SKYMirror
6f1a925833
- 数据库默认文件 filecodebox.db → fileshare.db（config.go 默认值与全部文档/编排同步）
- Go module filecodebox → fileshare（全部 import 同步，build/vet/test 全绿）
- 应用版本 APP_VERSION 2.5.6 → 26.9（health 接口已验证返回 26.9）
- deploy 编排统一：compose 项目名、Postgres 默认凭据、minio 桶名、env 注释
- JWT issuer、存储临时目录前缀、web 包名同步 fileshare
- CI：镜像 tag 以 APP_VERSION 为唯一版本源，main/tag 推送即发布
${VER} + latest；tag 触发时校验 tag 名与 APP_VERSION 一致，防错版
- 本地开发库文件已改名 fileshare.db（含 -shm/-wal 清理）
90 lines
2.3 KiB
Go
90 lines
2.3 KiB
Go
// audit_l5_test.go — L5 回归：admin 类动作（如登录失败）必须落审计。
|
||
package middleware
|
||
|
||
import (
|
||
"context"
|
||
"net/http"
|
||
"net/http/httptest"
|
||
"testing"
|
||
"time"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
"fileshare/internal/audit"
|
||
"fileshare/internal/model"
|
||
)
|
||
|
||
type captureSink struct {
|
||
logs []model.AuditLog
|
||
}
|
||
|
||
func (s *captureSink) Save(_ context.Context, logs []model.AuditLog) error {
|
||
s.logs = append(s.logs, logs...)
|
||
return nil
|
||
}
|
||
|
||
// TestAuditRecordsAdminActions L5：/admin/login 失败（401）后应产生一条
|
||
// result=denied 的 admin 审计记录（此前 skip 条件把 admin 动作整体跳过）。
|
||
func TestAuditRecordsAdminActions(t *testing.T) {
|
||
gin.SetMode(gin.TestMode)
|
||
sink := &captureSink{}
|
||
svc := audit.NewService(sink)
|
||
|
||
r := gin.New()
|
||
r.Use(Audit(svc, nil)) // DefaultClassifier
|
||
r.POST("/admin/login", func(c *gin.Context) {
|
||
c.JSON(http.StatusUnauthorized, gin.H{"code": 401})
|
||
})
|
||
r.POST("/share/text", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"code": 200})
|
||
})
|
||
r.GET("/healthz", func(c *gin.Context) {
|
||
c.Status(http.StatusOK) // 未分类动作：不应产生审计
|
||
})
|
||
|
||
// 管理端：401 → denied
|
||
w := httptest.NewRecorder()
|
||
r.ServeHTTP(w, httptest.NewRequest("POST", "/admin/login", nil))
|
||
if w.Code != http.StatusUnauthorized {
|
||
t.Fatalf("login should 401, got %d", w.Code)
|
||
}
|
||
// 上传类：200 → success
|
||
w2 := httptest.NewRecorder()
|
||
r.ServeHTTP(w2, httptest.NewRequest("POST", "/share/text", nil))
|
||
// 未分类：不落库
|
||
w3 := httptest.NewRecorder()
|
||
r.ServeHTTP(w3, httptest.NewRequest("GET", "/healthz", nil))
|
||
|
||
// audit.Service 异步落库，轮询等待
|
||
var actions []string
|
||
for i := 0; i < 50; i++ {
|
||
if len(sink.logs) >= 2 {
|
||
break
|
||
}
|
||
waitMillis(20)
|
||
}
|
||
if len(sink.logs) != 2 {
|
||
t.Fatalf("应恰好 2 条审计记录, got %d", len(sink.logs))
|
||
}
|
||
for _, l := range sink.logs {
|
||
actions = append(actions, l.Action)
|
||
switch l.Action {
|
||
case audit.ActionAdmin:
|
||
if l.Result != model.AuditResultDenied {
|
||
t.Fatalf("admin 401 应记 denied, got %q", l.Result)
|
||
}
|
||
case audit.ActionUpload:
|
||
if l.Result != model.AuditResultSuccess {
|
||
t.Fatalf("upload 200 应记 success, got %q", l.Result)
|
||
}
|
||
default:
|
||
t.Fatalf("意外动作 %q", l.Action)
|
||
}
|
||
}
|
||
_ = actions
|
||
}
|
||
|
||
func waitMillis(ms int) {
|
||
time.Sleep(time.Duration(ms) * time.Millisecond)
|
||
}
|