Your Name
|
ad776e4079
|
fix: P0/P1 security fixes across gateway, token-runtime, and supply-api
P0 fixes:
- platform-token-runtime: Add store.Save() after Refresh token update (P0-3)
- platform-token-runtime: Add sync.RWMutex to InMemoryRuntimeStore (P0-4)
- platform-token-runtime: Add bearer token auth to /audit-events endpoint (P0-5)
- gateway: Fail startup in production if PASSWORD_ENCRYPTION_KEY uses default (P0-1)
- gateway: Require explicit CORS_ALLOW_ORIGINS in production (P0-2)
P1 fixes:
- gateway: Add TrustedProxies config field + env var GATEWAY_TRUSTED_PROXIES (P1-5)
- gateway: Sanitize X-Request-ID header to prevent log injection (P1-6)
- gateway: Strip internal error details from error responses to clients (P1-7)
- supply-api: Upgrade deriveDEK from trivial byte-rotation to HKDF-SHA256 (P1-1)
- supply-api: Reject HS256/HS384/HS512 in production, require RSA (P1-2)
Code quality fixes:
- supply-api: Add BruteForceMaxAttempts + BruteForceLockoutDuration to AuthConfig (MED-12)
- supply-api: Add TrustedProxies to token_auth_middleware (IP spoofing protection)
- supply-api: Use shared pathutil.SplitPath instead of duplicate splitPath
- supply-api: Fix query_key_reject_middleware call sites with trustedProxies param
- gateway: Wire TrustedProxies into AuthMiddlewareConfig and extractClientIP
- gateway: Add CORSAllowOrigins to AuthConfig, wire into CORSMiddleware
- gateway: Fix CompletionsHandle to have context and RecordResult like ChatCompletions
- gateway: Add sanitizeRequestID helper for X-Request-ID log injection prevention
- gateway: Add os import for PASSWORD_ENCRYPTION_KEY check
- gateway: Add strings import to handler.go for sanitizeRequestID
Environment issues documented in TEST_ENVIRONMENT_ISSUES.md
|
2026-04-17 14:36:02 +08:00 |
|
Your Name
|
f9fc984e5c
|
test(iam): 使用TDD方法补充IAM模块测试覆盖
- 创建完整的IAM Service测试文件 (iam_service_real_test.go)
- 测试真实 DefaultIAMService 而非 mock
- 覆盖 CreateRole, GetRole, UpdateRole, DeleteRole, ListRoles
- 覆盖 AssignRole, RevokeRole, GetUserRoles
- 覆盖 CheckScope, GetUserScopes, IsExpired
- 创建完整的IAM Handler测试文件 (iam_handler_real_test.go)
- 测试真实 IAMHandler 使用 httptest
- 覆盖路由处理器方法 (handleRoles, handleRoleByCode等)
- 覆盖 CreateRole, GetRole, ListRoles, UpdateRole, DeleteRole
- 覆盖 AssignRole, RevokeRole, GetUserRoles, CheckScope, ListScopes
- 覆盖辅助函数和中间件
- 修复原有代码bug
- extractUserID: 修正索引从parts[3]到parts[4]
- extractRoleCodeFromUserPath: 修正索引从parts[5]到parts[6]
- 修复多余的空格导致的语法问题
测试覆盖率:
- IAM Handler: 0% -> 85.9%
- IAM Service: 0% -> 99.0%
|
2026-04-03 07:59:12 +08:00 |
|