@polyv/request-plugin-authorize-app-sign 2.0.0

package/README.md

@@ -0,0 +1,103 @@
+# AuthorizeAppSignRequestPlugin
+
+用途：应用签名授权插件，使用后会在所有请求中插入应用签名信息。
+
+## 实例化参数
+
+| 参数名 | 用途 | 类型 | 默认值 |
+| - | - | - | - |
+| `appId` | 应用 ID | `string` | - |
+| `appSecret` | 应用密钥 | `string` | - |
+| `signatureNonce` | 是否使用防重放 | `boolean` | `false` |
+| `signatureMethod` | 签名方式 | `SignatureMethod` | `SignatureMethod.MD5` |
+| `getAppSign` | 获取应用签名信息的方法 | `function` | - |
+
+## 请求选项
+
+| 参数名 | 用途 | 类型 | 默认值 |
+| - | - | - | - |
+| `useAppSign` | 是否使用应用签名授权 | `boolean` | `true` |
+| `signatureNonce` | 是否使用防重放 | `boolean` | - |
+| `signatureMethod` | 签名方式 | `SignatureMethod` | - |
+
+## 应用签名信息类型
+
+`AppSignData` 类型如下：
+
+| 参数名 | 用途 | 类型 | 默认值 |
+| - | - | - | - |
+| `appId` | 应用 ID | `string` | - |
+| `timestamp` | 签名的时间戳 | `number` | - |
+| `sign` | 签名 | `string` | - |
+| `signatureMethod` | 签名方式 | `SignatureMethod` | - |
+
+## 使用方式
+
+```js
+import { PolyvRequest, SignatureMethod } from '@polyv/request-core';
+import { AuthorizeAppSignRequestPlugin } from '@polyv/request-plugin-authorize-app-sign';
+
+// 方式一：直接传入应用 ID 和密钥
+const requester = new PolyvRequest({
+  requestPlugins: [
+    new AuthorizeAppSignRequestPlugin({
+      appId: 'yourAppId',
+      appSecret: 'yourAppSecret',
+      signatureMethod: SignatureMethod.MD5,
+    }),
+  ]
+});
+
+// 方式二（推荐）：自定义获取应用签名信息的方法
+const requester = new PolyvRequest({
+  requestPlugins: [
+    new AuthorizeAppSignRequestPlugin({
+      getAppSign: async ({ params, signatureMethod }) => {
+        // 可以在这里实现自定义的签名逻辑
+        return {
+          appId: 'yourAppId',
+          timestamp: Date.now(),
+          sign: 'yourGeneratedSign',
+          signatureMethod,
+        };
+      },
+    }),
+  ]
+});
+
+// 使用防重放机制
+const requester = new PolyvRequest({
+  requestPlugins: [
+    new AuthorizeAppSignRequestPlugin({
+      appId: 'yourAppId',
+      appSecret: 'yourAppSecret',
+      signatureNonce: true,
+    }),
+  ]
+});
+
+// 如果你想在某个请求中使用不同的签名方式
+requester.get('/api/data', {}, {
+  signatureMethod: SignatureMethod.SHA256,
+});
+
+// 如果你想在某个请求中不使用应用签名授权
+requester.get('/api/data', {}, {
+  useAppSign: false,
+});
+```
+
+## 签名处理逻辑
+
+1. 插件会自动在请求中添加以下参数：
+   - `appId`: 应用 ID
+   - `timestamp`: 当前时间戳
+   - `sign`: 根据参数生成的签名
+   - `signatureMethod`: 签名方式（可选）
+   - `signatureNonce`: 防重放随机字符串（当启用防重放时）
+
+2. 签名生成逻辑有两种方式：
+   - 通过传入的 `appId` 和 `appSecret` 自动生成
+   - 通过自定义的 `getAppSign` 方法生成
+
+3. 当启用防重放机制时，每次请求会生成一个唯一的 `signatureNonce` 参数，用于防止请求被重放攻击

