wangsli/hyb-oa
1
0
派生 0
代码 工单 合并请求 工作流 8 软件包 项目 发布 百科 活动

WREMOTE1 规划远端收口和正式模板测试

浏览代码
这个提交包含在：
wangsli
2026-05-22 13:41:48 +08:00
父节点 170b9f9146
当前提交 6361dc2efb
共修改 18 个文件，包含 330 行新增和 171 行删除
下载 Patch 文件 下载 Diff 文件 展开所有文件 折叠所有文件
scripts/qa/collect-wecom-controlled-trial-evidence.sh
+65 -9
查看文件
@@ -9,6 +9,62 @@ SUMMARY_TXT="$REPORT_DIR/summary.txt"
STATUS=0
FINDING_COUNT=0
usage() {
cat <<'EOF'
Usage:
bash scripts/qa/collect-wecom-controlled-trial-evidence.sh --remote
WAUTO1 reads live Enterprise WeChat approval data, so business evidence must run
on the deployment server trusted IP. Local execution is blocked; use bash -n for
syntax/static checks.
EOF
}
run_remote() {
local deploy_server="${DEPLOY_SERVER:-deploy@118.89.77.218}"
local remote_dir="${REMOTE_DIR:-/opt/hyb-oa-trialrun}"
local remote_env_file="${REMOTE_ENV_FILE:-${remote_dir}/deploy/trialrun/.env}"
local compose_file="${COMPOSE_FILE:-deploy/trialrun/docker-compose.yml}"
local public_base_url="${LIVE_SMOKE_BASE_URL:-$PUBLIC_BASE_URL}"
ssh "$deploy_server" \
"REMOTE_DIR='${remote_dir}' REMOTE_ENV_FILE='${remote_env_file}' COMPOSE_FILE='${compose_file}' LIVE_SMOKE_BASE_URL='${public_base_url}' bash -s" <<'REMOTE'
set -euo pipefail
cd "$REMOTE_DIR"
if docker compose version >/dev/null 2>&1; then
compose_cmd=(docker compose)
else
compose_cmd=(docker-compose)
fi
"${compose_cmd[@]}" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE" exec -T server sh -lc \
"cd /app && LIVE_SMOKE_BASE_URL='$LIVE_SMOKE_BASE_URL' WAUTO1_EXECUTION_MODE=remote WAUTO1_REMOTE_CONTEXT=deployment-server bash scripts/qa/collect-wecom-controlled-trial-evidence.sh"
REMOTE
}
case "${1:-}" in
--remote)
run_remote
exit $?
;;
--help|-h)
usage
exit 0
;;
"")
;;
*)
printf '[wauto1][ERROR] unknown argument: %s\n' "$1" >&2
usage >&2
exit 2
;;
esac
if [[ "${WAUTO1_EXECUTION_MODE:-}" != "remote" || "${WAUTO1_REMOTE_CONTEXT:-}" != "deployment-server" ]]; then
printf '[wauto1][ERROR] Enterprise WeChat evidence must run on the deployment server trusted IP. Use --remote.\n' >&2
usage >&2
exit 2
fi
mkdir -p "$REPORT_DIR"
: >"$SUMMARY_TXT"
@@ -107,7 +163,7 @@ write_manual_checklist() {
- C：必须申请人手选审批人。
- D：当前看不到或模板未配置。
小团队默认规则：公司不到 10 人，按一层直属主管或指定审批角色自动带出审批人；主管链缺失、审批人不可见/停用/未绑定或命中自审时，由管理员兜底或阻断。当前目标按 A 执行，B/C/D 均视为阻断 WEXT1-LIVE 和 WREAL1 的 finding。
小团队默认规则：公司不到 10 人，按一层直属主管或指定审批角色自动带出审批人；主管链缺失、审批人不可见/停用/未绑定或命中自审时，由管理员兜底或阻断。当前目标按 A 执行，B/C/D 均视为阻断 WEXT1-FORMAL 和 WREAL1 的 finding。
需要记录的字段：模板入口、适用范围、审批人规则、是否允许申请人手选、是否可能自审、主管链缺失时表现、审批人不可见或停用时表现。
@@ -235,10 +291,10 @@ const manualGates = [
requiredEvidence: "请假、补卡、外出、加班逐模板均达到 A；小团队采用一层主管/指定审批角色 + 管理员兜底",
},
{
id: "WEXT1-LIVE",
