xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 11 Pull Requests 3 Actions 6 Packages Projects Releases 7 Wiki Activity

test(wave131): password_hasher密码哈希+验证 + 55单测 #1034

Closed
xiaoxia wants to merge 1 commits from test/wave131-password-hasher into develop
pull from: test/wave131-password-hasher
merge into: xiaoxia:develop
Conversation 3 Commits 1 Files Changed 1
+274 -182
xiaoxia commented 2026-07-27 15:20:11 +08:00
Owner
Copy Link
Copy Source

wave131: 密码哈希与验证模块单测覆盖

测试覆盖

模块 用例数 覆盖场景
PasswordHasher初始化 8 默认/自定义/边界值/越界/负数
hash_password 9 返回值/空密码/None/bcrypt格式/随机盐/长度/长密码/Unicode/特殊字符
verify_password 9 正确密码/错误密码/空密码/空hash/None/无效格式/大小写敏感/空格/Unicode往返
needs_rehash 6 相同rounds/不同rounds/更高/更低/无效hash/空hash
PasswordValidator初始化 2 默认配置/自定义配置
validate 16 强密码通过/空/太短/刚好/无大写/无小写/无数字/默认不需特殊字符/需特殊字符缺失/需特殊字符存在/所有特殊字符/最短有效/全数字/全字母/长密码/Unicode/空格
全局实例 4 hasher存在/validator存在/hasher可用/validator可用
合计 55

说明

  • 测试用 rounds=4 加速 bcrypt 计算（生产环境用 rounds=12）
  • 覆盖密码安全相关所有边界：空值、无效格式、大小写敏感、Unicode、特殊字符
  • 全局实例验证确保生产配置正确
## wave131: 密码哈希与验证模块单测覆盖 ### 测试覆盖 | 模块 | 用例数 | 覆盖场景 | |------|--------|----------| | PasswordHasher初始化 | 8 | 默认/自定义/边界值/越界/负数 | | hash_password | 9 | 返回值/空密码/None/bcrypt格式/随机盐/长度/长密码/Unicode/特殊字符 | | verify_password | 9 | 正确密码/错误密码/空密码/空hash/None/无效格式/大小写敏感/空格/Unicode往返 | | needs_rehash | 6 | 相同rounds/不同rounds/更高/更低/无效hash/空hash | | PasswordValidator初始化 | 2 | 默认配置/自定义配置 | | validate | 16 | 强密码通过/空/太短/刚好/无大写/无小写/无数字/默认不需特殊字符/需特殊字符缺失/需特殊字符存在/所有特殊字符/最短有效/全数字/全字母/长密码/Unicode/空格 | | 全局实例 | 4 | hasher存在/validator存在/hasher可用/validator可用 | | **合计** | **55** | | ### 说明 - 测试用 rounds=4 加速 bcrypt 计算（生产环境用 rounds=12） - 覆盖密码安全相关所有边界：空值、无效格式、大小写敏感、Unicode、特殊字符 - 全局实例验证确保生产配置正确
gitea-actions bot commented 2026-07-27 16:42:07 +08:00
Copy Link
Copy Source

🚀 预览环境已部署

项目 详情
PR号 #1034
预览链接 https://pr-1034.preview.xiaoxiajianji.com
API环境 staging

💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。

🔄 每次提交新代码后预览环境会自动更新。

🗑️ PR 关闭或合并后，预览环境会自动清理。

🚀 **预览环境已部署** | 项目 | 详情 | |------|------| | PR号 | #1034 | | 预览链接 | [https://pr-1034.preview.xiaoxiajianji.com](https://pr-1034.preview.xiaoxiajianji.com) | | API环境 | staging | > 💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。 > > 🔄 每次提交新代码后预览环境会自动更新。 > > 🗑️ PR 关闭或合并后，预览环境会自动清理。
auto-approve-bot commented 2026-07-27 16:42:53 +08:00
Collaborator
Copy Link
Copy Source

