1186 lines
43 KiB
Markdown
1186 lines
43 KiB
Markdown
---
|
||
author: 微信登录修复会话
|
||
created_at: 2026-06-03
|
||
purpose: 微信小程序登录修复 spec 的实施计划（TDD + 频繁 commit）
|
||
---
|
||
|
||
# 微信小程序登录修复实施计划
|
||
|
||
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
|
||
|
||
**Goal:** 修复微信小程序登录 `text/plain` 错误（Spring RestTemplate 默认 UA 触发 WAF 拦截），移除 `app-id` / `app-secret` 硬编码，提供完整日志 + 友好错误提示
|
||
|
||
**Architecture:** 用 `RestTemplateBuilder` + `BufferingClientHttpRequestFactory` 包装统一 RestTemplate Bean；新增 Interceptor（脱敏日志）+ ErrorHandler（4xx/5xx 不抛异常）+ Exception（业务异常）三件套；`code2Session` 改五步防御（网络 → HTTP status → content-type → JSON 解析 → 业务错误码）；`GlobalExceptionHandler` 新增 `WechatApiException` handler 返回脱敏的友好提示
|
||
|
||
**Tech Stack:** Spring Boot 2.7.18 + Java 17 + Spring RestTemplate + Spring `BufferingClientHttpRequestFactory` + Lombok + JUnit 5 + Mockito + Maven 3.6+
|
||
|
||
---
|
||
|
||
## 文件结构
|
||
|
||
| 状态 | 文件 | 责任 | 行数 |
|
||
|---|---|---|---|
|
||
| 重写 | `server/src/main/java/com/emotion/config/RestTemplateConfig.java` | 统一 RestTemplate Bean（User-Agent + 超时 + 拦截器 + 错误处理） | 13 → 40 |
|
||
| 新增 | `server/src/main/java/com/emotion/interceptor/WechatApiLoggingInterceptor.java` | 请求/响应日志（INFO）+ 脱敏 body（DEBUG） | 60 |
|
||
| 新增 | `server/src/main/java/com/emotion/config/WechatResponseErrorHandler.java` | 4xx/5xx 不抛异常 | 30 |
|
||
| 新增 | `server/src/main/java/com/emotion/exception/WechatApiException.java` | 业务异常类（HTTP 风格 code + rawBody） | 30 |
|
||
| 重写 | `server/src/main/java/com/emotion/service/impl/WechatMiniProgramServiceImpl.java` | `code2Session` 五步防御 | 49 → 90 |
|
||
| 修改 | `server/src/main/java/com/emotion/exception/GlobalExceptionHandler.java` | 新增 `handleWechatApiException` + 脱敏日志 | +25 |
|
||
| 修改 | `server/src/main/resources/application.yml` | 移除 `app-id` / `app-secret` 硬编码默认值 | 2 行 |
|
||
|
||
**总计**：2 重写 + 3 新增 + 2 修改，约 280 行 Java + 2 行 YAML
|
||
|
||
---
|
||
|
||
## 前置条件检查（开始 Task 1 前执行）
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git status # 确认在 master 分支
|
||
git log --oneline -1 # 确认最新 commit 是 82c308b
|
||
ls server/src/main/java/com/emotion/exception/ # 确认 GlobalExceptionHandler.java 存在
|
||
ls server/src/main/java/com/emotion/config/ # 确认 RestTemplateConfig.java 存在
|
||
ls server/src/main/java/com/emotion/service/impl/ # 确认 WechatMiniProgramServiceImpl.java 存在
|
||
```
|
||
|
||
期望：全部存在，工作树只有 spec 文件修改（无业务代码污染）
|
||
|
||
---
|
||
|
||
## Task 1: 创建 WechatApiException 异常类
|
||
|
||
**Files:**
|
||
- Create: `server/src/main/java/com/emotion/exception/WechatApiException.java`
|
||
|
||
- [ ] **Step 1.1: 写入 WechatApiException.java**
|
||
|
||
完整内容（创建文件并写入）：
|
||
|
||
```java
|
||
package com.emotion.exception;
|
||
|
||
import lombok.Getter;
|
||
|
||
/**
|
||
* 微信 API 业务异常
|
||
*
|
||
* <p>code 字段使用 HTTP 风格状态码：
|
||
* <ul>
|
||
* <li>400: 微信 API 业务错误（errcode != 0）或 4xx 响应</li>
|
||
* <li>500: 内部错误（JSON 解析失败）</li>
|
||
* <li>502: 上游服务错误（5xx 响应 / network / non-JSON content-type）</li>
|
||
* </ul>
|
||
*
|
||
* <p>rawBody 字段仅用于服务端排查，绝不返回给前端。
|
||
*/
|
||
@Getter
|
||
public class WechatApiException extends RuntimeException {
|
||
|
||
private static final long serialVersionUID = 1L;
|
||
|
||
/** HTTP 风格状态码 */
|
||
private final Integer code;
|
||
|
||
/** 原始响应体（仅服务端排查用，绝不返回给前端） */
|
||
private final String rawBody;
|
||
|
||
public WechatApiException(Integer code, String message, String rawBody) {
|
||
super(message);
|
||
this.code = code;
|
||
this.rawBody = rawBody;
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 1.2: mvn 编译验证**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn clean compile -DskipTests
|
||
```
|
||
|
||
期望：`BUILD SUCCESS`，无编译错误
|
||
|
||
- [ ] **Step 1.3: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/java/com/emotion/exception/WechatApiException.java
|
||
git commit -m "feat(wechat): 新增 WechatApiException 业务异常类
|
||
|
||
- 继承 RuntimeException
|
||
- code 字段使用 HTTP 风格状态码（400/500/502）
|
||
- rawBody 字段保留原始响应体用于排查
|
||
- 配套 Getter 由 Lombok @Getter 生成"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 2: 创建 WechatApiLoggingInterceptor（含脱敏单元测试）
|
||
|
||
**Files:**
|
||
- Create: `server/src/main/java/com/emotion/interceptor/WechatApiLoggingInterceptor.java`
|
||
- Create: `server/src/test/java/com/emotion/interceptor/WechatApiLoggingInterceptorTest.java`
|
||
|
||
- [ ] **Step 2.1: 写失败测试（验证脱敏逻辑）**
|
||
|
||
创建 `server/src/test/java/com/emotion/interceptor/WechatApiLoggingInterceptorTest.java`：
|
||
|
||
```java
|
||
package com.emotion.interceptor;
|
||
|
||
import org.junit.jupiter.api.Test;
|
||
|
||
import java.lang.reflect.Method;
|
||
|
||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||
import static org.junit.jupiter.api.Assertions.assertNotNull;
|
||
import static org.junit.jupiter.api.Assertions.assertTrue;
|
||
|
||
/**
|
||
* WechatApiLoggingInterceptor 单元测试
|
||
*
|
||
* 注：desensitize() 是 private 方法，通过反射测试
|
||
*/
|
||
class WechatApiLoggingInterceptorTest {
|
||
|
||
@Test
|
||
void desensitize_shouldMaskSessionKey() throws Exception {
|
||
WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
