577 行
21 KiB
Bash
可执行文件
577 行
21 KiB
Bash
可执行文件
#!/usr/bin/env bash
|
|
set -u -o pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
CLIENT_DIR="$ROOT_DIR/client"
|
|
PUBLIC_BASE_URL="${LIVE_SMOKE_BASE_URL:-https://oa.hyinda.com}"
|
|
REPORT_DIR="${OAOPS1_REPORT_DIR:-$ROOT_DIR/artifacts/qa-flow/oa-real-use-daily-$(date +%Y%m%d-%H%M%S)}"
|
|
SUMMARY_TXT="$REPORT_DIR/summary.txt"
|
|
STATUS=0
|
|
FINDING_COUNT=0
|
|
|
|
mkdir -p "$REPORT_DIR"
|
|
: >"$SUMMARY_TXT"
|
|
|
|
log() {
|
|
printf '%s\n' "$*" | tee -a "$SUMMARY_TXT"
|
|
}
|
|
|
|
write_step_json() {
|
|
local name="$1"
|
|
local status="$2"
|
|
local kind="$3"
|
|
local code="${4:-0}"
|
|
local detail="${5:-}"
|
|
node - "$ROOT_DIR" "$REPORT_DIR" "$name" "$status" "$kind" "$code" "$detail" <<'NODE' || true
|
|
const fs = require("node:fs");
|
|
const path = require("node:path");
|
|
const [rootDir, reportDir, name, status, kind, code, detail] = process.argv.slice(2);
|
|
|
|
function reportRef(file) {
|
|
const absolute = path.resolve(file);
|
|
const relative = path.relative(rootDir, absolute);
|
|
if (relative && !relative.startsWith("..") && !path.isAbsolute(relative)) {
|
|
return relative;
|
|
}
|
|
return path.basename(absolute);
|
|
}
|
|
|
|
fs.writeFileSync(path.join(reportDir, `${name}.step.json`), `${JSON.stringify({
|
|
name,
|
|
status,
|
|
kind,
|
|
code: Number(code || 0),
|
|
detail: String(detail || "").slice(0, 600),
|
|
logRef: reportRef(path.join(reportDir, `${name}.log`)),
|
|
checkedAt: new Date().toISOString(),
|
|
}, null, 2)}\n`, "utf8");
|
|
NODE
|
|
}
|
|
|
|
run_step() {
|
|
local name="$1"
|
|
shift
|
|
local log_file="$REPORT_DIR/${name}.log"
|
|
|
|
log ">>> [oaops1] $name"
|
|
if "$@" > >(tee "$log_file") 2>&1; then
|
|
log "[oaops1][PASS] $name"
|
|
write_step_json "$name" "PASS" "required" 0 "ok"
|
|
else
|
|
local code="$?"
|
|
log "[oaops1][FAIL] $name exit=$code"
|
|
STATUS=1
|
|
write_step_json "$name" "FAIL" "required" "$code" "required step failed"
|
|
fi
|
|
}
|
|
|
|
run_finding_step() {
|
|
local name="$1"
|
|
shift
|
|
local log_file="$REPORT_DIR/${name}.log"
|
|
|
|
log ">>> [oaops1] $name"
|
|
if "$@" > >(tee "$log_file") 2>&1; then
|
|
log "[oaops1][PASS] $name"
|
|
write_step_json "$name" "PASS" "finding_allowed" 0 "ok"
|
|
else
|
|
local code="$?"
|
|
log "[oaops1][FINDING] $name exit=$code"
|
|
FINDING_COUNT=$((FINDING_COUNT + 1))
|
|
write_step_json "$name" "FINDING" "finding_allowed" "$code" "finding or missing runtime credential"
|
|
fi
|
|
}
|
|
|
|
run_client_finding_step() {
|
|
local name="$1"
|
|
shift
|
|
local log_file="$REPORT_DIR/${name}.log"
|
|
|
|
log ">>> [oaops1] $name"
|
|
if (cd "$CLIENT_DIR" && env "$@") > >(tee "$log_file") 2>&1; then
|
|
log "[oaops1][PASS] $name"
|
|
write_step_json "$name" "PASS" "finding_allowed" 0 "ok"
|
|
else
|
|
local code="$?"
