256 行
15 KiB
JavaScript
256 行
15 KiB
JavaScript
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import crypto from "node:crypto";
|
|
import assert from "node:assert/strict";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import { spawnSync } from "node:child_process";
|
|
|
|
const require = createRequire(import.meta.url);
|
|
const ts = require("../../client/node_modules/typescript");
|
|
const root = fileURLToPath(new URL("../../", import.meta.url));
|
|
const primaryFiles = new Set([
|
|
"server/src/routes/paymentBatches.js", "server/src/routes/reimbursements.js",
|
|
"server/src/routes/leave.js", "server/src/services/leave.js",
|
|
"server/src/routes/attendanceCorrections.js",
|
|
]);
|
|
const primaryInvoiceOperations = new Set(["/invoice-pool/:id/bind", "/invoice-pool/:id/unbind", "function:resolveInvoiceLinkedItem"]);
|
|
|
|
export function operationFor(node) {
|
|
for (let parent = node.parent; parent; parent = parent.parent) {
|
|
if (ts.isCallExpression(parent) && ts.isPropertyAccessExpression(parent.expression) && ["get", "post", "patch", "delete"].includes(parent.expression.name.text) && literal(parent.arguments[0])?.startsWith("/")) return literal(parent.arguments[0]);
|
|
if (ts.isFunctionDeclaration(parent)) return `function:${parent.name?.text ?? "anonymous"}`;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function isPrimary(entry) {
|
|
return primaryFiles.has(entry.file) || (entry.file === "server/src/routes/invoicePool.js" && primaryInvoiceOperations.has(entry.operation));
|
|
}
|
|
|
|
function legacyKey(entry) {
|
|
return `${entry.file}:${entry.operation ?? "module"}:${entry.fingerprint}`;
|
|
}
|
|
|
|
function parse(file, source) {
|
|
const tree = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
|
|
if (tree.parseDiagnostics.length) throw new Error("source_parse_failed");
|
|
return tree;
|
|
}
|
|
|
|
function visit(node, callback) {
|
|
callback(node);
|
|
ts.forEachChild(node, (child) => visit(child, callback));
|
|
}
|
|
|
|
function shape(node) {
|
|
if (ts.isParenthesizedExpression(node)) return shape(node.expression);
|
|
const children = [];
|
|
ts.forEachChild(node, (child) => { children.push(shape(child)); });
|
|
return [node.kind, typeof node.text === "string" ? node.text : null, children];
|
|
}
|
|
|
|
export function fingerprint(node) {
|
|
return crypto.createHash("sha256").update(JSON.stringify(shape(node))).digest("hex");
|
|
}
|
|
|
|
function literal(node) {
|
|
return node && ts.isStringLiteralLike(node) ? node.text : null;
|
|
}
|
|
|
|
function properties(node) {
|
|
if (!node || !ts.isObjectLiteralExpression(node)) return {};
|
|
return Object.fromEntries(node.properties.filter(ts.isPropertyAssignment).map((property) => [property.name.text, literal(property.initializer)]));
|
|
}
|
|
|
|
function isSafeMessage(value) {
|
|
return typeof value === "string" && /[\u3400-\u9fff]/.test(value)
|
|
&& !/参数校验失败|https?:\/\/|\/api\/|(?:^|\s)\/[A-Za-z0-9._-]+|[A-Za-z]:\\|^\s*[\[{]|\d{12,}|\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i.test(value);
|
|
}
|
|
|
|
function declarations(source, name) {
|
|
let value;
|
|
visit(parse("contract.ts", source), (node) => {
|
|
if (ts.isVariableDeclaration(node) && node.name.text === name) {
|
|
if (value) throw new Error("duplicate_contract_declaration");
|
|
value = node.initializer;
|
|
}
|
|
});
|
|
if (!value) throw new Error("missing_contract_declaration");
|
|
return value;
|
|
}
|
|
|
|
export function inventory(sources) {
|
|
const legacy = [];
|
|
const used = [];
|
|
for (const [file, source] of Object.entries(sources)) {
|
|
const tree = parse(file, source);
|
|
const aliases = new Map();
|
|
visit(tree, (node) => {
|
|
if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && ts.isIdentifier(node.initializer)) aliases.set(node.name.text, node.initializer.text);
|
|
if (ts.isBindingElement(node) && node.propertyName && ts.isIdentifier(node.name)) aliases.set(node.name.text, node.propertyName.text);
