Compare commits
12
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 QiuSW
|
babb530b99 | ||
|
QiuSW
|
55d9e09bda | ||
|
QiuSW
|
47c0844f9c | ||
|
QiuSW
|
88d8f77417 | ||
|
QiuSW
|
f7efa4a161 | ||
|
QiuSW
|
ef1ac60ac5 | ||
|
QiuSW
|
5332d67b5e | ||
|
QiuSW
|
5f6b3ce01a | ||
|
QiuSW
|
824a628733 | ||
|
QiuSW
|
1e69d274b8 | ||
|
QiuSW
|
8ee26be95a | ||
|
QiuSW
|
a45a1b5afc |
@@ -0,0 +1,22 @@
|
||||
# 采购服务
|
||||
|
||||
启动前必须显式设置下列环境变量；服务不提供默认管理员账号、密码或会话密钥。
|
||||
|
||||
| 变量 | 要求 |
|
||||
| --- | --- |
|
||||
| `CMBUYER_ADMIN_USERNAME` | 非空管理员账号。 |
|
||||
| `CMBUYER_ADMIN_PASSWORD_BCRYPT` | 非空 bcrypt 密码哈希，不接受明文密码。 |
|
||||
| `CMBUYER_SESSION_SECRET` | 至少 32 字节的会话签名密钥。 |
|
||||
| `CMBUYER_COOKIE_SECURE` | 可选；存在时只能精确为 `true` 或 `false`。HTTPS 部署应设为 `true`。 |
|
||||
|
||||
示例仅展示变量名，不提供可运行凭据：
|
||||
|
||||
```powershell
|
||||
$env:CMBUYER_ADMIN_USERNAME = '<管理员账号>'
|
||||
$env:CMBUYER_ADMIN_PASSWORD_BCRYPT = '<bcrypt 密码哈希>'
|
||||
$env:CMBUYER_SESSION_SECRET = '<至少 32 字节的随机密钥>'
|
||||
$env:CMBUYER_COOKIE_SECURE = 'true'
|
||||
go run ./cmd/server
|
||||
```
|
||||
|
||||
采购服务会话仅保存在当前进程内；进程重启后既有登录会话会安全失效。
|
||||
@@ -5,6 +5,8 @@ import (
|
||||
"log"
|
||||
"net/http"
|
||||
|
||||
"cmbuyer/admin/internal/auth"
|
||||
"cmbuyer/admin/internal/config"
|
||||
"cmbuyer/admin/internal/server"
|
||||
)
|
||||
|
||||
@@ -17,7 +19,21 @@ func main() {
|
||||
}
|
||||
|
||||
func run() error {
|
||||
err := http.ListenAndServe(listenAddress, server.NewRouter())
|
||||
configuration, err := config.LoadFromEnv()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
router, err := server.NewRouter(server.Options{
|
||||
AdminUsername: configuration.AdminUsername,
|
||||
AdminPasswordBcrypt: configuration.AdminPasswordBcrypt,
|
||||
Sessions: auth.NewManager(configuration.SessionSecret, configuration.CookieSecure),
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = http.ListenAndServe(listenAddress, router)
|
||||
if errors.Is(err, http.ErrServerClosed) {
|
||||
return nil
|
||||
}
|
||||
|
||||
+1
-1
@@ -6,6 +6,7 @@ require (
|
||||
github.com/gin-gonic/gin v1.11.0
|
||||
github.com/mattn/go-sqlite3 v1.14.49
|
||||
github.com/pressly/goose/v3 v3.24.0
|
||||
golang.org/x/crypto v0.40.0
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -35,7 +36,6 @@ require (
|
||||
go.uber.org/mock v0.5.0 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
golang.org/x/arch v0.20.0 // indirect
|
||||
golang.org/x/crypto v0.40.0 // indirect
|
||||
golang.org/x/mod v0.25.0 // indirect
|
||||
golang.org/x/net v0.42.0 // indirect
|
||||
golang.org/x/sync v0.16.0 // indirect
|
||||
|
||||
@@ -0,0 +1,198 @@
|
||||
// Package auth 提供内存会话与 CSRF 防护。会话不落库，服务重启会安全地使所有登录失效。
|
||||
package auth
|
||||
|
||||
import (
|
||||
"crypto/hmac"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"io"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
CookieName = "cmbuyer_session"
|
||||
SessionLifetime = 8 * time.Hour
|
||||
csrfTokenByteSize = 32
|
||||
)
|
||||
|
||||
type session struct {
|
||||
csrfToken string
|
||||
authenticated bool
|
||||
expiresAt time.Time
|
||||
}
|
||||
|
||||
// Manager 签发、验证并撤销进程内会话。cookie 仅承载经过 HMAC 签名的随机 session ID。
|
||||
type Manager struct {
|
||||
secret []byte
|
||||
cookieSecure bool
|
||||
now func() time.Time
|
||||
random io.Reader
|
||||
|
||||
mu sync.Mutex
|
||||
sessions map[string]session
|
||||
}
|
||||
|
||||
// NewManager 创建会话管理器。secret 在启动时已由 config 验证为足够长度。
|
||||
func NewManager(secret []byte, cookieSecure bool) *Manager {
|
||||
return &Manager{
|
||||
secret: append([]byte(nil), secret...),
|
||||
cookieSecure: cookieSecure,
|
||||
now: time.Now,
|
||||
random: rand.Reader,
|
||||
sessions: make(map[string]session),
|
||||
}
|
||||
}
|
||||
|
||||
// Ensure 返回当前有效会话；不存在或过期时签发匿名会话，以保护登录表单本身的 POST。
|
||||
func (manager *Manager) Ensure(writer http.ResponseWriter, request *http.Request) (csrfToken string, authenticated bool) {
|
||||
if id, current, ok := manager.current(request); ok {
|
||||
return current.csrfToken, current.authenticated
|
||||
} else if id != "" {
|
||||
manager.delete(id)
|
||||
}
|
||||
|
||||
id, current := manager.create(false)
|
||||
manager.writeCookie(writer, id, current.expiresAt)
|
||||
return current.csrfToken, false
|
||||
}
|
||||
|
||||
// VerifyCSRF 只接受当前未过期会话中以恒定时间比较匹配的 token。
|
||||
func (manager *Manager) VerifyCSRF(request *http.Request, token string) (authenticated bool, ok bool) {
|
||||
_, current, found := manager.current(request)
|
||||
if !found || token == "" {
|
||||
return false, false
|
||||
}
|
||||
|
||||
if subtle.ConstantTimeCompare([]byte(current.csrfToken), []byte(token)) != 1 {
|
||||
return false, false
|
||||
}
|
||||
|
||||
return current.authenticated, true
|
||||
}
|
||||
|
||||
// RotateAuthenticated 在登录成功后撤销旧会话并签发全新认证会话，避免 session fixation 与 CSRF 复用。
|
||||
func (manager *Manager) RotateAuthenticated(writer http.ResponseWriter, request *http.Request) string {
|
||||
if id, _, ok := manager.current(request); ok {
|
||||
manager.delete(id)
|
||||
}
|
||||
|
||||
id, current := manager.create(true)
|
||||
manager.writeCookie(writer, id, current.expiresAt)
|
||||
return current.csrfToken
|
||||
}
|
||||
|
||||
// Logout 撤销当前会话并立即清除浏览器 cookie。
|
||||
func (manager *Manager) Logout(writer http.ResponseWriter, request *http.Request) {
|
||||
if id, _, ok := manager.current(request); ok {
|
||||
manager.delete(id)
|
||||
}
|
||||
http.SetCookie(writer, &http.Cookie{
|
||||
Name: CookieName,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
MaxAge: -1,
|
||||
HttpOnly: true,
|
||||
Secure: manager.cookieSecure,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
}
|
||||
|
||||
func (manager *Manager) current(request *http.Request) (string, session, bool) {
|
||||
cookie, err := request.Cookie(CookieName)
|
||||
if err != nil {
|
||||
return "", session{}, false
|
||||
}
|
||||
|
||||
id, expiresAt, ok := manager.verifyCookie(cookie.Value)
|
||||
if !ok || !manager.now().Before(expiresAt) {
|
||||
return id, session{}, false
|
||||
}
|
||||
|
||||
manager.mu.Lock()
|
||||
defer manager.mu.Unlock()
|
||||
current, found := manager.sessions[id]
|
||||
if !found || !manager.now().Before(current.expiresAt) {
|
||||
return id, session{}, false
|
||||
}
|
||||
|
||||
return id, current, true
|
||||
}
|
||||
|
||||
func (manager *Manager) create(authenticated bool) (string, session) {
|
||||
id := manager.randomToken()
|
||||
current := session{
|
||||
csrfToken: manager.randomToken(),
|
||||
authenticated: authenticated,
|
||||
expiresAt: manager.now().Add(SessionLifetime),
|
||||
}
|
||||
|
||||
manager.mu.Lock()
|
||||
manager.sessions[id] = current
|
||||
manager.mu.Unlock()
|
||||
return id, current
|
||||
}
|
||||
|
||||
func (manager *Manager) delete(id string) {
|
||||
manager.mu.Lock()
|
||||
delete(manager.sessions, id)
|
||||
manager.mu.Unlock()
|
||||
}
|
||||
|
||||
func (manager *Manager) randomToken() string {
|
||||
bytes := make([]byte, csrfTokenByteSize)
|
||||
if _, err := io.ReadFull(manager.random, bytes); err != nil {
|
||||
panic("crypto/rand failed while creating a session token")
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(bytes)
|
||||
}
|
||||
|
||||
func (manager *Manager) writeCookie(writer http.ResponseWriter, id string, expiresAt time.Time) {
|
||||
http.SetCookie(writer, &http.Cookie{
|
||||
Name: CookieName,
|
||||
Value: manager.signCookie(id, expiresAt),
|
||||
Path: "/",
|
||||
MaxAge: int(expiresAt.Sub(manager.now()).Seconds()),
|
||||
Expires: expiresAt,
|
||||
HttpOnly: true,
|
||||
Secure: manager.cookieSecure,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
}
|
||||
|
||||
func (manager *Manager) signCookie(id string, expiresAt time.Time) string {
|
||||
payload := id + "." + strconv.FormatInt(expiresAt.Unix(), 10)
|
||||
mac := hmac.New(sha256.New, manager.secret)
|
||||
_, _ = mac.Write([]byte(payload))
|
||||
return payload + "." + base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
|
||||
}
|
||||
|
||||
func (manager *Manager) verifyCookie(value string) (string, time.Time, bool) {
|
||||
parts := strings.Split(value, ".")
