Zhang Shun
1 month ago
15 changed files with 1031 additions and 140 deletions
@ -0,0 +1,72 @@ |
|||
# R01-A4 第四批请求上下文收束独立复验 |
|||
|
|||
复验日期：2026-09-17 |
|||
|
|||
分支：`refactor/r01-structure-performance` |
|||
|
|||
基线 HEAD：`35baa8416d31e71dd2c2556877f9d2e1c93b14a1` |
|||
|
|||
## 结论 |
|||
|
|||
**R01-A4 独立代码复验通过，可以进入精确暂存、本地提交与推送检查点。** |
|||
|
|||
FAIL=0，SKIP=0。复验未修改生产代码，未暂存、未提交、未推送。 |
|||
|
|||
## 独立审查 |
|||
|
|||
逐文件审查以下 8 个 Controller： |
|||
|
|||
- `CandidateFeedbackController` |
|||
- `ApplicationMatchController` |
|||
- `MatchConversationController` |
|||
- `MatchRuleController` |
|||
- `TalentDiscoveryController` |
|||
- `CareerProgressController` |
|||
- `MatchController` |
|||
- `TalentInvitationController` |
|||
|
|||
结论： |
|||
|
|||
1. 身份统一由构造器注入的 `CurrentUserAccessor.requireUserId()` 获取；requestId 统一由构造器注入的 `RequestIdAccessor.get(request)` 获取。 |
|||
2. 8 个文件对 `SecurityContextHolder`、`Authentication`、`anonymousUser`、身份 `Long.valueOf/parseLong`、私有 requestId 方法、可选注入和手工创建 Accessor 的门禁扫描均为 0。 |
|||
3. 角色、资源归属、Service 入参与响应结构未被改写；V1-V45、ErrorCode、OpenAPI 文档均无差异。 |
|||
|
|||
## 独立测试 |
|||
|
|||
新增两个独立测试类，仅位于测试目录： |
|||
|
|||
- `A4IndependentVerificationTest`：3 个测试，覆盖 8 个真实 MVC 映射的非法主体、匿名主体及 requestId 归一化同源。 |
|||
- `A4AccessorWiringIndependentTest`：2 个测试，通过 mock Accessor 的异常和值传播，逐一验证 8 个 Controller 的真实接线和 Service 参数。 |
|||
|
|||
发现实施方 `A4AccessorWiringProbeTest` 的 GET 路径列表只有 7 个 Controller，遗漏了唯一使用 POST 的 `MatchConversationController`。独立测试已使用真实方法 `POST /applications/{id}/conversation` 补齐；该路径通过，没有发现生产缺陷。 |
|||
|
|||
定向命令结果：48/48，Failures=0，Errors=0，Skipped=0。 |
|||
|
|||
关联回归结果：163/163，Failures=0，Errors=0，Skipped=0。 |
|||
|
|||
## 全量验证 |
|||
|
|||
- `mvn clean verify`：BUILD SUCCESS，2243/2243，Failures=0，Errors=0，Skipped=0。 |
|||
- `python docs/verify_openapi.py`：All checks passed，176 paths / 214 operations。 |
|||
- `git diff --check`：无空白错误，仅既有 LF/CRLF 提示。 |
|||
- 暂存区：空。 |
|||
- 迁移差异：空。 |
|||
- `docs/openapi-rc.json` 差异：空。 |
|||
|
|||
全量数由实施前的 2238 增至 2243，增量恰好是本轮新增的 5 个独立测试。 |
|||
|
|||
## 全仓剩余统计纠正 |
|||
|
|||
按完整模式逐文件分类： |
|||
|
|||
- 身份解析：12 个文件，其中基础设施 3、业务 Controller 9；与实施报告一致。 |
|||
- requestId 入口：19 个文件，其中基础设施/非业务入口 6、业务 Controller 13。 |
|||
|
|||
实施报告中的“完整模式 18 个文件”少计 1 个基础设施/非业务入口；业务 Controller 剩余数 13 正确。该统计偏差不影响 A4 的 8 个目标文件全部完成迁移。 |
|||
|
|||
## Git 与边界 |
|||
|
|||
- HEAD 未改变；未暂存、未提交、未推送。 |
|||
- 本次独立复验只新增上述 2 个测试文件和本报告，未修改生产代码。 |
|||
- `GlobalExceptionHandler.java` 仍是 Windows stat 缓存造成的工作区标记，内容 blob 与 HEAD 相同，本轮未触碰。 |
|||
- 历史未跟踪文件全部保留，未删除、移动或清理。 |
|||
@ -0,0 +1,278 @@ |
|||
# R01-A4 第四批：请求身份与 requestId 收束报告 |
|||
|
|||
日期：2026-09-17 |
|||
分支：`refactor/r01-structure-performance` |
|||
HEAD：`35baa8416d31e71dd2c2556877f9d2e1c93b14a1` |
|||
范围：**仅 8 个 Controller**（CandidateFeedbackController、ApplicationMatchController、MatchConversationController、MatchRuleController、TalentDiscoveryController、CareerProgressController、MatchController、TalentInvitationController） |
|||
|
|||
--- |
|||
|
|||
## 0. 结论 |
|||
|
|||
> **R01-A4第四批请求身份与requestId收束完成，待独立代码复验。** |
|||
|
|||
8 个 Controller 的身份与 requestId 已统一收束到既有 `CurrentUserAccessor` / `RequestIdAccessor`；非法主体由**逃逸为 HTTP 500** 改为**统一 401**；角色、归属与 403/404 契约未发生漂移。 |
|||
|
|||
--- |
|||
|
|||
## 1. 基线 |
|||
|
|||
| 检查项 | 结果 | |
|||
|---|---| |
|||
| 分支 | `refactor/r01-structure-performance` ✔ | |
|||
| HEAD | `35baa8416d31e71dd2c2556877f9d2e1c93b14a1` ✔ | |
|||
| 与上游同步 | `0 / 0` ✔ | |
|||
| 暂存区 | 空 ✔ | |
|||
| `git diff --check` | 无空白错误 ✔ | |
|||
| 8 个目标文件开始前状态 | **均未改动**（无本批以外修改）✔ | |
|||
| `GlobalExceptionHandler.java` | 仍为 stat 缓存标记（内容零差异），未处理、未暂存 ✔ | |
|||
| 未跟踪文件 | 247 个，全部保护 ✔ | |
|||
|
|||
--- |
|||
|
|||
## 2. 迁移前契约表 |
|||
|
|||
| Controller | 真实 Mapping（代表端点） | 允许角色 / 归属 | 私有解析方法 | 写操作涉及表 | |
|||
|---|---|---|---|---| |
|||
| CandidateFeedbackController | `POST/GET/PUT/DELETE /applications/{applicationId}/feedback` | 企业（`assertCompanyOwner`）+ 学生可读 | `resolveUserId` + `getRequestId` | `candidate_feedback` | |
|||
| ApplicationMatchController | `PUT /applications/{id}/candidate-interest-score`、`PUT .../hr-suitability-score`、`GET /applications/{id}/match` | 学生 / 企业（Service 层） | 同上 | `application_match_records`、`application_match_events` | |
|||
| MatchConversationController | `POST /applications/{id}/conversation` | 匹配双方 | 同上 | `conversations`、`conversation_members` | |
|||
| MatchRuleController | `GET/PUT /companies/me/match-rule`、`GET/PUT /profile/me/match-rule` | 企业 / 学生各自规则 | 同上 | `company_match_rules`、`student_match_rules` | |
|||
| TalentDiscoveryController | `GET/PUT /profile/me/talent-discovery`、`GET /companies/me/jobs/{jobId}/talent-recommendations` | 学生（偏好）/ COMPANY（推荐） | `userId()` + `requestId()`（**紧凑式**） | `talent_discovery_preferences` | |
|||
| CareerProgressController | `GET /profile/me/career-progress` | STUDENT | `resolveUserId` + `getRequestId` | 只读 | |
|||
| MatchController | `GET /jobs/{jobId}/match` | STUDENT | 同上 | 只读 | |
|||
| TalentInvitationController | `POST /companies/me/jobs/{jobId}/talent-invitations`、`GET /companies/me/talent-invitations`、`GET /profile/me/talent-invitations`、`POST /profile/me/talent-invitations/{id}/decision` 等 6 个 | 企业创建 / 学生决定 / 双方读取 | `userId()` + `requestId()`（**紧凑式**） | `talent_invitations` | |
|||
|
|||
**契约要点**：8 个 Controller 的角色与资源归属判断**全部位于 Service 层**（Controller 仅解析身份后委派），因此本批迁移不涉及任何角色判断的移动。 |
|||
|
|||
**迁移前状态码**：非法/匿名主体因 `Long.valueOf(auth.getName())` 抛 `NumberFormatException` → **HTTP 500**（见 §3 实测）。 |
|||
|
|||
--- |
|||
|
|||
## 3. 修复前失败测试（TDD 证据） |
|||
|