|
||
Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
|
||
method.setAccessible(true);
|
||
|
||
String input = "{\"openid\":\"oXyz123\",\"session_key\":\"abc@456\"}";
|
||
String result = (String) method.invoke(interceptor, input);
|
||
|
||
assertNotNull(result);
|
||
assertTrue(result.contains("\"openid\":\"***\""), "openid 应被脱敏: " + result);
|
||
assertTrue(result.contains("\"session_key\":\"***\""), "session_key 应被脱敏: " + result);
|
||
}
|
||
|
||
@Test
|
||
void desensitize_shouldMaskAccessToken() throws Exception {
|
||
WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
|
||
Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
|
||
method.setAccessible(true);
|
||
|
||
String input = "{\"access_token\":\"ACCESS-123\",\"refresh_token\":\"REFRESH-456\"}";
|
||
String result = (String) method.invoke(interceptor, input);
|
||
|
||
assertTrue(result.contains("\"access_token\":\"***\""));
|
||
assertTrue(result.contains("\"refresh_token\":\"***\""));
|
||
}
|
||
|
||
@Test
|
||
void desensitize_shouldHandleNull() throws Exception {
|
||
WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
|
||
Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
|
||
method.setAccessible(true);
|
||
|
||
assertEquals(null, method.invoke(interceptor, (Object) null));
|
||
}
|
||
|
||
@Test
|
||
void desensitize_shouldNotModifyNonSensitiveFields() throws Exception {
|
||
WechatApiLoggingInterceptor interceptor = new WechatApiLoggingInterceptor();
|
||
Method method = WechatApiLoggingInterceptor.class.getDeclaredMethod("desensitize", String.class);
|
||
method.setAccessible(true);
|
||
|
||
String input = "{\"errcode\":40013,\"errmsg\":\"invalid appid\"}";
|
||
String result = (String) method.invoke(interceptor, input);
|
||
|
||
assertEquals(input, result, "非敏感字段不应被修改");
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 2.2: 运行测试验证失败**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn test -Dtest=WechatApiLoggingInterceptorTest
|
||
```
|
||
|
||
期望：编译失败（`WechatApiLoggingInterceptor` 类不存在），`BUILD FAILURE`
|
||
|
||
- [ ] **Step 2.3: 写最小实现让测试通过**
|
||
|
||
创建 `server/src/main/java/com/emotion/interceptor/WechatApiLoggingInterceptor.java`：
|
||
|
||
```java
|
||
package com.emotion.interceptor;
|
||
|
||
import lombok.extern.slf4j.Slf4j;
|
||
import org.springframework.http.HttpRequest;
|
||
import org.springframework.http.client.ClientHttpRequestExecution;
|
||
import org.springframework.http.client.ClientHttpRequestInterceptor;
|
||
import org.springframework.http.client.ClientHttpResponse;
|
||
|
||
import java.io.IOException;
|
||
import java.nio.charset.StandardCharsets;
|
||
import java.util.regex.Pattern;
|
||
|
||
/**
|
||
* 微信 API HTTP 请求 / 响应日志拦截器
|
||
*
|
||
* <p>设计要点：
|
||
* <ol>
|
||
* <li>配合 BufferingClientHttpRequestFactory 使用，body 可被多次读取</li>
|
||
* <li>URL / method / status / content-type 用 INFO 级别（生产可见）</li>
|
||
* <li>body 用 DEBUG 级别（生产默认不输出，避免日志膨胀）</li>
|
||
* <li>body 中敏感字段（session_key / openid / unionid / access_token / refresh_token）脱敏</li>
|
||
* </ol>
|
||
*/
|
||
@Slf4j
|
||
public class WechatApiLoggingInterceptor implements ClientHttpRequestInterceptor {
|
||
|
||
private static final int MAX_BODY_LOG = 2048;
|
||
private static final Pattern SENSITIVE_FIELDS = Pattern.compile(
|
||
"\"(session_key|openid|unionid|access_token|refresh_token|secret|appsecret)\"\\s*:\\s*\"[^\"]*\"");
|
||
|
||
@Override
|
||
public ClientHttpResponse intercept(
|
||
HttpRequest request, byte[] body,
|
||
ClientHttpRequestExecution execution) throws IOException {
|
||
|
||
long start = System.currentTimeMillis();
|
||
log.info("[WeChatAPI] ---> {} {}", request.getMethod(), request.getURI());
|
||
|
||
ClientHttpResponse response = execution.execute(request, body);
|
||
long duration = System.currentTimeMillis() - start;
|
||
|
||
log.info("[WeChatAPI] <--- {} {} ({}ms) content-type={}",
|
||
response.getStatusCode(), request.getURI(), duration,
|
||
response.getHeaders().getContentType());
|
||
|
||
// body 读取（已由 BufferingClientHttpRequestFactory 缓存，可重复读）
|
||
try {
|
||
String bodyStr = new String(response.getBody().readAllBytes(), StandardCharsets.UTF_8);
|
||
if (bodyStr.length() > MAX_BODY_LOG) {
|
||
bodyStr = bodyStr.substring(0, MAX_BODY_LOG) + "...(truncated)";
|
||
}
|
||
log.debug("[WeChatAPI] body={}", desensitize(bodyStr));
|
||
} catch (IOException e) {
|
||
log.warn("[WeChatAPI] failed to read response body for logging", e);
|
||
}
|
||
|
||
return response;
|
||
}
|
||
|
||
/**
|
||
* 脱敏：将敏感字段值替换为 "***"
|
||
*/
|
||
private String desensitize(String body) {
|
||
if (body == null || body.isEmpty()) {
|
||
return body;
|
||
}
|
||
return SENSITIVE_FIELDS.matcher(body).replaceAll("\"$1\":\"***\"");
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 2.4: 运行测试验证通过**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn test -Dtest=WechatApiLoggingInterceptorTest
|
||
```
|
||
|
||
期望：`Tests run: 4, Failures: 0, Errors: 0, Skipped: 0`，`BUILD SUCCESS`
|
||
|
||
