sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

Browse Source 
- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue
This commit is contained in:
Hermes CI Fix
2026-09-14 17:39:53 +08:00
parent 8adc783501
commit 40d522cd34
39 changed files with 602 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_security_multitenant.py
+9 -9
View File
@@ -13,7 +13,7 @@ from sqlalchemy.orm import Session
from app.models import KPIDefinition, KPIAlert, Entity, UserEntity
from app.api.alert_rules import AlertRule, _eval_threshold
from tests.conftest import create_test_kpi, create_test_user, get_token_for_user, auth_header
from tests.conftest import create_test_kpi, create_test_user, get_token_for_user, auth_header, TEST_USER_PASSWORD
BOT_KEY = {"X-BOT-KEY": "cma-bot-finance-2026"}
@@ -103,7 +103,7 @@ class TestAlertRulesIsolation:
k1 = _seed_entity_kpi(db, entity_id=1, code="AR_E1")
db.commit()
create_test_user(db)
token = get_token_for_user(client, "testadmin", "admin123")
token = get_token_for_user(client, "testadmin", TEST_USER_PASSWORD)
headers = auth_header(token)
resp = client.post("/api/cma/alert-rules", headers=headers, json={
@@ -128,7 +128,7 @@ class TestAlertRulesIsolation:
entity_id=1))
db.commit()
create_test_user(db)
token = get_token_for_user(client, "testadmin", "admin123")
token = get_token_for_user(client, "testadmin", TEST_USER_PASSWORD)
r1 = client.get(f"/api/cma/alert-rules/kpi/{k1.id}", headers=auth_header(token))
assert r1.status_code == 200
@@ -149,7 +149,7 @@ class TestReportsIsolation:
data_status="verified", entity_id=1))
db.commit()
create_test_user(db)
token = get_token_for_user(client, "testadmin", "admin123")
token = get_token_for_user(client, "testadmin", TEST_USER_PASSWORD)
r1 = client.get("/api/cma/reports/profit-summary?period=2026-06", headers=auth_header(token))
assert r1.status_code == 200
@@ -164,7 +164,7 @@ class TestReportsIsolation:
_seed_entity_kpi(db, entity_id=2, code="TR_E2")
db.commit()
create_test_user(db)
token = get_token_for_user(client, "testadmin", "admin123")
token = get_token_for_user(client, "testadmin", TEST_USER_PASSWORD)
r1 = client.get("/api/cma/reports/kpi-trends", headers=auth_header(token))
assert r1.status_code == 200
@@ -212,7 +212,7 @@ class TestCheckGovernanceRetired:
_seed_entity_kpi(db, entity_id=1, code="GOV_KPI")
db.commit()
create_test_user(db)
token = get_token_for_user(client, "testadmin", "admin123")
token = get_token_for_user(client, "testadmin", TEST_USER_PASSWORD)
resp = client.get("/api/cma/data-quality/check-governance", headers=auth_header(token))
assert resp.status_code == 404, f"应 404，实际 {resp.status_code}: {resp.text[:200]}"
@@ -225,7 +225,7 @@ class TestCheckGovernanceRetired:
_seed_entity_kpi(db, entity_id=1, code="GOV2_KPI")
db.commit()
create_test_user(db)
token = get_token_for_user(client, "testadmin", "admin123")
token = get_token_for_user(client, "testadmin", TEST_USER_PASSWORD)
resp = client.get("/api/cma/data-quality/governance-check", headers=auth_header(token))
assert resp.status_code == 200, resp.text[:300]
@@ -242,7 +242,7 @@ class TestCrossEntityEndpointAuth:
def _login(self, client, db):
_ensure_entity(db, 2)
create_test_user(db)
return get_token_for_user(client, "testadmin", "admin123") # 登录账套 entity_id=1
return get_token_for_user(client, "testadmin", TEST_USER_PASSWORD) # 登录账套 entity_id=1
# ── 1. data-quality/governance-check ──────────────────
def test_governance_check_cross_entity_403(self, client, db):
@@ -352,7 +352,7 @@ class TestDupontSessionScope:
def _login(self, client, db):
_ensure_entity(db, 2)
create_test_user(db)
return get_token_for_user(client, "testadmin", "admin123") # 登录账套 entity_id=1
return get_token_for_user(client, "testadmin", TEST_USER_PASSWORD) # 登录账套 entity_id=1
def test_dupont_cross_entity_bohai_403(self, client, db):
"""酣客会话显式 entity=bohai（博海真实KPI）→ 403（旧豁免已撤销）"""