WTCLOSE2 收口测试号最终证据
这个提交包含在：
@@ -0,0 +1,351 @@
|
||||
#!/usr/bin/env bash
|
||||
set -u -o pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
SERVER_DIR="$ROOT_DIR/server"
|
||||
PUBLIC_BASE_URL="${LIVE_SMOKE_BASE_URL:-https://oa.hyinda.com}"
|
||||
REPORT_DIR="${WTCLOSE2_REPORT_DIR:-$ROOT_DIR/artifacts/qa-flow/wecom-test-account-final-closeout-$(date +%Y%m%d-%H%M%S)}"
|
||||
SUMMARY_TXT="$REPORT_DIR/summary.txt"
|
||||
STATUS=0
|
||||
FINDING_COUNT=0
|
||||
|
||||
mkdir -p "$REPORT_DIR"
|
||||
: >"$SUMMARY_TXT"
|
||||
|
||||
log() {
|
||||
printf '%s\n' "$*" | tee -a "$SUMMARY_TXT"
|
||||
}
|
||||
|
||||
run_step() {
|
||||
local name="$1"
|
||||
shift
|
||||
local log_file="$REPORT_DIR/${name}.log"
|
||||
|
||||
log ">>> [wtclose2] $name"
|
||||
if "$@" > >(tee "$log_file") 2>&1; then
|
||||
log "[wtclose2][PASS] $name"
|
||||
else
|
||||
local code="$?"
|
||||
log "[wtclose2][FAIL] $name exit=$code"
|
||||
STATUS=1
|
||||
fi
|
||||
}
|
||||
|
||||
run_finding_step() {
|
||||
local name="$1"
|
||||
shift
|
||||
local log_file="$REPORT_DIR/${name}.log"
|
||||
|
||||
log ">>> [wtclose2] $name"
|
||||
if "$@" > >(tee "$log_file") 2>&1; then
|
||||
log "[wtclose2][PASS] $name"
|
||||
else
|
||||
local code="$?"
|
||||
log "[wtclose2][FINDING] $name exit=$code"
|
||||
FINDING_COUNT=$((FINDING_COUNT + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
run_server_finding_step() {
|
||||
local name="$1"
|
||||
shift
|
||||
local log_file="$REPORT_DIR/${name}.log"
|
||||
|
||||
log ">>> [wtclose2] $name"
|
||||
if (cd "$SERVER_DIR" && "$@") > >(tee "$log_file") 2>&1; then
|
||||
log "[wtclose2][PASS] $name"
|
||||
else
|
||||
local code="$?"
|
||||
log "[wtclose2][FINDING] $name exit=$code"
|
||||
FINDING_COUNT=$((FINDING_COUNT + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
run_ready() {
|
||||
run_step "public-ready" curl -fsS "$PUBLIC_BASE_URL/ready"
|
||||
}
|
||||
|
||||
write_day_report_index() {
|
||||
node - "$ROOT_DIR" "$REPORT_DIR" <<'NODE' || true
|
||||
const fs = require("node:fs");
|
||||
const path = require("node:path");
|
||||
const [rootDir, reportDir] = process.argv.slice(2);
|
||||
const qaRoot = path.join(rootDir, "artifacts/qa-flow");
|
||||
|
||||
function readJson(file) {
|
||||
try {
|
||||
return JSON.parse(fs.readFileSync(file, "utf8"));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function collect(prefix) {
|
||||
let dirs = [];
|
||||
try {
|
||||
dirs = fs.readdirSync(qaRoot, { withFileTypes: true })
|
||||
.filter((entry) => entry.isDirectory() && entry.name.startsWith(prefix))
|
||||
.map((entry) => path.join(qaRoot, entry.name, "summary.json"))
|
||||
.filter((file) => fs.existsSync(file))
|
||||
.sort()
|
||||
.slice(-8);
|
||||
} catch {}
|
||||
return dirs.map((file) => {
|
||||
const json = readJson(file);
|
||||
return {
|
||||
status: json?.status || json?.conclusion || "UNKNOWN",
|
||||
conclusion: json?.conclusion || null,
|
||||
checkedAt: json?.checkedAt || json?.generatedAt || null,
|
||||
reportPath: path.resolve(file),
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
const index = {
|
||||
issueId: "WTCLOSE2",
|
||||
