@gadmin2n/schematics 0.0.70 → 0.0.71

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/taihu.ts

@@ -0,0 +1,175 @@
+import * as jwt from 'jsonwebtoken';
+import * as request from 'request';
+import { URLSearchParams } from 'url';
+
+export type TaiHuTokenInfo = {
+  access_token: string;
+  id_token: string;
+  expires_in: number;
+  token_type: 'Bearer';
+  scope: string;
+};
+
+export type TaiHuUserInfo = {
+  user_id: string;
+  sub: string;
+  name: string;
+  preferred_username: string;
+  email: string;
+  email_verified: boolean;
+  phone_number_verified: boolean;
+};
+
+export type GAdminUserInfo = Pick<
+  TaiHuUserInfo,
+  'user_id' | 'sub' | 'name' | 'email'
+>;
+export const GAdminTokenName = 'gadmin-token';
+
+// see https://docs.qq.com/doc/DSEN0SlhZWWFJSHR4
+export default class TaiHuId {
+  static config = {
+    clientId: process.env.TAIHU_ODC_CLIENT_ID,
+    clientSecret: process.env.TAIHU_ODC_APP_TOKEN || 'gadmin-default-secret',
+    apiBase: process.env.TAIHU_BASE,
+    callback: process.env.TAIHU_CALLBACK,
+    logout: process.env.TAIHU_LOGOUT,
+  };
+
+  static callApi<T>(
+    url: string,
+    params?: Record<string, any>,
+    options?: Record<string, any>,
+  ): Promise<T> {
+    return new Promise((resolve, reject) => {
+      request(
+        {
+          url: `${TaiHuId.config.apiBase}${url}`,
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            ...options?.headers,
+          },
+          form: params,
+          ...options,
+        },
+        (error: Error, _response: unknown, body: string) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+          try {
+            const parsedBody = JSON.parse(body);
+            if (parsedBody.error) {
+              reject(new Error(parsedBody.error_description));
+              return;
+            }
+            resolve(parsedBody as T);
+          } catch (parseError) {
+            reject(new Error('Failed to parse response body as JSON'));
+          }
+        },
+      );
+    });
+  }
+
+  static getToken(code: string) {
+    return TaiHuId.callApi<TaiHuTokenInfo>('/token', {
+      client_id: TaiHuId.config.clientId,
+      client_secret: TaiHuId.config.clientSecret,
+      grant_type: 'authorization_code',
+      redirect_uri: TaiHuId.config.callback,
+      code,
+    });
+  }
+
+  static refreshToken(refreshToken: string) {
+    return TaiHuId.callApi<TaiHuTokenInfo>('/token', {
+      client_id: TaiHuId.config.clientId,
+      client_secret: TaiHuId.config.clientSecret,
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+    });
+  }
+
+  // get userinfo by api
+  static async getUserInfo(accessToken: string) {
+    const user_info = await TaiHuId.callApi<any>('/userinfo', undefined, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    });
+    const { user_name } = user_info;
+    return {
+      user_id: user_name,
+      sub: user_name,
+      name: user_name,
+      email: `${user_name}@tencent.com`,
+    };
+  }
+
+  static authorize(redirectUrl: string, uiLocales = 'zh-CN') {
+    const map = new Map();
+    map.set('response_type', 'code');
+    map.set('client_id', TaiHuId.config.clientId);
+    map.set('ui_locales', uiLocales);
+    map.set('scope', 'openid profile');
+    map.set('redirect_uri', TaiHuId.config.callback);
+    map.set('state', redirectUrl);
+    const params = new URLSearchParams(map);
+    return `${TaiHuId.config.apiBase}/authorize?${params.toString()}`;
+  }
+
+  static logout(redirectUrl: string) {
+    const map = new Map();
+    map.set('url', redirectUrl);
+    const params = new URLSearchParams(map);
+    return `${TaiHuId.config.logout}?${params.toString()}`;
+  }
+
+  /**
