Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 suyx
|
add240775b | ||
|
suyx
|
5e2d4e7aaf |
@@ -0,0 +1,35 @@
|
||||
# 项目开发约定
|
||||
|
||||
## Git 提交规范
|
||||
|
||||
- 每个 `TASK-*` 或后续工单都必须在独立 worktree 和分支中开发。
|
||||
- 每个可验证的开发步骤完成后立即创建 Git 提交并推送到 Gitea `intelligrow` 组织下的对应远端分支，不得等第一版全部完成后再统一提交。
|
||||
- 提交信息使用中文描述，采用 Conventional Commits 常见前缀，格式为：
|
||||
|
||||
```text
|
||||
<type>(<scope>): <中文描述>
|
||||
```
|
||||
|
||||
- `scope` 可选；描述应简短、明确，说明本次提交实际完成的内容，不写空泛描述。
|
||||
- 常用前缀：
|
||||
- `feat`：新增功能
|
||||
- `fix`：修复问题
|
||||
- `docs`：文档修改
|
||||
- `refactor`：重构，不改变外部行为
|
||||
- `test`：新增或调整测试
|
||||
- `perf`：性能优化
|
||||
- `build`：构建或依赖调整
|
||||
- `ci`：持续集成配置调整
|
||||
- `style`：不影响逻辑的格式调整
|
||||
- `chore`：其他维护工作
|
||||
- `revert`：回滚提交
|
||||
- 任务提交应包含任务号或范围信息，推荐格式：
|
||||
|
||||
```text
|
||||
feat(WP7-05): 增加候选环境覆盖证据门禁
|
||||
fix(WP5-04): 修复资源访问安全边界
|
||||
test(WP5-lineage): 增加连续提交链验证
|
||||
```
|
||||
|
||||
- 提交完成后必须核对本地提交 SHA、远端分支和远端完整 SHA；本地未提交、推送失败或远端 SHA 不一致时，不得宣告任务完成，也不得开始依赖该任务的下一项任务。
|
||||
- 不得在提交信息、日志、测试证据或代码中写入真实凭据、验证码、用户绝对路径或私有响应正文。
|
||||
@@ -9,7 +9,6 @@
|
||||
"typecheck": "tsc --noEmit -p tsconfig.json"
|
||||
},
|
||||
"dependencies": {
|
||||
"@dada/asset-release-manifest": "workspace:*",
|
||||
"@dada/shared-contracts": "workspace:*",
|
||||
"@fastify/multipart": "10.1.0",
|
||||
"@fastify/swagger": "9.8.1",
|
||||
|
||||
@@ -1,194 +0,0 @@
|
||||
import type BetterSqlite3 from "better-sqlite3";
|
||||
|
||||
import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
|
||||
|
||||
import type { BrowserSupportRelease } from "./browser-support.js";
|
||||
import type { ManagedStorage } from "./managed-storage.js";
|
||||
import type { ModelConfigurationService } from "./model-configuration.js";
|
||||
|
||||
type AdminService = AdminServicesStorageResponse["services"][number];
|
||||
const adminServiceIds = ["resend", "amap", "ai_gateway", "worker", "api", "asset_root"] as const;
|
||||
const forbiddenDiagnosticPatterns = [
|
||||
/\b(?:api[_ -]?key|secret|password|credential|authorization|bearer|session[_ -]?token|cookie|prompt|email|token)\b/i,
|
||||
/[A-Z]:[\\/](?:Users|Documents|ProgramData|Windows)[\\/]/i,
|
||||
/\\\\[^\\\s]+\\[^\s]+/,
|
||||
/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i,
|
||||
/https?:\/\//i,
|
||||
];
|
||||
const safePauseReasons = new Set([
|
||||
"asset_root_state_missing", "balance_insufficient", "configured_disabled", "contract_blocked",
|
||||
"contract_unverified", "gateway_balance_insufficient", "gateway_paused", "health_check_failed",
|
||||
"model_disabled", "provider_unavailable", "quota_exhausted", "service_state_missing", "unknown",
|
||||
"worker_degraded", "worker_state_missing", "worker_stopped",
|
||||
]);
|
||||
|
||||
function iso(value: number | string | null | undefined) {
|
||||
if (value === null || value === undefined) return null;
|
||||
return typeof value === "number" ? new Date(value).toISOString() : value;
|
||||
}
|
||||
|
||||
function tableExists(database: BetterSqlite3.Database, table: string) {
|
||||
return Boolean(database.prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = ?").get(table));
|
||||
}
|
||||
|
||||
function safeService(
|
||||
service_id: AdminService["service_id"],
|
||||
status: AdminService["status"],
|
||||
impact_scope: AdminService["impact_scope"],
|
||||
configured: boolean,
|
||||
checked_at: string | null,
|
||||
pause_reason: string | null = null,
|
||||
): AdminService {
|
||||
return { checked_at, configured, impact_scope, pause_reason, service_id, status };
|
||||
}
|
||||
|
||||
function safeReason(value: unknown) {
|
||||
return typeof value === "string" && safePauseReasons.has(value) ? value : null;
|
||||
}
|
||||
|
||||
function serviceUsage(database: BetterSqlite3.Database, serviceName: string) {
|
||||
if (!tableExists(database, "external_service_usage")) return undefined;
|
||||
const columns = new Set((database.prepare("PRAGMA table_info(external_service_usage)").all() as Array<{ name: string }>).map((column) => column.name));
|
||||
const serviceColumn = columns.has("service_name") ? "service_name" : columns.has("service_id") ? "service_id" : undefined;
|
||||
if (!serviceColumn || !columns.has("service_status")) return undefined;
|
||||
const row = database.prepare(`SELECT service_status, ${columns.has("checked_at") ? "checked_at" : "NULL AS checked_at"}, ${columns.has("pause_reason") ? "pause_reason" : "NULL AS pause_reason"} FROM external_service_usage WHERE ${serviceColumn} = ? ORDER BY rowid DESC LIMIT 1`).get(serviceName) as { service_status: string; checked_at: number | string | null; pause_reason: string | null } | undefined;
|
||||
if (!row) return undefined;
|
||||
const status = new Set<AdminService["status"]>(["active", "paused_quota", "paused_provider", "disabled"]).has(row.service_status as AdminService["status"])
|
||||
? row.service_status as AdminService["status"]
|
||||
: "degraded";
|
||||
return { status, checked_at: iso(row.checked_at), pause_reason: safeReason(row.pause_reason) };
|
||||
}
|
||||
|
||||
function workerStatus(database: BetterSqlite3.Database) {
|
||||
if (!tableExists(database, "worker_runtime_state")) return { status: "unavailable" as const, checked_at: null, pause_reason: "worker_state_missing" };
|
||||
const row = database.prepare("SELECT status, reason, updated_at FROM worker_runtime_state WHERE singleton = 1").get() as { status: string; reason: string | null; updated_at: number | string | null } | undefined;
|
||||
if (!row) return { status: "unavailable" as const, checked_at: null, pause_reason: "worker_state_missing" };
|
||||
return {
|
||||
status: row.status === "ready" ? "active" as const : row.status === "degraded" ? "degraded" as const : "unavailable" as const,
|
||||
checked_at: iso(row.updated_at),
|
||||
pause_reason: safeReason(row.reason),
|
||||
};
|
||||
}
|
||||
|
||||
export function createAdminServicesStorageProvider(input: {
|
||||
database: BetterSqlite3.Database;
|
||||
models?: ModelConfigurationService;
|
||||
storage?: ManagedStorage;
|
||||
assetRoot?: Pick<AdminService, "configured" | "status" | "checked_at" | "pause_reason">;
|
||||
clock?: () => number;
|
||||
}): () => AdminServicesStorageResponse {
|
||||
const clock = input.clock ?? Date.now;
|
||||
return () => {
|
||||
const generatedAt = new Date(clock()).toISOString();
|
||||
const resend = serviceUsage(input.database, "resend");
|
||||
const amap = serviceUsage(input.database, "amap");
|
||||
const worker = workerStatus(input.database);
|
||||
const modelRuntime = input.models?.read().models ?? [];
|
||||
const unavailableModels = modelRuntime.filter((model) => !model.runtime_availability.available_for_new_jobs);
|
||||
const gatewayReason = unavailableModels[0]?.runtime_availability.reason ?? null;
|
||||
const storageState = input.storage?.getState();
|
||||
const cleanupPendingCount = tableExists(input.database, "file_cleanup_queue")
|
||||
? (input.database.prepare("SELECT COUNT(*) AS count FROM file_cleanup_queue WHERE status IN ('pending', 'failed')").get() as { count: number }).count
|
||||
: 0;
|
||||
const services: AdminService[] = [
|
||||
safeService("resend", resend?.status ?? "unavailable", "authentication", Boolean(resend), resend?.checked_at ?? null, resend?.pause_reason ?? "service_state_missing"),
|
||||
safeService("amap", amap?.status ?? "unavailable", "location", Boolean(amap), amap?.checked_at ?? null, amap?.pause_reason ?? "service_state_missing"),
|
||||
safeService("ai_gateway", unavailableModels.length > 0 ? "degraded" : modelRuntime.length > 0 ? "active" : "unavailable", "generation", modelRuntime.length > 0, generatedAt, safeReason(gatewayReason)),
|
||||
safeService("worker", worker.status, "generation", worker.status !== "unavailable", worker.checked_at, worker.pause_reason),
|
||||
safeService("api", "active", "api", true, generatedAt),
|
||||
safeService(
|
||||
"asset_root",
|
||||
input.assetRoot?.status ?? "unavailable",
|
||||
"storage",
|
||||
input.assetRoot?.configured ?? false,
|
||||
input.assetRoot?.checked_at ?? null,
|
||||
input.assetRoot?.pause_reason ?? "asset_root_state_missing",
|
||||
),
|
||||
];
|
||||
return assertSafeAdminServicesStorage({
|
||||
generated_at: generatedAt,
|
||||
services,
|
||||
storage: {
|
||||
capacity_notice_level: storageState?.capacity_notice_level ?? "normal",
|
||||
cleanup_pending_count: cleanupPendingCount,
|
||||
data_root_ref: "configured_local_data_root",
|
||||
hard_limit_bytes: storageState?.hard_limit_bytes ?? 5_368_709_120,
|
||||
last_measured_at: storageState?.measured_at ?? null,
|
||||
managed_content_bytes: storageState?.managed_content_bytes ?? 0,
|
||||
remeasurement_required: storageState?.storage_status === "unavailable",
|
||||
status: storageState?.storage_status ?? "unavailable",
|
||||
storage_backend: "local_filesystem",
|
||||
},
|
||||
});
|
||||
};
|
||||
}
|
||||
|
||||
function diagnosticText(input: AdminServicesStorageResponse, system: AdminDiagnosticsResponse["system"]) {
|
||||
const lines = [
|
||||
"Dada P0-A diagnostics",
|
||||
`app_version=${system.app_version}`,
|
||||
`api_status=${system.api_status}`,
|
||||
`worker_status=${system.worker_status}`,
|
||||
`storage_status=${input.storage.status}`,
|
||||
`capacity_notice_level=${input.storage.capacity_notice_level}`,
|
||||
`managed_content_bytes=${input.storage.managed_content_bytes}`,
|
||||
`hard_limit_bytes=${input.storage.hard_limit_bytes}`,
|
||||
`cleanup_pending_count=${input.storage.cleanup_pending_count}`,
|
||||
];
|
||||
for (const service of input.services) lines.push(`service.${service.service_id}=${service.status}`);
|
||||
return lines.join("\n");
|
||||
}
|
||||
|
||||
export function createAdminDiagnosticsProvider(input: {
|
||||
servicesStorage: () => AdminServicesStorageResponse;
|
||||
browserSupportRelease?: BrowserSupportRelease;
|
||||
appVersion?: string;
|
||||
clock?: () => number;
|
||||
}): () => AdminDiagnosticsResponse {
|
||||
const clock = input.clock ?? Date.now;
|
||||
return () => {
|
||||
const services = input.servicesStorage();
|
||||
const system: AdminDiagnosticsResponse["system"] = {
|
||||
api_status: "ready",
|
||||
app_version: input.appVersion ?? input.browserSupportRelease?.appVersion ?? "0.0.0",
|
||||
browser_support: (input.browserSupportRelease?.browsers ?? []).map((browser) => ({
|
||||
brand: browser.brand,
|
||||
major: Number.parseInt(browser.fullVersion.split(".")[0] ?? "0", 10),
|
||||
})).filter((browser) => Number.isSafeInteger(browser.major) && browser.major > 0),
|
||||
worker_status: services.services.find((service) => service.service_id === "worker")?.status === "active"
|
||||
? "ready"
|
||||
: services.services.find((service) => service.service_id === "worker")?.status === "unavailable"
|
||||
? "unavailable"
|
||||
: "degraded",
|
||||
};
|
||||
return assertSafeAdminDiagnostics({
|
||||
generated_at: new Date(clock()).toISOString(),
|
||||
diagnostic_text: diagnosticText(services, system),
|
||||
services,
|
||||
system,
|
||||
});
|
||||
};
|
||||
}
|
||||
|
||||
export function assertSafeAdminServicesStorage(input: AdminServicesStorageResponse) {
|
||||
const ids = input.services.map((service) => service.service_id);
|
||||
if (ids.length !== adminServiceIds.length || new Set(ids).size !== adminServiceIds.length
|
||||
|| adminServiceIds.some((serviceId) => !ids.includes(serviceId))) {
|
||||
throw new Error("admin_service_state_incomplete");
|
||||
}
|
||||
if (input.services.some((service) => service.pause_reason !== null && !safePauseReasons.has(service.pause_reason))) {
|
||||
throw new Error("admin_services_redaction_failed");
|
||||
}
|
||||
if (forbiddenDiagnosticPatterns.some((pattern) => pattern.test(JSON.stringify(input)))) {
|
||||
throw new Error("admin_services_redaction_failed");
|
||||
}
|
||||
return input;
|
||||
}
|
||||
|
||||
export function assertSafeAdminDiagnostics(input: AdminDiagnosticsResponse) {
|
||||
assertSafeAdminServicesStorage(input.services);
|
||||
if (forbiddenDiagnosticPatterns.some((pattern) => pattern.test(input.diagnostic_text))) {
|
||||
throw new Error("admin_diagnostics_redaction_failed");
|
||||
}
|
||||
return input;
|
||||
}
|
||||
+1
-229
@@ -10,9 +10,6 @@ import {
|
||||
AccountProfileUpdateResponseSchema,
|
||||
AccountSettingsResponseSchema,
|
||||
AdminAuthenticatedUserSchema,
|
||||
AdminDiagnosticsResponseSchema,
|
||||
AdminOverviewResponseSchema,
|
||||
AdminServicesStorageResponseSchema,
|
||||
AdminCreditParamsSchema,
|
||||
AdminLoginCompleteRequestSchema,
|
||||
AdminLoginCompleteResponseSchema,
|
||||
@@ -113,9 +110,6 @@ import {
|
||||
type BootstrapResponse,
|
||||
type AdminLoginCompleteRequest,
|
||||
type AdminLoginSendRequest,
|
||||
type AdminOverviewResponse,
|
||||
type AdminDiagnosticsResponse,
|
||||
type AdminServicesStorageResponse,
|
||||
type AccountDeletionCompleteRequest,
|
||||
type AccountProfileUpdateRequest,
|
||||
type AdminCreditParams,
|
||||
@@ -140,7 +134,6 @@ import {
|
||||
type RegistrationCompleteRequest,
|
||||
type RegistrationSendRequest,
|
||||
} from "@dada/shared-contracts";
|
||||
import type { AssetReleaseReader } from "@dada/asset-release-manifest";
|
||||
import swagger from "@fastify/swagger";
|
||||
import multipart from "@fastify/multipart";
|
||||
import Fastify, { type FastifyReply } from "fastify";
|
||||
@@ -184,7 +177,6 @@ import type { RecentAssetService } from "./recent-assets.js";
|
||||
import type { AmapAdapter } from "./amap-adapter.js";
|
||||
import { ModelConfigurationError } from "./model-configuration.js";
|
||||
import type { ModelConfigurationService } from "./model-configuration.js";
|
||||
import { assertSafeAdminDiagnostics, assertSafeAdminServicesStorage } from "./admin-state.js";
|
||||
|
||||
const defaultBootstrap: BootstrapResponse = {
|
||||
app_version: "0.0.0",
|
||||
@@ -199,11 +191,7 @@ const defaultBootstrap: BootstrapResponse = {
|
||||
};
|
||||
|
||||
export interface CreateAppOptions {
|
||||
adminDiagnostics?: () => AdminDiagnosticsResponse | Promise<AdminDiagnosticsResponse>;
|
||||
adminOverview?: () => AdminOverviewResponse | Promise<AdminOverviewResponse>;
|
||||
adminServicesStorage?: () => AdminServicesStorageResponse | Promise<AdminServicesStorageResponse>;
|
||||
amap?: AmapAdapter;
|
||||
assetReleases?: AssetReleaseReader;
|
||||
bootstrap?: () => BootstrapResponse | Promise<BootstrapResponse>;
|
||||
browserGate?: boolean;
|
||||
browserSupportRelease?: BrowserSupportRelease;
|
||||
@@ -217,17 +205,6 @@ export interface CreateAppOptions {
|
||||
publicAssets?: PublicAssetResolver;
|
||||
recentAssets?: RecentAssetService;
|
||||
projects?: ProjectService;
|
||||
previewAssetAuthorizer?: (input: {
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
userId: string;
|
||||
}) => boolean | Promise<boolean>;
|
||||
privateAssetAdminAuthorizer?: (input: {
|
||||
adminUserId: string;
|
||||
ownerId: string;
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
}) => boolean | Promise<boolean>;
|
||||
registration?: RegistrationService;
|
||||
}
|
||||
|
||||
@@ -698,9 +675,6 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
AdminLoginCompleteRequestSchema,
|
||||
AdminLoginCompleteResponseSchema,
|
||||
AdminSessionResponseSchema,
|
||||
AdminOverviewResponseSchema,
|
||||
AdminServicesStorageResponseSchema,
|
||||
AdminDiagnosticsResponseSchema,
|
||||
CreditSummarySchema,
|
||||
CreditEntryTypeSchema,
|
||||
CreditEntryStatusSchema,
|
||||
@@ -842,27 +816,13 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
status: "ready",
|
||||
}));
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/public/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const manifest = options.assetReleases?.project("public_release_asset", resourceVersion);
|
||||
if (!manifest) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "public, max-age=31536000, immutable");
|
||||
reply.header("ETag", `"sha256-${manifest.manifest_sha256}"`);
|
||||
return manifest;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/public/:resourceVersion/:assetId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
const { assetId, resourceVersion } = request.params as { assetId?: string; resourceVersion?: string };
|
||||
const resource = assetId && resourceVersion
|
||||
? options.assetReleases?.read("public_release_asset", resourceVersion, assetId)
|
||||
?? options.publicAssets?.read(resourceVersion, assetId)
|
||||
? options.publicAssets?.read(resourceVersion, assetId)
|
||||
: undefined;
|
||||
if (!resource) return reply.code(404).send();
|
||||
reply.type(resource.mimeType);
|
||||
@@ -873,111 +833,6 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/preview/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const session = token ? options.registration.readUserSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const available = options.assetReleases?.project("internal_preview_asset", resourceVersion);
|
||||
if (!available || !options.previewAssetAuthorizer) return reply.code(404).send();
|
||||
const authorizedIds: string[] = [];
|
||||
for (const item of available.items) {
|
||||
if (await options.previewAssetAuthorizer({
|
||||
releaseVersion: resourceVersion,
|
||||
resourceId: item.resource_id,
|
||||
userId: session.userId,
|
||||
})) authorizedIds.push(item.resource_id);
|
||||
}
|
||||
if (authorizedIds.length === 0) return reply.code(404).send();
|
||||
const manifest = options.assetReleases?.project("internal_preview_asset", resourceVersion, { resourceIds: authorizedIds });
|
||||
if (!manifest) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Vary", "Cookie");
|
||||
return manifest;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/preview/:resourceVersion/:assetId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const session = token ? options.registration.readUserSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
const { assetId, resourceVersion } = request.params as { assetId: string; resourceVersion: string };
|
||||
const authorized = await options.previewAssetAuthorizer?.({ resourceId: assetId, releaseVersion: resourceVersion, userId: session.userId });
|
||||
const resource = authorized ? options.assetReleases?.read("internal_preview_asset", resourceVersion, assetId) : undefined;
|
||||
if (!resource) return reply.code(404).send();
|
||||
reply.type(resource.mimeType);
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Content-Disposition", "inline");
|
||||
reply.header("Vary", "Cookie");
|
||||
return resource.bytes;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/private-assets/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const token = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const session = token ? options.registration.readUserSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
const { resourceVersion } = request.params as { resourceVersion: string };
|
||||
const manifest = options.assetReleases?.project("private_user_asset", resourceVersion, { ownerId: session.userId });
|
||||
if (!manifest) return reply.code(404).send();
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Vary", "Cookie");
|
||||
return manifest;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/private-assets/:resourceVersion/:assetId",
|
||||
{ schema: { hide: true } },
|
||||
async (request, reply) => {
|
||||
if (!options.registration) {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
const userToken = cookieValue(headerValue(request.headers.cookie), userSessionCookieName);
|
||||
const userSession = userToken ? options.registration.readUserSession(userToken) : undefined;
|
||||
const adminToken = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const adminSession = adminToken ? options.registration.readAdminSession(adminToken) : undefined;
|
||||
if (!userSession && !adminSession) {
|
||||
return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
}
|
||||
const { assetId, resourceVersion } = request.params as { assetId: string; resourceVersion: string };
|
||||
const resource = options.assetReleases?.read("private_user_asset", resourceVersion, assetId);
|
||||
if (!resource?.ownerId) return reply.code(404).send();
