@gadmin2n/schematics 0.0.71 → 0.0.72

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/app.service.ts

@@ -1,189 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
-import * as crypto from 'crypto';
-import { WINSTON_MODULE_PROVIDER } from 'nest-winston';
-import * as path from 'path';
-import { Logger } from 'winston';
-import TaihuId, { GAdminTokenName } from './lib/taihu';
-
-@Injectable()
-export class AppService {
-  private readonly externalPageSecretKey: string;
-  private readonly externalPageExpireSeconds: number;
-
-  constructor(
-    private readonly config: ConfigService,
-    @Inject(WINSTON_MODULE_PROVIDER) private readonly logger: Logger,
-  ) {
-    this.logger = this.logger.child({
-      file: path.basename(__filename),
-    });
-
-    // External Page 配置
-    this.externalPageSecretKey =
-      this.config.get<string>('EXTERNAL_PAGE_SECRET') ||
-      process.env.EXTERNAL_PAGE_SECRET ||
-      'change-this-secret-in-production';
-
-    this.externalPageExpireSeconds =
-      this.config.get<number>('EXTERNAL_PAGE_EXPIRE_SECONDS') || 300;
-
-    if (this.externalPageSecretKey === 'change-this-secret-in-production') {
-      this.logger.warn(
-        'external_page_secret_warning - 使用默认密钥，请在生产环境配置 EXTERNAL_PAGE_SECRET 环境变量',
-      );
-    }
-  }
-
-  getHello(): string {
-    return 'Hello World!';
-  }
-
-  async loginCallback(req, res) {
-    const { code, state } = req.query;
-
-    const tokenInfo = await TaihuId.getToken(code);
-    const userInfo = await TaihuId.getUserInfo(tokenInfo.access_token);
-
-    const expiresIn = 7 * 24 * 3600;
-    const { user_id, sub, name, email } = userInfo;
-    const payload = { user_id, sub, name, email };
-    const token = await TaihuId.sign(payload, expiresIn);
-
-    // append token param for local development
-    const redirectUrl = new URL(state);
-    const selfUrl = new URL(process.env.TAIHU_CALLBACK || '');
-    if (redirectUrl.hostname !== selfUrl.hostname) {
-      redirectUrl.searchParams.set(GAdminTokenName, token);
-    }
-
-    res.cookie(GAdminTokenName, token, {
-      maxAge: expiresIn * 1000,
-      httpOnly: false,
-    });
-    res.status(302).redirect(redirectUrl.toString());
-  }
-
-  login(req, res) {
-    const { redirect_url, ui_locales = 'zh-CN' } = req.query;
-
-    // TODO: verify redirect_url domain
-
-    const authorizeUrl = TaihuId.authorize(redirect_url, ui_locales);
-    res.status(302).redirect(authorizeUrl);
-  }
-
-  logout(req, res) {
-    const { redirect_url } = req.query;
-
-    const logoutUrl = TaihuId.logout(redirect_url);
-    res.cookie(GAdminTokenName, '', { maxAge: 0 });
-    res.status(302).redirect(logoutUrl);
-  }
-
-  // ============ External Page 功能 ============
-
-  /**
-   * 生成带签名的外部页面 URL
-   */
-  generateExternalPageSignedUrl(
-    domain: string,
-    pageCode: string,
-    userid: string,
-  ): { url: string; expiresIn: number } {
-    const timestamp = Date.now();
-    const data = `${domain}:${pageCode}:${userid}:${timestamp}`;
-
-    const signature = crypto
-      .createHmac('sha256', this.externalPageSecretKey)
-      .update(data)
-      .digest('hex');
-
-    let pagePath: string;
-    let pageQuery: string;
-
-    const queryIndex = pageCode.indexOf('?');
-    if (queryIndex !== -1) {
-      pagePath = pageCode.substring(0, queryIndex);
-      pageQuery = pageCode.substring(queryIndex + 1);
-    } else {
-      pagePath = pageCode;
-      pageQuery = '';
-    }
-
-    const signParams = `_t=${timestamp}&_s=${signature}&_u=${encodeURIComponent(
-      userid,
-    )}`;
-
-    let url: string;
-    if (pageQuery) {
-      url = `https://oit-erp-gtdr.woa.com/${domain}/${pagePath}?${pageQuery}&${signParams}`;
-    } else {
-      url = `https://oit-erp-gtdr.woa.com/${domain}/${pagePath}?${signParams}`;
-    }
-
-    this.logger.info(
-      `external_page_sign_url - 生成签名URL - domain: ${domain}, pageCode: ${pageCode}, userid: ${userid}`,
-    );
-
-    return {
-      url,
-      expiresIn: this.externalPageExpireSeconds,
-    };
-  }
-
-  /**
-   * 验证外部页面签名
-   */
-  verifyExternalPageSignature(
-    domain: string,
-    pageCode: string,
-    userid: string,
-    timestamp: string,
-    signature: string,
-  ): { valid: boolean; reason?: string } {
-    const ts = parseInt(timestamp, 10);
-    if (isNaN(ts)) {
-      return { valid: false, reason: 'invalid timestamp format' };
-    }
-
-    const now = Date.now();
-    const age = now - ts;
-
-    if (age < -5000) {
-      return { valid: false, reason: 'timestamp in future' };
-    }
-
-    if (age > this.externalPageExpireSeconds * 1000) {
-      return { valid: false, reason: 'signature expired' };
-    }
-
-    const data = `${domain}:${pageCode}:${userid}:${timestamp}`;
-    const expectedSignature = crypto
-      .createHmac('sha256', this.externalPageSecretKey)
-      .update(data)
-      .digest('hex');
-
-    if (signature.length !== expectedSignature.length) {
-      return { valid: false, reason: 'invalid signature' };
-    }
-
-    try {
-      const signatureBuffer = Buffer.from(signature, 'hex');
-      const expectedBuffer = Buffer.from(expectedSignature, 'hex');
-
-      if (
-        !crypto.timingSafeEqual(
-          new Uint8Array(signatureBuffer),
-          new Uint8Array(expectedBuffer),
-        )
-      ) {
-        return { valid: false, reason: 'invalid signature' };
-      }
-    } catch {
-      return { valid: false, reason: 'invalid signature format' };
-    }
-
-    return { valid: true };
-  }
-}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/auth.guard.ts

