super/crawler-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(鉴权/测试): 用户态工具鉴权改开关控制（默认关）+ 修复既有测试编译与断言

Browse Source 
- collect-data/price-track 兜底鉴权改由 aiimage.security.user-tool-guard-enabled
  控制，默认 false：老客户端直连不带认证头，先开启会让线上集采/跟价全线 401，
  待携带 X-Internal-Token 的新客户端铺开后再置 true
- 补齐 DistributedJobLockService 构造参数缺失的 6 个测试类（双活分布式锁
  commit 只改了主代码，测试已无法编译）；断言按"先删 DB 行再物理删"的现语义校正
This commit is contained in:
黄自达
2026-09-11 18:03:54 +08:00
parent 9962d9797e
commit db7cd22ed1
8 changed files with 62 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
+17 -3
View File
@@ -53,8 +53,12 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
/**
* 用户态工具接口前缀：controller 无方法级鉴权（归属由请求参数 user_id 判定），
* 匿名可达即越权读写他人数据。纳入兜底要求 JWT 或可信内部令牌（2026-09-12）。
* 桌面 Python 直连调用已同步携带 X-Internal-Token。
* 匿名可达即越权读写他人数据。**默认不纳入兜底**，由
* aiimage.security.user-tool-guard-enabled 开关控制（默认 false = 行为不变）。
*
* <p>原因：桌面客户端（Python）直连这些接口且不带任何认证头，先于客户端发布开启会
* 让线上集采/跟价全线 401。待携带 X-Internal-Token 的新客户端铺开后，把开关置 true
* （或把这些前缀从 USER_TOOL_PREFIXES 移除、直接无条件纳入）即可完成收紧。
*/
private static final String[] USER_TOOL_PREFIXES = {
"/api/collect-data",
@@ -67,6 +71,13 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
@Value("${aiimage.security.admin-guard-enabled:true}")
private boolean enabled;
/**
* 用户态工具前缀（collect-data/price-track）是否纳入兜底鉴权。
* 默认 false：老客户端直连不带认证头，先开启会打断线上任务；新客户端铺开后置 true。
*/
@Value("${aiimage.security.user-tool-guard-enabled:false}")
private boolean userToolGuardEnabled;
@Value("${aiimage.security.admin-guard-exempt-prefixes:}")
private String exemptPrefixes;
@@ -121,10 +132,13 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
}
/** 命中受保护前缀（/api/admin、/debug、用户态工具前缀及其子路径）才进入鉴权，其余请求直接放行。 */
private static boolean isGuarded(String uri) {
private boolean isGuarded(String uri) {
if (matchesPrefix(uri, ADMIN_API_PREFIX) || matchesPrefix(uri, DEBUG_PREFIX)) {
return true;
}
if (!userToolGuardEnabled) {
return false;
}
for (String prefix : USER_TOOL_PREFIXES) {
if (matchesPrefix(uri, prefix)) {
return true;
backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataDeleteConsistencyTest.java
+4 -2
View File
@@ -108,6 +108,7 @@ class CollectDataDeleteConsistencyTest {
mock(com.nanri.aiimage.modules.collectdata.service.CollectDataExcelAssemblyService.class),
mock(com.nanri.aiimage.modules.file.service.oss.OssStorageService.class),
objectMapper, txTemplate,
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS),
mock(com.nanri.aiimage.modules.collectdata.util.CollectDataBatchQuery.class),
mock(com.nanri.aiimage.modules.collectdata.util.CollectDataBrandBatchFilter.class),
mock(com.nanri.aiimage.modules.collectdata.util.CollectDataInvalidAsinBatchWriter.class),
@@ -296,9 +297,10 @@ class CollectDataDeleteConsistencyTest {
verify(fileTaskMapper, never()).deleteById(1L);
assertThat("COLLECT_DATA").as("任务行未被删除（事务回滚）").isEqualTo(CollectDataService.MODULE_TYPE);
// 恢复后重试：DB 行删除 + 物理删除全部完成（首次失败那次调用 + 重试的 2 次）。
// 恢复后重试：DB 行删除 + 物理删除全部完成（首次失败那次 mock 计数已记一次，
// 真实 DB 因事务回滚未生效，故 mock 视角共 2 次）。
service.deleteTask(8L, 7L);
verify(fileTaskMapper).deleteById(8L);
verify(fileTaskMapper, times(2)).deleteById(8L);
verify(transientPayloadStorageService, times(3)).deletePayloadIfPresent(anyString());
}
}
backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataServiceTest.java
+4
View File
@@ -49,6 +49,10 @@ class CollectDataServiceTest {
@Mock
private TaskDistributedLockService.LockHandle lockHandle;
/** 调度互斥锁（双节点 Redis 锁）：测试内返回可用句柄，使 stale 收尾路径正常执行。 */
@Mock(answer = org.mockito.Answers.RETURNS_MOCKS)
private com.nanri.aiimage.common.service.DistributedJobLockService distributedJobLockService;