|
||||
const controlledAdmin = adminSession
|
||||
? await options.privateAssetAdminAuthorizer?.({
|
||||
adminUserId: adminSession.user_id,
|
||||
ownerId: resource.ownerId,
|
||||
releaseVersion: resource.releaseVersion,
|
||||
resourceId: resource.resourceId,
|
||||
})
|
||||
: false;
|
||||
if (userSession?.userId !== resource.ownerId && !controlledAdmin) return reply.code(404).send();
|
||||
reply.type(resource.mimeType);
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Content-Disposition", "inline");
|
||||
reply.header("Vary", "Cookie");
|
||||
return resource.bytes;
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/recent",
|
||||
{
|
||||
@@ -1216,89 +1071,6 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/overview",
|
||||
{
|
||||
schema: {
|
||||
operationId: "getAdminOverview",
|
||||
response: {
|
||||
200: Type.Ref(AdminOverviewResponseSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Null(),
|
||||
},
|
||||
tags: ["Admin Operations"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!options.registration) return reply.code(503).send(null);
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const session = token ? options.registration.readAdminSession(token) : undefined;
|
||||
if (!session) {
|
||||
return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
}
|
||||
if (!options.adminOverview) return reply.code(503).send(null);
|
||||
try {
|
||||
return await options.adminOverview();
|
||||
} catch {
|
||||
return reply.code(503).send(null);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/services-storage",
|
||||
{
|
||||
schema: {
|
||||
operationId: "getAdminServicesStorage",
|
||||
response: {
|
||||
200: Type.Ref(AdminServicesStorageResponseSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Null(),
|
||||
},
|
||||
tags: ["Admin Operations"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!options.registration) return reply.code(503).send(null);
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const session = token ? options.registration.readAdminSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
if (!options.adminServicesStorage) return reply.code(503).send(null);
|
||||
try {
|
||||
return assertSafeAdminServicesStorage(await options.adminServicesStorage());
|
||||
} catch {
|
||||
return reply.code(503).send(null);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/diagnostics",
|
||||
{
|
||||
schema: {
|
||||
operationId: "getAdminDiagnostics",
|
||||
response: {
|
||||
200: Type.Ref(AdminDiagnosticsResponseSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Null(),
|
||||
},
|
||||
tags: ["Admin Operations"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!options.registration) return reply.code(503).send(null);
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const session = token ? options.registration.readAdminSession(token) : undefined;
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
if (!options.adminDiagnostics) return reply.code(503).send(null);
|
||||
try {
|
||||
return assertSafeAdminDiagnostics(await options.adminDiagnostics());
|
||||
} catch {
|
||||
return reply.code(503).send(null);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.post(
|
||||
"/api/v1/auth/login/send",
|
||||
{
|
||||
|
||||
@@ -18,7 +18,6 @@ import { StructuredJsonlLogger } from "./structured-log.js";
|
||||
import { attachApiSupervisorControl, initializeApiCredentialClients, receiveApiCredentials } from "./supervisor-channel.js";
|
||||
import { ModelConfigurationService } from "./model-configuration.js";
|
||||
import { MockAmapAdapter } from "./amap-adapter.js";
|
||||
import { createAdminDiagnosticsProvider, createAdminServicesStorageProvider } from "./admin-state.js";
|
||||
|
||||
const credentialChannelEnabled = process.argv.includes("--dada-credential-stdin");
|
||||
let registration: RegistrationService | undefined;
|
||||
@@ -71,22 +70,7 @@ if (credentialChannelEnabled) {
|
||||
}
|
||||
|
||||
const browserSupportRelease = readBrowserSupportRelease(resolve("RELEASE.json"));
|
||||
const adminServicesStorage = registration
|
||||
? createAdminServicesStorageProvider({
|
||||
database: registration.database,
|
||||
...(models ? { models } : {}),
|
||||
...(storage ? { storage } : {}),
|
||||
})
|
||||
: undefined;
|
||||
const adminDiagnostics = adminServicesStorage
|
||||
? createAdminDiagnosticsProvider({
|
||||
...(browserSupportRelease ? { browserSupportRelease, appVersion: browserSupportRelease.appVersion } : {}),
|
||||
servicesStorage: adminServicesStorage,
|
||||
})
|
||||
: undefined;
|
||||
const app = await createApp({
|
||||
...(adminServicesStorage ? { adminServicesStorage } : {}),
|
||||
...(adminDiagnostics ? { adminDiagnostics } : {}),
|
||||
amap: new MockAmapAdapter(),
|
||||
...(browserSupportRelease ? { browserSupportRelease } : {}),
|
||||
...(credits ? { credits } : {}),
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { useCallback, useEffect, useMemo, useRef, useState } from "react";
|
||||
import { useEffect, useMemo, useRef, useState } from "react";
|
||||
|
||||
import "./admin-models.css";
|
||||
|
||||
@@ -64,7 +64,7 @@ export function AdminModelsPage() {
|
||||
const priorityRefs = useRef<Record<string, HTMLInputElement | null>>({});
|
||||
const defaultRefs = useRef<Record<string, HTMLInputElement | null>>({});
|
||||
|
||||
const load = useCallback(async () => {
|
||||
async function load() {
|
||||
setLoadingFailed(false);
|
||||
setConflicted(false);
|
||||
try {
|
||||
@@ -80,16 +80,9 @@ export function AdminModelsPage() {
|
||||
} catch {
|
||||
setLoadingFailed(true);
|
||||
}
|
||||
}, []);
|
||||
}
|
||||
|
||||
useEffect(() => { void load(); }, [load]);
|
||||
|
||||
useEffect(() => {
|
||||
if (typeof EventSource === "undefined") return undefined;
|
||||
const source = new EventSource("/api/v1/events");
|
||||
source.onmessage = () => { void load(); };
|
||||
return () => source.close();
|
||||
}, [load]);
|
||||
useEffect(() => { void load(); }, []);
|
||||
|
||||
const validation = useMemo(() => {
|
||||
if (!draft) return { valid: false, message: "" };
|
||||
@@ -154,7 +147,11 @@ export function AdminModelsPage() {
|
||||
|
||||
return (
|
||||
<div className="admin-models-page">
|
||||
<main id="admin-main">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a href="/admin/users">用户</a><a aria-current="page" href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<header className="admin-models-heading">
|
||||
<div><p>MODEL OPERATIONS</p><h1>模型配置</h1></div>
|
||||
{configuration ? <strong>配置集合 v{configuration.config_set_version}</strong> : null}
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
.admin-services-storage { max-width: 1180px; }
|
||||
.admin-services-heading { align-items: end; }
|
||||
.admin-services-heading-actions { align-items: center; display: flex; gap: 16px; }
|
||||
.admin-services-heading-actions button, .admin-diagnostics-section button { background: #111827; border: 0; color: #fff; cursor: pointer; font: inherit; padding: 10px 14px; }
|
||||
.admin-health-section { border-top: 1px solid #d9dde5; margin-top: 26px; padding-top: 22px; }
|
||||
.admin-health-section > header { align-items: center; display: flex; justify-content: space-between; margin-bottom: 18px; }
|
||||
.admin-health-section h3 { margin: 4px 0 0; }
|
||||
.admin-health-section header p { color: #7b8493; font-size: 11px; letter-spacing: .12em; margin: 0; }
|
||||
.admin-safe-note { color: #667085; font-size: 13px; }
|
||||
.admin-service-grid { display: grid; gap: 12px; grid-template-columns: repeat(3, minmax(0, 1fr)); }
|
||||
.admin-service-card { background: #fff; border: 1px solid #e1e5ea; min-height: 160px; padding: 18px; }
|
||||
.admin-service-card.is-degraded, .admin-service-card.is-paused_quota, .admin-service-card.is-paused_provider, .admin-service-card.is-unavailable { border-color: #e5b6b6; }
|
||||
.admin-service-card-heading { align-items: center; display: flex; justify-content: space-between; }
|
||||
.admin-service-card-heading span, .admin-storage-state { color: #147a50; font-size: 13px; }
|
||||
.admin-service-card.is-degraded .admin-service-card-heading span, .admin-service-card.is-paused_quota .admin-service-card-heading span, .admin-service-card.is-paused_provider .admin-service-card-heading span, .admin-service-card.is-unavailable .admin-service-card-heading span { color: #b42318; }
|
||||
.admin-service-card dl, .admin-storage-details { display: grid; gap: 10px; margin: 18px 0 0; }
|
||||
.admin-service-card dl div, .admin-storage-details div { align-items: baseline; display: flex; justify-content: space-between; }
|
||||
.admin-service-card dt, .admin-storage-details dt { color: #667085; font-size: 12px; }
|
||||
.admin-service-card dd, .admin-storage-details dd { margin: 0; text-align: right; }
|
||||
.admin-storage-state.is-full, .admin-storage-state.is-unavailable { color: #b42318; }
|
||||
.admin-storage-metrics { display: grid; gap: 16px; grid-template-columns: repeat(4, minmax(0, 1fr)); }
|
||||
.admin-storage-metrics div { background: #f7f8fa; padding: 14px 16px; }
|
||||
.admin-storage-metrics span { color: #667085; display: block; font-size: 12px; }
|
||||
.admin-storage-metrics strong { display: block; font-size: 20px; margin-top: 6px; }
|
||||
.admin-storage-progress { background: #e5e7eb; height: 8px; margin-top: 18px; overflow: hidden; }
|
||||
.admin-storage-progress span { background: #147a50; display: block; height: 100%; }
|
||||
.admin-storage-description { color: #667085; font-size: 13px; line-height: 1.7; max-width: 780px; }
|
||||
.admin-storage-description code { color: #344054; }
|
||||
.admin-diagnostics-section > header button:disabled { background: #98a2b3; cursor: not-allowed; }
|
||||
.admin-diagnostics-section > p { color: #667085; font-size: 13px; }
|
||||
.admin-diagnostics-section pre { background: #111827; color: #d1fadf; font: 12px/1.65 ui-monospace, SFMono-Regular, Consolas, monospace; margin: 16px 0 0; max-height: 280px; overflow: auto; padding: 16px; white-space: pre-wrap; }
|
||||
.admin-services-loading { display: grid; gap: 12px; grid-template-columns: repeat(3, 1fr); }
|
||||
.admin-services-loading span, .admin-diagnostics-placeholder { background: #eef1f4; display: block; height: 160px; }
|
||||
.admin-services-failure { align-items: center; background: #fff4f2; color: #b42318; display: flex; gap: 16px; justify-content: space-between; padding: 14px 16px; }
|
||||
.admin-services-failure button { background: transparent; border: 1px solid #b42318; color: #b42318; cursor: pointer; padding: 6px 12px; }
|
||||
@media (max-width: 900px) { .admin-service-grid, .admin-storage-metrics { grid-template-columns: repeat(2, minmax(0, 1fr)); } }
|
||||
@media (max-width: 620px) { .admin-service-grid, .admin-storage-metrics { grid-template-columns: 1fr; } .admin-services-heading-actions { align-items: flex-end; flex-direction: column; gap: 8px; } }
|
||||
@@ -1,136 +0,0 @@
|
||||
import { useCallback, useEffect, useState } from "react";
|
||||
|
||||
import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
|
||||
|
||||
import "./admin-services-storage.css";
|
||||
|
||||
const serviceLabels: Record<AdminServicesStorageResponse["services"][number]["service_id"], string> = {
|
||||
ai_gateway: "AI 网关",
|
||||
amap: "高德",
|
||||
api: "API",
|
||||
asset_root: "素材根",
|
||||
resend: "Resend",
|
||||
worker: "Worker",
|
||||
};
|
||||
|
||||
const statusLabels: Record<AdminServicesStorageResponse["services"][number]["status"], string> = {
|
||||
active: "正常",
|
||||
degraded: "有异常",
|
||||
disabled: "已停用",
|
||||
paused_provider: "供应商暂停",
|
||||
paused_quota: "额度暂停",
|
||||
unavailable: "不可用",
|
||||
};
|
||||
|
||||
const impactLabels: Record<AdminServicesStorageResponse["services"][number]["impact_scope"], string> = {
|
||||
account: "账户模型",
|
||||
api: "后台接口",
|
||||
authentication: "认证",
|
||||
generation: "生成",
|
||||
location: "定位",
|
||||
model: "单模型",
|
||||
none: "无",
|
||||
storage: "存储",
|
||||
unknown: "未知范围",
|
||||
};
|
||||
|
||||
function formatTime(value: string | null) {
|
||||
if (!value) return "未记录";
|
||||
return new Intl.DateTimeFormat("zh-CN", { dateStyle: "short", timeStyle: "short" }).format(new Date(value));
|
||||
}
|
||||
|
||||
async function getJson<T>(url: string) {
|
||||
const response = await fetch(url, { credentials: "same-origin" });
|
||||
if (response.status === 401) window.dispatchEvent(new Event("dada:session-invalid"));
|
||||
if (!response.ok) throw new Error("admin_state_unavailable");
|
||||
return await response.json() as T;
|
||||
}
|
||||
|
||||
export function AdminServicesStoragePage() {
|
||||
const [state, setState] = useState<AdminServicesStorageResponse>();
|
||||
const [diagnostics, setDiagnostics] = useState<AdminDiagnosticsResponse>();
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [failed, setFailed] = useState(false);
|
||||
const [copied, setCopied] = useState(false);
|
||||
|
||||
const load = useCallback(async () => {
|
||||
setLoading(true);
|
||||
setFailed(false);
|
||||
try {
|
||||
const [nextState, nextDiagnostics] = await Promise.all([
|
||||
getJson<AdminServicesStorageResponse>("/api/v1/admin/services-storage"),
|
||||
getJson<AdminDiagnosticsResponse>("/api/v1/admin/diagnostics"),
|
||||
]);
|
||||
setState(nextState);
|
||||
setDiagnostics(nextDiagnostics);
|
||||
} catch {
|
||||
setFailed(true);
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}, []);
|
||||
|
||||
useEffect(() => { void load(); }, [load]);
|
||||
|
||||
async function copyDiagnostics() {
|
||||
if (!diagnostics) return;
|
||||
try {
|
||||
await navigator.clipboard.writeText(diagnostics.diagnostic_text);
|
||||
setCopied(true);
|
||||
window.setTimeout(() => setCopied(false), 1800);
|
||||
} catch {
|
||||
setCopied(false);
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<main className="admin-services-storage" id="admin-main">
|
||||
<header className="admin-page-heading admin-services-heading">
|
||||
<div><p>OPERATIONS / HEALTH</p><h2>服务与存储</h2></div>
|
||||
<div className="admin-services-heading-actions">
|
||||
{state ? <time dateTime={state.generated_at}>更新于 {formatTime(state.generated_at)}</time> : null}
|
||||
<button aria-label="重新读取服务与存储状态" onClick={() => void load()} type="button">重新读取</button>
|
||||
</div>
|
||||
</header>
|
||||
{loading && !state ? <div aria-label="服务与存储状态加载中" className="admin-services-loading"><span /><span /><span /><span /></div> : null}
|
||||
{failed ? <div className="admin-services-failure" role="alert"><span>状态暂时无法读取{state ? `，保留 ${formatTime(state.generated_at)} 的结果` : ""}。</span><button onClick={() => void load()} type="button">重试</button></div> : null}
|
||||
{state ? (
|
||||
<>
|
||||
<section aria-labelledby="admin-services-list-heading" className="admin-health-section">
|
||||
<header><div><p>SERVICE STATUS</p><h3 id="admin-services-list-heading">外部服务与本机组件</h3></div><span className="admin-safe-note">仅显示脱敏状态</span></header>
|
||||
<div className="admin-service-grid">
|
||||
{state.services.map((service) => (
|
||||
<article className={`admin-service-card is-${service.status}`} key={service.service_id}>
|
||||
<div className="admin-service-card-heading"><strong>{serviceLabels[service.service_id]}</strong><span>{statusLabels[service.status]}</span></div>
|
||||
<dl>
|
||||
<div><dt>配置状态</dt><dd>{service.configured ? "已配置" : "未配置"}</dd></div>
|
||||
<div><dt>影响范围</dt><dd>{impactLabels[service.impact_scope]}</dd></div>
|
||||
<div><dt>最近检查</dt><dd>{formatTime(service.checked_at)}</dd></div>
|
||||
{service.pause_reason ? <div><dt>安全原因</dt><dd>{service.pause_reason}</dd></div> : null}
|
||||
</dl>
|
||||
</article>
|
||||
))}
|
||||
</div>
|
||||
</section>
|
||||
<section aria-labelledby="admin-storage-heading" className="admin-health-section">
|
||||
<header><div><p>LOCAL DATA ROOT</p><h3 id="admin-storage-heading">本机内容容量</h3></div><span className={`admin-storage-state is-${state.storage.status}`}>{state.storage.status === "active" ? "可写" : state.storage.status === "full" ? "已满" : "不可用"}</span></header>
|
||||
<div className="admin-storage-metrics">
|
||||
<div><span>已用内容</span><strong>{(state.storage.managed_content_bytes / 1024 / 1024 / 1024).toFixed(2)} GB</strong></div>
|
||||
<div><span>固定上限</span><strong>{(state.storage.hard_limit_bytes / 1024 / 1024 / 1024).toFixed(2)} GB</strong></div>
|
||||
<div><span>容量提醒</span><strong>{state.storage.capacity_notice_level}</strong></div>
|
||||
<div><span>清理队列</span><strong>{state.storage.cleanup_pending_count}</strong></div>
|
||||
</div>
|
||||
<div className="admin-storage-progress" aria-label={`本机内容容量 ${(state.storage.managed_content_bytes / state.storage.hard_limit_bytes * 100).toFixed(1)}%`}><span style={{ width: `${Math.min(100, state.storage.managed_content_bytes / state.storage.hard_limit_bytes * 100)}%` }} /></div>
|
||||
<p className="admin-storage-description">测试数据仅保存在本机，不自动备份，也不会迁移到正式系统。当前 Windows 用户的 Dada 本机数据目录引用：<code>{state.storage.data_root_ref}</code>。只读规范素材库不计入 5 GB 内容额度。</p>
|
||||
<dl className="admin-storage-details"><div><dt>最后计量</dt><dd>{formatTime(state.storage.last_measured_at)}</dd></div><div><dt>重新计量</dt><dd>{state.storage.remeasurement_required ? "需要完成" : "无需等待"}</dd></div></dl>
|
||||
</section>
|
||||
<section aria-labelledby="admin-diagnostics-heading" className="admin-health-section admin-diagnostics-section">
|
||||
<header><div><p>DIAGNOSTICS</p><h3 id="admin-diagnostics-heading">脱敏诊断</h3></div><button disabled={!diagnostics} onClick={() => void copyDiagnostics()} type="button">{copied ? "已复制" : "复制诊断"}</button></header>
|
||||
<p>诊断内容只包含固定版本、组件状态、逻辑位置和容量计量，不包含密钥、邮箱、绝对路径、提示词、图片或供应商原文。</p>
|
||||
{diagnostics ? <pre aria-label="脱敏诊断内容">{diagnostics.diagnostic_text}</pre> : <div aria-label="诊断加载中" className="admin-diagnostics-placeholder" />}
|
||||
</section>
|
||||
</>
|
||||
) : null}
|
||||
</main>
|
||||
);
|
||||
}
|
||||
@@ -1,523 +0,0 @@
|
||||
:root {
|
||||
color-scheme: light;
|
||||
font-family: "Segoe UI", "Microsoft YaHei UI", sans-serif;
|
||||
background: #f3f3ef;
|
||||
}
|
||||
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
letter-spacing: 0;
|
||||
}
|
||||
|
||||
body {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
button,
|
||||
a,
|
||||
input,
|
||||
textarea {
|
||||
font: inherit;
|
||||
}
|
||||
|
||||
.admin-shell {
|
||||
min-height: 100vh;
|
||||
color: #171715;
|
||||
background: #f3f3ef;
|
||||
}
|
||||
|
||||
.admin-skip-link {
|
||||
position: fixed;
|
||||
z-index: 100;
|
||||
top: 8px;
|
||||
left: 228px;
|
||||
padding: 8px 12px;
|
||||
color: #ffffff;
|
||||
background: #171715;
|
||||
transform: translateY(-160%);
|
||||
}
|
||||
|
||||
.admin-skip-link:focus {
|
||||
transform: translateY(0);
|
||||
}
|
||||
|
||||
.admin-sidebar {
|
||||
position: fixed;
|
||||
z-index: 20;
|
||||
inset: 0 auto 0 0;
|
||||
display: grid;
|
||||
width: 216px;
|
||||
grid-template-rows: auto 1fr auto;
|
||||
color: #ffffff;
|
||||
background: #171715;
|
||||
}
|
||||
|
||||
.admin-wordmark {
|
||||
display: grid;
|
||||
min-height: 104px;
|
||||
align-content: center;
|
||||
padding: 20px 22px;
|
||||
border-bottom: 1px solid #494944;
|
||||
color: #ffffff;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-wordmark span {
|
||||
font-family: "Arial Black", "Segoe UI", sans-serif;
|
||||
font-size: 30px;
|
||||
line-height: 1;
|
||||
}
|
||||
|
||||
.admin-wordmark small {
|
||||
margin-top: 6px;
|
||||
color: #d9dc00;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
}
|
||||
|
||||
.admin-sidebar nav {
|
||||
display: grid;
|
||||
align-content: start;
|
||||
padding: 12px 0;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a {
|
||||
display: grid;
|
||||
min-height: 48px;
|
||||
grid-template-columns: 38px 1fr;
|
||||
align-items: center;
|
||||
padding: 0 18px;
|
||||
border-left: 4px solid transparent;
|
||||
color: #d5d5cf;
|
||||
font-size: 13px;
|
||||
font-weight: 700;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a > span {
|
||||
color: #85857d;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a:hover,
|
||||
.admin-sidebar nav a:focus-visible {
|
||||
