WREMOTE1 规划远端收口和正式模板测试

scripts/qa/run-three-day-full-goal-smoke.sh

@@ -10,6 +10,63 @@ SUMMARY_TXT="$REPORT_DIR/summary.txt"
 STATUS=0
 FINDING_COUNT=0
 
+usage() {
+  cat <<'EOF'
+Usage:
+  bash scripts/qa/run-three-day-full-goal-smoke.sh --remote
+
+WFULLSMOKE includes Enterprise WeChat read checks, so business evidence must run
+on the deployment server trusted IP. Local execution is intentionally blocked
+and bash -n should be used for syntax/static checks.
+EOF
+}
+
+run_remote() {
+  local deploy_server="${DEPLOY_SERVER:-deploy@118.89.77.218}"
+  local remote_dir="${REMOTE_DIR:-/opt/hyb-oa-trialrun}"
+  local remote_env_file="${REMOTE_ENV_FILE:-${remote_dir}/deploy/trialrun/.env}"
+  local compose_file="${COMPOSE_FILE:-deploy/trialrun/docker-compose.yml}"
+  local public_base_url="${LIVE_SMOKE_BASE_URL:-$PUBLIC_BASE_URL}"
+  local public_writes="${WFULLSMOKE_ALLOW_PUBLIC_WRITES:-1}"
+
+  ssh "$deploy_server" \
+    "REMOTE_DIR='${remote_dir}' REMOTE_ENV_FILE='${remote_env_file}' COMPOSE_FILE='${compose_file}' LIVE_SMOKE_BASE_URL='${public_base_url}' WFULLSMOKE_ALLOW_PUBLIC_WRITES='${public_writes}' bash -s" <<'REMOTE'
+set -euo pipefail
+cd "$REMOTE_DIR"
+if docker compose version >/dev/null 2>&1; then
+  compose_cmd=(docker compose)
+else
+  compose_cmd=(docker-compose)
+fi
+"${compose_cmd[@]}" -f "$COMPOSE_FILE" --env-file "$REMOTE_ENV_FILE" exec -T server sh -lc \
+  "cd /app && LIVE_SMOKE_BASE_URL='$LIVE_SMOKE_BASE_URL' WFULLSMOKE_EXECUTION_MODE=remote WFULLSMOKE_REMOTE_CONTEXT=deployment-server WFULLSMOKE_ALLOW_PUBLIC_WRITES='$WFULLSMOKE_ALLOW_PUBLIC_WRITES' bash scripts/qa/run-three-day-full-goal-smoke.sh"
+REMOTE
+}
+
+case "${1:-}" in
+  --remote)
+    run_remote
+    exit $?
+    ;;
+  --help|-h)
+    usage
+    exit 0
+    ;;
+  "")
+    ;;
+  *)
+    printf '[wfullsmoke1][ERROR] unknown argument: %s\n' "$1" >&2
+    usage >&2
+    exit 2
+    ;;
+esac
+
+if [[ "${WFULLSMOKE_EXECUTION_MODE:-}" != "remote" || "${WFULLSMOKE_REMOTE_CONTEXT:-}" != "deployment-server" ]]; then
+  printf '[wfullsmoke1][ERROR] Enterprise WeChat checks must run on the deployment server trusted IP. Use --remote.\n' >&2
+  usage >&2
+  exit 2
+fi
+
 mkdir -p "$REPORT_DIR"
 : >"$SUMMARY_TXT"
 
@@ -153,7 +210,7 @@ run_r7e_flow() {
     LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
     QA_ISSUE_ID=WFULLSMOKE1 \
     TRIALRUN_ISSUE_ID=WFULLSMOKE1 \
-    TRIALRUN_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-WFULL}" \
+    TRIALRUN_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}" \
     TRIALRUN_REPORT_TITLE="WFULLSMOKE1 ${flow} 主路径报告" \
     TRIALRUN_REPORT_DIR="$flow_report" \
     TRIALRUN_SCREENSHOT_DIR="$flow_screens" \
@@ -173,9 +230,9 @@ run_procurement_contract_project_regression() {
     MANAGER_PASSWORD="$LIVE_SMOKE_MANAGER_PASSWORD" \
     FINANCE_MGR_IDENTIFIER="$LIVE_SMOKE_FINANCE_MGR_IDENTIFIER" \
     FINANCE_MGR_PASSWORD="$LIVE_SMOKE_FINANCE_MGR_PASSWORD" \
-    PROCUREMENT_REGRESSION_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-WFULL}" \
-    PROCUREMENT_PO_NO="PO-${WFULLSMOKE_MARKER_PREFIX:-WFULL}-${marker}" \
-    PROCUREMENT_CONTRACT_NO="CT-${WFULLSMOKE_MARKER_PREFIX:-WFULL}-${marker}" \
+    PROCUREMENT_REGRESSION_MARKER_PREFIX="${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}" \
+    PROCUREMENT_PO_NO="PO-${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}-${marker}" \
+    PROCUREMENT_CONTRACT_NO="CT-${WFULLSMOKE_MARKER_PREFIX:-TEST-SMOKE-WFULL}-${marker}" \
     bash "$ROOT_DIR/server/scripts/regression-procurement.sh"
 }
 