|
|
log "[oaops1][FINDING] $name exit=$code"
|
|
FINDING_COUNT=$((FINDING_COUNT + 1))
|
|
write_step_json "$name" "FINDING" "finding_allowed" "$code" "finding or missing runtime credential"
|
|
fi
|
|
}
|
|
|
|
run_client_spec_if_present() {
|
|
local name="$1"
|
|
local spec="$2"
|
|
shift 2
|
|
|
|
if [[ ! -f "$CLIENT_DIR/$spec" ]]; then
|
|
log "[oaops1][FINDING] $name missing client spec: $spec"
|
|
FINDING_COUNT=$((FINDING_COUNT + 1))
|
|
write_step_json "$name" "FINDING" "finding_allowed" 0 "client spec missing: $spec"
|
|
return 0
|
|
fi
|
|
|
|
local cooldown="${OAOPS1_E2E_COOLDOWN_SECONDS:-2}"
|
|
if [[ "$cooldown" =~ ^[0-9]+$ && "$cooldown" -gt 0 ]]; then
|
|
sleep "$cooldown"
|
|
fi
|
|
run_client_finding_step "$name" "$@" npx playwright test "$spec" --workers=1 --reporter=list
|
|
}
|
|
|
|
cooldown_login_step() {
|
|
local reason="$1"
|
|
local cooldown="${OAOPS1_LOGIN_STEP_COOLDOWN_SECONDS:-65}"
|
|
if [[ "$cooldown" =~ ^[0-9]+$ && "$cooldown" -gt 0 ]]; then
|
|
log "[oaops1] login cooldown ${cooldown}s before ${reason}"
|
|
sleep "$cooldown"
|
|
fi
|
|
}
|
|
|
|
load_default_env() {
|
|
local env_file="${OAOPS1_ENV_FILE:-$HOME/.hyb-oa/live-smoke.env}"
|
|
if [[ "${OAOPS1_SKIP_ENV_FILE:-0}" == "1" || ! -f "$env_file" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
source "$env_file"
|
|
set +a
|
|
PUBLIC_BASE_URL="${LIVE_SMOKE_BASE_URL:-$PUBLIC_BASE_URL}"
|
|
log "[oaops1] loaded masked live smoke env file"
|
|
}
|
|
|
|
run_ready_and_runtime() {
|
|
run_step "public-ready" curl -fsS "$PUBLIC_BASE_URL/ready"
|
|
run_finding_step "live-smoke-env" env LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" node "$ROOT_DIR/scripts/qa/check-live-smoke-env.mjs" --json
|
|
run_finding_step "live-readiness" env QA_ISSUE_ID=OAOPS1 LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" LIVE_SMOKE_READINESS_DIR="$REPORT_DIR/live-smoke-readiness" bash "$ROOT_DIR/scripts/qa/run-live-smoke-readiness.sh"
|
|
run_finding_step "oa-only-smoke-readiness" env LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" OA_ONLY_SMOKE_READINESS_REPORT_DIR="$REPORT_DIR/oa-only-smoke-readiness" node "$ROOT_DIR/scripts/qa/check-oa-only-smoke-readiness.mjs"
|
|
cooldown_login_step "live-feature-flags"
|
|
run_finding_step "live-feature-flags" env LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" node "$ROOT_DIR/scripts/qa/check-live-feature-flags.mjs" \
|
|
--expect payment_batch_v1=force_on \
|
|
--expect erp_sync=force_off \
|
|
--expect attendance_v1=disabled \
|
|
--expect attendance_unified_v1=enabled \
|
|
--json
|
|
}
|
|
|
|
run_authenticated_readonly_probe() {
|
|
node - "$PUBLIC_BASE_URL" "$REPORT_DIR" <<'NODE'
|
|
const fs = require("node:fs");
|
|
const path = require("node:path");
|
|
|
|
const [baseUrlRaw, reportDir] = process.argv.slice(2);
|
|
const baseUrl = String(baseUrlRaw || "https://oa.hyinda.com").replace(/\/$/, "");
|
|
|
|
const credentials = {
|
|
admin: {
|
|
identifier: process.env.LIVE_SMOKE_ADMIN_IDENTIFIER?.trim(),