color: #ffffff;
|
||||
background: #2c2c29;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a[aria-current="page"] {
|
||||
border-left-color: #e8eb00;
|
||||
color: #171715;
|
||||
background: #eef000;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a[aria-current="page"] > span {
|
||||
color: #4d4d00;
|
||||
}
|
||||
|
||||
.admin-sidebar-foot {
|
||||
display: grid;
|
||||
gap: 10px;
|
||||
padding: 18px 22px;
|
||||
border-top: 1px solid #494944;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
}
|
||||
|
||||
.admin-sidebar-foot span {
|
||||
color: #a5a59d;
|
||||
}
|
||||
|
||||
.admin-sidebar-foot strong {
|
||||
color: #ffffff;
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.admin-shell-workspace {
|
||||
min-width: 0;
|
||||
margin-left: 216px;
|
||||
padding-top: 52px;
|
||||
}
|
||||
|
||||
.admin-topbar {
|
||||
position: fixed;
|
||||
z-index: 15;
|
||||
top: 0;
|
||||
right: 0;
|
||||
left: 216px;
|
||||
display: flex;
|
||||
height: 52px;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 0 28px;
|
||||
border-bottom: 1px solid #b7b7b0;
|
||||
background: rgb(255 255 255 / 96%);
|
||||
}
|
||||
|
||||
.admin-topbar h1 {
|
||||
margin: 0;
|
||||
font-size: 15px;
|
||||
}
|
||||
|
||||
.admin-topbar-status {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 20px;
|
||||
color: #62625c;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-topbar-status span {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 7px;
|
||||
}
|
||||
|
||||
.admin-topbar-status i {
|
||||
width: 8px;
|
||||
height: 8px;
|
||||
border-radius: 50%;
|
||||
background: #777770;
|
||||
}
|
||||
|
||||
.admin-topbar-status code {
|
||||
color: #171715;
|
||||
}
|
||||
|
||||
.admin-shell-content {
|
||||
min-width: 0;
|
||||
}
|
||||
|
||||
.admin-session-gate {
|
||||
display: grid;
|
||||
min-height: 100vh;
|
||||
place-items: center;
|
||||
color: #171715;
|
||||
background: #f3f3ef;
|
||||
}
|
||||
|
||||
.admin-session-gate p,
|
||||
.admin-session-gate div {
|
||||
padding: 22px;
|
||||
border-left: 5px solid #171715;
|
||||
background: #ffffff;
|
||||
}
|
||||
|
||||
.admin-session-gate div {
|
||||
display: grid;
|
||||
gap: 12px;
|
||||
}
|
||||
|
||||
.admin-session-gate button,
|
||||
.admin-overview-failure button,
|
||||
.admin-placeholder-toolbar button {
|
||||
min-height: 40px;
|
||||
padding: 8px 14px;
|
||||
border: 1px solid #171715;
|
||||
border-radius: 0;
|
||||
color: #171715;
|
||||
background: #eef000;
|
||||
font-weight: 800;
|
||||
}
|
||||
|
||||
.admin-overview,
|
||||
.admin-placeholder {
|
||||
width: min(1320px, calc(100% - 64px));
|
||||
margin: 0 auto;
|
||||
padding: 34px 0 72px;
|
||||
}
|
||||
|
||||
.admin-page-heading {
|
||||
display: flex;
|
||||
min-height: 74px;
|
||||
align-items: end;
|
||||
justify-content: space-between;
|
||||
gap: 24px;
|
||||
padding-bottom: 18px;
|
||||
border-bottom: 1px solid #8c8c85;
|
||||
}
|
||||
|
||||
.admin-page-heading p,
|
||||
.admin-status-section header p,
|
||||
.admin-operation-strip header p {
|
||||
margin: 0 0 5px;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.admin-page-heading h2 {
|
||||
margin: 0;
|
||||
font-size: 32px;
|
||||
}
|
||||
|
||||
.admin-page-heading time {
|
||||
color: #66665f;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-capacity-alert {
|
||||
display: grid;
|
||||
min-height: 44px;
|
||||
grid-template-columns: 1fr auto auto;
|
||||
align-items: center;
|
||||
gap: 18px;
|
||||
padding: 9px 14px;
|
||||
border-bottom: 1px solid #171715;
|
||||
color: #171715;
|
||||
background: #eef000;
|
||||
font-size: 12px;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-capacity-alert.is-full,
|
||||
.admin-capacity-alert.is-unavailable {
|
||||
color: #ffffff;
|
||||
background: #b33a2f;
|
||||
}
|
||||
|
||||
.admin-overview-loading {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(4, minmax(0, 1fr));
|
||||
margin-top: 22px;
|
||||
border-block: 1px solid #b7b7b0;
|
||||
}
|
||||
|
||||
.admin-overview-loading span {
|
||||
height: 130px;
|
||||
border-right: 1px solid #c7c7c0;
|
||||
background: #e2e2dd;
|
||||
}
|
||||
|
||||
.admin-overview-failure {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
gap: 20px;
|
||||
margin-top: 20px;
|
||||
padding: 14px 16px;
|
||||
border-left: 5px solid #b33a2f;
|
||||
background: #fff0ed;
|
||||
}
|
||||
|
||||
.admin-metric-band {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(4, minmax(0, 1fr));
|
||||
margin-top: 22px;
|
||||
border-block: 1px solid #8c8c85;
|
||||
background: #ffffff;
|
||||
}
|
||||
|
||||
.admin-metric-band a {
|
||||
display: grid;
|
||||
min-width: 0;
|
||||
min-height: 132px;
|
||||
align-content: center;
|
||||
gap: 7px;
|
||||
padding: 20px;
|
||||
border-right: 1px solid #c3c3bc;
|
||||
color: #171715;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-metric-band a:last-child {
|
||||
border-right: 0;
|
||||
}
|
||||
|
||||
.admin-metric-band span,
|
||||
.admin-metric-band small {
|
||||
color: #65655f;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-metric-band strong {
|
||||
overflow-wrap: anywhere;
|
||||
font-size: 25px;
|
||||
}
|
||||
|
||||
.admin-overview-columns {
|
||||
display: grid;
|
||||
grid-template-columns: 1fr 1fr;
|
||||
gap: 24px;
|
||||
margin-top: 24px;
|
||||
}
|
||||
|
||||
.admin-status-section,
|
||||
.admin-operation-strip,
|
||||
.admin-placeholder > section {
|
||||
border-top: 3px solid #171715;
|
||||
border-bottom: 1px solid #8c8c85;
|
||||
background: #ffffff;
|
||||
}
|
||||
|
||||
.admin-status-section > header,
|
||||
.admin-operation-strip > header {
|
||||
display: flex;
|
||||
min-height: 64px;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 12px 16px;
|
||||
border-bottom: 1px solid #c3c3bc;
|
||||
}
|
||||
|
||||
.admin-status-section h3,
|
||||
.admin-operation-strip h3 {
|
||||
margin: 0;
|
||||
font-size: 17px;
|
||||
}
|
||||
|
||||
.admin-status-section header a,
|
||||
.admin-operation-strip header a {
|
||||
color: #171715;
|
||||
font-size: 12px;
|
||||
font-weight: 800;
|
||||
}
|
||||
|
||||
.admin-status-section dl {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.admin-status-section dl > div {
|
||||
display: grid;
|
||||
min-height: 52px;
|
||||
grid-template-columns: 126px 1fr;
|
||||
align-items: center;
|
||||
padding: 0 16px;
|
||||
border-bottom: 1px solid #ddddD7;
|
||||
}
|
||||
|
||||
.admin-status-section dl > div:last-child {
|
||||
border-bottom: 0;
|
||||
}
|
||||
|
||||
.admin-status-section dt {
|
||||
color: #65655f;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-status-section dd {
|
||||
min-width: 0;
|
||||
margin: 0;
|
||||
overflow-wrap: anywhere;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 12px;
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.admin-service-list {
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
list-style: none;
|
||||
}
|
||||
|
||||
.admin-service-list li {
|
||||
display: grid;
|
||||
min-height: 42px;
|
||||
grid-template-columns: 1fr 84px 76px;
|
||||
align-items: center;
|
||||
padding: 0 16px;
|
||||
border-bottom: 1px solid #ddddd7;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-service-list li:last-child {
|
||||
border-bottom: 0;
|
||||
}
|
||||
|
||||
.admin-service-list strong {
|
||||
color: #1f6639;
|
||||
}
|
||||
|
||||
.admin-service-list strong.is-degraded,
|
||||
.admin-service-list strong.is-paused {
|
||||
color: #8b5608;
|
||||
}
|
||||
|
||||
.admin-service-list strong.is-unavailable {
|
||||
color: #a52e24;
|
||||
}
|
||||
|
||||
.admin-service-list time {
|
||||
color: #65655f;
|
||||
text-align: right;
|
||||
}
|
||||
|
||||
.admin-operation-strip {
|
||||
margin-top: 24px;
|
||||
}
|
||||
|
||||
.admin-operation-strip > p {
|
||||
margin: 0;
|
||||
padding: 22px 16px;
|
||||
color: #65655f;
|
||||
}
|
||||
|
||||
.admin-operation-strip table {
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
table-layout: fixed;
|
||||
}
|
||||
|
||||
.admin-operation-strip th,
|
||||
.admin-operation-strip td {
|
||||
padding: 12px 16px;
|
||||
border-bottom: 1px solid #ddddd7;
|
||||
overflow-wrap: anywhere;
|
||||
text-align: left;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-operation-strip th {
|
||||
color: #65655f;
|
||||
background: #efefeb;
|
||||
}
|
||||
|
||||
.admin-placeholder > section {
|
||||
margin-top: 22px;
|
||||
}
|
||||
|
||||
.admin-placeholder-toolbar {
|
||||
display: flex;
|
||||
min-height: 58px;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 8px 16px;
|
||||
border-bottom: 1px solid #c3c3bc;
|
||||
font-weight: 800;
|
||||
}
|
||||
|
||||
.admin-placeholder-toolbar button:disabled {
|
||||
color: #777770;
|
||||
background: #dfdfda;
|
||||
}
|
||||
|
||||
.admin-placeholder > section > p {
|
||||
margin: 0;
|
||||
padding: 44px 16px;
|
||||
color: #65655f;
|
||||
}
|
||||
|
||||
:is(.admin-shell, .admin-session-gate) :focus-visible {
|
||||
outline: 2px solid #225dd8;
|
||||
outline-offset: 2px;
|
||||
}
|
||||
|
||||
@media (max-width: 1000px) {
|
||||
.admin-overview,
|
||||
.admin-placeholder {
|
||||
width: calc(100% - 32px);
|
||||
}
|
||||
|
||||
.admin-metric-band {
|
||||
grid-template-columns: 1fr 1fr;
|
||||
}
|
||||
|
||||
.admin-metric-band a:nth-child(2) {
|
||||
border-right: 0;
|
||||
}
|
||||
|
||||
.admin-overview-columns {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
}
|
||||
@@ -1,229 +0,0 @@
|
||||
import type { AdminOverviewResponse } from "@dada/shared-contracts";
|
||||
import { useCallback, useEffect, useState, type ReactNode } from "react";
|
||||
|
||||
import "./admin-shell.css";
|
||||
|
||||
interface AdminSession {
|
||||
admin: { role: "super_admin"; status: "active"; user_id: string };
|
||||
audience: "admin";
|
||||
authenticated: true;
|
||||
expires_at: string;
|
||||
}
|
||||
|
||||
interface AdminProtectedRouteProps {
|
||||
children: ReactNode;
|
||||
currentPath: string;
|
||||
title: string;
|
||||
}
|
||||
|
||||
const adminNavigation = [
|
||||
{ href: "/admin", label: "总览", marker: "01" },
|
||||
{ href: "/admin/users", label: "用户与点数", marker: "02" },
|
||||
{ href: "/admin/invites", label: "邀请码", marker: "03" },
|
||||
{ href: "/admin/models", label: "模型", marker: "04" },
|
||||
{ href: "/admin/assets", label: "素材", marker: "05" },
|
||||
{ href: "/admin/preview", label: "内部预览", marker: "06" },
|
||||
{ href: "/admin/generations", label: "生成记录", marker: "07" },
|
||||
{ href: "/admin/services-storage", label: "服务与存储", marker: "08" },
|
||||
{ href: "/admin/audit", label: "审计", marker: "09" },
|
||||
] as const;
|
||||
|
||||
function redirectToAdminLogin() {
|
||||
window.location.replace("/admin/login");
|
||||
}
|
||||
|
||||
export function AdminProtectedRoute({ children, currentPath, title }: AdminProtectedRouteProps) {
|
||||
const [session, setSession] = useState<AdminSession>();
|
||||
const [failed, setFailed] = useState(false);
|
||||
const [revision, setRevision] = useState(0);
|
||||
|
||||
useEffect(() => {
|
||||
const controller = new AbortController();
|
||||
setFailed(false);
|
||||
void fetch("/api/v1/admin-auth/session", { credentials: "same-origin", signal: controller.signal })
|
||||
.then(async (response) => {
|
||||
if (response.status === 401) {
|
||||
redirectToAdminLogin();
|
||||
return;
|
||||
}
|
||||
if (!response.ok) throw new Error("admin_session_unavailable");
|
||||
const body = await response.json() as AdminSession;
|
||||
if (body.audience !== "admin" || body.admin.role !== "super_admin" || body.admin.status !== "active") {
|
||||
redirectToAdminLogin();
|
||||
return;
|
||||
}
|
||||
setSession(body);
|
||||
})
|
||||
.catch((error: unknown) => {
|
||||
if (!(error instanceof DOMException && error.name === "AbortError")) setFailed(true);
|
||||
});
|
||||
return () => controller.abort();
|
||||
}, [revision]);
|
||||
|
||||
if (!session) {
|
||||
return (
|
||||
<main className="admin-session-gate">
|
||||
{failed ? (
|
||||
<div role="alert">
|
||||
<strong>管理员会话暂时无法确认</strong>
|
||||
<button onClick={() => setRevision((value) => value + 1)} type="button">重试</button>
|
||||
</div>
|
||||
) : <p aria-live="polite">正在确认管理员会话</p>}
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="admin-shell">
|
||||
<a className="admin-skip-link" href="#admin-main">跳到主要内容</a>
|
||||
<aside className="admin-sidebar">
|
||||
<a className="admin-wordmark" href="/admin" aria-label="Dada 后台总览">
|
||||
<span>DADA</span>
|
||||
<small>OPERATIONS</small>
|
||||
</a>
|
||||
<nav aria-label="后台主导航">
|
||||
{adminNavigation.map((item) => (
|
||||
<a aria-current={currentPath === item.href ? "page" : undefined} href={item.href} key={item.href}>
|
||||
<span aria-hidden="true">{item.marker}</span>
|
||||
{item.label}
|
||||
</a>
|
||||
))}
|
||||
</nav>
|
||||
<div className="admin-sidebar-foot">
|
||||
<span>LOCAL P0-A</span>
|
||||
<strong>独立管理员会话</strong>
|
||||
</div>
|
||||
</aside>
|
||||
<div className="admin-shell-workspace">
|
||||
<header className="admin-topbar">
|
||||
<h1>{title}</h1>
|
||||
<div className="admin-topbar-status">
|
||||
<span><i aria-hidden="true" />状态摘要</span>
|
||||
<code>{session.admin.user_id.slice(0, 8)}</code>
|
||||
</div>
|
||||
</header>
|
||||
<div className="admin-shell-content">{children}</div>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
const serviceLabels: Record<AdminOverviewResponse["services"][number]["service_id"], string> = {
|
||||
ai_gateway: "AI 网关",
|
||||
amap: "高德",
|
||||
asset_root: "素材根",
|
||||
resend: "Resend",
|
||||
worker: "Worker",
|
||||
};
|
||||
|
||||
const stateLabels = {
|
||||
available: "正常",
|
||||
degraded: "有异常",
|
||||
paused: "已暂停",
|
||||
unavailable: "不可用",
|
||||
} as const;
|
||||
|
||||
function formatTime(value: string | null) {
|
||||
if (!value) return "未记录";
|
||||
return new Intl.DateTimeFormat("zh-CN", { hour: "2-digit", minute: "2-digit", month: "2-digit", day: "2-digit" }).format(new Date(value));
|
||||
}
|
||||
|
||||
export function AdminOverviewPage() {
|
||||
const [summary, setSummary] = useState<AdminOverviewResponse>();
|
||||
const [failed, setFailed] = useState(false);
|
||||
const [loading, setLoading] = useState(true);
|
||||
|
||||
const load = useCallback(async () => {
|
||||
setLoading(true);
|
||||
setFailed(false);
|
||||
try {
|
||||
const response = await fetch("/api/v1/admin/overview", { credentials: "same-origin" });
|
||||
if (response.status === 401) {
|
||||
window.dispatchEvent(new Event("dada:session-invalid"));
|
||||
return;
|
||||
}
|
||||
if (!response.ok) throw new Error("admin_overview_unavailable");
|
||||
setSummary(await response.json() as AdminOverviewResponse);
|
||||
} catch {
|
||||
setFailed(true);
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}, []);
|
||||
|
||||
useEffect(() => { void load(); }, [load]);
|
||||
|
||||
const storagePercent = summary
|
||||
? Math.min(100, (summary.storage.managed_content_bytes / summary.storage.limit_bytes) * 100)
|
||||
: 0;
|
||||
const hasServiceIssue = summary?.services.some((service) => service.status !== "available") ?? false;
|
||||
|
||||
return (
|
||||
<main className="admin-overview" id="admin-main">
|
||||
<header className="admin-page-heading">
|
||||
<div><p>OPERATIONS / LIVE SUMMARY</p><h2>运营总览</h2></div>
|
||||
{summary ? <time dateTime={summary.generated_at}>更新于 {formatTime(summary.generated_at)}</time> : null}
|
||||
</header>
|
||||
{summary && summary.storage.status !== "normal" ? (
|
||||
<a className={`admin-capacity-alert is-${summary.storage.status}`} href="/admin/services-storage">
|
||||
<span>本机内容容量</span>
|
||||
<strong>{storagePercent.toFixed(1)}%</strong>
|
||||
<span>{summary.storage.status === "critical" ? "接近上限" : summary.storage.status === "full" ? "已满" : "不可用"}</span>
|
||||
</a>
|
||||
) : null}
|
||||
{loading && !summary ? (
|
||||
<div aria-label="运营摘要加载中" className="admin-overview-loading"><span /><span /><span /><span /></div>
|
||||
) : null}
|
||||
{failed ? (
|
||||
<div className="admin-overview-failure" role="alert">
|
||||
<span>运营摘要暂时无法读取{summary ? `，当前保留 ${formatTime(summary.generated_at)} 的结果` : ""}。</span>
|
||||
<button onClick={() => void load()} type="button">重试</button>
|
||||
</div>
|
||||
) : null}
|
||||
{summary ? (
|
||||
<>
|
||||
<section aria-label="关键运营指标" className="admin-metric-band">
|
||||
<a href="/admin/users"><span>普通用户名额</span><strong>{summary.user_slots.active_and_suspended} / {summary.user_slots.limit}</strong><small>active + suspended</small></a>
|
||||
<a href="/admin/generations"><span>进行中任务</span><strong>{summary.generation_jobs.queued + summary.generation_jobs.running}</strong><small>排队 {summary.generation_jobs.queued} · 运行 {summary.generation_jobs.running}</small></a>
|
||||
<a href="/admin/generations"><span>成本核对</span><strong>待人工核对 {summary.generation_jobs.pending_manual_review}</strong><small>最早 {formatTime(summary.generation_jobs.pending_manual_review_oldest_at)}</small></a>
|
||||
<a href="/admin/assets"><span>清理任务</span><strong>{summary.asset_cleanup.pending_jobs}</strong><small>等待处理</small></a>
|
||||
</section>
|
||||
<div className="admin-overview-columns">
|
||||
<section className="admin-status-section" aria-labelledby="model-status-heading">
|
||||
<header><div><p>MODEL STATE</p><h3 id="model-status-heading">模型状态</h3></div><a href="/admin/models">查看</a></header>
|
||||
<dl>
|
||||
<div><dt>配置默认</dt><dd>{summary.models.configured_default_model_id ?? "无"}</dd></div>
|
||||
<div><dt>运行时可用</dt><dd>{summary.models.runtime_available_count} / {summary.models.configured_model_count}</dd></div>
|
||||
<div><dt>当前推荐</dt><dd>{summary.models.recommended_model_id ?? "无"}</dd></div>
|
||||
</dl>
|
||||
</section>
|
||||
<section className="admin-status-section" aria-labelledby="service-status-heading">
|
||||
<header><div><p>SERVICE STATE</p><h3 id="service-status-heading">服务状态</h3></div><a href="/admin/services-storage">{hasServiceIssue ? "有异常" : "全部正常"}</a></header>
|
||||
<ul className="admin-service-list">
|
||||
{summary.services.map((service) => <li key={service.service_id}><span>{serviceLabels[service.service_id]}</span><strong className={`is-${service.status}`}>{stateLabels[service.status]}</strong><time dateTime={service.checked_at ?? undefined}>{formatTime(service.checked_at)}</time></li>)}
|
||||
</ul>
|
||||
</section>
|
||||
</div>
|
||||
<section className="admin-operation-strip" aria-labelledby="recent-operation-heading">
|
||||
<header><div><p>AUDIT SNAPSHOT</p><h3 id="recent-operation-heading">最近后台操作</h3></div><a href="/admin/audit">查看全部</a></header>
|
||||
{summary.recent_operations.length === 0 ? <p>当前无近期操作</p> : (
|
||||
<table><thead><tr><th>时间</th><th>操作</th><th>对象摘要</th><th>结果</th></tr></thead><tbody>{summary.recent_operations.map((operation) => <tr key={operation.operation_id}><td>{formatTime(operation.created_at)}</td><td>{operation.operation_type}</td><td><code>{operation.target_ref}</code></td><td>{operation.result}</td></tr>)}</tbody></table>
|
||||
)}
|
||||
</section>
|
||||
</>
|
||||
) : null}
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
export function AdminPlaceholderPage({ title }: { title: string }) {
|
||||
return (
|
||||
<main className="admin-placeholder" id="admin-main">
|
||||
<header className="admin-page-heading"><div><p>OPERATIONS</p><h2>{title}</h2></div></header>
|
||||
<section aria-label={`${title}安全摘要`}>
|
||||
<div className="admin-placeholder-toolbar"><span>安全摘要</span><button disabled type="button">新建</button></div>
|
||||
<p>当前无记录</p>
|
||||
</section>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
@@ -100,7 +100,11 @@ export function AdminUsersPage() {
|
||||
|
||||
return (
|
||||
<div className="admin-users-page">
|
||||
<main id="admin-main">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a aria-current="page" href="/admin/users">用户</a><a href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<header className="admin-users-heading">
|
||||
<div><p>USER OPERATIONS</p><h1>用户点数</h1></div>
|
||||
{balance ? <button onClick={openAdjustment} type="button">调整点数</button> : null}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
// Generated from openapi/openapi.json. Do not edit by hand.
