- Flyway V2：platform.product_events（客户端 UUIDv7 主键即幂等键，user_id 不设外键，client_ts 合理性约束，三索引），DDL 照报告 13 §2.2 - POST /api/v1/events（报告 13 §1 OpenAPI）：批量 1-50 条、202 逐条结果（accepted/duplicate/rejected）、eventId ON CONFLICT 去重、字典 v1 白名单（11 个 auth_* + 工单增补 page_viewed/health_record_action）、字典外 props 剥离计数、隐私红线字段整条拒绝（forbidden_field）、认证请求 userId 与 token subject 不一致拒绝（identity_mismatch） - BearerAuthFilter 对 /api/v1/events 改为可选鉴权（规范：唯一允许匿名的写端点；带 token 仍严格验签 401/40101） - 日志红线：props 内容不落日志（仅计数与字段名告警） - 门禁：./mvnw clean test → BUILD SUCCESS，82 测试 0 失败（新增 AnalyticsIntegrationTest 7 例：V2 生效/匿名落库/未知事件拒绝/去重/剥离/红线拒绝/参数 40000） Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
+228
@@ -0,0 +1,228 @@
|
||||
package com.patbond.patbond.user.analytics;
|
||||
|
||||
import com.patbond.patbond.user.TestcontainersConfiguration;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
|
||||
import org.springframework.boot.test.context.SpringBootTest;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.jdbc.core.simple.JdbcClient;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
|
||||
import java.time.OffsetDateTime;
|
||||
import java.util.Map;
|
||||
import java.util.UUID;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
/**
|
||||
* Analytics ingestion end-to-end: Flyway V2 DDL, anonymous/authenticated
|
||||
* uploads, event dictionary validation, props sanitization, deduplication,
|
||||
* privacy red-line checks (report 13).
|
||||
*/
|
||||
@SpringBootTest
|
||||
@AutoConfigureMockMvc
|
||||
@Import(TestcontainersConfiguration.class)
|
||||
class AnalyticsIntegrationTest {
|
||||
|
||||
@Autowired
|
||||
private MockMvc mockMvc;
|
||||
|
||||
@Autowired
|
||||
private JdbcClient jdbcClient;
|
||||
|
||||
@Test
|
||||
void v2MigrationCreatesProductEventsTable() {
|
||||
int count = jdbcClient.sql(
|
||||
"SELECT COUNT(*) FROM information_schema.tables " +
|
||||
"WHERE table_schema='platform' AND table_name='product_events'")
|
||||
.query(Integer.class)
|
||||
.single();
|
||||
assertThat(count).isEqualTo(1);
|
||||
}
|
||||
|
||||
@Test
|
||||
void acceptsAnonymousEventBatch() throws Exception {
|
||||
String eventId = UUID.randomUUID().toString();
|
||||
String body = """
|
||||
{
|
||||
"events": [{
|
||||
"eventId": "%s",
|
||||
"eventName": "auth_register_started",
|
||||
"eventVersion": 1,
|
||||
"anonymousId": "019212aa-0000-7000-8000-000000000001",
|
||||
"sessionId": "019212aa-1111-7000-8000-000000000001",
|
||||
"clientTs": "%s",
|
||||
"appVersion": "1.0.0+1",
|
||||
"platform": "android",
|
||||
"osVersion": "android-14",
|
||||
"props": {"entryPoint": "splash"}
|
||||
}]
|
||||
}
|
||||
""".formatted(eventId, OffsetDateTime.now());
|
||||
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content(body))
|
||||
.andExpect(status().isAccepted())
|
||||
.andExpect(jsonPath("$.code").value(0))
|
||||
.andExpect(jsonPath("$.data.accepted").value(1))
|
||||
.andExpect(jsonPath("$.data.results[0].status").value("accepted"));
|
||||
|
||||
String storedName = jdbcClient.sql(
|
||||
"SELECT event_name FROM platform.product_events WHERE event_id = :id")
|
||||
.param("id", UUID.fromString(eventId))
|
||||
.query(String.class)
|
||||
.single();
|
||||
assertThat(storedName).isEqualTo("auth_register_started");
|
||||
}
|
||||
|
||||
@Test
|
||||
void rejectsBatchWithUnknownEventName() throws Exception {
|
||||
String body = """
|
||||
{
|
||||
"events": [{
|
||||
"eventId": "019212aa-2222-7000-8000-000000000001",
|
||||
"eventName": "unknown_event",
|
||||
"eventVersion": 1,
|
||||
"anonymousId": "019212aa-0000-7000-8000-000000000001",
|
||||
"sessionId": "019212aa-1111-7000-8000-000000000001",
|
||||
"clientTs": "%s",
|
||||
"appVersion": "1.0.0",
|
||||
"platform": "ios",
|
||||
"osVersion": "ios-17"
|
||||
}]
|
||||
}
|
||||
""".formatted(OffsetDateTime.now());
|
||||
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content(body))
|
||||
.andExpect(status().isAccepted())
|
||||
.andExpect(jsonPath("$.data.rejected").value(1))
|
||||
.andExpect(jsonPath("$.data.results[0].status").value("rejected"))
