8f90cf0f0d
- Remove stale test docs (test2-*, bugs-user-*, bug-report, session-notes) - Add UNRESOLVED-BUGS.md and regression-full-report.md - Update todo.md
210 lines
8.0 KiB
Markdown
210 lines
8.0 KiB
Markdown
# OCDP 回归测试完整报告 (Round 3)
|
||
|
||
**测试日期:** 2026-05-14
|
||
**环境:** http://10.6.80.114:18080
|
||
**集群:** k3s v1.28.0 (dbf824f1-9962-4d8e-881e-870c75fdb6f5), k8s (23880994-dfe4-48d0-abc0-b49692cc630a)
|
||
**Harbor:** harbor.bwgdi.com (83b823af-873b-457c-912c-9ccde3cb12e6)
|
||
|
||
---
|
||
|
||
## 代码变更概要 (Commit b88fe24 +)
|
||
|
||
| Commit | 变更 |
|
||
|--------|------|
|
||
| b88fe24 | fix: real K8s replicas in list API, full Helm values in modify YAML editor |
|
||
| 96d42ee | fix: scale replicas in response, YAML lineWidth, delta values, modified keys |
|
||
| 4441f58 | fix: direct K8s scaling, replicas from K8s API, button labels, modify fetch |
|
||
| 49b92e6 | fix: UI redesign — horizontal instance rows, proper scaling, readable tag cards |
|
||
| 28ecb2e | feat: scale instances, --reuse-values, values diff, UI redesign, hover animations |
|
||
| 87eaaa5 | fix: remove per-card Refresh button, consolidate to page-level refresh |
|
||
|
||
---
|
||
|
||
## 测试结果总览
|
||
|
||
### 总评分: 85/100
|
||
|
||
| 测试领域 | 状态 | 问题数 |
|
||
|----------|------|--------|
|
||
| 前端 UI / Launch / Routes | ✅ ALL PASS | 0 |
|
||
| API CRUD / 部署生命周期 | ⚠️ 2 issues | 2 |
|
||
| 配额执行 | ⚠️ 1 issue (pre-existing) | 1 |
|
||
| Values 优先级 / gpuMem | ⚠️ 1 issue | 1 |
|
||
| 权限隔离 | ✅ ALL PASS | 0 |
|
||
| 安全测试 | ⚠️ 3 issues (pre-existing) | 3 |
|
||
| DELETE 行为 | ✅ FIXED | 0 |
|
||
| InstanceCard / Scaling UI | ✅ ALL PASS | 0 |
|
||
| ModifyModal / Values Diff | ✅ ALL PASS | 0 |
|
||
|
||
---
|
||
|
||
## 新发现 Bug
|
||
|
||
### 🆕 BUG-R3-001: Detail API replicas=0 与 List API 不一致 (High)
|
||
|
||
| 属性 | 值 |
|
||
|------|-----|
|
||
| 严重度 | **P1 (High)** |
|
||
| 端点 | `GET /clusters/{id}/instances/{instance_id}` |
|
||
| 现象 | List API 返回正确 replicas（如 1, 5），但 Detail API 始终返回 `replicas: 0` |
|
||
| 根因 | Detail endpoint 从数据库读取实例记录，replicas 字段未同步自 K8s 实时状态 |
|
||
| 影响 | 前端依赖 Detail API 的页面（如刷新后详情页）显示错误的副本数 |
|
||
| 修复建议 | Detail endpoint 也从 K8s live state 填充 replicas，或确保数据库同步 |
|
||
|
||
### 🆕 BUG-R3-002: List API 移除 values 字段
|
||
|
||
| 属性 | 值 |
|
||
|------|-----|
|
||
| 严重度 | **P2 (Medium)** |
|
||
| 端点 | `GET /clusters/{id}/instances` |
|
||
| 现象 | List API 响应不再包含 `values` 字段（之前版本有）；values 仅在单实例 GET 中返回 |
|
||
| 影响 | 依赖 list API values 的测试脚本和前端组件会 break |
|
||
| 备注 | 可能是故意的性能优化，但属于 API 行为变更 |
|
