nixevol/NixMsg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 后台加人审计按实际插入数避免全跳过记成 ok

Browse Source
This commit is contained in:
Nixevol
2026-09-30 17:31:40 +08:00
parent 0c9b459fb1
commit 8b7b78093b
6 changed files with 143 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/admin/groups.go
+33 -5
View File
@@ -316,6 +316,13 @@ func (h *Handler) handleGroupAddMembers(w http.ResponseWriter, r *http.Request)
return
}
before, err := h.groupMemberCount(r.Context(), id)
if err != nil {
h.auditP(p, "group_add_members", id, "error", ip)
httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
return
}
res, err := h.groups.AdminAddMembers(r.Context(), id, req.MemberIDs)
if err != nil {
h.writeGroupErr(w, p, "group_add_members", id, ip, err)
@@ -325,15 +332,29 @@ func (h *Handler) handleGroupAddMembers(w http.ResponseWriter, r *http.Request)
if failed == nil {
failed = []group.MemberFail{}
}
okN := len(req.MemberIDs) - len(failed)
if okN < 0 {
okN = 0
after, err := h.groupMemberCount(r.Context(), id)
if err != nil {
h.auditP(p, "group_add_members", id, "error", ip)
httpx.WriteError(w, http.StatusInternalServerError, "internal", "内部错误")
return
}
h.auditPD(p, "group_add_members", id, batchAuditResult(okN, len(failed)), ip, map[string]any{
added := after - before
if added < 0 {
added = 0
}
// 已是成员/请求内重复编号会静默跳过，不算失败；审计用实际插入数，避免全跳过写成 ok。
result := batchAuditResult(added, len(failed))
if added == 0 && len(failed) == 0 {
result = "noop"
}
h.auditPD(p, "group_add_members", id, result, ip, map[string]any{
"members": req.MemberIDs,
"failed": failed,
"added": added,
})
httpx.WriteOK(w, map[string]any{"failed": failed})
httpx.WriteOK(w, map[string]any{"failed": failed, "added": added})
}
func (h *Handler) handleGroupRemoveMember(w http.ResponseWriter, r *http.Request) {
@@ -413,6 +434,13 @@ func (h *Handler) groupOwner(ctx context.Context, groupID string) (string, error
return owner, err
}
func (h *Handler) groupMemberCount(ctx context.Context, groupID string) (int, error) {
var n int
err := h.db.Read.QueryRowContext(ctx,
`SELECT COUNT(*) FROM group_members WHERE group_id = ?`, groupID).Scan(&n)
return n, err
}
func (h *Handler) groupSummary(ctx context.Context, groupID string) (map[string]any, error) {
var name, owner string
var created int64
internal/admin/h02_test.go
+87 -3
View File
@@ -262,6 +262,7 @@ func TestH02BatchPartialImportAndGroups(t *testing.T) {
insertEndpoint(t, db, "keep-1", "admin", true, false)
insertEndpoint(t, db, "alice", "admin", true, false)
insertEndpoint(t, db, "bob", "admin", true, false)
insertEndpoint(t, db, "carol", "admin", true, false)
res := doReq(t, client, http.MethodPost, srv.URL+"/api/admin/endpoints/batch",
`{"ids":["keep-1","missing-ep"],"action":"disable"}`,
@@ -304,11 +305,24 @@ func TestH02BatchPartialImportAndGroups(t *testing.T) {
}
res = doReq(t, client, http.MethodPost, srv.URL+"/api/admin/groups/"+created.ID+"/members",
`{"member_ids":["keep-1","ghost-ep"]}`, csrf())
`{"member_ids":["carol","ghost-ep"]}`, csrf())
env = decodeEnv(t, res)
if res.StatusCode != http.StatusOK || !env.OK {
t.Fatalf("add members: %d %+v", res.StatusCode, env)
}
var addBody struct {
Failed []any `json:"failed"`
Added int `json:"added"`
}
if err := json.Unmarshal(env.Data, &addBody); err != nil {
