统一 Node 22 与后端安全运行基线（07-15-production-trust-closeout-cleanup）
这个提交包含在：
+41
-43
@@ -1,13 +1,13 @@
|
||||
# hyb-oa Server Runbook (P0/P1)
|
||||
|
||||
## 1. 环境准备
|
||||
- Node.js: `>=20`
|
||||
- Node.js: `>=22 <23`
|
||||
- Docker + Docker Compose
|
||||
- 本地工具：`curl`、`jq`
|
||||
- 配置文件：从 `server/.env.example` 复制为 `server/.env` 并按需修改
|
||||
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd server
|
||||
cp .env.example .env
|
||||
```
|
||||
|
||||
@@ -15,39 +15,37 @@ cp .env.example .env
|
||||
|
||||
### 2.1 启动数据库
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa
|
||||
cd ..
|
||||
export POSTGRES_PASSWORD="<local-only-db-password>"
|
||||
export JWT_SECRET="<local-only-jwt-secret>"
|
||||
docker compose up -d db
|
||||
```
|
||||
|
||||
根级 Compose 不再内置数据库口令或 JWT 密钥；请仅在本地 shell 或未提交的环境文件中设置，并让 `server/.env` 的 `DATABASE_URL` 使用同一数据库口令。
|
||||
|
||||
### 2.2 应用迁移
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd server
|
||||
npm run prisma:migrate:deploy
|
||||
```
|
||||
|
||||
### 2.3 执行 seed（幂等）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
npm run seed:dev
|
||||
cd server
|
||||
SEED_DEV_ALLOW=1 SEED_DEV_DATABASE_CONFIRM=hyb_oa npm run seed:dev
|
||||
```
|
||||
|
||||
开发环境默认账号（仅用于本地 seed:dev）：
|
||||
- employee：`[email protected]` / `EmployeePassword1234`
|
||||
- manager：`[email protected]` / `ManagerPassword1234`
|
||||
- finance：`[email protected]` / `FinancePassword1234`
|
||||
- finance_mgr：`[email protected]` / `FinanceMgrPassword1234`
|
||||
- admin：`[email protected]` / `AdminPassword1234`
|
||||
- ceo：`[email protected]` / `CeoPassword1234`
|
||||
|
||||
说明：
|
||||
- 以上账号可通过 `SEED_*` 环境变量覆盖（见 `server/src/scripts/seed-dev.js`）。
|
||||
- 生产/试运行环境默认采用“管理员重置密码”，不建议启用默认弱口令。
|
||||
- `seed:dev` 永久拒绝 production，只接受 loopback PostgreSQL，并要求确认 URL 中的数据库名。
|
||||
- 开发账号资料和口令可通过 `SEED_*` 环境变量覆盖；脚本不会打印口令。
|
||||
- 默认保留已有账号密码。新建账号以及主动设置 `SEED_DEV_RESET_PASSWORDS=1` 后轮换的账号，首次登录都必须改密。
|
||||
- 开发账号配置不得复用于试运行或生产。
|
||||
|
||||
试运行管理员引导（E20）：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
TRIALRUN_ADMIN_EMAIL="admin@hyinda.com" \
|
||||
TRIALRUN_ADMIN_PHONE="13800000000" \
|
||||
cd server
|
||||
TRIALRUN_ADMIN_EMAIL="<admin-email>" \
|
||||
TRIALRUN_ADMIN_PHONE="<admin-phone>" \
|
||||
TRIALRUN_ADMIN_PASSWORD="" \
|
||||
npm run seed:trialrun
|
||||
```
|
||||
@@ -101,11 +99,11 @@ npm run seed:trialrun
|
||||
本地双进程示例：
|
||||
```bash
|
||||
# 终端 A：API（不跑作业）
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
JOBS_ENABLED=false npm run dev
|
||||
|
||||
# 终端 B：Worker（只跑作业）
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
JOBS_ENABLED=true npm run worker
|
||||
```
|
||||
|
||||
@@ -127,19 +125,19 @@ JOBS_ENABLED=true npm run worker
|
||||
|
||||
### 2.4 启动服务
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
npm run dev
|
||||
```
|
||||
|
||||
### 2.5 冒烟验证
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
./scripts/smoke-test.sh
|
||||
```
|
||||
|
||||
### 2.6 本地最小门禁（P1-b）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa
|
||||
cd <repo-root>
|
||||
./scripts/check-minimal.sh
|
||||
```
|
||||
|
||||
@@ -149,7 +147,7 @@ cd /home/shunli/Projects/hyb-oa
|
||||
|
||||
## 3. 1 分钟快速验证
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
./scripts/smoke-test.sh
|
||||
```
|
||||
|
||||
@@ -171,26 +169,26 @@ curl -fsS http://127.0.0.1:3000/metrics | head
|
||||
|
||||
### 4.1 脚本回归（推荐）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
BASE_URL=http://127.0.0.1:3000 ./scripts/smoke-test.sh
|
||||
```
|
||||
|
||||
