diff --git a/backend-api/internal/platform/shunyunbao/session.go b/backend-api/internal/platform/shunyunbao/session.go index e5159c6..5a6a460 100644 --- a/backend-api/internal/platform/shunyunbao/session.go +++ b/backend-api/internal/platform/shunyunbao/session.go @@ -78,12 +78,18 @@ type SessionManager struct { diagnosticLog DiagnosticLogger diagnosticsOn bool authenticated bool + identity sessionIdentity captchaTicket string captchaContent []byte captchaType string captchaExpires time.Time } +type sessionIdentity struct { + ID string + Username string +} + func NewSessionManager(config SessionConfig) (*SessionManager, error) { baseURL := strings.TrimRight(strings.TrimSpace(config.BaseURL), "/") headers, err := RequestHeaders(baseURL) @@ -259,7 +265,7 @@ func (manager *SessionManager) Login( return manager.statusLocked(), ErrCaptchaTicketInvalid } defer manager.clearCaptchaLocked() - manager.authenticated = false + manager.clearAuthenticatedLocked() payload, err := json.Marshal(map[string]string{ "username": manager.username, "password": manager.password, @@ -274,17 +280,18 @@ func (manager *SessionManager) Login( LoginPath, payload, true, - false, ) if err != nil { return manager.statusLocked(), err } - if !hasUser(data) { + identity, err := sessionIdentityFrom(data) + if err != nil { return manager.statusLocked(), domain.ErrFreightSourceProtocol } - if _, err := manager.validateLocked(ctx); err != nil { + if _, err := manager.validateIdentityLocked(ctx, identity); err != nil { return manager.statusLocked(), err } + manager.identity = identity manager.authenticated = true manager.clearCaptchaLocked() return manager.statusLocked(), nil @@ -308,18 +315,35 @@ func (manager *SessionManager) Validate( } func (manager *SessionManager) validateLocked(ctx context.Context) (any, error) { + if manager.identity.ID == "" || manager.identity.Username == "" { + manager.clearAuthenticatedLocked() + return nil, domain.ErrFreightSourceProtocol + } + return manager.validateIdentityLocked(ctx, manager.identity) +} + +func (manager *SessionManager) validateIdentityLocked( + ctx context.Context, + expected sessionIdentity, +) (any, error) { + query := url.Values{} + query.Set("id", expected.ID) data, err := manager.requestJSONLocked( ctx, http.MethodGet, - UserPath, + UserPath+"?"+query.Encode(), nil, false, - true, ) if err != nil { + if errors.Is(err, domain.ErrFreightSourceProtocol) { + manager.clearAuthenticatedLocked() + } return nil, err } - if !hasUser(data) { + actual, err := sessionIdentityFrom(data) + if err != nil || actual != expected { + manager.clearAuthenticatedLocked() return nil, domain.ErrFreightSourceProtocol } return data, nil @@ -330,7 +354,6 @@ func (manager *SessionManager) requestJSONLocked( method, path string, body []byte, loginRequest bool, - requireSession bool, ) (any, error) { var content io.Reader if body != nil { @@ -387,8 +410,8 @@ func (manager *SessionManager) requestJSONLocked( if loginRequest { return nil, ErrLoginRejected } - if requireSession || unauthenticatedCode(envelope.Code) { - manager.authenticated = false + if