id: "WEXT1-FORMAL",
status: "PENDING_USER_APPROVAL",
owner: "human_lead",
requiredEvidence: "外出/加班 dry-run 可解释通过后，是否允许单次 live 创建 OA-POC 样件",
requiredEvidence: "远端收口可解释通过后，是否允许 SMOKE002 人工提交正式模板外出/加班测试单，系统只读校验",
},
];
@@ -286,15 +342,15 @@ const summary = {
findings,
manualGates,
nextQuestions: {
wext1Live: [
"A：批准一次 live 创建外出+加班 OA-POC 样件，保留审计。",
"B：只保留 dry-run，不创建样件。",
"C：外出/加班移出 V1。",
wext1Formal: [
"A：批准 SMOKE002 在正式模板提交外出+加班低风险测试单，SMOKE101 先看详情再审批，系统只读校验并保留审计。",
"B：只测请假/补卡/打卡，不提交外出/加班正式模板测试单。",
"C：暂停，先检查企微正式模板配置。",
],
threeDayCloseout: [
"A：接受 PASS_AUTO_EVIDENCE_READY，进入 WEXT1-LIVE live 问答。",
"A：接受 PASS_AUTO_EVIDENCE_READY，进入 WEXT1-FORMAL 正式模板人工提交问答。",
"B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
"C：暂停，不进入外出/加班 live 或真实试用。",
"C：暂停，不进入外出/加班正式模板测试或真实试用。",
],
},
privacy: "status/count/report-path summaries only; no phone/email/token/Secret/EncodingAESKey/full userid/full template_id/full sp_no/form values/attachments/comments/raw payload/XML/ciphertext",
scripts/qa/run-three-day-full-goal-smoke.sh
+78 -15
查看文件
@@ -10,6 +10,63 @@ SUMMARY_TXT="$REPORT_DIR/summary.txt"
STATUS=0
FINDING_COUNT=0
usage() {
cat <<'EOF'
Usage:
bash scripts/qa/run-three-day-full-goal-smoke.sh --remote
WFULLSMOKE includes Enterprise WeChat read checks, so business evidence must run
on the deployment server trusted IP. Local execution is intentionally blocked
and bash -n should be used for syntax/static checks.
EOF
}
run_remote() {
local deploy_server="${DEPLOY_SERVER:-deploy@118.89.77.218}"
local remote_dir="${REMOTE_DIR:-/opt/hyb-oa-trialrun}"
local remote_env_file="${REMOTE_ENV_FILE:-${remote_dir}/deploy/trialrun/.env}"
local compose_file="${COMPOSE_FILE:-deploy/trialrun/docker-compose.yml}"
local public_base_url="${LIVE_SMOKE_BASE_URL:-$PUBLIC_BASE_URL}"
local public_writes="${WFULLSMOKE_ALLOW_PUBLIC_WRITES:-1}"
ssh "$deploy_server" \
"REMOTE_DIR='${remote_dir}' REMOTE_ENV_FILE='${remote_env_file}' COMPOSE_FILE='${compose_file}' LIVE_SMOKE_BASE_URL='${public_base_url}' WFULLSMOKE_ALLOW_PUBLIC_WRITES='${public_writes}' bash -s" <<'REMOTE'
set -euo pipefail
cd "$REMOTE_DIR"
if docker compose version >/dev/null 2>&1; then
compose_cmd=(docker compose)
else
compose_cmd=(docker-compose)
fi
"${compose_cmd[@]}" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE" exec -T server sh -lc \
"cd /app && LIVE_SMOKE_BASE_URL='$LIVE_SMOKE_BASE_URL' WFULLSMOKE_EXECUTION_MODE=remote WFULLSMOKE_REMOTE_CONTEXT=deployment-server WFULLSMOKE_ALLOW_PUBLIC_WRITES='$WFULLSMOKE_ALLOW_PUBLIC_WRITES' bash scripts/qa/run-three-day-full-goal-smoke.sh"
REMOTE
}
case "${1:-}" in
--remote)
run_remote
exit $?