|
||||
if len(parts) != 3 || parts[0] == "" {
|
||||
return "", time.Time{}, false
|
||||
}
|
||||
|
||||
expiresUnix, err := strconv.ParseInt(parts[1], 10, 64)
|
||||
if err != nil {
|
||||
return "", time.Time{}, false
|
||||
}
|
||||
provided, err := base64.RawURLEncoding.DecodeString(parts[2])
|
||||
if err != nil {
|
||||
return "", time.Time{}, false
|
||||
}
|
||||
|
||||
payload := parts[0] + "." + parts[1]
|
||||
mac := hmac.New(sha256.New, manager.secret)
|
||||
_, _ = mac.Write([]byte(payload))
|
||||
if !hmac.Equal(provided, mac.Sum(nil)) {
|
||||
return "", time.Time{}, false
|
||||
}
|
||||
|
||||
return parts[0], time.Unix(expiresUnix, 0), true
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestManagerRejectsTamperedAndExpiredCookies(t *testing.T) {
|
||||
manager := NewManager([]byte(strings.Repeat("s", 32)), true)
|
||||
request := httptest.NewRequest(http.MethodGet, "/login", nil)
|
||||
response := httptest.NewRecorder()
|
||||
csrf, authenticated := manager.Ensure(response, request)
|
||||
if csrf == "" || authenticated {
|
||||
t.Fatalf("Ensure = (%q, %t), want anonymous CSRF session", csrf, authenticated)
|
||||
}
|
||||
cookie := response.Result().Cookies()[0]
|
||||
if !cookie.HttpOnly || !cookie.Secure || cookie.SameSite != http.SameSiteLaxMode || cookie.Path != "/" {
|
||||
t.Fatalf("session cookie is missing security attributes: %#v", cookie)
|
||||
}
|
||||
|
||||
tampered := *cookie
|
||||
tampered.Value = flipCookieValue(t, cookie.Value)
|
||||
tamperedRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
|
||||
tamperedRequest.AddCookie(&tampered)
|
||||
if _, ok := manager.VerifyCSRF(tamperedRequest, csrf); ok {
|
||||
t.Fatal("tampered signed cookie passed CSRF verification")
|
||||
}
|
||||
|
||||
manager.now = func() time.Time { return time.Now().Add(9 * time.Hour) }
|
||||
expiredRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
|
||||
expiredRequest.AddCookie(cookie)
|
||||
if _, ok := manager.VerifyCSRF(expiredRequest, csrf); ok {
|
||||
t.Fatal("expired cookie passed CSRF verification")
|
||||
}
|
||||
}
|
||||
|
||||
func flipCookieValue(t *testing.T, value string) string {
|
||||
t.Helper()
|
||||
if value == "" {
|
||||
t.Fatal("cannot tamper with an empty cookie")
|
||||
}
|
||||
if value[0] == 'A' {
|
||||
return "B" + value[1:]
|
||||
}
|
||||
return "A" + value[1:]
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
// Package config 读取采购服务的启动配置。凭据只允许来自显式环境变量，避免把秘密写入代码或仓库。
|
||||
package config
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
const (
|
||||
adminUsernameEnv = "CMBUYER_ADMIN_USERNAME"
|
||||
adminPasswordBcryptEnv = "CMBUYER_ADMIN_PASSWORD_BCRYPT"
|
||||
sessionSecretEnv = "CMBUYER_SESSION_SECRET"
|
||||
cookieSecureEnv = "CMBUYER_COOKIE_SECURE"
|
||||
minimumSecretLength = 32
|
||||
)
|
||||
|
||||
// Config 是启动采购服务所需的最小安全配置。
|
||||
type Config struct {
|
||||
AdminUsername string
|
||||
AdminPasswordBcrypt string
|
||||
SessionSecret []byte
|
||||
CookieSecure bool
|
||||
}
|
||||
|
||||
// LoadFromEnv 从进程环境读取配置。错误只指出缺失或非法的变量名，绝不回显秘密。
|
||||
func LoadFromEnv() (Config, error) {
|
||||
return Load(os.LookupEnv)
|
||||
}
|
||||
|
||||
// Load 使用 lookup 读取配置，以便在不污染进程环境的情况下测试启动边界。
|
||||
func Load(lookup func(string) (string, bool)) (Config, error) {
|
||||
username, err := required(lookup, adminUsernameEnv)
|
||||
if err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
|
||||
passwordHash, err := required(lookup, adminPasswordBcryptEnv)
|
||||
if err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
if _, err := bcrypt.Cost([]byte(passwordHash)); err != nil {
|
||||
return Config{}, fmt.Errorf("%s is not a valid bcrypt hash", adminPasswordBcryptEnv)
|
||||
}
|
||||
|
||||
secret, err := required(lookup, sessionSecretEnv)
|
||||
if err != nil {
|
||||
return Config{}, err
|
||||
}
|
||||
if len([]byte(secret)) < minimumSecretLength {
|
||||
return Config{}, fmt.Errorf("%s must be at least %d bytes", sessionSecretEnv, minimumSecretLength)
|
||||
}
|
||||
|
||||
cookieSecure := false
|
||||
if value, present := lookup(cookieSecureEnv); present {
|
||||
switch value {
|
||||
case "true":
|
||||
cookieSecure = true
|
||||
case "false":
|
||||
cookieSecure = false
|
||||
default:
|
||||
return Config{}, fmt.Errorf("%s must be exactly true or false", cookieSecureEnv)
|
||||
}
|
||||
}
|
||||
|
||||
return Config{
|
||||
AdminUsername: username,
|
||||
AdminPasswordBcrypt: passwordHash,
|
||||
SessionSecret: []byte(secret),
|
||||
CookieSecure: cookieSecure,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func required(lookup func(string) (string, bool), name string) (string, error) {
|
||||
value, present := lookup(name)
|
||||
if !present || strings.TrimSpace(value) == "" {
|
||||
return "", errors.New(name + " must be set")
|
||||
}
|
||||
|
||||
return value, nil
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
package config_test
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"cmbuyer/admin/internal/config"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
func TestLoad(t *testing.T) {
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatalf("generate bcrypt hash: %v", err)
|
||||
}
|
||||
|
||||
values := map[string]string{
|
||||
"CMBUYER_ADMIN_USERNAME": "admin",
|
||||
"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
|
||||
"CMBUYER_SESSION_SECRET": strings.Repeat("s", 32),
|
||||
"CMBUYER_COOKIE_SECURE": "true",
|
||||
}
|
||||
|
||||
got, err := config.Load(lookup(values))
|
||||
if err != nil {
|
||||
t.Fatalf("Load: %v", err)
|
||||
}
|
||||
if got.AdminUsername != "admin" || !got.CookieSecure {
|
||||
t.Fatalf("Load returned unexpected public configuration: %#v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatalf("generate bcrypt hash: %v", err)
|
||||
}
|
||||
|
||||
base := map[string]string{
|
||||
"CMBUYER_ADMIN_USERNAME": "admin",
|
||||
"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
|
||||
"CMBUYER_SESSION_SECRET": strings.Repeat("s", 32),
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
mutate func(map[string]string)
|
||||
want string
|
||||
}{
|
||||
{"missing username", func(values map[string]string) { delete(values, "CMBUYER_ADMIN_USERNAME") }, "CMBUYER_ADMIN_USERNAME"},
|
||||
{"invalid bcrypt", func(values map[string]string) { values["CMBUYER_ADMIN_PASSWORD_BCRYPT"] = "not-a-bcrypt-hash" }, "CMBUYER_ADMIN_PASSWORD_BCRYPT"},
|
||||
{"short secret", func(values map[string]string) { values["CMBUYER_SESSION_SECRET"] = "short" }, "CMBUYER_SESSION_SECRET"},
|
||||
{"invalid secure flag", func(values map[string]string) { values["CMBUYER_COOKIE_SECURE"] = "1" }, "CMBUYER_COOKIE_SECURE"},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
values := copyValues(base)
|
||||
test.mutate(values)
|
||||
_, err := config.Load(lookup(values))
|
||||
if err == nil || !strings.Contains(err.Error(), test.want) {
|
||||
t.Fatalf("Load error = %v, want mention of %s", err, test.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func lookup(values map[string]string) func(string) (string, bool) {
|
||||
return func(key string) (string, bool) {
|
||||
value, ok := values[key]
|
||||
return value, ok
|
||||
}
|
||||
}
|
||||
|
||||
func copyValues(values map[string]string) map[string]string {
|
||||
copy := make(map[string]string, len(values))
|
||||
for key, value := range values {
|
||||
copy[key] = value
|
||||
}
|
||||
return copy
|
||||
}
|
||||
@@ -2,18 +2,164 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"crypto/subtle"
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"cmbuyer/admin/internal/auth"
|
||||
"cmbuyer/admin/internal/transport/webui"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
// NewRouter 返回当前服务范围内的完整 HTTP 路由。
|
||||
func NewRouter() *gin.Engine {
|
||||
router := gin.New()
|
||||
const maxFormBytes = 8 << 10
|
||||
|
||||
router.GET("/healthz", func(context *gin.Context) {
|
||||
context.JSON(http.StatusOK, gin.H{"status": "ok"})
|
||||
})
|
||||
// Options 是路由层需要的安全依赖。凭据由启动配置注入，不能在路由中设置默认值。
|
||||
type Options struct {
|
||||
AdminUsername string
|
||||
AdminPasswordBcrypt string
|
||||
Sessions *auth.Manager
|
||||
}
|
||||
|
||||
return router
|
||||
// NewRouter 返回当前服务范围内的完整 HTTP 路由。
|
||||
func NewRouter(options Options) (*gin.Engine, error) {
|
||||
if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil {
|
||||
return nil, errors.New("server authentication options are incomplete")
|
||||
}
|
||||
|
||||
router := gin.New()
|
||||
router.Use(gin.Recovery())
|
||||
router.Use(securityHeaders())
|
||||
router.GET("/healthz", healthz)
|
||||
router.GET("/login", loginPage(options))
|
||||
router.POST("/login", login(options))
|
||||
router.POST("/logout", logout(options))
|
||||
router.GET("/tasks", tasksPage(options))
|
||||
|
||||
return router, nil
|
||||
}
|
||||
|
||||
func healthz(context *gin.Context) {
|
||||
context.JSON(http.StatusOK, gin.H{"status": "ok"})
|
||||
}
|
||||
|
||||
func securityHeaders() gin.HandlerFunc {
|
||||
return func(context *gin.Context) {
|
||||
context.Header("Cache-Control", "no-store")
|
||||
context.Header("X-Content-Type-Options", "nosniff")
|
||||
context.Header("Referrer-Policy", "no-referrer")
|
||||
context.Header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'")
|
||||
context.Next()
|
||||
}
|
||||
}
|
||||
|
||||
func loginPage(options Options) gin.HandlerFunc {
|
||||
return func(context *gin.Context) {
|
||||
csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
|
||||
if authenticated {
|
||||
context.Redirect(http.StatusSeeOther, "/tasks")
|
||||
return
|
||||
}
|
||||
|
||||
renderLogin(context, http.StatusOK, csrfToken, returnTo(context.Query("return_to")), "", "")
|
||||
}
|
||||
}
|
||||
|
||||
func login(options Options) gin.HandlerFunc {
|
||||
return func(context *gin.Context) {
|
||||
limitFormBody(context)
|
||||
csrfToken := context.PostForm("csrf_token")
|
||||
returnPath := returnTo(context.PostForm("return_to"))
|
||||
username := context.PostForm("username")
|
||||
password := context.PostForm("password")
|
||||
|
||||
if _, ok := options.Sessions.VerifyCSRF(context.Request, csrfToken); !ok {
|
||||
newCSRF, _ := options.Sessions.Ensure(context.Writer, context.Request)
|
||||
renderLogin(context, http.StatusForbidden, newCSRF, returnPath, "", "请求已过期，请重新登录。")
|
||||
return
|
||||
}
|
||||
|
||||
usernameMatches := subtle.ConstantTimeCompare([]byte(options.AdminUsername), []byte(username)) == 1
|
||||
passwordMatches := bcrypt.CompareHashAndPassword([]byte(options.AdminPasswordBcrypt), []byte(password)) == nil
|
||||
if !usernameMatches || !passwordMatches {
|
||||
csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
|
||||
renderLogin(context, http.StatusUnauthorized, csrf, returnPath, "", "账号或密码不正确，请检查后重试。")
|
||||
return
|
||||
}
|
||||
|
||||
options.Sessions.RotateAuthenticated(context.Writer, context.Request)
|
||||
context.Redirect(http.StatusSeeOther, returnPath)
|
||||
}
|
||||
}
|
||||
|
||||
func logout(options Options) gin.HandlerFunc {
|
||||
return func(context *gin.Context) {
|
||||
limitFormBody(context)
|
||||
authenticated, ok := options.Sessions.VerifyCSRF(context.Request, context.PostForm("csrf_token"))
|
||||
if !ok || !authenticated {
|
||||
context.Status(http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
|
||||
options.Sessions.Logout(context.Writer, context.Request)
|
||||
context.Redirect(http.StatusSeeOther, "/login")
|
||||
}
|
||||
}
|
||||
|
||||
func tasksPage(options Options) gin.HandlerFunc {
|
||||
return func(context *gin.Context) {
|
||||
csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
