WARCH1 实现企微审批最小历史留存
这个提交包含在：
@@ -0,0 +1,430 @@
|
||||
#!/usr/bin/env node
|
||||
require("dotenv/config");
|
||||
|
||||
const fs = require("node:fs");
|
||||
const path = require("node:path");
|
||||
|
||||
const { createPrismaClient } = require("../prismaClient");
|
||||
const { maskApprovalIdentifier } = require("../services/integrations/wecomApproval");
|
||||
|
||||
const DEFAULT_REPORT_ROOT = path.resolve(__dirname, "../../../artifacts/qa-flow");
|
||||
const DEFAULT_TARGETS = Object.freeze(["leave", "missed_punch"]);
|
||||
const REPORT_PRIVACY =
|
||||
"OA DB archive counts/status summaries/masked sp_no/template/userid prefixes only; no phone/email/token/secret/full userid/full template_id/full sp_no/reason text/attachments/comments/raw payload";
|
||||
|
||||
function printHelp() {
|
||||
process.stdout.write(`Usage: node src/scripts/check-wecom-approval-archive.js [options]
|
||||
|
||||
QA-only 企业微信审批自建留存离线读取检查。
|
||||
该脚本只读取 OA DB，不调用企业微信 API，不写 OA/企微数据。
|
||||
|
||||
Options:
|
||||
--offline 明确以离线模式验证 OA 自建留存可读。
|
||||
--format=text|json 输出格式，默认 text。
|
||||
--report-dir=<path> 报告目录，默认 artifacts/qa-flow/wecom-approval-archive-<timestamp>。
|
||||
--template=leave 只检查请假留存。
|
||||
--template=missed_punch 只检查补卡留存。
|
||||
--status=<status> 按规范化状态过滤。
|
||||
--limit=<1..100> 最大读取条数，默认 20。
|
||||
--help 显示帮助。
|
||||
|
||||
隐私边界：
|
||||
报告只输出计数、状态摘要、字段类型、脱敏 sp_no/template/userid 前缀和 finding 类型。
|
||||
不输出手机号、邮箱、token、secret、完整 userid、完整 template_id、完整 sp_no、原因全文、附件、评论或企微原始 payload。
|
||||
`);
|
||||
}
|
||||
|
||||
function timestamp() {
|
||||
return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
|
||||
}
|
||||
|
||||
function toSafeString(value, maxLength = 500) {
|
||||
if (value == null) return "";
|
||||
return String(value).trim().slice(0, maxLength);
|
||||
}
|
||||
|
||||
function safeMessage(value) {
|
||||
return toSafeString(value, 500)
|
||||
.replace(/access_token=[^&\s]+/gi, "access_token=***")
|
||||
.replace(/[A-Za-z0-9+/=_-]{24,}/g, "***")
|
||||
.slice(0, 240);
|
||||
}
|
||||
|
||||
function parseArgs(argv) {
|
||||
const options = {
|
||||
offline: false,
|
||||
format: "text",
|
||||
reportDir: path.join(DEFAULT_REPORT_ROOT, `wecom-approval-archive-${timestamp()}`),
|
||||
templates: [],
|
||||
status: "",
|
||||
limit: 20,
|
||||
help: false,
|
||||
};
|
||||
|
||||
for (let index = 0; index < argv.length; index += 1) {
|
||||
const arg = argv[index];
|
||||
if (arg === "--help" || arg === "-h") {
|
||||
options.help = true;
|
||||
} else if (arg === "--offline") {
|
||||
options.offline = true;
|
||||
} else if (arg === "--format") {
|
||||
options.format = argv[index + 1] || options.format;
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--format=")) {
|
||||
options.format = arg.slice("--format=".length);
|
||||
} else if (arg === "--report-dir") {
|
||||
options.reportDir = argv[index + 1] || options.reportDir;
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--report-dir=")) {
|
||||
options.reportDir = arg.slice("--report-dir=".length);
|
||||
} else if (arg === "--template") {
|
||||
options.templates.push(toSafeString(argv[index + 1], 40));
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--template=")) {
|
||||
options.templates.push(toSafeString(arg.slice("--template=".length), 40));
|
||||
} else if (arg === "--status") {
|
||||
options.status = toSafeString(argv[index + 1], 40);
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--status=")) {
|
||||
options.status = toSafeString(arg.slice("--status=".length), 40);
|
||||
} else if (arg === "--limit") {
|
||||
options.limit = Number(argv[index + 1] || options.limit);
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--limit=")) {
|
||||
options.limit = Number(arg.slice("--limit=".length));
|
||||
} else {
|
||||
throw new Error(`Unsupported argument: ${arg}`);
|
||||
}
|
||||
