WTCLOSE2F 修正测试号收口远端执行口径

scripts/qa/run-wecom-test-account-final-closeout.sh

@@ -9,6 +9,63 @@ SUMMARY_TXT="$REPORT_DIR/summary.txt"
 STATUS=0
 FINDING_COUNT=0
 
+usage() {
+  cat <<'EOF'
+Usage:
+  bash scripts/qa/run-wecom-test-account-final-closeout.sh --remote
+  WTCLOSE2_EXECUTION_MODE=remote bash scripts/qa/run-wecom-test-account-final-closeout.sh
+
+WTCLOSE2 must run on the deployment server because Enterprise WeChat API access is
+restricted by trusted IP. Local execution is intentionally blocked unless
+WTCLOSE2_ALLOW_LOCAL_RUN=1 is set for script development only.
+EOF
+}
+
+run_remote() {
+  local deploy_server="${DEPLOY_SERVER:-deploy@118.89.77.218}"
+  local remote_dir="${REMOTE_DIR:-/opt/hyb-oa-trialrun}"
+  local remote_env_file="${REMOTE_ENV_FILE:-${remote_dir}/deploy/trialrun/.env}"
+  local compose_file="${COMPOSE_FILE:-deploy/trialrun/docker-compose.yml}"
+  local public_base_url="${LIVE_SMOKE_BASE_URL:-$PUBLIC_BASE_URL}"
+
+  ssh "$deploy_server" \
+    "REMOTE_DIR='${remote_dir}' REMOTE_ENV_FILE='${remote_env_file}' COMPOSE_FILE='${compose_file}' LIVE_SMOKE_BASE_URL='${public_base_url}' bash -s" <<'REMOTE'
+set -euo pipefail
+cd "$REMOTE_DIR"
+if docker compose version >/dev/null 2>&1; then
+  compose_cmd=(docker compose)
+else
+  compose_cmd=(docker-compose)
+fi
+"${compose_cmd[@]}" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE" exec -T server sh -lc \
+  "cd /app && LIVE_SMOKE_BASE_URL='$LIVE_SMOKE_BASE_URL' WTCLOSE2_EXECUTION_MODE=remote bash scripts/qa/run-wecom-test-account-final-closeout.sh"
+REMOTE
+}
+
+case "${1:-}" in
+  --remote)
+    run_remote
+    exit $?
+    ;;
+  --help|-h)
+    usage
+    exit 0
+    ;;
+  "")
+    ;;
+  *)
+    printf '[wtclose2][ERROR] unknown argument: %s\n' "$1" >&2
+    usage >&2
+    exit 2
+    ;;
+esac
+
+if [[ "${WTCLOSE2_EXECUTION_MODE:-}" != "remote" && "${WTCLOSE2_ALLOW_LOCAL_RUN:-0}" != "1" ]]; then
+  printf '[wtclose2][ERROR] Enterprise WeChat API checks must run on the deployment server trusted IP. Use --remote.\n' >&2
+  usage >&2
+  exit 2
+fi
+
 mkdir -p "$REPORT_DIR"
 : >"$SUMMARY_TXT"
 
@@ -151,7 +208,7 @@ run_wrule1() {
 }
 
 run_privacy_smoke() {
-  local sensitive_pattern='([A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)[[:space:]]*=[[:space:]]*["'\''"]?[A-Za-z0-9._:/+=-]{8,}["'\''"]?|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"[^"]*(token|secret|password|encodingAESKey|encoding_aes_key|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*"[[:space:]]*:[[:space:]]*"[^"]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
+  local sensitive_pattern='(["'\'']?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\'']?[[:space:]]*[:=][[:space:]]*["'\'']?[A-Za-z0-9._:/+=-]{8,}["'\'']?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"[^"]*(token|secret|password|encodingAESKey|encoding_aes_key|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*"[[:space:]]*:[[:space:]]*"[^"]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
   local safe_metadata_pattern='"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)([[:space:]]|["]|$)|"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)[^"]*(source|path|read paths|fallback)'
   local matches
   matches="$(grep -RInEi "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' | grep -vEi "$safe_metadata_pattern" || true)"
@@ -282,6 +339,8 @@ const summary = {
   conclusion: status,
   baseURL,
   commit,
+  executionMode: process.env.WTCLOSE2_EXECUTION_MODE || "unknown",
+  trustedIpBoundary: "Enterprise WeChat API checks must run on the deployment server; local runs are blocked by default",
   checkedAt: new Date().toISOString(),
   reportDir: path.resolve(reportDir),
   accounts: {