|
|
if (ts.isImportSpecifier(node) && node.propertyName) aliases.set(node.name.text, node.propertyName.text);
|
|
});
|
|
visit(tree, (node) => {
|
|
if (!ts.isCallExpression(node) && !ts.isNewExpression(node)) return;
|
|
let name = ts.isIdentifier(node.expression) ? node.expression.text : node.expression.name?.text;
|
|
const visitedNames = new Set();
|
|
while (aliases.has(name) && !visitedNames.has(name)) { visitedNames.add(name); name = aliases.get(name); }
|
|
if (name === "buildBusinessValidationError" || name === "addPaymentReadinessBlocker") {
|
|
const argument = node.arguments?.[0];
|
|
const registryValidated = argument && ts.isPropertyAccessExpression(argument) && argument.name.text === "code"
|
|
&& ts.isCallExpression(argument.expression) && argument.expression.expression.getText() === "getErrorReason";
|
|
if (!registryValidated) used.push({ file, code: literal(argument) });
|
|
}
|
|
const errorProperties = properties(node.arguments?.[0]);
|
|
let containsValidationCode = false;
|
|
const codeExpression = node.arguments?.[0]?.properties?.find((property) => property.name?.text === "code")?.initializer;
|
|
if (codeExpression) visit(codeExpression, (child) => { if (literal(child) === "VALID_001") containsValidationCode = true; });
|
|
const appError = name === "AppError" && (containsValidationCode || errorProperties.message === "参数校验失败");
|
|
if (!/^build(?!Business).*ValidationError$/.test(name ?? "") && !appError) return;
|
|
const errorDetails = node.arguments?.[0]?.properties?.find((property) => property.name?.text === "details")?.initializer;
|
|
const reasonProperty = errorDetails?.properties?.find((property) => property.name?.text === "reasonCode");
|
|
if (file === "server/src/utils/businessValidationError.js" && appError && operationFor(node) === "function:buildBusinessValidationError"
|
|
&& reasonProperty?.initializer?.getText(tree) === "reason.code") return;
|
|
legacy.push({ file, fingerprint: fingerprint(node), operation: operationFor(node) });
|
|
});
|
|
}
|
|
return { legacy, used };
|
|
}
|
|
|
|
function sourceFiles(directory) {
|
|
return fs.readdirSync(path.join(root, directory), { withFileTypes: true }).flatMap((entry) => {
|
|
const file = `${directory}/${entry.name}`;
|
|
return entry.isDirectory() ? sourceFiles(file) : /\.[cm]?[jt]sx?$/.test(file) ? [file] : [];
|
|
});
|
|
}
|
|
|
|
export function repositoryInput() {
|
|
return {
|
|
registry: fs.readFileSync(path.join(root, "server/src/constants/errorReasons.js"), "utf8"),
|
|
mapping: fs.readFileSync(path.join(root, "client/src/api/errorReasons.ts"), "utf8"),
|
|
expectedMessages: JSON.parse(fs.readFileSync(path.join(root, "server/tests/unit/fixtures/error-reason-messages.json"), "utf8")),
|
|
sources: Object.fromEntries(sourceFiles("server/src").map((file) => [file, fs.readFileSync(path.join(root, file), "utf8")])),
|
|
baseline: JSON.parse(fs.readFileSync(path.join(root, "scripts/qa/error-reason-legacy-baseline.json"), "utf8")),
|
|
};
|
|
}
|
|
|
|
export function check(input) {
|
|
const findings = [];
|
|
const add = (kind, extra = {}) => findings.push({ kind, ...extra });
|
|
const registered = new Set();
|
|
const rows = [...declarations(input.registry, "ERROR_REASONS").elements].map(properties);
|
|
if (!rows.length) add("empty_registry");
|
|
for (const row of rows) {
|
|
if (registered.has(row.code)) add("duplicate_reason", { code: row.code });
|
|
registered.add(row.code);
|
|
if (input.expectedMessages?.[row.code] !== row.defaultMessage) add("missing_content_assertion", { code: row.code });
|
|
if (!/^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/.test(row.code ?? "") || row.domain !== row.code?.split(".")[0]
|
|
|| !["user", "internal"].includes(row.audience) || !row.recovery || !isSafeMessage(row.defaultMessage)) add("invalid_registry_metadata");
|
|
}
|
|
const mapped = new Set();