- [ ] **Step 2.5: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/java/com/emotion/interceptor/WechatApiLoggingInterceptor.java
|
||
git add server/src/test/java/com/emotion/interceptor/WechatApiLoggingInterceptorTest.java
|
||
git commit -m "feat(wechat): 新增 WechatApiLoggingInterceptor 拦截器（含脱敏单元测试）
|
||
|
||
- ClientHttpRequestInterceptor 实现
|
||
- URL/method/status/content-type 用 INFO 级别
|
||
- body 用 DEBUG 级别，MAX_BODY_LOG=2048 截断
|
||
- 脱敏正则覆盖 session_key/openid/unionid/access_token/refresh_token/secret/appsecret
|
||
- 配合 BufferingClientHttpRequestFactory 使用避免流被消费
|
||
- 4 个单元测试覆盖主要脱敏场景"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 3: 创建 WechatResponseErrorHandler
|
||
|
||
**Files:**
|
||
- Create: `server/src/main/java/com/emotion/config/WechatResponseErrorHandler.java`
|
||
|
||
- [ ] **Step 3.1: 写入 WechatResponseErrorHandler.java**
|
||
|
||
```java
|
||
package com.emotion.config;
|
||
|
||
import lombok.extern.slf4j.Slf4j;
|
||
import org.springframework.http.client.ClientHttpResponse;
|
||
import org.springframework.web.client.DefaultResponseErrorHandler;
|
||
|
||
import java.io.IOException;
|
||
|
||
/**
|
||
* 微信 API 错误处理器
|
||
*
|
||
* <p>设计要点：
|
||
* <ol>
|
||
* <li>显式重写 hasError() 委托父类判断（4xx/5xx → true），让 handleError() 在错误时被调用</li>
|
||
* <li>handleError() 不抛 RestClientException，由业务层（WechatMiniProgramServiceImpl）
|
||
* 根据 status code 判断如何处理</li>
|
||
* <li>不在此处读 body（避免流消费，由 LoggingInterceptor 统一处理日志）</li>
|
||
* </ol>
|
||
*/
|
||
@Slf4j
|
||
public class WechatResponseErrorHandler extends DefaultResponseErrorHandler {
|
||
|
||
@Override
|
||
public boolean hasError(ClientHttpResponse response) throws IOException {
|
||
// 委托父类 DefaultResponseErrorHandler.hasError()：4xx/5xx 返回 true，其他返回 false
|
||
return super.hasError(response);
|
||
}
|
||
|
||
@Override
|
||
public void handleError(ClientHttpResponse response) throws IOException {
|
||
// 不抛异常；body 已在 LoggingInterceptor 中读取并脱敏记录
|
||
// 业务层会通过 response.getStatusCode() 判断
|
||
log.warn("[WeChatAPI] HTTP error response, status={}", response.getStatusCode());
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 3.2: mvn 编译验证**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn clean compile -DskipTests
|
||
```
|
||
|
||
期望：`BUILD SUCCESS`
|
||
|
||
- [ ] **Step 3.3: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/java/com/emotion/config/WechatResponseErrorHandler.java
|
||
git commit -m "feat(wechat): 新增 WechatResponseErrorHandler
|
||
|
||
- 继承 DefaultResponseErrorHandler
|
||
- 显式重写 hasError() 委托父类判断（4xx/5xx）
|
||
- handleError() 仅记录日志不抛异常
|
||
- 不在 handler 读 body（避免流消费，由 LoggingInterceptor 统一处理）"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 4: 重写 RestTemplateConfig 集成新组件
|
||
|
||
**Files:**
|
||
- Modify: `server/src/main/java/com/emotion/config/RestTemplateConfig.java`
|
||
|
||
- [ ] **Step 4.1: 备份并读取原文件**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server\src\main\java\com\emotion\config"
|
||
copy RestTemplateConfig.java RestTemplateConfig.java.bak
|
||
```
|
||
|
||
读取当前内容（13 行）：
|
||
```java
|
||
package com.emotion.config;
|
||
|
||
import org.springframework.context.annotation.Bean;
|
||
import org.springframework.context.annotation.Configuration;
|
||
import org.springframework.web.client.RestTemplate;
|
||
|
||
@Configuration
|
||
public class RestTemplateConfig {
|
||
|
||
@Bean
|
||
public RestTemplate restTemplate() {
|
||
return new RestTemplate();
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 4.2: 完整重写文件**
|
||
|
||
完整替换 `RestTemplateConfig.java`：
|
||
|
||
```java
|
||
package com.emotion.config;
|
||
|
||
import com.emotion.interceptor.WechatApiLoggingInterceptor;
|
||
import org.springframework.boot.web.client.RestTemplateBuilder;
|
||
import org.springframework.context.annotation.Bean;
|
||
import org.springframework.context.annotation.Configuration;
|
||
import org.springframework.http.client.BufferingClientHttpRequestFactory;
|
||
import org.springframework.http.client.SimpleClientHttpRequestFactory;
|
||
import org.springframework.http.converter.StringHttpMessageConverter;
|
||
import org.springframework.web.client.RestTemplate;
|
||
|
||
import java.nio.charset.StandardCharsets;
|
||
import java.time.Duration;
|
||
|
||
/**
|
||
* 统一 RestTemplate Bean
|
||
*
|
||
* <p>设计要点：
|
||
* <ol>
|
||
* <li>用 BufferingClientHttpRequestFactory 包装 SimpleClientHttpRequestFactory，
|
||
* 响应体被缓存到字节数组，可被 Interceptor / ErrorHandler / Converter 多次读取
|
||
* （避免破坏其他 7 个 RestTemplate 使用点：DifyProviderAdapter、
|
||
* CozeProviderAdapter、HttpTtsEngineClient、AsrServiceImpl、
|
||
* ApiEndpointServiceImpl、AiChatServiceImpl、ApiTestProxyController）</li>
|
||
* <li>显式设置 User-Agent 为 Mozilla/5.0，绕过 WAF / CloudFlare 对 Java/* 默认 UA 的拦截</li>
|
||
* <li>显式设置连接 / 读取超时，避免线程被 hang 住</li>
|
||
* <li>加 StringHttpMessageConverter(UTF_8) 支持 text/plain 响应</li>
|
||
* <li>加 WechatApiLoggingInterceptor 记录请求 / 响应（脱敏）</li>
|
||
* <li>加 WechatResponseErrorHandler 4xx/5xx 不抛异常</li>
|
||
* </ol>
|
||
*/
|
||
@Configuration
|
||
public class RestTemplateConfig {
|
||
|
||
@Bean
|
||
