WCBK1 实现企微审批回调只读 POC

server/tests/unit/scripts/check-wecom-approval-callback-poc.test.js

@@ -0,0 +1,145 @@
+const fs = require("node:fs/promises");
+const path = require("node:path");
+
+const {
+  buildCallbackConfigCheck,
+  executeCallbackPoc,
+  parseArgs,
+  runSyntheticCheck,
+  runUrlVerificationCheck,
+} = require("../../../src/scripts/check-wecom-approval-callback-poc");
+
+const TOKEN = "callback-token";
+const AES_KEY = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG";
+const CORP_ID = "ww-callback-corp";
+const SECRET_VALUE = "secret-value-should-not-leak";
+
+function baseConfig(overrides = {}) {
+  return {
+    wecomCorpId: CORP_ID,
+    wecomApprovalCallbackUrl: "https://oa.hyinda.com/api/wecom/approval/callback",
+    wecomCallbackToken: TOKEN,
+    wecomCallbackEncodingAesKey: AES_KEY,
+    wecomApprovalCallbackEvidenceFile: path.join("/tmp", `wcbk1-script-${Date.now()}-${Math.random()}.jsonl`),
+    wecomRequestTimeoutMs: 1000,
+    ...overrides,
+  };
+}
+
+function textResponse(body, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    text: async () => body,
+  };
+}
+
+describe("check-wecom-approval-callback-poc", () => {
+  it("parses CLI options", () => {
+    const options = parseArgs([
+      "--live",
+      "--format=json",
+      "--callback-url=https://oa.hyinda.com/api/wecom/approval/callback",
+      "--report-dir=/tmp/wcbk1",
+    ]);
+
+    expect(options).toMatchObject({
+      live: true,
+      format: "json",
+      callbackUrl: "https://oa.hyinda.com/api/wecom/approval/callback",
+      reportDir: "/tmp/wcbk1",
+    });
+    expect(() => parseArgs(["--format=xml"])).toThrow(/unsupported format/);
+  });
+
+  it("classifies missing callback config as NEEDS_CONFIG", () => {
+    const check = buildCallbackConfigCheck(baseConfig({ wecomCallbackToken: "", wecomApprovalCallbackUrl: "" }), "");
+
+    expect(check.status).toBe("NEEDS_CONFIG");
+    expect(check.missing).toEqual(expect.arrayContaining([
+      "WECOM_APPROVAL_CALLBACK_URL",
+      "WECOM_CALLBACK_TOKEN",
+    ]));
+    expect(JSON.stringify(check)).not.toContain(SECRET_VALUE);
+  });
+
+  it("runs synthetic crypto check without leaking raw identifiers", () => {
+    const check = runSyntheticCheck(baseConfig());
+
+    expect(check.status).toBe("OK");
+    expect(check.summary).toMatchObject({
+      eventType: "open_approval_change",
+      approvalType: "leave",
+      statusLabel: "已通过",
+    });
+    expect(JSON.stringify(check)).not.toContain("SPWCBK1SYNTHETIC000001");
+    expect(JSON.stringify(check)).not.toContain("TPLWCBK1SYNTHETIC000001");
+  });
+
+  it("verifies live callback URL with generated echostr", async () => {
+    const fetchImpl = vi.fn(async (url) => {
+      expect(String(url)).toContain("msg_signature=");
+      expect(String(url)).not.toContain(TOKEN);
+      expect(String(url)).not.toContain(AES_KEY);
+      return textResponse("wcbk1-url-verify-ok");
+    });
+
+    const check = await runUrlVerificationCheck({
+      config: baseConfig(),
+      callbackUrl: "https://oa.hyinda.com/api/wecom/approval/callback",
+      fetchImpl,
+      timeoutMs: 1000,
+    });
+
+    expect(check).toMatchObject({
+      status: "OK",
+      matched: true,
+      callbackUrlPreview: "https://oa.hyinda.com/api/wecom/approval/callback",
+    });
+  });
+
+  it("returns PARTIAL_CALLBACK_NEEDS_CONFIG when real callback config is missing", async () => {
+    const report = await executeCallbackPoc({
+      live: false,
+      format: "json",
+    }, {
+      config: baseConfig({
+        wecomApprovalCallbackUrl: "",
+        wecomCallbackToken: "",
+        wecomCallbackEncodingAesKey: "",
+      }),
+    });
+
+    expect(report.status).toBe("PARTIAL_CALLBACK_NEEDS_CONFIG");
+    expect(report.checks.synthetic.status).toBe("OK");
+    expect(report.configGaps.map((item) => item.name)).toEqual(expect.arrayContaining([
+      "WECOM_APPROVAL_CALLBACK_URL",
+      "WECOM_CALLBACK_TOKEN",
+      "WECOM_CALLBACK_ENCODING_AES_KEY",
+    ]));
+  });
+
+  it("returns PASS_CALLBACK_EVENT_CONFIRMED when sanitized event evidence exists", async () => {
+    const config = baseConfig();
+    await fs.mkdir(path.dirname(config.wecomApprovalCallbackEvidenceFile), { recursive: true });
+    await fs.writeFile(config.wecomApprovalCallbackEvidenceFile, `${JSON.stringify({
+      recordedAt: "2026-05-19T06:00:00.000Z",
+      eventType: "open_approval_change",
+      callbackKind: "approval_status_change",
+      approvalType: "leave",
+      spStatus: "2",
+      statusLabel: "已通过",
+      spNoPrefix: "SPFULLID***",
+      templateIdPrefix: "TPLFULLI***",
+      idempotencyKey: "idem",
+    })}\n`);
+    const fetchImpl = vi.fn(async () => textResponse("wcbk1-url-verify-ok"));
+
+    const report = await executeCallbackPoc({ live: true }, { config, fetchImpl });
+
+    expect(report.status).toBe("PASS_CALLBACK_EVENT_CONFIRMED");
+    expect(report.checks.eventEvidence.eventCount).toBe(1);
+    expect(JSON.stringify(report)).not.toContain(TOKEN);
+    expect(JSON.stringify(report)).not.toContain(AES_KEY);
+  });
+});