unauthenticatedCode(envelope.Code) { + manager.clearAuthenticatedLocked() return nil, domain.ErrFreightSourceSessionNeeded } return nil, domain.ErrFreightSourceProtocol @@ -430,12 +453,17 @@ func (manager *SessionManager) applyHeaders(request *http.Request) { func (manager *SessionManager) responseErrorLocked(status int) error { if status == http.StatusUnauthorized || status == http.StatusForbidden { - manager.authenticated = false + manager.clearAuthenticatedLocked() return domain.ErrFreightSourceSessionNeeded } return domain.ErrFreightSourceUnavailable } +func (manager *SessionManager) clearAuthenticatedLocked() { + manager.authenticated = false + manager.identity = sessionIdentity{} +} + func (manager *SessionManager) configuredLocked() bool { return manager.username != "" && manager.password != "" } @@ -693,16 +721,28 @@ func redactDiagnosticString(value string) string { return string(characters) } -func hasUser(value any) bool { +func sessionIdentityFrom(value any) (sessionIdentity, error) { data, ok := value.(map[string]any) if !ok { - return false + return sessionIdentity{}, errInvalidProtocolInput } if user, exists := data["user"]; exists { - _, ok := user.(map[string]any) - return ok + data, ok = user.(map[string]any) + if !ok { + return sessionIdentity{}, errInvalidProtocolInput + } } - return data["id"] != nil || data["username"] != nil + id, err := externalID(data["id"]) + if err != nil { + return sessionIdentity{}, errInvalidProtocolInput + } + username, ok := data["username"].(string) + username = strings.TrimSpace(username) + if !ok || username == "" || len([]byte(username)) > 512 || + !utf8.ValidString(username) || hasControl(username) { + return sessionIdentity{}, errInvalidProtocolInput + } + return sessionIdentity{ID: id, Username: username}, nil } func validCaptchaCode(value string) bool { diff --git a/backend-api/internal/platform/shunyunbao/session_test.go b/backend-api/internal/platform/shunyunbao/session_test.go index b8f2108..e9f45dd 100644 --- a/backend-api/internal/platform/shunyunbao/session_test.go +++ b/backend-api/internal/platform/shunyunbao/session_test.go @@ -38,13 +38,16 @@ func TestSessionManagerCaptchaLoginAndValidationShareCookieJar(t *testing.T) { t.Fatalf("login body = %s", content) } http.SetCookie(writer, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"}) - _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12},"token":"never-exposed"}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"test-user"},"token":"never-exposed"}}`)) case UserPath: userCalls++ + if request.URL.Query().Get("id") != "12" { + t.Fatalf("user query = %q", request.URL.RawQuery) + } if cookie, err := request.Cookie("authenticated"); err != nil || cookie.Value != "yes" { t.Fatalf("user cookie = %v / %v", cookie, err) } - _, _ = writer.Write([]byte(`{"status":true,"data":{"id":12}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"test-user"}}`)) default: writer.WriteHeader(http.StatusNotFound) } @@ -118,12 +121,62 @@ func TestSessionManagerMapsAnonymousFailuresAndExpiresState(t *testing.T) { t.Fatalf("expired captcha error = %v", err) } manager.authenticated = true + manager.identity = sessionIdentity{ID: "12", Username: "test-user"} if _, err := manager.Validate(context.Background()); !errors.Is(err, domain.ErrFreightSourceSessionNeeded) || manager.Status().Authenticated { t.Fatalf("expired session error/status = %v / %+v", err, manager.Status()) } } +func TestSessionManagerUserValidationClassifiesResponses(t *testing.T) { + testCases := []struct { + name string + response string + want error + }{ + { + name: "ordinary ERP failure is protocol error", + response: `{"status":false,"code":0,"data":null,"msg":"没有任何操作"}`, + want: domain.ErrFreightSourceProtocol, + }, + { + name: "unauthenticated code expires session", + response: `{"status":false,"code":-2,"data":null,"msg":"未登录"}`, + want: domain.ErrFreightSourceSessionNeeded, + }, + { + name: "different user is protocol error", + response: `{"status":true,"code":0,"data":{"id":13,"username":"other-user"}}`, + want: domain.ErrFreightSourceProtocol, + }, + } + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func( + writer http.ResponseWriter, + request *http.Request, + ) { + if request.URL.Path != UserPath { + writer.WriteHeader(http.StatusNotFound) + return + } + if request.URL.Query().Get("id") != "12" { + t.Fatalf("user query = %q", request.URL.RawQuery) + } + _, _ = writer.Write([]byte(testCase.response)) + })) + defer server.Close() + manager := testSessionManager(t, server.URL, "test-user", "test-password") + manager.authenticated = true + manager.identity = sessionIdentity{ID: "12", Username: "test-user"} + _, err := manager.Validate(context.Background()) + if !errors.Is(err, testCase.want) || manager.Status().Authenticated { + t.Fatalf("Validate() error/status = %v / %+v", err, manager.Status()) + } + }) + } +} + func TestSessionManagerSerializesCaptchaRequests(t *testing.T) { var mutex sync.Mutex inFlight, maximum := 0, 0 @@ -178,9 +231,12 @@ func TestSessionManagerEnsureAuthenticatedUsesRecognizerOnce(t *testing.T) { case LoginPath: loginCalls++ http.SetCookie(w, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"}) - _, _ = w.Write([]byte(`{"status":true,"data":{"user":{"id":12}}}`)) + _, _ = w.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"test-user"}}}`)) case UserPath: - _, _ = w.Write([]byte(`{"status":true,"data":{"id":12}}`)) + if r.URL.Query().Get("id") != "12" { + t.Fatalf("user query = %q", r.URL.RawQuery) + } + _, _ = w.Write([]byte(`{"status":true,"data":{"id":12,"username":"test-user"}}`)) default: w.WriteHeader(http.StatusNotFound) } @@ -332,6 +388,46 @@ func TestSessionManagerDiagnosticLogsHideInvalidOCRResults(t *testing.T) { } } +func TestSessionManagerDiagnosticLogOmitsUserIdentityQuery(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func( + writer http.ResponseWriter, + request *http.Request, + ) { + if request.URL.Path != UserPath || request.URL.Query().Get("id") != "12" { + writer.WriteHeader(http.StatusNotFound) + return + } + writer.Header().Set("Content-Type", "application/json") + _, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"test-user"}}`)) + })) + defer server.Close() + var events []string + manager, err := NewSessionManager(SessionConfig{ + BaseURL: