xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

test: run launch persona smoke with app session

Browse Source
This commit is contained in:
Codex
2026-07-01 08:28:17 +08:00
parent 9d1bb47041
commit cf1ae6026b
6 changed files with 101 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -607,7 +607,7 @@ $env:DATABASE_URL="postgresql://postgres:postgres@127.0.0.1:54322/postgres"
npm run smoke:launch-persona
```
`smoke:launch-persona` 会从普通学生、租户管理员、平台管理员三个视角调用真实 API，覆盖 SVIP 后刷题、收藏、错题复习入口、租户数据看板/主题/学生/销售转化、平台租户/套餐/审计入口和越权拒绝。它会写入少量 `launch_persona_smoke` 测试记录，生产只建议在灰度或演练租户运行。
`smoke:launch-persona` 会从普通学生、租户管理员、平台管理员三个视角调用真实 API，默认使用 `LAUNCH_SMOKE_AUTH_MODE=app_session` 的 Bearer `tk_` session，不依赖旧 `x-user-id` 或平台本地 key；覆盖 SVIP 后刷题、收藏、错题复习入口、租户数据看板/主题/学生/销售转化、平台租户/套餐/审计入口和越权拒绝。它会写入少量 `launch_persona_smoke` 测试记录，生产只建议在灰度或演练租户运行。
Taro H5 发布产物守卫：

7
docs/refactor/production-launch-evidence.template.json
View File

@@ -136,11 +136,12 @@
{
"id": "api.launch-persona-smoke",
"status": "pass",
"command": "npm run smoke:launch-persona > docs/refactor/launch-artifacts/launch-persona-smoke.log",
"command": "LAUNCH_SMOKE_AUTH_MODE=app_session npm run smoke:launch-persona > docs/refactor/launch-artifacts/launch-persona-smoke.log",
"completedAt": "2026-06-30T10:49:30+08:00",
"artifact": "launch-artifacts/launch-persona-smoke.json",
"summary": {
"status": "pass",
"authMode": "app_session",
"student": {
"status": "pass",
"result": {
@@ -163,8 +164,8 @@
"status": "pass",
"result": {
"guards": {
"studentDashboardDenied": "TENANT_MEMBER_REQUIRED",
"crossTenantDenied": "TENANT_MEMBER_REQUIRED"
"studentDashboardDenied": "TENANT_ADMIN_REQUIRED",
"crossTenantDenied": "AUTH_TENANT_MISMATCH"
}
}
},

2
docs/refactor/web-launch-acceptance-checklist.md
View File

@@ -90,7 +90,7 @@ node scripts/taro-h5-release-guardrails-test.js --require-dist
npm run smoke:launch-persona
```
`smoke:launch-persona` 是真实 API 角色旅程烟测，必须进入生产上线证据：普通学生要能在 SVIP 权益下创建练习、答题、收藏题目、进入收藏复习和错题复习入口；租户管理员要能读取看板/主题/学生/销售转化并拒绝学生或跨租户访问；平台管理员要能读取租户/套餐/审计入口并拒绝学生访问平台后台。
`smoke:launch-persona` 是真实 API 角色旅程烟测，必须进入生产上线证据；正式证据必须使用 `LAUNCH_SMOKE_AUTH_MODE=app_session`，通过 Bearer `tk_` session 验证身份，不使用旧 `x-user-id` 或平台本地 key。普通学生要能在 SVIP 权益下创建练习、答题、收藏题目、进入收藏复习和错题复习入口；租户管理员要能读取看板/主题/学生/销售转化并拒绝学生或跨租户访问；平台管理员要能读取租户/套餐/审计入口并拒绝学生访问平台后台。
`smoke:taro:h5` 会启动临时静态服务器和 mock API，验证三套 H5 的 `index.html`、JS/CSS 资源、history fallback、公开 runtime config 和 `/api/tenant/resolve` 契约。`smoke:taro:h5:interaction` 会在真实 Chrome/Edge 中点击学生、租户后台、平台后台关键路径，覆盖静态烟测发现不了的 JS 运行时、直接 history 路由刷新和 Taro 点击事件问题；当前脚本覆盖 32 项检查，包括学生首页、题库、答题、收藏、错题/收藏复习、背单词、知识手册、资料短签名和水印、视频播放授权、分数线、AI 择校、消息中心、会员收银台下单/支付参数/订单状态，租户后台内容导入、公共题库采纳/同步/冲突处理、学生运营、营销/CRM/分佣、主题/角色/成员写操作，以及平台后台租户、账务、公共题库授权和员工写操作。`taro-h5-release-guardrails-test` 会扫描源码、三套 H5 产物和 runtime-config 边界，防止旧 PocketBase、`x-user-id`、`x-platform-admin-key`、数据库连接串和服务端密钥形态进入前端发布目录。若刚构建完但未放入真实 `runtime-config.json`，脚本允许 warning；正式部署目录必须补齐。

