@lingxiteam/assets 0.7.30-alpha.28 → 0.7.30-alpha.30

package/es/security/fetch.d.ts

@@ -0,0 +1,4 @@
+declare const fetch: (url: any, fetchOptions?: any, config?: {
+    mode: string;
+}) => Promise<Response>;
+export default fetch;

package/es/security/fetch.js

@@ -0,0 +1,24 @@
+function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
+
+function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { _defineProperty(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
+
+function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+
+import { createHttpSignStr } from './sign';
+var originFetch = window.fetch;
+var envKey = process.env.LING_XI_HTTP_SIGN_HEADER_KEY || process.env.REACT_APP_HTTP_SIGN_HEADER_KEY || process.env.UMI_APP_HTTP_SIGN_HEADER_KEY || process.env.FISHX_APP_HTTP_SIGN_HEADER_KEY;
+
+var fetch = function fetch(url) {
+  var fetchOptions = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var config = arguments.length > 2 ? arguments[2] : undefined;
+
+  var opts = _objectSpread({}, fetchOptions);
+
+  if (!config || !config.mode || config.mode === 'signKey') {
+    opts.headers = _objectSpread(_objectSpread({}, opts.headers), {}, _defineProperty({}, envKey || 'X-SIGN', createHttpSignStr(url, fetchOptions)));
+  }
+
+  return originFetch(url, opts);
+};
+
+export default fetch;

package/es/security/httpEncryption.js

@@ -1,25 +1,22 @@
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); enumerableOnly && (symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
-
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? ownKeys(Object(source), !0).forEach(function (key) { _defineProperty(target, key, source[key]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)) : ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } return target; }
-
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
-
 /*
  * @Author: 张国永 zhang.guoyong2@iwhalecloud.com
  * @Date: 2022-08-08 15:08:58
- * @LastEditors: 张国永 zhang.guoyong2@iwhalecloud.com
- * @LastEditTime: 2022-08-08 17:48:49
- * @FilePath: /lcdp-editor/packages/assets/src/security/http.js
  * @Description: 一个简单的http请求安全加密处理
  */
-// TODO 支持XMLHttpRequest拦截、响应拦截
-import { createHttpSignStr } from '../utils/sign';
+// TODO 支持XMLHttpRequest拦截、参数混淆、响应拦截
+// 使用方式1: 使用fetch请求模块，start({ mode: signKey })，适应经过封装的fetch模块
+// 使用方式2: 使用fetch请求模块，将window.fetch 替换成 fetch，适应自己封装的fetch模块
+// 使用方式3: 不使用fetch请求模块，使用createHttpSignStr自己获取签名，自行在header上添加参数
+import { createHttpSignStr } from './sign';
+import fetch from './fetch';
 var isHttpEncryption = false;
 var originFetch = window.fetch;
 
 function start(_ref) {
   var _ref$mode = _ref.mode,
-      mode = _ref$mode === void 0 ? '' : _ref$mode;
+      mode = _ref$mode === void 0 ? '' : _ref$mode,
+      _ref$signKeyOptions = _ref.signKeyOptions,
+      signKeyOptions = _ref$signKeyOptions === void 0 ? {} : _ref$signKeyOptions;
 
   if (!mode) {
     console.error('http加密开启失败，缺少mode参数');
@@ -35,17 +32,10 @@ function start(_ref) {
           isHttpEncryption = true;
 
           window.fetch = function (url) {
-            var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-
-            var opts = _objectSpread({}, options);
-
-            if (isHttpEncryption && options.isHttpEncryption !== false) {
-              opts.headers = _objectSpread(_objectSpread({}, opts.headers), {}, {
-                'X-SIGN': createHttpSignStr(url, options)
-              });
-            }
-
-            return originFetch(url, opts);
+            var fetchOptions = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+            return fetch(url, fetchOptions, {
+              mode: mode
+            });
           };
         } else {
           console.error('http加密开启失败，目前仅支持window.fetch方式');
@@ -70,5 +60,6 @@ function stop() {
 export default {
   start: start,
   stop: stop,
+  fetch: fetch,
   createHttpSignStr: createHttpSignStr
 };

package/es/security/index.d.ts

@@ -0,0 +1,17 @@
+declare const _default: {
+    httpEncryption: {
+        start: ({ mode, signKeyOptions }: {
+            mode?: string | undefined;
+            signKeyOptions?: {} | undefined;
+        }) => boolean;
+        stop: () => void;
+        fetch: (url: any, fetchOptions?: any, config?: {
+            mode: string;
+        } | undefined) => Promise<Response>;
+        createHttpSignStr: (url: string, options: any) => string;
+    };
+    sign: {
+        createHttpSignStr: (url: string, options: any) => string;
+    };
+};
+export default _default;