generatedAt: new Date().toISOString(),
|
||||
wroad2Reports: collect("wroad2-ops-"),
|
||||
warch3Reports: collect("warch3-ops-"),
|
||||
wauto1Reports: collect("wecom-controlled-trial-evidence-"),
|
||||
wfullsmokeReports: collect("three-day-full-goal-smoke-"),
|
||||
wext1DryRunReports: collect("wecom-approval-fixtures-"),
|
||||
wrule1Reports: collect("wecom-approval-rule-validator-"),
|
||||
};
|
||||
fs.writeFileSync(path.join(reportDir, "day-report-index.json"), `${JSON.stringify(index, null, 2)}\n`, "utf8");
|
||||
NODE
|
||||
}
|
||||
|
||||
run_wauto1() {
|
||||
run_finding_step "wauto1-evidence" env \
|
||||
WAUTO1_REPORT_DIR="$REPORT_DIR/wecom-controlled-trial-evidence" \
|
||||
LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
|
||||
bash "$ROOT_DIR/scripts/qa/collect-wecom-controlled-trial-evidence.sh"
|
||||
}
|
||||
|
||||
run_wfullsmoke1() {
|
||||
run_finding_step "wfullsmoke1-no-public-writes" env \
|
||||
WFULLSMOKE_REPORT_DIR="$REPORT_DIR/three-day-full-goal-smoke" \
|
||||
WFULLSMOKE_ALLOW_PUBLIC_WRITES=0 \
|
||||
LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
|
||||
bash "$ROOT_DIR/scripts/qa/run-three-day-full-goal-smoke.sh"
|
||||
}
|
||||
|
||||
run_wext1ld_dryrun() {
|
||||
run_server_finding_step "outing-overtime-dryrun" npm run check:wecom-approval-fixtures -- \
|
||||
--format=json \
|
||||
--target=outing \
|
||||
--target=overtime \
|
||||
--report-dir="$REPORT_DIR/wecom-approval-fixtures-dryrun"
|
||||
}
|
||||
|
||||
run_wrule1() {
|
||||
run_server_finding_step "approval-rule-validator" npm run check:wecom-approval-rule-validator -- \
|
||||
--format=json \
|
||||
--template=leave \
|
||||
--template=missed_punch \
|
||||
--template=outing \
|
||||
--template=overtime \
|
||||
--manual-gate=all:A \
|
||||
--limit=50 \
|
||||
--report-dir="$REPORT_DIR/wecom-approval-rule-validator"
|
||||
}
|
||||
|
||||
run_privacy_smoke() {
|
||||
local sensitive_pattern='([A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)[[:space:]]*=[[:space:]]*["'\''"]?[A-Za-z0-9._:/+=-]{8,}["'\''"]?|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"[^"]*(token|secret|password|encodingAESKey|encoding_aes_key|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*"[[:space:]]*:[[:space:]]*"[^"]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
|
||||
local safe_metadata_pattern='"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)([[:space:]]|["]|$)|"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)[^"]*(source|path|read paths|fallback)'
|
||||
local matches
|
||||
matches="$(grep -RInEi "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' | grep -vEi "$safe_metadata_pattern" || true)"
|
||||
if [[ -n "$matches" ]]; then
|
||||
printf '%s\n' "$matches"
|
||||
log "[wtclose2][FAIL] report-privacy-smoke matched sensitive pattern"
|
||||
STATUS=1
|
||||
else
|
||||
log "[wtclose2][PASS] report-privacy-smoke"
|
||||
fi
|
||||
}
|
||||
|
||||
write_summary_json() {
|
||||
node - "$ROOT_DIR" "$REPORT_DIR" "$PUBLIC_BASE_URL" "$STATUS" "$FINDING_COUNT" <<'NODE' || return 1
|
||||
const fs = require("node:fs");
|
||||
const path = require("node:path");
