@gadmin2n/schematics 0.0.69 → 0.0.71

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/app.service.ts

@@ -0,0 +1,189 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import * as crypto from 'crypto';
+import { WINSTON_MODULE_PROVIDER } from 'nest-winston';
+import * as path from 'path';
+import { Logger } from 'winston';
+import TaihuId, { GAdminTokenName } from './lib/taihu';
+
+@Injectable()
+export class AppService {
+  private readonly externalPageSecretKey: string;
+  private readonly externalPageExpireSeconds: number;
+
+  constructor(
+    private readonly config: ConfigService,
+    @Inject(WINSTON_MODULE_PROVIDER) private readonly logger: Logger,
+  ) {
+    this.logger = this.logger.child({
+      file: path.basename(__filename),
+    });
+
+    // External Page 配置
+    this.externalPageSecretKey =
+      this.config.get<string>('EXTERNAL_PAGE_SECRET') ||
+      process.env.EXTERNAL_PAGE_SECRET ||
+      'change-this-secret-in-production';
+
+    this.externalPageExpireSeconds =
+      this.config.get<number>('EXTERNAL_PAGE_EXPIRE_SECONDS') || 300;
+
+    if (this.externalPageSecretKey === 'change-this-secret-in-production') {
+      this.logger.warn(
+        'external_page_secret_warning - 使用默认密钥，请在生产环境配置 EXTERNAL_PAGE_SECRET 环境变量',
+      );
+    }
+  }
+
+  getHello(): string {
+    return 'Hello World!';
+  }
+
+  async loginCallback(req, res) {
+    const { code, state } = req.query;
+
+    const tokenInfo = await TaihuId.getToken(code);
+    const userInfo = await TaihuId.getUserInfo(tokenInfo.access_token);
+
+    const expiresIn = 7 * 24 * 3600;
+    const { user_id, sub, name, email } = userInfo;
+    const payload = { user_id, sub, name, email };
+    const token = await TaihuId.sign(payload, expiresIn);
+
+    // append token param for local development
+    const redirectUrl = new URL(state);
+    const selfUrl = new URL(process.env.TAIHU_CALLBACK || '');
+    if (redirectUrl.hostname !== selfUrl.hostname) {
+      redirectUrl.searchParams.set(GAdminTokenName, token);
+    }
+
+    res.cookie(GAdminTokenName, token, {
+      maxAge: expiresIn * 1000,
+      httpOnly: false,
+    });
+    res.status(302).redirect(redirectUrl.toString());
+  }
+
+  login(req, res) {
+    const { redirect_url, ui_locales = 'zh-CN' } = req.query;
+
+    // TODO: verify redirect_url domain
+
+    const authorizeUrl = TaihuId.authorize(redirect_url, ui_locales);
+    res.status(302).redirect(authorizeUrl);
+  }
+
+  logout(req, res) {
+    const { redirect_url } = req.query;
+
+    const logoutUrl = TaihuId.logout(redirect_url);
+    res.cookie(GAdminTokenName, '', { maxAge: 0 });
+    res.status(302).redirect(logoutUrl);
+  }
+
+  // ============ External Page 功能 ============
+
+  /**
+   * 生成带签名的外部页面 URL
+   */
+  generateExternalPageSignedUrl(
+    domain: string,
+    pageCode: string,
+    userid: string,
+  ): { url: string; expiresIn: number } {
+    const timestamp = Date.now();
+    const data = `${domain}:${pageCode}:${userid}:${timestamp}`;
+
+    const signature = crypto
+      .createHmac('sha256', this.externalPageSecretKey)
+      .update(data)
+      .digest('hex');
+
+    let pagePath: string;
+    let pageQuery: string;
+
+    const queryIndex = pageCode.indexOf('?');
+    if (queryIndex !== -1) {
+      pagePath = pageCode.substring(0, queryIndex);
+      pageQuery = pageCode.substring(queryIndex + 1);
+    } else {
+      pagePath = pageCode;
+      pageQuery = '';
+    }
+
+    const signParams = `_t=${timestamp}&_s=${signature}&_u=${encodeURIComponent(
+      userid,
+    )}`;
+
+    let url: string;
+    if (pageQuery) {
+      url = `https://oit-erp-gtdr.woa.com/${domain}/${pagePath}?${pageQuery}&${signParams}`;
+    } else {
+      url = `https://oit-erp-gtdr.woa.com/${domain}/${pagePath}?${signParams}`;
+    }
+
+    this.logger.info(
+      `external_page_sign_url - 生成签名URL - domain: ${domain}, pageCode: ${pageCode}, userid: ${userid}`,
+    );
+
+    return {
+      url,
+      expiresIn: this.externalPageExpireSeconds,
+    };
+  }
+
+  /**
+   * 验证外部页面签名
+   */
+  verifyExternalPageSignature(
+    domain: string,
+    pageCode: string,
+    userid: string,
+    timestamp: string,
+    signature: string,
+  ): { valid: boolean; reason?: string } {
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) {
+      return { valid: false, reason: 'invalid timestamp format' };
+    }
+
+    const now = Date.now();
+    const age = now - ts;
+
+    if (age < -5000) {
+      return { valid: false, reason: 'timestamp in future' };
+    }
+
+    if (age > this.externalPageExpireSeconds * 1000) {
+      return { valid: false, reason: 'signature expired' };
+    }
+
+    const data = `${domain}:${pageCode}:${userid}:${timestamp}`;
+    const expectedSignature = crypto
+      .createHmac('sha256', this.externalPageSecretKey)
+      .update(data)
+      .digest('hex');
+
+    if (signature.length !== expectedSignature.length) {
+      return { valid: false, reason: 'invalid signature' };
+    }
+
+    try {
+      const signatureBuffer = Buffer.from(signature, 'hex');
+      const expectedBuffer = Buffer.from(expectedSignature, 'hex');
+
+      if (
+        !crypto.timingSafeEqual(
+          new Uint8Array(signatureBuffer),
+          new Uint8Array(expectedBuffer),
+        )
+      ) {
+        return { valid: false, reason: 'invalid signature' };
+      }
+    } catch {
+      return { valid: false, reason: 'invalid signature format' };
+    }
+
+    return { valid: true };
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/auth.guard.ts

