@oj-module/cli 0.2.46 → 0.2.48

package/templates/tests/wecom-endpoints.spec.ts

@@ -5,12 +5,13 @@
 //   2. 企微事件端点必须回**纯文本** success / echostr（JSON 信封 = 企微判失败 → 重推三次）；
 //   3. 回调链的租户来自服务端推导（state→profile → db.asTenant），且票据只能兑换一次。
 //
-// json / vars / kv / fetch / crypto 全部桩掉（oj 运行时全局同名同面）；密文用 WebCrypto 现造，
+// json / vars / kv / fetch / crypto 全部桩掉（oj 运行时全局同名同面）；密文用 node:crypto 现造，
 // 与 wecom-crypt.spec.ts 同一对照物，不拿自实现给自己背书。
 /* eslint-disable test/prefer-lowercase-title -- AC 编号是验收锚点，保留大写 */
-import { webcrypto } from "node:crypto";
+import { Buffer } from "node:buffer";
+import { createCipheriv, webcrypto } from "node:crypto";
 import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
-import { bytesToB64, utf8Bytes, wecomSignature } from "../src/auth/api/_shared/wecom/crypt";
+import { bytesToB64, sha1Hex, utf8Bytes, wecomSignature } from "../src/auth/api/_shared/wecom/crypt";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -110,21 +111,24 @@ function installCrypto(): void {
 	Object.defineProperty(globalThis, "crypto", { value: c, configurable: true });
 }
 
-/** 企微侧 webhook 的密文包（random|len|msg|receiveid → AES-256-CBC/PKCS#7） */
+/**
+ * 企微侧 webhook 的密文包（random|len|msg|receiveid → AES-256-CBC，PKCS#7 **补到 32 字节**）。
+ *
+ * 补到 32 而不是 16：企微（90968）就是这么补的，补位值会落在 1~32——用 WebCrypto 的默认补位
+ * （固定 16 字节块）会永远只覆盖到 1~16，正好把线上约一半的报文排除在测试之外（真踩过）。
+ * 所以这里用 node:crypto 并关掉自动补位，自己按 32 补。
+ */
 async function seal(plain: string, receiveId = SUITE): Promise<string> {
 	const msg = utf8Bytes(plain);
 	const head = webcrypto.getRandomValues(new Uint8Array(16));
 	const len = new Uint8Array(4);
 	new DataView(len.buffer).setUint32(0, msg.length);
 	const recv = utf8Bytes(receiveId);
-	const buf = new Uint8Array(20 + msg.length + recv.length);
-	buf.set(head, 0);
-	buf.set(len, 16);
-	buf.set(msg, 20);
-	buf.set(recv, 20 + msg.length);
-	const key = await webcrypto.subtle.importKey("raw", AES_KEY, { name: "AES-CBC" }, false, ["encrypt"]);
-	const cipher = new Uint8Array(await webcrypto.subtle.encrypt({ name: "AES-CBC", iv: AES_KEY.subarray(0, 16) }, key, buf));
-	return bytesToB64(cipher);
+	const body = Buffer.concat([Buffer.from(head), Buffer.from(len), Buffer.from(msg), Buffer.from(recv)]);
+	const pad = 32 - (body.length % 32);
+	const cipher = createCipheriv("aes-256-cbc", Buffer.from(AES_KEY), Buffer.from(AES_KEY.subarray(0, 16)));
+	cipher.setAutoPadding(false);
+	return Buffer.concat([cipher.update(Buffer.concat([body, Buffer.alloc(pad, pad)])), cipher.final()]).toString("base64");
 }
 
