@xiangyang9999/folib-server-scan-export-sync 0.0.0-stage → 1.0.1

package/README.md

@@ -1,3 +1,73 @@
-# Temporary Holding Version
+# @xiangyang9999/folib-server-scan-export-sync
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+版本 `1.0.1`：扫描报告导出测试修复的离线手工同步增量包。
+
+- 源提交：`454e63ce953114b039fe3de06185f5a9a4d1c812`。
+- 相对父提交：`d272e5684448e626126ad070cf9a52a3cc9f1eef`。
+- 使用前提：已同步扫描导出功能提交 `a28ada525f48cf8b6ea3024d4f3eda83cc6d358a`，或旧资料包 `1.0.0`。
+- 共 7 个文件：新增 1 个、修改 6 个；沿用旧包范围，排除 `tools/scan-export/`。
+- 这 7 个文件在 `a28ada52` 与修复提交的父提交之间没有其他改动，可直接接在旧包后同步。
+- 本包从 Git 提交提取代码，不包含当前工作区未提交的修改或中间的前端依赖提交。
+
+## 修复内容
+
+恢复固定的 `org.mockito.internal.creation.bytebuddy.SubclassByteBuddyMockMaker`，移除 web POM 中本功能新增的 MockMaker 属性和测试资源过滤。两个新增导出测试改用真实请求上下文、RepositoryPath 和普通 mock。storage 模块新增 9 项 Repository 查询测试，并修复原漏洞筛选测试的 mock 链及断言。
+
+`ArtifactRepository.java` 的生产实现、storage POM、前端及数据库均没有本次增量变更。旧包中的扫描导出业务代码继续保留；web POM 的变更是恢复原有配置，不添加新的打包或覆盖率参数。
+
+## 包内资料
+
+| 路径 | 内容 |
+| --- | --- |
+| `payload/内网手工同步修改说明.docx` | 同步前提、逐文件说明、新增文件完整代码、修改文件精确差异及验证命令 |
+| `payload/涉及文件_按原路径.zip` | 7 个提交版本文件，保留原路径；附文件清单和含 SHA-256 的 `manifest.json` |
+| `payload/完整变更补丁_供核对.patch` | 本次 7 个文件的精确增量补丁；排除 tools 目录 |
+
+ZIP 中既有文件提供的是完整提交版本，主要用于核对；手工同步时按 Word 或补丁逐段修改，避免覆盖目标环境自身的其他改动。
+
+## 离线安装与提取
+
+将 `.tgz` 复制到目标机器后执行：
+
+```bash
+npm install ./xiangyang9999-folib-server-scan-export-sync-1.0.1.tgz
+npx --no-install folib-scan-export-sync list
+npx --no-install folib-scan-export-sync extract ./folib-sync-454e63ce9
+```
+
+提取命令只复制三个资料文件，不修改项目代码。默认拒绝覆盖已有资料；需要替换时显式添加 `--force`。
+
+```bash
+npx --no-install folib-scan-export-sync extract ./folib-sync-454e63ce9 --force
+```
+
+## 手工同步顺序
+
+1. 确认旧包 `1.0.0` 对应的导出功能已同步。
+2. 恢复 `folib-web-core/pom.xml` 中原有配置及固定的 MockMaker 资源。
+3. 同步两个 web 导出测试的差异。
+4. 新增 storage 的 `ArtifactRepositoryScanExportTest.java`，修复 `ArtifactRepositoryTest.java` 中的漏洞筛选用例。
+5. 更新 `SCAN_EXPORT.md`，执行其中的定向测试命令，按现有 CI 流程收集 storage 覆盖率。
+
+## 已完成的本地验证
+
+2026-10-10：web 定向回归 141 项通过，其中包含 10 类导出测试的 77 项；storage 新增 9 项与修复的 1 项测试全部通过。使用本地临时命令行 JaCoCo agent，`ArtifactRepository.java` 第 205–277 行的 49 个可执行行全部命中，分支覆盖 74/81。没有修改 storage 的 Surefire 配置。
+
+上述结果来自本地验证，Jenkins 的实际覆盖率仍需由现有 CI 执行及收集。定向 `package` 验证不等同于正式发行包验收。
+
+## 重新打包
+
+在 `npm-package` 目录中执行：
+
+```bash
+npm pack --dry-run --ignore-scripts
+npm pack --ignore-scripts
+```
+
+如需上传到内网 npm 仓库，在该目录执行并替换仓库地址：
+
+```bash
+npm publish --registry=https://npm.example.internal/
+```
+
+本目录生成的是本地安装包，未执行发布。

package/bin/folib-scan-export-sync.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const files = [
+  '内网手工同步修改说明.docx',
+  '涉及文件_按原路径.zip',
+  '完整变更补丁_供核对.patch',
+];
+
+const sourceDir = path.resolve(__dirname, '..', 'payload');
+const args = process.argv.slice(2);
+
+function usage() {
+  process.stdout.write(
+    '用法:\n' +
+    '  folib-scan-export-sync list\n' +
+    '  folib-scan-export-sync extract <输出目录> [--force]\n' +
+    '  folib-scan-export-sync --help\n\n' +
+    'extract 只复制手工同步资料，默认拒绝覆盖已有文件。\n'
+  );
+}
+
+function main() {
+  const command = args[0] || '--help';
+  if (command === '--help' || command === '-h' || command === 'help') {
+    usage();
+    return;
+  }
+
+  for (const file of files) {
+    const src = path.join(sourceDir, file);
+    if (!fs.statSync(src).isFile()) {
+      throw new Error('缺少包内文件: ' + src);
+    }
+  }
+
+  if (command === 'list') {
+    for (const file of files) {
+      const bytes = fs.statSync(path.join(sourceDir, file)).size;
+      process.stdout.write(file + ' (' + bytes + ' bytes)\n');
+    }
+    return;
+  }
+
+  if (command !== 'extract' || !args[1] || args.some((a, i) => i >= 2 && a !== '--force')) {
+    usage();
+    process.exitCode = 2;
+    return;
+  }
+
+  const force = args.includes('--force');
+  const outDir = path.resolve(args[1]);
+  const targets = files.map((file) => ({ src: path.join(sourceDir, file), dst: path.join(outDir, file) }));
+
+  if (!force) {
+    const existing = targets.filter(({ dst }) => fs.existsSync(dst));
+    if (existing.length > 0) {
+      throw new Error('为避免覆盖，已停止。目标文件已存在: ' + existing.map(({ dst }) => dst).join(', ') + '；需要覆盖时加 --force');
+    }
+  }
+
+  fs.mkdirSync(outDir, { recursive: true });
+  for (const { src, dst } of targets) {
+    fs.copyFileSync(src, dst, force ? 0 : fs.constants.COPYFILE_EXCL);
+    process.stdout.write('已复制: ' + dst + '\n');
+  }
+}
+
+try {
+  main();
+} catch (err) {
+  process.stderr.write('错误: ' + err.message + '\n');
