feat: expand companion platform, device controls, and memoir workflows

Add customer and operator login, BLE provisioning, device fleet controls, call memory, memoir generation, and refreshed family and maintenance portals. Include API contracts, migrations, firmware sources, tests, assets, and deployment documentation.
2026-10-08 10:06:44 +08:00
parent 98fb2965d0
commit bf1233d5df
861 changed files with 94614 additions and 3209 deletions
@@ -0,0 +1,84 @@
+package onboarding
+
+import (
+	"context"
+	"data-terminal-cloud/internal/config"
+	"errors"
+	captcha "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/captcha/v20190722"
+	"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+type fakeCaptchaAPI struct {
+	web, mini int
+	result    int64
+	err       error
+	t         *testing.T
+}
+
+func (f *fakeCaptchaAPI) DescribeCaptchaResultWithContext(_ context.Context, r *captcha.DescribeCaptchaResultRequest) (*captcha.DescribeCaptchaResultResponse, error) {
+	f.web++
+	if *r.CaptchaAppId != 123 || *r.AppSecretKey != "web-secret-123456" || *r.Randstr != "random" || *r.CaptchaType != 9 {
+		f.t.Fatal("wrong web request")
+	}
+	return &captcha.DescribeCaptchaResultResponse{Response: &captcha.DescribeCaptchaResultResponseParams{CaptchaCode: common.Int64Ptr(f.result)}}, f.err
+}
+func (f *fakeCaptchaAPI) DescribeCaptchaMiniResultWithContext(_ context.Context, r *captcha.DescribeCaptchaMiniResultRequest) (*captcha.DescribeCaptchaMiniResultResponse, error) {
+	f.mini++
+	if *r.CaptchaAppId != 456 || *r.AppSecretKey != "mini-secret-12345" || *r.CaptchaType != 9 {
+		f.t.Fatal("wrong mini request")
+	}
+	return &captcha.DescribeCaptchaMiniResultResponse{Response: &captcha.DescribeCaptchaMiniResultResponseParams{CaptchaCode: common.Int64Ptr(f.result)}}, f.err
+}
+func TestTencentCaptchaProviderSeparatesClientsAndFailsClosed(t *testing.T) {
+	f := &fakeCaptchaAPI{t: t, result: 1}
+	p := &tencentCaptchaProvider{api: f, config: config.TencentCaptchaConfig{SaaS: config.CaptchaClientConfig{AppID: "123", AppSecretKey: "web-secret-123456"}, Mini: config.CaptchaClientConfig{AppID: "456", AppSecretKey: "mini-secret-12345"}}}
+	ctx := context.Background()
+	if err := p.Verify(ctx, "saas", "ticket", "random", "203.0.113.1"); err != nil {
+		t.Fatal(err)
+	}
+	if err := p.Verify(ctx, "mini_program", "ticket", "", "203.0.113.1"); err != nil {
+		t.Fatal(err)
+	}
+	if f.web != 1 || f.mini != 1 {
+		t.Fatal("wrong API")
+	}
+	for _, code := range []int64{0, 7, 8, 9, 21, 100} {
+		f.result = code
+		if p.Verify(ctx, "saas", "ticket", "random", "203.0.113.1") == nil {
+			t.Fatal("rejection accepted", code)
+		}
+	}
+	f.result = 1
+	f.err = errors.New("contains-secret-value")
+	if err := p.Verify(ctx, "saas", "ticket", "random", "203.0.113.1"); err == nil || strings.Contains(err.Error(), "secret-value") {
+		t.Fatal("error must be closed and sanitized")
+	}
+	before := f.web
+	for _, ticket := range []string{"", "trerror_123", strings.Repeat("x", 4097)} {
+		if p.Verify(ctx, "saas", ticket, "random", "203.0.113.1") == nil {
+			t.Fatal("bad ticket accepted")
+		}
+	}
+	if f.web != before {
+		t.Fatal("bad ticket caused API call")
+	}
+}
+func TestCaptchaClientIPTrustBoundary(t *testing.T) {
+	s := &Service{options: Options{TrustedProxyCIDRs: []string{"172.18.0.0/16"}}}
+	for _, tc := range []struct{ remote, forwarded, want string }{
+		{"203.0.113.9:123", "1.1.1.1", "203.0.113.9"},
+		{"172.18.0.4:123", "1.1.1.1, 203.0.113.9", "203.0.113.9"},
+		{"172.18.0.4:123", "203.0.113.9, 172.18.0.3", "203.0.113.9"},
+		{"[2001:db8::1]:123", "1.1.1.1", "2001:db8::1"},
+	} {
+		r := httptest.NewRequest("POST", "https://example.test", nil)
+		r.RemoteAddr = tc.remote
+		r.Header.Set("X-Forwarded-For", tc.forwarded)
+		if got := s.clientIP(r); got != tc.want {
+			t.Fatalf("ip %s want %s", got, tc.want)
+		}
+	}
+}