|
||||
if !authenticated {
|
||||
context.Redirect(http.StatusSeeOther, "/login?return_to="+url.QueryEscape(context.Request.URL.RequestURI()))
|
||||
return
|
||||
}
|
||||
|
||||
context.Header("Content-Type", "text/html; charset=utf-8")
|
||||
if err := webui.RenderTasks(context.Writer, webui.TasksData{CSRFToken: csrfToken}); err != nil {
|
||||
_ = context.Error(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func renderLogin(context *gin.Context, status int, csrfToken, returnPath, username, message string) {
|
||||
context.Header("Content-Type", "text/html; charset=utf-8")
|
||||
context.Status(status)
|
||||
if err := webui.RenderLogin(context.Writer, webui.LoginData{
|
||||
CSRFToken: csrfToken,
|
||||
ReturnTo: returnPath,
|
||||
Username: username,
|
||||
Error: message,
|
||||
}); err != nil {
|
||||
_ = context.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
func limitFormBody(context *gin.Context) {
|
||||
context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxFormBytes)
|
||||
}
|
||||
|
||||
func returnTo(value string) string {
|
||||
if value == "/tasks" || strings.HasPrefix(value, "/tasks/") || strings.HasPrefix(value, "/tasks?") {
|
||||
if strings.Contains(value, "\\") || strings.Contains(value, "%") || strings.HasPrefix(value, "//") {
|
||||
return "/tasks"
|
||||
}
|
||||
parsed, err := url.ParseRequestURI(value)
|
||||
if err == nil && parsed.IsAbs() == false && parsed.Host == "" && hasSafeTaskPath(parsed.Path) {
|
||||
return value
|
||||
}
|
||||
}
|
||||
|
||||
return "/tasks"
|
||||
}
|
||||
|
||||
func hasSafeTaskPath(path string) bool {
|
||||
for _, segment := range strings.Split(path, "/") {
|
||||
if segment == "." || segment == ".." {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
@@ -3,26 +3,291 @@ package server_test
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"cmbuyer/admin/internal/auth"
|
||||
"cmbuyer/admin/internal/server"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
func TestHealthz(t *testing.T) {
|
||||
var csrfPattern = regexp.MustCompile(`name="csrf_token" value="([^"]+)"`)
|
||||
|
||||
func TestHealthzIsPublic(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
|
||||
response := httptest.NewRecorder()
|
||||
|
||||
server.NewRouter().ServeHTTP(response, request)
|
||||
router.ServeHTTP(response, request)
|
||||
|
||||
if response.Code != http.StatusOK {
|
||||
t.Fatalf("healthz status = %d, want %d", response.Code, http.StatusOK)
|
||||
}
|
||||
|
||||
if contentType := response.Header().Get("Content-Type"); contentType != "application/json; charset=utf-8" {
|
||||
t.Fatalf("healthz content type = %q, want application/json; charset=utf-8", contentType)
|
||||
}
|
||||
|
||||
if body := response.Body.String(); body != "{\"status\":\"ok\"}" {
|
||||
t.Fatalf("healthz body = %q, want {\"status\":\"ok\"}", body)
|
||||
}
|
||||
assertSecurityHeaders(t, response)
|
||||
}
|
||||
|
||||
func TestTasksRequiresLoginAndBlocksOpenRedirects(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
|
||||
tasks := serve(router, http.MethodGet, "/tasks", nil, nil)
|
||||
if tasks.Code != http.StatusSeeOther {
|
||||
t.Fatalf("GET /tasks status = %d, want %d", tasks.Code, http.StatusSeeOther)
|
||||
}
|
||||
if location := tasks.Header().Get("Location"); location != "/login?return_to=%2Ftasks" {
|
||||
t.Fatalf("GET /tasks location = %q, want login return path", location)
|
||||
}
|
||||
|
||||
for _, target := range []string{"https://example.invalid", "//example.invalid", `\\example.invalid`, "/other", "/tasks/..", "/tasks/../other", "/tasks/%2e%2e", "%2F%2Fevil.invalid", "%252F%252Fevil.invalid"} {
|
||||
response := serve(router, http.MethodGet, "/login?return_to="+url.QueryEscape(target), nil, nil)
|
||||
if response.Code != http.StatusOK {
|
||||
t.Fatalf("GET /login return_to=%q status = %d, want 200", target, response.Code)
|
||||
}
|
||||
if strings.Contains(response.Body.String(), target) || !strings.Contains(response.Body.String(), `name="return_to" value="/tasks"`) {
|
||||
t.Fatalf("GET /login accepted unsafe return_to %q", target)
|
||||
}
|
||||
}
|
||||
|
||||
encodedPath := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%252F..", nil, nil)
|
||||
if !strings.Contains(encodedPath.Body.String(), `name="return_to" value="/tasks"`) {
|
||||
t.Fatal("encoded parent path was accepted as return_to")
|
||||
}
|
||||
encodedQuery := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fnext%3D%252Ftasks%252F..", nil, nil)
|
||||
if !strings.Contains(encodedQuery.Body.String(), `name="return_to" value="/tasks"`) {
|
||||
t.Fatal("encoded query bypass was accepted as return_to")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginRotatesSessionAndCSRF(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
initial := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fview%3Dmine", nil, nil)
|
||||
oldCookie := sessionCookie(t, initial)
|
||||
oldCSRF := csrfToken(t, initial.Body.String())
|
||||
|
||||
login := serve(router, http.MethodPost, "/login", url.Values{
|
||||
"csrf_token": {oldCSRF},
|
||||
"return_to": {"/tasks?view=mine"},
|
||||
"username": {"admin"},
|
||||
"password": {"test-password"},
|
||||
}, oldCookie)
|
||||
if login.Code != http.StatusSeeOther || login.Header().Get("Location") != "/tasks?view=mine" {
|
||||
t.Fatalf("successful login = (%d, %q), want 303 /tasks?view=mine", login.Code, login.Header().Get("Location"))
|
||||
}
|
||||
newCookie := sessionCookie(t, login)
|
||||
if newCookie.Value == oldCookie.Value {
|
||||
t.Fatal("successful login reused the anonymous session cookie")
|
||||
}
|
||||
|
||||
tasks := serve(router, http.MethodGet, "/tasks", nil, newCookie)
|
||||
if tasks.Code != http.StatusOK {
|
||||
t.Fatalf("GET /tasks after login status = %d, want 200", tasks.Code)
|
||||
}
|
||||
if newCSRF := csrfToken(t, tasks.Body.String()); newCSRF == oldCSRF {
|
||||
t.Fatal("successful login reused the anonymous CSRF token")
|
||||
}
|
||||
for _, forbidden := range []string{"建单", "试选", "拼多多", "规格", "单价", "证据"} {
|
||||
if strings.Contains(tasks.Body.String(), forbidden) {
|
||||
t.Fatalf("task shell must not expose deferred feature content %q", forbidden)
|
||||
}
|
||||
}
|
||||
assertSecurityHeaders(t, initial)
|
||||
assertSecurityHeaders(t, tasks)
|
||||
}
|
||||
|
||||
func TestLoginPageIncludesAccessibleFormBasics(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
page := serve(router, http.MethodGet, "/login", nil, nil)
|
||||
body := page.Body.String()
|
||||
for _, want := range []string{
|
||||
`<label for="username">`,
|
||||
`<label for="password">`,
|
||||
`autocomplete="username"`,
|
||||
`autocomplete="current-password"`,
|
||||
`min-height:44px`,
|
||||
`:focus-visible`,
|
||||
`prefers-reduced-motion`,
|
||||
} {
|
||||
if !strings.Contains(body, want) {
|
||||
t.Fatalf("login page is missing %q", want)
|
||||
}
|
||||
}
|
||||
if strings.Contains(body, "http://") || strings.Contains(body, "https://") || strings.Contains(body, "<script") {
|
||||
t.Fatal("login page must not load external resources or require client-side JavaScript")
|
||||
}
|
||||
|
||||
failure := serve(router, http.MethodPost, "/login", url.Values{
|
||||
"csrf_token": {csrfToken(t, body)},
|
||||
"username": {"admin"},
|
||||
"password": {"wrong"},
|
||||
}, sessionCookie(t, page))
|
||||
if !strings.Contains(failure.Body.String(), `role="alert"`) {
|
||||
t.Fatal("login failure must announce its error")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginCSRFAndCredentialFailuresAreSafe(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
page := serve(router, http.MethodGet, "/login", nil, nil)
|
||||
cookie := sessionCookie(t, page)
|
||||
|
||||
withoutCSRF := serve(router, http.MethodPost, "/login", url.Values{
|
||||
"username": {"admin"},
|
||||
"password": {"test-password"},
|
||||
}, cookie)
|
||||
if withoutCSRF.Code != http.StatusForbidden || !strings.Contains(withoutCSRF.Body.String(), "请求已过期") {
|
||||
t.Fatalf("login without CSRF = (%d, %q), want rejected form", withoutCSRF.Code, withoutCSRF.Body.String())
|
||||
}
|
||||
|
||||
page = serve(router, http.MethodGet, "/login", nil, cookie)
|
||||
badCredentials := serve(router, http.MethodPost, "/login", url.Values{
|
||||
"csrf_token": {csrfToken(t, page.Body.String())},
|
||||
"username": {"unknown"},
|
||||
"password": {"wrong"},
|
||||
}, cookie)
|
||||
if badCredentials.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("login with invalid credentials status = %d, want 401", badCredentials.Code)
|
||||
}
|
||||
if body := badCredentials.Body.String(); !strings.Contains(body, "账号或密码不正确") || strings.Contains(body, "unknown") {
|
||||
t.Fatalf("invalid login leaked account detail: %q", body)
|
||||
}
|
||||
}
|
||||
|
||||
func TestTamperedCookieCannotAccessTasks(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
page := serve(router, http.MethodGet, "/login", nil, nil)
|
||||
cookie := sessionCookie(t, page)
|
||||
|
||||
tampered := *cookie
|
||||
tampered.Value = flipCookieValue(t, cookie.Value)
|
||||
response := serve(router, http.MethodGet, "/tasks", nil, &tampered)
|
||||
if response.Code != http.StatusSeeOther {
|
||||
t.Fatalf("tampered cookie status = %d, want 303", response.Code)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) {
|
||||
t.Helper()
|
||||
want := map[string]string{
|
||||
"Cache-Control": "no-store",
|
||||
"X-Content-Type-Options": "nosniff",
|
||||
"Referrer-Policy": "no-referrer",
|
||||
"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
|
||||
}
|
||||
for name, expected := range want {
|
||||
if got := response.Header().Get(name); got != expected {
|
||||
t.Fatalf("%s = %q, want %q", name, got, expected)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func flipCookieValue(t *testing.T, value string) string {
|
||||
t.Helper()
|
||||
if value == "" {
|
||||
t.Fatal("cannot tamper with an empty cookie")
|
||||
}
|
||||
if value[0] == 'A' {
|
||||
return "B" + value[1:]
|
||||
}
|
||||
return "A" + value[1:]
|
||||
}
|
||||
|
||||
func TestLogoutRequiresCSRFAndRevokesSession(t *testing.T) {
|
||||
router, _ := newRouter(t)
|
||||
loginPage := serve(router, http.MethodGet, "/login", nil, nil)
|
||||
loginCookie := sessionCookie(t, loginPage)
|
||||
login := serve(router, http.MethodPost, "/login", url.Values{
|
||||
"csrf_token": {csrfToken(t, loginPage.Body.String())},
|
||||
"username": {"admin"},
|
||||
"password": {"test-password"},
|
||||
}, loginCookie)
|
||||
authenticatedCookie := sessionCookie(t, login)
|
||||
|
||||
missingCSRF := serve(router, http.MethodPost, "/logout", url.Values{}, authenticatedCookie)
|
||||
if missingCSRF.Code != http.StatusForbidden {
|
||||
t.Fatalf("logout without CSRF status = %d, want 403", missingCSRF.Code)
|
||||
}
|
||||
|
||||
tasks := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
|
||||
logout := serve(router, http.MethodPost, "/logout", url.Values{
|
||||
"csrf_token": {csrfToken(t, tasks.Body.String())},
|
||||
}, authenticatedCookie)
|
||||
if logout.Code != http.StatusSeeOther || logout.Header().Get("Location") != "/login" {
|
||||
t.Fatalf("logout = (%d, %q), want 303 /login", logout.Code, logout.Header().Get("Location"))
|
||||
}
|
||||
if cookie := sessionCookie(t, logout); cookie.MaxAge >= 0 {
|
||||
t.Fatalf("logout cookie MaxAge = %d, want a deletion cookie", cookie.MaxAge)
|
||||
}
|
||||
|
||||
reused := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
|
||||
if reused.Code != http.StatusSeeOther {
|
||||
t.Fatalf("revoked session status = %d, want 303", reused.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
