WAPC2 实现企微审批只读 POC
这个提交包含在：
@@ -0,0 +1,507 @@
|
||||
#!/usr/bin/env node
|
||||
require("dotenv/config");
|
||||
|
||||
const fs = require("node:fs");
|
||||
const path = require("node:path");
|
||||
|
||||
const { getConfig } = require("../config");
|
||||
const {
|
||||
APPROVAL_POC_TARGETS,
|
||||
fetchWecomApprovalDetail,
|
||||
fetchWecomApprovalTemplateDetail,
|
||||
maskApprovalIdentifier,
|
||||
} = require("../services/integrations/wecomApproval");
|
||||
|
||||
const DEFAULT_REPORT_ROOT = path.resolve(__dirname, "../../../artifacts/qa-flow");
|
||||
|
||||
const REPORT_PRIVACY =
|
||||
"approval type/counts/masked template and sp_no prefixes only; no phone/email/token/secret/full userid/full sp_no/form values/attachments/comments/raw payload";
|
||||
|
||||
const TEMPLATE_ENV = Object.freeze({
|
||||
leave: "WECOM_APPROVAL_LEAVE_TEMPLATE_ID",
|
||||
missed_punch: "WECOM_APPROVAL_MISSED_PUNCH_TEMPLATE_ID",
|
||||
});
|
||||
|
||||
const SP_NO_ENV = Object.freeze({
|
||||
leave: "WECOM_APPROVAL_LEAVE_TEST_SP_NO",
|
||||
missed_punch: "WECOM_APPROVAL_MISSED_PUNCH_TEST_SP_NO",
|
||||
});
|
||||
|
||||
function printHelp() {
|
||||
process.stdout.write(`Usage: node src/scripts/check-wecom-approval-poc.js [options]
|
||||
|
||||
QA-only 企业微信审批模板与低风险 sp_no 只读 POC。
|
||||
默认不写 OA/企微资料，不接真实回调，不进入审批镜像。
|
||||
|
||||
Options:
|
||||
--live 启用企微 live 只读检查。
|
||||
--format=text|json 输出格式，默认 text。
|
||||
--report-dir=<path> 报告目录，默认 artifacts/qa-flow/wecom-approval-poc-<timestamp>。
|
||||
--template=leave:<id> 指定请假模板 ID。
|
||||
--template=missed_punch:<id> 指定补卡模板 ID。
|
||||
--sp-no=leave:<sp_no> 指定请假低风险测试审批单号。
|
||||
--sp-no=missed_punch:<sp_no> 指定补卡低风险测试审批单号。
|
||||
--help 显示帮助。
|
||||
|
||||
Secret 固定规则：
|
||||
审批模板详情/审批详情：WECOM_AGENT_SECRET。
|
||||
不使用 WECOM_CONTACT_SECRET、WECOM_CHECKIN_SECRET 或 WECOM_HR_ASSISTANT_SECRET 兜底。
|
||||
|
||||
隐私边界：
|
||||
报告只输出模板类型、计数、状态、脱敏模板 ID / sp_no 前缀和错误分类。
|
||||
不输出手机号、邮箱、token、secret、完整 userid、完整 sp_no、表单值、附件、评论或企微原始 payload。
|
||||
`);
|
||||
}
|
||||
|
||||
function timestamp() {
|
||||
return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
|
||||
}
|
||||
|
||||
function toSafeString(value, maxLength = 500) {
|
||||
if (value == null) return "";
|
||||
return String(value).trim().slice(0, maxLength);
|
||||
}
|
||||
|
||||
function safeMessage(value) {
|
||||
return toSafeString(value, 500)
|
||||
.replace(/access_token=[^&\s]+/gi, "access_token=***")
|
||||
.replace(/[A-Za-z0-9_-]{24,}/g, "***")
|
||||
.slice(0, 240);
|
||||
}
|
||||
|
||||
function supportedTargetKeys() {
|
||||
return APPROVAL_POC_TARGETS.map((item) => item.key);
|
||||
}
|
||||
|
||||
function parseTargetPair(value, flagName) {
|
||||
const raw = toSafeString(value, 500);
|
||||
const separatorIndex = raw.indexOf(":");
|
||||
if (separatorIndex <= 0) {
|
||||
throw new Error(`${flagName} requires <target>:<value>`);
|
||||
}
|
||||
const target = raw.slice(0, separatorIndex).trim();
|
||||
const itemValue = raw.slice(separatorIndex + 1).trim();
|
||||
if (!supportedTargetKeys().includes(target)) {
|
||||
throw new Error(`${flagName} unsupported target: ${target}`);
|
||||
}
|
||||
if (!itemValue) {
|
||||
throw new Error(`${flagName} requires non-empty value`);
|
||||
}
|
||||
return { target, value: itemValue };
|
||||
}
|
||||
|
||||
function parseArgs(argv) {
|
||||
const options = {
|
||||
live: process.env.WECOM_APPROVAL_POC_LIVE === "1",
|
||||
format: "text",
|
||||
reportDir: process.env.WECOM_APPROVAL_POC_REPORT_DIR