+   * 生成JWT
+   * @param payload 用户信息
+   * @param expiresIn 过期时间，单位秒
+   * @returns token
+   */
+  static sign(payload: GAdminUserInfo, expiresIn = 1800) {
+    return new Promise<string>((resolve, reject) => {
+      jwt.sign(
+        payload,
+        TaiHuId.config.clientSecret,
+        { expiresIn },
+        (err, token) => {
+          if (err) {
+            reject(err);
+            return;
+          }
+          resolve(token as string);
+        },
+      );
+    });
+  }
+
+  /**
+   * 验证并返回sign生成的JWT信息
+   * @param token JWT
+   * @returns 用户信息
+   */
+  static verify(token: string) {
+    return new Promise<GAdminUserInfo>((resolve, reject) => {
+      if (!token) {
+        reject(new Error('no token'));
+        return;
+      }
+
+      jwt.verify(token, TaiHuId.config.clientSecret, {}, (err, decoded) => {
+        if (err) {
+          reject(err);
+          return;
+        }
+        resolve(decoded as GAdminUserInfo);
+      });
+    });
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/tracing.ts

@@ -0,0 +1,174 @@
+// OpenTelemetry 手工注入 - 不依赖 K8s autoinstrumentation
+//
+// 通过 NodeSDK 手动配置 Resource、Exporter 和 Instrumentations，
+// 支持通过环境变量或 .env 文件配置，不再依赖 K8s Operator 注入探针。
+
+import { trace } from '@opentelemetry/api';
+import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-grpc';
+import { ExpressInstrumentation } from '@opentelemetry/instrumentation-express';
+import { HttpInstrumentation } from '@opentelemetry/instrumentation-http';
+import { NestInstrumentation } from '@opentelemetry/instrumentation-nestjs-core';
+import { PgInstrumentation } from '@opentelemetry/instrumentation-pg';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import {
+  BatchSpanProcessor,
+  ReadableSpan,
+  SpanProcessor,
+} from '@opentelemetry/sdk-trace-base';
+import {
+  ATTR_SERVICE_NAME,
+  ATTR_SERVICE_VERSION,
+} from '@opentelemetry/semantic-conventions';
+import { PrismaInstrumentation } from '@prisma/instrumentation';
+
+// 从 DATABASE_URL 解析数据库连接信息，用于补充 Prisma span 的 peer 属性
+function parseDbUrl(url?: string) {
+  if (!url) return null;
+  try {
+    const parsed = new URL(url);
+    return {
+      host: parsed.hostname,
+      port: parsed.port || '5432',
+      name: parsed.pathname.replace('/', ''),
+    };
+  } catch {
+    return null;
+  }
+}
+
+// 自定义 SpanProcessor：为 Prisma 产生的 db span 补充连接信息
+class PrismaDbSpanProcessor implements SpanProcessor {
+  private inner: SpanProcessor;
+
+  constructor(inner: SpanProcessor) {
+    this.inner = inner;
+  }
+
+  onStart(span: ReadableSpan, parentContext: any) {
+    this.inner.onStart(span as any, parentContext);
+  }
+
+  onEnd(span: ReadableSpan) {
+    const dbInfo = parseDbUrl(process.env.DATABASE_URL);
+    if (dbInfo && span.attributes['db.system'] === 'postgresql') {
+      const mutableSpan = span as any;
+      mutableSpan.attributes['net.peer.name'] = dbInfo.host;
+      mutableSpan.attributes['net.peer.port'] = Number(dbInfo.port);
+      mutableSpan.attributes['db.name'] = dbInfo.name;
+      mutableSpan.attributes['db.instance'] = dbInfo.name;
+      mutableSpan.attributes['db.ip'] = dbInfo.host;
+      mutableSpan.attributes[
+        'peer.service'
+      ] = `${dbInfo.name}@${dbInfo.host}:${dbInfo.port}`;
+      mutableSpan.attributes[
+        'peer.filled'
+      ] = `${dbInfo.name}@${dbInfo.host}:${dbInfo.port}`;
+    }
+    this.inner.onEnd(span);
+  }
+
+  shutdown() {
+    return this.inner.shutdown();
+  }
+
+  forceFlush() {
+    return this.inner.forceFlush();
+  }
+}
+
+export function initializeTracing(): void {
+  const otelEndpoint = process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT;
+  const serviceName =