|
||||
t.Helper()
|
||||
gin.SetMode(gin.TestMode)
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatalf("generate bcrypt hash: %v", err)
|
||||
}
|
||||
manager := auth.NewManager([]byte(strings.Repeat("s", 32)), false)
|
||||
router, err := server.NewRouter(server.Options{
|
||||
AdminUsername: "admin",
|
||||
AdminPasswordBcrypt: string(hash),
|
||||
Sessions: manager,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("NewRouter: %v", err)
|
||||
}
|
||||
return router, manager
|
||||
}
|
||||
|
||||
func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
|
||||
var body *strings.Reader
|
||||
if form == nil {
|
||||
body = strings.NewReader("")
|
||||
} else {
|
||||
body = strings.NewReader(form.Encode())
|
||||
}
|
||||
request := httptest.NewRequest(method, target, body)
|
||||
if form != nil {
|
||||
request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
}
|
||||
if cookie != nil {
|
||||
request.AddCookie(cookie)
|
||||
}
|
||||
response := httptest.NewRecorder()
|
||||
router.ServeHTTP(response, request)
|
||||
return response
|
||||
}
|
||||
|
||||
func sessionCookie(t *testing.T, response *httptest.ResponseRecorder) *http.Cookie {
|
||||
t.Helper()
|
||||
for _, cookie := range response.Result().Cookies() {
|
||||
if cookie.Name == auth.CookieName {
|
||||
return cookie
|
||||
}
|
||||
}
|
||||
t.Fatalf("response did not set %s cookie", auth.CookieName)
|
||||
return nil
|
||||
}
|
||||
|
||||
func csrfToken(t *testing.T, body string) string {
|
||||
t.Helper()
|
||||
matches := csrfPattern.FindStringSubmatch(body)
|
||||
if len(matches) != 2 || matches[1] == "" {
|
||||
t.Fatalf("no CSRF token in response body: %q", body)
|
||||
}
|
||||
return matches[1]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,63 @@
|
||||
{{define "login.html"}}
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>登录 · 采购服务</title>
|
||||
<style>
|
||||
:root { color-scheme: light; --bg:#f4f7fb; --surface:#fff; --text:#172033; --muted:#526079; --border:#cfd8e6; --primary:#155eef; --primary-hover:#0b4ed1; --primary-soft:#eaf1ff; --danger:#b42318; --danger-soft:#fef3f2; --focus:#ffbf47; --shadow:0 12px 30px rgba(23,32,51,.1); font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif; }
|
||||
* { box-sizing:border-box; }
|
||||
html { min-width:320px; background:var(--bg); }
|
||||
body { min-height:100dvh; margin:0; color:var(--text); background:var(--bg); font-size:16px; line-height:1.55; }
|
||||
button,input { font:inherit; }
|
||||
:focus-visible { outline:3px solid var(--focus); outline-offset:3px; }
|
||||
.skip-link { position:fixed; z-index:10; top:8px; left:8px; padding:10px 14px; color:#fff; background:var(--text); transform:translateY(-160%); }
|
||||
.skip-link:focus { transform:translateY(0); }
|
||||
main { display:grid; min-height:100dvh; place-items:center; padding:24px 16px; }
|
||||
.card { width:min(100%,440px); padding:32px; border:1px solid var(--border); border-radius:14px; background:var(--surface); box-shadow:var(--shadow); }
|
||||
.brand { display:flex; align-items:center; gap:10px; margin:0 0 24px; font-size:1rem; font-weight:700; }
|
||||
.brand-mark { display:grid; width:32px; height:32px; place-items:center; border-radius:8px; color:#fff; background:var(--primary); font-size:.82rem; }
|
||||
h1 { margin:0; font-size:clamp(1.6rem,5vw,2rem); line-height:1.25; }
|
||||
.intro { margin:8px 0 24px; color:var(--muted); }
|
||||
.field { margin-top:16px; }
|
||||
label { display:block; margin-bottom:6px; font-weight:700; }
|
||||
input { width:100%; min-height:44px; padding:10px 12px; border:1px solid #9ba9bc; border-radius:8px; color:var(--text); background:#fff; }
|
||||
input[aria-invalid="true"] { border-color:var(--danger); box-shadow:0 0 0 1px var(--danger); }
|
||||
.hint { margin:5px 0 0; color:var(--muted); font-size:.875rem; }
|
||||
.error { margin:0 0 18px; padding:12px 14px; border-left:4px solid var(--danger); border-radius:6px; color:var(--danger); background:var(--danger-soft); font-weight:650; }
|
||||
.submit { width:100%; min-height:44px; margin-top:24px; padding:10px 16px; border:1px solid transparent; border-radius:8px; color:#fff; background:var(--primary); font-weight:700; cursor:pointer; transition:background-color 180ms ease-out; }
|
||||
.submit:hover { background:var(--primary-hover); }
|
||||
.notice { margin:20px 0 0; padding:12px 14px; border:1px solid #b9cffc; border-radius:8px; color:#29466f; background:var(--primary-soft); font-size:.9rem; }
|
||||
@media (max-width:420px) { main { padding-inline:12px; } .card { padding:24px 16px; } }
|
||||
@media (prefers-reduced-motion:reduce) { *,*::before,*::after { transition-duration:.01ms !important; animation-duration:.01ms !important; } }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<a class="skip-link" href="#main">跳到主要内容</a>
|
||||
<main id="main">
|
||||
<section class="card" aria-labelledby="login-title">
|
||||
<p class="brand"><span class="brand-mark" aria-hidden="true">采</span><span>采购服务</span></p>
|
||||
<h1 id="login-title">管理端登录</h1>
|
||||
<p class="intro">登录后进入采购任务工作台。设备身份不能使用此入口。</p>
|
||||
{{if .Error}}<p class="error" role="alert">{{.Error}}</p>{{end}}
|
||||
<form method="post" action="/login">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
|
||||
<input type="hidden" name="return_to" value="{{.ReturnTo}}">
|
||||
<div class="field">
|
||||
<label for="username">账号</label>
|
||||
<input id="username" name="username" type="text" value="{{.Username}}" autocomplete="username" required aria-invalid="{{if .Error}}true{{else}}false{{end}}" aria-describedby="username-hint">
|
||||
<p class="hint" id="username-hint">使用采购管理员账号登录。</p>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label for="password">密码</label>
|
||||
<input id="password" name="password" type="password" autocomplete="current-password" required aria-invalid="{{if .Error}}true{{else}}false{{end}}">
|
||||
</div>
|
||||
<button class="submit" type="submit">登录并继续</button>
|
||||
</form>
|
||||
<p class="notice">系统只创建待付款订单，付款始终由人完成。</p>
|
||||
</section>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
{{end}}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{define "tasks.html"}}
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>采购任务 · 采购服务</title>
|
||||
<style>
|
||||
:root { color-scheme:light; --bg:#f4f7fb; --surface:#fff; --text:#172033; --muted:#526079; --border:#cfd8e6; --primary:#155eef; --focus:#ffbf47; font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif; }
|
||||
* { box-sizing:border-box; } body { min-height:100dvh; margin:0; color:var(--text); background:var(--bg); font-size:16px; line-height:1.55; } button { font:inherit; } :focus-visible { outline:3px solid var(--focus); outline-offset:3px; }
|
||||
.skip-link { position:fixed; z-index:10; top:8px; left:8px; padding:10px 14px; color:#fff; background:var(--text); transform:translateY(-160%); } .skip-link:focus { transform:translateY(0); }
|
||||
header { display:flex; min-height:64px; align-items:center; justify-content:space-between; gap:16px; padding:10px clamp(16px,4vw,40px); border-bottom:1px solid var(--border); background:var(--surface); }
|
||||
.brand { display:flex; align-items:center; gap:10px; font-weight:700; } .brand-mark { display:grid; width:32px; height:32px; place-items:center; border-radius:8px; color:#fff; background:var(--primary); font-size:.82rem; }
|
||||
.logout { min-height:44px; padding:8px 14px; border:1px solid var(--border); border-radius:8px; color:var(--text); background:var(--surface); font-weight:700; cursor:pointer; }
|
||||
main { width:min(100% - 32px,760px); margin:48px auto; padding:32px; border:1px solid var(--border); border-radius:14px; background:var(--surface); }
|
||||
h1 { margin:0; font-size:clamp(1.5rem,5vw,2rem); } p { color:var(--muted); } .notice { margin-top:24px; padding:14px; border-left:4px solid var(--primary); border-radius:6px; background:#eaf1ff; color:#29466f; }
|
||||
@media (max-width:420px) { main { width:calc(100% - 24px); margin:24px auto; padding:24px 16px; } }
|
||||
@media (prefers-reduced-motion:reduce) { *,*::before,*::after { transition-duration:.01ms !important; animation-duration:.01ms !important; } }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<a class="skip-link" href="#main">跳到主要内容</a>
|
||||
<header><div class="brand"><span class="brand-mark" aria-hidden="true">采</span><span>采购服务</span></div><form method="post" action="/logout"><input type="hidden" name="csrf_token" value="{{.CSRFToken}}"><button class="logout" type="submit">退出登录</button></form></header>
|
||||
<main id="main"><h1>采购任务</h1><p>任务功能正在准备中。</p><p class="notice">当前页面仅用于验证管理员会话。</p></main>
|
||||
</body>
|
||||
</html>
|
||||
{{end}}
|
||||
@@ -0,0 +1,36 @@
|
||||
// Package webui 渲染采购服务当前可用的服务端页面。
|
||||
package webui
|
||||
|
||||
import (
|
||||
"embed"
|
||||
"html/template"
|
||||
"io"
|
||||
)
|
||||
|
||||
//go:embed templates/*.html
|
||||
var templateFiles embed.FS
|
||||
|
||||
var templates = template.Must(template.New("webui").ParseFS(templateFiles, "templates/*.html"))
|
||||
|
||||
// LoginData 是登录页面所需的非敏感展示数据。
|
||||
type LoginData struct {
|
||||
CSRFToken string
|
||||
ReturnTo string
|
||||
Username string
|
||||
Error string
|
||||
}
|
||||
|
||||
// TasksData 是当前受保护任务空壳所需的数据。任务字段将在后续任务实现。
|
||||
type TasksData struct {
|
||||
CSRFToken string
|
||||
}
|
||||
|
||||
// RenderLogin 写入登录页。
|
||||
func RenderLogin(writer io.Writer, data LoginData) error {
|
||||
return templates.ExecuteTemplate(writer, "login.html", data)
|
||||
}
|
||||
|
||||
// RenderTasks 写入登录后的受保护空壳。
|
||||
func RenderTasks(writer io.Writer, data TasksData) error {
|
||||
return templates.ExecuteTemplate(writer, "tasks.html", data)
|
||||
}
|
||||
@@ -1,6 +1,7 @@
|
||||
"""T-103 原始规格面板证据的本机确定性隐私脱敏。
|
||||
|
||||
此模块只处理人工采集的本地文件：不连接设备、不理解拼多多页面，也不识别规格或价格。
|
||||
此模块只处理人工采集的本地文件：不连接设备、不识别规格；仅可按已取证的固定
|
||||
几何和严格格式，将跨隐私边界的价格叶节点投影到派生 XML。
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
@@ -21,7 +22,7 @@ from ..pdd.product_url import ProductUrl, ProductUrlError, parse_product_url
|
||||
from ..pdd.sku_panel_state import HUMAN_DECLARED_STATES
|
||||
|
||||
|
||||
SANITIZER_VERSION = "t103-privacy-v3"
|
||||
SANITIZER_VERSION = "t103-privacy-v4"
|
||||
EXPECTED_GOODS_ID = "937122477375"
|
||||
EXPECTED_PDD_VERSION = "8.17.0"
|
||||
EXPECTED_DEVICE_MODEL = "PKG110"
|
||||
@@ -37,6 +38,27 @@ _FULL_PHONE_RE = re.compile(r"(?:\+?86)?1[3-9]\d{9}")
|
||||
_MASKED_PHONE_RE = re.compile(r"1[3-9]\d\*{4}\d{4}")
|
||||
_MASK_TRANSLATION = str.maketrans({"＊": "*", "•": "*", "·": "*", "×": "*", "x": "*", "X": "*"})
|
||||
_SEPARATOR_RE = re.compile(r"[\s\-‐‑‒–—―()（）]+")
|
||||
# 这两个槽位来自 T-103 当前第一态、1080×2376 XML 坐标的人工审查。它们不是通用
|
||||
# 页面判据；坐标、文本或结构任何变化都停止发布，交由人重新取证。
|
||||
_CROSSING_PRICE_SLOTS = {
|
||||
(396, 503, 712, 570): "[396,503][712,570]",
|
||||
(730, 503, 895, 570): "[730,503][895,570]",
|
||||
}
|
||||
_CROSSING_PRICE_BOUNDS = frozenset(_CROSSING_PRICE_SLOTS)
|
||||
_PRICE_PROJECTION_ATTRIBUTES = (
|
||||
"bounds",
|
||||
"text",
|
||||
"package",
|
||||
"class",
|
||||
"clickable",
|
||||
"enabled",
|
||||
"visible-to-user",
|
||||
)
|
||||
# 仅接受普通 ASCII 空格，且每个可分隔位置最多一个；禁止换行、折扣、支付/提交文案和
|
||||
# 任何其它字符。前缀捕获组用于区分当前价与至多一个划线/原价候选。
|
||||
_CROSSING_PRICE_TEXT_RE = re.compile(r" {0,1}(?:(快卖光) {0,1})?[¥￥] {0,1}[1-9]\d*\.\d{2} {0,1}\Z")
|
||||
_CROSSING_PRICE_PREFIX_RE = re.compile(r" {0,1}(?:快卖光 {0,1})?[¥￥] {0,1}[1-9]\d*\.\d{2} {0,1}")
|
||||
_CROSSING_PRICE_ALLOWED_CHARACTERS = frozenset(" 快卖光¥￥0123456789.")
