162 lines
13 KiB
JavaScript
162 lines
13 KiB
JavaScript
|
import { createRequire } from "node:module";
|
||
|
|
import { randomUUID } from "node:crypto";
|
||
|
|
import { execFileSync } from "node:child_process";
|
||
|
|
import { mkdir } from "node:fs/promises";
|
||
|
|
import { fileURLToPath } from "node:url";
|
||
|
|
|
||
|
|
const require = createRequire(process.env.PLAYWRIGHT_REQUIRE_FROM ?? import.meta.url);
|
||
|
|
const { chromium } = require("playwright");
|
||
|
|
const outputDirectory = new URL("./screenshots/", import.meta.url);
|
||
|
|
const webURL = process.env.VISUAL_WEB_URL ?? "http://localhost:3100";
|
||
|
|
const webHostPattern = new RegExp(new URL(webURL).host.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
|
||
|
|
const oidcURLPattern = new RegExp(process.env.VISUAL_OIDC_URL_PATTERN ?? "localhost:58180");
|
||
|
|
const username = process.env.VISUAL_USERNAME ?? "owner";
|
||
|
|
const password = process.env.VISUAL_PASSWORD ?? "LocalOnly123!";
|
||
|
|
const contextID = randomUUID();
|
||
|
|
const contextPublicID = randomUUID();
|
||
|
|
const conversationID = randomUUID();
|
||
|
|
const conversationPublicID = randomUUID();
|
||
|
|
const segmentID = randomUUID();
|
||
|
|
const segmentPublicID = randomUUID();
|
||
|
|
const playGrantID = randomUUID();
|
||
|
|
const playGrantPublicID = randomUUID();
|
||
|
|
const downloadGrantID = randomUUID();
|
||
|
|
const downloadGrantPublicID = randomUUID();
|
||
|
|
const consentID = randomUUID();
|
||
|
|
const consentPublicID = randomUUID();
|
||
|
|
const exportID = randomUUID();
|
||
|
|
const exportPublicID = randomUUID();
|
||
|
|
const fixtureMarker = segmentPublicID.slice(0, 8);
|
||
|
|
const subjectPublicID = "10000000-0000-0000-0000-000000000411";
|
||
|
|
await mkdir(outputDirectory, { recursive: true });
|
||
|
|
|
||
|
|
function psql(statement) {
|
||
|
|
return execFileSync("docker", ["compose", "exec", "-T", "postgres", "psql", "-v", "ON_ERROR_STOP=1", "-U", "voice", "-d", "voice_platform", "-Atc", statement], {
|
||
|
|
cwd: process.cwd(), encoding: "utf8", stdio: ["ignore", "pipe", "pipe"]
|
||
|
|
}).trim();
|
||
|
|
}
|
||
|
|
|
||
|
|
function cleanup() {
|
||
|
|
psql(`BEGIN;
|
||
|
|
DELETE FROM media_access_log WHERE media_segment_id='${segmentID}'::uuid;
|
||
|
|
DELETE FROM media_segment WHERE id='${segmentID}'::uuid;
|
||
|
|
DELETE FROM recording_access_grant WHERE id IN ('${playGrantID}'::uuid,'${downloadGrantID}'::uuid);
|
||
|
|
DELETE FROM consent_record WHERE id='${consentID}'::uuid;
|
||
|
|
DELETE FROM conversation_state_history WHERE conversation_id='${conversationID}'::uuid;
|
||
|
|
DELETE FROM conversation WHERE id='${conversationID}'::uuid;
|
||
|
|
DELETE FROM context_snapshot WHERE id='${contextID}'::uuid;
|
||
|
|
DELETE FROM export_task WHERE id='${exportID}'::uuid;
|
||
|
|
COMMIT;`);
|
||
|
|
}
|
||
|
|
|
||
|
|
psql(`BEGIN;
|
||
|
|
INSERT INTO context_snapshot(id,public_id,tenant_id,subject_id,profile_version,consent_snapshot_id,memory_versions,prompt_bundle_version,engine_mode,content_digest,sanitized_summary,preparation_status)
|
||
|
|
VALUES('${contextID}'::uuid,'${contextPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'10000000-0000-0000-0000-000000000401'::uuid,1,'10000000-0000-0000-0000-000000000701'::uuid,'[]'::jsonb,'visual-sensitive-address-v1','s2s_hybrid',repeat('0',64),'浏览器敏感地址受控操作夹具','READY');
|
||
|
|
INSERT INTO conversation(id,public_id,tenant_id,household_id,subject_id,device_id,consent_snapshot_id,context_snapshot_id,provider_task_ref,engine_mode,retention_mode,status,allocation_expires_at,started_at,ended_at,stop_reason,created_at)
