biss
e845ba8d3a
原生 GET /api/admin/notices
原生五类系统公示聚合：计划、资格、录取、分数线、报到
原生 PATCH /api/admin/publications/{type}/{id} 显隐控制
权限、事务审计和 Node 返回结构保持一致
开关升级为 ADMIN_NATIVE_NOTICE_MANAGEMENT_ENABLED
兼容旧变量 ADMIN_NATIVE_NOTICE_WRITES_ENABLED
冒烟脚本现在会自动构建 Web，避免使用过期程序集
1179 lines
73 KiB
PowerShell
1179 lines
73 KiB
PowerShell
[CmdletBinding()]
|
|
param()
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
Set-StrictMode -Version Latest
|
|
|
|
$repositoryRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
|
|
$smokeArtifactRoot = [System.IO.Path]::GetFullPath((Join-Path $repositoryRoot 'artifacts\smoke'))
|
|
$testDirectory = Join-Path $smokeArtifactRoot ("eis-migration-smoke-{0}" -f [guid]::NewGuid().ToString('N'))
|
|
$nodeProcess = $null
|
|
$dotnetProcess = $null
|
|
$nativeAuthProcess = $null
|
|
|
|
function Get-AvailableTcpPort {
|
|
$listener = [System.Net.Sockets.TcpListener]::new([System.Net.IPAddress]::Loopback, 0)
|
|
try {
|
|
$listener.Start()
|
|
return ([System.Net.IPEndPoint] $listener.LocalEndpoint).Port
|
|
}
|
|
finally {
|
|
$listener.Stop()
|
|
}
|
|
}
|
|
|
|
function Start-TestProcess {
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[string] $FileName,
|
|
|
|
[Parameter(Mandatory)]
|
|
[string[]] $ArgumentList,
|
|
|
|
[Parameter(Mandatory)]
|
|
[hashtable] $Environment
|
|
)
|
|
|
|
$startInfo = [System.Diagnostics.ProcessStartInfo]::new()
|
|
$startInfo.FileName = $FileName
|
|
$startInfo.WorkingDirectory = $repositoryRoot
|
|
$startInfo.UseShellExecute = $false
|
|
$startInfo.CreateNoWindow = $true
|
|
$startInfo.RedirectStandardOutput = $true
|
|
$startInfo.RedirectStandardError = $true
|
|
foreach ($argument in $ArgumentList) {
|
|
$startInfo.ArgumentList.Add($argument)
|
|
}
|
|
foreach ($entry in $Environment.GetEnumerator()) {
|
|
$startInfo.Environment[$entry.Key] = [string] $entry.Value
|
|
}
|
|
|
|
return [System.Diagnostics.Process]::Start($startInfo)
|
|
}
|
|
|
|
function Wait-ForUrl {
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[uri] $Uri,
|
|
|
|
[Parameter(Mandatory)]
|
|
[System.Diagnostics.Process[]] $Processes
|
|
)
|
|
|
|
$deadline = [DateTimeOffset]::UtcNow.AddSeconds(25)
|
|
while ([DateTimeOffset]::UtcNow -lt $deadline) {
|
|
foreach ($process in $Processes) {
|
|
if ($process.HasExited) {
|
|
$standardOutput = $process.StandardOutput.ReadToEnd()
|
|
$standardError = $process.StandardError.ReadToEnd()
|
|
throw "Process $($process.Id) exited with code $($process.ExitCode) before $Uri became ready`n$standardOutput`n$standardError"
|
|
}
|
|
}
|
|
|
|
try {
|
|
$response = Invoke-WebRequest -Uri $Uri -TimeoutSec 2
|
|
if ($response.StatusCode -eq 200) {
|
|
return
|
|
}
|
|
}
|
|
catch {
|
|
Start-Sleep -Milliseconds 250
|
|
}
|
|
}
|
|
|
|
throw "Timed out waiting for $Uri"
|
|
}
|
|
|
|
function Assert-JsonEquivalent {
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[string] $Expected,
|
|
|
|
[Parameter(Mandatory)]
|
|
[string] $Actual,
|
|
|
|
[Parameter(Mandatory)]
|
|
[string] $Label
|
|
)
|
|
|
|
$expectedNode = [System.Text.Json.Nodes.JsonNode]::Parse($Expected)
|
|
$actualNode = [System.Text.Json.Nodes.JsonNode]::Parse($Actual)
|
|
if (-not [System.Text.Json.Nodes.JsonNode]::DeepEquals($expectedNode, $actualNode)) {
|
|
$difference = Find-JsonDifference -Expected $expectedNode -Actual $actualNode -Path '$'
|
|
throw "$Label JSON payload differs from the legacy API at $difference"
|
|
}
|
|
}
|
|
|
|
function Assert-CandidateResultsEquivalent {
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[string] $Expected,
|
|
|
|
[Parameter(Mandatory)]
|
|
[string] $Actual
|
|
)
|
|
|
|
$expectedNode = [System.Text.Json.Nodes.JsonNode]::Parse($Expected)
|
|
$actualNode = [System.Text.Json.Nodes.JsonNode]::Parse($Actual)
|
|
foreach ($node in @($expectedNode, $actualNode)) {
|
|
foreach ($summary in $node['summaries'].AsArray()) {
|
|
$summary.AsObject().Remove('verificationQr') | Out-Null
|
|
}
|
|
}
|
|
if (-not [System.Text.Json.Nodes.JsonNode]::DeepEquals($expectedNode, $actualNode)) {
|
|
$difference = Find-JsonDifference -Expected $expectedNode -Actual $actualNode -Path '$'
|
|
throw "Candidate route 'results' JSON payload differs from the legacy API at $difference"
|
|
}
|
|
}
|
|
|
|
function Assert-CandidateAdmissionsEquivalent {
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[string] $Expected,
|
|
|
|
[Parameter(Mandatory)]
|
|
[string] $Actual
|
|
)
|
|
|
|
$expectedNode = [System.Text.Json.Nodes.JsonNode]::Parse($Expected)
|
|
$actualNode = [System.Text.Json.Nodes.JsonNode]::Parse($Actual)
|
|
foreach ($node in @($expectedNode, $actualNode)) {
|
|
foreach ($admission in $node['admissions'].AsArray()) {
|
|
$admission.AsObject().Remove('noticeVerificationQr') | Out-Null
|
|
}
|
|
}
|
|
if (-not [System.Text.Json.Nodes.JsonNode]::DeepEquals($expectedNode, $actualNode)) {
|
|
$difference = Find-JsonDifference -Expected $expectedNode -Actual $actualNode -Path '$'
|
|
throw "Candidate route 'admissions' JSON payload differs from the legacy API at $difference"
|
|
}
|
|
}
|
|
|
|
function Find-JsonDifference {
|
|
param(
|
|
[AllowNull()]
|
|
[System.Text.Json.Nodes.JsonNode] $Expected,
|
|
|
|
[AllowNull()]
|
|
[System.Text.Json.Nodes.JsonNode] $Actual,
|
|
|
|
[Parameter(Mandatory)]
|
|
[string] $Path
|
|
)
|
|
|
|
if ($null -eq $Expected -or $null -eq $Actual) {
|
|
return "$Path (expected=$Expected, actual=$Actual)"
|
|
}
|
|
|
|
if ($Expected -is [System.Text.Json.Nodes.JsonObject] -and $Actual -is [System.Text.Json.Nodes.JsonObject]) {
|
|
foreach ($entry in $Expected) {
|
|
if (-not $Actual.ContainsKey($entry.Key)) {
|
|
return "$Path.$($entry.Key) (missing from actual)"
|
|
}
|
|
if (-not [System.Text.Json.Nodes.JsonNode]::DeepEquals($entry.Value, $Actual[$entry.Key])) {
|
|
return Find-JsonDifference -Expected $entry.Value -Actual $Actual[$entry.Key] -Path "$Path.$($entry.Key)"
|
|
}
|
|
}
|
|
foreach ($entry in $Actual) {
|
|
if (-not $Expected.ContainsKey($entry.Key)) {
|
|
return "$Path.$($entry.Key) (unexpected in actual)"
|
|
}
|
|
}
|
|
return "$Path (object values differ)"
|
|
}
|
|
|
|
if ($Expected -is [System.Text.Json.Nodes.JsonArray] -and $Actual -is [System.Text.Json.Nodes.JsonArray]) {
|
|
if ($Expected.Count -ne $Actual.Count) {
|
|
return "$Path.Count (expected=$($Expected.Count), actual=$($Actual.Count))"
|
|
}
|
|
for ($index = 0; $index -lt $Expected.Count; $index++) {
|
|
if (-not [System.Text.Json.Nodes.JsonNode]::DeepEquals($Expected[$index], $Actual[$index])) {
|
|
return Find-JsonDifference -Expected $Expected[$index] -Actual $Actual[$index] -Path "$Path[$index]"
|
|
}
|
|
}
|
|
return "$Path (array values differ)"
|
|
}
|
|
|
|
return "$Path (expected=$($Expected.ToJsonString()), actual=$($Actual.ToJsonString()))"
|
|
}
|
|
|
|
try {
|
|
New-Item -ItemType Directory -Path $testDirectory | Out-Null
|
|
|
|
$legacyPort = Get-AvailableTcpPort
|
|
$webPort = Get-AvailableTcpPort
|
|
$nativeAuthPort = Get-AvailableTcpPort
|
|
$legacyBaseUrl = "http://127.0.0.1:$legacyPort"
|
|
$webBaseUrl = "http://127.0.0.1:$webPort"
|
|
$nativeAuthBaseUrl = "http://127.0.0.1:$nativeAuthPort"
|
|
|
|
$nodeExecutable = (Get-Command node.exe -ErrorAction Stop).Source
|
|
$dotnetExecutable = (Get-Command dotnet.exe -ErrorAction Stop).Source
|
|
$smokeDatabasePath = Join-Path $testDirectory 'smoke.sqlite'
|
|
$nodeEnvironment = @{
|
|
NODE_ENV = 'test'
|
|
HOST = '127.0.0.1'
|
|
PORT = [string] $legacyPort
|
|
DATABASE_CLIENT = 'sqlite'
|
|
SQLITE_PATH = $smokeDatabasePath
|
|
INITIAL_ADMIN_USERNAME = 'migration_admin'
|
|
INITIAL_ADMIN_PASSWORD = 'Migration123!'
