wangchuanli
23799b4ea5
* LICENSE —— MIT
* THIRD-PARTY-NOTICES —— 依赖清单、再分发合规说明（含随仓库分发的
Apache ECharts 5.6.0 / Apache-2.0）与自查清单
* CONTRIBUTING.md —— 开发环境、五层验证、必须遵守的不变量、提交规范
* SECURITY.md —— 漏洞私有报告渠道、已有措施、已知非目标
* CODE_OF_CONDUCT.md —— 改编自 Contributor Covenant 2.1
* .github/ —— Bug 报告 / 功能建议表单 + PR 模板
* .editorconfig —— 与 .gitattributes 保持一致
* 全部 Python / Shell 源文件加 SPDX-License-Identifier: MIT 头
* README 增加「开源与许可」章节与许可标识
301 行
14 KiB
Python
301 行
14 KiB
Python
#!/usr/bin/env python
|
||
# -*- coding: utf-8 -*-
|
||
# SPDX-License-Identifier: MIT
|
||
# Copyright (c) 2026 Wang Chuanli
|
||
|
||
"""端到端验收：对**运行中的**服务发真实 HTTP 请求，走完整登录/CSRF/API 链路。
|
||
|
||
与 tests 里用 Flask test_client 的冒烟测试互补——这里验证的是「真的起起来了、
|
||
真的能登录、真的能取到数」，适合部署到局域网后随手跑一遍。
|
||
|
||
用法：
|
||
python tools/check_live.py # 默认 http://127.0.0.1:8848
|
||
python tools/check_live.py --base http://192.168.1.50:8848 # 换成你的部署主机
|
||
python tools/check_live.py -u admin -p 你的密码
|
||
python tools/check_live.py --from 2026-09-08 --to 2026-09-14
|
||
|
||
退出码：0 全通过；1 有失败项（会打印失败清单）。
|
||
|
||
注意：脚本会读取窗口数据但**不写库**（不触发采集、不改配置），可安全反复运行。
|
||
"""
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import http.cookiejar
|
||
import json
|
||
import re
|
||
import sys
|
||
import urllib.error
|
||
import urllib.parse
|
||
import urllib.request
|
||
from datetime import datetime
|
||
|
||
OK = 0
|
||
FAIL = 0
|
||
FAILS: list[str] = []
|
||
|
||
|
||
def _d(s: str):
|
||
"""把 YYYY-MM-DD 解析成本地 datetime（不用 date.fromisoformat 之外的时区处理）。"""
|
||
return datetime.strptime(s, "%Y-%m-%d")
|
||
|
||
|
||
def chk(name: str, cond: bool, extra: str = "") -> None:
|
||
global OK, FAIL
|
||
if cond:
|
||
OK += 1
|
||
print(" [OK] %s %s" % (name, extra))
|
||
else:
|
||
FAIL += 1
|
||
FAILS.append(name)
|
||
print(" [FAIL] %s %s" % (name, extra))
|
||
|
||
|
||
class _NoRedirect(urllib.request.HTTPRedirectHandler):
|
||
"""不要自动跟随 302 —— 检查跳转目标本身是否安全时必须看到原始 Location。"""
|
||
|
||
def redirect_request(self, req, fp, code, msg, headers, newurl):
|
||
return None
|
||
|
||
|
||
class Live:
|
||
def __init__(self, base: str, timeout: int = 20):
|
||
self.base = base.rstrip("/")
|
||
self.timeout = timeout
|
||
# 关键：显式清空代理，否则本机代理会把 127.0.0.1 也拦成 502
|
||
self.cj = http.cookiejar.CookieJar()
|
||
self.op = urllib.request.build_opener(
|
||
urllib.request.ProxyHandler({}),
|
||
urllib.request.HTTPCookieProcessor(self.cj),
|
||
)
|
||
self.op.addheaders = [("User-Agent", "workbuddy-portal-check/1.1")]
|
||
# 不跟随跳转的 opener：共用同一个 cookie jar，保证是同一会话
|
||
self.op_nr = urllib.request.build_opener(
|
||
urllib.request.ProxyHandler({}),
|
||
urllib.request.HTTPCookieProcessor(self.cj),
|
||
_NoRedirect,
|
||
