mirror of
https://github.com/shuaiplus/nodewarden.git
synced 2026-06-20 21:00:41 +00:00
shuaiplus
2a747c996d
- Introduced `PaginationRequest` interface to define pagination parameters. - Implemented `parsePagination` function to extract and validate pagination parameters from a URL. - Added `encodeContinuationToken` and `decodeContinuationToken` functions for managing continuation tokens. - Ensured that pagination respects maximum page size limits defined in configuration.
1773 lines
80 KiB
TypeScript
1773 lines
80 KiB
TypeScript
#!/usr/bin/env npx tsx
|
||
/**
|
||
* ╔══════════════════════════════════════════════════════════════╗
|
||
* ║ NodeWarden 自查程序 — Bitwarden API 兼容性全面诊断 ║
|
||
* ╚══════════════════════════════════════════════════════════════╝
|
||
*
|
||
* 功能：自动验证 NodeWarden 服务端的所有 API 端点，确保兼容
|
||
* Bitwarden 全平台客户端（Windows / Android / iOS / 浏览器
|
||
* 插件 / Linux / macOS / CLI）。
|
||
*
|
||
* 核心特性：
|
||
* · 内置 Bitwarden 标准 KDF（PBKDF2-SHA256），输入明文密码即可
|
||
* · 自动注册（全新实例）或自动登录（已有用户）
|
||
* · 空保管库锁定/解锁回归测试（历史 bug 场景）
|
||
* · JWT 内部声明验证（移动端依赖）
|
||
* · 多客户端平台兼容性验证（不同 client_id、设备头）
|
||
* · CORS 深度验证（浏览器插件依赖）
|
||
* · 覆盖全部已实现端点 + 未实现端点差距分析
|
||
* · 响应结构合规性校验（字段、格式、嵌套结构）
|
||
* · 带颜色的分组输出 + 汇总报告
|
||
*
|
||
* 用法：
|
||
* npx tsx tests/selfcheck.ts [服务器地址] [邮箱] [明文密码]
|
||
*
|
||
* 示例：
|
||
* npx tsx tests/selfcheck.ts http://localhost:8787 test@test.com testtesttest
|
||
*
|
||
* 也可以通过环境变量传入（优先级低于命令行参数）：
|
||
* NW_URL=http://localhost:8787
|
||
* NW_EMAIL=test@test.com
|
||
* NW_PASSWORD=testtesttest
|
||
*
|
||
* 注意：
|
||
* · 运行前请确保 NodeWarden 服务器已启动（npm run dev）
|
||
* · 自查会创建测试数据（文件夹、密码项等），测试结束后会自动清理
|
||
* · 如果是全新数据库，会自动用提供的邮箱和密码注册第一个用户
|
||
*/
|
||
|
||
import { pbkdf2Sync, randomBytes } from 'node:crypto';
|
||
|
||
// ─── 配置 ───────────────────────────────────────────────────────────────────
|
||
// 优先取命令行参数，其次取环境变量，最后用默认值
|
||
|
||
const BASE = (process.argv[2] || process.env.NW_URL || 'https://key.shuai.plus').replace(/\/+$/, '');
|
||
const EMAIL = (process.argv[3] || process.env.NW_EMAIL || 'shuai@cock.li').toLowerCase();
|
||
const PASSWORD = (process.argv[4] || process.env.NW_PASSWORD || 'rezwangul4qoxka@');
|
||
|
||
// ─── Bitwarden KDF ─────────────────────────────────────────────────────────
|
||
// Bitwarden 客户端在注册和登录时，不会把明文密码发给服务器。
|
||
// 流程：
|
||
// 1. prelogin 获取 KDF 参数（kdfType, kdfIterations）
|
||
// 2. masterKey = PBKDF2-SHA256(password, salt=email, iterations, 32字节)
|
||
// 3. masterPasswordHash = Base64( PBKDF2-SHA256(masterKey, salt=password, 1次, 32字节) )
|
||
// 4. 把 masterPasswordHash 发给服务器
|
||
//
|
||
// 下面的函数实现了这套标准流程。
|
||
|
||
/**
|
||
* 计算 Bitwarden 的 masterPasswordHash
|
||
* @param password - 用户明文密码
|
||
* @param email - 用户邮箱（小写，作为盐）
|
||
* @param kdfType - KDF 类型（0=PBKDF2, 1=Argon2id）
|
||
* @param iterations - KDF 迭代次数
|
||
* @returns Base64 编码的 masterPasswordHash
|
||
*/
|
||
function computePasswordHash(password: string, email: string, kdfType: number, iterations: number): string {
|
||
if (kdfType !== 0) {
|
||
throw new Error(`不支持的 KDF 类型: ${kdfType}（仅支持 PBKDF2=0）`);
|
||
}
|
||
// 第一步：用邮箱作为盐，对密码做 PBKDF2 派生 → masterKey（32字节）
|
||
const masterKey = pbkdf2Sync(password, email, iterations, 32, 'sha256');
|
||
// 第二步：用密码作为盐，对 masterKey 再做 1 次 PBKDF2 → 最终哈希
|
||
const hash = pbkdf2Sync(masterKey, password, 1, 32, 'sha256');
|
||
return hash.toString('base64');
|
||
}
|
||
|
||
/**
|
||
* 生成假的加密密钥（注册时占位用）
|
||
* 格式模拟 Bitwarden 客户端: "2.base64IV|base64Data|base64MAC"
|
||
*/
|
||
function generateFakeEncKey(): string {
|
||
const iv = randomBytes(16).toString('base64');
|
||
const data = randomBytes(32).toString('base64');
|
||
const mac = randomBytes(32).toString('base64');
|
||
return `2.${iv}|${data}|${mac}`;
|
||
}
|
||
|
||
/**
|
||
* 解码 JWT payload（不验证签名，仅用于检查声明字段）
|
||
* Bitwarden 移动端会在本地解码 JWT 检查 email_verified、amr 等字段
|
||
*/
|
||
function decodeJwtPayload(token: string): Record<string, any> | null {
|
||
try {
|
||
const parts = token.split('.');
|
||
if (parts.length !== 3) return null;
|
||
// JWT 的 base64url 编码需要转换为标准 base64
|
||
let b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
|
||
while (b64.length % 4) b64 += '=';
|
||
return JSON.parse(Buffer.from(b64, 'base64').toString('utf-8'));
|
||
} catch { return null; }
|
||
}
|
||
|
||
// ─── ANSI 颜色 ─────────────────────────────────────────────────────────────
|
||
|
||
const c = {
|
||
reset : '\x1b[0m',
|
||
bold : '\x1b[1m',
|
||
dim : '\x1b[2m',
|
||
green : '\x1b[32m',
|
||
red : '\x1b[31m',
|
||
yellow: '\x1b[33m',
|
||
cyan : '\x1b[36m',
|
||
gray : '\x1b[90m',
|
||
white : '\x1b[97m',
|
||
};
|
||
|
||
// ─── 结果类型 ───────────────────────────────────────────────────────────────
|
||
|
||
type Status = 'PASS' | 'FAIL' | 'WARN' | 'SKIP';
|
||
|
||
interface TestResult {
|
||
group : string;
|
||
name : string;
|
||
status : Status;
|
||
detail? : string;
|
||
ms : number;
|
||
}
|
||
|
||
// ─── 运行时状态 ─────────────────────────────────────────────────────────────
|
||
|
||
let masterPasswordHash = ''; // 经 KDF 计算后的密码哈希
|
||
let userEncKey = ''; // 用户加密密钥
|
||
let accessToken = ''; // JWT 访问令牌
|
||
let refreshToken = ''; // 刷新令牌
|
||
let userId = ''; // 用户 ID
|
||
let testFolderId = ''; // 测试文件夹 ID
|
||
let testCipherId = ''; // 测试 Login 密码项 ID
|
||
let testCipher2Id = ''; // 测试 SecureNote 密码项 ID（将被永久删除）
|
||
let testAttachmentId = ''; // 测试附件 ID
|
||
let downloadToken = ''; // 附件下载令牌
|
||
let isNewRegistration = false;
|
||
|
||
// Track ALL test-created cipher and folder IDs so cleanup can permanently delete them.
|
||
// This prevents leftover undecryptable "[error: cannot decrypt]" items in the vault.