|
||
|
|
VALUES('${conversationID}'::uuid,'${conversationPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'10000000-0000-0000-0000-000000000201'::uuid,'10000000-0000-0000-0000-000000000401'::uuid,'10000000-0000-0000-0000-000000000501'::uuid,'10000000-0000-0000-0000-000000000701'::uuid,'${contextID}'::uuid,'visual-sensitive-address-${fixtureMarker}','s2s_hybrid','transcript_and_audio','COMPLETED',now()+interval '5 minutes',now()-interval '3 minutes',now()-interval '2 minutes','user_hangup',now()+interval '1 second');
|
||
|
|
INSERT INTO conversation_state_history(conversation_id,from_status,to_status,reason,source,occurred_at)
|
||
|
|
VALUES('${conversationID}'::uuid,NULL,'ROOM_ISSUED','visual fixture','platform',now()-interval '3 minutes'),('${conversationID}'::uuid,'ROOM_ISSUED','ACTIVE','visual fixture','provider',now()-interval '170 seconds'),('${conversationID}'::uuid,'ACTIVE','COMPLETED','visual fixture','device',now()-interval '2 minutes');
|
||
|
|
INSERT INTO consent_record(id,public_id,tenant_id,subject_id,consent_type,scope,policy_version,notice_digest,actor_user_id,evidence_ref,granted_at)
|
||
|
|
VALUES('${consentID}'::uuid,'${consentPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'10000000-0000-0000-0000-000000000401'::uuid,'raw_audio_storage','{}'::jsonb,'visual-sensitive-address-v1',repeat('a',64),'10000000-0000-0000-0000-000000000101'::uuid,'visual://sensitive-address',now()-interval '10 minutes');
|
||
|
|
INSERT INTO recording_access_grant(id,public_id,tenant_id,subject_id,grantee_user_id,permission,purpose,granted_by,granted_at,expires_at)
|
||
|
|
VALUES
|
||
|
|
('${playGrantID}'::uuid,'${playGrantPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'10000000-0000-0000-0000-000000000401'::uuid,'10000000-0000-0000-0000-000000000101'::uuid,'PLAY','页面敏感地址检查-${fixtureMarker}','10000000-0000-0000-0000-000000000101'::uuid,now()-interval '10 minutes',now()+interval '2 hours'),
|
||
|
|
('${downloadGrantID}'::uuid,'${downloadGrantPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'10000000-0000-0000-0000-000000000401'::uuid,'10000000-0000-0000-0000-000000000101'::uuid,'DOWNLOAD','页面敏感地址检查-${fixtureMarker}','10000000-0000-0000-0000-000000000101'::uuid,now()-interval '10 minutes',now()+interval '2 hours');
|
||
|
|
INSERT INTO media_segment(id,public_id,tenant_id,conversation_id,device_id,track,sequence_no,codec,content_type,duration_ms,expected_size,expected_digest,object_ref,status,verified_at,local_delete_after)
|
||
|
|
VALUES('${segmentID}'::uuid,'${segmentPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'${conversationID}'::uuid,'10000000-0000-0000-0000-000000000501'::uuid,'near',987654,'pcm_s16le','audio/wav',12300,98765,repeat('b',64),'visual/sensitive-address/${segmentPublicID}.wav','VERIFIED',now()-interval '1 minute',now()+interval '1 hour');
|
||
|
|
INSERT INTO export_task(id,public_id,tenant_id,subject_id,requested_by,scope,status,object_ref,object_size,content_digest,expires_at,attempts,idempotency_key,request_digest,completed_at,created_at,updated_at)
|
||
|
|
VALUES('${exportID}'::uuid,'${exportPublicID}'::uuid,'10000000-0000-0000-0000-000000000001'::uuid,'10000000-0000-0000-0000-000000000401'::uuid,'10000000-0000-0000-0000-000000000101'::uuid,'{"categories":["profile","consents","device_bindings","conversations","transcripts","summaries","stories","memories"]}'::jsonb,'READY','visual/sensitive-address/${exportPublicID}.json',98765,repeat('c',64),now()+interval '2 hours',1,'visual-sensitive-address-${exportPublicID}',repeat('d',64),now()-interval '1 minute',now()-interval '2 minutes',now()-interval '1 minute');