)
|
||
self.op_nr.addheaders = [("User-Agent", "workbuddy-portal-check/1.1")]
|
||
|
||
def get(self, path: str):
|
||
try:
|
||
r = self.op.open(urllib.request.Request(self.base + path), timeout=self.timeout)
|
||
return r.status, r.read().decode("utf-8", "replace")
|
||
except urllib.error.HTTPError as e:
|
||
return e.code, e.read().decode("utf-8", "replace")
|
||
|
||
def post(self, path: str, data: dict, csrf: str | None = None, as_json: bool = False):
|
||
if as_json:
|
||
body, ct = json.dumps(data).encode(), "application/json"
|
||
else:
|
||
body, ct = urllib.parse.urlencode(data).encode(), "application/x-www-form-urlencoded"
|
||
req = urllib.request.Request(self.base + path, data=body, method="POST")
|
||
req.add_header("Content-Type", ct)
|
||
if csrf:
|
||
req.add_header("X-CSRF-Token", csrf)
|
||
try:
|
||
r = self.op.open(req, timeout=self.timeout)
|
||
return r.status, r.read().decode("utf-8", "replace")
|
||
except urllib.error.HTTPError as e:
|
||
return e.code, e.read().decode("utf-8", "replace")
|
||
|
||
def post_raw(self, path: str, data: dict):
|
||
"""表单 POST 且**不跟随**跳转，返回 (status, Location)。"""
|
||
body = urllib.parse.urlencode(data).encode()
|
||
req = urllib.request.Request(self.base + path, data=body, method="POST")
|
||
req.add_header("Content-Type", "application/x-www-form-urlencoded")
|
||
try:
|
||
r = self.op_nr.open(req, timeout=self.timeout)
|
||
return r.status, r.headers.get("Location")
|
||
except urllib.error.HTTPError as e:
|
||
return e.code, e.headers.get("Location")
|
||
|
||
def jget(self, path: str) -> dict:
|
||
st, body = self.get(path)
|
||
return json.loads(body) if st == 200 else {}
|
||
|
||
|
||
def run(L: Live, user: str, pwd: str, frm: str, to: str) -> None:
|
||
print("== 1. 未登录访问受保护资源 ==")
|
||
st, body = L.get("/")
|
||
chk("GET / 未登录落登录页", st == 200 and "登录" in body, "status=%s" % st)
|
||
for p in ("/api/summary", "/api/bundle", "/api/manifest"):
|
||
st, _ = L.get(p)
|
||
chk("GET %-14s 未登录=401" % p, st == 401, "status=%s" % st)
|
||
|
||
print("== 2. 登录（含 CSRF） ==")
|
||
st, html = L.get("/login")
|
||
m = re.search(r'name="_csrf"\s+value="([^"]+)"', html)
|
||
chk("登录页含 CSRF 隐藏域", bool(m))
|
||
st, _ = L.post("/login", {"username": user, "password": pwd,
|
||
"_csrf": m.group(1) if m else ""})
|
||
chk("登录成功", st in (200, 302), "status=%s" % st)
|
||
st, html = L.get("/")
|
||
chk("登录后 GET / 到概览", st == 200 and "概览" in html, "len=%d" % len(html))
|
||
|
||
print("== 3. 后台页面均可达 ==")
|
||
for p, kw in [("/", "概览"), ("/tasks", "任务"), ("/config", "配置"),
|
||
("/logs", "日志"), ("/records", "记录")]:
|
||
st, html = L.get(p)
|
||