|
|
password: process.env.LIVE_SMOKE_ADMIN_PASSWORD?.trim(),
|
|
},
|
|
};
|
|
|
|
const probes = [
|
|
{ id: "portal", role: "admin", path: "/api/portal/home", domain: "portal" },
|
|
{ id: "workflow-tasks", role: "admin", path: "/api/workflow/tasks?page=1&pageSize=5", domain: "approval" },
|
|
{ id: "reimbursements", role: "admin", path: "/api/reimbursements?page=1&pageSize=5", domain: "reimbursement" },
|
|
{ id: "reimbursement-summary", role: "admin", path: "/api/reimbursements/stats/summary", domain: "reimbursement" },
|
|
{ id: "invoice-pool", role: "admin", path: "/api/invoice-pool?page=1&pageSize=5", domain: "invoice_ocr" },
|
|
{ id: "purchase-requests", role: "admin", path: "/api/purchase-requests?page=1&pageSize=5", domain: "procurement" },
|
|
{ id: "contracts-registry", role: "admin", path: "/api/contracts-registry", domain: "contracts" },
|
|
{ id: "projects", role: "admin", path: "/api/projects?page=1&pageSize=5", domain: "projects" },
|
|
{ id: "audit-logs", role: "admin", path: "/api/audit-logs?page=1&pageSize=5", domain: "audit" },
|
|
];
|
|
|
|
function maskIdentifier(value) {
|
|
if (!value) return null;
|
|
const text = String(value);
|
|
if (text.length <= 4) return "***";
|
|
return `${text.slice(0, 2)}***${text.slice(-2)}`;
|
|
}
|
|
|
|
async function fetchJson(url, init = {}) {
|
|
const response = await fetch(url, {
|
|
...init,
|
|
signal: AbortSignal.timeout(20_000),
|
|
});
|
|
const text = await response.text();
|
|
let json = null;
|
|
try {
|
|
json = text ? JSON.parse(text) : null;
|
|
} catch {
|
|
json = null;
|
|
}
|
|
return { ok: response.ok, status: response.status, json, text: text.slice(0, 200) };
|
|
}
|
|
|
|
function summarizePayload(json) {
|
|
const data = json?.data;
|
|
if (Array.isArray(data)) return { itemCount: data.length };
|
|
if (Array.isArray(data?.items)) return { itemCount: data.items.length, total: data.total ?? null };
|
|
if (typeof data === "object" && data) {
|
|
const summary = {};
|
|
for (const [key, value] of Object.entries(data)) {
|
|
if (/token|secret|password|phone|email|payload|attachment|comment|form|amount|money|price|cost|balance|bank|receipt|account|invoice|tax|fee|paid|payment/i.test(key)) continue;
|
|
if (typeof value === "number" && /(count|total|size|days|pending|open|closed|passed|failed)$/i.test(key)) {
|
|
summary[key] = value;
|
|
}
|
|
if (typeof value === "boolean" && /^(enabled|disabled|ready|ok|healthy|configured|available|has[A-Z]|is[A-Z]|can[A-Z])/i.test(key)) {
|
|
summary[key] = value;
|
|
}
|
|
if (typeof value === "string" && /^(status|mode|conclusion)$/i.test(key) && /^[a-z0-9_/-]{1,60}$/i.test(value)) {
|
|
summary[key] = value;
|
|
}
|
|
}
|
|
return summary;
|
|
}
|
|
return {};
|
|
}
|
|
|
|
async function login(role) {
|
|
const credential = credentials[role];
|
|
if (!credential?.identifier || !credential?.password) {
|
|
return { status: "SKIP", reason: `missing_${role}_credentials` };
|
|
}
|
|
const result = await fetchJson(`${baseUrl}/api/auth/login`, {
