# Remote Auth, Session, and Permission Test Report

Date: 2026-06-29T05:05:54.328Z
Base URL: https://100.90.90.91
Username: admin

| Result | Check | Detail |
| --- | --- | --- |
| PASS | captcha endpoint is public | status=200, duration=1787ms |
| PASS | captcha returns id, SVG image, and expiry | captchaId=9de040cf-75c5-440f-a5cc-4bbf16d052c3, expiresAt=2026-06-29T05:10:43.316Z |
| PASS | protected API rejects anonymous request | status=401, duration=1025ms |
| PASS | login rejects invalid captcha | status=401, duration=1152ms |
| PASS | invalid captcha returns AUTH_CAPTCHA_INVALID | code=AUTH_CAPTCHA_INVALID |
| PASS | captcha answer can be parsed from SVG | length=5 |
| PASS | login rejects invalid password with valid captcha | status=401, duration=489ms |
| PASS | invalid credentials code is returned | code=AUTH_INVALID_CREDENTIALS |
| PASS | login succeeds with valid captcha and password | status=200, duration=456ms |
| PASS | login returns access token | tokenLength=296 |
| PASS | login returns user profile and permissions | {"id":"usr_admin","username":"admin","displayName":"系统管理员","roles":["超级管理员"],"permissionCount":24} |
| PASS | login sets HttpOnly refresh cookie | refresh cookie present |
| PASS | bearer token can access protected dashboard summary | status=200, duration=402ms |
| PASS | invalid bearer token is rejected | status=401, duration=790ms |
| PASS | refresh rotates session and returns new token | status=200, duration=392ms |
| PASS | refresh returns access token | tokenChanged=true |
| PASS | refresh sets a rotated refresh cookie | rotated cookie present |
| PASS | refreshed bearer token can access protected dashboard summary | status=200, duration=411ms |
| PASS | logout revokes current refresh session | status=204, duration=399ms |
| PASS | refresh after logout is rejected | status=401, duration=376ms |
| PASS | admin account has non-empty permission set | permissionCount=24, roles=超级管理员 |

## Notes

- Password and token values are intentionally omitted.
- This run uses the remote B service as a black-box API target.
- Permission-denied 403 checks require a low-privilege account and are not asserted by this admin-only run.