xiaoshu-app/scripts/smoke-admin-functions.mjs

#!/usr/bin/env node

import { randomBytes } from 'node:crypto';
import { readFile } from 'node:fs/promises';

const APP_ID = process.env.XIAOSHU_PARSE_APP_ID || '7pIbDBJmKx_main';
const MASTER_KEY = process.env.XIAOSHU_MASTER_KEY || '';
const PARSE_URL = (process.env.XIAOSHU_PARSE_URL || 'https://server.xiaoshu.pro/parse').replace(/\/$/, '');
const FUNCTION_URL = (process.env.XIAOSHU_FUNCTION_URL || 'https://server.xiaoshu.pro/api/functions').replace(/\/$/, '');

if (!MASTER_KEY) throw new Error('缺少 XIAOSHU_MASTER_KEY');

async function jsonRequest(url, init = {}, master = false) {
  const response = await fetch(url, {
    ...init,
    headers: {
      'X-Parse-Application-Id': APP_ID,
      ...(master ? { 'X-Parse-Master-Key': MASTER_KEY } : {}),
      'Content-Type': 'application/json',
      ...(init.headers || {}),
    },
  });
  const payload = await response.json().catch(() => ({}));
  if (!response.ok) {
    const detail = payload.message || payload.error || payload;
    throw new Error(`${response.status}: ${typeof detail === 'string' ? detail : JSON.stringify(detail)}`);
  }
  return payload;
}

async function callFunction(path, token, params) {
  const payload = await jsonRequest(`${FUNCTION_URL}/${path}`, {
    method: 'POST',
    body: JSON.stringify({ token, params }),
  });
  if (!payload.success) throw new Error(payload.message || `${path} 返回失败`);
  return payload.data;
}

async function callLegacyFunction(token, params, expectedStatus = 200) {
  const response = await fetch(`${FUNCTION_URL}/xiaoshu/app/gateway`, {
    method: 'POST',
    headers: { 'X-Parse-Application-Id': APP_ID, 'Content-Type': 'application/json' },
    body: JSON.stringify({ ...(token ? { token } : {}), params }),
  });
  const payload = await response.json().catch(() => ({}));
  if (response.status !== expectedStatus) throw new Error(`app gateway ${params.action} 期望 ${expectedStatus}，实际 ${response.status}: ${payload.retmsg || payload.error || ''}`);
  return payload;
}

async function sourceActions() {
  const source = await readFile(new URL('../src/app/core/source-parity.generated.ts', import.meta.url), 'utf8');
  const match = source.match(/export const SOURCE_API_ACTIONS = (\[[\s\S]*?\]) as const;/);
  if (!match) throw new Error('无法读取 SOURCE_API_ACTIONS');
  return JSON.parse(match[1]);
}

let userId = '';
let memberId = '';
try {
  const sample = await jsonRequest(`${PARSE_URL}/classes/Company?limit=1&keys=objectId`, {}, true);
  const companyId = sample.results?.[0]?.objectId;
  if (!companyId) throw new Error('没有可用于帐套隔离测试的 Company');
  const company = { __type: 'Pointer', className: 'Company', objectId: companyId };

  const username = `codex_admin_smoke_${Date.now()}`;
  const password = randomBytes(24).toString('base64url');
  const created = await jsonRequest(`${PARSE_URL}/users`, {
    method: 'POST',
    body: JSON.stringify({ username, password, isAdmin: true, roles: ['admin'], company }),
  }, true);
  userId = created.objectId;

  const login = await jsonRequest(`${PARSE_URL}/login`, {
    method: 'POST',
    body: JSON.stringify({ username, password }),
  });
  if (!login.sessionToken) throw new Error('临时管理员登录未返回 sessionToken');

  const memberUsername = `codex_member_smoke_${Date.now()}`;
  const memberPassword = randomBytes(24).toString('base64url');
  const memberLegacyId = 900000000 + Math.floor(Date.now() / 1000) % 90000000;
  const member = await jsonRequest(`${PARSE_URL}/users`, {
    method: 'POST',
    body: JSON.stringify({ username: memberUsername, password: memberPassword, legacyUserId: memberLegacyId, company }),
  }, true);
  memberId = member.objectId;
  const memberLogin = await jsonRequest(`${PARSE_URL}/login`, {
    method: 'POST',
    body: JSON.stringify({ username: memberUsername, password: memberPassword }),
  });

