247 lines
10 KiB
JavaScript
247 lines
10 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { createRequire } from 'node:module';
|
|
import { createHmac, createHash, randomUUID } from 'node:crypto';
|
|
import { request } from 'node:http';
|
|
import fs from 'node:fs';
|
|
const require = createRequire(new URL('../../api/package.json', import.meta.url));
|
|
const dbUrl = new URL(process.env.SIGNATURE_TEST_DATABASE_URL || '');
|
|
const redisUrl = new URL(process.env.SIGNATURE_TEST_REDIS_URL || '');
|
|
assert(['127.0.0.1', 'localhost'].includes(dbUrl.hostname) && dbUrl.pathname.startsWith('/cmpp_qa_'));
|
|
assert(['127.0.0.1', 'localhost'].includes(redisUrl.hostname) && Number(redisUrl.port) > 10000);
|
|
process.env.DATABASE_URL = dbUrl.toString();
|
|
process.env.REDIS_URL = redisUrl.toString();
|
|
process.env.NODE_ENV = 'test';
|
|
process.env.HTTP_API_MASTER_KEY = randomUUID();
|
|
require('reflect-metadata');
|
|
const { Module } = require('@nestjs/common');
|
|
const { NestFactory } = require('@nestjs/core');
|
|
const { PrismaService } = require('./dist/prisma/prisma.service');
|
|
const { OpenApiService } = require('./dist/open-api/open-api.service');
|
|
const { OpenApiAuthGuard } = require('./dist/open-api/open-api-auth.guard');
|
|
const { OpenApiController } = require('./dist/open-api/open-api.controller');
|
|
const { OpenApiDocsController } = require('./dist/open-api/open-api-docs.controller');
|
|
const { OpenApiTraceInterceptor } = require('./dist/open-api/open-api-trace.interceptor');
|
|
const { SecurityDetectionService } = require('./dist/security-detection/security-detection.service');
|
|
const { encryptSecret } = require('./dist/open-api/open-api.crypto');
|
|
const { configureHttpBodyParsers } = require('./dist/http-body-limits');
|
|
const db = new PrismaService();
|
|
const service = new OpenApiService(db, undefined);
|
|
const checks = [];
|
|
let app;
|
|
const ok = (name) => {
|
|
checks.push(name);
|
|
console.log('PASS', name);
|
|
};
|
|
try {
|
|
assert.equal(await db.smsMessageRecord.count(), 0, 'Dedicated empty QA database required');
|
|
const tenant = await db.tenant.create({ data: { name: '签名隔离验收', code: randomUUID() } });
|
|
const createApp = () =>
|
|
db.smsApplication.create({
|
|
data: {
|
|
tenantId: tenant.id,
|
|
name: '签名隔离应用',
|
|
cmppAccount: randomUUID(),
|
|
cmppEnterpriseCode: '000001',
|
|
secretHash: 'not-login',
|
|
interfaceEnabled: false,
|
|
httpConfig: { create: { enabled: true, sendEnabled: true, qpsLimit: 100 } },
|
|
},
|
|
});
|
|
const own = await createApp();
|
|
const other = await createApp();
|
|
const secret = randomUUID();
|
|
const accessKey = randomUUID();
|
|
const credential = await db.httpApiCredential.create({
|
|
data: {
|
|
applicationId: own.id,
|
|
name: '签名测试',
|
|
accessKey,
|
|
secretEncrypted: encryptSecret(secret),
|
|
secretLast4: secret.slice(-4),
|
|
},
|
|
});
|
|
const channel = await db.smsChannel.create({
|
|
data: {
|
|
name: '隔离占位',
|
|
code: randomUUID(),
|
|
gatewayHost: '127.0.0.1',
|
|
gatewayPort: 1,
|
|
account: 'none',
|
|
passwordCipher: 'none',
|
|
srcId: 'none',
|
|
status: 'disabled',
|
|
carriers: ['mobile'],
|
|
},
|
|
});
|
|
const uplink = await db.smsUplinkMessage.create({
|
|
data: {
|
|
tenantId: tenant.id,
|
|
applicationId: own.id,
|
|
channelId: channel.id,
|
|
phoneNumber: '13800138000',
|
|
destId: '10690000',
|
|
content: '签名验收',
|
|