|
|
for (const entry of declarations(input.mapping, "ERROR_REASON_MESSAGES").properties) {
|
|
const code = entry.name?.text;
|
|
if (mapped.has(code)) add("duplicate_mapping", { code });
|
|
mapped.add(code);
|
|
if (!registered.has(code)) add("orphan_mapping", { code });
|
|
if (!isSafeMessage(literal(entry.initializer))) add("unsafe_mapping", { code });
|
|
}
|
|
for (const row of rows) if (row.audience === "user" && !mapped.has(row.code)) add("missing_mapping", { code: row.code });
|
|
for (const code of Object.keys(input.expectedMessages ?? {})) if (!registered.has(code)) add("orphan_content_assertion", { code });
|
|
const { legacy, used } = inventory(input.sources);
|
|
for (const use of used) if (!registered.has(use.code)) add("unregistered_reason", use);
|
|
if (input.baseline.version !== 1) add("invalid_baseline_version");
|
|
const remaining = new Map();
|
|
const today = new Date().toISOString().slice(0, 10);
|
|
for (const entry of input.baseline.entries ?? []) {
|
|
const key = legacyKey(entry);
|
|
if (isPrimary(entry)) add("primary_exception_forbidden", { file: entry.file });
|
|
const expiresAt = Date.parse(`${entry.expiresOn}T00:00:00Z`);
|
|
if (!entry.owner || !entry.reason || !/^\d{4}-\d{2}-\d{2}$/.test(entry.expiresOn ?? "") || !Number.isFinite(expiresAt)
|
|
|| new Date(expiresAt).toISOString().slice(0, 10) !== entry.expiresOn || !Number.isSafeInteger(entry.count) || entry.count < 1) add("invalid_exception", { file: entry.file });
|
|
if (entry.expiresOn <= today) add("expired_exception", { file: entry.file });
|
|
if (remaining.has(key)) add("duplicate_exception", { file: entry.file });
|
|
remaining.set(key, entry.count);
|
|
}
|
|
for (const entry of legacy) {
|
|
if (isPrimary(entry)) add("primary_legacy_forbidden", { file: entry.file });
|
|
const key = legacyKey(entry);
|
|
const count = remaining.get(key) ?? 0;
|
|
if (count < 1) add("new_legacy", { file: entry.file });
|
|
else remaining.set(key, count - 1);
|
|
}
|
|
for (const [key, count] of remaining) if (count > 0) add("stale_exception", { file: key.split(":")[0] });
|
|
const domains = {};
|
|
const domain = (name) => domains[name] ??= { registered: 0, migrated: 0, legacy: 0, expired: 0 };
|
|
for (const row of rows) domain(row.domain).registered += 1;
|
|
for (const use of used) domain(use.code?.split(".")[0] ?? "unresolved").migrated += 1;
|
|
for (const entry of legacy) domain(path.basename(entry.file, path.extname(entry.file))).legacy += 1;
|
|
for (const entry of input.baseline.entries ?? []) if (entry.expiresOn <= today) domain(path.basename(entry.file, path.extname(entry.file))).expired += entry.count;
|
|
return { pass: findings.length === 0, registered: rows.length, migrated: used.length, legacy: legacy.length, primaryExceptions: (input.baseline.entries ?? []).filter(isPrimary).length, domains, findings };
|
|
}
|
|
|
|
function selfTest() {
|
|
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "error-reason-contract-"));
|
|
const registry = 'const ERROR_REASONS = [{code:"first.required",domain:"first",audience:"user",defaultMessage:"请补充资料。",recovery:"edit"},{code:"second.required",domain:"second",audience:"user",defaultMessage:"请确认审核人。",recovery:"edit"}];';
|
|
const mapping = 'const ERROR_REASON_MESSAGES = {"first.required":"请补充资料。","second.required":"请确认审核人。"};';
|
|
const legacySource = 'throw buildValidationError({status:"old"}, 409);';
|
|
const sourceFile = "server/src/routes/legacy.js";
|
|
const sample = inventory({ [sourceFile]: legacySource }).legacy[0];
|
|
const base = { registry, mapping, sources: { [sourceFile]: legacySource, "server/src/routes/example.js": 'buildBusinessValidationError("first.required", {status:"same"}); buildBusinessValidationError("second.required", {status:"same"});' }, baseline: { version: 1, entries: [{ ...sample, count: 1, owner: "task-owner", reason: "deferred domain", expiresOn: "2099-01-01" }] } };
|
|