+  process.exitCode = 1;
+}

package/package.json

@@ -1,6 +1,26 @@
 {
   "name": "@xiangyang9999/folib-server-scan-export-sync",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Offline incremental sync bundle for folib-server scan export Mockito compatibility and coverage fix commit 454e63ce9.",
+  "license": "UNLICENSED",
+  "bin": {
+    "folib-scan-export-sync": "./bin/folib-scan-export-sync.js"
+  },
+  "files": [
+    "bin/",
+    "payload/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=16"
+  },
+  "keywords": [
+    "folib-server",
+    "scan-export",
+    "offline-sync",
+    "manual-migration",
+    "internal-code"
+  ],
+  "sourceCommit": "454e63ce953114b039fe3de06185f5a9a4d1c812",
+  "syncBaseCommit": "a28ada525f48cf8b6ea3024d4f3eda83cc6d358a"
+}

package/payload//345/256/214/346/225/264/345/217/230/346/233/264/350/241/245/344/270/201_/344/276/233/346/240/270/345/257/271.patch

@@ -0,0 +1,561 @@
+diff --git a/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryScanExportTest.java b/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryScanExportTest.java
+new file mode 100644
+index 0000000000000000000000000000000000000000..5bda7653fd51427cc22fc6499aa2a55faa7b6e96
+--- /dev/null
++++ b/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryScanExportTest.java
+@@ -0,0 +1,207 @@
++package com.veadan.folib.repositories;
++
++import com.veadan.folib.configuration.Configuration;
++import com.veadan.folib.configuration.ConfigurationManager;
++import com.veadan.folib.db.schema.Properties;
++import com.veadan.folib.db.schema.Vertices;
++import com.veadan.folib.domain.Artifact;
++import com.veadan.folib.domain.ArtifactEntity;
++import com.veadan.folib.gremlin.adapters.ArtifactAdapter;
++import com.veadan.folib.gremlin.dsl.EntityTraversalUtils;
++import com.veadan.folib.gremlin.dsl.__;
++import com.veadan.folib.services.ConfigurationManagementService;
++import com.veadan.folib.storage.Storage;
++import com.veadan.folib.storage.repository.Repository;
++import org.apache.tinkerpop.gremlin.structure.T;
++import org.apache.tinkerpop.gremlin.structure.Vertex;
++import org.apache.tinkerpop.gremlin.tinkergraph.structure.TinkerGraph;
++import org.junit.jupiter.api.AfterEach;
++import org.junit.jupiter.api.BeforeEach;
++import org.junit.jupiter.api.Test;
++import org.springframework.test.util.ReflectionTestUtils;
++
++import java.time.LocalDateTime;
++import java.util.ArrayList;
++import java.util.LinkedHashMap;
++import java.util.List;
++import java.util.Map;
++import java.util.concurrent.CancellationException;
++import java.util.stream.Collectors;
++
++import static org.junit.jupiter.api.Assertions.*;
++import static org.mockito.ArgumentMatchers.*;
++import static org.mockito.Mockito.*;
++
++/** Run the real export traversal in its owning module so module-level coverage includes it. */
++class ArtifactRepositoryScanExportTest {
++    private TinkerGraph graph;
++    private ArtifactRepository artifacts;
++    private ConfigurationManager manager;
++    private Configuration configuration;
++    private Storage storage;
++    private Map<String, Repository> repositories;
++
++    @BeforeEach void setup() {
++        graph = TinkerGraph.open();
++        artifacts = new ArtifactRepository();
++        manager = mock(ConfigurationManager.class);
++        configuration = mock(Configuration.class);
++        storage = mock(Storage.class);
++        repositories = new LinkedHashMap<>();
++        addRepository("r1", "hosted");
++        addRepository("r2", "hosted");
++        when(storage.getId()).thenReturn("s");
++        doReturn(repositories).when(storage).getRepositories();
++        when(configuration.getStorages()).thenReturn(Map.of("s", storage));
++        when(manager.getRepository(eq("s"), anyString())).thenAnswer(c -> repositories.get(c.getArgument(1)));
++        when(configuration.getRepository(eq("s"), anyString())).thenAnswer(c -> repositories.get(c.getArgument(1)));
++        ConfigurationManagementService service = mock(ConfigurationManagementService.class);
++        when(service.getConfiguration()).thenReturn(configuration);
++        artifacts.configurationManager = manager;
++        artifacts.configurationManagementService = service;
++        ReflectionTestUtils.setField(artifacts, "graph", graph);
++        // Substitute presentation only; predicates, ordering, cursors and limits execute on real vertices.
