143 lines
8.0 KiB
Go
143 lines
8.0 KiB
Go
package sharing
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"data-terminal-cloud/internal/audit"
|
|
"data-terminal-cloud/internal/identity"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
type sharingIntegrationStore struct{}
|
|
|
|
func (*sharingIntegrationStore) PresignMediaDownload(context.Context, string, time.Duration, string, string, bool) (string, error) {
|
|
return "https://objects.invalid/shared-media", nil
|
|
}
|
|
|
|
func TestTranscriptSharingLoginAndAnonymousLifecycle(t *testing.T) {
|
|
databaseURL := os.Getenv("TEST_DATABASE_URL")
|
|
if databaseURL == "" {
|
|
t.Skip("TEST_DATABASE_URL is not set")
|
|
}
|
|
ctx := context.Background()
|
|
pool, err := pgxpool.New(ctx, databaseURL)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer pool.Close()
|
|
if _, err := NewService(nil, audit.NewRepository(), &sharingIntegrationStore{}, []byte(strings.Repeat("s", 32)), time.Minute); err == nil {
|
|
t.Fatal("nil database pool was accepted")
|
|
}
|
|
service, err := NewService(pool, audit.NewRepository(), &sharingIntegrationStore{}, []byte(strings.Repeat("s", 32)), 5*time.Minute)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
owner := identity.Principal{Issuer: "http://localhost:58180/realms/voice-local", Subject: "00000000-0000-0000-0000-000000000101"}
|
|
editor := identity.Principal{Issuer: owner.Issuer, Subject: "00000000-0000-0000-0000-000000000102"}
|
|
outsider := identity.Principal{Issuer: owner.Issuer, Subject: "00000000-0000-0000-0000-000000000103"}
|
|
contextID, contextPublicID := uuid.NewString(), uuid.NewString()
|
|
conversationID, conversationPublicID := uuid.NewString(), uuid.NewString()
|
|
loginKey, anonymousKey := "sharing-integration-login-"+uuid.NewString(), "sharing-integration-anonymous-"+uuid.NewString()
|
|
grantIDs := []string{}
|
|
defer func() {
|
|
_, _ = pool.Exec(ctx, `DELETE FROM audit_event WHERE request_id LIKE 'sharing-integration-%'`)
|
|
_, _ = pool.Exec(ctx, `DELETE FROM idempotency_record WHERE scope='sharing-grant.create' AND idempotency_key=ANY($1::text[])`, []string{loginKey, anonymousKey})
|
|
if len(grantIDs) > 0 {
|
|
_, _ = pool.Exec(ctx, `DELETE FROM sharing_grant WHERE public_id=ANY($1::uuid[])`, grantIDs)
|
|
}
|
|
_, _ = pool.Exec(ctx, `DELETE FROM conversation_turn WHERE conversation_id=$1::uuid`, conversationID)
|
|
_, _ = pool.Exec(ctx, `DELETE FROM conversation WHERE id=$1::uuid`, conversationID)
|
|
_, _ = pool.Exec(ctx, `DELETE FROM context_snapshot WHERE id=$1::uuid`, contextID)
|
|
}()
|
|
if _, err := pool.Exec(ctx, `
|
|
INSERT INTO context_snapshot(id,public_id,tenant_id,subject_id,profile_version,consent_snapshot_id,memory_versions,prompt_bundle_version,engine_mode,content_digest,sanitized_summary)
|
|
VALUES($1::uuid,$2::uuid,'10000000-0000-0000-0000-000000000001','10000000-0000-0000-0000-000000000401',1,
|
|
'10000000-0000-0000-0000-000000000701','[]','sharing-integration-v1','s2s_hybrid',$3,'合成分享上下文')`,
|
|
contextID, contextPublicID, strings.Repeat("f", 64)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := pool.Exec(ctx, `
|
|
INSERT INTO conversation(id,public_id,tenant_id,household_id,subject_id,device_id,consent_snapshot_id,context_snapshot_id,
|
|
provider_task_ref,engine_mode,retention_mode,status,allocation_expires_at,started_at,ended_at,stop_reason)
|
|
VALUES($1::uuid,$2::uuid,'10000000-0000-0000-0000-000000000001','10000000-0000-0000-0000-000000000201',
|
|
'10000000-0000-0000-0000-000000000401','10000000-0000-0000-0000-000000000501',
|
|
'10000000-0000-0000-0000-000000000701',$3::uuid,$4,'s2s_hybrid','transcript_only','COMPLETED',now(),now()-interval '2 minutes',now(),'user_hangup')`,
|
|
conversationID, conversationPublicID, contextID, "sharing-task-"+conversationID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := pool.Exec(ctx, `
|
|
INSERT INTO conversation_turn(tenant_id,subject_id,conversation_id,turn_key,sequence_no,speaker,start_at,end_at,final_text,source_type)
|
|
VALUES('10000000-0000-0000-0000-000000000001','10000000-0000-0000-0000-000000000401',$1::uuid,$2,1,'subject',now()-interval '90 seconds',now()-interval '80 seconds',$3,'provider')`,
|
|
