fix: 修复 Bell 生产外壳白屏 (#142)

用户已于 2026-08-29 明确验收通过 #140。

Bell/server/app/admin/apis/captcha.go

@@ -21,13 +21,12 @@ func (e System) GenerateCaptchaHandler(c *gin.Context) {
 		e.Error(500, err, "服务初始化失败！")
 		return
 	}
-	id, b64s, answer, err := captcha.DriverDigitFunc()
+	id, b64s, _, err := captcha.DriverDigitFunc()
 	if err != nil {
 		e.Logger.Errorf("DriverDigitFunc error, %s", err.Error())
 		e.Error(500, err, "验证码获取失败")
 		return
 	}
-	e.Logger.Infof("DriverDigitFunc answer: %s", answer)
 	e.Custom(gin.H{
 		"code": 200,
 		"data": b64s,

Bell/server/app/admin/router/sys_router.go

@@ -28,6 +28,9 @@ func sysCheckRoleRouterInit(r *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddle
 }
 
 func registerBaseRouter(v1 *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddleware) {
+	systemAPI := apis.System{}
+	v1.GET("/captcha", systemAPI.GenerateCaptchaHandler)
+
 	api := apis.SysMenu{}
 	v1auth := v1.Group("").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
 	{

Bell/server/cmd/migrate/migration/version-local/2026082917001_bell_minimal_menu.go

@@ -0,0 +1,52 @@
+package version_local
+
+import (
+	"runtime"
+
+	"gorm.io/gorm"
+
+	"go-admin/cmd/migrate/migration"
+	common "go-admin/common/models"
+)
+
+func init() {
+	_, fileName, _, _ := runtime.Caller(0)
+	migration.Migrate.SetVersion(migration.GetFilename(fileName), migrateBellMinimalMenu)
+}
+
+func migrateBellMinimalMenu(db *gorm.DB, version string) error {
+	return db.Transaction(func(tx *gorm.DB) error {
+		if err := ApplyBellMinimalMenuVisibility(tx); err != nil {
+			return err
+		}
+		return tx.Create(&common.Migration{Version: version}).Error
+	})
+}
+
+// ApplyBellMinimalMenuVisibility keeps the imported GoAdmin menu records for
+// rollback and upgrades, but exposes only Bell product entries and the three
+// RBAC administration pages required to maintain local accounts.
+func ApplyBellMinimalMenuVisibility(tx *gorm.DB) error {
+	if err := tx.Exec(`
+		UPDATE sys_menu
+		SET visible = '1', updated_at = now()
+		WHERE menu_type IN ('M', 'C')
+		  AND deleted_at IS NULL
+		  AND visible IS DISTINCT FROM '1'
+	`).Error; err != nil {
+		return err
+	}
+
+	return tx.Exec(`
+		UPDATE sys_menu
+		SET visible = '0', updated_at = now()
+		WHERE menu_type IN ('M', 'C')
+		  AND deleted_at IS NULL
+		  AND (
+			path IN ('/admin', '/admin/sys-user', '/admin/sys-menu', '/admin/sys-role', '/bell')
+			OR permission IN ('admin:sysUser:list', 'admin:sysMenu:list', 'admin:sysRole:list',
+			                  'bell:alert:list', 'bell:event:list', 'bell:rule:list')
+		  )
+		  AND visible IS DISTINCT FROM '0'
+	`).Error
+}

