heqiapp/platforms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden platform audit coverage

Browse Source
This commit is contained in:
yanweidong
2026-07-27 11:13:55 +08:00
parent 48fc80b003
commit 0ba4136e1a
7 changed files with 125 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
frontend/platform_admin/scripts/audit-check.mjs
View File

@@ -9,7 +9,7 @@ const sourceFiles = (dir, extensions = ['.ts', '.vue']) => new Map(files(dir).fi
const mutationActions = (source) => [...source.matchAll(/resourceApi\.(create|update|updateStatus|archive)\b/g)].map((match) => match[1]);
function requiredBackendRoutes(contract) {
if (contract.mode === 'append_only') return [{ method: 'POST', path: contract.path }];
if (contract.mode === 'append_only') return [{ method: 'GET', path: contract.path }, { method: 'POST', path: contract.path }];
const resource = contract.path;
const detail = `${resource}/:identity`;
if (contract.mode === 'readonly') return [{ method: 'GET', path: resource }, { method: 'GET', path: detail }];
@@ -23,7 +23,7 @@ function routeCoverage(contract, routeSources, viewSources) {
const expectedView = new RegExp(`getResource\\(\\s*['\"]${escapeRegExp(contract.path)}['\"]\\s*\\)`);
let hasPage = false;
let hasMenu = false;
for (const source of routeSources) {
for (const [, source] of sourceEntries(routeSources, 'src/router')) {
for (const match of source.matchAll(/component:\s*\(\)\s*=>\s*import\(['\"]@\/views\/([^'\"]+)['\"]\)([\s\S]{0,260}?meta:\s*\{[^}]*\})?/g)) {
const view = viewSources.get(`src/views/${match[1]}`);
if (!view || !expectedView.test(view)) continue;
@@ -34,6 +34,11 @@ function routeCoverage(contract, routeSources, viewSources) {
return { hasPage, hasMenu };
}
function sourceEntries(sources, fallbackDirectory) {
if (sources instanceof Map) return [...sources];
return sources.map((source, index) => [`${fallbackDirectory}/${index}`, source]);
}
function escapeRegExp(value) {
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}
@@ -43,11 +48,11 @@ export function scanInternalIdLeaks(sources) {
const failures = [];
for (const [file, source] of sources) {
for (const line of source.split(/\r?\n/)) {
// These are defensive filters that explicitly remove IDs from details, not leaks.
if (line.includes("key !== 'id'") || line.includes("key.endsWith('_id')")) continue;
const relation = line.match(/\b([A-Za-z][A-Za-z0-9_]*_id)\b/);
// Remove only the defensive predicates, then keep scanning the rest of the line.
const scanned = line.replace(/key\s*!==\s*['\"]id['\"]/g, '').replace(/key\.endsWith\(\s*['\"]_id['\"]\s*\)/g, '');
const relation = scanned.match(/\b([A-Za-z][A-Za-z0-9_]*_id)\b/);
if (relation) failures.push(`${file}: internal identifier ${relation[1]}`);
else if (/\bdata-index\s*=\s*['\"]id['\"]|\.id\b|[,{]\s*id\s*:/.test(line)) failures.push(`${file}: internal identifier id`);
else if (/\bdata-index\s*=\s*['\"]id['\"]|\.id\b|[,{]\s*id\s*:/.test(scanned)) failures.push(`${file}: internal identifier id`);
}
}
return failures;
@@ -68,10 +73,21 @@ export function auditPlatform({ manifest, resources, readOnlyPage, routeSources,
}
if (!/^[\u4e00-\u9fff]/.test(resource.title) || resource.fields.length === 0 || resource.fields.some((field) => field.key === 'id' || field.key.endsWith('_id')) || resource.fields.some((field) => !/^[\u4e00-\u9fff]/.test(field.label))) failures.push(`${label}: invalid frontend allowlist`);
for (const expected of requiredBackendRoutes(contract)) if (!manifest.routes.some((route) => route.method === expected.method && route.path === expected.path)) failures.push(`${label}: missing backend ${expected.method}`);
if (contract.mode === 'append_only') continue;
const coverage = routeCoverage(contract, routeSources, viewSources);
if (!coverage.hasPage) failures.push(`${label}: missing page`);
if (!coverage.hasMenu) failures.push(`${label}: missing menu route`);
if (contract.mode === 'append_only') {
const event = resources.find((item) => item.name === 'saf_event');
if (!event?.detailActions?.some((action) => action.name === contract.name && action.resource === contract.path)) failures.push(`${label}: missing saf_event detail action`);
if ([...viewSources.keys()].some((file) => file.includes(`/${contract.name}/`))) failures.push(`${label}: independent page exposed`);
} else {
const coverage = routeCoverage(contract, routeSources, viewSources);
if (!coverage.hasPage) failures.push(`${label}: missing page`);
if (!coverage.hasMenu) failures.push(`${label}: missing menu route`);
}
if (contract.mode === 'readonly') {
const statusCall = new RegExp(`resourceApi\\.updateStatus\\(\\s*['\"]${escapeRegExp(contract.path)}['\"]`);
for (const [file, source] of [...sourceEntries(routeSources, 'src/router'), ...sourceEntries(apiSources, 'src/api'), ...sourceEntries(viewSources, 'src/views')]) {
if (statusCall.test(source)) failures.push(`${label}: readonly status mutation in ${file}`);
}
}
}
if (JSON.stringify(resources.map((item) => item.name).sort()) !== JSON.stringify(manifest.resources.map((item) => item.name).sort())) failures.push('catalogue names differ from backend ExpectedResources');
const readonlyMutations = mutationActions(readOnlyPage);
@@ -97,7 +113,7 @@ function runAudit() {
manifest,
resources: loadResources(),
readOnlyPage: fs.readFileSync('src/views/shared/ReadOnlyListPage.vue', 'utf8'),
routeSources: [...sourceFiles('src/router/routes/modules', ['.ts']).values()],
routeSources: sourceFiles('src/router', ['.ts']),
viewSources,
apiSources: sourceFiles('src/api', ['.ts']),
responseShapeVerified,