Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,273 @@
+import 'reflect-metadata';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { signAccessToken, type PermissionKey } from '@lisglosips/auth';
+import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from '../audit/audit.repository.js';
+import { IDENTITY_REPOSITORY, type IdentityRepository } from '../security/identity.repository.js';
+import type { CurrentUser } from '../security/security.metadata.js';
+import {
+  CUSTOMER_GATEWAYS_REPOSITORY,
+  type CreateCustomerGatewayInput,
+  type CustomerGatewayStatus,
+  type CustomerGatewaySummary,
+  type CustomerGatewaysRepository,
+  type UpdateCustomerGatewayInput
+} from './customer-gateways.repository.js';
+
+class MemoryIdentityRepository implements IdentityRepository {
+  users = new Map<string, CurrentUser>();
+
+  async findCurrentUserById(userId: string): Promise<CurrentUser | null> {
+    return this.users.get(userId) ?? null;
+  }
+}
+
+class MemoryAuditRepository implements AuditRepository {
+  entries: AuditEntryInput[] = [];
+
+  async write(input: AuditEntryInput): Promise<void> {
+    this.entries.push(input);
+  }
+}
+
+class MemoryCustomerGatewaysRepository implements CustomerGatewaysRepository {
+  private readonly gateways = new Map<string, CustomerGatewaySummary>();
+
+  constructor() {
+    this.gateways.set(
+      'cgw_seed',
+      this.summary({
+        id: 'cgw_seed',
+        customerId: 'cus_seed',
+        name: 'Seed IP Gateway',
+        authMode: 'IP',
+        sourceIp: '100.93.185.30',
+        hasSipCredential: false,
+        policyCount: 1
+      })
+    );
+  }
+
+  async list(customerId?: string): Promise<CustomerGatewaySummary[]> {
+    return [...this.gateways.values()].filter((gateway) => !customerId || gateway.customerId === customerId);
+  }
+
+  async get(gatewayId: string): Promise<CustomerGatewaySummary> {
+    return this.gateways.get(gatewayId) ?? this.summary({ id: gatewayId, name: 'Missing Gateway' });
+  }
+
+  async create(input: CreateCustomerGatewayInput): Promise<CustomerGatewaySummary> {
+    const gateway = this.summary({
+      id: 'cgw_created',
+      customerId: input.customerId,
+      name: input.name,
+      authMode: input.authMode,
+      sourceIp: input.sourceIp ?? null,
+      sipUsername: input.sipUsername ?? null,
+      sipDomain: input.sipDomain ?? null,
+      hasSipCredential: Boolean(input.sipHa1)
+    });
+    this.gateways.set(gateway.id, gateway);
+    return gateway;
+  }
+
+  async update(gatewayId: string, input: UpdateCustomerGatewayInput): Promise<CustomerGatewaySummary> {
+    const current = await this.get(gatewayId);
+    const updated: CustomerGatewaySummary = {
+      ...current,
+      customerId: input.customerId ?? current.customerId,
+      name: input.name ?? current.name,
+      authMode: input.authMode ?? current.authMode,
+      sourceIp: input.sourceIp === undefined ? current.sourceIp : input.sourceIp,
+      sipUsername: input.sipUsername === undefined ? current.sipUsername : input.sipUsername,
+      sipDomain: input.sipDomain === undefined ? current.sipDomain : input.sipDomain,
+      hasSipCredential: input.sipHa1 === undefined ? current.hasSipCredential : Boolean(input.sipHa1),
+      updatedAt: new Date('2026-06-21T03:00:00.000Z')
+    };
+    this.gateways.set(gatewayId, updated);
+    return updated;
+  }
+
+  async setStatus(gatewayId: string, status: CustomerGatewayStatus): Promise<CustomerGatewaySummary> {
+    const current = await this.get(gatewayId);
+    const updated = { ...current, status };
+    this.gateways.set(gatewayId, updated);
+    return updated;
+  }
+
+  private summary(input: {
+    id: string;
+    customerId?: string;
+    name: string;
+    authMode?: 'IP' | 'SIP_DIGEST' | 'MIXED';
+    sourceIp?: string | null;
+    sipUsername?: string | null;
+    sipDomain?: string | null;
+    hasSipCredential?: boolean;
+    status?: CustomerGatewayStatus;
+    policyCount?: number;
+  }): CustomerGatewaySummary {
+    return {
+      id: input.id,
+      customerId: input.customerId ?? 'cus_seed',
+      customerName: 'Seed Customer',
+      name: input.name,
+      authMode: input.authMode ?? 'IP',
+      sourceIp: input.sourceIp ?? null,
+      sipUsername: input.sipUsername ?? null,
+      sipDomain: input.sipDomain ?? null,
+      hasSipCredential: input.hasSipCredential ?? false,
+      status: input.status ?? 'ENABLED',
+      policyCount: input.policyCount ?? 0,
+      createdAt: new Date('2026-06-21T02:30:00.000Z'),
+      updatedAt: new Date('2026-06-21T02:30:00.000Z')
+    };
+  }
+}
+
+describe('S13 customer gateways API', () => {
+  let app: NestFastifyApplication;
+  let audit: MemoryAuditRepository;
+
+  const tokenFor = (userId: string) =>
+    signAccessToken(