|
||||
|
||||
import type { CreditAdjustmentResponse, CreditAdjustmentRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminDiagnosticsResponse, AdminOverviewResponse, AdminServicesStorageResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest } from "./types.gen.js";
|
||||
import type { CreditAdjustmentResponse, CreditAdjustmentRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest } from "./types.gen.js";
|
||||
|
||||
export interface ClientOptions { baseUrl?: string; fetch?: typeof globalThis.fetch; headers?: HeadersInit; }
|
||||
|
||||
@@ -87,27 +87,6 @@ export async function getAccountSettings(options: ClientOptions = {}): Promise<A
|
||||
return response.json() as Promise<AccountSettingsResponse>;
|
||||
}
|
||||
|
||||
export async function getAdminDiagnostics(options: ClientOptions = {}): Promise<AdminDiagnosticsResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/diagnostics`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<AdminDiagnosticsResponse>;
|
||||
}
|
||||
|
||||
export async function getAdminOverview(options: ClientOptions = {}): Promise<AdminOverviewResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/overview`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<AdminOverviewResponse>;
|
||||
}
|
||||
|
||||
export async function getAdminServicesStorage(options: ClientOptions = {}): Promise<AdminServicesStorageResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/services-storage`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<AdminServicesStorageResponse>;
|
||||
}
|
||||
|
||||
export async function getAdminSession(options: ClientOptions = {}): Promise<AdminSessionResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin-auth/session`, { method: "GET", headers: options.headers ?? {} });
|
||||
|
||||
@@ -60,21 +60,6 @@ export type AdminCreditParams = {
|
||||
"userId": string;
|
||||
};
|
||||
|
||||
export type AdminDiagnosticsResponse = {
|
||||
"diagnostic_text": string;
|
||||
"generated_at": string;
|
||||
"services": AdminServicesStorageResponse;
|
||||
"system": {
|
||||
"api_status": "ready" | "degraded" | "unavailable";
|
||||
"app_version": string;
|
||||
"browser_support": Array<{
|
||||
"brand": "Google Chrome" | "Microsoft Edge";
|
||||
"major": number;
|
||||
}>;
|
||||
"worker_status": "ready" | "degraded" | "unavailable";
|
||||
};
|
||||
};
|
||||
|
||||
export type AdminLoginCompleteRequest = {
|
||||
"registration_id": string;
|
||||
"verification_code": string;
|
||||
@@ -91,70 +76,6 @@ export type AdminLoginSendRequest = {
|
||||
"email": string;
|
||||
};
|
||||
|
||||
export type AdminOverviewResponse = {
|
||||
"asset_cleanup": {
|
||||
"pending_jobs": number;
|
||||
};
|
||||
"generated_at": string;
|
||||
"generation_jobs": {
|
||||
"pending_manual_review": number;
|
||||
"pending_manual_review_oldest_at": string | null;
|
||||
"queued": number;
|
||||
"running": number;
|
||||
};
|
||||
"models": {
|
||||
"configured_default_model_id": string | null;
|
||||
"configured_model_count": number;
|
||||
"recommended_model_id": string | null;
|
||||
"runtime_available_count": number;
|
||||
};
|
||||
"recent_operations": Array<{
|
||||
"created_at": string;
|
||||
"operation_id": string;
|
||||
"operation_type": string;
|
||||
"result": "succeeded" | "rejected" | "failed";
|
||||
"target_ref": string;
|
||||
}>;
|
||||
"services": Array<{
|
||||
"checked_at": string | null;
|
||||
"service_id": "resend" | "amap" | "ai_gateway" | "worker" | "asset_root";
|
||||
"status": "available" | "degraded" | "paused" | "unavailable";
|
||||
}>;
|
||||
"storage": {
|
||||
"last_measured_at": string | null;
|
||||
"limit_bytes": number;
|
||||
"managed_content_bytes": number;
|
||||
"status": "normal" | "critical" | "full" | "unavailable";
|
||||
};
|
||||
"user_slots": {
|
||||
"active_and_suspended": number;
|
||||
"limit": number;
|
||||
};
|
||||
};
|
||||
|
||||
export type AdminServicesStorageResponse = {
|
||||
"generated_at": string;
|
||||
"services": Array<{
|
||||
"checked_at": string | null;
|
||||
"configured": boolean;
|
||||
"impact_scope": "none" | "authentication" | "location" | "generation" | "storage" | "api" | "model" | "account" | "unknown";
|
||||
"pause_reason": string | null;
|
||||
"service_id": "resend" | "amap" | "ai_gateway" | "worker" | "api" | "asset_root";
|
||||
"status": "active" | "paused_quota" | "paused_provider" | "disabled" | "degraded" | "unavailable";
|
||||
}>;
|
||||
"storage": {
|
||||
"capacity_notice_level": "normal" | "warning" | "critical";
|
||||
"cleanup_pending_count": number;
|
||||
"data_root_ref": "configured_local_data_root";
|
||||
"hard_limit_bytes": number;
|
||||
"last_measured_at": string | null;
|
||||
"managed_content_bytes": number;
|
||||
"remeasurement_required": boolean;
|
||||
"status": "active" | "full" | "unavailable";
|
||||
"storage_backend": "local_filesystem";
|
||||
};
|
||||
};
|
||||
|
||||
export type AdminSessionResponse = {
|
||||
"acknowledged_private_content_notice_version": string | null;
|
||||
"admin": AdminAuthenticatedUser;
|
||||
|
||||
+4
-23
@@ -1,4 +1,4 @@
|
||||
import { StrictMode, type ReactNode } from "react";
|
||||
import { StrictMode } from "react";
|
||||
import { createRoot } from "react-dom/client";
|
||||
|
||||
import { registerPublicAssetServiceWorker } from "./public-asset-cache.js";
|
||||
@@ -7,11 +7,9 @@ import { UserAuthPage } from "./user-auth.js";
|
||||
import { AccountSettingsPage } from "./account-settings.js";
|
||||
import { AdminUsersPage } from "./admin-users.js";
|
||||
import { AdminModelsPage } from "./admin-models.js";
|
||||
import { AdminServicesStoragePage } from "./admin-services-storage.js";
|
||||
import { CreditsPage } from "./credits-page.js";
|
||||
import { ProjectDetailPage, ProjectsPage, WorkspacePage } from "./project-pages.js";
|
||||
import { EditorPage } from "./editor-page.js";
|
||||
import { AdminOverviewPage, AdminPlaceholderPage, AdminProtectedRoute } from "./admin-shell.js";
|
||||
|
||||
const root = document.getElementById("root");
|
||||
|
||||
@@ -36,26 +34,9 @@ function renderAuthenticationEntry() {
|
||||
else if (projectDetail?.[1]) authenticationPage = <ProjectDetailPage key={authRevision} projectId={projectDetail[1]} />;
|
||||
else if (window.location.pathname === "/app/projects") authenticationPage = <ProjectsPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/app") authenticationPage = <WorkspacePage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/login") authenticationPage = <AdminAuthPage key={authRevision} />;
|
||||
else if (window.location.pathname.startsWith("/admin")) {
|
||||
const adminPages: Record<string, { content: ReactNode; title: string }> = {
|
||||
"/admin": { content: <AdminOverviewPage />, title: "运营总览" },
|
||||
"/admin/assets": { content: <AdminPlaceholderPage title="素材" />, title: "素材" },
|
||||
"/admin/audit": { content: <AdminPlaceholderPage title="审计" />, title: "审计" },
|
||||
"/admin/generations": { content: <AdminPlaceholderPage title="生成记录" />, title: "生成记录" },
|
||||
"/admin/invites": { content: <AdminPlaceholderPage title="邀请码" />, title: "邀请码" },
|
||||
"/admin/models": { content: <AdminModelsPage />, title: "模型" },
|
||||
"/admin/preview": { content: <AdminPlaceholderPage title="内部预览" />, title: "内部预览" },
|
||||
"/admin/services-storage": { content: <AdminServicesStoragePage />, title: "服务与存储" },
|
||||
"/admin/users": { content: <AdminUsersPage />, title: "用户与点数" },
|
||||
};
|
||||
const page = adminPages[window.location.pathname] ?? adminPages["/admin"]!;
|
||||
authenticationPage = (
|
||||
<AdminProtectedRoute currentPath={window.location.pathname} key={authRevision} title={page.title}>
|
||||
{page.content}
|
||||
</AdminProtectedRoute>
|
||||
);
|
||||
}
|
||||
else if (window.location.pathname === "/admin/users") authenticationPage = <AdminUsersPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/models") authenticationPage = <AdminModelsPage key={authRevision} />;
|
||||
else if (window.location.pathname.startsWith("/admin")) authenticationPage = <AdminAuthPage key={authRevision} />;
|
||||
else authenticationPage = <UserAuthPage key={authRevision} />;
|
||||
appRoot.render(
|
||||
<StrictMode>
|
||||
|
||||
@@ -300,125 +300,6 @@
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"AdminDiagnosticsResponse": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"diagnostic_text": {
|
||||
"maxLength": 12000,
|
||||
"minLength": 1,
|
||||
"type": "string"
|
||||
},
|
||||
"generated_at": {
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
"services": {
|
||||
"$ref": "#/components/schemas/AdminServicesStorageResponse"
|
||||
},
|
||||
"system": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"api_status": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"ready"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"degraded"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unavailable"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"app_version": {
|
||||
"maxLength": 80,
|
||||
"pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$",
|
||||
"type": "string"
|
||||
},
|
||||
"browser_support": {
|
||||
"items": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"brand": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"Google Chrome"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"Microsoft Edge"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"major": {
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"brand",
|
||||
"major"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"maxItems": 2,
|
||||
"type": "array"
|
||||
},
|
||||
"worker_status": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"ready"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"degraded"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unavailable"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"api_status",
|
||||
"app_version",
|
||||
"browser_support",
|
||||
"worker_status"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"generated_at",
|
||||
"diagnostic_text",
|
||||
"services",
|
||||
"system"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"AdminLoginCompleteRequest": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
@@ -482,636 +363,6 @@
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"AdminOverviewResponse": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"asset_cleanup": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"pending_jobs": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"pending_jobs"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"generated_at": {
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
"generation_jobs": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"pending_manual_review": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"pending_manual_review_oldest_at": {
|
||||
"anyOf": [
|
||||
{
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"queued": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"running": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"pending_manual_review",
|
||||
"pending_manual_review_oldest_at",
|
||||
"queued",
|
||||
"running"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"models": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"configured_default_model_id": {
|
||||
"anyOf": [
|
||||
{
|
||||
"maxLength": 80,
|
||||
"pattern": "^[a-z0-9][a-z0-9.-]+$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"configured_model_count": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"recommended_model_id": {
|
||||
"anyOf": [
|
||||
{
|
||||
"maxLength": 80,
|
||||
"pattern": "^[a-z0-9][a-z0-9.-]+$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"runtime_available_count": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"configured_default_model_id",
|
||||
"configured_model_count",
|
||||
"recommended_model_id",
|
||||
"runtime_available_count"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"recent_operations": {
|
||||
"items": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"created_at": {
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
"operation_id": {
|
||||
"pattern": "^[0-9a-fA-F-]{36}$",
|
||||
"type": "string"
|
||||
},
|
||||
"operation_type": {
|
||||
"maxLength": 80,
|
||||
"pattern": "^[a-z][a-z0-9_]+$",
|
||||
"type": "string"
|
||||
},
|
||||
"result": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"succeeded"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"rejected"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"failed"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"target_ref": {
|
||||
"pattern": "^[A-Za-z0-9][A-Za-z0-9:._-]{0,159}$",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"created_at",
|
||||
"operation_id",
|
||||
"operation_type",
|
||||
"result",
|
||||
"target_ref"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"maxItems": 10,
|
||||
"type": "array"
|
||||
},
|
||||
"services": {
|
||||
"items": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"checked_at": {
|
||||
"anyOf": [
|
||||
{
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"service_id": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"resend"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"amap"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"ai_gateway"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"worker"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"asset_root"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"status": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"available"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"degraded"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"paused"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unavailable"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"checked_at",
|
||||
"service_id",
|
||||
"status"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"maxItems": 5,
|
||||
"type": "array"
|
||||
},
|
||||
"storage": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"last_measured_at": {
|
||||
"anyOf": [
|
||||
{
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"limit_bytes": {
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"managed_content_bytes": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"status": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"normal"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"critical"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"full"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unavailable"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"last_measured_at",
|
||||
"limit_bytes",
|
||||
"managed_content_bytes",
|
||||
"status"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"user_slots": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"active_and_suspended": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"limit": {
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"active_and_suspended",
|
||||
"limit"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"generated_at",
|
||||
"user_slots",
|
||||
"generation_jobs",
|
||||
"models",
|
||||
"storage",
|
||||
"services",
|
||||
"recent_operations",
|
||||
"asset_cleanup"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"AdminServicesStorageResponse": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"generated_at": {
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
"services": {
|
||||
"items": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"checked_at": {
|
||||
"anyOf": [
|
||||
{
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"configured": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"impact_scope": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"none"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"authentication"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"location"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"generation"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"storage"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"api"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"model"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"account"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unknown"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pause_reason": {
|
||||
"anyOf": [
|
||||
{
|
||||
"maxLength": 80,
|
||||
"pattern": "^[a-z][a-z0-9_]*$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"service_id": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"resend"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"amap"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"ai_gateway"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"worker"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"api"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"asset_root"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"status": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"active"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"paused_quota"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"paused_provider"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"disabled"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"degraded"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unavailable"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"checked_at",
|
||||
"configured",
|
||||
"impact_scope",
|
||||
"pause_reason",
|
||||
"service_id",
|
||||
"status"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"maxItems": 6,
|
||||
"minItems": 6,
|
||||
"type": "array"
|
||||
},
|
||||
"storage": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"capacity_notice_level": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"normal"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"warning"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"critical"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"cleanup_pending_count": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"data_root_ref": {
|
||||
"enum": [
|
||||
"configured_local_data_root"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
"hard_limit_bytes": {
|
||||
"minimum": 1,
|
||||
"type": "integer"
|
||||
},
|
||||
"last_measured_at": {
|
||||
"anyOf": [
|
||||
{
|
||||
"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$",
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
},
|
||||
"managed_content_bytes": {
|
||||
"minimum": 0,
|
||||
"type": "integer"
|
||||
},
|
||||
"remeasurement_required": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"status": {
|
||||
"anyOf": [
|
||||
{
|
||||
"enum": [
|
||||
"active"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"full"
|
||||
],
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"enum": [
|
||||
"unavailable"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
]
|
||||
},
|
||||
"storage_backend": {
|
||||
"enum": [
|
||||
"local_filesystem"
|
||||
],
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"capacity_notice_level",
|
||||
"cleanup_pending_count",
|
||||
"data_root_ref",
|
||||
"hard_limit_bytes",
|
||||
"last_measured_at",
|
||||
"managed_content_bytes",
|
||||
"remeasurement_required",
|
||||
"status",
|
||||
"storage_backend"
|
||||
],
|
||||
"type": "object"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"generated_at",
|
||||
"services",
|
||||
"storage"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"AdminSessionResponse": {
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
@@ -5703,39 +4954,6 @@
|
||||
]
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/diagnostics": {
|
||||
"get": {
|
||||
"operationId": "getAdminDiagnostics",
|
||||
"responses": {
|
||||
"200": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/AdminDiagnosticsResponse"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Default Response"
|
||||
},
|
||||
"401": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/ErrorEnvelope"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Default Response"
|
||||
},
|
||||
"503": {
|
||||
"description": "Default Response"
|
||||
}
|
||||
},
|
||||
"tags": [
|
||||
"Admin Operations"
|
||||
]
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/models/configuration": {
|
||||
"put": {
|
||||
"operationId": "replaceModelConfiguration",
|
||||
@@ -8747,72 +7965,6 @@
|
||||
]
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/overview": {
|
||||
"get": {
|
||||
"operationId": "getAdminOverview",
|
||||
"responses": {
|
||||
"200": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/AdminOverviewResponse"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Default Response"
|
||||
},
|
||||
"401": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/ErrorEnvelope"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Default Response"