|
||
|
|
COMMIT;`);
|
||
|
|
|
||
|
|
const mediaLogBefore = Number(psql(`SELECT count(*) FROM media_access_log WHERE media_segment_id='${segmentID}'::uuid;`));
|
||
|
|
const exportCountBefore = Number(psql(`SELECT count(*) FROM export_task WHERE id='${exportID}'::uuid;`));
|
||
|
|
const browser = await chromium.launch({ headless: true, executablePath: process.env.CHROME_PATH ?? "C:/Program Files/Google/Chrome/Application/chrome.exe" });
|
||
|
|
const page = await browser.newPage({ viewport: { width: 1440, height: 1050 }, deviceScaleFactor: 1 });
|
||
|
|
const consoleErrors = [];
|
||
|
|
const failedRequests = [];
|
||
|
|
const sensitiveRequests = [];
|
||
|
|
page.on("console", (message) => { if (message.type() === "error") consoleErrors.push(message.text()); });
|
||
|
|
page.on("request", (request) => {
|
||
|
|
const requestURL = new URL(request.url());
|
||
|
|
if (request.method() === "POST" && /^\/api\/v1\/media-segments\/[^/]+\/access$/.test(requestURL.pathname)) sensitiveRequests.push(`${request.method()} ${requestURL.pathname}`);
|
||
|
|
if (request.method() === "GET" && requestURL.pathname === `/api/v1/exports/${exportPublicID}`) sensitiveRequests.push(`${request.method()} ${requestURL.pathname}`);
|
||
|
|
});
|
||
|
|
page.on("requestfailed", (request) => {
|
||
|
|
const failure = request.failure()?.errorText ?? "failed";
|
||
|
|
const requestURL = new URL(request.url());
|
||
|
|
if (request.method() === "GET" && requestURL.pathname === "/api/v1/events" && failure.includes("ERR_ABORTED")) return;
|
||
|
|
failedRequests.push(`${request.method()} ${request.url()} ${failure}`);
|
||
|
|
});
|
||
|
|
|
||
|
|
try {
|
||
|
|
await page.goto(webURL, { waitUntil: "networkidle" });
|
||
|
|
await page.getByRole("button", { name: "登录研发环境" }).click();
|
||
|
|
await page.waitForURL(oidcURLPattern);
|
||
|
|
await page.locator("#username").fill(username);
|
||
|
|
await page.locator("#password").fill(password);
|
||
|
|
await page.locator("#kc-login").click();
|
||
|
|
await page.waitForURL(webHostPattern, { timeout: 15000 });
|
||
|
|
await page.getByRole("heading", { name: "家庭业务工作台" }).waitFor();
|
||
|
|
|
||
|
|
await page.getByRole("button", { name: "通话记录", exact: true }).click();
|
||
|
|
const conversationRow = page.locator(".conversation-row").first();
|
||
|
|
await conversationRow.waitFor();
|
||
|
|
await conversationRow.click();
|
||
|
|
const segmentRow = page.locator(".recording-segment").filter({ hasText: "#987654" });
|
||
|
|
await segmentRow.waitFor();
|
||
|
|
|
||
|
|
await segmentRow.getByRole("button", { name: "播放", exact: true }).click();
|
||
|
|
let form = page.getByRole("form", { name: "家庭业务受控操作" });
|
||
|
|
await form.waitFor();
|
||
|
|
let text = await form.textContent();
|
||
|
|
const playTargetBound = text?.includes(subjectPublicID) === true && text?.includes(conversationPublicID) === true && text?.includes(segmentPublicID) === true && text?.includes("近端（长者） #987654") === true && text?.includes("家庭回听") === true && text?.includes("5分钟") === true;
|
||
|
|
let action = form.getByRole("button", { name: "确认并获取播放地址" });
|
||
|
|
const playNeedsAcknowledgement = await action.isDisabled();
|
||
|
|
await form.getByLabel(/本次只为固定录音分片申请5分钟播放地址/).check();
|
||
|
|
const playEnabled = await action.isEnabled();
|
||
|
|
await form.getByRole("button", { name: "取消" }).click();
|
||
|
|
const playCancelClosed = await form.count() === 0;
|
||
|
|
|
||
|
|
await segmentRow.getByRole("button", { name: "下载", exact: true }).click();
|
||
|
|
form = page.getByRole("form", { name: "家庭业务受控操作" });
|
||
|
|
await form.waitFor();
|
||
|
|