84
scripts/launch-persona-smoke.js
View File

@@ -1,4 +1,5 @@
import assert from 'node:assert/strict';
import crypto from 'node:crypto';
import { spawn } from 'node:child_process';
import fs from 'node:fs/promises';
import net from 'node:net';
@@ -10,6 +11,8 @@ const databaseUrl = process.env.DATABASE_URL || DEFAULT_DATABASE_URL;
const outputDir = process.env.LAUNCH_SMOKE_OUTPUT_DIR || 'docs/refactor/launch-artifacts';
const startServer = boolEnv('LAUNCH_SMOKE_START_SERVER', !process.env.LAUNCH_SMOKE_API_BASE);
const fixedPort = Number(process.env.LAUNCH_SMOKE_API_PORT || 0) || 0;
const authMode = normalizeAuthMode(process.env.LAUNCH_SMOKE_AUTH_MODE || 'app_session');
const authSessionSecret = process.env.AUTH_SESSION_SECRET || 'development-session-secret-change-me';
const ids = {
tenant: '00000000-0000-0000-0000-000000000001',
@@ -24,6 +27,7 @@ const ids = {
let apiBase = process.env.LAUNCH_SMOKE_API_BASE || process.env.API_BASE || '';
let serverProcess = null;
let serverLogs = '';
let authTokens = {};
function boolEnv(key, fallback) {
const value = process.env[key];
@@ -31,6 +35,13 @@ function boolEnv(key, fallback) {
return ['1', 'true', 'yes', 'on'].includes(value.toLowerCase());
}
function normalizeAuthMode(value) {
const normalized = String(value || '').toLowerCase().replace(/[-_]/g, '');
if (normalized === 'legacy' || normalized === 'headers') return 'legacy';
if (normalized === 'appsession' || normalized === 'session' || normalized === 'tk') return 'app_session';
return 'app_session';
}
function nowIso() {
return new Date().toISOString();
}
@@ -92,6 +103,9 @@ async function startServerIfNeeded() {
...process.env,
PORT: String(port),
DATABASE_URL: databaseUrl,
AUTH_SESSION_SECRET: authSessionSecret,
ALLOW_LEGACY_AUTH_HEADERS: authMode === 'legacy' ? 'true' : 'false',
ALLOW_PLATFORM_ADMIN_KEY: authMode === 'legacy' ? 'true' : 'false',
MAX_JSON_BODY_BYTES: process.env.MAX_JSON_BODY_BYTES || '1048576',
MAX_IMPORT_JSON_BODY_BYTES: process.env.MAX_IMPORT_JSON_BODY_BYTES || '10485760',
},
@@ -120,12 +134,15 @@ function buildUrl(pathname, query = {}) {
}
async function request(pathname, options = {}) {
const token = authTokenFor(options.persona || 'student');
const useSession = authMode === 'app_session' && token;
const response = await fetch(buildUrl(pathname, options.query), {
method: options.method || 'GET',
headers: {
'content-type': 'application/json',
...(options.tenantId === false ? {} : { 'x-tenant-id': options.tenantId || ids.tenant }),
...(options.userId === false ? {} : { 'x-user-id': options.userId || ids.student }),
...(useSession ? { authorization: `Bearer ${token}` } : {}),
...(authMode === 'legacy' && options.userId !== false ? { 'x-user-id': options.userId || ids.student } : {}),
...(options.headers || {}),
},
body: options.body ? JSON.stringify(options.body) : undefined,
@@ -136,6 +153,55 @@ async function request(pathname, options = {}) {
return payload;
}
function createSessionToken() {
return `tk_${crypto.randomBytes(32).toString('base64url')}`;
}
function hashSessionToken(token) {
return crypto.createHmac('sha256', authSessionSecret).update(token).digest('hex');
}
function authTokenFor(persona) {
if (authMode !== 'app_session') return '';
return authTokens[persona] || authTokens.student || '';
}
async function createSmokeAuthSession(pool, persona, userId, tenantId = ids.tenant) {
if (authMode !== 'app_session') return '';
const token = createSessionToken();
await pool.query(
`
insert into app_private.auth_sessions (
