@fgbg/mdocs 0.6.0

package/dist/server/migrations/visitor-migration.service.js

@@ -0,0 +1,212 @@
+import fs from "node:fs";
+import path from "node:path";
+import { getConfig } from "../config/index.js";
+import { getDb } from "../db/connection.js";
+import { disableVisitor, findVisitorById, } from "../db/repositories/visitor.repo.js";
+import { findDomainById, insertDomain, deleteDomainRow, } from "../db/repositories/domain.repo.js";
+import { insertAuditLog, insertVisitorMigration, } from "../db/repositories/audit.repo.js";
+import { personalDomainDisplayName } from "../../shared/personalDomain.js";
+import { useLogger } from "../logger/logger.js";
+const log = useLogger("visitor-migration");
+/** 迁移过程中出现的自定义错误 */
+export class MigrationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/**
+ * 将源访客的数据迁移到目标访客，并在确认后禁用源访客。
+ * 如果 confirm 为 false，则仅执行预演（dry-run），返回影响统计但不修改数据。
+ *
+ * @param params.fromVisitorId - 源访客 ID
+ * @param params.toVisitorId - 目标访客 ID
+ * @param params.confirm - 是否真正执行迁移（true 执行，false 预演）
+ * @returns 迁移结果，包含影响统计与备份路径
+ */
+export function migrateVisitor(params) {
+    const db = getDb();
+    // 查询源访客和目标访客
+    const from = findVisitorById(db, params.fromVisitorId);
+    const to = findVisitorById(db, params.toVisitorId);
+    // 校验双方访客是否存在且状态合法
+    if (!from)
+        throw new MigrationError("FROM_NOT_FOUND", `from visitor ${params.fromVisitorId} not found`);
+    if (!to)
+        throw new MigrationError("TO_NOT_FOUND", `to visitor ${params.toVisitorId} not found`);
+    if (from.visitor_id === to.visitor_id) {
+        throw new MigrationError("SAME_VISITOR", "from and to visitors are the same");
+    }
+    if (from.disabled_at) {
+        throw new MigrationError("FROM_DISABLED", "from visitor is already disabled");
+    }
+    if (to.disabled_at) {
+        throw new MigrationError("TO_DISABLED", "to visitor is disabled");
+    }
+    // 计算源访客在当前系统中拥有的各类资源数量
+    const impact = computeImpact(db, from.visitor_id);
+    // 若未确认，则返回预演结果，不做任何数据修改
+    if (!params.confirm) {
+        return { dryRun: true, from, to, impact, backupPath: null };
+    }
+    // 正式执行前先备份数据库文件
+    const backupPath = backupDatabase();
+    const executedAt = new Date().toISOString();
+    const cfg = getConfig();
+    // 在数据库事务中原子化完成所有数据迁移与日志记录
+    const tx = db.transaction(() => {
+        // ---- 1. 转移个人域 ----
+        const fromDomain = findDomainById(db, from.visitor_id);
+        if (fromDomain) {
+            // 确保目标访客也有个人域
+            const toDomain = findDomainById(db, to.visitor_id);
+            if (!toDomain) {
+                const now = new Date().toISOString();
+                insertDomain(db, {
+                    domainId: to.visitor_id,
+                    domainName: personalDomainDisplayName(to.visitor_name),
+                    creatorVisitorId: to.visitor_id,
+                    createdAt: now,
+                    updatedAt: now,
+                    permission: "private",
+                });
+            }
+            // 将旧个人域下的文档迁移到新个人域
+            const personalDocCount = db
+                .prepare(`SELECT COUNT(*) AS c FROM documents WHERE domain_id = ?`)
+                .get(from.visitor_id)?.c ?? 0;
+            if (personalDocCount > 0) {
+                db.prepare(`UPDATE documents SET domain_id = ? WHERE domain_id = ?`).run(to.visitor_id, from.visitor_id);
+            }
+            // 删除旧个人域
+            deleteDomainRow(db, from.visitor_id);
+        }
+        // ---- 2. 转移所有权 ----
+        db.prepare(`UPDATE documents SET owner_visitor_id = ? WHERE owner_visitor_id = ?`).run(to.visitor_id, from.visitor_id);
+        db.prepare(`UPDATE documents SET created_by = ? WHERE created_by = ?`).run(to.visitor_id, from.visitor_id);
+        db.prepare(`UPDATE documents SET updated_by = ? WHERE updated_by = ?`).run(to.visitor_id, from.visitor_id);
+        db.prepare(`UPDATE attachments SET owner_visitor_id = ? WHERE owner_visitor_id = ?`).run(to.visitor_id, from.visitor_id);