++        ArtifactAdapter adapter = mock(ArtifactAdapter.class);
++        when(adapter.searchFold(any())).thenAnswer(c -> __.<Vertex, Artifact>map(t -> {
++            ArtifactEntity artifact = new ArtifactEntity();
++            artifact.setUuid(t.get().value(Properties.UUID));
++            return artifact;
++        }));
++        artifacts.artifactAdapter = adapter;
++    }
++
++    @AfterEach void cleanup() throws Exception { graph.close(); }
++
++    @Test void uuidPaginationFiltersRemovedRepositoriesBeforeApplyingTheLimit() {
++        addArtifact("a", "removed", 1);
++        addArtifact("b", "r1", 2);
++        addArtifact("c", "r2", 3);
++        graph.addVertex(T.label, Vertices.ARTIFACT, Properties.UUID, "invalid", Properties.CREATED, 0L);
++        assertEquals(List.of("b", "c"), ids(batch(2, null, null, null, null, null, null, null)));
++        assertEquals(List.of("c"), ids(batch(2, "b", null, null, null, null, null, null)));
++        assertTrue(batch(2, "c", null, null, null, null, null, null).isEmpty());
++    }
++
++    @Test void selectedAndAuthorizedRepositoriesConstrainTheQueryWithoutChangingTheInput() {
++        addArtifact("a", "r1", 1);
++        addArtifact("b", "r2", 2);
++        List<String> authorized = new ArrayList<>(List.of("s-r2", "s-removed"));
++        assertEquals(List.of("b"), ids(batch(10, null, null, null, authorized, null, null, null)));
++        assertEquals(List.of("s-r2", "s-removed"), authorized);
++        assertEquals(List.of("a"), ids(batch(10, null, "s", "r1", null, null, null, null)));
++        assertTrue(batch(10, null, "s", "missing", null, null, null, null).isEmpty());
++        assertTrue(batch(10, null, null, null, List.of("s-removed"), null, null, null).isEmpty());
++        assertTrue(batch(10, null, null, null, List.of(), null, null, null).isEmpty());
++    }
++
++    @Test void groupExportsIntersectMembersWithTheOwnersAuthorizedRepositories() {
++        Repository group = addRepository("group", "group");
++        doAnswer(c -> {
++            c.<List<String>>getArgument(1).addAll(List.of("r1", "r2"));
++            return null;
++        }).when(manager).resolveGroupRepository(eq(group), anyList());
++        addArtifact("a", "r1", 1);
++        addArtifact("b", "r2", 2);
++        assertEquals(List.of("a", "b"), ids(batch(10, null, "s", "group", null, null, null, null)));
++        assertEquals(List.of("b"), ids(batch(10, null, "s", "group", List.of("s-r2"), null, null, null)));
++        assertTrue(batch(10, null, "s", "group", List.of("s-other"), null, null, null).isEmpty());
++    }
++
++    @Test void sortedPagesUseUuidToBreakTiesInBothDirectionsForEverySupportedField() {
++        addArtifact("a", "r1", 2);
++        addArtifact("b", "r1", 1);
++        addArtifact("c", "r1", 2);
++        addArtifact("d", "r2", 3);
++        for (String field : List.of(Properties.LAST_USED, Properties.DOWNLOAD_COUNT,
++                Properties.SIZE_IN_BYTES, Properties.VULNERABILITIES_COUNT)) {
++            assertEquals(List.of("b", "a"), ids(batch(2, null, null, null, null, field, "asc", null)), field);
++            assertEquals(List.of("c", "d"), ids(batch(2, "a", null, null, null, field, "asc", 2L)), field);
++            assertEquals(List.of("d", "a"), ids(batch(2, null, null, null, null, field, "desc", null)), field);
++            assertEquals(List.of("c", "b"), ids(batch(2, "a", null, null, null, field, "desc", 2L)), field);
++        }
++    }
++
++    @Test void sortedContinuationRejectsVerticesWithoutUuid() {
++        addArtifact("a", "r1", 2);
++        addArtifact("b", "r1", 3);
++        Vertex missingUuid = addArtifact("temporary", "r1", 3);
++        missingUuid.property(Properties.UUID).remove();
++        assertEquals(List.of("b"), ids(batch(10, "a", null, null, null, Properties.DOWNLOAD_COUNT, "asc", 2L)));
++    }
++
++    @Test void invalidBatchSizeSortAndIncompleteCursorFailBeforeReturningData() {
++        for (int limit : List.of(0, 1001)) {
++            assertThrows(IllegalArgumentException.class, () -> batch(limit, null, null, null, null, null, null, null));
++        }
++        assertThrows(IllegalArgumentException.class, () -> batch(10, null, null, null, null, "uuid", "asc", null));
++        assertThrows(IllegalArgumentException.class, () -> batch(10, null, null, null, null, Properties.DOWNLOAD_COUNT, "invalid", null));
++        assertThrows(IllegalArgumentException.class, () -> batch(10, "a", null, null, null, Properties.DOWNLOAD_COUNT, "asc", null));
++    }
++
++    @Test void emptyConfigurationReturnsNoArtifacts() {
++        when(configuration.getStorages()).thenReturn(Map.of());
++        assertTrue(batch(10, null, null, null, null, null, null, null).isEmpty());
++    }
++
++    @Test void interruptedExportStopsBeforeOpeningTheGraph() {
++        Thread.currentThread().interrupt();
++        try {
++            assertThrows(CancellationException.class, () -> batch(10, null, null, null, null, null, null, null));
