fix web ui smoke and brand assets

2026-06-30 11:13:30 +08:00
parent 0dfb2988b2
commit 9920575bba
103 changed files with 6650 additions and 135 deletions
@@ -0,0 +1,45 @@
+# Remote Auth, Session, and Permission Test Report
+
+Date: 2026-06-29T05:09:44.031Z
+Base URL: https://100.90.90.91
+Username: admin
+Low-Privilege Username: codex.low
+
+| Result | Check | Detail |
+| --- | --- | --- |
+| PASS | captcha endpoint is public | status=200, duration=2229ms |
+| PASS | captcha returns id, SVG image, and expiry | captchaId=e003b59f-ddd2-4732-a0eb-8e7ff9e2a30e, expiresAt=2026-06-29T05:14:28.340Z |
+| PASS | protected API rejects anonymous request | status=401, duration=664ms |
+| PASS | login rejects invalid captcha | status=401, duration=375ms |
+| PASS | invalid captcha returns AUTH_CAPTCHA_INVALID | code=AUTH_CAPTCHA_INVALID |
+| PASS | captcha answer can be parsed from SVG | length=5 |
+| PASS | login rejects invalid password with valid captcha | status=401, duration=613ms |
+| PASS | invalid credentials code is returned | code=AUTH_INVALID_CREDENTIALS |
+| PASS | login succeeds with valid captcha and password | status=200, duration=581ms |
+| PASS | login returns access token | tokenLength=296 |
+| PASS | login returns user profile and permissions | {"id":"usr_admin","username":"admin","displayName":"系统管理员","roles":["超级管理员"],"permissionCount":24} |
+| PASS | login sets HttpOnly refresh cookie | refresh cookie present |
+| PASS | low-privilege role is created | status=201, duration=555ms |
+| PASS | low-privilege role only has dashboard.view | roleId=rol_1f4592370a1941cf860ff1afdc92, permissions=dashboard.view |
+| PASS | low-privilege user is created | status=201, duration=449ms |
+| PASS | low-privilege user is bound to low role | userId=usr_102e3dcda767449f9f288ec09e8b, roleIds=rol_1f4592370a1941cf860ff1afdc92 |
+| PASS | bearer token can access protected dashboard summary | status=200, duration=387ms |
+| PASS | invalid bearer token is rejected | status=401, duration=378ms |
+| PASS | refresh rotates session and returns new token | status=200, duration=391ms |
+| PASS | refresh returns access token | tokenChanged=true |
+| PASS | refresh sets a rotated refresh cookie | rotated cookie present |
+| PASS | refreshed bearer token can access protected dashboard summary | status=200, duration=383ms |
+| PASS | logout revokes current refresh session | status=204, duration=384ms |
+| PASS | refresh after logout is rejected | status=401, duration=825ms |
+| PASS | low-privilege captcha answer can be parsed from SVG | length=5 |
+| PASS | low-privilege user can login | status=200, duration=636ms |
+| PASS | low-privilege login returns dashboard.view only | {"id":"usr_102e3dcda767449f9f288ec09e8b","username":"codex.low","displayName":"Codex低权限测试用户","roles":["自动化低权限角色"],"permissionCount":1} |
+| PASS | low-privilege user can access allowed dashboard summary | status=200, duration=697ms |
+| PASS | low-privilege user is forbidden from users.manage endpoint | status=403, duration=1132ms |
+| PASS | admin account has non-empty permission set | permissionCount=24, roles=超级管理员 |
+
+## Notes
+
+- Password and token values are intentionally omitted.
+- This run uses the remote B service as a black-box API target.
+- The low-privilege role and user are created or updated through the admin API before RBAC assertions.