WEXT1F 修复远端取证汇总误判

scripts/qa/run-wecom-formal-outing-overtime-evidence.sh

@@ -159,7 +159,7 @@ run_rule_validator() {
 run_privacy_smoke() {
   local sensitive_pattern='(["'\'']?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\'']?[[:space:]]*[:=][[:space:]]*["'\'']?[A-Za-z0-9._:/+=-]{8,}["'\'']?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"[^"]*(token|secret|password|encodingAESKey|encoding_aes_key|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*"[[:space:]]*:[[:space:]]*"[^"]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
   local safe_metadata_pattern='"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)([[:space:]]|["]|$)|"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)[^"]*(source|path|read paths|fallback)'
-  local safe_redacted_prefix_pattern='"[^"]*(sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*Prefixes?"[[:space:]]*:[[:space:]]*"[^"]{1,16}\*\*\*[^"]{0,8}"'
+  local safe_redacted_prefix_pattern='"[^"]*(sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*Prefix(es)?"[[:space:]]*:[[:space:]]*"[^"]{1,16}\*\*\*[^"]{0,8}"'
   local matches
   matches="$(grep -RInEi "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' | grep -vEi "$safe_metadata_pattern" | grep -vEi "$safe_redacted_prefix_pattern" || true)"
   if [[ -n "$matches" ]]; then
@@ -202,6 +202,19 @@ function child(relativePath) {
   };
 }
 
+function publicReadyReport() {
+  const file = path.join(reportDir, "public-ready.log");
+  const body = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+  return {
+    status: /"ok"\s*:\s*true/.test(body) ? "PASS" : "MISSING",
+    reportPath: fs.existsSync(file) ? path.resolve(file) : null,
+    mainBlockers: [],
+    configGaps: [],
+    templateDataGaps: [],
+    findingCount: 0,
+  };
+}
+
 function safeStatus(value) {
   return String(value || "UNKNOWN").slice(0, 120);
 }
@@ -216,9 +229,9 @@ function isFindingPass(value) {
 
 function isNoDataGap(report) {
   const reasons = [
-    ...report.configGaps.map((item) => item?.reason || item?.id),
-    ...report.mainBlockers.map((item) => item?.reason || item?.id),
-    ...report.templateDataGaps.map((item) => item?.reason || item?.id),
+    ...(Array.isArray(report.configGaps) ? report.configGaps : []).map((item) => item?.reason || item?.id),
+    ...(Array.isArray(report.mainBlockers) ? report.mainBlockers : []).map((item) => item?.reason || item?.id),
+    ...(Array.isArray(report.templateDataGaps) ? report.templateDataGaps : []).map((item) => item?.reason || item?.id),
   ].filter(Boolean).join(" ");
   return /no_wecom_approval_archive_rows|no_existing_approval_in_window|archive_history_data|approval_compensation_window_empty/i.test(reasons);
 }
@@ -229,10 +242,7 @@ try {
 } catch {}
 
 const childReports = {
-  publicReady: {
-    status: Number(statusInput || 0) === 0 ? "PASS" : "FAIL",
-    reportPath: path.resolve(path.join(reportDir, "public-ready.log")),
-  },
+  publicReady: publicReadyReport(),
   compensationArchive: child("wecom-approval-compensation-poc"),
   archiveOffline: child("wecom-approval-archive"),
   ruleValidator: child("wecom-approval-rule-validator"),