|
||||
|| path.join(DEFAULT_REPORT_ROOT, `wecom-approval-poc-${timestamp()}`),
|
||||
templates: {},
|
||||
spNos: {},
|
||||
help: false,
|
||||
};
|
||||
|
||||
for (let index = 0; index < argv.length; index += 1) {
|
||||
const arg = argv[index];
|
||||
if (arg === "--help" || arg === "-h") {
|
||||
options.help = true;
|
||||
} else if (arg === "--live") {
|
||||
options.live = true;
|
||||
} else if (arg === "--no-live") {
|
||||
options.live = false;
|
||||
} else if (arg === "--format") {
|
||||
options.format = argv[index + 1] || options.format;
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--format=")) {
|
||||
options.format = arg.slice("--format=".length);
|
||||
} else if (arg === "--report-dir") {
|
||||
options.reportDir = argv[index + 1] || options.reportDir;
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--report-dir=")) {
|
||||
options.reportDir = arg.slice("--report-dir=".length);
|
||||
} else if (arg === "--template") {
|
||||
const pair = parseTargetPair(argv[index + 1], "--template");
|
||||
options.templates[pair.target] = pair.value;
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--template=")) {
|
||||
const pair = parseTargetPair(arg.slice("--template=".length), "--template");
|
||||
options.templates[pair.target] = pair.value;
|
||||
} else if (arg === "--sp-no") {
|
||||
const pair = parseTargetPair(argv[index + 1], "--sp-no");
|
||||
options.spNos[pair.target] = pair.value;
|
||||
index += 1;
|
||||
} else if (arg.startsWith("--sp-no=")) {
|
||||
const pair = parseTargetPair(arg.slice("--sp-no=".length), "--sp-no");
|
||||
options.spNos[pair.target] = pair.value;
|
||||
} else {
|
||||
throw new Error(`Unsupported argument: ${arg}`);
|
||||
}
|
||||
}
|
||||
|
||||
if (!["text", "json"].includes(options.format)) {
|
||||
throw new Error(`Unsupported --format: ${options.format}`);
|
||||
}
|
||||
return options;
|
||||
}
|
||||
|
||||
function envValue(env, name) {
|
||||
return toSafeString(env[name], 500);
|
||||
}
|
||||
|
||||
function buildInputs(options, env = process.env) {
|
||||
return APPROVAL_POC_TARGETS.map((target) => {
|
||||
const cliTemplateId = toSafeString(options.templates[target.key], 500);
|
||||
const cliSpNo = toSafeString(options.spNos[target.key], 500);
|
||||
const envTemplateId = envValue(env, TEMPLATE_ENV[target.key]);
|
||||
const envSpNo = envValue(env, SP_NO_ENV[target.key]);
|
||||
const templateId = cliTemplateId || envTemplateId;
|
||||
const spNo = cliSpNo || envSpNo;
|
||||
|
||||
return {
|
||||
key: target.key,
|
||||
label: target.label,
|
||||
templateId,
|
||||
templateIdPrefix: maskApprovalIdentifier(templateId),
|
||||
templateSource: templateId ? (cliTemplateId ? "cli" : TEMPLATE_ENV[target.key]) : null,
|
||||
templateMissingEnv: templateId ? [] : [TEMPLATE_ENV[target.key]],
|
||||
spNo,
|
||||
spNoPrefix: maskApprovalIdentifier(spNo),
|
||||
spNoSource: spNo ? (cliSpNo ? "cli" : SP_NO_ENV[target.key]) : null,
|
||||
spNoMissingEnv: spNo ? [] : [SP_NO_ENV[target.key]],
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
function buildSecretCheck(config) {
|
||||
const missing = [];
|
||||
if (!config.wecomCorpId) missing.push("WECOM_CORP_ID");
|
||||
if (!config.wecomAgentSecret) missing.push("WECOM_AGENT_SECRET");
|
||||
return {
|
||||
id: "approval_secret_matrix",
|
||||
source: "WECOM_AGENT_SECRET",
|
||||
endpoints: [
|
||||
"POST /cgi-bin/oa/gettemplatedetail",
|
||||
"POST /cgi-bin/oa/getapprovaldetail",
|
||||
],
|
||||
