@maiyunnet/kebab 9.0.2 → 9.1.1

package/sys/ctr.js

@@ -78,12 +78,12 @@ export class Ctr {
     }
     /** --- timeout 的 timer --- */
     _timer;
-    /** --- 获取当前过期时间 --- */
+    /** --- 获取当前过期时间（毫秒） --- */
     get timeout() {
         return this._timer?.timeout ?? 30_000;
     }
     /**
-     * --- 设置当前过期时间 ---
+     * --- 设置当前过期时间（毫秒） ---
      */
     set timeout(num) {
         if (!this._timer) {
@@ -249,8 +249,9 @@ export class Ctr {
      * @param opt 可选配置
      */
     async _loadReactPage(path, props = {}, opt = {}) {
+        // --- 约定：传入路径不含 .page 后缀，框架自动补全（对应 build 命令的 *.page.tsx 约定）---
         // --- 组件 JS 从 stc 目录读取，浏览器同样通过 staticPath（支持 CDN）下载 ---
-        const componentPath = this._config.const.rootPath + 'stc/' + path + '.js';
+        const componentPath = this._config.const.rootPath + 'stc/' + path + '.page.js';
         if (!await lFs.isFile(componentPath)) {
             return '';
         }
@@ -280,56 +281,67 @@ export class Ctr {
                 '_locale': this._locale,
                 '_localeData': localeData,
             };
+            // --- 框架自动注入的 HTML 片段，用户组件无需手动渲染 ---
+            let headInject = '';
+            let bodyInject = '';
             if (opt.hydrate !== false) {
                 const reactVer = opt.reactVer ?? '19';
                 const esm = 'https://esm.sh/';
                 // --- 检查是否有 npx kebab build 生成的自包含预构建包 ---
-                const bundlePath = this._config.const.rootPath + 'stc/' + path + '.bundle.js';
+                const bundlePath = this._config.const.rootPath + 'stc/' + path + '.page.bundle.js';
                 const hasBundle = await lFs.isFile(bundlePath);
                 if (opt.router === 'browser') {
-                    // --- BrowserRouter 模式：_routerBase 注入 props，bundle 读取此值决定是否包裹 BrowserRouter ---
+                    // --- BrowserRouter 模式：_routerBase 注入 props，供水合脚本读取 ---
                     const base = opt.routerBase ?? '';
                     const routerBase = this._config.const.urlBase + base.replace(/^\//, '');
                     fullProps['_routerBase'] = routerBase.replace(/\/$/, '');
                 }
+                // --- propsJson 在渲染前序列化，框架直接注入 HTML，组件无需手动渲染 ---
+                const propsJson = lText.stringifyJson(fullProps).replace(/<\/script>/gi, '<\\/script>');
+                let hydrateScript;
                 if (hasBundle) {
-                    // --- bundle 模式：bundle 自包含 React + 水合逻辑，无需 import map，一个 JS 文件搞定 ---
-                    const clientUrl = `${staticPath}${path}.bundle.js?v=${this._config.set.staticVer}`;
-                    fullProps['_hydrateScript'] = `import'${clientUrl}';`;
+                    // --- bundle 模式：bundle 自包含 React + 水合逻辑，无需 import map ---
+                    const clientUrl = `${staticPath}${path}.page.bundle.js?v=${this._config.set.staticVer}`;
+                    hydrateScript = `import'${clientUrl}';`;
                 }
                 else {
                     // --- 开发模式（tsc 编译 .js）：通过 esm.sh import map 解析 bare import ---
-                    const clientUrl = `${staticPath}${path}.js?v=${this._config.set.staticVer}`;
-                    fullProps['_importMapJson'] = lText.stringifyJson({
-                        'imports': {
-                            'react': `${esm}react@${reactVer}`,
-                            'react-dom': `${esm}react-dom@${reactVer}`,
-                            'react-dom/client': `${esm}react-dom@${reactVer}/client`,
-                            'react/jsx-runtime': `${esm}react@${reactVer}/jsx-runtime`,
-                            'react-router-dom': `${esm}react-router-dom@7?external=react,react-dom`,
-                        },
-                    });
-                    if (opt.router === 'browser') {
-                        fullProps['_hydrateScript'] =
-                            `import{hydrateRoot}from'react-dom/client';` +
-                                `import{createElement}from'react';` +
-                                `import{BrowserRouter}from'react-router-dom';` +
-                                `import App from'${clientUrl}';` +
-                                `const p=JSON.parse(document.getElementById('__kebab_props__').textContent);` +
-                                `hydrateRoot(document,createElement(BrowserRouter,{basename:p._routerBase},createElement(App,p)));`;
-                    }
-                    else {
-                        fullProps['_hydrateScript'] =
-                            `import{hydrateRoot}from'react-dom/client';` +
-                                `import{createElement}from'react';` +
-                                `import App from'${clientUrl}';` +
-                                `const p=JSON.parse(document.getElementById('__kebab_props__').textContent);` +
-                                `hydrateRoot(document,createElement(App,p));`;
+                    const clientUrl = `${staticPath}${path}.page.js?v=${this._config.set.staticVer}`;
+                    // --- 内置 import map 条目（React 生态核心包）---
+                    const builtinImports = {
+                        'react': `${esm}react@${reactVer}`,
+                        'react-dom': `${esm}react-dom@${reactVer}`,
+                        'react-dom/client': `${esm}react-dom@${reactVer}/client`,
+                        'react/jsx-runtime': `${esm}react@${reactVer}/jsx-runtime`,
+                        'react-router-dom': `${esm}react-router-dom@7?external=react,react-dom`,
+                    };
+                    // --- 自动扫描入口 JS 及其相对引用，收集所有第三方 bare specifier ---
+                    const scannedFiles = new Set();
+                    const extraImports = new Set();
+                    await this._scanImports(componentPath, scannedFiles, extraImports, builtinImports);
+                    // --- 第三方包统一通过 esm.sh 解析，external react/react-dom 避免重复加载 ---