conversationID, "sharing-turn-"+conversationID, "这是可分享的合成话轮。"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := normalizeInput(CreateInput{ResourceType: "story", ResourceID: uuid.NewString(), GranteeUserID: "10000000-0000-0000-0000-000000000112", Permission: "edit", Purpose: "禁止匿名编辑", ExpiresAt: time.Now().Add(time.Hour), LoginRequired: false}); !errors.Is(err, ErrInvalid) {
|
|
t.Fatalf("anonymous edit validation error=%v", err)
|
|
}
|
|
|
|
loginInput := CreateInput{ResourceType: " transcript ", ResourceID: conversationPublicID, GranteeUserID: "10000000-0000-0000-0000-000000000112", Permission: " view_text ", Purpose: "家庭回顾", ExpiresAt: time.Now().Add(time.Hour), LoginRequired: true}
|
|
loginGrant, created, err := service.Create(ctx, owner, loginKey, "sharing-integration-login-create", loginInput)
|
|
if err != nil || !created || loginGrant.AccessToken != "" || loginGrant.ResourceType != "TRANSCRIPT" || loginGrant.Permission != "VIEW_TEXT" {
|
|
t.Fatalf("login grant=%+v created=%v err=%v", loginGrant, created, err)
|
|
}
|
|
grantIDs = append(grantIDs, loginGrant.ID)
|
|
replayedGrant, created, err := service.Create(ctx, owner, loginKey, "sharing-integration-login-replay", loginInput)
|
|
if err != nil || created || replayedGrant.ID != loginGrant.ID {
|
|
t.Fatalf("replayed grant=%+v created=%v err=%v", replayedGrant, created, err)
|
|
}
|
|
grants, err := service.List(ctx, owner, "10000000-0000-0000-0000-000000000411")
|
|
if err != nil || len(grants) != 1 || grants[0].ID != loginGrant.ID {
|
|
t.Fatalf("grants=%+v err=%v", grants, err)
|
|
}
|
|
shared, err := service.Access(ctx, editor, loginGrant.ID, "sharing-integration-login-access")
|
|
if err != nil || len(shared.Turns) != 1 || shared.Turns[0].Text != "这是可分享的合成话轮。" {
|
|
t.Fatalf("shared transcript=%+v err=%v", shared, err)
|
|
}
|
|
if _, err := service.Access(ctx, owner, loginGrant.ID, "sharing-integration-recipient-mismatch"); !errors.Is(err, ErrAccessDenied) {
|
|
t.Fatalf("grantor recipient mismatch error=%v", err)
|
|
}
|
|
if _, err := service.Access(ctx, outsider, loginGrant.ID, "sharing-integration-outsider"); !errors.Is(err, ErrAccessDenied) {
|
|
t.Fatalf("outsider access error=%v", err)
|
|
}
|
|
if _, err := service.AccessByToken(ctx, loginGrant.ID, strings.Repeat("x", 40), "sharing-integration-login-token"); !errors.Is(err, ErrAccessDenied) {
|
|
t.Fatalf("login grant token error=%v", err)
|
|
}
|
|
|
|
anonymousInput := loginInput
|
|
anonymousInput.LoginRequired = false
|
|
anonymousInput.Purpose = "匿名家庭回顾"
|
|
anonymousGrant, created, err := service.Create(ctx, owner, anonymousKey, "sharing-integration-anonymous-create", anonymousInput)
|
|
if err != nil || !created || len(anonymousGrant.AccessToken) < 32 {
|
|
t.Fatalf("anonymous grant=%+v created=%v err=%v", anonymousGrant, created, err)
|
|
}
|
|
grantIDs = append(grantIDs, anonymousGrant.ID)
|
|
if _, err := service.AccessByToken(ctx, anonymousGrant.ID, "wrong-token-value-that-is-long-enough", "sharing-integration-bad-token"); !errors.Is(err, ErrAccessDenied) {
|
|
t.Fatalf("bad anonymous token error=%v", err)
|
|
}
|
|
shared, err = service.AccessByToken(ctx, anonymousGrant.ID, anonymousGrant.AccessToken, "sharing-integration-token-access")
|
|
if err != nil || len(shared.Turns) != 1 {
|
|
t.Fatalf("anonymous shared transcript=%+v err=%v", shared, err)
|
|
}
|
|
revoked, err := service.Revoke(ctx, owner, anonymousGrant.ID, "sharing-integration-revoke")
|
|
if err != nil || revoked.RevokedAt == nil || revoked.Version != 2 {
|
|
t.Fatalf("revoked grant=%+v err=%v", revoked, err)
|
|
}
|
|
if _, err := service.AccessByToken(ctx, anonymousGrant.ID, anonymousGrant.AccessToken, "sharing-integration-revoked-token"); !errors.Is(err, ErrExpired) {
|
|
t.Fatalf("revoked token error=%v", err)
|
|
}
|
|
var successLogs, deniedLogs int
|
|
if err := pool.QueryRow(ctx, `SELECT count(*) FILTER(WHERE result='SUCCESS'),count(*) FILTER(WHERE result='DENIED') FROM sharing_access_log WHERE sharing_grant_id IN (SELECT id FROM sharing_grant WHERE public_id=ANY($1::uuid[]))`, grantIDs).Scan(&successLogs, &deniedLogs); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if successLogs != 2 || deniedLogs != 5 {
|
|
t.Fatalf("sharing access logs success=%d denied=%d", successLogs, deniedLogs)
|
|
}
|
|
}
|