+      {
+        sub: userId,
+        username: userId,
+        roles: ['test'],
+        typ: 'access'
+      },
+      {
+        secret: 'test-only-access-token-secret-min-32-bytes',
+        issuer: 'lisglosips-api',
+        audience: 'lisglosips-web',
+        ttlSeconds: 900
+      }
+    );
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = 'mysql://lisglosips_app@127.0.0.1:3306/lisglosips';
+    process.env.REDIS_URL = 'redis://127.0.0.1:6379/0';
+    process.env.LISGLOSIPS_LOG_LEVEL = 'silent';
+    process.env.AUTH_ACCESS_TOKEN_SECRET = 'test-only-access-token-secret-min-32-bytes';
+
+    const identities = new MemoryIdentityRepository();
+    audit = new MemoryAuditRepository();
+
+    identities.users.set('usr_ops', {
+      id: 'usr_ops',
+      username: 'ops',
+      roles: ['运营管理员'],
+      permissions: ['customer_gateways.view', 'customer_gateways.manage'] as PermissionKey[]
+    });
+    identities.users.set('usr_viewer', {
+      id: 'usr_viewer',
+      username: 'viewer',
+      roles: ['只读'],
+      permissions: ['customer_gateways.view'] as PermissionKey[]
+    });
+
+    const { AppModule } = await import('../app.module.js');
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule]
+    })
+      .overrideProvider(IDENTITY_REPOSITORY)
+      .useValue(identities)
+      .overrideProvider(AUDIT_REPOSITORY)
+      .useValue(audit)
+      .overrideProvider(CUSTOMER_GATEWAYS_REPOSITORY)
+      .useValue(new MemoryCustomerGatewaysRepository())
+      .compile();
+
+    app = moduleFixture.createNestApplication<NestFastifyApplication>(new FastifyAdapter({ logger: false }));
+    app.setGlobalPrefix('api/v2');
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+  });
+
+  it('lists gateways without exposing SIP secrets', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/v2/customer-gateways?customerId=cus_seed')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .expect(200);
+
+    expect(response.body[0]).toMatchObject({
+      id: 'cgw_seed',
+      authMode: 'IP',
+      sourceIp: '100.93.185.30',
+      policyCount: 1
+    });
+    expect(JSON.stringify(response.body)).not.toContain('sipPassword');
+    expect(JSON.stringify(response.body)).not.toContain('sipHa1');
+  });
+
+  it('rejects writes without customer_gateways.manage', async () => {
+    await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_viewer')}`)
+      .send({ customerId: 'cus_seed', name: 'Denied', authMode: 'IP', sourceIp: '100.93.185.31' })
+      .expect(403);
+  });
+
+  it('creates SIP digest gateway, hides the password, and writes audit', async () => {
+    const response = await request(app.getHttpServer())
+      .post('/api/v2/customer-gateways')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({
+        customerId: 'cus_seed',
+        name: 'SIP Digest Gateway',
+        authMode: 'SIP_DIGEST',
+        sipUsername: 'alice-gw',
+        sipDomain: 'SIP.EXAMPLE.LOCAL',
+        sipPassword: 'change-me-very-strong'
+      })
+      .expect(201);
+
+    expect(response.body).toMatchObject({
+      id: 'cgw_created',
+      authMode: 'SIP_DIGEST',
+      sipUsername: 'alice-gw',
+      sipDomain: 'sip.example.local',
+      sourceIp: null,
+      hasSipCredential: true
+    });
+    expect(response.body.sipPassword).toBeUndefined();
+    expect(response.body.sipHa1).toBeUndefined();
+    expect(audit.entries.some((entry) => entry.module === 'customer_gateways' && entry.action === 'create' && entry.result === 'SUCCESS')).toBe(true);
+    expect(JSON.stringify(audit.entries)).not.toContain('change-me-very-strong');
+  });
+
+  it('requires a new SIP password when SIP identity changes', async () => {
+    await request(app.getHttpServer())
+      .patch('/api/v2/customer-gateways/cgw_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ sipDomain: 'new.example.local' })
+      .expect(400);
+  });
+
+  it('switches to IP auth and supports enable/disable', async () => {
+    await request(app.getHttpServer())
+      .patch('/api/v2/customer-gateways/cgw_created')
+      .set('Authorization', `Bearer ${tokenFor('usr_ops')}`)
+      .send({ authMode: 'IP', sourceIp: '100.93.185.32' })
+      .expect(200)
+      .expect((response) => {
+        expect(response.body).toMatchObject({
+          authMode: 'IP',
+          sourceIp: '100.93.185.32',
+          sipUsername: null,
+          sipDomain: null,
+          hasSipCredential: false
+        });
+      });
+
+    await request(app.getHttpServer()).post('/api/v2/customer-gateways/cgw_created/disable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+    await request(app.getHttpServer()).post('/api/v2/customer-gateways/cgw_created/enable').set('Authorization', `Bearer ${tokenFor('usr_ops')}`).expect(201);
+  });
+});