fix(t233): add redacted ERP diagnostics

2026-07-29 11:24:04 +08:00
parent 817a968233
commit 1e703ef257
14 changed files with 412 additions and 28 deletions
@@ -211,6 +211,65 @@ func TestSessionManagerEnsureAuthenticatedRequiresRecognizer(t *testing.T) {
 	}
 }

+func TestSessionManagerDiagnosticLogsAreRedacted(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case CaptchaPath:
+			w.Header().Set("Content-Type", "image/png")
+			_, _ = w.Write([]byte("private-captcha-image"))
+		case LoginPath:
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{
+"status":false,
+"msg":"ERP says order 123456789 is blocked",
+"data":{"username":"test-user","password":"test-password","token":"secret-token","orderNumber":"order-123456789"}
+}`))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+	var events []string
+	manager, err := NewSessionManager(SessionConfig{
+		BaseURL:           server.URL,
+		Username:          "test-user",
+		Password:          "test-password",
+		Timeout:           time.Second,
+		AllowInsecureHTTP: true,
+		CaptchaRecognizer: &fixedRecognizer{code: "1234"},
+		DiagnosticLogger: func(event string) {
+			events = append(events, event)
+		},
+	})
+	if err != nil {
+		t.Fatalf("NewSessionManager() error = %v", err)
+	}
+	if err := manager.EnsureAuthenticated(context.Background()); !errors.Is(err, domain.ErrFreightSourceLoginRejected) {
+		t.Fatalf("EnsureAuthenticated() error = %v", err)
+	}
+	actual := strings.Join(events, "\n")
+	for _, expected := range []string{
+		"erp_request method=GET path=/api/p/code1",
+		"erp_response method=GET path=/api/p/code1 status=200",
+		"body=omitted_non_json",
+		"erp_request method=POST path=/am/auth/login",
+		"erp_response method=POST path=/am/auth/login status=200",
+		`"status":false`,
+		`"password":"[REDACTED]"`,
+	} {
+		if !strings.Contains(actual, expected) {
+			t.Fatalf("diagnostic log missing %q: %s", expected, actual)
+		}
+	}
+	for _, secret := range []string{
+		"test-user", "test-password", "secret-token", "123456789", "private-captcha-image",
+	} {
+		if strings.Contains(actual, secret) {
+			t.Fatalf("diagnostic log leaked %q: %s", secret, actual)
+		}
+	}
+}
+
 type fixedRecognizer struct {
 	code  string
 	err   error