++        } finally { Thread.interrupted(); }
++    }
++
++    @Test void sortValuesPreserveNullsAndConvertDatesAndIntegerCounts() {
++        ArtifactEntity artifact = new ArtifactEntity();
++        for (String field : List.of(Properties.LAST_USED, Properties.DOWNLOAD_COUNT,
++                Properties.SIZE_IN_BYTES, Properties.VULNERABILITIES_COUNT)) {
++            assertTrue(ArtifactRepository.isScanExportSortField(field));
++            assertNull(ArtifactRepository.scanExportSortValue(artifact, field));
++        }
++        LocalDateTime date = LocalDateTime.of(2026, 9, 1, 12, 0);
++        artifact.setLastUsed(date);
++        artifact.setDownloadCount(2);
++        artifact.setSizeInBytes(3L);
++        artifact.setVulnerabilitiesCount(4);
++        assertEquals(EntityTraversalUtils.toLong(date), ArtifactRepository.scanExportSortValue(artifact, Properties.LAST_USED));
++        assertEquals(2L, ArtifactRepository.scanExportSortValue(artifact, Properties.DOWNLOAD_COUNT));
++        assertEquals(3L, ArtifactRepository.scanExportSortValue(artifact, Properties.SIZE_IN_BYTES));
++        assertEquals(4L, ArtifactRepository.scanExportSortValue(artifact, Properties.VULNERABILITIES_COUNT));
++        assertFalse(ArtifactRepository.isScanExportSortField(null));
++        assertFalse(ArtifactRepository.isScanExportSortField("uuid"));
++        assertThrows(IllegalArgumentException.class, () -> ArtifactRepository.scanExportSortValue(artifact, "uuid"));
++    }
++
++    private Repository addRepository(String id, String type) {
++        Repository repository = mock(Repository.class);
++        when(repository.getId()).thenReturn(id);
++        when(repository.getStorage()).thenReturn(storage);
++        when(repository.getType()).thenReturn(type);
++        when(repository.isInService()).thenReturn(true);
++        when(repository.isAllowsDirectoryBrowsing()).thenReturn(true);
++        repositories.put(id, repository);
++        return repository;
++    }
++
++    private Vertex addArtifact(String uuid, String repositoryId, int rank) {
++        return graph.addVertex(T.label, Vertices.ARTIFACT, Properties.UUID, uuid,
++                Properties.STORAGE_ID, "s", Properties.REPOSITORY_ID, repositoryId,
++                Properties.STORAGE_ID_AND_REPOSITORY_ID, "s-" + repositoryId,
++                Properties.CREATED, 0L, Properties.LAST_USED, (long) rank,
++                Properties.DOWNLOAD_COUNT, rank, Properties.SIZE_IN_BYTES, (long) rank,
++                Properties.VULNERABILITIES_COUNT, rank);
++    }
++
++    private List<Artifact> batch(int limit, String after, String storageId, String repositoryId,
++                                 List<String> authorized, String field, String order, Long value) {
++        if (field == null && order == null) {
++            return artifacts.findScanExportBatch(limit, after, false, null, null, storageId, repositoryId,
++                    null, authorized, null, null, null, null, null, null, null);
++        }
++        return artifacts.findScanExportBatch(limit, after, false, null, null, storageId, repositoryId,
++                null, authorized, null, null, null, null, null, null, null, field, order, value);
++    }
++
++    private static List<String> ids(List<Artifact> values) {
++        return values.stream().map(Artifact::getUuid).collect(Collectors.toList());
++    }
++}
+diff --git a/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryTest.java b/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryTest.java
+index 1bdbaf0ff1b8d9f3a56a1dac26373e46225565dd..68d7b3d396ece7f871d40f8983bc1b1559cda621 100644
+--- a/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryTest.java
++++ b/folib-storage/folib-storage-api/src/test/java/com/veadan/folib/repositories/ArtifactRepositoryTest.java
+@@ -489,38 +489,30 @@ class ArtifactRepositoryTest {
+         List<String> vulnerabilities = Lists.newArrayList("critical", "high");
+ 
+         lenient().when(entityTraversalSource.V()).thenReturn(entityTraversal);
+         lenient().when(entityTraversal.hasLabel(Vertices.ARTIFACT)).thenReturn(entityTraversal);
+         lenient().when(entityTraversal.has(anyString(), any(P.class))).thenReturn(entityTraversal);
++        when(entityTraversal.or(any(EntityTraversal[].class))).thenReturn(entityTraversal);
+         lenient().when(entityTraversal.count()).thenReturn(countTraversal);
+         lenient().when(countTraversal.tryNext()).thenReturn(Optional.of(3L));
+         lenient().when(entityTraversal.range(0L, 10L)).thenReturn(entityTraversal);
+         lenient().when(entityTraversal.filter(any(Predicate.class))).thenReturn(entityTraversal);
+-        lenient().when(entityTraversal.map(any(Function.class))).thenReturn(artifactTraversalObject);
+-        lenient().when(artifactTraversalObject.toList()).thenReturn(Lists.newArrayList(mock(Artifact.class)));
++        EntityTraversal fold = mock(EntityTraversal.class);
++        when(artifactAdapter.searchFold(any())).thenReturn(fold);