  const meta = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'meta' });
  if (meta.identity?.objectId !== userId || !meta.cloudFunctions) throw new Error('管理员 meta 校验失败');

  const dashboard = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'dashboard' });
  if (!Array.isArray(dashboard.metrics) || dashboard.metrics.length !== 8) throw new Error('dashboard 指标校验失败');

  const schema = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'schema', className: 'CourseAppointment' });
  if (schema.className !== 'CourseAppointment' || !Array.isArray(schema.fields)) throw new Error('schema 校验失败');

  const page = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'list', className: 'CourseAppointment', page: 1, pageSize: 2 });
  if (!Array.isArray(page.results) || page.pageSize !== 2) throw new Error('资源分页校验失败');

  const normalized = await callFunction('xiaoshu/cms/content-normalizer', login.sessionToken, { content: '<p>中文&nbsp;<strong>内容</strong></p><script>alert(1)</script>' });
  if (normalized.content !== '中文 内容') throw new Error(`内容清理结果异常：${normalized.content}`);

  const exams = await callFunction('xiaoshu/cms/exams/classes', login.sessionToken, { page: 1, pageSize: 2 });
  if (!Array.isArray(exams.results)) throw new Error('考试班级投影校验失败');

  const guest = await callFunction('xiaoshu/cms/guest/bar', login.sessionToken, { page: 1, pageSize: 2 });
  if (!Array.isArray(guest.results)) throw new Error('互动社区投影校验失败');

  const migration = await callLegacyFunction('', { action: 'migration_status' });
  const covered = new Set([...(migration.result?.implemented || []), ...Object.keys(migration.result?.blocked || {})]);
  const missing = (await sourceActions()).filter((action) => !covered.has(action));
  if (missing.length) throw new Error(`app gateway 迁移矩阵缺少：${missing.join(', ')}`);

  const content = await callLegacyFunction('', { action: 'content_list', page: 1, pageSize: 2 });
  if (!Array.isArray(content.result) || content.result.length !== 2 || Number(content.page?.itemCount) < 89000) throw new Error('公开内容分页校验失败');
  const contentExact = await callLegacyFunction('', { action: 'content_list', page: 1, pageSize: 1, objectId: content.result[0].objectId });
  if (contentExact.result?.[0]?.objectId !== content.result[0].objectId || contentExact.page?.itemCount !== 1) throw new Error('内容 objectId 精确查询校验失败');
  const contentDetail = await callLegacyFunction('', { action: 'content_get', id: content.result[0].objectId });
  if (contentDetail.result?.objectId !== content.result[0].objectId) throw new Error('内容详情 ID 校验失败');

  const words = await callLegacyFunction('', { action: 'content_list', modelId: 52, page: 1, pageSize: 1 });
  if (Number(words.page?.itemCount) < 89000 || !words.result?.[0]?.GeneralID || words.result?.[0]?.sy === undefined) throw new Error('词库 addon 联表校验失败');

  const privateContent = await callLegacyFunction('', { action: 'content_list', modelId: 56, page: 1, pageSize: 1 }, 401);
  if (!String(privateContent.retmsg).includes('登录')) throw new Error('学习记录未阻止匿名访问');
  const learning = await callLegacyFunction(login.sessionToken, { action: 'content_list', modelId: 56, page: 1, pageSize: 1 });
  if (!learning.result?.[0]?.GeneralID || learning.result?.[0]?.xxqs === undefined) throw new Error('学习记录 addon 联表校验失败');

  const recordDetail = await callLegacyFunction(login.sessionToken, { action: 'e_record_detail', id: learning.result[0].GeneralID });
  if (!Array.isArray(recordDetail.result) || !recordDetail.result.length || !recordDetail.result[0]?.detail?.[0]?.Title) throw new Error('学习记录单词详情联查校验失败');