package/es/security/index.js

@@ -1,4 +1,6 @@
+import sign from './sign';
 import httpEncryption from './httpEncryption';
 export default {
-  httpEncryption: httpEncryption
+  httpEncryption: httpEncryption,
+  sign: sign
 };

package/es/{utils → security}/sign.d.ts

@@ -1,9 +1,3 @@
-/**
- * 组装X-SIGN请求头
- * @param {请求地址} url 接口请求地址
- * @param {请求参数} options
- * @returns
- */
 export declare const createHttpSignStr: (url: string, options: any) => string;
 declare const _default: {
     createHttpSignStr: (url: string, options: any) => string;

package/es/{utils → security}/sign.js

@@ -1,15 +1,7 @@
 function _typeof(obj) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (obj) { return typeof obj; } : function (obj) { return obj && "function" == typeof Symbol && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }, _typeof(obj); }
 
-/*
- * @Author: 张国永 zhang.guoyong2@iwhalecloud.com
- * @Date: 2022-08-03 15:23:52
- * @LastEditors: 张国永 zhang.guoyong2@iwhalecloud.com
- * @LastEditTime: 2022-08-08 16:31:52
- * @FilePath: /lcdp-editor/packages/assets/src/utils/sign.ts
- * @Description: 这是默认设置,请设置`customMade`, 打开koroFileHeader查看配置 进行设置: https://github.com/OBKoro1/koro1FileHeader/wiki/%E9%85%8D%E7%BD%AE
- */
 import { sha256 } from 'js-sha256';
-var SIGN_KEY = process.env.SIGN_KEY || 'zrT5bi2escXilaH1fs653uZiH9RWfzCS'; // 1、签名算法：
+var SIGN_KEY = process.env.LING_XI_HTTP_SIGN_KEY || 'zrT5bi2escXilaH1fs653uZiH9RWfzCS'; // 1、签名算法：
 // 通过对url、参数、秘钥拼接成字符串，然后对字符串使用算法SHA-256得到64个字符串，放到header, X-SIGN=XXXXXXX。
 // 2、签名字符串拼接规则：
 // a.get 请求：url+"#"+header+"#"+参数+"#"+秘钥
@@ -28,8 +20,15 @@ var SIGN_KEY = process.env.SIGN_KEY || 'zrT5bi2escXilaH1fs653uZiH9RWfzCS'; // 1
  * @param {请求参数} options
  * @returns
  */
+// 由于X-B 的规则可能被业务网关使用，并往请求头增加内容，导致前后端加密不一致
+// 2022.08.09 使用以下3个固定值 + X-LX-*匹配 方式
 
+var hKeys = ['X-B-AUTH', 'X-B-TARGET-ID', 'APP-ID'];
 export var createHttpSignStr = function createHttpSignStr(url, options) {
+  if (!url || !options) {
+    return '';
+  }
+
   var method = options.method,
       headers = options.headers,
       body = options.body; // 获取参数1: 接口名称
@@ -39,32 +38,22 @@ export var createHttpSignStr = function createHttpSignStr(url, options) {
   var headerParams = '';
   var headersKeyArr = [];
   Object.keys(headers).forEach(function (key) {
-    if (key.startsWith('X-')) {
-      headersKeyArr.push(key.toLowerCase());
+    if (key.startsWith('X-LX-') || hKeys.includes(key)) {
+      headersKeyArr.push("".concat(key.toLowerCase(), "=").concat(headers[key]));
     }
   });
-
-  if (headers['APP-ID']) {
-    headersKeyArr.push('APP-ID'.toLowerCase());
-  }
-
-  if (headersKeyArr.length > 0) {
-    var tmpHeader = JSON.parse(JSON.stringify(headers));
-    Object.keys(headers).forEach(function (key) {
-      tmpHeader[key.toLowerCase()] = headers[key];
-    });
-    headerParams = headersKeyArr.sort().map(function (key) {
-      return "".concat(key, "=").concat(tmpHeader[key]);
-    }).join(';');
-  } // 获取参数3:
-
+  headerParams = headersKeyArr.sort().join(';'); // 获取参数3: 请求参数
 
   var params = '';
 
-  if (method === 'get') {
+  if (method.toLowerCase() === 'get') {
     params = url.split('?')[1] || '';
   } else {
     params = _typeof(body) === 'object' ? JSON.stringify(body) : body;
+  }
+
+  if (window.signDebug) {
+    console.log('sign', [apiName, headerParams, params, SIGN_KEY].join('#'));
   } // 生成约定签名
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lingxiteam/assets",
-  "version": "0.7.30-alpha.28",
+  "version": "0.7.30-alpha.30",
   "description": "灵犀低代码平台移动端 - 工具类",
   "main": "lib/index.js",
   "module": "es/index.js",

package/es/utils/index.d.ts

@@ -1 +0,0 @@
-

package/es/utils/index.js

@@ -1 +0,0 @@
-"use strict";