Bell/server/tests/bell_minimal_menu/minimal_menu_test.go

@@ -0,0 +1,120 @@
+package bell_minimal_menu_test
+
+import (
+	"os"
+	"reflect"
+	"sort"
+	"testing"
+
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+
+	versionlocal "go-admin/cmd/migrate/migration/version-local"
+)
+
+var expectedVisibleMenus = []string{
+	"事件查询",
+	"用户管理",
+	"系统管理",
+	"菜单管理",
+	"角色管理",
+	"规则配置",
+	"预警中心",
+	"预警管理",
+}
+
+func TestBellMinimalMenuMigration(t *testing.T) {
+	databaseURL := os.Getenv("BELL_MINIMAL_MENU_TEST_DATABASE_URL")
+	if databaseURL == "" {
+		t.Skip("minimal menu database is not configured")
+	}
+	db, err := gorm.Open(postgres.Open(databaseURL), &gorm.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	assertVisibleMenus(t, db)
+	assertUnusedMenusRetainedAndHidden(t, db)
+	assertOperatorHasNoDefaultMenus(t, db)
+
+	var rowCountBefore int64
+	if err = db.Table("sys_menu").Count(&rowCountBefore).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Exec(`UPDATE sys_menu SET visible = '0' WHERE title IN ('开发工具','定时任务','系统工具')`).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Exec(`UPDATE sys_menu SET visible = '1' WHERE title IN ('系统管理','预警中心')`).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Transaction(versionlocal.ApplyBellMinimalMenuVisibility); err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Transaction(versionlocal.ApplyBellMinimalMenuVisibility); err != nil {
+		t.Fatalf("reapplying minimal menu policy failed: %v", err)
+	}
+	var rowCountAfter int64
+	if err = db.Table("sys_menu").Count(&rowCountAfter).Error; err != nil {
+		t.Fatal(err)
+	}
+	if rowCountAfter != rowCountBefore {
+		t.Fatalf("menu records changed during visibility migration: before=%d after=%d", rowCountBefore, rowCountAfter)
+	}
+	assertVisibleMenus(t, db)
+	assertUnusedMenusRetainedAndHidden(t, db)
+}
+
+func assertVisibleMenus(t *testing.T, db *gorm.DB) {
+	t.Helper()
+	var titles []string
+	if err := db.Table("sys_menu").
+		Where("menu_type IN ? AND deleted_at IS NULL AND visible = ?", []string{"M", "C"}, "0").
+		Order("title").Pluck("title", &titles).Error; err != nil {
+		t.Fatal(err)
+	}
+	sort.Strings(titles)
+	expected := append([]string(nil), expectedVisibleMenus...)
+	sort.Strings(expected)
+	if !reflect.DeepEqual(titles, expected) {
+		t.Fatalf("visible menu mismatch\nwant: %v\n got: %v", expected, titles)
+	}
+}
+
+func assertUnusedMenusRetainedAndHidden(t *testing.T, db *gorm.DB) {
+	t.Helper()
+	for _, title := range []string{"开发工具", "定时任务", "系统工具"} {
+		var values []string
+		if err := db.Table("sys_menu").Where("title = ? AND deleted_at IS NULL", title).Pluck("visible", &values).Error; err != nil {
+			t.Fatal(err)
+		}
+		if len(values) == 0 {
+			t.Fatalf("unused upstream menu %q was deleted", title)
+		}
+		for _, visible := range values {
+			if visible != "1" {
+				t.Fatalf("unused upstream menu %q remains visible=%q", title, visible)
+			}
+		}
+	}
+}
+
+func assertOperatorHasNoDefaultMenus(t *testing.T, db *gorm.DB) {
+	t.Helper()
+	var titles []string
+	err := db.Raw(`
+		SELECT DISTINCT m.title
+		FROM sys_role r
+		JOIN sys_role_menu rm ON rm.role_id = r.role_id
+		JOIN sys_menu m ON m.menu_id = rm.menu_id
+		WHERE r.role_key = 'operator'
+		  AND m.menu_type IN ('M', 'C')
+		  AND m.deleted_at IS NULL
+		  AND (m.path LIKE '/admin%' OR m.permission LIKE 'admin:%')
+	`).Scan(&titles).Error
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(titles) != 0 {
+		t.Fatalf("operator retains default administration menus: %v", titles)
+	}
+}