|
||
const allCreatedCipherIds: string[] = [];
|
||
const allCreatedFolderIds: string[] = [];
|
||
|
||
const results: TestResult[] = [];
|
||
|
||
// ─── HTTP 请求辅助 ─────────────────────────────────────────────────────────
|
||
|
||
type FetchOpt = {
|
||
method? : string;
|
||
body? : any;
|
||
form? : Record<string, string>;
|
||
auth? : boolean;
|
||
headers? : Record<string, string>;
|
||
};
|
||
|
||
/**
|
||
* 统一 API 请求封装
|
||
* @param path - 请求路径
|
||
* @param opt - 选项：method、body（JSON）、form（表单）、auth（是否附加令牌）、headers
|
||
*/
|
||
async function api(path: string, opt: FetchOpt = {}): Promise<{ status: number; body: any; raw: Response }> {
|
||
const url = `${BASE}${path}`;
|
||
const headers: Record<string, string> = { 'Accept': 'application/json', ...opt.headers };
|
||
|
||
if (opt.auth !== false && accessToken) {
|
||
headers['Authorization'] = `Bearer ${accessToken}`;
|
||
}
|
||
|
||
let reqBody: string | undefined;
|
||
if (opt.form) {
|
||
headers['Content-Type'] = 'application/x-www-form-urlencoded';
|
||
reqBody = new URLSearchParams(opt.form).toString();
|
||
} else if (opt.body !== undefined) {
|
||
headers['Content-Type'] = 'application/json';
|
||
reqBody = JSON.stringify(opt.body);
|
||
}
|
||
|
||
const resp = await fetch(url, { method: opt.method || 'GET', headers, body: reqBody, redirect: 'manual' });
|
||
let body: any;
|
||
const text = await resp.text();
|
||
try { body = JSON.parse(text); } catch { body = text; }
|
||
return { status: resp.status, body, raw: resp };
|
||
}
|
||
|
||
// ─── 测试运行器 ─────────────────────────────────────────────────────────────
|
||
|
||
let currentGroup = '';
|
||
|
||
function group(name: string) {
|
||
currentGroup = name;
|
||
console.log(`\n${c.bold}${c.cyan}━━ ${name} ━━${c.reset}`);
|
||
}
|
||
|
||
async function test(name: string, fn: () => Promise<{ ok: boolean; detail?: string; warn?: boolean }>): Promise<void> {
|
||
const t0 = performance.now();
|
||
let status: Status = 'PASS';
|
||
let detail: string | undefined;
|
||
try {
|
||
const r = await fn();
|
||
if (r.warn) {
|
||
status = 'WARN';
|
||
} else {
|
||
status = r.ok ? 'PASS' : 'FAIL';
|
||
}
|
||
detail = r.detail;
|
||
} catch (e: any) {
|
||
status = 'FAIL';
|
||
detail = e.message || String(e);
|
||
}
|
||
const ms = performance.now() - t0;
|
||
results.push({ group: currentGroup, name, status, detail, ms });
|
||
const icon = { PASS: `${c.green}✔`, FAIL: `${c.red}✘`, WARN: `${c.yellow}⚠`, SKIP: `${c.gray}○` }[status];
|
||
const time = `${c.dim}${ms.toFixed(0)}ms${c.reset}`;
|
||
const det = detail ? ` ${c.dim}${detail}${c.reset}` : '';
|
||
console.log(` ${icon} ${c.reset}${name} ${time}${det}`);
|
||
}
|
||
|
||
function skip(name: string, reason: string) {
|
||
results.push({ group: currentGroup, name, status: 'SKIP', detail: reason, ms: 0 });
|
||
console.log(` ${c.gray}○ ${name} ${c.dim}${reason}${c.reset}`);
|
||
}
|
||
|
||
// ─── 结构验证辅助 ──────────────────────────────────────────────────────────
|
||
|
||
/** 检查对象是否包含指定的所有键，返回缺失键列表 */
|
||
function hasKeys(obj: any, keys: string[]): string[] {
|
||
if (!obj || typeof obj !== 'object') return ['（不是对象）'];
|
||
return keys.filter(k => !(k in obj));
|
||
}
|
||
|
||
/** 验证 Bitwarden 列表格式 { data: [...], object: "list" } */
|
||
function expectList(body: any, objectName = 'list'): { ok: boolean; detail?: string } {
|
||
const missing = hasKeys(body, ['data', 'object']);
|
||
if (missing.length) return { ok: false, detail: `缺少字段: ${missing.join(', ')}` };
|
||
if (body.object !== objectName) return { ok: false, detail: `object="${body.object}" 期望="${objectName}"` };
|
||
if (!Array.isArray(body.data)) return { ok: false, detail: 'data 不是数组' };
|
||
return { ok: true };
|
||
}
|
||
|
||
// ─── 客户端期望的关键响应字段清单 ──────────────────────────────────────────
|
||
|
||
// Profile：全平台客户端都会读取这些字段
|
||
const PROFILE_KEYS = [
|
||
'id', 'name', 'email', 'emailVerified', 'premium', 'key', 'privateKey',
|
||
'securityStamp', 'organizations', 'providers', 'providerOrganizations',
|
||
'twoFactorEnabled', 'forcePasswordReset', 'culture', 'object', 'creationDate',
|
||
];
|
||
|
||
// Cipher：密码项响应的完整字段
|
||
const CIPHER_KEYS = [
|
||
'id', 'type', 'name', 'favorite', 'reprompt', 'edit', 'viewPassword',
|
||
'creationDate', 'revisionDate', 'object', 'collectionIds', 'organizationId',
|
||
'permissions', 'deletedDate',
|
||
];
|
||
|
||
const FOLDER_KEYS = ['id', 'name', 'revisionDate', 'object'];
|
||
|
||
// Sync：全量同步的顶级字段
|
||
const SYNC_KEYS = [
|
||
'profile', 'folders', 'collections', 'ciphers', 'domains',
|
||
'policies', 'sends', 'object', 'UserDecryptionOptions', 'userDecryption',
|
||
];
|
||
|
||
// Token：登录/刷新响应的必需字段
|
||
const TOKEN_KEYS = [
|
||
'access_token', 'expires_in', 'token_type', 'refresh_token',
|
||
'Key', 'PrivateKey', 'Kdf', 'KdfIterations', 'scope', 'UserDecryptionOptions',
|
||
];
|
||
|
||
// ═══════════════════════════════════════════════════════════════════════════
|
||
// 测试套件
|
||
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
||
// ─── 1. 服务器连通性 + Config 深度验证 ──────────────────────────────────────
|
||
// 验证服务器基础端点、Config 结构、favicon、DevTools 探针
|
||
|
||
async function suiteConnectivity() {
|
||
group('1 · 服务器连通性');
|
||
|
||
await test('GET /config 返回有效配置', async () => {
|
||
const { status, body } = await api('/config', { auth: false });
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const missing = hasKeys(body, ['version', 'environment', 'object']);
|
||
if (missing.length) return { ok: false, detail: `缺少字段: ${missing.join(', ')}` };
|
||
return { ok: body.object === 'config', detail: `版本 ${body.version}` };
|
||
});
|
||
|
||
await test('GET /api/config（别名路径）', async () => {
|
||
const { status, body } = await api('/api/config', { auth: false });
|
||
return { ok: status === 200 && body?.object === 'config' };
|
||
});
|
||
|
||
// Config.environment 所有 URL 字段必须指向服务器自身
|
||
// 客户端用这些 URL 构建后续请求地址
|
||
await test('Config.environment URL 一致性', async () => {
|
||
const { body } = await api('/config', { auth: false });
|
||
const env = body?.environment;
|
||
if (!env) return { ok: false, detail: 'environment 缺失' };
|
||
const checks = [
|
||
env.vault && env.vault.startsWith('http'),
|
||
env.api && env.api.includes('/api'),
|
||
env.identity && env.identity.includes('/identity'),
|
||
env.notifications && env.notifications.includes('/notifications'),
|
||
];
|
||
return { ok: checks.every(Boolean), detail: `vault=${env.vault}` };
|
||
});
|
||
|
||
// featureStates 字段存在（客户端读取 feature flags）
|
||
await test('Config.featureStates 存在', async () => {
|
||
const { body } = await api('/config', { auth: false });
|
||
return { ok: body?.featureStates && typeof body.featureStates === 'object' };
|
||
});
|
||
|
||
await test('GET /api/version 返回版本字符串', async () => {
|
||
const { status, body } = await api('/api/version', { auth: false });
|
||
return { ok: status === 200 && typeof body === 'string' && body.length > 0, detail: body };
|
||
});
|
||
|
||
await test('GET /favicon.ico 返回 SVG 图标', async () => {
|
||
const resp = await fetch(`${BASE}/favicon.ico`);
|
||
const ct = resp.headers.get('content-type') || '';
|
||
const text = await resp.text();
|
||
return { ok: resp.status === 200 && ct.includes('svg') && text.includes('<svg'), detail: ct };
|
||
});
|
||
|
||
await test('GET /favicon.svg 返回 SVG 图标', async () => {
|
||
const resp = await fetch(`${BASE}/favicon.svg`);
|
||
return { ok: resp.status === 200, detail: `状态码=${resp.status}` };
|
||
});
|
||
|
||
await test('GET /.well-known DevTools 探针端点', async () => {
|
||
const { status } = await api('/.well-known/appspecific/com.chrome.devtools.json', { auth: false });
|
||
return { ok: status === 200 };
|
||
});
|
||
}
|
||
|
||
// ─── 2. CORS 深度验证 ──────────────────────────────────────────────────────
|
||
// 浏览器插件（Chrome/Firefox/Safari/Edge）依赖 CORS 头
|
||
// 缺少任何必需头都会导致插件请求被浏览器拦截
|
||
|
||
async function suiteCors() {
|
||
group('2 · CORS 深度验证（浏览器插件必需）');
|
||
|
||
await test('OPTIONS / 返回 204 + CORS 头', async () => {
|
||
const resp = await fetch(`${BASE}/`, {
|
||
method: 'OPTIONS',
|
||
headers: { Origin: BASE },
|
||
});
|
||
const acao = resp.headers.get('access-control-allow-origin');
|
||
return { ok: resp.status === 204 && acao === BASE };
|
||
});
|
||
|
||
// 浏览器插件请求 /identity/connect/token 前会发 OPTIONS 预检
|
||
await test('OPTIONS /identity/connect/token CORS 预检', async () => {
|
||
const resp = await fetch(`${BASE}/identity/connect/token`, { method: 'OPTIONS' });
|
||
return { ok: resp.status === 204 };
|
||
});
|
||
|
||
// 浏览器插件请求 /api/sync 前也会预检
|
||
await test('OPTIONS /api/sync CORS 预检', async () => {
|
||
const resp = await fetch(`${BASE}/api/sync`, { method: 'OPTIONS' });
|
||
return { ok: resp.status === 204 };
|
||
});
|
||
|
||
// Access-Control-Allow-Headers 必须包含这些头
|
||
// Bitwarden 客户端会发送 Device-Type、Bitwarden-Client-Name 等自定义头
|
||
await test('CORS Allow-Headers 包含全部必需头', async () => {
|
||
const resp = await fetch(`${BASE}/`, { method: 'OPTIONS' });
|
||
const ah = (resp.headers.get('access-control-allow-headers') || '').toLowerCase();
|
||
const required = ['authorization', 'content-type', 'accept', 'device-type',
|
||
'bitwarden-client-name', 'bitwarden-client-version'];
|
||
const missing = required.filter(h => !ah.includes(h));
|
||
return { ok: missing.length === 0, detail: missing.length ? `缺少: ${missing.join(', ')}` : '全部包含' };