}
|
||||
|
||||
if (!["text", "json"].includes(options.format)) {
|
||||
throw new Error(`Unsupported --format: ${options.format}`);
|
||||
}
|
||||
const uniqueTemplates = Array.from(new Set(options.templates.filter(Boolean)));
|
||||
for (const template of uniqueTemplates) {
|
||||
if (!DEFAULT_TARGETS.includes(template)) {
|
||||
throw new Error(`Unsupported --template: ${template}`);
|
||||
}
|
||||
}
|
||||
options.templates = uniqueTemplates.length ? uniqueTemplates : [...DEFAULT_TARGETS];
|
||||
if (!Number.isFinite(options.limit) || options.limit < 1 || options.limit > 100) {
|
||||
throw new Error("--limit must be between 1 and 100");
|
||||
}
|
||||
options.limit = Math.floor(options.limit);
|
||||
return options;
|
||||
}
|
||||
|
||||
function countBy(items, selector) {
|
||||
const counts = {};
|
||||
for (const item of items || []) {
|
||||
const key = toSafeString(selector(item), 80) || "unknown";
|
||||
counts[key] = (counts[key] || 0) + 1;
|
||||
}
|
||||
return counts;
|
||||
}
|
||||
|
||||
function buildWhere(options) {
|
||||
const where = {
|
||||
template_type: { in: options.templates },
|
||||
};
|
||||
if (options.status) {
|
||||
where.normalized_status = options.status;
|
||||
}
|
||||
return where;
|
||||
}
|
||||
|
||||
function sanitizeArchiveRow(row) {
|
||||
const participants = (row.participants || []).map((item) => ({
|
||||
role: item.role,
|
||||
nodeIndex: item.node_index,
|
||||
userIdPrefix: maskApprovalIdentifier(item.external_user_id),
|
||||
mappingStatus: item.mapping_status,
|
||||
current: Boolean(item.is_current),
|
||||
}));
|
||||
const actions = (row.actions || []).map((item) => ({
|
||||
actionType: item.action_type,
|
||||
operatorPrefix: maskApprovalIdentifier(item.operator_external_user_id),
|
||||
actionTime: item.action_time ? new Date(item.action_time).toISOString() : null,
|
||||
nodeIndex: item.node_index,
|
||||
source: item.source,
|
||||
}));
|
||||
const fieldSummaries = (row.field_summaries || []).map((item) => ({
|
||||
fieldName: item.display_allowed ? item.field_name : null,
|
||||
fieldType: item.field_type || "unknown",
|
||||
sensitiveLevel: item.sensitive_level,
|
||||
displayAllowed: Boolean(item.display_allowed),
|
||||
}));
|
||||
const findings = (row.reconcile_findings || []).map((item) => ({
|
||||
findingType: item.finding_type,
|
||||
status: item.status,
|
||||
severity: item.severity,
|
||||
source: item.source,
|
||||
detectedAt: item.detected_at ? new Date(item.detected_at).toISOString() : null,
|
||||
}));
|
||||
return {
|
||||
archiveId: row.id,
|
||||
spNoPrefix: maskApprovalIdentifier(row.sp_no),
|
||||
templateIdPrefix: maskApprovalIdentifier(row.template_id),
|
||||
templateType: row.template_type,
|
||||
normalizedStatus: row.normalized_status,
|
||||
submittedAt: row.submitted_at ? new Date(row.submitted_at).toISOString() : null,
|
||||
statusObservedAt: row.status_observed_at ? new Date(row.status_observed_at).toISOString() : null,
|
||||
completedAt: row.completed_at ? new Date(row.completed_at).toISOString() : null,
|
||||
lastSource: row.last_source,
|
||||
readabilityStatus: row.readability_status,
|
||||
singleTapApproveRisk: Boolean(row.single_tap_approve_risk),
|
||||
templateAdjustmentRequired: Boolean(row.template_adjustment_required),
|
||||
participantRoleCounts: countBy(participants, (item) => item.role),
|
||||
actionTypeCounts: countBy(actions, (item) => item.actionType),
|
||||
fieldTypeCounts: countBy(fieldSummaries, (item) => item.fieldType),
|
||||
openFindingCounts: countBy(findings, (item) => item.findingType),
|
||||
participants,
|
||||
actions,
|
||||
fieldSummaries,
|
||||
findings,
|
||||
counts: row._count || {},
|
||||
};
|
||||
}
|
||||
|
||||
async function readArchiveRows(prisma, options) {
|
||||
return prisma.wecomApprovalArchive.findMany({
|
||||
where: buildWhere(options),