status: missing.length ? "BLOCKED" : "OK",
|
||||
missing,
|
||||
noFallback: [
|
||||
"WECOM_CONTACT_SECRET",
|
||||
"WECOM_CHECKIN_SECRET",
|
||||
"WECOM_HR_ASSISTANT_SECRET",
|
||||
],
|
||||
};
|
||||
}
|
||||
|
||||
function summarizeApiResult(result) {
|
||||
if (!result || typeof result !== "object") return null;
|
||||
const summary = {};
|
||||
for (const key of ["errcode", "errmsg", "fieldCount", "fieldTypeCounts", "spStatus", "applyFieldCount", "approvalNodeCount", "notifyerCount", "commentCount"]) {
|
||||
if (result[key] != null) {
|
||||
summary[key] = key === "errmsg" ? safeMessage(result[key]) : result[key];
|
||||
}
|
||||
}
|
||||
return Object.keys(summary).length ? summary : null;
|
||||
}
|
||||
|
||||
function buildMissingTemplateCheck(input) {
|
||||
return {
|
||||
id: "approval_template_detail",
|
||||
target: input.key,
|
||||
label: input.label,
|
||||
endpoint: "POST /cgi-bin/oa/gettemplatedetail",
|
||||
source: "WECOM_AGENT_SECRET",
|
||||
status: "NEEDS_CONFIG",
|
||||
missingEnv: input.templateMissingEnv,
|
||||
templateIdPrefix: null,
|
||||
summary: null,
|
||||
};
|
||||
}
|
||||
|
||||
function buildMissingApprovalCheck(input) {
|
||||
return {
|
||||
id: "approval_detail",
|
||||
target: input.key,
|
||||
label: input.label,
|
||||
endpoint: "POST /cgi-bin/oa/getapprovaldetail",
|
||||
source: "WECOM_AGENT_SECRET",
|
||||
status: "NEEDS_CONFIG",
|
||||
missingEnv: input.spNoMissingEnv,
|
||||
spNoPrefix: null,
|
||||
summary: null,
|
||||
};
|
||||
}
|
||||
|
||||
function buildDryRunTemplateCheck(input) {
|
||||
return {
|
||||
id: "approval_template_detail",
|
||||
target: input.key,
|
||||
label: input.label,
|
||||
endpoint: "POST /cgi-bin/oa/gettemplatedetail",
|
||||
source: "WECOM_AGENT_SECRET",
|
||||
status: "DRY_RUN_READY",
|
||||
templateIdPrefix: input.templateIdPrefix,
|
||||
configuredFrom: input.templateSource,
|
||||
summary: null,
|
||||
};
|
||||
}
|
||||
|
||||
function buildDryRunApprovalCheck(input) {
|
||||
return {
|
||||
id: "approval_detail",
|
||||
target: input.key,
|
||||
label: input.label,
|
||||
endpoint: "POST /cgi-bin/oa/getapprovaldetail",
|
||||
source: "WECOM_AGENT_SECRET",
|
||||
status: "DRY_RUN_READY",
|
||||
spNoPrefix: input.spNoPrefix,
|
||||
configuredFrom: input.spNoSource,
|
||||
summary: null,
|
||||
};
|
||||
}
|
||||
|
||||
function buildLiveTemplateCheck(input, result) {
|
||||
return {
|
||||
id: "approval_template_detail",
|
||||
target: input.key,
|
||||
label: input.label,
|
||||
endpoint: "POST /cgi-bin/oa/gettemplatedetail",
|
||||
source: result.tokenSource || "WECOM_AGENT_SECRET",
|
||||
status: result.ok ? "OK" : "BLOCKED",
|
||||
reason: result.ok ? null : result.code,
|
||||
message: result.message ? safeMessage(result.message) : null,
|
||||
templateIdPrefix: input.templateIdPrefix,
|
||||
configuredFrom: input.templateSource,
|
||||
summary: result.summary,
|
||||
response: summarizeApiResult(result.response),
|
||||
};
|
||||
}
|
||||
|
||||
function buildLiveApprovalCheck(input, result) {
|
||||
return {
|
||||
id: "approval_detail",
|
||||
target: input.key,
|
||||
label: input.label,
|
||||
endpoint: "POST /cgi-bin/oa/getapprovaldetail",
|
||||
source: result.tokenSource || "WECOM_AGENT_SECRET",
|
||||
status: result.ok ? "OK" : "BLOCKED",
|
||||
reason: result.ok ? null : result.code,
|
||||
message: result.message ? safeMessage(result.message) : null,
|
||||
spNoPrefix: input.spNoPrefix,
|
||||
configuredFrom: input.spNoSource,
|
||||