chk("GET %-10s" % p, st == 200 and kw in html, "status=%s len=%d" % (st, len(html)))
|
||
|
||
print("== 4. 登录后写操作仍需 CSRF ==")
|
||
st, _ = L.post("/api/collect", {}, csrf=None, as_json=True)
|
||
chk("POST /api/collect 缺 CSRF=400", st == 400, "status=%s" % st)
|
||
|
||
print("== 5. 结构与数值 ==")
|
||
mf = L.jget("/api/manifest")
|
||
chk("manifest 含 health/archive/totals/sources",
|
||
all(k in mf for k in ("health", "archive", "totals", "sources")))
|
||
src = (mf.get("sources") or [{}])[0]
|
||
chk("manifest 存档条数与数据源一致",
|
||
mf["totals"]["records"] == src.get("count"),
|
||
"records=%s src=%s" % (mf["totals"]["records"], src.get("count")))
|
||
|
||
sm = L.jget("/api/summary?from=%s&to=%s" % (frm, to))
|
||
want_days = (_d(to) - _d(frm)).days + 1
|
||
chk("summary 窗口天数正确", sm.get("window", {}).get("days") == want_days,
|
||
"window=%s 期望 %d 天" % (sm.get("window"), want_days))
|
||
chk("summary 窗口内有记录", (sm.get("records") or 0) > 0, "records=%s" % sm.get("records"))
|
||
chk("summary 环比 prev 存在", bool(sm.get("prev")),
|
||
"prev=%s~%s" % ((sm.get("prev") or {}).get("firstDay"), (sm.get("prev") or {}).get("lastDay")))
|
||
chk("summary avgPerCall 自洽",
|
||
not sm.get("calls") or abs(sm["avgPerCall"] - round(sm["credits"] / sm["calls"], 4)) < 1e-6)
|
||
|
||
bd = L.jget("/api/bundle?from=%s&to=%s" % (frm, to))
|
||
chk("bundle 顶层键齐全",
|
||
{"manifest", "daily", "dims", "top", "records", "totals", "window"} <= set(bd),
|
||
"keys=%s" % list(bd.keys()))
|
||
recs, daily = bd.get("records", []), bd.get("daily", [])
|
||
rsum = round(sum(float(x["c"]) for x in recs), 2)
|
||
tsum = round(float(bd.get("totals", {}).get("credits", 0)), 2)
|
||
print(" 窗口 %d 条，records 求和 %.2f ；totals.credits %.2f" % (len(recs), rsum, tsum))
|
||
chk("records 求和 == totals.credits", abs(rsum - tsum) < 0.005, "diff=%.4f" % (rsum - tsum))
|
||
chk("records 求和 == summary.credits",
|
||
abs(rsum - float(sm.get("credits", 0))) < 0.005,
|
||
"diff=%.4f" % (rsum - float(sm.get("credits", 0))))
|
||
chk("daily 为全量（多于窗口天数，供日历/日期轴）", len(daily) > want_days,
|
||
"daily=%d 天 > 窗口 %d 天" % (len(daily), want_days))
|
||
chk("daily 全量求和 == 存档总额",
|
||
abs(round(sum(float(x["c"]) for x in daily), 2)
|
||
- round(float(mf["totals"]["credits"]), 2)) < 0.005)
|
||
chk("逐日 h[24] 求和 == 当日 c",
|
||
all(abs(round(sum(d["h"]), 2) - round(d["c"], 2)) < 0.005 for d in daily))
|
||
chk("dims.hour 补齐 24 槽", len(bd.get("dims", {}).get("hour", [])) == 24)
|
||
chk("dims.model 非空", len(bd.get("dims", {}).get("model", [])) > 0)
|
||
top = bd.get("top", [])
|
||
chk("top 榜按积分降序",
|
||
all(top[i]["c"] >= top[i + 1]["c"] for i in range(len(top) - 1)), "n=%d" % len(top))
|
||
|
||
print("== 6. 明细分页/筛选/排序 ==")
|
||