+    process.env.OTEL_SERVICE_NAME || `oit-erp-backend-${process.env.NODE_ENV}`;
+  const otelToken = process.env.OTEL_RESOURCE_ATTRIBUTES_TOKEN;
+
+  console.log('[Tracing] ========== OpenTelemetry 手工注入模式 ==========');
+  console.log('[Tracing] NODE_ENV:', process.env.NODE_ENV);
+  console.log('[Tracing] OTEL_SERVICE_NAME:', serviceName);
+  console.log('[Tracing] OTEL_EXPORTER_OTLP_ENDPOINT:', otelEndpoint);
+  console.log(
+    '[Tracing] OTEL_RESOURCE_ATTRIBUTES_TOKEN:',
+    otelToken ? '******(已配置)' : '未配置',
+  );
+
+  let sdk: NodeSDK | null = null;
+
+  if (!otelEndpoint) {
+    console.log(
+      '[Tracing] OTEL_EXPORTER_OTLP_ENDPOINT 未配置，跳过 tracing 初始化',
+    );
+    return;
+  }
+
+  console.log('[Tracing] 正在初始化 OpenTelemetry SDK...');
+
+  try {
+    const resource = resourceFromAttributes({
+      token: otelToken,
+      [ATTR_SERVICE_NAME]: serviceName,
+      [ATTR_SERVICE_VERSION]: process.env.npm_package_version || '0.0.1',
+      ['deployment.environment']: process.env.NODE_ENV || 'development',
+      'host.name': process.env.HOSTNAME,
+    } as Record<string, string>);
+
+    const traceExporter = new OTLPTraceExporter({
+      url: otelEndpoint,
+    });
+
+    const spanProcessor = new PrismaDbSpanProcessor(
+      new BatchSpanProcessor(traceExporter),
+    );
+
+    sdk = new NodeSDK({
+      resource,
+      spanProcessor,
+      instrumentations: [
+        new HttpInstrumentation({
+          ignoreIncomingRequestHook: (req) => req.method === 'HEAD',
+        }),
+        new ExpressInstrumentation(),
+        new NestInstrumentation(),
+        new PgInstrumentation(),
+        new PrismaInstrumentation(),
+      ],
+    });
+
+    sdk.start();
+
+    // 验证 TracerProvider 是否正常
+    const tracer = trace.getTracer(serviceName);
+    const testSpan = tracer.startSpan('tracing-init-test');
+    const spanContext = testSpan.spanContext();
+
+    console.log('[Tracing] SDK 启动成功');
+    console.log(
+      '[Tracing]   TracerProvider:',
+      trace.getTracerProvider()?.constructor?.name,
+    );
+    console.log('[Tracing]   Test traceId:', spanContext.traceId);
+    console.log('[Tracing]   Sampled:', spanContext.traceFlags === 1);
+
+    testSpan.end();
+  } catch (error) {
+    console.error('[Tracing] 初始化失败:', error);
+  }
+
+  process.on('SIGTERM', async () => {
+    if (sdk) {
+      console.log('[Tracing] 正在关闭 OpenTelemetry SDK...');
+      await sdk.shutdown();
+      console.log('[Tracing] SDK 已关闭');
+    }
+
+    console.log(
+      '[Tracing] ====================================================',
+    );
+  });
+}
+
+if (process.env.NODE_ENV !== 'development') {
+  console.log('[Bootstrap] Initializing tracing...');
+  initializeTracing();
+  console.log('[Bootstrap] Tracing ready, starting NestJS application...');
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/trim.pipe.ts

@@ -0,0 +1,51 @@
+import { ArgumentMetadata, Injectable, PipeTransform } from '@nestjs/common';
+
+@Injectable()
+export class TrimPipe implements PipeTransform {
+  transform(value: any, metadata: ArgumentMetadata) {
+    if (value === null || value === undefined) {
+      return value;
+    }
+
+    // parse string and trim
+    if (typeof value === 'string') {
+      return value.trim();
+    }
+
+    // parse object and trim
+    if (typeof value === 'object' && !Array.isArray(value)) {
+      return this.trimObject(value);
+    }
+
+    // parse array and trim
+    if (Array.isArray(value)) {
+      return value.map((item) =>
+        typeof item === 'string'
+          ? item.trim()
+          : this.transform(item, { ...metadata }),
+      );
+    }
+    return value;
+  }
+
+  private trimObject(obj: any): any {