@@ -0,0 +1,154 @@
+// https://iwiki.woa.com/pages/viewpage.action?pageId=4007728669
+// node version >= v12.22
+// npm i jose@4.14.4
+import { UserType } from '@gadmin2n/nest-common';
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  SetMetadata,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ApiSecurity } from '@nestjs/swagger';
+import { DECORATORS_PREFIX } from '@nestjs/swagger/dist/constants';
+import * as path from 'path';
+import { UserService } from '../modules/user/user.service';
+import { loggerInstance } from './logger';
+import TaiHuId, { GAdminTokenName } from './taihu';
+import { getIdentity as getWoaIdentity } from './woaAuth';
+
+const logger = loggerInstance.child({
+  file: path.basename(__filename),
+});
+
+const API_SECURITY = `${DECORATORS_PREFIX}/apiSecurity`;
+export function ApiKeyAuth(name = 'X-API-KEY') {
+  return ApiSecurity(name);
+}
+
+export const AllowUnauthorizedRequest = () =>
+  SetMetadata('allowUnauthorizedRequest', true);
+
+export const AllowApiKeyRequest = () => SetMetadata('allowApiKeyRequest', true);
+
+async function getIdentity(headers, cookies): Promise<UserType> {
+  // 先验证woa登录态 https://iwiki.woa.com/p/4007728669#nodejs-%E7%A4%BA%E4%BE%8B
+  try {
+    const { staffid, staffname } = await getWoaIdentity(
+      headers,
+      process.env.TAIHU_APP_TOKEN || '',
+    );
+    if (staffid) {
+      logger.info(
+        `woa_auth_success - 用户ID: ${staffid}, 用户名: ${staffname}`,
+      );
+      return { userid: staffid, username: staffname };
+    }
+  } catch (e) {
+    logger.warn(`woa_auth_failed - WOA认证失败: ${e.message}`);
+  }
+
+  // 再验证taihu登录态 https://iwiki.woa.com/p/4008986665
+  const token = headers[GAdminTokenName] || cookies[GAdminTokenName];
+  const userInfo = await TaiHuId.verify(token);
+
+  logger.info(
+    `taihu_auth_success - Taihu认证成功 - 用户ID: ${userInfo.sub}, Token长度: ${
+      token ? token.length : 0
+    }`,
+  );
+
+  return { userid: userInfo.sub, username: userInfo.sub };
+}
+
+@Injectable()
+export default class AuthGuard implements CanActivate {
+  constructor(private reflector: Reflector, private userService: UserService) {}
+
+  private async getApikeyIdentity(req): Promise<UserType> {
+    const apiKey = req.headers['x-api-key'] ?? req.query.api_key;
+
+    if (apiKey) {
+      const record = await this.userService.findByApiKey(apiKey);
+      if (record && record.isActive && record.isApiKey) {
+        logger.info(
+          `apikey_auth_success - API Key认证成功 - 用户ID: ${
+            record.userid
+          }, Key前缀: ${apiKey.substring(0, 8)}...`,
+        );
+        return {
+          userid: record.userid,
+          username: record.username || record.userid,
+        };
+      }
+    }
+
+    logger.warn(
+      `apikey_auth_failed - API Key认证失败 - 提供的Key: ${
+        apiKey ? `${apiKey.substring(0, 8)}...` : 'none'
+      }`,
+    );
+
+    throw new UnauthorizedException(`error apikey: ${apiKey}`);
+  }
+
+  canActivate(context: ExecutionContext): boolean | Promise<boolean> {
+    const request = context.switchToHttp().getRequest();
+    const handler = context.getHandler();
+    const controller = context.getClass();
+
+    const allowUnauthorizedRequest = this.reflector.get<boolean>(
+      'allowUnauthorizedRequest',
+      handler,
+    );
+
+    if (allowUnauthorizedRequest) {
+      logger.info(
+        `auth_bypassed - 认证被绕过 - 端点: ${request.method} ${request.url}, 控制器: ${controller.name}`,
+      );
+      return true;
+    }
+
+    const allowApiKeyRequest =
+      this.reflector.get<boolean>(API_SECURITY, handler) ||
+      this.reflector.get<boolean>('allowApiKeyRequest', handler);
+
+    logger.info(
+      `auth_attempt - 认证尝试 - 端点: ${request.method} ${
+        request.url
+      }, 控制器: ${controller.name}, 允许API Key: ${allowApiKeyRequest}, IP: ${
+        request.ip || request.connection.remoteAddress
+      }`,
+    );
+
+    return (
+      allowApiKeyRequest
+        ? this.getApikeyIdentity(request)
+        : Promise.reject("don't allow api key request.")
+    )
+      .catch((error) => {
+        logger.warn(
+          `apikey_fallback - API Key认证失败，回退到WOA/Taihu认证 - 端点: ${request.method} ${request.url}, 错误: ${error.message}`,
+        );
+
+        return getIdentity(request.headers, request.cookies);
+      })
+      .then((userInfo) => {
+        request.user = userInfo;
+
+        logger.info(
+          `auth_success - 认证成功 - 用户ID: ${userInfo.userid}, 用户名: ${userInfo.username}, 端点: ${request.method} ${request.url}`,
+        );
+
+        return true;
+      })
+      .catch((error) => {
+        logger.error(
+          `auth_failed - 认证失败 - 端点: ${request.method} ${request.url}, 错误: ${error.message}`,
+        );
+
+        throw new UnauthorizedException(error);
+      });
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/http-cache.interceptor.ts