+                    for (const pkg of extraImports) {
+                        builtinImports[pkg] = `${esm}${pkg}?external=react,react-dom`;
                     }
+                    // --- import map 注入到 </head> 前 ---
+                    headInject = `<script type="importmap">${lText.stringifyJson({ 'imports': builtinImports })}</script>`;
+                    // --- BrowserRouter 模式多一段 Router 导入与包裹层 ---
+                    const routerImport = opt.router === 'browser' ? `import{BrowserRouter}from'react-router-dom';` : '';
+                    const routerCreate = opt.router === 'browser'
+                        ? `createElement(BrowserRouter,{basename:p._routerBase},createElement(App,p))`
+                        : `createElement(App,p)`;
+                    hydrateScript =
+                        `import{hydrateRoot}from'react-dom/client';` +
+                            `import{createElement}from'react';` +
+                            routerImport +
+                            `import App from'${clientUrl}';` +
+                            `const p=JSON.parse(document.getElementById('__kebab_props__').textContent);` +
+                            `hydrateRoot(document,${routerCreate});`;
                 }
-                // --- _propsJson 序列化当前 fullProps（不含 _propsJson 本身，避免循环引用）---
-                // --- 客户端水合时读取此 JSON，_propsJson 缺失，suppressHydrationWarning 处理差异 ---
-                fullProps['_propsJson'] = lText.stringifyJson(fullProps).replace(/<\/script>/gi, '<\\/script>');
+                // --- props JSON + 水合脚本注入到 </body> 前 ---
+                bodyInject =
+                    `<script id="__kebab_props__" type="application/json">${propsJson}</script>` +
+                        `<script type="module">${hydrateScript}</script>`;
             }
             // --- BrowserRouter 模式：服务端用 StaticRouter 渲染，与客户端的 BrowserRouter 等价 ---
             // --- component 来自动态 import，TypeScript 无法精确推断，需要明确限定 element 类型 ---
@@ -343,13 +355,51 @@ export class Ctr {
                     'basename': fullProps['_routerBase'],
                 }, react.createElement(component, fullProps));
             }
-            return '<!DOCTYPE html>' + reactDomServer.renderToString(element);
+            // --- 框架将 import map 注入 </head> 前，props JSON + 水合脚本注入 </body> 前 ---
+            let html = '<!DOCTYPE html>' + reactDomServer.renderToString(element);
+            if (opt.hydrate !== false) {
+                html = html.replace('</head>', headInject + '</head>');
+                html = html.replace('</body>', bodyInject + '</body>');
+            }
+            return html;
         }
         catch (e) {
             lCore.debug(`[CTR][_loadReactPage] ${e.message ?? ''}`);
             return '';
         }
     }
+    /**
+     * --- 递归扫描 JS 文件中的 import 语句，收集第三方 bare specifier ---
+     * @param filePath 当前要扫描的文件绝对路径
+     * @param scannedFiles 已扫描文件集（去重用）
+     * @param extraImports 收集到的第三方包名集合
+     * @param builtinImports 内置 import map，已有条目不重复添加
+     */
+    async _scanImports(filePath, scannedFiles, extraImports, builtinImports) {
+        if (scannedFiles.has(filePath)) {
+            return;
+        }
+        scannedFiles.add(filePath);
+        const src = await lFs.getContent(filePath, 'utf8');
+        if (!src) {
+            return;
+        }
+        const re = /\bfrom\s*['"]([^'"]+)['"]/g;
+        let m;
+        while ((m = re.exec(src)) !== null) {
+            const spec = m[1];
+            if (spec.startsWith('./') || spec.startsWith('../')) {
+                // --- 相对引用：解析为绝对路径后递归扫描 ---
+                const dir = filePath.substring(0, filePath.lastIndexOf('/') + 1);
+                const resolved = new URL(spec, 'file://' + dir).pathname;
+                await this._scanImports(resolved, scannedFiles, extraImports, builtinImports);
+            }
+            else if (!spec.startsWith('/') && !spec.startsWith('http') && !(spec in builtinImports)) {
+                // --- 第三方 bare specifier：加入 import map ---
+                extraImports.add(spec);
+            }
+        }
+    }
     /**
      * --- 设置校验错误返回值 ---
      * @param rtn 返回值数组
@@ -592,10 +642,10 @@ export class Ctr {
         }
         return 'unknown';
     }
-    /** --- auth 对象，user, pwd --- */
+    /** --- auth 对象 --- */
     _authorization = null;
     /**
-     * --- 通过 header 或 _auth 获取 Basic Auth 鉴权信息 ---
+     * --- 通过 header 或 _auth 获取鉴权信息，支持 Basic Auth 和 Bearer Token ---
      */
     getAuthorization() {
         if (this._authorization !== null) {
@@ -614,15 +664,28 @@ export class Ctr {
         if (typeof auth !== 'string') {
             return false;
         }
-        let authArr = auth.split(' ');
-        if (authArr[1] === undefined) {
+        const spaceIdx = auth.indexOf(' ');
+        if (spaceIdx === -1) {
             return false;
         }
-        if (!(auth = lCrypto.base64Decode(authArr[1]))) {
+        const scheme = auth.slice(0, spaceIdx).toLowerCase();
+        const credential = auth.slice(spaceIdx + 1).trim();
+        if (!credential) {
+            return false;
+        }
+        if (scheme === 'bearer') {
+            this._authorization = { 'type': 'bearer', 'token': credential };
+            return this._authorization;
+        }
+        // --- Basic Auth: base64(user:pwd) ---
+        const decoded = lCrypto.base64Decode(credential);
+        if (!decoded) {
             return false;
         }
-        authArr = auth.split(':');
-        this._authorization = { 'user': authArr[0], 'pwd': authArr[1] ?? '' };
+        const colonIdx = decoded.indexOf(':');
+        const user = colonIdx === -1 ? decoded : decoded.slice(0, colonIdx);
+        const pwd = colonIdx === -1 ? '' : decoded.slice(colonIdx + 1);
+        this._authorization = { 'type': 'basic', 'user': user, 'pwd': pwd };
         return this._authorization;
     }
     /**

