@wdyy/skills 0.1.23 → 0.1.24

package/.well-known/skills/wdyy-logging-standard/scripts/validate-log-entry.test.mjs

@@ -1,179 +1,455 @@
 import assert from 'node:assert/strict';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, test } from 'node:test';
-import { spawnSync } from 'node:child_process';
 import {
+  BusinessFunctionCatalog,
   createLogFileName,
   createLogFilePath,
+  createTraceContext,
   LOG_DIRECTORY,
   MAX_LOG_FILE_SIZE_BYTES,
+  MIN_NETWORK_LOG_RETENTION_MONTHS,
+  requireSourceIp,
+  resolveActorContext,
+  sanitizeLogValue,
+  SecureLogWriter,
+  toLogEntry,
 } from '../templates/logger.template.ts';
+import {
+  createTraceContext as createFrontendTraceContext,
+  sanitizeFrontendErrorReport,
+} from '../templates/frontend-error-report.template.ts';
+
+process.env.TZ = 'Asia/Shanghai';
 
 const validator = new URL('./validate-log-entry.mjs', import.meta.url);
+const loggerTemplate = new URL('../templates/logger.template.ts', import.meta.url);
+const skillRoot = new URL('..', import.meta.url);
 const temporaryDirectories = [];
+const fixedDate = new Date('2026-07-09T08:00:00+08:00');
 
 afterEach(async () => {
   await Promise.all(
-    temporaryDirectories.splice(0).map((directory) =>
-      rm(directory, { force: true, recursive: true }),
-    ),
+    temporaryDirectories.splice(0).map((directory) => rm(directory, { force: true, recursive: true })),
   );
 });
 
-async function validate(entry) {
-  const directory = await mkdtemp(join(tmpdir(), 'log-entry-'));
+async function createTemporaryDirectory() {
+  const directory = await mkdtemp(join(tmpdir(), 'secure-log-'));
   temporaryDirectories.push(directory);
-  const input = join(directory, 'entry.json');
-  await writeFile(input, JSON.stringify(entry));
-  return spawnSync(process.execPath, [validator.pathname, input], { encoding: 'utf8' });
+  return directory;
 }
 
-test('同一秒日志文件使用递增后缀', () => {
-  const date = new Date(2026, 6, 28, 9, 5, 3);
-
-  assert.deepEqual(
-    [createLogFileName(date), createLogFileName(date, 1), createLogFileName(date, 2)],
-    ['2026-07-28_09-05-03.log', '2026-07-28_09-05-03_1.log', '2026-07-28_09-05-03_2.log'],
+async function validate(entry, stored = false) {
+  const directory = await createTemporaryDirectory();
+  const input = join(directory, 'entry.log');
+  await writeFile(input, stored ? entry : JSON.stringify(entry));
+  return spawnSync(
+    process.execPath,
+    [...(stored ? ['--experimental-strip-types'] : []), validator.pathname, ...(stored ? ['--stored'] : []), input],
+    { encoding: 'utf8', env: { ...process.env, TZ: 'Asia/Shanghai' } },
   );
-});
+}
 