|
|
INITIAL_ADMIN_DISPLAY_NAME = '迁移测试管理员'
|
|
REDIS_URL = ''
|
|
REDIS_SESSION_URL = ''
|
|
TOTP_ENCRYPTION_KEY = 'migration-smoke-totp-key-32-characters-minimum'
|
|
DOCUMENT_VERIFICATION_SECRET = 'migration-smoke-document-key-32-characters-minimum'
|
|
}
|
|
$seedProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @('scripts/import-test-data.mjs', '--sqlite') -Environment $nodeEnvironment
|
|
if (-not $seedProcess.WaitForExit(30000)) {
|
|
$seedProcess.Kill($true)
|
|
throw 'Timed out while preparing the migration smoke-test database'
|
|
}
|
|
$seedOutput = $seedProcess.StandardOutput.ReadToEnd()
|
|
$seedError = $seedProcess.StandardError.ReadToEnd()
|
|
if ($seedProcess.ExitCode -ne 0) {
|
|
throw "Failed to prepare the migration smoke-test database`n$seedOutput`n$seedError"
|
|
}
|
|
$seedProcess.Dispose()
|
|
|
|
$registrationSwitchProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @(
|
|
'tests/helpers/enable-self-registration.mjs', $smokeDatabasePath
|
|
) -Environment $nodeEnvironment
|
|
if (-not $registrationSwitchProcess.WaitForExit(10000)) {
|
|
$registrationSwitchProcess.Kill($true)
|
|
throw 'Timed out while enabling self-registration in the smoke-test database'
|
|
}
|
|
$registrationSwitchOutput = $registrationSwitchProcess.StandardOutput.ReadToEnd()
|
|
$registrationSwitchError = $registrationSwitchProcess.StandardError.ReadToEnd()
|
|
if ($registrationSwitchProcess.ExitCode -ne 0) {
|
|
throw "Could not enable self-registration in the smoke-test database`n$registrationSwitchOutput`n$registrationSwitchError"
|
|
}
|
|
$registrationSwitchProcess.Dispose()
|
|
|
|
$projectPath = Join-Path $repositoryRoot 'src\Eis.Web\Eis.Web.csproj'
|
|
$buildProcess = Start-TestProcess -FileName $dotnetExecutable -ArgumentList @(
|
|
'build', $projectPath,
|
|
'--configuration', 'Release'
|
|
) -Environment @{}
|
|
if (-not $buildProcess.WaitForExit(60000)) {
|
|
$buildProcess.Kill($true)
|
|
throw 'Timed out while building the ASP.NET Core migration host'
|
|
}
|
|
$buildOutput = $buildProcess.StandardOutput.ReadToEnd()
|
|
$buildError = $buildProcess.StandardError.ReadToEnd()
|
|
if ($buildProcess.ExitCode -ne 0) {
|
|
throw "Failed to build the ASP.NET Core migration host`n$buildOutput`n$buildError"
|
|
}
|
|
$buildProcess.Dispose()
|
|
|
|
$nodeProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @('server.mjs') -Environment $nodeEnvironment
|
|
$dotnetProcess = Start-TestProcess -FileName $dotnetExecutable -ArgumentList @(
|
|
'run',
|
|
'--project', $projectPath,
|
|
'--configuration', 'Release',
|
|
'--no-build',
|
|
'--no-launch-profile',
|
|
'--',
|
|
'--urls', $webBaseUrl
|
|
) -Environment @{
|
|
ASPNETCORE_ENVIRONMENT = 'Development'
|
|
LegacyNode__Enabled = 'true'
|
|
LegacyNode__BaseUrl = $legacyBaseUrl
|
|
DATABASE_CLIENT = 'sqlite'
|
|
SQLITE_PATH = $smokeDatabasePath
|
|
DOCUMENT_VERIFICATION_SECRET = 'migration-smoke-document-key-32-characters-minimum'
|
|
}
|
|
|
|
Wait-ForUrl -Uri "$webBaseUrl/health/live" -Processes @($nodeProcess, $dotnetProcess)
|
|
Wait-ForUrl -Uri "$webBaseUrl/health/migration" -Processes @($nodeProcess, $dotnetProcess)
|
|
|
|
$index = Invoke-WebRequest -Uri "$webBaseUrl/"
|
|
if ($index.Content -notmatch '衡准') {
|
|
throw 'ASP.NET Core did not serve the existing index.html'
|
|
}
|
|
|
|
$clientModule = Invoke-WebRequest -Uri "$webBaseUrl/src/client/api.mjs"
|
|
if ($clientModule.Content -notmatch 'export function api') {
|
|
throw 'ASP.NET Core did not serve the existing client module'
|
|
}
|
|
|
|
$homeResponse = Invoke-WebRequest -Uri "$webBaseUrl/api/public/home"
|
|
if ($homeResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Public home request did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$homePayload = $homeResponse.Content | ConvertFrom-Json
|
|
if ($homePayload.ok -ne $true) {
|
|
throw 'Native public API did not return a valid JSON response'
|
|
}
|
|
$legacyHomePayload = Invoke-RestMethod -Uri "$legacyBaseUrl/api/public/home"
|
|
if ($homePayload.stats.candidates -ne $legacyHomePayload.stats.candidates -or
|
|
$homePayload.stats.exams -ne $legacyHomePayload.stats.exams -or
|
|
$homePayload.stats.registrations -ne $legacyHomePayload.stats.registrations -or
|
|
$homePayload.schools.Count -ne $legacyHomePayload.schools.Count -or
|
|
$homePayload.classes.Count -ne $legacyHomePayload.classes.Count -or
|
|
$homePayload.notices.Count -ne $legacyHomePayload.notices.Count) {
|
|
throw 'Native public home aggregates do not match the legacy API'
|
|
}
|
|
foreach ($legacyExam in $legacyHomePayload.exams) {
|
|
$nativeExam = $homePayload.exams | Where-Object id -eq $legacyExam.id | Select-Object -First 1
|
|
if ($null -eq $nativeExam -or $nativeExam.subjects.Count -ne $legacyExam.subjects.Count -or
|
|
$nativeExam.totalScore -ne $legacyExam.totalScore -or $nativeExam.registrationCount -ne $legacyExam.registrationCount) {
|
|
throw "Native public exam projection does not match the legacy API for $($legacyExam.id)"
|
|
}
|
|
}
|
|
|
|
$announcementResponse = Invoke-WebRequest -Uri "$webBaseUrl/api/public/announcements"
|
|
if ($announcementResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Public announcements request did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$nativeAnnouncements = $announcementResponse.Content | ConvertFrom-Json
|
|
$legacyAnnouncements = Invoke-RestMethod -Uri "$legacyBaseUrl/api/public/announcements"
|
|
foreach ($section in @('plans', 'qualifications', 'admissions', 'cutoffs', 'reports')) {
|
|
$nativeIds = @($nativeAnnouncements.$section | ForEach-Object id)
|
|
$legacyIds = @($legacyAnnouncements.$section | ForEach-Object id)
|
|
if (($nativeIds -join "`0") -ne ($legacyIds -join "`0")) {
|
|
throw "Native public announcement section '$section' does not match the legacy API"
|
|
}
|
|
$nativeSectionJson = $nativeAnnouncements.$section | ConvertTo-Json -Depth 100 -Compress
|
|
$legacySectionJson = $legacyAnnouncements.$section | ConvertTo-Json -Depth 100 -Compress
|
|
if ($nativeSectionJson -ne $legacySectionJson) {
|
|
throw "Native public announcement payload '$section' differs from the legacy API"
|
|
}
|
|
}
|
|
|
|
$session = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$loginBody = @{ username = 'admin'; password = '12345678' } | ConvertTo-Json -Compress
|
|
$login = Invoke-RestMethod -Uri "$webBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $loginBody -WebSession $session
|
|
if ($login.ok -ne $true -or $login.user.username -ne 'admin') {
|
|
throw 'Legacy login API proxy did not preserve the response'
|
|
}
|
|
|
|
$currentUser = Invoke-RestMethod -Uri "$webBaseUrl/api/auth/me" -WebSession $session
|
|
if ($currentUser.user.username -ne 'admin') {
|
|
throw 'Legacy API proxy did not preserve the session cookie'
|
|
}
|
|
|
|
$noticeBody = @{
|
|
title = 'ASP.NET Core 迁移冒烟通知'
|
|
content = '<p>原生公开读取验证</p><script>throw new Error("unsafe")</script>'
|
|
category = '系统测试'
|
|
pinned = $true
|
|
status = 'published'
|
|
} | ConvertTo-Json -Compress
|
|
$createdNotice = Invoke-RestMethod -Uri "$webBaseUrl/api/admin/notices" -Method Post -ContentType 'application/json' -Body $noticeBody -WebSession $session
|
|
$noticeResponse = Invoke-WebRequest -Uri "$webBaseUrl/api/public/notices/$($createdNotice.notice.id)"
|
|
if ($noticeResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Public notice request did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$noticePayload = $noticeResponse.Content | ConvertFrom-Json
|
|
if ($noticePayload.notice.title -ne 'ASP.NET Core 迁移冒烟通知' -or $noticePayload.notice.content -match '<script') {
|
|
throw 'Native public notice endpoint did not preserve data or sanitize unsafe content'
|
|
}
|
|
|
|
$candidateSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$candidateLoginBody = @{ username = '2026-HZ01-F-0001'; password = '12345678' } | ConvertTo-Json -Compress
|
|
$candidateLogin = Invoke-RestMethod -Uri "$webBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $candidateLoginBody -WebSession $candidateSession
|
|
if ($candidateLogin.user.username -ne '2026-HZ01-F-0001') {
|
|
throw 'Could not sign in as the migration verification candidate'
|
|
}
|
|
|
|
$candidateResults = Invoke-RestMethod -Uri "$webBaseUrl/api/candidate/results" -WebSession $candidateSession
|
|
$scoreCode = @($candidateResults.summaries | Where-Object verificationCode | Select-Object -First 1).verificationCode
|
|
if (-not $scoreCode) {
|
|
throw 'Seed data did not provide a score-report verification code'
|
|
}
|
|
$scoreVerificationResponse = Invoke-WebRequest -Uri "$webBaseUrl/api/public/verifications/$scoreCode"
|
|
if ($scoreVerificationResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Document verification request did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$nativeScoreVerification = $scoreVerificationResponse.Content | ConvertFrom-Json
|
|
$legacyScoreVerification = Invoke-RestMethod -Uri "$legacyBaseUrl/api/public/verifications/$scoreCode"
|
|
if ($nativeScoreVerification.document.type -ne 'score-report' -or
