linmeng
d44a41408b
Deploy staging to test server / deploy (push) Successful in 3m34s
Add the missing least-privilege grants and RLS policies so self-hosted admin payment and package APIs can use the admin_runtime database role.
30 lines
1.9 KiB
TypeScript
30 lines
1.9 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import { test } from "node:test";
|
|
import { epayCanonical, epaySign } from "../src/lib/epay/sign";
|
|
|
|
const migration = readFileSync(new URL("../supabase/migrations/20260727020000_epay_packages_orders.sql", import.meta.url), "utf8");
|
|
const adminPermissionsMigration = readFileSync(new URL("../supabase/migrations/20260730010000_admin_payment_permissions.sql", import.meta.url), "utf8");
|
|
|
|
test("易支付签名过滤空值并按键排序", () => {
|
|
const params = { money: "10.00", pid: "10001", name: "套餐", empty: "", sign_type: "MD5" };
|
|
assert.equal(epayCanonical(params), "money=10.00&name=套餐&pid=10001");
|
|
assert.equal(epaySign(params, "secret"), "79dd3a13f9fd32622fa2197c0a2d7b66");
|
|
});
|
|
|
|
test("支付迁移包含套餐、订单、payment 类型与原子结算", () => {
|
|
assert.match(migration, /create table public\.payment_packages/);
|
|
assert.match(migration, /create table public\.payment_orders/);
|
|
assert.match(migration, /transaction_type in \('redeem', 'reserve', 'refund', 'payment'\)/);
|
|
assert.match(migration, /settle_epay_order/);
|
|
assert.match(migration, /on conflict \(user_id, transaction_type, request_id\) do nothing/);
|
|
});
|
|
|
|
test("self-hosted 管理角色具有支付后台最小权限", () => {
|
|
assert.match(adminPermissionsMigration, /grant select, insert, update on table public\.payment_packages to admin_runtime/);
|
|
assert.match(adminPermissionsMigration, /grant select on table public\.payment_orders to admin_runtime/);
|
|
assert.doesNotMatch(adminPermissionsMigration, /grant (?:all|insert|update|delete) on table public\.payment_orders to admin_runtime/);
|
|
assert.match(adminPermissionsMigration, /grant select on table public\.epay_settings to admin_runtime/);
|
|
assert.match(adminPermissionsMigration, /grant execute on function public\.admin_save_epay_settings\([\s\S]*\) to admin_runtime/);
|
|
});
|