|
||
});
|
||
|
||
// Allow-Methods 必须包含所有 HTTP 方法
|
||
await test('CORS Allow-Methods 包含 GET/POST/PUT/DELETE', async () => {
|
||
const resp = await fetch(`${BASE}/`, { method: 'OPTIONS' });
|
||
const am = (resp.headers.get('access-control-allow-methods') || '').toUpperCase();
|
||
const required = ['GET', 'POST', 'PUT', 'DELETE'];
|
||
const missing = required.filter(m => !am.includes(m));
|
||
return { ok: missing.length === 0, detail: missing.length ? `缺少: ${missing.join(', ')}` : undefined };
|
||
});
|
||
|
||
// 实际 JSON 响应也必须带 CORS 头（不只是 OPTIONS）
|
||
await test('JSON 响应包含 Access-Control-Allow-Origin（同源）', async () => {
|
||
const resp = await fetch(`${BASE}/config`, {
|
||
headers: { Origin: BASE },
|
||
});
|
||
const acao = resp.headers.get('access-control-allow-origin');
|
||
return { ok: acao === BASE };
|
||
});
|
||
}
|
||
|
||
// ─── 3. 注册与设置 ──────────────────────────────────────────────────────────
|
||
|
||
async function suiteRegistration() {
|
||
group('3 · 注册与设置');
|
||
|
||
await test('GET /setup/status 返回设置状态', async () => {
|
||
const { status, body } = await api('/setup/status', { auth: false });
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
return { ok: 'registered' in body && 'disabled' in body, detail: `已注册=${body.registered}` };
|
||
});
|
||
|
||
// 用默认 KDF 参数计算密码哈希（注册时用默认参数）
|
||
const defaultIter = 600000;
|
||
masterPasswordHash = computePasswordHash(PASSWORD, EMAIL, 0, defaultIter);
|
||
userEncKey = generateFakeEncKey();
|
||
|
||
await test('POST /api/accounts/register（单用户注册）', async () => {
|
||
const { status, body } = await api('/api/accounts/register', {
|
||
method: 'POST', auth: false,
|
||
body: {
|
||
email: EMAIL, name: EMAIL.split('@')[0],
|
||
masterPasswordHash, key: userEncKey,
|
||
kdf: 0, kdfIterations: defaultIter, kdfMemory: null, kdfParallelism: null,
|
||
keys: { publicKey: 'selfcheck-pubkey-placeholder', encryptedPrivateKey: 'selfcheck-privkey-placeholder' },
|
||
},
|
||
});
|
||
if (status === 200) { isNewRegistration = true; return { ok: true, detail: '✓ 新用户创建成功' }; }
|
||
if (status === 403) { return { ok: true, detail: '已有用户注册（正常）' }; }
|
||
return { ok: false, detail: `状态码=${status} ${JSON.stringify(body)}` };
|
||
});
|
||
|
||
await test('POST /api/accounts/register 重复注册 → 403', async () => {
|
||
const { status } = await api('/api/accounts/register', {
|
||
method: 'POST', auth: false,
|
||
body: {
|
||
email: 'duplicate@test.com', masterPasswordHash: 'x', key: 'x',
|
||
kdf: 0, kdfIterations: 600000,
|
||
keys: { publicKey: 'x', encryptedPrivateKey: 'x' },
|
||
},
|
||
});
|
||
return { ok: status === 403, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// ─── 4. 认证 ── 多客户端 + JWT Claims + 边界条件 ───────────────────────────
|
||
// 覆盖所有平台的登录行为差异
|
||
|
||
async function suiteAuth() {
|
||
group('4 · 认证（多平台登录 + JWT 声明）');
|
||
|
||
// 4.1 Prelogin
|
||
await test('POST /identity/accounts/prelogin 返回 KDF 参数', async () => {
|
||
const { status, body } = await api('/identity/accounts/prelogin', {
|
||
method: 'POST', auth: false, body: { email: EMAIL },
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
// 用服务器返回的真实 KDF 参数重新计算密码哈希
|
||
masterPasswordHash = computePasswordHash(PASSWORD, EMAIL, body.kdf, body.kdfIterations);
|
||
return { ok: true, detail: `kdf=${body.kdf} 迭代=${body.kdfIterations}` };
|
||
});
|
||
|
||
// 防枚举：不存在的用户也返回默认参数
|
||
await test('Prelogin 不存在的用户 → 返回默认参数（防枚举）', async () => {
|
||
const { status, body } = await api('/identity/accounts/prelogin', {
|
||
method: 'POST', auth: false, body: { email: 'nobody-exists@test.com' },
|
||
});
|
||
return { ok: status === 200 && body.kdf === 0 && body.kdfIterations === 600000 };
|
||
});
|
||
|
||
// 4.2 密码登录（web client_id）
|
||
await test('密码登录 client_id=web', async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: {
|
||
grant_type: 'password', username: EMAIL, password: masterPasswordHash,
|
||
scope: 'api offline_access', client_id: 'web',
|
||
},
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status} ${JSON.stringify(body)}` };
|
||
const missing = hasKeys(body, TOKEN_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少字段: ${missing.join(', ')}` };
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
userEncKey = body.Key;
|
||
return { ok: true, detail: `有效期=${body.expires_in}s` };
|
||
});
|
||
|
||
// 4.3 不同 client_id 登录（模拟各平台客户端）
|
||
// 浏览器插件用 browser，桌面端用 desktop，移动端用 mobile，CLI 用 cli
|
||
for (const cid of ['browser', 'desktop', 'mobile', 'cli']) {
|
||
await test(`密码登录 client_id=${cid}（${
|
||
{ browser: '浏览器插件', desktop: '桌面端', mobile: '移动端', cli: 'CLI' }[cid]
|
||
}）`, async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: {
|
||
grant_type: 'password', username: EMAIL, password: masterPasswordHash,
|
||
scope: 'api offline_access', client_id: cid,
|
||
},
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
// 更新令牌到最新的
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
return { ok: !!body.access_token && !!body.Key };
|
||
});
|
||
}
|
||
|
||
// 4.4 带设备头的登录（Android/iOS 会发送 deviceType、deviceName、deviceIdentifier）
|
||
await test('带设备头登录（Android 设备参数）', async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: {
|
||
grant_type: 'password', username: EMAIL, password: masterPasswordHash,
|
||
scope: 'api offline_access', client_id: 'mobile',
|
||
deviceType: '0', deviceName: 'Android', deviceIdentifier: 'selfcheck-device-id',
|
||
},
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
return { ok: true };
|
||
});
|
||
|
||
// 4.5 JSON 格式登录（部分第三方客户端用 JSON 而非 form-urlencoded）
|
||
await test('JSON 格式登录（非 form-urlencoded）', async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
body: {
|
||
grant_type: 'password', username: EMAIL, password: masterPasswordHash,
|
||
scope: 'api offline_access', client_id: 'web',
|
||
},
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
return { ok: true };
|
||
});
|
||
|
||
// 4.6 错误密码
|
||
await test('错误密码 → 400 invalid_grant', async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'password', username: EMAIL, password: 'wrong-hash' },
|
||
});
|
||
return { ok: status === 400 && body?.error === 'invalid_grant' };
|
||
});
|
||
|
||
// 4.7 缺少字段
|
||
await test('缺少 grant_type → 400', async () => {
|
||
const { status } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false, form: { username: EMAIL, password: 'x' },
|
||
});
|
||
return { ok: status === 400 };
|
||
});
|
||
|
||
// 4.8 不支持的 grant_type
|
||
await test('grant_type=client_credentials → 400', async () => {
|
||
const { status } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'client_credentials', client_id: 'x', client_secret: 'x' },
|
||
});
|
||
return { ok: status === 400 };
|
||
});
|
||
|
||
// 4.9 JWT 内部声明验证
|
||
// 移动端（Android/iOS）会解码 JWT 检查这些字段，缺失会导致认证失败
|
||
await test('JWT payload 包含 email_verified=true（移动端必需）', async () => {
|
||
const payload = decodeJwtPayload(accessToken);
|
||
if (!payload) return { ok: false, detail: 'JWT 解码失败' };
|
||
return { ok: payload.email_verified === true, detail: `email_verified=${payload.email_verified}` };
|
||
});
|
||
|
||
await test('JWT payload 包含 amr=["Application"]（移动端必需）', async () => {
|
||
const payload = decodeJwtPayload(accessToken);
|
||
if (!payload) return { ok: false, detail: 'JWT 解码失败' };
|
||
return { ok: Array.isArray(payload.amr) && payload.amr.includes('Application') };
|
||
});
|
||
|
||
await test('JWT payload 包含 premium=true', async () => {
|
||
const payload = decodeJwtPayload(accessToken);
|
||
return { ok: payload?.premium === true };
|
||
});
|
||
|
||
await test('JWT payload 包含 sub / email / sstamp / iss', async () => {
|
||
const payload = decodeJwtPayload(accessToken);
|
||
if (!payload) return { ok: false, detail: 'JWT 解码失败' };
|
||
const missing = ['sub', 'email', 'sstamp', 'iss'].filter(k => !(k in payload));
|
||
return { ok: missing.length === 0, detail: missing.length ? `缺少: ${missing.join(', ')}` : undefined };
|
||
});
|
||
|
||
// 4.10 Token 响应的 UserDecryptionOptions 深度验证
|
||
await test('Token.UserDecryptionOptions 嵌套结构完整', async () => {
|
||
const { body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'password', username: EMAIL, password: masterPasswordHash },
|
||
});
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
const udo = body?.UserDecryptionOptions;
|
||
if (!udo) return { ok: false, detail: 'UDO 缺失' };
|
||
const mpu = udo.MasterPasswordUnlock;
|
||
if (!mpu) return { ok: false, detail: 'MasterPasswordUnlock 缺失' };
|
||
const checks = [
|
||
udo.HasMasterPassword === true,
|
||
mpu.Salt === EMAIL,
|
||
mpu.MasterKeyWrappedUserKey != null,
|
||
mpu.Kdf?.KdfType === 0,
|
||
mpu.Kdf?.Iterations === 600000 || mpu.Kdf?.Iterations > 0,
|
||
];
|
||
const failed = checks.filter(c => !c).length;
|
||
return { ok: failed === 0, detail: failed ? `${failed} 项检查失败` : `Salt=${mpu.Salt}` };
|
||
});
|
||
}
|
||
|
||
// ─── 5. 令牌刷新完整性 ─────────────────────────────────────────────────────
|
||
// 令牌刷新是客户端后台自动行为，响应结构必须与登录一致
|
||
|
||
async function suiteRefresh() {
|
||
group('5 · 令牌刷新完整性');
|
||
|
||
if (!refreshToken) { skip('全部刷新测试', '无刷新令牌'); return; }
|
||
|
||
// 保存旧 refresh_token 用于后续的复用测试
|
||
const oldRefreshToken = refreshToken;
|
||
|
||
await test('刷新令牌 → 返回全部字段', async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'refresh_token', refresh_token: refreshToken },
