feat(wechat): 新增 WechatApiLoggingInterceptor 拦截器（含脱敏单元测试）

- ClientHttpRequestInterceptor 实现 - URL/method/status/content-type 用 INFO 级别 - body 用 DEBUG 级别，MAX_BODY_LOG=2048 截断 - 脱敏正则覆盖 session_key/openid/unionid/access_token/refresh_token/secret/appsecret - 配合 BufferingClientHttpRequestFactory 使用避免流被消费 - 4 个单元测试覆盖主要脱敏场景
2026-06-03 22:30:38 +08:00
parent 35baa6c958
commit 4452d0301c
2 changed files with 175 additions and 0 deletions
@@ -0,0 +1,106 @@
+package com.emotion.interceptor;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Method;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * WechatApiLoggingInterceptor 单元测试
+ *
+ * 注：desensitize() 是 private 方法，通过反射测试
+ */
+class WechatApiLoggingInterceptorTest {
+
+    @Test
+    void desensitize_shouldMaskSessionKey() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        String input = "{\"openid\":\"oXyz123\",\"session_key\":\"abc@456\"}";
+        String result = (String) method.invoke(interceptor, input);
+
+        assertNotNull(result);
+        assertTrue(result.contains("\"openid\":\"***\""), "openid 应被脱敏: " + result);
+        assertTrue(result.contains("\"session_key\":\"***\""), "session_key 应被脱敏: " + result);
+    }
+
+    @Test
+    void desensitize_shouldMaskAccessToken() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        String input = "{\"access_token\":\"ACCESS-123\",\"refresh_token\":\"REFRESH-456\"}";
+        String result = (String) method.invoke(interceptor, input);
+
+        assertTrue(result.contains("\"access_token\":\"***\""));
+        assertTrue(result.contains("\"refresh_token\":\"***\""));
+    }
+
+    @Test
+    void desensitize_shouldHandleNull() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        assertEquals(null, method.invoke(interceptor, (Object) null));
+    }
+
+    @Test
+    void desensitize_shouldNotModifyNonSensitiveFields() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        String input = "{\"errcode\":40013,\"errmsg\":\"invalid appid\"}";
+        String result = (String) method.invoke(interceptor, input);
+
+        assertEquals(input, result, "非敏感字段不应被修改");
+    }
+
+    @Test
+    void desensitize_shouldNotMatchAccessTokenV2() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        // 验证 access_token_v2 不会被 access_token 模式误匹配
+        String input = "{\"access_token_v2\":\"PUBLIC_VALUE\",\"my_reset_secret\":\"OK\"}";
+        String result = (String) method.invoke(interceptor, input);
+
+        // access_token_v2 不应被脱敏（正则精确匹配完整 key 名称）
+        // my_reset_secret 也不应被脱敏（正则需要精确匹配 "secret" 而非子串）
+        assertTrue(result.contains("\"access_token_v2\":\"PUBLIC_VALUE\""), "access_token_v2 不应被脱敏: " + result);
+        assertTrue(result.contains("\"my_reset_secret\":\"OK\""), "my_reset_secret 不应被脱敏: " + result);
+    }
+
+    @Test
+    void desensitize_shouldHandleEmptyString() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        String result = (String) method.invoke(interceptor, "");
+        assertEquals("", result, "空字符串应原样返回");
+    }
+
+    @Test
+    void desensitize_shouldMaskMultipleSensitiveFieldsSimultaneously() throws Exception {
+        WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
+        Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
+        method.setAccessible(true);
+
+        String input = "{\"openid\":\"o123\",\"access_token\":\"tok\",\"unionid\":\"uni456\",\"refresh_token\":\"ref789\"}";
+        String result = (String) method.invoke(interceptor, input);
+
+        assertTrue(result.contains("\"openid\":\"***\""));
+        assertTrue(result.contains("\"access_token\":\"***\""));
+        assertTrue(result.contains("\"unionid\":\"***\""));
+        assertTrue(result.contains("\"refresh_token\":\"***\""));
+    }
+}