+    Object.keys(obj).forEach((key) => {
+      if (typeof obj[key] === 'string') {
+        obj[key] = obj[key].trim();
+      } else if (
+        typeof obj[key] === 'object' &&
+        !Array.isArray(obj[key]) &&
+        obj[key] !== null
+      ) {
+        obj[key] = this.trimObject(obj[key]);
+      } else if (Array.isArray(obj[key])) {
+        obj[key] = obj[key].map((item) =>
+          typeof item === 'string'
+            ? item.trim()
+            : this.transform(item, { type: 'custom' }),
+        );
+      }
+    });
+    return obj;
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/utils.ts

@@ -0,0 +1,145 @@
+const crypto = require('crypto');
+const CryptoJS = require('crypto-js');
+
+export function md5(text: string) {
+  return crypto.createHash('md5').update(text).digest('hex');
+}
+
+// https://segmentfault.com/a/1190000039192480
+/**
+ * AES-256-ECB对称加密
+ * @param text {string} 要加密的明文
+ * @param secretKey {string} 密钥，43位随机大小写与数字
+ * @returns {string} 加密后的密文，Base64格式
+ */
+export function AES_ECB_ENCRYPT(text: string, secretKey: string): string {
+  const keyHex = CryptoJS.enc.Base64.parse(secretKey);
+  const messageHex = CryptoJS.enc.Utf8.parse(text);
+  const encrypted = CryptoJS.AES.encrypt(messageHex, keyHex, {
+    mode: CryptoJS.mode.ECB,
+    padding: CryptoJS.pad.Pkcs7,
+  });
+  return encrypted.toString();
+}
+
+/**
+ * AES-256-ECB对称解密
+ * @param textBase64 {string} 要解密的密文，Base64格式
+ * @param secretKey {string} 密钥，43位随机大小写与数字
+ * @returns {string} 解密后的明文
+ */
+export function AES_ECB_DECRYPT(textBase64: string, secretKey: string): string {
+  const keyHex = CryptoJS.enc.Base64.parse(secretKey);
+  const decrypt = CryptoJS.AES.decrypt(textBase64, keyHex, {
+    mode: CryptoJS.mode.ECB,
+    padding: CryptoJS.pad.Pkcs7,
+  });
+  return CryptoJS.enc.Utf8.stringify(decrypt);
+}
+
+export function addFieldIfExist(
+  name: string,
+  value: any,
+  obj: any,
+  anthor: any = undefined,
+) {
+  if (value !== undefined) {
+    if (anthor !== undefined) {
+      obj[name] = anthor;
+    } else {
+      obj[name] = value;
+    }
+  }
+  return obj;
+}
+
+/**
+ * AES 加密
+ * @param {string} data - 要加密的数据
+ * @param {string} key - 加密密钥（16/24/32 字节，对应 AES-128/192/256）
+ * @param {string} iv - 初始化向量（16 字节）
+ * @param {string} algorithm - 加密算法，默认为 'aes-256-cbc'
+ * @param {string} outputEncoding - 输出编码，默认为 'base64'
+ * @returns {string} - 加密后的数据
+ */
+export function AES_CBC_ENCRYPT(
+  data,
+  key,
+  iv,
+  algorithm = 'aes-256-cbc',
+  outputEncoding = 'base64',
+) {
+  // 验证输入
+  if (!data || !key || !iv) {
+    throw new Error('数据、密钥和初始化向量不能为空');
+  }
+
+  const keyFromHex = Buffer.from(key, 'hex');
+  const ivFromHex = Buffer.from(iv, 'hex');
+
+  if (ivFromHex.length !== 16) {
+    throw new Error('AES IV 必须是 16 字节');
+  }
+
+  // 创建加密器
+  const cipher = crypto.createCipheriv(algorithm, keyFromHex, ivFromHex);
+
+  // 更新加密内容
+  let encrypted = cipher.update(data, 'utf8', outputEncoding);
+  encrypted += cipher.final(outputEncoding);
+
+  return encrypted;
+}
+
+/**
+ * AES 解密
+ * @param {string} encryptedData - 加密的数据
+ * @param {string} key - 解密密钥（必须与加密时使用的相同）
+ * @param {string} iv - 初始化向量（必须与加密时使用的相同）
+ * @param {string} algorithm - 解密算法，默认为 'aes-256-cbc'
+ * @param {string} inputEncoding - 输入编码，默认为 'base64'
+ * @returns {string} - 解密后的数据
+ */
+export function AES_CBC_DECRYPT(
+  encryptedData,
+  key,
+  iv,
+  algorithm = 'aes-256-cbc',
+  inputEncoding = 'base64',
+) {
+  // 验证输入
+  if (!encryptedData || !key || !iv) {
+    throw new Error('加密数据、密钥和初始化向量不能为空');
+  }
+
+  const keyFromHex = Buffer.from(key, 'hex');
+  const ivFromHex = Buffer.from(iv, 'hex');