+        // ---- 3. 转移域创建者身份 ----
+        db.prepare(`UPDATE domains SET creator_visitor_id = ? WHERE creator_visitor_id = ?`).run(to.visitor_id, from.visitor_id);
+        // ---- 4. 转移域成员身份（旧访客曾是哪些域的成员） ----
+        db.prepare(`UPDATE domain_members SET visitor_id = ? WHERE visitor_id = ?`).run(to.visitor_id, from.visitor_id);
+        // ---- 5. 转移成员模板 ----
+        db.prepare(`UPDATE domain_member_templates SET create_visitor_id = ? WHERE create_visitor_id = ?`).run(to.visitor_id, from.visitor_id);
+        // ---- 6. 转移文档邀请 ----
+        db.prepare(`UPDATE document_invites SET visitor_id = ? WHERE visitor_id = ?`).run(to.visitor_id, from.visitor_id);
+        // ---- 7. 吊销旧访客的 CLI Token ----
+        db.prepare(`UPDATE cli_tokens SET revoked = 1 WHERE visitor_id = ? AND revoked = 0`).run(from.visitor_id);
+        // 禁用源访客并标记其合并目标
+        disableVisitor(db, from.visitor_id, to.visitor_id, executedAt);
+        // 记录迁移日志
+        insertVisitorMigration(db, {
+            fromVisitorId: from.visitor_id,
+            toVisitorId: to.visitor_id,
+            affectedCounts: impact,
+            executedAt,
+        });
+        // 记录审计日志
+        insertAuditLog(db, {
+            actorVisitorId: null,
+            action: "visitor.migrate",
+            targetType: "visitor",
+            targetId: from.visitor_id,
+            metadata: {
+                fromVisitorId: from.visitor_id,
+                toVisitorId: to.visitor_id,
+                impact,
+                backupPath,
+            },
+            createdAt: executedAt,
+        });
+    });
+    tx();
+    // ---- 8. 搬物理文件（事务外执行，避免事务内 IO 耗时） ----
+    const fromDocDir = path.resolve(cfg.docsDir, from.visitor_id);
+    const toDocDir = path.resolve(cfg.docsDir, to.visitor_id);
+    if (fs.existsSync(fromDocDir)) {
+        // 确保目标目录存在
+        fs.mkdirSync(toDocDir, { recursive: true, mode: 0o700 });
+        // 逐个搬文件（保留文件属性）
+        const entries = fs.readdirSync(fromDocDir);
+        let moved = 0;
+        for (const entry of entries) {
+            const src = path.join(fromDocDir, entry);
+            const dst = path.join(toDocDir, entry);
+            // 如果目标已存在同名文件，跳过（避免覆盖）
+            if (!fs.existsSync(dst)) {
+                fs.renameSync(src, dst);
+                moved++;
+            }
+            else {
+                log.warn("file exists at target, skipping: %s", entry);
+            }
+        }
+        // 删除空的原目录
+        if (fs.readdirSync(fromDocDir).length === 0) {
+            fs.rmdirSync(fromDocDir);
+        }
+        else {
+            log.warn("source personal domain dir not empty after migration: %s", fromDocDir);
+        }
+    }
+    log.info("migrated visitor %s -> %s (personal domain: %d docs, %d files moved)", from.visitor_id, to.visitor_id, impact.personal_domain_docs, impact.personal_domain_files_moved);
+    return { dryRun: false, from, to, impact, backupPath };
+}
+/**
+ * 计算源访客在系统中关联的各类数据数量。
+ */
+function computeImpact(db, fromVisitorId) {
+    const one = (sql) => {
+        const row = db
+            .prepare(sql)
+            .get(fromVisitorId);
+        return row?.c ?? 0;
+    };
+    return {
+        documents_owner: one(`SELECT COUNT(*) AS c FROM documents WHERE owner_visitor_id = ?`),
+        documents_created_by: one(`SELECT COUNT(*) AS c FROM documents WHERE created_by = ?`),
+        documents_updated_by: one(`SELECT COUNT(*) AS c FROM documents WHERE updated_by = ?`),
+        attachments_owner: one(`SELECT COUNT(*) AS c FROM attachments WHERE owner_visitor_id = ?`),
+        personal_domain_docs: one(`SELECT COUNT(*) AS c FROM documents WHERE domain_id = ?`),
+        personal_domain_files_moved: hasPersonalDomainDir(fromVisitorId) ? countFilesInPersonalDomain(fromVisitorId) : 0,
+    };
+}
+/**
+ * 检查源访客的个人域在磁盘上是否有目录。
+ */
+function hasPersonalDomainDir(visitorId) {
+    const cfg = getConfig();
+    const dir = path.resolve(cfg.docsDir, visitorId);
+    return fs.existsSync(dir);
+}
