xiaoshu-app/scripts/smoke-admin-functions.mjs

#!/usr/bin/env node

import { randomBytes } from 'node:crypto';
import { readFile } from 'node:fs/promises';

const APP_ID = process.env.XIAOSHU_PARSE_APP_ID || '7pIbDBJmKx_main';
const MASTER_KEY = process.env.XIAOSHU_MASTER_KEY || '';
const PARSE_URL = (process.env.XIAOSHU_PARSE_URL || 'https://server.xiaoshu.pro/parse').replace(/\/$/, '');
const FUNCTION_URL = (process.env.XIAOSHU_FUNCTION_URL || 'https://server.xiaoshu.pro/api/functions').replace(/\/$/, '');

if (!MASTER_KEY) throw new Error('缺少 XIAOSHU_MASTER_KEY');

async function jsonRequest(url, init = {}, master = false) {
  const response = await fetch(url, {
    ...init,
    headers: {
      'X-Parse-Application-Id': APP_ID,
      ...(master ? { 'X-Parse-Master-Key': MASTER_KEY } : {}),
      'Content-Type': 'application/json',
      ...(init.headers || {}),
    },
  });
  const payload = await response.json().catch(() => ({}));
  if (!response.ok) {
    const detail = payload.message || payload.error || payload;
    throw new Error(`${response.status}: ${typeof detail === 'string' ? detail : JSON.stringify(detail)}`);
  }
  return payload;
}

async function callFunction(path, token, params) {
  const payload = await jsonRequest(`${FUNCTION_URL}/${path}`, {
    method: 'POST',
    body: JSON.stringify({ token, params }),
  });
  if (!payload.success) throw new Error(payload.message || `${path} 返回失败`);
  return payload.data;
}

async function callLegacyFunction(token, params, expectedStatus = 200) {
  const response = await fetch(`${FUNCTION_URL}/xiaoshu/app/gateway`, {
    method: 'POST',
    headers: { 'X-Parse-Application-Id': APP_ID, 'Content-Type': 'application/json' },
    body: JSON.stringify(token ? { token, params } : params),
  });
  const payload = await response.json().catch(() => ({}));
  if (response.status !== expectedStatus) throw new Error(`app gateway ${params.action} 期望 ${expectedStatus}，实际 ${response.status}: ${payload.retmsg || payload.error || ''}`);
  return payload;
}

async function sourceActions() {
  const source = await readFile(new URL('../src/app/core/source-parity.generated.ts', import.meta.url), 'utf8');
  const match = source.match(/export const SOURCE_API_ACTIONS = (\[[\s\S]*?\]) as const;/);
  if (!match) throw new Error('无法读取 SOURCE_API_ACTIONS');
  return JSON.parse(match[1]);
}

let userId = '';
try {
  const sample = await jsonRequest(`${PARSE_URL}/classes/Company?limit=1&keys=objectId`, {}, true);
  const companyId = sample.results?.[0]?.objectId;
  if (!companyId) throw new Error('没有可用于帐套隔离测试的 Company');
  const company = { __type: 'Pointer', className: 'Company', objectId: companyId };

  const username = `codex_admin_smoke_${Date.now()}`;
  const password = randomBytes(24).toString('base64url');
  const created = await jsonRequest(`${PARSE_URL}/users`, {
    method: 'POST',
    body: JSON.stringify({ username, password, isAdmin: true, roles: ['admin'], company }),
  }, true);
  userId = created.objectId;

  const login = await jsonRequest(`${PARSE_URL}/login`, {
    method: 'POST',
    body: JSON.stringify({ username, password }),
  });
  if (!login.sessionToken) throw new Error('临时管理员登录未返回 sessionToken');

  const meta = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'meta' });
  if (meta.identity?.objectId !== userId || !meta.cloudFunctions) throw new Error('管理员 meta 校验失败');

  const dashboard = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'dashboard' });
  if (!Array.isArray(dashboard.metrics) || dashboard.metrics.length !== 8) throw new Error('dashboard 指标校验失败');

  const schema = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'schema', className: 'CourseAppointment' });
  if (schema.className !== 'CourseAppointment' || !Array.isArray(schema.fields)) throw new Error('schema 校验失败');

  const page = await callFunction('xiaoshu/admin/gateway', login.sessionToken, { operation: 'list', className: 'CourseAppointment', page: 1, pageSize: 2 });
  if (!Array.isArray(page.results) || page.pageSize !== 2) throw new Error('资源分页校验失败');

  const normalized = await callFunction('xiaoshu/cms/content-normalizer', login.sessionToken, { content: '<p>中文&nbsp;<strong>内容</strong></p><script>alert(1)</script>' });
  if (normalized.content !== '中文 内容') throw new Error(`内容清理结果异常：${normalized.content}`);

  const exams = await callFunction('xiaoshu/cms/exams/classes', login.sessionToken, { page: 1, pageSize: 2 });
  if (!Array.isArray(exams.results)) throw new Error('考试班级投影校验失败');

  const guest = await callFunction('xiaoshu/cms/guest/bar', login.sessionToken, { page: 1, pageSize: 2 });
  if (!Array.isArray(guest.results)) throw new Error('互动社区投影校验失败');

  const migration = await callLegacyFunction('', { action: 'migration_status' });
  const covered = new Set([...(migration.result?.implemented || []), ...Object.keys(migration.result?.blocked || {})]);
  const missing = (await sourceActions()).filter((action) => !covered.has(action));
  if (missing.length) throw new Error(`app gateway 迁移矩阵缺少：${missing.join(', ')}`);

  const content = await callLegacyFunction('', { action: 'content_list', page: 1, pageSize: 2 });
  if (!Array.isArray(content.result) || content.result.length !== 2 || Number(content.page?.itemCount) < 90000) throw new Error('公开内容分页校验失败');
  const contentExact = await callLegacyFunction('', { action: 'content_list', page: 1, pageSize: 1, objectId: content.result[0].objectId });
  if (contentExact.result?.[0]?.objectId !== content.result[0].objectId || contentExact.page?.itemCount !== 1) throw new Error('内容 objectId 精确查询校验失败');

  const profile = await callLegacyFunction(login.sessionToken, { action: 'user_get' });
  if (profile.retcode !== 0 || profile.result?.objectId !== userId) throw new Error('app gateway 用户会话校验失败');

  const blocked = await callLegacyFunction('', { action: 'cart_list' }, 501);
  if (!String(blocked.retmsg).startsWith('migration_blocked:')) throw new Error('阻塞接口未返回 migration_blocked');

  console.log('Cloud smoke passed: admin auth/tenant/CRUD reads, CMS projections, app action coverage, public content, session scope, explicit blocked APIs.');
} finally {
  if (userId) {
    await jsonRequest(`${PARSE_URL}/users/${userId}`, { method: 'DELETE' }, true).catch((error) => {
      console.error(`临时管理员清理失败：${error.message}`);
      process.exitCode = 1;
    });
  }
}