 function request(opts: { query?: Record<string, string>, body?: unknown, headers?: Record<string, string>, tenantId?: string } = {}): void {
@@ -163,7 +167,7 @@ beforeEach(() => {
 	installKv();
 	installCrypto();
 	g.fetch = async () => ({ ok: true, json: async () => ({}) });
-	for (const t of ["wecom_app_profile", "wecom_suite_ticket", "wecom_login_ticket", "sys_refresh_token", "sys_login_throttle", "sys_rate_window", "sys_oplog"])
+	for (const t of ["wecom_app_profile", "wecom_suite_ticket", "wecom_login_ticket", "sys_refresh_token", "sys_login_throttle", "sys_rate_window", "sys_oplog", "sys_dept_member", "sys_department"])
 		dbo.exec(`DELETE FROM ${t}`);
 	// JIT 建号是跨用例污染源：每个用例都从「本企业还没建过号」起步
 	dbo.exec("DELETE FROM users WHERE source = 'wecom'");
@@ -374,6 +378,28 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		return { ...query, msg_signature: wecomSignature(TOKEN, query.timestamp, query.nonce, encrypted) };
 	}
 
+	/** 抓这一段里所有 log.info / log.warn 的 (msg, kv)：验收看的是日志，不是只看 HTTP 200 */
+	async function captureLogs(fn: () => Promise<void>): Promise<unknown[][]> {
+		const lines: unknown[][] = [];
+		const orig = g.log;
+		const push = (msg: string, ...kv: unknown[]) => void lines.push([msg, kv]);
+		g.log = { ...orig, info: push, warn: push };
+		try {
+			await fn();
+		}
+		finally {
+			g.log = orig;
+		}
+		return lines;
+	}
+
+	/** 取某条日志的 kv 片段；没这条就当场失败，别让后面的断言在 undefined 上跑 */
+	function logOf(lines: unknown[][], msg: string): unknown {
+		const line = lines.find(a => a[0] === msg);
+		expect(line, `没抓到日志：${msg}`).toBeDefined();
+		return line![1];
+	}
+
 	it("URL 验证：验签通过 → 以 text/plain 原样回解出的 echostr（不套信封）", async () => {
 		const echo = await seal("echo_12345");
 		request({ query: { ...signedQuery(echo), echostr: echo } });
@@ -403,7 +429,8 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(out.body.msg).toMatch(/签名/);
 	});
 
-	it("指令回调：验签+解密 → 落 suite_ticket → 回纯文本 success", async () => {
+	it("指令回调（文档形态：XML）→ 落 suite_ticket → 回纯文本 success", async () => {
+		// 96238 §3.2 的报文就是这个形状，也是线上真正会到的形态
 		const plain = "<xml><InfoType>suite_ticket</InfoType><SuiteId>suite_1</SuiteId><SuiteTicket>tk_9</SuiteTicket></xml>";
 		const encrypted = await seal(plain);
 		request({ query: signedQuery(encrypted), body: `<xml><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>` });
@@ -413,6 +440,117 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_9" });
 	});
 