|
||||
|
||||
|
||||
class SkuEvidenceSanitizationError(RuntimeError):
|
||||
@@ -49,9 +71,12 @@ class _CleanupStats:
|
||||
|
||||
removed_nodes: int = 0
|
||||
cleared_crossing_nodes: int = 0
|
||||
preserved_crossing_price_nodes: int = 0
|
||||
retained_below_nodes: int = 0
|
||||
max_right: int = 0
|
||||
max_bottom: int = 0
|
||||
current_price_candidates: int = 0
|
||||
original_price_candidates: int = 0
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
@@ -271,6 +296,7 @@ def _sanitize_hierarchy(source: Path, target: Path) -> _CleanupStats:
|
||||
_require_expected_xml_coordinate_space(stats)
|
||||
if stats.removed_nodes < 1 or stats.retained_below_nodes < 1:
|
||||
raise SkuEvidenceSanitizationError("原始节点树未满足隐私几何结构。")
|
||||
_require_safe_crossing_price_projection(stats)
|
||||
if _contains_phone(root):
|
||||
raise SkuEvidenceSanitizationError("派生节点树仍包含手机号，拒绝发布。")
|
||||
ElementTree.ElementTree(root).write(target, encoding="utf-8", xml_declaration=True)
|
||||
@@ -294,9 +320,12 @@ def _sanitize_node(parent: ElementTree.Element, node: ElementTree.Element, stats
|
||||
parent.remove(node)
|
||||
return
|
||||
if position == "crossing":
|
||||
# 全屏/跨界容器可保留其下方子节点，但自身所有属性和文本都可能含地址或手机号。
|
||||
_clear_node_text(node)
|
||||
stats.cleared_crossing_nodes += 1
|
||||
if bounds in _CROSSING_PRICE_BOUNDS and node.get("text"):
|
||||
_project_crossing_price_node(node, bounds, stats)
|
||||
else:
|
||||
# 全屏/跨界容器可保留其下方子节点，但自身所有属性和文本都可能含地址或手机号。
|
||||
_clear_node_text(node)
|
||||
stats.cleared_crossing_nodes += 1
|
||||
else:
|
||||
stats.retained_below_nodes += 1
|
||||
for child in list(node):
|
||||
@@ -340,6 +369,83 @@ def _vertical_position(bounds: tuple[int, int, int, int]) -> str:
|
||||
return "crossing"
|
||||
|
||||
|
||||
def _project_crossing_price_node(
|
||||
node: ElementTree.Element,
|
||||
bounds: tuple[int, int, int, int],
|
||||
stats: _CleanupStats,
|
||||
) -> None:
|
||||
"""投影唯一允许的跨界价格叶节点；任何结构漂移一律拒绝发布。"""
|
||||
|
||||
if (
|
||||
len(node) != 0
|
||||
or node.get("package") != "com.xunmeng.pinduoduo"
|
||||
or node.get("class") != "android.widget.TextView"
|
||||
or node.get("clickable") != "false"
|
||||
or node.get("enabled") != "true"
|
||||
or node.get("visible-to-user") != "true"
|
||||
):
|
||||
raise SkuEvidenceSanitizationError("跨界价格节点结构不匹配，拒绝发布。")
|
||||
text = node.get("text")
|
||||
if text is None:
|
||||
raise SkuEvidenceSanitizationError("跨界价格节点文本不匹配，拒绝发布。")
|
||||
match = _CROSSING_PRICE_TEXT_RE.fullmatch(text)
|
||||
if match is None:
|
||||
raise _crossing_price_text_mismatch_error(bounds, text)
|
||||
|
||||
# 只有这七项经上述检查后可进入派生 XML；尤其不复制 content-desc、resource-id 等原始属性。
|
||||
node.attrib = {attribute: node.attrib[attribute] for attribute in _PRICE_PROJECTION_ATTRIBUTES}
|
||||
node.text = None
|
||||
node.tail = None
|
||||
stats.preserved_crossing_price_nodes += 1
|
||||
if match.group(1) is not None:
|
||||
stats.current_price_candidates += 1
|
||||
else:
|
||||
stats.original_price_candidates += 1
|
||||
|
||||
|
||||
def _crossing_price_text_mismatch_error(
|
||||
bounds: tuple[int, int, int, int],
|
||||
text: str,
|
||||
) -> SkuEvidenceSanitizationError:
|
||||
"""仅输出固定槽位与 reason，避免将任意 raw 正文带入 CLI 或日志。"""
|
||||
|
||||
reason = _crossing_price_text_mismatch_reason(text)
|
||||
slot = _CROSSING_PRICE_SLOTS[bounds]
|
||||
return SkuEvidenceSanitizationError(f"跨界价格节点文本不匹配：slot={slot}；reason={reason}。")
|
||||
|
||||
|
||||
def _crossing_price_text_mismatch_reason(text: str) -> str:
|
||||
"""将未匹配文本归类为受控枚举；返回值绝不包含原始片段。"""
|
||||
|
||||
if "\r" in text or "\n" in text:
|
||||
return "newline"
|
||||
if any(character.isspace() and character != " " for character in text):
|
||||
return "non_ascii_whitespace"
|
||||
if any(marker in text for marker in ("提交订单", "支付", "下单", "优惠")):
|
||||
return "extra_or_order"
|
||||
without_leading_space = text.lstrip(" ")
|
||||
if without_leading_space.startswith("快") and not without_leading_space.startswith("快卖光"):
|
||||
return "known_prefix_missing"
|
||||
if "¥" not in text and "￥" not in text:
|
||||
return "currency_missing"
|
||||
if _CROSSING_PRICE_PREFIX_RE.match(text) is not None:
|
||||
return "extra_or_order"
|
||||
if any(character not in _CROSSING_PRICE_ALLOWED_CHARACTERS for character in text):
|
||||
return "forbidden_characters"
|
||||
return "amount_shape"
|
||||
|
||||
|
||||
def _require_safe_crossing_price_projection(stats: _CleanupStats) -> None:
|
||||
"""当前价必须唯一；原价仅可选且唯一，避免把任意金额释放为价格证据。"""
|
||||
|
||||
if (
|
||||
stats.current_price_candidates != 1
|
||||
or stats.original_price_candidates > 1
|
||||
or stats.preserved_crossing_price_nodes != stats.current_price_candidates + stats.original_price_candidates
|
||||
):
|
||||
raise SkuEvidenceSanitizationError("跨界价格候选不唯一或缺失，拒绝发布。")
|
||||
|
||||
|
||||
def _clear_node_text(node: ElementTree.Element) -> None:
|
||||
node.attrib = {"bounds": node.attrib["bounds"]} if "bounds" in node.attrib else {}
|
||||
node.text = None
|
||||
@@ -415,6 +521,7 @@ def _derived_manifest(
|
||||
"privacy_cleanup": {
|
||||
"removed_nodes": cleanup_stats.removed_nodes,
|
||||
"cleared_crossing_nodes": cleanup_stats.cleared_crossing_nodes,
|
||||
"preserved_crossing_price_nodes": cleanup_stats.preserved_crossing_price_nodes,
|
||||
"retained_below_nodes": cleanup_stats.retained_below_nodes,
|
||||
"max_right": cleanup_stats.max_right,
|
||||
"max_bottom": cleanup_stats.max_bottom,
|
||||
|
||||
@@ -34,6 +34,10 @@ TEST_ADDRESS = "SYNTHETIC_ADDRESS_NEVER_PUBLISH"
|
||||
FULL_PHONE = "13800138000"
|
||||
MASKED_PHONE = "138****0000"
|
||||
SAFE_TEXT = "synthetic-safe-lower-content"
|
||||
CURRENT_PRICE = "快卖光 ¥12.88"
|
||||
ORIGINAL_PRICE = "¥29.00"
|
||||
PRICE_CURRENT_BOUNDS = "[396,503][712,570]"
|
||||
PRICE_ORIGINAL_BOUNDS = "[730,503][895,570]"
|
||||
|
||||
|
||||
def _hash(path: Path) -> str:
|
||||
@@ -48,11 +52,56 @@ def _default_xml() -> str:
|
||||
return (
|
||||
"<hierarchy rotation='0'>"
|
||||
f"<node bounds='[0,0][1080,540]' text='{TEST_ADDRESS}' content-desc='{MASKED_PHONE} {FULL_PHONE}' />"
|
||||
f"{_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS)}"
|
||||
f"{_price_node(ORIGINAL_PRICE, PRICE_ORIGINAL_BOUNDS)}"
|
||||
f"<node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' />"
|
||||
"</hierarchy>"
|
||||
)
|
||||
|
||||
|
||||
def _price_node(
|
||||
text: str,
|
||||
bounds: str,
|
||||
*,
|
||||
package: str = "com.xunmeng.pinduoduo",
|
||||
node_class: str = "android.widget.TextView",
|
||||
clickable: str = "false",
|
||||
enabled: str = "true",
|
||||
visible: str = "true",
|
||||
extra_attributes: str = "",
|
||||
children: str = "",
|
||||
) -> str:
|
||||
attributes = (
|
||||
f"bounds='{bounds}' text='{text}' package='{package}' class='{node_class}' "
|
||||
f"clickable='{clickable}' enabled='{enabled}' visible-to-user='{visible}'{extra_attributes}"
|
||||
)
|
||||
return f"<node {attributes}>{children}</node>"
|
||||
|
||||
|
||||
def _xml_with_prices(
|
||||
current: str = CURRENT_PRICE,
|
||||
original: str = ORIGINAL_PRICE,
|
||||
*,
|
||||
current_node: str | None = None,
|
||||
original_node: str | None = None,
|
||||
include_original: bool = True,
|
||||
extra_nodes: str = "",
|
||||
) -> str:
|
||||
current_markup = current_node if current_node is not None else _price_node(current, PRICE_CURRENT_BOUNDS)
|
||||
original_markup = (
|
||||
original_node if original_node is not None else _price_node(original, PRICE_ORIGINAL_BOUNDS)
|
||||
) if include_original else ""
|
||||
return (
|
||||
"<hierarchy>"
|
||||
f"<node bounds='[0,0][1080,540]' text='{TEST_ADDRESS}' />"
|
||||
f"{current_markup}"
|
||||
f"{original_markup}"
|
||||
f"{extra_nodes}"
|
||||
f"<node bounds='[0,570][1080,2376]' text='{SAFE_TEXT}' />"
|
||||
"</hierarchy>"
|
||||
)
|
||||
|
||||
|
||||
def _write_raw(
|