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const missing = hasKeys(body, TOKEN_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少: ${missing.join(', ')}` };
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
return { ok: true, detail: '令牌已轮换' };
|
||
});
|
||
|
||
// 刷新响应必须包含 UserDecryptionOptions（Android 空 vault 解锁依赖此）
|
||
await test('刷新响应包含 UserDecryptionOptions', async () => {
|
||
// 用新的 refresh_token 再刷新一次
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'refresh_token', refresh_token: refreshToken },
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
const udo = body?.UserDecryptionOptions;
|
||
return { ok: !!udo && udo.HasMasterPassword === true && !!udo.MasterPasswordUnlock };
|
||
});
|
||
|
||
// 刷新响应必须包含 Key 和 PrivateKey（桌面端重建加密上下文需要）
|
||
await test('刷新响应包含 Key 和 PrivateKey', async () => {
|
||
// 通过上一次测试已更新了 accessToken，直接检查最近的响应
|
||
const { body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'refresh_token', refresh_token: refreshToken },
|
||
});
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
return { ok: body?.Key != null && typeof body.Key === 'string' && body.Key.length > 0 };
|
||
});
|
||
|
||
// 安全性：旧的 refresh_token 不可复用（令牌轮换机制）
|
||
await test('旧 refresh_token 不可复用（令牌轮换安全性）', async () => {
|
||
const { status } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'refresh_token', refresh_token: oldRefreshToken },
|
||
});
|
||
return { ok: status === 400 || status === 401, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// ─── 6. 空保管库回归测试 ───────────────────────────────────────────────────
|
||
// 【关键场景】用户报告的 bug：刚注册、没有任何密码项，锁定后解锁报错。
|
||
//
|
||
// 复现路径：注册 → 登录 → sync（空数据）→ 锁定（前端丢弃密钥）→ 重新登录
|
||
// 本套件模拟这个完整流程，验证空 vault 状态下所有核心端点正常工作。
|
||
//
|
||
// 客户端锁定/解锁的本质：
|
||
// 锁定 = 前端丢弃内存中的 masterKey 和 encKey
|
||
// 解锁 = 用密码重新派生 masterKey → 调用 /identity/connect/token → 获取 Key → 解密
|
||
// 所以 "解锁失败" 的根因通常是 Token 响应中 Key 为空或 UDO 结构不完整。
|
||
|
||
async function suiteEmptyVault() {
|
||
group('6 · 空保管库回归测试（锁定/解锁 bug 场景）');
|
||
|
||
if (!accessToken) { skip('全部空保管库测试', '未获取到访问令牌'); return; }
|
||
|
||
// 6.1 空 vault sync — 最核心的测试
|
||
await test('空 vault GET /api/sync 结构完整', async () => {
|
||
const { status, body } = await api('/api/sync');
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const missing = hasKeys(body, SYNC_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少: ${missing.join(', ')}` };
|
||
// 即使没有数据，数组字段也必须存在且为数组（不能是 null/undefined）
|
||
const arrays = ['folders', 'collections', 'ciphers', 'policies', 'sends'];
|
||
const nullArrays = arrays.filter(k => !Array.isArray(body[k]));
|
||
if (nullArrays.length) return { ok: false, detail: `非数组字段: ${nullArrays.join(', ')}` };
|
||
return { ok: body.object === 'sync' };
|
||
});
|
||
|
||
// 6.2 空 vault 下 ciphers 列表
|
||
await test('空 vault GET /api/ciphers → 空列表', async () => {
|
||
const { status, body } = await api('/api/ciphers');
|
||
const r = expectList(body);
|
||
if (!r.ok) return r;
|
||
// 注意：可能上次测试残留了数据，这里只验证格式正确
|
||
return { ok: status === 200, detail: `数量=${body.data.length}` };
|
||
});
|
||
|
||
// 6.3 空 vault 下 folders 列表
|
||
await test('空 vault GET /api/folders → 空列表', async () => {
|
||
const { status, body } = await api('/api/folders');
|
||
const r = expectList(body);
|
||
return { ok: status === 200 && r.ok, detail: `数量=${body.data.length}` };
|
||
});
|
||
|
||
// 6.4 空 vault 下 revision-date 仍然有效
|
||
await test('空 vault revision-date 有效（>0）', async () => {
|
||
const { status, body } = await api('/api/accounts/revision-date');
|
||
return { ok: status === 200 && typeof body === 'number' && body > 0, detail: `时间戳=${body}` };
|
||
});
|
||
|
||
// 6.5 Sync.UserDecryptionOptions 深度验证（PascalCase — 桌面端/浏览器插件）
|
||
await test('Sync.UserDecryptionOptions 嵌套结构（桌面端/浏览器插件）', async () => {
|
||
const { body } = await api('/api/sync');
|
||
const udo = body?.UserDecryptionOptions;
|
||
if (!udo) return { ok: false, detail: 'UDO 缺失' };
|
||
const mpu = udo.MasterPasswordUnlock;
|
||
if (!mpu) return { ok: false, detail: 'MasterPasswordUnlock 缺失' };
|
||
// Salt 必须等于用户邮箱，否则客户端 KDF 计算会出错
|
||
if (mpu.Salt !== EMAIL) return { ok: false, detail: `Salt="${mpu.Salt}" 期望="${EMAIL}"` };
|
||
// MasterKeyWrappedUserKey 不能为 null（这是解锁的关键数据）
|
||
if (!mpu.MasterKeyWrappedUserKey) return { ok: false, detail: 'MasterKeyWrappedUserKey 为空' };
|
||
// Kdf 结构
|
||
if (!mpu.Kdf) return { ok: false, detail: 'Kdf 缺失' };
|
||
if (typeof mpu.Kdf.KdfType !== 'number') return { ok: false, detail: 'Kdf.KdfType 缺失' };
|
||
return { ok: true, detail: `KdfType=${mpu.Kdf.KdfType} Iterations=${mpu.Kdf.Iterations}` };
|
||
});
|
||
|
||
// 6.6 Sync.userDecryption 深度验证（camelCase — Android 专用）
|
||
await test('Sync.userDecryption 嵌套结构（Android 客户端）', async () => {
|
||
const { body } = await api('/api/sync');
|
||
const ud = body?.userDecryption;
|
||
if (!ud) return { ok: false, detail: 'userDecryption 缺失' };
|
||
const mpu = ud.masterPasswordUnlock;
|
||
if (!mpu) return { ok: false, detail: 'masterPasswordUnlock 缺失' };
|
||
if (mpu.salt !== EMAIL) return { ok: false, detail: `salt="${mpu.salt}" 期望="${EMAIL}"` };
|
||
if (!mpu.masterKeyWrappedUserKey) return { ok: false, detail: 'masterKeyWrappedUserKey 为空' };
|
||
if (!mpu.kdf) return { ok: false, detail: 'kdf 缺失' };
|
||
if (typeof mpu.kdf.kdfType !== 'number') return { ok: false, detail: 'kdf.kdfType 缺失' };
|
||
return { ok: true };
|
||
});
|
||
|
||
// 6.7 Sync.domains 结构（不能为 null）
|
||
await test('Sync.domains 结构完整', async () => {
|
||
const { body } = await api('/api/sync');
|
||
const d = body?.domains;
|
||
if (!d) return { ok: false, detail: 'domains 缺失' };
|
||
return {
|
||
ok: d.object === 'domains'
|
||
&& Array.isArray(d.equivalentDomains)
|
||
&& Array.isArray(d.globalEquivalentDomains),
|
||
};
|
||
});
|
||
|
||
// 6.8 模拟锁定后解锁（本质是重新登录 → 获取完整 Token 响应）
|
||
await test('模拟解锁：重新登录获取 Key（锁定/解锁核心）', async () => {
|
||
const { status, body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: {
|
||
grant_type: 'password', username: EMAIL, password: masterPasswordHash,
|
||
scope: 'api offline_access', client_id: 'web',
|
||
},
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `登录失败 状态码=${status}` };
|
||
// Key 必须非空且格式有效（这是解锁失败的常见根因）
|
||
if (!body.Key || typeof body.Key !== 'string' || body.Key.length < 10) {
|
||
return { ok: false, detail: `Key 无效: "${body.Key}"` };
|
||
}
|
||
accessToken = body.access_token;
|
||
refreshToken = body.refresh_token;
|
||
return { ok: true, detail: `Key 长度=${body.Key.length}` };
|
||
});
|
||
|
||
// 6.9 解锁后 sync 正常
|
||
await test('解锁后 sync 正常', async () => {
|
||
const { status, body } = await api('/api/sync');
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const ok = body?.object === 'sync' && body?.profile?.email === EMAIL;
|
||
return { ok };
|
||
});
|
||
|
||
// 6.10 Profile 的 key 字段非空（解锁时用于初始化加密上下文）
|
||
await test('Profile.key 非空（加密上下文初始化依赖）', async () => {
|
||
const { body } = await api('/api/accounts/profile');
|
||
return { ok: body?.key != null && typeof body.key === 'string' && body.key.length > 10 };
|
||
});
|
||
}
|
||
|
||
// ─── 7. 账户端点 ────────────────────────────────────────────────────────────
|
||
|
||
async function suiteAccounts() {
|
||
group('7 · 账户端点');
|
||
|
||
if (!accessToken) { skip('全部账户测试', '未获取到访问令牌'); return; }
|
||
|
||
await test('GET /api/accounts/profile 获取用户资料', async () => {
|
||
const { status, body } = await api('/api/accounts/profile');
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const missing = hasKeys(body, PROFILE_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少: ${missing.join(', ')}` };
|
||
userId = body.id;
|
||
return { ok: body.object === 'profile' && body.email === EMAIL, detail: `id=${userId}` };
|
||
});
|
||
|
||
// Profile 详细字段验证
|
||
await test('Profile 字段类型正确', async () => {
|
||
const { body } = await api('/api/accounts/profile');
|
||
const checks: [string, boolean][] = [
|
||
['emailVerified=true', body.emailVerified === true],
|
||
['premium=true', body.premium === true],
|
||
['twoFactorEnabled=bool', typeof body.twoFactorEnabled === 'boolean'],
|
||
['forcePasswordReset=false', body.forcePasswordReset === false],
|
||
['organizations=array', Array.isArray(body.organizations)],
|
||
['providers=array', Array.isArray(body.providers)],
|
||
['providerOrganizations=array', Array.isArray(body.providerOrganizations)],
|
||
['culture=string', typeof body.culture === 'string'],
|
||
];
|
||
const failed = checks.filter(([, ok]) => !ok).map(([name]) => name);
|
||
return { ok: failed.length === 0, detail: failed.length ? `失败: ${failed.join(', ')}` : undefined };
|
||
});
|
||
|
||
await test('PUT /api/accounts/profile 更新用户资料', async () => {
|
||
const { status, body } = await api('/api/accounts/profile', {
|
||
method: 'PUT', body: { name: 'SelfCheck Updated', masterPasswordHint: null },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'profile' };
|
||
});
|
||
|
||
await test('POST /api/accounts/keys 更新密钥', async () => {
|
||
const current = await api('/api/accounts/profile');
|
||
if (current.status !== 200 || !current.body?.key || !current.body?.privateKey) {
|
||
return { ok: false, detail: '无法读取当前 key/privateKey' };
|
||
}
|
||
const { status, body } = await api('/api/accounts/keys', {
|
||
method: 'POST',
|
||
// Non-destructive roundtrip: submit current encrypted keys as-is.
