# Remote Auth, Session, and Permission Test Report

Date: 2026-06-29T05:09:44.031Z
Base URL: https://100.90.90.91
Username: admin
Low-Privilege Username: codex.low

| Result | Check | Detail |
| --- | --- | --- |
| PASS | captcha endpoint is public | status=200, duration=2229ms |
| PASS | captcha returns id, SVG image, and expiry | captchaId=e003b59f-ddd2-4732-a0eb-8e7ff9e2a30e, expiresAt=2026-06-29T05:14:28.340Z |
| PASS | protected API rejects anonymous request | status=401, duration=664ms |
| PASS | login rejects invalid captcha | status=401, duration=375ms |
| PASS | invalid captcha returns AUTH_CAPTCHA_INVALID | code=AUTH_CAPTCHA_INVALID |
| PASS | captcha answer can be parsed from SVG | length=5 |
| PASS | login rejects invalid password with valid captcha | status=401, duration=613ms |
| PASS | invalid credentials code is returned | code=AUTH_INVALID_CREDENTIALS |
| PASS | login succeeds with valid captcha and password | status=200, duration=581ms |
| PASS | login returns access token | tokenLength=296 |
| PASS | login returns user profile and permissions | {"id":"usr_admin","username":"admin","displayName":"系统管理员","roles":["超级管理员"],"permissionCount":24} |
| PASS | login sets HttpOnly refresh cookie | refresh cookie present |
| PASS | low-privilege role is created | status=201, duration=555ms |
| PASS | low-privilege role only has dashboard.view | roleId=rol_1f4592370a1941cf860ff1afdc92, permissions=dashboard.view |
| PASS | low-privilege user is created | status=201, duration=449ms |
| PASS | low-privilege user is bound to low role | userId=usr_102e3dcda767449f9f288ec09e8b, roleIds=rol_1f4592370a1941cf860ff1afdc92 |
| PASS | bearer token can access protected dashboard summary | status=200, duration=387ms |
| PASS | invalid bearer token is rejected | status=401, duration=378ms |
| PASS | refresh rotates session and returns new token | status=200, duration=391ms |
| PASS | refresh returns access token | tokenChanged=true |
| PASS | refresh sets a rotated refresh cookie | rotated cookie present |
| PASS | refreshed bearer token can access protected dashboard summary | status=200, duration=383ms |
| PASS | logout revokes current refresh session | status=204, duration=384ms |
| PASS | refresh after logout is rejected | status=401, duration=825ms |
| PASS | low-privilege captcha answer can be parsed from SVG | length=5 |
| PASS | low-privilege user can login | status=200, duration=636ms |
| PASS | low-privilege login returns dashboard.view only | {"id":"usr_102e3dcda767449f9f288ec09e8b","username":"codex.low","displayName":"Codex低权限测试用户","roles":["自动化低权限角色"],"permissionCount":1} |
| PASS | low-privilege user can access allowed dashboard summary | status=200, duration=697ms |
| PASS | low-privilege user is forbidden from users.manage endpoint | status=403, duration=1132ms |
| PASS | admin account has non-empty permission set | permissionCount=24, roles=超级管理员 |

## Notes

- Password and token values are intentionally omitted.
- This run uses the remote B service as a black-box API target.
- The low-privilege role and user are created or updated through the admin API before RBAC assertions.