text = await form.textContent();
|
||
|
|
const recordingDownloadTargetBound = text?.includes(subjectPublicID) === true && text?.includes(conversationPublicID) === true && text?.includes(segmentPublicID) === true && text?.includes("文件下载地址") === true && text?.includes("访问审计") === true;
|
||
|
|
action = form.getByRole("button", { name: "确认并下载录音" });
|
||
|
|
const recordingDownloadNeedsAcknowledgement = await action.isDisabled();
|
||
|
|
await form.getByLabel(/本次将下载固定录音分片/).check();
|
||
|
|
const recordingDownloadEnabled = await action.isEnabled();
|
||
|
|
await form.screenshot({ path: fileURLToPath(new URL("family-recording-download-address-control.png", outputDirectory)) });
|
||
|
|
await form.getByRole("button", { name: "取消" }).click();
|
||
|
|
const recordingDownloadCancelClosed = await form.count() === 0;
|
||
|
|
|
||
|
|
await page.getByRole("button", { name: "隐私请求" }).click();
|
||
|
|
const exportRow = page.locator(".privacy-exports .data-row").filter({ hasText: "97 KB" }).first();
|
||
|
|
await exportRow.waitFor();
|
||
|
|
await exportRow.getByRole("button", { name: "获取短期下载" }).click();
|
||
|
|
form = page.getByRole("form", { name: "家庭业务受控操作" });
|
||
|
|
await form.waitFor();
|
||
|
|
text = await form.textContent();
|
||
|
|
const exportDownloadTargetBound = text?.includes(subjectPublicID) === true && text?.includes(exportPublicID) === true && text?.includes("共8类") === true && text?.includes("96.5 KB") === true && text?.includes("只有仍为可下载时才签发短期地址") === true;
|
||
|
|
action = form.getByRole("button", { name: "确认并下载私有导出" });
|
||
|
|
const exportDownloadNeedsAcknowledgement = await action.isDisabled();
|
||
|
|
await form.getByLabel(/固定私有导出任务申请短期下载地址/).check();
|
||
|
|
const exportDownloadEnabled = await action.isEnabled();
|
||
|
|
await form.screenshot({ path: fileURLToPath(new URL("family-private-export-download-control.png", outputDirectory)) });
|
||
|
|
await form.getByRole("button", { name: "取消" }).click();
|
||
|
|
const exportDownloadCancelClosed = await form.count() === 0;
|
||
|
|
|
||
|
|
const mediaLogUnchanged = Number(psql(`SELECT count(*) FROM media_access_log WHERE media_segment_id='${segmentID}'::uuid;`)) === mediaLogBefore;
|
||
|
|
const exportTaskUnchanged = Number(psql(`SELECT count(*) FROM export_task WHERE id='${exportID}'::uuid;`)) === exportCountBefore;
|
||
|
|
const overflow = await page.evaluate(() => [...document.querySelectorAll("body *")]
|
||
|
|
.filter((element) => element instanceof HTMLElement && element.scrollWidth > element.clientWidth + 2 && getComputedStyle(element).overflowX === "visible")
|
||
|
|
.slice(0, 20)
|
||
|
|
.map((element) => `${element.tagName}.${element.className}: ${element.clientWidth}/${element.scrollWidth}`));
|
||
|
|
const result = { playTargetBound, playNeedsAcknowledgement, playEnabled, playCancelClosed, recordingDownloadTargetBound, recordingDownloadNeedsAcknowledgement, recordingDownloadEnabled, recordingDownloadCancelClosed, exportDownloadTargetBound, exportDownloadNeedsAcknowledgement, exportDownloadEnabled, exportDownloadCancelClosed, mediaLogUnchanged, exportTaskUnchanged, sensitiveRequests, overflow, consoleErrors, failedRequests };
|
||
|
|
console.log(JSON.stringify(result, null, 2));
|
||
|
|
if (Object.entries(result).some(([key, value]) => !["sensitiveRequests", "overflow", "consoleErrors", "failedRequests"].includes(key) && value !== true) || sensitiveRequests.length || overflow.length || consoleErrors.length || failedRequests.length) throw new Error("Family sensitive address controls visual smoke failed");
|
||
|
|
} finally {
|
||
|
|
await browser.close();
|
||
|
|
cleanup();
|
||
|
|
}
|