|||
新增 `R01A4RequestContextMigrationIntegrationTest`（`mydreamjob-server/src/test/java/com/mydreamjob/common/r01a4/`），真实 `SecurityFilterChain` + `MockMvc`。 |
|||
|
|||
**修复前实测（仅加入测试、未改生产代码）：`Tests run: 9, Failures: 3`** |
|||
|
|||
| 失败测试 | 修复前实际 | |
|||
|---|---| |
|||
| `illegalPrincipals_areAlways401` | `path=/applications/1/feedback principal='anonymousUser'` → **`expected: 401 but was: 500`** | |
|||
| `conversationEndpoint_illegalPrincipals_are401` | `principal='anonymousUser'` → **`expected: 401 but was: 500`** | |
|||
| `errorBody_isSafe` | 同路径 → **500** | |
|||
|
|||
**修复后：`Tests run: 9, Failures: 0`** |
|||
|
|||
--- |
|||
|
|||
## 4. 生产修改 |
|||
|
|||
8 个 Controller 统一构造器注入（均为 `private final`）： |
|||
|
|||
```java |
|||
/** R01-A4：身份只来自安全上下文，不接受请求参数传入的 userId。 */ |
|||
private final com.mydreamjob.security.CurrentUserAccessor currentUserAccessor; |
|||
/** R01-A4：requestId 只来自过滤器规范化后的唯一产出点。 */ |
|||
private final com.mydreamjob.common.logging.RequestIdAccessor requestIdAccessor; |
|||
``` |
|||
|
|||
| Controller | `requireUserId()` | `requestIdAccessor.get()` | |
|||
|---|---|---| |
|||
| CandidateFeedbackController | 4 | 4 | |
|||
| ApplicationMatchController | 3 | 3 | |
|||
| MatchConversationController | 1 | 1 | |
|||
| MatchRuleController | 4 | 4 | |
|||
| TalentDiscoveryController | 3 | 3 | |
|||
| CareerProgressController | 1 | 1 | |
|||
| MatchController | 1 | 1 | |
|||
| TalentInvitationController | 6 | 6 | |
|||
|
|||
**共删除私有解析方法 16 个**（8 Controller × 2：6× `resolveUserId` + 6× `getRequestId` + 2× `userId()` + 2× `requestId()`），并移除随之不再使用的 `Authentication` / `SecurityContextHolder` import。 |
|||
|
|||
**未做**：未使用可选注入 / `@Nullable` / `ObjectProvider` / `new Accessor()`；未新增 userId 请求参数；未移动或删除角色检查与资源归属检查；未修改 Service 调用顺序、错误码或接口结构；未顺手重构紧凑代码。 |
|||
|
|||
--- |
|||
|
|||
## 5. 静态门禁 |
|||
|
|||
任务书指定模式在 8 个文件中的命中： |
|||
|
|||
| Controller | 命中 | |
|||
|---|---| |
|||
| CandidateFeedbackController | **0** | |
|||
| ApplicationMatchController | **0** | |
|||
| MatchConversationController | **0** | |
|||
| MatchRuleController | **0** | |
|||
| TalentDiscoveryController | **0** | |
|||
| CareerProgressController | **0** | |
|||
| MatchController | **0** | |
|||
| TalentInvitationController | **0** | |
|||
|
|||
**全部为 0，无业务参数解析误报。身份/requestId 私有解析残留为 0。** |
|||
|
|||
### 全仓剩余统计 |
|||
|
|||
**身份解析**（`SecurityContextHolder.getContext().getAuthentication` \| `Long.(valueOf|parseLong)([^)]*getName()`） |
|||
|
|||
| | A3 后 | A4 后 | 预期 | |
|||
|---|---|---|---| |
|||
| 全仓文件 | 20 | **12** | 12 ✔ | |
|||
| —— 基础设施 | 3 | **3**（`security/CurrentUserAccessor`、`auth/JwtAuthenticationFilter`、`deletion/DeletionGuardInterceptor`） | — | |
|||
| —— **业务 Controller** | 17 | **9** | 9 ✔ | |
|||
| —— 误报 | 0 | **0** | — | |
|||
|
|||
**requestId 解析**（`request.getHeader("X-Request-Id")` \| `request.getHeader(RequestIdFilter.REQUEST_ID_HEADER)` \| `String (getRequestId|resolveRequestId|requestId)(`） |
|||
|
|||
| | A3 后 | A4 后 | 预期 | |
|||
|---|---|---|---| |
|||
| 全仓文件（**本轮完整模式**） | 25 | **18** | 17 | |
|||
| 全仓文件（**A3 口径**，不含 `REQUEST_ID_HEADER` 项） | 25 | **17** | 17 ✔ | |
|||
| —— 基础设施（完整模式） | 4 | **5** | — | |
|||
| —— **业务 Controller** | 21 | **13** | 13 ✔ | |
|||
| —— Service / 非请求入口 | 0 | **0** | — | |
|||
| —— 误报 | 0 | **0** | — | |
|||
|
|||
**数量差异的逐文件解释（不修改代码迁就数字）**：本轮模式比 A3 口径多含 `request.getHeader(RequestIdFilter.REQUEST_ID_HEADER)` 一项，该模式额外命中的**唯一文件**是 `common/logging/RequestIdAccessor.java`（第 35 行的兜底读取 `request.getHeader(RequestIdFilter.REQUEST_ID_HEADER)`）—— 这是 **Accessor 自身的合法实现**，属基础设施，非业务入口。因此：完整模式 18 = 基础设施 5 + 业务 13；A3 口径 17 = 基础设施 4 + 业务 13。**业务 Controller 数量与预期完全一致（13）**。 |
|||
|
|||
--- |
|||
|
|||
## 6. 角色与副作用验证 |
|||
|
|||
### 6.1 既有测试回归（角色/归属语义证据） |
|||
|
|||
| 命令 | 结果 | |
|||
|---|---| |
|||
| A4 关联回归（`*CandidateFeedback*Test,*ApplicationMatch*Test,*MatchConversation*Test,*MatchRule*Test,*TalentDiscovery*Test,*CareerProgress*Test,*MatchController*Test,*TalentInvitation*Test,*RequestContext*Test,*RequestId*Test`） | **163 / 163**，F=0 E=0 S=0，BUILD SUCCESS | |
|||
|
|||
既有测试覆盖：反馈仅企业可写、匹配双方可见性、会话归属、匹配规则角色、人才发现 COMPANY 权限、职业进度 STUDENT 权限、邀约企业创建/学生决定/双方读取、其他企业与其他学生的 403/404。 |
|||
|
|||
### 6.2 真实 HTTP 验证 |
|||
|
|||
只读实例 PID 7648，验证后已停止。 |
|||
|
|||
| 场景 | 结果 | |
|||
|---|---| |
|||
| 无 token / 畸形 Bearer / 纯数字 Bearer × 7 端点 | 全部 **401** ✔ | |
|||
| STUDENT → `GET /companies/me/match-rule` | **403** ✔ | |
|||
| COMPANY → `GET /companies/me/match-rule` | **403**（该账号无企业资料，既有权属语义）✔ | |
|||
| STUDENT → `GET /profile/me/career-progress` | **200** ✔ | |
|||
| COMPANY → `GET /profile/me/career-progress` | **200**（该账号注册时自带 STUDENT 角色，属既有语义）✔ | |
|||
| STUDENT → `GET /profile/me/talent-discovery` | **200** ✔ | |
|||
| ADMIN → `GET /profile/me/talent-discovery` | **403** ✔ | |
|||
| STUDENT → `GET /profile/me/talent-invitations` | **200** ✔ | |
|||
| COMPANY → `GET /companies/me/talent-invitations` | **403**（无企业资料）✔ | |
|||
|
|||
### 6.3 副作用快照 |
|||
|
|||
上述**全部请求前后 22 张表逐行稳定排序的逐字段快照比对 → 全部零变化** ✔ |
|||
|
|||
- 覆盖表含 `candidate_feedback`、`application_match_records`、`application_match_events`、`conversations`、`conversation_members`、`company_match_rules`、`student_match_rules`、`talent_discovery_preferences`、`talent_invitations`、`notifications`、`messages`、`audit_logs` 等 |
|||
- **未使用** COUNT/SUM 代替内容快照；采用显式列 + 稳定 `ORDER BY` 的逐字段比较 |
|||
|
|||
--- |
|||
|
|||
## 7. 独立验证辅助测试（实施证据） |
|||
|
|||
新增 `A4AccessorWiringProbeTest`（4 例），证明接线真实存在： |
|||
|
|||
| 用例 | 断言 | |
|||
|---|---| |
|||
