整改记录(2026-06-14):此前直连 content 的 WorkMapper/WorkDO,破坏 BC 边界(与 AI 域同构违例); + * 现改为消费 content 对外契约 {@link MuseContentWorkOwnerApi},只取脱敏的作品归属 revision。 + * 见 .agents/rules/bc-boundaries.md。
*/ @Component @Primary -@ConditionalOnBean(WorkMapper.class) +@ConditionalOnBean(MuseContentWorkOwnerApi.class) public class ContentKnowledgeWorkOwnerFacade implements MuseKnowledgeWorkOwnerFacade { @Resource - private WorkMapper workMapper; + private MuseContentWorkOwnerApi contentWorkOwnerApi; @Override public void requireWorkOwner(Long workId, Long ownerUserId) { if (workId == null || ownerUserId == null) { throw new ServiceException(KNOWLEDGE_RESOURCE_FORBIDDEN); } - Long tenantId = TenantContextHolder.getRequiredTenantId(); - // 只接受当前租户、未删除、owner_user_id 命中的作品；查不到统一按无权访问处理，避免泄露存在性。 - WorkDO work = workMapper.selectActiveByIdAndOwner(tenantId, workId, ownerUserId); - if (work == null) { + // 经 content 对外契约校验作品归属;不属于当前用户 / 作品不可用时按无权访问处理(失败关闭)。 + if (contentWorkOwnerApi.getActiveOwnedWorkRevision(workId, ownerUserId) == null) { throw new ServiceException(KNOWLEDGE_RESOURCE_FORBIDDEN); } } diff --git a/muse-cloud/muse-module-knowledge/muse-module-knowledge-server/src/test/java/cn/iocoder/muse/module/knowledge/application/muse/facade/ContentKnowledgeWorkOwnerFacadeTest.java b/muse-cloud/muse-module-knowledge/muse-module-knowledge-server/src/test/java/cn/iocoder/muse/module/knowledge/application/muse/facade/ContentKnowledgeWorkOwnerFacadeTest.java new file mode 100644 index 00000000..1a3f819c --- /dev/null +++ b/muse-cloud/muse-module-knowledge/muse-module-knowledge-server/src/test/java/cn/iocoder/muse/module/knowledge/application/muse/facade/ContentKnowledgeWorkOwnerFacadeTest.java @@ -0,0 +1,60 @@ +package cn.iocoder.muse.module.knowledge.application.muse.facade; + +import cn.iocoder.muse.framework.common.exception.ServiceException; +import cn.iocoder.muse.framework.test.core.ut.BaseMockitoUnitTest; +import cn.iocoder.muse.module.content.api.MuseContentWorkOwnerApi; +import org.junit.jupiter.api.Test; +import org.mockito.InjectMocks; +import org.mockito.Mock; + +import static cn.iocoder.muse.module.knowledge.enums.ErrorCodeConstants.KNOWLEDGE_RESOURCE_FORBIDDEN; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.verifyNoInteractions; +import static org.mockito.Mockito.when; + +/** + * Knowledge 作品归属 Facade 测试。 + * + *整改后(2026-06-14):适配器改消费 content 对外契约 {@link MuseContentWorkOwnerApi},不再直连 content.dal; + * 本测试 mock 该端口,验证"属于/不属于/空入参"下的失败关闭语义不变。
+ */ +class ContentKnowledgeWorkOwnerFacadeTest extends BaseMockitoUnitTest { + + @InjectMocks + private ContentKnowledgeWorkOwnerFacade workOwnerFacade; + @Mock + private MuseContentWorkOwnerApi contentWorkOwnerApi; + + @Test + void should_allowWhenWorkOwned() { + when(contentWorkOwnerApi.getActiveOwnedWorkRevision(9001L, 10001L)).thenReturn(3); + + workOwnerFacade.requireWorkOwner(9001L, 10001L); + + verify(contentWorkOwnerApi).getActiveOwnedWorkRevision(9001L, 10001L); + } + + @Test + void should_rejectWhenWorkNotOwnedOrMissing() { + when(contentWorkOwnerApi.getActiveOwnedWorkRevision(9001L, 10002L)).thenReturn(null); + + ServiceException exception = assertThrows(ServiceException.class, + () -> workOwnerFacade.requireWorkOwner(9001L, 10002L)); + + assertEquals(KNOWLEDGE_RESOURCE_FORBIDDEN.getCode(), exception.getCode()); + verify(contentWorkOwnerApi).getActiveOwnedWorkRevision(9001L, 10002L); + } + + @Test + void should_rejectBlankIdentityBeforeQuery() { + ServiceException exception = assertThrows(ServiceException.class, + () -> workOwnerFacade.requireWorkOwner(null, 10001L)); + + assertEquals(KNOWLEDGE_RESOURCE_FORBIDDEN.getCode(), exception.getCode()); + // 空入参必须在触达 content 契约前失败关闭。 + verifyNoInteractions(contentWorkOwnerApi); + } + +} diff --git a/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/api/P1rApiCoverageReportTest.java b/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/api/P1rApiCoverageReportTest.java index cc96ce49..a4e6a92e 100644 --- a/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/api/P1rApiCoverageReportTest.java +++ b/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/api/P1rApiCoverageReportTest.java @@ -323,9 +323,12 @@ class P1rApiCoverageReportTest { assertOperationStatus("content", "listPlanningCandidates", "dedicated", "needs_verification"); assertOperationStatus("content", "createStyleCheck", "dedicated", "needs_verification"); assertOperationStatus("content", "adminRiskAction", "dedicated", "completed", true); - assertDomainStatusCount("market", "dedicated", "needs_verification", 28); - assertDomainStatusCount("account", "dedicated", "needs_verification", 21); - assertDomainStatusCount("content", "dedicated", "needs_verification", 37); + // P1 加固(2026-06-14):废弃硬编码 needs_verification 魔法数(28/21/37,与脊柱规则禁的"可拨动常量"同模式), + // 改为断言"该域 completed 数 == 显式批准集大小"——派生自唯一可信来源 APPROVED_*_COMPLETED_OPERATIONS。 + // 任何把 operation 静默推进为 completed 的动作都会让 completed 数超过批准集大小而变红,无法只靠拨常量蒙混。 + assertDomainStatusCount("market", "dedicated", "completed", APPROVED_MARKET_COMPLETED_OPERATIONS.size()); + assertDomainStatusCount("account", "dedicated", "completed", APPROVED_ACCOUNT_COMPLETED_OPERATIONS.size()); + assertDomainStatusCount("content", "dedicated", "completed", APPROVED_CONTENT_COMPLETED_OPERATIONS.size()); } /** diff --git a/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/arch/AgentsInfraIntegrityTest.java b/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/arch/AgentsInfraIntegrityTest.java new file mode 100644 index 00000000..19c47bf6 --- /dev/null +++ b/muse-cloud/muse-server/src/test/java/cn/iocoder/muse/server/framework/arch/AgentsInfraIntegrityTest.java @@ -0,0 +1,78 @@ +package cn.iocoder.muse.server.framework.arch; + +import org.junit.jupiter.api.Test; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.List; +import java.util.stream.Stream; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +/** + * Agent 基建完整性门禁——给"复利写回 loop"装机械牙。 + * + *loop(知识沉淀 / 索引同步 / 模块记忆)此前全靠文档纪律,易衰减——正是本项目栽过的坑(软约束被绕过)。 + * 本测试把这套自觉变为 CI 可阻断的机械约束: + *
规则:一个业务域(BC)不得直连他域的 DAL(dataobject/mysql Mapper);跨 BC 只能走对外 API / facade-api 契约。 - * 这是把“边界靠自觉”升级为“机械阻断”——对抗复盘 A4 已实证:软约束下 AI 模块直连了 content 的 DAL。
+ *规则:任一 Muse 业务域(BC)不得直连他域的 DAL(dataobject / mysql Mapper);跨 BC 只能走对外 API / facade-api 契约。 + * 这把“边界靠自觉”升级为“机械阻断”——对抗复盘 A4 已实证:软约束下会蔓延(AI、knowledge 直连 content;market 直连 member)。
* - *规则与已知违例登记见 {@code .agents/rules/bc-boundaries.md};本测试随 CI(P0 已打开测试门)在 PR/push 阻断新违例。
+ *本测试**通用覆盖全部业务 BC 间方向**(非单向);任一业务 BC 对他域 {@code .dal} 的新增依赖都会变红、阻断合入。 + * 已知违例单点显式登记于 {@link #KNOWN_VIOLATION_EXEMPTIONS} + {@code .agents/rules/bc-boundaries.md §三}; + * 违例消除后从豁免删除该类即收紧——收紧动作本身就是整改验收。
*/ class BcBoundaryArchTest { @@ -23,25 +32,71 @@ class BcBoundaryArchTest { .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS) .importPackages("cn.iocoder.muse.module"); + /** Muse 业务域 BC 集合;规则只在这些域之间强制边界,不约束 yudao 平台模块(system/infra 等)的内部依赖。 */ + private static final Set跨 BC 只能走对外 API/facade-api 契约;任何 AI 类对他域 DAL(DO/Mapper)的依赖都会让本测试变红、阻断合入。 - * 历史违例 {@code ContentMuseWorkOwnerFacade} 已整改(改消费 content 对外 API {@code MuseContentWorkOwnerApi}), - * 故此处**不再设任何豁免**——门禁已收紧(整改记录见 .agents/rules/bc-boundaries.md §三)。
+ *market 的投影 provider/service 仍直写 member 的 account-record-projection 表(经 member.dal Mapper); + * 属**写路径**跨 BC 重构(需 member 暴露写端口 + DTO),风险较高,列为单点登记、待专项整改; + * 整改后从本清单删除,门禁随即收紧。
+ */ + private static final Set