@sfmc-bds/db-server 0.2.0-beta.6 → 0.2.0-beta.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"module-auth.d.ts","sourceRoot":"","sources":["../src/module-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AASD,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,
|
|
1
|
+
{"version":3,"file":"module-auth.d.ts","sourceRoot":"","sources":["../src/module-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AASD,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAIpE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,aAAa,CAgChB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAInE;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAQjG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIhF;AAED,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIhF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC/B,GAAG,MAAM,GAAG,IAAI,CAuBhB"}
|
package/dist/module-auth.js
CHANGED
|
@@ -26,13 +26,9 @@ function buildModuleAuth(opts) {
|
|
|
26
26
|
generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
|
|
27
27
|
secretGenerated: !opts.envAuthToken
|
|
28
28
|
});
|
|
29
|
-
log.success(
|
|
30
|
-
`[auth] \u5DF2\u4E3A ${opts.enabledModuleIds.length} \u4E2A\u6A21\u5757\u6D3E\u751F HMAC token,\u5199\u5165 ${outFile}`
|
|
31
|
-
);
|
|
29
|
+
log.success(`[auth] \u5DF2\u4E3A ${opts.enabledModuleIds.length} \u4E2A\u6A21\u5757\u6D3E\u751F HMAC token,\u5199\u5165 ${outFile}`);
|
|
32
30
|
if (!opts.envAuthToken) {
|
|
33
|
-
log.warn(
|
|
34
|
-
"[auth] \u672A\u914D\u7F6E env.AUTH_TOKEN(\u51B2\u7A81 config http_auth),\u672C\u6B21\u542F\u52A8\u4F7F\u7528\u4E86\u968F\u673A secret; \u91CD\u542F\u540E token \u4F1A\u53D8,host-bootstrap \u5FC5\u987B\u6BCF\u6B21\u91CD\u65B0\u8BFB module-tokens.json"
|
|
35
|
-
);
|
|
31
|
+
log.warn("[auth] \u672A\u914D\u7F6E env.AUTH_TOKEN,\u672C\u6B21\u542F\u52A8\u4F7F\u7528\u4E86\u968F\u673A secret;");
|
|
36
32
|
}
|
|
37
33
|
if (process.env.SFMC_LOG_MODULE_TOKEN === "1") {
|
|
38
34
|
log.info("[auth] module tokens (SFMC_LOG_MODULE_TOKEN=1):");
|
package/dist/module-auth.js.map
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"version": 3,
|
|
3
3
|
"sources": ["../src/module-auth.ts"],
|
|
4
|
-
"sourcesContent": ["/**\n * module-auth.ts \u2014 \u6A21\u5757\u8EAB\u4EFD\u7684 HMAC token \u6D3E\u751F\u4E0E\u6821\u9A8C\n *\n * \u4E24\u5957\u5E76\u5B58:\n * - `env.AUTH_TOKEN` (config db_config.json http_auth):sfmc \u7BA1\u63A7 / \u5E73\u53F0\u5185\u90E8\u7528\n * - `moduleTokens[moduleId]`:db-server \u7ED9\u6BCF\u4E2A enabled \u6A21\u5757\u5728\u542F\u52A8\u65F6\u6D3E\u751F,\n * \u5199\u5230\u300C\u4E0E\u6570\u636E\u5E93\u540C\u76EE\u5F55\u300D\u7684 module-tokens.json\uFF08\u8DDF db_config.dbDir \u8D70\uFF0C\u52FF\u5199\u6B7B ROOT/data\uFF09,\n * SAPI \u7ECF loopback API \u6CE8\u5165 setDbModuleContext\u3002\n *\n * \u6D3E\u751F\u516C\u5F0F:\n * module_token = HMAC-SHA256(auth_secret, \"sfmc-module:\" + moduleId).hex\n *\n * auth_secret \u4F18\u5148\u7EA7:\n * 1. env.AUTH_TOKEN\n * 2. \u542F\u52A8\u65F6\u968F\u673A\u751F\u6210(\u65E0 AUTH_TOKEN \u65F6),\u5199\u5230 module-tokens.json,\n * \u53EA\u8B66\u544A\u4E00\u6B21(\u6BCF\u6B21\u91CD\u542F\u6A21\u5757 token \u90FD\u53D8,SAPI host \u5FC5\u987B\u91CD\u8BFB\u6587\u4EF6)\n *\n * \u6821\u9A8C:\n * - HTTP `Authorization: Bearer <module_token>` \u5934\n * - Query `?moduleId=<id>`\n * - \u4E24\u90FD\u5339\u914D = \u8C03\u7528\u65B9\u8EAB\u4EFD\n * - \u6821\u9A8C\u8C03\u7528\u65B9 moduleId \u5728 enabled \u5217\u8868(\u5426\u5219 403)\n */\n\nimport { readJson, writeJson, type TokenStore } from \"@sfmc-bds/sdk/node/config\";\nimport { createHmac, randomBytes } from \"node:crypto\";\nimport { dirname, join } from \"node:path\";\nimport { log } from \"./lib/log.js\";\n\nexport interface ModuleAuthMap {\n /** moduleId \u2192 hex token */\n tokens: Record<string, string>;\n /** \u7528\u4E8E\u6D3E\u751F token \u7684 secret (env.AUTH_TOKEN \u6216\u672C\u6B21\u542F\u52A8\u968F\u673A\u751F\u6210) */\n secret: string;\n}\n\nconst IDENT = /^[A-Za-z0-9_\\-]+$/;\n\nfunction safeId(id: string): string {\n if (!IDENT.test(id)) throw new Error(`[auth] invalid module id: ${id}`);\n return id;\n}\n\n/** token \u6587\u4EF6\u4E0E SQLite \u540C\u76EE\u5F55\uFF08\u7531 dbDir \u51B3\u5B9A\uFF0C\u907F\u514D\u5411\u5BFC\u9009\u76EE\u5F55\u524D\u5C31\u521B\u5EFA ROOT/data\uFF09 */\nexport function moduleTokensFile(dbPath: string): string {\n return join(dirname(dbPath), \"module-tokens.json\");\n}\n\nexport function deriveToken(moduleId: string, secret: string): string {\n return createHmac(\"sha256\", secret).update(`sfmc-module:${safeId(moduleId)}`).digest(\"hex\");\n}\n\n/**\n * \u542F\u52A8\u65F6\u8C03\u7528\u4E00\u6B21:\n * - \u628A env.AUTH_TOKEN \u5F53 secret\n * - \u7ED9\u6BCF\u4E2A enabled moduleId \u6D3E\u751F token\n * - \u5199 module-tokens.json\uFF08\u4E0E DB \u540C\u76EE\u5F55\uFF09\n * - \u63A7\u5236\u53F0\u6253\u5370\u6458\u8981(env var SFMC_LOG_MODULE_TOKEN=1 \u65F6\u6253\u5B8C\u6574)\n */\nexport function buildModuleAuth(opts: {\n dbPath: string;\n envAuthToken: string;\n enabledModuleIds: string[];\n}): ModuleAuthMap {\n const secret = opts.envAuthToken || randomBytes(32).toString(\"hex\");\n const tokens: Record<string, string> = {};\n for (const id of opts.enabledModuleIds) {\n tokens[id] = deriveToken(id, secret);\n }\n\n const outFile = moduleTokensFile(opts.dbPath);\n writeJson(outFile, {\n tokens,\n secret,\n generatedAt: new Date().toISOString(),\n secretGenerated: !opts.envAuthToken,\n });\n\n log.success(
|
|
5
|
-
"mappings": "AAwBA,SAAS,UAAU,iBAAkC;AACrD,SAAS,YAAY,mBAAmB;AACxC,SAAS,SAAS,YAAY;AAC9B,SAAS,WAAW;AASpB,MAAM,QAAQ;AAEd,SAAS,OAAO,IAAoB;AAClC,MAAI,CAAC,MAAM,KAAK,EAAE,EAAG,OAAM,IAAI,MAAM,6BAA6B,EAAE,EAAE;AACtE,SAAO;AACT;AAGO,SAAS,iBAAiB,QAAwB;AACvD,SAAO,KAAK,QAAQ,MAAM,GAAG,oBAAoB;AACnD;AAEO,SAAS,YAAY,UAAkB,QAAwB;AACpE,SAAO,WAAW,UAAU,MAAM,
