wangbo
0f0998cbcf
新增 Aliyun OSS 与 S3 协议、通道内重试和按优先级跨通道切换，保留 server-main 兼容与环境 OSS 内存通道。 将请求及结果中的 Base64、Data URI、Buffer、multipart 和内联二进制统一对象化，生产路径不再写入本机静态目录，历史本地资源仅保留只读兼容。 引入 PublicErrorV1 并统一 API、异步查询、兼容协议和失败回调的安全错误输出，同时补充迁移、管理端、指标、OpenAPI 与本地模拟验收。 验证：go test ./... -count=1；go vet ./...；pnpm lint；pnpm test；pnpm build；pnpm openapi；tests/ci/migrations-test.sh。
70 lines
3.3 KiB
Go
70 lines
3.3 KiB
Go
package publicerror
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestTransportErrorsNeverExposeSocketDetails(t *testing.T) {
|
|
raw := "read tcp 10.42.0.72:54960->47.77.191.126:443: read: connection reset by peer"
|
|
got := FromFields("response_read_error", raw, http.StatusOK, true)
|
|
if got.Code != "upstream_connection_interrupted" || got.HTTPStatus != http.StatusBadGateway || !got.Retryable {
|
|
t.Fatalf("unexpected public error: %+v", got)
|
|
}
|
|
if strings.Contains(got.Message, "10.42.0.72") || strings.Contains(got.Message, "47.77.191.126") {
|
|
t.Fatalf("public error leaked socket details: %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestStorageAndExpiredErrorsHaveStableActions(t *testing.T) {
|
|
storage := FromFields("storage_write_failed", "secret endpoint", 0, true)
|
|
if storage.Category != "storage" || storage.Action != "retry" || storage.HTTPStatus != http.StatusServiceUnavailable {
|
|
t.Fatalf("unexpected storage error: %+v", storage)
|
|
}
|
|
expired := FromFields("binary_result_expired", "local binary result has expired", 0, false)
|
|
if expired.Code != "result_expired" || expired.Action != "resubmit" || expired.HTTPStatus != http.StatusGone {
|
|
t.Fatalf("unexpected expired error: %+v", expired)
|
|
}
|
|
}
|
|
|
|
func TestUnknownServerErrorDoesNotExposeProviderBody(t *testing.T) {
|
|
raw := `provider rejected request: {"account":"secret-project","detail":"internal"}`
|
|
got := FromFields("vendor_opaque_error", raw, http.StatusBadGateway, true)
|
|
if got.Code != "gateway_error" || got.Message == raw || strings.Contains(got.Message, "secret-project") {
|
|
t.Fatalf("unknown provider error was exposed: %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestProviderHTTPErrorDoesNotExposeProviderBody(t *testing.T) {
|
|
raw := `{"error":{"message":"bucket private-a rejected secret-project"}}`
|
|
for _, test := range []struct {
|
|
code string
|
|
status int
|
|
wantCode string
|
|
wantStatus int
|
|
}{
|
|
{code: "http_400", status: http.StatusBadRequest, wantCode: "upstream_request_rejected", wantStatus: http.StatusBadRequest},
|
|
{code: "auth_failed", status: http.StatusUnauthorized, wantCode: "upstream_auth_failed", wantStatus: http.StatusBadGateway},
|
|
{code: "provider_failed", status: http.StatusForbidden, wantCode: "upstream_auth_failed", wantStatus: http.StatusBadGateway},
|
|
{code: "provider_failed", status: http.StatusTooManyRequests, wantCode: "upstream_rate_limited", wantStatus: http.StatusTooManyRequests},
|
|
{code: "server_error", status: http.StatusBadGateway, wantCode: "upstream_unavailable", wantStatus: http.StatusServiceUnavailable},
|
|
{code: "invalid_response", status: http.StatusOK, wantCode: "upstream_invalid_response", wantStatus: http.StatusBadGateway},
|
|
} {
|
|
got := FromFields(test.code, raw, test.status, true)
|
|
if got.Code != test.wantCode || got.HTTPStatus != test.wantStatus {
|
|
t.Fatalf("%s: unexpected public error: %+v", test.code, got)
|
|
}
|
|
if strings.Contains(got.Message, "private-a") || strings.Contains(got.Message, "secret-project") {
|
|
t.Fatalf("%s: provider body leaked: %+v", test.code, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestValidationGateKeepsStablePublicCode(t *testing.T) {
|
|
got := FromFields("validation_in_progress", "new production tasks are paused while validation is running", http.StatusServiceUnavailable, true)
|
|
if got.Code != "validation_in_progress" || got.HTTPStatus != http.StatusServiceUnavailable || !got.Retryable {
|
|
t.Fatalf("unexpected validation gate error: %+v", got)
|
|
}
|
|
}
|