|
|
$nativeScoreVerification.document.examName -ne $legacyScoreVerification.document.examName -or
|
|
$nativeScoreVerification.document.totalScore -ne $legacyScoreVerification.document.totalScore -or
|
|
$nativeScoreVerification.document.subjectCount -ne $legacyScoreVerification.document.subjectCount) {
|
|
throw 'Native score-report verification does not match the legacy API'
|
|
}
|
|
|
|
$admissionCodeProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @(
|
|
'tests/helpers/create-admission-verification.mjs', $smokeDatabasePath
|
|
) -Environment $nodeEnvironment
|
|
if (-not $admissionCodeProcess.WaitForExit(10000)) {
|
|
$admissionCodeProcess.Kill($true)
|
|
throw 'Timed out while reading an admission-notice verification code'
|
|
}
|
|
$noticeCode = $admissionCodeProcess.StandardOutput.ReadToEnd().Trim()
|
|
$admissionCodeError = $admissionCodeProcess.StandardError.ReadToEnd()
|
|
if ($admissionCodeProcess.ExitCode -ne 0) {
|
|
throw "Could not read an admission-notice verification code`n$admissionCodeError"
|
|
}
|
|
$admissionCodeProcess.Dispose()
|
|
if (-not $noticeCode) {
|
|
throw "Seed data did not provide an admission-notice verification code`n$admissionCodeError"
|
|
}
|
|
$nativeNoticeVerification = Invoke-RestMethod -Uri "$webBaseUrl/api/public/verifications/$noticeCode"
|
|
$legacyNoticeVerification = Invoke-RestMethod -Uri "$legacyBaseUrl/api/public/verifications/$noticeCode"
|
|
if ($nativeNoticeVerification.document.type -ne 'admission-notice' -or
|
|
$nativeNoticeVerification.document.noticeNumber -ne $legacyNoticeVerification.document.noticeNumber -or
|
|
$nativeNoticeVerification.document.schoolName -ne $legacyNoticeVerification.document.schoolName) {
|
|
throw 'Native admission-notice verification does not match the legacy API'
|
|
}
|
|
|
|
$invalidVerification = Invoke-WebRequest -Uri "$webBaseUrl/api/public/verifications/SR-000000000000000000000000" -SkipHttpErrorCheck
|
|
if ($invalidVerification.StatusCode -ne 404 -or $invalidVerification.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native document verification did not reject an invalid code'
|
|
}
|
|
|
|
$nativeAuthProcess = Start-TestProcess -FileName $dotnetExecutable -ArgumentList @(
|
|
'run',
|
|
'--project', $projectPath,
|
|
'--configuration', 'Release',
|
|
'--no-build',
|
|
'--no-launch-profile',
|
|
'--',
|
|
'--urls', $nativeAuthBaseUrl
|
|
) -Environment @{
|
|
ASPNETCORE_ENVIRONMENT = 'Development'
|
|
AUTH_NATIVE_ENABLED = 'true'
|
|
CANDIDATE_NATIVE_ENABLED = 'true'
|
|
CANDIDATE_NATIVE_ALLOW_MEMORY = 'true'
|
|
ADMIN_NATIVE_READS_ENABLED = 'true'
|
|
ADMIN_NATIVE_ORGANIZATION_WRITES_ENABLED = 'true'
|
|
ADMIN_NATIVE_ACCOUNT_BATCHES_ENABLED = 'true'
|
|
ADMIN_NATIVE_CONFIGURATION_ENABLED = 'true'
|
|
ADMIN_NATIVE_NOTICE_MANAGEMENT_ENABLED = 'true'
|
|
ADMIN_NATIVE_ALLOW_MEMORY = 'true'
|
|
LegacyNode__Enabled = 'true'
|
|
LegacyNode__BaseUrl = $legacyBaseUrl
|
|
DATABASE_CLIENT = 'sqlite'
|
|
SQLITE_PATH = $smokeDatabasePath
|
|
TOTP_ENCRYPTION_KEY = 'migration-smoke-totp-key-32-characters-minimum'
|
|
DOCUMENT_VERIFICATION_SECRET = 'migration-smoke-document-key-32-characters-minimum'
|
|
REDIS_URL = ''
|
|
REDIS_SESSION_URL = ''
|
|
}
|
|
Wait-ForUrl -Uri "$nativeAuthBaseUrl/health/live" -Processes @($nodeProcess, $nativeAuthProcess)
|
|
|
|
$anonymousCandidate = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/profile" -SkipHttpErrorCheck
|
|
if ($anonymousCandidate.StatusCode -ne 401 -or $anonymousCandidate.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native candidate API did not reject an anonymous request'
|
|
}
|
|
|
|
$nativeCandidateSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$nativeCandidateLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $candidateLoginBody -WebSession $nativeCandidateSession
|
|
if ($nativeCandidateLogin.user.candidateNumber -ne '2026-HZ01-F-0001') {
|
|
throw 'Native authentication could not create the candidate parity-test session'
|
|
}
|
|
foreach ($candidateRoute in @('dashboard', 'notices', 'profile', 'exams', 'registrations')) {
|
|
$legacyCandidateResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/$candidateRoute" -WebSession $candidateSession
|
|
$nativeCandidateResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/$candidateRoute" -WebSession $nativeCandidateSession
|
|
if ($nativeCandidateResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw "Candidate route '$candidateRoute' did not use the native ASP.NET Core endpoint"
|
|
}
|
|
Assert-JsonEquivalent -Expected $legacyCandidateResponse.Content -Actual $nativeCandidateResponse.Content -Label "Candidate route '$candidateRoute'"
|
|
}
|
|
$legacyCandidateResultsResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/results" -WebSession $candidateSession
|
|
$nativeCandidateResultsResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/results" -WebSession $nativeCandidateSession
|
|
if ($nativeCandidateResultsResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw "Candidate route 'results' did not use the native ASP.NET Core endpoint"
|
|
}
|
|
Assert-CandidateResultsEquivalent -Expected $legacyCandidateResultsResponse.Content -Actual $nativeCandidateResultsResponse.Content
|
|
$nativeCandidateResults = $nativeCandidateResultsResponse.Content | ConvertFrom-Json
|
|
if (@($nativeCandidateResults.summaries | Where-Object { $_.verificationQr -match '^data:image/png;base64,' }).Count -eq 0) {
|
|
throw 'Native candidate results did not include a local PNG verification QR code'
|
|
}
|
|
$legacyCandidateAdmissionsResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/admissions" -WebSession $candidateSession
|
|
$nativeCandidateAdmissionsResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions" -WebSession $nativeCandidateSession
|
|
if ($nativeCandidateAdmissionsResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw "Candidate route 'admissions' did not use the native ASP.NET Core endpoint"
|
|
}
|
|
Assert-CandidateAdmissionsEquivalent -Expected $legacyCandidateAdmissionsResponse.Content -Actual $nativeCandidateAdmissionsResponse.Content
|
|
$admissionWriteProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @(
|
|
'tests/helpers/prepare-candidate-admission-write-smoke.mjs', $smokeDatabasePath
|
|
) -Environment $nodeEnvironment
|
|
if (-not $admissionWriteProcess.WaitForExit(10000)) {
|
|
$admissionWriteProcess.Kill($true)
|
|
throw 'Timed out while preparing the candidate admission preference smoke data'
|
|
}
|
|
$admissionWriteError = $admissionWriteProcess.StandardError.ReadToEnd()
|
|
if ($admissionWriteProcess.ExitCode -ne 0) {
|
|
throw "Could not prepare the candidate admission preference smoke data`n$admissionWriteError"
|
|
}
|
|
$admissionWriteProcess.Dispose()
|
|
$admissionContext = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/candidate/admissions" -WebSession $nativeCandidateSession
|
|
$admissionSetting = @($admissionContext.admissions | Where-Object { $_.status -eq 'filling' } | Select-Object -First 1)[0]
|
|
$admissionPlan = @($admissionSetting.plans | Select-Object -First 1)[0]
|
|
$admissionCategory = @($admissionPlan.categories | Where-Object { $_.preferenceTypes -contains 'general' } | Select-Object -First 1)[0]
|
|
if ($null -eq $admissionSetting -or $null -eq $admissionPlan -or $null -eq $admissionCategory) {
|
|
throw 'Native candidate admissions did not expose an eligible plan for preference submission'
|
|
}
|
|
$emptyPreference = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions/$($admissionSetting.examId)/preferences" -Method Put -ContentType 'application/json' -Body '{"choices":[]}' -WebSession $nativeCandidateSession -SkipHttpErrorCheck
|
|
if ($emptyPreference.StatusCode -ne 400) {
|
|
throw 'Native admission preference API accepted an empty preference list'
|
|
}
|
|
$preferenceBody = @{
|
|
choices = @(@{
|
|
schoolId = $admissionPlan.schoolId
|
|
categoryCode = $admissionCategory.code
|
|
preferenceType = 'general'
|
|
})
|
|
} | ConvertTo-Json -Depth 5 -Compress
|
|
$firstPreferenceResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions/$($admissionSetting.examId)/preferences" -Method Put -ContentType 'application/json' -Body $preferenceBody -WebSession $nativeCandidateSession
|
|
$firstPreference = $firstPreferenceResponse.Content | ConvertFrom-Json
|
|
if ($firstPreferenceResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or $firstPreference.remainingSubmissions -ne 1 -or $firstPreference.locked -ne $false) {
|
|
throw 'Native admission preference API did not persist the first submission count'
|
|
}
|
|
$secondPreference = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/candidate/admissions/$($admissionSetting.examId)/preferences" -Method Put -ContentType 'application/json' -Body $preferenceBody -WebSession $nativeCandidateSession
|
|
if ($secondPreference.remainingSubmissions -ne 0 -or $secondPreference.locked -ne $true) {
|
|
throw 'Native admission preference API did not lock at the configured submission limit'
|
|
}
|
|