|
|
method: "POST",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
"x-device-fingerprint": `oaops1-${role}-readonly`,
|
|
},
|
|
body: JSON.stringify({
|
|
identifier: credential.identifier,
|
|
password: credential.password,
|
|
}),
|
|
});
|
|
const accessToken = result.json?.data?.accessToken;
|
|
if (!result.ok || typeof accessToken !== "string" || !accessToken) {
|
|
return {
|
|
status: "FAIL",
|
|
reason: `login_http_${result.status}`,
|
|
code: result.json?.error?.code ?? null,
|
|
};
|
|
}
|
|
return {
|
|
status: "PASS",
|
|
accessToken,
|
|
maskedIdentifier: maskIdentifier(credential.identifier),
|
|
};
|
|
}
|
|
|
|
async function main() {
|
|
const roles = {};
|
|
for (const role of Object.keys(credentials)) {
|
|
roles[role] = await login(role);
|
|
}
|
|
|
|
const checks = [];
|
|
for (const probe of probes) {
|
|
const roleState = roles[probe.role];
|
|
if (roleState.status !== "PASS") {
|
|
checks.push({
|
|
...probe,
|
|
status: "SKIP",
|
|
reason: roleState.reason || `${probe.role}_login_not_available`,
|
|
});
|
|
continue;
|
|
}
|
|
const result = await fetchJson(`${baseUrl}${probe.path}`, {
|
|
headers: {
|
|
accept: "application/json",
|
|
authorization: `Bearer ${roleState.accessToken}`,
|
|
},
|
|
});
|
|
checks.push({
|
|
...probe,
|
|
status: result.ok ? "PASS" : "FAIL",
|
|
httpStatus: result.status,
|
|
summary: result.ok ? summarizePayload(result.json) : {
|
|
code: result.json?.error?.code ?? null,
|
|
message: typeof result.json?.error?.message === "string" ? result.json.error.message.slice(0, 100) : null,
|
|
},
|
|
});
|
|
}
|
|
|
|
const blocking = checks.filter((item) => item.status === "FAIL");
|
|
const skipped = checks.filter((item) => item.status === "SKIP");
|
|
const status = blocking.length ? "FAIL" : skipped.length ? "PASS_WITH_FINDINGS" : "PASS";
|
|
const summary = {
|
|
mode: "oaops1-authenticated-readonly-probe",
|
|
status,
|
|
baseUrl,
|
|
checkedAt: new Date().toISOString(),
|
|
readOnly: true,
|
|
duplicateRoleChecks: "employee/finance/payment/AP are covered by oa-only-smoke-readiness to avoid repeated login throttling",
|
|
roles: Object.fromEntries(Object.entries(roles).map(([role, state]) => [role, {
|
|
status: state.status,
|
|
reason: state.reason || null,
|
|
maskedIdentifier: state.maskedIdentifier || null,
|
|
}])),
|
|
checks,
|
|
boundaries: {
|
|
noBusinessWrites: true,
|
|
noExportsByDefault: true,
|
|
noFileUploads: true,
|
|
noWeComWrites: true,
|
|
noRealPaymentExecution: true,
|
|
},
|
|
};
|
|
fs.writeFileSync(path.join(reportDir, "authenticated-readonly-probe.json"), `${JSON.stringify(summary, null, 2)}\n`, "utf8");
|
|
console.log(JSON.stringify(summary, null, 2));
|
|
if (blocking.length) process.exit(1);
|
|
}
|
|
|
|
main().catch((error) => {
|
|
console.error(`[oaops1-probe][ERROR] ${error instanceof Error ? error.message : String(error)}`);
|
|
process.exit(1);
|
|
});
|
|
NODE
|
|
}
|
|
|
|
run_mobile_and_entry_matrix() {
|
|
