SKYMirror
9686fe887a
Go 1.27.1 (Gin+GORM) + Vue 3 文件快传服务： - 安全审计全部修复（docs/security-audit-2026-09-05.md）： bcrypt 密码哈希与自动升级、presign 直传服务端大小/内容校验、 全局请求体上限、依赖升级（govulncheck 0 命中）、janitor 后台清理、 管理端审计动作落库、/admin CORS 收紧、通知内容白名单净化、 会话默认 7 天、限流缓存故障降级、robots.txt 端点等 - 前端：取件链接复制修复（不再重复拼接提取码）、markdown 净化器加固 - Redis 支持库号（FCB_REDIS_DB / redis://…/db URL） - 文档：docs/api/* 与 openapi.yaml 同步最新行为（robots.txt、 提码 5 位起、chunk 32MiB 上限、admin 审计动作等） 验证：gofmt/go vet/go test 全绿；二进制端到端冒烟通过
90 lines
2.3 KiB
Go
90 lines
2.3 KiB
Go
// audit_l5_test.go — L5 回归：admin 类动作（如登录失败）必须落审计。
|
||
package middleware
|
||
|
||
import (
|
||
"context"
|
||
"net/http"
|
||
"net/http/httptest"
|
||
"testing"
|
||
"time"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
"filecodebox/internal/audit"
|
||
"filecodebox/internal/model"
|
||
)
|
||
|
||
type captureSink struct {
|
||
logs []model.AuditLog
|
||
}
|
||
|
||
func (s *captureSink) Save(_ context.Context, logs []model.AuditLog) error {
|
||
s.logs = append(s.logs, logs...)
|
||
return nil
|
||
}
|
||
|
||
// TestAuditRecordsAdminActions L5：/admin/login 失败（401）后应产生一条
|
||
// result=denied 的 admin 审计记录（此前 skip 条件把 admin 动作整体跳过）。
|
||
func TestAuditRecordsAdminActions(t *testing.T) {
|
||
gin.SetMode(gin.TestMode)
|
||
sink := &captureSink{}
|
||
svc := audit.NewService(sink)
|
||
|
||
r := gin.New()
|
||
r.Use(Audit(svc, nil)) // DefaultClassifier
|
||
r.POST("/admin/login", func(c *gin.Context) {
|
||
c.JSON(http.StatusUnauthorized, gin.H{"code": 401})
|
||
})
|
||
r.POST("/share/text", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{"code": 200})
|
||
})
|
||
r.GET("/healthz", func(c *gin.Context) {
|
||
c.Status(http.StatusOK) // 未分类动作：不应产生审计
|
||
})
|
||
|
||
// 管理端：401 → denied
|
||
w := httptest.NewRecorder()
|
||
r.ServeHTTP(w, httptest.NewRequest("POST", "/admin/login", nil))
|
||
if w.Code != http.StatusUnauthorized {
|
||
t.Fatalf("login should 401, got %d", w.Code)
|
||
}
|
||
// 上传类：200 → success
|
||
w2 := httptest.NewRecorder()
|
||
r.ServeHTTP(w2, httptest.NewRequest("POST", "/share/text", nil))
|
||
// 未分类：不落库
|
||
w3 := httptest.NewRecorder()
|
||
r.ServeHTTP(w3, httptest.NewRequest("GET", "/healthz", nil))
|
||
|
||
// audit.Service 异步落库，轮询等待
|
||
var actions []string
|
||
for i := 0; i < 50; i++ {
|
||
if len(sink.logs) >= 2 {
|
||
break
|
||
}
|
||
waitMillis(20)
|
||
}
|
||
if len(sink.logs) != 2 {
|
||
t.Fatalf("应恰好 2 条审计记录, got %d", len(sink.logs))
|
||
}
|
||
for _, l := range sink.logs {
|
||
actions = append(actions, l.Action)
|
||
switch l.Action {
|
||
case audit.ActionAdmin:
|
||
if l.Result != model.AuditResultDenied {
|
||
t.Fatalf("admin 401 应记 denied, got %q", l.Result)
|
||
}
|
||
case audit.ActionUpload:
|
||
if l.Result != model.AuditResultSuccess {
|
||
t.Fatalf("upload 200 应记 success, got %q", l.Result)
|
||
}
|
||
default:
|
||
t.Fatalf("意外动作 %q", l.Action)
|
||
}
|
||
}
|
||
_ = actions
|
||
}
|
||
|
||
func waitMillis(ms int) {
|
||
time.Sleep(time.Duration(ms) * time.Millisecond)
|
||
}
|