@gadmin2n/schematics 0.0.64 → 0.0.65

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/app.service.ts

@@ -1,8 +1,40 @@
-import { Injectable } from '@nestjs/common';
-import YuFuId, { GAdminTokenName } from './lib/yufuid';
+import { Inject, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import * as crypto from 'crypto';
+import { WINSTON_MODULE_PROVIDER } from 'nest-winston';
+import * as path from 'path';
+import { Logger } from 'winston';
+import TaihuId, { GAdminTokenName } from './lib/taihu';
 
 @Injectable()
 export class AppService {
+  private readonly externalPageSecretKey: string;
+  private readonly externalPageExpireSeconds: number;
+
+  constructor(
+    private readonly config: ConfigService,
+    @Inject(WINSTON_MODULE_PROVIDER) private readonly logger: Logger,
+  ) {
+    this.logger = this.logger.child({
+      file: path.basename(__filename),
+    });
+
+    // External Page 配置
+    this.externalPageSecretKey =
+      this.config.get<string>('EXTERNAL_PAGE_SECRET') ||
+      process.env.EXTERNAL_PAGE_SECRET ||
+      'change-this-secret-in-production';
+
+    this.externalPageExpireSeconds =
+      this.config.get<number>('EXTERNAL_PAGE_EXPIRE_SECONDS') || 300;
+
+    if (this.externalPageSecretKey === 'change-this-secret-in-production') {
+      this.logger.warn(
+        'external_page_secret_warning - 使用默认密钥，请在生产环境配置 EXTERNAL_PAGE_SECRET 环境变量',
+      );
+    }
+  }
+
   getHello(): string {
     return 'Hello World!';
   }
@@ -10,25 +42,26 @@ export class AppService {
   async loginCallback(req, res) {
     const { code, state } = req.query;
 
-    const tokenInfo = await YuFuId.getToken(code);
-    const userInfo = await YuFuId.getUserInfo(tokenInfo.access_token);
+    const tokenInfo = await TaihuId.getToken(code);
+    const userInfo = await TaihuId.getUserInfo(tokenInfo.access_token);
 
     const expiresIn = 7 * 24 * 3600;
     const { user_id, sub, name, email } = userInfo;
     const payload = { user_id, sub, name, email };
-    const token = await YuFuId.sign(payload, expiresIn);
+    const token = await TaihuId.sign(payload, expiresIn);
 
     // append token param for local development
-    const url = new URL(state);
-    if (url.port != '') {
-      url.searchParams.set(GAdminTokenName, token);
+    const redirectUrl = new URL(state);
+    const selfUrl = new URL(process.env.TAIHU_CALLBACK || '');
+    if (redirectUrl.hostname !== selfUrl.hostname) {
+      redirectUrl.searchParams.set(GAdminTokenName, token);
     }
 
     res.cookie(GAdminTokenName, token, {
       maxAge: expiresIn * 1000,
       httpOnly: false,
     });
-    res.status(302).redirect(url.toString());
+    res.status(302).redirect(redirectUrl.toString());
   }
 
   login(req, res) {
@@ -36,15 +69,121 @@ export class AppService {
 
     // TODO: verify redirect_url domain
 
-    const authorizeUrl = YuFuId.authorize(redirect_url, ui_locales);
+    const authorizeUrl = TaihuId.authorize(redirect_url, ui_locales);
     res.status(302).redirect(authorizeUrl);
   }
 
   logout(req, res) {
     const { redirect_url } = req.query;
 