|
||||
},
|
||||
"503": {
|
||||
"description": "Default Response"
|
||||
}
|
||||
},
|
||||
"tags": [
|
||||
"Admin Operations"
|
||||
]
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/services-storage": {
|
||||
"get": {
|
||||
"operationId": "getAdminServicesStorage",
|
||||
"responses": {
|
||||
"200": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/AdminServicesStorageResponse"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Default Response"
|
||||
},
|
||||
"401": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/ErrorEnvelope"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Default Response"
|
||||
},
|
||||
"503": {
|
||||
"description": "Default Response"
|
||||
}
|
||||
},
|
||||
"tags": [
|
||||
"Admin Operations"
|
||||
]
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/users/{userId}/credit-adjustments": {
|
||||
"post": {
|
||||
"operationId": "adjustAdminUserCredits",
|
||||
|
||||
+2
-7
@@ -14,7 +14,7 @@
|
||||
"test:integration": "vitest run tests/integration",
|
||||
"test:api": "pnpm check:openapi && vitest run tests/api",
|
||||
"test:worker": "pnpm --filter @dada/worker build && node scripts/worker-smoke.mjs && vitest run tests/worker",
|
||||
"test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts tests/e2e/wp6-01-admin-shell.spec.ts tests/e2e/wp6-05-state.spec.ts --config playwright.config.ts",
|
||||
"test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts --config playwright.config.ts",
|
||||
"test:visual": "node scripts/validate-layer-scope.mjs VISUAL",
|
||||
"test:performance": "node scripts/validate-layer-scope.mjs PERFORMANCE",
|
||||
"test:security": "node scripts/verify-frozen-dependencies.mjs && node scripts/redaction-scan.mjs",
|
||||
@@ -92,12 +92,7 @@
|
||||
"test:wp5-02:red": "node scripts/run-wp5-02-validation.mjs --phase red",
|
||||
"preview:wp5-02": "node scripts/run-wp5-02-manual-preview.mjs",
|
||||
"test:wp5-03": "node scripts/run-wp5-03-validation.mjs",
|
||||
"test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red",
|
||||
"test:wp5-04": "node scripts/run-wp5-04-validation.mjs",
|
||||
"test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red",
|
||||
"test:wp6-01": "node scripts/run-wp6-01-validation.mjs --phase scaffold",
|
||||
"test:wp6-01:red": "node scripts/run-wp6-01-validation.mjs --phase red",
|
||||
"test:wp6-05": "pnpm exec vitest run tests/api/wp6-05-state.test.ts && pnpm exec playwright test tests/e2e/wp6-05-state.spec.ts --config playwright.config.ts"
|
||||
"test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@playwright/test": "1.62.0",
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
{
|
||||
"name": "@dada/asset-release-manifest",
|
||||
"version": "0.0.0",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"exports": {
|
||||
".": "./dist/index.js"
|
||||
},
|
||||
"types": "./dist/index.d.ts",
|
||||
"scripts": {
|
||||
"build": "tsc -p tsconfig.json",
|
||||
"typecheck": "tsc --noEmit -p tsconfig.json"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/node": "24.13.3",
|
||||
"typescript": "7.0.2"
|
||||
}
|
||||
}
|
||||
@@ -1,180 +0,0 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { posix, win32 } from "node:path";
|
||||
|
||||
export const ASSET_ACCESS_CLASSES = [
|
||||
"public_release_asset",
|
||||
"internal_preview_asset",
|
||||
"private_user_asset",
|
||||
] as const;
|
||||
|
||||
export type AssetAccessClass = typeof ASSET_ACCESS_CLASSES[number];
|
||||
export type PublicAssetCacheKind = "font" | "template_conversion" | "thumbnail";
|
||||
|
||||
export interface AssetReleaseItemInput {
|
||||
access_class: AssetAccessClass;
|
||||
cache_kind?: PublicAssetCacheKind;
|
||||
content: Uint8Array;
|
||||
mime_type: string;
|
||||
owner_id?: string;
|
||||
relative_path: string;
|
||||
resource_id: string;
|
||||
root_ref: string;
|
||||
sha256?: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseManifestInput {
|
||||
items: readonly AssetReleaseItemInput[];
|
||||
release_version: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseManifestItem {
|
||||
access_class: AssetAccessClass;
|
||||
byte_size: number;
|
||||
cache_kind?: PublicAssetCacheKind;
|
||||
mime_type: string;
|
||||
release_version: string;
|
||||
resource_id: string;
|
||||
sha256: string;
|
||||
url: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseManifestProjection {
|
||||
items: readonly AssetReleaseManifestItem[];
|
||||
manifest_sha256: string;
|
||||
release_version: string;
|
||||
schema_version: "AssetReleaseManifest/v1";
|
||||
}
|
||||
|
||||
export interface AssetReleasePayload {
|
||||
accessClass: AssetAccessClass;
|
||||
bytes: Buffer;
|
||||
mimeType: string;
|
||||
ownerId?: string;
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
sha256: string;
|
||||
}
|
||||
|
||||
export interface AssetReleaseReader {
|
||||
project(
|
||||
accessClass: AssetAccessClass,
|
||||
releaseVersion: string,
|
||||
options?: { ownerId?: string; resourceIds?: readonly string[] },
|
||||
): AssetReleaseManifestProjection | undefined;
|
||||
read(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string): AssetReleasePayload | undefined;
|
||||
}
|
||||
|
||||
interface StoredItem {
|
||||
accessClass: AssetAccessClass;
|
||||
bytes: Buffer;
|
||||
cacheKind?: PublicAssetCacheKind;
|
||||
mimeType: string;
|
||||
ownerId?: string;
|
||||
projection: AssetReleaseManifestItem;
|
||||
relativePath: string;
|
||||
rootRef: string;
|
||||
sha256: string;
|
||||
}
|
||||
|
||||
const releaseVersionPattern = /^[a-z0-9][a-z0-9._-]{0,79}$/i;
|
||||
const resourceIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
||||
const sha256Pattern = /^[0-9a-f]{64}$/;
|
||||
const rootRefPattern = /^[a-z0-9][a-z0-9._-]{0,79}$/i;
|
||||
|
||||
function assetUrl(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string) {
|
||||
if (accessClass === "public_release_asset") return `/api/v1/assets/public/${releaseVersion}/${resourceId}`;
|
||||
if (accessClass === "internal_preview_asset") return `/api/v1/assets/preview/${releaseVersion}/${resourceId}`;
|
||||
return `/api/v1/private-assets/${releaseVersion}/${resourceId}`;
|
||||
}
|
||||
|
||||
function isSafeRelativePath(value: string) {
|
||||
if (!value || value.includes("\\") || posix.isAbsolute(value) || win32.isAbsolute(value)) return false;
|
||||
const segments = value.split("/");
|
||||
return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
|
||||
}
|
||||
|
||||
function sha256(value: string | Uint8Array) {
|
||||
return createHash("sha256").update(value).digest("hex");
|
||||
}
|
||||
|
||||
function immutableProjection(input: Omit<AssetReleaseManifestProjection, "manifest_sha256">): AssetReleaseManifestProjection {
|
||||
const items = input.items.map((item) => Object.freeze({ ...item }));
|
||||
const manifestBody = JSON.stringify({ ...input, items });
|
||||
return Object.freeze({ ...input, items: Object.freeze(items), manifest_sha256: sha256(manifestBody) });
|
||||
}
|
||||
|
||||
function validateItem(item: AssetReleaseItemInput, releaseVersion: string, seenIds: Set<string>): StoredItem {
|
||||
if (!ASSET_ACCESS_CLASSES.includes(item.access_class)) throw new Error("asset access class is unsupported");
|
||||
if (!resourceIdPattern.test(item.resource_id) || seenIds.has(item.resource_id)) throw new Error("resource_id must be a unique opaque UUID");
|
||||
seenIds.add(item.resource_id);
|
||||
if (!rootRefPattern.test(item.root_ref)) throw new Error("root_ref is invalid");
|
||||
if (!isSafeRelativePath(item.relative_path)) throw new Error("relative path must stay within its declared root");
|
||||
if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/i.test(item.mime_type)) throw new Error("mime_type is invalid");
|
||||
if (item.access_class === "public_release_asset" && !item.cache_kind) throw new Error("public release asset requires an allowlisted cache kind");
|
||||
if (item.access_class !== "public_release_asset" && item.cache_kind) throw new Error("non-public assets cannot declare a public cache kind");
|
||||
if (item.access_class === "private_user_asset" && !item.owner_id) throw new Error("private user asset requires owner_id");
|
||||
if (item.access_class !== "private_user_asset" && item.owner_id) throw new Error("only private user assets can declare owner_id");
|
||||
|
||||
const bytes = Buffer.from(item.content);
|
||||
const digest = sha256(bytes);
|
||||
if (item.sha256 !== undefined && (!sha256Pattern.test(item.sha256) || item.sha256 !== digest)) {
|
||||
throw new Error("file SHA-256 does not match content");
|
||||
}
|
||||
const projection: AssetReleaseManifestItem = {
|
||||
access_class: item.access_class,
|
||||
byte_size: bytes.byteLength,
|
||||
...(item.cache_kind ? { cache_kind: item.cache_kind } : {}),
|
||||
mime_type: item.mime_type,
|
||||
release_version: releaseVersion,
|
||||
resource_id: item.resource_id,
|
||||
sha256: digest,
|
||||
url: assetUrl(item.access_class, releaseVersion, item.resource_id),
|
||||
};
|
||||
return {
|
||||
accessClass: item.access_class,
|
||||
bytes,
|
||||
...(item.cache_kind ? { cacheKind: item.cache_kind } : {}),
|
||||
mimeType: item.mime_type,
|
||||
...(item.owner_id ? { ownerId: item.owner_id } : {}),
|
||||
projection: Object.freeze(projection),
|
||||
relativePath: item.relative_path,
|
||||
rootRef: item.root_ref,
|
||||
sha256: digest,
|
||||
};
|
||||
}
|
||||
|
||||
export function createAssetReleaseManifest(input: AssetReleaseManifestInput): AssetReleaseReader {
|
||||
if (!releaseVersionPattern.test(input.release_version)) throw new Error("release_version is invalid");
|
||||
const seenIds = new Set<string>();
|
||||
const items = input.items
|
||||
.map((item) => validateItem(item, input.release_version, seenIds))
|
||||
.sort((left, right) => left.projection.resource_id.localeCompare(right.projection.resource_id));
|
||||
|
||||
return Object.freeze({
|
||||
project(accessClass: AssetAccessClass, releaseVersion: string, options: { ownerId?: string; resourceIds?: readonly string[] } = {}) {
|
||||
if (releaseVersion !== input.release_version) return undefined;
|
||||
const selected = items.filter((item) => item.accessClass === accessClass
|
||||
&& (accessClass !== "private_user_asset" || Boolean(options.ownerId) && item.ownerId === options.ownerId)
|
||||
&& (!options.resourceIds || options.resourceIds.includes(item.projection.resource_id)));
|
||||
return immutableProjection({
|
||||
items: selected.map((item) => item.projection),
|
||||
release_version: input.release_version,
|
||||
schema_version: "AssetReleaseManifest/v1",
|
||||
});
|
||||
},
|
||||
read(accessClass: AssetAccessClass, releaseVersion: string, resourceId: string) {
|
||||
if (releaseVersion !== input.release_version) return undefined;
|
||||
const item = items.find((candidate) => candidate.accessClass === accessClass && candidate.projection.resource_id === resourceId);
|
||||
if (!item) return undefined;
|
||||
return {
|
||||
accessClass: item.accessClass,
|
||||
bytes: Buffer.from(item.bytes),
|
||||
mimeType: item.mimeType,
|
||||
...(item.ownerId ? { ownerId: item.ownerId } : {}),
|
||||
releaseVersion,
|
||||
resourceId,
|
||||
sha256: item.sha256,
|
||||
};
|
||||
},
|
||||
});
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
{
|
||||
"extends": "../../tsconfig.base.json",
|
||||
"compilerOptions": {
|
||||
"module": "NodeNext",
|
||||
"moduleResolution": "NodeNext",
|
||||
"lib": ["ES2024"],
|
||||
"types": ["node"],
|
||||
"declaration": true,
|
||||
"outDir": "dist",
|
||||
"rootDir": "src"
|
||||
},
|
||||
"include": ["src"]
|
||||
}
|
||||
@@ -1,163 +0,0 @@
|
||||
import { Type, type Static } from "@sinclair/typebox";
|
||||
|
||||
const isoTimestampPattern = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$";
|
||||
const modelIdPattern = "^[a-z0-9][a-z0-9.-]+$";
|
||||
const safeReferencePattern = "^[A-Za-z0-9][A-Za-z0-9:._-]{0,159}$";
|
||||
|
||||
export const AdminOverviewResponseSchema = Type.Object(
|
||||
{
|
||||
generated_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
user_slots: Type.Object(
|
||||
{
|
||||
active_and_suspended: Type.Integer({ minimum: 0 }),
|
||||
limit: Type.Integer({ minimum: 1 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
generation_jobs: Type.Object(
|
||||
{
|
||||
pending_manual_review: Type.Integer({ minimum: 0 }),
|
||||
pending_manual_review_oldest_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
queued: Type.Integer({ minimum: 0 }),
|
||||
running: Type.Integer({ minimum: 0 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
models: Type.Object(
|
||||
{
|
||||
configured_default_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
|
||||
configured_model_count: Type.Integer({ minimum: 0 }),
|
||||
recommended_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
|
||||
runtime_available_count: Type.Integer({ minimum: 0 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
storage: Type.Object(
|
||||
{
|
||||
last_measured_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
limit_bytes: Type.Integer({ minimum: 1 }),
|
||||
managed_content_bytes: Type.Integer({ minimum: 0 }),
|
||||
status: Type.Union([
|
||||
Type.Literal("normal"),
|
||||
Type.Literal("critical"),
|
||||
Type.Literal("full"),
|
||||
Type.Literal("unavailable"),
|
||||
]),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
services: Type.Array(
|
||||
Type.Object(
|
||||
{
|
||||
checked_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
service_id: Type.Union([
|
||||
Type.Literal("resend"),
|
||||
Type.Literal("amap"),
|
||||
Type.Literal("ai_gateway"),
|
||||
Type.Literal("worker"),
|
||||
Type.Literal("asset_root"),
|
||||
]),
|
||||
status: Type.Union([
|
||||
Type.Literal("available"),
|
||||
Type.Literal("degraded"),
|
||||
Type.Literal("paused"),
|
||||
Type.Literal("unavailable"),
|
||||
]),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
{ maxItems: 5 },
|
||||
),
|
||||
recent_operations: Type.Array(
|
||||
Type.Object(
|
||||
{
|
||||
created_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
operation_id: Type.String({ pattern: "^[0-9a-fA-F-]{36}$" }),
|
||||
operation_type: Type.String({ maxLength: 80, pattern: "^[a-z][a-z0-9_]+$" }),
|
||||
result: Type.Union([Type.Literal("succeeded"), Type.Literal("rejected"), Type.Literal("failed")]),
|
||||
target_ref: Type.String({ pattern: safeReferencePattern }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
{ maxItems: 10 },
|
||||
),
|
||||
asset_cleanup: Type.Object(
|
||||
{
|
||||
pending_jobs: Type.Integer({ minimum: 0 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
},
|
||||
{ additionalProperties: false, $id: "AdminOverviewResponse" },
|
||||
);
|
||||
|
||||
export type AdminOverviewResponse = Static<typeof AdminOverviewResponseSchema>;
|
||||
|
||||
const adminServiceStatusSchema = Type.Union([
|
||||
Type.Literal("active"),
|
||||
Type.Literal("paused_quota"),
|
||||
Type.Literal("paused_provider"),
|
||||
Type.Literal("disabled"),
|
||||
Type.Literal("degraded"),
|
||||
Type.Literal("unavailable"),
|
||||
]);
|
||||
|
||||
const adminServiceIdSchema = Type.Union([
|
||||
Type.Literal("resend"),
|
||||
Type.Literal("amap"),
|
||||
Type.Literal("ai_gateway"),
|
||||
Type.Literal("worker"),
|
||||
Type.Literal("api"),
|
||||
Type.Literal("asset_root"),
|
||||
]);
|
||||
|
||||
export const AdminServicesStorageResponseSchema = Type.Object({
|
||||
generated_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
services: Type.Array(Type.Object({
|
||||
checked_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
configured: Type.Boolean(),
|
||||
impact_scope: Type.Union([
|
||||
Type.Literal("none"),
|
||||
Type.Literal("authentication"),
|
||||
Type.Literal("location"),
|
||||
Type.Literal("generation"),
|
||||
Type.Literal("storage"),
|
||||
Type.Literal("api"),
|
||||
Type.Literal("model"),
|
||||
Type.Literal("account"),
|
||||
Type.Literal("unknown"),
|
||||
]),
|
||||
pause_reason: Type.Union([Type.String({ maxLength: 80, pattern: "^[a-z][a-z0-9_]*$" }), Type.Null()]),
|
||||
service_id: adminServiceIdSchema,
|
||||
status: adminServiceStatusSchema,
|
||||
}, { additionalProperties: false }), { minItems: 6, maxItems: 6 }),
|
||||
storage: Type.Object({
|
||||
capacity_notice_level: Type.Union([Type.Literal("normal"), Type.Literal("warning"), Type.Literal("critical")]),
|
||||
cleanup_pending_count: Type.Integer({ minimum: 0 }),
|
||||
data_root_ref: Type.Literal("configured_local_data_root"),
|
||||
hard_limit_bytes: Type.Integer({ minimum: 1 }),
|
||||
last_measured_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
managed_content_bytes: Type.Integer({ minimum: 0 }),
|
||||
remeasurement_required: Type.Boolean(),
|
||||
status: Type.Union([Type.Literal("active"), Type.Literal("full"), Type.Literal("unavailable")]),
|
||||
storage_backend: Type.Literal("local_filesystem"),
|
||||
}, { additionalProperties: false }),
|
||||
}, { additionalProperties: false, $id: "AdminServicesStorageResponse" });
|
||||
|
||||
export const AdminDiagnosticsResponseSchema = Type.Object({
|
||||
generated_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
diagnostic_text: Type.String({ minLength: 1, maxLength: 12_000 }),
|
||||
services: Type.Ref(AdminServicesStorageResponseSchema),
|
||||
system: Type.Object({
|
||||
api_status: Type.Union([Type.Literal("ready"), Type.Literal("degraded"), Type.Literal("unavailable")]),
|
||||
app_version: Type.String({ maxLength: 80, pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*$" }),
|
||||
browser_support: Type.Array(Type.Object({
|
||||
brand: Type.Union([Type.Literal("Google Chrome"), Type.Literal("Microsoft Edge")]),
|
||||
major: Type.Integer({ minimum: 1 }),
|
||||
}, { additionalProperties: false }), { maxItems: 2 }),
|
||||
worker_status: Type.Union([Type.Literal("ready"), Type.Literal("degraded"), Type.Literal("unavailable")]),
|
||||
}, { additionalProperties: false }),
|
||||
}, { additionalProperties: false, $id: "AdminDiagnosticsResponse" });
|
||||
|
||||
export type AdminServicesStorageResponse = Static<typeof AdminServicesStorageResponseSchema>;
|
||||
export type AdminDiagnosticsResponse = Static<typeof AdminDiagnosticsResponseSchema>;
|
||||
@@ -1,6 +1,5 @@
|
||||
export { Type } from "@sinclair/typebox";
|
||||
export * from "./api.js";
|
||||
export * from "./admin.js";
|
||||
export * from "./assets.js";
|
||||
export * from "./auth.js";
|
||||
export * from "./bootstrap.js";
|
||||
|
||||
Generated
-12
@@ -38,9 +38,6 @@ importers:
|
||||
|
||||
apps/api:
|
||||
dependencies:
|
||||
'@dada/asset-release-manifest':
|
||||
specifier: workspace:*
|
||||
version: link:../../packages/asset-release-manifest
|
||||
'@dada/shared-contracts':
|
||||
specifier: workspace:*
|
||||
version: link:../../packages/shared-contracts
|
||||
@@ -154,15 +151,6 @@ importers:
|
||||
specifier: 7.0.2
|
||||
version: 7.0.2
|
||||
|
||||
packages/asset-release-manifest:
|
||||
devDependencies:
|
||||
'@types/node':
|
||||
specifier: 24.13.3
|
||||
version: 24.13.3
|
||||
typescript:
|
||||
specifier: 7.0.2
|
||||
version: 7.0.2
|
||||
|
||||
packages/asset-renderer:
|
||||
dependencies:
|
||||
'@dada/template-registry':
|
||||
|
||||
@@ -26,7 +26,6 @@ export const frozenPackages = {
|
||||
},
|
||||
"apps/api/package.json": {
|
||||
dependencies: {
|
||||
"@dada/asset-release-manifest": "workspace:*",
|
||||
"@fastify/multipart": "10.1.0",
|
||||
"@fastify/swagger": "9.8.1",
|
||||
"@sinclair/typebox": "0.34.52",
|
||||
@@ -47,12 +46,6 @@ export const frozenPackages = {
|
||||
typescript: "7.0.2",
|
||||
},
|
||||
},
|
||||
"packages/asset-release-manifest/package.json": {
|
||||
devDependencies: {
|
||||
"@types/node": "24.13.3",
|
||||
typescript: "7.0.2",
|
||||
},
|
||||
},
|
||||
"packages/shared-contracts/package.json": {
|
||||
dependencies: {
|
||||
"@sinclair/typebox": "0.34.52",
|
||||
|
||||
@@ -13,7 +13,6 @@ function runPnpm(args) {
|
||||
}
|
||||
|
||||
export function buildApiContracts() {
|
||||
runPnpm(["--filter", "@dada/asset-release-manifest", "build"]);
|
||||
runPnpm(["--filter", "@dada/shared-contracts", "build"]);
|
||||
runPnpm(["--filter", "@dada/api", "build"]);
|
||||
}
|
||||
|
||||
@@ -1,132 +0,0 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
const phaseIndex = process.argv.indexOf("--phase");
|
||||
const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "green";
|
||||
if (!["red", "green"].includes(phase)) throw new Error(`Unsupported phase: ${phase}`);
|
||||
const runId = process.env.DADA_TDD_RUN_ID ?? `wp5-04-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
|
||||
const runDirectory = resolve("artifacts", "tdd", runId);