receivedAt: new Date(),
|
|
matchStatus: 'matched',
|
|
},
|
|
});
|
|
const foreign = await db.smsUplinkMessage.create({
|
|
data: {
|
|
tenantId: tenant.id,
|
|
applicationId: other.id,
|
|
channelId: channel.id,
|
|
phoneNumber: '13800138000',
|
|
destId: '10690000',
|
|
content: '其他应用',
|
|
receivedAt: new Date(),
|
|
matchStatus: 'matched',
|
|
},
|
|
});
|
|
class Harness {}
|
|
Module({
|
|
controllers: [OpenApiController, OpenApiDocsController],
|
|
providers: [
|
|
{ provide: PrismaService, useValue: db },
|
|
{ provide: OpenApiService, useValue: service },
|
|
{ provide: SecurityDetectionService, useValue: { recordEvent: async () => {} } },
|
|
OpenApiAuthGuard,
|
|
OpenApiTraceInterceptor,
|
|
],
|
|
})(Harness);
|
|
app = await NestFactory.create(Harness, { logger: false, rawBody: true, bodyParser: false });
|
|
app.setGlobalPrefix('api');
|
|
configureHttpBodyParsers(app);
|
|
await app.listen(16426, '127.0.0.1');
|
|
const invoke = async (path, options = {}) => {
|
|
const method = options.method || 'GET';
|
|
const timestamp = options.timestamp || String(Math.floor(Date.now() / 1000));
|
|
const nonce = options.nonce || randomUUID();
|
|
const body = options.body;
|
|
const fields = [method, path.split('?')[0], timestamp, nonce];
|
|
let bytes = Buffer.from(fields.join(options.separator || '\n'));
|
|
if (options.legacy)
|
|
bytes = Buffer.from(
|
|
[
|
|
...fields,
|
|
createHash('sha256')
|
|
.update(body || '{}')
|
|
.digest('hex'),
|
|
].join('\n'),
|
|
);
|
|
else if (method === 'POST')
|
|
bytes = Buffer.concat([bytes, Buffer.from('\n'), Buffer.from(options.signedBody ?? body ?? '')]);
|
|
else if (options.trailing) bytes = Buffer.concat([bytes, Buffer.from('\n')]);
|
|
const signature = createHmac('sha256', secret).update(bytes).digest('hex');
|
|
const headers = {
|
|
'X-App-Key': options.key || accessKey,
|
|
'X-Timestamp': timestamp,
|
|
'X-Nonce': nonce,
|
|
'X-Signature': signature,
|
|
...options.headers,
|
|
};
|
|
if (body !== undefined) {
|
|
headers['Content-Type'] = 'application/json';
|
|
headers['Content-Length'] = String(Buffer.byteLength(body));
|
|
}
|
|
return new Promise((resolve, reject) => {
|
|
const req = request('http://127.0.0.1:16426' + path, { method, headers, timeout: 10000 }, (res) => {
|
|
let data = '';
|
|
res.on('data', (x) => (data += x));
|
|
res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(data) }));
|
|
});
|
|
req.on('error', reject);
|
|
req.on('timeout', () => req.destroy(new Error('timeout')));
|
|
req.end(body);
|
|
});
|
|
};
|
|
const list = '/api/openapi/v1/sms/uplinks';
|
|
let r = await invoke(list);
|
|
assert.equal(r.status, 200);
|
|
assert.deepEqual(
|
|
r.body.items.map((x) => x.id),
|
|
[uplink.id],
|
|
);
|
|
ok('new GET authenticates and queries actual PostgreSQL with app isolation');
|
|
r = await invoke(list + '/' + uplink.id);
|
|
assert.equal(r.body.content, uplink.content);
|
|
assert(!('channelId' in r.body));
|
|
ok('detail matches database and hides channel fields');
|
|
assert.equal((await invoke(list + '/' + foreign.id)).status, 404);
|
|
ok('foreign application detail excluded');
|
|
for (const options of [{ legacy: true }, { trailing: true }, { separator: '\r\n' }, { separator: '\\n' }]) {
|
|
r = await invoke(list, options);
|
|
assert.equal(r.status, 401);
|
|
assert.equal(r.body.code, 'SIGNATURE_INVALID');
|
|
}
|
|
ok('legacy GET, trailing LF, CRLF and literal escape rejected');
