This is an automated email from the ASF dual-hosted git repository. JackieTien97 pushed a commit to branch ty/itPrompt in repository https://gitbox.apache.org/repos/asf/iotdb.git
commit 756faf92f731dcc53481a939c405d5580e8f5968 Author: JackieTien97 <[email protected]> AuthorDate: Thu Oct 29 09:28:07 2026 +0800 Add credential strength baseline for test-created users in IT guidance --- integration-test/AGENTS.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/integration-test/AGENTS.md b/integration-test/AGENTS.md index 401dbf9b779..8a902cef63b 100644 --- a/integration-test/AGENTS.md +++ b/integration-test/AGENTS.md @@ -36,6 +36,15 @@ These instructions apply to `integration-test/` and supplement the repository-le while a manually constructed discovery client silently uses different ones. - Explicit credentials are appropriate for users created by the test and for authentication or invalid-password scenarios. Make that intent clear, and clean up users created by the test. +- When a test creates users or roles with explicit credentials, make each password 12-32 + characters long with no spaces, drawn from the supported credential charset (letters, + digits, `_ - ! @ # $ % ^ & * ( ) + =`), containing at least one lowercase letter, one + uppercase letter, one digit, and one special character, and different from the username; + usernames use the same charset and a 4-32 character length (for example `newuser` with + `IoTDB!Test2024`). Trivial placeholders such as `123456` or `password` pass on a default + local cluster yet are exactly what stricter password policies reject, and they encourage + weak secrets to spread into real configurations through copied test code. Reserve weak or + illegal credentials for scenarios that deliberately test them. - Obtain node addresses and allocated ports from the test environment or node wrappers. Configure required consensus protocols, replication factors, and other non-default settings before initializing the cluster.