++        when(entityTraversal.map(fold)).thenReturn(artifactTraversalObject);
++        List<Artifact> expected = Lists.newArrayList(mock(Artifact.class), mock(Artifact.class), mock(Artifact.class));
++        when(artifactTraversalObject.toList()).thenReturn(expected);
+ 
+-        try {
+-            java.lang.reflect.Method gMethod = ArtifactRepository.class.getDeclaredMethod("g");
+-            gMethod.setAccessible(true);
+-            lenient().when(gMethod.invoke(artifactRepository)).thenReturn(entityTraversalSource);
+-        } catch (Exception e) {
+-            // Ignore exception
+-        }
+-
+-        //lenient().when
+-        Page<Artifact> result = null;
+-        try {
+-            result = artifactRepository.findMatchingByIndex(
+-                    pageable, false, null, null, null, null,
+-                    null, null, null, null, null, vulnerabilities, null, null, null, null, null);
+-        } catch (Exception e) {
+-            log.error("Error:", e);
+-        }
++        Page<Artifact> result = artifactRepository.findMatchingByIndex(
++                pageable, false, null, null, null, null,
++                null, null, null, null, null, vulnerabilities, null, null, null, null, null);
+ 
+         // Then
+-        assertNull(result);
+-//        assertEquals(3, result.getTotalElements());
++        assertNotNull(result);
++        assertEquals(3, result.getTotalElements());
++        assertEquals(expected, result.getContent());
++        verify(entityTraversal, times(2)).or(any(EntityTraversal[].class));
+     }
+ 
+     //    @Test
+     void testFindMatchingByIndex_WithDateRange() {
+         // Given
+diff --git a/folib-web-core/SCAN_EXPORT.md b/folib-web-core/SCAN_EXPORT.md
+index cc6bb10d0a067a96f9e80cf54f8b73dc37aa50e1..cfbfb86a6ed5c40380d46f48fd5ca3a8b152afb5 100644
+--- a/folib-web-core/SCAN_EXPORT.md
++++ b/folib-web-core/SCAN_EXPORT.md
+@@ -113,14 +113,24 @@ workers 范围为 1 至 8；page-size 范围为 1 至 1000；三个超时均至
+ ## 验证命令与验收
+ 
+ 从项目根目录执行后端定向测试及模块打包（离线模式要求本地依赖已准备好）：
+ 
+ ```sh
+-mvn -q -o --settings folib-settings.xml -pl folib-web-core -am -Dfolib.test.mockMaker=mock-maker-inline -Dtest=ArtifactScanExportAccessTest,ArtifactScanExportServiceTest,ArtifactScanExportStoreTest,ArtifactScanReportWriterTest,ArtifactScanExportProjectionTest,ArtifactScanExportSqlTest,ScanExportSeedTest,ArtifactScanExportSettingsTest,ArtifactScanExportParityTest,ArtifactScanExportBackgroundAuthTest,AqlControllerTest,FqlSearchServiceTest,ExtendedAuthoritiesVoterTest -Dsurefire.failIfNoSpecifiedTests=false -DfailIfNoTests=false -Dspring-boot.repackage.skip=true package
++mvn -q -o --settings folib-settings.xml -pl folib-web-core -am '-Dtest=ArtifactRepositoryScanExportTest,ArtifactRepositoryTest#testFindMatchingByIndex_WithVulnerabilities,ArtifactScanExport*Test,ArtifactScanReportWriterTest,ScanExportSeedTest,AqlControllerTest' -Dsurefire.failIfNoSpecifiedTests=false -DfailIfNoTests=false -Dspring-boot.repackage.skip=true package
+ ```
+ 
+-完整回归包含静态模拟测试，需要支持 Java agent 的 JDK，并通过 folib.test.mockMaker 参数显式选择 inline；不改变项目普通测试的默认 MockMaker。验收工具 prepare 仅运行其定义的 7 个测试类，不替代这里的完整回归。
++此命令覆盖本功能的 10 个 web 测试类、storage 模块的 ArtifactRepositoryScanExportTest、修复后的漏洞筛选用例，以及原有 AqlControllerTest。测试资源固定使用原有的 SubclassByteBuddyMockMaker；新增测试不使用静态模拟，无需切换 inline 或设置 folib.test.mockMaker。web 模块沿用现有 JaCoCo 配置，报告位于 folib-web-core/target/site/jacoco/index.html。
++
++ArtifactRepository 的直接测试放在所属的 folib-storage-api 模块，避免依赖跨模块覆盖率汇总。单独验证该模块的测试可执行以下命令；覆盖率仍由现有 CI 流程注入 agent 和收集报告，不修改 storage 的 Surefire 或打包配置：
++
++```sh
++mvn -q -o --settings folib-settings.xml -pl folib-storage/folib-storage-api '-Dtest=ArtifactRepositoryScanExportTest,ArtifactRepositoryTest#testFindMatchingByIndex_WithVulnerabilities' test
++```
++
++2026-10-10 本地验证：web 侧回归 141 项通过（含上述 10 类导出测试的 77 项），storage 侧 9 项新增查询测试和 1 项漏洞筛选测试全部通过。本地临时通过命令行传入 JaCoCo agent 后，独立 storage 执行数据生成的报告中，ArtifactRepository.java 第 205–277 行的 49 个可执行行全部命中；分支覆盖 74/81，尚未达到全部分支覆盖。该统计是本地验证结果，不代表 Jenkins 已完成同样的覆盖率收集。
++
++验收工具 prepare 仅运行其定义的 7 个测试类，不替代上述回归。历史命令中的 FqlSearchServiceTest、ExtendedAuthoritiesVoterTest 仍包含原有静态模拟，不属于此处的默认 MockMaker 回归范围。
+ 
+ 这里必须使用 package，而非仅使用 test：folib-data-service 的资源解包需要上游模块已生成 JAR，仅执行 test 会在到达导出测试之前报 MDEP-98。此命令不跳过定向测试；spring-boot.repackage.skip 只跳过可执行 Boot JAR 的重打包，不代表生成了可部署的完整发行包。
+ 
+ 前端回归测试使用 Node 20 的原生测试运行器和 VM 模块，不增加测试框架，也不会访问实际服务器。行为用例读取真实组件脚本、筛选函数、API 模块和鉴权拦截器，仅模拟外部接口；两条模板用例使用项目已有的 vue-template-compiler 编译扫描页和抽屉，并检查生成的渲染函数语法。模板测试需要已安装项目依赖，不替代完整 Webpack 构建或浏览器端到端测试。
+ 
+diff --git a/folib-web-core/pom.xml b/folib-web-core/pom.xml
+index f706de2f9f2dccf413cc8acf859c29d429df8c0b..5324c0f3576f14d0c450a1b7d7c44debe86744b3 100644
+--- a/folib-web-core/pom.xml
++++ b/folib-web-core/pom.xml
+@@ -15,38 +15,17 @@
+     <artifactId>folib-web-core</artifactId>
+     <packaging>jar</packaging>
+     <name>Folib: Web Core</name>
+     <inceptionYear>2019</inceptionYear>
+ 
+-    <properties>
+-        <!-- Keep agent-free tests as the default; static-mock suites opt in with -Dfolib.test.mockMaker=mock-maker-inline. -->