$lockedPreference = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions/$($admissionSetting.examId)/preferences" -Method Put -ContentType 'application/json' -Body $preferenceBody -WebSession $nativeCandidateSession -SkipHttpErrorCheck
|
|
if ($lockedPreference.StatusCode -ne 409) {
|
|
throw 'Native admission preference API accepted a submission after automatic locking'
|
|
}
|
|
$legacyAdmissionsAfterWrite = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/admissions" -WebSession $candidateSession
|
|
$nativeAdmissionsAfterWrite = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions" -WebSession $nativeCandidateSession
|
|
Assert-CandidateAdmissionsEquivalent -Expected $legacyAdmissionsAfterWrite.Content -Actual $nativeAdmissionsAfterWrite.Content
|
|
$appealableResult = @($nativeCandidateResults.results | Where-Object { $null -eq $_.appeal } | Select-Object -First 1)[0]
|
|
if ($null -ne $appealableResult) {
|
|
$shortAppeal = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/results/$($appealableResult.id)/appeals" -Method Post -ContentType 'application/json' -Body '{"reason":"短"}' -WebSession $nativeCandidateSession -SkipHttpErrorCheck
|
|
if ($shortAppeal.StatusCode -ne 400 -or $shortAppeal.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native score appeal did not validate the minimum reason length'
|
|
}
|
|
$appealBody = @{ reason = '迁移冒烟验证：成绩与个人估分差异较大，请复核计分。' } | ConvertTo-Json -Compress
|
|
$appealResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/results/$($appealableResult.id)/appeals" -Method Post -ContentType 'application/json' -Body $appealBody -WebSession $nativeCandidateSession
|
|
$appeal = $appealResponse.Content | ConvertFrom-Json
|
|
if ($appealResponse.StatusCode -ne 201 -or $appealResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or $appeal.workflow.status -ne 'pending') {
|
|
throw 'Native score appeal did not persist a pending workflow'
|
|
}
|
|
}
|
|
$admitProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @(
|
|
'tests/helpers/prepare-candidate-admit-smoke.mjs', $smokeDatabasePath, '2026-HZ01-F-0001'
|
|
) -Environment $nodeEnvironment
|
|
if (-not $admitProcess.WaitForExit(10000)) {
|
|
$admitProcess.Kill($true)
|
|
throw 'Timed out while preparing the candidate admit-card smoke data'
|
|
}
|
|
$admitRegistrationId = $admitProcess.StandardOutput.ReadToEnd().Trim()
|
|
$admitError = $admitProcess.StandardError.ReadToEnd()
|
|
if ($admitProcess.ExitCode -ne 0 -or -not $admitRegistrationId) {
|
|
throw "Could not prepare the candidate admit-card smoke data`n$admitError"
|
|
}
|
|
$admitProcess.Dispose()
|
|
$legacyAdmitResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/registrations/$admitRegistrationId/admit-card" -WebSession $candidateSession
|
|
$nativeAdmitResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/registrations/$admitRegistrationId/admit-card" -WebSession $nativeCandidateSession
|
|
if ($nativeAdmitResponse.StatusCode -ne 200 -or
|
|
$nativeAdmitResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or
|
|
$nativeAdmitResponse.Headers['Content-Disposition'] -notmatch '^attachment;' -or
|
|
$nativeAdmitResponse.Content -notmatch '考试考场序号' -or
|
|
$nativeAdmitResponse.Content -ne $legacyAdmitResponse.Content) {
|
|
throw 'Native admit-card download did not match the legacy HTML document'
|
|
}
|
|
|
|
$registrationSchool = @($homePayload.schools | Select-Object -First 1)[0]
|
|
$registrationClass = @($homePayload.classes | Where-Object schoolId -eq $registrationSchool.id | Select-Object -First 1)[0]
|
|
if ($null -eq $registrationSchool -or $null -eq $registrationClass) {
|
|
throw 'Seed data did not provide a source school and class for native registration'
|
|
}
|
|
$registrationBody = @{
|
|
name = '原生迁移注册考生'
|
|
gender = '女'
|
|
password = 'Registration456!'
|
|
schoolId = $registrationSchool.id
|
|
classId = $registrationClass.id
|
|
} | ConvertTo-Json -Compress
|
|
$registrationResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/auth/register" -Method Post -ContentType 'application/json' -Body $registrationBody
|
|
if ($registrationResponse.StatusCode -ne 201 -or $registrationResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Self-registration request did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$registration = $registrationResponse.Content | ConvertFrom-Json
|
|
$registeredLoginBody = @{ username = $registration.registrationNumber; password = 'Registration456!' } | ConvertTo-Json -Compress
|
|
$registeredSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$registeredLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $registeredLoginBody -WebSession $registeredSession
|
|
if ($registeredLogin.user.candidateNumber -ne $registration.registrationNumber) {
|
|
throw 'Native self-registration did not create a usable candidate account'
|
|
}
|
|
$incompleteDashboard = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/dashboard" -WebSession $registeredSession -SkipHttpErrorCheck
|
|
if ($incompleteDashboard.StatusCode -ne 428) {
|
|
throw 'Native candidate API did not require completion of a newly registered profile'
|
|
}
|
|
$incompleteProfile = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/profile" -WebSession $registeredSession
|
|
if ($incompleteProfile.StatusCode -ne 200) {
|
|
throw 'Native candidate profile route was not available during onboarding'
|
|
}
|
|
|
|
$invalidSpecialtyBody = @{
|
|
name = '原生迁移注册考生'
|
|
gender = '女'
|
|
idNumber = 'SMOKE-INVALID-SPECIALTY'
|
|
phone = '13800000000'
|
|
email = 'candidate@example.test'
|
|
nativePlace = '江苏连云港'
|
|
address = '迁移测试路 1 号'
|
|
schoolId = $registrationSchool.id
|
|
classId = $registrationClass.id
|
|
provinceCode = '320000'
|
|
cityCode = '320700'
|
|
districtCode = '320706'
|
|
specialtyCategory = 'arts'
|
|
specialtyType = 'track_field'
|
|
} | ConvertTo-Json -Compress
|
|
$invalidSpecialty = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/profile" -Method Put -ContentType 'application/json' -Body $invalidSpecialtyBody -WebSession $registeredSession -SkipHttpErrorCheck
|
|
if ($invalidSpecialty.StatusCode -ne 400) {
|
|
throw 'Native candidate profile API accepted a mismatched specialty category and type'
|
|
}
|
|
|
|
$profileIdNumber = "SMOKE-NATIVE-$([guid]::NewGuid().ToString('N'))"
|
|
$profileBody = @{
|
|
name = '原生迁移注册考生'
|
|
gender = '女'
|
|
idNumber = $profileIdNumber
|
|
phone = '13800000000'
|
|
email = 'candidate@example.test'
|
|
address = '迁移测试路 1 号'
|
|
emergencyContact = '测试联系人'
|
|
emergencyPhone = '13900000000'
|
|
nativePlace = '江苏连云港'
|
|
birthDate = '2010-01-02'
|
|
ethnicity = '汉族'
|
|
postalCode = '222000'
|
|
guardianName = '测试监护人'
|
|
guardianPhone = '13700000000'
|
|
schoolId = $registrationSchool.id
|
|
classId = $registrationClass.id
|
|
provinceCode = '320000'
|
|
cityCode = '320700'
|
|
districtCode = '320706'
|
|
specialtyCategory = ''
|
|
specialtyType = ''
|
|
specialtyCertificate = ''
|
|
policyEligibility = ''
|
|
} | ConvertTo-Json -Compress
|
|
$profileUpdateResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/profile" -Method Put -ContentType 'application/json' -Body $profileBody -WebSession $registeredSession
|
|
if ($profileUpdateResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Candidate profile update did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$profileUpdate = $profileUpdateResponse.Content | ConvertFrom-Json
|
|
if ($profileUpdate.profile.profileCompleted -ne $true -or $profileUpdate.profile.districtName -ne '海州区' -or $profileUpdate.profile.status -ne 'pending') {
|
|
throw 'Native candidate profile update did not resolve the region or persist onboarding state'
|
|
}
|
|
|
|
$prematureRegistrationBody = @{ examId = 'not-approved-yet'; subjectIds = @('none') } | ConvertTo-Json -Compress
|
|
$prematureRegistration = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/registrations" -Method Post -ContentType 'application/json' -Body $prematureRegistrationBody -WebSession $registeredSession -SkipHttpErrorCheck
|
|
if ($prematureRegistration.StatusCode -ne 403) {
|
|
throw 'Native registration API did not require an approved candidate profile'
|
|
}
|
|
|
|
$candidateWriteSetup = Start-TestProcess -FileName $nodeExecutable -ArgumentList @(
|
|
'tests/helpers/prepare-candidate-write-smoke.mjs', $smokeDatabasePath, $registration.registrationNumber
|
|
) -Environment $nodeEnvironment
|
|
if (-not $candidateWriteSetup.WaitForExit(10000)) {
|
|
$candidateWriteSetup.Kill($true)
|
|
throw 'Timed out while preparing the native candidate write smoke test'
|
|
}
|
|
$candidateWriteSetupOutput = $candidateWriteSetup.StandardOutput.ReadToEnd().Trim()
|
|
$candidateWriteSetupError = $candidateWriteSetup.StandardError.ReadToEnd()
|
|
if ($candidateWriteSetup.ExitCode -ne 0) {
|
|
throw "Could not prepare the native candidate write smoke test`n$candidateWriteSetupError"
|
|
}
|
|
$candidateWriteSetup.Dispose()
|
|
$candidateWriteTarget = $candidateWriteSetupOutput | ConvertFrom-Json
|
|
|
|
$nativeRegistrationBody = @{
|
|