rj = L.jget("/api/records?page=1&size=5")
|
||
chk("分页返回 5 条", len(rj.get("items", [])) == 5,
|
||
"total=%s pages=%s" % (rj.get("total"), rj.get("pages")))
|
||
chk("分页 total 与存档一致", rj.get("total") == mf["totals"]["records"])
|
||
chk("分页字段为可读全名", "request_id" in (rj.get("items") or [{}])[0])
|
||
chk("分页页码自洽",
|
||
rj.get("pages") == max(1, (rj.get("total", 0) + rj.get("size", 1) - 1) // rj.get("size", 1)))
|
||
r2 = L.jget("/api/records?page=2&size=5")
|
||
chk("第 2 页与第 1 页不重叠",
|
||
set(x["request_id"] for x in r2.get("items", [])).isdisjoint(
|
||
set(x["request_id"] for x in rj.get("items", []))))
|
||
models = bd.get("dims", {}).get("model", [])
|
||
if models:
|
||
mn = models[0]["name"]
|
||
rf = L.jget("/api/records?page=1&size=5&model=" + urllib.parse.quote(mn))
|
||
chk("按模型筛选生效", all(x["model"] == mn for x in rf.get("items", [])),
|
||
"model=%s total=%s" % (mn, rf.get("total")))
|
||
ro = L.jget("/api/records?page=1&size=10&order=credits_desc")
|
||
chk("按积分降序生效",
|
||
all(ro["items"][i]["credits"] >= ro["items"][i + 1]["credits"]
|
||
for i in range(len(ro.get("items", [])) - 1)))
|
||
|
||
print("== 7. 凭据不外泄 ==")
|
||
stj = L.jget("/api/settings")
|
||
chk("settings 无 cookie 明文字段", "cookie" not in stj, "keys=%s" % list(stj.keys()))
|
||
chk("settings 仅回 cookie_hint 掩码",
|
||
bool(stj.get("cookie_hint")) and len(str(stj.get("cookie_hint"))) < 200,
|
||
"hint=%s" % stj.get("cookie_hint"))
|
||
chk("配置页 HTML 不含 cookie 明文", "eyJ" not in L.get("/config")[1])
|
||
|
||
print("== 8. 错误处理 ==")
|
||
for p in ("/api/nope", "/nope"):
|
||
st, _ = L.get(p)
|
||
chk("GET %-12s =404" % p, st == 404, "status=%s" % st)
|
||
for p in ("/api/summary?from=abc&to=def", "/api/daily?from=2026-13-99"):
|
||
st, _ = L.get(p)
|
||
chk("GET %-32s 非法日期=400" % p, st == 400, "status=%s" % st)
|
||
|
||
print("== 9. 新增能力：用户管理 / 审计 / 流式导出 ==")
|
||
st, html = L.get("/users")
|
||
chk("GET /users 管理员可达", st == 200 and "用户管理" in html, "status=%s" % st)
|
||
chk("用户管理页不回传口令散列", "pbkdf2:" not in html)
|
||
au = L.jget("/api/audit?size=5")
|
||
chk("GET /api/audit 结构完整",
|
||
all(k in au for k in ("total", "page", "size", "pages", "actions", "items")),
|
||
"keys=%s" % list(au.keys()))
|
||
chk("审计条目带 actor/action/at",
|
||
not au.get("items") or {"actor", "action", "at"} <= set(au["items"][0]),
|
||
"n=%d" % len(au.get("items", [])))
|
||
|
||
st, csv_body = L.get("/records/export?from=%s&to=%s" % (frm, to))
|
||
chk("GET /records/export=200", st == 200, "status=%s" % st)
|
||
chk("导出带 UTF-8 BOM（Excel 不乱码）", csv_body.startswith("\ufeff"))
|
||
lines = [x for x in csv_body.lstrip("\ufeff").split("\r\n") if x]
|
||
chk("导出表头为官网同构列",
|
||
