加固既有生产部署流程（07-27-yang-jun-reimbursement-readiness）

server/src/scripts/seed-trialrun.js

@@ -1,7 +1,5 @@
 require("dotenv/config");
 
-const crypto = require("node:crypto");
-
 const { createPrismaClient } = require("../prismaClient");
 const { hashPassword } = require("../utils/crypto");
 const { validatePassword } = require("../utils/passwordPolicy");
@@ -94,12 +92,6 @@ async function ensureDepartment(prisma, payload) {
   });
 }
 
-function generateOneTimePassword() {
-  // 确保满足 passwordPolicy：>=12 + 小写 + 大写 + 数字
-  const suffix = crypto.randomBytes(6).toString("hex");
-  return `TrialrunA1${suffix}`;
-}
-
 async function ensureFeatureFlag(prisma, payload) {
   const now = new Date();
   const existing = await prisma.featureFlag.findUnique({
@@ -248,7 +240,10 @@ async function ensureAdminEmployee(prisma, params) {
     return { employeeId: existing.id, created: false, password: null };
   }
 
-  const password = params.password || generateOneTimePassword();
+  if (!params.password) {
+    throw new Error('TRIALRUN_ADMIN_PASSWORD is required when creating the trialrun admin; credentials are never generated into deployment logs');
+  }
+  const password = params.password;
   const errors = validatePassword(password);
   if (errors.length) {
     throw new Error(`Invalid TRIALRUN_ADMIN_PASSWORD: ${errors.join("; ")}`);
@@ -348,9 +343,7 @@ async function main() {
     // eslint-disable-next-line no-console
     console.log("Seeded trialrun admin:");
     // eslint-disable-next-line no-console
-    console.log(`- email: ${adminEmail}`);
-    // eslint-disable-next-line no-console
-    console.log(`- phone: ${adminPhone}`);
+    console.log("- login identifiers: configured");
     // eslint-disable-next-line no-console
     console.log(`- created: ${result.created}`);
     // eslint-disable-next-line no-console
@@ -361,9 +354,7 @@ async function main() {
     }
     if (result.password) {
       // eslint-disable-next-line no-console
-      console.log(`- one-time password: ${result.password}`);
-      // eslint-disable-next-line no-console
-      console.log("  (请立刻保存，并在首次登录后由管理员重置/更换密码)");
+      console.log("- initial password: supplied by approved configuration; not logged");
     } else {
       // eslint-disable-next-line no-console
       console.log("- password: unchanged");