST: '58.38.22.103',
+      },
+    }),
+    (error) => {
+      assert.match(error.message, /DATABASE_URL/);
+      assert.match(error.message, /STUDIO_HOST/);
+      assert.doesNotMatch(error.message, /secret/);
+      return true;
+    },
+  );
+});