@@ -1,154 +0,0 @@
-// https://iwiki.woa.com/pages/viewpage.action?pageId=4007728669
-// node version >= v12.22
-// npm i jose@4.14.4
-import { UserType } from '@gadmin2n/nest-common';
-import {
-  CanActivate,
-  ExecutionContext,
-  Injectable,
-  SetMetadata,
-  UnauthorizedException,
-} from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { ApiSecurity } from '@nestjs/swagger';
-import { DECORATORS_PREFIX } from '@nestjs/swagger/dist/constants';
-import * as path from 'path';
-import { UserService } from '../modules/user/user.service';
-import { loggerInstance } from './logger';
-import TaiHuId, { GAdminTokenName } from './taihu';
-import { getIdentity as getWoaIdentity } from './woaAuth';
-
-const logger = loggerInstance.child({
-  file: path.basename(__filename),
-});
-
-const API_SECURITY = `${DECORATORS_PREFIX}/apiSecurity`;
-export function ApiKeyAuth(name = 'X-API-KEY') {
-  return ApiSecurity(name);
-}
-
-export const AllowUnauthorizedRequest = () =>
-  SetMetadata('allowUnauthorizedRequest', true);
-
-export const AllowApiKeyRequest = () => SetMetadata('allowApiKeyRequest', true);
-
-async function getIdentity(headers, cookies): Promise<UserType> {
-  // 先验证woa登录态 https://iwiki.woa.com/p/4007728669#nodejs-%E7%A4%BA%E4%BE%8B
-  try {
-    const { staffid, staffname } = await getWoaIdentity(
-      headers,
-      process.env.TAIHU_APP_TOKEN || '',
-    );
-    if (staffid) {
-      logger.info(
-        `woa_auth_success - 用户ID: ${staffid}, 用户名: ${staffname}`,
-      );
-      return { userid: staffid, username: staffname };
-    }
-  } catch (e) {
-    logger.warn(`woa_auth_failed - WOA认证失败: ${e.message}`);
-  }
-
-  // 再验证taihu登录态 https://iwiki.woa.com/p/4008986665
-  const token = headers[GAdminTokenName] || cookies[GAdminTokenName];
-  const userInfo = await TaiHuId.verify(token);
-
-  logger.info(
-    `taihu_auth_success - Taihu认证成功 - 用户ID: ${userInfo.sub}, Token长度: ${
-      token ? token.length : 0
-    }`,
-  );
-
-  return { userid: userInfo.sub, username: userInfo.sub };
-}
-
-@Injectable()
-export default class AuthGuard implements CanActivate {
-  constructor(private reflector: Reflector, private userService: UserService) {}
-
-  private async getApikeyIdentity(req): Promise<UserType> {
-    const apiKey = req.headers['x-api-key'] ?? req.query.api_key;
-
-    if (apiKey) {
-      const record = await this.userService.findByApiKey(apiKey);
-      if (record && record.isActive && record.isApiKey) {
-        logger.info(
-          `apikey_auth_success - API Key认证成功 - 用户ID: ${
-            record.userid
-          }, Key前缀: ${apiKey.substring(0, 8)}...`,
-        );
-        return {
-          userid: record.userid,
-          username: record.username || record.userid,
-        };
-      }
-    }
-
-    logger.warn(
-      `apikey_auth_failed - API Key认证失败 - 提供的Key: ${
-        apiKey ? `${apiKey.substring(0, 8)}...` : 'none'
-      }`,
-    );
-
-    throw new UnauthorizedException(`error apikey: ${apiKey}`);
-  }
-
-  canActivate(context: ExecutionContext): boolean | Promise<boolean> {
-    const request = context.switchToHttp().getRequest();
-    const handler = context.getHandler();
-    const controller = context.getClass();
-
-    const allowUnauthorizedRequest = this.reflector.get<boolean>(
-      'allowUnauthorizedRequest',
-      handler,
-    );
-
-    if (allowUnauthorizedRequest) {
-      logger.info(
-        `auth_bypassed - 认证被绕过 - 端点: ${request.method} ${request.url}, 控制器: ${controller.name}`,
-      );
-      return true;
-    }
-
-    const allowApiKeyRequest =
-      this.reflector.get<boolean>(API_SECURITY, handler) ||
-      this.reflector.get<boolean>('allowApiKeyRequest', handler);
-
-    logger.info(
-      `auth_attempt - 认证尝试 - 端点: ${request.method} ${
-        request.url
-      }, 控制器: ${controller.name}, 允许API Key: ${allowApiKeyRequest}, IP: ${
-        request.ip || request.connection.remoteAddress
-      }`,
-    );
-
-    return (
-      allowApiKeyRequest
-        ? this.getApikeyIdentity(request)
-        : Promise.reject("don't allow api key request.")
-    )
-      .catch((error) => {
-        logger.warn(
-          `apikey_fallback - API Key认证失败，回退到WOA/Taihu认证 - 端点: ${request.method} ${request.url}, 错误: ${error.message}`,
-        );
-
-        return getIdentity(request.headers, request.cookies);
-      })
-      .then((userInfo) => {
-        request.user = userInfo;
-
-        logger.info(
-          `auth_success - 认证成功 - 用户ID: ${userInfo.userid}, 用户名: ${userInfo.username}, 端点: ${request.method} ${request.url}`,
-        );
-
-        return true;
-      })
-      .catch((error) => {
-        logger.error(
-          `auth_failed - 认证失败 - 端点: ${request.method} ${request.url}, 错误: ${error.message}`,
-        );
-
-        throw new UnauthorizedException(error);
-      });
-  }
-}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/http-cache.interceptor.ts