run_client_spec_if_present "mobile-entry-matrix" "tests/e2e/r124-mobile-entry-matrix.spec.ts" E2E_BASE_URL="$PUBLIC_BASE_URL"
|
|
run_client_spec_if_present "wecom-rendering-matrix" "tests/e2e/r6-wecom-mobile-rendering-hardening.spec.ts" E2E_BASE_URL="$PUBLIC_BASE_URL"
|
|
run_client_spec_if_present "wecom-entry" "tests/e2e/wecom-entry.spec.ts" E2E_BASE_URL="$PUBLIC_BASE_URL"
|
|
}
|
|
|
|
write_manual_checklist() {
|
|
cat >"$REPORT_DIR/manual-gates.md" <<'EOF'
|
|
# OAOPS1 每日人工收口清单
|
|
|
|
## 员工
|
|
- 真实报销：上传 PDF 发票，补充必要附件，提交 OA 审批。
|
|
- 采购/费用：在 OA 创建申请，关联项目；如涉及合同，关联或补录合同台账。
|
|
- 合同：只录入合同摘要、编号、负责人、项目、金额、线下归档位置；涉密合同正文、敏感报价和成本细节不上传公网 OA。
|
|
|
|
## 审批人
|
|
- 从 OA 待办进入详情，确认报销、采购、合同或项目上下文后再审批。
|
|
- 退回时写清需要补充的材料，避免线下口头说明替代系统记录。
|
|
|
|
## 出纳/财务
|
|
- 审批通过后创建付款批次，线下银行渠道付款。
|
|
- 上传银行回单附件后再在 OA 标记已付款。
|
|
- 每日抽查 AP 台账、报销导出、票据状态和付款批次状态。
|
|
|
|
## 管理员
|
|
- 查看本报告 summary.json 和人工问题登记。
|
|
- 阻断项当天建修复 Issue CSV 或暂停对应流程；非阻断体验问题进入反馈池。
|
|
- 确认 payment_batch_v1=force_on，erp_sync=force_off；图片 OCR、预算、ERP、银行流水导入、真实支付直连继续冻结。
|
|
EOF
|
|
}
|
|
|
|
run_privacy_smoke() {
|
|
local sensitive_pattern='(["'\''"]?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\''"]?[[:space:]]*[:=][[:space:]]*["'\''"]?[A-Za-z0-9._:/+=-]{8,}["'\''"]?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
|
|
local matches
|
|
matches="$(grep -RInE "$sensitive_pattern" "$REPORT_DIR" || true)"
|
|
if [[ -n "$matches" ]]; then
|
|
while IFS= read -r line; do
|
|
local match_file="${line%%:*}"
|
|
local rest="${line#*:}"
|
|
local match_line="${rest%%:*}"
|
|
local match_ref="${match_file#$ROOT_DIR/}"
|
|
printf '%s:%s:REDACTED\n' "$match_ref" "$match_line"
|
|
done <<<"$matches" >"$REPORT_DIR/privacy-findings.txt"
|
|
log "[oaops1][FAIL] report-privacy-smoke matched sensitive pattern"
|
|
STATUS=1
|
|
write_step_json "report-privacy-smoke" "FAIL" "required" 1 "sensitive pattern matched; see privacy-findings.txt"
|
|
else
|
|
log "[oaops1][PASS] report-privacy-smoke"
|
|
write_step_json "report-privacy-smoke" "PASS" "required" 0 "ok"
|
|
fi
|
|
}
|
|
|
|
write_summary_json() {
|
|
node - "$ROOT_DIR" "$REPORT_DIR" "$PUBLIC_BASE_URL" "$STATUS" "$FINDING_COUNT" <<'NODE' || return 1
|
|
const fs = require("node:fs");
|
|
const path = require("node:path");
|
|
const { execSync } = require("node:child_process");
|
|
|
|
const [rootDir, reportDir, baseURL, statusInput, findingCountInput] = process.argv.slice(2);
|
|
|
|
function readJson(file) {
|
|
if (!file || !fs.existsSync(file)) return null;
|
|
try {
|
|
return JSON.parse(fs.readFileSync(file, "utf8"));
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function reportRef(file) {
|
|
const absolute = path.resolve(file);
|
|
const relative = path.relative(rootDir, absolute);
|
|
if (relative && !relative.startsWith("..") && !path.isAbsolute(relative)) {
|
|
return relative;
|
|
}
|
|
return path.basename(absolute);
|
|
}
|
|
|
|
function step(name) {
|
|
return readJson(path.join(reportDir, `${name}.step.json`)) || {
|
|
name,
|
|