@@ -0,0 +1,21 @@
+import { CacheInterceptor } from '@nestjs/cache-manager';
+import { ExecutionContext, Injectable } from '@nestjs/common';
+
+/**
+ * 扩展 CacheInterceptor，将 POST body 纳入 cache key，
+ * 避免不同参数的请求命中同一份缓存。
+ * cache key 格式：{url}:{JSON.stringify(body)}
+ */
+@Injectable()
+export class HttpCacheInterceptor extends CacheInterceptor {
+  trackBy(context: ExecutionContext): string | undefined {
+    const request = context.switchToHttp().getRequest();
+    const url = request.url as string;
+    const body = request.body;
+
+    const bodyKey =
+      body && Object.keys(body).length > 0 ? JSON.stringify(body) : '';
+
+    return bodyKey ? `${url}:${bodyKey}` : url;
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/logger.ts

@@ -0,0 +1,19 @@
+import * as winston from 'winston';
+
+export const LogFormat = winston.format.combine(
+  winston.format.splat(),
+  winston.format.timestamp({
+    format: 'YYYY-MM-DD HH:mm:ss.SSS',
+  }),
+  winston.format.errors({ stack: true }),
+  winston.format.json(),
+);
+
+export const loggerInstance = winston.createLogger({
+  level: 'info',
+  transports: [
+    new winston.transports.Console({
+      format: LogFormat,
+    }),
+  ],
+});

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/roles.guard.ts

@@ -0,0 +1,47 @@
+import { UserType } from '@gadmin2n/nest-common';
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+type RolesGetter = (
+  user: UserType,
+) => Promise<{ business?: (string | number)[]; roles: string[] }>;
+
+@Injectable()
+export default class RolesGuard implements CanActivate {
+  constructor(
+    private readonly getter: RolesGetter,
+    private reflector: Reflector,
+  ) {}
+
+  canActivate(context: ExecutionContext): boolean | Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+
+    const allowUnauthorizedRequest = this.reflector.get<boolean>(
+      'allowUnauthorizedRequest',
+      context.getHandler(),
+    );
+    if (allowUnauthorizedRequest) {
+      return true;
+    }
+
+    if (!req.user) {
+      throw new ForbiddenException();
+    }
+
+    return this.getter(req.user)
+      .then((configPerms) => {
+        if (configPerms.roles.length === 0) {
+          throw new ForbiddenException();
+        }
+        req.user.configPerms = configPerms;
+        return true;
+      })
+      .catch((_) => {
+        throw new ForbiddenException();
+      });
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/safe-log.util.ts