|
|
4
|
+
"sourcesContent": ["/**\n * module-auth.ts \u2014 \u6A21\u5757\u8EAB\u4EFD\u7684 HMAC token \u6D3E\u751F\u4E0E\u6821\u9A8C\n *\n * \u4E24\u5957\u5E76\u5B58:\n * - `env.AUTH_TOKEN` (config db_config.json http_auth):sfmc \u7BA1\u63A7 / \u5E73\u53F0\u5185\u90E8\u7528\n * - `moduleTokens[moduleId]`:db-server \u7ED9\u6BCF\u4E2A enabled \u6A21\u5757\u5728\u542F\u52A8\u65F6\u6D3E\u751F,\n * \u5199\u5230\u300C\u4E0E\u6570\u636E\u5E93\u540C\u76EE\u5F55\u300D\u7684 module-tokens.json\uFF08\u8DDF db_config.dbDir \u8D70\uFF0C\u52FF\u5199\u6B7B ROOT/data\uFF09,\n * SAPI \u7ECF loopback API \u6CE8\u5165 setDbModuleContext\u3002\n *\n * \u6D3E\u751F\u516C\u5F0F:\n * module_token = HMAC-SHA256(auth_secret, \"sfmc-module:\" + moduleId).hex\n *\n * auth_secret \u4F18\u5148\u7EA7:\n * 1. env.AUTH_TOKEN\n * 2. \u542F\u52A8\u65F6\u968F\u673A\u751F\u6210(\u65E0 AUTH_TOKEN \u65F6),\u5199\u5230 module-tokens.json,\n * \u53EA\u8B66\u544A\u4E00\u6B21(\u6BCF\u6B21\u91CD\u542F\u6A21\u5757 token \u90FD\u53D8,SAPI host \u5FC5\u987B\u91CD\u8BFB\u6587\u4EF6)\n *\n * \u6821\u9A8C:\n * - HTTP `Authorization: Bearer <module_token>` \u5934\n * - Query `?moduleId=<id>`\n * - \u4E24\u90FD\u5339\u914D = \u8C03\u7528\u65B9\u8EAB\u4EFD\n * - \u6821\u9A8C\u8C03\u7528\u65B9 moduleId \u5728 enabled \u5217\u8868(\u5426\u5219 403)\n */\n\nimport { readJson, writeJson, type TokenStore } from \"@sfmc-bds/sdk/node/config\";\nimport { createHmac, randomBytes } from \"node:crypto\";\nimport { dirname, join } from \"node:path\";\nimport { log } from \"./lib/log.js\";\n\nexport interface ModuleAuthMap {\n /** moduleId \u2192 hex token */\n tokens: Record<string, string>;\n /** \u7528\u4E8E\u6D3E\u751F token \u7684 secret (env.AUTH_TOKEN \u6216\u672C\u6B21\u542F\u52A8\u968F\u673A\u751F\u6210) */\n secret: string;\n}\n\nconst IDENT = /^[A-Za-z0-9_\\-]+$/;\n\nfunction safeId(id: string): string {\n if (!IDENT.test(id)) throw new Error(`[auth] invalid module id: ${id}`);\n return id;\n}\n\n/** token \u6587\u4EF6\u4E0E SQLite \u540C\u76EE\u5F55\uFF08\u7531 dbDir \u51B3\u5B9A\uFF0C\u907F\u514D\u5411\u5BFC\u9009\u76EE\u5F55\u524D\u5C31\u521B\u5EFA ROOT/data\uFF09 */\nexport function moduleTokensFile(dbPath: string): string {\n return join(dirname(dbPath), \"module-tokens.json\");\n}\n\nexport function deriveToken(moduleId: string, secret: string): string {\n return createHmac(\"sha256\", secret)\n .update(`sfmc-module:${safeId(moduleId)}`)\n .digest(\"hex\");\n}\n\n/**\n * \u542F\u52A8\u65F6\u8C03\u7528\u4E00\u6B21:\n * - \u628A env.AUTH_TOKEN \u5F53 secret\n * - \u7ED9\u6BCF\u4E2A enabled moduleId \u6D3E\u751F token\n * - \u5199 module-tokens.json\uFF08\u4E0E DB \u540C\u76EE\u5F55\uFF09\n * - \u63A7\u5236\u53F0\u6253\u5370\u6458\u8981(env var SFMC_LOG_MODULE_TOKEN=1 \u65F6\u6253\u5B8C\u6574)\n */\nexport function buildModuleAuth(opts: {\n dbPath: string;\n envAuthToken: string;\n enabledModuleIds: string[];\n}): ModuleAuthMap {\n const secret = opts.envAuthToken || randomBytes(32).toString(\"hex\");\n const tokens: Record<string, string> = {};\n for (const id of opts.enabledModuleIds) {\n tokens[id] = deriveToken(id, secret);\n }\n\n const outFile = moduleTokensFile(opts.dbPath);\n writeJson(outFile, {\n tokens,\n secret,\n generatedAt: new Date().toISOString(),\n secretGenerated: !opts.envAuthToken,\n });\n\n log.success(`[auth] \u5DF2\u4E3A ${opts.enabledModuleIds.length} \u4E2A\u6A21\u5757\u6D3E\u751F HMAC token,\u5199\u5165 ${outFile}`);\n if (!opts.envAuthToken) {\n log.warn(\"[auth] \u672A\u914D\u7F6E env.AUTH_TOKEN,\u672C\u6B21\u542F\u52A8\u4F7F\u7528\u4E86\u968F\u673A secret;\");\n }\n if (process.env.SFMC_LOG_MODULE_TOKEN === \"1\") {\n log.info(\"[auth] module tokens (SFMC_LOG_MODULE_TOKEN=1):\");\n for (const [id, t] of Object.entries(tokens)) {\n log.info(` ${id} = ${t}`);\n }\n } else {\n const lines = Object.entries(tokens)\n .map(([id, t]) => ` ${id} = ${t.slice(0, 6)}\u2026${t.slice(-4)}`)\n .join(\"\\n\");\n log.info(`[auth] token \u6458\u8981:\\n${lines}`);\n }\n\n return { tokens, secret };\n}\n\nexport function loadModuleAuth(dbPath: string): ModuleAuthMap | null {\n const parsed = readJson<TokenStore>(moduleTokensFile(dbPath));\n if (!parsed || !parsed.tokens || !parsed.secret) return null;\n return { tokens: parsed.tokens, secret: parsed.secret };\n}\n\n/** \u628A\u5F53\u524D auth map \u5199\u56DE module-tokens.json(\u70ED\u66F4\u65B0 token \u65F6\u590D\u7528) */\nexport function persistModuleAuth(dbPath: string, auth: ModuleAuthMap, envAuthToken: string): void {\n const outFile = moduleTokensFile(dbPath);\n writeJson(outFile, {\n tokens: auth.tokens,\n secret: auth.secret,\n generatedAt: new Date().toISOString(),\n secretGenerated: !envAuthToken,\n } satisfies TokenStore);\n}\n\n/**\n * \u786E\u4FDD moduleId \u5728 auth.tokens \u4E2D\u6709\u6D3E\u751F\u503C(\u590D\u7528\u73B0\u6709 secret,\u52FF\u91CD\u5EFA\u968F\u673A secret)\u3002\n * @returns \u662F\u5426\u65B0\u5199\u5165\u4E86 token\n */\nexport function ensureModuleToken(auth: ModuleAuthMap, moduleId: string): boolean {\n if (auth.tokens[moduleId]) return false;\n auth.tokens[moduleId] = deriveToken(moduleId, auth.secret);\n return true;\n}\n\n/** \u7981\u7528\u65F6\u64A4\u9500\u5185\u5B58\u4E2D\u7684 token(\u78C1\u76D8\u7531 persistModuleAuth \u540C\u6B65) */\nexport function revokeModuleToken(auth: ModuleAuthMap, moduleId: string): boolean {\n if (!