|
|
const nonce = randomUUID();
|
|
assert.equal((await invoke(list, { nonce })).status, 200);
|
|
assert.equal((await invoke(list, { nonce })).body.code, 'NONCE_REPLAYED');
|
|
ok('real Redis atomic nonce replay rejection');
|
|
assert.equal((await invoke(list, { timestamp: '100' })).body.code, 'TIMESTAMP_EXPIRED');
|
|
ok('expired timestamp rejected');
|
|
assert.equal((await invoke(list, { key: 'unknown' })).body.code, 'CREDENTIAL_INVALID');
|
|
ok('unknown credential rejected');
|
|
assert.equal((await invoke(list + '?limit=1.5')).body.code, 'LIMIT_INVALID');
|
|
ok('signed invalid query reaches parameter validation');
|
|
assert.equal((await invoke(list, { body: '{}' })).status, 400);
|
|
ok('nonempty GET body rejected');
|
|
const post = '/api/openapi/v1/sms/messages';
|
|
const raw = '{ "mobile": "invalid", "content": "中文测试" }';
|
|
r = await invoke(post, { method: 'POST', body: raw });
|
|
assert.equal(r.body.code, 'PARAMETER_INVALID');
|
|
ok('new POST original UTF8 body authenticates before safe validation rejection');
|
|
for (const options of [
|
|
{ legacy: true },
|
|
{ signedBody: raw.trim() + '\n' },
|
|
{ signedBody: JSON.stringify(JSON.parse(raw)) },
|
|
]) {
|
|
r = await invoke(post, { method: 'POST', body: raw, ...options });
|
|
assert.equal(r.body.code, 'SIGNATURE_INVALID');
|
|
}
|
|
ok('legacy POST, changed whitespace and trailing newline rejected');
|
|
r = await invoke(post, { method: 'POST' });
|
|
assert.equal(r.status, 400);
|
|
ok('missing raw POST body rejected');
|
|
// Stored uncertain request proves internal idempotency remains; never create an SMS.
|
|
const valid = '{"mobile":"13800138000","content":"仅幂等核验"}',
|
|
idem = 'qa-' + randomUUID();
|
|
await db.openApiRequest.create({
|
|
data: {
|
|
applicationId: own.id,
|
|
tenantId: tenant.id,
|
|
requestId: randomUUID(),
|
|
idempotencyKey: idem,
|
|
credentialId: credential.id,
|
|
bodyHash: createHash('sha256').update(valid).digest('hex'),
|
|
status: 'requires_review',
|
|
},
|
|
});
|
|
r = await invoke(post, { method: 'POST', body: valid, headers: { 'Idempotency-Key': idem } });
|
|
assert.equal(r.body.code, 'REQUEST_REQUIRES_REVIEW');
|
|
r = await invoke(post, { method: 'POST', body: valid + ' ', headers: { 'Idempotency-Key': idem } });
|
|
assert.equal(r.body.code, 'IDEMPOTENCY_CONFLICT');
|
|
ok('existing idempotency fingerprint preserved without requeue');
|
|
const last = await db.httpApiCredential.findUnique({ where: { id: credential.id } });
|
|
assert(last.lastUsedAt);
|
|
ok('actual credential usage persisted');
|
|
assert.equal(await db.smsMessageRecord.count(), 0);
|
|
assert.equal(await db.smsBatchTask.count(), 0);
|
|
ok('zero SMS records or batches created');
|
|
const md = await (await fetch('http://127.0.0.1:16426/api/client-docs?format=md')).text();
|
|
assert.equal(md, fs.readFileSync(new URL('../../docs/client-http-api-guide.md', import.meta.url), 'utf8'));
|
|
ok('actual docs download equals authoritative guide');
|
|
if (process.env.SIGNATURE_TEST_KEEP_OPEN === '1') {
|
|
console.log('READY_BROWSER');
|
|
await new Promise((resolve) => {
|
|
process.on('SIGINT', resolve);
|
|
process.on('SIGTERM', resolve);
|
|
});
|
|
}
|
|
} finally {
|
|
if (process.env.SIGNATURE_TEST_REPORT)
|
|
fs.writeFileSync(process.env.SIGNATURE_TEST_REPORT, JSON.stringify({ checks }, null, 2));
|
|
await app?.close();
|
|
await db.$disconnect();
|
|
}
|