-    const logoutUrl = YuFuId.logout(redirect_url);
-    res.cookie(GAdminTokenName);
+    const logoutUrl = TaihuId.logout(redirect_url);
+    res.cookie(GAdminTokenName, '', { maxAge: 0 });
     res.status(302).redirect(logoutUrl);
   }
+
+  // ============ External Page 功能 ============
+
+  /**
+   * 生成带签名的外部页面 URL
+   */
+  generateExternalPageSignedUrl(
+    domain: string,
+    pageCode: string,
+    userid: string,
+  ): { url: string; expiresIn: number } {
+    const timestamp = Date.now();
+    const data = `${domain}:${pageCode}:${userid}:${timestamp}`;
+
+    const signature = crypto
+      .createHmac('sha256', this.externalPageSecretKey)
+      .update(data)
+      .digest('hex');
+
+    let pagePath: string;
+    let pageQuery: string;
+
+    const queryIndex = pageCode.indexOf('?');
+    if (queryIndex !== -1) {
+      pagePath = pageCode.substring(0, queryIndex);
+      pageQuery = pageCode.substring(queryIndex + 1);
+    } else {
+      pagePath = pageCode;
+      pageQuery = '';
+    }
+
+    const signParams = `_t=${timestamp}&_s=${signature}&_u=${encodeURIComponent(
+      userid,
+    )}`;
+
+    let url: string;
+    if (pageQuery) {
+      url = `https://oit-erp-gtdr.woa.com/${domain}/${pagePath}?${pageQuery}&${signParams}`;
+    } else {
+      url = `https://oit-erp-gtdr.woa.com/${domain}/${pagePath}?${signParams}`;
+    }
+
+    this.logger.info(
+      `external_page_sign_url - 生成签名URL - domain: ${domain}, pageCode: ${pageCode}, userid: ${userid}`,
+    );
+
+    return {
+      url,
+      expiresIn: this.externalPageExpireSeconds,
+    };
+  }
+
+  /**
+   * 验证外部页面签名
+   */
+  verifyExternalPageSignature(
+    domain: string,
+    pageCode: string,
+    userid: string,
+    timestamp: string,
+    signature: string,
+  ): { valid: boolean; reason?: string } {
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) {
+      return { valid: false, reason: 'invalid timestamp format' };
+    }
+
+    const now = Date.now();
+    const age = now - ts;
+
+    if (age < -5000) {
+      return { valid: false, reason: 'timestamp in future' };
+    }
+
+    if (age > this.externalPageExpireSeconds * 1000) {
+      return { valid: false, reason: 'signature expired' };
+    }
+
+    const data = `${domain}:${pageCode}:${userid}:${timestamp}`;
+    const expectedSignature = crypto
+      .createHmac('sha256', this.externalPageSecretKey)
+      .update(data)
+      .digest('hex');
+
+    if (signature.length !== expectedSignature.length) {
+      return { valid: false, reason: 'invalid signature' };
+    }
+
+    try {
+      const signatureBuffer = Buffer.from(signature, 'hex');
+      const expectedBuffer = Buffer.from(expectedSignature, 'hex');
+
+      if (
+        !crypto.timingSafeEqual(
+          new Uint8Array(signatureBuffer),
+          new Uint8Array(expectedBuffer),
+        )
+      ) {
+        return { valid: false, reason: 'invalid signature' };
+      }
+    } catch {
+      return { valid: false, reason: 'invalid signature format' };
+    }
+
+    return { valid: true };
+  }
 }

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/auth.guard.ts

@@ -12,8 +12,15 @@ import {
 import { Reflector } from '@nestjs/core';
 import { ApiSecurity } from '@nestjs/swagger';
 import { DECORATORS_PREFIX } from '@nestjs/swagger/dist/constants';
+import * as path from 'path';
+import { UserService } from '../modules/user/user.service';
+import { loggerInstance } from './logger';
+import TaiHuId, { GAdminTokenName } from './taihu';
 import { getIdentity as getWoaIdentity } from './woaAuth';
-import YuFuId, { GAdminTokenName } from './yufuid';
+
+const logger = loggerInstance.child({
+  file: path.basename(__filename),
+});
 
 const API_SECURITY = `${DECORATORS_PREFIX}/apiSecurity`;
 export function ApiKeyAuth(name = 'X-API-KEY') {
@@ -25,83 +32,122 @@ export const AllowUnauthorizedRequest = () =>
 
 export const AllowApiKeyRequest = () => SetMetadata('allowApiKeyRequest', true);
 