|
||||
const { execSync } = require("node:child_process");
|
||||
|
||||
const [rootDir, reportDir, baseURL, statusInput, findingCountInput] = process.argv.slice(2);
|
||||
|
||||
function readJson(file) {
|
||||
if (!file || !fs.existsSync(file)) return null;
|
||||
try {
|
||||
return JSON.parse(fs.readFileSync(file, "utf8"));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function child(relativePath) {
|
||||
const file = path.join(reportDir, relativePath, "summary.json");
|
||||
const json = readJson(file);
|
||||
return {
|
||||
status: json?.status || json?.conclusion || "MISSING",
|
||||
conclusion: json?.conclusion || null,
|
||||
reportPath: fs.existsSync(file) ? path.resolve(file) : null,
|
||||
findingCount: Number(json?.findingCount || 0),
|
||||
};
|
||||
}
|
||||
|
||||
function safeStatus(value) {
|
||||
return String(value || "UNKNOWN").slice(0, 80);
|
||||
}
|
||||
|
||||
function isBlocked(value) {
|
||||
return /SKIP|BLOCKED|FAIL|ERROR/i.test(value);
|
||||
}
|
||||
|
||||
function isFinding(value) {
|
||||
return /FINDING/i.test(value);
|
||||
}
|
||||
|
||||
function isManualGap(value) {
|
||||
return /PAUSED|PARTIAL|MISSING|NEEDS/i.test(value);
|
||||
}
|
||||
|
||||
let commit = "unknown";
|
||||
try {
|
||||
commit = execSync("git rev-parse --short HEAD", { cwd: rootDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
|
||||
} catch {}
|
||||
|
||||
const dayReportIndex = readJson(path.join(reportDir, "day-report-index.json")) || {};
|
||||
const childReports = {
|
||||
publicReady: {
|
||||
status: Number(statusInput || 0) === 0 ? "PASS" : "FAIL",
|
||||
reportPath: path.resolve(path.join(reportDir, "public-ready.log")),
|
||||
},
|
||||
wauto1: child("wecom-controlled-trial-evidence"),
|
||||
wfullsmoke1: child("three-day-full-goal-smoke"),
|
||||
outingOvertimeDryRun: child("wecom-approval-fixtures-dryrun"),
|
||||
wrule1: child("wecom-approval-rule-validator"),
|
||||
};
|
||||
|
||||
const findings = [];
|
||||
for (const [source, report] of Object.entries(childReports)) {
|
||||
const status = safeStatus(report.status);
|
||||
if (status === "PASS" || /^PASS_/.test(status)) {
|
||||
if (isFinding(status) || Number(report.findingCount || 0) > 0) {
|
||||
findings.push({ source, status, severity: "finding", reportPath: report.reportPath });
|
||||
}
|
||||
continue;
|
||||
}
|
||||
if (isBlocked(status)) {
|
||||
findings.push({ source, status, severity: "blocker", reportPath: report.reportPath });
|
||||
} else if (isManualGap(status)) {
|
||||
findings.push({ source, status, severity: "manual_or_data_gap", reportPath: report.reportPath });
|
||||
} else {
|
||||
findings.push({ source, status, severity: "finding", reportPath: report.reportPath });
|
||||
}
|
||||
}
|
||||
|
||||
const manualGates = [
|
||||
{
|
||||
id: "WAPPR1",
|
||||
status: "PASS_APPROVER_RULES_READY",
|
||||
evidence: "2026-05-21 用户真机确认请假、补卡、外出、加班均为 A",
|
||||
},
|
||||
{
|
||||
id: "WROAD2-BIZ1",
|
||||
status: "NEEDS_CLOSEOUT_SUMMARY",
|
||||
evidence: "三天打卡、请假/补卡、详情后审批和 OA 历史查看需随最终验收确认",
|
||||
},
|
||||
{
|
||||
id: "WEXT1-LIVE",
|
||||
status: "PENDING_USER_APPROVAL",
