chore: establish local platform baseline

2026-08-26 06:41:54 +08:00
commit 29bdf4900f
575 changed files with 95644 additions and 0 deletions
@@ -0,0 +1,67 @@
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+$root = Split-Path -Parent $PSScriptRoot
+Set-Location -LiteralPath $root
+
+$api = 'http://localhost:58080'
+$tokenUrl = 'http://localhost:58180/realms/voice-local/protocol/openid-connect/token'
+$tenant = '10000000-0000-0000-0000-000000000010'
+$key = 'acceptance-snapshot-smoke-' + [Guid]::NewGuid().ToString('N')
+$requestID = 'acceptance-snapshot-smoke-' + [Guid]::NewGuid().ToString('N')
+$snapshot = $null
+
+function Get-Token([string]$name) {
+  (Invoke-RestMethod -Method Post -Uri $tokenUrl -ContentType 'application/x-www-form-urlencoded' -Body @{
+    grant_type = 'password'; client_id = 'voice-platform-web'; username = $name; password = 'LocalOnly123!'; scope = 'openid'
+  }).access_token
+}
+
+try {
+  $owner = Get-Token 'owner'
+  $outsider = Get-Token 'outsider'
+  $imageDigest = (docker image inspect data-terminal-cloud-api --format '{{.Id}}').Trim()
+  if ($imageDigest -notmatch '^sha256:[a-f0-9]{64}$') { throw '无法取得API候选镜像摘要' }
+  $body = @{
+    candidate_version = '0.51.0-rc.local'
+    build_digest = $imageDigest
+    environment = 'LAB'
+    run_type = 'REAL_DEVICE_PROVIDER'
+    scope = '本地真实OIDC和平台技术预检'
+    required_dependencies = @('oidc_jwks')
+    reason = '验证发布候选验收快照的真实登录、门禁聚合和归档输出'
+  } | ConvertTo-Json -Compress
+  $headers = @{Authorization = "Bearer $owner"; 'X-Tenant-Id' = $tenant; 'Idempotency-Key' = $key; 'X-Request-Id' = $requestID}
+
+  $createdResponse = Invoke-WebRequest -UseBasicParsing -Method Post -Uri "$api/api/v1/ops/diagnostics/acceptance-snapshots" -Headers $headers -ContentType 'application/json' -Body $body
+  $snapshot = ($createdResponse.Content | ConvertFrom-Json).data
+  if ($createdResponse.StatusCode -ne 201 -or $snapshot.redaction_policy -ne 'ops-acceptance-minimal-v1') { throw '验收快照首次生成结果不正确' }
+  if ($snapshot.database.migration_version -lt 36 -or $snapshot.database.dirty) { throw '验收快照未正确冻结数据库迁移状态' }
+  if (@($snapshot.external_dependencies).Count -ne 1 -or $snapshot.external_dependencies[0].dependency -ne 'oidc_jwks' -or -not $snapshot.external_dependencies[0].gate_satisfied) { throw '验收快照未正确冻结OIDC外部依赖状态' }
+  if (@($snapshot.gates).Count -ne 6) { throw '验收快照门禁数量不正确' }
+  $failedGates = @($snapshot.gates | Where-Object { -not $_.satisfied })
+  if ($snapshot.overall_gate_satisfied -ne ($failedGates.Count -eq 0)) { throw '验收快照总结果与六项门禁不一致' }
+  $blockingItems = @($snapshot.alerts.blocking_items)
+  $expectedItems = [Math]::Min([int]$snapshot.alerts.blocking, 100)
+  if ($blockingItems.Count -ne $expectedItems -or $snapshot.alerts.blocking_items_truncated -ne ($snapshot.alerts.blocking -gt 100)) { throw '阻断告警定位数量或截断标识不正确' }
+  foreach ($item in $blockingItems) {
+    if ($item.id -notmatch '^[0-9a-fA-F-]{36}$' -or -not $item.rule_code -or @('PRESENT','MISSING','AGGREGATE','UNKNOWN') -notcontains $item.resource_state) { throw '阻断告警定位字段不正确' }
+  }
+  if (($createdResponse.Content -match 'https?://') -or ($createdResponse.Content -match '"endpoint"')) { throw '验收快照泄露了外部探针端点' }
+
+  Start-Sleep -Milliseconds 550
+  $replayResponse = Invoke-WebRequest -UseBasicParsing -Method Post -Uri "$api/api/v1/ops/diagnostics/acceptance-snapshots" -Headers $headers -ContentType 'application/json' -Body $body
+  if ($replayResponse.StatusCode -ne 200 -or $replayResponse.Headers.'Idempotency-Replayed' -ne 'true' -or ($replayResponse.Content | ConvertFrom-Json).data.id -ne $snapshot.id) { throw '验收快照幂等重放不正确' }
+
+  Start-Sleep -Milliseconds 550
+  try {
+    Invoke-WebRequest -UseBasicParsing -Method Post -Uri "$api/api/v1/ops/diagnostics/acceptance-snapshots" -Headers @{Authorization = "Bearer $outsider"; 'X-Tenant-Id' = $tenant; 'Idempotency-Key' = ('outsider-' + $key)} -ContentType 'application/json' -Body $body | Out-Null
+    throw '跨客户组织生成验收快照不应成功'
+  } catch {
+    if ($null -eq $_.Exception.Response -or [int]$_.Exception.Response.StatusCode -ne 403) { throw }
+  }
+  $failedCodes = if ($failedGates.Count) { ($failedGates.code -join ',') } else { 'none' }
+  Write-Host "发布候选验收快照烟测通过：真实OIDC、迁移冻结、外部依赖、六项门禁、阻断告警定位、幂等重放、租户隔离和端点脱敏均正确；当前阻断项=$failedCodes。"
+} finally {
+  docker compose exec -T postgres psql -U voice -d voice_platform -v ON_ERROR_STOP=1 -c "BEGIN; DELETE FROM audit_event WHERE request_id='$requestID'; DELETE FROM idempotency_record WHERE idempotency_key='$key'; COMMIT;" | Out-Null
+  Write-Host '已清理验收快照烟测审计和幂等记录；快照本身不在服务端留存。'
+}