examId = $candidateWriteTarget.examId
|
|
subjectIds = @($candidateWriteTarget.subjectId)
|
|
} | ConvertTo-Json -Compress
|
|
$nativeRegistrationResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/registrations" -Method Post -ContentType 'application/json' -Body $nativeRegistrationBody -WebSession $registeredSession
|
|
if ($nativeRegistrationResponse.StatusCode -ne 201 -or $nativeRegistrationResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Exam registration submission did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$nativeRegistration = $nativeRegistrationResponse.Content | ConvertFrom-Json
|
|
if ($nativeRegistration.registration.status -ne 'pending' -or $nativeRegistration.registration.subjectIds.Count -ne 1) {
|
|
throw 'Native exam registration did not persist the selected subject and pending state'
|
|
}
|
|
$duplicateRegistration = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/registrations" -Method Post -ContentType 'application/json' -Body $nativeRegistrationBody -WebSession $registeredSession -SkipHttpErrorCheck
|
|
if ($duplicateRegistration.StatusCode -ne 409) {
|
|
throw 'Native exam registration did not reject a duplicate submission'
|
|
}
|
|
|
|
$legacyRegisteredSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
Invoke-RestMethod -Uri "$legacyBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $registeredLoginBody -WebSession $legacyRegisteredSession | Out-Null
|
|
foreach ($candidateWriteReadRoute in @('profile', 'registrations')) {
|
|
$legacyWriteRead = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/$candidateWriteReadRoute" -WebSession $legacyRegisteredSession
|
|
$nativeWriteRead = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/$candidateWriteReadRoute" -WebSession $registeredSession
|
|
Assert-JsonEquivalent -Expected $legacyWriteRead.Content -Actual $nativeWriteRead.Content -Label "Candidate write follow-up '$candidateWriteReadRoute'"
|
|
}
|
|
|
|
$nativeSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$nativeLoginResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $loginBody -WebSession $nativeSession
|
|
if ($nativeLoginResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Authentication login request did not use the native ASP.NET Core endpoint'
|
|
}
|
|
$nativeLogin = $nativeLoginResponse.Content | ConvertFrom-Json
|
|
if ($nativeLogin.ok -ne $true -or $nativeLogin.user.username -ne 'admin') {
|
|
throw 'Native authentication could not verify the existing Node PBKDF2 account'
|
|
}
|
|
foreach ($adminReadRoute in @('context', 'dashboard', 'schools', 'admins', 'exams')) {
|
|
$legacyAdminRead = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/$adminReadRoute" -WebSession $session
|
|
$nativeAdminRead = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$adminReadRoute" -WebSession $nativeSession
|
|
if ($nativeAdminRead.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw "Admin read route '$adminReadRoute' did not use the native ASP.NET Core endpoint"
|
|
}
|
|
Assert-JsonEquivalent -Expected $legacyAdminRead.Content -Actual $nativeAdminRead.Content -Label "Admin read route '$adminReadRoute'"
|
|
}
|
|
$superSchoolOrganization = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/school-organization" -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($superSchoolOrganization.StatusCode -ne 403 -or $superSchoolOrganization.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native school-organization route did not preserve the school-level authorization boundary'
|
|
}
|
|
$schoolLoginBody = @{ username = 'school_admin'; password = '12345678' } | ConvertTo-Json -Compress
|
|
$legacySchoolSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$nativeSchoolSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
Invoke-RestMethod -Uri "$legacyBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $schoolLoginBody -WebSession $legacySchoolSession | Out-Null
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $schoolLoginBody -WebSession $nativeSchoolSession | Out-Null
|
|
foreach ($schoolAdminRoute in @('context', 'dashboard', 'school-organization', 'admins')) {
|
|
$legacySchoolRead = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/$schoolAdminRoute" -WebSession $legacySchoolSession
|
|
$nativeSchoolRead = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$schoolAdminRoute" -WebSession $nativeSchoolSession
|
|
Assert-JsonEquivalent -Expected $legacySchoolRead.Content -Actual $nativeSchoolRead.Content -Label "School admin read route '$schoolAdminRoute'"
|
|
}
|
|
foreach ($superOnlyRoute in @('schools', 'exams')) {
|
|
$schoolForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$superOnlyRoute" -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($schoolForbidden.StatusCode -ne 403 -or $schoolForbidden.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw "Native admin route '$superOnlyRoute' did not preserve the super-admin boundary"
|
|
}
|
|
}
|
|
$legacyNoticeManagement = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/notices" -WebSession $session
|
|
$nativeNoticeManagement = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/notices" -WebSession $nativeSession
|
|
if ($nativeNoticeManagement.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native notice management list did not use ASP.NET Core'
|
|
}
|
|
Assert-JsonEquivalent -Expected $legacyNoticeManagement.Content -Actual $nativeNoticeManagement.Content -Label 'Admin notice management list'
|
|
$schoolNoticeManagementForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/notices" -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($schoolNoticeManagementForbidden.StatusCode -ne 403 -or $schoolNoticeManagementForbidden.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native notice management list did not preserve the super-admin boundary'
|
|
}
|
|
|
|
$noticeManagementState = $nativeNoticeManagement.Content | ConvertFrom-Json
|
|
$managedPlan = @($noticeManagementState.publications | Where-Object { $_.sourceType -eq 'plan' })[0]
|
|
if ($null -eq $managedPlan) {
|
|
throw 'Seed data did not provide a system plan publication for notice-management smoke testing'
|
|
}
|
|
$invalidPublicationVisibility = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/publications/plan/$($managedPlan.id)" -Method Patch -ContentType 'application/json' -Body (@{ visible = 'false' } | ConvertTo-Json -Compress) -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($invalidPublicationVisibility.StatusCode -ne 400 -or $invalidPublicationVisibility.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native system-publication update accepted a non-boolean visibility value'
|
|
}
|
|
$missingPublication = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/publications/plan/missing-publication" -Method Patch -ContentType 'application/json' -Body (@{ visible = $false } | ConvertTo-Json -Compress) -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($missingPublication.StatusCode -ne 404) {
|
|
throw 'Native system-publication update did not return 404 for a missing record'
|
|
}
|
|
$schoolPublicationForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/publications/plan/$($managedPlan.id)" -Method Patch -ContentType 'application/json' -Body (@{ visible = $false } | ConvertTo-Json -Compress) -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($schoolPublicationForbidden.StatusCode -ne 403) {
|
|
throw 'Native system-publication update did not preserve the super-admin boundary'
|
|
}
|
|
$hiddenPublicationResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/publications/plan/$($managedPlan.id)" -Method Patch -ContentType 'application/json' -Body (@{ visible = $false } | ConvertTo-Json -Compress) -WebSession $nativeSession
|
|
$hiddenPublication = ($hiddenPublicationResponse.Content | ConvertFrom-Json).publication
|
|
if ($hiddenPublicationResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or $hiddenPublication.visible -ne $false -or $hiddenPublication.status -ne 'hidden') {
|
|
throw 'Native system-publication update did not hide the requested publication'
|
|
}
|
|
$hiddenAnnouncements = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/public/announcements"
|
|
if (@($hiddenAnnouncements.plans | Where-Object { $_.id -eq $managedPlan.id }).Count -ne 0) {
|
|
throw 'Native public announcements still exposed a hidden system publication'
|
|
}
|
|
$restoredPublicationResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/publications/plan/$($managedPlan.id)" -Method Patch -ContentType 'application/json' -Body (@{ visible = $true } | ConvertTo-Json -Compress) -WebSession $nativeSession
|
|
$restoredPublication = ($restoredPublicationResponse.Content | ConvertFrom-Json).publication
|
|
if ($restoredPublication.visible -ne $true -or $restoredPublication.status -ne 'visible') {
|
|
throw 'Native system-publication update did not restore the requested publication'
|
|
}
|
|
$restoredAnnouncements = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/public/announcements"
|
|