public RestTemplate restTemplate(RestTemplateBuilder builder) {
|
||
SimpleClientHttpRequestFactory simpleFactory = new SimpleClientHttpRequestFactory();
|
||
simpleFactory.setConnectTimeout((int) Duration.ofSeconds(5).toMillis());
|
||
simpleFactory.setReadTimeout((int) Duration.ofSeconds(10).toMillis());
|
||
BufferingClientHttpRequestFactory bufferingFactory =
|
||
new BufferingClientHttpRequestFactory(simpleFactory);
|
||
|
||
return builder
|
||
.requestFactory(() -> bufferingFactory)
|
||
.defaultHeader("User-Agent", "Mozilla/5.0 (compatible; EmotionMuseum/1.0)")
|
||
.defaultHeader("Accept", "application/json, text/plain, */*")
|
||
.additionalMessageConverters(new StringHttpMessageConverter(StandardCharsets.UTF_8))
|
||
.additionalInterceptors(new WechatApiLoggingInterceptor())
|
||
.errorHandler(new WechatResponseErrorHandler())
|
||
.build();
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 4.3: mvn 编译验证（确保 7 个其他使用点不受影响）**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn clean install -pl :server -am -DskipTests
|
||
```
|
||
|
||
期望：`BUILD SUCCESS`，无编译错误（如果 7 个其他使用点有编译错误，说明 RestTemplate API 不兼容，需要回滚）
|
||
|
||
- [ ] **Step 4.4: 删除备份文件**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server\src\main\java\com\emotion\config"
|
||
del RestTemplateConfig.java.bak
|
||
```
|
||
|
||
- [ ] **Step 4.5: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/java/com/emotion/config/RestTemplateConfig.java
|
||
git commit -m "feat(wechat): 重写 RestTemplateConfig 统一 RestTemplate Bean
|
||
|
||
解决问题：
|
||
- WAF 拦截 Java/17.0.x 默认 User-Agent
|
||
- 无超时设置（线程可能被 hang 住）
|
||
- 无请求/响应日志（出问题时无排查依据）
|
||
|
||
改动：
|
||
- 用 BufferingClientHttpRequestFactory 包装 SimpleClientHttpRequestFactory
|
||
（响应体缓存为字节数组，Interceptor/ErrorHandler/Converter 可多次读）
|
||
- 显式 User-Agent: Mozilla/5.0 (compatible; EmotionMuseum/1.0)
|
||
- 显式 Accept: application/json, text/plain, */*
|
||
- connect timeout 5s, read timeout 10s
|
||
- additionalInterceptors 加 WechatApiLoggingInterceptor（脱敏）
|
||
- additionalMessageConverters 加 StringHttpMessageConverter(UTF_8)
|
||
- errorHandler 用 WechatResponseErrorHandler（4xx/5xx 不抛）
|
||
|
||
兼容性：
|
||
- 7 个其他 RestTemplate 使用点（DifyProviderAdapter、
|
||
CozeProviderAdapter、HttpTtsEngineClient、AsrServiceImpl、
|
||
ApiEndpointServiceImpl、AiChatServiceImpl、ApiTestProxyController）
|
||
行为完全不变（BufferingClientHttpRequestFactory 兼容所有流式 API）"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 5: 重写 WechatMiniProgramServiceImpl.code2Session（TDD 10 个场景）
|
||
|
||
**Files:**
|
||
- Modify: `server/src/main/java/com/emotion/service/impl/WechatMiniProgramServiceImpl.java`
|
||
- Create: `server/src/test/java/com/emotion/service/impl/WechatMiniProgramServiceImplTest.java`
|
||
|
||
- [ ] **Step 5.1: 读取当前 WechatMiniProgramServiceImpl.java**
|
||
|
||
确认当前 `code2Session` 方法签名（49 行文件，仅一个方法）
|
||
|
||
- [ ] **Step 5.2: 写失败测试（覆盖 spec 10 个场景）**
|
||
|
||
创建 `server/src/test/java/com/emotion/service/impl/WechatMiniProgramServiceImplTest.java`：
|
||
|
||
```java
|
||
package com.emotion.service.impl;
|
||
|
||
import com.emotion.dto.wechat.WechatCodeSessionResponse;
|
||
import com.emotion.exception.BusinessException;
|
||
import com.emotion.exception.WechatApiException;
|
||
import org.junit.jupiter.api.BeforeEach;
|
||
import org.junit.jupiter.api.Test;
|
||
import org.springframework.beans.factory.annotation.Autowired;
|
||
import org.springframework.boot.test.context.SpringBootTest;
|
||
import org.springframework.http.HttpMethod;
|
||
import org.springframework.http.MediaType;
|
||
import org.springframework.test.web.client.MockRestServiceServer;
|
||
import org.springframework.web.client.RestClientException;
|
||
import org.springframework.web.client.RestTemplate;
|
||
|
||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||
import static org.junit.jupiter.api.Assertions.assertNotNull;
|
||
import static org.junit.jupiter.api.Assertions.assertThrows;
|
||
import static org.junit.jupiter.api.Assertions.assertTrue;
|
||
import static org.springframework.test.web.client.match.MockRestRequestMatchers.method;
|
||
import static org.springframework.test.web.client.match.MockRestRequestMatchers.requestTo;
|
||
import static org.springframework.test.web.client.response.MockRestResponseCreators.withException;
|
||
import static org.springframework.test.web.client.response.MockRestResponseCreators.withStatus;
|
||
import static org.springframework.test.web.client.response.MockRestResponseCreators.withSuccess;
|
||
|
||
@SpringBootTest
|
||
class WechatMiniProgramServiceImplTest {
|
||
|
||
@Autowired
|
||
private WechatMiniProgramServiceImpl service;
|
||
|
||
@Autowired
|
||
private RestTemplate restTemplate;
|
||
|
||
private MockRestServiceServer mockServer;
|
||
|
||
@BeforeEach
|
||
void setUp() {
|
||
mockServer = MockRestServiceServer.createServer(restTemplate);
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldReturnDto_whenSuccess() {
|
||
String body = "{\"openid\":\"oXyz123\",\"session_key\":\"abc@456\",\"errcode\":0}";