|
||
body: { key: current.body.key, encryptedPrivateKey: current.body.privateKey },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'profile' };
|
||
});
|
||
|
||
await test('GET /api/accounts/revision-date 时间戳', async () => {
|
||
const { status, body } = await api('/api/accounts/revision-date');
|
||
return { ok: status === 200 && typeof body === 'number' && body > 0, detail: `时间戳=${body}` };
|
||
});
|
||
|
||
await test('POST /api/accounts/verify-password 正确密码 → 200', async () => {
|
||
const { status } = await api('/api/accounts/verify-password', {
|
||
method: 'POST', body: { masterPasswordHash },
|
||
});
|
||
return { ok: status === 200 };
|
||
});
|
||
|
||
await test('POST /api/accounts/verify-password 错误密码 → 400', async () => {
|
||
const { status } = await api('/api/accounts/verify-password', {
|
||
method: 'POST', body: { masterPasswordHash: 'wrong-hash-value' },
|
||
});
|
||
return { ok: status === 400 };
|
||
});
|
||
}
|
||
|
||
// ─── 8. 同步深度验证 ───────────────────────────────────────────────────────
|
||
|
||
async function suiteSync() {
|
||
group('8 · 同步深度验证');
|
||
|
||
if (!accessToken) { skip('全部同步测试', '未获取到访问令牌'); return; }
|
||
|
||
await test('GET /api/sync 完整同步', async () => {
|
||
const { status, body } = await api('/api/sync');
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const missing = hasKeys(body, SYNC_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少: ${missing.join(', ')}` };
|
||
const pMissing = hasKeys(body.profile, PROFILE_KEYS);
|
||
if (pMissing.length) return { ok: false, detail: `profile 缺少: ${pMissing.join(', ')}` };
|
||
return { ok: body.object === 'sync' };
|
||
});
|
||
|
||
// Sync.profile 与独立 Profile 一致性
|
||
await test('Sync.profile 与 GET /api/accounts/profile 一致', async () => {
|
||
const [sync, profile] = await Promise.all([api('/api/sync'), api('/api/accounts/profile')]);
|
||
const sp = sync.body?.profile;
|
||
const pp = profile.body;
|
||
return { ok: sp?.id === pp?.id && sp?.email === pp?.email && sp?.key === pp?.key };
|
||
});
|
||
}
|
||
|
||
// ─── 9. 文件夹 CRUD ─────────────────────────────────────────────────────────
|
||
|
||
async function suiteFolders() {
|
||
group('9 · 文件夹');
|
||
|
||
if (!accessToken) { skip('全部文件夹测试', '未获取到访问令牌'); return; }
|
||
|
||
await test('POST /api/folders 创建', async () => {
|
||
const { status, body } = await api('/api/folders', {
|
||
method: 'POST', body: { name: '2.自查测试文件夹==' },
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const missing = hasKeys(body, FOLDER_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少: ${missing.join(', ')}` };
|
||
testFolderId = body.id;
|
||
return { ok: body.object === 'folder', detail: `id=${testFolderId}` };
|
||
});
|
||
|
||
await test('GET /api/folders 列表', async () => {
|
||
const { status, body } = await api('/api/folders');
|
||
const r = expectList(body);
|
||
if (!r.ok) return r;
|
||
return { ok: body.data.length >= 1, detail: `数量=${body.data.length}` };
|
||
});
|
||
|
||
await test('GET /api/folders/:id 单个', async () => {
|
||
if (!testFolderId) return { ok: false, detail: '无可用文件夹' };
|
||
const { status, body } = await api(`/api/folders/${testFolderId}`);
|
||
return { ok: status === 200 && body?.id === testFolderId };
|
||
});
|
||
|
||
await test('PUT /api/folders/:id 更新', async () => {
|
||
if (!testFolderId) return { ok: false, detail: '无可用文件夹' };
|
||
const { status, body } = await api(`/api/folders/${testFolderId}`, {
|
||
method: 'PUT', body: { name: '2.更新后文件夹==' },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'folder' };
|
||
});
|
||
}
|
||
|
||
// ─── 10. 密码项 CRUD + 边界条件 ─────────────────────────────────────────────
|
||
|
||
async function suiteCiphers() {
|
||
group('10 · 密码项（Ciphers）');
|
||
|
||
if (!accessToken) { skip('全部密码项测试', '未获取到访问令牌'); return; }
|
||
|
||
// 记录创建前的 revision-date，用于后面验证递增
|
||
let revDateBefore = 0;
|
||
{
|
||
const { body } = await api('/api/accounts/revision-date');
|
||
if (typeof body === 'number') revDateBefore = body;
|
||
}
|
||
|
||
// --- 创建：四种类型 ---
|
||
|
||
await test('POST /api/ciphers 创建 Login 类型', async () => {
|
||
const { status, body } = await api('/api/ciphers', {
|
||
method: 'POST',
|
||
body: {
|
||
type: 1, name: '2.测试登录项==', notes: '2.备注内容==',
|
||
folderId: testFolderId || null, favorite: true, reprompt: 0,
|
||
login: {
|
||
username: '2.用户名==', password: '2.密码==',
|
||
uris: [{ uri: '2.https://example.com==', match: null }], totp: null,
|
||
},
|
||
fields: [{ name: '2.自定义字段==', value: '2.值==', type: 0, linkedId: null }],
|
||
passwordHistory: [{ password: '2.旧密码==', lastUsedDate: new Date().toISOString() }],
|
||
},
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status} ${JSON.stringify(body)}` };
|
||
const missing = hasKeys(body, CIPHER_KEYS);
|
||
if (missing.length) return { ok: false, detail: `缺少: ${missing.join(', ')}` };
|
||
testCipherId = body.id;
|
||
allCreatedCipherIds.push(body.id);
|
||
return { ok: body.object === 'cipher' && body.type === 1, detail: `id=${testCipherId}` };
|
||
});
|
||
|
||
await test('POST /api/ciphers 创建 SecureNote', async () => {
|
||
const { status, body } = await api('/api/ciphers', {
|
||
method: 'POST', body: { type: 2, name: '2.安全笔记==', secureNote: { type: 0 }, reprompt: 0 },
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
testCipher2Id = body.id;
|
||
allCreatedCipherIds.push(body.id);
|
||
return { ok: body.type === 2, detail: `id=${testCipher2Id}` };
|
||
});
|
||
|
||
await test('POST /api/ciphers 创建 Card', async () => {
|
||
const { status, body } = await api('/api/ciphers', {
|
||
method: 'POST',
|
||
body: {
|
||
type: 3, name: '2.银行卡==', reprompt: 0,
|
||
card: { cardholderName: '2.持卡人==', number: '2.卡号==', brand: '2.Visa==',
|
||
expMonth: '2.01==', expYear: '2.2030==', code: '2.123==' },
|
||
},
|
||
});
|
||
if (body?.id) allCreatedCipherIds.push(body.id);
|
||
return { ok: status === 200 && body?.type === 3 };
|
||
});
|
||
|
||
await test('POST /api/ciphers 创建 Identity', async () => {
|
||
const { status, body } = await api('/api/ciphers', {
|
||
method: 'POST',
|
||
body: {
|
||
type: 4, name: '2.身份信息==', reprompt: 0,
|
||
identity: { firstName: '2.名==', lastName: '2.姓==', email: '2.邮箱==' },
|
||
},
|
||
});
|
||
if (body?.id) allCreatedCipherIds.push(body.id);
|
||
return { ok: status === 200 && body?.type === 4 };
|
||
});
|
||
|
||
// 部分客户端用 { cipher: {...} } 嵌套格式
|
||
await test('POST /api/ciphers/create 嵌套格式', async () => {
|
||
const { status, body } = await api('/api/ciphers/create', {
|
||
method: 'POST',
|
||
body: { cipher: { type: 2, name: '2.嵌套创建==', secureNote: { type: 0 }, reprompt: 0 } },
|
||
});
|
||
if (body?.id) allCreatedCipherIds.push(body.id);
|
||
return { ok: status === 200 && body?.object === 'cipher' };
|
||
});
|
||
|
||
// --- 响应字段深度验证 ---
|
||
|
||
await test('Cipher 响应字段完整性', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { body } = await api(`/api/ciphers/${testCipherId}`);
|
||
const checks: [string, boolean][] = [
|
||
['organizationId=null', body.organizationId === null],
|
||
['edit=true', body.edit === true],
|
||
['viewPassword=true', body.viewPassword === true],
|
||
['collectionIds=[]', Array.isArray(body.collectionIds) && body.collectionIds.length === 0],
|
||
['permissions.delete=true', body.permissions?.delete === true],
|
||
['permissions.restore=true', body.permissions?.restore === true],
|
||
['deletedDate=null', body.deletedDate === null],
|
||
];
|
||
const failed = checks.filter(([, ok]) => !ok).map(([name]) => name);
|
||
return { ok: failed.length === 0, detail: failed.length ? `失败: ${failed.join(', ')}` : undefined };
|
||
});
|
||
|
||
// --- 读取 ---
|
||
|
||
await test('GET /api/ciphers 列表', async () => {
|
||
const { status, body } = await api('/api/ciphers');
|
||
const r = expectList(body);
|
||
if (!r.ok) return r;
|
||
return { ok: body.data.length >= 4, detail: `数量=${body.data.length}` };
|
||
});
|
||
|
||
await test('GET /api/ciphers/:id 单个', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}`);
|
||
return { ok: status === 200 && body?.id === testCipherId };
|
||
});
|
||
|
||
await test('GET /api/ciphers/:id/details 详情', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}/details`);
|
||
return { ok: status === 200 && body?.id === testCipherId };
|
||
});
|
||
|
||
// --- 更新 ---
|
||
|
||
await test('PUT /api/ciphers/:id 更新', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}`, {
|
||
method: 'PUT',
|
||
body: { type: 1, name: '2.已更新==', reprompt: 0,
|
||
login: { username: '2.新用户名==', password: '2.新密码==', uris: [] } },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'cipher' };
|
||
});
|
||
|
||
// POST 方式更新（部分 Android 客户端行为）
|
||
await test('POST /api/ciphers/:id 更新（POST 别名）', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}`, {
|
||
method: 'POST',
|
||
body: { type: 1, name: '2.POST更新==', reprompt: 0,
|
||
login: { username: '2.u==', password: '2.p==', uris: [] } },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'cipher' };
|
||
});
|
||
|
||
await test('PUT /api/ciphers/:id/partial 部分更新', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}/partial`, {
|
||
method: 'PUT', body: { favorite: false, folderId: null },
|
||
});
|
||
return { ok: status === 200 && body?.favorite === false };
|
||
});
|
||
|
||
await test('POST /api/ciphers/:id/share（单用户 stub）', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}/share`, { method: 'POST', body: {} });
|
||
return { ok: status === 200 && body?.object === 'cipher' };