+-        <folib.test.mockMaker>org.mockito.internal.creation.bytebuddy.SubclassByteBuddyMockMaker</folib.test.mockMaker>
+-    </properties>
+-
+      <scm>
+         <url>http://git.folib.com/folib/folib-server</url>
+         <connection>scm:git:git://git.folib.com/folib/folib-server.git</connection>
+         <developerConnection>scm:git:git://git.folib.com/folib/folib-server.git</developerConnection>
+     </scm>
+ 
+     <build>
+-        <testResources>
+-            <testResource>
+-                <directory>src/test/resources</directory>
+-                <filtering>false</filtering>
+-                <excludes>
+-                    <exclude>mockito-extensions/org.mockito.plugins.MockMaker</exclude>
+-                </excludes>
+-            </testResource>
+-            <testResource>
+-                <directory>src/test/resources</directory>
+-                <filtering>true</filtering>
+-                <includes>
+-                    <include>mockito-extensions/org.mockito.plugins.MockMaker</include>
+-                </includes>
+-            </testResource>
+-        </testResources>
+         <plugins>
+             <plugin>
+             <groupId>org.apache.maven.plugins</groupId>
+             <artifactId>maven-clean-plugin</artifactId>
+             <version>3.1.0</version>
+diff --git a/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportBackgroundAuthTest.java b/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportBackgroundAuthTest.java
+index b17c44c8506a48675fb72b12a546d4bcc256baf5..ae2529c8ba25217d783b4ab9d4ad42e2fa672dd2 100644
+--- a/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportBackgroundAuthTest.java
++++ b/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportBackgroundAuthTest.java
+@@ -1,14 +1,19 @@
+ package com.veadan.folib.export;
+ 
++import ch.qos.logback.classic.Level;
++import ch.qos.logback.classic.Logger;
++import ch.qos.logback.classic.spi.ILoggingEvent;
++import ch.qos.logback.core.read.ListAppender;
+ import com.fasterxml.jackson.databind.ObjectMapper;
+ import com.veadan.folib.components.auth.AuthComponent;
+ import com.veadan.folib.configuration.ConfigurationManager;
+ import com.veadan.folib.configuration.ConfigurationUtils;
+-import com.veadan.folib.providers.io.RepositoryFiles;
++import com.veadan.folib.providers.io.LayoutFileSystem;
+ import com.veadan.folib.providers.io.RepositoryPath;
+ import com.veadan.folib.providers.io.RepositoryPathResolver;
++import com.veadan.folib.providers.io.RootRepositoryPath;
+ import com.veadan.folib.security.resolvepath.ResolvePathProviderRegistry;
+ import com.veadan.folib.security.vote.ExtendedAuthoritiesVoter;
+ import com.veadan.folib.storage.Storage;
+ import com.veadan.folib.storage.repository.Repository;
+ import com.veadan.folib.users.domain.Privileges;
+@@ -16,10 +21,12 @@ import com.veadan.folib.users.userdetails.SpringSecurityUser;
+ import com.veadan.folib.util.CacheUtil;
+ import com.veadan.folib.utils.UrlUtils;
+ import org.junit.jupiter.api.AfterEach;
+ import org.junit.jupiter.api.BeforeEach;
+ import org.junit.jupiter.api.Test;
++import org.junit.jupiter.api.io.TempDir;
++import org.slf4j.LoggerFactory;
+ import org.springframework.mock.web.MockHttpServletRequest;
+ import org.springframework.security.access.AccessDeniedException;
+ import org.springframework.security.core.GrantedAuthority;
+ import org.springframework.security.core.context.SecurityContext;
+ import org.springframework.security.core.context.SecurityContextHolder;
+@@ -27,10 +34,11 @@ import org.springframework.security.core.userdetails.UserDetailsService;
+ import org.springframework.test.util.ReflectionTestUtils;
+ import org.springframework.web.context.request.RequestAttributes;
+ import org.springframework.web.context.request.RequestContextHolder;
+ import org.springframework.web.context.request.ServletRequestAttributes;
+ 
++import java.nio.file.Path;
+ import java.util.ArrayList;
+ import java.util.HashMap;
+ import java.util.List;
+ import java.util.Map;
+ import java.util.Set;
+@@ -40,10 +48,11 @@ import java.util.concurrent.TimeUnit;
+ import static org.junit.jupiter.api.Assertions.*;
+ import static org.mockito.ArgumentMatchers.*;
+ import static org.mockito.Mockito.*;
+ 
+ class ArtifactScanExportBackgroundAuthTest {
++    @TempDir Path directory;
+     private RequestAttributes previousRequest;
+     private SecurityContext previousSecurity;
+ 
+     @BeforeEach void isolateThreadContext() {
+         previousRequest = RequestContextHolder.getRequestAttributes();
+@@ -55,14 +64,25 @@ class ArtifactScanExportBackgroundAuthTest {
+     @AfterEach void restoreThreadContext() {
+         RequestContextHolder.setRequestAttributes(previousRequest);
+         SecurityContextHolder.setContext(previousSecurity);
+     }
+ 
+-    @Test void absentRequestIsOptionalWithoutInvokingTheThrowingAccessor() {
+-        try (var holder = mockStatic(RequestContextHolder.class, CALLS_REAL_METHODS)) {