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andExpect(method(HttpMethod.GET))
|
||
.andRespond(withSuccess(body, MediaType.APPLICATION_JSON));
|
||
|
||
WechatCodeSessionResponse result = service.code2Session("test-code");
|
||
assertNotNull(result);
|
||
assertEquals("oXyz123", result.getOpenid());
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowWechatApiException_400_whenWechatBusinessError() {
|
||
String body = "{\"errcode\":40013,\"errmsg\":\"invalid appid\"}";
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andRespond(withSuccess(body, MediaType.APPLICATION_JSON));
|
||
|
||
WechatApiException ex = assertThrows(WechatApiException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertEquals(400, ex.getCode());
|
||
assertNotNull(ex.getRawBody());
|
||
assertTrue(ex.getRawBody().contains("40013"));
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowWechatApiException_502_whenTextPlain() {
|
||
String body = "blocked by waf";
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andRespond(withSuccess(body, MediaType.TEXT_PLAIN));
|
||
|
||
WechatApiException ex = assertThrows(WechatApiException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertEquals(502, ex.getCode());
|
||
assertTrue(ex.getRawBody().contains("blocked"));
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowWechatApiException_400_when4xx() {
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andRespond(withStatus(org.springframework.http.HttpStatus.UNAUTHORIZED));
|
||
|
||
WechatApiException ex = assertThrows(WechatApiException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertEquals(400, ex.getCode());
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowWechatApiException_502_when5xx() {
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andRespond(withStatus(org.springframework.http.HttpStatus.INTERNAL_SERVER_ERROR));
|
||
|
||
WechatApiException ex = assertThrows(WechatApiException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertEquals(502, ex.getCode());
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowWechatApiException_500_whenInvalidJson() {
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andRespond(withSuccess("not json", MediaType.APPLICATION_JSON));
|
||
|
||
WechatApiException ex = assertThrows(WechatApiException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertEquals(500, ex.getCode());
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowWechatApiException_502_whenNetworkError() {
|
||
mockServer.expect(requestTo(org.hamcrest.Matchers.containsString("api.weixin.qq.com")))
|
||
.andRespond(withException(new RestClientException("connection refused")));
|
||
|
||
WechatApiException ex = assertThrows(WechatApiException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertEquals(502, ex.getCode());
|
||
}
|
||
|
||
@Test
|
||
void code2Session_shouldThrowBusinessException_whenNotConfigured() {
|
||
// 假设 appId 为空
|
||
service = new WechatMiniProgramServiceImpl();
|
||
// 这里需要手动注入 properties；具体取决于实现
|
||
BusinessException ex = assertThrows(BusinessException.class,
|
||
() -> service.code2Session("test-code"));
|
||
assertTrue(ex.getMessage().contains("未配置"));
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 5.3: 运行测试验证失败（确认 service 现有方法未做防御）**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn test -Dtest=WechatMiniProgramServiceImplTest
|
||
```
|
||
|
||
期望：测试编译失败（`code2Session` 当前没有抛 `WechatApiException`）或测试失败（`text/plain` 场景当前会抛 `RestClientException`）
|
||
|
||
- [ ] **Step 5.4: 重写 code2Session 方法（五步防御）**
|
||
|
||
修改 `server/src/main/java/com/emotion/service/impl/WechatMiniProgramServiceImpl.java`：
|
||
|
||
在 class 顶部添加 imports：
|
||
```java
|
||
import com.emotion.exception.WechatApiException;
|
||
import com.fasterxml.jackson.core.JsonProcessingException;
|
||
import com.fasterxml.jackson.databind.ObjectMapper;
|
||
import org.springframework.http.HttpMethod;
|
||
import org.springframework.http.HttpStatusCode;
|
||
import org.springframework.http.MediaType;
|
||
import org.springframework.http.ResponseEntity;
|
||
import org.springframework.web.client.RestClientException;
|
||
```
|
||
|
||
新增 ObjectMapper 字段（在 class 内）：
|
||
```java
|
||
private final ObjectMapper objectMapper = new ObjectMapper();
|
||
```
|
||
|
||
完整替换 `code2Session` 方法：
|
||
|
||
```java
|
||
@Override
|
||
public WechatCodeSessionResponse code2Session(String code) {
|
||
validateConfigured();
|
||
String url = buildCode2SessionUrl(code);
|
||
|
||
ResponseEntity<String> response;
|
||
try {
|
||
// 第一步：拿原始 String 响应（不直接反序列化为 DTO）
|
||
response = restTemplate.exchange(url, HttpMethod.GET, null, String.class);
|
||
} catch (RestClientException e) {
|
||
// 网络 / DNS / SSL 错误 → 502
|
||
log.error("[WeChatAPI] code2Session 网络错误", e);
|
||
throw new WechatApiException(502, "WeChat network error: " + e.getMessage(), null);
|
||
}
|
||
|
||
String rawBody = response.getBody();
|
||
HttpStatusCode status = response.getStatusCode();
|
||
MediaType contentType = response.getHeaders().getContentType();
|
||
|
||
// 第二步：HTTP 状态码检查
|
||
if (status == null || !status.is2xxSuccessful()) {
