diff --git a/scripts/qa/run-wecom-formal-outing-overtime-evidence.sh b/scripts/qa/run-wecom-formal-outing-overtime-evidence.sh index d3fa2dc3..37f046ff 100755 --- a/scripts/qa/run-wecom-formal-outing-overtime-evidence.sh +++ b/scripts/qa/run-wecom-formal-outing-overtime-evidence.sh @@ -159,7 +159,7 @@ run_rule_validator() { run_privacy_smoke() { local sensitive_pattern='(["'\'']?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\'']?[[:space:]]*[:=][[:space:]]*["'\'']?[A-Za-z0-9._:/+=-]{8,}["'\'']?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"[^"]*(token|secret|password|encodingAESKey|encoding_aes_key|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*"[[:space:]]*:[[:space:]]*"[^"]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:' local safe_metadata_pattern='"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)([[:space:]]|["]|$)|"[^"]*(secret|token)[^"]*"[[:space:]]*:[[:space:]]*"WECOM_[A-Z0-9_]*(SECRET|TOKEN)[^"]*(source|path|read paths|fallback)' - local safe_redacted_prefix_pattern='"[^"]*(sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*Prefixes?"[[:space:]]*:[[:space:]]*"[^"]{1,16}\*\*\*[^"]{0,8}"' + local safe_redacted_prefix_pattern='"[^"]*(sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId|external_user_id)[^"]*Prefix(es)?"[[:space:]]*:[[:space:]]*"[^"]{1,16}\*\*\*[^"]{0,8}"' local matches matches="$(grep -RInEi "$sensitive_pattern" "$REPORT_DIR" | grep -vE 'HRWDTEST-[0-9]{14}' | grep -vEi "$safe_metadata_pattern" | grep -vEi "$safe_redacted_prefix_pattern" || true)" if [[ -n "$matches" ]]; then @@ -202,6 +202,19 @@ function child(relativePath) { }; } +function publicReadyReport() { + const file = path.join(reportDir, "public-ready.log"); + const body = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : ""; + return { + status: /"ok"\s*:\s*true/.test(body) ? "PASS" : "MISSING", + reportPath: fs.existsSync(file) ? path.resolve(file) : null, + mainBlockers: [], + configGaps: [], + templateDataGaps: [], + findingCount: 0, + }; +} + function safeStatus(value) { return String(value || "UNKNOWN").slice(0, 120); } @@ -216,9 +229,9 @@ function isFindingPass(value) { function isNoDataGap(report) { const reasons = [ - ...report.configGaps.map((item) => item?.reason || item?.id), - ...report.mainBlockers.map((item) => item?.reason || item?.id), - ...report.templateDataGaps.map((item) => item?.reason || item?.id), + ...(Array.isArray(report.configGaps) ? report.configGaps : []).map((item) => item?.reason || item?.id), + ...(Array.isArray(report.mainBlockers) ? report.mainBlockers : []).map((item) => item?.reason || item?.id), + ...(Array.isArray(report.templateDataGaps) ? report.templateDataGaps : []).map((item) => item?.reason || item?.id), ].filter(Boolean).join(" "); return /no_wecom_approval_archive_rows|no_existing_approval_in_window|archive_history_data|approval_compensation_window_empty/i.test(reasons); } @@ -229,10 +242,7 @@ try { } catch {} const childReports = { - publicReady: { - status: Number(statusInput || 0) === 0 ? "PASS" : "FAIL", - reportPath: path.resolve(path.join(reportDir, "public-ready.log")), - }, + publicReady: publicReadyReport(), compensationArchive: child("wecom-approval-compensation-poc"), archiveOffline: child("wecom-approval-archive"), ruleValidator: child("wecom-approval-rule-validator"),