@Spy
private ObjectMapper objectMapper = new ObjectMapper();
backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataStorageCallCountTest.java
+5 -4
View File
@@ -107,6 +107,7 @@ class CollectDataStorageCallCountTest {
mock(com.nanri.aiimage.modules.collectdata.service.CollectDataExcelAssemblyService.class),
mock(com.nanri.aiimage.modules.file.service.oss.OssStorageService.class),
objectMapper, txTemplate,
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS),
mock(com.nanri.aiimage.modules.collectdata.util.CollectDataBatchQuery.class),
mock(com.nanri.aiimage.modules.collectdata.util.CollectDataBrandBatchFilter.class),
mock(com.nanri.aiimage.modules.collectdata.util.CollectDataInvalidAsinBatchWriter.class),
@@ -282,12 +283,12 @@ class CollectDataStorageCallCountTest {
assertThatThrownBy(() -> service.deleteHistory(16L, 7L))
.isInstanceOf(RuntimeException.class)
.hasMessage("rustfs down");
verify(fileResultMapper, never()).deleteById(16L);
assertThat(CollectDataService.MODULE_TYPE).as("结果行未删除（异常传播）")
.isEqualTo(CollectDataService.MODULE_TYPE);
// 实现已改为"事务内先删 DB 行、提交后再物理删除对象"：行删除先于物理删除发生，
// 物理删除抛错时真实 DB 回滚，但 mock 计数已记一次（该次删除未生效）。
verify(fileResultMapper, times(1)).deleteById(16L);
service.deleteHistory(16L, 7L);
verify(fileResultMapper).deleteById(16L);
verify(fileResultMapper, times(2)).deleteById(16L);
verify(transientPayloadStorageService, times(3)).deletePayloadIfPresent(anyString());
}
}
backend-java/src/test/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoAsyncTaskServiceTest.java
+28 -14
View File
@@ -61,7 +61,8 @@ class ImageVideoAsyncTaskServiceTest {
TaskExecutor directExecutor = Runnable::run;
ImageVideoAsyncTaskService service = new ImageVideoAsyncTaskService(
taskMapper, cozeService, workflowConfigService, mock(ImageVideoArchiveService.class), objectMapper,
directExecutor, instanceMetadata("server-121"));
directExecutor, instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingDouyinTask();
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
@@ -97,7 +98,8 @@ class ImageVideoAsyncTaskServiceTest {
ImageVideoWorkflowConfigService workflowConfigService = mock(ImageVideoWorkflowConfigService.class);
ImageVideoAsyncTaskService service = new ImageVideoAsyncTaskService(
taskMapper, cozeService, workflowConfigService, mock(ImageVideoArchiveService.class), new ObjectMapper(),
Runnable::run, instanceMetadata("server-121"));
Runnable::run, instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingDouyinTask();
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of("execute_status", "Running")));
@@ -125,7 +127,8 @@ class ImageVideoAsyncTaskServiceTest {
ImageVideoArchiveService archiveService = mock(ImageVideoArchiveService.class);
ImageVideoAsyncTaskService service = new ImageVideoAsyncTaskService(
taskMapper, cozeService, workflowConfigService, archiveService, new ObjectMapper(), Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingWorkflowTask();
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
"execute_status", "Fail",
@@ -158,7 +161,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingWorkflowTask();
task.setStatus("FAILED");
task.setCozeStatus("FAIL");
@@ -182,7 +186,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingWorkflowTask();
task.setStatus("FAILED");
task.setCozeStatus("RUNNING");
@@ -206,7 +211,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
when(taskMapper.delete(any())).thenReturn(3);
service.cleanupFailedTasks();
@@ -224,7 +230,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
DouyinCopyRequest request = new DouyinCopyRequest();
