继续更新 update 门户站点界面和功能

server/unified-management/internal/db/store_test.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -63,3 +64,212 @@ func TestOpenImportsJSONPrototypeIntoSQLite(t *testing.T) {
 		t.Fatalf("expected prototype backup, got %v", matches)
 	}
 }
+
+func TestVerifyAdminPasswordUsesLocalSQLiteWhenRemoteIsUnavailable(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "unified.sqlite")
+	store, err := Open(&config.Config{
+		StorageDir: root,
+		Database: config.DatabaseConfig{
+			Provider:               "sqlite",
+			SQLitePath:             path,
+			FailoverEnabled:        true,
+			HealthIntervalSec:      3600,
+			MaxOpenConns:           1,
+			MaxIdleConns:           1,
+			ConnMaxLifetimeSeconds: 60,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	if err := store.EnsureDefaultAdmin(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+
+	remote, err := sql.Open("sqlite", filepath.Join(root, "closed-remote.sqlite"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = remote.Close()
+	store.cfg.Database.Provider = "mysql"
+	store.mu.Lock()
+	store.remoteDB = remote
+	store.remoteDialect = dialectFor("sqlite")
+	store.db = remote
+	store.dialect = store.remoteDialect
+	store.status.ActiveProvider = "mysql"
+	store.status.ConfigProvider = "mysql"
+	store.mu.Unlock()
+
+	if _, ok, err := store.VerifyAdminPassword(context.Background(), "admin", "admin"); err != nil || !ok {
+		t.Fatalf("VerifyAdminPassword local priority failed, ok=%v err=%v", ok, err)
+	}
+}
+
+func TestOpenRecordsCurrentSchemaVersion(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "unified.sqlite")
+	store, err := Open(&config.Config{
+		StorageDir: root,
+		Database: config.DatabaseConfig{
+			Provider:               "sqlite",
+			SQLitePath:             path,
+			FailoverEnabled:        true,
+			HealthIntervalSec:      3600,
+			MaxOpenConns:           1,
+			MaxIdleConns:           1,
+			ConnMaxLifetimeSeconds: 60,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+
+	var description string
+	if err := store.localDB.QueryRow(`SELECT description FROM schema_migrations WHERE version = ?`, CurrentSchemaVersion).Scan(&description); err != nil {
+		t.Fatal(err)
+	}
+	if description == "" {
+		t.Fatal("schema version description is empty")
+	}
+}
+
+func TestChangeAdminPasswordPersistsWhenRemoteSyncFails(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "unified.sqlite")
+	store, err := Open(&config.Config{
+		StorageDir: root,
+		Database: config.DatabaseConfig{
+			Provider:               "sqlite",
+			SQLitePath:             path,
+			FailoverEnabled:        true,
+			HealthIntervalSec:      3600,
+			MaxOpenConns:           1,
+			MaxIdleConns:           1,
+			ConnMaxLifetimeSeconds: 60,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	if err := store.EnsureDefaultAdmin(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+
+	remote, err := sql.Open("sqlite", filepath.Join(root, "closed-remote-password.sqlite"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = remote.Close()
+	store.cfg.Database.Provider = "mysql"
+	store.mu.Lock()
+	store.remoteDB = remote
+	store.remoteDialect = dialectFor("sqlite")
+	store.status.ConfigProvider = "mysql"
+	store.mu.Unlock()
+
+	warning, err := store.ChangeAdminPasswordWithWarning(context.Background(), "admin", "admin", "new-local-password")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if warning == "" {
+		t.Fatal("expected remote sync warning")
+	}
+	if _, ok, err := store.VerifyAdminPassword(context.Background(), "admin", "new-local-password"); err != nil || !ok {
+		t.Fatalf("new password was not persisted locally, ok=%v err=%v", ok, err)
+	}
+	if _, ok, err := store.VerifyAdminPassword(context.Background(), "admin", "admin"); err != nil || ok {
+		t.Fatalf("old password still works, ok=%v err=%v", ok, err)
+	}
+}
+
+func TestChangeAdminPasswordAcceptsRemoteCurrentPasswordAndPersistsLocal(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "unified.sqlite")
+	store, err := Open(&config.Config{
+		StorageDir: root,
+		Database: config.DatabaseConfig{
+			Provider:               "sqlite",
+			SQLitePath:             path,
+			FailoverEnabled:        true,
+			HealthIntervalSec:      3600,
+			MaxOpenConns:           1,
+			MaxIdleConns:           1,
+			ConnMaxLifetimeSeconds: 60,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	if err := store.EnsureDefaultAdmin(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+
+	remote, err := sql.Open("sqlite", filepath.Join(root, "remote-password.sqlite"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	remoteDialect := dialectFor("sqlite")
+	if err := store.migrate(remote, remoteDialect); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.ensureDefaultAdminOn(remote, remoteDialect); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.changeAdminPasswordOn(remote, remoteDialect, "admin", passwordHash("remote-current-password"), Now(), false); err != nil {
+		t.Fatal(err)
+	}
+	defer remote.Close()
+
+	store.cfg.Database.Provider = "mysql"
+	store.mu.Lock()
+	store.remoteDB = remote
+	store.remoteDialect = remoteDialect
+	store.status.ConfigProvider = "mysql"
+	store.mu.Unlock()
+
+	if _, err := store.ChangeAdminPasswordWithWarning(context.Background(), "admin", "remote-current-password", "merged-password"); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, err := store.verifyAdminPasswordOn(store.localDB, store.localDialect, "admin", "merged-password"); err != nil || !ok {
+		t.Fatalf("new password was not persisted to local sqlite, ok=%v err=%v", ok, err)
+	}
+	if _, ok, err := store.verifyAdminPasswordOn(remote, remoteDialect, "admin", "merged-password"); err != nil || !ok {
+		t.Fatalf("new password was not synced to remote, ok=%v err=%v", ok, err)
+	}
+}
+
+func TestChangeAdminPasswordRejectsWeakPasswords(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "unified.sqlite")
+	store, err := Open(&config.Config{
+		StorageDir: root,
+		Database: config.DatabaseConfig{
+			Provider:               "sqlite",
+			SQLitePath:             path,
+			FailoverEnabled:        true,
+			HealthIntervalSec:      3600,
+			MaxOpenConns:           1,
+			MaxIdleConns:           1,
+			ConnMaxLifetimeSeconds: 60,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	if err := store.EnsureDefaultAdmin(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, next := range []string{"", "short", "admin"} {
+		if _, err := store.ChangeAdminPasswordWithWarning(context.Background(), "admin", "admin", next); err == nil {
+			t.Fatalf("expected password %q to be rejected", next)
+		}
+	}
+}