|
||
});
|
||
|
||
// --- revision-date 递增验证 ---
|
||
|
||
await test('写操作后 revision-date 递增', async () => {
|
||
const { body } = await api('/api/accounts/revision-date');
|
||
if (typeof body !== 'number') return { ok: false, detail: '返回非数字' };
|
||
return { ok: body >= revDateBefore, detail: `前=${revDateBefore} 后=${body}` };
|
||
});
|
||
|
||
// --- 软删除、恢复、永久删除 ---
|
||
|
||
await test('DELETE /api/ciphers/:id 软删除', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}`, { method: 'DELETE' });
|
||
return { ok: status === 200 && body?.deletedDate != null };
|
||
});
|
||
|
||
await test('PUT /api/ciphers/:id/restore 恢复', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}/restore`, { method: 'PUT' });
|
||
return { ok: status === 200 && body?.deletedDate === null };
|
||
});
|
||
|
||
await test('PUT /api/ciphers/:id/delete 软删除（别名）', async () => {
|
||
if (!testCipher2Id) return { ok: false, detail: '无可用密码项' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipher2Id}/delete`, { method: 'PUT' });
|
||
return { ok: status === 200 && body?.deletedDate != null };
|
||
});
|
||
|
||
// 验证 deleted 过滤功能
|
||
await test('GET /api/ciphers 默认不含已删除项', async () => {
|
||
const { body } = await api('/api/ciphers');
|
||
const hasDeleted = body?.data?.some((c: any) => c.deletedDate != null);
|
||
return { ok: !hasDeleted, detail: hasDeleted ? '包含已删除项' : undefined };
|
||
});
|
||
|
||
await test('GET /api/ciphers?deleted=true 包含已删除项', async () => {
|
||
const { body } = await api('/api/ciphers?deleted=true');
|
||
// 至少有一个被软删除的项（testCipher2Id）
|
||
const hasDeleted = body?.data?.some((c: any) => c.deletedDate != null);
|
||
return { ok: body?.data?.length > 0 && hasDeleted, detail: `数量=${body?.data?.length}` };
|
||
});
|
||
|
||
await test('DELETE /api/ciphers/:id/delete 永久删除', async () => {
|
||
if (!testCipher2Id) return { ok: false, detail: '无可用密码项' };
|
||
const { status } = await api(`/api/ciphers/${testCipher2Id}/delete`, { method: 'DELETE' });
|
||
return { ok: status === 204 || status === 200 };
|
||
});
|
||
|
||
await test('永久删除后 → 404', async () => {
|
||
if (!testCipher2Id) return { ok: false, detail: '无可用密码项' };
|
||
const { status } = await api(`/api/ciphers/${testCipher2Id}`);
|
||
return { ok: status === 404 };
|
||
});
|
||
|
||
// --- 批量操作 ---
|
||
|
||
await test('POST /api/ciphers/move 批量移动', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status } = await api('/api/ciphers/move', {
|
||
method: 'POST', body: { ids: [testCipherId], folderId: testFolderId || null },
|
||
});
|
||
return { ok: status === 204 || status === 200 };
|
||
});
|
||
|
||
// PUT 也应该支持（部分桌面端行为）
|
||
await test('PUT /api/ciphers/move 批量移动（PUT 别名）', async () => {
|
||
if (!testCipherId) return { ok: false, detail: '无可用密码项' };
|
||
const { status } = await api('/api/ciphers/move', {
|
||
method: 'PUT', body: { ids: [testCipherId], folderId: null },
|
||
});
|
||
return { ok: status === 204 || status === 200 };
|
||
});
|
||
|
||
await test('POST /api/ciphers/import 批量导入', async () => {
|
||
const { status, body } = await api('/api/ciphers/import', {
|
||
method: 'POST',
|
||
body: {
|
||
ciphers: [{ type: 1, name: '2.导入项==', login: { username: '2.u==', password: '2.p==' }, reprompt: 0 }],
|
||
folders: [{ name: '2.导入文件夹==' }],
|
||
folderRelationships: [{ key: 0, value: 0 }],
|
||
},
|
||
});
|
||
// Track imported ciphers/folders for cleanup
|
||
if (body?.ciphers) for (const c of body.ciphers) { if (c?.id) allCreatedCipherIds.push(c.id); }
|
||
if (body?.folders) for (const f of body.folders) { if (f?.id) allCreatedFolderIds.push(f.id); }
|
||
return { ok: status === 200, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// ─── 11. 附件 ───────────────────────────────────────────────────────────────
|
||
|
||
async function suiteAttachments() {
|
||
group('11 · 附件');
|
||
|
||
if (!accessToken || !testCipherId) { skip('全部附件测试', '无可用令牌或密码项'); return; }
|
||
|
||
// v2 端点（新版客户端标准流程）
|
||
await test('POST /api/ciphers/:id/attachment/v2 创建元数据', async () => {
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}/attachment/v2`, {
|
||
method: 'POST', body: { fileName: '2.测试文件.txt==', key: '2.附件密钥==', fileSize: 42 },
|
||
});
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status} ${JSON.stringify(body)}` };
|
||
testAttachmentId = body.attachmentId;
|
||
return { ok: !!testAttachmentId && body.object === 'attachment-fileUpload' && !!body.url,
|
||
detail: `id=${testAttachmentId}` };
|
||
});
|
||
|
||
await test('POST /api/ciphers/:id/attachment/:aid 上传文件', async () => {
|
||
if (!testAttachmentId) return { ok: false, detail: '未创建附件' };
|
||
const formData = new FormData();
|
||
formData.append('data', new Blob([new Uint8Array([0x48, 0x65, 0x6c, 0x6c, 0x6f])]), 'test.bin');
|
||
const resp = await fetch(`${BASE}/api/ciphers/${testCipherId}/attachment/${testAttachmentId}`, {
|
||
method: 'POST', headers: { 'Authorization': `Bearer ${accessToken}` }, body: formData,
|
||
});
|
||
return { ok: resp.status === 200, detail: `状态码=${resp.status}` };
|
||
});
|
||
|
||
// 上传后验证附件出现在 cipher 的 attachments 数组中
|
||
await test('上传后 cipher.attachments 非空（Android 依赖）', async () => {
|
||
const { body } = await api(`/api/ciphers/${testCipherId}`);
|
||
const atts = body?.attachments;
|
||
if (!Array.isArray(atts) || atts.length === 0) return { ok: false, detail: 'attachments 为空' };
|
||
const att = atts[0];
|
||
// Android 要求 url 非 null，size 为数字
|
||
const checks = [
|
||
typeof att.url === 'string' && att.url.length > 0,
|
||
typeof att.size === 'number',
|
||
typeof att.fileName === 'string',
|
||
];
|
||
const ok = checks.every(Boolean);
|
||
return { ok, detail: ok ? `url=${att.url} size=${att.size}` : 'url/size 格式不符' };
|
||
});
|
||
|
||
// 获取下载链接
|
||
await test('GET /api/ciphers/:id/attachment/:aid 下载链接', async () => {
|
||
if (!testAttachmentId) return { ok: false, detail: '未创建附件' };
|
||
const { status, body } = await api(`/api/ciphers/${testCipherId}/attachment/${testAttachmentId}`);
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
const ok = body.object === 'attachment' && typeof body.url === 'string' && body.url.includes('token=');
|
||
if (ok) {
|
||
const u = new URL(body.url);
|
||
downloadToken = u.searchParams.get('token') || '';
|
||
}
|
||
return { ok };
|
||
});
|
||
|
||
// 公开下载
|
||
await test('GET /api/attachments/:cid/:aid?token= 公开下载', async () => {
|
||
if (!downloadToken) return { ok: false, detail: '无下载令牌' };
|
||
const resp = await fetch(`${BASE}/api/attachments/${testCipherId}/${testAttachmentId}?token=${downloadToken}`);
|
||
return { ok: resp.status === 200, detail: `状态码=${resp.status}` };
|
||
});
|
||
|
||
// 安全性：无 token 的下载应被拒绝
|
||
await test('公开下载无 token → 401', async () => {
|
||
const resp = await fetch(`${BASE}/api/attachments/${testCipherId}/${testAttachmentId}`);
|
||
return { ok: resp.status === 401, detail: `状态码=${resp.status}` };
|
||
});
|
||
|
||
// 安全性：无效 token 的下载应被拒绝
|
||
await test('公开下载无效 token → 401', async () => {
|
||
const resp = await fetch(`${BASE}/api/attachments/${testCipherId}/${testAttachmentId}?token=invalid-garbage`);
|
||
return { ok: resp.status === 401, detail: `状态码=${resp.status}` };
|
||
});
|
||
|
||
// 旧版附件端点（旧版桌面客户端用这个路径）
|
||
await test('POST /api/ciphers/:id/attachment 旧版端点', async () => {
|
||
const { status } = await api(`/api/ciphers/${testCipherId}/attachment`, {
|
||
method: 'POST', body: { fileName: '2.旧版附件==', key: '2.key==', fileSize: 10 },
|
||
});
|
||
// 路由器已路由到同一 handler，应返回 200
|
||
return { ok: status === 200, detail: `状态码=${status}` };
|
||
});
|
||
|
||
// 删除附件
|
||
await test('DELETE /api/ciphers/:id/attachment/:aid 删除', async () => {
|
||
if (!testAttachmentId) return { ok: false, detail: '未创建附件' };
|
||
const { status } = await api(`/api/ciphers/${testCipherId}/attachment/${testAttachmentId}`, {
|
||
method: 'DELETE',
|
||
});
|
||
return { ok: status === 200, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// ─── 12. Stub 端点 + 通知 + 子路径 ─────────────────────────────────────────
|
||
// 这些端点没有完整实现，但客户端会请求它们
|
||
// 必须返回正确格式的空数据，否则客户端报错
|
||
|
||
async function suiteStubs() {
|
||
group('12 · Stub 端点（客户端兼容性）');
|
||
|
||
if (!accessToken) { skip('全部 Stub 测试', '未获取到访问令牌'); return; }
|
||
|
||
const stubs: [string, string, string][] = [
|
||
['GET', '/api/collections', 'Collections（集合）'],
|
||
['GET', '/api/organizations', 'Organizations（组织）'],
|
||
['GET', '/api/sends', 'Sends（安全发送）'],
|
||
['GET', '/api/policies', 'Policies（策略）'],
|
||
['GET', '/api/auth-requests', 'Auth Requests（认证请求）'],
|
||
['GET', '/api/devices', 'Devices（设备）'],
|
||
];
|
||
|
||
for (const [method, path, label] of stubs) {
|
||
await test(`${method} ${path} → 空列表 stub（${label}）`, async () => {
|
||
const { status, body } = await api(path, { method });
|
||
const r = expectList(body);
|
||
return { ok: status === 200 && r.ok && body.data.length === 0, detail: r.detail ? r.detail : 'stub 占位' };
|
||
});
|
||
}
|
||
|
||
// Stub 子路径测试（客户端可能请求带 ID 的子路径）
|
||
const subPaths: [string, string][] = [
|
||
['/api/organizations/00000000-0000-0000-0000-000000000000', '组织子路径'],
|
||
['/api/collections/00000000-0000-0000-0000-000000000000', '集合子路径'],
|
||
['/api/sends/00000000-0000-0000-0000-000000000000', '发送子路径'],
|
||
['/api/policies/00000000-0000-0000-0000-000000000000', '策略子路径'],
|
||
];
|
||
|
||
for (const [path, label] of subPaths) {
|
||
await test(`GET ${path}（${label}）→ 不崩溃`, async () => {
|
||
const { status } = await api(path);
|
||
