修复V4审计查询误匹配和脱敏
This commit is contained in:
andy
@@ -382,6 +382,18 @@ class ReservationV4QueryControllerTest {
|
||||
Instant.parse("2026-07-18T04:13:00Z"));
|
||||
insertV4OrderTaskAudit(otherOrderTask, "V4_CARD_CONFIRM", "v4-query-admin",
|
||||
Instant.parse("2026-07-18T04:14:00Z"));
|
||||
insertV4OrderTaskAuditRaw(
|
||||
otherOrderTask.orderId(),
|
||||
"V4_CARD_CONFIRM",
|
||||
"v4-query-admin",
|
||||
"容易误命中的 V4 订单任务审计。",
|
||||
"""
|
||||
{"v4_order_task_id":"%s","related_card_id":"%s","marker":"false-positive-order-task"}
|
||||
""".formatted(otherOrderTask.id(), orderTask.id()),
|
||||
"""
|
||||
{"v4_order_task_id":"%s","related_order_task_id":"%s","card_status":"CONFIRMED"}
|
||||
""".formatted(otherOrderTask.id(), orderTask.id()),
|
||||
Instant.parse("2026-07-18T04:15:00Z"));
|
||||
|
||||
performAuthorized(mockMvc, adminToken(), get("/api/reservation/order-tasks/{orderTaskId}/audits",
|
||||
orderTask.id()).param("hotel_id", HOTEL_ID))
|
||||
@@ -395,7 +407,14 @@ class ReservationV4QueryControllerTest {
|
||||
.andExpect(jsonPath("$.items[1].after_snapshot.v4_order_task_id").value(orderTask.id().toString()))
|
||||
.andExpect(jsonPath("$.items[0].occurred_at").value(matchesPattern(UTC_INSTANT_PATTERN)))
|
||||
.andExpect(content().string(not(containsString(otherOrderTask.id().toString()))))
|
||||
.andExpect(content().string(not(containsString("Sensitive raw audit body"))));
|
||||
.andExpect(content().string(not(containsString("false-positive-order-task"))))
|
||||
.andExpect(content().string(not(containsString("Sensitive raw audit body"))))
|
||||
.andExpect(content().string(not(containsString("https://oss.example.test"))))
|
||||
.andExpect(content().string(not(containsString("guest email text"))))
|
||||
.andExpect(content().string(not(containsString("sk-test-secret"))))
|
||||
.andExpect(content().string(not(containsString("Bearer sensitive-token"))))
|
||||
.andExpect(content().string(not(containsString("raw-ai-payload"))))
|
||||
.andExpect(content().string(containsString("visible audit note")));
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -406,6 +425,21 @@ class ReservationV4QueryControllerTest {
|
||||
Instant.parse("2026-07-18T04:20:00Z"));
|
||||
insertV4SourceNotificationAudit(notification, "v4-query-admin",
|
||||
Instant.parse("2026-07-18T04:21:00Z"));
|
||||
ReservationV4SourceNotificationSnapshot otherNotification = seedSourceNotification(
|
||||
"mail-v4-query-notification-audits-other-001",
|
||||
"S99",
|
||||
Instant.parse("2026-07-18T04:22:00Z"));
|
||||
insertV4SourceNotificationAuditRaw(
|
||||
otherNotification,
|
||||
"v4-query-admin",
|
||||
"容易误命中的 V4 来源通知审计。",
|
||||
"""
|
||||
{"v4_source_notification_id":"%s","related_notification_id":"%s","marker":"false-positive-notification"}
|
||||
""".formatted(otherNotification.id(), notification.id()),
|
||||
"""
|
||||
{"v4_source_notification_id":"%s","related_notification_id":"%s","notification_status":"ACKED"}
|
||||
""".formatted(otherNotification.id(), notification.id()),
|
||||
Instant.parse("2026-07-18T04:23:00Z"));
|
||||
|
||||
performAuthorized(mockMvc, adminToken(), get("/api/reservation/source-notifications/{notificationId}/audits",
|
||||
notification.id()).param("hotel_id", HOTEL_ID))
|
||||
@@ -417,6 +451,7 @@ class ReservationV4QueryControllerTest {
|
||||
.andExpect(jsonPath("$.items[0].after_snapshot.v4_source_notification_id")
|
||||
.value(notification.id().toString()))
|
||||
.andExpect(jsonPath("$.items[0].occurred_at").value(matchesPattern(UTC_INSTANT_PATTERN)))
|
||||
.andExpect(content().string(not(containsString("false-positive-notification"))))
|
||||
.andExpect(content().string(not(containsString("Sensitive raw audit body"))));
|
||||
}
|
||||
|
||||
