xiaoshu-app/scripts/smoke-admin-functions.mjs

#!/usr/bin/env node

import { randomBytes } from 'node:crypto';

const APP_ID = process.env.XIAOSHU_PARSE_APP_ID || '7pIbDBJmKx_main';
const MASTER_KEY = process.env.XIAOSHU_MASTER_KEY || '';
const PARSE_URL = (process.env.XIAOSHU_PARSE_URL || 'https://server.xiaoshu.pro/parse').replace(/\/$/, '');
const FUNCTION_URL = (process.env.XIAOSHU_FUNCTION_URL || 'https://server.xiaoshu.pro/api/functions').replace(/\/$/, '');

if (!MASTER_KEY) throw new Error('缺少 XIAOSHU_MASTER_KEY');

async function jsonRequest(url, init = {}, master = false) {
  const response = await fetch(url, {
    ...init,
    headers: {
      'X-Parse-Application-Id': APP_ID,
      ...(master ? { 'X-Parse-Master-Key': MASTER_KEY } : {}),
      'Content-Type': 'application/json',
      ...(init.headers || {}),
    },
  });
  const payload = await response.json().catch(() => ({}));
  if (!response.ok) {
    const detail = payload.message || payload.error || payload;
    throw new Error(`${response.status}: ${typeof detail === 'string' ? detail : JSON.stringify(detail)}`);
  }
  return payload;
}

async function callFunction(path, token, params) {
  const payload = await jsonRequest(`${FUNCTION_URL}/${path}`, {
    method: 'POST',
    body: JSON.stringify({ token, params }),
  });
  if (!payload.success) throw new Error(payload.message || `${path} 返回失败`);
  return payload.data;
}

let userId = '';
try {
  const sample = await jsonRequest(`${PARSE_URL}/classes/Company?limit=1&keys=objectId`, {}, true);
  const companyId = sample.results?.[0]?.objectId;
  if (!companyId) throw new Error('没有可用于帐套隔离测试的 Company');
  const company = { __type: 'Pointer', className: 'Company', objectId: companyId };

  const username = `codex_admin_smoke_${Date.now()}`;
  const password = randomBytes(24).toString('base64url');
  const created = await jsonRequest(`${PARSE_URL}/users`, {
    method: 'POST',
    body: JSON.stringify({ username, password, isAdmin: true, roles: ['admin'], company }),
  }, true);
  userId = created.objectId;

  const login = await jsonRequest(`${PARSE_URL}/login`, {
    method: 'POST',
    body: JSON.stringify({ username, password }),
  });
  if (!login.sessionToken) throw new Error('临时管理员登录未返回 sessionToken');

  const meta = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'meta' });
  if (meta.identity?.objectId !== userId || !meta.cloudFunctions) throw new Error('管理员 meta 校验失败');

  const dashboard = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'dashboard' });
  if (!Array.isArray(dashboard.metrics) || dashboard.metrics.length !== 8) throw new Error('dashboard 指标校验失败');

  const schema = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'schema', className: 'CourseAppointment' });
  if (schema.className !== 'CourseAppointment' || !Array.isArray(schema.fields)) throw new Error('schema 校验失败');

  const page = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'list', className: 'CourseAppointment', page: 1, pageSize: 2 });
  if (!Array.isArray(page.results) || page.pageSize !== 2) throw new Error('资源分页校验失败');

  const normalized = await callFunction('xiaoshu/cms/content-normalizer', login.sessionToken, { content: '<p>中文&nbsp;<strong>内容</strong></p><script>alert(1)</script>' });
  if (normalized.content !== '中文 内容') throw new Error(`内容清理结果异常：${normalized.content}`);

  const exams = await callFunction('xiaoshu/cms/exams/classes', login.sessionToken, { page: 1, pageSize: 2 });
  if (!Array.isArray(exams.results)) throw new Error('考试班级投影校验失败');

  const guest = await callFunction('xiaoshu/cms/guest/bar', login.sessionToken, { page: 1, pageSize: 2 });
  if (!Array.isArray(guest.results)) throw new Error('互动社区投影校验失败');

  console.log('Cloud smoke passed: auth, tenant scope, dashboard, schema, list, normalizer, exams, guest.');
} finally {
  if (userId) {
    await jsonRequest(`${PARSE_URL}/users/${userId}`, { method: 'DELETE' }, true).catch((error) => {
      console.error(`临时管理员清理失败：${error.message}`);
      process.exitCode = 1;
    });
  }
}