package/authorize-app-sign-plugin.d.ts

@@ -0,0 +1,23 @@
+import type { RequestOptions, RequestPlugin } from '@polyv/request-core';
+import { AuthorizeAppSignRequestPluginConfig } from './types';
+/**
+ * 应用签名授权请求插件
+ */
+export declare class AuthorizeAppSignRequestPlugin implements RequestPlugin {
+    private __config;
+    /** 应用 id */
+    private __appId;
+    /** 应用密钥 */
+    private __appSecret;
+    /** 是否使用放重放 */
+    private __signatureNonce;
+    /** 签名方式 */
+    private __signatureMethod;
+    /** 获取应用签名信息 */
+    private __getAppSign?;
+    constructor(__config: AuthorizeAppSignRequestPluginConfig);
+    usePlugin(options: RequestOptions): boolean;
+    interceptIncludeParams(options: RequestOptions): object | undefined;
+    interceptAuthorizeRequest(options: RequestOptions): Promise<RequestOptions>;
+    private __getAppSignData;
+}

package/authorize-app-sign-plugin.js

@@ -0,0 +1,88 @@
+import { v4 as uuidv4 } from 'uuid';
+import { SignatureMethod } from './types';
+import { getDataSign } from './utils';
+/**
+ * 应用签名授权请求插件
+ */
+export class AuthorizeAppSignRequestPlugin {
+    __config;
+    /** 应用 id */
+    __appId;
+    /** 应用密钥 */
+    __appSecret;
+    /** 是否使用放重放 */
+    __signatureNonce;
+    /** 签名方式 */
+    __signatureMethod;
+    /** 获取应用签名信息 */
+    __getAppSign;
+    constructor(__config) {
+        this.__config = __config;
+        this.__appId = __config.appId || '';
+        this.__appSecret = __config.appSecret || '';
+        this.__signatureNonce = __config.signatureNonce ?? false;
+        this.__signatureMethod = __config.signatureMethod ?? SignatureMethod.MD5;
+        this.__getAppSign = __config.getAppSign;
+    }
+    usePlugin(options) {
+        const { useAppSign = true } = options;
+        return useAppSign;
+    }
+    interceptIncludeParams(options) {
+        const { signatureNonce = this.__signatureNonce, signatureMethod = this.__signatureMethod } = options;
+        const includeParams = {};
+        // 加入放重放参数
+        if (signatureNonce) {
+            includeParams.signatureNonce = uuidv4();
+        }
+        // 加入签名方式
+        if (signatureMethod) {
+            includeParams.signatureMethod = signatureMethod;
+        }
+        return includeParams;
+    }
+    async interceptAuthorizeRequest(options) {
+        const params = {
+            ...(options.params || {}),
+        };
+        // 获取签名
+        const signData = await this.__getAppSignData(params, options);
+        if (signData) {
+            params.appId = signData.appId;
+            params.timestamp = signData.timestamp;
+            params.sign = signData.sign;
+            signData.signatureMethod && (params.signatureMethod = signData.signatureMethod);
+        }
+        else {
+            console.error('AuthorizeAppSignRequestPlugin error, signData is undefined');
+        }
+        return {
+            ...options,
+            params,
+        };
+    }
+    async __getAppSignData(params, options) {
+        const { signatureMethod = this.__signatureMethod } = options;
+        if (this.__getAppSign) {
+            return await this.__getAppSign({
+                params,
+                signatureMethod,
+            });
+        }
+        if (this.__appId && this.__appSecret) {
+            const timestamp = Date.now();
+            const targetData = {
+                ...params,
+                appId: this.__appId,
+                timestamp,
+            };
+            const sign = getDataSign(targetData, this.__appSecret, signatureMethod);
+            return {
+                appId: this.__appId,
+                timestamp,
+                sign,
+                signatureMethod,
+            };
+        }
+    }
+}

package/index.d.ts

@@ -0,0 +1,3 @@
+export * from './authorize-app-sign-plugin';
+export * from './types';
+export * from './request-options';

package/index.js

@@ -0,0 +1,3 @@
+export * from './authorize-app-sign-plugin';
+export * from './types';
+export * from './request-options';