// 200 空列表或 404 都可以接受，关键是不能 500
|
||
return { ok: status !== 500, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// 域名设置
|
||
await test('GET /api/settings/domains → domains 对象', async () => {
|
||
const { status, body } = await api('/api/settings/domains');
|
||
return {
|
||
ok: status === 200 && body?.object === 'domains'
|
||
&& Array.isArray(body.equivalentDomains)
|
||
&& Array.isArray(body.globalEquivalentDomains),
|
||
};
|
||
});
|
||
|
||
await test('PUT /api/settings/domains 更新', async () => {
|
||
const { status, body } = await api('/api/settings/domains', {
|
||
method: 'PUT', body: { equivalentDomains: [], globalEquivalentDomains: [] },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'domains' };
|
||
});
|
||
|
||
// POST 别名（旧版客户端）
|
||
await test('POST /api/settings/domains（POST 别名）', async () => {
|
||
const { status, body } = await api('/api/settings/domains', {
|
||
method: 'POST', body: { equivalentDomains: [], globalEquivalentDomains: [] },
|
||
});
|
||
return { ok: status === 200 && body?.object === 'domains' };
|
||
});
|
||
|
||
// 通知端点 — 桌面端和浏览器插件启动时必调
|
||
await test('GET /notifications/hub → 200', async () => {
|
||
const resp = await fetch(`${BASE}/notifications/hub`);
|
||
return { ok: resp.status === 200 };
|
||
});
|
||
|
||
// POST /notifications/hub/negotiate — SignalR 协商（桌面端/浏览器插件）
|
||
// 客户端启动时会发 POST 请求进行 SignalR 握手
|
||
await test('POST /notifications/hub/negotiate → 200（SignalR 协商）', async () => {
|
||
const resp = await fetch(`${BASE}/notifications/hub/negotiate`, { method: 'POST' });
|
||
return { ok: resp.status === 200, detail: `状态码=${resp.status}` };
|
||
});
|
||
|
||
// POST /notifications/hub — SignalR WebSocket 回退
|
||
await test('POST /notifications/hub → 200（SignalR 回退）', async () => {
|
||
const resp = await fetch(`${BASE}/notifications/hub`, { method: 'POST' });
|
||
return { ok: resp.status === 200 };
|
||
});
|
||
|
||
// 带查询参数的通知路径
|
||
await test('GET /notifications/hub?id=xxx → 200（长轮询）', async () => {
|
||
const resp = await fetch(`${BASE}/notifications/hub?id=some-connection-id`);
|
||
return { ok: resp.status === 200 };
|
||
});
|
||
|
||
// 设备已知检查
|
||
await test('GET /api/devices/knowndevice → "true"', async () => {
|
||
const resp = await fetch(`${BASE}/api/devices/knowndevice`);
|
||
const text = await resp.text();
|
||
return { ok: resp.status === 200 && text.trim() === 'true' };
|
||
});
|
||
|
||
// 带设备头的 knowndevice（iOS/Android 会附加这些头）
|
||
await test('GET /api/devices/knowndevice + Device 头', async () => {
|
||
const resp = await fetch(`${BASE}/api/devices/knowndevice`, {
|
||
headers: {
|
||
'X-Device-Identifier': 'selfcheck-device',
|
||
'X-Request-Email': Buffer.from(EMAIL).toString('base64'),
|
||
},
|
||
});
|
||
const text = await resp.text();
|
||
return { ok: resp.status === 200 && (text.trim() === 'true' || text.trim() === 'false') };
|
||
});
|
||
}
|
||
|
||
// ─── 13. 图标代理 ──────────────────────────────────────────────────────────
|
||
|
||
async function suiteIcons() {
|
||
group('13 · 图标代理');
|
||
|
||
await test('GET /icons/google.com/icon.png', async () => {
|
||
const resp = await fetch(`${BASE}/icons/google.com/icon.png`);
|
||
return { ok: resp.status === 200 || resp.status === 204, detail: `状态码=${resp.status}` };
|
||
});
|
||
}
|
||
|
||
// ─── 14. 认证守卫 ──────────────────────────────────────────────────────────
|
||
|
||
async function suiteAuthGuard() {
|
||
group('14 · 认证守卫');
|
||
|
||
await test('GET /api/sync 无令牌 → 401', async () => {
|
||
const { status } = await api('/api/sync', { auth: false });
|
||
return { ok: status === 401 };
|
||
});
|
||
|
||
await test('GET /api/ciphers 无效令牌 → 401', async () => {
|
||
const { status } = await api('/api/ciphers', {
|
||
auth: false, headers: { 'Authorization': 'Bearer invalid.jwt.token' },
|
||
});
|
||
return { ok: status === 401 };
|
||
});
|
||
|
||
await test('GET /api/accounts/profile 无令牌 → 401', async () => {
|
||
const { status } = await api('/api/accounts/profile', { auth: false });
|
||
return { ok: status === 401 };
|
||
});
|
||
|
||
await test('POST /api/ciphers 无令牌 → 401', async () => {
|
||
const { status } = await api('/api/ciphers', {
|
||
method: 'POST', auth: false, body: { type: 1, name: 'x', reprompt: 0 },
|
||
});
|
||
return { ok: status === 401 };
|
||
});
|
||
}
|
||
|
||
// ─── 15. 被阻止端点完整验证 ────────────────────────────────────────────────
|
||
// 单用户模式下禁止修改密码和删除账户
|
||
// 路由器阻止了多个路径 × 多种 HTTP 方法
|
||
|
||
async function suiteBlocked() {
|
||
group('15 · 被阻止端点（单用户模式）');
|
||
|
||
if (!accessToken) { skip('全部阻止测试', '未获取到访问令牌'); return; }
|
||
|
||
// POST 方法
|
||
const blockedPaths = [
|
||
'/api/accounts/password',
|
||
'/api/accounts/change-password',
|
||
'/api/accounts/set-password',
|
||
'/api/accounts/master-password',
|
||
'/api/accounts/delete',
|
||
'/api/accounts/delete-account',
|
||
'/api/accounts/delete-vault',
|
||
];
|
||
|
||
for (const path of blockedPaths) {
|
||
await test(`POST ${path} → 501`, async () => {
|
||
const { status } = await api(path, { method: 'POST', body: {} });
|
||
return { ok: status === 501, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// PUT 和 DELETE 也应该被阻止（路由器检查 POST|PUT|DELETE）
|
||
await test('PUT /api/accounts/password → 501', async () => {
|
||
const { status } = await api('/api/accounts/password', { method: 'PUT', body: {} });
|
||
return { ok: status === 501, detail: `状态码=${status}` };
|
||
});
|
||
|
||
await test('DELETE /api/accounts/delete → 501', async () => {
|
||
const { status } = await api('/api/accounts/delete', { method: 'DELETE' });
|
||
return { ok: status === 501, detail: `状态码=${status}` };
|
||
});
|
||
}
|
||
|
||
// ─── 16. 响应结构合规性 ────────────────────────────────────────────────────
|
||
|
||
async function suiteResponseSchema() {
|
||
group('16 · 响应结构合规性');
|
||
|
||
await test('错误响应符合 Bitwarden ErrorModel 格式', async () => {
|
||
const { body } = await api('/api/ciphers/00000000-0000-0000-0000-000000000000');
|
||
const ok = body?.ErrorModel && body.ErrorModel.Object === 'error' && typeof body.ErrorModel.Message === 'string';
|
||
return { ok: !!ok, detail: ok ? 'ErrorModel 正确' : `内容=${JSON.stringify(body).substring(0, 100)}` };
|
||
});
|
||
|
||
await test('Identity 错误响应符合 OAuth2 格式', async () => {
|
||
const { body } = await api('/identity/connect/token', {
|
||
method: 'POST', auth: false,
|
||
form: { grant_type: 'password', username: EMAIL, password: 'wrong-hash' },
|
||
});
|
||
return { ok: typeof body?.error === 'string' && typeof body?.error_description === 'string' };
|
||
});
|
||
|
||
// 404 端点也应返回 JSON（不是纯文本）
|
||
await test('404 返回 JSON ErrorModel', async () => {
|
||
const { status, body } = await api('/api/nonexistent-endpoint-12345');
|
||
return {
|
||
ok: status === 404 && body?.ErrorModel?.Object === 'error',
|
||
detail: typeof body === 'string' ? 'HTML/纯文本' : 'JSON',
|
||
};
|
||
});
|
||
|
||
// 401 端点返回 JSON
|
||
await test('401 返回 JSON ErrorModel', async () => {
|
||
const { body } = await api('/api/sync', { auth: false });
|
||
return { ok: body?.ErrorModel?.Object === 'error' };
|
||
});
|
||
}
|
||
|
||
// ─── 17. 清理 ──────────────────────────────────────────────────────────────
|
||
|
||
async function suiteCleanup() {
|
||
group('17 · 清理与最终验证');
|
||
|
||
if (!accessToken) { skip('清理', '未获取到访问令牌'); return; }
|
||
|
||
// Permanently delete ALL test-created ciphers to avoid "[error: cannot decrypt]" leftovers.
|
||
// Collect any remaining ciphers from a sync in case some IDs were not tracked (e.g. import).
|
||
try {
|
||
const { body } = await api('/api/sync');
|
||
if (body?.ciphers) {
|
||
for (const c of body.ciphers) {
|
||
if (c?.id && !allCreatedCipherIds.includes(c.id)) {
|
||
// Check if this cipher has a fake encrypted name (our test marker)
|
||
const n = c.name || '';
|
||
if (n.startsWith('2.') && (n.endsWith('==') || n.endsWith('='))) {
|
||
allCreatedCipherIds.push(c.id);
|
||
}
|
||
}
|
||
}
|
||
// Also find orphan test folders from import
|
||
for (const f of (body.folders || [])) {
|
||
if (f?.id && f.id !== testFolderId && !allCreatedFolderIds.includes(f.id)) {
|
||
const n = f.name || '';
|
||
if (n.startsWith('2.') && (n.endsWith('==') || n.endsWith('='))) {
|
||
allCreatedFolderIds.push(f.id);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
} catch { /* best effort */ }
|
||
|
||
// Delete all tracked ciphers
|
||
const cipherIds = [...new Set(allCreatedCipherIds)];
|
||
if (cipherIds.length > 0) {
|
||
await test(`永久删除所有测试密码项 (${cipherIds.length} 个)`, async () => {
|
||
let deleted = 0;
|
||
for (const id of cipherIds) {
|
||
// Soft-delete first (required for permanent delete if not already soft-deleted)
|
||
await api(`/api/ciphers/${id}`, { method: 'DELETE' }).catch(() => {});
|
||
const { status } = await api(`/api/ciphers/${id}/delete`, { method: 'DELETE' });
|
||
if (status === 204 || status === 200) deleted++;
|
||
}
|
||
return { ok: deleted > 0, detail: `已删除 ${deleted}/${cipherIds.length}` };
|
||
});
|
||
}
|
||
|
||
// Delete test folder
|
||
if (testFolderId) {
|
||
await test('DELETE /api/folders/:id 删除测试文件夹', async () => {
|
||
const { status } = await api(`/api/folders/${testFolderId}`, { method: 'DELETE' });
|
||
return { ok: status === 204 || status === 200 };
|
||
});
|
||
|
||
await test('文件夹删除后 → 404', async () => {
|
||
const { status } = await api(`/api/folders/${testFolderId}`);
|
||
return { ok: status === 404 };
|
||
});
|
||
}
|
||
|
||
// Delete any extra test folders (from import etc.)
