25 lines
2.7 KiB
JavaScript
25 lines
2.7 KiB
JavaScript
import fs from 'node:fs';
|
|
const employee=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8');
|
|
const change=fs.readFileSync('supabase/functions/caterium-change-password/index.ts','utf8');
|
|
const changeMap=fs.readFileSync('supabase/functions/caterium-change-password/deno.json','utf8');
|
|
const account=fs.readFileSync('public/core/account-security-v1774.js','utf8');
|
|
const performance=fs.readFileSync('public/core/performance.js','utf8');
|
|
const sw=fs.readFileSync('public/service-worker.js','utf8');
|
|
const migration=fs.readFileSync('ops/sql/SUPABASE-V17.7.4-PASSWORD-SECURITY.sql','utf8');
|
|
let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
|
|
check(employee.includes('app_metadata: {')&&employee.includes('must_change_password: true'),'new employees use server-controlled app metadata marker');
|
|
check(!/user_metadata:\s*\{[^}]*must_change_password:\s*true/s.test(employee),'new employees do not rely on user metadata marker');
|
|
check(account.includes('user?.app_metadata?.must_change_password===true'),'client gate reads only app metadata marker');
|
|
check(!account.includes('user_metadata?.must_change_password'),'client gate does not trust user metadata marker');
|
|
check(account.includes("c.functions.invoke('caterium-change-password'")||account.includes("c.functions.invoke(\"caterium-change-password\""),'client changes passwords through server edge');
|
|
check(account.includes('result?.error?.context')&&account.includes('context.clone().json()'),'client surfaces safe structured Edge errors');
|
|
check(change.includes('caller.auth.getUser()')&&change.includes('signInWithPassword'),'password edge verifies JWT user and current password');
|
|
check(change.includes('verifier.auth.signOut({ scope: "local" })'),'temporary password-verification session is closed');
|
|
check(change.includes('auth.admin.updateUserById')&&change.includes('must_change_password: false'),'password edge atomically updates password and clears server marker');
|
|
check(change.includes('current_password_invalid')&&change.includes('password_change_failed'),'password edge returns stable safe errors');
|
|
check(change.includes('npm:@supabase/supabase-js@2.116.0')&&changeMap.includes('npm:@supabase/supabase-js@2.116.0'),'password edge dependencies are pinned');
|
|
check(performance.includes('loadAccountSecurity()')&&performance.includes('core/account-security-v1774.js'),'account security module is loaded');
|
|
check(sw.includes('core/auth-security-v1774.js')&&sw.includes('core/account-security-v1774.js'),'auth security modules are in PWA core cache');
|
|
check(migration.includes('update auth.users')&&migration.includes('raw_app_meta_data')&&migration.includes('raw_user_meta_data'),'legacy temporary-password markers have a server-marker backfill');
|
|
if(bad)process.exit(1);
|