(moduleId in auth.tokens)) return false;\n delete auth.tokens[moduleId];\n return true;\n}\n\n/**\n * \u6821\u9A8C\u8BF7\u6C42\u65B9\u8EAB\u4EFD:\n * - Bearer \u5934 / X-Module-Token \u4E8C\u9009\u4E00\n * - ?moduleId=<id> \u5FC5\u987B\u5B58\u5728\n * - \u6A21\u5757\u5FC5\u987B\u5728 enabledModuleIds \u96C6\u5408\u4E2D\n * - token \u5FC5\u987B = deriveToken(moduleId, secret)\n * \u8FD4\u56DE\u6A21\u5757 ID \u6216 null\u3002\n */\nexport function verifyModuleAuth(opts: {\n headers: NodeJS.Dict<string | string[]>;\n params: URLSearchParams;\n auth: ModuleAuthMap;\n enabledModuleIds: Set<string>;\n}): string | null {\n const moduleId = opts.params.get(\"moduleId\") || \"\";\n if (!moduleId || !opts.enabledModuleIds.has(moduleId)) return null;\n\n let provided = \"\";\n const auth = opts.headers[\"authorization\"];\n const token = opts.headers[\"x-module-token\"];\n if (typeof auth === \"string\" && auth.startsWith(\"Bearer \")) {\n provided = auth.slice(7);\n } else if (typeof token === \"string\") {\n provided = token;\n }\n if (!provided) return null;\n\n const expected = opts.auth.tokens[moduleId];\n if (!expected) return null;\n // constant-time \u6BD4\u8F83\n if (provided.length !== expected.length) return null;\n let diff = 0;\n for (let i = 0; i < provided.length; i++) {\n diff |= provided.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return diff === 0 ? moduleId : null;\n}\n"],
|
|
5
|
+
"mappings": "AAwBA,SAAS,UAAU,iBAAkC;AACrD,SAAS,YAAY,mBAAmB;AACxC,SAAS,SAAS,YAAY;AAC9B,SAAS,WAAW;AASpB,MAAM,QAAQ;AAEd,SAAS,OAAO,IAAoB;AAClC,MAAI,CAAC,MAAM,KAAK,EAAE,EAAG,OAAM,IAAI,MAAM,6BAA6B,EAAE,EAAE;AACtE,SAAO;AACT;AAGO,SAAS,iBAAiB,QAAwB;AACvD,SAAO,KAAK,QAAQ,MAAM,GAAG,oBAAoB;AACnD;AAEO,SAAS,YAAY,UAAkB,QAAwB;AACpE,SAAO,WAAW,UAAU,MAAM,EAC/B,OAAO,eAAe,OAAO,QAAQ,CAAC,EAAE,EACxC,OAAO,KAAK;AACjB;AASO,SAAS,gBAAgB,MAId;AAChB,QAAM,SAAS,KAAK,gBAAgB,YAAY,EAAE,EAAE,SAAS,KAAK;AAClE,QAAM,SAAiC,CAAC;AACxC,aAAW,MAAM,KAAK,kBAAkB;AACtC,WAAO,EAAE,IAAI,YAAY,IAAI,MAAM;AAAA,EACrC;AAEA,QAAM,UAAU,iBAAiB,KAAK,MAAM;AAC5C,YAAU,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,iBAAiB,CAAC,KAAK;AAAA,EACzB,CAAC;AAED,MAAI,QAAQ,uBAAa,KAAK,iBAAiB,MAAM,2DAAwB,OAAO,EAAE;AACtF,MAAI,CAAC,KAAK,cAAc;AACtB,QAAI,KAAK,yGAA6C;AAAA,EACxD;AACA,MAAI,QAAQ,IAAI,0BAA0B,KAAK;AAC7C,QAAI,KAAK,iDAAiD;AAC1D,eAAW,CAAC,IAAI,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC5C,UAAI,KAAK,KAAK,EAAE,MAAM,CAAC,EAAE;AAAA,IAC3B;AAAA,EACF,OAAO;AACL,UAAM,QAAQ,OAAO,QAAQ,MAAM,EAChC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,SAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAC5D,KAAK,IAAI;AACZ,QAAI,KAAK;AAAA,EAAqB,KAAK,EAAE;AAAA,EACvC;AAEA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEO,SAAS,eAAe,QAAsC;AACnE,QAAM,SAAS,SAAqB,iBAAiB,MAAM,CAAC;AAC5D,MAAI,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,OAAO,OAAQ,QAAO;AACxD,SAAO,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,OAAO;AACxD;AAGO,SAAS,kBAAkB,QAAgB,MAAqB,cAA4B;AACjG,QAAM,UAAU,iBAAiB,MAAM;AACvC,YAAU,SAAS;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,iBAAiB,CAAC;AAAA,EACpB,CAAsB;AACxB;AAMO,SAAS,kBAAkB,MAAqB,UAA2B;AAChF,MAAI,KAAK,OAAO,QAAQ,EAAG,QAAO;AAClC,OAAK,OAAO,QAAQ,IAAI,YAAY,UAAU,KAAK,MAAM;AACzD,SAAO;AACT;AAGO,SAAS,kBAAkB,MAAqB,UAA2B;AAChF,MAAI,EAAE,YAAY,KAAK,QAAS,QAAO;AACvC,SAAO,KAAK,OAAO,QAAQ;AAC3B,SAAO;AACT;AAUO,SAAS,iBAAiB,MAKf;AAChB,QAAM,WAAW,KAAK,OAAO,IAAI,UAAU,KAAK;AAChD,MAAI,CAAC,YAAY,CAAC,KAAK,iBAAiB,IAAI,QAAQ,EAAG,QAAO;AAE9D,MAAI,WAAW;AACf,QAAM,OAAO,KAAK,QAAQ,eAAe;AACzC,QAAM,QAAQ,KAAK,QAAQ,gBAAgB;AAC3C,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,SAAS,GAAG;AAC1D,eAAW,KAAK,MAAM,CAAC;AAAA,EACzB,WAAW,OAAO,UAAU,UAAU;AACpC,eAAW;AAAA,EACb;AACA,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,WAAW,KAAK,KAAK,OAAO,QAAQ;AAC1C,MAAI,CAAC,SAAU,QAAO;AAEtB,MAAI,SAAS,WAAW,SAAS,OAAQ,QAAO;AAChD,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,YAAQ,SAAS,WAAW,CAAC,IAAI,SAAS,WAAW,CAAC;AAAA,EACxD;AACA,SAAO,SAAS,IAAI,WAAW;AACjC;",
|
|
6
6
|
"names": []
|
|
7
7
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../src/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AACnC,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;AAEhE,MAAM,WAAW,sBAAsB;IACrC,gBAAgB;IAChB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,sBAAsB;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoBD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,IAAI,
|
|
1
|
+
{"version":3,"file":"permission-gate.d.ts","sourceRoot":"","sources":["../src/permission-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AACnC,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;AAEhE,MAAM,WAAW,sBAAsB;IACrC,gBAAgB;IAChB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,sBAAsB;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoBD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,IAAI,CAcN;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAChD,QAAQ,EAAE,MAAM,GACf,OAAO,CAUT;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAChD,QAAQ,EAAE,MAAM,GACf,IAAI,CAIN;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAG3B,QAAQ,EAAE,MAAM;IAAS,UAAU,EAAE,MAAM;IAF9D,IAAI,SAAuB;IAC3B,MAAM,SAAO;IACb,YAAmB,QAAQ,EAAE,MAAM,EAAS,UAAU,EAAE,MAAM,EAE7D;CACF;AAED;;GAEG;AACH,eAAO,MAAM,IAAI;aACf,MAAM,UAAU,MAAM;aACtB,OAAO,UAAU,MAAM;aACvB,UAAU,QAAQ,MAAM;aACxB,WAAW,QAAQ,MAAM;aACzB,OAAO,SAAS,MAAM;CACd,CAAC;AAEX,eAAO,MAAM,wBAAwB,aAAkB,CAAC"}
|
package/dist/permission-gate.js
CHANGED
|
@@ -7,13 +7,19 @@ const PERMISSION_KEYS = /* @__PURE__ */ new Set([
|
|
|
7
7
|
]);
|
|
8
8
|
function validPermissionKey(k) {
|
|
9
9
|
if (/^service:[A-Za-z0-9_.]+$/.test(k)) return true;
|
|
10
|
-
return /^[a-z]+:[a-z]+:[A-Za-z0-9_
|
|
10
|
+
return /^[a-z]+:[a-z]+:[A-Za-z0-9_.*]+$/.test(k);
|
|
11
11
|
}
|
|
12
12
|
function validateManifestPermissions(moduleId, permissions) {
|
|
13
13
|
const seen = /* @__PURE__ */ new Set();
|
|
14
14
|
for (const k of permissions) {
|
|
15
15
|
if (!k || typeof k !== "string") throw new Error(`[perm] ${moduleId}: permission \u4E0D\u662F\u5B57\u7B26\u4E32 "${k}"`);
|
|
16
|
-
if (!validPermissionKey(k))
|
|
16
|
+
if (!validPermissionKey(k)) {
|
|
17
|
+
throw new Error(
|
|
18
|
+
`[perm] ${moduleId}: permission \u683C\u5F0F\u4E0D\u5408\u6CD5 "${k}"\u3002