if (@($restoredAnnouncements.plans | Where-Object { $_.id -eq $managedPlan.id }).Count -ne 1) {
|
|
throw 'Native public announcements did not restore a visible system publication'
|
|
}
|
|
$classLoginBody = @{ username = 'class_admin'; password = '12345678' } | ConvertTo-Json -Compress
|
|
$legacyClassSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$nativeClassSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
Invoke-RestMethod -Uri "$legacyBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $classLoginBody -WebSession $legacyClassSession | Out-Null
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $classLoginBody -WebSession $nativeClassSession | Out-Null
|
|
foreach ($classAdminRoute in @('context', 'dashboard')) {
|
|
$legacyClassRead = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/$classAdminRoute" -WebSession $legacyClassSession
|
|
$nativeClassRead = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$classAdminRoute" -WebSession $nativeClassSession
|
|
Assert-JsonEquivalent -Expected $legacyClassRead.Content -Actual $nativeClassRead.Content -Label "Class admin read route '$classAdminRoute'"
|
|
}
|
|
$classAdminsForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/admins" -WebSession $nativeClassSession -SkipHttpErrorCheck
|
|
if ($classAdminsForbidden.StatusCode -ne 403) {
|
|
throw 'Native admins route did not preserve the class-admin boundary'
|
|
}
|
|
|
|
foreach ($configurationRoute in @('number-rules', 'workflows')) {
|
|
$legacyConfiguration = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/$configurationRoute" -WebSession $session
|
|
$nativeConfiguration = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$configurationRoute" -WebSession $nativeSession
|
|
if ($nativeConfiguration.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw "Native admin configuration route '$configurationRoute' did not use ASP.NET Core"
|
|
}
|
|
Assert-JsonEquivalent -Expected $legacyConfiguration.Content -Actual $nativeConfiguration.Content -Label "Admin configuration '$configurationRoute'"
|
|
}
|
|
foreach ($configurationRoute in @('number-rules', 'workflows')) {
|
|
$schoolConfigurationForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/$configurationRoute" -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($schoolConfigurationForbidden.StatusCode -ne 403) {
|
|
throw "Admin configuration route '$configurationRoute' did not preserve the super-admin boundary"
|
|
}
|
|
}
|
|
|
|
$numberRuleState = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/number-rules" -WebSession $nativeSession
|
|
$activeNumberRule = $numberRuleState.activeRule
|
|
$numberRuleBody = @{
|
|
id = $activeNumberRule.id
|
|
name = '原生年度学校流水号'
|
|
separator = $activeNumberRule.separator
|
|
segments = @($activeNumberRule.segments | ForEach-Object {
|
|
@{ type = $_.type; value = $_.value; width = $_.width }
|
|
})
|
|
} | ConvertTo-Json -Depth 5 -Compress
|
|
$savedNumberRule = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/number-rules" -Method Post -ContentType 'application/json' -Body $numberRuleBody -WebSession $nativeSession
|
|
if ($savedNumberRule.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or ($savedNumberRule.Content | ConvertFrom-Json).rule.name -ne '原生年度学校流水号') {
|
|
throw 'Native number-rule update did not persist the requested definition'
|
|
}
|
|
|
|
$workflowState = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/workflows" -WebSession $nativeSession
|
|
$accountWorkflow = @($workflowState.workflows | Where-Object { $_.businessType -eq 'candidate_account_batch' })[0]
|
|
$invalidWorkflowBody = @{ name = '无效流程'; steps = @(@{ name = '学校终审'; adminLevel = 'school' }) } | ConvertTo-Json -Depth 4 -Compress
|
|
$invalidWorkflow = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/workflows/candidate_account_batch" -Method Put -ContentType 'application/json' -Body $invalidWorkflowBody -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($invalidWorkflow.StatusCode -ne 400) {
|
|
throw 'Native workflow update allowed a non-super final account-batch step'
|
|
}
|
|
$workflowBody = @{
|
|
name = '原生批量报名号审批'
|
|
steps = @($accountWorkflow.steps | ForEach-Object {
|
|
@{ name = $_.name; adminLevel = $_.adminLevel }
|
|
})
|
|
} | ConvertTo-Json -Depth 5 -Compress
|
|
$savedWorkflow = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/workflows/candidate_account_batch" -Method Put -ContentType 'application/json' -Body $workflowBody -WebSession $nativeSession
|
|
if ($savedWorkflow.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or ($savedWorkflow.Content | ConvertFrom-Json).workflow.name -ne '原生批量报名号审批') {
|
|
throw 'Native workflow update did not persist the account-batch definition'
|
|
}
|
|
|
|
$legacySuperBatches = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/candidate-account-batches" -WebSession $session
|
|
$nativeSuperBatches = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches" -WebSession $nativeSession
|
|
if ($nativeSuperBatches.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native candidate-account batch read did not use ASP.NET Core'
|
|
}
|
|
Assert-JsonEquivalent -Expected $legacySuperBatches.Content -Actual $nativeSuperBatches.Content -Label 'Super-admin candidate-account batches'
|
|
$legacySchoolBatches = Invoke-WebRequest -Uri "$legacyBaseUrl/api/admin/candidate-account-batches" -WebSession $legacySchoolSession
|
|
$nativeSchoolBatches = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches" -WebSession $nativeSchoolSession
|
|
Assert-JsonEquivalent -Expected $legacySchoolBatches.Content -Actual $nativeSchoolBatches.Content -Label 'School-admin candidate-account batches'
|
|
$classBatchesForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches" -WebSession $nativeClassSession -SkipHttpErrorCheck
|
|
if ($classBatchesForbidden.StatusCode -ne 403 -or $classBatchesForbidden.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native candidate-account batches did not preserve the candidates.write boundary'
|
|
}
|
|
|
|
$schoolBatchState = $nativeSchoolBatches.Content | ConvertFrom-Json
|
|
$batchClass = @($schoolBatchState.classes)[0]
|
|
if ($null -eq $batchClass) {
|
|
throw 'Seed data did not provide an active class for account-batch smoke testing'
|
|
}
|
|
$batchSubmitBody = @{ quotas = @(@{ classId = $batchClass.id; count = 2 }) } | ConvertTo-Json -Depth 4 -Compress
|
|
$batchSubmitResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches" -Method Post -ContentType 'application/json' -Body $batchSubmitBody -WebSession $nativeSchoolSession
|
|
if ($batchSubmitResponse.StatusCode -ne 202 -or $batchSubmitResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native candidate-account batch submission did not use ASP.NET Core'
|
|
}
|
|
$submittedBatch = ($batchSubmitResponse.Content | ConvertFrom-Json).batch
|
|
if ($submittedBatch.status -ne 'pending' -or $submittedBatch.totalCount -ne 2 -or $submittedBatch.workflow.status -ne 'pending') {
|
|
throw 'Native candidate-account batch submission did not create its workflow atomically'
|
|
}
|
|
$schoolBatchReview = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches/$($submittedBatch.id)" -Method Patch -ContentType 'application/json' -Body (@{ status = 'approved'; reviewNote = '越权审批' } | ConvertTo-Json -Compress) -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($schoolBatchReview.StatusCode -ne 403) {
|
|
throw 'Native account-batch review did not enforce the current workflow assignee'
|
|
}
|
|
$batchApproveBody = @{ status = 'approved'; reviewNote = '原生终审通过' } | ConvertTo-Json -Compress
|
|
$batchApproveResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches/$($submittedBatch.id)" -Method Patch -ContentType 'application/json' -Body $batchApproveBody -WebSession $nativeSession
|
|
if ($batchApproveResponse.StatusCode -ne 200 -or $batchApproveResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native candidate-account batch approval did not use ASP.NET Core'
|
|
}
|
|
$approvedBatch = ($batchApproveResponse.Content | ConvertFrom-Json).batch
|
|
if ($approvedBatch.status -ne 'approved' -or @($approvedBatch.items).Count -ne 2 -or @($approvedBatch.items | Where-Object { -not $_.candidateNumber -or $_.initialPassword -notmatch '^Init-' }).Count -ne 0) {
|
|
throw 'Native candidate-account batch approval did not generate all candidate credentials'
|
|
}
|
|
$generatedAccount = @($approvedBatch.items)[0]
|
|
$generatedLoginBody = @{ username = $generatedAccount.candidateNumber; password = $generatedAccount.initialPassword } | ConvertTo-Json -Compress
|
|
$generatedLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $generatedLoginBody
|
|
if ($generatedLogin.user.candidateNumber -ne $generatedAccount.candidateNumber -or $generatedLogin.user.mustChangePassword -ne $true) {
|
|
throw 'Generated candidate credentials are not compatible with native authentication'
|
|
}
|
|
$duplicateBatchApproval = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/candidate-account-batches/$($submittedBatch.id)" -Method Patch -ContentType 'application/json' -Body $batchApproveBody -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($duplicateBatchApproval.StatusCode -ne 404) {