status: "MISSING",
|
|
kind: "unknown",
|
|
logRef: reportRef(path.join(reportDir, `${name}.log`)),
|
|
};
|
|
}
|
|
|
|
function child(relativePath) {
|
|
const file = path.join(reportDir, relativePath, "summary.json");
|
|
const json = readJson(file);
|
|
const findingCount = Number(json?.findingCount ?? json?.findings?.length ?? json?.gates?.findings?.length ?? 0);
|
|
return {
|
|
status: json?.status || json?.conclusion || "MISSING",
|
|
reportRef: fs.existsSync(file) ? reportRef(file) : null,
|
|
findingCount: Number.isFinite(findingCount) ? findingCount : 0,
|
|
openCount: Number(json?.gates?.openCount ?? 0),
|
|
};
|
|
}
|
|
|
|
let commit = "unknown";
|
|
try {
|
|
commit = execSync("git rev-parse --short HEAD", { cwd: rootDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
|
|
} catch {}
|
|
|
|
const stepNames = [
|
|
"public-ready",
|
|
"live-smoke-env",
|
|
"live-readiness",
|
|
"oa-only-smoke-readiness",
|
|
"live-feature-flags",
|
|
"authenticated-readonly-probe",
|
|
"mobile-entry-matrix",
|
|
"wecom-rendering-matrix",
|
|
"wecom-entry",
|
|
"report-privacy-smoke",
|
|
];
|
|
const steps = Object.fromEntries(stepNames.map((name) => [name, step(name)]));
|
|
const readonlyProbe = readJson(path.join(reportDir, "authenticated-readonly-probe.json"));
|
|
const childReports = {
|
|
liveReadiness: child("live-smoke-readiness"),
|
|
oaOnlySmokeReadiness: child("oa-only-smoke-readiness"),
|
|
};
|
|
|
|
const findings = [];
|
|
for (const [name, item] of Object.entries(steps)) {
|
|
const status = String(item.status || "UNKNOWN");
|
|
if (status === "PASS") continue;
|
|
if (status === "FINDING") {
|
|
findings.push({ source: name, status, severity: "finding" });
|
|
} else if (/FAIL|ERROR|BLOCKED/i.test(status)) {
|
|
findings.push({ source: name, status, severity: item.kind === "required" ? "blocker" : "finding" });
|
|
} else if (/SKIP|MISSING|PAUSED|PARTIAL/i.test(status)) {
|
|
findings.push({ source: name, status, severity: "manual_or_config" });
|
|
}
|
|
}
|
|
if (readonlyProbe?.status && readonlyProbe.status !== "PASS") {
|
|
findings.push({ source: "authenticated-readonly-probe", status: readonlyProbe.status, severity: readonlyProbe.status === "FAIL" ? "finding" : "manual_or_config" });
|
|
}
|
|
for (const [name, item] of Object.entries(childReports)) {
|
|
const status = String(item.status || "UNKNOWN");
|
|
if (status === "PASS" && item.findingCount <= 0 && item.openCount <= 0) continue;
|
|
if (/BLOCKED|FAIL|ERROR/i.test(status)) {
|
|
findings.push({ source: `child:${name}`, status, severity: "finding", reportRef: item.reportRef });
|
|
} else if (/FINDING/i.test(status) || item.findingCount > 0) {
|
|
findings.push({ source: `child:${name}`, status, severity: "finding", findingCount: item.findingCount, reportRef: item.reportRef });
|
|
} else if (/SKIP|MISSING|PAUSED|PARTIAL/i.test(status) || item.openCount > 0) {
|
|
findings.push({ source: `child:${name}`, status, severity: "manual_or_config", openCount: item.openCount, reportRef: item.reportRef });