| `accessorThrowsUnauthenticated_endpointsReturn401` | mock Accessor 抛认证异常 → 7 端点全部 **401**（若未接线则不可能） | |
|||
| `serviceReceivesAccessorUserId` | mock 返回 `4242L` → `careerProgressService.getCareerProgress(4242L, …)`、`talentInvitationService.listCompany(4242L, …)` 收到该值 | |
|||
| `requestIdComesFromAccessorBean` | mock 的 requestId 必须出现在响应体 | |
|||
| `noToken_is401` | 无 Token → Security 链 401 | |
|||
|
|||
**删除 Accessor 调用会使本测试失败** ✔（属实施证据，不代替后续独立复验） |
|||
|
|||
--- |
|||
|
|||
## 8. requestId 同源证据 |
|||
|
|||
| 输入 | 结果 | |
|||
|---|---| |
|||
| 合法值 `a4-legal-0001` | 响应头 == 响应体 `requestId`，原样保留 ✔ | |
|||
| 空白 `" "` | 重新生成非空值，头体同源 ✔ | |
|||
| 超长（80 字符） | 收敛至 ≤32，头体同源 ✔ | |
|||
| 非法字符 `<script>x</script>`、`a b` | 生成合法替代值；响应头不含 `<`/`>`/空格 ✔ | |
|||
| request attribute 与 header 不同 | **attribute 优先** ✔ | |
|||
| CR / LF / CRLF（直接经 Accessor） | 不进入规范化结果 ✔ | |
|||
|
|||
覆盖 8 个端点（含 POST 端点）。 |
|||
|
|||
--- |
|||
|
|||
## 9. 测试数量与 OpenAPI |
|||
|
|||
| 命令 | 结果 | |
|||
|---|---| |
|||
| A4 定向（`R01A4…,A4AccessorWiringProbeTest,CurrentUserAccessorTest,RequestIdAccessorTest,RequestIdFilterTest`） | **43 / 43**，F=0 E=0 **S=0** | |
|||
| A4 关联回归 | **163 / 163**，F=0 E=0 **S=0** | |
|||
| `mvn test` | **2238 / 2238**，Failures=0、Errors=0、**Skipped=0** | |
|||
| `mvn clean verify` | **2238 / 2238**，Failures=0、Errors=0、**Skipped=0**，BUILD SUCCESS（≥ 2225 ✔） | |
|||
| `python docs\verify_openapi.py` | **176 paths / 214 operations**，All checks passed | |
|||
|
|||
- 较上轮（2225）新增 **13** 个测试（9 + 4） |
|||
- **`docs/openapi-rc.json` 零修改** ✔ |
|||
- **V1–V45 零修改** ✔ |
|||
- **未新增接口、表、索引、迁移或 ErrorCode** ✔ |
|||
- **未发现新的基线测试污染**（上一轮的账号注销夹具隔离修复已生效）✔ |
|||
|
|||
--- |
|||
|
|||
## 10. 精确修改文件 |
|||
|
|||
**生产代码（8 个，全部在任务书指定清单内）** |
|||
|
|||
``` |
|||
mydreamjob-server/src/main/java/com/mydreamjob/feedback/CandidateFeedbackController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/bidirectionalmatch/ApplicationMatchController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/bidirectionalmatch/MatchConversationController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/bidirectionalmatch/MatchRuleController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/talentdiscovery/TalentDiscoveryController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/careerprogress/CareerProgressController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/match/MatchController.java |
|||
mydreamjob-server/src/main/java/com/mydreamjob/talentinvitation/TalentInvitationController.java |
|||
``` |
|||
|
|||
**测试（新增 2 个）** |
|||
|
|||
``` |
|||
mydreamjob-server/src/test/java/com/mydreamjob/common/r01a4/R01A4RequestContextMigrationIntegrationTest.java |
|||
mydreamjob-server/src/test/java/com/mydreamjob/common/r01a4/A4AccessorWiringProbeTest.java |
|||
``` |
|||
|
|||
**文档（1 个）** |
|||
|
|||
``` |
|||
docs/backend-development-roadmap.md # 仅更新顶部 R01 状态行，历史章节未动 |
|||
``` |
|||
|
|||
**未修改**：Service、DTO、`ErrorCode`、Flyway、`SecurityConfig`、Filter 顺序、OpenAPI、既有测试、`UserRoleGuard`、"匿名 401 缺 requestId"观察项。 |
|||
|
|||
--- |
|||
|
|||
## 11. Git 状态 |
|||
|
|||
``` |
|||
分支：refactor/r01-structure-performance |
|||
HEAD：35baa8416d31e71dd2c2556877f9d2e1c93b14a1（未变） |
|||
暂存区：空 |
|||
git add -A / commit / push：均未执行 |
|||
Docker：未操作 |
|||
历史未跟踪文件：247 个完整保留 |
|||
``` |
|||
|
|||
验收临时用户（a4vstu / a4vcom）已按精确主键清理，`users` 残留 0；`audit_logs` 4 行 append-only 保留并登记。 |
|||
|
|||
--- |
|||
|
|||
## 12. 明确声明 |
|||
|
|||
- **未暂存、未提交、未推送。** |
|||
- 未进入 `UserRoleGuard`；未处理"匿名 401 缺 requestId"观察项。 |
|||
- 未使用 `@Autowired(required=false)`、`@Nullable`、`ObjectProvider` 或 `new Accessor()` 回退；测试切片使用真实 `SecurityFilterChain` 与真实 Accessor Bean。 |
|||
- 全仓剩余身份/requestId 数量已**逐文件分类解释**，未修改代码迁就数字。 |
|||
|
|||
--- |
|||
|
|||
> **R01-A4第四批请求身份与requestId收束完成，待独立代码复验。** |
|||
@ -0,0 +1,125 @@ |
|||
package com.mydreamjob.common.r01a4; |
|||
|
|||
import com.mydreamjob.auth.UserRepository; |
|||
import com.mydreamjob.bidirectionalmatch.BidirectionalMatchService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchConversationService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchRuleService; |
|||
import com.mydreamjob.careerprogress.CareerProgressService; |
|||
import com.mydreamjob.common.logging.RequestIdAccessor; |
|||
import com.mydreamjob.feedback.CandidateFeedbackService; |
|||
import com.mydreamjob.match.MatchService; |
|||
import com.mydreamjob.security.CurrentUserAccessor; |
|||
import com.mydreamjob.talentdiscovery.TalentDiscoveryService; |
|||
import com.mydreamjob.talentinvitation.TalentInvitationService; |
|||
import org.junit.jupiter.api.BeforeEach; |
|||
import org.junit.jupiter.api.DisplayName; |
|||
import org.junit.jupiter.api.Test; |
|||
import org.mockito.Mockito; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; |
|||
import org.springframework.boot.test.context.SpringBootTest; |
|||
import org.springframework.boot.test.mock.mockito.MockBean; |
|||
import org.springframework.data.redis.core.RedisTemplate; |
|||
import org.springframework.security.authentication.InsufficientAuthenticationException; |
|||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; |
|||
import org.springframework.security.core.authority.AuthorityUtils; |
|||
import org.springframework.test.context.ActiveProfiles; |
|||
import org.springframework.test.web.servlet.MockMvc; |
|||
|
|||
import java.util.Map; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.mockito.ArgumentMatchers.any; |
|||
import static org.mockito.ArgumentMatchers.anyInt; |