;;
--help|-h)
usage
exit 0
;;
"")
;;
*)
printf '[wfullsmoke1][ERROR] unknown argument: %s\n' "$1" >&2
usage >&2
exit 2
;;
esac
if [[ "${WFULLSMOKE_EXECUTION_MODE:-}" != "remote" || "${WFULLSMOKE_REMOTE_CONTEXT:-}" != "deployment-server" ]]; then
printf '[wfullsmoke1][ERROR] Enterprise WeChat checks must run on the deployment server trusted IP. Use --remote.\n' >&2
usage >&2
exit 2
fi
mkdir -p "$REPORT_DIR"
: >"$SUMMARY_TXT"
@@ -153,7 +210,7 @@ run_r7e_flow() {
LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
QA_ISSUE_ID=WFULLSMOKE1 \
TRIALRUN_ISSUE_ID=WFULLSMOKE1 \
TRIALRUN_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-WFULL}" \
TRIALRUN_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}" \
TRIALRUN_REPORT_TITLE="WFULLSMOKE1 ${flow} 主路径报告" \
TRIALRUN_REPORT_DIR="$flow_report" \
TRIALRUN_SCREENSHOT_DIR="$flow_screens" \
@@ -173,9 +230,9 @@ run_procurement_contract_project_regression() {
MANAGER_PASSWORD="$LIVE_SMOKE_MANAGER_PASSWORD" \
FINANCE_MGR_IDENTIFIER="$LIVE_SMOKE_FINANCE_MGR_IDENTIFIER" \
FINANCE_MGR_PASSWORD="$LIVE_SMOKE_FINANCE_MGR_PASSWORD" \
PROCUREMENT_REGRESSION_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-WFULL}" \
PROCUREMENT_PO_NO="PO-${WFULLSMOKE_MARKER_PREFIX:-WFULL}-${marker}" \
PROCUREMENT_CONTRACT_NO="CT-${WFULLSMOKE_MARKER_PREFIX:-WFULL}-${marker}" \
PROCUREMENT_REGRESSION_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}" \
PROCUREMENT_PO_NO="PO-${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}-${marker}" \
PROCUREMENT_CONTRACT_NO="CT-${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}-${marker}" \
bash "$ROOT_DIR/server/scripts/regression-procurement.sh"
}
@@ -199,6 +256,8 @@ run_wecom_and_archive_chain() {
run_finding_step "wauto1-evidence" env \
WAUTO1_REPORT_DIR="$REPORT_DIR/wecom-controlled-trial-evidence" \
WAUTO1_EXECUTION_MODE=remote \
WAUTO1_REMOTE_CONTEXT=deployment-server \
LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
bash "$ROOT_DIR/scripts/qa/collect-wecom-controlled-trial-evidence.sh"
}
@@ -252,14 +311,14 @@ write_manual_checklist() {
## Day 3
- HYD000006：确认三天业务结果和 OA 历史可读性。
- 若 WAPPR1 为 A 且外出/加班 dry-run 通过，再问答是否进入 WEXT1-LIVE。
- 若 WAPPR1 为 A 且远端收口通过，再问答是否进入 WEXT1-FORMAL：由 SMOKE002 真机提交正式模板外出/加班测试单，系统只读校验。
边界：不要记录 Secret、token、EncodingAESKey、完整 userid、完整审批单号、完整 template_id、表单值、附件、评论或原始 payload。
EOF
}
run_privacy_smoke() {
local sensitive_pattern='access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
local sensitive_pattern='(["'\''"]?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\''"]?[[:space:]]*[:=][[:space:]]*["'\''"]?[A-Za-z0-9._:/+=-]{8,}["'\''"]?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