-async function getIdentity(headers, cookies, key): Promise<UserType> {
-  // 先验证woa登录态
+async function getIdentity(headers, cookies): Promise<UserType> {
+  // 先验证woa登录态 https://iwiki.woa.com/p/4007728669#nodejs-%E7%A4%BA%E4%BE%8B
   try {
-    const { staffid, staffname } = await getWoaIdentity(headers, key);
+    const { staffid, staffname } = await getWoaIdentity(
+      headers,
+      process.env.TAIHU_APP_TOKEN || '',
+    );
     if (staffid) {
+      logger.info(
+        `woa_auth_success - 用户ID: ${staffid}, 用户名: ${staffname}`,
+      );
       return { userid: staffid, username: staffname };
     }
   } catch (e) {
-    console.warn('woa auth failed, try yufu auth...');
+    logger.warn(`woa_auth_failed - WOA认证失败: ${e.message}`);
   }
-  // 再验证玉符登录态
+
+  // 再验证taihu登录态 https://iwiki.woa.com/p/4008986665
   const token = headers[GAdminTokenName] || cookies[GAdminTokenName];
-  const userInfo = await YuFuId.verify(token);
-  console.log('yufu auth success', userInfo);
+  const userInfo = await TaiHuId.verify(token);
+
+  logger.info(
+    `taihu_auth_success - Taihu认证成功 - 用户ID: ${userInfo.sub}, Token长度: ${
+      token ? token.length : 0
+    }`,
+  );
+
   return { userid: userInfo.sub, username: userInfo.sub };
 }
 
-// apikey genertor https://codepen.io/corenominal/pen/rxOmMJ
-const API_KEYS = [
-  {
-    userid: 'steam_session',
-    username: 'steam_session',
-    apiKey: '9c5fc474-9e95-480b-b380-5e15f77b5f9f',
-  },
-];
-async function getApikeyIdentity(req): Promise<UserType> {
-  const apiKey = req.headers['x-api-key'] ?? req.query.api_key;
-  if (apiKey) {
-    for (const item of API_KEYS) {
-      if (item.apiKey === apiKey) {
-        console.log('apikey auth success:', item.userid);
-        return { userid: item.userid, username: item.username };
+@Injectable()
+export default class AuthGuard implements CanActivate {
+  constructor(private reflector: Reflector, private userService: UserService) {}
+
+  private async getApikeyIdentity(req): Promise<UserType> {
+    const apiKey = req.headers['x-api-key'] ?? req.query.api_key;
+
+    if (apiKey) {
+      const record = await this.userService.findByApiKey(apiKey);
+      if (record && record.isActive && record.isApiKey) {
+        logger.info(
+          `apikey_auth_success - API Key认证成功 - 用户ID: ${
+            record.userid
+          }, Key前缀: ${apiKey.substring(0, 8)}...`,
+        );
+        return {
+          userid: record.userid,
+          username: record.username || record.userid,
+        };
       }
     }
-  }
-  throw new UnauthorizedException(`error apikey: ${apiKey}`);
-}
 
-@Injectable()
-export default class AuthGuard implements CanActivate {
-  constructor(private readonly token: string, private reflector: Reflector) {}
+    logger.warn(
+      `apikey_auth_failed - API Key认证失败 - 提供的Key: ${
+        apiKey ? `${apiKey.substring(0, 8)}...` : 'none'
+      }`,
+    );
+
+    throw new UnauthorizedException(`error apikey: ${apiKey}`);
+  }
 
   canActivate(context: ExecutionContext): boolean | Promise<boolean> {
     const request = context.switchToHttp().getRequest();
+    const handler = context.getHandler();
+    const controller = context.getClass();
+
     const allowUnauthorizedRequest = this.reflector.get<boolean>(
       'allowUnauthorizedRequest',
-      context.getHandler(),
+      handler,
     );
+
     if (allowUnauthorizedRequest) {
+      logger.info(
+        `auth_bypassed - 认证被绕过 - 端点: ${request.method} ${request.url}, 控制器: ${controller.name}`,
+      );
       return true;
     }
 
