feat: SSE 放行 touch.workflow——参与人+admin 可见性（经任务服务归属端口）
I6 把 touch.workflow. 从可订阅集摘出去，理由是**当时没有规则**：形状一过就直接进订阅集， 而鉴权分支只覆盖 touch.task./stream.task.，任何登录用户订 touch.workflow.<任意 id> 都能收 别人流程的推送。N3 的引擎每次推进都发 touch.workflow.<instanceId>，规则也定了：参与人 （节点 ownerSub）／审批人（approverSub）／admin。规则到位，故放回来。 - workflow-access.ts：与 task-access 同形的 HTTP 口——服务账号 token、3s 超时、非 200 一律 false 并告警（失败关闭）。打的是任务侧新加的 /workflow/:id/access。 - hub：SUBSCRIBABLE 收回 touch.workflow.，subscribe 补上对应鉴权分支——放形状与补鉴权 必须同一次改动，只放形状就是把 I6 原样退回去。admin 旁路（全可见，也免掉白跑的往返）。 - 两口分开而不是复用一口：任务问的是单张单的归属，工作流问的是实例**定义里**的节点归属。 - app：两口共用同一个 token provider，缓存只此一份。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
lovefyf
co-authored by
Claude Fable 5
Claude Fable 5
parent
9a02094281
commit
5ebef45b1d
@@ -4,6 +4,7 @@ import { SseHub, isSubscribable } from '../../src/modules/sse/hub';
|
||||
import type { Connection, SseEvent } from '../../src/modules/sse/hub';
|
||||
import { sseRoutes } from '../../src/modules/sse/routes';
|
||||
import { createHttpTaskAccess } from '../../src/modules/sse/task-access';
|
||||
import { createHttpWorkflowAccess } from '../../src/modules/sse/workflow-access';
|
||||
import { buildApp } from '../../src/app/app';
|
||||
import { makeToken, setupTestJwks } from '../support/token';
|
||||
|
||||
@@ -12,6 +13,10 @@ function conn(id: string, staffSub: string, topics: string[] = []): { c: Connect
|
||||
return { c: { id, staffSub, isAdmin: false, topics: new Set(topics), send: (e) => got.push(e) }, got };
|
||||
}
|
||||
|
||||
/** 一律放行/一律拒绝的假口：两口分开传，才证明得了"这一拒来自哪一口" */
|
||||
const ALLOW = { allowed: async (): Promise<boolean> => true };
|
||||
const DENY = { allowed: async (): Promise<boolean> => false };
|
||||
|
||||
describe('SseHub 路由', () => {
|
||||
it('staff 精确投递、system 广播、task 按订阅集、回放窗口', () => {
|
||||
const hub = new SseHub(8);
|
||||
@@ -36,48 +41,85 @@ describe('SseHub 路由', () => {
|
||||
const hub = new SseHub();
|
||||
const a = conn('a', 'sub-a');
|
||||
hub.register(a.c);
|
||||
const denyAccess = { allowed: async () => false };
|
||||
const res = await hub.subscribe('a', 'stream.task.t9', denyAccess);
|
||||
const res = await hub.subscribe('a', 'stream.task.t9', DENY, ALLOW);
|
||||
expect(res.ok).toBe(false);
|
||||
expect(a.c.topics.has('stream.task.t9')).toBe(false);
|
||||
});
|
||||
|
||||
it('D3：形状校验排在连接查找之前，失败带判别式 reason 供路由分流', async () => {
|
||||
const hub = new SseHub();
|
||||
const denyAccess = { allowed: async () => false };
|
||||
// 连接不存在 + 形状也不对 → 必须报形状（否则 HTTP 面永远回不出 422）
|
||||
expect(await hub.subscribe('nope', 'touch.staff.hack', denyAccess)).toMatchObject({
|
||||
expect(await hub.subscribe('nope', 'touch.staff.hack', DENY, DENY)).toMatchObject({
|
||||
ok: false,
|
||||
reason: 'bad-shape',
|
||||
});
|
||||
expect(await hub.subscribe('nope', 'touch.task.t1', denyAccess)).toMatchObject({
|
||||
expect(await hub.subscribe('nope', 'touch.task.t1', DENY, DENY)).toMatchObject({
|
||||
