统一 Node 22 与后端安全运行基线（07-15-production-trust-closeout-cleanup）

server/src/scripts/seed-dev.js

@@ -2,6 +2,7 @@ require("dotenv/config");
 
 const { createPrismaClient } = require("../prismaClient");
 const { hashPassword } = require("../utils/crypto");
+const { validateDevSeedSafety } = require("./dev-seed-safety");
 
 async function ensureDepartment(prisma, payload) {
   const now = new Date();
@@ -330,9 +331,8 @@ async function ensureWorkspaceSetting(prisma) {
   return prisma.workspaceSetting.create({ data });
 }
 
-async function ensureEmployee(prisma, payload) {
+async function ensureEmployee(prisma, payload, { resetPasswords = false } = {}) {
   const now = new Date();
-  const passwordHash = await hashPassword(payload.password);
 
   const existing = await prisma.employee.findFirst({
     where: { email: payload.email },
@@ -340,6 +340,12 @@ async function ensureEmployee(prisma, payload) {
   });
 
   if (existing) {
+    const passwordData = resetPasswords
+      ? {
+          password_hash: await hashPassword(payload.password),
+          must_change_password: true,
+        }
+      : {};
     const employee = await prisma.employee.update({
       where: { id: existing.id },
       data: {
@@ -353,11 +359,10 @@ async function ensureEmployee(prisma, payload) {
         status: "active",
         bank_account_encrypted: "ENC_DEV_ONLY",
         bank_name: "DEV_BANK",
-        password_hash: passwordHash,
-        must_change_password: false,
+        ...passwordData,
         updated_at: now,
       },
-      select: { id: true, email: true },
+      select: { id: true },
     });
 
     await prisma.employeeRole.deleteMany({
@@ -373,9 +378,13 @@ async function ensureEmployee(prisma, payload) {
       skipDuplicates: true,
     });
 
-    return employee;
+    return {
+      ...employee,
+      seedPasswordAction: resetPasswords ? "reset" : "preserved",
+    };
   }
 
+  const passwordHash = await hashPassword(payload.password);
   const employee = await prisma.employee.create({
     data: {
       employee_no: payload.employeeNo,
@@ -391,11 +400,11 @@ async function ensureEmployee(prisma, payload) {
       bank_account_encrypted: "ENC_DEV_ONLY",
       bank_name: "DEV_BANK",
       password_hash: passwordHash,
-      must_change_password: false,
+      must_change_password: true,
       created_at: now,
       updated_at: now,
     },
-    select: { id: true, email: true },
+    select: { id: true },
   });
 
   await prisma.employeeRole.createMany({
@@ -407,10 +416,11 @@ async function ensureEmployee(prisma, payload) {
     skipDuplicates: true,
   });
 
-  return employee;
+  return { ...employee, seedPasswordAction: "created" };
 }
 
 async function main() {
+  const safety = validateDevSeedSafety();
   const { prisma, pool } = createPrismaClient();
   await prisma.$connect();
 
@@ -451,6 +461,9 @@ async function main() {
     });
 
     await ensureWorkspaceSetting(prisma);
+    const ensureDevEmployee = (payload) => ensureEmployee(prisma, payload, {
+      resetPasswords: safety.resetPasswords,
+    });
 
     for (const flagKey of [
       "portal_home_v1",
@@ -477,7 +490,7 @@ async function main() {
       });
     }
 
-    const ceo = await ensureEmployee(prisma, {
+    const ceo = await ensureDevEmployee({
       employeeNo: process.env.SEED_CEO_EMPLOYEE_NO ?? "HYD000001",
       name: "张总",
       phone: process.env.SEED_CEO_PHONE ?? "13900000000",
@@ -491,7 +504,7 @@ async function main() {
       hireDate,
     });
 
-    const admin = await ensureEmployee(prisma, {
+    const admin = await ensureDevEmployee({
       employeeNo: process.env.SEED_ADMIN_EMPLOYEE_NO ?? "HYD000006",
       name: "王顺利",
       phone: process.env.SEED_ADMIN_PHONE ?? "13800000000",
@@ -505,7 +518,7 @@ async function main() {
       hireDate,
     });
 
-    const manager = await ensureEmployee(prisma, {
+    const manager = await ensureDevEmployee({
       employeeNo: process.env.SEED_MANAGER_EMPLOYEE_NO ?? "HYD000002",
       name: "李研发",
       phone: process.env.SEED_MANAGER_PHONE ?? "13700000000",
@@ -519,7 +532,7 @@ async function main() {
       hireDate,
     });
 