  const appointments = await callLegacyFunction(login.sessionToken, { action: 'content_list', modelId: 54, page: 1, pageSize: 1 });
  const appointment = await callLegacyFunction(login.sessionToken, { action: 'e_order_detail', id: appointments.result?.[0]?.GeneralID });
  if (!appointment.result?.[0]?.GeneralID || appointment.result[0].kcid === undefined) throw new Error('预约详情联查校验失败');

  const newWords = await callLegacyFunction(login.sessionToken, { action: 'e_words_list', uid: 58, page: 1, pageSize: 2 });
  if (Number(newWords.page?.itemCount) < 1 || !newWords.result?.[0]?.detail?.[0]?.Title) throw new Error('用户生词联查校验失败');

  const courseWords = await callLegacyFunction(login.sessionToken, { action: 'e_ck_list', uid: 58, nids: 40, page: 1, pageSize: 1000 });
  const learnedWord = courseWords.result?.find((word) => Number(word.GeneralID) === 2505);
  if (Number(courseWords.page?.itemCount) < 1 || !courseWords.result?.[0]?.detail?.Title || Number(learnedWord?.w_learned) !== 7) throw new Error('课程词库学习进度联查校验失败');

  const memory = await callLegacyFunction(login.sessionToken, { action: 'e_get_21list', uid: 58, page: 1, pageSize: 2 });
  if (Number(memory.page?.itemCount) < 1 || !memory.result?.[0]?.GeneralID || memory.result[0].learned === undefined) throw new Error('21 天抗遗忘联查校验失败');

  const incomeBlocked = await callLegacyFunction(login.sessionToken, { action: 'e_get_21list_tj', uid: 58 }, 501);
  if (!String(incomeBlocked.retmsg).includes('计价规则')) throw new Error('复习收入缺失规则未显式阻塞');

  const ownEmpty = await callLegacyFunction(memberLogin.sessionToken, { action: 'content_list', modelId: 56, myfield2: `UserId=${memberLegacyId}`, page: 1, pageSize: 1 });
  if (!Array.isArray(ownEmpty.result) || ownEmpty.page?.itemCount !== 0) throw new Error('普通用户本人记录权限校验失败');
  const ownCourseWords = await callLegacyFunction(memberLogin.sessionToken, { action: 'e_ck_list', uid: memberLegacyId, nids: 40, page: 1, pageSize: 1 });
  if (!Array.isArray(ownCourseWords.result) || ownCourseWords.result[0]?.w_learned !== 0) throw new Error('普通用户本人课程词库权限校验失败');
  const deniedCourseWords = await callLegacyFunction(memberLogin.sessionToken, { action: 'e_ck_list', uid: 58, nids: 40, page: 1, pageSize: 1 }, 403);
  if (!String(deniedCourseWords.retmsg).includes('无权')) throw new Error('普通用户跨用户课程词库未被拒绝');
  const denied = await callLegacyFunction(memberLogin.sessionToken, { action: 'content_list', modelId: 56, myfield2: 'UserId=3', page: 1, pageSize: 1 }, 403);
  if (!String(denied.retmsg).includes('无权')) throw new Error('普通用户跨用户记录未被拒绝');

  const profile = await callLegacyFunction(login.sessionToken, { action: 'user_get' });
  if (profile.retcode !== 0 || profile.result?.objectId !== userId) throw new Error('app gateway 用户会话校验失败');

  const blocked = await callLegacyFunction('', { action: 'cart_list' }, 501);
  if (!String(blocked.retmsg).startsWith('migration_blocked:')) throw new Error('阻塞接口未返回 migration_blocked');

  console.log('Cloud smoke passed: admin auth/tenant/CRUD reads, CMS projections, normalized learning joins, app action coverage, public content, session scope, explicit blocked APIs.');
} finally {
  if (memberId) {
    await jsonRequest(`${PARSE_URL}/users/${memberId}`, { method: 'DELETE' }, true).catch((error) => {
      console.error(`临时普通用户清理失败：${error.message}`);
      process.exitCode = 1;
    });
  }
  if (userId) {
    await jsonRequest(`${PARSE_URL}/users/${userId}`, { method: 'DELETE' }, true).catch((error) => {
      console.error(`临时管理员清理失败：${error.message}`);
      process.exitCode = 1;
    });
  }
}