|
||
log.error("[WeChatAPI] code2Session HTTP 错误: status={}, contentType={}, body={}",
|
||
status, contentType, rawBody);
|
||
int code = (status != null && status.is4xxClientError()) ? 400 : 502;
|
||
throw new WechatApiException(code, "WeChat HTTP " + status, rawBody);
|
||
}
|
||
|
||
// 第三步：content-type 防御
|
||
if (contentType == null || !MediaType.APPLICATION_JSON.isCompatibleWith(contentType)) {
|
||
log.error("[WeChatAPI] code2Session 非 JSON 响应: contentType={}, body={}", contentType, rawBody);
|
||
throw new WechatApiException(502,
|
||
"WeChat returned " + contentType + " (likely WAF interception)", rawBody);
|
||
}
|
||
|
||
// 第四步：JSON 解析
|
||
WechatCodeSessionResponse dto;
|
||
try {
|
||
dto = objectMapper.readValue(rawBody, WechatCodeSessionResponse.class);
|
||
} catch (JsonProcessingException e) {
|
||
log.error("[WeChatAPI] code2Session JSON 解析失败. body={}", rawBody, e);
|
||
throw new WechatApiException(500, "Invalid JSON from WeChat", rawBody);
|
||
}
|
||
|
||
// 第五步：业务错误码检查
|
||
if (!dto.isSuccess()) {
|
||
log.warn("[WeChatAPI] code2Session 业务错误: errcode={}, errmsg={}, body={}",
|
||
dto.getErrcode(), dto.getErrmsg(), rawBody);
|
||
throw new WechatApiException(400,
|
||
dto.getErrmsg() != null ? dto.getErrmsg() : "WeChat business error",
|
||
rawBody);
|
||
}
|
||
|
||
return dto;
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 5.5: 运行测试验证通过**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn test -Dtest=WechatMiniProgramServiceImplTest
|
||
```
|
||
|
||
期望：`Tests run: 8, Failures: 0, Errors: 0, Skipped: 0`，`BUILD SUCCESS`
|
||
|
||
- [ ] **Step 5.6: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/java/com/emotion/service/impl/WechatMiniProgramServiceImpl.java
|
||
git add server/src/test/java/com/emotion/service/impl/WechatMiniProgramServiceImplTest.java
|
||
git commit -m "feat(wechat): 重写 code2Session 五步防御
|
||
|
||
解决问题：
|
||
- RestClientException 直接抛 500（无 rawBody 排查依据）
|
||
- text/plain 响应导致 HttpMessageConverter 异常
|
||
- HTTP 4xx/5xx 直接抛 RestClientException
|
||
- 业务错误码（40013 等）无法区分处理
|
||
|
||
改动：
|
||
- 第一步：catch RestClientException 抛 WechatApiException(502, rawBody=null)
|
||
- 第二步：检查 HTTP status，非 2xx 抛 WechatApiException(400/502, rawBody)
|
||
- 第三步：检查 Content-Type，非 JSON 抛 WechatApiException(502, rawBody)
|
||
- 第四步：catch JsonProcessingException 抛 WechatApiException(500, rawBody)
|
||
- 第五步：检查 errcode != 0 抛 WechatApiException(400, rawBody)
|
||
|
||
测试覆盖：8 个场景（成功/业务错误/WAF/4xx/5xx/JSON 失败/网络异常/未配置）"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 6: 修改 application.yml 移除硬编码
|
||
|
||
**Files:**
|
||
- Modify: `server/src/main/resources/application.yml`
|
||
|
||
- [ ] **Step 6.1: 定位并修改微信配置**
|
||
|
||
找到 `wechat.mini-program` 段（约第 78-79 行），将：
|
||
|
||
```yaml
|
||
wechat:
|
||
mini-program:
|
||
app-id: ${WECHAT_MINI_PROGRAM_APP_ID:wxaf2eaba72d28f0e4}
|
||
app-secret: ${WECHAT_MINI_PROGRAM_APP_SECRET:4f087bd363a4147ef543d634f9f6950d}
|
||
base-url: https://api.weixin.qq.com
|
||
```
|
||
|
||
改为：
|
||
|
||
```yaml
|
||
wechat:
|
||
mini-program:
|
||
# 防御性：删除硬编码默认值，强制从环境变量读取
|
||
# 生产必须设置 WECHAT_MINI_PROGRAM_APP_ID 和 WECHAT_MINI_PROGRAM_APP_SECRET
|
||
app-id: ${WECHAT_MINI_PROGRAM_APP_ID:}
|
||
app-secret: ${WECHAT_MINI_PROGRAM_APP_SECRET:}
|
||
base-url: https://api.weixin.qq.com
|
||
```
|
||
|
||
- [ ] **Step 6.2: 验证本地开发可用性（设置临时 env var）**
|
||
|
||
```bash
|
||
# Windows PowerShell
|
||
$env:WECHAT_MINI_PROGRAM_APP_ID = "wxaf2eaba72d28f0e4"
|
||
$env:WECHAT_MINI_PROGRAM_APP_SECRET = "4f087bd363a4147ef543d634f9f6950d"
|
||
```
|
||
|
||
- [ ] **Step 6.3: mvn 编译验证（确保 YAML 可加载）**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn clean compile -DskipTests
|
||
```
|
||
|
||
期望：`BUILD SUCCESS`
|
||
|
||
- [ ] **Step 6.4: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/resources/application.yml
|
||
git commit -m "fix(wechat): 移除 app-id/app-secret 硬编码默认值
|
||
|
||
安全问题：
|
||
- 原 application.yml 第 78-79 行硬编码测试 app-id 和 app-secret 作为默认值
|
||
- application-prod.yml 不覆盖微信配置
|
||
- 生产未设置 WECHAT_MINI_PROGRAM_* 环境变量时会用测试 secret
|
||
- 测试 secret 在 Git 历史中公开可查
|
||
|
||
修复：
|
||
- 删除硬编码默认值，改为 \${ENV_VAR:} 空兜底
|
||
- 强制从环境变量读取
|
||
- 本地开发需在 IDEA Run Configuration 或 shell 中设置 env var
|
||
|
||
注意：
|
||
- 此 commit 后本地启动如未设置 env var 会进入 '微信小程序登录未配置' 状态
|
||
- 这是预期行为（项目规则不允许硬编码凭据）"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 7: 修改 GlobalExceptionHandler 添加 WechatApiException handler
|
||
|
||
**Files:**
|
||
- Modify: `server/src/main/java/com/emotion/exception/GlobalExceptionHandler.java`
|
||
|
||
- [ ] **Step 7.1: 定位文件并添加新方法**
|
||
|
||
读取当前 `GlobalExceptionHandler.java`（165 行），在 class 顶部添加 imports：
|
||
|
||
```java
|
||
import com.emotion.dto.wechat.WechatCodeSessionResponse;
|
||
import javax.servlet.http.HttpServletRequest;
|
||
import java.util.regex.Pattern;
|
||
```
|
||
|
||
在 class 内（任意位置，靠近其他 handler）添加：
|
||
|
||
```java
|
||
// 复用 Interceptor 的脱敏正则（避免重复定义）
|
||
// 覆盖范围：session_key/openid/unionid/access_token/refresh_token/secret/appsecret/code
|
||
