44 lines
4.0 KiB
JavaScript
44 lines
4.0 KiB
JavaScript
// Checks existing synthetic credentials only; never resets passwords or creates users.
|
|
import fs from 'node:fs/promises';
|
|
import assert from 'node:assert/strict';
|
|
const reports=[];
|
|
// Existing integrated evaluation entry: verify all four roles without credentials.
|
|
for(const role of ['preparador','validador','tecnico','verificador']){
|
|
const cookies=new Map();
|
|
async function get(path,method='GET',body){
|
|
const r=await fetch('http://127.0.0.1:8002'+path,{method,redirect:'manual',headers:{Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),...(body?{'Content-Type':'application/x-www-form-urlencoded'}:{})},...(body?{body:new URLSearchParams(body)}:{})});
|
|
for(const c of r.headers.getSetCookie()){const pair=c.split(';',1)[0],i=pair.indexOf('=');cookies.set(pair.slice(0,i),pair.slice(i+1));}
|
|
return {status:r.status,text:await r.text(),location:r.headers.get('location')};
|
|
}
|
|
const landing=await get('/avaliar');assert.equal(landing.status,200);
|
|
const token=landing.text.match(/name="_token" value="([^"]+)"/)?.[1];assert(token);
|
|
const entry=await get('/avaliar/entrar','POST',{role,_token:token});assert.equal(entry.status,302);assert.equal(new URL(entry.location, 'http://127.0.0.1:8002').pathname,'/','evaluation redirect');
|
|
assert.equal((await get('/')).status,200);
|
|
const session=JSON.parse((await get('/api/session')).text);assert(session.user);assert(session.context);
|
|
assert.equal((await get('/api/workshop')).status,200);
|
|
const logout=await fetch('http://127.0.0.1:8002/api/logout',{method:'POST',headers:{Accept:'application/json',Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),'X-CSRF-TOKEN':session.csrf}});assert.equal(logout.status,200);
|
|
reports.push({host:'sgf-product',role,password_required:false,authorised_consultation:true,logout:true});
|
|
}
|
|
for(const mode of ['compras','sgf']){
|
|
const fixture=JSON.parse(await fs.readFile(`C:/laragon/data/sgf-tempo/secrets/payables-demo-${mode}-access.json`,'utf8'));
|
|
const base=`http://127.0.0.1:${mode==='compras'?8005:8006}`;
|
|
for(const [role,account] of Object.entries(fixture.accounts)){
|
|
const cookies=new Map();let csrf='',context='';
|
|
async function request(path,method='GET',body){
|
|
const r=await fetch(base+path,{method,redirect:'manual',headers:{Accept:'application/json','Content-Type':'application/json',Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),'X-CSRF-TOKEN':csrf,'X-XSRF-TOKEN':decodeURIComponent(cookies.get('XSRF-TOKEN')??''),'X-SGF-Context':context},...(body?{body:JSON.stringify(body)}:{})});
|
|
for(const c of r.headers.getSetCookie()){const pair=c.split(';',1)[0],i=pair.indexOf('=');cookies.set(pair.slice(0,i),pair.slice(i+1));}
|
|
const text=await r.text();let data={};try{data=JSON.parse(text);}catch{}
|
|
if(data.csrf)csrf=data.csrf;if(data.context?.token)context=data.context.token;
|
|
return {status:r.status,data};
|
|
}
|
|
assert.equal((await request(mode==='compras'?'/login':'/api/session')).status,200);
|
|
const login=await request(mode==='compras'?'/login':'/api/login','POST',{email:account.email,password:account.password});assert.equal(login.status,200,mode+' '+role+' existing login');
|
|
if(mode==='sgf')assert.equal((await request('/api/context','POST',fixture.scope)).status,200);
|
|
assert.equal((await request('/api/supplier-payables')).status,200);
|
|
assert.equal((await request(mode==='compras'?'/logout':'/api/logout','POST',{})).status,mode==='compras'?204:200);
|
|
reports.push({host:mode,role,existing_password_accepted:true,authorised_consultation:true,logout:true});
|
|
}
|
|
}
|
|
await fs.writeFile('docs/proofs/access-recovery.json',JSON.stringify({checked_at:new Date().toISOString(),results:reports,accounts_created:0,passwords_changed:0,permissions_changed:0,business_commands:0,visual_review:false},null,2)+'\n');
|
|
console.log('Integrated password-free SGF entry passed for four roles; six existing payables credentials accepted by their correct hosts. Consultation and logout passed.');
|