||
|
||
---
|
||
|
||
## 已修复 Bug (验证通过)
|
||
|
||
| Bug ID | 描述 | 之前状态 | 现在状态 | 验证 |
|
||
|--------|------|----------|----------|------|
|
||
| BUG-001 | Launch 按钮无反应 | P0 Blocker | ✅ FIXED | 部署端到端成功 |
|
||
| BUG-002 | SPA 旧路由空白页 | P0 Blocker | ✅ FIXED | 所有旧路由返回 SPA |
|
||
| BUG-003 | DELETE 返回 404 | P1 High | ✅ FIXED | 返回 HTTP 204 |
|
||
| BUG-004 | DELETE 空 body | P1 High | ✅ FIXED | HTTP 204 No Content |
|
||
| - | InstanceCard 无 scaling UI | New Feature | ✅ ADDED | +/- 按钮 + API 调用 |
|
||
| - | ModifyModal values 为空 | Bug | ✅ FIXED | Full Helm values 返回 |
|
||
|
||
---
|
||
|
||
## 仍未修复的已知问题
|
||
|
||
| Bug ID | 描述 | 严重度 | 状态 |
|
||
|--------|------|--------|------|
|
||
| BUG-013 | 用户枚举（login 错误消息差异） | Medium | 未修复 |
|
||
| BUG-014 | 无速率限制 | Medium | 未修复 |
|
||
| BUG-015 | Nginx 版本泄露 | Low | 未修复 |
|
||
| BUG-016 | CORS: * | Low | 未修复 |
|
||
| BUG-017 | 缺少安全响应头 | Low | 未修复 |
|
||
| BUG-018 | /health 返回 HTML | Low | 未修复 |
|
||
| BUG-005 | Tags 端点 404 | Medium | 未修复 |
|
||
| BUG-006 | Namespace 静默覆盖无警告 | Medium | 未修复 |
|
||
| BUG-007-009 | Metrics/Stats/Kubeconfig 端点缺失 | Medium | 未修复 |
|
||
| BUG-011 | API 响应格式不一致 | Low | 未修复 |
|
||
| BUG-012 | /auth/me 空 token 字段 | Low | 未修复 |
|
||
| - | API 层配额预检查 | New Feature | 未实现 |
|
||
| - | Values 冲突时无警告 | UX | 未修复 |
|
||
|
||
---
|
||
|
||
## 详细测试结果
|
||
|
||
### 1. 前端 UI (test-user-a)
|
||
|
||
| 测试项 | 结果 |
|
||
|--------|------|
|
||
| 登录页加载 | ✅ HTTP 200, SPA 398 bytes |
|
||
| JWT 认证 | ✅ role=user, 10 permissions, quota 字段 |
|
||
| 所有页面路由 | ✅ 6 个路由全部返回 398 bytes (非空白) |
|
||
| 旧路由重定向 | ✅ /clusters, /registries, /launch, /monitoring 全部返回 SPA |
|
||
| Chart Browser | ✅ nginx:22.1.1 可发现，Launch 按钮可用 |
|
||
| 部署 Pipeline | ✅ pending-install → deployed (~15s) |
|
||
| InstanceCard Scale UI | ✅ +/- 按钮，副本数显示 |
|
||
| InstanceCard Actions | ✅ Entries/Diag/Modify/Delete 全部可见 |
|
||
| ModifyModal YAML Editor | ✅ full Helm values, lineWidth:0, diff 检测 |
|
||
| TagCard UI | ✅ 色标 (chart=blue, image=green), Copy helm pull 命令, LATEST badge |
|
||
| DELETE | ✅ HTTP 204 |
|
||
|
||
### 2. API 后端 (test-user-b)
|
||
|
||
| 测试项 | 结果 |
|
||
|--------|------|
|
||
| Login + /auth/me | ✅ 完整 profile (quota, namespace, permissions) |
|
||
| Cluster list | ✅ 2 clusters |
|
||
| Registry list | ✅ 1 registry (harbor-bwgdi) |
|
||
| Repository artifacts | ✅ Harbor API proxy 正常 |
|
||
| Cluster health | ✅ k3s healthy, v1.28.0 |
|
||
| 部署 nginx (default) | ✅ deployed, replicas=1 |
|
||
| 部署 nginx (over-quota) | ⚠️ 接受部署 (API 无预检查) |
|
||
| 实例状态轮询 | ✅ ~20s 到达 deployed |