server.URL, + Username: "test-user", + Password: "test-password", + Timeout: time.Second, + AllowInsecureHTTP: true, + DiagnosticLogger: func(event string) { + events = append(events, event) + }, + }) + if err != nil { + t.Fatalf("NewSessionManager() error = %v", err) + } + manager.authenticated = true + manager.identity = sessionIdentity{ID: "12", Username: "test-user"} + if _, err := manager.Validate(context.Background()); err != nil { + t.Fatalf("Validate() error = %v", err) + } + actual := strings.Join(events, "\n") + if !strings.Contains(actual, "erp_request method=GET path=/am/user/get") || + strings.Contains(actual, "?id=") || strings.Contains(actual, "test-user") || + strings.Contains(actual, `"id":12`) { + t.Fatalf("diagnostic log leaked user identity: %s", actual) + } +} + type fixedRecognizer struct { code string err error diff --git a/backend-api/internal/platform/shunyunbao/source.go b/backend-api/internal/platform/shunyunbao/source.go index 18f2680..28e342c 100644 --- a/backend-api/internal/platform/shunyunbao/source.go +++ b/backend-api/internal/platform/shunyunbao/source.go @@ -120,7 +120,6 @@ func (manager *SessionManager) queryStocksLocked( StockListTotalPath, firstBody, false, - false, ) if err != nil { return nil, err @@ -154,7 +153,6 @@ func (manager *SessionManager) queryStocksLocked( StockListPath, body, false, - false, ) if err != nil { return nil, err @@ -223,7 +221,6 @@ func (manager *SessionManager) queryDetailsLocked( StockDetailPath+"?hist=0", body, false, - false, ) if err != nil { return nil, err diff --git a/backend-api/internal/platform/shunyunbao/source_test.go b/backend-api/internal/platform/shunyunbao/source_test.go index 35f4694..fa7d05a 100644 --- a/backend-api/internal/platform/shunyunbao/source_test.go +++ b/backend-api/internal/platform/shunyunbao/source_test.go @@ -31,12 +31,15 @@ func TestSessionManagerQueryOrderUsesVerifiedSessionAndAllowlist(t *testing.T) { t.Fatalf("login captcha cookie = %v / %v", cookie, err) } http.SetCookie(writer, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"}) - _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1}}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1,"username":"test-user"}}}`)) case UserPath: + if request.URL.Query().Get("id") != "1" { + t.Fatalf("user query = %q", request.URL.RawQuery) + } if cookie, err := request.Cookie("authenticated"); err != nil || cookie.Value != "yes" { t.Fatalf("user cookie = %v / %v", cookie, err) } - _, _ = writer.Write([]byte(`{"status":true,"data":{"id":1}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"id":1,"username":"test-user"}}`)) case StockListTotalPath: assertStockPayload(t, request, "SOURCE-12", 0, 1, 20) _, _ = writer.Write([]byte(`{"status":true,"data":1}`)) @@ -100,9 +103,12 @@ func TestSessionManagerQueryCreatedRangePaginatesAndDeduplicates(t *testing.T) { _, _ = writer.Write([]byte("captcha")) case LoginPath: http.SetCookie(writer, &http.Cookie{Name: "authenticated", Value: "yes", Path: "/"}) - _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1}}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":1,"username":"test-user"}}}`)) case