From 00a31e9b8ddea3f3864c8a5b248c32d3b8f69989 Mon Sep 17 00:00:00 2001
From: weichen <weichen@example.com>
Date: Sun, 13 Sep 2026 11:13:22 +0000
Subject: [PATCH] fix(e2e): require ADMIN_* env for UI acceptance credentials

Drop the hardcoded admin password fallback so secrets never ship in the
spec; missing ADMIN_USERNAME/ADMIN_PASSWORD fails the suite explicitly.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 web/e2e/document-revision-runtime.spec.ts | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/web/e2e/document-revision-runtime.spec.ts b/web/e2e/document-revision-runtime.spec.ts
index 9844b627..a4bec385 100644
--- a/web/e2e/document-revision-runtime.spec.ts
+++ b/web/e2e/document-revision-runtime.spec.ts
@@ -133,8 +133,18 @@ function readPhaseSecrets(): PhaseSecrets {
   return JSON.parse(fs.readFileSync(PHASE_SECRETS_FILE, 'utf-8')) as PhaseSecrets;
 }
 
-const ADMIN_USER = process.env.ADMIN_USERNAME || 'admin';
-const ADMIN_PASS = process.env.ADMIN_PASSWORD || 'admin-secret-password-123';
+const ADMIN_USER = process.env.ADMIN_USERNAME?.trim() || '';
+const ADMIN_PASS = process.env.ADMIN_PASSWORD?.trim() || '';
+
+/** Admin creds must come from env — never hardcode or fallback secrets into the repo/runtime. */
+function requireAdminCreds(): { username: string; password: string } {
+  if (!ADMIN_USER || !ADMIN_PASS) {
+    fail(
+      'ADMIN_USERNAME and ADMIN_PASSWORD environment variables are required for UI acceptance (no credential fallbacks)',
+    );
+  }
+  return { username: ADMIN_USER, password: ADMIN_PASS };
+}
 const suffix = `${Date.now().toString(36)}`;
 const USER_A = `uia_${suffix}`;
 const USER_B = `uib_${suffix}`;
@@ -345,9 +355,10 @@ test.describe.serial('document-revision-runtime UI acceptance', () => {
   test('UI-00 bootstrap: admin creates A/B/C via page', async () => {
     const t0 = Date.now();
     logs = [];
+    const admin = requireAdminCreds();
     await page.goto('/');
-    await page.fill('input[placeholder*="系统用户名"]', ADMIN_USER);
-    await page.fill('input[placeholder*="登录密码"]', ADMIN_PASS);
+    await page.fill('input[placeholder*="系统用户名"]', admin.username);
+    await page.fill('input[placeholder*="登录密码"]', admin.password);
     await page.click('button:has-text("进入医疗协同工作台")');
     await expect(page.getByText('新建立项会话')).toBeVisible({ timeout: 30_000 });
     await openAdminConsole(page);