hectorzhao/lisglosips
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix web ui smoke and brand assets

Browse Source
This commit is contained in:
hectorzhao
2026-06-30 11:13:30 +08:00
parent 0dfb2988b2
commit 9920575bba
103 changed files with 6650 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/reports/REMOTE_AUTH_RBAC_20260629T050554Z.md
+35
View File
@@ -0,0 +1,35 @@
# Remote Auth, Session, and Permission Test Report
Date: 2026-06-29T05:05:54.328Z
Base URL: https://100.90.90.91
Username: admin
| Result | Check | Detail |
| --- | --- | --- |
| PASS | captcha endpoint is public | status=200, duration=1787ms |
| PASS | captcha returns id, SVG image, and expiry | captchaId=9de040cf-75c5-440f-a5cc-4bbf16d052c3, expiresAt=2026-06-29T05:10:43.316Z |
| PASS | protected API rejects anonymous request | status=401, duration=1025ms |
| PASS | login rejects invalid captcha | status=401, duration=1152ms |
| PASS | invalid captcha returns AUTH_CAPTCHA_INVALID | code=AUTH_CAPTCHA_INVALID |
| PASS | captcha answer can be parsed from SVG | length=5 |
| PASS | login rejects invalid password with valid captcha | status=401, duration=489ms |
| PASS | invalid credentials code is returned | code=AUTH_INVALID_CREDENTIALS |
| PASS | login succeeds with valid captcha and password | status=200, duration=456ms |
| PASS | login returns access token | tokenLength=296 |
| PASS | login returns user profile and permissions | {"id":"usr_admin","username":"admin","displayName":"系统管理员","roles":["超级管理员"],"permissionCount":24} |
| PASS | login sets HttpOnly refresh cookie | refresh cookie present |
| PASS | bearer token can access protected dashboard summary | status=200, duration=402ms |
| PASS | invalid bearer token is rejected | status=401, duration=790ms |
| PASS | refresh rotates session and returns new token | status=200, duration=392ms |
| PASS | refresh returns access token | tokenChanged=true |
| PASS | refresh sets a rotated refresh cookie | rotated cookie present |
| PASS | refreshed bearer token can access protected dashboard summary | status=200, duration=411ms |
| PASS | logout revokes current refresh session | status=204, duration=399ms |
| PASS | refresh after logout is rejected | status=401, duration=376ms |
| PASS | admin account has non-empty permission set | permissionCount=24, roles=超级管理员 |
## Notes
- Password and token values are intentionally omitted.
- This run uses the remote B service as a black-box API target.
- Permission-denied 403 checks require a low-privilege account and are not asserted by this admin-only run.