-test('日志路径固定在项目根目录的扁平 logs 目录', () => {
-  const date = new Date(2026, 6, 28, 9, 5, 3);
+function validAccessEntry(overrides = {}) {
+  return {
+    timestamp: '2026-07-09 08:00:00',
+    timestampEpochMs: fixedDate.getTime(),
+    timezone: '+08:00',
+    level: 'info',
+    service: 'backend',
+    instanceId: 'blue',
+    env: 'production',
+    logType: 'access',
+    message: 'request completed',
+    traceId: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+    method: 'GET',
+    route: '/patients/:patientId',
+    sourceIp: '10.0.0.8',
+    actorId: 'user-1',
+    actorType: 'employee',
+    functionCode: 'patient.query',
+    functionName: '患者信息查询',
+    action: 'read',
+    statusCode: 200,
+    result: 'success',
+    durationMs: 12.5,
+    ...overrides,
+  };
+}
+
+function validSecurityEntry(overrides = {}) {
+  return {
+    timestamp: '2026-07-09 08:00:00',
+    timestampEpochMs: fixedDate.getTime(),
+    timezone: '+08:00',
+    level: 'warn',
+    service: 'backend',
+    instanceId: 'blue',
+    env: 'production',
+    logType: 'security',
+    message: 'access denied',
+    eventId: 'event-1',
+    eventType: 'access.denied',
+    actorId: 'user-1',
+    actorType: 'employee',
+    action: 'patient.read',
+    targetType: 'patient',
+    targetId: 'patient-1',
+    result: 'failure',
+    reason: 'permission denied',
+    ...overrides,
+  };
+}
+
+function runWriter(directory, body) {
+  const source = `
+    import { SecureLogWriter, toLogEntry } from ${JSON.stringify(loggerTemplate.href)};
+    process.env.TZ = 'Asia/Shanghai';
+    const fixedDate = new Date('2026-07-09T08:00:00+08:00');
+    const writer = new SecureLogWriter(() => fixedDate);
+    ${body}
+    await writer.close();
+  `;
+  return spawnSync(process.execPath, ['--experimental-strip-types', '--input-type=module', '--eval', source], {
+    cwd: directory,
+    encoding: 'utf8',
+    env: { ...process.env, TZ: 'Asia/Shanghai' },
+  });
+}
 
+test('固定根日志路径、2MB 阈值和六个月留存合同', () => {
   assert.equal(LOG_DIRECTORY, './logs');
+  assert.equal(MAX_LOG_FILE_SIZE_BYTES, 2 * 1024 * 1024);
+  assert.equal(MIN_NETWORK_LOG_RETENTION_MONTHS, 6);
+  assert.equal(createLogFileName(fixedDate), '2026-07-09_08-00-00.log');
+  assert.equal(createLogFilePath(fixedDate, 2), './logs/2026-07-09_08-00-00_2.log');
+});
+
+test('完整业务结构保留但秘密和敏感个人信息被递归删除', () => {
+  const sanitized = sanitizeLogValue({
+    orderId: 'order-1',
+    nested: {
+      password: 'not-allowed',
+      Authorization: 'Bearer not-allowed',
+      idCard: '110101199001011234',
+      medicalRecord: { diagnosis: 'not-allowed' },
+      items: [{ sku: 'A', token: 'not-allowed' }],
+    },
+  });
+
+  assert.deepEqual(sanitized, {
+    orderId: 'order-1',
+    nested: { items: [{ sku: 'A' }] },
+  });
+});
+
+test('项目确认的附加敏感字段也会被删除', () => {
   assert.deepEqual(
-    [createLogFilePath(date), createLogFilePath(date, 1), createLogFilePath(date, 2)],
-    [
-      './logs/2026-07-28_09-05-03.log',
-      './logs/2026-07-28_09-05-03_1.log',
-      './logs/2026-07-28_09-05-03_2.log',
-    ],
+    sanitizeLogValue({ orderId: '1', hospitalSecretField: 'remove-me' }, ['hospitalSecretField']),
+    { orderId: '1' },
   );
-  assert.ok(
-    [createLogFilePath(date), createLogFilePath(date, 1), createLogFilePath(date, 2)]
-      .every((path) => path.split('/').length === 3),
+});
+
+test('访问日志强制关键字段并映射 HTTP 结果', () => {
+  const trace = createTraceContext();
+  const entry = toLogEntry('info', 'request completed', {
+    logType: 'access',
+    traceId: trace.traceId,
+    spanId: trace.spanId,
+    method: 'POST',
+    route: '/inventory/:inventoryId',
+    sourceIp: '10.0.0.8',
+    actorId: 'user-1',
+    actorType: 'employee',
+    functionCode: 'inventory.update',
+    functionName: '库存更新',
+    action: 'update',
+    statusCode: 422,
+    durationMs: 7,
+  }, fixedDate);
+
+  assert.equal(entry.result, 'failure');
+  assert.equal(entry.timezone, '+08:00');
+  assert.throws(
+    () => toLogEntry('info', 'incomplete', { logType: 'access' }, fixedDate),
+    /Missing access log fields/,
   );
 });
 