|
||
| List API replicas | ✅ 正确显示 1/5 |
|
||
| Detail API replicas | ❌ 返回 0 (BUG-R3-001) |
|
||
| 实例删除 | ✅ HTTP 204 (BUG-003 FIXED) |
|
||
| 缺失端点 | ✅ 正常 404 |
|
||
|
||
### 3. Values 优先级 (test-user-c)
|
||
|
||
| 方法 | 结果 |
|
||
|------|------|
|
||
| values JSON only | ✅ gpuMem=10000 正确接受 |
|
||
| valuesYaml only | ✅ YAML -> JSON 解析正确 |
|
||
| 同时提供 (冲突) | ✅ values JSON 覆盖 valuesYaml |
|
||
| 冲突警告 | ❌ 无警告（建议添加） |
|
||
| 默认值 (空 values) | ✅ 使用 chart 内置 defaults |
|
||
| gpuMem=10000 | ✅ 整数 MB scalar 正确 |
|
||
| 清理 | ✅ 所有 3 个实例已删除 |
|
||
|
||
### 4. 权限隔离
|
||
|
||
| 测试项 | 结果 |
|
||
|--------|------|
|
||
| Admin lists users | ✅ 10 users |
|
||
| test-admin-d lists users | ✅ 10 users (admin role works) |
|
||
| test-user-c GET /users | ✅ 403 Forbidden |
|
||
| test-user-c POST /auth/register | ✅ 403 Forbidden |
|
||
| Cross-tenant deploy (c→b) | ✅ Silent override to ocdp-u-test-c (secure) |
|
||
| Deploy into own namespace | ✅ 成功 |
|
||
| Instance visibility | ✅ 仅看到自己的实例 |
|
||
| Disable user | ✅ 用户被禁用 |
|
||
| Disabled user login | ✅ 401 |
|
||
| Re-enable user | ✅ 恢复 |
|
||
| Self-registration | ✅ 401 (必须认证) |
|
||
|
||
### 5. 安全 (回归)
|
||
|
||
| 测试项 | 结果 |
|
||
|--------|------|
|
||
| 未认证端点 | ✅ 全部 401 |
|
||
| JWT 验证 | ✅ 篡改 token 被拒绝 |
|
||
| XSS/SQLi | ✅ 安全处理 |
|
||
| 敏感数据脱敏 | ✅ creds 显示为 •••••••• |
|
||
| 普通用户权限提升 | ✅ 403 blocked |
|
||
| 用户枚举 | ❌ 不同错误消息 (未修复) |
|
||
| 速率限制 | ❌ 无 429 (未修复) |
|
||
| CORS * + 缺失安全头 | ❌ 未修复 |
|
||
| Nginx 版本泄露 | ❌ "nginx/1.27.5" (未修复) |
|
||
| /auth/me 空 token | ✅ tokens 已正确清空 |
|
||
|
||
---
|
||
|
||
## 优先修复清单
|
||
|
||
### 立即修复 (P0/P1)
|
||
1. **BUG-R3-001**: Detail API replicas=0 — 从 K8s live state 填充
|
||
2. **配额预检查** — POST instances 时验证请求资源 ≤ 用户配额
|
||
|
||
### 尽快修复 (P2)
|
||
3. Values 冲突时添加 API 警告
|
||
4. Tags/Metrics/Stats/Kubeconfig 端点实现
|
||
5. Namespace 静默覆盖返回警告
|
||
6. List API values 字段回归或文档化
|
||
|
||
### 安全加固 (P3)
|
||
7. 登录错误消息统一
|
||
8. 速率限制
|
||
9. Nginx 安全头 + 关闭 server_tokens
|
||
10. CORS 收紧
|
||
|
||
---
|
||
|
||
## 对比: Round 1 vs Round 3
|
||
|
||
| 指标 | Round 1 (2026-05-11) | Round 3 (2026-05-14) |
|
||
|------|---------------------|---------------------|
|
||
| Total Bugs | 18 | 15 (3 fixed, 12 remain, 2 new) |
|
||
| P0 Blockers | 2 (Launch, Routes) | 0 |
|
||
| P1 High | 2 (DELETE 404, empty body) | 1 (Detail replicas=0) |
|
||
| 新功能 | - | Scaling UI, Values Diff, YAML editor |
|
||
| 安全漏洞 | 6 | 5 (token fields fixed) |
|
||
|
||
**结论:** 代码修改有效，3 个关键 Bug 已修复，新增了 scaling 和 values diff 功能。仍有 12 个已知问题和 2 个新问题待修复。
|