base.expectedMessages = { "first.required": "请补充资料。", "second.required": "请确认审核人。" };
|
|
const cases = [
|
|
["valid-cross-domain", () => {}, true],
|
|
["unregistered", (input) => { input.sources[sourceFile] += 'buildBusinessValidationError("missing.required");'; }, false],
|
|
["missing-mapping", (input) => { input.mapping = mapping.replace('"second.required":"请确认审核人。"', ''); }, false],
|
|
["typo", (input) => { input.mapping = mapping.replace("second.required", "second.requird"); }, false],
|
|
["new-legacy", (input) => { input.sources[sourceFile] += legacySource; }, false],
|
|
["structural-change", (input) => { input.sources[sourceFile] = legacySource.replace('"old"', '"new"'); }, false],
|
|
["expired", (input) => { input.baseline.entries[0].expiresOn = "2000-01-01"; }, false],
|
|
["one-added-one-removed", (input) => { input.sources[sourceFile] = 'buildValidationError({status:"replacement"}, 409);'; }, false],
|
|
["formatting-stable", (input) => { input.sources[sourceFile] = "throw buildValidationError(\n { status: 'old', },\n 409,\n);"; }, true],
|
|
["primary-exception", (input) => { input.sources["server/src/routes/paymentBatches.js"] = legacySource; input.baseline.entries.push({ ...input.baseline.entries[0], file: "server/src/routes/paymentBatches.js" }); }, false],
|
|
["duplicate-registry", (input) => { input.registry = registry.replace('code:"second.required",domain:"second"', 'code:"first.required",domain:"first"'); }, false],
|
|
["dynamic-reason", (input) => { input.sources[sourceFile] += 'buildBusinessValidationError(variable);'; }, false],
|
|
["missing-content-assertion", (input) => { delete input.expectedMessages["first.required"]; }, false],
|
|
["aliased-legacy", (input) => { input.sources[sourceFile] += 'const reject = buildValidationError; reject({status:"new"});'; }, false],
|
|
["aliased-unregistered", (input) => { input.sources[sourceFile] += 'const reject = buildBusinessValidationError; reject("first.typo");'; }, false],
|
|
["invalid-expiry", (input) => { input.baseline.entries[0].expiresOn = "2099-02-31"; }, false],
|
|
["moved-operation", (input) => { input.sources[sourceFile] = `function moved() { ${legacySource} }`; }, false],
|
|
["conditional-validation-code", (input) => { input.sources[sourceFile] += 'new AppError({code: condition ? "VALID_001" : "OTHER", message:"参数校验失败"});'; }, false],
|
|
["unsafe-client-message", (input) => { input.mapping = mapping.replace("请补充资料。", "请补充资料 /api/private"); }, false],
|
|
["unsafe-registry-message", (input) => { input.registry = registry.replace("请补充资料。", "请补充资料 /api/private"); input.expectedMessages["first.required"] = "请补充资料 /api/private"; }, false],
|
|
];
|
|
try {
|
|
for (const [name, mutate, expectedPass] of cases) {
|
|
const input = structuredClone(base);
|
|
mutate(input);
|
|
const file = path.join(directory, "fixture.json");
|
|
fs.writeFileSync(file, JSON.stringify(input));
|
|
const result = spawnSync(process.execPath, [fileURLToPath(import.meta.url), "--fixture", file], { encoding: "utf8" });
|
|
assert.equal(result.status, expectedPass ? 0 : 1, name);
|
|
assert.equal(JSON.parse(result.stdout).pass, expectedPass, name);
|
|
console.log(`${name}: PASS (exit=${result.status})`);
|
|
}
|
|
} finally {
|
|
fs.rmSync(directory, { recursive: true, force: true });
|
|
}
|
|
}
|
|
|
|
if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
|
try {
|
|
if (process.argv.includes("--self-test")) selfTest();
|
|
else {
|
|
const fixtureIndex = process.argv.indexOf("--fixture");
|
|
const input = fixtureIndex >= 0 ? JSON.parse(fs.readFileSync(process.argv[fixtureIndex + 1], "utf8")) : repositoryInput();
|
|
const report = check(input);
|
|
console.log(JSON.stringify(report, null, 2));
|
|
process.exitCode = report.pass ? 0 : 1;
|
|
}
|
|
} catch {
|
|
console.log(JSON.stringify({ pass: false, findings: [{ kind: "contract_scan_failed" }] }));
|
|
process.exitCode = 1;
|
|
}
|
|
}
|