+/**
+ * 统计个人域目录下的文件数量（不含子目录）。
+ */
+function countFilesInPersonalDomain(visitorId) {
+    const cfg = getConfig();
+    const dir = path.resolve(cfg.docsDir, visitorId);
+    if (!fs.existsSync(dir))
+        return 0;
+    return fs.readdirSync(dir).filter((e) => {
+        try {
+            return fs.statSync(path.join(dir, e)).isFile();
+        }
+        catch {
+            return false;
+        }
+    }).length;
+}
+/**
+ * 备份当前数据库文件到同级目录，文件名带时间戳。
+ */
+function backupDatabase() {
+    const cfg = getConfig();
+    const dir = path.dirname(cfg.dbFile);
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const target = path.join(dir, `data.sqlite.backup-${ts}`);
+    fs.copyFileSync(cfg.dbFile, target);
+    return target;
+}
+//# sourceMappingURL=visitor-migration.service.js.map

package/dist/server/migrations/visitor-migration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visitor-migration.service.js","sourceRoot":"","sources":["../../../src/server/migrations/visitor-migration.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EACL,cAAc,EACd,eAAe,GAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,GAAG,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAqB3C,oBAAoB;AACpB,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAI9B;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,aAAa;IACb,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAEnD,kBAAkB;IAClB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,gBAAgB,MAAM,CAAC,aAAa,YAAY,CAAC,CAAC;IACxG,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,cAAc,MAAM,CAAC,WAAW,YAAY,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;IACpE,CAAC;IAED,uBAAuB;IACvB,MAAM,MAAM,GAAoB,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAEnE,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,gBAAgB;IAChB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IAExB,0BAA0B;IAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAC7B,qBAAqB;QACrB,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC;YACf,cAAc;YACd,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,YAAY,CAAC,EAAE,EAAE;oBACf,QAAQ,EAAE,EAAE,CAAC,UAAU;oBACvB,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC,YAAY,CAAC;oBACtD,gBAAgB,EAAE,EAAE,CAAC,UAAU;oBAC/B,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;oBACd,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,mBAAmB;YACnB,MAAM,gBAAgB,GAAG,EAAE;iBACxB,OAAO,CACN,yDAAyD,CAC1D;iBACA,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBACzB,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CACtE,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;YACJ,CAAC;YAED,SAAS;YACT,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QAED,qBAAqB;QACrB,EAAE,CAAC,OAAO,CAAC,sEAAsE,CAAC,CAAC,GAAG,CACpF,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,CACxE,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,CACxE,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CACtF,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,wBAAwB;QACxB,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CACtF,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,oCAAoC;QACpC,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAC7E,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,sBAAsB;QACtB,EAAE,CAAC,OAAO,CAAC,sFAAsF,CAAC,CAAC,GAAG,CACpG,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,sBAAsB;QACtB,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAC/E,EAAE,CAAC,UAAU,EACb,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,gCAAgC;QAChC,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CACtF,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,gBAAgB;QAChB,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAE/D,SAAS;QACT,sBAAsB,CAAC,EAAE,EAAE;YACzB,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,WAAW,EAAE,EAAE,CAAC,UAAU;YAC1B,cAAc,EAAE,MAA2C;YAC3D,UAAU;SACX,CAAC,CAAC;QACH,SAAS;QACT,cAAc,CAAC,EAAE,EAAE;YACjB,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,QAAQ,EAAE;gBACR,aAAa,EAAE,IAAI,CAAC,UAAU;gBAC9B,WAAW,EAAE,EAAE,CAAC,UAAU;gBAC1B,MAAM;gBACN,UAAU;aACX;YACD,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,EAAE,EAAE,CAAC;IAEL,wCAAwC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IAE1D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,WAAW;QACX,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,gBAAgB;QAChB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACvC,uBAAuB;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxB,KAAK,EAAE,CAAC;YACV,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,UAAU;QACV,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,UAAU,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,sEAAsE,EACtE,IAAI,CAAC,UAAU,EACf,EAAE,CAAC,UAAU,EACb,MAAM,CAAC,oBAAoB,EAC3B,MAAM,CAAC,2BAA2B,CACnC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,EAA4B,EAAE,aAAqB;IACxE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE;QAClC,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAwB,GAAG,CAAC;aACnC,GAAG,CAAC,aAAa,CAAC,CAAC;QACtB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,OAAO;QACL,eAAe,EAAE,GAAG,CAAC,gEAAgE,CAAC;QACtF,oBAAoB,EAAE,GAAG,CAAC,0DAA0D,CAAC;QACrF,oBAAoB,EAAE,GAAG,CAAC,0DAA0D,CAAC;QACrF,iBAAiB,EAAE,GAAG,CAAC,kEAAkE,CAAC;QAC1F,oBAAoB,EAAE,GAAG,CAAC,yDAAyD,CAAC;QACpF,2BAA2B,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;KACjH,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC,MAAM,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/assets.routes.js

@@ -0,0 +1,350 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { Router } from "express";
+import multer from "multer";
+import { getConfig } from "../config/index.js";
+import { getDb } from "../db/connection.js";
+import { findDocumentById } from "../db/repositories/document.repo.js";
+import { useLogger } from "../logger/logger.js";
+const log = useLogger("assets-route");
+// 单文件最大 12 MB
+const MAX_BYTES = 12 * 1024 * 1024;
+// 允许上传的图片扩展名白名单
+const ALLOWED_EXT = new Set([
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".webp",
+    ".svg",
+    ".ico",
+    ".bmp",
+    ".jfif",
+    ".pjpeg",
+]);
+// MIME 类型到扩展名的映射表
+const MIME_TO_EXT = {
+    "image/png": ".png",
+    "image/jpeg": ".jpg",
+    "image/gif": ".gif",
+    "image/webp": ".webp",
+    "image/svg+xml": ".svg",
+    "image/bmp": ".bmp",
+    "image/x-icon": ".ico",
+};
+// 资源文件名校验正则（UUID + 扩展名）
+const ASSET_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.[a-z0-9]+$/i;
+/**
+ * 构造 Vditor 上传成功的响应体。
+ * @param succMap - 原始文件名到公开路径的映射
+ * @returns Vditor 标准成功响应结构
+ */
+function vditorSuccess(succMap) {
+    return { msg: "", code: 0, data: { errFiles: [], succMap } };
+}
+/**
+ * 构造 Vditor 上传失败的响应体。
+ * @param msg - 错误信息
+ * @param status - HTTP 状态码
+ * @returns 包含状态码与响应体的对象
+ */
+function vditorError(msg, status = 400) {
+    return { status, body: { code: 1, msg, data: { errFiles: [], succMap: {} } } };
+}
+/** Paste / drop remote image URL: Vditor expects `data.originalURL` + `data.url` (not succMap). */
+/**
+ * 构造 Vditor 链接转图片成功的响应体。
+ * @param originalURL - 原始远程图片地址
+ * @param url - 转存后的本地公开地址
+ * @returns Vditor 标准成功响应结构
+ */
+function vditorLinkToImgOk(originalURL, url) {
+    return { msg: "", code: 0, data: { originalURL, url } };
+}
+/**
+ * 校验当前访客是否拥有指定文档，并返回规范化后的文档ID。
+ * @param req - Express 请求对象
+ * @param documentId - 文档ID（未知类型，需校验）
+ * @returns 规范化后的文档ID字符串
+ * @throws 未登录、参数缺失、文档不存在或无权限时抛出带 status 的 Error
+ */
+function assertDocumentOwner(req, documentId) {
+    if (!req.visitor) {
+        throw Object.assign(new Error("UNAUTHENTICATED"), { status: 401 });
+    }
+    if (typeof documentId !== "string" || !documentId.trim()) {
+        throw Object.assign(new Error("documentId is required"), { status: 400 });
+    }
+    const row = findDocumentById(getDb(), documentId.trim());
+    if (!row) {
+        throw Object.assign(new Error("document not found"), { status: 404 });
+    }
+    if (row.owner_visitor_id !== req.visitor.visitor_id) {
+        throw Object.assign(new Error("forbidden"), { status: 403 });
+    }