||||
root: Path,
|
||||
*,
|
||||
@@ -117,7 +166,7 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
|
||||
self.assertNotIn(MASKED_PHONE, derived_xml)
|
||||
self.assertIn(f'"human_declared_state": "{state}"', manifest)
|
||||
self.assertIn('"privacy_tier": "SANITIZED"', manifest)
|
||||
self.assertIn('"sanitizer_version": "t103-privacy-v3"', manifest)
|
||||
self.assertIn('"sanitizer_version": "t103-privacy-v4"', manifest)
|
||||
self.assertIn('"screenshot_space": {', manifest)
|
||||
self.assertIn('"xml_coordinate_space": {', manifest)
|
||||
self.assertIn('"height": 2376', manifest)
|
||||
@@ -125,6 +174,7 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
|
||||
self.assertIn('"privacy_mask_rectangle": [', manifest)
|
||||
self.assertIn('"removed_nodes": 1', manifest)
|
||||
self.assertIn('"cleared_crossing_nodes": 0', manifest)
|
||||
self.assertIn('"preserved_crossing_price_nodes": 2', manifest)
|
||||
self.assertIn('"retained_below_nodes": 1', manifest)
|
||||
self.assertIn('"max_right": 1080', manifest)
|
||||
self.assertIn('"max_bottom": 2376', manifest)
|
||||
@@ -140,6 +190,8 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
|
||||
"<hierarchy>"
|
||||
f"<node bounds='[0,0][1080,2376]' text='{TEST_ADDRESS}' content-desc='{MASKED_PHONE}'>"
|
||||
f"<node bounds='[0,0][1080,540]' text='{FULL_PHONE}' />"
|
||||
f"{_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS)}"
|
||||
f"{_price_node(ORIGINAL_PRICE, PRICE_ORIGINAL_BOUNDS)}"
|
||||
f"<node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' />"
|
||||
"</node></hierarchy>"
|
||||
)
|
||||
@@ -152,20 +204,245 @@ class SkuEvidenceSanitizerTests(unittest.TestCase):
|
||||
self.assertIsNotNone(crossing)
|
||||
assert crossing is not None
|
||||
self.assertEqual(crossing.attrib, {"bounds": "[0,0][1080,2376]"})
|
||||
self.assertEqual(len(list(crossing)), 1)
|
||||
self.assertEqual(list(crossing)[0].get("text"), SAFE_TEXT)
|
||||
self.assertEqual(len(list(crossing)), 3)
|
||||
self.assertEqual(list(crossing)[-1].get("text"), SAFE_TEXT)
|
||||
manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
|
||||
self.assertEqual(
|
||||
manifest["privacy_cleanup"],
|
||||
{
|
||||
"removed_nodes": 1,
|
||||
"cleared_crossing_nodes": 1,
|
||||
"preserved_crossing_price_nodes": 2,
|
||||
"retained_below_nodes": 1,
|
||||
"max_right": 1080,
|
||||
"max_bottom": 2376,
|
||||
},
|
||||
)
|
||||
|
||||
def test_only_strict_crossing_price_leaves_are_projected_with_whitelisted_attributes(self) -> None:
|
||||
xml = _xml_with_prices(
|
||||
current_node=_price_node(
|
||||
CURRENT_PRICE,
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
extra_attributes=" content-desc='discard' resource-id='discard' focused='true'",
|
||||
),
|
||||
original_node=_price_node(
|
||||
ORIGINAL_PRICE,
|
||||
PRICE_ORIGINAL_BOUNDS,
|
||||
extra_attributes=" content-desc='discard-too' resource-id='discard-too'",
|
||||
),
|
||||
)
|
||||
with TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=xml)
|
||||
result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
root = ElementTree.parse(result.hierarchy_path).getroot()
|
||||
prices = [node for node in root.findall("node") if node.get("text") in {CURRENT_PRICE, ORIGINAL_PRICE}]
|
||||
|
||||
self.assertEqual(len(prices), 2)
|
||||
for node in prices:
|
||||
self.assertEqual(
|
||||
set(node.attrib),
|
||||
{"bounds", "text", "package", "class", "clickable", "enabled", "visible-to-user"},
|
||||
)
|
||||
self.assertEqual(node.get("package"), "com.xunmeng.pinduoduo")
|
||||
self.assertEqual(node.get("class"), "android.widget.TextView")
|
||||
self.assertEqual(node.get("clickable"), "false")
|
||||
self.assertEqual(node.get("enabled"), "true")
|
||||
self.assertEqual(node.get("visible-to-user"), "true")
|
||||
|
||||
manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
|
||||
self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 2)
|
||||
self.assertNotIn("discard", result.hierarchy_path.read_text(encoding="utf-8"))
|
||||
|
||||
def test_crossing_price_window_rejects_text_and_structure_drift(self) -> None:
|
||||
bad_texts = (
|
||||
f"快卖光 ¥12.88 {TEST_ADDRESS}",
|
||||
f"快卖光 ¥12.88 {FULL_PHONE}",
|
||||
"快卖光 ¥12.88 使用微信支付",
|
||||
"快卖光 ¥12.88 提交订单",
|
||||
"快卖光 ¥12.88 优惠-11元",
|
||||
"快要抢光 ¥12.88",
|
||||
"快卖光 ¥0.00",
|
||||
"快卖光 ¥12.8",
|
||||
"快卖光 ¥12.880",
|
||||
"快卖光 ¥12.88",
|
||||
)
|
||||
for text in bad_texts:
|
||||
with self.subTest(text=text), TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
|
||||
with self.assertRaises(SkuEvidenceSanitizationError):
|
||||
sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
self.assertFalse((raw.parent / "derived").exists())
|
||||
|
||||
def test_crossing_price_text_mismatch_reports_only_fixed_slot_and_reason(self) -> None:
|
||||
newline_node = _price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS).replace(
|
||||
"快卖光 ¥12.88", "快卖光 ¥12.88"
|
||||
)
|
||||
cases = (
|
||||
("newline", _xml_with_prices(current_node=newline_node), "newline", PRICE_CURRENT_BOUNDS),
|
||||
(
|
||||
"non-ascii-whitespace",
|
||||
_xml_with_prices(current="快卖光 ¥12.88"),
|
||||
"non_ascii_whitespace",
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
),
|
||||
(
|
||||
"known-prefix-missing",
|
||||
_xml_with_prices(current="快要抢光 ¥12.88"),
|
||||
"known_prefix_missing",
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
),
|
||||
(
|
||||
"currency-missing",
|
||||
_xml_with_prices(current="快卖光 12.88"),
|
||||
"currency_missing",
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
),
|
||||
(
|
||||
"amount-shape",
|
||||
_xml_with_prices(current="快卖光 ¥12.8"),
|
||||
"amount_shape",
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
),
|
||||
(
|
||||
"extra-or-order",
|
||||
_xml_with_prices(current="提交订单 ¥12.88"),
|
||||
"extra_or_order",
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
),
|
||||
(
|
||||
"forbidden-characters",
|
||||
_xml_with_prices(current="商品 ¥12.88"),
|
||||
"forbidden_characters",
|
||||
PRICE_CURRENT_BOUNDS,
|
||||
),
|
||||
(
|
||||
"right-slot-amount-shape",
|
||||
_xml_with_prices(original="¥29.0"),
|
||||
"amount_shape",
|
||||
PRICE_ORIGINAL_BOUNDS,
|
||||
),
|
||||
)
|
||||
for name, xml, reason, bounds in cases:
|
||||
with self.subTest(name=name), TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=xml)
|
||||
with self.assertRaises(SkuEvidenceSanitizationError) as raised:
|
||||
sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
|
||||
self.assertEqual(
|
||||
str(raised.exception),
|
||||
f"跨界价格节点文本不匹配：slot={bounds}；reason={reason}。",
|
||||
)
|
||||
self.assertFalse((raw.parent / "derived").exists())
|
||||
|
||||
def test_crossing_price_text_mismatch_never_echoes_sensitive_or_order_text(self) -> None:
|
||||
cases = (
|
||||
f"快卖光 ¥12.88 {TEST_ADDRESS}",
|
||||
f"快卖光 ¥12.88 {FULL_PHONE}",
|
||||
"快卖光 ¥12.88 使用微信支付",
|
||||
"快卖光 ¥12.88 提交订单",
|
||||
)
|
||||
for text in cases:
|
||||
with self.subTest(text=text), TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
|
||||
with self.assertRaises(SkuEvidenceSanitizationError) as raised:
|
||||
sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
|
||||
message = str(raised.exception)
|
||||
self.assertIn("slot=[396,503][712,570]", message)
|
||||
self.assertIn("reason=extra_or_order", message)
|
||||
for raw_fragment in (TEST_ADDRESS, FULL_PHONE, "使用微信支付", "提交订单", "¥12.88"):
|
||||
self.assertNotIn(raw_fragment, message)
|
||||
|
||||
def test_crossing_price_projection_allows_only_limited_ascii_spaces_and_yen_variants(self) -> None:
|
||||
for current in ("快卖光 ¥12.88", " 快卖光 ¥ 12.88 ", "快卖光 ￥12.88"):
|
||||
with self.subTest(current=current), TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=current))
|
||||
result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
|
||||
self.assertIn(current, hierarchy)