-    const employee = await ensureEmployee(prisma, {
+    const employee = await ensureDevEmployee({
       employeeNo: process.env.SEED_EMPLOYEE_EMPLOYEE_NO ?? "HYD000003",
       name: "陈工程",
       phone: process.env.SEED_EMPLOYEE_PHONE ?? "13600000000",
@@ -533,7 +546,7 @@ async function main() {
       hireDate,
     });
 
-    const finance = await ensureEmployee(prisma, {
+    const finance = await ensureDevEmployee({
       employeeNo: process.env.SEED_FINANCE_EMPLOYEE_NO ?? "HYD000004",
       name: "赵财务",
       phone: process.env.SEED_FINANCE_PHONE ?? "13500000000",
@@ -547,7 +560,7 @@ async function main() {
       hireDate,
     });
 
-    const financeMgr = await ensureEmployee(prisma, {
+    const financeMgr = await ensureDevEmployee({
       employeeNo: process.env.SEED_FINANCE_MGR_EMPLOYEE_NO ?? "HYD000005",
       name: "钱主管",
       phone: process.env.SEED_FINANCE_MGR_PHONE ?? "13400000000",
@@ -561,7 +574,7 @@ async function main() {
       hireDate,
     });
 
-    const hr = await ensureEmployee(prisma, {
+    const hr = await ensureDevEmployee({
       employeeNo: process.env.SEED_HR_EMPLOYEE_NO ?? "HYD000007",
       name: "孙人事",
       phone: process.env.SEED_HR_PHONE ?? "13300000000",
@@ -575,7 +588,7 @@ async function main() {
       hireDate,
     });
 
-    const administration = await ensureEmployee(prisma, {
+    const administration = await ensureDevEmployee({
       employeeNo: process.env.SEED_ADMINISTRATION_EMPLOYEE_NO ?? "HYD000008",
       name: "周行政",
       phone: process.env.SEED_ADMINISTRATION_PHONE ?? "13200000000",
@@ -659,40 +672,28 @@ async function main() {
       warningThresholdPercent: 75,
     });
 
-    // eslint-disable-next-line no-console
-    console.log("Seeded dev users:");
-    // eslint-disable-next-line no-console
-    console.log(`- 负责人:          ${ceo.email} / ${process.env.SEED_CEO_PASSWORD ?? "CeoPassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 管理员:          ${admin.email} / ${process.env.SEED_ADMIN_PASSWORD ?? "AdminPassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 研发负责人:      ${manager.email} / ${process.env.SEED_MANAGER_PASSWORD ?? "ManagerPassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 员工:            ${employee.email} / ${process.env.SEED_EMPLOYEE_PASSWORD ?? "EmployeePassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 财务:            ${finance.email} / ${process.env.SEED_FINANCE_PASSWORD ?? "FinancePassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 财务主管:        ${financeMgr.email} / ${process.env.SEED_FINANCE_MGR_PASSWORD ?? "FinanceMgrPassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 人事:            ${hr.email} / ${process.env.SEED_HR_PASSWORD ?? "HrPassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- 行政:            ${administration.email} / ${process.env.SEED_ADMINISTRATION_PASSWORD ?? "AdministrationPassword1234"}`);
-    // eslint-disable-next-line no-console
-    console.log(`- Legal Entity:    ${legalEntity.code} / ${legalEntity.name}`);
-    // eslint-disable-next-line no-console
-    console.log(`- HolidayCalendar: ${holidayCalendar.code} / ${holidayCalendar.name}`);
-    // eslint-disable-next-line no-console
-    console.log(`- Supplier:        ${supplier.code} / ${supplier.name}`);
-    // eslint-disable-next-line no-console
-    console.log(`- Budget Pools:    ${managementBudgetPool.code}, ${rdBudgetPool.code}`);
+    const users = [ceo, admin, manager, employee, finance, financeMgr, hr, administration];
+    const countAction = (action) => users.filter((item) => item.seedPasswordAction === action).length;
+    console.log(
+      `[seed-dev] completed; users=${users.length} created=${countAction("created")} ` +
+      `passwordsPreserved=${countAction("preserved")} oneTimeResets=${countAction("reset")}`,
+    );
+    console.log("[seed-dev] reference data synchronized; credential values were not printed");
   } finally {
     await prisma.$disconnect();
     await pool.end();
   }
 }
 
-main().catch((error) => {
-  // eslint-disable-next-line no-console
-  console.error(error);
-  process.exit(1);
-});
+if (require.main === module) {
+  main().catch((error) => {
+    const code = typeof error?.code === "string" ? error.code : error?.name || "unexpected_error";
+    console.error(`[seed-dev][FAIL] ${code}`);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  ensureEmployee,
+  main,
+};