+    return documentId.trim();
+}
+/**
+ * 从 URL 中提取合法扩展名，若无法识别则默认返回 .png。
+ * @param u - URL 对象
+ * @returns 小写扩展名字符串
+ */
+function extFromUrl(u) {
+    const ext = path.extname(u.pathname).toLowerCase();
+    if (ALLOWED_EXT.has(ext))
+        return ext;
+    return ".png";
+}
+/**
+ * 判断主机名是否为内部/本地地址，防止 SSRF。
+ * @param hostname - 主机名字符串
+ * @returns 若为本地、内网或元数据地址则返回 true
+ */
+function isBlockedHost(hostname) {
+    const h = hostname.toLowerCase();
+    if (h === "localhost" || h.endsWith(".localhost"))
+        return true;
+    if (h === "0.0.0.0")
+        return true;
+    if (h.endsWith(".local"))
+        return true;
+    if (h === "metadata.google.internal")
+        return true;
+    // 匹配 IPv4 地址并判断是否为私有/保留段
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) {
+        const p = h.split(".").map((x) => Number(x));
+        if (p[0] === 10)
+            return true;
+        if (p[0] === 127)
+            return true;
+        if (p[0] === 0)
+            return true;
+        if (p[0] === 169 && p[1] === 254)
+            return true;
+        if (p[0] === 192 && p[1] === 168)
+            return true;
+        if (p[0] === 172 && p[1] >= 16 && p[1] <= 31)
+            return true;
+    }
+    return false;
+}
+/**
+ * 创建 multer 上传中间件实例。
+ * 配置存储目录、文件名生成、大小限制与文件类型过滤。
+ * @returns multer 实例
+ */
+function createUploader() {
+    const cfg = getConfig();
+    return multer({
+        storage: multer.diskStorage({
+            destination: (_req, _file, cb) => {
+                cb(null, cfg.assetsDir);
+            },
+            filename: (_req, file, cb) => {
+                const ext = path.extname(file.originalname).toLowerCase() || ".bin";
+                cb(null, `${crypto.randomUUID()}${ext}`);
+            },
+        }),
+        limits: { fileSize: MAX_BYTES, files: 24 },
+        fileFilter: (_req, file, cb) => {
+            const ext = path.extname(file.originalname).toLowerCase();
+            if (!ALLOWED_EXT.has(ext)) {
+                cb(new Error("unsupported file type"));
+                return;
+            }
+            if (file.mimetype && !file.mimetype.startsWith("image/")) {
+                cb(new Error("not an image"));
+                return;
+            }
+            cb(null, true);
+        },
+    });
+}
+/** Public GET /api/assets/:assetId — must be registered before auth middleware. */
+/**
+ * 提供公开的图片资源访问（GET /api/assets/:assetId）。
+ * 需在认证中间件之前注册，以支持无认证访问。
+ * @param req - Express 请求对象
+ * @param res - Express 响应对象
+ */
+export function serveAssetFile(req, res) {
+    const assetId = req.params.assetId;
+    // 校验资源ID格式，防止目录遍历
+    if (!assetId || !ASSET_ID_RE.test(assetId)) {
+        res.status(404).end();
+        return;
+    }
+    const cfg = getConfig();
+    const assetsRoot = path.resolve(cfg.assetsDir);
+    const abs = path.resolve(cfg.assetsDir, path.basename(assetId));
+    // 确保解析后的路径仍在资源根目录内
+    if (!abs.startsWith(assetsRoot + path.sep) && abs !== assetsRoot) {
+        res.status(404).end();
+        return;
+    }
+    if (!fs.existsSync(abs)) {
+        res.status(404).end();
+        return;
+    }
+    // 根据扩展名推断 Content-Type
+    const ext = path.extname(abs).toLowerCase();
+    const ct = ext === ".svg"
+        ? "image/svg+xml"
+        : ext === ".png"
+            ? "image/png"
+            : ext === ".jpg" || ext === ".jpeg" || ext === ".jfif" || ext === ".pjpeg"
+                ? "image/jpeg"
+                : ext === ".gif"
+                    ? "image/gif"
+                    : ext === ".webp"
+                        ? "image/webp"
+                        : ext === ".ico"
+                            ? "image/x-icon"
+                            : ext === ".bmp"
+                                ? "image/bmp"
+                                : "application/octet-stream";
+    res.setHeader("Content-Type", ct);
+    res.setHeader("Cache-Control", "public, max-age=86400, immutable");
+    fs.createReadStream(abs).pipe(res);
+}