|
||||
const casesDirectory = resolve(runDirectory, "cases");
|
||||
if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
|
||||
|
||||
const cases = [
|
||||
{
|
||||
acceptance_criteria: ["AC-42", "AC-48"],
|
||||
evidence: ["response.json", "headers.json", "cache-enumeration.json", "trace.zip"],
|
||||
id: "TDD-WP5-RES-001-three-access-classes",
|
||||
red_reason: "公开 manifest 暴露 internal/private、路径可推导或缓存策略混用",
|
||||
requirements: ["PRIV-02", "PRIV-05"],
|
||||
},
|
||||
{
|
||||
acceptance_criteria: ["AC-46", "AC-48"],
|
||||
evidence: ["cache-enumeration.json", "service-worker.json", "trace.zip"],
|
||||
id: "TDD-WP5-CACHE-001-no-private-client-state",
|
||||
red_reason: "SW 拦截 internal/private 或 IndexedDB 保存私有字段",
|
||||
requirements: ["NFR-07", "PRIV-02"],
|
||||
},
|
||||
];
|
||||
for (const item of cases) mkdirSync(resolve(casesDirectory, item.id), { recursive: true });
|
||||
|
||||
const resourceDirectory = resolve(casesDirectory, cases[0].id);
|
||||
const cacheDirectory = resolve(casesDirectory, cases[1].id);
|
||||
const outputDirectory = resolve(runDirectory, "playwright-output");
|
||||
const environment = {
|
||||
...process.env,
|
||||
DADA_EVIDENCE_DIR_WP5_CACHE: cacheDirectory,
|
||||
DADA_EVIDENCE_DIR_WP5_RES: resourceDirectory,
|
||||
DADA_PLAYWRIGHT_OUTPUT_DIR: outputDirectory,
|
||||
};
|
||||
const commands = phase === "red"
|
||||
? [["red-focused", "pnpm --filter @dada/shared-contracts build && pnpm exec vitest run tests/unit/wp5-04-asset-release-manifest.test.ts tests/api/wp5-04-asset-access.test.ts"]]
|
||||
: [
|
||||
["build-manifest", "pnpm --filter @dada/asset-release-manifest build"],
|
||||
["unit", "pnpm test:unit"],
|
||||
["api", "pnpm test:api"],
|
||||
["e2e", "pnpm test:e2e"],
|
||||
["security", "pnpm test:security"],
|
||||
["package", "pnpm test:package"],
|
||||
["tdd-trace", "pnpm validate:tdd-trace"],
|
||||
];
|
||||
const commandResults = [];
|
||||
for (const [name, command] of commands) {
|
||||
const started_at = new Date().toISOString();
|
||||
const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
|
||||
encoding: "utf8", env: environment, maxBuffer: 40 * 1024 * 1024,
|
||||
});
|
||||
if (result.stdout) process.stdout.write(result.stdout);
|
||||
if (result.stderr) process.stderr.write(result.stderr);
|
||||
commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
|
||||
if (phase === "green" && (result.status ?? 1) !== 0) break;
|
||||
}
|
||||
|
||||
function findFiles(directory, name) {
|
||||
const matches = [];
|
||||
if (!existsSync(directory)) return matches;
|
||||
for (const entry of readdirSync(directory, { withFileTypes: true })) {
|
||||
const path = resolve(directory, entry.name);
|
||||
if (entry.isDirectory()) matches.push(...findFiles(path, name));
|
||||
else if (entry.name === name) matches.push(path);
|
||||
}
|
||||
return matches;
|
||||
}
|
||||
|
||||
if (phase === "green") {
|
||||
const trace = findFiles(outputDirectory, "trace.zip").find((path) => path.toLowerCase().includes("wp5-04"));
|
||||
if (trace) {
|
||||
copyFileSync(trace, resolve(resourceDirectory, "trace.zip"));
|
||||
copyFileSync(trace, resolve(cacheDirectory, "trace.zip"));
|
||||
}
|
||||
}
|
||||
|
||||
const redConfirmed = phase === "red" && commandResults.length === 1 && commandResults[0].exit_code !== 0;
|
||||
if (phase === "red") {
|
||||
for (const item of cases) {
|
||||
writeFileSync(resolve(casesDirectory, item.id, "red-observation.json"), `${JSON.stringify({
|
||||
expected_failure: item.red_reason,
|
||||
observed_command: commandResults[0].command,
|
||||
observed_exit_code: commandResults[0].exit_code,
|
||||
status: redConfirmed ? "red_confirmed" : "failed",
|
||||
}, null, 2)}\n`);
|
||||
}
|
||||
}
|
||||
|
||||
const commandState = phase === "red" ? redConfirmed : commandResults.length === commands.length && commandResults.every((result) => result.exit_code === 0);
|
||||
const manifest = { path: "tasks.manifest.json", sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase() };
|
||||
const commit = spawnSync("git", ["rev-parse", "--short", "HEAD"], { encoding: "utf8" }).stdout.trim();
|
||||
const dirty = spawnSync("git", ["status", "--porcelain"], { encoding: "utf8" }).stdout.trim().length > 0;
|
||||
const summaries = [];
|
||||
for (const item of cases) {
|
||||
const directory = resolve(casesDirectory, item.id);
|
||||
const evidenceRefs = phase === "red" ? ["red-observation.json"] : item.evidence;
|
||||
const missingEvidence = evidenceRefs.filter((file) => !existsSync(resolve(directory, file)));
|
||||
const status = commandState && missingEvidence.length === 0 ? phase === "red" ? "red_confirmed" : "passed" : "failed";
|
||||
writeFileSync(resolve(directory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(directory, "result.json"), `${JSON.stringify({
|
||||
acceptance_criteria: item.acceptance_criteria,
|
||||
automation: ["automated"],
|
||||
commit,
|
||||
evidence_refs: evidenceRefs,
|
||||
layer: ["UNIT", "API", "E2E", "PKG-SEC"],
|
||||
manifest,
|
||||
missing_evidence: missingEvidence,
|
||||
phase,
|
||||
red_reason: item.red_reason,
|
||||
requirements: item.requirements,
|
||||
run_id: runId,
|
||||
status,
|
||||
task_id: "TASK-WP5-04",
|
||||
test_id: item.id,
|
||||
work_package: "WP-5",
|
||||
worktree_under_test: dirty ? "uncommitted implementation" : "clean committed implementation",
|
||||
}, null, 2)}\n`);
|
||||
summaries.push({ missing_evidence: missingEvidence, status, test_id: item.id });
|
||||
}
|
||||
const status = summaries.every((item) => item.status === (phase === "red" ? "red_confirmed" : "passed"))
|
||||
? phase === "red" ? "red_confirmed" : "passed"
|
||||
: "failed";
|
||||
writeFileSync(resolve(runDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: summaries, phase, run_id: runId, status }, null, 2)}\n`);
|
||||
console.log(JSON.stringify({ cases: summaries, phase, run_id: runId, status }, null, 2));
|
||||
if (status === "failed") process.exit(1);
|
||||
@@ -1,115 +0,0 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
const phaseIndex = process.argv.indexOf("--phase");
|
||||
const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "scaffold";
|
||||
if (!new Set(["red", "scaffold"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
|
||||
|
||||
const runId = process.env.DADA_TDD_RUN_ID ?? `wp6-01-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
|
||||
const runDirectory = resolve("artifacts", "tdd", runId);
|
||||
const caseDirectory = resolve(runDirectory, "cases", "TDD-WP6-ADM-001-role-and-summary");
|
||||
if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
|
||||
mkdirSync(caseDirectory, { recursive: true });
|
||||
|
||||
const environment = {
|
||||
...process.env,
|
||||
DADA_EVIDENCE_DIR_ADMIN: caseDirectory,
|
||||
DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
|
||||
DADA_WP6_01_EVIDENCE_DIR: caseDirectory,
|
||||
};
|
||||
const commands = phase === "red"
|
||||
? [
|
||||
["api-red", "pnpm exec vitest run tests/api/wp6-01-admin-shell.test.ts"],
|
||||
["e2e-red", "pnpm exec playwright test tests/e2e/wp6-01-admin-shell.spec.ts --config playwright.config.ts"],
|
||||
]
|
||||
: [
|
||||
["api", "pnpm test:api"],
|
||||
["e2e", "pnpm test:e2e"],
|
||||
["security", "pnpm test:security"],
|
||||
["tdd-trace", "pnpm validate:tdd-trace"],
|
||||
];
|
||||
|
||||
const commandResults = [];
|
||||
for (const [name, command] of commands) {
|
||||
const started_at = new Date().toISOString();
|
||||
const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
|
||||
encoding: "utf8",
|
||||
env: environment,
|
||||
maxBuffer: 40 * 1024 * 1024,
|
||||
});
|
||||
if (result.stdout) process.stdout.write(result.stdout);
|
||||
if (result.stderr) process.stderr.write(result.stderr);
|
||||
commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
|
||||
if (phase === "scaffold" && (result.status ?? 1) !== 0) break;
|
||||
}
|
||||
|
||||
const redConfirmed = phase === "red" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code !== 0);
|
||||
if (phase === "red") {
|
||||
writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
|
||||
expected_failure: "The protected admin overview route, nine-entry admin shell, denied-session redirect, and disabled-session ejection are absent before TASK-WP6-01.",
|
||||
observed_commands: commandResults,
|
||||
red_reason: "TDD-WP6-ADM-001 first Red: ordinary or preview subjects can reach the unguarded admin route, while no safe summary API exists.",
|
||||
status: redConfirmed ? "red_confirmed" : "failed",
|
||||
}, null, 2)}\n`);
|
||||
}
|
||||
|
||||
function findFiles(directory, name) {
|
||||
if (!existsSync(directory)) return [];
|
||||
const matches = [];
|
||||
for (const entry of readdirSync(directory, { withFileTypes: true })) {
|
||||
const path = resolve(directory, entry.name);
|
||||
if (entry.isDirectory()) matches.push(...findFiles(path, name));
|
||||
else if (entry.name === name) matches.push(path);
|
||||
}
|
||||
return matches;
|
||||
}
|
||||
|
||||
if (phase === "scaffold") {
|
||||
const trace = findFiles(environment.DADA_PLAYWRIGHT_OUTPUT_DIR, "trace.zip")
|
||||
.find((path) => path.toLowerCase().includes("wp6-01-admin-shell"));
|
||||
if (trace) copyFileSync(trace, resolve(caseDirectory, "trace.zip"));
|
||||
}
|
||||
|
||||
const expectedEvidence = phase === "red"
|
||||
? ["red-observation.json"]
|
||||
: ["response.json", "db-access.json", "trace.zip", "screenshots/admin-denied.png", "screenshots/admin-overview.png"];
|
||||
const missingEvidence = expectedEvidence.filter((file) => !existsSync(resolve(caseDirectory, file)));
|
||||
const commandsPassed = phase === "scaffold" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code === 0);
|
||||
const status = phase === "red"
|
||||
? redConfirmed && missingEvidence.length === 0 ? "red_confirmed" : "failed"
|
||||
: commandsPassed && missingEvidence.length === 0 ? "red" : "failed";
|
||||
const commit = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim();
|
||||
const wp5BaselineSha = spawnSync("git", ["rev-parse", "origin/codex/wp5-04"], { encoding: "utf8" }).stdout.trim();
|
||||
const manifest = {
|
||||
path: "tasks.manifest.json",
|
||||
sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
|
||||
};
|
||||
const result = {
|
||||
acceptance_criteria: ["AC-25", "AC-49"],
|
||||
automation: ["automated"],
|
||||
commit,
|
||||
dependency_gate: {
|
||||
blocked_by: ["TASK-WP5-05", "TASK-WP5-06", "TASK-WP5-07"],
|
||||
baseline_remote_branch: "origin/codex/wp5-04",
|
||||
baseline_remote_sha: wp5BaselineSha,
|
||||
final_green_allowed: false,
|
||||
},
|
||||
evidence_refs: expectedEvidence,
|
||||
layer: ["API", "E2E"],
|
||||
manifest,
|
||||
missing_evidence: missingEvidence,
|
||||
phase,
|
||||
requirements: ["ADMIN-01", "ADMIN-02", "ADMIN-04", "ADMIN-08"],
|
||||
run_id: runId,
|
||||
status,
|
||||
task_id: "TASK-WP6-01",
|
||||
test_id: "TDD-WP6-ADM-001-role-and-summary",
|
||||
work_package: "WP-6",
|
||||
};
|
||||
writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
|
||||
writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: result.test_id }], phase, run_id: runId, status }, null, 2)}\n`);
|
||||
console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
|
||||
if (status === "failed") process.exit(1);
|
||||
@@ -1,150 +0,0 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js";
|
||||
|
||||
const now = Date.parse("2026-08-03T10:00:00.000Z");
|
||||
const releaseVersion = "asset-20260803.1";
|
||||
const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
|
||||
const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
|
||||
const ungrantedPreviewId = "d8fe890d-6df4-46a9-a578-96c1f8361ac0";
|
||||
const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
|
||||
const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
const roots: string[] = [];
|
||||
const registrations: RegistrationService[] = [];
|
||||
|
||||
function addUser(registration: RegistrationService, role: "super_admin" | "user") {
|
||||
const userId = randomUUID();
|
||||
registration.database.prepare(`INSERT INTO users (
|
||||
user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at
|
||||
) VALUES (?, ?, ?, 'active', ?, ?, ?)`).run(
|
||||
userId,
|
||||
`${role}-${userId}@example.invalid`,
|
||||
role,
|
||||
role === "user" ? 1 : 0,
|
||||
randomUUID(),
|
||||
now,
|
||||
);
|
||||
if (role === "user") {
|
||||
registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Asset User', '@asset_user')").run(userId);
|
||||
registration.database.prepare("INSERT INTO credit_accounts (user_id, available_balance, reserved_balance, updated_at) VALUES (?, 10, 0, ?)").run(userId, now);
|
||||
} else {
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
|
||||
}
|
||||
return { session: registration.issueAuthenticatedSession(userId, role === "user" ? "user" : "admin"), userId };
|
||||
}
|
||||
|
||||
function evidence(name: string, value: unknown) {
|
||||
const directory = process.env.DADA_EVIDENCE_DIR_WP5_RES;
|
||||
if (!directory) return;
|
||||
mkdirSync(directory, { recursive: true });
|
||||
writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
function harness() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp5-04-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
challengePepper: Buffer.alloc(32, 0x31), clock: () => now,
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1", databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0x32), resend: new MockResendAdapter(), sessionPepper: Buffer.alloc(32, 0x33),
|
||||
});
|
||||
registrations.push(registration);
|
||||
const owner = addUser(registration, "user");
|
||||
const intruder = addUser(registration, "user");
|
||||
const admin = addUser(registration, "super_admin");
|
||||
const assetReleases = createAssetReleaseManifest({
|
||||
items: [
|
||||
{ access_class: "public_release_asset", cache_kind: "thumbnail", content: Buffer.from("public"), mime_type: "image/png", relative_path: "public/FLOWER001.png", resource_id: publicId, root_ref: "canonical-assets" },
|
||||
{ access_class: "internal_preview_asset", content: Buffer.from("preview"), mime_type: "image/webp", relative_path: "preview/FLOWER009.webp", resource_id: previewId, root_ref: "canonical-assets" },
|
||||
{ access_class: "internal_preview_asset", content: Buffer.from("ungranted-preview"), mime_type: "image/webp", relative_path: "preview/FLOWER010.webp", resource_id: ungrantedPreviewId, root_ref: "canonical-assets" },
|
||||
{ access_class: "private_user_asset", content: Buffer.from("private"), mime_type: "image/png", owner_id: owner.userId, relative_path: "private/generated.png", resource_id: privateId, root_ref: "managed-assets" },
|
||||
],
|
||||
release_version: releaseVersion,
|
||||
});
|
||||
let previewGranted = true;
|
||||
let previewChecks = 0;
|
||||
const appPromise = createApp({
|
||||
assetReleases,
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
previewAssetAuthorizer: ({ resourceId, userId }) => {
|
||||
previewChecks += 1;
|
||||
return previewGranted && userId === owner.userId && resourceId === previewId;
|
||||
},
|
||||
privateAssetAdminAuthorizer: ({ adminUserId, ownerId }) => adminUserId === admin.userId && ownerId === owner.userId,
|
||||
registration,
|
||||
});
|
||||
return { admin, appPromise, intruder, owner, previewChecks: () => previewChecks, revokePreview: () => { previewGranted = false; } };
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const registration of registrations.splice(0)) registration.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP5-RES-001 three access classes", () => {
|
||||
it("separates route projections, per-request authorization, and cache headers", async () => {
|
||||
const test = harness();
|
||||
const app = await test.appPromise;
|
||||
const ownerCookie = `dada_session=${test.owner.session.sessionToken}`;
|
||||
const intruderCookie = `dada_session=${test.intruder.session.sessionToken}`;
|
||||
const adminCookie = `dada_admin_session=${test.admin.session.sessionToken}`;
|
||||
|
||||
const publicManifest = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/manifest` });
|
||||
const publicAsset = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/${publicId}` });
|
||||
const previewManifest = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/manifest` });
|
||||
const previewAsset = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${previewId}` });
|
||||
const privateManifest = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/manifest` });
|
||||
const privateAsset = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
|
||||
const deniedPrivate = await app.inject({ headers: { ...headers, cookie: intruderCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
|
||||
const controlledAdmin = await app.inject({ headers: { ...headers, cookie: adminCookie }, method: "GET", url: `/api/v1/private-assets/${releaseVersion}/${privateId}` });
|
||||
|
||||
expect(publicManifest.statusCode).toBe(200);
|
||||
expect(publicManifest.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
|
||||
expect(publicManifest.json().items).toEqual([expect.objectContaining({ access_class: "public_release_asset", resource_id: publicId })]);
|
||||
expect(JSON.stringify(publicManifest.json())).not.toMatch(/preview|private|relative_path|root_ref|[A-Z]:\\\\/i);
|
||||
expect(publicAsset.statusCode).toBe(200);
|
||||
expect(publicAsset.rawPayload).toEqual(Buffer.from("public"));
|
||||
expect(publicAsset.headers["cache-control"]).toBe("public, max-age=31536000, immutable");
|
||||
|
||||
expect(previewManifest.statusCode).toBe(200);
|
||||
expect(previewManifest.headers["cache-control"]).toBe("private, no-store");
|
||||
expect(previewManifest.json().items).toEqual([expect.objectContaining({ resource_id: previewId })]);
|
||||
expect(JSON.stringify(previewManifest.json())).not.toContain(ungrantedPreviewId);
|
||||
expect(previewAsset.statusCode).toBe(200);
|
||||
expect(previewAsset.headers["cache-control"]).toBe("private, no-store");
|
||||
expect(privateManifest.json().items).toEqual([expect.objectContaining({ access_class: "private_user_asset", resource_id: privateId })]);
|
||||
expect(privateAsset.rawPayload).toEqual(Buffer.from("private"));
|
||||
expect(privateAsset.headers["cache-control"]).toBe("private, no-store");
|
||||
expect(deniedPrivate.statusCode).toBe(404);
|
||||
expect(controlledAdmin.statusCode).toBe(200);
|
||||
|
||||
const publicGuess = await app.inject({ headers, method: "GET", url: `/api/v1/assets/public/${releaseVersion}/${privateId}` });
|
||||
expect(publicGuess.statusCode).toBe(404);
|
||||
test.revokePreview();
|
||||
const revoked = await app.inject({ headers: { ...headers, cookie: ownerCookie }, method: "GET", url: `/api/v1/assets/preview/${releaseVersion}/${previewId}` });
|
||||
expect(revoked.statusCode).toBe(404);
|
||||
expect(test.previewChecks()).toBe(4);
|
||||
|
||||
evidence("response.json", {
|
||||
controlled_admin_status: controlledAdmin.statusCode,
|
||||
private_intruder_status: deniedPrivate.statusCode,
|
||||
public_guess_status: publicGuess.statusCode,
|
||||
revoked_preview_status: revoked.statusCode,
|
||||
});
|
||||
evidence("headers.json", {
|
||||
private: privateAsset.headers["cache-control"],
|
||||
preview: previewAsset.headers["cache-control"],
|
||||
public: publicAsset.headers["cache-control"],
|
||||
});
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -1,140 +0,0 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
|
||||
|
||||
const roots: string[] = [];
|
||||
const services: RegistrationService[] = [];
|
||||
const now = Date.parse("2026-08-03T09:30:00.000Z");
|
||||
const requestHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
|
||||
function createRegistration() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp6-01-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
adminAllowlistPepper: Buffer.alloc(32, 0xd1),
|
||||
challengePepper: Buffer.alloc(32, 0xd2),
|
||||
clock: () => now,
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
|
||||
databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0xd3),
|
||||
resend: new MockResendAdapter(),
|
||||
sessionPepper: Buffer.alloc(32, 0xd4),
|
||||
});
|
||||
services.push(registration);
|
||||
return registration;
|
||||
}
|
||||
|
||||
function seedSubject(registration: RegistrationService, role: "super_admin" | "user") {
|
||||
const userId = randomUUID();
|
||||
registration.database.prepare(`
|
||||
INSERT INTO users (
|
||||
user_id, normalized_email, role, status, counts_toward_stage_limit,
|
||||
registration_id, created_at
|
||||
) VALUES (?, ?, ?, 'active', ?, ?, ?)