@@ -745,21 +780,54 @@ class ReservationV4QueryControllerTest {
|
||||
String action,
|
||||
String actorId,
|
||||
Instant occurredAt) {
|
||||
insertV4OrderTaskAuditRaw(
|
||||
orderTask.orderId(),
|
||||
action,
|
||||
actorId,
|
||||
"前端查询 V4 审计测试。",
|
||||
"""
|
||||
{
|
||||
"v4_order_task_id":"%s",
|
||||
"card_status":"PENDING_CONFIRM",
|
||||
"raw":"Sensitive raw audit body",
|
||||
"attachment_url":"https://oss.example.test/private.pdf",
|
||||
"download_url":"https://oss.example.test/download/private.pdf",
|
||||
"signed_url":"https://oss.example.test/signed/private.pdf",
|
||||
"attachments":[{"name":"invoice.pdf","url":"https://oss.example.test/attachment/private.pdf"}],
|
||||
"plain_text":"guest email text",
|
||||
"email_text":"guest email text",
|
||||
"api_key":"sk-test-secret",
|
||||
"cookie":"SESSION=secret-cookie",
|
||||
"authorization":"Bearer sensitive-token",
|
||||
"ai_payload":{"payload":"raw-ai-payload"},
|
||||
"safe_note":"visible audit note"
|
||||
}
|
||||
""".formatted(orderTask.id()),
|
||||
"""
|
||||
{"v4_order_task_id":"%s","card_status":"CONFIRMED","field_pointers":["/basic_information/account_code"]}
|
||||
""".formatted(orderTask.id()),
|
||||
occurredAt);
|
||||
}
|
||||
|
||||
private void insertV4OrderTaskAuditRaw(
|
||||
Long orderId,
|
||||
String action,
|
||||
String actorId,
|
||||
String summary,
|
||||
String beforeSnapshotJson,
|
||||
String afterSnapshotJson,
|
||||
Instant occurredAt) {
|
||||
aiWorkflowRepository.insertAuditLog(new ReservationAuditLogDraft(
|
||||
HOTEL_ID,
|
||||
orderTask.orderId(),
|
||||
orderId,
|
||||
null,
|
||||
null,
|
||||
"USER",
|
||||
actorId,
|
||||
action,
|
||||
"前端查询 V4 审计测试。",
|
||||
"""
|
||||
{"v4_order_task_id":"%s","card_status":"PENDING_CONFIRM","raw":"Sensitive raw audit body"}
|
||||
""".formatted(orderTask.id()),
|
||||
"""
|
||||
{"v4_order_task_id":"%s","card_status":"CONFIRMED","field_pointers":["/basic_information/account_code"]}
|
||||
""".formatted(orderTask.id()),
|
||||
summary,
|
||||
beforeSnapshotJson,
|
||||
afterSnapshotJson,
|
||||
LocalDateTime.ofInstant(occurredAt, ZoneOffset.UTC)));
|
||||
}
|
||||
|
||||
@@ -767,6 +835,26 @@ class ReservationV4QueryControllerTest {
|
||||
ReservationV4SourceNotificationSnapshot notification,
|
||||
String actorId,
|
||||
Instant occurredAt) {
|
||||
insertV4SourceNotificationAuditRaw(
|
||||
notification,
|
||||
actorId,
|
||||
"确认已处理。",
|
||||
"""
|
||||
{"v4_source_notification_id":"%s","notification_status":"ACK_REQUIRED","raw":"Sensitive raw audit body"}
|
||||
""".formatted(notification.id()),
|
||||
"""
|
||||
{"v4_source_notification_id":"%s","notification_status":"ACKED"}
|
||||
""".formatted(notification.id()),
|
||||
occurredAt);
|
||||
}
|
||||
|
||||
private void insertV4SourceNotificationAuditRaw(
|
||||
ReservationV4SourceNotificationSnapshot notification,
|
||||
String actorId,
|
||||
String summary,
|
||||
String beforeSnapshotJson,
|
||||
String afterSnapshotJson,
|
||||
Instant occurredAt) {
|
||||
aiWorkflowRepository.insertAuditLog(new ReservationAuditLogDraft(
|
||||
HOTEL_ID,
|
||||
null,
|
||||
@@ -775,13 +863,9 @@ class ReservationV4QueryControllerTest {
|
||||
"USER",
|
||||
actorId,
|
||||
"V4_SOURCE_NOTIFICATION_ACK",
|
||||
"确认已处理。",
|
||||
"""
|
||||
{"v4_source_notification_id":"%s","notification_status":"ACK_REQUIRED","raw":"Sensitive raw audit body"}
|
||||
""".formatted(notification.id()),
|
||||
"""
|
||||
{"v4_source_notification_id":"%s","notification_status":"ACKED"}
|
||||
""".formatted(notification.id()),
|
||||
summary,
|
||||
beforeSnapshotJson,
|
||||
afterSnapshotJson,
|
||||
LocalDateTime.ofInstant(occurredAt, ZoneOffset.UTC)));
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user