+/** POST /upload and POST /link-to-img — mount at /api/assets after auth. */
+/**
+ * 构建资源上传相关路由（POST /upload 与 POST /link-to-img）。
+ * 需在认证中间件之后挂载于 /api/assets。
+ * @returns Express Router 实例
+ */
+export function buildAssetsUploadRouter() {
+    const upload = createUploader();
+    const router = Router();
+    /**
+     * POST /upload
+     * 批量上传图片资源。先校验文档归属权，再将文件保存并返回公开访问路径。
+     */
+    router.post("/upload", (req, res, next) => {
+        upload.array("file[]", 20)(req, res, (err) => {
+            if (err) {
+                res.status(400).json(vditorError(err instanceof Error ? err.message : "upload failed").body);
+                return;
+            }
+            next();
+        });
+    }, (req, res) => {
+        let docId;
+        try {
+            // 校验当前访客是否拥有该文档的操作权限
+            docId = assertDocumentOwner(req, req.body?.documentId);
+        }
+        catch (e) {
+            // 校验失败时清理已上传的临时文件
+            const files = req.files;
+            if (files) {
+                for (const f of files) {
+                    try {
+                        fs.unlinkSync(f.path);
+                    }
+                    catch {
+                        // ignore
+                    }
+                }
+            }
+            const err = e;
+            const ve = vditorError(err.message || "error", err.status ?? 400);
+            res.status(ve.status).json(ve.body);
+            return;
+        }
+        const files = req.files;
+        if (!files?.length) {
+            res.status(400).json(vditorError("no files").body);
+            return;
+        }
+        // 将每个上传文件的本地路径映射为公开访问路径
+        const succMap = {};
+        for (const f of files) {
+            const publicPath = `/api/assets/${path.basename(f.path)}`;
+            succMap[f.originalname || path.basename(f.path)] = publicPath;
+        }
+        log.info("upload ok visitor=%s doc=%s count=%d", req.visitor.visitor_id, docId, files.length);
+        res.json(vditorSuccess(succMap));
+    });
+    /**
+     * POST /link-to-img
+     * 远程图片转存：下载指定 URL 的图片到本地，并返回新的公开访问路径。
+     */
+    router.post("/link-to-img", async (req, res) => {
+        const q = typeof req.query.documentId === "string" ? req.query.documentId : "";
+        let docId;
+        try {
+            docId = assertDocumentOwner(req, q);
+        }
+        catch (e) {
+            const err = e;
+            const ve = vditorError(err.message || "error", err.status ?? 400);
+            res.status(ve.status).json(ve.body);
+            return;
+        }
+        const rawUrl = req.body?.url;
+        if (typeof rawUrl !== "string" || !rawUrl.trim()) {
+            res.status(400).json(vditorError("url is required").body);
+            return;
+        }
+        // 解析并校验 URL 格式与协议
+        let u;
+        try {
+            u = new URL(rawUrl.trim());
+        }
+        catch {
+            res.status(400).json(vditorError("invalid url").body);
+            return;
+        }
+        if (u.protocol !== "http:" && u.protocol !== "https:") {
+            res.status(400).json(vditorError("only http(s) urls").body);
+            return;
+        }
+        // 拦截本地/内网/元数据地址，防止 SSRF
+        if (isBlockedHost(u.hostname)) {
+            res.status(400).json(vditorError("url host is not allowed").body);
+            return;
+        }
+        try {
+            const r = await fetch(u.toString(), {
+                redirect: "follow",
+                headers: { "User-Agent": "mdocs-asset-fetch/1" },
+            });
+            if (!r.ok) {
+                res.status(400).json(vditorError(`fetch failed: ${r.status}`).body);
+                return;
+            }
+            const buf = Buffer.from(await r.arrayBuffer());
+            // 校验下载内容大小
+            if (buf.length > MAX_BYTES) {
+                res.status(400).json(vditorError("image too large").body);
+                return;
+            }
+            const ct = r.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
