实现(08-10-production-employee-smoke-break-glass-reset): 增加员工Smoke受控重置工具

2026-08-10 21:01:59 +08:00
@@ -1,4 +1,5 @@
 const {
+  applyTarget,
  isSafeOaOnlySmokeTarget,
  isSmokeLikeValue,
  normalizeRoleList,
@@ -85,4 +86,56 @@ describe("repair-oa-only-smoke-accounts", () => {
    expect(normalizeRoleList(["admin", "admin", "invalid", "employee"])).toEqual(["admin", "employee"]);
    expect(process.env.OA_ONLY_SMOKE_REPAIR_APPLY).toBeUndefined();
  });
+
+  it("applies only lifecycle, login-lock, token, missing-role, and audit repairs", async () => {
+    const current = row({
+      status: "archived",
+      employmentStatus: "inactive",
+      archived: true,
+      roles: ["employee"],
+    });
+    const planned = planForTarget(target(), current);
+    const client = {
+      query: vi.fn(async (sql) => {
+        const text = String(sql);
+        if (text.includes("SELECT")) {
+          return {
+            rows: [
+              {
+                id: current.id,
+                employee_no: current.employeeNo,
+                name: current.name,
+                email: current.email,
+                phone: current.phone,
+                status: "active",
+                employment_status: "active",
+                archived: false,
+                login_failed_count: 0,
+                has_login_failed_first_at: false,
+                login_locked_until: null,
+                roles: ["admin", "employee"],
+                active_auth_sessions: 0,
+              },
+            ],
+          };
+        }
+        return { rows: [] };
+      }),
+    };
+
+    await expect(
+      applyTarget(client, target(), planned, new Date("2026-08-10T00:00:00.000Z")),
+    ).resolves.toMatchObject({ result: "applied" });
+
+    const sql = client.query.mock.calls.map(([statement]) => String(statement)).join("\n");
+    expect(sql).toContain("token_version = token_version + 1");
+    expect(sql).toContain("INSERT INTO employee_roles");
+    expect(sql).toContain("ON CONFLICT (employee_id, role_code) DO NOTHING");
+    expect(sql).toContain("INSERT INTO employee_lifecycle_events");
+    expect(sql).not.toContain("DELETE FROM employee_roles");
+    expect(sql).not.toContain("password_hash");
+    expect(sql).not.toMatch(/(?:UPDATE|INSERT\s+INTO|DELETE\s+FROM)\s+auth_sessions/iu);
+    expect(sql).not.toMatch(/(?:UPDATE|INSERT\s+INTO|DELETE\s+FROM)\s+password_reset_codes/iu);
+    expect(sql).not.toMatch(/(?:UPDATE|INSERT\s+INTO|DELETE\s+FROM)\s+email_login_codes/iu);
+  });
 });
@@ -0,0 +1,329 @@
+const {
+  AUDIT_ACTION,
+  applyReset,
+  preflight,
+  resolveMode,
+  verifyCompletedPasswordChange,
+  verifyState,
+} = require("../../../src/scripts/reset-employee-smoke-password");
+const { ROLE_PERMISSIONS } = require("../../../src/constants/permissions");
+
+const TARGET_ID = "00000000-0000-4000-8000-000000000101";
+
+function employeeRow(overrides = {}) {
+  return {
+    id: TARGET_ID,
+    token_version: 7,
+    employee_no: "SMOKE-EMPLOYEE",
+    name: "OA试运行账号",
+    email: "[email protected]",
+    phone: null,
+    status: "active",
+    employment_status: "active",
+    archived_at: null,
+    must_change_password: false,
+    login_failed_count: 0,
+    login_failed_first_at: null,
+    login_locked_until: null,
+    email_login_code_failed_count: 0,
+    email_login_code_failed_first_at: null,
+    email_login_code_locked_until: null,
+    password_reset_failed_count: 0,
+    password_reset_failed_first_at: null,
+    password_reset_locked_until: null,
+    roles: [{ role_code: "employee" }],
+    ...overrides,
+  };
+}
+
+function rawEmployeeRow(row) {