++    @Test void absentRequestIsOptionalWithoutLoggingExceptions() {
++        Logger logger = (Logger) LoggerFactory.getLogger(UrlUtils.class);
++        Level previousLevel = logger.getLevel();
++        ListAppender<ILoggingEvent> events = new ListAppender<>();
++        events.start();
++        logger.setLevel(Level.ERROR);
++        logger.addAppender(events);
++        try {
+             for (int i = 0; i < 1000; i++) assertNull(UrlUtils.getRequest());
+-            holder.verify(RequestContextHolder::currentRequestAttributes, never());
++            assertTrue(events.list.isEmpty(), "An absent request must not log an exception on each lookup");
++            assertThrows(IllegalStateException.class, RequestContextHolder::currentRequestAttributes);
++        } finally {
++            logger.detachAppender(events);
++            logger.setLevel(previousLevel);
++            events.stop();
+         }
+     }
+ 
+     @Test void realServletRequestAndStrictUriAccessorAreUnchanged() {
+         MockHttpServletRequest request = new MockHttpServletRequest("GET", "/storages/s/r/file.jar");
+@@ -121,20 +141,20 @@ class ArtifactScanExportBackgroundAuthTest {
+         rights.put(prefix + "readable/a.jar", Set.of(Privileges.ARTIFACTS_RESOLVE));
+         rights.put(prefix + "reports/result.xlsx", Set.of(Privileges.ARTIFACTS_RESOLVE, Privileges.ARTIFACTS_DEPLOY));
+         when(user.getStorageAuthorities(anyString(), eq(false)))
+                 .thenAnswer(call -> rights.getOrDefault(call.getArgument(0), Set.of()));
+         ArtifactScanExportAccess access = new ArtifactScanExportAccess(configuration, paths, auth, users, new ObjectMapper());
+-        CacheUtil<String, Repository> cache = mock(CacheUtil.class);
+-        when(cache.get(storageId + ":" + repositoryId)).thenReturn(repository);
+-        try (var cacheFactory = mockStatic(CacheUtil.class);
+-             var files = mockStatic(RepositoryFiles.class);
+-             var holder = mockStatic(RequestContextHolder.class, CALLS_REAL_METHODS)) {
+-            cacheFactory.when(CacheUtil::getInstance).thenReturn(cache);
++        LayoutFileSystem fileSystem = mock(LayoutFileSystem.class);
++        when(fileSystem.getRootDirectory()).thenReturn(new RootRepositoryPath(directory, fileSystem));
++        CacheUtil<String, Repository> cache = CacheUtil.getInstance();
++        String cacheKey = storageId + ":" + repositoryId;
++        Repository previousRepository = cache.get(cacheKey);
++        cache.put(cacheKey, repository);
++        try {
+             for (String path : List.of("readable/a.jar", "denied/b.jar", "reports/result.xlsx")) {
+-                RepositoryPath resolved = mock(RepositoryPath.class);
++                RepositoryPath resolved = new RepositoryPath(directory.resolve(path), fileSystem);
+                 when(paths.resolve(storageId, repositoryId, path)).thenReturn(resolved);
+-                files.when(() -> RepositoryFiles.relativizePath(resolved)).thenReturn(path);
+             }
+             access.assumeOwner("export-user");
+             var identity = SecurityContextHolder.getContext().getAuthentication();
+             assertEquals("export-user", access.owner());
+             for (int i = 0; i < 200; i++) {
+@@ -147,12 +167,14 @@ class ArtifactScanExportBackgroundAuthTest {
+             rights.clear();
+             assertFalse(access.canReadArtifact(storageId, repositoryId, "readable/a.jar"));
+             assertThrows(AccessDeniedException.class, () -> access.target(storageId, repositoryId, "reports/result.xlsx", true));
+             assertSame(identity, SecurityContextHolder.getContext().getAuthentication());
+             assertNull(RequestContextHolder.getRequestAttributes());
+-            holder.verify(RequestContextHolder::currentRequestAttributes, never());
+             verify(user, atLeastOnce()).getStorageAuthorities(prefix + "denied/b.jar", false);
++        } finally {
++            if (previousRepository == null) cache.remove(cacheKey);
++            else cache.put(cacheKey, previousRepository);
+         }
+     }
+ 
+     @Test void webRequestStillAppliesTheExistingRestrictedHostRule() {
+         ExtendedAuthoritiesVoter voter = spy(new ExtendedAuthoritiesVoter());
+diff --git a/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportParityTest.java b/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportParityTest.java
+index f10eceb5832b7e23053c02643ae9003299ef384d..d399b1ce575c3eadc923b2a472f284defcffb89f 100644
+--- a/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportParityTest.java
++++ b/folib-web-core/src/test/java/com/veadan/folib/export/ArtifactScanExportParityTest.java
+@@ -6,12 +6,15 @@ import com.veadan.folib.components.common.CommonComponent;
+ import com.veadan.folib.components.repository.RepositoryComponent;
+ import com.veadan.folib.controllers.aql.AqlController;
+ import com.veadan.folib.domain.Artifact;
+ import com.veadan.folib.domain.Component;