summary: result.summary,
|
||||
response: summarizeApiResult(result.response),
|
||||
};
|
||||
}
|
||||
|
||||
async function runTargetChecks({
|
||||
config,
|
||||
input,
|
||||
options,
|
||||
fetchTemplateDetailImpl = fetchWecomApprovalTemplateDetail,
|
||||
fetchApprovalDetailImpl = fetchWecomApprovalDetail,
|
||||
}) {
|
||||
let template = null;
|
||||
let approval = null;
|
||||
|
||||
if (!input.templateId) {
|
||||
template = buildMissingTemplateCheck(input);
|
||||
} else if (!options.live) {
|
||||
template = buildDryRunTemplateCheck(input);
|
||||
} else {
|
||||
template = buildLiveTemplateCheck(input, await fetchTemplateDetailImpl({
|
||||
config,
|
||||
templateId: input.templateId,
|
||||
}));
|
||||
}
|
||||
|
||||
if (!input.spNo) {
|
||||
approval = buildMissingApprovalCheck(input);
|
||||
} else if (!options.live) {
|
||||
approval = buildDryRunApprovalCheck(input);
|
||||
} else {
|
||||
approval = buildLiveApprovalCheck(input, await fetchApprovalDetailImpl({
|
||||
config,
|
||||
spNo: input.spNo,
|
||||
}));
|
||||
}
|
||||
|
||||
return { target: input.key, label: input.label, template, approval };
|
||||
}
|
||||
|
||||
function collectConfigGaps(targetChecks) {
|
||||
const gaps = [];
|
||||
for (const item of targetChecks) {
|
||||
for (const check of [item.template, item.approval]) {
|
||||
if (check?.status === "NEEDS_CONFIG") {
|
||||
gaps.push({
|
||||
id: check.id,
|
||||
target: check.target,
|
||||
status: check.status,
|
||||
missingEnv: check.missingEnv || [],
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
return gaps;
|
||||
}
|
||||
|
||||
function collectMainBlockers(secretCheck, targetChecks) {
|
||||
const blockers = [];
|
||||
if (secretCheck.status === "BLOCKED") {
|
||||
blockers.push({
|
||||
id: secretCheck.id,
|
||||
reason: "missing_required_wecom_approval_config",
|
||||
missing: secretCheck.missing,
|
||||
});
|
||||
}
|
||||
|
||||
for (const item of targetChecks) {
|
||||
for (const check of [item.template, item.approval]) {
|
||||
if (check?.status === "BLOCKED") {
|
||||
blockers.push({
|
||||
id: check.id,
|
||||
target: check.target,
|
||||
reason: check.reason || "wecom_approval_api_blocked",
|
||||
missing: [],
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
return blockers;
|
||||
}
|
||||
|
||||
function evaluateConclusion({ mainBlockers, configGaps, verificationGaps }) {
|
||||
if (mainBlockers.length) {
|
||||
return {
|
||||
status: "SKIP",
|
||||
conclusion: "BLOCKED_BY_EXTERNAL_CONFIG",
|
||||
};
|
||||
}
|
||||
if (configGaps.length || verificationGaps.length) {
|
||||
return {
|
||||
status: "PARTIAL_APPROVAL_POC_NEEDS_CONFIG",
|
||||
conclusion: "PARTIAL_APPROVAL_POC_NEEDS_CONFIG",
|
||||
};
|
||||
}
|
||||
return {
|
||||
status: "PASS_APPROVAL_POC",
|
||||
conclusion: "PASS_APPROVAL_POC",
|
||||
};
|
||||
}
|
||||
|
||||
async function executeApprovalPoc(options, deps = {}) {
|
||||
const env = deps.env || process.env;
|
||||
const generatedAt = deps.generatedAt || new Date().toISOString();
|
||||
const config = deps.config || getConfig();
|
||||
const inputs = buildInputs(options, env);
|
||||
const secretCheck = buildSecretCheck(config);
|
||||
const targetChecks = [];
|
||||
|
||||
for (const input of inputs) {
|
||||
targetChecks.push(await runTargetChecks({
|
||||
config,
|
||||
input,
|
||||
options,
|
||||
fetchTemplateDetailImpl: deps.fetchTemplateDetailImpl,
|
||||
fetchApprovalDetailImpl: deps.fetchApprovalDetailImpl,
|
||||
}));
|
||||
}
|
||||
|
