3.1 KiB
3.1 KiB
Remote Auth, Session, and Permission Test Report
Date: 2026-06-29T05:10:08.459Z Base URL: https://100.90.90.91 Username: admin Low-Privilege Username: codex.low
| Result | Check | Detail |
|---|---|---|
| PASS | captcha endpoint is public | status=200, duration=2754ms |
| PASS | captcha returns id, SVG image, and expiry | captchaId=ffef58d0-1acf-43f7-adf2-6a97bf64960d, expiresAt=2026-06-29T05:14:51.988Z |
| PASS | protected API rejects anonymous request | status=401, duration=387ms |
| PASS | login rejects invalid captcha | status=401, duration=857ms |
| PASS | invalid captcha returns AUTH_CAPTCHA_INVALID | code=AUTH_CAPTCHA_INVALID |
| PASS | captcha answer can be parsed from SVG | length=5 |
| PASS | login rejects invalid password with valid captcha | status=401, duration=441ms |
| PASS | invalid credentials code is returned | code=AUTH_INVALID_CREDENTIALS |
| PASS | login succeeds with valid captcha and password | status=200, duration=455ms |
| PASS | login returns access token | tokenLength=296 |
| PASS | login returns user profile and permissions | {"id":"usr_admin","username":"admin","displayName":"系统管理员","roles":["超级管理员"],"permissionCount":24} |
| PASS | login sets HttpOnly refresh cookie | refresh cookie present |
| PASS | low-privilege role is updated | status=200, duration=400ms |
| PASS | low-privilege role only has dashboard.view | roleId=rol_1f4592370a1941cf860ff1afdc92, permissions=dashboard.view |
| FAIL | low-privilege user is updated | status=201, duration=583ms |
| PASS | low-privilege user is bound to low role | userId=usr_102e3dcda767449f9f288ec09e8b, roleIds=rol_1f4592370a1941cf860ff1afdc92 |
| PASS | bearer token can access protected dashboard summary | status=200, duration=430ms |
| PASS | invalid bearer token is rejected | status=401, duration=379ms |
| PASS | refresh rotates session and returns new token | status=200, duration=412ms |
| PASS | refresh returns access token | tokenChanged=true |
| PASS | refresh sets a rotated refresh cookie | rotated cookie present |
| PASS | refreshed bearer token can access protected dashboard summary | status=200, duration=979ms |
| PASS | logout revokes current refresh session | status=204, duration=531ms |
| PASS | refresh after logout is rejected | status=401, duration=373ms |
| PASS | low-privilege captcha answer can be parsed from SVG | length=5 |
| PASS | low-privilege user can login | status=200, duration=709ms |
| PASS | low-privilege login returns dashboard.view only | {"id":"usr_102e3dcda767449f9f288ec09e8b","username":"codex.low","displayName":"Codex低权限测试用户","roles":["自动化低权限角色"],"permissionCount":1} |
| PASS | low-privilege user can access allowed dashboard summary | status=200, duration=572ms |
| PASS | low-privilege user is forbidden from users.manage endpoint | status=403, duration=383ms |
| PASS | admin account has non-empty permission set | permissionCount=24, roles=超级管理员 |
Notes
- Password and token values are intentionally omitted.
- This run uses the remote B service as a black-box API target.
- The low-privilege role and user are created or updated through the admin API before RBAC assertions.