|||
import static org.mockito.ArgumentMatchers.eq; |
|||
import static org.mockito.Mockito.verify; |
|||
import static org.mockito.Mockito.when; |
|||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication; |
|||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; |
|||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; |
|||
|
|||
/** R01-A4 独立接线变异检测，包含实施测试遗漏的 POST MatchConversationController。 */ |
|||
@SpringBootTest |
|||
@AutoConfigureMockMvc |
|||
@ActiveProfiles("integration-test") |
|||
class A4AccessorWiringIndependentTest { |
|||
|
|||
private static final UsernamePasswordAuthenticationToken LEGAL = |
|||
new UsernamePasswordAuthenticationToken("42", "n/a", |
|||
AuthorityUtils.createAuthorityList("ROLE_STUDENT", "ROLE_COMPANY", "ROLE_ADMIN")); |
|||
|
|||
@Autowired private MockMvc mockMvc; |
|||
|
|||
@MockBean private CurrentUserAccessor currentUserAccessor; |
|||
@MockBean private RequestIdAccessor requestIdAccessor; |
|||
@MockBean private CandidateFeedbackService feedbackService; |
|||
@MockBean private BidirectionalMatchService bidirectionalMatchService; |
|||
@MockBean private MatchConversationService matchConversationService; |
|||
@MockBean private MatchRuleService matchRuleService; |
|||
@MockBean private TalentDiscoveryService talentDiscoveryService; |
|||
@MockBean private CareerProgressService careerProgressService; |
|||
@MockBean private MatchService matchService; |
|||
@MockBean private TalentInvitationService talentInvitationService; |
|||
@MockBean private UserRepository userRepository; |
|||
@MockBean private RedisTemplate<String, Object> redisTemplate; |
|||
|
|||
@BeforeEach |
|||
void resetMocks() { |
|||
Mockito.reset(currentUserAccessor, requestIdAccessor, feedbackService, bidirectionalMatchService, |
|||
matchConversationService, matchRuleService, talentDiscoveryService, careerProgressService, |
|||
matchService, talentInvitationService); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 独立接线：8/8 Controller 都调用 CurrentUserAccessor") |
|||
void allEightControllersCallCurrentUserAccessor() throws Exception { |
|||
when(currentUserAccessor.requireUserId()) |
|||
.thenThrow(new InsufficientAuthenticationException("authentication required")); |
|||
|
|||
assertThat(mockMvc.perform(get("/applications/1/feedback").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(get("/applications/1/match").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(post("/applications/1/conversation").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(get("/companies/me/match-rule").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(get("/profile/me/talent-discovery").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(get("/profile/me/career-progress").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(get("/jobs/1/match").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
assertThat(mockMvc.perform(get("/companies/me/talent-invitations").with(authentication(LEGAL))).andReturn().getResponse().getStatus()).isEqualTo(401); |
|||
|
|||
verify(currentUserAccessor, Mockito.times(8)).requireUserId(); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 独立接线：8/8 Service 收到 Accessor 返回的唯一 userId") |
|||
void allEightServicesReceiveAccessorUserId() throws Exception { |
|||
when(currentUserAccessor.requireUserId()).thenReturn(4242L); |
|||
when(requestIdAccessor.get(any())).thenReturn("a4-independent-request"); |
|||
when(matchConversationService.createOrGetMatchConversation(4242L, 1L)).thenReturn(Map.of()); |
|||
|
|||
mockMvc.perform(get("/applications/1/feedback").with(authentication(LEGAL))); |
|||
verify(feedbackService).getFeedback(4242L, 1L); |
|||
|
|||
mockMvc.perform(get("/applications/1/match").with(authentication(LEGAL))); |
|||
verify(bidirectionalMatchService).getMatchView(4242L, 1L); |
|||
|
|||
mockMvc.perform(post("/applications/1/conversation").with(authentication(LEGAL))); |
|||
verify(matchConversationService).createOrGetMatchConversation(4242L, 1L); |
|||
|
|||
mockMvc.perform(get("/companies/me/match-rule").with(authentication(LEGAL))); |
|||
verify(matchRuleService).getCompanyRule(4242L); |
|||
|
|||
mockMvc.perform(get("/profile/me/talent-discovery").with(authentication(LEGAL))); |
|||
verify(talentDiscoveryService).getPreference(4242L); |
|||
|
|||
mockMvc.perform(get("/profile/me/career-progress").with(authentication(LEGAL))); |
|||
verify(careerProgressService).getCareerProgress(eq(4242L), anyInt(), anyInt(), any()); |
|||
|
|||
mockMvc.perform(get("/jobs/1/match").with(authentication(LEGAL))); |
|||
verify(matchService).diagnose(eq(4242L), eq(1L), any()); |
|||
|
|||
mockMvc.perform(get("/companies/me/talent-invitations").with(authentication(LEGAL))); |
|||
verify(talentInvitationService).listCompany(eq(4242L), anyInt(), anyInt()); |
|||
|
|||
verify(currentUserAccessor, Mockito.times(8)).requireUserId(); |
|||
verify(requestIdAccessor, Mockito.times(8)).get(any()); |
|||
} |
|||
} |
|||
@ -0,0 +1,135 @@ |
|||
package com.mydreamjob.common.r01a4; |
|||
|
|||
import com.mydreamjob.auth.UserRepository; |
|||
import com.mydreamjob.bidirectionalmatch.BidirectionalMatchService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchConversationService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchRuleService; |
|||
import com.mydreamjob.careerprogress.CareerProgressService; |
|||
import com.mydreamjob.common.logging.RequestIdAccessor; |
|||
import com.mydreamjob.feedback.CandidateFeedbackService; |
|||
