break
b3499adfca
Constraint: 切换 main 前必须保存当前七月分支全部项目进展，套餐生效提案仅属于 Iteration/7-11。 Rejected: 将七月套餐修复直接移植到 main | 两个分支的可靠投递架构不同。 Confidence: medium Scope-risk: broad Directive: 不得将本提交整体 cherry-pick 到 main；main 套餐热修必须基于其纯 Asynq 代码独立实施。 Tested: git diff --check；openspec validate fix-package-activation-starvation --strict。 Not-tested: 按用户要求未运行自动化测试；go build ./... 因当前审计改造中的 Enterprise 模型字面量和 role.recordFailure 参数类型错误未通过。
58 lines
1.8 KiB
Go
58 lines
1.8 KiB
Go
package audit
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/bytedance/sonic"
|
|
|
|
"github.com/break/junhong_cmp_fiber/pkg/constants"
|
|
)
|
|
|
|
// TestSecurityActionsRegistered 验证账号安全动作不会绕过注册表。
|
|
func TestSecurityActionsRegistered(t *testing.T) {
|
|
registry := NewRegistry()
|
|
for _, code := range []string{
|
|
constants.AuditActionAccountPasswordReset,
|
|
constants.AuditActionAccountPasswordChanged,
|
|
constants.AuditActionAccountWeComBound,
|
|
constants.AuditActionAuthLogin,
|
|
constants.AuditActionAuthLogout,
|
|
constants.AuditActionAuthTokenRefreshed,
|
|
} {
|
|
action, ok := registry.Action(code)
|
|
if !ok {
|
|
t.Fatalf("安全动作未注册：%s", code)
|
|
}
|
|
if action.PrimaryResource != constants.AuditResourceAccount || action.Category != constants.AuditCategorySecurity {
|
|
t.Fatalf("安全动作注册错误：%s", code)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestSecurityAuditRemovesCredentials 验证安全凭据不会进入审计 JSON。
|
|
func TestSecurityAuditRemovesCredentials(t *testing.T) {
|
|
encoded, err := safeObject(map[string]any{
|
|
"password": "secret",
|
|
"verification_code": "123456",
|
|
"access_token": "token",
|
|
"cookie": "session=value",
|
|
"credentials_configured": true,
|
|
"state": "changed",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("清理审计 JSON 失败：%v", err)
|
|
}
|
|
var value map[string]any
|
|
if err := sonic.Unmarshal(encoded, &value); err != nil {
|
|
t.Fatalf("解析审计 JSON 失败：%v", err)
|
|
}
|
|
for _, field := range []string{"password", "verification_code", "access_token", "cookie"} {
|
|
if _, exists := value[field]; exists {
|
|
t.Fatalf("安全凭据未删除：%s", field)
|
|
}
|
|
}
|
|
if value["credentials_configured"] != true || value["state"] != "changed" {
|
|
t.Fatalf("安全业务事实被错误删除：%v", value)
|
|
}
|
|
}
|