feat(pages): 支持 Remote 部署源同步

新增部署源配置与运行态模型、安全下载、租约续期、原子激活和失败补偿。接入内部任务与脱敏前端交互，并阻止数据库 Trace 和日志展开敏感查询参数。
2026-10-09 00:56:37 +08:00 · 2026-07-19 17:36:51 +08:00
parent 4e8ec23264
commit 38b0516937
58 changed files with 9858 additions and 1075 deletions
@@ -0,0 +1,69 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package db
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/glebarez/sqlite"
+	"go.opentelemetry.io/otel/attribute"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+	semconv "go.opentelemetry.io/otel/semconv/v1.30.0"
+	"gorm.io/gorm"
+	gormLogger "gorm.io/gorm/logger"
+	"gorm.io/plugin/opentelemetry/tracing"
+)
+
+func TestGORMTracingPluginDoesNotRecordQueryVariables(t *testing.T) {
+	t.Parallel()
+
+	const secret = "https://example.test/release.zip?token=otel-secret"
+	spanRecorder := tracetest.NewSpanRecorder()
+	tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(spanRecorder))
+	t.Cleanup(func() {
+		if err := tracerProvider.Shutdown(context.Background()); err != nil {
+			t.Errorf("shutdown tracer provider: %v", err)
+		}
+	})
+
+	testDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		Logger: gormLogger.Default.LogMode(gormLogger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	if err := testDB.Use(newGORMTracingPlugin(
+		[]attribute.KeyValue{attribute.String("db.instance", "trace-test")},
+		tracing.WithTracerProvider(tracerProvider),
+	)); err != nil {
+		t.Fatalf("register tracing plugin: %v", err)
+	}
+	if err := testDB.Exec("CREATE TABLE source_secrets (remote_url TEXT NOT NULL)").Error; err != nil {
+		t.Fatalf("create table: %v", err)
+	}
+	if err := testDB.Exec("INSERT INTO source_secrets (remote_url) VALUES (?)", secret).Error; err != nil {
+		t.Fatalf("insert source secret: %v", err)
+	}
+
+	var queryText string
+	for _, span := range spanRecorder.Ended() {
+		for _, attr := range span.Attributes() {
+			if attr.Key == semconv.DBQueryTextKey && strings.Contains(attr.Value.AsString(), "INSERT INTO source_secrets") {
+				queryText = attr.Value.AsString()
+			}
+		}
+	}
+	if queryText == "" {
+		t.Fatal("database query text attribute not found")
+	}
+	if strings.Contains(queryText, secret) || strings.Contains(queryText, "otel-secret") {
+		t.Fatalf("db.query.text leaked bound value: %q", queryText)
+	}
+	if !strings.Contains(queryText, "VALUES (?)") {
+		t.Fatalf("db.query.text = %q, want parameter placeholder", queryText)
+	}
+}