171 lines
9.6 KiB
Bash
Executable File
171 lines
9.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
API_URL="${AIHR_PERSONAL_API_URL:-https://wygj-api.localhost}"
|
|
QDRANT_URL="${AIHR_QDRANT_URL:-http://127.0.0.1:6333}"
|
|
QDRANT_COLLECTION="${AIHR_PERSONAL_QDRANT_COLLECTION:-aihr_personal_knowledge}"
|
|
DB_CONTAINER="${AIHR_DB_CONTAINER:-wygj-mysql}"
|
|
DB_NAME="${AIHR_DB_NAME:-ry-vue}"
|
|
REDIS_CONTAINER="${AIHR_REDIS_CONTAINER:-wygj-redis}"
|
|
DOCKER_NETWORK="${AIHR_DOCKER_NETWORK:-wygj_default}"
|
|
PHONE_A="13900009111"
|
|
PHONE_B="13900009222"
|
|
SMS_CODE="${AIHR_SMS_DEV_CODE:-123456}"
|
|
TITLE="personal-assistant-smoke-isolation"
|
|
CONTENT="个人助理隔离烟测唯一标记，物业催费沟通资料。"
|
|
|
|
TOKEN_A=""
|
|
CLIENT_A=""
|
|
TOKEN_B=""
|
|
CLIENT_B=""
|
|
USER_A=""
|
|
USER_B=""
|
|
ITEM_ID=""
|
|
|
|
fail() { echo "FAIL: $*" >&2; exit 1; }
|
|
need() { command -v "$1" >/dev/null 2>&1 || fail "missing command: $1"; }
|
|
expect_code() {
|
|
local actual="$1" expected="$2" label="$3"
|
|
[[ "$actual" == "$expected" ]] || fail "$label expected=$expected actual=$actual"
|
|
}
|
|
|
|
mysql() {
|
|
docker exec "$DB_CONTAINER" mysql -uroot -proot --default-character-set=utf8mb4 -N -B -D "$DB_NAME" -e "$1" 2>/dev/null
|
|
}
|
|
|
|
cleanup() {
|
|
local exit_code=$?
|
|
local oss_rows oss_id object_key
|
|
set +e
|
|
[[ -n "$USER_A" ]] || USER_A="$(mysql "select user_id from sys_user where phonenumber='$PHONE_A' order by user_id desc limit 1" | head -1)"
|
|
[[ -n "$USER_B" ]] || USER_B="$(mysql "select user_id from sys_user where phonenumber='$PHONE_B' order by user_id desc limit 1" | head -1)"
|
|
for uid in "$USER_A" "$USER_B"; do
|
|
[[ "$uid" =~ ^[0-9]+$ ]] || continue
|
|
curl -fsS -X POST "$QDRANT_URL/collections/$QDRANT_COLLECTION/points/delete?wait=true" \
|
|
-H 'Content-Type: application/json' \
|
|
--data "{\"filter\":{\"must\":[{\"key\":\"tenant_id\",\"match\":{\"value\":\"000000\"}},{\"key\":\"owner_user_id\",\"match\":{\"value\":$uid}}]}}" >/dev/null 2>&1 || true
|
|
done
|
|
oss_rows="$(mysql "select o.oss_id,o.file_name from sys_oss o join aihr_personal_item i on i.oss_id=o.oss_id where i.title='$TITLE' and i.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0))" || true)"
|
|
while IFS=$'\t' read -r oss_id object_key; do
|
|
[[ "$oss_id" =~ ^[0-9]+$ && -n "$object_key" ]] || continue
|
|
docker run --rm --network "$DOCKER_NETWORK" --entrypoint /bin/sh minio/mc -c \
|
|
"mc alias set local http://wygj-minio:9000 ruoyi ruoyi123 >/dev/null && mc rm --force 'local/ruoyi/$object_key' >/dev/null" \
|
|
>/dev/null 2>&1 || true
|
|
mysql "delete from sys_oss where oss_id=$oss_id and file_name='$object_key'" >/dev/null 2>&1 || true
|
|
done <<<"$oss_rows"
|
|
mysql "
|
|
delete f from aihr_personal_fragment f join aihr_personal_item i on i.id=f.item_id
|
|
where i.title='$TITLE' and i.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete j from aihr_personal_cleanup_job j join aihr_personal_item i on i.id=j.item_id
|
|
where i.title='$TITLE' and i.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete from aihr_personal_item where title='$TITLE'
|
|
and owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete m from aihr_personal_chat_message m join aihr_personal_chat_session s on s.id=m.session_id