local matches
matches="$(grep -RInE "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' || true)"
if [[ -n "$matches" ]]; then
@@ -383,10 +442,10 @@ const manualGates = [
requiredEvidence: "四类模板均为 A：一层主管/指定审批角色自动带出，申请人不能任意选择；缺主管/不可用/自审时管理员兜底或阻断",
},
{
id: "WEXT1-LIVE",
id: "WEXT1-FORMAL",
status: "PENDING_USER_APPROVAL",
owner: "human_lead",
requiredEvidence: "WAPPR1=A 且 WEXT1LD dry-run 通过后，是否允许 live 创建外出/加班样件",
requiredEvidence: "WAPPR1=A 且 WREMOTE1/WFULLSMOKE2 可解释通过后，是否允许 SMOKE002 人工提交正式模板外出/加班测试单",
},
{
id: "WREAL1",
@@ -412,6 +471,10 @@ const summary = {
conclusion: status,
baseURL,
commit,
executionMode: process.env.WFULLSMOKE_EXECUTION_MODE || "unknown",
remoteContext: process.env.WFULLSMOKE_REMOTE_CONTEXT || "unknown",
runtimeHost: process.env.HOSTNAME || "unknown",
trustedIpBoundary: "Enterprise WeChat API checks must run on the deployment server; local runs are blocked by default",
checkedAt: new Date().toISOString(),
reportDir: path.resolve(reportDir),
accounts: {
@@ -427,7 +490,7 @@ const summary = {
},
boundaries: {
oaTestDataAllowed: true,
testMarkerRequired: "TEST/SMOKE/WFULL",
testMarkerRequired: "TEST-SMOKE-WFULL",
noRealPayment: true,
noErpWrite: true,
noBankStatementImport: true,
@@ -446,15 +509,15 @@ const summary = {
"C：必须申请人手选审批人。",
"D：当前看不到或模板未配置。",
],
wext1Live: [
"A：批准一次 live 创建外出+加班 OA-POC 样件，保留审计。",
"B：只保留 dry-run，不创建样件。",
"C：外出/加班移出 V1。",
wext1Formal: [
"A：批准 SMOKE002 在正式模板提交外出+加班低风险测试单，SMOKE101 先看详情再审批，系统只读校验并保留审计。",
"B：只测请假/补卡/打卡，不提交外出/加班正式模板测试单。",
"C：暂停，先检查企微正式模板配置。",
],
finalCloseout: [
"A：接受主路径闭环通过，进入外出/加班 live 或 WREAL1 准备。",
"A：接受主路径闭环通过，进入 WEXT1-FORMAL 或 WREAL1 准备问答。",
"B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
"C：暂停，不进入 live、真实员工试用或镜像。",
"C：暂停，不进入正式模板外出/加班测试、真实员工试用或镜像。",
],
},
privacy: "status/count/report-path summaries only; no phone/email/token/Secret/EncodingAESKey/full userid/full template_id/full sp_no/form values/attachments/comments/raw payload/XML/ciphertext",
scripts/qa/run-wecom-test-account-final-closeout.sh
+16 -13
查看文件
@@ -13,11 +13,10 @@ usage() {
cat <<'EOF'
Usage:
bash scripts/qa/run-wecom-test-account-final-closeout.sh --remote
WTCLOSE2_EXECUTION_MODE=remote bash scripts/qa/run-wecom-test-account-final-closeout.sh
WTCLOSE2 must run on the deployment server because Enterprise WeChat API access is
restricted by trusted IP. Local execution is intentionally blocked unless
WTCLOSE2_ALLOW_LOCAL_RUN=1 is set for script development only.
restricted by trusted IP. Local execution is intentionally blocked; use bash -n
for syntax/static checks.
