优化

2026-08-25 16:40:48 +08:00
parent 1f6f1a0677
commit 87c5e18ca6
93 changed files with 1154 additions and 527 deletions
@@ -0,0 +1,75 @@
+package com.baiyue.lastleg.security;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LastlegSecurityContractTest {
+    @Test void securityProjectionLivesInLastlegDatabaseWithReliableInbox() throws Exception {
+        String baseline = read("lastleg-service/src/main/resources/db/lastleg.sql");
+        String migration = read("deploy/sql/海外区域统一增量-MySQL8.sql");
+        String authSeed = read("auth/src/main/resources/db/phase1-admin-accounts.sql");
+        String service = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java");
+        String validation = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java");
+        String validationDto = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/dto/LastlegSecurityDtos.java");
+        String mirror = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionRedisMirror.java");
+        assertThat(baseline).contains("CREATE TABLE IF NOT EXISTS ll_security_event_inbox",
+                "PRIMARY KEY (event_id)", "payload_hash CHAR(64)",
+                "CREATE TABLE IF NOT EXISTS ll_security_projection",
+                "PRIMARY KEY (aggregate_type,aggregate_id)", "aggregate_version BIGINT",
+                "permission_version BIGINT");
+        for (String sql : new String[]{baseline, migration}) {
+            assertThat(sql).contains("('USER','1000001',0,'ACTIVE',0,0",
+                    "('AUTHORIZATION','1000001',0,NULL,0,0",
+                    "baseline-platform-admin-user-v0",
+                    "baseline-platform-admin-authorization-v0")
+                    .doesNotContain("baseline-merchant-admin");
+        }
+        assertThat(authSeed).contains("(1000001, 'platform_admin'", "default_tenant_id",
+                "default_app_code");
+        assertThat(migration).contains("USE baiyue_lastleg;", "table_schema='baiyue_lastleg'")
+                .doesNotContain("CREATE DATABASE IF NOT EXISTS baiyue_overseas_security",
+                        "USE baiyue_overseas_security;", "CREATE TABLE IF NOT EXISTS overseas_security_event_inbox",
+                        "CREATE TABLE IF NOT EXISTS overseas_security_projection");
+        assertThat(service).contains("SecurityProjectionMonotonicity.decide", "Decision.APPLY");
+        assertThat(service).contains("EventPayloadHash.matches", "validatedStorageHash")
+                .doesNotContain("LoadingCompletedConsumer");
+        assertThat(mirror).contains("TransactionPhase.AFTER_COMMIT", "Redis 镜像写入失败");
+        assertThat(validation).contains("SELECT MAX(permission_version)", "tenant_id=?",
+                "SECURITY_PROJECTION_MISSING", "SECURITY_PROJECTION_NOT_READY", "USER_DISABLED",
+                "TENANT_DISABLED", "PERMISSION_VERSION_STALE");
+        assertThat(validationDto).contains("Long userId", "Long tenantId", "Long permissionVersion")
+                .doesNotContain("Long tokenVersion");
+    }
+
+    @Test void genericLastlegEventEndpointWhitelistsBusinessEventsOnly() throws Exception {
+        String controller = read("lastleg-service/src/main/java/com/baiyue/lastleg/controller/LastlegOrderController.java");
+        assertThat(controller).contains("FIRST_LEG_CONTAINER_SHIPPING_NODE_RECORDED",
+                "FIRST_LEG_LOADING_PLAN_COMPLETED", "Lastleg 不消费该事件类型")
+                .doesNotContain("IAM_USER_STATUS_CHANGED", "IAM_TENANT_STATUS_CHANGED",
+                        "IAM_PERMISSION_VERSION_CHANGED");
+    }
+
+    @Test void internalControllerUsesLastlegOwnedPathsAndExistingTokenGuard() throws Exception {
+        String controller = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java");
+        String guard = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/InternalServiceTokenGuard.java");
+        String application = read("lastleg-service/src/main/resources/application.yml");
+        assertThat(controller).contains("@RequestMapping(\"/internal/lastleg/security/v1\")",
+                "@PostMapping(\"/events\")", "@PostMapping(\"/validate\")",
+                "com.baiyue.lastleg.security.InternalServiceTokenGuard")
+                .doesNotContain("/internal/overseas-security/v1");
+        assertThat(guard).contains("MessageDigest.isEqual", "SERVICE_UNAVAILABLE", "UNAUTHORIZED");
+        assertThat(application).contains("internal-service-token: ${INTERNAL_SERVICE_TOKEN:}")
+                .doesNotContain("phase1-local-internal-token");
+    }
+
+    private static String read(String relative) throws Exception {
+        Path path = Path.of(relative);
+        if (!Files.exists(path)) path = Path.of("..").resolve(relative);
+        return Files.readString(path, StandardCharsets.UTF_8);
+    }
+}