feat: improve operations diagnostics and channel management

api/src/send-chain/send-chain.service.spec.ts

@@ -983,19 +983,34 @@ describe('SendChainService', () => {
     expect(prisma.smsBatchTask.create).not.toHaveBeenCalled();
   });
 
-  it('returns the application enterprise code after Gateway authentication', async () => {
-    const { service } = createService();
+  it('returns the application enterprise code and audits the inbound parameters after Gateway authentication', async () => {
+    const { service, prisma } = createService();
 
     await expect(service.authenticateInboundApplication({
       account: '100001',
       password: 'secret-hash',
       remoteIp: '127.0.0.1',
+      version: 'cmpp30',
+      requestedVersion: 48,
     })).resolves.toEqual(expect.objectContaining({
       account: '100001',
       enterpriseCode: 'SP0001',
       maxConnections: 2,
       status: 'authenticated',
     }));
+    expect(prisma.operationLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        tenantId: 'tenant-1',
+        action: 'cmpp_connection.connect_requested',
+        resource: 'cmpp_downstream_connection',
+        resourceId: 'app-1',
+        ipAddress: '127.0.0.1',
+        detail: expect.objectContaining({
+          result: 'authenticated',
+          request: expect.objectContaining({ account: '100001', password: 'secret-hash', version: 'cmpp30', requestedVersion: 48 }),
+        }),
+      }),
+    });
   });
 
   it('rejects Gateway authentication when application interface is disabled', async () => {
@@ -1015,6 +1030,38 @@ describe('SendChainService', () => {
       password: 'secret-hash',
       remoteIp: '127.0.0.1',
     })).rejects.toThrow('CMPP interface is disabled for this application');
+    expect(prisma.operationLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        tenantId: 'tenant-1',
+        ipAddress: '127.0.0.1',
+        detail: expect.objectContaining({ result: 'failed', error: 'CMPP interface is disabled for this application' }),
+      }),
+    });
+  });
+
+  it('audits an unknown Gateway authentication account with its source IP', async () => {
+    const { service, prisma } = createService();
+    prisma.smsApplication.findFirst.mockResolvedValue(null);
+
+    await expect(service.authenticateInboundApplication({
+      account: 'ATTACKER',
+      authSource: 'invalid-auth-source',
+      timestamp: 120000000,
+      remoteIp: '203.0.113.9',
+      version: 'cmpp30',
+      requestedVersion: 48,
+    })).rejects.toThrow('CMPP account is invalid or disabled');
+    expect(prisma.operationLog.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        tenantId: undefined,
+        resourceId: 'ATTACKER',
+        ipAddress: '203.0.113.9',
+        detail: expect.objectContaining({
+          result: 'failed',
+          request: expect.objectContaining({ account: 'ATTACKER', authSource: 'invalid-auth-source' }),
+        }),
+      }),
+    });
   });
 
   it('rejects new submissions synchronously when the application interface was disabled after bind', async () => {
@@ -3308,6 +3355,8 @@ describe('SendChainService', () => {
       account: '100001',
       password: 'secret-hash',
       remoteIp: '127.0.0.1',
+      version: 'cmpp30',
+      requestedVersion: 48,
     })).resolves.toEqual(expect.objectContaining({ status: 'authenticated' }));
     await expect(service.submitInboundMessage({
       account: '100001',