|
||||
evidence: "外出/加班 dry-run 通过后仍需单独问答批准 live 写入",
|
||||
},
|
||||
{
|
||||
id: "WREAL1",
|
||||
status: "PENDING_USER_APPROVAL",
|
||||
evidence: "测试号证据和 WRULE1 可解释通过后，再问 1 名真实员工 + 1 名审批人/管理员观察",
|
||||
},
|
||||
];
|
||||
|
||||
let status = "PASS_TEST_ACCOUNT_CLOSEOUT_READY";
|
||||
if (Number(statusInput || 0) !== 0 || findings.some((item) => item.severity === "blocker")) {
|
||||
status = "SKIP/BLOCKED_BY_EXTERNAL_CONFIG";
|
||||
} else if (findings.some((item) => item.severity === "manual_or_data_gap") || manualGates.some((gate) => gate.status.startsWith("NEEDS"))) {
|
||||
status = "PAUSED_MANUAL_CONFIRMATION";
|
||||
} else if (findings.length || Number(findingCountInput || 0) > 0) {
|
||||
status = "PASS_WITH_FINDINGS";
|
||||
}
|
||||
|
||||
const summary = {
|
||||
issueId: "WTCLOSE2",
|
||||
mode: "wecom-test-account-final-closeout",
|
||||
status,
|
||||
conclusion: status,
|
||||
baseURL,
|
||||
commit,
|
||||
checkedAt: new Date().toISOString(),
|
||||
reportDir: path.resolve(reportDir),
|
||||
accounts: {
|
||||
applicant: "SMOKE002",
|
||||
approver: "SMOKE101",
|
||||
adminObserverEmployeeNo: "HYD000006",
|
||||
},
|
||||
childReports,
|
||||
sourceReports: {
|
||||
dayReportIndex: path.resolve(path.join(reportDir, "day-report-index.json")),
|
||||
wroad2Reports: dayReportIndex.wroad2Reports || [],
|
||||
warch3Reports: dayReportIndex.warch3Reports || [],
|
||||
},
|
||||
manualGates,
|
||||
findingCount: findings.length,
|
||||
findings,
|
||||
boundaries: {
|
||||
noWeComWrites: true,
|
||||
noWeComTemplateCreation: true,
|
||||
noWeComApprovalSubmission: true,
|
||||
noRealEmployees: true,
|
||||
noOutingOvertimeLive: true,
|
||||
wfullsmokePublicWrites: false,
|
||||
onlyAllowedOaWrites: "existing WARCH3/WCHECK1 archive paths when invoked by child runners",
|
||||
},
|
||||
nextQuestions: {
|
||||
closeout: [
|
||||
"A：接受测试号收口，进入 WEXT1-LIVE 问答。",
|
||||
"B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
|
||||
"C：暂停，不进入 live 或真实试用。",
|
||||
],
|
||||
wext1Live: [
|
||||
"A：批准一次 live 创建外出+加班 OA-POC 样件，保留审计。",
|
||||
"B：只保留 dry-run，不创建样件。",
|
||||
"C：外出/加班移出 V1。",
|
||||
],
|
||||
wreal1: [
|
||||
"A：1 名真实员工 + 1 名审批人/管理员观察。",
|
||||
"B：继续测试账号，不引入真实员工。",
|
||||
"C：暂停，先处理指定 finding。",
|
||||
],
|
||||
},
|
||||
privacy: "status/count/report-path summaries only; no phone/email/token/Secret/EncodingAESKey/full userid/full template_id/full sp_no/form values/attachments/comments/raw payload/XML/ciphertext",
|
||||
};
|
||||
|
||||
fs.writeFileSync(path.join(reportDir, "summary.json"), `${JSON.stringify(summary, null, 2)}\n`, "utf8");
|
||||
console.log(`[wtclose2] summary=${path.join(reportDir, "summary.json")}`);
|
||||
NODE
|
||||
}
|
||||
|
||||
finish() {
|
||||
write_day_report_index
|
||||
write_summary_json || STATUS=1
|
||||
run_privacy_smoke
|
||||
write_summary_json || STATUS=1
|
||||
log "[wtclose2] report=$REPORT_DIR"
|
||||
exit "$STATUS"
|
||||
}
|
||||
|
||||
trap finish EXIT
|
||||
|
||||
run_ready
|
||||
write_day_report_index
|
||||
run_wauto1
|
||||
run_wfullsmoke1
|
||||
run_wext1ld_dryrun
|
||||
run_wrule1
|
||||
在新工单中引用
屏蔽一个用户