Bell/server/tests/bell_minimal_menu/run-postgres.ps1

@@ -0,0 +1,79 @@
+[CmdletBinding()]
+param([string]$PostgresBin = 'D:\pgsql17\bin')
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+$started = $false
+$root = Join-Path ([IO.Path]::GetTempPath()) ('yovision-bell-140-' + [guid]::NewGuid().ToString('N'))
+$data = Join-Path $root 'postgres'
+$log = Join-Path $root 'postgres.log'
+$serverRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Get-FreePort {
+    $listener = [Net.Sockets.TcpListener]::new([Net.IPAddress]::Loopback, 0)
+    try {
+        $listener.Start()
+        return ([Net.IPEndPoint]$listener.LocalEndpoint).Port
+    } finally {
+        $listener.Stop()
+    }
+}
+
+function Wait-ForPort([int]$Port) {
+    for ($attempt = 0; $attempt -lt 120; $attempt++) {
+        try {
+            $client = [Net.Sockets.TcpClient]::new()
+            $connected = $client.ConnectAsync('127.0.0.1', $Port).Wait(250) -and $client.Connected
+            $client.Dispose()
+            if ($connected) { return }
+        } catch {
+        }
+        Start-Sleep -Milliseconds 250
+    }
+    throw 'PostgreSQL did not start'
+}
+
+New-Item -ItemType Directory -Path $root | Out-Null
+$port = Get-FreePort
+try {
+    foreach ($name in @('initdb.exe', 'pg_ctl.exe', 'createdb.exe')) {
+        if (-not (Test-Path -LiteralPath (Join-Path $PostgresBin $name))) { throw "Missing $name" }
+    }
+    & (Join-Path $PostgresBin 'initdb.exe') -D $data -U postgres -A trust --encoding=UTF8 --no-locale | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'initdb failed' }
+    $arguments = "-D `"$data`" -l `"$log`" -o `"-p $port -h 127.0.0.1`" start"
+    Start-Process (Join-Path $PostgresBin 'pg_ctl.exe') -ArgumentList $arguments -WindowStyle Hidden | Out-Null
+    Wait-ForPort $port
+    $started = $true
+    & (Join-Path $PostgresBin 'createdb.exe') -h 127.0.0.1 -p $port -U postgres bell_140
+    if ($LASTEXITCODE -ne 0) { throw 'createdb failed' }
+
+    $env:GOTOOLCHAIN = 'go1.26.5'
+    $env:BELL_DATABASE_URL = "host=127.0.0.1 port=$port user=postgres dbname=bell_140 sslmode=disable"
+    $env:BELL_MINIMAL_MENU_TEST_DATABASE_URL = $env:BELL_DATABASE_URL
+    $env:BELL_JWT_SECRET = [guid]::NewGuid().ToString('N') + [guid]::NewGuid().ToString('N')
+    $env:BELL_BOOTSTRAP_USERNAME = 'bell_140_admin'
+    $env:BELL_BOOTSTRAP_PASSWORD = [guid]::NewGuid().ToString('N')
+    $env:BELL_HOST = '127.0.0.1'
+    $env:BELL_PORT = (Get-FreePort).ToString()
+
+    Push-Location $serverRoot
+    try {
+        go run . migrate -c config/settings.yml *> (Join-Path $root 'migrate.log')
+        if ($LASTEXITCODE -ne 0) { throw "migration failed; evidence: $root" }
+        go test ./tests/bell_minimal_menu -count=1 -v
+        if ($LASTEXITCODE -ne 0) { throw 'minimal menu test failed' }
+        go run . migrate -c config/settings.yml *> (Join-Path $root 'migrate-repeat.log')
+        if ($LASTEXITCODE -ne 0) { throw "repeat migration failed; evidence: $root" }
+    } finally {
+        Pop-Location
+    }
+    Write-Output 'BELL_140_MINIMAL_MENU fresh=true upgrade=true repeat=true admin_whitelist=true operator_default_menu=false'
+} finally {
+    if ($started) {
+        & (Join-Path $PostgresBin 'pg_ctl.exe') -D $data -m fast stop *> (Join-Path $root 'stop.log')
+    }
+    foreach ($name in @('BELL_DATABASE_URL', 'BELL_MINIMAL_MENU_TEST_DATABASE_URL', 'BELL_JWT_SECRET', 'BELL_BOOTSTRAP_USERNAME', 'BELL_BOOTSTRAP_PASSWORD', 'BELL_HOST', 'BELL_PORT')) {
+        Remove-Item "Env:$name" -ErrorAction SilentlyContinue
+    }
+}