+	it("指令回调（JSON 包体）：信封小写键 + 明文字段照常落库", async () => {
+		// 回调地址不带 callback_format=json（文档没覆盖这个参数，见 config.ts::eventUrlOf），
+		// 但归一化那层两种都认：万一上游改发 JSON，上下两层分别是
+		// {"tousername","encrypt","agentid"}（小写）与 {"InfoType",…}（大写）。
+		// 这条钉的是「大小写不敏感」这一层，别再让人回头改一次字段名。
+		const plain = JSON.stringify({ InfoType: "suite_ticket", SuiteId: SUITE, SuiteTicket: "tk_json" });
+		const encrypted = await seal(plain);
+		request({ query: signedQuery(encrypted), body: { tousername: SUITE, encrypt: encrypted, agentid: "100001" } });
+		await (await api()).event.post();
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_json" });
+	});
+
+	it("指令回调（JSON 字符串包体）：未经框架解析的原始串也能归一", async () => {
+		const plain = JSON.stringify({ InfoType: "suite_ticket", SuiteId: SUITE, SuiteTicket: "tk_str" });
+		const encrypted = await seal(plain);
+		request({ query: signedQuery(encrypted), body: JSON.stringify({ tousername: SUITE, encrypt: encrypted }) });
+		await (await api()).event.post();
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(dbo.prepare("SELECT suite_ticket FROM wecom_suite_ticket WHERE suite_id = ?").get(SUITE)).toMatchObject({ suite_ticket: "tk_str" });
+	});
+
+	it("数据回调 change_contact（应用侧形态：MsgType/Event，无 InfoType）→ 走轨三建档", async () => {
+		// 90970「成员变更通知」的原样字段：ToUserName/FromUserName/CreateTime/MsgType=event/
+		// Event=change_contact/ChangeType/UserID/Name/Department。
+		// 这条钉的是整条接线：解密 → 按 Event 分流（InfoType 为空）→ 绑租户 → 落库。
+		seedCorp();
+		const plain = [
+			"<xml>",
+			"<ToUserName><![CDATA[ww_corp_a]]></ToUserName>",
+			"<FromUserName><![CDATA[sys]]></FromUserName>",
+			"<CreateTime>1700000000</CreateTime>",
+			"<MsgType><![CDATA[event]]></MsgType>",
+			"<Event><![CDATA[change_contact]]></Event>",
+			"<ChangeType><![CDATA[create_user]]></ChangeType>",
+			"<UserID><![CDATA[zhangsan]]></UserID>",
+			"<Name><![CDATA[张三]]></Name>",
+			"<Department>1</Department>",
+			"</xml>",
+		].join("");
+		// 应用回调的 receiveid 是 **corpid**（90968 附注），不是 suiteid——信封 ToUserName 也是它
+		const encrypted = await seal(plain, "ww_corp_a");
+		const lines = await captureLogs(async () => {
+			request({
+				query: signedQuery(encrypted),
+				body: `<xml><ToUserName><![CDATA[ww_corp_a]]></ToUserName><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>`,
+			});
+			await (await api()).event.post();
+		});
+
+		// 无论处理成没成，都必须回 success：否则企微 5 秒后重推三次
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(logOf(lines, "wecom change_contact applied")).toEqual(["changeType", "create_user", "corpId", "ww_corp_a"]);
+
+		// 上游在本用例里拿不到 token（user/get 取不到）→ 退回事件自带字段：
+		// 姓名落库、**activated 保持 0**（建档 ≠ 用过本站，§9.1 的通讯录目录只收登录过的人）
+		expect(dbo.prepare("SELECT display_name, source, activated FROM users WHERE username = ?").get("wecom:zhangsan"))
+			.toMatchObject({ display_name: "张三", source: "wecom", activated: 0 });
+		// 值一律不进日志（姓名、工号都在明文里）
+		expect(JSON.stringify(lines)).not.toContain("张三");
+		expect(JSON.stringify(lines)).not.toContain("zhangsan");
+	});
+
+	it("数据回调 change_contact（代开发形态：InfoType）→ 同样进轨三，只给 Id 也能落库", async () => {
+		// 91134「成员通知事件」走的是模板指令回调，字段是 SuiteId/AuthCorpId/InfoType=change_contact，
+		// 没有 MsgType/Event。它与 suite_ticket 同用 InfoType 那一列，分流必须在 switch 之前——
+		// 落进 default 只会被记成「不消费的事件」，页面永远等不到部门。
+		seedCorp();
+		const plain = [
+			"<xml>",
+			"<SuiteId><![CDATA[suite_1]]></SuiteId>",
+			"<AuthCorpId><![CDATA[ww_corp_a]]></AuthCorpId>",
+			"<InfoType><![CDATA[change_contact]]></InfoType>",
+			"<ChangeType><![CDATA[update_party]]></ChangeType>",
+			"<Id>2</Id>",
+			"<Name><![CDATA[研发部]]></Name>",
+			"<ParentId>1</ParentId>",
+			"</xml>",
+		].join("");
+		const encrypted = await seal(plain);
+		const lines = await captureLogs(async () => {
+			request({ query: signedQuery(encrypted), body: `<xml><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>` });
+			await (await api()).event.post();
+		});
+
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(logOf(lines, "wecom change_contact applied")).toEqual(["changeType", "update_party", "corpId", "ww_corp_a"]);
+		expect(dbo.prepare("SELECT origin, origin_id, name, deleted FROM sys_department WHERE origin = 'wecom'").get())
+			.toMatchObject({ origin: "wecom", origin_id: "2", name: "研发部", deleted: 0 });
+		expect(JSON.stringify(lines)).not.toContain("研发部");
+	});
+
+	it("未授权企业的通讯录事件：只记一笔，照旧回 success（事件是加速器不是权威）", async () => {
+		// 没 seedCorp：企业没授权、没有永久码，什么都不该写——但也不能抛，
+		// 否则企微重推三次，而重推补不回「这家企业没授权」。
+		const plain = "<xml><ToUserName><![CDATA[ww_corp_z]]></ToUserName><MsgType>event</MsgType><Event>change_contact</Event><ChangeType>delete_user</ChangeType><UserID>lisi</UserID></xml>";
+		const encrypted = await seal(plain, "ww_corp_z");
+		const lines = await captureLogs(async () => {
+			request({ query: signedQuery(encrypted), body: `<xml><ToUserName><![CDATA[ww_corp_z]]></ToUserName><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>` });
+			await (await api()).event.post();
+		});
+		expect(out.status).toBe(200);
+		expect(out.text).toBe("success");
+		expect(JSON.stringify(logOf(lines, "wecom change_contact ignored"))).toContain("未授权");
+		expect(dbo.prepare("SELECT COUNT(*) AS n FROM users WHERE source = 'wecom'").get()).toMatchObject({ n: 0 });
+	});
+
 	it("报文缺 Encrypt → 400", async () => {
 		request({ query: signedQuery("x"), body: "<xml></xml>" });
 		await (await api()).event.post();
@@ -427,6 +565,36 @@ describe("P1-L：GET/POST /auth/wecom/event（企微指令回调）", () => {
 		expect(dbo.prepare("SELECT COUNT(*) AS n FROM wecom_suite_ticket").get()).toMatchObject({ n: 0 });
 	});
 
