first commit

2026-06-20 14:22:31 +08:00
commit c2498911ab
793 changed files with 291660 additions and 0 deletions
@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict'
+import { checkJwtConfig } from '../src/lib/security-config.js'
+
+const originalEnv = {
+  NODE_ENV: process.env.NODE_ENV,
+  JWT_SECRET: process.env.JWT_SECRET,
+  ENCRYPTION_KEY: process.env.ENCRYPTION_KEY
+}
+
+function setEnv(input: {
+  nodeEnv: string
+  jwtSecret?: string
+  encryptionKey?: string
+}) {
+  process.env.NODE_ENV = input.nodeEnv
+  if (input.jwtSecret === undefined) {
+    delete process.env.JWT_SECRET
+  } else {
+    process.env.JWT_SECRET = input.jwtSecret
+  }
+  if (input.encryptionKey === undefined) {
+    delete process.env.ENCRYPTION_KEY
+  } else {
+    process.env.ENCRYPTION_KEY = input.encryptionKey
+  }
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(originalEnv)) {
+    if (value === undefined) {
+      delete process.env[key]
+    } else {
+      process.env[key] = value
+    }
+  }
+}
+
+const strongJwtSecret = 'JwT!AlphaBeta2026_Long_Value_ABCDE'
+const strongEncryptionKey = 'EncK!AlphaBeta2026_Long_Value_ABCDE'
+
+try {
+  setEnv({
+    nodeEnv: 'production',
+    jwtSecret: strongJwtSecret
+  })
+  let result = checkJwtConfig()
+  assert.equal(result.valid, false)
+  assert.ok(result.warnings.includes('ENCRYPTION_KEY must be configured in production'))
+
+  setEnv({
+    nodeEnv: 'production',
+    jwtSecret: strongJwtSecret,
+    encryptionKey: 'ShortEnc1!'
+  })
+  result = checkJwtConfig()
+  assert.equal(result.valid, false)
+  assert.ok(result.warnings.includes('ENCRYPTION_KEY must be at least 32 characters in production'))
+
+  setEnv({
+    nodeEnv: 'production',
+    jwtSecret: strongJwtSecret,
+    encryptionKey: strongEncryptionKey
+  })
+  result = checkJwtConfig()
+  assert.equal(result.valid, true)
+  assert.deepEqual(result.warnings, [])
+
+  setEnv({
+    nodeEnv: 'development',
+    jwtSecret: strongJwtSecret
+  })
+  result = checkJwtConfig()
+  assert.equal(result.valid, true)
+  assert.ok(result.warnings.includes('ENCRYPTION_KEY not configured, will use JWT_SECRET as fallback'))
+
+  console.log('security-config self-test passed')
+} finally {
+  restoreEnv()
+}