-test('旧日志目录环境变量不能改变固定路径', () => {
-  const previousLogDir = process.env.LOG_DIR;
-  const previousHostLogDir = process.env.HOST_LOG_DIR;
-  process.env.LOG_DIR = '/tmp/legacy-logs';
-  process.env.HOST_LOG_DIR = '/srv/legacy-logs';
+test('显式功能目录按 method 与路由解析且拒绝缺失或重复映射', () => {
+  const catalog = new BusinessFunctionCatalog([{
+    method: 'GET',
+    route: '/patients/:patientId',
+    functionCode: 'patient.query',
+    functionName: '患者信息查询',
+    action: 'read',
+  }]);
+  assert.deepEqual(catalog.resolve('get', '/patients/:patientId'), {
+    functionCode: 'patient.query',
+    functionName: '患者信息查询',
+    action: 'read',
+  });
+  assert.throws(() => catalog.resolve('POST', '/patients/:patientId'), /Missing business function mapping/);
+  assert.throws(() => new BusinessFunctionCatalog([
+    {
+      method: 'GET', route: '/patients', functionCode: 'patient.list', functionName: '患者列表', action: 'read',
+    },
+    {
+      method: 'get', route: '/patients', functionCode: 'patient.query', functionName: '患者查询', action: 'read',
+    },
+  ]), /Duplicate business function mapping/);
+});
 
-  try {
-    assert.equal(
-      createLogFilePath(new Date(2026, 6, 28, 9, 5, 3)),
-      './logs/2026-07-28_09-05-03.log',
-    );
-  } finally {
-    if (previousLogDir === undefined) delete process.env.LOG_DIR;
-    else process.env.LOG_DIR = previousLogDir;
-    if (previousHostLogDir === undefined) delete process.env.HOST_LOG_DIR;
-    else process.env.HOST_LOG_DIR = previousHostLogDir;
+test('认证和匿名主体语义明确且不接受不完整身份', () => {
+  assert.deepEqual(resolveActorContext(), { actorId: 'anonymous', actorType: 'anonymous' });
+  assert.deepEqual(resolveActorContext({ id: 'user-1', type: 'employee' }), {
+    actorId: 'user-1', actorType: 'employee',
+  });
+  assert.throws(() => resolveActorContext({ id: 'user-1' }), /both id and type/);
+});
+
+test('访问日志拒绝无效 IP、未知功能和缺少主体', async () => {
+  for (const [overrides, expected] of [
+    [{ sourceIp: 'unknown' }, /valid IPv4 or IPv6/],
+    [{ functionCode: undefined }, /Missing access log fields.*functionCode/],
+    [{ functionCode: 'Patient Query' }, /stable lowercase business identifier/],
+    [{ functionCode: 'unknown' }, /stable lowercase business identifier/],
+    [{ functionName: '待确认' }, /resolved non-empty business name/],
+    [{ actorId: undefined }, /Missing access log fields.*actorId/],
+  ]) {
+    const result = await validate(validAccessEntry(overrides));
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, expected);
   }
+  assert.equal(requireSourceIp('2001:db8::1'), '2001:db8::1');
+  assert.throws(() => requireSourceIp('unknown'), /valid IPv4 or IPv6/);
 });
 
-test('2MB 轮转阈值使用同一 logs 目录的下一个候选路径', () => {
-  const date = new Date(2026, 6, 28, 9, 5, 3);
+test('访问日志拒绝原始查询 URL 和无效 traceId', async () => {
+  const rawRoute = await validate(validAccessEntry({ route: '/patients/1?token=secret' }));
+  assert.notEqual(rawRoute.status, 0);
+  assert.match(rawRoute.stderr, /route template/);
 