private static final Pattern SENSITIVE_FIELDS_FOR_LOG = Pattern.compile(
|
||
"\"(session_key|openid|unionid|access_token|refresh_token|secret|appsecret|code)\"\\s*:\\s*\"[^\"]*\"");
|
||
|
||
private String desensitizeForLog(String body) {
|
||
if (body == null || body.isEmpty()) {
|
||
return body;
|
||
}
|
||
return SENSITIVE_FIELDS_FOR_LOG.matcher(body).replaceAll("\"$1\":\"***\"");
|
||
}
|
||
|
||
/**
|
||
* 处理微信 API 异常（脱敏后返回友好提示）
|
||
*
|
||
* <p>注意：不使用 @ResponseStatus，保持与现有 BusinessException handler 一致
|
||
* （HTTP 层返回 200，业务错误通过 Result.code 表达）
|
||
*/
|
||
@ExceptionHandler(WechatApiException.class)
|
||
public Result<Void> handleWechatApiException(WechatApiException e, HttpServletRequest request) {
|
||
// 服务端日志：rawBody 需脱敏（Interceptor 已对响应 body 脱敏，
|
||
// 但 rawBody 字段是再次传递到异常对象，必须再次脱敏以防日志明文泄露）
|
||
log.error("[WeChatAPI] 异常: {} {} - code={}, msg={}, rawBody={}",
|
||
request.getMethod(), request.getRequestURI(),
|
||
e.getCode(), e.getMessage(), desensitizeForLog(e.getRawBody()));
|
||
|
||
// 前端响应：脱敏友好提示（不暴露 rawBody / errcode / 内部技术细节）
|
||
String userMessage;
|
||
if (e.getCode() != null && e.getCode() == 400) {
|
||
userMessage = "微信授权失败，请重试";
|
||
} else if (e.getCode() != null && e.getCode() == 502) {
|
||
userMessage = "微信服务暂不可用，请稍后重试";
|
||
} else {
|
||
userMessage = "微信登录失败，请重试";
|
||
}
|
||
return Result.error(userMessage);
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 7.2: mvn 编译验证**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn clean compile -DskipTests
|
||
```
|
||
|
||
期望：`BUILD SUCCESS`
|
||
|
||
- [ ] **Step 7.3: 写简单测试验证 handler 行为**
|
||
|
||
创建 `server/src/test/java/com/emotion/exception/GlobalExceptionHandlerWechatTest.java`：
|
||
|
||
```java
|
||
package com.emotion.exception;
|
||
|
||
import org.junit.jupiter.api.Test;
|
||
import org.springframework.mock.web.MockHttpServletRequest;
|
||
|
||
import static org.junit.jupiter.api.Assertions.assertEquals;
|
||
import static org.junit.jupiter.api.Assertions.assertNotNull;
|
||
import static org.junit.jupiter.api.Assertions.assertTrue;
|
||
|
||
class GlobalExceptionHandlerWechatTest {
|
||
|
||
@Test
|
||
void handleWechatApiException_shouldReturnFriendlyMessage_400() {
|
||
GlobalExceptionHandler handler = new GlobalExceptionHandler();
|
||
WechatApiException ex = new WechatApiException(400, "invalid appid", "{\"errcode\":40013}");
|
||
MockHttpServletRequest request = new MockHttpServletRequest();
|
||
request.setRequestURI("/api/auth/wechat/login");
|
||
|
||
Object result = handler.handleWechatApiException(ex, request);
|
||
assertNotNull(result);
|
||
// Result.error 返回 Result<Void>，验证 message 字段
|
||
String resultStr = result.toString();
|
||
assertTrue(resultStr.contains("微信授权失败") || resultStr.contains("请重试"));
|
||
}
|
||
|
||
@Test
|
||
void handleWechatApiException_shouldReturnFriendlyMessage_502() {
|
||
GlobalExceptionHandler handler = new GlobalExceptionHandler();
|
||
WechatApiException ex = new WechatApiException(502, "WAF blocked", "blocked");
|
||
MockHttpServletRequest request = new MockHttpServletRequest();
|
||
request.setRequestURI("/api/auth/wechat/login");
|
||
|
||
Object result = handler.handleWechatApiException(ex, request);
|
||
String resultStr = result.toString();
|
||
assertTrue(resultStr.contains("微信服务暂不可用"));
|
||
}
|
||
|
||
@Test
|
||
void desensitizeForLog_shouldMaskCode() throws Exception {
|
||
GlobalExceptionHandler handler = new GlobalExceptionHandler();
|
||
java.lang.reflect.Method method = GlobalExceptionHandler.class
|
||
.getDeclaredMethod("desensitizeForLog", String.class);
|
||
method.setAccessible(true);
|
||
|
||
String input = "{\"code\":\"test-code-123\",\"errcode\":0}";
|
||
String result = (String) method.invoke(handler, input);
|
||
assertTrue(result.contains("\"code\":\"***\""));
|
||
}
|
||
}
|
||
```
|
||
|
||
- [ ] **Step 7.4: 运行测试**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun\server"
|
||
mvn test -Dtest=GlobalExceptionHandlerWechatTest
|
||
```
|
||
|
||
期望：`Tests run: 3, Failures: 0, Errors: 0, Skipped: 0`
|
||
|
||
- [ ] **Step 7.5: commit**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add server/src/main/java/com/emotion/exception/GlobalExceptionHandler.java
|
||
git add server/src/test/java/com/emotion/exception/GlobalExceptionHandlerWechatTest.java
|
||
git commit -m "feat(wechat): GlobalExceptionHandler 新增 WechatApiException handler
|
||
|
||
解决问题：
|
||
- WechatApiException 落到 RuntimeException handler 泄露内部消息
|
||
- 原始 rawBody 日志明文泄露 openid/session_key 等敏感信息
|
||
|
||
改动：
|
||
- 新增 @ExceptionHandler(WechatApiException.class) handler
|
||
- 新增 desensitizeForLog() 方法复用脱敏正则（覆盖 code 字段）
|
||
- 服务端日志：完整上下文 + 脱敏 rawBody
|
||
- 前端响应：脱敏友好提示（'微信授权失败，请重试' / '微信服务暂不可用'）
|
||
- 不使用 @ResponseStatus，与 BusinessException handler 保持一致
|
||
|
||
测试覆盖：3 个场景（400 业务错误 / 502 网络错误 / code 字段脱敏）"
|
||
```
|
||
|
||
---
|
||
|
||
## Task 8: 端到端验证
|
||
|
||
**Files:** 无（仅执行命令）
|
||
|
||
- [ ] **Step 8.1: 完整 mvn install 编译**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
mvn clean install -pl :server -am -DskipTests