Bell/server/tests/bell_production_login/production_login_test.go

@@ -0,0 +1,195 @@
+package bell_production_login_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/config/source/file"
+	"github.com/go-admin-team/go-admin-core/sdk"
+	sdkapi "github.com/go-admin-team/go-admin-core/sdk/api"
+	"github.com/go-admin-team/go-admin-core/sdk/config"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg/captcha"
+	"github.com/mojocn/base64Captcha"
+	"gorm.io/gorm"
+	gormlogger "gorm.io/gorm/logger"
+
+	adminrouter "go-admin/app/admin/router"
+	bellrouter "go-admin/app/bell/router"
+	"go-admin/common/bellconfig"
+	"go-admin/common/database"
+	"go-admin/common/middleware"
+	"go-admin/common/storage"
+	ext "go-admin/config"
+)
+
+type apiResponse struct {
+	Code  int             `json:"code"`
+	Data  json.RawMessage `json:"data"`
+	ID    string          `json:"id"`
+	Msg   string          `json:"msg"`
+	Token string          `json:"token"`
+}
+
+func TestProductionCaptchaLoginAndRouteBoundary(t *testing.T) {
+	if os.Getenv("BELL_PRODUCTION_LOGIN_TEST_DATABASE_URL") == "" {
+		t.Skip("production login database is not configured")
+	}
+	if err := os.MkdirAll("temp/logs", 0o700); err != nil {
+		t.Fatal(err)
+	}
+	gin.SetMode(gin.TestMode)
+	config.ExtendConfig = &ext.ExtConfig
+	config.Setup(file.NewSource(file.WithPath("../../config/settings.yml")))
+	if err := bellconfig.ApplyRequiredEnvironment(); err != nil {
+		t.Fatal(err)
+	}
+	if config.ApplicationConfig.Mode != "prod" {
+		t.Fatalf("expected production mode, got %q", config.ApplicationConfig.Mode)
+	}
+	database.Setup()
+	storage.Setup()
+
+	engine := gin.New()
+	sdk.Runtime.SetEngine(engine)
+	engine.Use(sdkapi.SetRequestLogger)
+	engine.Use(middleware.WithContextDb)
+	authMiddleware, err := middleware.AuthInit()
+	if err != nil {
+		t.Fatal(err)
+	}
+	adminrouter.InitSysRouter(engine, authMiddleware)
+	adminrouter.InitExamplesRouter(engine, authMiddleware)
+	bellrouter.InitRouter()
+
+	captchaResponse := requestJSON(t, engine, http.MethodGet, "/api/v1/captcha", nil, "")
+	if captchaResponse.Code != 200 || captchaResponse.ID == "" || !bytes.Contains(captchaResponse.Data, []byte("data:image/")) {
+		t.Fatalf("unexpected captcha response: code=%d id=%q data=%s", captchaResponse.Code, captchaResponse.ID, captchaResponse.Data)
+	}
+
+	username := os.Getenv("BELL_BOOTSTRAP_USERNAME")
+	password := os.Getenv("BELL_BOOTSTRAP_PASSWORD")
+	answer := "813907"
+	validID := "bell-138-valid"
+	if err := base64Captcha.DefaultMemStore.Set(validID, answer); err != nil {
+		t.Fatal(err)
+	}
+	if !captcha.Verify(validID, answer, false) {
+		t.Fatal("known captcha was not stored")
+	}
+	login := requestJSON(t, engine, http.MethodPost, "/api/v1/login", loginBody(username, password, validID, answer), "")
+	if login.Code != 200 || login.Token == "" {
+		t.Fatalf("valid captcha login failed: code=%d msg=%q", login.Code, login.Msg)
+	}
+	replay := requestJSON(t, engine, http.MethodPost, "/api/v1/login", loginBody(username, password, validID, answer), "")
+	if replay.Code == 200 {
+		t.Fatal("used captcha was accepted again")
+	}
+
+	wrongID := "bell-138-wrong"
+	if err := base64Captcha.DefaultMemStore.Set(wrongID, answer); err != nil {
+		t.Fatal(err)
+	}