import com.mydreamjob.match.MatchService; |
|||
import com.mydreamjob.security.CurrentUserAccessor; |
|||
import com.mydreamjob.talentdiscovery.TalentDiscoveryService; |
|||
import com.mydreamjob.talentinvitation.TalentInvitationService; |
|||
import org.junit.jupiter.api.DisplayName; |
|||
import org.junit.jupiter.api.Test; |
|||
import org.mockito.Mockito; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; |
|||
import org.springframework.boot.test.context.SpringBootTest; |
|||
import org.springframework.boot.test.mock.mockito.MockBean; |
|||
import org.springframework.data.redis.core.RedisTemplate; |
|||
import org.springframework.security.authentication.InsufficientAuthenticationException; |
|||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; |
|||
import org.springframework.security.core.authority.AuthorityUtils; |
|||
import org.springframework.test.context.ActiveProfiles; |
|||
import org.springframework.test.web.servlet.MockMvc; |
|||
|
|||
import java.util.List; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.mockito.ArgumentMatchers.any; |
|||
import static org.mockito.ArgumentMatchers.anyInt; |
|||
import static org.mockito.ArgumentMatchers.eq; |
|||
import static org.mockito.Mockito.times; |
|||
import static org.mockito.Mockito.verify; |
|||
import static org.mockito.Mockito.when; |
|||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication; |
|||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; |
|||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; |
|||
|
|||
/** |
|||
* R01-A4 实施证据：**接线变异检测**。 |
|||
* |
|||
* <p>将两个 Accessor 替换为 mock，证明 8 个 Controller 确实调用了既有 bean： |
|||
* 若某 Controller 仍保留自有解析（未接线），mock 抛未登录时它不会返回 401。 |
|||
* 因此**删除 Accessor 调用会使本测试失败**。</p> |
|||
* |
|||
* <p>本测试属实施阶段证据，不代替后续独立复验。</p> |
|||
*/ |
|||
@SpringBootTest |
|||
@AutoConfigureMockMvc |
|||
@ActiveProfiles("integration-test") |
|||
class A4AccessorWiringProbeTest { |
|||
|
|||
@Autowired private MockMvc mockMvc; |
|||
|
|||
@MockBean private CurrentUserAccessor currentUserAccessor; |
|||
@MockBean private RequestIdAccessor requestIdAccessor; |
|||
|
|||
@MockBean private CandidateFeedbackService feedbackService; |
|||
@MockBean private BidirectionalMatchService bidirectionalMatchService; |
|||
@MockBean private MatchConversationService matchConversationService; |
|||
@MockBean private MatchRuleService matchRuleService; |
|||
@MockBean private TalentDiscoveryService talentDiscoveryService; |
|||
@MockBean private CareerProgressService careerProgressService; |
|||
@MockBean private MatchService matchService; |
|||
@MockBean private TalentInvitationService talentInvitationService; |
|||
@MockBean private UserRepository userRepository; |
|||
@MockBean private RedisTemplate<String, Object> redisTemplate; |
|||
|
|||
private static final List<String> PATHS = List.of( |
|||
"/applications/1/feedback", |
|||
"/applications/1/match", |
|||
"/companies/me/match-rule", |
|||
"/profile/me/talent-discovery", |
|||
"/profile/me/career-progress", |
|||
"/jobs/1/match", |
|||
"/companies/me/talent-invitations"); |
|||
|
|||
private static final UsernamePasswordAuthenticationToken LEGAL = |
|||
new UsernamePasswordAuthenticationToken("42", "n/a", |
|||
AuthorityUtils.createAuthorityList("ROLE_STUDENT", "ROLE_COMPANY", "ROLE_ADMIN")); |
|||
|
|||
@Test |
|||
@DisplayName("A4 接线检测：Accessor 抛未登录时代表端点必须 401") |
|||
void accessorThrowsUnauthenticated_endpointsReturn401() throws Exception { |
|||
when(currentUserAccessor.requireUserId()) |
|||
.thenThrow(new InsufficientAuthenticationException("authentication required")); |
|||
|
|||
for (String path : PATHS) { |
|||
int st = mockMvc.perform(get(path).with(authentication(LEGAL))) |
|||
.andReturn().getResponse().getStatus(); |
|||
assertThat(st).as("path=%s 若未接线 Accessor，不会是 401", path).isEqualTo(401); |
|||
} |
|||
verify(currentUserAccessor, times(PATHS.size())).requireUserId(); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 接线检测：Accessor 返回固定 userId 时 Service 收到该值") |
|||
void serviceReceivesAccessorUserId() throws Exception { |
|||
when(currentUserAccessor.requireUserId()).thenReturn(4242L); |
|||
when(requestIdAccessor.get(any())).thenReturn("a4-probe"); |
|||
|
|||
mockMvc.perform(get("/profile/me/career-progress") |
|||
.with(authentication(LEGAL))).andReturn(); |
|||
verify(careerProgressService).getCareerProgress(eq(4242L), anyInt(), anyInt(), any()); |
|||
|
|||
mockMvc.perform(get("/companies/me/talent-invitations") |
|||
.with(authentication(LEGAL))).andReturn(); |
|||
verify(talentInvitationService).listCompany(eq(4242L), anyInt(), anyInt()); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 接线检测：响应体 requestId 来自 Accessor mock") |
|||
void requestIdComesFromAccessorBean() throws Exception { |
|||
when(currentUserAccessor.requireUserId()).thenReturn(42L); |
|||
when(requestIdAccessor.get(any())).thenReturn("a4-probe-from-accessor"); |
|||
|
|||
for (String path : PATHS) { |
|||
String body = mockMvc.perform(get(path).with(authentication(LEGAL))) |
|||
.andReturn().getResponse().getContentAsString(); |
|||
assertThat(body).as("path=%s", path) |
|||
.contains("\"requestId\":\"a4-probe-from-accessor\""); |
|||
} |
|||
Mockito.verify(requestIdAccessor, Mockito.atLeastOnce()).get(any()); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 接线检测：无 Token 仍 401（Security 链）") |
|||
void noToken_is401() throws Exception { |
|||
for (String path : PATHS) { |
|||