+  const { roles: _roles, ...raw } = row;
+  return raw;
+}
+
+function createFixture({ rows = [employeeRow()], auditTargetIds = [TARGET_ID] } = {}) {
+  const tx = {
+    $queryRaw: vi.fn(async (strings) => {
+      const sql = strings.join(" ");
+      if (sql.includes('FROM "employees"')) {
+        return rows.length === 1 ? [rawEmployeeRow(rows[0])] : [];
+      }
+      if (sql.includes('FROM "employee_roles"')) {
+        return rows.length === 1 ? rows[0].roles : [];
+      }
+      throw new Error("unexpected_query");
+    }),
+    employee: {
+      update: vi
+        .fn()
+        .mockResolvedValue({ must_change_password: true, token_version: 8 }),
+    },
+    authSession: { updateMany: vi.fn().mockResolvedValue({ count: 2 }) },
+    passwordResetCode: { updateMany: vi.fn().mockResolvedValue({ count: 1 }) },
+    emailLoginCode: { updateMany: vi.fn().mockResolvedValue({ count: 3 }) },
+    auditLog: { create: vi.fn().mockResolvedValue({}) },
+  };
+  const prisma = {
+    employee: {
+      findMany: vi.fn(async (query) => {
+        if (query?.where?.id?.in) {
+          return rows.filter((row) => query.where.id.in.includes(row.id));
+        }
+        return rows;
+      }),
+    },
+    authSession: { count: vi.fn().mockResolvedValue(0) },
+    passwordResetCode: { count: vi.fn().mockResolvedValue(0) },
+    emailLoginCode: { count: vi.fn().mockResolvedValue(0) },
+    auditLog: {
+      findMany: vi
+        .fn()
+        .mockResolvedValue(auditTargetIds.map((target_id) => ({ target_id }))),
+      count: vi.fn().mockResolvedValue(1),
+    },
+    $transaction: vi.fn(async (callback, options) => {
+      expect(options).toEqual({ isolationLevel: "Serializable" });
+      return callback(tx);
+    }),
+  };
+  return { prisma, tx };
+}
+
+describe("employee smoke break-glass password reset", () => {
+  it("defaults to read-only preflight and requires the exact apply confirmation", () => {
+    expect(resolveMode([])).toEqual({ mode: "preflight" });
+    expect(resolveMode(["--dry-run"])).toEqual({ mode: "preflight" });
+    expect(resolveMode(["--preflight"])).toEqual({ mode: "preflight" });
+    expect(resolveMode(["--apply", "EMPLOYEE_SMOKE_BREAK_GLASS"])).toEqual({
+      mode: "apply",
+    });
+    expect(() => resolveMode(["--apply"])).toThrow("explicit_confirmation_required");
+    expect(() => resolveMode(["--apply", "wrong"])).toThrow(
+      "explicit_confirmation_required",
+    );
+  });
+
+  it("passes preflight only for one exact employee smoke role without management permissions", async () => {
+    const { prisma } = createFixture();
+
+    await expect(preflight(prisma)).resolves.toMatchObject({
+      status: "PASS",
+      targetMatches: 1,
+      exactTarget: true,
+      mustChangePassword: false,
+      mustChangePasswordMatches: true,
+      rolesExact: true,
+      hasWildcard: false,
+      hasProjectManage: false,
+      hasProjectViewAll: false,
+      hasSystemSettings: false,
+      contractManagePermissionsAbsent: true,
+    });
+  });
+
+  it.each([
+    ["no target", []],
+    ["multiple targets", [employeeRow(), employeeRow({ id: "00000000-0000-4000-8000-000000000102" })]],
+    ["non smoke", [employeeRow({ employee_no: "E100", name: "普通员工", email: "[email protected]" })]],
+    ["identifier missing", [employeeRow({ email: null, phone: null })]],
+    ["status inactive", [employeeRow({ status: "inactive" })]],
+    ["employment inactive", [employeeRow({ employment_status: "inactive" })]],
+    ["archived", [employeeRow({ archived_at: new Date() })]],
+    ["locked", [employeeRow({ login_locked_until: new Date() })]],
