hectorzhao/lislgosms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce strong hashes in maintenance tools

Browse Source
This commit is contained in:
hectorzhao
2026-08-28 12:00:55 +08:00
parent d85ff85999
commit fc4a6a7afc
3 changed files with 25 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/quality/verify-code-quality.mjs
+12
View File
@@ -34,6 +34,18 @@ const authService = readFileSync(resolve(root, 'api/src/auth/auth.service.ts'),
if (/passwordHash\s*===|===\s*[^\n;]*passwordHash/.test(authService)) {
violations.push('api/src/auth/auth.service.ts: password hashes must not be compared directly');
}
const ensureAdmin = readFileSync(resolve(root, 'tools/deploy/ensure-production-admin.mjs'), 'utf8');
if (/createHash\(['"]sha256['"]\)|function\s+hashPassword\s*\(/.test(ensureAdmin)
|| !ensureAdmin.includes("api/dist/auth/password-hasher.js")) {
violations.push('tools/deploy/ensure-production-admin.mjs: administrative password writes must use the API password hasher');
}
for (const relativePath of ['tools/deploy/ensure-production-admin.mjs', 'tools/smoke/real-env-smoke.mjs']) {
const content = readFileSync(resolve(root, relativePath), 'utf8');
if (/function\s+hashPassword\s*\(|passwordHash:\s*(?:createHash|legacyHashPassword)/.test(content)
|| !content.includes("api/dist/auth/password-hasher.js")) {
violations.push(`${relativePath}: user password writes must use the compiled API password hasher`);
}
}
const packageJson = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
if (packageJson.dependencies?.['react-router-dom'] !== '7.18.2') {