发布 0.3.0：恢复 Chat 接口并增强云端事件通知

internal/service/logevent_test.go

@@ -30,8 +30,7 @@ func newLogEventEnv(t *testing.T) (*LogEventService, *gorm.DB, uint) {
 		t.Fatalf("db handle: %v", err)
 	}
 	sqlDB.SetMaxOpenConns(1)
-	if err := db.AutoMigrate(&model.Setting{}, &model.OciConfig{}, &model.LogEvent{},
-		&model.AlertRule{}, &model.AlertRuleHit{}); err != nil {
+	if err := db.AutoMigrate(&model.Setting{}, &model.OciConfig{}, &model.LogEvent{}); err != nil {
 		t.Fatalf("auto migrate: %v", err)
 	}
 	cfg := model.OciConfig{Alias: "测试租户"}
@@ -240,12 +239,15 @@ func TestIngestRejectsUnknownConfig(t *testing.T) {
 func TestParseLogEvent(t *testing.T) {
 	ts := "2026-07-07T08:00:00Z"
 	tests := []struct {
-		name       string
-		payload    string
-		wantType   string
-		wantSource string
-		wantIP     string
-		wantTime   bool
+		name        string
+		payload     string
+		wantType    string
+		wantSource  string
+		wantIP      string
+		wantTime    bool
+		wantActor   string
+		wantOutcome string
+		wantDetail  string
 	}{
 		{
 			name:       "CloudEvents 单事件",
@@ -283,6 +285,29 @@ func TestParseLogEvent(t *testing.T) {
 			payload:  `{"eventType":"x","data":{"identity":{}}}`,
 			wantType: "x",
 		},
+		{
+			name: "Audit v2 提取操作者成败与策略描述",
+			payload: `{"eventType":"com.oraclecloud.identityControlPlane.CreatePolicy","data":{
+				"identity":{"principalName":"Alfonso Garcia","ipAddress":"129.159.43.9"},
+				"message":"ociportal-logs-sch CreatePolicy succeeded",
+				"stateChange":{"current":{"description":"允许 Connector 发布到 ONS"}}}}`,
+			wantType: "com.oraclecloud.identityControlPlane.CreatePolicy", wantIP: "129.159.43.9",
+			wantActor: "Alfonso Garcia", wantOutcome: "成功", wantDetail: "允许 Connector 发布到 ONS",
+		},
+		{
+			name: "IDCS 登录失败提取用户 IP 与原因",
+			payload: `{"eventType":"com.oraclecloud.IdentitySignOn.InteractiveLogin","data":{
+				"additionalDetails":{"actorName":"oci","clientIp":"155.117.82.111",
+				"auditEventMapValue":"{\"eventId\":\"sso.authentication.failure\",\"message\":\"Authentication failure : incorrect password.\"}"}}}`,
+			wantType: "com.oraclecloud.IdentitySignOn.InteractiveLogin", wantIP: "155.117.82.111",
+			wantActor: "oci", wantOutcome: "失败", wantDetail: "Authentication failure : incorrect password.",
+		},
+		{
+			name:        "message failed 后缀判失败",
+			payload:     `{"eventType":"x","data":{"message":"vm TerminateInstance failed"}}`,
+			wantType:    "x",
+			wantOutcome: "失败",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -291,6 +316,10 @@ func TestParseLogEvent(t *testing.T) {
 				t.Errorf("parse = (%q,%q,%q), want (%q,%q,%q)",
 					got.EventType, got.Source, got.SourceIP, tt.wantType, tt.wantSource, tt.wantIP)
 			}
+			if got.Actor != tt.wantActor || got.Outcome != tt.wantOutcome || got.Detail != tt.wantDetail {
+				t.Errorf("推送字段 = (%q,%q,%q), want (%q,%q,%q)",
+					got.Actor, got.Outcome, got.Detail, tt.wantActor, tt.wantOutcome, tt.wantDetail)
+			}
 			if (got.EventTime != nil) != tt.wantTime {
 				t.Errorf("eventTime present = %v, want %v", got.EventTime != nil, tt.wantTime)
 			}