+  if (ivFromHex.length !== 16) {
+    throw new Error('AES IV 必须是 16 字节');
+  }
+  // 创建解密器
+  const decipher = crypto.createDecipheriv(algorithm, keyFromHex, ivFromHex);
+
+  // 更新解密内容
+  let decrypted = decipher.update(encryptedData, inputEncoding, 'utf8');
+  decrypted += decipher.final('utf8');
+
+  return decrypted;
+}
+
+/**
+ * 生成随机密钥
+ * @param {number} length - 密钥长度（字节），默认为 32（对应 AES-256）
+ * @returns {string} - 十六进制格式的密钥
+ */
+export function generateKey(length = 32) {
+  return crypto.randomBytes(length).toString('hex');
+}
+
+/**
+ * 生成随机初始化向量
+ * @returns {string} - 十六进制格式的初始化向量
+ */
+export function generateIV() {
+  return crypto.randomBytes(16).toString('hex');
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/woaAuth.ts

@@ -0,0 +1,95 @@
+// https://iwiki.woa.com/pages/viewpage.action?pageId=4007728669
+// node version >= v12.22
+// npm i jose@4.14.4
+import { UserType } from '@gadmin2n/nest-common';
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+const crypto = require('crypto'); //改成import，运行时会报错
+const jose = require('jose'); //改成import，运行时会报错
+
+async function decodeAuthorizationHeader(authorizationHeader, key) {
+  const keyBytes = Buffer.from(key);
+  try {
+    const dec = await jose.compactDecrypt(authorizationHeader, keyBytes);
+    const payload = JSON.parse(dec.plaintext as any);
+
+    const exp = new Date(payload.Expiration);
+    // 检验 token 是否已经过期，增加5分钟缓冲，避免服务器时间差异
+    if (new Date(new Date().getTime() - 3 * 60 * 1000) > exp) {
+      // demo 为了正常运行，此处异常注释了，实际环境需要开启验证
+      throw new Error('expired');
+    }
+    return payload;
+  } catch (error) {
+    throw new Error(
+      `decodeAuthorizationHeader(${authorizationHeader}, ${key}) error: ${error}`,
+    );
+  }
+}
+
+function checkSignature(key, timestampSeconds, signature, extHeaders) {
+  if (!timestampSeconds || isNaN(timestampSeconds)) {
+    return false;
+  }
+  if (
+    !(Math.abs(parseInt(timestampSeconds, 10) * 1000 - Date.now()) <= 180000)
+  ) {
+    // demo 为了正常运行，此处异常注释了，实际环境需要开启验证
+    return false;
+  }
+
+  const hash = crypto.createHash('sha256');
+  hash.update(timestampSeconds + key + extHeaders.join(',') + timestampSeconds);
+  return signature.toLowerCase() === hash.digest('hex').toLowerCase();
+}
+
+export async function getIdentity(headers, key) {
+  const { staffid = '', staffname = '' } = headers;
+  const extHeaders = [
+    headers['x-rio-seq'],
+    staffid,
+    staffname,
+    headers['x-ext-data'] || '',
+  ];
+  if (
+    staffid &&
+    staffname &&
+    headers['x-ext-data'] &&
+    !checkSignature(key, headers.timestamp, headers.signature, extHeaders)
+  ) {
+    throw new Error(
+      `check smartgate signature failed, headers: ${headers.timestamp}, ${headers.signature}, ${extHeaders}`,
+    );
+  }
+  const taiIdentity = headers['x-tai-identity'];
+  if (taiIdentity) {
+    const payload = await decodeAuthorizationHeader(taiIdentity, key);
+    return { staffid: payload.StaffId, staffname: payload.LoginName };
+  }
+  return { staffid: parseInt(staffid, 10) || 0, staffname };
+}
+
+@Injectable()
+export class WoaAuthGuard implements CanActivate {
+  constructor(private readonly token: string) {}
+
+  canActivate(context: ExecutionContext): boolean | Promise<boolean> {
+    const request = context.switchToHttp().getRequest();
+    return getIdentity(request.headers, Buffer.from(this.token))
+      .then((userInfo) => {
+        const user: UserType = {
+          userid: userInfo.staffid,
+          username: userInfo.staffname,
+        };
+        request.user = user;
+        return true;
+      })
+      .catch((error) => {
+        throw new UnauthorizedException();
+      });
+  }
+}