|
|
throw 'Native candidate-account batch approval was not idempotently protected'
|
|
}
|
|
|
|
$schoolCreateBody = @{
|
|
name = '原生迁移测试学校'
|
|
code = 'NATIVE_SMOKE'
|
|
address = '迁移测试路 1 号'
|
|
isSourceSchool = $true
|
|
isAdmissionSchool = $true
|
|
} | ConvertTo-Json -Compress
|
|
$schoolCreateResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/schools" -Method Post -ContentType 'application/json' -Body $schoolCreateBody -WebSession $nativeSession
|
|
if ($schoolCreateResponse.StatusCode -ne 201 -or $schoolCreateResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native school creation did not use the ASP.NET Core endpoint'
|
|
}
|
|
$createdSchool = ($schoolCreateResponse.Content | ConvertFrom-Json).school
|
|
if ($createdSchool.code -ne 'NATIVE_SMOKE' -or $createdSchool.active -ne $true) {
|
|
throw 'Native school creation returned an unexpected projection'
|
|
}
|
|
$duplicateSchool = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/schools" -Method Post -ContentType 'application/json' -Body $schoolCreateBody -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($duplicateSchool.StatusCode -ne 409) {
|
|
throw 'Native school creation did not reject a duplicate school code'
|
|
}
|
|
$schoolCreateForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/schools" -Method Post -ContentType 'application/json' -Body $schoolCreateBody -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($schoolCreateForbidden.StatusCode -ne 403 -or $schoolCreateForbidden.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native school creation did not preserve the super-admin boundary'
|
|
}
|
|
|
|
$schoolPatchBody = @{ address = '迁移测试路 2 号'; isAdmissionSchool = $false } | ConvertTo-Json -Compress
|
|
$schoolPatch = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/schools/$($createdSchool.id)" -Method Patch -ContentType 'application/json' -Body $schoolPatchBody -WebSession $nativeSession
|
|
if ($schoolPatch.school.address -ne '迁移测试路 2 号' -or $schoolPatch.school.isAdmissionSchool -ne $false) {
|
|
throw 'Native school update did not persist the requested fields'
|
|
}
|
|
|
|
$newSchoolAdminBody = @{
|
|
username = 'native_school_writer'
|
|
password = '12345678'
|
|
displayName = '原生校级管理员'
|
|
adminLevel = 'school'
|
|
schoolId = $createdSchool.id
|
|
} | ConvertTo-Json -Compress
|
|
$newSchoolAdminResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/admins" -Method Post -ContentType 'application/json' -Body $newSchoolAdminBody -WebSession $nativeSession
|
|
if ($newSchoolAdminResponse.StatusCode -ne 201 -or $newSchoolAdminResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native administrator creation did not use the ASP.NET Core endpoint'
|
|
}
|
|
$createdSchoolAdmin = ($newSchoolAdminResponse.Content | ConvertFrom-Json).admin
|
|
|
|
$newSchoolAdminSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$newSchoolAdminLoginBody = @{ username = 'native_school_writer'; password = '12345678' } | ConvertTo-Json -Compress
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $newSchoolAdminLoginBody -WebSession $newSchoolAdminSession | Out-Null
|
|
$classCreateBody = @{ name = '迁移测试班'; grade = '2026级' } | ConvertTo-Json -Compress
|
|
$classCreateResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/classes" -Method Post -ContentType 'application/json' -Body $classCreateBody -WebSession $newSchoolAdminSession
|
|
if ($classCreateResponse.StatusCode -ne 201 -or $classCreateResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native class creation did not use the ASP.NET Core endpoint'
|
|
}
|
|
$createdClass = ($classCreateResponse.Content | ConvertFrom-Json).schoolClass
|
|
$superClassForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/classes" -Method Post -ContentType 'application/json' -Body $classCreateBody -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($superClassForbidden.StatusCode -ne 403) {
|
|
throw 'Native class creation did not preserve the school-admin boundary'
|
|
}
|
|
$classPatchBody = @{ name = '迁移测试一班'; active = $true } | ConvertTo-Json -Compress
|
|
$classPatch = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/classes/$($createdClass.id)" -Method Patch -ContentType 'application/json' -Body $classPatchBody -WebSession $newSchoolAdminSession
|
|
if ($classPatch.schoolClass.name -ne '迁移测试一班') {
|
|
throw 'Native class update did not persist the requested name'
|
|
}
|
|
|
|
$newClassAdminBody = @{
|
|
username = 'native_class_writer'
|
|
password = '12345678'
|
|
displayName = '原生班级管理员'
|
|
adminLevel = 'super'
|
|
classId = $createdClass.id
|
|
} | ConvertTo-Json -Compress
|
|
$newClassAdminResponse = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/admins" -Method Post -ContentType 'application/json' -Body $newClassAdminBody -WebSession $newSchoolAdminSession
|
|
if ($newClassAdminResponse.admin.adminLevel -ne 'class' -or $newClassAdminResponse.admin.schoolId -ne $createdSchool.id) {
|
|
throw 'School admin did not create a class-scoped administrator'
|
|
}
|
|
$createdClassAdmin = $newClassAdminResponse.admin
|
|
$newClassAdminSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$newClassAdminLoginBody = @{ username = 'native_class_writer'; password = '12345678' } | ConvertTo-Json -Compress
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $newClassAdminLoginBody -WebSession $newClassAdminSession | Out-Null
|
|
|
|
$disableClassAdminBody = @{ active = $false; displayName = '原生班级管理员（停用）' } | ConvertTo-Json -Compress
|
|
$disabledClassAdmin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/admins/$($createdClassAdmin.id)" -Method Patch -ContentType 'application/json' -Body $disableClassAdminBody -WebSession $newSchoolAdminSession
|
|
if ($disabledClassAdmin.admin.displayName -ne '原生班级管理员（停用）') {
|
|
throw 'Native administrator update did not persist the display name'
|
|
}
|
|
$invalidatedClassSession = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/auth/me" -WebSession $newClassAdminSession -SkipHttpErrorCheck
|
|
$invalidatedClassIdentity = $invalidatedClassSession.Content | ConvertFrom-Json
|
|
if ($invalidatedClassSession.StatusCode -ne 200 -or $null -ne $invalidatedClassIdentity.user) {
|
|
throw 'Disabling an administrator did not invalidate existing sessions'
|
|
}
|
|
|
|
$resetClassAdmin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/admins/$($createdClassAdmin.id)/reset-password" -Method Post -WebSession $newSchoolAdminSession
|
|
if ($resetClassAdmin.username -ne 'native_class_writer' -or $resetClassAdmin.temporaryPassword -notmatch '^Reset-[A-Za-z0-9_-]+$') {
|
|
throw 'Native administrator password reset returned an invalid temporary password'
|
|
}
|
|
$resetLoginBody = @{ username = 'native_class_writer'; password = $resetClassAdmin.temporaryPassword } | ConvertTo-Json -Compress
|
|
$resetLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $resetLoginBody
|
|
if ($resetLogin.user.username -ne 'native_class_writer') {
|
|
throw 'The temporary administrator password is not compatible with native authentication'
|
|
}
|
|
|
|
$adminStateBeforeSetting = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/admins" -WebSession $nativeSession
|
|
$originalSelfRegistration = [bool]$adminStateBeforeSetting.selfRegistrationEnabled
|
|
$settingBody = @{ enabled = -not $originalSelfRegistration } | ConvertTo-Json -Compress
|
|
$settingUpdate = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/settings/self-registration" -Method Put -ContentType 'application/json' -Body $settingBody -WebSession $nativeSession
|
|
if ($settingUpdate.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or ($settingUpdate.Content | ConvertFrom-Json).enabled -eq $originalSelfRegistration) {
|
|
throw 'Native self-registration setting did not persist the requested value'
|
|
}
|
|
$settingForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/settings/self-registration" -Method Put -ContentType 'application/json' -Body $settingBody -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($settingForbidden.StatusCode -ne 403) {
|
|
throw 'Native self-registration setting did not preserve the super-admin boundary'
|
|
}
|
|
$restoreSettingBody = @{ enabled = $originalSelfRegistration } | ConvertTo-Json -Compress
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/admin/settings/self-registration" -Method Put -ContentType 'application/json' -Body $restoreSettingBody -WebSession $nativeSession | Out-Null
|
|
|
|
$noticeCreateForbidden = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/notices" -Method Post -ContentType 'application/json' -Body (@{ title = '越权公告'; content = '<p>无权发布</p>' } | ConvertTo-Json -Compress) -WebSession $nativeSchoolSession -SkipHttpErrorCheck
|
|
if ($noticeCreateForbidden.StatusCode -ne 403 -or $noticeCreateForbidden.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native notice creation did not preserve the super-admin boundary'