+    ["must change already", [employeeRow({ must_change_password: true })]],
+    ["extra role", [employeeRow({ roles: [{ role_code: "employee" }, { role_code: "manager" }] })]],
+  ])("blocks preflight for %s", async (_label, rows) => {
+    const { prisma } = createFixture({ rows });
+    await expect(preflight(prisma)).resolves.toMatchObject({ status: "BLOCKED" });
+  });
+
+  it("blocks when the employee role permission mapping gains contract management", async () => {
+    ROLE_PERMISSIONS.employee.push("project.manage");
+    try {
+      const { prisma } = createFixture();
+      await expect(preflight(prisma)).resolves.toMatchObject({
+        status: "BLOCKED",
+        rolesExact: true,
+        hasProjectManage: true,
+        contractManagePermissionsAbsent: false,
+      });
+    } finally {
+      ROLE_PERMISSIONS.employee.pop();
+    }
+  });
+
+  it("writes only target authentication state and never writes roles or employee identity", async () => {
+    const { prisma, tx } = createFixture();
+
+    await expect(applyReset(prisma, "UniqueBreakGlass9Qz!")).resolves.toEqual({
+      status: "PASS",
+      targetMatches: 1,
+      exactTarget: true,
+      passwordUpdated: true,
+      mustChangePassword: true,
+      tokenVersionIncremented: true,
+      locksCleared: true,
+      rolesExact: true,
+      contractManagePermissionsAbsent: true,
+      revokedSessions: 2,
+      invalidatedPasswordResetCodes: 1,
+      consumedEmailLoginCodes: 3,
+      auditCreated: true,
+    });
+
+    const update = tx.employee.update.mock.calls[0][0];
+    expect(update.where).toEqual({ id: TARGET_ID });
+    expect(Object.keys(update.data).sort()).toEqual(
+      [
+        "email_login_code_failed_count",
+        "email_login_code_failed_first_at",
+        "email_login_code_locked_until",
+        "login_failed_count",
+        "login_failed_first_at",
+        "login_locked_until",
+        "must_change_password",
+        "password_hash",
+        "password_reset_failed_count",
+        "password_reset_failed_first_at",
+        "password_reset_last_requested_at",
+        "password_reset_locked_until",
+        "password_reset_request_count",
+        "password_reset_request_first_at",
+        "token_version",
+      ].sort(),
+    );
+    expect(update.data).not.toHaveProperty("roles");
+    expect(update.data).not.toHaveProperty("status");
+    expect(update.data).not.toHaveProperty("employment_status");
+    expect(update.data).not.toHaveProperty("archived_at");
+    expect(update.data).not.toHaveProperty("email");
+    expect(update.data).not.toHaveProperty("phone");
+    expect(tx.authSession.updateMany).toHaveBeenCalledWith({
+      where: { employee_id: TARGET_ID, revoked_at: null },
+      data: { revoked_at: expect.any(Date), last_seen_at: expect.any(Date) },
+    });
+    expect(tx.passwordResetCode.updateMany).toHaveBeenCalledWith({
+      where: { employee_id: TARGET_ID, invalidated_at: null },
+      data: { invalidated_at: expect.any(Date) },
+    });
+    expect(tx.emailLoginCode.updateMany).toHaveBeenCalledWith({
+      where: { employee_id: TARGET_ID, used_at: null },
+      data: { used_at: expect.any(Date) },
+    });
+    expect(tx.auditLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        actor_id: TARGET_ID,
+        target_id: TARGET_ID,
+        action: AUDIT_ACTION,
+        extra: { credentialRecorded: false },
+      }),
+    });
+  });
+
+  it("fails closed when the exact role changes after preflight", async () => {
+    const { prisma, tx } = createFixture();
+    tx.$queryRaw.mockImplementation(async (strings) => {
+      const sql = strings.join(" ");