+	it("EncodingAESKey 与后台不一致（签名过、解密爆 pkcs7）→ 400，日志点名是哪一侧配错", async () => {
+		// 用户实报的原样症状：WARN reason=pkcs7: bad padding。签名先过说明后台 Token 与本部署一致，
+		// 所以只回一句 bad padding 等于没给线索——日志必须带「外层 ToUserName / 配置套件 / 实际加载的密钥指纹」。
+		const warns: unknown[][] = [];
+		const orig = g.log;
+		g.log = { ...orig, warn: (msg: string, ...kv: unknown[]) => warns.push([msg, kv]) };
+		try {
+			const encrypted = await seal(TICKET_XML);
+			// 后台用真钥匙加密，本部署加载另一把 43 字符（仍解 32 字节，不会先撞长度校验）
+			installVars({ wecom_encoding_aes_key: "Q".repeat(43) });
+			request({
+				query: signedQuery(encrypted),
+				body: `<xml><ToUserName><![CDATA[${SUITE}]]></ToUserName><Encrypt><![CDATA[${encrypted}]]></Encrypt></xml>`,
+			});
+			await (await api()).event.post();
+		}
+		finally {
+			g.log = orig;
+		}
+
+		expect(out.status).toBe(400);
+		expect(out.body.msg).toMatch(/解密失败/);
+		const hit = warns.find(w => w[0] === "wecom callback decrypt failed");
+		expect(hit).toBeDefined();
+		const kv = hit![1] as unknown[];
+		expect(kv).toContain("pkcs7: bad padding");
+		expect(kv).toContain(SUITE); // envelopeToUser 与 configuredSuite 同值 → 指向「密钥不一致」而不是「套件不对」
+		expect(kv).toContain(sha1Hex("Q".repeat(43)).slice(0, 8));
+	});
+
 	it("timestamp 超出 ±5 分钟窗口 → 400（历史回调不得被无限期重放）", async () => {
 		const encrypted = await seal(TICKET_XML);
 		const stale = String(nowSecs() - 8 * 60);