|
||||
|
||||
def test_unique_current_price_without_original_price_is_published(self) -> None:
|
||||
with TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=_xml_with_prices(include_original=False))
|
||||
result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
|
||||
manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
|
||||
|
||||
self.assertIn(CURRENT_PRICE, hierarchy)
|
||||
self.assertNotIn(ORIGINAL_PRICE, hierarchy)
|
||||
self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 1)
|
||||
|
||||
def test_crossing_price_projection_rejects_newline_and_structure_drift(self) -> None:
|
||||
encoded_newline = _price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS).replace(
|
||||
"快卖光 ¥12.88", "快卖光 ¥12.88"
|
||||
)
|
||||
with TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=_xml_with_prices(current_node=encoded_newline))
|
||||
with self.assertRaises(SkuEvidenceSanitizationError):
|
||||
sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
self.assertFalse((raw.parent / "derived").exists())
|
||||
|
||||
bad_structure = (
|
||||
("package", {"package": "com.android.systemui"}),
|
||||
("class", {"node_class": "android.view.View"}),
|
||||
("clickable", {"clickable": "true"}),
|
||||
("disabled", {"enabled": "false"}),
|
||||
("hidden", {"visible": "false"}),
|
||||
("children", {"children": "<node bounds='[400,510][500,520]' />"}),
|
||||
)
|
||||
for name, kwargs in bad_structure:
|
||||
with self.subTest(structure=name), TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(
|
||||
Path(temporary),
|
||||
xml=_xml_with_prices(current_node=_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS, **kwargs)),
|
||||
)
|
||||
with self.assertRaises(SkuEvidenceSanitizationError):
|
||||
sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
self.assertFalse((raw.parent / "derived").exists())
|
||||
|
||||
def test_crossing_price_candidates_require_unique_current_and_at_most_one_original(self) -> None:
|
||||
scenarios = (
|
||||
(
|
||||
"missing-current",
|
||||
_xml_with_prices(current="¥12.88", original=ORIGINAL_PRICE),
|
||||
),
|
||||
(
|
||||
"duplicate-current",
|
||||
_xml_with_prices(current=CURRENT_PRICE, original=f"快卖光 {ORIGINAL_PRICE}"),
|
||||
),
|
||||
(
|
||||
"multiple-original",
|
||||
_xml_with_prices(
|
||||
extra_nodes=_price_node("¥39.88", PRICE_ORIGINAL_BOUNDS),
|
||||
),
|
||||
),
|
||||
)
|
||||
for name, xml in scenarios:
|
||||
with self.subTest(name=name), TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=xml)
|
||||
with self.assertRaises(SkuEvidenceSanitizationError):
|
||||
sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
self.assertFalse((raw.parent / "derived").exists())
|
||||
|
||||
def test_crossing_price_outside_fixed_windows_is_cleared_and_submit_price_is_not_candidate(self) -> None:
|
||||
outside_crossing = _price_node("快卖光 ¥99.99", "[396,498][712,570]")
|
||||
submit = (
|
||||
"<node bounds='[369,2225][710,2284]' text='提交订单 ¥12.88' "
|
||||
"package='com.xunmeng.pinduoduo' class='android.widget.TextView' clickable='false' "
|
||||
"enabled='true' visible-to-user='true' resource-id='submit-button' />"
|
||||
)
|
||||
with TemporaryDirectory() as temporary:
|
||||
raw = _write_raw(Path(temporary), xml=_xml_with_prices(extra_nodes=outside_crossing + submit))
|
||||
result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
|
||||
hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
|
||||
manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
|
||||
|
||||
self.assertNotIn("快卖光 ¥99.99", hierarchy)
|
||||
self.assertIn("提交订单 ¥12.88", hierarchy)
|
||||
self.assertIn("submit-button", hierarchy)
|
||||
self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 2)
|
||||
|
||||
def test_same_raw_and_config_produce_identical_derived_files(self) -> None:
|
||||
with TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
|
||||
+15
-7
@@ -155,12 +155,20 @@ T-103 已在 `client/src/cmbuyer_client/device/sku_evidence_sanitizer.py` 实现
|
||||
`client/scripts/sanitize_sku_panel_evidence.py` 提供离线 CLI。第一组新 raw 的 PNG 头部由人确认实际为
|
||||
1080×2376，推翻了 v1 将截图和 XML 坐标空间都写成 1080×2400 的假设；v1 正确拒绝且原始证据未重采。
|
||||
随后 v2 在同一份 raw 上安全报告 XML `observed 1080x2376` 并拒绝发布，证明其独立配置的
|
||||
1080×2400 假设同样不成立。当前 `t103-privacy-v3` 配置精确绑定 PKG110 / Android 16 / 拼多多
|
||||
8.17.0 / goods_id `937122477375`；screenshot space 与 XML coordinate space 仍分别建模、分别校验，
|
||||
当前都精确为 1080×2376，且都把
|
||||
1080×2400 假设同样不成立。v3 用同一 raw 成功发布后，人已确认截图隐私带完整遮挡、派生 XML
|
||||
不含地址或手机号且目标颜色和尺码仍为预选；但顶部当前价节点横跨隐私带边界，v3 只留下断片，
|
||||
而下方完整的“提交订单 ¥12.88”属于第一趟硬拒绝区，不能作为 SKU 单价证据。
|
||||
|
||||
当前 `t103-privacy-v4` 继续精确绑定 PKG110 / Android 16 / 拼多多 8.17.0 / goods_id
|
||||
`937122477375`；screenshot space 与 XML coordinate space 仍分别建模、分别校验，当前都精确为
|
||||
1080×2376，且都把
|
||||
`[0,0,1080,540)` 作为整宽隐私带。截图覆盖该区域；XML 递归移除区域内节点，跨界容器只清空自身
|
||||
敏感属性并保留下方子节点。地址依靠已确认的整块几何隔离而不是易漏的关键词表；完整、掩码、带分隔符
|
||||
或跨节点手机号残留会被自动复检拒绝。
|
||||
敏感属性并保留下方子节点。v4 **不改变或缩小截图遮罩**，只允许交界带两个已取证精确 bounds 中，
|
||||
属于拼多多包、不可点击、可见且启用的 `TextView` 叶节点投影最小价格属性；当前价必须唯一匹配
|
||||
可选“快卖光”前缀加人民币符号和两位小数，原价同格式且最多一个。包外、可点击、结构漂移、重复、
|
||||
零值、混杂文本或坐标变化一律拒绝。地址依靠已确认的整块几何隔离而不是易漏的关键词表；完整、
|
||||
掩码、带分隔符或跨节点手机号残留会被自动复检拒绝。v4 离线实现已通过合成测试，仍须由人用同一
|
||||
第一态 raw 重跑并确认派生结果，才构成真实价格证据。
|
||||
|
||||
```powershell
|
||||
.\client\.venv\Scripts\python.exe client\scripts\sanitize_sku_panel_evidence.py --raw-dir "<证据目录>\raw" --output-dir "<证据目录>\derived"
|
||||
@@ -170,8 +178,8 @@ T-103 已在 `client/src/cmbuyer_client/device/sku_evidence_sanitizer.py` 实现
|
||||
节点观察到的最大 right/bottom 必须精确为 1080×2376，否则只报告非敏感 observed 尺寸并拒绝。它只允许发布到
|
||||
同级且尚不存在的 `derived`；失败或发布竞态不覆盖已有目录、不留下 staging。派生 manifest 记录
|
||||
`privacy_tier=SANITIZED`、sanitizer 版本、两个坐标空间、清理计数及本机 source/derived 哈希，不记录
|
||||
原始路径、serial 或页面正文。只有自动复检通过并经人确认状态对应性的派生物，agent 才能读取并提取
|
||||
最小 fixture、编写判据。
|
||||
原始路径、serial 或页面正文；v4 另记录 `preserved_crossing_price_nodes`，用于核对严格价格投影
|
||||
数量。只有自动复检通过并经人确认状态对应性的派生物，agent 才能读取并提取最小 fixture、编写判据。
|
||||
|
||||
2026-08-04 的首轮旧证据只用于确认上述入口事实；其中旧 `initial` 不是规格面板，另两张原始截图含隐私
|
||||
区域，因此 XML 未读取、fixture 与选择器未生成。T-110 完成受控入口与脱敏契约后，T-103 重新取证；
|
||||
|
||||
+19
-12
@@ -21,7 +21,7 @@
|
||||
`client/` 已有 Python 包、PySide6 最小入口、运行目录与日志脱敏策略，以及显式 serial 的 ADB
|
||||
连接边界、本地基线取证 CLI、受限商品链接打开取证 CLI、人工声明规格面板状态的只读取证 CLI，
|
||||
以及绑定 PKG110 / Android 16 / 拼多多 8.17.0 的规格证据确定性脱敏 CLI；尚无规格选择、价格读取或下单流程
|
||||
- 测试：采购服务已覆盖健康检查、核心模型、迁移与状态机等离线包级测试；采购工具 69 项离线单元测试
|
||||
- 测试：采购服务已覆盖健康检查、核心模型、迁移与状态机等离线包级测试；采购工具 78 项离线单元测试
|
||||
（全部 mock，不连接真机）
|
||||
- 数据：SQLite 核心表与迁移已落成；无业务实例数据
|
||||
- 标准启动路径：Windows PowerShell 运行 `./init.ps1`，Unix shell 运行 `./init.sh`。Windows 入口
|
||||
@@ -32,10 +32,13 @@
|
||||
- 当前设备门禁：人工已确认拼多多 8.17.0、goods_id `937122477375` 的衣服商品只能通过“快要抢光”
|
||||
打开规格面板；T-110 已获项目所有者批准，只把该证据/版本绑定的精确唯一入口作为第一趟可逆导航，
|
||||
数量、确认页、提交订单、付款与通用点击能力仍不可达。T-103 的原始证据本机隔离与确定性脱敏器
|
||||
已完成离线实现；人工确认面板刚打开时目标颜色和尺码已经自动选中，取证三态已据此修正。下一步
|
||||
用 v3 对已采第一态 raw 重新脱敏；截图与 XML 已分别安全观测为 1080×2376，仍作为两个独立坐标
|
||||
空间严格校验。第一态 derived 经人验收后，再采集“两个维度改为非目标 / 两个维度恢复目标”的 raw，
|
||||
并由人只核对 derived。在派生证据验收前不写页面判据，Phase 2 仍不能抢跑。
|
||||
已完成离线实现；第一态 v3 derived 已由人确认隐私安全，并证明目标颜色和尺码自动预选，派生哈希
|
||||
复算一致。顶部规格价格横跨隐私遮罩边界，当前只保留了不可读断片；唯一完整金额位于禁触的
|
||||
“提交订单 ¥12.88”区域，不能作为第一趟价格证据。v4 已在保持截图遮罩不变的前提下，只允许顶部
|
||||
交界带中满足精确坐标、拼多多包、非点击叶节点和严格金额格式的文本投影到派生 XML，离线门禁已通过；
|
||||
下一步由人保留已验收 v3 derived，并用同一 raw 重跑 v4。价格证据通过后才采集“两个维度改为非目标 /
|
||||
两个维度恢复目标”两态。T-010 已允许不依赖真机字段的 T-201 和只创建 `DRAFT` 的 T-202 并行；
|
||||
T-203 及后续会启动试选或依赖真机字段的 Phase 2 功能继续等待 T-103。
|
||||
|
||||
## 当前目录要点
|
||||
|
||||
@@ -59,9 +62,11 @@
|
||||
- 已完成：T-002（采购工具 Python 骨架）、T-003（双端统一初始化与验证入口）、
|
||||
T-004（核心数据模型）、T-101（真机环境盘点与 USB/WiFi 双通道人工验收）、T-102（canonical
|
||||
链接打开与目标商品/隐私人工验收）。
|
||||
- 已完成 T-010（安全并行门禁）；T-201（管理员登录与会话）已在独立写路径并行开发。T-202 可在
|
||||
T-201 完成后继续，但只能创建和展示 `DRAFT`，不得启动试选或引入未经 T-103 证实的真机字段。