-  assert.equal(MAX_LOG_FILE_SIZE_BYTES, 2 * 1024 * 1024);
-  assert.equal(createLogFilePath(date, 3), './logs/2026-07-28_09-05-03_3.log');
+  const invalidTrace = await validate(validAccessEntry({ traceId: '00000000000000000000000000000000' }));
+  assert.notEqual(invalidTrace.status, 0);
+  assert.match(invalidTrace.stderr, /traceId/);
 });
 
-test('多进程日志必须包含 instanceId', async () => {
-  const result = await validate({
-    timestamp: '2026-07-09 08:00:00',
-    level: 'info',
-    service: 'backend',
-    instanceId: 'blue',
-    env: 'production',
-    message: 'request completed',
-  });
+test('有效 traceparent 延续 trace，无效值生成新上下文', () => {
+  const incoming = '00-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbb-01';
+  const continued = createTraceContext(incoming);
+  assert.equal(continued.traceId, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+  assert.equal(continued.parentSpanId, 'bbbbbbbbbbbbbbbb');
+  assert.match(continued.traceparent, /^00-a{32}-[0-9a-f]{16}-01$/);
 
-  assert.equal(result.status, 0, result.stderr);
+  const replaced = createTraceContext('00-00000000000000000000000000000000-0000000000000000-01');
+  assert.match(replaced.traceparent, /^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/);
+  assert.notEqual(replaced.traceId, '00000000000000000000000000000000');
 });
 
-test('缺少 instanceId 时明确失败', async () => {
-  const result = await validate({
-    timestamp: '2026-07-09 08:00:00',
-    level: 'info',
-    service: 'backend',
-    env: 'production',
-    message: 'request completed',
-  });
+test('安全与审计失败事件必须包含原因', () => {
+  assert.doesNotThrow(() => toLogEntry('warn', 'denied', {
+    logType: 'security',
+    eventId: 'event-1',
+    eventType: 'access.denied',
+    actorId: 'user-1',
+    actorType: 'employee',
+    action: 'patient.read',
+    targetType: 'patient',
+    targetId: 'patient-1',
+    result: 'failure',
+    reason: 'permission denied',
+  }, fixedDate));
+  assert.throws(
+    () => toLogEntry('warn', 'denied', {
+      logType: 'security',
+      eventId: 'event-1',
+      eventType: 'access.denied',
+      actorId: 'user-1',
+      actorType: 'employee',
+      action: 'patient.read',
+      targetType: 'patient',
+      targetId: 'patient-1',
+      result: 'failure',
+    }, fixedDate),
+    /require reason/,
+  );
+  const auditEntry = toLogEntry('info', 'permission changed', {
+    logType: 'audit',
+    eventId: 'event-2',
+    eventType: 'permission.changed',
+    actorId: 'admin-1',
+    actorType: 'employee',
+    action: 'permission.update',
+    targetType: 'role',
+    targetId: 'role-1',
+    result: 'success',
+    before: { permission: 'read' },
+    after: { permission: 'write', token: 'not-allowed' },
+  }, fixedDate);
+  assert.deepEqual(auditEntry.after, { permission: 'write' });
+});
+
+test('请求触发的安全审计日志要求完整功能和来源上下文', () => {
+  assert.doesNotThrow(() => toLogEntry('warn', 'denied', {
+    ...validSecurityEntry(),
+    traceId: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+    sourceIp: '10.0.0.8',
+    route: '/patients/:patientId',
+    functionCode: 'patient.query',
+    functionName: '患者信息查询',
+  }, fixedDate));
+  assert.throws(() => toLogEntry('warn', 'denied', {
+    ...validSecurityEntry(),
+    traceId: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+    sourceIp: '10.0.0.8',
+  }, fixedDate), /require traceId, sourceIp, route, functionCode and functionName/);
+});
 
+test('校验器拒绝绕过净化的秘密字段', async () => {
+  const result = await validate(validAccessEntry({ body: { password: 'not-allowed' } }));
   assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /instanceId/);
+  assert.match(result.stderr, /Forbidden log field.*password/);
 });
 
