fix(acceptance): keep safe fleet metadata clear of sensitive report fields

2026-10-03 23:58:47 +08:00
parent 19e9913f30
commit 3f6083ff02
6 changed files with 37 additions and 5 deletions
@@ -210,7 +210,8 @@ test('missing persistence and failed pre-send checkpoints cannot send HTTP', asy
    assert.ok(blocked)
    assert.ok(!f.calls.some(row => row.method === blocked.method && row.path === blocked.path))
    if (target === 'multipart') {
-      assert.match(blocked.file.sha256, /^[a-f0-9]{64}$/); assert.ok(blocked.file.bytes > 0)
+      assert.match(blocked.file.sha256, /^[a-f0-9]{64}$/); assert.ok(blocked.file.sizeBytes > 0)
+      assert.equal(Object.hasOwn(blocked.file, 'bytes'), false)
      assert.equal(blocked.file.content, undefined)
    }
  }
@@ -38,7 +38,7 @@ function io(context, module, proof) {
  }
  async function request(method, path, body, label, { token, conflict, file } = {}) {
    const entry = { method, path, label, actor: token ? 'PDA' : 'PLATFORM', body: clone(body), status: 'SENDING' }
-    if (file) entry.file = { name: file.name, type: file.type, sha256: createHash('sha256').update(file.content).digest('hex'), bytes: file.content.length }
+    if (file) entry.file = { name: file.name, type: file.type, sha256: createHash('sha256').update(file.content).digest('hex'), sizeBytes: file.content.length }
    proof.requests.push(entry)
    // A failed write must stop before HTTP. Keep the durable SENDING record if the process dies in flight.
    await checkpoint(proof)
@@ -117,6 +117,9 @@ test('fresh return/redispatch chain proves A pending, B complete, then A complet
  assert.equal(result.afterRedispatch.departed.shippedPackages, 2)
  assert.ok(!JSON.stringify(f.checkpoints).includes('private-pda-token'))
  assert.ok(f.checkpoints.some(row => row.requests.at(-1)?.status === 'SENDING' && row.requests.at(-1)?.file?.sha256))
+  const uploads = f.trip.returnRedispatch.requests.filter(row => row.file)
+  assert.ok(uploads.length > 0)
+  assert.ok(uploads.every(row => Number.isSafeInteger(row.file.sizeBytes) && row.file.sizeBytes > 0 && !Object.hasOwn(row.file, 'bytes')))
 })

 for (const missing of [false, true]) test(`unapproved or missing pre-signature gate cannot sign or close new trip; missing=${missing}`, async () => {
@@ -51,7 +51,7 @@ export async function verifyFleetReturnRedispatch(context, module, trip, input,
  io.assert = (...args) => { context.assert(...args); if (!args[3]) throw Error(args[1]) }
  async function invoke(method, path, body, token, file, options) {
    const entry = { method, path, body: copy(body), actor: token ? 'PDA' : 'PLATFORM', status: 'SENDING' }
-    if (file) entry.file = { name: file.name, type: file.type, bytes: file.content.byteLength, sha256: createHash('sha256').update(file.content).digest('hex') }
+    if (file) entry.file = { name: file.name, type: file.type, sizeBytes: file.content.byteLength, sha256: createHash('sha256').update(file.content).digest('hex') }
    proof.requests.push(entry); await context.checkpoint()
    try {
      const response = file ? await context.requestMultipart(method, path, file) : await context.request(method, path, body, token, options)
@@ -573,18 +573,35 @@ export function fleetCostShares(trip, dispatchDetails) {
  return shares
 }

+export function fleetCostActorJournalData(value) {
+  const clean = redactEvidence(value)
+  function removeCredentials(item) {
+    if (Array.isArray(item)) return item.map(removeCredentials)
+    if (!item || typeof item !== 'object') return item
+    const result = {}, forbidden = /^(?:password|newPassword|temporaryPassword|accessToken|refreshToken|authorization)$/i
+    let removed = false
+    for (const [name, field] of Object.entries(item)) {
+      if (forbidden.test(name)) removed = true
+      else result[name] = removeCredentials(field)
+    }
+    if (removed) result.credentialFieldsRemoved = true
+    return result
+  }
+  return removeCredentials(clean)
+}
+
 export async function prepareFleetCostActors(context) {
  if (!context.marker || context.createdResources.fleetCostActors || typeof context.checkpoint !== 'function')
    throw Error('Cost actors require fresh current-run ownership and durable checkpoints')
  const proof = context.createdResources.fleetCostActors = { marker: context.marker, status: 'CREATING', actors: [], requests: [] }
  const base = '/api/platform/v1/iam', sessions = []
  async function request(method, path, body, token) {
-    const entry = { method, path, body: redactEvidence(body), status: 'SENDING' }
+    const entry = { method, path, body: fleetCostActorJournalData(body), status: 'SENDING' }
    proof.requests.push(entry); await context.checkpoint()
    try {
      const response = await context.request(method, path, body, token)
      Object.assign(entry, { status: 'RESPONDED', http: response?.http, code: response?.body?.code,
-        requestId: response?.requestId, traceId: response?.traceId, result: redactEvidence(response?.body?.data) })
+        requestId: response?.requestId, traceId: response?.traceId, result: fleetCostActorJournalData(response?.body?.data) })
      await context.checkpoint()
      if (!success(response) || !response.requestId || !response.traceId) throw Error(`Cost actor request failed: ${method} ${path}`)
      return response.body.data
@@ -519,6 +519,17 @@ test('missing isolated cost actor preparation rejects before readers or fixture
  assert.equal(touched, false)
 })

+test('cost actor journal removes credential keys while retaining IDs, roles and boolean removal evidence', async () => {
+  const { fleetCostActorJournalData } = await import('./fleet-test-env-acceptance.mjs')
+  const source = { membershipId: '12', roleIds: ['7'], password: 'actual-secret',
+    nested: { accessToken: 'actual-session', refreshToken: 'actual-refresh', status: 'ACTIVE' } }
+  const result = fleetCostActorJournalData(source)
+  assert.deepEqual(result, { membershipId: '12', roleIds: ['7'], credentialFieldsRemoved: true,
+    nested: { status: 'ACTIVE', credentialFieldsRemoved: true } })
+  assert.doesNotMatch(JSON.stringify(result), /"(?:password|accessToken|refreshToken)"\s*:/)
+  assert.equal(source.nested.accessToken, 'actual-session')
+})
+
 for (const failLogin of [false, true]) test(`cost actors create exact isolated roles and disable only owned accounts; login failure=${failLogin}`, async () => {
  const calls = [], saved = [], roles = [], users = []
  const context = { marker: 'RUN', token: 'admin-secret', createdResources: {}, async findAvailablePhone() { return '19900000000' },