|
||||
`).run(userId, `${role}-${userId}@example.invalid`, role, role === "user" ? 1 : 0, randomUUID(), now);
|
||||
if (role === "super_admin") {
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
|
||||
}
|
||||
return userId;
|
||||
}
|
||||
|
||||
function tableCounts(registration: RegistrationService) {
|
||||
return {
|
||||
admin: (registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs").get() as { count: number }).count,
|
||||
private: (registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count,
|
||||
};
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const service of services.splice(0)) service.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP6-ADM-001-role-and-summary", () => {
|
||||
it("authorizes only an active admin audience and returns a schema-redacted summary", async () => {
|
||||
const registration = createRegistration();
|
||||
const adminId = seedSubject(registration, "super_admin");
|
||||
const ordinaryId = seedSubject(registration, "user");
|
||||
const previewId = seedSubject(registration, "user");
|
||||
registration.database.exec("CREATE TABLE asset_preview_grants_fixture (user_id TEXT PRIMARY KEY, status TEXT NOT NULL)");
|
||||
registration.database.prepare("INSERT INTO asset_preview_grants_fixture (user_id, status) VALUES (?, 'active')").run(previewId);
|
||||
|
||||
const adminSession = registration.issueAuthenticatedSession(adminId, "admin");
|
||||
const ordinarySession = registration.issueAuthenticatedSession(ordinaryId, "user");
|
||||
const previewSession = registration.issueAuthenticatedSession(previewId, "user");
|
||||
let providerCalls = 0;
|
||||
const app = await createApp({
|
||||
adminOverview: async () => {
|
||||
providerCalls += 1;
|
||||
return {
|
||||
...adminOverviewFixture,
|
||||
absolute_path: "forbidden-path-trap",
|
||||
["api" + "_key"]: "forbidden-key-trap",
|
||||
private_prompt: "forbidden-prompt-trap",
|
||||
recent_operations: adminOverviewFixture.recent_operations.map((operation) => ({
|
||||
...operation,
|
||||
actor_email: "forbidden@example.invalid",
|
||||
})),
|
||||
};
|
||||
},
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
|
||||
for (const token of [undefined, ordinarySession.sessionToken, previewSession.sessionToken]) {
|
||||
const response = await app.inject({
|
||||
headers: token ? { ...requestHeaders, cookie: `dada_admin_session=${token}` } : requestHeaders,
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/overview",
|
||||
});
|
||||
expect(response.statusCode).toBe(401);
|
||||
}
|
||||
expect(providerCalls).toBe(0);
|
||||
|
||||
const before = tableCounts(registration);
|
||||
const allowed = await app.inject({
|
||||
headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/overview",
|
||||
});
|
||||
expect(allowed.statusCode).toBe(200);
|
||||
expect(allowed.json()).toEqual(adminOverviewFixture);
|
||||
expect(JSON.stringify(allowed.json())).not.toMatch(/absolute_path|api_key|private_prompt|actor_email|forbidden/i);
|
||||
expect(providerCalls).toBe(1);
|
||||
expect(tableCounts(registration)).toEqual(before);
|
||||
|
||||
registration.revokeAdminSessions(adminId, "disabled");
|
||||
const afterDisable = tableCounts(registration);
|
||||
const revoked = await app.inject({
|
||||
headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/overview",
|
||||
});
|
||||
expect(revoked.statusCode).toBe(401);
|
||||
expect(providerCalls).toBe(1);
|
||||
expect(tableCounts(registration)).toEqual(afterDisable);
|
||||
const evidenceRoot = process.env.DADA_WP6_01_EVIDENCE_DIR;
|
||||
if (evidenceRoot) {
|
||||
mkdirSync(evidenceRoot, { recursive: true });
|
||||
writeFileSync(resolve(evidenceRoot, "response.json"), `${JSON.stringify({
|
||||
active_admin: allowed.json(),
|
||||
denied_statuses: { anonymous: 401, ordinary: 401, preview: 401, suspended_admin: revoked.statusCode },
|
||||
}, null, 2)}\n`);
|
||||
writeFileSync(resolve(evidenceRoot, "db-access.json"), `${JSON.stringify({
|
||||
active_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
|
||||
denied_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
|
||||
provider_calls: providerCalls,
|
||||
}, null, 2)}\n`);
|
||||
}
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -1,179 +0,0 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdtempSync, rmSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { createAdminServicesStorageProvider } from "../../apps/api/src/admin-state.js";
|
||||
import { ManagedStorage } from "../../apps/api/src/managed-storage.js";
|
||||
import { ModelConfigurationService } from "../../apps/api/src/model-configuration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import type { AdminDiagnosticsResponse, AdminServicesStorageResponse } from "@dada/shared-contracts";
|
||||
|
||||
const now = "2026-08-04T09:30:00.000Z";
|
||||
const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
const roots: string[] = [];
|
||||
const registrations: RegistrationService[] = [];
|
||||
const storages: ManagedStorage[] = [];
|
||||
|
||||
const servicesFixture: AdminServicesStorageResponse = {
|
||||
generated_at: now,
|
||||
services: [
|
||||
{ checked_at: now, configured: true, impact_scope: "authentication", pause_reason: null, service_id: "resend", status: "active" },
|
||||
{ checked_at: now, configured: true, impact_scope: "location", pause_reason: "quota_exhausted", service_id: "amap", status: "paused_quota" },
|
||||
{ checked_at: now, configured: true, impact_scope: "generation", pause_reason: "balance_insufficient", service_id: "ai_gateway", status: "degraded" },
|
||||
{ checked_at: now, configured: true, impact_scope: "generation", pause_reason: "worker_stopped", service_id: "worker", status: "degraded" },
|
||||
{ checked_at: now, configured: true, impact_scope: "api", pause_reason: null, service_id: "api", status: "active" },
|
||||
{ checked_at: now, configured: true, impact_scope: "storage", pause_reason: null, service_id: "asset_root", status: "active" },
|
||||
],
|
||||
storage: {
|
||||
capacity_notice_level: "warning",
|
||||
cleanup_pending_count: 2,
|
||||
data_root_ref: "configured_local_data_root",
|
||||
hard_limit_bytes: 5_368_709_120,
|
||||
last_measured_at: now,
|
||||
managed_content_bytes: 4_563_402_752,
|
||||
remeasurement_required: false,
|
||||
status: "active",
|
||||
storage_backend: "local_filesystem",
|
||||
},
|
||||
};
|
||||
|
||||
const diagnosticsFixture: AdminDiagnosticsResponse = {
|
||||
generated_at: now,
|
||||
diagnostic_text: "Dada P0-A\napp_version=0.0.0\napi_status=ready\nworker_status=ready\nstorage_status=active",
|
||||
services: servicesFixture,
|
||||
system: {
|
||||
api_status: "ready",
|
||||
app_version: "0.0.0",
|
||||
browser_support: [{ brand: "Google Chrome", major: 128 }, { brand: "Microsoft Edge", major: 128 }],
|
||||
worker_status: "ready",
|
||||
},
|
||||
};
|
||||
|
||||
function createRegistration() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp6-05-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
adminAllowlistPepper: Buffer.alloc(32, 0xe1),
|
||||
challengePepper: Buffer.alloc(32, 0xe2),
|
||||
clock: () => Date.parse(now),
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
|
||||
databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0xe3),
|
||||
resend: new MockResendAdapter(),
|
||||
sessionPepper: Buffer.alloc(32, 0xe4),
|
||||
});
|
||||
registrations.push(registration);
|
||||
return registration;
|
||||
}
|
||||
|
||||
function seedAdmin(registration: RegistrationService) {
|
||||
const userId = randomUUID();
|
||||
registration.database.prepare(`
|
||||
INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
|
||||
VALUES (?, ?, 'super_admin', 'active', 0, ?, ?)
|
||||
`).run(userId, `${userId}@example.invalid`, randomUUID(), Date.parse(now));
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
|
||||
return registration.issueAuthenticatedSession(userId, "admin");
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const storage of storages.splice(0)) storage.close();
|
||||
for (const registration of registrations.splice(0)) registration.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe("admin status aggregation", () => {
|
||||
it("reads storage and runtime truth without fabricating provider readiness", () => {
|
||||
const registration = createRegistration();
|
||||
const root = roots[roots.length - 1]!;
|
||||
const storage = new ManagedStorage({ dataRoot: root, databasePath: join(root, "dada.sqlite3") });
|
||||
storages.push(storage);
|
||||
const models = new ModelConfigurationService({ database: registration.database, clock: () => Date.parse(now) });
|
||||
const state = createAdminServicesStorageProvider({ database: registration.database, models, storage, clock: () => Date.parse(now) })();
|
||||
expect(new Set(state.services.map((service) => service.service_id)).size).toBe(6);
|
||||
expect(state.services.find((service) => service.service_id === "worker")?.status).toBe("unavailable");
|
||||
expect(state.services.find((service) => service.service_id === "ai_gateway")?.status).toBe("degraded");
|
||||
expect(state.storage.storage_backend).toBe("local_filesystem");
|
||||
expect(JSON.stringify(state)).not.toContain("http");
|
||||
expect(JSON.stringify(state)).not.toContain("@example");
|
||||
});
|
||||
});
|
||||
|
||||
describe("TDD-WP6-STATE-001-three-model-states", () => {
|
||||
it("requires an active admin session and keeps model/service state provider-backed", async () => {
|
||||
const registration = createRegistration();
|
||||
let serviceCalls = 0;
|
||||
const app = await createApp({
|
||||
adminDiagnostics: async () => diagnosticsFixture,
|
||||
adminServicesStorage: async () => {
|
||||
serviceCalls += 1;
|
||||
return servicesFixture;
|
||||
},
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
|
||||
const denied = await app.inject({ headers, method: "GET", url: "/api/v1/admin/services-storage" });
|
||||
expect(denied.statusCode).toBe(401);
|
||||
expect(serviceCalls).toBe(0);
|
||||
|
||||
const session = seedAdmin(registration);
|
||||
const authorizedHeaders = { ...headers, cookie: `dada_admin_session=${session.sessionToken}` };
|
||||
const state = await app.inject({ headers: authorizedHeaders, method: "GET", url: "/api/v1/admin/services-storage" });
|
||||
expect(state.statusCode).toBe(200);
|
||||
expect(state.json()).toEqual(servicesFixture);
|
||||
expect(serviceCalls).toBe(1);
|
||||
expect(JSON.stringify(state.json()).toLowerCase()).not.toMatch(/secret|password|email|absolute/);
|
||||
|
||||
const diagnostic = await app.inject({ headers: authorizedHeaders, method: "GET", url: "/api/v1/admin/diagnostics" });
|
||||
expect(diagnostic.statusCode).toBe(200);
|
||||
expect(diagnostic.json()).toEqual(diagnosticsFixture);
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
|
||||
describe("TDD-WP6-DIAG-001-redacted-diagnostics", () => {
|
||||
it("rejects a provider diagnostic that contains a credential or absolute path trap", async () => {
|
||||
const registration = createRegistration();
|
||||
const app = await createApp({
|
||||
adminDiagnostics: async () => ({ ...diagnosticsFixture, diagnostic_text: "api_key=trap C:\\Users\\dada\\secret.txt" }),
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
const session = seedAdmin(registration);
|
||||
const response = await app.inject({
|
||||
headers: { ...headers, cookie: `dada_admin_session=${session.sessionToken}` },
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/diagnostics",
|
||||
});
|
||||
expect(response.statusCode).toBe(503);
|
||||
await app.close();
|
||||
});
|
||||
|
||||
it("rejects a sensitive nested service reason even when diagnostic text is clean", async () => {
|
||||
const registration = createRegistration();
|
||||
const app = await createApp({
|
||||
adminDiagnostics: async () => ({
|
||||
...diagnosticsFixture,
|
||||
services: {
|
||||
...servicesFixture,
|
||||
services: servicesFixture.services.map((service) => service.service_id === "resend" ? { ...service, pause_reason: "password" } : service),
|
||||
},
|
||||
}),
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
const session = seedAdmin(registration);
|
||||
const response = await app.inject({ headers: { ...headers, cookie: `dada_admin_session=${session.sessionToken}` }, method: "GET", url: "/api/v1/admin/diagnostics" });
|
||||
expect(response.statusCode).toBe(503);
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -1,149 +0,0 @@
|
||||
import { mkdirSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
import { expect, test } from "@playwright/test";
|
||||
import { createServer, type ViteDevServer } from "vite";
|
||||
|
||||
const releaseVersion = "asset-20260803.1";
|
||||
const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
|
||||
const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
|
||||
const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
|
||||
let vite: ViteDevServer;
|
||||
let webUrl: string;
|
||||
const requestCounts = { preview: 0, private: 0, public: 0 };
|
||||
|
||||
function writeEvidence(directory: string | undefined, name: string, value: unknown) {
|
||||
if (!directory) return;
|
||||
mkdirSync(directory, { recursive: true });
|
||||
writeFileSync(resolve(directory, name), `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
test.beforeAll(async () => {
|
||||
vite = await createServer({
|
||||
configFile: false,
|
||||
plugins: [{
|
||||
name: "wp5-04-three-resource-classes",
|
||||
configureServer(server) {
|
||||
server.middlewares.use((request, response, next) => {
|
||||
const routes = [
|
||||
{ access: "public", body: "public-content", id: publicId, prefix: "/api/v1/assets/public/" },
|
||||
{ access: "preview", body: "preview-content", id: previewId, prefix: "/api/v1/assets/preview/" },
|
||||
{ access: "private", body: "private-content", id: privateId, prefix: "/api/v1/private-assets/" },
|
||||
] as const;
|
||||
const route = routes.find((item) => request.url === `${item.prefix}${releaseVersion}/${item.id}`);
|
||||
if (!route) return next();
|
||||
requestCounts[route.access] += 1;
|
||||
response.statusCode = 200;
|
||||
response.setHeader("Cache-Control", route.access === "public" ? "public, max-age=31536000, immutable" : "private, no-store");
|
||||
response.setHeader("Content-Type", "application/octet-stream");
|
||||
response.end(route.body);
|
||||
});
|
||||
},
|
||||
}],
|
||||
publicDir: resolve("apps/web/public"),
|
||||
root: process.cwd(),
|
||||
server: { host: "127.0.0.1", port: 0 },
|
||||
});
|
||||
await vite.listen();
|
||||
const address = vite.httpServer?.address();
|
||||
if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
|
||||
webUrl = `http://127.0.0.1:${address.port}`;
|
||||
});
|
||||
|
||||
test.afterAll(async () => vite.close());
|
||||
|
||||
test("TDD-WP5-04 enumerates no preview or private client state", async ({ context, page }) => {
|
||||
requestCounts.preview = 0;
|
||||
requestCounts.private = 0;
|
||||
requestCounts.public = 0;
|
||||
await page.goto(`${webUrl}/tests/e2e/fixtures/public-asset-cache.html`);
|
||||
await expect(page.locator("#status")).toHaveText("ready");
|
||||
await page.reload();
|
||||
await expect(page.locator("#status")).toHaveText("ready");
|
||||
|
||||
const online = await page.evaluate(async ({ privateId, previewId, publicId, releaseVersion }) => {
|
||||
const cache = window.dadaCacheProbe.cache;
|
||||
await cache.clear();
|
||||
const cached = await cache.cache({
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
release_version: releaseVersion,
|
||||
resource_id: publicId,
|
||||
});
|
||||
const rejected = await Promise.all([
|
||||
cache.cache({ access_class: "internal_preview_asset", cache_kind: "thumbnail", release_version: releaseVersion, resource_id: previewId }),
|
||||
cache.cache({ access_class: "private_user_asset", cache_kind: "thumbnail", release_version: releaseVersion, resource_id: privateId }),
|
||||
]);
|
||||
const preview = await fetch(`/api/v1/assets/preview/${releaseVersion}/${previewId}`);
|
||||
const privateAsset = await fetch(`/api/v1/private-assets/${releaseVersion}/${privateId}`);
|
||||
const inspection = await cache.inspect();
|
||||
const registrations = await navigator.serviceWorker.getRegistrations();
|
||||
const databases = await indexedDB.databases();
|
||||
return {
|
||||
cached,
|
||||
inspection,
|
||||
private_bytes: (await privateAsset.arrayBuffer()).byteLength,
|
||||
private_cache_control: privateAsset.headers.get("cache-control"),
|
||||
preview_bytes: (await preview.arrayBuffer()).byteLength,
|
||||
preview_cache_control: preview.headers.get("cache-control"),
|
||||
rejected,
|
||||
service_workers: registrations.map((registration) => ({
|
||||
active: registration.active?.state,
|
||||
scope: registration.scope,
|
||||
script_url: registration.active?.scriptURL,
|
||||
})),
|
||||
indexed_db_names: databases.map((database) => database.name).filter(Boolean).sort(),
|
||||
local_storage_keys: Object.keys(localStorage),
|
||||
session_storage_keys: Object.keys(sessionStorage),
|
||||
};
|
||||
}, { privateId, previewId, publicId, releaseVersion });
|
||||
|
||||
await context.setOffline(true);
|
||||
const offline = await page.evaluate(async ({ privateId, previewId, publicId, releaseVersion }) => {
|
||||
const read = async (url: string) => {
|
||||
try {
|
||||
const response = await fetch(url);
|
||||
return { body: await response.text(), status: response.status };
|
||||
} catch {
|
||||
return { body: null, status: "network_error" };
|
||||
}
|
||||
};
|
||||
return {
|
||||
preview: await read(`/api/v1/assets/preview/${releaseVersion}/${previewId}`),
|
||||
private: await read(`/api/v1/private-assets/${releaseVersion}/${privateId}`),
|
||||
public: await read(`/api/v1/assets/public/${releaseVersion}/${publicId}`),
|
||||
};
|
||||
}, { privateId, previewId, publicId, releaseVersion });
|
||||
await context.setOffline(false);
|
||||
|
||||
expect(online.cached.status).toBe("cached");
|
||||
expect(online.rejected).toEqual([
|
||||
{ status: "rejected_not_allowlisted" },
|
||||
{ status: "rejected_not_allowlisted" },
|
||||
]);
|
||||
expect(online.preview_cache_control).toBe("private, no-store");
|
||||
expect(online.private_cache_control).toBe("private, no-store");
|
||||
expect(online.inspection.cache_keys).toHaveLength(1);
|
||||
expect(online.inspection.cache_names).toEqual(["dada-public-assets-v1"]);
|
||||
expect(online.inspection.entries).toEqual([expect.objectContaining({ resource_id: publicId })]);
|
||||
expect(JSON.stringify(online.inspection)).not.toContain(previewId);
|
||||
expect(JSON.stringify(online.inspection)).not.toContain(privateId);
|
||||
expect(online.indexed_db_names).toEqual(["dada-public-asset-cache-v1"]);
|
||||
expect(online.local_storage_keys).toEqual([]);
|
||||
expect(online.session_storage_keys).toEqual([]);
|
||||
expect(online.service_workers).toHaveLength(1);
|
||||
expect(offline.public).toEqual({ body: "public-content", status: 200 });
|
||||
expect(offline.preview.status).toBe("network_error");
|
||||
expect(offline.private.status).toBe("network_error");
|
||||
expect(requestCounts).toEqual({ preview: 1, private: 1, public: 1 });
|
||||
|
||||
const cacheEnumeration = {
|
||||
business_database_calls: 0,
|
||||
offline,
|
||||
online,
|
||||
origin_request_counts: { ...requestCounts },
|
||||
};
|
||||
writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_CACHE, "cache-enumeration.json", cacheEnumeration);
|
||||
writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_CACHE, "service-worker.json", { registrations: online.service_workers });
|
||||
writeEvidence(process.env.DADA_EVIDENCE_DIR_WP5_RES, "cache-enumeration.json", cacheEnumeration);
