fix(admin): remove default credentials from staging bundle

deploy/prepare-staging-rc.sh

@@ -156,6 +156,17 @@ printf '[4/7] 构建 game-admin stage\n'
 corepack prepare pnpm@9.15.4 --activate
 (cd game-admin && pnpm install --frozen-lockfile && pnpm build:stage)
 
+# 前端制品可被所有内测用户读取，任何默认口令、模拟令牌或预置密钥标识都必须拒绝签发。
+for build_dir in game-studio/dist game-admin/dist-stage; do
+  if rg -n -i 'admin123|mock-token|bootstrap-admin\.token|DOGFOOD_PASSWORD_SEED' "$build_dir" \
+    >"$evidence/frontend-secret-scan.log"; then
+    printf '前端制品包含禁止发布的凭据或模拟令牌：%s\n' "$build_dir" >&2
+    exit 5
+  fi
+done
+printf 'FRONTEND_SECRET_SCAN_PASS\n' >"$evidence/frontend-secret-scan.log"
+chmod 600 "$evidence/frontend-secret-scan.log"
+
 printf '[5/7] 准备 commit 内独立 Python 虚拟环境\n'
 UV_BIN="${UV_BIN:-/root/.local/bin/uv}"
 [ -x "$UV_BIN" ] || { printf '缺少 uv：%s\n' "$UV_BIN" >&2; exit 5; }
@@ -217,6 +228,8 @@ printf '[7/7] 记录制品与启动坐标\n'
   printf 'security_java_tests_summary_sha256=%s\n' "$(sha256sum "$evidence/security-java-tests-summary.tsv" | awk '{print $1}')"
   printf 'studio_build=PASS\n'
   printf 'admin_build=PASS\n'
+  printf 'frontend_secret_scan=PASS\n'
+  printf 'frontend_secret_scan_sha256=%s\n' "$(sha256sum "$evidence/frontend-secret-scan.log" | awk '{print $1}')"
 } >"$evidence/verification-summary.txt"
 
 [ -z "$(git status --porcelain --untracked-files=no)" ] || { printf '构建修改了 tracked 文件，拒绝将其标为 ready。\n' >&2; exit 6; }

deploy/tests/test-staging-rc.sh

@@ -174,6 +174,8 @@ rg -q 'security_java_tests_sha256=' "$PREPARE" || fail "prepare 摘要未绑定
 rg -q 'verify_security_java_reports' "$PREPARE" || fail "prepare 未校验安全测试报告实际包含全部目标类"
 rg -q 'security-java-tests-summary\.tsv' "$PREPARE" || fail "prepare 未保存可审计的 Java 测试计数摘要"
 rg -q 'security_java_tests_summary_sha256=' "$PREPARE" || fail "prepare 摘要未绑定 Java 测试计数证据"
+rg -q 'FRONTEND_SECRET_SCAN_PASS' "$PREPARE" || fail "prepare 未扫描前端制品中的默认凭据"
+rg -q 'frontend_secret_scan_sha256=' "$PREPARE" || fail "prepare 摘要未绑定前端凭据扫描证据"
 ! rg -q 'backend_tests=NOT_RUN' "$PREPARE" || fail "prepare 仍宣称后端测试未运行"
 venv_line="$(rg -n '准备 commit 内独立 Python 虚拟环境' "$PREPARE" | cut -d: -f1)"
 tool_test_line="$(rg -n '运行发布工具回归测试' "$PREPARE" | cut -d: -f1)"

game-admin/.env

@@ -19,10 +19,10 @@ VITE_APP_DOCALERT_ENABLE=true
 # 百度统计
 VITE_APP_BAIDU_CODE = a1ff8825baa73c3a78eb96aa40325abc
 
-# 默认账户密码
+# 登录页只允许预填公开租户名，禁止把任何账号口令编进前端制品
 VITE_APP_DEFAULT_LOGIN_TENANT = 芋道源码
-VITE_APP_DEFAULT_LOGIN_USERNAME = admin
-VITE_APP_DEFAULT_LOGIN_PASSWORD = admin123
+VITE_APP_DEFAULT_LOGIN_USERNAME =
+VITE_APP_DEFAULT_LOGIN_PASSWORD =
 
 # API 加解密
 VITE_APP_API_ENCRYPT_ENABLE = true

game-admin/src/views/Login/SocialLogin.vue

@@ -199,9 +199,10 @@ const loginData = reactive({
   captchaEnable: import.meta.env.VITE_APP_CAPTCHA_ENABLE !== 'false',
   tenantEnable: import.meta.env.VITE_APP_TENANT_ENABLE !== 'false',
   loginForm: {
-    tenantName: '芋道源码',
-    username: 'admin',
-    password: 'admin123',
+    // 社交登录回调页与普通登录页共用无凭据默认值，避免口令进入浏览器制品。
+    tenantName: import.meta.env.VITE_APP_DEFAULT_LOGIN_TENANT || '',
+    username: import.meta.env.VITE_APP_DEFAULT_LOGIN_USERNAME || '',
+    password: import.meta.env.VITE_APP_DEFAULT_LOGIN_PASSWORD || '',
     captchaVerification: '',
     rememberMe: false
   }