+      if (sql.includes('FROM "employees"')) return [rawEmployeeRow(employeeRow())];
+      return [{ role_code: "employee" }, { role_code: "manager" }];
+    });
+
+    await expect(applyReset(prisma, "UniqueBreakGlass9Qz!")).rejects.toThrow(
+      "employee_smoke_target_changed",
+    );
+    expect(tx.employee.update).not.toHaveBeenCalled();
+    expect(tx.auditLog.create).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when the token version changes after preflight", async () => {
+    const { prisma, tx } = createFixture();
+    tx.$queryRaw.mockImplementation(async (strings) => {
+      const sql = strings.join(" ");
+      if (sql.includes('FROM "employees"')) {
+        return [rawEmployeeRow(employeeRow({ token_version: 8 }))];
+      }
+      return [{ role_code: "employee" }];
+    });
+
+    await expect(applyReset(prisma, "UniqueBreakGlass9Qz!")).rejects.toThrow(
+      "employee_smoke_target_changed",
+    );
+    expect(tx.employee.update).not.toHaveBeenCalled();
+    expect(tx.auditLog.create).not.toHaveBeenCalled();
+  });
+
+  it("verifies reset state with exact role and all four management permissions absent", async () => {
+    const row = employeeRow({ must_change_password: true });
+    const { prisma } = createFixture({ rows: [row] });
+
+    await expect(verifyState(prisma)).resolves.toMatchObject({
+      status: "PASS",
+      mustChangePassword: true,
+      mustChangePasswordMatches: true,
+      targetMatches: 1,
+      rolesExact: true,
+      hasWildcard: false,
+      hasProjectManage: false,
+      hasProjectViewAll: false,
+      hasSystemSettings: false,
+      contractManagePermissionsAbsent: true,
+      activeSessions: 0,
+      activePasswordResetCodes: 0,
+      activeEmailLoginCodes: 0,
+      auditPresent: true,
+    });
+  });
+
+  it("blocks verify when the reset target has any extra role", async () => {
+    const row = employeeRow({
+      must_change_password: true,
+      roles: [{ role_code: "employee" }, { role_code: "manager" }],
+    });
+    const { prisma } = createFixture({ rows: [row] });
+
+    await expect(verifyState(prisma)).resolves.toMatchObject({
+      status: "BLOCKED",
+      targetMatches: 1,
+      rolesExact: false,
+    });
+  });
+
+  it.each(["*", "project.manage", "project.view_all", "system.settings"])(
+    "blocks verify when employee permissions contain %s",
+    async (permission) => {
+      ROLE_PERMISSIONS.employee.push(permission);
+      try {
+        const row = employeeRow({ must_change_password: true });
+        const { prisma } = createFixture({ rows: [row] });
+        const result = await verifyState(prisma);
+        expect(result).toMatchObject({
+          status: "BLOCKED",
+          rolesExact: true,
+          contractManagePermissionsAbsent: false,
+        });
+      } finally {
+        ROLE_PERMISSIONS.employee.pop();
+      }
+    },
+  );
+
+  it("verifies the completed forced password change without exposing the target", async () => {
+    const { prisma } = createFixture();
+    prisma.authSession.count.mockResolvedValue(1);
+    prisma.auditLog.count.mockResolvedValue(1);
+
+    const result = await verifyCompletedPasswordChange(prisma);
+    expect(result).toMatchObject({
+      status: "PASS",
+      mustChangePassword: false,
+      mustChangePasswordMatches: true,
+      rolesExact: true,
+      contractManagePermissionsAbsent: true,
+      activeSessions: 1,
+      passwordChangeAuditPresent: true,
+      breakGlassAuditPresent: true,
+    });
+    expect(JSON.stringify(result)).not.toContain("[email protected]");
+    expect(JSON.stringify(result)).not.toContain(TARGET_ID);
+  });
+});