### 4.2 判重专项回归（dedup）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
DATABASE_URL='postgresql://hyboa_user:[email protected]:5432/hyb_oa?schema=public' \
|
||||
cd <repo-root>/server
|
||||
DATABASE_URL='<local-postgresql-url>' \
|
||||
BASE_URL=http://127.0.0.1:3000 ./scripts/regression-dedup.sh
|
||||
```
|
||||
|
||||
### 4.3 工作流动作回归
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
./scripts/regression-workflow-actions.sh
|
||||
```
|
||||
|
||||
可选并发校验：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
RUN_DELEGATION_CONCURRENCY_CHECK=1 ./scripts/regression-workflow-actions.sh
|
||||
```
|
||||
|
||||
@@ -219,7 +217,7 @@ RUN_DELEGATION_CONCURRENCY_CHECK=1 ./scripts/regression-workflow-actions.sh
|
||||
|
||||
### 4.4 一键全量回归
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
./scripts/regression-all.sh
|
||||
```
|
||||
|
||||
@@ -227,25 +225,25 @@ cd /home/shunli/Projects/hyb-oa/server
|
||||
|
||||
可选关闭审计/OCR：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
RUN_AUDIT_REGRESSION=0 RUN_OCR_REGRESSION=0 ./scripts/regression-all.sh
|
||||
```
|
||||
|
||||
可选打开组织/配置回归（org + settings）：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
RUN_ORG_SETTINGS_REGRESSION=1 ./scripts/regression-all.sh
|
||||
```
|
||||
|
||||
可选打开认证安全回归（auth security）：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
RUN_AUTH_SECURITY_REGRESSION=1 ./scripts/regression-all.sh
|
||||
```
|
||||
|
||||
独立执行：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
./scripts/regression-audit.sh
|
||||
OCR_PROVIDER=mock ./scripts/regression-ocr.sh
|
||||
./scripts/regression-org-settings.sh
|
||||
@@ -267,7 +265,7 @@ OCR_PROVIDER=mock ./scripts/regression-ocr.sh
|
||||
|
||||
### 4.6 前端壳联调（P1-5）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/client
|
||||
cd <repo-root>/client
|
||||
npm install
|
||||
npm run dev
|
||||
```
|
||||
@@ -279,10 +277,10 @@ npm run dev
|
||||
|
||||
### 4.7 单域托管 client/dist（可选，试运行建议）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/client
|
||||
cd <repo-root>/client
|
||||
npm run build
|
||||
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
SERVE_CLIENT_DIST=true npm run dev
|
||||
```
|
||||
|
||||
@@ -299,7 +297,7 @@ SERVE_CLIENT_DIST=true npm run dev
|
||||
|
||||
备份/恢复脚本（E14）：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa
|
||||
cd <repo-root>
|
||||
./scripts/backup-db.sh
|
||||
./scripts/restore-db.sh deploy/trialrun/backups/<db.dump>
|
||||
./scripts/backup-storage.sh
|
||||
@@ -358,7 +356,7 @@ cd /home/shunli/Projects/hyb-oa
|
||||
|
||||
### 5.8 定时任务（可手动执行）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
npm run job:revoke-expired-delegations
|
||||
npm run job:ocr-once
|
||||
```
|
||||
@@ -492,7 +490,7 @@ npm run job:ocr-once
|
||||
|
||||
### 9.3 新增回归脚本
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
./scripts/regression-verification.sh
|
||||
./scripts/regression-dashboard.sh
|
||||
./scripts/regression-budget.sh
|
||||
@@ -502,7 +500,7 @@ cd /home/shunli/Projects/hyb-oa/server
|
||||
|
||||
可通过总回归开关启用：
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
RUN_VERIFICATION_REGRESSION=1 \
|
||||
RUN_DASHBOARD_REGRESSION=1 \
|
||||
RUN_BUDGET_REGRESSION=1 \
|
||||
@@ -513,7 +511,7 @@ RUN_FEATURE_FLAGS_REGRESSION=1 \
|
||||
|
||||
### 9.4 单次任务脚本（调试）
|
||||
```bash
|
||||
cd /home/shunli/Projects/hyb-oa/server
|
||||
cd <repo-root>/server
|
||||
VERIFICATION_RECORD_ID=<uuid> npm run job:verification-once
|
||||
npm run job:integration-outbox-once
|
||||
```
|
||||
|
||||
在新工单中引用
屏蔽一个用户