feat: 接入后台消息治理与登录审计

2026-09-07 11:53:24 +08:00
parent 90185b6c88
commit 6b20a633ce
17 changed files with 1062 additions and 45 deletions
@@ -0,0 +1,89 @@
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/tinode/chat/server/store/types"
+)
+
+func TestLoginAuditAccountDoesNotTreatTokenAsAccount(t *testing.T) {
+	kind, account := loginAuditAccount("token", "secret-token", "")
+	if kind != "" || account != "" {
+		t.Fatalf("token must not be persisted as an account: kind=%q account=%q", kind, account)
+	}
+
+	kind, account = loginAuditAccount("basic", "13800138000", "")
+	if kind != "phone" || account != "13800138000" {
+		t.Fatalf("unexpected basic account classification: kind=%q account=%q", kind, account)
+	}
+}
+
+func TestMaskAndHashLoginAccount(t *testing.T) {
+	tests := map[string]string{
+		"13800138000":       "138****8000",
+		"alice@example.com": "a***@example.com",
+		"alice":             "a***e",
+		"ab":                "**",
+	}
+	for input, want := range tests {
+		if got := maskLoginAccount(input); got != want {
+			t.Errorf("maskLoginAccount(%q)=%q want %q", input, got, want)
+		}
+	}
+	hash := hashLoginAccount(" Alice ")
+	if len(hash) != 64 || hash != hashLoginAccount("alice") || strings.Contains(hash, "alice") {
+		t.Fatalf("unexpected account hash %q", hash)
+	}
+}
+
+func TestClassifyLoginFailure(t *testing.T) {
+	tests := []struct {
+		scheme string
+		err    error
+		want   string
+	}{
+		{"basic", types.ErrFailed, "password_error"},
+		{"sms_code", types.ErrFailed, "code_error"},
+		{"basic", types.ErrUserNotFound, "account_not_found"},
+		{"basic", types.ErrPermissionDenied, "account_disabled"},
+		{"basic", types.ErrPolicy, "risk_blocked"},
+		{"basic", errors.New("too many attempts"), "rate_limited"},
+	}
+	for _, tc := range tests {
+		got, _, _, _ := classifyLoginFailure(tc.scheme, tc.err)
+		if got != tc.want {
+			t.Errorf("classifyLoginFailure(%q,%v)=%q want %q", tc.scheme, tc.err, got, tc.want)
+		}
+	}
+}
+
+func TestMessageQuerySpecsExposeAdminFields(t *testing.T) {
+	privateSpec := privateMessagesInternalQuerySpec()
+	groupSpec := groupMessagesInternalQuerySpec()
+	for label, spec := range map[string]*internalQuerySpec{"private": privateSpec, "group": groupSpec} {
+		joined := strings.ToLower(spec.Select + " " + spec.From)
+		for _, field := range []string{"from_user_id", "content_type", "content_excerpt", "status", "im_message_admin_actions"} {
+			if !strings.Contains(joined, field) {
+				t.Errorf("%s query missing %s", label, field)
+			}
+		}
+	}
+	if strings.Contains(strings.ToLower(privateSpec.Select), "m.content as content") || strings.Contains(strings.ToLower(groupSpec.Select), "m.content as content") {
+		t.Fatal("message list query must not expose full message content")
+	}
+}
+
+func TestRedactClientMessageForLog(t *testing.T) {
+	raw := []byte(`{"login":{"id":"1","scheme":"basic","secret":"YWxpY2U6YWxpY2UxMjM="},"acc":{"secret":"account-secret","tmpsecret":"temp-secret"}}`)
+	redacted := string(redactClientMessageForLog(raw))
+	for _, secret := range []string{"YWxpY2U6YWxpY2UxMjM=", "account-secret", "temp-secret"} {
+		if strings.Contains(redacted, secret) {
+			t.Fatalf("redacted log still contains secret %q: %s", secret, redacted)
+		}
+	}
+	if strings.Count(redacted, "[REDACTED]") != 3 {
+		t.Fatalf("unexpected redacted payload: %s", redacted)
+	}
+}