|
|
where s.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete from aihr_personal_chat_session
|
|
where owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete from aihr_personal_space
|
|
where owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete from sys_user_role where user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete from sys_user_post where user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
|
|
delete from sys_user where phonenumber in ('$PHONE_A','$PHONE_B') and remark='移动端短信自动注册';
|
|
delete from sys_logininfor where user_name in ('$PHONE_A','$PHONE_B');
|
|
" >/dev/null 2>&1 || true
|
|
docker exec "$REDIS_CONTAINER" redis-cli -a ruoyi123 DEL \
|
|
"global:captcha_codes:$PHONE_A" "global:captcha_codes:$PHONE_B" >/dev/null 2>&1 || true
|
|
for phone in "$PHONE_A" "$PHONE_B"; do
|
|
docker exec "$REDIS_CONTAINER" sh -c \
|
|
"redis-cli -a ruoyi123 --scan --pattern '*resource/sms/code:$phone*' 2>/dev/null | xargs -r redis-cli -a ruoyi123 DEL" \
|
|
>/dev/null 2>&1 || true
|
|
done
|
|
return "$exit_code"
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
api() {
|
|
local token="$1" client="$2" method="$3" path="$4" body="${5:-}"
|
|
local args=(-kfsS -X "$method" "$API_URL$path" -H "Authorization: Bearer $token" -H "clientid: $client")
|
|
[[ -z "$body" ]] || args+=(-H 'Content-Type: application/json' --data "$body")
|
|
curl "${args[@]}"
|
|
}
|
|
|
|
login() {
|
|
local phone="$1" response
|
|
response="$(curl -kfsS "$API_URL/resource/sms/code?phonenumber=$phone")"
|
|
expect_code "$(jq -r '.code' <<<"$response")" "200" "send sms code"
|
|
response="$(curl -kfsS -X POST "$API_URL/auth/mobile/sms-login" -H 'Content-Type: application/json' \
|
|
--data "{\"tenantId\":\"000000\",\"phonenumber\":\"$phone\",\"smsCode\":\"$SMS_CODE\"}")"
|
|
expect_code "$(jq -r '.code' <<<"$response")" "200" "mobile sms login"
|
|
jq -er '.data.access_token, .data.client_id' <<<"$response" | paste -sd ' ' -
|
|
}
|
|
|
|
need curl
|
|
need jq
|
|
need docker
|
|
curl -kfsS "$API_URL/auth/tenant/list" | jq -e '.code == 200' >/dev/null || fail "backend health is not UP: $API_URL"
|
|
docker ps --format '{{.Names}}' | grep -qx "$DB_CONTAINER" || fail "database container not running: $DB_CONTAINER"
|
|
docker ps --format '{{.Names}}' | grep -qx "$REDIS_CONTAINER" || fail "redis container not running: $REDIS_CONTAINER"
|
|
mysql "select 1 from aihr_personal_item limit 1" >/dev/null || fail "personal knowledge schema missing; run ./scripts/reset-dev-db.sh"
|
|
|
|
cleanup
|
|
read -r TOKEN_A CLIENT_A <<<"$(login "$PHONE_A")"
|
|
read -r TOKEN_B CLIENT_B <<<"$(login "$PHONE_B")"
|
|
USER_A="$(mysql "select user_id from sys_user where phonenumber='$PHONE_A' order by user_id desc limit 1")"
|
|
USER_B="$(mysql "select user_id from sys_user where phonenumber='$PHONE_B' order by user_id desc limit 1")"
|
|
[[ "$USER_A" =~ ^[0-9]+$ && "$USER_B" =~ ^[0-9]+$ && "$USER_A" != "$USER_B" ]] || fail "smoke users were not created independently"
|
|
|
|
created="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/items/text \
|
|
"{\"title\":\"$TITLE\",\"content\":\"$CONTENT\",\"tags\":[\"smoke\"]}")"
|
|
expect_code "$(jq -r '.code' <<<"$created")" "200" "A create text item"
|
|
