feat(self-operated): expose private runtime configuration snapshots

2026-10-13 22:23:48 +08:00
parent 1d0b0918ba
commit 54f79b3902
11 changed files with 356 additions and 11 deletions
@@ -0,0 +1,57 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.CollectionMode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.*;
+import java.util.HexFormat;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class LingxingEgressRuntimeSnapshotTest {
+    private static final Instant NOW = Instant.parse("2026-10-13T14:00:00Z");
+    private final LingxingBudgetAuthority authority = mock(LingxingBudgetAuthority.class);
+    private LingxingEgressGate gate(CollectionMode mode, String account, String grant, URI uri) {
+        return new LingxingEgressGate(new LingxingEgressProperties(mode, "test", account, grant, null, uri,
+            mode == CollectionMode.VALIDATION ? Duration.ofSeconds(5) : Duration.ofMillis(1200), null, true),
+            authority, Clock.fixed(NOW, ZoneOffset.UTC), millis -> { throw new AssertionError("DIAGNOSTIC_MUST_NOT_WAIT"); });
+    }
+    private static String hash(String domain, String value) throws Exception {
+        return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
+            .digest(("selfop-runtime:v1:" + domain + "\n" + value).getBytes(StandardCharsets.UTF_8)));
+    }
+    @Test void sameGateReturnsActualBindingsWithDomainSeparatedExactRawFingerprints() throws Exception {
+        var snapshot = gate(CollectionMode.BUSINESS, "same-raw-value", "same-raw-value", URI.create("http://authority:9303")).runtimeSnapshot(true);
+        assertThat(snapshot.schemaVersion()).isEqualTo(1);assertThat(snapshot.service()).isEqualTo("integration");
+        assertThat(snapshot.observedAt()).isEqualTo(NOW);assertThat(snapshot.mode()).isEqualTo("BUSINESS");
+        assertThat(snapshot.environment()).isEqualTo("test");assertThat(snapshot.continuousEnabled()).isTrue();
+        assertThat(snapshot.providerEnabled()).isTrue();assertThat(snapshot.grantPresent()).isTrue();
+        assertThat(snapshot.intervalMs()).isEqualTo(1200);assertThat(snapshot.permitMaxSeconds()).isEqualTo(30);
+        assertThat(snapshot.sourceAccountFingerprint()).isEqualTo(hash("source-account", "same-raw-value"));
+        assertThat(snapshot.grantFingerprint()).isEqualTo(hash("grant", "same-raw-value")).isNotEqualTo(snapshot.sourceAccountFingerprint());
+        assertThat(snapshot.budgetAuthorityFingerprint()).isEqualTo(hash("budget-authority", "http://authority:9303"));
+        assertThat(gate(CollectionMode.BUSINESS, " raw ", " raw ", null).runtimeSnapshot(false).grantFingerprint())
+            .isEqualTo(hash("grant", " raw ")).isNotEqualTo(hash("grant", "raw"));
+        verifyNoInteractions(authority);
+    }
+    @Test void offAndValidationAreObservableAndAbsentOrBlankValuesAreNotHashed() {
+        for (String value : new String[] {null, "", "  "}) {
+            var s = gate(CollectionMode.OFF, value, value, null).runtimeSnapshot(false);
+            assertThat(s.mode()).isEqualTo("OFF");assertThat(s.sourceAccountFingerprint()).isNull();
+            assertThat(s.grantPresent()).isFalse();assertThat(s.grantFingerprint()).isNull();
+            assertThat(s.budgetAuthorityFingerprint()).isNull();assertThat(s.providerEnabled()).isFalse();
+        }
+        assertThat(gate(CollectionMode.VALIDATION, null, null, null).runtimeSnapshot(false).intervalMs()).isEqualTo(5000);
+        verifyNoInteractions(authority);
+    }
+    @Test void serializedSnapshotContainsNoRawIdentityAddressCredentialOrVerifiedClaim() throws Exception {
+        var raw = new ObjectMapper().findAndRegisterModules().writeValueAsString(
+            gate(CollectionMode.BUSINESS, "private-account", "private-grant", URI.create("http://private-host:9303")).runtimeSnapshot(true));
+        assertThat(raw).doesNotContain("private-account", "private-grant", "private-host", "http://", "verified", "appSecret", "internalServiceToken");
+        verifyNoInteractions(authority);
+    }
+}