t.Fatal(err)
}
if addBody.Added != 1 {
t.Fatalf("add response added=%d want 1", addBody.Added)
}
if len(addBody.Failed) != 1 {
t.Fatalf("add response failed=%v want 1", addBody.Failed)
}
res = doReq(t, client, http.MethodPost, srv.URL+"/api/admin/groups/"+created.ID+"/transfer",
`{"endpoint_id":"bob"}`, csrf())
@@ -346,8 +360,8 @@ func TestH02BatchPartialImportAndGroups(t *testing.T) {
if ad == nil {
t.Fatalf("add members missing detail: %v", add)
}
if add["result"] != "partial" && add["result"] != "failed" && add["result"] != "ok" {
t.Fatalf("add members result=%v", add["result"])
if add["result"] != "partial" {
t.Fatalf("add members result=%v want partial", add["result"])
}
if _, ok := ad["members"]; !ok {
t.Fatalf("add members missing members: %v", ad)
@@ -355,6 +369,9 @@ func TestH02BatchPartialImportAndGroups(t *testing.T) {
if _, ok := ad["failed"]; !ok {
t.Fatalf("add members missing failed: %v", ad)
}
if ad["added"] != float64(1) {
t.Fatalf("add members added=%v want 1", ad["added"])
}
tr := lastAuditByAction(t, recs, "group_transfer")
td, _ := tr["detail"].(map[string]any)
@@ -364,3 +381,70 @@ func TestH02BatchPartialImportAndGroups(t *testing.T) {
assertNoSecrets(t, auditBuf.String(), "csv-pass-secret-1", "csv-pass-secret-2", testPassword)
}
func TestH02AddMembersAllSkippedAuditNotOK(t *testing.T) {
_, auditBuf, db, srv, client := setupH02(t)
login(t, client, srv.URL)
insertEndpoint(t, db, "alice", "admin", true, false)
insertEndpoint(t, db, "bob", "admin", true, false)
res := doReq(t, client, http.MethodPost, srv.URL+"/api/admin/groups",
`{"name":"一组","owner_id":"alice","member_ids":["bob"]}`, csrf())
env := decodeEnv(t, res)
if res.StatusCode != http.StatusOK || !env.OK {
t.Fatalf("group create: %d %+v", res.StatusCode, env)
}
var created struct {
ID string `json:"id"`
}
if err := json.Unmarshal(env.Data, &created); err != nil {
t.Fatal(err)
}
auditBuf.Reset()
var before int
if err := db.Read.QueryRow(`SELECT COUNT(*) FROM group_members WHERE group_id = ?`, created.ID).Scan(&before); err != nil {
t.Fatal(err)
}
res = doReq(t, client, http.MethodPost, srv.URL+"/api/admin/groups/"+created.ID+"/members",
`{"member_ids":["bob","bob","alice"]}`, csrf())
env = decodeEnv(t, res)
if res.StatusCode != http.StatusOK || !env.OK {
t.Fatalf("add members: %d %+v", res.StatusCode, env)
}
var body struct {
Failed []any `json:"failed"`
Added int `json:"added"`
}
if err := json.Unmarshal(env.Data, &body); err != nil {
t.Fatal(err)
}
if len(body.Failed) != 0 {
t.Fatalf("failed=%v want empty (already members are not errors)", body.Failed)
}
if body.Added != 0 {
t.Fatalf("added=%d want 0", body.Added)
}
var after int
if err := db.Read.QueryRow(`SELECT COUNT(*) FROM group_members WHERE group_id = ?`, created.ID).Scan(&after); err != nil {
t.Fatal(err)
}
if after != before {
t.Fatalf("member rows before=%d after=%d want unchanged", before, after)
}
recs := parseSlogJSON(t, auditBuf)
add := lastAuditByAction(t, recs, "group_add_members")
if add["result"] == "ok" {
t.Fatalf("audit result must not be ok when all skipped: %v", add)
}
ad, _ := add["detail"].(map[string]any)
if ad == nil {
t.Fatalf("missing detail: %v", add)
}
if ad["added"] != float64(0) {
t.Fatalf("detail.added=%v want 0", ad["added"])
}
}