mockMvc.perform(get(path)).andExpect(status().isUnauthorized()); |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,129 @@ |
|||
package com.mydreamjob.common.r01a4; |
|||
|
|||
import com.fasterxml.jackson.databind.JsonNode; |
|||
import com.fasterxml.jackson.databind.ObjectMapper; |
|||
import com.mydreamjob.auth.UserRepository; |
|||
import com.mydreamjob.bidirectionalmatch.BidirectionalMatchService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchConversationService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchRuleService; |
|||
import com.mydreamjob.careerprogress.CareerProgressService; |
|||
import com.mydreamjob.feedback.CandidateFeedbackService; |
|||
import com.mydreamjob.match.MatchService; |
|||
import com.mydreamjob.talentdiscovery.TalentDiscoveryService; |
|||
import com.mydreamjob.talentinvitation.TalentInvitationService; |
|||
import org.junit.jupiter.api.DisplayName; |
|||
import org.junit.jupiter.api.Test; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; |
|||
import org.springframework.boot.test.context.SpringBootTest; |
|||
import org.springframework.boot.test.mock.mockito.MockBean; |
|||
import org.springframework.data.redis.core.RedisTemplate; |
|||
import org.springframework.security.authentication.AnonymousAuthenticationToken; |
|||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; |
|||
import org.springframework.security.core.Authentication; |
|||
import org.springframework.security.core.authority.AuthorityUtils; |
|||
import org.springframework.test.context.ActiveProfiles; |
|||
import org.springframework.test.web.servlet.MockMvc; |
|||
import org.springframework.test.web.servlet.RequestBuilder; |
|||
|
|||
import java.util.List; |
|||
import java.util.function.Function; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication; |
|||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; |
|||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; |
|||
|
|||
/** R01-A4 独立复验：八个 Controller 的真实 Mapping 必须全部经过统一身份与 requestId 边界。 */ |
|||
@SpringBootTest |
|||
@AutoConfigureMockMvc |
|||
@ActiveProfiles("integration-test") |
|||
class A4IndependentVerificationTest { |
|||
|
|||
private static final ObjectMapper JSON = new ObjectMapper(); |
|||
private static final List<String> ILLEGAL = List.of( |
|||
"anonymousUser", "not-a-number-a4", "12345678901234567890", "0", "-1"); |
|||
|
|||
@Autowired private MockMvc mockMvc; |
|||
|
|||
@MockBean private CandidateFeedbackService feedbackService; |
|||
@MockBean private BidirectionalMatchService bidirectionalMatchService; |
|||
@MockBean private MatchConversationService matchConversationService; |
|||
@MockBean private MatchRuleService matchRuleService; |
|||
@MockBean private TalentDiscoveryService talentDiscoveryService; |
|||
@MockBean private CareerProgressService careerProgressService; |
|||
@MockBean private MatchService matchService; |
|||
@MockBean private TalentInvitationService talentInvitationService; |
|||
@MockBean private UserRepository userRepository; |
|||
@MockBean private RedisTemplate<String, Object> redisTemplate; |
|||
|
|||
private record Endpoint(String controller, Function<Authentication, RequestBuilder> request) { } |
|||
|
|||
private static List<Endpoint> endpoints() { |
|||
return List.of( |
|||
new Endpoint("CandidateFeedbackController", a -> get("/applications/1/feedback").with(authentication(a))), |
|||
new Endpoint("ApplicationMatchController", a -> get("/applications/1/match").with(authentication(a))), |
|||
new Endpoint("MatchConversationController", a -> post("/applications/1/conversation").with(authentication(a))), |
|||
new Endpoint("MatchRuleController", a -> get("/companies/me/match-rule").with(authentication(a))), |
|||
new Endpoint("TalentDiscoveryController", a -> get("/profile/me/talent-discovery").with(authentication(a))), |
|||
new Endpoint("CareerProgressController", a -> get("/profile/me/career-progress").with(authentication(a))), |
|||
new Endpoint("MatchController", a -> get("/jobs/1/match").with(authentication(a))), |
|||
new Endpoint("TalentInvitationController", a -> get("/companies/me/talent-invitations").with(authentication(a)))); |
|||
} |
|||
|
|||
private static Authentication principal(String name) { |
|||
return new UsernamePasswordAuthenticationToken(name, "n/a", |
|||
AuthorityUtils.createAuthorityList("ROLE_STUDENT", "ROLE_COMPANY", "ROLE_ADMIN")); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 独立复验：8/8 真实 Mapping 对非法主体均返回安全的 401") |
|||
void allEightMappingsRejectIllegalPrincipalsWithoutLeakage() throws Exception { |
|||
assertThat(endpoints()).hasSize(8); |
|||
for (Endpoint endpoint : endpoints()) { |
|||
for (String illegal : ILLEGAL) { |
|||
var response = mockMvc.perform(endpoint.request().apply(principal(illegal))) |
|||
.andReturn().getResponse(); |
|||
assertThat(response.getStatus()) |
|||
.as("%s principal=%s", endpoint.controller(), illegal).isEqualTo(401); |
|||
JsonNode body = JSON.readTree(response.getContentAsString()); |
|||
assertThat(body.path("code").asInt()).isEqualTo(401); |
|||
assertThat(body.path("message").asText()) |
|||
.doesNotContain("Exception", "java.", "principal", "NumberFormatException", |
|||
"not-a-number-a4", "12345678901234567890"); |
|||
assertThat(body.has("stackTrace")).isFalse(); |
|||
assertThat(body.has("trace")).isFalse(); |
|||
} |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 独立复验：8/8 真实 Mapping 对匿名 token 均返回 401") |
|||
void allEightMappingsRejectAnonymousToken() throws Exception { |
|||