+	wrong := requestJSON(t, engine, http.MethodPost, "/api/v1/login", loginBody(username, password, wrongID, "000000"), "")
+	if wrong.Code == 200 {
+		t.Fatal("incorrect captcha was accepted")
+	}
+	consumed := requestJSON(t, engine, http.MethodPost, "/api/v1/login", loginBody(username, password, wrongID, answer), "")
+	if consumed.Code == 200 {
+		t.Fatal("captcha used by a failed attempt was not consumed")
+	}
+
+	unauthenticated := requestJSON(t, engine, http.MethodGet, "/api/v1/bell/alerts", nil, "")
+	if unauthenticated.Code == 200 {
+		t.Fatal("unauthenticated Bell business API was accepted")
+	}
+	disabled := httptest.NewRecorder()
+	engine.ServeHTTP(disabled, httptest.NewRequest(http.MethodGet, "/api/v1/config", nil))
+	if disabled.Code != http.StatusNotFound {
+		t.Fatalf("disabled default route returned HTTP %d", disabled.Code)
+	}
+
+	assertSecretsAbsentFromAudit(t, password, answer, login.Token)
+	assertSecretsAbsentFromLogs(t, password, answer, login.Token)
+	if captcha.Verify(captchaResponse.ID, "deliberately-wrong", true) {
+		t.Fatal("generated captcha accepted a deliberately incorrect answer")
+	}
+}
+
+func loginBody(username, password, id, answer string) map[string]string {
+	return map[string]string{"username": username, "password": password, "uuid": id, "code": answer}
+}
+
+func requestJSON(t *testing.T, engine http.Handler, method, path string, body any, token string) apiResponse {
+	t.Helper()
+	var payload []byte
+	var err error
+	if body != nil {
+		payload, err = json.Marshal(body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	request := httptest.NewRequest(method, path, bytes.NewReader(payload))
+	request.Header.Set("Content-Type", "application/json")
+	if token != "" {
+		request.Header.Set("Authorization", "Bearer "+token)
+	}
+	recorder := httptest.NewRecorder()
+	engine.ServeHTTP(recorder, request)
+	var response apiResponse
+	if err = json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatalf("decode %s response (HTTP %d): %v: %s", path, recorder.Code, err, recorder.Body.String())
+	}
+	return response
+}
+
+func assertSecretsAbsentFromAudit(t *testing.T, secrets ...string) {
+	t.Helper()
+	db := sdk.Runtime.GetDbByKey("").Session(&gorm.Session{Logger: gormlogger.Default.LogMode(gormlogger.Silent)})
+	for _, table := range []string{"sys_login_log", "sys_opera_log"} {
+		for _, secret := range secrets {
+			var count int64
+			query := "SELECT count(*) FROM " + table + " WHERE row_to_json(" + table + ")::text LIKE ?"
+			if err := db.Raw(query, "%"+secret+"%").Scan(&count).Error; err != nil {
+				t.Fatal(err)
+			}
+			if count != 0 {
+				t.Fatalf("secret leaked into %s", table)
+			}
+		}
+	}
+}
+
+func assertSecretsAbsentFromLogs(t *testing.T, secrets ...string) {
+	t.Helper()
+	patterns := append([]string{"DriverDigitFunc answer:"}, secrets...)
+	err := filepath.WalkDir("temp", func(path string, entry fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		content, readErr := os.ReadFile(path)
+		if readErr != nil {
+			return readErr
+		}
+		for _, pattern := range patterns {
+			if pattern != "" && strings.Contains(string(content), pattern) {
+				t.Fatalf("sensitive value found in server log %s", path)
+			}
+		}
+		return nil
+	})
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+}