|
|
}
|
|
}
|
|
|
|
let status = "PASS_OA_REAL_USE_DAILY_READY";
|
|
if (Number(statusInput || 0) !== 0 || findings.some((item) => item.severity === "blocker")) {
|
|
status = "SKIP/BLOCKED_BY_EXTERNAL_CONFIG";
|
|
} else if (findings.length || Number(findingCountInput || 0) > 0) {
|
|
status = "PASS_WITH_FINDINGS";
|
|
}
|
|
|
|
const summary = {
|
|
issueId: "OAOPS1",
|
|
mode: "oa-real-use-daily",
|
|
status,
|
|
conclusion: status,
|
|
baseURL,
|
|
commit,
|
|
checkedAt: new Date().toISOString(),
|
|
reportRef: reportRef(reportDir),
|
|
window: {
|
|
durationDays: 7,
|
|
scope: "small-team-all-employees",
|
|
realBusinessDataAllowed: true,
|
|
fixPolicy: "blocking_same_day_issue_contract_nonblocking_feedback_pool",
|
|
},
|
|
oaPrimaryDomains: [
|
|
"reimbursement_pdf_ocr",
|
|
"approval_tasks",
|
|
"procurement_expense",
|
|
"contracts_registry",
|
|
"projects",
|
|
"payment_batches",
|
|
"bank_receipt_attachments",
|
|
"ap_accounting_handoff",
|
|
"mobile_wecom_entry",
|
|
"audit",
|
|
],
|
|
frozenItems: [
|
|
"image_ocr",
|
|
"complex_bpm",
|
|
"budget_control",
|
|
"erp_write",
|
|
"bank_statement_import",
|
|
"real_payment_provider",
|
|
"wecom_hr_deep_mirror",
|
|
"emergency_takeover",
|
|
"recovery_writeback",
|
|
"ruleops",
|
|
],
|
|
boundaries: {
|
|
defaultReadOnlyAutomation: true,
|
|
manualRealBusinessWritesOnly: true,
|
|
paymentBatchExpected: "force_on",
|
|
erpExpected: "force_off",
|
|
actualPaymentChannel: "offline_bank_channel",
|
|
contractSensitiveFiles: "do_not_upload_confidential_body_sensitive_quote_cost_detail_to_public_oa",
|
|
},
|
|
childReports,
|
|
steps,
|
|
readonlyProbe,
|
|
findingCount: findings.length,
|
|
findings,
|
|
manualGates: {
|
|
dailyCloseout: "管理员每日查看 summary.json 和 manual-gates.md，阻断即修，非阻断入反馈池。",
|
|
day7Closeout: [
|
|
"A：接受 PASS_OA_REAL_USE_READY，进入下一轮体验/效率优化。",
|
|
"B：接受 PASS_WITH_FINDINGS，但先处理指定 finding。",
|
|
"C：暂停真实使用扩展，先做整改。",
|
|
],
|
|
},
|
|
privacy: "status/count/report-path summaries only; no phone/email/token/Secret/EncodingAESKey/full external ids/full invoice image/full bank receipt/full contract body/raw payload",
|
|
};
|
|
|
|
fs.writeFileSync(path.join(reportDir, "summary.json"), `${JSON.stringify(summary, null, 2)}\n`, "utf8");
|
|
console.log(`[oaops1] summary=${reportRef(path.join(reportDir, "summary.json"))}`);
|
|
NODE
|
|
}
|
|
|
|
finish() {
|
|
write_manual_checklist
|
|
write_summary_json || STATUS=1
|
|
run_privacy_smoke
|
|
write_summary_json || true
|
|
local before_second_privacy_status="$STATUS"
|
|
run_privacy_smoke
|
|
if [[ "$STATUS" != "$before_second_privacy_status" ]]; then
|
|
write_summary_json || true
|
|
fi
|
|
log "[oaops1] report=$REPORT_DIR"
|
|
exit "$STATUS"
|
|
}
|
|
|
|
trap finish EXIT
|
|
|
|
load_default_env
|
|
run_ready_and_runtime
|
|
cooldown_login_step "authenticated-readonly-probe"
|
|
run_finding_step "authenticated-readonly-probe" run_authenticated_readonly_probe
|
|
run_mobile_and_entry_matrix
|