|
||
const extraFolderIds = [...new Set(allCreatedFolderIds)];
|
||
if (extraFolderIds.length > 0) {
|
||
await test(`删除导入的测试文件夹 (${extraFolderIds.length} 个)`, async () => {
|
||
let deleted = 0;
|
||
for (const id of extraFolderIds) {
|
||
const { status } = await api(`/api/folders/${id}`, { method: 'DELETE' });
|
||
if (status === 204 || status === 200) deleted++;
|
||
}
|
||
return { ok: true, detail: `已删除 ${deleted}/${extraFolderIds.length}` };
|
||
});
|
||
}
|
||
|
||
await test('最终同步一致性检查', async () => {
|
||
const { status, body } = await api('/api/sync');
|
||
if (status !== 200) return { ok: false, detail: `状态码=${status}` };
|
||
return { ok: true, detail: `密码项=${body.ciphers?.length ?? '?'} 文件夹=${body.folders?.length ?? '?'}` };
|
||
});
|
||
}
|
||
|
||
// ─── 18. 缺失端点差距分析 ──────────────────────────────────────────────────
|
||
// 列出 Bitwarden 全客户端可能调用但 NodeWarden 尚未实现的端点
|
||
// 200=已实现, 501=明确未实现, 404=未路由, 400=端点存在但缺参数, 其他=需关注
|
||
|
||
async function suiteGapAnalysis() {
|
||
group('18 · 缺失端点差距分析');
|
||
|
||
const gaps: [string, string, string][] = [
|
||
['POST', '/api/two-factor/get-authenticator', 'TOTP 两步验证'],
|
||
['POST', '/api/two-factor/get-email', '邮件两步验证'],
|
||
['POST', '/api/two-factor/get-duo', 'Duo 两步验证'],
|
||
['POST', '/api/two-factor/get-webauthn', 'WebAuthn 两步验证'],
|
||
['GET', '/api/emergency-access/trusted', '紧急访问（受信任）'],
|
||
['GET', '/api/emergency-access/granted', '紧急访问（已授权）'],
|
||
['POST', '/api/sends', '安全发送（创建）'],
|
||
['POST', '/api/organizations', '组织（创建）'],
|
||
['GET', '/api/accounts/billing', '账单信息'],
|
||
['GET', '/api/accounts/subscription', '订阅信息'],
|
||
['GET', '/api/accounts/tax', '税务信息'],
|
||
['POST', '/api/accounts/api-key', 'API 密钥管理'],
|
||
['POST', '/api/accounts/rotate-api-key', '轮换 API 密钥'],
|
||
['POST', '/api/ciphers/purge', '清空保管库'],
|
||
['POST', '/api/ciphers/bulk-delete', '批量删除'],
|
||
['POST', '/api/ciphers/restore', '批量恢复'],
|
||
['POST', '/api/folders/delete', '批量删除文件夹'],
|
||
['GET', '/api/ciphers/organization-details', '组织密码项详情'],
|
||
['POST', '/api/accounts/email-token', '修改邮箱'],
|
||
['POST', '/api/accounts/verify-email', '验证邮箱'],
|
||
['PUT', '/api/devices/identifier/x/token', '推送令牌注册'],
|
||
['DELETE', '/api/push/token', '注销推送'],
|
||
];
|
||
|
||
for (const [method, path, label] of gaps) {
|
||
await test(`${method} ${path}（${label}）`, async () => {
|
||
const { status } = await api(path, { method, body: method !== 'GET' && method !== 'DELETE' ? {} : undefined });
|
||
if (status === 200) return { ok: true, detail: '✓ 已实现' };
|
||
if (status === 400) return { ok: true, detail: '✓ 端点存在（缺参数 400）' };
|
||
// 未实现的端点 → 标记为 WARN（黄色），不算 PASS 也不算 FAIL
|
||
if (status === 501) return { warn: true, ok: false, detail: '未实现 (501)' };
|
||
if (status === 404) return { warn: true, ok: false, detail: '未路由 (404)' };
|
||
if (status === 401) return { warn: true, ok: false, detail: '需认证 (401)' };
|
||
return { warn: true, ok: false, detail: `状态码 ${status}` };
|
||
});
|
||
}
|
||
}
|
||
|
||
// ─── 19. 设置页面禁用 ──────────────────────────────────────────────────────
|
||
|
||
async function suiteSetupDisable() {
|
||
group('19 · 设置页面禁用（单向操作）');
|
||
|
||
if (!isNewRegistration) {
|
||
skip('POST /setup/disable', '非全新注册，跳过此破坏性操作');
|
||
skip('GET / 禁用后 → 404', '跳过');
|
||
return;
|
||
}
|
||
|
||
await test('POST /setup/disable 禁用设置页面', async () => {
|
||
const { status, body } = await api('/setup/disable', { method: 'POST', auth: false });
|
||
return { ok: status === 200 && body?.success === true };
|
||
});
|
||
|
||
await test('GET / 禁用后 → 404', async () => {
|
||
const resp = await fetch(`${BASE}/`);
|
||
return { ok: resp.status === 404 };
|
||
});
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════════════════════
|
||
// 汇总报告
|
||
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
||
function printSummary(): number {
|
||
const counts = { PASS: 0, FAIL: 0, WARN: 0, SKIP: 0 };
|
||
for (const r of results) counts[r.status]++;
|
||
const total = results.length;
|
||
const totalMs = results.reduce((s, r) => s + r.ms, 0);
|
||
|
||
console.log(`\n${c.bold}${c.white}${'═'.repeat(60)}${c.reset}`);
|
||
console.log(`${c.bold} NodeWarden 自查报告${c.reset}`);
|
||
console.log(`${'═'.repeat(60)}`);
|
||
console.log(` ${c.green}通过 ${counts.PASS}${c.reset} │ ${c.red}失败 ${counts.FAIL}${c.reset} │ ${c.yellow}未实现 ${counts.WARN}${c.reset} │ ${c.gray}跳过 ${counts.SKIP}${c.reset} │ 总计 ${total}`);
|
||
console.log(` 耗时: ${(totalMs / 1000).toFixed(2)}s`);
|
||
console.log(`${'─'.repeat(60)}`);
|
||
|
||
// 失败项
|
||
const failures = results.filter(r => r.status === 'FAIL');
|
||
if (failures.length) {
|
||
console.log(`\n${c.red}${c.bold} 失败项：${c.reset}`);
|
||
for (const f of failures) {
|
||
console.log(` ${c.red}✘ [${f.group}] ${f.name}${c.reset}`);
|
||
if (f.detail) console.log(` ${c.dim}${f.detail}${c.reset}`);
|
||
}
|
||
}
|
||
|
||
// 未实现项
|
||
const warns = results.filter(r => r.status === 'WARN');
|
||
if (warns.length) {
|
||
console.log(`\n${c.yellow}${c.bold} 尚未实现的功能（${warns.length} 项）：${c.reset}`);
|
||
for (const w of warns) {
|
||
console.log(` ${c.yellow}⚠ ${w.name}${c.reset} ${c.dim}${w.detail || ''}${c.reset}`);
|
||
}
|
||
}
|
||
|
||
console.log(`\n${c.bold} 分组汇总：${c.reset}`);
|
||
const groups = new Map<string, { pass: number; fail: number; warn: number; total: number }>();
|
||
for (const r of results) {
|
||
if (!groups.has(r.group)) groups.set(r.group, { pass: 0, fail: 0, warn: 0, total: 0 });
|
||
const g = groups.get(r.group)!;
|
||
g.total++;
|
||
if (r.status === 'PASS') g.pass++;
|
||
if (r.status === 'FAIL') g.fail++;
|
||
if (r.status === 'WARN') g.warn++;
|
||
}
|
||
for (const [name, g] of groups) {
|
||
const icon = g.fail > 0 ? `${c.red}✘` : g.warn > 0 ? `${c.yellow}⚠` : `${c.green}✔`;
|
||
const warnStr = g.warn > 0 ? ` ${c.yellow}${g.warn} 未实现${c.reset}` : '';
|
||
console.log(` ${icon} ${c.reset}${name} ${c.dim}(${g.pass}/${g.total})${c.reset}${warnStr}`);
|
||
}
|
||
|
||
console.log(`\n${'═'.repeat(60)}`);
|
||
if (counts.FAIL === 0 && counts.WARN === 0) {
|
||
console.log(`${c.green}${c.bold} ✔ 全部检查通过！NodeWarden 兼容全平台 Bitwarden 客户端。${c.reset}`);
|
||
} else if (counts.FAIL === 0) {
|
||
console.log(`${c.green}${c.bold} ✔ 已实现功能全部通过！${c.reset}${c.yellow} ⚠ ${counts.WARN} 个端点尚未实现。${c.reset}`);
|
||
} else {
|
||
console.log(`${c.red}${c.bold} ✘ ${counts.FAIL} 项检查未通过，请查看上方详情。${c.reset}`);
|
||
}
|
||
console.log(`${'═'.repeat(60)}\n`);
|
||
|
||
return counts.FAIL;
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════════════════════
|
||
// 主流程
|
||
// ═══════════════════════════════════════════════════════════════════════════
|
||
|
||
async function main() {
|
||
console.log(`\n${c.bold}${c.cyan}╔${'═'.repeat(58)}╗${c.reset}`);
|
||
console.log(`${c.bold}${c.cyan}║ NodeWarden 自查程序 · Bitwarden API 兼容性全面诊断 ║${c.reset}`);
|
||
console.log(`${c.bold}${c.cyan}╚${'═'.repeat(58)}╝${c.reset}`);
|
||
console.log(`${c.dim} 服务器 : ${BASE}${c.reset}`);
|
||
console.log(`${c.dim} 邮箱 : ${EMAIL}${c.reset}`);
|
||
console.log(`${c.dim} 密码 : ${'*'.repeat(PASSWORD.length)}${c.reset}`);
|
||
console.log(`${c.dim} 时间 : ${new Date().toISOString()}${c.reset}`);
|
||
|
||
try { await fetch(`${BASE}/config`); } catch (e: any) {
|
||
console.error(`\n${c.red} ✘ 无法连接到服务器 ${BASE}${c.reset}`);
|
||
console.error(`${c.dim} 请先启动 NodeWarden: npm run dev${c.reset}`);
|
||
console.error(`${c.dim} ${e.message}${c.reset}\n`);
|
||
process.exit(1);
|
||
}
|
||
|
||
await suiteConnectivity(); // 1. 连通性 + Config 深度
|
||
await suiteCors(); // 2. CORS 深度验证
|
||
await suiteRegistration(); // 3. 注册与设置
|
||
await suiteAuth(); // 4. 认证（多平台 + JWT Claims）
|
||
await suiteRefresh(); // 5. 令牌刷新完整性
|
||
await suiteEmptyVault(); // 6. 空保管库回归测试
|
||
await suiteAccounts(); // 7. 账户端点
|
||
await suiteSync(); // 8. 同步深度验证
|
||
await suiteFolders(); // 9. 文件夹
|
||
await suiteCiphers(); // 10. 密码项
|
||
await suiteAttachments(); // 11. 附件
|
||
await suiteStubs(); // 12. Stub 端点 + 通知
|
||
await suiteIcons(); // 13. 图标代理
|
||
await suiteAuthGuard(); // 14. 认证守卫
|
||
await suiteBlocked(); // 15. 被阻止端点
|
||
await suiteResponseSchema(); // 16. 响应格式合规
|
||
await suiteCleanup(); // 17. 清理
|
||
await suiteGapAnalysis(); // 18. 缺失端点分析
|
||
await suiteSetupDisable(); // 19. 设置页面禁用
|
||
|
||
const failCount = printSummary();
|
||
process.exit(failCount > 0 ? 1 : 0);
|
||
}
|
||
|
||
main().catch(e => {
|
||
console.error(`\n${c.red}致命错误: ${e.message || e}${c.reset}\n`);
|
||
process.exit(2);
|
||
});
|