||||
const configGaps = collectConfigGaps(targetChecks);
|
||||
const verificationGaps = options.live ? [] : [{
|
||||
id: "live_read",
|
||||
status: "DRY_RUN",
|
||||
reason: "run_with_--live_for_public_readonly_gate",
|
||||
}];
|
||||
const mainBlockers = collectMainBlockers(secretCheck, targetChecks);
|
||||
const conclusion = evaluateConclusion({ mainBlockers, configGaps, verificationGaps });
|
||||
|
||||
return {
|
||||
mode: "qa_only",
|
||||
generatedAt,
|
||||
status: conclusion.status,
|
||||
conclusion: conclusion.conclusion,
|
||||
privacy: REPORT_PRIVACY,
|
||||
scope: {
|
||||
targets: APPROVAL_POC_TARGETS.map((item) => item.key),
|
||||
writeBehavior: "no OA writes, no WeCom writes, no approval callbacks, no mirror import",
|
||||
liveRead: Boolean(options.live),
|
||||
deepMirror: "not_started",
|
||||
},
|
||||
inputs: {
|
||||
templates: Object.fromEntries(inputs.map((item) => [item.key, {
|
||||
configured: Boolean(item.templateId),
|
||||
configuredFrom: item.templateSource,
|
||||
templateIdPrefix: item.templateIdPrefix,
|
||||
}])),
|
||||
spNos: Object.fromEntries(inputs.map((item) => [item.key, {
|
||||
configured: Boolean(item.spNo),
|
||||
configuredFrom: item.spNoSource,
|
||||
spNoPrefix: item.spNoPrefix,
|
||||
}])),
|
||||
},
|
||||
checks: {
|
||||
secretMatrix: secretCheck,
|
||||
targets: targetChecks,
|
||||
},
|
||||
configGaps,
|
||||
verificationGaps,
|
||||
mainBlockers,
|
||||
};
|
||||
}
|
||||
|
||||
function ensureReportDir(reportDir) {
|
||||
fs.mkdirSync(reportDir, { recursive: true });
|
||||
}
|
||||
|
||||
function writeReport(reportDir, report) {
|
||||
ensureReportDir(reportDir);
|
||||
const filePath = path.join(reportDir, "summary.json");
|
||||
fs.writeFileSync(filePath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
|
||||
return filePath;
|
||||
}
|
||||
|
||||
function printText(report, reportPath) {
|
||||
process.stdout.write(`[wecom-approval-poc] status=${report.status} conclusion=${report.conclusion}\n`);
|
||||
process.stdout.write(`[wecom-approval-poc] report=${reportPath}\n`);
|
||||
process.stdout.write(`[wecom-approval-poc] privacy=${report.privacy}\n`);
|
||||
process.stdout.write(`[wecom-approval-poc] liveRead=${report.scope.liveRead} targets=${report.scope.targets.join(",")}\n`);
|
||||
if (report.configGaps?.length) {
|
||||
process.stdout.write(`[wecom-approval-poc] configGaps=${JSON.stringify(report.configGaps)}\n`);
|
||||
}
|
||||
if (report.mainBlockers?.length) {
|
||||
process.stdout.write(`[wecom-approval-poc] mainBlockers=${JSON.stringify(report.mainBlockers)}\n`);
|
||||
}
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const options = parseArgs(process.argv.slice(2));
|
||||
if (options.help) {
|
||||
printHelp();
|
||||
return;
|
||||
}
|
||||
const report = await executeApprovalPoc(options);
|
||||
const reportPath = writeReport(options.reportDir, report);
|
||||
if (options.format === "json") {
|
||||
process.stdout.write(`${JSON.stringify({ ...report, reportPath }, null, 2)}\n`);
|
||||
} else {
|
||||
printText(report, reportPath);
|
||||
}
|
||||
}
|
||||
|
||||
if (require.main === module) {
|
||||
main().catch((error) => {
|
||||
process.stderr.write(`[wecom-approval-poc][FAIL] ${safeMessage(error?.message || error)}\n`);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
buildInputs,
|
||||
buildSecretCheck,
|
||||
evaluateConclusion,
|
||||
executeApprovalPoc,
|
||||
parseArgs,
|
||||
summarizeApiResult,
|
||||
};
|
||||
在新工单中引用
屏蔽一个用户