Isolate smoke authentication settings in the loopback child

Reviewed-on: #15

apps/waterfall-wiki/scripts/smoke.mjs

@@ -16,7 +16,9 @@ async function availablePort() {
 const port = process.env.SMOKE_PORT || await availablePort();
 const release = "smoke-test";
 const child = spawn(process.execPath, [".next/standalone/server.js"], {
-  env: { ...process.env, PORT: port, HOSTNAME: "127.0.0.1", RELEASE_SHA: release },
+  // This loopback-only child checks retained resources without production credentials.
+  // Production keeps failing closed; the bypass requires both explicit test settings.
+  env: { ...process.env, AUTH_CONFIG_FILE: "", AUTH_DISABLED_FOR_TESTS: "true", PORT: port, HOSTNAME: "127.0.0.1", RELEASE_SHA: release },
   stdio: "inherit",
 });
 try {

apps/waterfall-wiki/tests/guidance-integration.ts

@@ -2,13 +2,13 @@ import assert from 'node:assert/strict';
 import {chromium} from 'playwright-core';
 import {randomUUID} from 'node:crypto';
 import {newToken,tokenDigest,ACCOUNT_COOKIE} from '../src/lib/account-crypto';
-import {guidanceXml} from '../src/content/guides/catalog';
+import {guidanceXml,type Guidance} from '../src/content/guides/catalog';
 import {db} from '../src/lib/db';
 import {publishDocument,resolveDocument,withdrawDocument,discoverDocuments} from '../src/lib/guidance-store';
 export async function verifyGuidancePublishing(base:string){
  const owner=randomUUID(),other=randomUUID(),id='user-'+owner+'-document';
  for(const uid of [owner,other])await db().query("INSERT INTO account_users(id,email,password_hash,verified_at) VALUES($1,$2,'test',now())",[uid,uid+'@example.com']);
- const doc={id,revision:1,kind:'context',title:'实际数据库文档',summary:'摘要',applies:'条件',body:'正文',steps:[],checks:[],links:[],tags:[]};
+ const doc:Guidance={id,revision:1,kind:'context',title:'实际数据库文档',summary:'摘要',applies:'条件',body:'正文',steps:[],checks:[],links:[],tags:[]};
  await assert.rejects(()=>publishDocument(other,doc),/INVALID_ID/);
  await publishDocument(other,{...doc,id:'user-'+other+'-document'});
  await publishDocument(owner,doc);assert.equal((await resolveDocument(id,1))?.title,doc.title);