Bell/server/tests/bell_production_login/run-postgres.ps1

@@ -0,0 +1,83 @@
+[CmdletBinding()]
+param([string]$PostgresBin = 'D:\pgsql17\bin')
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+$started = $false
+$root = Join-Path ([IO.Path]::GetTempPath()) ('yovision-bell-138-' + [guid]::NewGuid().ToString('N'))
+$data = Join-Path $root 'postgres'
+$log = Join-Path $root 'postgres.log'
+$serverRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Get-FreePort {
+    $listener = [Net.Sockets.TcpListener]::new([Net.IPAddress]::Loopback, 0)
+    try {
+        $listener.Start()
+        return ([Net.IPEndPoint]$listener.LocalEndpoint).Port
+    } finally {
+        $listener.Stop()
+    }
+}
+
+function Wait-ForPort([int]$Port) {
+    for ($attempt = 0; $attempt -lt 120; $attempt++) {
+        try {
+            $client = [Net.Sockets.TcpClient]::new()
+            $connected = $client.ConnectAsync('127.0.0.1', $Port).Wait(250) -and $client.Connected
+            $client.Dispose()
+            if ($connected) {
+                return
+            }
+        } catch {
+        }
+        Start-Sleep -Milliseconds 250
+    }
+    throw 'PostgreSQL did not start'
+}
+
+New-Item -ItemType Directory -Path $root | Out-Null
+$port = Get-FreePort
+try {
+    foreach ($name in @('initdb.exe', 'pg_ctl.exe', 'createdb.exe')) {
+        if (-not (Test-Path -LiteralPath (Join-Path $PostgresBin $name))) {
+            throw "Missing $name"
+        }
+    }
+    & (Join-Path $PostgresBin 'initdb.exe') -D $data -U postgres -A trust --encoding=UTF8 --no-locale | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'initdb failed' }
+    $arguments = "-D `"$data`" -l `"$log`" -o `"-p $port -h 127.0.0.1`" start"
+    Start-Process (Join-Path $PostgresBin 'pg_ctl.exe') -ArgumentList $arguments -WindowStyle Hidden | Out-Null
+    Wait-ForPort $port
+    $started = $true
+    & (Join-Path $PostgresBin 'createdb.exe') -h 127.0.0.1 -p $port -U postgres bell_138
+    if ($LASTEXITCODE -ne 0) { throw 'createdb failed' }
+
+    $env:GOTOOLCHAIN = 'go1.26.5'
+    $env:BELL_DATABASE_URL = "host=127.0.0.1 port=$port user=postgres dbname=bell_138 sslmode=disable"
+    $env:BELL_PRODUCTION_LOGIN_TEST_DATABASE_URL = $env:BELL_DATABASE_URL
+    $env:BELL_JWT_SECRET = [guid]::NewGuid().ToString('N') + [guid]::NewGuid().ToString('N')
+    $env:BELL_BOOTSTRAP_USERNAME = 'bell_138_admin'
+    $env:BELL_BOOTSTRAP_PASSWORD = [guid]::NewGuid().ToString('N')
+    $env:BELL_HOST = '127.0.0.1'
+    $env:BELL_PORT = (Get-FreePort).ToString()
+
+    Remove-Item -LiteralPath (Join-Path $PSScriptRoot 'temp') -Recurse -Force -ErrorAction SilentlyContinue
+    Push-Location $serverRoot
+    try {
+        go run . migrate -c config/settings.yml *> (Join-Path $root 'migrate.log')
+        if ($LASTEXITCODE -ne 0) { throw "migration failed; evidence: $root" }
+        go test ./tests/bell_production_login -count=1 -v
+        if ($LASTEXITCODE -ne 0) { throw 'production login test failed' }
+    } finally {
+        Pop-Location
+    }
+    Write-Output 'BELL_138_PRODUCTION_LOGIN captcha=200 valid_login=200 wrong_rejected=true replay_rejected=true secrets_absent=true'
+} finally {
+    if ($started) {
+        & (Join-Path $PostgresBin 'pg_ctl.exe') -D $data -m fast stop *> (Join-Path $root 'stop.log')
+    }
+    foreach ($name in @('BELL_DATABASE_URL', 'BELL_PRODUCTION_LOGIN_TEST_DATABASE_URL', 'BELL_JWT_SECRET', 'BELL_BOOTSTRAP_USERNAME', 'BELL_BOOTSTRAP_PASSWORD', 'BELL_HOST', 'BELL_PORT')) {
+        Remove-Item "Env:$name" -ErrorAction SilentlyContinue
+    }
+    Remove-Item -LiteralPath (Join-Path $PSScriptRoot 'temp') -Recurse -Force -ErrorAction SilentlyContinue
+}