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@polyv/request-plugin-authorize-app-sign",
+  "version": "2.0.0",
+  "main": "./index.js",
+  "dependencies": {
+    "@polyv/request-core": "2.0.0",
+    "md5": "2.3.0",
+    "sha256": "0.2.0",
+    "uuid": "^9.0.0"
+  },
+  "types": "./index.d.ts"
+}

package/request-options.d.ts

@@ -0,0 +1,27 @@
+import { SignatureMethod } from './types';
+export interface AuthorizeAppSignRequestOptions {
+    /**
+     * 是否使用应用签名授权
+     * @default true
+     * @plugin `AuthorizeAppSignRequestPlugin`
+     */
+    useAppSign?: boolean;
+    /**
+     * 是否使用放重放
+     * @plugin `AuthorizeAppSignRequestPlugin`
+     */
+    signatureNonce?: boolean;
+    /**
+     * 签名方式
+     * @plugin `AuthorizeAppSignRequestPlugin`
+     */
+    signatureMethod?: SignatureMethod;
+}
+declare module '@polyv/request-core' {
+    interface RequestCustomOptions extends AuthorizeAppSignRequestOptions {
+    }
+}
+declare module 'axios' {
+    interface AxiosRequestConfig extends AuthorizeAppSignRequestOptions {
+    }
+}

package/request-options.js

@@ -0,0 +1 @@
+export {};

package/types.d.ts

@@ -0,0 +1,67 @@
+import { UniversalParams } from '@polyv/request-core';
+/**
+ * 签名方式
+ */
+export declare enum SignatureMethod {
+    MD5 = "MD5",
+    SHA256 = "SHA256"
+}
+export interface AuthorizeAppSignRequestPluginConfig {
+    /**
+     * 应用 id
+     */
+    appId?: string;
+    /**
+     * 应用密钥
+     */
+    appSecret?: string;
+    /**
+     * 是否使用放重放
+     * @default false
+     */
+    signatureNonce?: boolean;
+    /**
+     * 签名方式
+     * @default SignatureMethod.MD5
+     */
+    signatureMethod?: SignatureMethod;
+    /**
+     * 获取应用签名信息
+     */
+    getAppSign?: GetAppSignFn;
+}
+/**
+ * 应用签名信息
+ */
+export interface AppSignData {
+    /**
+     * 应用 id
+     */
+    appId: string;
+    /**
+     * 签名的时间戳
+     */
+    timestamp: number;
+    /**
+     * 签名
+     */
+    sign: string;
+    /**
+     * 签名方式
+     */
+    signatureMethod: SignatureMethod;
+}
+export interface AppSignOptions {
+    /**
+     * 需要签名的参数
+     */
+    params: UniversalParams;
+    /**
+     * 签名方式
+     */
+    signatureMethod: SignatureMethod;
+}
+/**
+ * 获取应用签名方法
+ */
+export type GetAppSignFn = (signOptions: AppSignOptions) => Promise<AppSignData> | AppSignData;

package/types.js

@@ -0,0 +1,8 @@
+/**
+ * 签名方式
+ */
+export var SignatureMethod;
+(function (SignatureMethod) {
+    SignatureMethod["MD5"] = "MD5";
+    SignatureMethod["SHA256"] = "SHA256";
+})(SignatureMethod || (SignatureMethod = {}));

package/utils.d.ts

@@ -0,0 +1,9 @@
+import { SignatureMethod } from './types';
+/**
+ * 获取对象 key 排序后的字符串
+ */
+export declare function getSortDataText(data: object): string;
+/**
+ * 计算 sign 值
+ */
+export declare function getDataSign(data: object, secret: string, signatureMethod?: SignatureMethod): string;

package/utils.js

@@ -0,0 +1,23 @@
+import md5 from 'md5';
+import sha256 from 'sha256';
+import { SignatureMethod } from './types';
+/**
+ * 获取对象 key 排序后的字符串
+ */
+export function getSortDataText(data) {
+    let text = '';
+    const keys = Object.keys(data).sort();
+    for (const key of keys) {
+        text += `${key}${data[key]}`;
+    }
+    return text;
+}
+/**
+ * 计算 sign 值
+ */
+export function getDataSign(data, secret, signatureMethod = SignatureMethod.MD5) {
+    const text = getSortDataText(data);
+    const cryptoText = secret + text + secret;
+    const sign = signatureMethod === SignatureMethod.MD5 ? md5(cryptoText) : sha256(cryptoText);
+    return sign.toUpperCase();
+}