|
||||
.andExpect(jsonPath("$.data.results[0].reason").value("unknown_event_name"));
|
||||
}
|
||||
|
||||
@Test
|
||||
void deduplicationReturnsDuplicate() throws Exception {
|
||||
String eventId = UUID.randomUUID().toString();
|
||||
String body = """
|
||||
{
|
||||
"events": [{
|
||||
"eventId": "%s",
|
||||
"eventName": "auth_login_succeeded",
|
||||
"eventVersion": 1,
|
||||
"anonymousId": "019212aa-0000-7000-8000-000000000001",
|
||||
"sessionId": "019212aa-1111-7000-8000-000000000001",
|
||||
"clientTs": "%s",
|
||||
"appVersion": "1.0.0",
|
||||
"platform": "android",
|
||||
"osVersion": "android-14",
|
||||
"props": {"identifierType": "username", "durationMs": 123}
|
||||
}]
|
||||
}
|
||||
""".formatted(eventId, OffsetDateTime.now());
|
||||
|
||||
// First upload: accepted
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content(body))
|
||||
.andExpect(status().isAccepted())
|
||||
.andExpect(jsonPath("$.data.accepted").value(1));
|
||||
|
||||
// Second upload (same eventId): duplicate
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content(body))
|
||||
.andExpect(status().isAccepted())
|
||||
.andExpect(jsonPath("$.data.duplicated").value(1))
|
||||
.andExpect(jsonPath("$.data.results[0].status").value("duplicate"));
|
||||
}
|
||||
|
||||
@Test
|
||||
void stripsPropsOutsideWhitelist() throws Exception {
|
||||
String eventId = UUID.randomUUID().toString();
|
||||
String body = """
|
||||
{
|
||||
"events": [{
|
||||
"eventId": "%s",
|
||||
"eventName": "auth_login_succeeded",
|
||||
"eventVersion": 1,
|
||||
"anonymousId": "019212aa-0000-7000-8000-000000000001",
|
||||
"sessionId": "019212aa-1111-7000-8000-000000000001",
|
||||
"clientTs": "%s",
|
||||
"appVersion": "1.0.0",
|
||||
"platform": "android",
|
||||
"osVersion": "android-14",
|
||||
"props": {
|
||||
"identifierType": "username",
|
||||
"durationMs": 123,
|
||||
"forbiddenExtraField": "should_be_stripped"
|
||||
}
|
||||
}]
|
||||
}
|
||||
""".formatted(eventId, OffsetDateTime.now());
|
||||
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content(body))
|
||||
.andExpect(status().isAccepted())
|
||||
.andExpect(jsonPath("$.data.accepted").value(1));
|
||||
|
||||
Map<String, Object> storedProps = jdbcClient.sql(
|
||||
"SELECT props::text FROM platform.product_events WHERE event_id = :id")
|
||||
.param("id", UUID.fromString(eventId))
|
||||
.query((rs, rowNum) -> {
|
||||
try {
|
||||
return new com.fasterxml.jackson.databind.ObjectMapper()
|
||||
.readValue(rs.getString(1), Map.class);
|
||||
} catch (Exception e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
})
|
||||
.single();
|
||||
assertThat(storedProps).containsKeys("identifierType", "durationMs");
|
||||
assertThat(storedProps).doesNotContainKey("forbiddenExtraField");
|
||||
}
|
||||
|
||||
@Test
|
||||
void rejectsEventWithForbiddenFieldPattern() throws Exception {
|
||||
String body = """
|
||||
{
|
||||
"events": [{
|
||||
"eventId": "019212aa-3333-7000-8000-000000000001",
|
||||
"eventName": "auth_login_succeeded",
|
||||
"eventVersion": 1,
|
||||
"anonymousId": "019212aa-0000-7000-8000-000000000001",
|
||||
"sessionId": "019212aa-1111-7000-8000-000000000001",
|
||||
"clientTs": "%s",
|
||||
"appVersion": "1.0.0",
|
||||
"platform": "android",
|
||||
"osVersion": "android-14",
|
||||
"props": {"userPassword": "leak"}
|
||||
}]
|
||||
}
|
||||
""".formatted(OffsetDateTime.now());
|
||||
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content(body))
|
||||
.andExpect(status().isAccepted())
|
||||
.andExpect(jsonPath("$.data.rejected").value(1))
|
||||
.andExpect(jsonPath("$.data.results[0].reason").value("forbidden_field"));
|
||||
}
|
||||
|
||||
@Test
|
||||
void validationRejects400OnEmptyBatch() throws Exception {
|
||||
mockMvc.perform(post("/api/v1/events")
|
||||
.contentType(MediaType.APPLICATION_JSON)
|
||||
.content("{\"events\":[]}"))
|
||||
.andExpect(status().isBadRequest())
|
||||
.andExpect(jsonPath("$.code").value(40000));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user