+ import com.veadan.folib.domain.Vulnerability;
++import com.veadan.folib.providers.io.LayoutFileSystem;
++import com.veadan.folib.providers.io.RepositoryFileAttributeType;
+ import com.veadan.folib.providers.io.RepositoryFiles;
+ import com.veadan.folib.providers.io.RepositoryPath;
++import com.veadan.folib.providers.layout.LayoutFileSystemProvider;
+ import com.veadan.folib.repositories.ArtifactRepository;
+ import com.veadan.folib.repositories.ComponentRepository;
+ import com.veadan.folib.repositories.VulnerabilityRepository;
+ import com.veadan.folib.services.impl.ComponentServiceImpl;
+ import com.veadan.folib.services.impl.FqlSearchService;
+@@ -25,11 +28,11 @@ import org.springframework.data.domain.PageImpl;
+ import org.springframework.data.domain.Pageable;
+ import org.springframework.mock.web.MockHttpServletResponse;
+ import org.springframework.test.util.ReflectionTestUtils;
+ 
+ import java.io.ByteArrayInputStream;
+-import java.net.URL;
++import java.nio.file.LinkOption;
+ import java.nio.file.Path;
+ import java.time.LocalDateTime;
+ import java.util.*;
+ 
+ import static org.junit.jupiter.api.Assertions.*;
+@@ -49,14 +52,19 @@ class ArtifactScanExportParityTest {
+         TimeZone.setDefault(TimeZone.getTimeZone("UTC"));
+         try {
+             Repository repository = mock(Repository.class);
+             when(repository.getLayout()).thenReturn(docker ? "Docker" : "Raw");
+             when(repository.getOwner()).thenReturn("project-owner");
+-            RepositoryPath repositoryPath = mock(RepositoryPath.class);
+-            when(repositoryPath.getRepository()).thenReturn(repository);
+-            when(repositoryPath.toAbsolutePath()).thenReturn(repositoryPath);
+-            when(repositoryPath.toString()).thenReturn("/acceptance/file.jar");
++            LayoutFileSystem fileSystem = mock(LayoutFileSystem.class);
++            LayoutFileSystemProvider provider = mock(LayoutFileSystemProvider.class);
++            when(fileSystem.getRepository()).thenReturn(repository);
++            when(fileSystem.provider()).thenReturn(provider);
++            RepositoryPath repositoryPath = new RepositoryPath(directory.resolve("file.jar"), fileSystem);
++            when(provider.readAttributes(eq(repositoryPath),
++                    eq(RepositoryFiles.formatAttributes(RepositoryFileAttributeType.RESOURCE_URL)), any(LinkOption[].class)))
++                    .thenReturn(Map.of(RepositoryFileAttributeType.RESOURCE_URL.getName(),
++                            repositoryPath.getTarget().toUri().toURL()));
+             FqlSearchService search = ScanExportPresentationFixture.search(repositoryPath);
+             ArtifactRepository artifacts = mock(ArtifactRepository.class);
+             ComponentRepository components = mock(ComponentRepository.class);
+             VulnerabilityRepository vulnerabilities = mock(VulnerabilityRepository.class);
+             CommonComponent common = mock(CommonComponent.class);
+@@ -113,15 +121,12 @@ class ArtifactScanExportParityTest {
+             AqlController legacy = new AqlController();
+             ReflectionTestUtils.setField(legacy, "fqlSearchService", search);
+             ReflectionTestUtils.setField(legacy, "componentService", componentService);
+             ReflectionTestUtils.setField(legacy, "vulnerabilityWebService", vulnerabilityService);
+             MockHttpServletResponse response = new MockHttpServletResponse();
+-            try (var files = mockStatic(RepositoryFiles.class)) {
+-                files.when(() -> RepositoryFiles.readResourceUrl(repositoryPath)).thenReturn(new URL("file:/acceptance/file.jar"));
+-                legacy.exportArtifactComponentVulnerability(null, null, false, "storage", "source", null, null,
+-                        null, null, null, status, null, null, null, null, 10, 1, response);
+-            }
++            legacy.exportArtifactComponentVulnerability(null, null, false, "storage", "source", null, null,
++                    null, null, null, status, null, null, null, null, 10, 1, response);
+             ArtifactScanExportAccess access = mock(ArtifactScanExportAccess.class);
+             when(access.isAdmin()).thenReturn(true);
+             when(access.canReadArtifact(anyString(), anyString(), anyString())).thenReturn(true);
+             ArtifactScanReportWriter writer = new ArtifactScanReportWriter(artifacts, components, vulnerabilities,
+                     mock(RepositoryComponent.class), access, search);
+diff --git a/folib-web-core/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker b/folib-web-core/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
+index 8b43cbaa00f32ddd60f74282d2015b709269a21a..ca8778f4f8e0ca2e2ecf3ca86d36f18dfd882da9 100644
+--- a/folib-web-core/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
++++ b/folib-web-core/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
+@@ -1 +1 @@
+-${folib.test.mockMaker}
++org.mockito.internal.creation.bytebuddy.SubclassByteBuddyMockMaker