ITEM_ID="$(jq -er '.data.itemId' <<<"$created")"
|
|
|
|
for _ in {1..40}; do
|
|
detail="$(api "$TOKEN_A" "$CLIENT_A" GET "/api/aihr/personal-assistant/items/$ITEM_ID")"
|
|
[[ "$(jq -r '.data.status // empty' <<<"$detail")" == "READY" ]] && break
|
|
sleep 1
|
|
done
|
|
expect_code "$(jq -r '.data.status // empty' <<<"$detail")" "READY" "A text item processing"
|
|
expect_code "$(jq -r '.data.title // empty' <<<"$detail")" "$TITLE" "A item detail"
|
|
|
|
search_a="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/search \
|
|
"{\"queryText\":\"隔离烟测\",\"scope\":[\"PERSONAL\"],\"itemIds\":[$ITEM_ID],\"limit\":10}")"
|
|
expect_code "$(jq -r '.code' <<<"$search_a")" "200" "A search"
|
|
[[ "$(jq --arg item "$ITEM_ID" '[.data.hits[] | select((.itemId | tostring) == $item)] | length' <<<"$search_a")" -ge 1 ]] || {
|
|
jq '{code,msg,data}' <<<"$search_a" >&2
|
|
fail "A search did not return own item"
|
|
}
|
|
|
|
for operation in detail download retry delete; do
|
|
case "$operation" in
|
|
detail) response="$(api "$TOKEN_B" "$CLIENT_B" GET "/api/aihr/personal-assistant/items/$ITEM_ID" || true)" ;;
|
|
download) response="$(api "$TOKEN_B" "$CLIENT_B" GET "/api/aihr/personal-assistant/items/$ITEM_ID/download-url" || true)" ;;
|
|
retry) response="$(api "$TOKEN_B" "$CLIENT_B" POST "/api/aihr/personal-assistant/items/$ITEM_ID/retry" || true)" ;;
|
|
delete) response="$(api "$TOKEN_B" "$CLIENT_B" DELETE "/api/aihr/personal-assistant/items/$ITEM_ID" || true)" ;;
|
|
esac
|
|
expect_code "$(jq -r '.msg // empty' <<<"$response")" "PERSONAL_ITEM_NOT_FOUND" "B $operation A item"
|
|
done
|
|
|
|
search_b="$(api "$TOKEN_B" "$CLIENT_B" POST /api/aihr/personal-assistant/search \
|
|
"{\"queryText\":\"隔离烟测\",\"scope\":[\"PERSONAL\"],\"itemIds\":[$ITEM_ID],\"limit\":10}")"
|
|
expect_code "$(jq -r '.code' <<<"$search_b")" "200" "B itemIds search"
|
|
expect_code "$(jq '.data.hits | length' <<<"$search_b")" "0" "B itemIds search isolation"
|
|
|
|
for blocked_url in 'http://127.0.0.1/admin' 'http://169.254.169.254/latest/meta-data/'; do
|
|
response="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/items/url \
|
|
"{\"url\":\"$blocked_url\",\"title\":\"$TITLE\"}" || true)"
|
|
expect_code "$(jq -r '.msg // empty' <<<"$response")" "PERSONAL_URL_BLOCKED" "SSRF $blocked_url"
|
|
done
|
|
|
|
deleted1="$(api "$TOKEN_A" "$CLIENT_A" DELETE "/api/aihr/personal-assistant/items/$ITEM_ID")"
|
|
deleted2="$(api "$TOKEN_A" "$CLIENT_A" DELETE "/api/aihr/personal-assistant/items/$ITEM_ID")"
|
|
expect_code "$(jq -r '.code' <<<"$deleted1")" "200" "A delete"
|
|
expect_code "$(jq -r '.data.cleanupJobId' <<<"$deleted2")" "$(jq -r '.data.cleanupJobId' <<<"$deleted1")" "idempotent delete job"
|
|
response="$(api "$TOKEN_A" "$CLIENT_A" GET "/api/aihr/personal-assistant/items/$ITEM_ID" || true)"
|
|
expect_code "$(jq -r '.msg // empty' <<<"$response")" "PERSONAL_ITEM_NOT_FOUND" "A item hidden immediately"
|
|
response="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/search \
|
|
"{\"queryText\":\"隔离烟测\",\"scope\":[\"PERSONAL\"],\"itemIds\":[$ITEM_ID],\"limit\":10}")"
|
|
expect_code "$(jq '.data.hits | length' <<<"$response")" "0" "deleted item search"
|
|
|
|
echo "PASS: personal assistant isolation, SSRF, readiness and deletion gates"
|