@@ -1,21 +0,0 @@
-import { CacheInterceptor } from '@nestjs/cache-manager';
-import { ExecutionContext, Injectable } from '@nestjs/common';
-
-/**
- * 扩展 CacheInterceptor，将 POST body 纳入 cache key，
- * 避免不同参数的请求命中同一份缓存。
- * cache key 格式：{url}:{JSON.stringify(body)}
- */
-@Injectable()
-export class HttpCacheInterceptor extends CacheInterceptor {
-  trackBy(context: ExecutionContext): string | undefined {
-    const request = context.switchToHttp().getRequest();
-    const url = request.url as string;
-    const body = request.body;
-
-    const bodyKey =
-      body && Object.keys(body).length > 0 ? JSON.stringify(body) : '';
-
-    return bodyKey ? `${url}:${bodyKey}` : url;
-  }
-}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/logger.ts

@@ -1,19 +0,0 @@
-import * as winston from 'winston';
-
-export const LogFormat = winston.format.combine(
-  winston.format.splat(),
-  winston.format.timestamp({
-    format: 'YYYY-MM-DD HH:mm:ss.SSS',
-  }),
-  winston.format.errors({ stack: true }),
-  winston.format.json(),
-);
-
-export const loggerInstance = winston.createLogger({
-  level: 'info',
-  transports: [
-    new winston.transports.Console({
-      format: LogFormat,
-    }),
-  ],
-});

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/roles.guard.ts

@@ -1,47 +0,0 @@
-import { UserType } from '@gadmin2n/nest-common';
-import {
-  CanActivate,
-  ExecutionContext,
-  ForbiddenException,
-  Injectable,
-} from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-type RolesGetter = (
-  user: UserType,
-) => Promise<{ business?: (string | number)[]; roles: string[] }>;
-
-@Injectable()
-export default class RolesGuard implements CanActivate {
-  constructor(
-    private readonly getter: RolesGetter,
-    private reflector: Reflector,
-  ) {}
-
-  canActivate(context: ExecutionContext): boolean | Promise<boolean> {
-    const req = context.switchToHttp().getRequest();
-
-    const allowUnauthorizedRequest = this.reflector.get<boolean>(
-      'allowUnauthorizedRequest',
-      context.getHandler(),
-    );
-    if (allowUnauthorizedRequest) {
-      return true;
-    }
-
-    if (!req.user) {
-      throw new ForbiddenException();
-    }
-
-    return this.getter(req.user)
-      .then((configPerms) => {
-        if (configPerms.roles.length === 0) {
-          throw new ForbiddenException();
-        }
-        req.user.configPerms = configPerms;
-        return true;
-      })
-      .catch((_) => {
-        throw new ForbiddenException();
-      });
-  }
-}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/lib/safe-log.util.ts