request.setUserId(1L);
request.setUrl("https://example.com/video");
@@ -246,7 +253,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingWorkflowTask();
task.setOwnerInstanceId("server-110");
when(taskMapper.selectOne(any())).thenReturn(task);
@@ -270,7 +278,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
when(taskMapper.requeuePollingTasks("server-121")).thenReturn(2);
service.recoverInterruptedPollingTasks();
@@ -290,7 +299,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingWorkflowTask();
task.setSubmittedAt(LocalDateTime.now().minusHours(2));
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
@@ -323,7 +333,8 @@ class ImageVideoAsyncTaskServiceTest {
archiveService,
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingWorkflowTask();
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
"execute_status", "Success",
@@ -360,7 +371,8 @@ class ImageVideoAsyncTaskServiceTest {
archiveService,
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingVoiceListTask();
String error = "Query voices failed: invalid API key (status: 1004)";
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
@@ -396,7 +408,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingVoiceListTask();
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
"execute_status", "Success",
@@ -429,7 +442,8 @@ class ImageVideoAsyncTaskServiceTest {
mock(ImageVideoArchiveService.class),
new ObjectMapper(),
Runnable::run,
instanceMetadata("server-121"));
instanceMetadata("server-121"),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS));
ImageVideoAsyncTaskEntity task = waitingVoiceListTask();
Map<String, Object> cozeResult = Map.of("data", List.of(Map.of(
"execute_status", "Success",
backend-java/src/test/java/com/nanri/aiimage/modules/publish/service/PublishBatchLoadingSnapshotEquivTest.java
+1
View File
@@ -301,6 +301,7 @@ class PublishBatchLoadingSnapshotEquivTest {
mock(TaskScopeStateMapper.class), taskFileJobService,
mock(TaskDistributedLockService.class), mock(TransientPayloadStorageService.class),
ossStorageService, new ObjectMapper(), mock(TransactionTemplate.class),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS),
mock(InstanceMetadata.class),
mock(TaskProgressLightAssembler.class));
}
backend-java/src/test/java/com/nanri/aiimage/modules/publish/service/PublishDashboardAggregateTest.java
+1
View File
@@ -179,6 +179,7 @@ class PublishDashboardAggregateTest {
mock(TaskScopeStateMapper.class), taskFileJobService,
mock(TaskDistributedLockService.class), mock(TransientPayloadStorageService.class),
ossStorageService, new ObjectMapper(), mock(TransactionTemplate.class),
mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS),
mock(InstanceMetadata.class),
mock(TaskProgressLightAssembler.class));
}
backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/PublishFileLevelStatusTest.java
+2 -1
View File
@@ -73,7 +73,8 @@ class PublishFileLevelStatusTest {
localFileStorageService, ziniaoShopSwitchService, workbookService, publishFileMapper,
publishItemMapper, fileTaskMapper, fileResultMapper, taskChunkMapper, taskScopeStateMapper,
taskFileJobService, taskDistributedLockService, transientPayloadStorageService, ossStorageService,
objectMapper, transactionTemplate, instanceMetadata, taskProgressLightAssembler);
objectMapper, transactionTemplate, org.mockito.Mockito.mock(com.nanri.aiimage.common.service.DistributedJobLockService.class, org.mockito.Answers.RETURNS_MOCKS),
instanceMetadata, taskProgressLightAssembler);
lenient().when(ossStorageService.generateFreshDownloadUrl(any()))
.thenReturn("https://dl.example/publish-result.zip");
}