|
|
}
|
|
$invalidNotice = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/notices" -Method Post -ContentType 'application/json' -Body (@{ title = '无正文公告'; content = '<script>alert(1)</script>' } | ConvertTo-Json -Compress) -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($invalidNotice.StatusCode -ne 400 -or $invalidNotice.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native notice creation accepted content that became empty after sanitization'
|
|
}
|
|
$noticeCreateBody = @{
|
|
title = '原生迁移公告'
|
|
summary = ''
|
|
content = '<p>公告<strong>正文</strong><script>alert(1)</script></p><a href="javascript:alert(1)">危险链接</a>'
|
|
category = '迁移公告'
|
|
pinned = $true
|
|
status = 'draft'
|
|
} | ConvertTo-Json -Compress
|
|
$noticeCreateResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/notices" -Method Post -ContentType 'application/json' -Body $noticeCreateBody -WebSession $nativeSession
|
|
$createdNativeNotice = ($noticeCreateResponse.Content | ConvertFrom-Json).notice
|
|
if ($noticeCreateResponse.StatusCode -ne 201 -or $noticeCreateResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
|
|
throw 'Native notice creation did not use ASP.NET Core'
|
|
}
|
|
if ($createdNativeNotice.status -ne 'draft' -or $null -ne $createdNativeNotice.publishAt -or $createdNativeNotice.summary -ne '公告正文 危险链接') {
|
|
throw 'Native notice creation did not preserve draft state or derive its summary'
|
|
}
|
|
if ($createdNativeNotice.content -match '(?i)<script|javascript:') {
|
|
throw 'Native notice creation returned unsafe HTML'
|
|
}
|
|
$noticePublishBody = @{ title = '原生迁移公告（已发布）'; status = 'published' } | ConvertTo-Json -Compress
|
|
$noticePublishResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/admin/notices/$($createdNativeNotice.id)" -Method Patch -ContentType 'application/json' -Body $noticePublishBody -WebSession $nativeSession
|
|
$publishedNativeNotice = ($noticePublishResponse.Content | ConvertFrom-Json).notice
|
|
if ($noticePublishResponse.StatusCode -ne 200 -or $noticePublishResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or $publishedNativeNotice.status -ne 'published' -or -not $publishedNativeNotice.publishAt) {
|
|
throw 'Native notice update did not publish the notice'
|
|
}
|
|
$nativePublicNoticeResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/public/notices/$($createdNativeNotice.id)"
|
|
$nativePublicNotice = ($nativePublicNoticeResponse.Content | ConvertFrom-Json).notice
|
|
if ($nativePublicNoticeResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or $nativePublicNotice.title -ne '原生迁移公告（已发布）') {
|
|
throw 'Native public notice endpoint could not read the newly published notice'
|
|
}
|
|
if ($nativePublicNotice.content -match '(?i)<script|javascript:') {
|
|
throw 'Native public notice endpoint exposed unsafe HTML from an administrative write'
|
|
}
|
|
|
|
$adminCandidateRoute = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/profile" -WebSession $nativeSession -SkipHttpErrorCheck
|
|
if ($adminCandidateRoute.StatusCode -ne 403) {
|
|
throw 'Native candidate API did not enforce the candidate role boundary'
|
|
}
|
|
|
|
$nativeMe = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/me" -WebSession $nativeSession
|
|
if ($nativeMe.user.username -ne 'admin' -or $nativeMe.permissions[0] -ne '*') {
|
|
throw 'Native authentication did not preserve the session or administrator projection'
|
|
}
|
|
|
|
$totpSetupBody = @{ currentPassword = '12345678' } | ConvertTo-Json -Compress
|
|
$totpSetup = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/totp/setup" -Method Post -ContentType 'application/json' -Body $totpSetupBody -WebSession $nativeSession
|
|
if ($totpSetup.qrCode -notmatch '^data:image/png;base64,' -or $totpSetup.uri -notmatch '^otpauth://totp/') {
|
|
throw 'Native TOTP setup did not return a local PNG QR code and otpauth URI'
|
|
}
|
|
|
|
$totpCodeProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @(
|
|
'tests/helpers/current-totp-code.mjs', $totpSetup.secret
|
|
) -Environment $nodeEnvironment
|
|
if (-not $totpCodeProcess.WaitForExit(10000)) {
|
|
$totpCodeProcess.Kill($true)
|
|
throw 'Timed out while generating the native TOTP smoke-test code'
|
|
}
|
|
$totpCode = $totpCodeProcess.StandardOutput.ReadToEnd().Trim()
|
|
$totpCodeError = $totpCodeProcess.StandardError.ReadToEnd()
|
|
if ($totpCodeProcess.ExitCode -ne 0 -or -not $totpCode) {
|
|
throw "Could not generate the native TOTP smoke-test code`n$totpCodeError"
|
|
}
|
|
$totpCodeProcess.Dispose()
|
|
|
|
$totpEnableBody = @{ code = $totpCode } | ConvertTo-Json -Compress
|
|
$totpEnable = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/totp/enable" -Method Post -ContentType 'application/json' -Body $totpEnableBody -WebSession $nativeSession
|
|
if ($totpEnable.user.totpEnabled -ne $true -or $totpEnable.recoveryCodes.Count -ne 8) {
|
|
throw 'Native TOTP enablement did not persist security state or issue eight recovery codes'
|
|
}
|
|
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/logout" -Method Post -WebSession $nativeSession | Out-Null
|
|
$totpPasswordLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $loginBody
|
|
if ($totpPasswordLogin.requiresTotp -ne $true -or -not $totpPasswordLogin.challenge) {
|
|
throw 'Native password login bypassed enabled TOTP'
|
|
}
|
|
|
|
$totpLoginSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
|
|
$recoveryLoginBody = @{ challenge = $totpPasswordLogin.challenge; code = $totpEnable.recoveryCodes[0] } | ConvertTo-Json -Compress
|
|
$totpLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login/totp" -Method Post -ContentType 'application/json' -Body $recoveryLoginBody -WebSession $totpLoginSession
|
|
if ($totpLogin.usedRecoveryCode -ne $true -or $totpLogin.user.username -ne 'admin') {
|
|
throw 'Native TOTP recovery-code login did not create a session'
|
|
}
|
|
|
|
$totpStatus = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/totp" -WebSession $totpLoginSession
|
|
if ($totpStatus.enabled -ne $true -or $totpStatus.recoveryCodesRemaining -ne 7) {
|
|
throw 'Native TOTP recovery code was not consumed exactly once'
|
|
}
|
|
|
|
$disableBody = @{ currentPassword = '12345678'; code = $totpEnable.recoveryCodes[1] } | ConvertTo-Json -Compress
|
|
$disabled = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/totp/disable" -Method Post -ContentType 'application/json' -Body $disableBody -WebSession $totpLoginSession
|
|
if ($disabled.user.totpEnabled -ne $false) {
|
|
throw 'Native TOTP disable endpoint did not clear the security state'
|
|
}
|
|
|
|
$changePasswordBody = @{ currentPassword = '12345678'; newPassword = 'MigrationAuth456!' } | ConvertTo-Json -Compress
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/change-password" -Method Post -ContentType 'application/json' -Body $changePasswordBody -WebSession $totpLoginSession | Out-Null
|
|
Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/logout" -Method Post -WebSession $totpLoginSession | Out-Null
|
|
$changedLoginBody = @{ username = 'admin'; password = 'MigrationAuth456!' } | ConvertTo-Json -Compress
|
|
$changedLogin = Invoke-RestMethod -Uri "$nativeAuthBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $changedLoginBody
|
|
if ($changedLogin.user.username -ne 'admin') {
|
|
throw 'Native password change did not create a Node-compatible PBKDF2 hash'
|
|
}
|
|
|
|
[pscustomobject]@{
|
|
AspNetCoreHost = 'passed'
|
|
StaticAssets = 'passed'
|
|
JsonProxy = 'passed'
|
|
SessionCookie = 'passed'
|
|
NativePublicApi = 'passed'
|
|
PublicParity = 'passed'
|
|
DocumentCodes = 'passed'
|
|
NativeAuthentication = 'passed'
|
|
NativeCandidateReads = 'passed'
|
|
NativeCandidateWrites = 'passed'
|
|
NativeCandidateDocuments = 'passed'
|
|
NativeCandidateAdmissions = 'passed'
|
|
NativeAdminReads = 'passed'
|
|
NativeAdminOrganizationWrites = 'passed'
|
|
NativeAdminAccountBatches = 'passed'
|
|
NativeAdminConfiguration = 'passed'
|
|
NativeAdminNoticeManagement = 'passed'
|
|
} | Format-List
|
|
}
|
|
finally {
|
|
foreach ($process in @($nativeAuthProcess, $dotnetProcess, $nodeProcess)) {
|
|
if ($null -ne $process -and -not $process.HasExited) {
|
|
$process.Kill($true)
|
|
$process.WaitForExit()
|
|
}
|
|
if ($null -ne $process) {
|
|
$process.Dispose()
|
|
}
|
|
}
|
|
|
|
if (Test-Path -LiteralPath $testDirectory) {
|
|
$resolvedTestDirectory = [System.IO.Path]::GetFullPath($testDirectory)
|
|
if (-not $resolvedTestDirectory.StartsWith($smokeArtifactRoot, [StringComparison]::OrdinalIgnoreCase) -or
|
|
-not ([System.IO.Path]::GetFileName($resolvedTestDirectory)).StartsWith('eis-migration-smoke-', [StringComparison]::Ordinal)) {
|
|
throw "Refusing to remove unexpected smoke-test directory: $resolvedTestDirectory"
|
|
}
|
|
for ($attempt = 1; $attempt -le 20; $attempt++) {
|
|
try {
|
|
Remove-Item -LiteralPath $resolvedTestDirectory -Recurse -Force -ErrorAction Stop
|
|
break
|
|
}
|
|
catch {
|
|
if ($attempt -eq 20) {
|
|
throw
|
|
}
|
|
Start-Sleep -Milliseconds 200
|
|
}
|
|
}
|
|
}
|
|
}
|