|
||||
orderBy: [
|
||||
{ status_observed_at: "desc" },
|
||||
{ updated_at: "desc" },
|
||||
],
|
||||
take: options.limit,
|
||||
select: {
|
||||
id: true,
|
||||
sp_no: true,
|
||||
template_id: true,
|
||||
template_type: true,
|
||||
normalized_status: true,
|
||||
submitted_at: true,
|
||||
completed_at: true,
|
||||
status_observed_at: true,
|
||||
last_source: true,
|
||||
readability_status: true,
|
||||
single_tap_approve_risk: true,
|
||||
template_adjustment_required: true,
|
||||
participants: {
|
||||
take: 20,
|
||||
orderBy: [{ role: "asc" }, { node_index: "asc" }],
|
||||
select: {
|
||||
role: true,
|
||||
node_index: true,
|
||||
external_user_id: true,
|
||||
mapping_status: true,
|
||||
is_current: true,
|
||||
},
|
||||
},
|
||||
actions: {
|
||||
take: 30,
|
||||
orderBy: [{ action_time: "asc" }, { created_at: "asc" }],
|
||||
select: {
|
||||
action_type: true,
|
||||
operator_external_user_id: true,
|
||||
action_time: true,
|
||||
node_index: true,
|
||||
source: true,
|
||||
},
|
||||
},
|
||||
field_summaries: {
|
||||
take: 30,
|
||||
orderBy: [{ field_index: "asc" }],
|
||||
select: {
|
||||
field_name: true,
|
||||
field_type: true,
|
||||
sensitive_level: true,
|
||||
display_allowed: true,
|
||||
},
|
||||
},
|
||||
reconcile_findings: {
|
||||
where: { status: "open" },
|
||||
take: 20,
|
||||
orderBy: [{ detected_at: "desc" }],
|
||||
select: {
|
||||
finding_type: true,
|
||||
status: true,
|
||||
severity: true,
|
||||
source: true,
|
||||
detected_at: true,
|
||||
},
|
||||
},
|
||||
_count: {
|
||||
select: {
|
||||
participants: true,
|
||||
actions: true,
|
||||
field_summaries: true,
|
||||
attachment_summaries: true,
|
||||
callback_events: true,
|
||||
compensation_items: true,
|
||||
reconcile_findings: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function evaluateArchiveReport({ options, archives, error, configGaps }) {
|
||||
if (error) {
|
||||
return { status: "SKIP", conclusion: "BLOCKED_BY_EXTERNAL_CONFIG" };
|
||||
}
|
||||
if (configGaps.length || !archives.length) {
|
||||
return { status: "PARTIAL_ARCHIVE_NEEDS_DATA", conclusion: "PARTIAL_ARCHIVE_NEEDS_DATA" };
|
||||
}
|
||||
if (archives.some((item) => item.findings?.length)) {
|
||||
return { status: "PASS_WITH_FINDINGS", conclusion: "PASS_WITH_FINDINGS" };
|
||||
}
|
||||
if (!options.offline) {
|
||||
return { status: "PARTIAL_ARCHIVE_NEEDS_DATA", conclusion: "PARTIAL_ARCHIVE_NEEDS_DATA" };
|
||||
}
|
||||
return { status: "PASS_ARCHIVE_HISTORY_READABLE", conclusion: "PASS_ARCHIVE_HISTORY_READABLE" };
|
||||
}
|
||||
|
||||
async function executeArchiveCheck(options, deps = {}) {
|
||||
const generatedAt = deps.generatedAt || new Date().toISOString();
|
||||
const env = deps.env || process.env;
|
||||
const configGaps = [];
|
||||
const mainBlockers = [];
|
||||
let ownedPrisma = null;
|
||||
let ownedPool = null;
|
||||
let rawRows = [];
|
||||
let readError = null;
|
||||
|
||||
if (!options.offline) {
|
||||
configGaps.push({
|
||||
id: "offline_mode",
|
||||
status: "NEEDS_CONFIG",
|
||||
reason: "run_with_--offline_to_prove_no_wecom_api_dependency",
|
||||
});
|
||||
}
|
||||
|
||||
try {
|
||||
let prisma = deps.prisma;
|
||||
if (!prisma) {
|
||||
if (!env.DATABASE_URL) {
|
||||
throw new Error("DATABASE_URL is required for OA archive offline read");
|
||||
}
|
||||
const created = deps.createPrismaClientImpl ? deps.createPrismaClientImpl() : createPrismaClient();
|
||||
ownedPrisma = created.prisma;
|
||||
ownedPool = created.pool;
|
||||
prisma = ownedPrisma;
|
||||
}
|
||||
rawRows = await (deps.readArchiveRowsImpl || readArchiveRows)(prisma, options);
|
||||
} catch (error) {
|
||||
readError = error;
|
||||
mainBlockers.push({
|
||||
id: "archive_db_read",
|
||||
reason: "oa_archive_db_read_failed",
|
||||
message: safeMessage(error?.message || error),
