fix(deploy): 加固 Redis 持久化与旧环境启动配置

scripts/test-security-origin.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/init-security-origin.sh
+. "${script_dir}/init-security-origin.sh"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_value() {
+    local actual
+    actual="$(public_url_read_env_value "$1" CONFIG_SECURITY_ORIGIN)"
+    [ "$actual" = "$2" ] || { echo "unexpected origin: $actual" >&2; exit 1; }
+}
+
+cat > "$tmp_dir/missing.env" <<'ENV'
+CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
+ENV
+init_security_origin "$tmp_dir/missing.env" > /dev/null
+assert_value "$tmp_dir/missing.env" 'https://zaowua.com'
+first_hash="$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)"
+init_security_origin "$tmp_dir/missing.env" > /dev/null
+[ "$first_hash" = "$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)" ]
+
+cat > "$tmp_dir/sample.env" <<'ENV'
+CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
+CONFIG_SECURITY_ORIGIN=http://127.0.0.1,http://localhost
+ENV
+init_security_origin "$tmp_dir/sample.env" > /dev/null
+assert_value "$tmp_dir/sample.env" 'https://zaowua.com'
+
+cat > "$tmp_dir/preserved.env" <<'ENV'
+CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
+CONFIG_SECURITY_ORIGIN=https://zaowua.com,https://www.zaowua.com
+ENV
+before="$(shasum -a 256 "$tmp_dir/preserved.env" | cut -d ' ' -f 1)"
+init_security_origin "$tmp_dir/preserved.env" > /dev/null
+[ "$before" = "$(shasum -a 256 "$tmp_dir/preserved.env" | cut -d ' ' -f 1)" ]
+
+for invalid in '*' 'https://zaowua.com/api' 'https://zaowua.com,' 'https://user:pass@zaowua.com'; do
+    printf 'CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api\nCONFIG_SECURITY_ORIGIN=%s\n' "$invalid" > "$tmp_dir/invalid.env"
+    if init_security_origin "$tmp_dir/invalid.env" > /dev/null 2>&1; then
+        echo "accepted invalid origin: $invalid" >&2
+        exit 1
+    fi
+done
+
+echo 'Security origin migration tests passed'