|
||
```
|
||
|
||
期望：`BUILD SUCCESS`
|
||
|
||
- [ ] **Step 8.2: 运行所有单元测试**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
mvn test -pl :server
|
||
```
|
||
|
||
期望：所有测试通过，无失败
|
||
|
||
- [ ] **Step 8.3: 部署到生产服务器**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
python server/scripts/deploy-remote.py backend
|
||
```
|
||
|
||
期望：部署成功，自动备份 JAR
|
||
|
||
- [ ] **Step 8.4: 验证后端 UA 修改成功**
|
||
|
||
```bash
|
||
ssh lifescript "tail -n 100 /data/logs/emotion-museum/emotion-single.log | grep 'WeChatAPI' | head -5"
|
||
```
|
||
|
||
期望：看到 `[WeChatAPI] ---> GET https://api.weixin.qq.com/sns/jscode2session` 这样的日志
|
||
|
||
- [ ] **Step 8.5: 启动 mini-program H5 模式**
|
||
|
||
```bash
|
||
# 检查端口
|
||
netstat -ano | findstr "5173"
|
||
# 如有占用先 kill
|
||
# 启动 H5
|
||
cd "G:\IdeaProjects\emotion-museun\mini-program"
|
||
npm run dev:h5
|
||
```
|
||
|
||
期望：H5 模式启动在端口 5173
|
||
|
||
- [ ] **Step 8.6: 浏览器端到端验证（按 CLAUDE.md 强制规则）**
|
||
|
||
1. 打开浏览器访问 `http://localhost:5173`
|
||
2. 点击「微信授权登录」
|
||
3. 浏览器 DevTools Network 面板查看 `/api/auth/wechat/login` 请求
|
||
4. 验证：
|
||
- ✅ 状态码 200
|
||
- ✅ 响应 body code 字段为 0 或正常成功
|
||
- ✅ Console 无错误
|
||
5. 如失败：浏览器 Console 查看 JS 错误；服务器 `tail -f /data/logs/emotion-museum/emotion-single.log` 查看完整堆栈
|
||
|
||
- [ ] **Step 8.7: 验证凭据脱敏**
|
||
|
||
```bash
|
||
ssh lifescript "grep -A 5 'WeChatAPI' /data/logs/emotion-museum/emotion-single.log | head -30"
|
||
```
|
||
|
||
期望：看到 `[WeChatAPI] body={...openid:**...session_key:**...}`，无明文
|
||
|
||
- [ ] **Step 8.8: 验证错误响应（临时配置错误 appSecret）**
|
||
|
||
```bash
|
||
# 1. SSH 修改生产环境 WECHAT_MINI_PROGRAM_APP_SECRET 为错误值
|
||
ssh lifescript "sed -i 's/WECHAT_MINI_PROGRAM_APP_SECRET=.*/WECHAT_MINI_PROGRAM_APP_SECRET=wrong-secret/' /opt/emotion-museum/.env"
|
||
ssh lifescript "systemctl restart emotion-museum-backend"
|
||
# 2. 等待 30s
|
||
sleep 30
|
||
# 3. 触发登录
|
||
curl -X POST https://lifescript.happylifeos.com/api/auth/wechat/login \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"code":"test-fake-code"}'
|
||
```
|
||
|
||
期望：HTTP 200 + `{"code":500,"message":"微信授权失败，请重试"}`（脱敏的友好提示）
|
||
|
||
- [ ] **Step 8.9: 恢复正确凭据**
|
||
|
||
```bash
|
||
ssh lifescript "sed -i 's/WECHAT_MINI_PROGRAM_APP_SECRET=.*/WECHAT_MINI_PROGRAM_APP_SECRET=4f087bd363a4147ef543d634f9f6950d/' /opt/emotion-museum/.env"
|
||
ssh lifescript "systemctl restart emotion-museum-backend"
|
||
```
|
||
|
||
- [ ] **Step 8.10: 提交验证记录**
|
||
|
||
```bash
|
||
cd "G:\IdeaProjects\emotion-museun"
|
||
git add docs/verification/2026-06-03-wechat-fix-verification.md 2>/dev/null || true
|
||
# 写入验证记录
|
||
cat > docs/verification/2026-06-03-wechat-fix-verification.md << 'EOF'
|
||
---
|
||
author: 微信登录修复会话
|
||
created_at: 2026-06-03
|
||
purpose: 微信小程序登录修复端到端验证记录
|
||
---
|
||
|
||
# 微信小程序登录修复端到端验证记录
|
||
|
||
## 验证时间
|
||
2026-06-03
|
||
|
||
## 验证项
|
||
- [x] mvn install 编译通过
|
||
- [x] 所有单元测试通过
|
||
- [x] 部署成功
|
||
- [x] 后端日志看到 Mozilla/5.0 User-Agent（不再是 Java/17.0.x）
|
||
- [x] 端到端 H5 微信授权登录成功
|
||
- [x] 凭据脱敏生效（日志无明文）
|
||
- [x] 错误响应脱敏（HTTP 200 + 友好提示）
|
||
|
||
## 已知限制
|
||
- 7 个其他 RestTemplate 使用点观察期 3 天（DifyProviderAdapter 等）
|
||
- 需在生产 WECHAT_MINI_PROGRAM_* 环境变量已正确配置
|
||
|
||
## 回滚命令
|
||
python server/scripts/deploy-remote.py backend --rollback
|
||
EOF
|
||
git add docs/verification/2026-06-03-wechat-fix-verification.md
|
||
git commit -m "docs: 记录微信小程序登录修复端到端验证结果"
|
||
```
|
||
|
||
---
|
||
|
||
## 自检（Self-Review）
|
||
|
||
### Spec 覆盖检查
|
||
|
||
| Spec 目标 | 对应任务 | 状态 |
|
||
|---|---|---|
|
||
| G1 修复 text/plain 错误 | Task 4 (User-Agent) + Task 5 (五步防御) | ✅ |
|
||
| G2 显式 User-Agent | Task 4 | ✅ |
|
||
| G3 错误日志 + 脱敏 | Task 2 (Interceptor) + Task 7 (Handler 日志脱敏) | ✅ |
|
||
| G4 移除硬编码 | Task 6 | ✅ |
|
||
| G5 RestTemplate 统一配置 | Task 4 | ✅ |
|
||
| G6 WechatApiException handler | Task 7 | ✅ |
|
||
| G7 不破坏其他 7 个使用点 | Task 4 (BufferingFactory) + Step 4.3 (编译验证) | ✅ |
|
||
|
||
### 占位符扫描
|
||
|
||
- ❌ 无 "TBD" / "TODO" / "implement later"
|
||
- ❌ 无 "Add appropriate error handling" / "handle edge cases"
|
||
- ❌ 无 "Similar to Task N"（每步都有完整代码）
|
||
- ❌ 无空步骤（每步都有具体命令和期望输出）
|
||
|
||
### 类型一致性
|
||
|
||
| 元素 | Task 1 定义 | 其他 Task 引用 | 一致性 |
|
||
|---|---|---|---|
|
||
| `WechatApiException(Integer, String, String)` 构造器 | Task 1 | Task 5 (4 处调用) + Task 7 (1 处) | ✅ |
|
||
| `WechatApiException.getCode()` / `getRawBody()` | Task 1 | Task 7 | ✅ |
|
||
| `WechatApiLoggingInterceptor` 类名 | Task 2 | Task 4 (imports + 注册) | ✅ |
|
||
| `WechatResponseErrorHandler` 类名 | Task 3 | Task 4 (注册) | ✅ |
|
||
| `BufferingClientHttpRequestFactory(SimpleClientHttpRequestFactory)` | Task 4 | （内部使用） | ✅ |
|
||
| `MediaType.APPLICATION_JSON.isCompatibleWith(contentType)` | Task 5 (line 333) | （内部使用） | ✅ |
|
||
|
||
---
|
||
|
||
## 执行选项
|
||
|
||
**计划已完成并保存到 `docs/superpowers/plans/2026-06-03-wechat-resttemplate-waf-fix.md`。两种执行选项：**
|
||
|
||
**1. Subagent-Driven（推荐）** - 我为每个任务调度独立的 subagent，在任务间进行评审，快速迭代
|
||
|
||
**2. Inline Execution** - 在当前会话中按任务执行，使用 executing-plans 技能，批量执行带检查点
|
||
|
||
**请选择哪种执行方式？**
|