tenant_id, user_id, token_hash, provider, expires_at, metadata
)
values (
$1, $2, $3, 'launch_persona_smoke',
now() + interval '2 hours',
$4::jsonb
)
`,
[
tenantId,
userId,
hashSessionToken(token),
JSON.stringify({ createdBy: 'launch-persona-smoke', persona, authMode }),
],
);
return token;
}
async function createSmokeAuthSessions(pool) {
if (authMode !== 'app_session') {
authTokens = {};
return;
}
authTokens = {
student: await createSmokeAuthSession(pool, 'student', ids.student, ids.tenant),
tenantAdmin: await createSmokeAuthSession(pool, 'tenantAdmin', ids.tenantAdmin, ids.tenant),
platformAdmin: await createSmokeAuthSession(pool, 'platformAdmin', ids.platformAdmin, ids.tenant),
};
}
async function one(pool, sql, params = []) {
const result = await pool.query(sql, params);
return result.rows[0] || null;
@@ -316,22 +382,26 @@ async function studentJourney(pool) {
}
async function tenantAdminJourney() {
const overview = await request('/api/tenant-admin/overview', { userId: ids.tenantAdmin });
const overview = await request('/api/tenant-admin/overview', { persona: 'tenantAdmin', userId: ids.tenantAdmin });
const dashboard = await request('/api/tenant-admin/dashboard', {
persona: 'tenantAdmin',
userId: ids.tenantAdmin,
query: { timeRange: '7d', regionId: ids.region },
});
const theme = await request('/api/tenant-admin/theme', { userId: ids.tenantAdmin });
const theme = await request('/api/tenant-admin/theme', { persona: 'tenantAdmin', userId: ids.tenantAdmin });
const students = await request('/api/tenant-admin/students', {
persona: 'tenantAdmin',
userId: ids.tenantAdmin,
query: { limit: 10 },
});
const conversion = await request('/api/referral/conversion-report', {
persona: 'tenantAdmin',
userId: ids.tenantAdmin,
query: { limit: 10 },
});
const studentDenied = await request('/api/tenant-admin/dashboard', { expectStatus: 403 });
const crossTenantDenied = await request('/api/tenant-admin/dashboard', {
persona: 'tenantAdmin',
tenantId: ids.partnerTenant,
userId: ids.tenantAdmin,
expectStatus: 403,
@@ -360,24 +430,28 @@ async function tenantAdminJourney() {
}
async function platformAdminJourney() {
const headers = { 'x-platform-admin-key': process.env.PLATFORM_ADMIN_API_KEY || 'local-platform-admin-key' };
const headers = authMode === 'legacy' ? { 'x-platform-admin-key': process.env.PLATFORM_ADMIN_API_KEY || 'local-platform-admin-key' } : {};
const overview = await request('/api/platform-admin/overview', {
persona: 'platformAdmin',
tenantId: false,
userId: false,
headers,
});
const tenants = await request('/api/platform-admin/tenants', {
persona: 'platformAdmin',
tenantId: false,
userId: false,
headers,
query: { limit: 10 },
});
const plans = await request('/api/platform-admin/plans', {
persona: 'platformAdmin',
tenantId: false,
userId: false,
headers,
});
const auditAlerts = await request('/api/platform-admin/audit-alerts', {
persona: 'platformAdmin',
tenantId: false,
userId: false,
headers,
@@ -450,12 +524,14 @@ async function runStep(name, fn) {
async function main() {
const pool = new pg.Pool({ connectionString: databaseUrl, max: 4 });
try {
await createSmokeAuthSessions(pool);
await startServerIfNeeded();
if (!apiBase) throw new Error('LAUNCH_SMOKE_API_BASE is required when LAUNCH_SMOKE_START_SERVER=false.');
const report = {
startedAt: nowIso(),
finishedAt: '',
apiBase,
authMode,
databaseUrl: databaseUrl.replace(/:\/\/([^:]+):([^@]+)@/, '://$1:[redacted]@'),
student: await runStep('student', () => studentJourney(pool)),
tenantAdmin: await runStep('tenant-admin', tenantAdminJourney),

