feat: add local access control and managed point clouds

server/bootstrap-admin.test.ts

@@ -0,0 +1,37 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("./db", () => ({
+  countActiveSuperAdmins: vi.fn(),
+  getUserByUsername: vi.fn(),
+  createUser: vi.fn(),
+  updateUser: vi.fn(),
+}));
+
+import * as db from "./db";
+import { ensureBootstrapAdmin } from "./_core/auth";
+import { ENV } from "./_core/env";
+
+describe("引导超级管理员", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    ENV.bootstrapAdminUsername = "bootstrap-test";
+    ENV.bootstrapAdminPassword = "bootstrap-password";
+  });
+
+  it("不存在有效超级管理员时只创建一次", async () => {
+    vi.mocked(db.countActiveSuperAdmins).mockResolvedValueOnce(0).mockResolvedValueOnce(1);
+    vi.mocked(db.getUserByUsername).mockResolvedValue(undefined);
+    vi.mocked(db.createUser).mockResolvedValue({} as never);
+    await ensureBootstrapAdmin();
+    await ensureBootstrapAdmin();
+    expect(db.createUser).toHaveBeenCalledTimes(1);
+    expect(db.createUser).toHaveBeenCalledWith(expect.objectContaining({ role: "super_admin", isActive: 1, mustChangePassword: 1 }));
+  });
+
+  it("无有效超级管理员且缺少变量时启动失败", async () => {
+    vi.mocked(db.countActiveSuperAdmins).mockResolvedValue(0);
+    ENV.bootstrapAdminUsername = "";
+    ENV.bootstrapAdminPassword = "";
+    await expect(ensureBootstrapAdmin()).rejects.toThrow("BOOTSTRAP_ADMIN_USERNAME");
+  });
+});