package/sys/monitor.js

@@ -411,7 +411,7 @@ function logSpike(alerts, cpuPercent, cpuOs, eloopLag, blocked = false) {
  */
 function getOsCpuPercent() {
     const cpus = os.cpus();
-    if (!lastOsCpus || lastOsCpus.length !== cpus.length) {
+    if (lastOsCpus?.length !== cpus.length) {
         lastOsCpus = cpus;
         return 0;
     }

package/sys/route.js

@@ -227,8 +227,18 @@ export async function run(data) {
     if (data.req.headers['cookie']) {
         const hcookies = data.req.headers['cookie'].split(';');
         for (const cookie of hcookies) {
-            const co = cookie.split('=');
-            cookies[co[0].trim()] = decodeURIComponent(co[1]);
+            const eqIndex = cookie.indexOf('=');
+            if (eqIndex === -1) {
+                continue;
+            }
+            const key = cookie.slice(0, eqIndex).trim();
+            const rawVal = cookie.slice(eqIndex + 1);
+            try {
+                cookies[key] = decodeURIComponent(rawVal);
+            }
+            catch {
+                cookies[key] = rawVal;
+            }
         }
     }
     // --- 处理 headers ---
@@ -818,11 +828,30 @@ export function getPost(req) {
             return;
         }
         // --- json 或普通 post ---
+        /** --- POST body 最大允许 50 MB，防止攻击者发送超大请求体耗尽内存 --- */
+        const maxPostSize = 50 * 1024 * 1024;
         let buffer = Buffer.from('');
+        let overflow = false;
         req.on('data', function (chunk) {
+            if (overflow) {
+                return;
+            }
+            if (buffer.length + chunk.length > maxPostSize) {
+                overflow = true;
+                buffer = Buffer.from('');
+                return;
+            }
             buffer = Buffer.concat([buffer, chunk], buffer.length + chunk.length);
         });
         req.on('end', function () {
+            if (overflow) {
+                resolve({
+                    'input': '',
+                    'raw': {},
+                    'post': {},
+                });
+                return;
+            }
             const s = buffer.toString();
             if (!s) {
                 resolve({