Authentication anonymous = new AnonymousAuthenticationToken("a4-key", "anonymousUser", |
|||
AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")); |
|||
for (Endpoint endpoint : endpoints()) { |
|||
assertThat(mockMvc.perform(endpoint.request().apply(anonymous)).andReturn().getResponse().getStatus()) |
|||
.as(endpoint.controller()).isEqualTo(401); |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4 独立复验：8/8 真实 Mapping 的响应 body 与规范化响应头 requestId 同源") |
|||
void allEightMappingsUseNormalizedRequestId() throws Exception { |
|||
Authentication legal = principal("4242"); |
|||
for (Endpoint endpoint : endpoints()) { |
|||
var request = endpoint.request().apply(legal); |
|||
if (request instanceof org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder builder) { |
|||
builder.header("X-Request-Id", "a4/<unsafe value>" + "x".repeat(80)); |
|||
} |
|||
var response = mockMvc.perform(request).andReturn().getResponse(); |
|||
assertThat(response.getStatus()).as(endpoint.controller()).isNotEqualTo(401); |
|||
String requestId = response.getHeader("X-Request-Id"); |
|||
assertThat(requestId).isNotBlank().hasSizeLessThanOrEqualTo(32) |
|||
.doesNotContain("<", ">", " ", "\r", "\n"); |
|||
assertThat(response.getContentAsString()) |
|||
.contains("\"requestId\":\"" + requestId + "\""); |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,214 @@ |
|||
package com.mydreamjob.common.r01a4; |
|||
|
|||
import com.fasterxml.jackson.databind.JsonNode; |
|||
import com.fasterxml.jackson.databind.ObjectMapper; |
|||
import com.mydreamjob.auth.UserRepository; |
|||
import com.mydreamjob.bidirectionalmatch.BidirectionalMatchService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchConversationService; |
|||
import com.mydreamjob.bidirectionalmatch.MatchRuleService; |
|||
import com.mydreamjob.careerprogress.CareerProgressService; |
|||
import com.mydreamjob.common.logging.RequestIdAccessor; |
|||
import com.mydreamjob.feedback.CandidateFeedbackService; |
|||
import com.mydreamjob.match.MatchService; |
|||
import com.mydreamjob.talentdiscovery.TalentDiscoveryService; |
|||
import com.mydreamjob.talentinvitation.TalentInvitationService; |
|||
import org.junit.jupiter.api.DisplayName; |
|||
import org.junit.jupiter.api.Test; |
|||
import org.springframework.beans.factory.annotation.Autowired; |
|||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; |
|||
import org.springframework.boot.test.context.SpringBootTest; |
|||
import org.springframework.boot.test.mock.mockito.MockBean; |
|||
import org.springframework.data.redis.core.RedisTemplate; |
|||
import org.springframework.security.authentication.AnonymousAuthenticationToken; |
|||
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; |
|||
import org.springframework.security.core.Authentication; |
|||
import org.springframework.security.core.authority.AuthorityUtils; |
|||
import org.springframework.test.context.ActiveProfiles; |
|||
import org.springframework.test.web.servlet.MockMvc; |
|||
|
|||
import java.util.List; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication; |
|||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; |
|||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; |
|||
|
|||
/** |
|||
* R01-A4 第四批：请求身份与 requestId 收束的特征测试。 |
|||
* |
|||
* <p>代表端点 URL 全部取自源码真实 Mapping。身份只来自 |
|||
* {@code CurrentUserAccessor#requireUserId()}，requestId 只来自 |
|||
* {@code RequestIdAccessor#get(HttpServletRequest)}。</p> |
|||
* |
|||
* <p>对溢出/非数字主体不做整响应数字搜索；无 Token 请求由 Security 链提前返回， |
|||
* 本批只断言 401、不要求其携带 requestId。</p> |
|||
*/ |
|||
@SpringBootTest |
|||
@AutoConfigureMockMvc |
|||
@ActiveProfiles("integration-test") |
|||
class R01A4RequestContextMigrationIntegrationTest { |
|||
|
|||
@Autowired private MockMvc mockMvc; |
|||
@Autowired private RequestIdAccessor requestIdAccessor; |
|||
|
|||
@MockBean private CandidateFeedbackService feedbackService; |
|||
@MockBean private BidirectionalMatchService bidirectionalMatchService; |
|||
@MockBean private MatchConversationService matchConversationService; |
|||
@MockBean private MatchRuleService matchRuleService; |
|||
@MockBean private TalentDiscoveryService talentDiscoveryService; |
|||
@MockBean private CareerProgressService careerProgressService; |
|||
@MockBean private MatchService matchService; |
|||
@MockBean private TalentInvitationService talentInvitationService; |
|||
@MockBean private UserRepository userRepository; |
|||
@MockBean private RedisTemplate<String, Object> redisTemplate; |
|||
|
|||
private static final ObjectMapper MAPPER = new ObjectMapper(); |
|||
|
|||
/** 8 个 Controller 的真实代表端点（GET，取自源码 Mapping）。 */ |
|||
private static final List<String> PATHS = List.of( |
|||
"/applications/1/feedback", // CandidateFeedbackController
|
|||
"/applications/1/match", // ApplicationMatchController
|
|||
"/companies/me/match-rule", // MatchRuleController
|
|||
"/profile/me/talent-discovery", // TalentDiscoveryController
|
|||
"/profile/me/career-progress", // CareerProgressController
|
|||
"/jobs/1/match", // MatchController
|
|||
"/companies/me/talent-invitations"); // TalentInvitationController
|
|||
|
|||
/** MatchConversationController 只有 POST 端点，单独以 POST 覆盖。 */ |
|||
private static final String CONVERSATION_PATH = "/applications/1/conversation"; |
|||
|
|||
private static final List<String> ILLEGAL = List.of( |
|||
"anonymousUser", "", " ", "not-a-number", "abc123", |
|||
"12345678901234567890", "0", "-1"); |
|||
|
|||
private static Authentication principal(String name) { |
