97 lines
3.1 KiB
Markdown
97 lines
3.1 KiB
Markdown
|
# 审计记录 — 推送页重构 B0–B6
|
|||
|
|
|
|||
|
|
## 审计信息
|
|||
|
|
|
|||
|
|
- **日期**: 2026-06-02
|
|||
|
|
- **审计人**: Cursor Agent
|
|||
|
|
- **触发原因**: 推送页重构 + M2 独立 WS + M9 清理 + 全量预览
|
|||
|
|
|
|||
|
|
## 审计范围（实际改动文件清单）
|
|||
|
|
|
|||
|
|
| 文件 | 状态 |
|
|||
|
|
|------|------|
|
|||
|
|
| server/api/websocket.py | ☑ 已审 |
|
|||
|
|
| server/api/sync_v2.py | ☑ 已审 |
|
|||
|
|
| server/api/schemas.py | ☑ 已审 |
|
|||
|
|
| server/application/services/sync_engine_v2.py | ☑ 已审 |
|
|||
|
|
| server/background/retry_runner.py | ☑ 已审 |
|
|||
|
|
| server/background/upload_staging_cleanup.py | ☑ 已审 |
|
|||
|
|
| server/infrastructure/database/sync_log_repo.py | ☑ 已审 |
|
|||
|
|
| server/infrastructure/database/server_repo.py | ☑ 已审 |
|
|||
|
|
| server/domain/models/__init__.py | ☑ 已审 |
|
|||
|
|
| server/main.py | ☑ 已审 |
|
|||
|
|
| frontend/src/pages/PushPage.vue | ☑ 已审 |
|
|||
|
|
| frontend/src/composables/push/* | ☑ 已审 |
|
|||
|
|
| frontend/src/components/push/* | ☑ 已审 |
|
|||
|
|
| frontend/src/composables/useWebSocket.ts | ☑ 已审 |
|
|||
|
|
| frontend/src/types/api.ts | ☑ 已审 |
|
|||
|
|
| tests/test_sync_websocket.py | ☑ 已审 |
|
|||
|
|
| tests/test_upload_staging_cleanup.py | ☑ 已审 |
|
|||
|
|
|
|||
|
|
## Step 3: 规则扫描H
|
|||
|
|
|
|||
|
|
- H1 鉴权：/ws/sync、/sync/* API 均 JWT；WS token 校验同 alerts
|
|||
|
|
- H2 注入：source_path `ensure_under_nexus_upload`；target_path SSH 经现有引擎
|
|||
|
|
- H3 凭据：无新增明文返回
|
|||
|
|
- H4 并发：preview 并发 4；sync gather 已有
|
|||
|
|
- H5 错误：无静默吞掉 AttributeError（sync_log update 已修）
|
|||
|
|
- H6 资源：WS disconnect + timer clear；staging cleanup realpath 校验
|
|||
|
|
- H7 跨层：API→Service→Repo 未破坏
|
|||
|
|
- H8 审计：CUD 路径未减
|
|||
|
|
|
|||
|
|
## Step 4: Closure 表
|
|||
|
|
|
|||
|
|
| H | 判定 | 依据 |
|
|||
|
|
|---|------|------|
|
|||
|
|
| H1 | PASS | websocket sync_ws 复用 _verify_ws_token；sync_v2 Depends get_current_admin |
|
|||
|
|
| H2 | PASS | upload_staging_cleanup realpath + prefix；sync 路径既有校验 |
|
|||
|
|
| H3 | PASS | 无 password 字段新增 |
|
|||
|
|
| H4 | PASS | preview 限流 PREVIEW_CONCURRENCY=4 |
|
|||
|
|
| H5 | PASS | retry_runner 成功判定修正；update() 存在 |
|
|||
|
|
| H6 | PASS | onUnmounted dispose；24h mtime 清理 |
|
|||
|
|
| H7 | PASS | 未在 API 写 SQL |
|
|||
|
|
| H8 | PASS | 推送/取消仍记审计（既有） |
|
|||
|
|
|
|||
|
|
## Step 5: 入口表
|
|||
|
|
|
|||
|
|
| 入口 | 鉴权 |
|
|||
|
|
|------|------|
|
|||
|
|
| POST /api/sync/files | JWT |
|
|||
|
|
| POST /api/sync/preview | JWT |
|
|||
|
|
| POST /api/sync/cancel | JWT |
|
|||
|
|
| POST /api/sync/reconcile-stale-logs | JWT |
|
|||
|
|
| POST /api/sync/diagnose | JWT |
|
|||
|
|
| WS /ws/sync | JWT query |
|
|||
|
|
| upload_staging_cleanup_loop | 内部任务 |
|
|||
|
|
|
|||
|
|
## Step 6: 输入→Sink
|
|||
|
|
|
|||
|
|
- ZIP/路径 → ensure_under_nexus_upload → rsync/SSH（既有池）
|
|||
|
|
- WS batch_id → 前端过滤，不执行命令
|
|||
|
|
|
|||
|
|
## Step 7: 归类
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
websocket.py 8H 0FINDING
|
|||
|
|
sync_engine_v2.py 8H 0FINDING
|
|||
|
|
upload_staging_cleanup.py 6H 0FINDING
|
|||
|
|
PushPage + composables 6H 0FINDING
|
|||
|
|
──────────────────────────────────
|
|||
|
|
总计 0FINDING
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## Step 8: DoD
|
|||
|
|
|
|||
|
|
- ☑ 设计/计划/changelog 齐全
|
|||
|
|
- ☑ pytest 新增用例通过（sync_ws、cleanup）
|
|||
|
|
- ☑ frontend build-only 通过
|
|||
|
|
- ☑ 0 FINDING
|
|||
|
|
|
|||
|
|
## FINDING 列表
|
|||
|
|
|
|||
|
|
无
|
|||
|
|
|
|||
|
|
## 结论
|
|||
|
|
|
|||
|
|
☑ 审计通过，0 FINDING，可部署
|