package/www/example/ctr/test.d.ts

@@ -127,6 +127,10 @@ export default class extends sCtr.Ctr {
      * --- Rate Limit 限流测试 ---
      */
     ratelimit(): Promise<string>;
+    /**
+     * --- React 最简页面示例：展示一个 React 页面最少需要写哪些内容 ---
+     */
+    reactHelloPage(): Promise<string>;
     /**
      * --- React 全页模式测试：组件自主渲染完整 HTML 文档 + 客户端水合，无需 EJS ---
      */

package/www/example/ctr/test.js

@@ -98,6 +98,7 @@ export default class extends sCtr.Ctr {
             `<br><a href="${this._config.const.urlBase}test/react-page">View "test/react-page" (SSR)</a>`,
             `<br><a href="${this._config.const.urlBase}test/react-router-page">View "test/react-router-page" (SSR + BrowserRouter)</a>`,
             `<br><a href="${this._config.const.urlBase}test/react-router-page-data?path=/user">View "test/react-router-page-data?path=/user" (Data API)</a>`,
+            `<br><a href="${this._config.const.urlBase}test/react-hello-page">View "test/react-hello-page" (React Hello Page)</a>`,
             '<br><br><b>Return json:</b>',
             `<br><br><a href="${this._config.const.urlBase}test/json?type=1">View "test/json?type=1"</a>`,
             `<br><a href="${this._config.const.urlBase}test/json?type=2">View "test/json?type=2"</a>`,
@@ -161,7 +162,7 @@ export default class extends sCtr.Ctr {
             `<br><br><a href="${this._config.const.urlBase}test/crypto">View "test/crypto"</a>`,
             '<br><br><b>Db:</b>',
             `<br><br><a href="${this._config.const.urlBase}test/db">View "test/db"</a> <a href="${this._config.const.urlBase}test/db?s=pgsql">pgsql</a>`,
-            `<br><br><a href="${this._config.const.urlBase}test/db-read">View "test/db-read"</a>`,
+            `<br><a href="${this._config.const.urlBase}test/db-read">View "test/db-read"</a>`,
             `<br><br><b>Vector:</b>`,
             `<br><br><a href="${this._config.const.urlBase}test/vector">View "test/vector"</a>`,
             '<br><br><b>Kv:</b>',
@@ -3907,12 +3908,20 @@ send.addEventListener('click', async () => {
         echo.push(`Result: ${JSON.stringify(rtn2)}`);
         return echo.join('') + '<br><br>' + this._getEnd();
     }
+    /**
+     * --- React 最简页面示例：展示一个 React 页面最少需要写哪些内容 ---
+     */
+    async reactHelloPage() {
+        return this._loadReactPage('view/hello', {
+            'greeting': 'Hello, Kebab React!',
+        });
+    }
     /**
      * --- React 全页模式测试：组件自主渲染完整 HTML 文档 + 客户端水合，无需 EJS ---
      */
     async reactPage() {
         // --- Ctr 方法负责数据准备（可以查数据库、调接口等），组件不包含任何服务端专属代码 ---
-        return this._loadReactPage('view/react-page', {
+        return this._loadReactPage('view/react', {
             'title': 'Kebab React Full Page',
             'serverTime': lTime.format(this, 'Y-m-d H:i:s'),
             'node': process.version,
@@ -3956,7 +3965,7 @@ send.addEventListener('click', async () => {
             ? (reqUrl.substring(basePrefix.length) || '/')
             : '/';
         const routeData = this._getRouteData(routePath);
-        return this._loadReactPage('view/react-router-page', {
+        return this._loadReactPage('view/react-router', {
             'title': 'Kebab React Router',
             'serverTime': lTime.format(this, 'Y-m-d H:i:s'),
             'node': process.version,