|
||||
- 已完成 T-110（第一趟受控规格入口与隐私脱敏边界）。T-103 是当前最高优先级和 MVP 生死线，
|
||||
已补充 T-110 依赖并恢复 `DOING`；脱敏器已完成，三态派生证据和新真机验收完成前不开发依赖真机可读字段的
|
||||
Phase 2 生产页面。
|
||||
已补充 T-110 依赖并恢复 `DOING`；v4 脱敏器离线实现已完成，三态派生证据和新真机验收完成前不开发
|
||||
T-203 及后续依赖真机可读字段或会启动试选的 Phase 2 生产页面。
|
||||
- 已确认原型继续只作信息架构依据；原型假数据不调用真实接口、不驱动真机。真机结论改变
|
||||
可读字段时必须先回修原型与交互清单。
|
||||
|
||||
@@ -161,11 +166,13 @@ T-103 已确认当前衣服商品只能从精确文案“快要抢光”进入
|
||||
.\client\.venv\Scripts\python.exe client\scripts\sanitize_sku_panel_evidence.py --raw-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-target-restored-<GOODS_ID>-v2\raw" --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-target-restored-<GOODS_ID>-v2\derived"
|
||||
```
|
||||
|
||||
原始 screenshot/XML 可能包含 PDD 固定展示的地址和掩码手机号，只能留在本机 `raw` 目录，不能由
|
||||
agent、fixture、业务或上传端消费。`t103-privacy-v3` 把截图与 XML 保持为两个独立坐标空间，
|
||||
并根据同一第一态 raw 的两次 fail-closed 安全观测将二者分别精确固定为 1080×2376；它校验源哈希、
|
||||
设备/App/商品/人工状态与隐私结构，在 sibling
|
||||
`derived` 目录原子发布 screenshot/XML 与 manifest；任何不匹配、手机号残留或已有目标均拒绝发布。
|
||||
PDD 现场显示地址和掩码手机号不阻塞真机流程；但原始 screenshot/XML 只能留在本机 `raw` 隔离目录，
|
||||
不能由 agent、fixture、业务或上传端消费。`t103-privacy-v4` 把截图与 XML 保持为两个独立坐标空间，
|
||||
并根据同一第一态 raw 的两次 fail-closed 安全观测将二者分别精确固定为 1080×2376；截图隐私带沿用
|
||||
v3，不扩大、不缩小。v4 只从两个精确交界 bounds 投影属于拼多多包、不可点击且格式严格唯一的价格
|
||||
叶节点，任何点击节点、包外节点、坐标/结构/文本漂移、重复或零值都 fail closed。它校验源哈希、
|
||||
设备/App/商品/人工状态与隐私结构，在 sibling `derived` 目录原子发布 screenshot/XML 与 manifest；
|
||||
任何不匹配、手机号残留或已有目标均拒绝发布。
|
||||
自动复检通过且人确认三态对应性后，agent 才能读取派生物并提取最小 fixture、编写判据。
|
||||
人工确认中还必须记录中间态实际选择的非目标颜色和尺码，不能只写“已切换”。
|
||||
|
||||
|
||||
+17
-1
@@ -25,7 +25,7 @@ write_paths:
|
||||
- docs/current-state.md
|
||||
---
|
||||
|
||||
<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-04T06:06:05Z sha256=9de2a35beba4cca7a29cf4dc6b5ff643d829f6467ff576da976589a8d1f3dcad -->
|
||||
<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-04T06:56:08Z sha256=1f5f8b30076531a859c0cada576c91206cbe20471694a53690231fbb031e816e -->
|
||||
## 问题 / 背景
|
||||
|
||||
T-102 已证明 canonical 链接可进入目标商品。T-103 随后在 PKG110 / Android 16 / 拼多多 8.17.0、衣服商品 goods_id `937122477375` 上确认：规格面板只能从详情页右下角精确文案“快要抢光”进入，面板固定显示收货区域和掩码手机号。T-110 经项目所有者批准，将该已取证点击定义为可逆、能力受限的规格面板导航；这不是通用购买入口豁免，不授权其他文案、数量、确认页、提交订单或支付。 项目所有者随后确认，面板刚打开时已自动选中目标颜色“黑色CHA(纯棉)”和尺码“M(建议100-115)”；因此本任务不再假设存在“未选择”或“只选择一个维度”的初始状态。
|
||||
@@ -131,6 +131,22 @@ T-103 sanitizer v2 坐标修正与主审：提交 44c027a 将 screenshot space
|
||||
### 2026-08-04T06:05:53Z · ila
|
||||
|
||||
2026-08-04 T-103 sanitizer v3 坐标修正与主审：人用同一第一态 raw 运行 v2，脱敏器安全拒绝并仅报告 observed 1080x2376，证明 XML 实际坐标与截图相同；原始证据仍有效、未重采、未读取正文。提交 acf7e11 将 sanitizer_version 升为 t103-privacy-v3；截图与 XML 仍分别建模并分别严格校验，但当前均精确绑定 1080x2376，隐私带保持 [0,0,1080,540)。合成测试明确拒绝旧截图 1080x2400、旧 v2 XML 1080x2400，以及较小/较大坐标；手机号残留、哈希/状态/版本、确定性、原子发布和不覆盖门禁保持不变。主 agent 独立复跑 69 项 client 单测、compileall、CLI help、静态禁用能力检索与 diff-check，全部通过；未连接设备、未读取真实 raw。T-103 保持 DOING，等待人用同一第一态 raw 重跑 v3 并只核对 derived。
|
||||
|
||||
### 2026-08-04T06:17:05Z · ila
|
||||
|
||||
2026-08-04 第一态 derived 人工隐私验收与主审：项目所有者确认截图顶部隐私区完全遮黑、派生 XML 不含地址/手机号、目标颜色和尺码仍为预选；顶部价格因隐私带只显示一部分，最底部价格完整。人工确认后主 agent 才读取 derived，未访问 raw。路径 C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-panel-opened-target- 937122477375-v2\derived；manifest 为 privacy_tier=SANITIZED、sanitizer_version=t103-privacy-v3、state=panel-opened-target-preselected，派生 screenshot/XML SHA-256 分别为 f9e370747cbef4facf6ec4a20d5af72b36c7615e7be7038144b1834632cdbf57 / f2024b7bcc69a03b05f5e95610708c0dbd33001698f40a011ddc895cf0410fb1，复算一致。XML 中“黑色 CHA (纯棉）”与“M（建议100-115）”各有明确 selected=true，汇总文本一致。完整金额候选仅见“提交订单 ¥12.88”；该文本只能在不可点击的派生快照中用于离线价格语义验证，第一趟绝不能获得该控件或其可点击父节点。另观察到 com.android.systemui 的“肉包采购辅助”浮层节点，后续最小 fixture/判据必须限定 PDD package，并建议后两态采集前关闭该浮层。第一态隐私与状态证据通过，但价格语义仍需另两态交叉验证，T-103 保持 DOING。
|
||||
|
||||
### 2026-08-04T06:20:03Z · ila
|
||||
|
||||
主审补充澄清：上一条所述“提交订单 ¥12.88”只能证明面板中存在该禁触文本，不得作为第一趟 SKU 单价证据，也不得驱动任何控件解析或交互。原因是它属于可点击“提交订单”父区域，违反 T-110 硬拒绝区边界。v3 第一态因此只通过隐私与预选状态验收，价格证据仍不通过。下一步不缩小 [0,0,1080,540) 截图遮罩，而由 v4 脱敏器在顶部交界带仅保留严格白名单、PDD package、非点击叶节点的价格文本到派生 XML；任何混杂文本、点击节点、包外节点或非唯一候选均 fail closed。
|
||||
|
||||
### 2026-08-04T06:43:53Z · ila
|
||||
|
||||
2026-08-04 客户确认加速方案：手机规格面板显示地址/手机号不再作为真机流程阻塞条件；不再扩大或调整截图黑色遮罩。原始证据仍只留本机，agent/Git/服务端仍只消费派生物。提交 1e69d27 实现 t103-privacy-v4：截图遮罩与 1080x2376 双坐标校验完全不变，只把已取证的两个顶部交界价格槽中，PDD package、TextView、非点击、可见启用、叶节点且严格匹配“唯一快卖光当前价 + 至多一个原价”的七属性安全文本投影到派生 XML；结构/文本/候选数漂移均原子拒绝，底部“提交订单 ¥12.88”仍不是价格候选。主 agent 两轮退回测试职责问题后独立复跑 76 项 client 单测、compileall、CLI help、禁用能力检索与 diff-check，全部通过。下一步保留已验收 v3 derived，用同一 raw 生成 v4 derived；T-103 保持 DOING。
|
||||
|
||||
### 2026-08-04T06:55:52Z · ila
|
||||
|
||||
2026-08-04 项目所有者用同一第一态 raw 运行 v4，脱敏器按设计 fail closed：跨界价格节点文本不匹配，未发布 derived；raw 与已保留的 derived-v3-reviewed 未受损。提交 ef1ac60 增加最小安全诊断：失败只输出两个固定价格槽位和受控 reason 枚举，不回显原文、金额、数字串、字符码点、长度或原始属性，v4 成功白名单与原子不发布语义不变。主 agent 独立复跑 78 项 client 单测、compileall、CLI help 与 diff-check，全部通过。等待项目所有者用同一 raw 重跑并反馈 slot/reason；T-103 保持 DOING。
|
||||
<!-- END VIKUNJA EXPORT -->
|
||||
|
||||
## 边界
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
id: T-201
|
||||
title: 管理员登录与会话
|
||||
phase: 2
|
||||
deps: [T-004, T-005]
|
||||
status: DONE
|
||||
created: 2026-08-04
|
||||
vikunja_task_id: 26
|
||||
context_ref: 80ed9b7
|
||||
work_branch: task/t-201-admin-session
|
||||
needs_device: false
|
||||
needs_human_review: false
|
||||
write_paths:
|
||||
- docs/tasks/T-201.md
|
||||
- admin/cmd/server/main.go
|
||||
- admin/internal/config/**
|
||||
- admin/internal/server/**
|
||||
- admin/internal/auth/**
|
||||
- admin/internal/transport/webui/**
|
||||
- admin/go.mod
|
||||
- admin/go.sum
|
||||
- admin/README.md
|
||||
---
|
||||
|
||||
<!-- BEGIN VIKUNJA EXPORT id=26 synced=2026-08-04T07:04:10Z sha256=25607da2b9c35781f56fdea1f399bdfb65b76fa9a5ca8210693714793f5ef5f4 -->
|
||||
## 问题 / 背景
|
||||
|
||||
采购服务已有 Go/Gin/SQLite 骨架和核心模型，但没有管理员会话。T-201 与真机规格字段无关，可在 T-103 进行时并行。
|
||||
|
||||
## 关联需求与交互
|
||||
|
||||
F-013、US-007；路由 GET/POST /login、POST /logout、受保护的 GET /tasks 空壳；沿用已确认采购服务原型。
|
||||
|
||||
## 方案
|
||||
|
||||
1. 启动时从环境变量读取管理员用户名、bcrypt 密码哈希、至少 32 字节 session secret；缺失或无效时明确失败，不提供默认凭据，不打印秘密。
|
||||
2. 使用签名会话和 CSRF；登录成功轮换会话，Cookie 为 HttpOnly、SameSite，Secure 由显式配置控制。
|
||||
3. return_to 仅接受 /tasks 及其子路径，拒绝绝对 URL、双斜杠、反斜杠和其他站内路径。
|
||||
4. 实现登录、登出与受保护的任务空壳；/healthz 保持公开。
|
||||
5. 不改数据库 schema，不实现设备 Bearer、建单、试选、授权、提交或付款。
|
||||
|
||||
## 验收要点
|
||||
|
||||
- 覆盖未登录跳转、成功登录与会话轮换、统一失败错误、CSRF 拒绝、登出失效和开放重定向拦截。
|
||||
- 无默认账号/密码/密钥，日志与响应不泄露凭据。
|
||||
- go test ./...、go vet ./...、go build ./...、上下文校验与 diff-check 通过。
|
||||
|
||||
## 执行记录
|
||||
|
||||
### 2026-08-04T06:58:30Z · ila
|
||||
|
||||
2026-08-04 T-201 实现与主审完成：提交 47c0844 新增强制环境配置、bcrypt 校验、HMAC-SHA256 签名进程内 session、随机 CSRF、登录轮换、登出撤销、受保护 /tasks 空壳和无外部资源的 SSR 登录页。主 agent 首轮退回 /tasks/.. 返回路径绕过、含 CSRF 页面缺安全响应头、Cookie 篡改测试概率失效三项；修正后独立复跑 go test ./...、go test -race ./...、go vet ./...、go build ./...、上下文校验与 diff-check，全部通过。实现未包含建单、试选、真机字段、授权、提交或付款；T-201 验收通过。
|
||||
|
||||
### 2026-08-04T07:03:54Z · ila
|
||||
|
||||
集成门禁补充：T-201 分支已合入 main@88d8f77（含 T-103 最新安全诊断），随后在独立 Windows worktree 运行完整 init.ps1，admin test/vet/build、client 78 项测试/compileall、editable install 与 agent-context 校验全部通过。首次运行因 120 秒工具超时中断在大体积 PySide6 依赖安装，未产生代码或证据问题；复用已建 venv 后完整成功。
|
||||
<!-- END VIKUNJA EXPORT -->
|
||||
|
||||
## 边界
|
||||
|
||||
- 启动配置只接受显式环境变量中的管理员用户名、bcrypt 密码哈希和至少 32 字节 session secret；
|
||||
不得内置开发默认值、明文密码或密钥，不得打印、回显或提交凭据。
|
||||
- 本任务只实现 `/login`、`/logout`、受保护的 `/tasks` 空壳和保持公开的 `/healthz`；不实现建单、
|
||||
查询、批量开始试选、设备 Bearer、真机自动化或任务状态流转。
|
||||
- 不增加或修改数据库 schema，不读写 `spec_trials`、授权或 `order_submissions`，不实现任何提交订单、
|
||||
付款、免密支付、先用后付或资金控件代码。
|
||||
- 页面和测试不得夹带机器实际规格、规格面板价格、截图、证据哈希或任何 PDD 页面判据；这些仍等待
|
||||
T-103 真机结论。
|
||||
- `return_to` 必须是 `/tasks` 或其子路径；绝对 URL、`//`、反斜杠、编码绕过和其他站内路径均拒绝。
|
||||
Reference in New Issue
Block a user