-test('HTTP 状态码与 result 不一致时明确失败', async () => {
-  const result = await validate({
-    timestamp: '2026-07-09 08:00:00',
-    level: 'info',
-    service: 'backend',
-    instanceId: 'blue',
-    env: 'production',
-    message: 'request completed',
-    statusCode: 201,
-    result: 'failure',
-  });
+test('日志消息换行被编码而不是注入新日志行', () => {
+  const entry = toLogEntry('info', 'first\nsecond\rthird token=secret-value', {
+    logType: 'application',
+    params: { note: 'Bearer abc.def', orderId: 'order-1' },
+  }, fixedDate);
+  assert.equal(entry.message, 'first\\nsecond\\rthird token=[REMOVED]');
+  assert.deepEqual(entry.params, { note: 'Bearer [REMOVED]', orderId: 'order-1' });
+  assert.equal(JSON.stringify(entry).split('\n').length, 1);
+});
 
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /result/);
+test('前端 trace 在缺少 Web Crypto 时仍有效且不会阻断请求', () => {
+  const descriptor = Object.getOwnPropertyDescriptor(globalThis, 'crypto');
+  Object.defineProperty(globalThis, 'crypto', { configurable: true, value: undefined });
+  try {
+    const trace = createFrontendTraceContext();
+    assert.match(trace.traceparent, /^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/);
+  } finally {
+    if (descriptor) Object.defineProperty(globalThis, 'crypto', descriptor);
+    else delete globalThis.crypto;
+  }
 });
 
-test('完整原始入参和成功响应可通过验证', async () => {
-  const result = await validate({
-    timestamp: '2026-07-09 08:00:00',
-    level: 'info',
-    service: 'backend',
-    instanceId: 'blue',
-    env: 'production',
-    message: 'request completed',
-    query: { page: '1' },
-    body: {
-      password: 'unredacted',
-      idCard: '110101199001011234',
-      permissions: Array.from({ length: 501 }, (_, index) => index),
-    },
-    response: { code: 'OK', message: '处理成功' },
-    statusCode: 201,
-    result: 'success',
+test('前端异常上报移除查询串和常见凭据', () => {
+  const report = sanitizeFrontendErrorReport({
+    errorName: 'FetchError',
+    message: 'authorization: Bearer abc.def password=hunter2',
+    stack: 'token=secret-value',
+    path: '/login?token=secret#fragment',
+    occurredAt: '2026-07-09T00:00:00.000Z',
   });
+  assert.equal(report.path, '/login');
+  assert.doesNotMatch(JSON.stringify(report), /hunter2|secret-value|abc\.def/);
+});
 
+test('真实写入使用最小权限、单行 JSON 和可验证哈希链', async () => {
+  const directory = await createTemporaryDirectory();
+  const result = runWriter(directory, `
+    await writer.write(toLogEntry('info', 'one', { logType: 'application' }, fixedDate));
+    await writer.write(toLogEntry('info', 'two', { logType: 'application' }, fixedDate));
+  `);
   assert.equal(result.status, 0, result.stderr);
+
+  const logsDirectory = join(directory, 'logs');
+  const files = await readdir(logsDirectory);
+  assert.deepEqual(files, ['2026-07-09_08-00-00.log']);
+  assert.equal((await stat(logsDirectory)).mode & 0o777, 0o700);
+  const logPath = join(logsDirectory, files[0]);
+  assert.equal((await stat(logPath)).mode & 0o777, 0o600);
+  const source = await readFile(logPath, 'utf8');
+  assert.equal(source.trim().split('\n').length, 2);
+  const validation = await validate(source, true);
+  assert.equal(validation.status, 0, validation.stderr);
 });
 