|
||||
});
|
||||
} finally {
|
||||
if (ownedPrisma?.$disconnect) {
|
||||
await ownedPrisma.$disconnect().catch(() => null);
|
||||
}
|
||||
if (ownedPool?.end) {
|
||||
await ownedPool.end().catch(() => null);
|
||||
}
|
||||
}
|
||||
|
||||
const archives = rawRows.map(sanitizeArchiveRow);
|
||||
if (!readError && !archives.length) {
|
||||
configGaps.push({
|
||||
id: "archive_history_data",
|
||||
status: "NEEDS_CONFIG",
|
||||
reason: "no_wecom_approval_archive_rows_for_scope",
|
||||
});
|
||||
}
|
||||
const conclusion = evaluateArchiveReport({ options, archives, error: readError, configGaps });
|
||||
|
||||
return {
|
||||
mode: "qa_only",
|
||||
generatedAt,
|
||||
status: conclusion.status,
|
||||
conclusion: conclusion.conclusion,
|
||||
privacy: REPORT_PRIVACY,
|
||||
scope: {
|
||||
issue: "WARCH1",
|
||||
source: "OA_DB_ONLY",
|
||||
offline: Boolean(options.offline),
|
||||
wecomApiCalls: false,
|
||||
writeBehavior: "read-only OA DB; no OA writes, no WeCom reads, no WeCom writes",
|
||||
targets: options.templates,
|
||||
deepMirror: "not_started",
|
||||
nextStage: "wecom_attendance_approval_mirror_v1_after_WARCH1_acceptance",
|
||||
},
|
||||
filters: {
|
||||
templates: options.templates,
|
||||
status: options.status || null,
|
||||
limit: options.limit,
|
||||
},
|
||||
checks: {
|
||||
archiveRead: {
|
||||
id: "archive_history_read",
|
||||
status: readError ? "BLOCKED" : (archives.length ? "OK" : "NEEDS_DATA"),
|
||||
count: archives.length,
|
||||
statusCounts: countBy(archives, (item) => item.normalizedStatus),
|
||||
templateCounts: countBy(archives, (item) => item.templateType),
|
||||
singleTapApproveRiskCount: archives.filter((item) => item.singleTapApproveRisk).length,
|
||||
},
|
||||
archives,
|
||||
},
|
||||
configGaps,
|
||||
mainBlockers,
|
||||
};
|
||||
}
|
||||
|
||||
function ensureReportDir(reportDir) {
|
||||
fs.mkdirSync(reportDir, { recursive: true });
|
||||
}
|
||||
|
||||
function writeReport(reportDir, report) {
|
||||
ensureReportDir(reportDir);
|
||||
const filePath = path.join(reportDir, "summary.json");
|
||||
fs.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
|
||||
return filePath;
|
||||
}
|
||||
|
||||
function printText(report, reportPath) {
|
||||
process.stdout.write(`[wecom-approval-archive] status=${report.status} conclusion=${report.conclusion}\n`);
|
||||
process.stdout.write(`[wecom-approval-archive] report=${reportPath}\n`);
|
||||
process.stdout.write(`[wecom-approval-archive] privacy=${report.privacy}\n`);
|
||||
process.stdout.write(`[wecom-approval-archive] offline=${report.scope.offline} targets=${report.scope.targets.join(",")}\n`);
|
||||
if (report.configGaps?.length) {
|
||||
process.stdout.write(`[wecom-approval-archive] configGaps=${JSON.stringify(report.configGaps)}\n`);
|
||||
}
|
||||
if (report.mainBlockers?.length) {
|
||||
process.stdout.write(`[wecom-approval-archive] mainBlockers=${JSON.stringify(report.mainBlockers)}\n`);
|
||||
}
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const options = parseArgs(process.argv.slice(2));
|
||||
if (options.help) {
|
||||
printHelp();
|
||||
return;
|
||||
}
|
||||
const report = await executeArchiveCheck(options);
|
||||
const reportPath = writeReport(options.reportDir, report);
|
||||
if (options.format === "json") {
|
||||
process.stdout.write(`${JSON.stringify({ ...report, reportPath }, null, 2)}\n`);
|
||||
} else {
|
||||
printText(report, reportPath);
|
||||
}
|
||||
}
|
||||
|
||||
if (require.main === module) {
|
||||
main().catch((error) => {
|
||||
process.stderr.write(`[wecom-approval-archive][FAIL] ${safeMessage(error?.message || error)}\n`);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
buildWhere,
|
||||
evaluateArchiveReport,
|
||||
executeArchiveCheck,
|
||||
parseArgs,
|
||||
sanitizeArchiveRow,
|
||||
};
|
||||
在新工单中引用
屏蔽一个用户