-    const allowApiKeyRequest = this.reflector.get<boolean>(
-      API_SECURITY,
-      context.getHandler(),
+    const allowApiKeyRequest =
+      this.reflector.get<boolean>(API_SECURITY, handler) ||
+      this.reflector.get<boolean>('allowApiKeyRequest', handler);
+
+    logger.info(
+      `auth_attempt - 认证尝试 - 端点: ${request.method} ${
+        request.url
+      }, 控制器: ${controller.name}, 允许API Key: ${allowApiKeyRequest}, IP: ${
+        request.ip || request.connection.remoteAddress
+      }`,
     );
 
     return (
       allowApiKeyRequest
-        ? getApikeyIdentity(request)
+        ? this.getApikeyIdentity(request)
         : Promise.reject("don't allow api key request.")
     )
       .catch((error) => {
-        console.warn(error, 'try woa auth...');
-
-        return getIdentity(
-          request.headers,
-          request.cookies,
-          Buffer.from(this.token),
+        logger.warn(
+          `apikey_fallback - API Key认证失败，回退到WOA/Taihu认证 - 端点: ${request.method} ${request.url}, 错误: ${error.message}`,
         );
+
+        return getIdentity(request.headers, request.cookies);
       })
       .then((userInfo) => {
         request.user = userInfo;
+
+        logger.info(
+          `auth_success - 认证成功 - 用户ID: ${userInfo.userid}, 用户名: ${userInfo.username}, 端点: ${request.method} ${request.url}`,
+        );
+
         return true;
       })
       .catch((error) => {
-        console.error(error);
+        logger.error(
+          `auth_failed - 认证失败 - 端点: ${request.method} ${request.url}, 错误: ${error.message}`,
+        );
+
         throw new UnauthorizedException(error);
       });
   }

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/http-cache.interceptor.ts

@@ -0,0 +1,21 @@
+import { CacheInterceptor } from '@nestjs/cache-manager';
+import { ExecutionContext, Injectable } from '@nestjs/common';
+
+/**
+ * 扩展 CacheInterceptor，将 POST body 纳入 cache key，
+ * 避免不同参数的请求命中同一份缓存。
+ * cache key 格式：{url}:{JSON.stringify(body)}
+ */
+@Injectable()
+export class HttpCacheInterceptor extends CacheInterceptor {
+  trackBy(context: ExecutionContext): string | undefined {
+    const request = context.switchToHttp().getRequest();
+    const url = request.url as string;
+    const body = request.body;
+
+    const bodyKey =
+      body && Object.keys(body).length > 0 ? JSON.stringify(body) : '';
+
+    return bodyKey ? `${url}:${bodyKey}` : url;
+  }
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/logger.ts

@@ -0,0 +1,19 @@
+import * as winston from 'winston';
+
+export const LogFormat = winston.format.combine(
+  winston.format.splat(),
+  winston.format.timestamp({
+    format: 'YYYY-MM-DD HH:mm:ss.SSS',
+  }),
+  winston.format.errors({ stack: true }),
+  winston.format.json(),
+);
+
+export const loggerInstance = winston.createLogger({
+  level: 'info',
+  transports: [
+    new winston.transports.Console({
+      format: LogFormat,
+    }),
+  ],
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/safe-log.util.ts