-test('失败响应内容和 failure 结果可通过验证', async () => {
-  const result = await validate({
-    timestamp: '2026-07-09 08:00:00',
-    level: 'info',
-    service: 'backend',
-    instanceId: 'blue',
-    env: 'production',
-    message: 'request failed',
-    body: { data: 'original-request' },
-    response: { code: 'INVALID_DATA', message: '参数不合法' },
-    statusCode: 422,
-    result: 'failure',
-  });
+test('多进程同秒排他创建且不覆盖既有文件', async () => {
+  const directory = await createTemporaryDirectory();
+  const body = "await writer.write(toLogEntry('info', 'entry', { logType: 'application' }, fixedDate));";
+  const first = runWriter(directory, body);
+  const second = runWriter(directory, body);
+  assert.equal(first.status, 0, first.stderr);
+  assert.equal(second.status, 0, second.stderr);
+  assert.deepEqual((await readdir(join(directory, 'logs'))).sort(), [
+    '2026-07-09_08-00-00.log',
+    '2026-07-09_08-00-00_1.log',
+  ]);
+});
 
+test('超过 2MB 时创建新文件并保留既有文件', async () => {
+  const directory = await createTemporaryDirectory();
+  const result = runWriter(directory, `
+    const payload = 'x'.repeat(1_200_000);
+    await writer.write(toLogEntry('info', 'first', { logType: 'application', body: { payload } }, fixedDate));
+    await writer.write(toLogEntry('info', 'second', { logType: 'application', body: { payload } }, fixedDate));
+  `);
   assert.equal(result.status, 0, result.stderr);
+  assert.deepEqual((await readdir(join(directory, 'logs'))).sort(), [
+    '2026-07-09_08-00-00.log',
+    '2026-07-09_08-00-00_1.log',
+  ]);
 });
 
-test('UTC ISO timestamp 时明确失败', async () => {
-  const result = await validate({
-    timestamp: '2026-07-09T00:00:00.000Z',
-    level: 'info',
-    service: 'backend',
-    instanceId: 'blue',
-    env: 'production',
-    message: 'request completed',
+test('跨秒轮转使用新的基础文件名而非沿用冲突后缀', async () => {
+  const directory = await createTemporaryDirectory();
+  const source = `
+    import { SecureLogWriter, toLogEntry } from ${JSON.stringify(loggerTemplate.href)};
+    process.env.TZ = 'Asia/Shanghai';
+    const firstDate = new Date('2026-07-09T08:00:00+08:00');
+    const secondDate = new Date('2026-07-09T08:00:01+08:00');
+    const dates = [firstDate, secondDate];
+    const writer = new SecureLogWriter(() => dates.shift() ?? secondDate);
+    const payload = 'x'.repeat(1_200_000);
+    await writer.write(toLogEntry('info', 'first', { logType: 'application', body: { payload } }, firstDate));
+    await writer.write(toLogEntry('info', 'second', { logType: 'application', body: { payload } }, secondDate));
+    await writer.close();
+  `;
+  const result = spawnSync(process.execPath, ['--experimental-strip-types', '--input-type=module', '--eval', source], {
+    cwd: directory,
+    encoding: 'utf8',
+    env: { ...process.env, TZ: 'Asia/Shanghai' },
   });
+  assert.equal(result.status, 0, result.stderr);
+  assert.deepEqual((await readdir(join(directory, 'logs'))).sort(), [
+    '2026-07-09_08-00-00.log',
+    '2026-07-09_08-00-01.log',
+  ]);
+});
 