12
scripts/production-launch-gate-test.js
View File

@@ -200,6 +200,18 @@ assert.ok(
'launch persona SVIP failure should be reported as a blocker',
);
const launchPersonaLegacyAuth = runGate(tempDir => {
const evidence = createEvidence(tempDir);
const item = evidence.checks.find(check => check.id === 'api.launch-persona-smoke');
item.summary.authMode = 'legacy';
return evidence;
});
assert.notEqual(launchPersonaLegacyAuth.status, 0, 'launch persona smoke with legacy auth should fail launch gate');
assert.ok(
launchPersonaLegacyAuth.payload.checks?.some(item => item.id === 'check.api.launch-persona-smoke.summary' && item.status === 'blocker'),
'launch persona legacy auth should be reported as a blocker',
);
const missingBusinessSampling = runGate(tempDir => {
const evidence = createEvidence(tempDir);
evidence.checks = evidence.checks.filter(item => item.id !== 'migration.pb-import-sample');

5
scripts/production-launch-gate.js
View File

@@ -102,6 +102,7 @@ const gateChecks = [
commandIncludes: 'smoke:launch-persona',
summary: {
status: 'pass',
authMode: 'app_session',
'student.status': 'pass',
'student.result.entitlement.isSvip': true,
'student.result.practice.questionCount': { gte: 1 },
@@ -109,8 +110,8 @@ const gateChecks = [
'student.result.favorite.reviewSessionId': { truthy: true },
'student.result.wrongReview.reviewPlanCount': { gte: 0 },
'tenantAdmin.status': 'pass',
'tenantAdmin.result.guards.studentDashboardDenied': { oneOf: ['TENANT_MEMBER_REQUIRED', 'TENANT_PERMISSION_DENIED', 'FORBIDDEN'] },
'tenantAdmin.result.guards.crossTenantDenied': { oneOf: ['TENANT_MEMBER_REQUIRED', 'TENANT_PERMISSION_DENIED', 'FORBIDDEN'] },
'tenantAdmin.result.guards.studentDashboardDenied': { oneOf: ['TENANT_ADMIN_REQUIRED', 'TENANT_MEMBER_REQUIRED', 'TENANT_PERMISSION_DENIED', 'FORBIDDEN'] },
'tenantAdmin.result.guards.crossTenantDenied': { oneOf: ['AUTH_TENANT_MISMATCH', 'TENANT_MEMBER_REQUIRED', 'TENANT_PERMISSION_DENIED', 'FORBIDDEN'] },
'platformAdmin.status': 'pass',
'platformAdmin.result.guards.studentPlatformDenied': { oneOf: ['PLATFORM_ADMIN_REQUIRED', 'FORBIDDEN'] },
},