代码审查结果 - PR #1034

📊 审查概览

  • 整体评价：需修改
  • 严重问题数量：1 个
  • 一般建议数量：2 个

❌ 需修改的问题（严重）

  1. [tests/unit/test_password_hasher.py: 143] 强制哈希降级的安全逻辑隐患
    • 问题描述：test_lower_rounds_also_needs_rehash 测试用例断言当哈希的 rounds (10) 高于当前验证器的 rounds (4) 时，needs_rehash 应返回 True。这会导致系统在检测到高强度的哈希时，主动将其降级为低强度哈希（如从 10 降级到 4），这是严重的安全倒退。
    • 修改建议：通常 needs_rehash 仅用于“升级”场景（即哈希强度低于当前策略时才需重算）。建议修改该断言为 assert hasher4.needs_rehash(hashed) is False，除非业务逻辑明确要求强制所有哈希与当前配置完全一致（虽然这通常不推荐）。

💡 改进建议（一般）

  1. [tests/unit/test_password_hasher.py: 49, 53] 异常断言的一致性

    • 具体内容：test_rounds_zero_raises 和 test_rounds_negative_raises 仅检查了异常类型，而同类的 test_rounds_below_min_raises 使用了 match 参数检查错误信息。建议统一添加 match 参数（如 match="rounds must be between"），以确保抛出的是预期的错误信息，避免因实现变更导致误判。

  2. [tests/unit/test_password_hasher.py: 72] 算法版本硬编码

    • 具体内容：test_bcrypt_format 中断言结果以 $2b$ 开头。虽然目前是标准，但如果底层库更新（如切换到 $2y$），测试将失败。建议改为断言以 $2 开头，或者允许配置算法版本，以提高测试的健壮性。

✅ 良好实践

  • 测试结构清晰，按功能模块（Init, Hash, Verify, Validator）拆分为多个类，可读性极佳。
  • 使用 rounds=4 加速单元测试，在保证逻辑覆盖的同时显著提升了 CI 运行效率。
  • 测试用例覆盖全面，包含了 Unicode、空值、None、边界值以及特殊字符等边缘情况。

✅ 格式检查通过 | ❌ 逻辑审查需修改 | ✅ 性能无明显问题

🤖 由 AI 代码审查机器人自动生成 | 2026-07-27 08:42:53 | 模型:

## 代码审查结果 - PR #1034 ### 📊 审查概览 - 整体评价：需修改 - 严重问题数量：1 个 - 一般建议数量：2 个 ### ❌ 需修改的问题（严重） 1. **[tests/unit/test_password_hasher.py: 143] 强制哈希降级的安全逻辑隐患** - 问题描述：`test_lower_rounds_also_needs_rehash` 测试用例断言当哈希的 rounds (10) 高于当前验证器的 rounds (4) 时，`needs_rehash` 应返回 `True`。这会导致系统在检测到高强度的哈希时，主动将其降级为低强度哈希（如从 10 降级到 4），这是严重的安全倒退。 - 修改建议：通常 `needs_rehash` 仅用于“升级”场景（即哈希强度低于当前策略时才需重算）。建议修改该断言为 `assert hasher4.needs_rehash(hashed) is False`，除非业务逻辑明确要求强制所有哈希与当前配置完全一致（虽然这通常不推荐）。 ### 💡 改进建议（一般） 1. **[tests/unit/test_password_hasher.py: 49, 53] 异常断言的一致性** - 具体内容：`test_rounds_zero_raises` 和 `test_rounds_negative_raises` 仅检查了异常类型，而同类的 `test_rounds_below_min_raises` 使用了 `match` 参数检查错误信息。建议统一添加 `match` 参数（如 `match="rounds must be between"`），以确保抛出的是预期的错误信息，避免因实现变更导致误判。 2. **[tests/unit/test_password_hasher.py: 72] 算法版本硬编码** - 具体内容：`test_bcrypt_format` 中断言结果以 `$2b$` 开头。虽然目前是标准，但如果底层库更新（如切换到 `$2y$`），测试将失败。建议改为断言以 `$2` 开头，或者允许配置算法版本，以提高测试的健壮性。 ### ✅ 良好实践 - 测试结构清晰，按功能模块（Init, Hash, Verify, Validator）拆分为多个类，可读性极佳。 - 使用 `rounds=4` 加速单元测试，在保证逻辑覆盖的同时显著提升了 CI 运行效率。 - 测试用例覆盖全面，包含了 Unicode、空值、None、边界值以及特殊字符等边缘情况。 --- ✅ 格式检查通过 | ❌ 逻辑审查需修改 | ✅ 性能无明显问题 --- <sub>🤖 由 AI 代码审查机器人自动生成 | 2026-07-27 08:42:53 | 模型: </sub> <!-- AI_CODE_REVIEW_AUTO_COMMENT -->
xiaoxia added 1 commit 2026-07-27 18:29:14 +08:00
test(wave131): password_hasher密码哈希+验证+55单测
ACR Cleanup / ACR Image Cleanup (pull_request_target) Has been cancelled
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Failing after 1s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Failing after 0s
Details
CI/CD Pipeline / Validate - Type Check (mypy) (pull_request) Failing after 0s
Details
CI/CD Pipeline / Validate - Code Quality (pull_request) Failing after 0s
Details
CI/CD Pipeline / Validate - Migration (alembic) (pull_request) Failing after 0s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Failing after 0s
Details
AI Code Review / AI Code Review (pull_request) Failing after 1s
Details
PR Automation / Auto Approve on CI Green (pull_request) Failing after 1s
Details
CI/CD Pipeline / Unit Tests (pull_request) Failing after 0s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 0s
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Failing after 0s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 1m8s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 27s
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Successful in 3m25s
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 2m45s
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 9m19s
Details
CI/CD Pipeline / CI Gate (pull_request) Failing after 0s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been cancelled
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
6300acf164 
- PasswordHasher: 初始化(8)/hash_password(9)/verify_password(9)/needs_rehash(6)
- PasswordValidator: 初始化(2)/validate(16)
- 全局实例: 4
- 覆盖场景: bcrypt格式/盐值随机性/大小写敏感/Unicode/特殊字符/
  空密码/无效hash/不同rounds重哈希/长度/大小写/数字/特殊字符
xiaoxia force-pushed test/wave131-password-hasher from 210d9eae98 to 6300acf164 2026-07-27 18:29:14 +08:00 Compare
xiaoxia closed this pull request 2026-07-27 18:30:28 +08:00
gitea-actions bot commented 2026-07-27 20:04:55 +08:00
Copy Link
Copy Source

🗑️ 预览环境已清理

PR #1034 已关闭或合并，对应的预览环境已被清理。

如有需要，可以重新打开 PR 来重新生成预览环境。

🗑️ **预览环境已清理** PR #1034 已关闭或合并，对应的预览环境已被清理。 > 如有需要，可以重新打开 PR 来重新生成预览环境。
Some checks are pending
ACR Cleanup / ACR Image Cleanup (pull_request_target) Has been cancelled
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Failing after 1s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Failing after 0s
Details
CI/CD Pipeline / Validate - Type Check (mypy) (pull_request) Failing after 0s
Details
CI/CD Pipeline / Validate - Code Quality (pull_request) Failing after 0s
Details
CI/CD Pipeline / Validate - Migration (alembic) (pull_request) Failing after 0s
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Failing after 0s
Details
AI Code Review / AI Code Review (pull_request) Failing after 1s
Details
PR Automation / Auto Approve on CI Green (pull_request) Failing after 1s
Details
CI/CD Pipeline / Unit Tests (pull_request) Failing after 0s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 0s
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Failing after 0s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 1m8s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 27s
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Successful in 3m25s
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 2m45s
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 9m19s
Details
CI/CD Pipeline / CI Gate (pull_request) Failing after 0s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been cancelled
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#1034
Delete Branch "test/wave131-password-hasher"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?