caterium/caterium-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: guard server-managed password security

Browse Source
This commit is contained in:
pavlov346346-source 2026-09-11 10:11:03 +03:00
parent 32bdec6259
commit 03959c3908
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
tests/password-security-v1774.mjs Normal file
View File

@ -0,0 +1,22 @@
import fs from 'node:fs';
const employee=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8');
const change=fs.readFileSync('supabase/functions/caterium-change-password/index.ts','utf8');
const changeMap=fs.readFileSync('supabase/functions/caterium-change-password/deno.json','utf8');
const account=fs.readFileSync('public/core/account-security-v1774.js','utf8');
const performance=fs.readFileSync('public/core/performance.js','utf8');
const sw=fs.readFileSync('public/service-worker.js','utf8');
const migration=fs.readFileSync('ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql','utf8');
let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
check(employee.includes('app_metadata: {')&&employee.includes('must_change_password: true'),'new employees use server-controlled app metadata marker');
check(!/user_metadata:\s*\{[^}]*must_change_password:\s*true/s.test(employee),'new employees do not rely on user metadata marker');
check(account.includes('user?.app_metadata?.must_change_password===true'),'client gate reads only app metadata marker');
check(!account.includes('user_metadata?.must_change_password'),'client gate does not trust user metadata marker');
check(account.includes("c.functions.invoke('caterium-change-password'")||account.includes("c.functions.invoke(\"caterium-change-password\""),'client changes passwords through server edge');
check(change.includes('caller.auth.getUser()')&&change.includes('signInWithPassword'),'password edge verifies JWT user and current password');
check(change.includes('auth.admin.updateUserById')&&change.includes('must_change_password: false'),'password edge atomically updates password and clears server marker');
check(change.includes('current_password_invalid')&&change.includes('password_change_failed'),'password edge returns stable safe errors');
check(change.includes('npm:@supabase/supabase-js@2.116.0')&&changeMap.includes('npm:@supabase/supabase-js@2.116.0'),'password edge dependencies are pinned');
check(performance.includes('loadAccountSecurity()')&&performance.includes('core/account-security-v1774.js'),'account security module is loaded');
check(sw.includes('core/auth-security-v1774.js')&&sw.includes('core/account-security-v1774.js'),'auth security modules are in PWA core cache');
check(migration.includes('update auth.users')&&migration.includes('raw_app_meta_data')&&migration.includes('raw_user_meta_data'),'legacy temporary-password markers have a server-marker backfill');
if(bad)process.exit(1);