@@ -0,0 +1,176 @@
+/**
+ * Safe logging utility to prevent circular structure errors and limit log size
+ */
+
+const MAX_LOG_SIZE = 10000; // Maximum characters for a single log field
+const MAX_ARRAY_ITEMS = 50; // Maximum array items to log
+
+/**
+ * Safely stringify an object, handling circular references and limiting size
+ * @param obj The object to stringify
+ * @param maxDepth Maximum depth to traverse
+ * @returns Safe string representation
+ */
+export function safeStringify(obj: any, maxDepth = 3): string {
+  const seen = new WeakSet();
+
+  const stringify = (value: any, depth: number): any => {
+    // Handle null and undefined
+    if (value === null) return null;
+    if (value === undefined) return undefined;
+
+    // Handle primitives
+    if (typeof value !== 'object') {
+      return value;
+    }
+
+    // Check for circular reference
+    if (seen.has(value)) {
+      return '[Circular]';
+    }
+
+    // Check depth limit
+    if (depth >= maxDepth) {
+      return '[Max Depth Reached]';
+    }
+
+    seen.add(value);
+
+    try {
+      // Handle Date
+      if (value instanceof Date) {
+        return value.toISOString();
+      }
+
+      // Handle Array
+      if (Array.isArray(value)) {
+        const items = value
+          .slice(0, MAX_ARRAY_ITEMS)
+          .map((item) => stringify(item, depth + 1));
+        if (value.length > MAX_ARRAY_ITEMS) {
+          items.push(`[... ${value.length - MAX_ARRAY_ITEMS} more items]`);
+        }
+        return items;
+      }
+
+      // Handle plain objects
+      const result: any = {};
+      const keys = Object.keys(value);
+
+      for (const key of keys) {
+        try {
+          result[key] = stringify(value[key], depth + 1);
+        } catch (error) {
+          result[key] = '[Error stringifying]';
+        }
+      }
+
+      return result;
+    } finally {
+      seen.delete(value);
+    }
+  };
+
+  try {
+    const safeObj = stringify(obj, 0);
+    const str = JSON.stringify(safeObj);
+
+    // Limit total size
+    if (str.length > MAX_LOG_SIZE) {
+      return (
+        str.substring(0, MAX_LOG_SIZE) +
+        `... [truncated ${str.length - MAX_LOG_SIZE} chars]`
+      );
+    }
+
+    return str;
+  } catch (error) {
+    return `[Error: ${error.message}]`;
+  }
+}
+
+/**
+ * Create a safe log object that can be passed to logger
+ * @param data The data to log
+ * @returns Safe log object
+ */
+export function createSafeLogData(
+  data: Record<string, any>,
+): Record<string, any> {
+  const safeData: Record<string, any> = {
+    __ROLE_PAGE_RESOURCE__: true, // Unified field for production log collection
+  };
+
+  for (const [key, value] of Object.entries(data)) {
+    try {
+      // For simple types, use directly
+      if (
+        value === null ||
+        value === undefined ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean'
+      ) {
+        safeData[key] = value;
+      } else {
+        // For complex types, use safe stringify
+        const stringified = safeStringify(value);
+        try {
+          // Try to parse back to object for better log formatting
+          safeData[key] = JSON.parse(stringified);
+        } catch {
+          // If parse fails, use the string
+          safeData[key] = stringified;
+        }
+      }
+    } catch (error) {
+      safeData[key] = `[Error processing ${key}]`;
+    }
+  }
+
+  return safeData;
+}
+
+/**
+ * Extract only essential fields from database records for logging
+ * @param record Database record
+ * @param essentialFields Fields to include (defaults to common fields)
+ * @returns Simplified record
+ */
+export function extractEssentialFields(
+  record: any,
+  essentialFields?: string[],
+): any {
+  if (!record) return record;
+
+  const defaultFields = [
+    'id',
+    'name',
+    'code',
+    'type',
+    'status',
+    'createdAt',
+    'updatedAt',
+  ];
+  const fields = essentialFields || defaultFields;
+
+  if (Array.isArray(record)) {
+    return record.map((item) => extractEssentialFields(item, essentialFields));
+  }
+
+  if (typeof record === 'object') {
+    const result: any = {};
+    for (const field of fields) {
+      if (field in record) {
+        result[field] = record[field];
+      }
+    }
+    // Always include id if exists
+    if ('id' in record && !result.id) {
+      result.id = record.id;
+    }
+    return result;
+  }
+
+  return record;
+}