5.0 KiB
5.0 KiB
Remote Dashboard, Active Calls, and Audit Test Report
Date: 2026-06-29T05:51:04.581Z Base URL: https://100.90.90.91 Username: admin Low-Privilege Username: codex.low
| Result | Check | Detail |
|---|---|---|
| PASS | admin can login | status=200, duration=1046ms |
| PASS | admin login returns access token | tokenLength=296 |
| PASS | low-privilege user can login for RBAC checks | status=200, duration=675ms |
| PASS | dashboard summary can be queried | status=200, duration=539ms |
| PASS | dashboard summary shape and Shanghai day window are valid | {"window":{"start":"2026-06-28T16:00:00.000Z","end":"2026-06-29T05:50:47.137Z","timezone":"Asia/Shanghai"},"calls":{"totalCalls":1,"answeredCalls":1,"failedCalls":0,"answerRate":"1.0000","totalDurationSec":6},"money":{"customerFee":"0.012000","vendorCost":"0.012000","grossProfit":"0.000000"},"quality":{"pendingReviews":54}} |
| PASS | dashboard trends can be queried with fixed range | status=200, duration=408ms |
| PASS | dashboard trends return fixed contiguous buckets | bucketCount=2 |
| PASS | invalid dashboard trend bucket is rejected | status=400, duration=392ms |
| PASS | invalid trend bucket returns DASHBOARD_BUCKET_INVALID | code=DASHBOARD_BUCKET_INVALID |
| PASS | too-large dashboard trend range is rejected | status=400, duration=379ms |
| PASS | too-large trend range returns INTEGER_INVALID | code=INTEGER_INVALID |
| PASS | low dashboard-only user can query dashboard summary | status=200, duration=975ms |
| PASS | active calls can be listed | status=200, duration=840ms |
| PASS | active calls response shape is stable | {"total":0,"source":"opensips-mi"} |
| PASS | low dashboard-only user cannot list active calls | status=403, duration=379ms |
| PASS | invalid active call id is rejected (../x) | status=400, duration=410ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (../x) | code=ACTIVE_CALL_ID_INVALID |
| PASS | invalid active call id is rejected (;rm -rf) | status=400, duration=388ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (;rm -rf) | code=ACTIVE_CALL_ID_INVALID |
| PASS | invalid active call id is rejected (contains space) | status=400, duration=384ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (contains space) | code=ACTIVE_CALL_ID_INVALID |
| PASS | invalid active call id is rejected (line\nbreak) | status=400, duration=385ms |
| PASS | invalid active call id returns ACTIVE_CALL_ID_INVALID (line\nbreak) | code=ACTIVE_CALL_ID_INVALID |
| FAIL | invalid active call id is rejected (xxxxxxxxxxxxxxxxxxxx) | status=404, duration=377ms |
| FAIL | invalid active call id returns ACTIVE_CALL_ID_INVALID (xxxxxxxxxxxxxxxxxxxx) | code=undefined |
| PASS | low dashboard-only user cannot hang up calls | status=403, duration=380ms |
| PASS | audit logs can be listed | status=200, duration=756ms |
| PASS | audit list shape is valid | count=10, total=113 |
| PASS | low dashboard-only user cannot list audit logs | status=403, duration=404ms |
| PASS | invalid audit result filter is rejected | status=400, duration=380ms |
| PASS | invalid audit result returns AUDIT_RESULT_INVALID | code=AUDIT_RESULT_INVALID |
| PASS | audit logs can be filtered by result | status=200, duration=899ms |
| PASS | audit success filter only returns SUCCESS rows | count=5 |
| PASS | roles can be listed for temporary audit user setup | status=200, duration=758ms |
| PASS | dashboard-capable role is available | roleId=ROLE_TECH_OPS |
| PASS | temporary user with sensitive password can be created | status=201, expected=201, duration=776ms |
| PASS | created temporary user response does not expose password fields | {"id":"usr_ddd21fd564f6456a8c120dc940d4","username":"codex.audit.1782712243816"} |
| PASS | temporary user password reset succeeds | status=201, duration=580ms |
| PASS | password reset response does not expose sensitive fields | {"id":"usr_ddd21fd564f6456a8c120dc940d4","username":"codex.audit.1782712243816"} |
| PASS | password reset audit can be filtered by module/action/object/result | status=200, duration=437ms |
| PASS | password reset audit row exists | auditId=aud_09853278ea1a4d7b8ff64275a926f9ac |
| PASS | password reset audit detail can be fetched | status=200, duration=1000ms |
| FAIL | password reset audit detail redacts sensitive body fields | {"id":"aud_09853278ea1a4d7b8ff64275a926f9ac","redactedPassword":"[REDACTED]"} |
| PASS | temporary audit user cleanup is stable | status=200, expected=200/404, duration=1695ms |
Notes
- Password and token values are intentionally omitted from console and report details.
- DASH-001 aggregate accuracy and DASH-002 exact Shanghai day-boundary attribution still require SQL comparison against seeded boundary CDRs.
- ACT-001/ACT-002 real long-call normalization and successful hangup require an active OpenSIPS dialog on A; this black-box run verifies list contract, RBAC, and invalid dialog-id safety.
- AUD-002 application log full-text checks require host-side log access; this run verifies API response and audit detail redaction.