@@ -1,176 +0,0 @@
-/**
- * Safe logging utility to prevent circular structure errors and limit log size
- */
-
-const MAX_LOG_SIZE = 10000; // Maximum characters for a single log field
-const MAX_ARRAY_ITEMS = 50; // Maximum array items to log
-
-/**
- * Safely stringify an object, handling circular references and limiting size
- * @param obj The object to stringify
- * @param maxDepth Maximum depth to traverse
- * @returns Safe string representation
- */
-export function safeStringify(obj: any, maxDepth = 3): string {
-  const seen = new WeakSet();
-
-  const stringify = (value: any, depth: number): any => {
-    // Handle null and undefined
-    if (value === null) return null;
-    if (value === undefined) return undefined;
-
-    // Handle primitives
-    if (typeof value !== 'object') {
-      return value;
-    }
-
-    // Check for circular reference
-    if (seen.has(value)) {
-      return '[Circular]';
-    }
-
-    // Check depth limit
-    if (depth >= maxDepth) {
-      return '[Max Depth Reached]';
-    }
-
-    seen.add(value);
-
-    try {
-      // Handle Date
-      if (value instanceof Date) {
-        return value.toISOString();
-      }
-
-      // Handle Array
-      if (Array.isArray(value)) {
-        const items = value
-          .slice(0, MAX_ARRAY_ITEMS)
-          .map((item) => stringify(item, depth + 1));
-        if (value.length > MAX_ARRAY_ITEMS) {
-          items.push(`[... ${value.length - MAX_ARRAY_ITEMS} more items]`);
-        }
-        return items;
-      }
-
-      // Handle plain objects
-      const result: any = {};
-      const keys = Object.keys(value);
-
-      for (const key of keys) {
-        try {
-          result[key] = stringify(value[key], depth + 1);
-        } catch (error) {
-          result[key] = '[Error stringifying]';
-        }
-      }
-
-      return result;
-    } finally {
-      seen.delete(value);
-    }
-  };
-
-  try {
-    const safeObj = stringify(obj, 0);
-    const str = JSON.stringify(safeObj);
-
-    // Limit total size
-    if (str.length > MAX_LOG_SIZE) {
-      return (
-        str.substring(0, MAX_LOG_SIZE) +
-        `... [truncated ${str.length - MAX_LOG_SIZE} chars]`
-      );
-    }
-
-    return str;
-  } catch (error) {
-    return `[Error: ${error.message}]`;
-  }
-}
-
-/**
- * Create a safe log object that can be passed to logger
- * @param data The data to log
- * @returns Safe log object
- */
-export function createSafeLogData(
-  data: Record<string, any>,
-): Record<string, any> {
-  const safeData: Record<string, any> = {
-    __ROLE_PAGE_RESOURCE__: true, // Unified field for production log collection
-  };
-
-  for (const [key, value] of Object.entries(data)) {
-    try {
-      // For simple types, use directly
-      if (
-        value === null ||
-        value === undefined ||
-        typeof value === 'string' ||
-        typeof value === 'number' ||
-        typeof value === 'boolean'
-      ) {
-        safeData[key] = value;
-      } else {
-        // For complex types, use safe stringify
-        const stringified = safeStringify(value);
-        try {
-          // Try to parse back to object for better log formatting
-          safeData[key] = JSON.parse(stringified);
-        } catch {
-          // If parse fails, use the string
-          safeData[key] = stringified;
-        }
-      }
-    } catch (error) {
-      safeData[key] = `[Error processing ${key}]`;
-    }
-  }
-
-  return safeData;
-}
-
-/**
- * Extract only essential fields from database records for logging
- * @param record Database record
- * @param essentialFields Fields to include (defaults to common fields)
- * @returns Simplified record
- */
-export function extractEssentialFields(
-  record: any,
-  essentialFields?: string[],
-): any {
-  if (!record) return record;
-
-  const defaultFields = [
-    'id',
-    'name',
-    'code',
-    'type',
-    'status',
-    'createdAt',
-    'updatedAt',
-  ];
-  const fields = essentialFields || defaultFields;
-
-  if (Array.isArray(record)) {
-    return record.map((item) => extractEssentialFields(item, essentialFields));
-  }
-
-  if (typeof record === 'object') {
-    const result: any = {};
-    for (const field of fields) {
-      if (field in record) {
-        result[field] = record[field];
-      }
-    }
-    // Always include id if exists
-    if ('id' in record && !result.id) {
-      result.id = record.id;
-    }
-    return result;
-  }
-
-  return record;
-}