@@ -199,6 +256,8 @@ run_wecom_and_archive_chain() {
 
   run_finding_step "wauto1-evidence" env \
     WAUTO1_REPORT_DIR="$REPORT_DIR/wecom-controlled-trial-evidence" \
+    WAUTO1_EXECUTION_MODE=remote \
+    WAUTO1_REMOTE_CONTEXT=deployment-server \
     LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
     bash "$ROOT_DIR/scripts/qa/collect-wecom-controlled-trial-evidence.sh"
 }
@@ -252,14 +311,14 @@ write_manual_checklist() {
 
 ## Day 3
 - HYD000006：确认三天业务结果和 OA 历史可读性。
-- 若 WAPPR1 为 A 且外出/加班 dry-run 通过，再问答是否进入 WEXT1-LIVE。
+- 若 WAPPR1 为 A 且远端收口通过，再问答是否进入 WEXT1-FORMAL：由 SMOKE002 真机提交正式模板外出/加班测试单，系统只读校验。
 
 边界：不要记录 Secret、token、EncodingAESKey、完整 userid、完整审批单号、完整 template_id、表单值、附件、评论或原始 payload。
 EOF
 }
 
 run_privacy_smoke() {
-  local sensitive_pattern='access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
+  local sensitive_pattern='(["'\''"]?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\''"]?[[:space:]]*[:=][[:space:]]*["'\''"]?[A-Za-z0-9._:/+=-]{8,}["'\''"]?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
   local matches
   matches="$(grep -RInE "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' || true)"
   if [[ -n "$matches" ]]; then
@@ -383,10 +442,10 @@ const manualGates = [
     requiredEvidence: "四类模板均为 A：一层主管/指定审批角色自动带出，申请人不能任意选择；缺主管/不可用/自审时管理员兜底或阻断",
   },
   {
-    id: "WEXT1-LIVE",
+    id: "WEXT1-FORMAL",
     status: "PENDING_USER_APPROVAL",
     owner: "human_lead",
-    requiredEvidence: "WAPPR1=A 且 WEXT1LD dry-run 通过后，是否允许 live 创建外出/加班样件",
+    requiredEvidence: "WAPPR1=A 且 WREMOTE1/WFULLSMOKE2 可解释通过后，是否允许 SMOKE002 人工提交正式模板外出/加班测试单",
   },
   {
     id: "WREAL1",
@@ -412,6 +471,10 @@ const summary = {
   conclusion: status,
   baseURL,
   commit,
+  executionMode: process.env.WFULLSMOKE_EXECUTION_MODE || "unknown",
+  remoteContext: process.env.WFULLSMOKE_REMOTE_CONTEXT || "unknown",
+  runtimeHost: process.env.HOSTNAME || "unknown",
+  trustedIpBoundary: "Enterprise WeChat API checks must run on the deployment server; local runs are blocked by default",
   checkedAt: new Date().toISOString(),
   reportDir: path.resolve(reportDir),
   accounts: {
@@ -427,7 +490,7 @@ const summary = {
   },
   boundaries: {
     oaTestDataAllowed: true,
-    testMarkerRequired: "TEST/SMOKE/WFULL",
+    testMarkerRequired: "TEST-SMOKE-WFULL",
     noRealPayment: true,
     noErpWrite: true,
     noBankStatementImport: true,
@@ -446,15 +509,15 @@ const summary = {
       "C：必须申请人手选审批人。",
       "D：当前看不到或模板未配置。",
     ],
-    wext1Live: [
-      "A：批准一次 live 创建外出+加班 OA-POC 样件，保留审计。",
-      "B：只保留 dry-run，不创建样件。",
-      "C：外出/加班移出 V1。",
+    wext1Formal: [
+      "A：批准 SMOKE002 在正式模板提交外出+加班低风险测试单，SMOKE101 先看详情再审批，系统只读校验并保留审计。",
+      "B：只测请假/补卡/打卡，不提交外出/加班正式模板测试单。",
+      "C：暂停，先检查企微正式模板配置。",
     ],
     finalCloseout: [
-      "A：接受主路径闭环通过，进入外出/加班 live 或 WREAL1 准备。",
+      "A：接受主路径闭环通过，进入 WEXT1-FORMAL 或 WREAL1 准备问答。",
       "B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
-      "C：暂停，不进入 live、真实员工试用或镜像。",
+      "C：暂停，不进入正式模板外出/加班测试、真实员工试用或镜像。",
     ],
   },
   privacy: "status/count/report-path summaries only; no phone/email/token/Secret/EncodingAESKey/full userid/full template_id/full sp_no/form values/attachments/comments/raw payload/XML/ciphertext",