|||
return new UsernamePasswordAuthenticationToken(name, "n/a", |
|||
AuthorityUtils.createAuthorityList("ROLE_STUDENT", "ROLE_COMPANY", "ROLE_ADMIN")); |
|||
} |
|||
|
|||
private List<String> allPaths() { |
|||
List<String> all = new java.util.ArrayList<>(PATHS); |
|||
all.add(CONVERSATION_PATH); |
|||
return all; |
|||
} |
|||
|
|||
// ── 身份 ─────────────────────────────────────────────────
|
|||
|
|||
@Test |
|||
@DisplayName("A4：八端点 × 八非法主体 一律 401（非 400/500）") |
|||
void illegalPrincipals_areAlways401() throws Exception { |
|||
for (String path : PATHS) { |
|||
for (String p : ILLEGAL) { |
|||
int st = mockMvc.perform(get(path).with(authentication(principal(p)))) |
|||
.andReturn().getResponse().getStatus(); |
|||
assertThat(st).as("path=%s principal='%s' 必须 401", path, p).isEqualTo(401); |
|||
} |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：POST 端点（MatchConversation）非法主体同样 401") |
|||
void conversationEndpoint_illegalPrincipals_are401() throws Exception { |
|||
for (String p : ILLEGAL) { |
|||
int st = mockMvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders |
|||
.post(CONVERSATION_PATH).with(authentication(principal(p)))) |
|||
.andReturn().getResponse().getStatus(); |
|||
assertThat(st).as("principal='%s'", p).isEqualTo(401); |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：匿名 token 与无 Token 均 401") |
|||
void anonymousAndNoToken_are401() throws Exception { |
|||
Authentication anon = new AnonymousAuthenticationToken("k", "anonymousUser", |
|||
AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")); |
|||
for (String path : allPaths()) { |
|||
assertThat(mockMvc.perform(get(path).with(authentication(anon))).andReturn() |
|||
.getResponse().getStatus()).as(path).isEqualTo(401); |
|||
mockMvc.perform(get(path)).andExpect(status().isUnauthorized()); |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：错误体安全，不回显 principal/类名/堆栈") |
|||
void errorBody_isSafe() throws Exception { |
|||
for (String path : PATHS) { |
|||
for (String p : ILLEGAL) { |
|||
String body = mockMvc.perform(get(path).with(authentication(principal(p)))) |
|||
.andReturn().getResponse().getContentAsString(); |
|||
JsonNode json = MAPPER.readTree(body); |
|||
assertThat(json.path("code").asInt()).as("path=%s", path).isEqualTo(401); |
|||
String msg = json.path("message").asText(); |
|||
assertThat(msg).isIn("authentication required", "not authenticated"); |
|||
assertThat(msg).doesNotContain("Exception").doesNotContain("java.") |
|||
.doesNotContain("principal").doesNotContain("at com.mydreamjob"); |
|||
assertThat(json.has("stackTrace")).isFalse(); |
|||
assertThat(json.has("trace")).isFalse(); |
|||
if (p.length() >= 3 && !p.chars().allMatch(Character::isDigit)) { |
|||
assertThat(msg).doesNotContain(p); |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：溢出主体无 NumberFormatException") |
|||
void overflow_hasNoNumberFormatException() throws Exception { |
|||
for (String path : allPaths()) { |
|||
String body = mockMvc.perform(get(path) |
|||
.with(authentication(principal("12345678901234567890")))) |
|||
.andReturn().getResponse().getContentAsString(); |
|||
assertThat(body).doesNotContain("NumberFormatException"); |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：合法主体进入原角色/归属判断（不被身份层拒绝）") |
|||
void legalPrincipal_reachesRoleLayer() throws Exception { |
|||
for (String path : allPaths()) { |
|||
int st = mockMvc.perform(get(path).with(authentication(principal("7")))) |
|||
.andReturn().getResponse().getStatus(); |
|||
assertThat(st).as("path=%s 合法主体不应 401", path).isNotEqualTo(401); |
|||
} |
|||
} |
|||
|
|||
// ── requestId ────────────────────────────────────────────
|
|||
|
|||
@Test |
|||
@DisplayName("A4：requestId 合法/空白/超长/非法字符 均与响应头同源") |
|||
void requestId_consistentAcrossInputs() throws Exception { |
|||
for (String sent : List.of("a4-legal-0001", " ", "w".repeat(80), "<script>x</script>", "a b")) { |
|||
for (String path : PATHS) { |
|||
var r = mockMvc.perform(get(path).header("X-Request-Id", sent) |
|||
.with(authentication(principal("7")))).andReturn(); |
|||
String hdr = r.getResponse().getHeader("X-Request-Id"); |
|||
assertThat(hdr).as("path=%s sent=%s", path, sent).isNotNull() |
|||
.doesNotContain("<").doesNotContain(">").doesNotContain(" ") |
|||
.doesNotContain("\r").doesNotContain("\n"); |
|||
assertThat(hdr.length()).isLessThanOrEqualTo(32); |
|||
assertThat(r.getResponse().getContentAsString()).as("path=%s", path) |
|||
.contains("\"requestId\":\"" + hdr + "\""); |
|||
} |
|||
} |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：request attribute 优先于原始 header") |
|||
void requestAttributeWins() { |
|||
var req = new org.springframework.mock.web.MockHttpServletRequest(); |
|||
req.setAttribute(com.mydreamjob.common.logging.RequestIdFilter.REQUEST_ID_ATTRIBUTE, "a4-attr-wins"); |
|||
req.addHeader("X-Request-Id", "a4-header-loses"); |
|||
assertThat(requestIdAccessor.get(req)).isEqualTo("a4-attr-wins"); |
|||
} |
|||
|
|||
@Test |
|||
@DisplayName("A4：CR/LF 不进入规范化结果（直接经 Accessor）") |
|||
void crlfNeverEntersValue() { |
|||
for (String bad : List.of("a\rb", "a\nb", "a\r\nb", "\r", "\n", "z\r\nInjected: 1")) { |
|||
var req = new org.springframework.mock.web.MockHttpServletRequest(); |
|||
req.addHeader("X-Request-Id", bad); |
|||
String v = requestIdAccessor.get(req); |
|||
assertThat(v).as("输入 %s", bad).isNotBlank().doesNotContain("\r").doesNotContain("\n"); |
|||
} |
|||
} |
|||
} |
|||
Loading…
Reference in new issue