user-system

long-agent/user-system

Fork 0

Commit Graph

Author	SHA1	Message	Date
long-agent	adb251e4ad	fix: P2 security and correctness issues P2-10: Change ActivateEmail from GET to POST - token now passed in request body instead of URL query parameter for better security P2-11: Change ValidateResetToken from GET to POST - token now passed in request body instead of URL query parameter to prevent log leakage P2-12: Note - /uploads static exposure remains (requires architectural decision about file serving) P2-13: cursor.Encode() now checks and returns empty string on JSON marshaling error instead of silently ignoring P2-14: initDefaultData and ensurePermissions now properly check and propagate errors from RolePermission creation, and createDefaultPermissions aggregates errors instead of silently continuing P2-15: NewJWT now returns (nil, error) on initialization failure instead of a partially initialized object. All callers updated to handle the error return. Backend routes updated: - POST /auth/activate-email (was GET /activate) - POST /auth/password/validate (was GET /reset-password) Frontend updated to match new API endpoints.	2026-04-18 20:48:11 +08:00
long-agent	8655b39b03	test: 完善方案一业务逻辑测试和方案二规模测试方案一（业务逻辑正确性测试）： - 修复 SocialAccount.CreatedAt/UpdatedAt NULL 扫描问题（改为 *time.Time 指针） - 修复 OPLOG_003~006 数据隔离（改用唯一前缀+Search方法隔离） - 修复 DEV_008 设备列表测试（改用UserID过滤器隔离） - 修复并发测试 cache=private → cache=shared（SQLite连接共享） - 新增 testEnv 隔离架构（独立DB + 独立 httptest.Server）方案二（真实数据规模测试）： - 新增 LatencyStats P99/P95 百分位统计采集器 - 全部 16 个测试迁移至 newIsolatedDB（独立内存DB，WAL模式） - 关键查询添加 P99 多次采样统计（UL/LL/DV/DS/PR/AUTH/OPLOG） - 新增 CONC_SCALE_001~003 并发压测（50-100 goroutine） - 删除旧 setupScaleTestDB 死代码 - 双阈值体系：SQLite本地宽松阈值 vs PostgreSQL生产严格目标共计 84 测试通过（68 业务逻辑 + 16 规模测试）	2026-04-07 07:23:29 +08:00

Author

SHA1

Message

Date

long-agent

adb251e4ad

fix: P2 security and correctness issues

P2-10: Change ActivateEmail from GET to POST - token now passed in
request body instead of URL query parameter for better security

P2-11: Change ValidateResetToken from GET to POST - token now passed
in request body instead of URL query parameter to prevent log leakage

P2-12: Note - /uploads static exposure remains (requires architectural
decision about file serving)

P2-13: cursor.Encode() now checks and returns empty string on JSON
marshaling error instead of silently ignoring

P2-14: initDefaultData and ensurePermissions now properly check and
propagate errors from RolePermission creation, and createDefaultPermissions
aggregates errors instead of silently continuing

P2-15: NewJWT now returns (nil, error) on initialization failure
instead of a partially initialized object. All callers updated to handle
the error return.

Backend routes updated:
- POST /auth/activate-email (was GET /activate)
- POST /auth/password/validate (was GET /reset-password)

Frontend updated to match new API endpoints.

2026-04-18 20:48:11 +08:00

long-agent

8655b39b03

test: 完善方案一业务逻辑测试和方案二规模测试

方案一（业务逻辑正确性测试）：
- 修复 SocialAccount.CreatedAt/UpdatedAt NULL 扫描问题（改为 *time.Time 指针）
- 修复 OPLOG_003~006 数据隔离（改用唯一前缀+Search方法隔离）
- 修复 DEV_008 设备列表测试（改用UserID过滤器隔离）
- 修复并发测试 cache=private → cache=shared（SQLite连接共享）
- 新增 testEnv 隔离架构（独立DB + 独立 httptest.Server）

方案二（真实数据规模测试）：
- 新增 LatencyStats P99/P95 百分位统计采集器
- 全部 16 个测试迁移至 newIsolatedDB（独立内存DB，WAL模式）
- 关键查询添加 P99 多次采样统计（UL/LL/DV/DS/PR/AUTH/OPLOG）
- 新增 CONC_SCALE_001~003 并发压测（50-100 goroutine）
- 删除旧 setupScaleTestDB 死代码
- 双阈值体系：SQLite本地宽松阈值 vs PostgreSQL生产严格目标

共计 84 测试通过（68 业务逻辑 + 16 规模测试）

2026-04-07 07:23:29 +08:00

2 Commits