UserPath: - _, _ = writer.Write([]byte(`{"status":true,"data":{"id":1}}`)) + if request.URL.Query().Get("id") != "1" { + t.Fatalf("user query = %q", request.URL.RawQuery) + } + _, _ = writer.Write([]byte(`{"status":true,"data":{"id":1,"username":"test-user"}}`)) case StockListTotalPath: assertStockPayload(t, request, "2026-07-22,2026-07-28", 0, 1, 20) _, _ = writer.Write([]byte(`{"status":true,"data":21}`)) diff --git a/backend-api/internal/transport/httpapi/admin_handlers_test.go b/backend-api/internal/transport/httpapi/admin_handlers_test.go index d93f4da..39102b3 100644 --- a/backend-api/internal/transport/httpapi/admin_handlers_test.go +++ b/backend-api/internal/transport/httpapi/admin_handlers_test.go @@ -76,12 +76,15 @@ func TestERPAdminAPIUsesCaptchaTicketWithoutExposingCredentials(t *testing.T) { t.Fatalf("login did not retain captcha cookie: %v", err) } http.SetCookie(writer, &http.Cookie{Name: "erp", Value: "login", Path: "/"}) - _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12},"token":"private-token"}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"user":{"id":12,"username":"private-user"},"token":"private-token"}}`)) case shunyunbao.UserPath: + if request.URL.Query().Get("id") != "12" { + t.Fatalf("user query = %q", request.URL.RawQuery) + } if cookie, err := request.Cookie("erp"); err != nil || cookie.Value != "login" { t.Fatalf("user session cookie = %v / %v", cookie, err) } - _, _ = writer.Write([]byte(`{"status":true,"data":{"id":12}}`)) + _, _ = writer.Write([]byte(`{"status":true,"data":{"id":12,"username":"private-user"}}`)) default: writer.WriteHeader(http.StatusNotFound) } diff --git a/docs/api.md b/docs/api.md index e720c53..dc93c44 100644 --- a/docs/api.md +++ b/docs/api.md @@ -203,6 +203,9 @@ T-203 成功返回 `201`。使用相同 `Idempotency-Key` 和相同图片内容 `/erp`、`/erp/captcha`、`/erp/login` 和 `/api/v1/erp-session*` 不再暴露。创建货运同步 前，单一 API 进程在未认证时以同一 Cookie jar 获取验证码、调用受控 OCR、登录并校验用户。 验证码图片、OCR 文字、Cookie、JWT、账号、密码和原始响应都不返回浏览器/API，也不写 SQLite。 +登录成功后从 `data.user` 严格读取 id/username，并请求 +`GET /am/user/get?id=`；返回身份必须一致。只有 HTTP 401/403 或 ERP code `-2` 被视为 +会话失效，其他 `status=false` 返回 `ERP_RESPONSE_INVALID`。 ERP 配置来源： diff --git a/docs/current-state.md b/docs/current-state.md index 0915995..104c53d 100644 --- a/docs/current-state.md +++ b/docs/current-state.md @@ -5,7 +5,7 @@ ## 当前快照 - 日期：2026-07-29 -- 阶段：T-235 计划修复顺运宝登录后用户会话校验协议 +- 阶段：T-235 已修复顺运宝登录后用户会话校验协议 - Git：当前分支为 `main`；T-001 至 T-004、T-101 至 T-104、T-201 至 T-219 均按文档提交、实现提交的顺序纳入历史 - 生产代码：`android-buyer/` 已接入 Roubao Android 源码 @@ -193,6 +193,7 @@ | `docs/tasks/T-232.md` | DONE | 记录 ERP/OCR 导入预检安全诊断日志 | | `docs/tasks/T-233.md` | DONE | 修复预检错误映射并增加受控 ERP 诊断日志 | | `docs/tasks/T-234.md` | DONE | 在受控诊断模式输出 OCR 验证码文本 | +| `docs/tasks/T-235.md` | DONE | 修复顺运宝登录后用户会话校验协议 | | `docs/design/` | 已确认 | T-202 原型索引、4 个管理页和 7 个 Android 页面 | | `deepseek总结.txt` | 已有 | 历史讨论摘要，不是正式需求权威 | | `android-buyer/` | 已有 | Roubao `main` 固定 commit 的 Android 基线 | @@ -204,12 +205,12 @@ ## 任务摘要 - 已完成：T-001 至 T-004、T-101 至 T-104、T-201 至 T-219。 -- 已完成：另含 T-220 至 T-234 ERP 契约、货运存储、采购需求生成、日期增量同步、Go +- 已完成：另含 T-220 至 T-235 ERP 契约、货运存储、采购需求生成、日期增量同步、Go 直连协议、OCR 会话预检、稳定预检错误、安全诊断日志、直连 `FreightSource`、旧 Connector 清理和受控本地凭证加载。 -- 进行中：T-235 将保存登录响应的受控用户身份，使用 `GET /am/user/get?id=` 校验 - 同一会话，并收紧 ERP session error 分类。 -- 下一步：实现并验证 T-235 后，使用 `start-backend.bat --erp-debug` 重新执行受控单号 smoke。 +- 进行中：无。 +- 下一步：使用 `start-backend.bat --erp-debug` 重启 API 并重新执行受控单号 smoke；确认用户 + 校验成功后继续观察 listTotal/list/detail 请求和同步结果。 ## 当前可运行内容 diff --git a/docs/integrations/shunyunbao-contract.md b/docs/integrations/shunyunbao-contract.md index 714326e..1d36441 100644 --- a/docs/integrations/shunyunbao-contract.md +++ b/docs/integrations/shunyunbao-contract.md @@ -7,8 +7,10 @@ 1. 同一 HTTP Session 获取 `GET /api/p/code1` 验证码。 2. `POST /am/auth/login` 提交环境变量提供的账号/密码和受控验证码。 -3. `POST /am/stock/listTotal` 与 `/am/stock/list` 使用“全部单号”条件查询。 -4. `POST /am/stock/detail/listByStock?hist=0` 使用列表 `stock.id` 批量读取详情。 +3. 从登录 `data.user` 读取正整数 `id` 和非空 `username`，以同一 Cookie Session 调用 + `GET /am/user/get?id=`；返回身份必须完全一致。 +4. `POST /am/stock/listTotal` 与 `/am/stock/list` 使用“全部单号”条件查询。 +5. `POST /am/stock/detail/listByStock?hist=0` 使用列表 `stock.id` 批量读取详情。 本地 HAR 结构确认： @@ -39,7 +41,9 @@ T-225 至 T-227 在 `backend-api/internal/platform/shunyunbao` 用脱敏 fixture Go 直连的验证码、登录、Cookie jar 和查询 source 都在 API 进程内。T-230 在未认证时仅可将 验证码图片一次提交给受控本机/HTTPS OCR endpoint，结果只用于当前登录请求；不得写入 Redis、 -SQLite、日志或浏览器，也不得轮询或重试。真实线上请求不属于自动化测试。 +SQLite、普通日志或浏览器，也不得轮询或重试。T-234 仅允许显式 diagnostics 进程短时输出有效 +OCR 文本；T-235 仅在受锁内存中保存已核验 user id/username，不保存登录 token。HTTP 401/403 +或 ERP code `-2` 才代表会话失效；其他 `status=false` 是协议错误。真实线上请求不属于自动化测试。 ## 身份和规范字段 diff --git a/docs/tasks/T-235.md b/docs/tasks/T-235.md index 5ac5b13..72738fa 100644 --- a/docs/tasks/T-235.md +++ b/docs/tasks/T-235.md @@ -4,7 +4,7 @@ title: 修复顺运宝登录后用户会话校验协议 phase: 2 deps: - T-234 -status: PLANNED +status: DONE created: 2026-07-29 context_ref: 4cf2151 work_branch: null @@ -14,6 +14,7 @@ write_paths: - docs/current-state.md - docs/integrations/shunyunbao-contract.md - backend-api/internal/platform/shunyunbao/** + - backend-api/internal/transport/httpapi/admin_handlers_test.go --- ## 问题 / 背景 @@ -39,13 +40,13 @@ write_paths: ## 验收要点 -- [ ] 登录成功后的用户校验请求包含登录响应中的唯一 `id`，且复用登录 Cookie。 -- [ ] 用户响应 ID/username 必须与登录身份一致；缺失、冲突或普通 `status=false` 返回 +- [x] 登录成功后的用户校验请求包含登录响应中的唯一 `id`，且复用登录 Cookie。 +- [x] 用户响应 ID/username 必须与登录身份一致；缺失、冲突或普通 `status=false` 返回 `ERP_RESPONSE_INVALID`。 -- [ ] 仅 HTTP 401/403 或 ERP code `-2` 清除认证并返回 `ERP_SESSION_REQUIRED`。 -- [ ] Admin 不再因缺失 user id 得到 `freight_import_failed status=503`；该协议失败若重现应显示 +- [x] 仅 HTTP 401/403 或 ERP code `-2` 清除认证并返回 `ERP_SESSION_REQUIRED`。 +- [x] Admin 不再因缺失 user id 得到 `freight_import_failed status=503`；该协议失败若重现应显示 `ERP_RESPONSE_INVALID`。 -- [ ] 标准 Go 测试、race、vet 和三个入口构建通过。 +- [x] 标准 Go 测试、race、vet 和三个入口构建通过。 ## 边界 @@ -57,3 +58,6 @@ write_paths: - 2026-07-29：创建任务。真实日志已排除 OCR、网络和账号密码；对照 `D:/chengma/shunyunbaoerp/shunyunbaoerp_single.py` 确认 Go 遗漏用户接口的 `id` query， 并发现非 `-2` 响应被过度归类为会话失效。 +- 2026-07-29：实现受锁内存 session identity、结构化 user id query、ID/username 一致性校验 + 和精确 session error 分类；更新 source/Admin 脱敏 fixture，并验证 diagnostics 不输出 query + 或用户身份。标准 Go 测试、race、vet 及 api/migrate/authctl 构建均通过。