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /timestamp/);
+test('篡改落盘记录后完整性验证失败', async () => {
+  const directory = await createTemporaryDirectory();
+  const result = runWriter(directory, `
+    await writer.write(toLogEntry('info', 'original', { logType: 'application' }, fixedDate));
+  `);
+  assert.equal(result.status, 0, result.stderr);
+  const logPath = join(directory, 'logs', '2026-07-09_08-00-00.log');
+  const entry = JSON.parse((await readFile(logPath, 'utf8')).trim());
+  entry.message = 'tampered';
+  const validation = await validate(`${JSON.stringify(entry)}\n`, true);
+  assert.notEqual(validation.status, 0);
+  assert.match(validation.stderr, /integrity verification/);
+});
+
+test('HTTP 与安全审计模板包含真实事件入口且不记录原始 URL', async () => {
+  const middleware = await readFile(new URL('templates/nestjs-http-logging.middleware.template.ts', skillRoot), 'utf8');
+  const securityLogger = await readFile(new URL('templates/security-audit-logger.template.ts', skillRoot), 'utf8');
+  assert.match(middleware, /response\.once\('finish'/);
+  assert.match(middleware, /traceparent/);
+  assert.match(middleware, /functionCatalog\.resolve/);
+  assert.match(middleware, /resolveActorContext/);
+  assert.match(middleware, /requireSourceIp/);
+  assert.doesNotMatch(middleware, /originalUrl/);
+  assert.doesNotMatch(middleware, /['"]unknown['"]/);
+  assert.match(securityLogger, /functionCode/);
+  assert.match(securityLogger, /functionName/);
+  for (const eventName of ['auth.login.failure', 'access.denied', 'permission.changed', 'sensitive-data.export']) {
+    assert.match(securityLogger, new RegExp(eventName.replaceAll('.', '\\.')));
+  }
 });

package/.well-known/skills/wdyy-logging-standard/templates/frontend-error-report.template.ts

@@ -1,4 +1,11 @@
-type FrontendErrorReport = {
+export type FrontendTraceContext = {
+  traceId: string;
+  spanId: string;
+  traceparent: string;
+};
+
+export type FrontendErrorReport = {
+  errorName: string;
   message: string;
   stack?: string;
   path: string;
@@ -6,22 +13,45 @@ type FrontendErrorReport = {
   occurredAt: string;
 };
 
-/**
- * 为 HTTP 请求生成追踪标识。HTTP 非安全上下文可能不提供 crypto.randomUUID，
- * 因此追踪标识必须有非加密用途的回退实现，不能阻断请求。
- */
-export function createTraceId(): string {
-  const cryptoApi = globalThis.crypto;
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID();
+const randomHex = (byteLength: number): string => {
+  const bytes = new Uint8Array(byteLength);
+  if (typeof globalThis.crypto?.getRandomValues === 'function') {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    for (let index = 0; index < bytes.length; index += 1) {
+      bytes[index] = Math.floor(Math.random() * 256);
+    }
   }
+  if (bytes.every((value) => value === 0)) bytes[bytes.length - 1] = 1;
+  return Array.from(bytes, (value) => value.toString(16).padStart(2, '0')).join('');
+};
+
+export function createTraceContext(): FrontendTraceContext {
+  const traceId = randomHex(16);
+  const spanId = randomHex(8);
+  return { traceId, spanId, traceparent: `00-${traceId}-${spanId}-01` };
+}
+
+const sanitizeErrorText = (value: string): string => value
+  .replaceAll(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REMOVED]')
+  .replaceAll(/\b(password|passwd|pwd|token|secret|api[_-]?key)\s*[:=]\s*[^\s,;]+/gi, '$1=[REMOVED]')
+  .replaceAll(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, '[REMOVED_JWT]');
 
-  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+export function sanitizeFrontendErrorReport(report: FrontendErrorReport): FrontendErrorReport {
+  return {
+    ...report,
+    errorName: sanitizeErrorText(report.errorName),
+    message: sanitizeErrorText(report.message),
+    stack: report.stack ? sanitizeErrorText(report.stack) : undefined,
+    path: report.path.split(/[?#]/, 1)[0],
+  };
 }
 
 // Axios 请求拦截器示例：
 // api.interceptors.request.use((config) => {
-//   config.headers.set('x-trace-id', createTraceId());
+//   const trace = createTraceContext();
+//   config.headers.set('traceparent', trace.traceparent);
+//   config.headers.set('x-trace-id', trace.traceId);
 //   return config;
 // });
 
@@ -30,7 +60,7 @@ export async function reportFrontendError(report: FrontendErrorReport): Promise<
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     credentials: 'same-origin',
-    body: JSON.stringify(report),
+    body: JSON.stringify(sanitizeFrontendErrorReport(report)),
   });
   if (!response.ok) throw new Error(`Frontend error report failed: ${response.status}`);
 }