ok: false,
|
||||
reason: 'no-conn',
|
||||
});
|
||||
const a = conn('a', 'sub-a');
|
||||
hub.register(a.c);
|
||||
expect(await hub.subscribe('a', 'stream.task.t9', denyAccess)).toMatchObject({
|
||||
expect(await hub.subscribe('a', 'stream.task.t9', DENY, DENY)).toMatchObject({
|
||||
ok: false,
|
||||
reason: 'denied',
|
||||
});
|
||||
});
|
||||
|
||||
it('I6：touch.workflow.* 默认拒——没有授权规则的主题不进可订阅集', async () => {
|
||||
// 形状白名单曾经收着 touch.workflow.，而 subscribe 的鉴权分支只覆盖 touch.task./stream.task.：
|
||||
// 形状一过就直接进订阅集，任何登录用户订 touch.workflow.<任意 id> 都能收别人流程的推送。
|
||||
// N3 给工作流补上可见性规则之后再放回来。
|
||||
expect(isSubscribable('touch.workflow.w1')).toBe(false);
|
||||
it('N3（原 I6 反转）：touch.workflow.* 放回可订阅集——规则到位了才收得进来', async () => {
|
||||
// I6 当初把它摘出去，是因为**当时没有规则**：形状一过就直接进订阅集，而鉴权分支只覆盖
|
||||
// touch.task./stream.task.，任何登录用户订 touch.workflow.<任意 id> 都能收别人流程的推送。
|
||||
// N3 补上归属口（参与人/审批人，admin 旁路）之后放回来——放形状与补鉴权是同一次改动，
|
||||
// 下面两条用例就是"规则确实生效"的那一半，缺了它这条断言等于把 I6 原样退回去。
|
||||
expect(isSubscribable('touch.workflow.w1')).toBe(true);
|
||||
expect(isSubscribable('touch.task.t1')).toBe(true);
|
||||
expect(isSubscribable('stream.task.t1')).toBe(true);
|
||||
// 放回的只是这一节：多一节的主题、以及别的域照旧不可订阅
|
||||
expect(isSubscribable('touch.workflow.w1.extra')).toBe(false);
|
||||
expect(isSubscribable('touch.workflow.')).toBe(false);
|
||||
expect(isSubscribable('touch.staff.hack')).toBe(false);
|
||||
});
|
||||
|
||||
it('N3：工作流按归属口放行——拒则不入集不投递，准则入集且收得到', async () => {
|
||||
const hub = new SseHub();
|
||||
const a = conn('a', 'sub-a');
|
||||
hub.register(a.c);
|
||||
// 放行一切的 access 口：证明拒绝来自形状白名单本身，而不是碰巧被授权挡住了
|
||||
const res = await hub.subscribe('a', 'touch.workflow.w1', { allowed: async () => true });
|
||||
expect(res).toMatchObject({ ok: false, reason: 'bad-shape' });
|
||||
// 任务口一律放行：这样"被拒"只可能来自**工作流**那一口，而不是碰巧被任务授权挡住
|
||||
const denied = await hub.subscribe('a', 'touch.workflow.w1', ALLOW, DENY);
|
||||
expect(denied).toMatchObject({ ok: false, reason: 'denied' });
|
||||
expect(denied.ok === false && denied.message).toContain('参与人/审批人或 admin');
|
||||
expect(a.c.topics.size).toBe(0);
|
||||
hub.deliver('touch.workflow.w1', '{}');
|
||||
expect(a.got).toEqual([]);
|
||||
expect(a.got).toEqual([]); // 拒了就一条都不该扇过去
|
||||
|
||||
const asked: string[][] = [];
|
||||
const ok = await hub.subscribe('a', 'touch.workflow.w1', ALLOW, {
|
||||
allowed: async (id: string, sub: string): Promise<boolean> => {
|
||||
asked.push([id, sub]);
|
||||
return true;
|
||||
},
|
||||
});
|
||||
expect(ok).toEqual({ ok: true });
|
||||
expect(asked).toEqual([['w1', 'sub-a']]); // 问的是主题末节＋**连接的** staffSub，不是调用方的
|
||||
hub.deliver('touch.workflow.w1', '{"n":1}');
|
||||
expect(a.got.map((e) => e.topic)).toEqual(['touch.workflow.w1']);
|
||||
});
|
||||
|
||||
it('N3：admin 订工作流不问归属口——admin 全可见，白跑一次跨服务往返没意义', async () => {
|
||||
const hub = new SseHub();
|
||||
const a = conn('adm', 'sub-adm');
|
||||