EOF
}
@@ -38,7 +37,7 @@ else
compose_cmd=(docker-compose)
fi
"${compose_cmd[@]}" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE" exec -T server sh -lc \
"cd /app && LIVE_SMOKE_BASE_URL='$LIVE_SMOKE_BASE_URL' WTCLOSE2_EXECUTION_MODE=remote bash scripts/qa/run-wecom-test-account-final-closeout.sh"
"cd /app && LIVE_SMOKE_BASE_URL='$LIVE_SMOKE_BASE_URL' WTCLOSE2_EXECUTION_MODE=remote WTCLOSE2_REMOTE_CONTEXT=deployment-server bash scripts/qa/run-wecom-test-account-final-closeout.sh"
REMOTE
}
@@ -60,7 +59,7 @@ case "${1:-}" in
;;
esac
if [[ "${WTCLOSE2_EXECUTION_MODE:-}" != "remote" && "${WTCLOSE2_ALLOW_LOCAL_RUN:-0}" != "1" ]]; then
if [[ "${WTCLOSE2_EXECUTION_MODE:-}" != "remote" || "${WTCLOSE2_REMOTE_CONTEXT:-}" != "deployment-server" ]]; then
printf '[wtclose2][ERROR] Enterprise WeChat API checks must run on the deployment server trusted IP. Use --remote.\n' >&2
usage >&2
exit 2
@@ -175,6 +174,8 @@ NODE
run_wauto1() {
run_finding_step "wauto1-evidence" env \
WAUTO1_REPORT_DIR="$REPORT_DIR/wecom-controlled-trial-evidence" \
WAUTO1_EXECUTION_MODE=remote \
WAUTO1_REMOTE_CONTEXT=deployment-server \
LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
bash "$ROOT_DIR/scripts/qa/collect-wecom-controlled-trial-evidence.sh"
}
@@ -182,6 +183,8 @@ run_wauto1() {
run_wfullsmoke1() {
run_finding_step "wfullsmoke1-no-public-writes" env \
WFULLSMOKE_REPORT_DIR="$REPORT_DIR/three-day-full-goal-smoke" \
WFULLSMOKE_EXECUTION_MODE=remote \
WFULLSMOKE_REMOTE_CONTEXT=deployment-server \
WFULLSMOKE_ALLOW_PUBLIC_WRITES=0 \
LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
bash "$ROOT_DIR/scripts/qa/run-three-day-full-goal-smoke.sh"
@@ -312,9 +315,9 @@ const manualGates = [
evidence: "三天打卡、请假/补卡、详情后审批和 OA 历史查看需随最终验收确认",
},
{
id: "WEXT1-LIVE",
id: "WEXT1-FORMAL",
status: "PENDING_USER_APPROVAL",
evidence: "外出/加班 dry-run 通过后仍需单独问答批准 live 写入",
evidence: "远端收口可解释通过后仍需单独问答批准 SMOKE002 人工提交正式模板外出/加班测试单；系统只读校验",
},
{
id: "WREAL1",
@@ -368,14 +371,14 @@ const summary = {
},
nextQuestions: {
closeout: [
"A：接受测试号收口，进入 WEXT1-LIVE 问答。",
"A：接受测试号收口，进入 WEXT1-FORMAL 正式模板人工提交问答。",
"B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
"C：暂停，不进入 live 或真实试用。",
"C：暂停，不进入正式模板外出/加班测试或真实试用。",
],
wext1Live: [
"A：批准一次 live 创建外出+加班 OA-POC 样件，保留审计。",
"B：只保留 dry-run，不创建样件。",
"C：外出/加班移出 V1。",
wext1Formal: [
"A：批准 SMOKE002 在正式模板提交外出+加班低风险测试单，SMOKE101 先看详情再审批，系统只读校验并保留审计。",
"B：只测请假/补卡/打卡，不提交外出/加班正式模板测试单。",
"C：暂停，先检查企微正式模板配置。",
],
wreal1: [
"A：1 名真实员工 + 1 名审批人/管理员观察。",