lines and lines[0] == "RequestID,积分消耗,User Prompt,模型,客户端,时间",
|
||
"header=%s" % (lines[0] if lines else None))
|
||
chk("导出行数 == 窗口记录数 + 表头", len(lines) == (sm.get("records") or 0) + 1,
|
||
"csv=%d 记录=%s" % (len(lines), sm.get("records")))
|
||
r1 = L.jget("/api/records?page=1&size=1&from=%s&to=%s" % (frm, to))
|
||
first_id = ((r1.get("items") or [{}])[0]).get("request_id")
|
||
chk("导出与明细同源同序（首行 == 明细首条）",
|
||
len(lines) > 1 and bool(first_id) and first_id in lines[1],
|
||
"api=%s csv=%s" % (first_id, (lines[1][:40] if len(lines) > 1 else None)))
|
||
|
||
print("== 10. 安全：开放重定向与凭证外泄 ==")
|
||
L2 = Live(L.base) # 全新会话，避免已登录被直跳
|
||
st, html = L2.get("/login")
|
||
m = re.search(r'name="_csrf"\s+value="([^"]+)"', html)
|
||
csrf = m.group(1) if m else ""
|
||
st, loc = L2.post_raw("/login", {"username": user, "password": pwd,
|
||
"_csrf": csrf, "next": "//evil.com"})
|
||
chk("next=//evil.com 被拒（不出现协议相对跳转）",
|
||
st == 302 and "evil.com" not in (loc or "") and not (loc or "").startswith("//"),
|
||
"status=%s Location=%s" % (st, loc))
|
||
L3 = Live(L.base)
|
||
st, html = L3.get("/login")
|
||
m = re.search(r'name="_csrf"\s+value="([^"]+)"', html)
|
||
st, loc = L3.post_raw("/login", {"username": user, "password": pwd,
|
||
"_csrf": m.group(1) if m else "", "next": "/records"})
|
||
chk("next=/records 站内路径正常放行", st == 302 and loc == "/records",
|
||
"status=%s Location=%s" % (st, loc))
|
||
st, loc = L3.post_raw("/login", {"username": user, "password": pwd, "_csrf": "wrong"})
|
||
chk("错误 CSRF 的登录 POST=400", st == 400, "status=%s" % st)
|
||
st, body = L.get("/logout")
|
||
chk("GET /logout 不执行退出（仅提示）", st == 200 and "退出" in body, "status=%s" % st)
|
||
st, html = L.get("/")
|
||
chk("GET /logout 后仍处于登录态", st == 200 and "概览" in html, "status=%s" % st)
|
||
|
||
|
||
def main() -> int:
|
||
ap = argparse.ArgumentParser(description="对运行中的用量门户做端到端验收")
|
||
ap.add_argument("--base", default="http://127.0.0.1:8848", help="服务地址")
|
||
ap.add_argument("-u", "--user", default="admin", help="登录用户名")
|
||
ap.add_argument("-p", "--password", default="admin123", help="登录密码")
|
||
ap.add_argument("--from", dest="frm", default="2026-09-08", help="验收窗口起")
|
||
ap.add_argument("--to", dest="to", default="2026-09-14", help="验收窗口止")
|
||
ap.add_argument("--timeout", type=int, default=20)
|
||
a = ap.parse_args()
|
||
|
||
print("目标：%s 窗口：%s ~ %s\n" % (a.base, a.frm, a.to))
|
||
run(Live(a.base, a.timeout), a.user, a.password, a.frm, a.to)
|
||
print("\nRESULT: ok=%d fail=%d" % (OK, FAIL))
|
||
if FAILS:
|
||
print("失败项：%s" % "、".join(FAILS))
|
||
return 1 if FAIL else 0
|
||
|
||
|
||
if __name__ == "__main__":
|
||
sys.exit(main())
|