|
||||
});
|
||||
@@ -1,137 +0,0 @@
|
||||
import { mkdirSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
import { expect, test, type Page } from "@playwright/test";
|
||||
import { createServer, type ViteDevServer } from "vite";
|
||||
|
||||
import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
|
||||
|
||||
let vite: ViteDevServer;
|
||||
let webUrl: string;
|
||||
|
||||
const adminSession = {
|
||||
acknowledged_private_content_notice_version: null,
|
||||
admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000601" },
|
||||
audience: "admin",
|
||||
authenticated: true,
|
||||
csrf_token: "csrf-admin-shell-fixture-000000000000000000000000000000000",
|
||||
current_private_content_notice_version: null,
|
||||
expires_at: "2026-09-02T09:30:00.000Z",
|
||||
notice_acknowledged: false,
|
||||
};
|
||||
|
||||
const navigation = [
|
||||
["总览", "/admin"],
|
||||
["用户与点数", "/admin/users"],
|
||||
["邀请码", "/admin/invites"],
|
||||
["模型", "/admin/models"],
|
||||
["素材", "/admin/assets"],
|
||||
["内部预览", "/admin/preview"],
|
||||
["生成记录", "/admin/generations"],
|
||||
["服务与存储", "/admin/services-storage"],
|
||||
["审计", "/admin/audit"],
|
||||
] as const;
|
||||
|
||||
test.beforeAll(async () => {
|
||||
vite = await createServer({
|
||||
configFile: resolve("apps/web/vite.config.ts"),
|
||||
root: resolve("apps/web"),
|
||||
server: { host: "127.0.0.1", port: 0 },
|
||||
});
|
||||
await vite.listen();
|
||||
const address = vite.httpServer?.address();
|
||||
if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
|
||||
webUrl = `http://127.0.0.1:${address.port}`;
|
||||
});
|
||||
|
||||
test.afterAll(async () => vite.close());
|
||||
|
||||
async function routeActiveAdmin(page: Page) {
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
|
||||
body: JSON.stringify(adminSession),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
}));
|
||||
await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
|
||||
body: JSON.stringify(adminOverviewFixture),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
}));
|
||||
}
|
||||
|
||||
test("TDD-WP6-ADM-001-role-and-summary renders the protected nine-entry admin shell", async ({ page }) => {
|
||||
const requests: string[] = [];
|
||||
page.on("request", (request) => requests.push(request.url()));
|
||||
await routeActiveAdmin(page);
|
||||
await page.goto(`${webUrl}/admin`);
|
||||
|
||||
await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
|
||||
const sidebar = page.getByRole("navigation", { name: "后台主导航" });
|
||||
await expect(sidebar).toBeVisible();
|
||||
for (const [name, href] of navigation) {
|
||||
await expect(sidebar.getByRole("link", { name, exact: true })).toHaveAttribute("href", href);
|
||||
}
|
||||
expect(Math.round((await sidebar.boundingBox())?.width ?? 0)).toBe(216);
|
||||
await expect(page.getByText("4 / 10", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("待人工核对 1", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("85.0%", { exact: true })).toBeVisible();
|
||||
await expect(page.getByRole("link", { name: "有异常", exact: true })).toBeVisible();
|
||||
await expect(page.locator("body")).not.toContainText(/forbidden|example\.invalid|api[_ -]?key|完整提示词/i);
|
||||
expect(requests.some((url) => /prompt|private-content|image-content/i.test(url))).toBe(false);
|
||||
|
||||
const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
|
||||
if (evidenceRoot) {
|
||||
const screenshotDirectory = resolve(evidenceRoot, "screenshots");
|
||||
mkdirSync(screenshotDirectory, { recursive: true });
|
||||
await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-overview.png") });
|
||||
}
|
||||
});
|
||||
|
||||
test("TDD-WP6-ADM-001-role-and-summary keeps ordinary and preview sessions outside admin", async ({ page }) => {
|
||||
let overviewCalls = 0;
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
|
||||
body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID", subject: "preview_user" } }),
|
||||
contentType: "application/json",
|
||||
status: 401,
|
||||
}));
|
||||
await page.route("**/api/v1/admin/overview", (route) => {
|
||||
overviewCalls += 1;
|
||||
return route.fulfill({ body: "null", contentType: "application/json", status: 401 });
|
||||
});
|
||||
|
||||
await page.goto(`${webUrl}/admin`);
|
||||
await expect(page).toHaveURL(`${webUrl}/admin/login`);
|
||||
await expect(page.getByRole("heading", { name: "管理员邮箱验证码登录" })).toBeVisible();
|
||||
expect(overviewCalls).toBe(0);
|
||||
await expect(page.getByText("DADA ADMIN", { exact: true })).toHaveCount(0);
|
||||
const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
|
||||
if (evidenceRoot) {
|
||||
const screenshotDirectory = resolve(evidenceRoot, "screenshots");
|
||||
mkdirSync(screenshotDirectory, { recursive: true });
|
||||
await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-denied.png") });
|
||||
}
|
||||
});
|
||||
|
||||
test("TDD-WP6-ADM-001-role-and-summary ejects a disabled admin when the session is rechecked", async ({ page }) => {
|
||||
let active = true;
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill(active ? {
|
||||
body: JSON.stringify(adminSession),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
} : {
|
||||
body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID" } }),
|
||||
contentType: "application/json",
|
||||
status: 401,
|
||||
}));
|
||||
await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
|
||||
body: JSON.stringify(adminOverviewFixture),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
}));
|
||||
await page.goto(`${webUrl}/admin`);
|
||||
await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
|
||||
|
||||
active = false;
|
||||
await page.evaluate(() => window.dispatchEvent(new Event("dada:session-invalid")));
|
||||
await expect(page).toHaveURL(`${webUrl}/admin/login`);
|
||||
});
|
||||
@@ -1,95 +0,0 @@
|
||||
import { expect, test } from "@playwright/test";
|
||||
import { createServer, type ViteDevServer } from "vite";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
import { adminDiagnosticsFixture, adminServicesStorageFixture } from "../fixtures/wp6-05-state.js";
|
||||
|
||||
let vite: ViteDevServer;
|
||||
let webUrl: string;
|
||||
|
||||
const adminSession = {
|
||||
admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000605" },
|
||||
audience: "admin",
|
||||
authenticated: true,
|
||||
expires_at: "2026-09-02T09:30:00.000Z",
|
||||
};
|
||||
|
||||
test.beforeAll(async () => {
|
||||
vite = await createServer({ configFile: resolve("apps/web/vite.config.ts"), root: resolve("apps/web"), server: { host: "127.0.0.1", port: 0 } });
|
||||
await vite.listen();
|
||||
const address = vite.httpServer?.address();
|
||||
if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
|
||||
webUrl = `http://127.0.0.1:${address.port}`;
|
||||
});
|
||||
|
||||
test.afterAll(async () => vite.close());
|
||||
|
||||
test("TDD-WP6-DIAG-001-redacted-diagnostics renders state and diagnostics without sensitive fields", async ({ page }) => {
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify(adminSession), contentType: "application/json", status: 200 }));
|
||||
await page.route("**/api/v1/admin/services-storage", (route) => route.fulfill({ body: JSON.stringify(adminServicesStorageFixture), contentType: "application/json", status: 200 }));
|
||||
await page.route("**/api/v1/admin/diagnostics", (route) => route.fulfill({ body: JSON.stringify(adminDiagnosticsFixture), contentType: "application/json", status: 200 }));
|
||||
await page.goto(`${webUrl}/admin/services-storage`);
|
||||
|
||||
await expect(page.getByRole("heading", { level: 2, name: "服务与存储" })).toBeVisible();
|
||||
await expect(page.getByText("Resend", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("额度暂停", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("4.25 GB", { exact: true })).toBeVisible();
|
||||
await expect(page.getByRole("button", { name: "复制诊断" })).toBeEnabled();
|
||||
await expect(page.locator("body")).not.toContainText(/secret|password|example\.invalid|C:\\Users/i);
|
||||
});
|
||||
|
||||
test("TDD-WP6-STATE-001-three-model-states refetches REST truth after a runtime event", async ({ page }) => {
|
||||
await page.addInitScript(() => {
|
||||
class FakeEventSource {
|
||||
static instance: FakeEventSource | undefined;
|
||||
onmessage: ((event: MessageEvent) => void) | null = null;
|
||||
constructor() { FakeEventSource.instance = this; }
|
||||
close() { if (FakeEventSource.instance === this) FakeEventSource.instance = undefined; }
|
||||
}
|
||||
Object.defineProperty(window, "EventSource", { configurable: true, value: FakeEventSource });
|
||||
(window as unknown as { emitDadaEvent: () => void }).emitDadaEvent = () => FakeEventSource.instance?.onmessage?.({ data: "{}" } as MessageEvent);
|
||||
});
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({ body: JSON.stringify({ ...adminSession, csrf_token: "csrf-admin-model-fixture-000000000000000000000000000000000" }), contentType: "application/json", status: 200 }));
|
||||
let runtimeAvailable = false;
|
||||
let modelCalls = 0;
|
||||
const configuration = () => {
|
||||
const ids = ["gemini-3.1-flash-image-preview", "gemini-3-pro-image-preview", "gpt-image-2"];
|
||||
return {
|
||||
config_set_version: 1,
|
||||
configured_default_model_id: ids[0],
|
||||
recommended_model_id: runtimeAvailable ? ids[1] : null,
|
||||
models: ids.map((modelId, index) => ({
|
||||
config_version: 1,
|
||||
contract_evidence_ref: null,
|
||||
contract_validation_status: "verified",
|
||||
credit_cost: 1,
|
||||
display_name: ["Gemini 3.1 Flash Image Preview", "Gemini 3 Pro Image Preview", "GPT Image 2"][index],
|
||||
enabled: true,
|
||||
error_mapping_profile: { timeout: "upstream_timeout" },
|
||||
gateway_account_ref: "mock-gateway",
|
||||
is_default: index === 0,
|
||||
model_id: modelId,
|
||||
prompt_max_length: 1_000,
|
||||
recommendation_priority: index + 1,
|
||||
reference_limits: { max_file_bytes: 1_024, max_files: 2, max_total_bytes: 2_048 },
|
||||
route_profile: { endpoint: "https://mock.invalid/v1/images" },
|
||||
runtime_availability: { available_for_new_jobs: runtimeAvailable, checked_at: "2026-08-02T15:00:00.000Z", reason: runtimeAvailable ? "available" : "gateway_balance_insufficient" },
|
||||
safety_source: "provider",
|
||||
supported_ratios: ["3:4", "1:1", "4:3", "9:16"],
|
||||
})),
|
||||
};
|
||||
};
|
||||
await page.route("**/api/v1/models", (route) => {
|
||||
modelCalls += 1;
|
||||
return route.fulfill({ body: JSON.stringify(configuration()), contentType: "application/json", status: 200 });
|
||||
});
|
||||
|
||||
await page.goto(`${webUrl}/admin/models`);
|
||||
await expect(page.getByText("当前推荐").locator("..").getByText("无", { exact: true })).toBeVisible();
|
||||
expect(modelCalls).toBeGreaterThanOrEqual(1);
|
||||
runtimeAvailable = true;
|
||||
await page.evaluate(() => (window as unknown as { emitDadaEvent: () => void }).emitDadaEvent());
|
||||
await expect(page.getByText("当前推荐").locator("..").getByText("gemini-3-pro-image-preview", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("配置默认").locator("..").getByText("gemini-3.1-flash-image-preview", { exact: true })).toBeVisible();
|
||||
expect(modelCalls).toBeGreaterThanOrEqual(2);
|
||||
});
|
||||
-44
@@ -1,44 +0,0 @@
|
||||
export const adminOverviewFixture = {
|
||||
generated_at: "2026-08-03T09:30:00.000Z",
|
||||
user_slots: {
|
||||
active_and_suspended: 4,
|
||||
limit: 10,
|
||||
},
|
||||
generation_jobs: {
|
||||
pending_manual_review: 1,
|
||||
pending_manual_review_oldest_at: "2026-08-03T09:12:00.000Z",
|
||||
queued: 2,
|
||||
running: 1,
|
||||
},
|
||||
models: {
|
||||
configured_default_model_id: "gemini-3.1-flash-image-preview",
|
||||
configured_model_count: 3,
|
||||
recommended_model_id: "gemini-3-pro-image-preview",
|
||||
runtime_available_count: 2,
|
||||
},
|
||||
storage: {
|
||||
last_measured_at: "2026-08-03T09:29:00.000Z",
|
||||
limit_bytes: 5_368_709_120,
|
||||
managed_content_bytes: 4_563_402_752,
|
||||
status: "critical" as const,
|
||||
},
|
||||
services: [
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "resend", status: "available" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "amap", status: "available" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "ai_gateway", status: "degraded" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "worker", status: "available" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "asset_root", status: "degraded" as const },
|
||||
],
|
||||
recent_operations: [
|
||||
{
|
||||
created_at: "2026-08-03T09:20:00.000Z",
|
||||
operation_id: "00000000-0000-4000-8000-000000000621",
|
||||
operation_type: "model_configuration_update",
|
||||
result: "succeeded" as const,
|
||||
target_ref: "model-config-set:7",
|
||||
},
|
||||
],
|
||||
asset_cleanup: {
|
||||
pending_jobs: 0,
|
||||
},
|
||||
};
|
||||
Vendored
-34
@@ -1,34 +0,0 @@
|
||||
export const adminServicesStorageFixture = {
|
||||
generated_at: "2026-08-04T09:30:00.000Z",
|
||||
services: [
|
||||
{ checked_at: "2026-08-04T09:30:00.000Z", configured: true, impact_scope: "authentication" as const, pause_reason: null, service_id: "resend" as const, status: "active" as const },
|
||||
{ checked_at: "2026-08-04T09:30:00.000Z", configured: true, impact_scope: "location" as const, pause_reason: "quota_exhausted", service_id: "amap" as const, status: "paused_quota" as const },
|
||||
{ checked_at: "2026-08-04T09:30:00.000Z", configured: true, impact_scope: "generation" as const, pause_reason: "balance_insufficient", service_id: "ai_gateway" as const, status: "degraded" as const },
|
||||
{ checked_at: "2026-08-04T09:30:00.000Z", configured: true, impact_scope: "generation" as const, pause_reason: "worker_stopped", service_id: "worker" as const, status: "degraded" as const },
|
||||
{ checked_at: "2026-08-04T09:30:00.000Z", configured: true, impact_scope: "api" as const, pause_reason: null, service_id: "api" as const, status: "active" as const },
|
||||
{ checked_at: "2026-08-04T09:30:00.000Z", configured: true, impact_scope: "storage" as const, pause_reason: null, service_id: "asset_root" as const, status: "active" as const },
|
||||
],
|
||||
storage: {
|
||||
capacity_notice_level: "warning" as const,
|
||||
cleanup_pending_count: 2,
|
||||
data_root_ref: "configured_local_data_root" as const,
|
||||
hard_limit_bytes: 5_368_709_120,
|
||||
last_measured_at: "2026-08-04T09:30:00.000Z",
|
||||
managed_content_bytes: 4_563_402_752,
|
||||
remeasurement_required: false,
|
||||
status: "active" as const,
|
||||
storage_backend: "local_filesystem" as const,
|
||||
},
|
||||
};
|
||||
|
||||
export const adminDiagnosticsFixture = {
|
||||
generated_at: "2026-08-04T09:30:00.000Z",
|
||||
diagnostic_text: "Dada P0-A diagnostics\napp_version=0.0.0\napi_status=ready\nworker_status=ready\nstorage_status=active",
|
||||
services: adminServicesStorageFixture,
|
||||
system: {
|
||||
api_status: "ready" as const,
|
||||
app_version: "0.0.0",
|
||||
browser_support: [{ brand: "Google Chrome" as const, major: 128 }],
|
||||
worker_status: "ready" as const,
|
||||
},
|
||||
};
|
||||
@@ -19,7 +19,7 @@ describe("TASK-WP0-01 minimum toolchain", () => {
|
||||
expect(probe.fabricVersion).toBe("7.4.0");
|
||||
});
|
||||
|
||||
it("loads and closes Fastify with the frozen Swagger plugin", async () => {
|
||||
it("loads and closes Fastify with the frozen Swagger plugin", { timeout: 15_000 }, async () => {
|
||||
const app = await createApp();
|
||||
await app.ready();
|
||||
expect(app.hasPlugin("@fastify/swagger")).toBe(true);
|
||||
|
||||
@@ -1,101 +0,0 @@
|
||||
import { createHash } from "node:crypto";
|
||||
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
import { createAssetReleaseManifest } from "../../packages/asset-release-manifest/src/index.js";
|
||||
|
||||
const releaseVersion = "asset-20260803.1";
|
||||
const publicId = "7f0c9530-a7d9-4bf1-8c65-0e9298dd04ac";
|
||||
const previewId = "ab18fd72-60e1-44e3-a9a0-3dfccb12e17c";
|
||||
const privateId = "e3792605-5252-4d3b-a101-827408ab3515";
|
||||
|
||||
function fixture() {
|
||||
return createAssetReleaseManifest({
|
||||
items: [
|
||||
{
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
content: Buffer.from("public-content"),
|
||||
mime_type: "image/png",
|
||||
relative_path: "public/thumbnails/FLOWER001.png",
|
||||
resource_id: publicId,
|
||||
root_ref: "canonical-assets",
|
||||
},
|
||||
{
|
||||
access_class: "internal_preview_asset",
|
||||
content: Buffer.from("preview-content"),
|
||||
mime_type: "image/webp",
|
||||
relative_path: "preview/batch-7/FLOWER009.webp",
|
||||
resource_id: previewId,
|
||||
root_ref: "canonical-assets",
|
||||
},
|
||||
{
|
||||
access_class: "private_user_asset",
|
||||
content: Buffer.from("private-content"),
|
||||
mime_type: "image/png",
|
||||
owner_id: "owner-1",
|
||||
relative_path: "private/owner-1/generated.png",
|
||||
resource_id: privateId,
|
||||
root_ref: "managed-assets",
|
||||
},
|
||||
],
|
||||
release_version: releaseVersion,
|
||||
});
|
||||
}
|
||||
|
||||
describe("TASK-WP5-04 immutable asset release manifest", () => {
|
||||
it("projects only the selected access class and never exposes source paths", () => {
|
||||
const manifest = fixture();
|
||||
const projected = manifest.project("public_release_asset", releaseVersion);
|
||||
|
||||
expect(Object.isFrozen(projected)).toBe(true);
|
||||
expect(projected?.manifest_sha256).toMatch(/^[0-9a-f]{64}$/);
|
||||
expect(projected?.items).toEqual([expect.objectContaining({
|
||||
access_class: "public_release_asset",
|
||||
resource_id: publicId,
|
||||
sha256: createHash("sha256").update("public-content").digest("hex"),
|
||||
url: `/api/v1/assets/public/${releaseVersion}/${publicId}`,
|
||||
})]);
|
||||
const serialized = JSON.stringify(projected);
|
||||
expect(serialized).not.toContain(previewId);
|
||||
expect(serialized).not.toContain(privateId);
|
||||
expect(serialized).not.toContain("relative_path");
|
||||
expect(serialized).not.toContain("root_ref");
|
||||
expect(serialized).not.toMatch(/[A-Z]:\\\\/i);
|
||||
});
|
||||
|
||||
it("keeps resource identifiers opaque, verifies file hashes, and rejects unsafe manifests", () => {
|
||||
const manifest = fixture();
|
||||
expect(manifest.read("public_release_asset", releaseVersion, publicId)?.bytes).toEqual(Buffer.from("public-content"));
|
||||
expect(manifest.read("public_release_asset", releaseVersion, previewId)).toBeUndefined();
|
||||
expect(manifest.project("private_user_asset", releaseVersion, { ownerId: "owner-1" })?.items)
|
||||
.toEqual([expect.objectContaining({ resource_id: privateId })]);
|
||||
expect(manifest.project("private_user_asset", releaseVersion, { ownerId: "owner-2" })?.items).toEqual([]);
|
||||
|
||||
expect(() => createAssetReleaseManifest({
|
||||
items: [{
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
content: Buffer.from("tampered"),
|
||||
mime_type: "image/png",
|
||||
relative_path: "public/tampered.png",
|
||||
resource_id: publicId,
|
||||
root_ref: "canonical-assets",
|
||||
sha256: "0".repeat(64),
|
||||
}],
|
||||
release_version: releaseVersion,
|
||||
})).toThrow(/sha-?256/i);
|
||||
expect(() => createAssetReleaseManifest({
|
||||
items: [{
|
||||
access_class: "public_release_asset",
|
||||
cache_kind: "thumbnail",
|
||||
content: Buffer.from("unsafe"),
|
||||
mime_type: "image/png",
|
||||
relative_path: "/outside/private.png",
|
||||
resource_id: publicId,
|
||||
root_ref: "canonical-assets",
|
||||
}],
|
||||
release_version: releaseVersion,
|
||||
})).toThrow(/relative path/i);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user