Bell/ui/src/layout/components/Sidebar/Logo.vue

@@ -15,7 +15,7 @@
 
 <script>
 
-import variables from '@/styles/variables.scss'
+import variables from '@/styles/variables.scss?module'
 import { mapGetters } from 'vuex'
 
 export default {

Bell/ui/src/layout/components/Sidebar/index.vue

@@ -29,7 +29,7 @@
 import { mapGetters } from 'vuex'
 import Logo from './Logo'
 import SidebarItem from './SidebarItem'
-import variables from '@/styles/variables.scss'
+import variables from '@/styles/variables.scss?module'
 
 export default {
   components: { SidebarItem, Logo },

Bell/ui/src/layout/index.vue

@@ -20,7 +20,7 @@ import RightPanel from '@/components/RightPanel'
 import { AppMain, Navbar, Settings, Sidebar, TagsView } from './components'
 import ResizeMixin from './mixin/ResizeHandler'
 import { mapState } from 'vuex'
-import variables from '@/styles/variables.scss'
+import variables from '@/styles/variables.scss?module'
 
 export default {
   name: 'MainLayout',

Bell/ui/src/store/modules/settings.js

@@ -1,4 +1,4 @@
-import variables from '@/styles/element-variables.scss'
+import variables from '@/styles/element-variables.scss?module'
 import defaultSettings from '@/settings'
 
 const { showSettings, topNav, tagsView, fixedHeader, sidebarLogo, themeStyle } = defaultSettings

Bell/ui/tests/unit/shell-startup/scss-module-imports.spec.js

@@ -0,0 +1,16 @@
+const fs = require('fs')
+const path = require('path')
+
+const valueImports = [
+  ['src/store/modules/settings.js', "@/styles/element-variables.scss?module"],
+  ['src/layout/index.vue', "@/styles/variables.scss?module"],
+  ['src/layout/components/Sidebar/Logo.vue', "@/styles/variables.scss?module"],
+  ['src/layout/components/Sidebar/index.vue', "@/styles/variables.scss?module"]
+]
+
+describe('GoAdmin shell Sass value imports', () => {
+  it.each(valueImports)('%s explicitly requests CSS Modules exports', (file, request) => {
+    const source = fs.readFileSync(path.join(__dirname, '../../..', file), 'utf8')
+    expect(source).toContain(`from '${request}'`)
+  })
+})