shaw
0ddd58aaf9
应对管理员访问凭证失守导致的数据外泄风险，新增三层防护： 审计日志（admin-only 可见，用户不可见） - 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理 - 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类 请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取） - 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url 保留以便追责）；非 JSON body 不入库 - 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许， 清空后同步写入留痕记录 会话 IP/UA 绑定（默认开启，可在系统设置关闭） - JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求 重新登录；旧 token 无指纹时放行以平滑升级 敏感操作 step-up 2FA（sudo 窗口 15 分钟） - 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试 - API key 查看按需求暂不加强管控 前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、 step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n
94 lines
2.5 KiB
Go
94 lines
2.5 KiB
Go
package main
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/Wei-Shaw/sub2api/internal/handler"
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestProvideServiceBuildInfo(t *testing.T) {
|
|
in := handler.BuildInfo{
|
|
Version: "v-test",
|
|
BuildType: "release",
|
|
}
|
|
out := provideServiceBuildInfo(in)
|
|
require.Equal(t, in.Version, out.Version)
|
|
require.Equal(t, in.BuildType, out.BuildType)
|
|
}
|
|
|
|
func TestProvideCleanup_WithMinimalDependencies_NoPanic(t *testing.T) {
|
|
cfg := &config.Config{}
|
|
|
|
oauthSvc := service.NewOAuthService(nil, nil)
|
|
openAIOAuthSvc := service.NewOpenAIOAuthService(nil, nil)
|
|
geminiOAuthSvc := service.NewGeminiOAuthService(nil, nil, nil, nil, cfg)
|
|
antigravityOAuthSvc := service.NewAntigravityOAuthService(nil)
|
|
|
|
tokenRefreshSvc := service.NewTokenRefreshService(
|
|
nil,
|
|
oauthSvc,
|
|
openAIOAuthSvc,
|
|
geminiOAuthSvc,
|
|
antigravityOAuthSvc,
|
|
nil,
|
|
nil,
|
|
cfg,
|
|
nil,
|
|
)
|
|
accountExpirySvc := service.NewAccountExpiryService(nil, time.Second)
|
|
proxyExpirySvc := service.NewProxyExpiryService(nil, time.Second)
|
|
subscriptionExpirySvc := service.NewSubscriptionExpiryService(nil, time.Second)
|
|
pricingSvc := service.NewPricingService(cfg, nil)
|
|
emailQueueSvc := service.NewEmailQueueService(nil, 1)
|
|
billingCacheSvc := service.NewBillingCacheService(nil, nil, nil, nil, nil, nil, cfg, nil)
|
|
idempotencyCleanupSvc := service.NewIdempotencyCleanupService(nil, cfg)
|
|
schedulerSnapshotSvc := service.NewSchedulerSnapshotService(nil, nil, nil, nil, cfg)
|
|
opsSystemLogSinkSvc := service.NewOpsSystemLogSink(nil)
|
|
|
|
cleanup := provideCleanup(
|
|
nil, // entClient
|
|
nil, // redis
|
|
&service.OpsMetricsCollector{},
|
|
&service.OpsAggregationService{},
|
|
&service.OpsAlertEvaluatorService{},
|
|
&service.OpsCleanupService{},
|
|
&service.OpsScheduledReportService{},
|
|
opsSystemLogSinkSvc,
|
|
schedulerSnapshotSvc,
|
|
tokenRefreshSvc,
|
|
accountExpirySvc,
|
|
proxyExpirySvc,
|
|
subscriptionExpirySvc,
|
|
&service.UsageCleanupService{},
|
|
idempotencyCleanupSvc,
|
|
&service.BatchImageCleanupService{},
|
|
nil, // batchImageWorker
|
|
pricingSvc,
|
|
emailQueueSvc,
|
|
billingCacheSvc,
|
|
&service.UsageRecordWorkerPool{},
|
|
&service.SubscriptionService{},
|
|
oauthSvc,
|
|
openAIOAuthSvc,
|
|
geminiOAuthSvc,
|
|
antigravityOAuthSvc,
|
|
nil, // grokOAuth
|
|
nil, // openAIGateway
|
|
nil, // scheduledTestRunner
|
|
nil, // backupSvc
|
|
nil, // paymentOrderExpiry
|
|
nil, // channelMonitorRunner
|
|
nil, // quotaFlusher
|
|
nil, // upstreamBillingProbe
|
|
nil, // auditLog
|
|
)
|
|
|
|
require.NotPanics(t, func() {
|
|
cleanup()
|
|
})
|
|
}
|