@@ -0,0 +1,176 @@
+/**
+ * Safe logging utility to prevent circular structure errors and limit log size
+ */
+
+const MAX_LOG_SIZE = 10000; // Maximum characters for a single log field
+const MAX_ARRAY_ITEMS = 50; // Maximum array items to log
+
+/**
+ * Safely stringify an object, handling circular references and limiting size
+ * @param obj The object to stringify
+ * @param maxDepth Maximum depth to traverse
+ * @returns Safe string representation
+ */
+export function safeStringify(obj: any, maxDepth = 3): string {
+  const seen = new WeakSet();
+
+  const stringify = (value: any, depth: number): any => {
+    // Handle null and undefined
+    if (value === null) return null;
+    if (value === undefined) return undefined;
+
+    // Handle primitives
+    if (typeof value !== 'object') {
+      return value;
+    }
+
+    // Check for circular reference
+    if (seen.has(value)) {
+      return '[Circular]';
+    }
+
+    // Check depth limit
+    if (depth >= maxDepth) {
+      return '[Max Depth Reached]';
+    }
+
+    seen.add(value);
+
+    try {
+      // Handle Date
+      if (value instanceof Date) {
+        return value.toISOString();
+      }
+
+      // Handle Array
+      if (Array.isArray(value)) {
+        const items = value
+          .slice(0, MAX_ARRAY_ITEMS)
+          .map((item) => stringify(item, depth + 1));
+        if (value.length > MAX_ARRAY_ITEMS) {
+          items.push(`[... ${value.length - MAX_ARRAY_ITEMS} more items]`);
+        }
+        return items;
+      }
+
+      // Handle plain objects
+      const result: any = {};
+      const keys = Object.keys(value);
+
+      for (const key of keys) {
+        try {
+          result[key] = stringify(value[key], depth + 1);
+        } catch (error) {
+          result[key] = '[Error stringifying]';
+        }
+      }
+
+      return result;
+    } finally {
+      seen.delete(value);
+    }
+  };
+
+  try {
+    const safeObj = stringify(obj, 0);
+    const str = JSON.stringify(safeObj);
+
+    // Limit total size
+    if (str.length > MAX_LOG_SIZE) {
+      return (
+        str.substring(0, MAX_LOG_SIZE) +
+        `... [truncated ${str.length - MAX_LOG_SIZE} chars]`
+      );
+    }
+
+    return str;
+  } catch (error) {
+    return `[Error: ${error.message}]`;
+  }
+}
+
+/**
+ * Create a safe log object that can be passed to logger
+ * @param data The data to log
+ * @returns Safe log object
+ */
+export function createSafeLogData(
+  data: Record<string, any>,
+): Record<string, any> {
+  const safeData: Record<string, any> = {
+    __ROLE_PAGE_RESOURCE__: true, // Unified field for production log collection
+  };
+
+  for (const [key, value] of Object.entries(data)) {
+    try {
+      // For simple types, use directly
+      if (
+        value === null ||
+        value === undefined ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean'
+      ) {
+        safeData[key] = value;
+      } else {
+        // For complex types, use safe stringify
+        const stringified = safeStringify(value);
+        try {
+          // Try to parse back to object for better log formatting
+          safeData[key] = JSON.parse(stringified);
+        } catch {
+          // If parse fails, use the string
+          safeData[key] = stringified;
+        }
+      }
+    } catch (error) {
+      safeData[key] = `[Error processing ${key}]`;
+    }
+  }
+
+  return safeData;
+}
+
+/**
+ * Extract only essential fields from database records for logging
+ * @param record Database record
+ * @param essentialFields Fields to include (defaults to common fields)
+ * @returns Simplified record
+ */
+export function extractEssentialFields(
+  record: any,
+  essentialFields?: string[],
+): any {
+  if (!record) return record;
+
+  const defaultFields = [
+    'id',
+    'name',
+    'code',
+    'type',
+    'status',
+    'createdAt',
+    'updatedAt',
+  ];
+  const fields = essentialFields || defaultFields;
+
+  if (Array.isArray(record)) {
+    return record.map((item) => extractEssentialFields(item, essentialFields));
+  }
+
+  if (typeof record === 'object') {
+    const result: any = {};
+    for (const field of fields) {
+      if (field in record) {
+        result[field] = record[field];
+      }
+    }
+    // Always include id if exists
+    if ('id' in record && !result.id) {
+      result.id = record.id;
+    }
+    return result;
+  }
+
+  return record;
+}