+            if (!ct.startsWith("image/")) {
+                res.status(400).json(vditorError("response is not an image").body);
+                return;
+            }
+            // 根据 Content-Type 或 URL 推断扩展名，并校验是否在白名单中
+            const ext = MIME_TO_EXT[ct] ?? extFromUrl(u);
+            if (!ALLOWED_EXT.has(ext)) {
+                res.status(400).json(vditorError("unsupported image type").body);
+                return;
+            }
+            const id = `${crypto.randomUUID()}${ext}`;
+            const cfg = getConfig();
+            const dest = path.join(cfg.assetsDir, id);
+            await fs.promises.writeFile(dest, buf);
+            const publicPath = `/api/assets/${id}`;
+            log.info("link-to-img ok visitor=%s doc=%s bytes=%d", req.visitor.visitor_id, docId, buf.length);
+            res.json(vditorLinkToImgOk(rawUrl.trim(), publicPath));
+        }
+        catch (e) {
+            log.warn("link-to-img failed: %s", e instanceof Error ? e.message : String(e));
+            res.status(400).json(vditorError("fetch failed").body);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=assets.routes.js.map

package/dist/server/routes/assets.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.routes.js","sourceRoot":"","sources":["../../../src/server/routes/assets.routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;AAEtC,cAAc;AACd,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,gBAAgB;AAChB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,kBAAkB;AAClB,MAAM,WAAW,GAA2B;IAC1C,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,OAAO;IACrB,eAAe,EAAE,MAAM;IACvB,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,MAAM;CACvB,CAAC;AAEF,wBAAwB;AACxB,MAAM,WAAW,GACf,uFAAuF,CAAC;AAE1F;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAA+B;IACpD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAc,EAAE,OAAO,EAAE,EAAE,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,MAAM,GAAG,GAAG;IAC5C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAc,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACtG,CAAC;AAED,mGAAmG;AACnG;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,WAAmB,EAAE,GAAW;IACzD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAAY,EAAE,UAAmB;IAC5D,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAM;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAC;IAClD,yBAAyB;IACzB,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC;YAC1B,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC/B,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YACD,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC;gBACpE,EAAE,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YAC3C,CAAC;SACF,CAAC;QACF,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1C,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,EAAE,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,kBAAkB;IAClB,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,mBAAmB;IACnB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,uBAAuB;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,EAAE,GACN,GAAG,KAAK,MAAM;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,GAAG,KAAK,MAAM;YACd,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ;gBACxE,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,GAAG,KAAK,MAAM;oBACd,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,GAAG,KAAK,OAAO;wBACf,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,GAAG,KAAK,MAAM;4BACd,CAAC,CAAC,cAAc;4BAChB,CAAC,CAAC,GAAG,KAAK,MAAM;gCACd,CAAC,CAAC,WAAW;gCACb,CAAC,CAAC,0BAA0B,CAAC;IAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACnE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,4EAA4E;AAC5E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,MAAM,CAAC,IAAI,CACT,SAAS,EACT,CAAC,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;QACpC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAY,EAAE,EAAE;YACpD,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,EACD,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChC,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,qBAAqB;YACrB,KAAK,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kBAAkB;YAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAA0C,CAAC;YAC7D,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,CAAgC,CAAC;YAC7C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAA0C,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,eAAe,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC;QAChE,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,OAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/F,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,CAAC,CACF,CAAC;IAEF;;;OAGG;IACH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,MAAM,CAAC,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAgC,CAAC;YAC7C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAI,GAAG,CAAC,IAA0B,EAAE,GAAG,CAAC;QACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,wBAAwB;QACxB,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAClC,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE;aACjD,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/C,WAAW;YACX,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACpF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,yCAAyC;YACzC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,eAAe,EAAE,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,CAAC,OAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAClG,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/routes/cli-tokens.routes.js

@@ -0,0 +1,73 @@
+import { Router } from "express";
+import { createCliToken, listCliTokens, revokeCliToken, } from "../identity/cli-token.service.js";
+/**
+ * 构建 CLI Token 管理路由。
+ *
+ * 包含以下接口：
+ * - POST /api/cli/tokens              创建新 Token（创建前吊销所有已有 Token）
+ * - GET  /api/cli/tokens              列出当前访客的所有 Token
+ * - DELETE /api/cli/tokens/:tokenId   吊销单个 Token
+ *
+ * 所有接口均需经过身份认证中间件。
+ */
+export function buildCliTokensRouter() {
+    const router = Router();
+    /**
+     * POST /api/cli/tokens
+     *
+     * 创建新的 CLI Token。
+     * 创建前会自动吊销该访客的所有已有 Token（确保同一时刻只有一个活跃 token）。
+     * 原始 token 仅在响应中返回一次，服务端只存储 SHA-256 hash。
+     */
+    router.post("/tokens", (req, res) => {
+        if (!req.visitor) {
+            res.status(401).json({ error: { code: "UNAUTHENTICATED", message: "no visitor" } });
+            return;
+        }
+        const body = (req.body ?? {});
+        const result = createCliToken({
+            visitorId: req.visitor.visitor_id,
+            name: typeof body.name === "string" ? body.name : undefined,
+        });
+        res.status(201).json({ data: result });
+    });
+    /**
+     * GET /api/cli/tokens
+     *
+     * 列出当前访客的所有 CLI Token（含已吊销的），按创建时间倒序排列。
+     * 返回值不包含 token_hash，避免泄露。
+     */
+    router.get("/tokens", (req, res) => {
+        if (!req.visitor) {
+            res.status(401).json({ error: { code: "UNAUTHENTICATED", message: "no visitor" } });
+            return;
+        }
+        const tokens = listCliTokens(req.visitor.visitor_id);
+        res.json({ data: tokens });
+    });
+    /**
+     * DELETE /api/cli/tokens/:tokenId
+     *
+     * 吊销指定的 CLI Token。
+     * 仅该 Token 的创建者可以吊销自己的 Token。
+     */
+    router.delete("/tokens/:tokenId", (req, res) => {
+        if (!req.visitor) {
+            res.status(401).json({ error: { code: "UNAUTHENTICATED", message: "no visitor" } });
+            return;
+        }
+        try {
+            revokeCliToken(req.visitor.visitor_id, req.params.tokenId);
+            res.status(204).end();
+        }
+        catch (err) {
+            if (err instanceof Error && err.message === "CLI token not found") {
+                res.status(404).json({ error: { code: "NOT_FOUND", message: "CLI token not found" } });
+                return;
+            }
+            res.status(500).json({ error: { code: "INTERNAL", message: "internal error" } });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=cli-tokens.routes.js.map