hub.register({ ...a.c, isAdmin: true }); // topics/send 与 a.c 共用，断言照旧看 a
|
||||
let calls = 0;
|
||||
const counting = {
|
||||
allowed: async (): Promise<boolean> => {
|
||||
calls += 1;
|
||||
return false; // 真被问到就会拒——订上了即证明没问
|
||||
},
|
||||
};
|
||||
expect(await hub.subscribe('adm', 'touch.workflow.w9', counting, counting)).toEqual({ ok: true });
|
||||
expect(calls).toBe(0);
|
||||
expect(a.c.topics.has('touch.workflow.w9')).toBe(true);
|
||||
hub.deliver('touch.workflow.w9', '{}');
|
||||
expect(a.got.map((e) => e.topic)).toEqual(['touch.workflow.w9']);
|
||||
});
|
||||
|
||||
it('D12：shutdown 逐条调 close 把手并摘除连接', () => {
|
||||
@@ -123,7 +165,7 @@ describe('SSE HTTP 面', () => {
|
||||
return true;
|
||||
},
|
||||
};
|
||||
const app = new Hono().route('/api/stream', sseRoutes(hub, access));
|
||||
const app = new Hono().route('/api/stream', sseRoutes(hub, access, access));
|
||||
const token = await makeToken({ roles: ['user'], aud: 'api-gateway' });
|
||||
const res = await app.request('/api/stream/subscribe', {
|
||||
method: 'POST',
|
||||
@@ -143,7 +185,7 @@ describe('SSE HTTP 面', () => {
|
||||
const hub = new SseHub();
|
||||
const a = conn('live-7', 'test-sub-1');
|
||||
hub.register(a.c);
|
||||
const app = new Hono().route('/api/stream', sseRoutes(hub, { allowed: async () => true }));
|
||||
const app = new Hono().route('/api/stream', sseRoutes(hub, ALLOW, ALLOW));
|
||||
const token = await makeToken({ roles: ['user'], aud: 'api-gateway' });
|
||||
const post = async (payload: unknown): Promise<Response> =>
|
||||
app.request('/api/stream/subscribe', {
|
||||
@@ -218,6 +260,35 @@ describe('SSE HTTP 面', () => {
|
||||
}
|
||||
});
|
||||
|
||||
it('workflow-access 与 task-access 同形：非 200 → false（失败关闭），打的是 /workflow/:id/access', async () => {
|
||||
const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
|
||||
const calls: string[] = [];
|
||||
try {
|
||||
vi.stubGlobal('fetch', (url: string | URL) => {
|
||||
calls.push(String(url));
|
||||
return Promise.resolve(new Response('down', { status: 503 }));
|
||||
});
|
||||
const wf = createHttpWorkflowAccess(async () => 'stub-token');
|
||||
expect(await wf.allowed('w 1', 'sub/a')).toBe(false);
|
||||
// 路径与任务口分开：任务侧是两条端点，判据也不同源
|
||||
expect(calls[0]).toContain('/workflow/w%201/access?staff=sub%2Fa');
|
||||
expect(warn).toHaveBeenCalled(); // 不出声的"人人被拒"无从诊断
|
||||
|
||||
vi.stubGlobal('fetch', () =>
|
||||
Promise.resolve(
|
||||
new Response(JSON.stringify({ allowed: true }), {
|
||||
status: 200,
|
||||
headers: { 'content-type': 'application/json' },
|
||||
}),
|
||||
),
|
||||
);
|
||||
expect(await wf.allowed('w1', 's1')).toBe(true);
|
||||
} finally {
|
||||
vi.unstubAllGlobals();
|
||||
warn.mockRestore();
|
||||
}
|
||||
});
|
||||
|
||||
it('D11/D12：hello 先于回放；hub.shutdown() 能把在途长连收尾', async () => {
|
||||
const hub = new SseHub(8);
|
||||
const app = buildApp(hub);
|
||||
|
||||
Reference in New Issue
Block a user