chore: remediate CI blockers for production readiness

prisma/seed-b2b-accounts.ts

@@ -13,11 +13,29 @@ const pool = new pg.Pool({ connectionString: process.env['DATABASE_URL'] });
 const adapter = new PrismaPg(pool);
 const prisma = new PrismaClient({ adapter });
 
-const DEMO_PASSWORD = 'Velik@2026';
+function getRequiredEnv(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) {
+    throw new Error(`${name} must be set before running B2B seed`);
+  }
+  return value;
+}
 
-// Matches how RegisterUserHandler (HashedPassword.fromPlain) bcrypts, cost 12.
+function getBcryptRounds(): number {
+  const raw = process.env['BCRYPT_ROUNDS'] ?? '12';
+  const rounds = Number.parseInt(raw, 10);
+  if (!Number.isInteger(rounds) || rounds < 4) {
+    throw new Error('BCRYPT_ROUNDS must be an integer >= 4');
+  }
+  return rounds;
+}
+
+const SEED_DEFAULT_PASSWORD = getRequiredEnv('SEED_DEFAULT_PASSWORD');
+const BCRYPT_ROUNDS = getBcryptRounds();
+
+// Matches RegisterUserHandler hashing while allowing faster rounds in tests.
 async function hashPassword(raw: string): Promise<string> {
-  return bcrypt.hash(raw, 12);
+  return bcrypt.hash(raw, BCRYPT_ROUNDS);
 }
 
 function hash(value: string): string {
@@ -25,7 +43,7 @@ function hash(value: string): string {
 }
 
 async function main() {
-  const passwordHash = await hashPassword(DEMO_PASSWORD);
+  const passwordHash = await hashPassword(SEED_DEFAULT_PASSWORD);
 
   // ── 1. DEVELOPER: CĐT Vingroup ──
   const developerPhone = '+84912000001';
@@ -134,7 +152,7 @@ async function main() {
   console.log(`DEVELOPER: ${developer.fullName} (${developerPhone}) — linked ${vingroupRes.count} projects`);
   console.log(`DEVELOPER: ${devMaster.fullName} (${devMasterPhone}) — linked ${masterRes.count} projects`);
   console.log(`PARK_OPERATOR: ${parkOp.fullName} (${parkPhone}) — linked ${parkLinked} KCN(s)`);
-  console.log('Password for all: ' + DEMO_PASSWORD);
+  console.log('Password for all: configured via SEED_DEFAULT_PASSWORD');
 }
 
 main()