feat(ops-api/audit): annotate audit log IP with region lookup

Add an IPRegionResolver wrapping the ip2region xdb library and attach it to AuditService so each appended event records both the raw IP and a resolved region in a new ops.audit_logs.ip_region column. Loopback and private addresses short-circuit to local labels; missing xdb data or lookup errors degrade silently so auditing keeps working without it. The ops console audit view shows the region beneath the IP. Bundle the v4/v6 xdb data under internal/ops/app/ipregiondata so the resolver works out of the box, with config paths/env overrides for swapping in updated data sets. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-29 00:46:37 +08:00
parent 5a9d80c518
commit 3480d04ec3
17 changed files with 344 additions and 11 deletions
@@ -0,0 +1,52 @@
+package app
+
+import "testing"
+
+func TestIPRegionResolverLookupSpecialAddresses(t *testing.T) {
+	resolver := &IPRegionResolver{}
+
+	tests := []struct {
+		name string
+		ip   string
+		want string
+	}{
+		{name: "ipv4 loopback", ip: "127.0.0.1", want: "本机"},
+		{name: "ipv6 loopback", ip: "::1", want: "本机"},
+		{name: "private network", ip: "192.168.1.10", want: "内网IP"},
+		{name: "host port", ip: "10.0.0.8:443", want: "内网IP"},
+		{name: "invalid", ip: "not-an-ip", want: ""},
+		{name: "public disabled", ip: "8.8.8.8", want: ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := resolver.Lookup(tt.ip); got != tt.want {
+				t.Fatalf("Lookup(%q) = %q, want %q", tt.ip, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestIPRegionResolverLookupFromXDB(t *testing.T) {
+	resolver, err := NewIPRegionResolver("", "", nil)
+	if err != nil {
+		t.Fatalf("NewIPRegionResolver() error = %v", err)
+	}
+	defer resolver.Close()
+
+	if got := resolver.Lookup("8.8.8.8"); got == "" {
+		t.Fatal("Lookup(8.8.8.8) returned empty region")
+	}
+}
+
+func TestIPRegionResolverExternalPathFallsBackToEmbedWhenMissing(t *testing.T) {
+	resolver, err := NewIPRegionResolver("/path/not/exist/ip2region_v4.xdb", "/path/not/exist/ip2region_v6.xdb", nil)
+	if err != nil {
+		t.Fatalf("NewIPRegionResolver() error = %v", err)
+	}
+	defer resolver.Close()
+
+	if got := resolver.Lookup("8.8.8.8"); got == "" {
+		t.Fatal("Lookup(8.8.8.8) returned empty region")
+	}
+}