Add Volcengine Cloud Security Center service

[632661265flynn-dotcom]

Summary

• Add a Volcengine Cloud Security Center (seccenter) OctoBus service package.
• Implement Volcengine OpenAPI V4 signing and read-only RPCs for host assets, vulnerabilities, HIDS alarms, baselines, cloud/container assets, and SOC asset statistics.
• Register the service in the tentacles dispatcher and package metadata.
• Add unit coverage for signing, protobuf Struct payload normalization, read-only action validation, response conversion, and error mapping.

Fixes #274

Tests

• npm run validate -- --service-dir volcengine__seccenter
• npm test -- --service-dir volcengine__seccenter
• npm run import:check
• npm run pack:check

Live check

Using temporary environment variables only, representative read-only actions reached the Volcengine Cloud Security Center business API and returned OperationDenied.TenantUnauthorized / tenant not found for the test account. This indicates the endpoint, service code, API version, and request signing path are working, but the account is not authorized/enrolled for this product tenant.

Live verification status: blocked by product tenant authorization

I could not provide a successful business response for this account because the Volcengine Cloud Security Center tenant is not authorized/enrolled for the tested account. The request still reached the documented product API endpoint and returned a product-level authorization error, which verifies the endpoint, service code, API version, Action routing, and request signing path.

Reference documentation:

• Cloud Security Center API reference: https://www.volcengine.com/docs/6507/1407727
• Example Cloud Security Center API error-code page documenting OperationDenied.TenantUnauthorized(%s): https://www.volcengine.com/docs/6507/1526316?lang=zh
• Cloud Security Center service access guide: https://www.volcengine.com/docs/6507/80646

联调阻塞证据：ListAssetGroups 到达业务 API，但账号租户未授权

Request

POST https://seccenter.volcengineapi.com/?Action=ListAssetGroups&Version=2024-05-08
Authorization: HMAC-SHA256 Credential=AKLTlZjk/20260625/cn-beijing/seccenter/request, SignedHeaders=content-type;host;x-content-sha256;x-date, Signature=**
Content-Type: application/json
Host: seccenter.volcengineapi.com
X-Date: 20260625T192149Z
X-Content-Sha256: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

{}

Response HTTP/1.1 403 Forbidden

{
"ResponseMetadata": {
"RequestId": "20260626032149774A6474BDB9845F3526",
"Action": "ListAssetGroups",
"Version": "2024-05-08",
"Service": "seccenter",
"Region": "cn-beijing",
"Error": {
"Code": "OperationDenied.TenantUnauthorized%!(EXTRA string=(2121953146))",
"Message": "The request has failed due to tenant not found(2121953146)"
}
}
}

Additional entitlement checks

The same signed request path was also checked with other read-only Cloud Security Center APIs and returned the same tenant authorization block:

• ListCloudPlatforms -> HTTP 403 OperationDenied.TenantUnauthorized
• MultiCloudAccessSyncStatus -> HTTP 403 OperationDenied.TenantUnauthorized

This is different from a signing, endpoint, or Action mismatch. If the signature, service code, API version, or endpoint were wrong, the gateway would return authentication/signature/route errors instead of a Cloud Security Center tenant authorization error with Service: seccenter and the requested Action echoed in ResponseMetadata.

Review follow-up

Addressed the adapter review feedback in follow-up commits:

• Use AbortController-backed fetch timeouts and map aborts to DEADLINE_EXCEEDED.
• Keep the timeout active through response body parsing so slow or stalled bodies cannot hang handlers.
• Reject nested GET query parameter values before signing/building URLs.
• Add regression coverage for body-stream aborts raised via the fetch signal.
• Replace deprecated global escape() in Volcengine URI signing with RFC3986-safe encodeURIComponent handling.

Validation run for volcengine__seccenter:

• npm test -- --service-dir volcengine__seccenter
• npm run validate -- --service-dir volcengine__seccenter
• git diff --check

API documentation coverage follow-up:

• Expanded the Volcengine Cloud Security Center proto/API allowlist with the documented safe read-only actions for assets, risks, baselines, vulnerabilities, alarms, containers, cloud assets, and statistics; excluded install commands, downloads/exports, quota/commercial, and sync-mutating actions.
• Re-ran npm test -- --service-dir volcengine__seccenter, npm run validate -- --service-dir volcengine__seccenter, and git diff --check.

[monkeyscan]

本次 PR 新增了一个 Volcengine Cloud Security Center 的 OctoBus 服务，包含完整的 gRPC 接口定义、服务配置、请求签名与调用逻辑及单元测试。主要变更包括：新增 proto 定义、config/secret JSON Schema、核心实现（volcengine-seccenter.js）、服务入口、测试用例，以及在父级 package.json 和 tentacles 注册表中注册该服务。

整体代码质量较高，测试覆盖较全面，签名逻辑基于 Volcengine 的 HMAC-SHA256 实现。但在 uriEscape 函数中使用了已弃用的全局函数 escape，该部分代码在当前路径下虽不会触发实际调用（属于死代码），但存在以下具体风险：未来 Node.js 主版本可能移除 escape 全局函数，届时即便该替换逻辑从未命中，JavaScript 引擎在解析函数引用时就会抛出 ReferenceError，导致服务直接崩溃。此外，该代码容易误导维护者认为 escape 是有效的编码手段，存在引入非 ASCII 字符编码错误的安全隐患。

[monkeyscan]

本次 PR 对 Volcengine Cloud Security Center 适配器进行了三处主要修改：

1. 修复 uriEscape 中引用已废弃全局 escape 的问题，改为显式编码 !'()*，同时修复了非 ASCII 字符（如中文）会被 escape 错误编码为 %uXXXX 的缺陷。
2. 为 GET 查询参数新增 assertQueryParamValue 校验，禁止嵌套对象进入查询字符串，防止出现 [object Object]。
3. 将 fetch 的超时机制从非标准的 timeoutMs 选项迁移为标准 AbortController + setTimeout，并在 gRPC 错误映射中新增 DEADLINE_EXCEEDED，使得超时请求能正确抛出 DEADLINE_EXCEEDED 而非 UNAVAILABLE。

整体代码逻辑正确，修复了历史缺陷，但测试中对新的 AbortController 超时链路缺少回归验证，仅检查了 signal 属性存在性，存在测试缺口。

[monkeyscan]

本次变更将 parseVolcengineResponse(res) 移入 try 块内，使得在读取响应体时发生的 AbortError/TimeoutError 也能被统一捕获并映射为 DEADLINE_EXCEEDED。同时新增了 err.legacyCode 检查以避免对已由 errorWithCode 包装过的错误进行二次包裹。测试文件补充了 TimeoutError 和 body stream AbortError 两个场景的断言。整体逻辑正确，未发现明显缺陷。

[monkeyscan]

本次 PR 为 Volcengine Cloud Security Center 服务大幅扩展了只读适配器 API 覆盖范围。变更内容主要包括：

1. proto 文件：在 Volcengine_Seccenter 服务中新增了约 184 个只读 RPC 方法声明（均为 Get/List/Describe 类型），统一返回 VolcengineResponse。
2. JS 实现文件：在 READ_ONLY_ACTIONS 数组中对应新增了相同数量的 method-to-action 映射条目，与 proto 定义保持一一对应。
3. 测试文件：在 action 名称验证测试中新增了对 GetSecurityOverview 的断言，其余新增动作已通过既有循环测试覆盖。

所有新增 API 均为只读操作，不存在状态修改风险。proto 定义与 JS 实现之间的动作映射保持一致，未引入行为回归。整体评估为低风险的 API 覆盖面扩展，代码质量良好。