|
|
19
|
+
manifest.permissions \u4EC5\u7528\u4E8E\u58F0\u660E\u5E73\u53F0\u5E95\u5C42\u8D44\u6E90\u6743\u9650\uFF08db:read:*, db:write:*, config:read:*, config:write:*, service:*\uFF09\u3002
|
|
20
|
+
\u73A9\u5BB6\u547D\u4EE4\u4E0E\u6E38\u620F\u5185\u6743\u9650\u8BF7\u5728\u4EE3\u7801\u4E2D\u4F7F\u7528 Command.register / Permission.register \u767B\u8BB0\uFF0C\u4E0D\u8981\u5199\u5165 manifest.json\u3002`
|
|
21
|
+
);
|
|
22
|
+
}
|
|
17
23
|
if (seen.has(k)) throw new Error(`[perm] ${moduleId}: permission \u91CD\u590D "${k}"`);
|
|
18
24
|
seen.add(k);
|
|
19
25
|
}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"version": 3,
|
|
3
3
|
"sources": ["../src/permission-gate.ts"],
|
|
4
|
-
"sourcesContent": ["/**\n * permission-gate.ts \u2014 \u6A21\u5757\u6743\u9650\u6821\u9A8C\n *\n * \u542F\u52A8\u671F:manifest.permissions \u5168\u5728\u767D\u540D\u5355(PERMISSION_KEYS),\u5426\u5219\u629B\u9519\u542F\u52A8\u5931\u8D25\u3002\n * (\u767D\u540D\u5355 = db:read:*, db:write:*, config:read:*, config:write:*,\n * service:* + \u901A\u914D ** / <table>)\n *\n * \u8FD0\u884C\u65F6:\u53D1\u8D77 db / config / service \u8C03\u7528\u65F6,gatesdb.<op>.requirePermission =\n * \"db:read:<table>\" / \"db:write:<table>\" / \"config:read:<key>\" /\n * \"config:write:<key>\" / \"service:<name>\"\n *\n * \u8BBE\u8BA1:gate \u4E0D\u66FF\u8DEF\u7531\u62E6\u622A,\u662F\u4E1A\u52A1\u903B\u8F91\u81EA\u5DF1\u68C0\u67E5(\u907F\u514D\u6BCF\u6761\u8DEF\u7531\u90FD\u9A8C)\u3002\n * \u8DEF\u7531\u5C42 fail-closed:\u4E0D\u901A\u8FC7 manifest.permissions \u8868\u7684\u8C03\u7528 = \u76F4\u63A5 403\u3002\n */\n\nexport type PermissionKey = string;\nexport type PermissionLevel = \"Any\" | \"Member\" | \"OP\" | \"Admin\";\n\nexport interface ManifestPermissionRule {\n /** \u6A21\u5757\u58F0\u660E\u7684\u6743\u9650\u5168\u96C6 */\n permissions: PermissionKey[];\n /** \u8DE8\u6A21\u5757\u8C03\u7528\u5BF9\u5E94\u662F\u5426\u9700\u8981\u663E\u5F0F\u58F0\u660E */\n serviceRequires: string[];\n}\n\nconst PERMISSION_KEYS = new Set<string>([\n // db:* \u8D70\u6A21\u5F0F\u5339\u914D db:read:* / db:write:*\n // \u914D\u7F6E\u6743\u9650\n \"config:read:*\",\n \"config:write:*\",\n // service \u5728\u8C03\u7528\u65F6\u6309 service \u540D\u5B57\u5339\u914D service:* \u901A\u914D\n]);\n\nfunction validPermissionKey(k: string): boolean {\n // \u4E09\u7C7B\u5408\u6CD5\u683C\u5F0F:\n // db:<op>:<table> (\u4F8B db:read:lands / db:write:land_members)\n // config:<op>:<key> (\u4F8B config:read:land / config:write:afk)\n // service:<name> (\u4F8B service:economy.debit / service:land.byId \u2014 \u540D\u5B57\u53EF\u542B .)\n // \u4E0D\u5141\u8BB8 raw \"*\"(\u8981\u6C42\u660E\u786E\u5BF9\u8C61) \u2014 \u8C03\u8BD5\u65F6\u4E00\u5F8B Resource-level\n if (/^service:[A-Za-z0-9_.]+$/.test(k)) return true;\n return /^[a-z]+:[a-z]+:[A-Za-z0-9_
|
|
5
|
-
"mappings": "AAyBA,MAAM,kBAAkB,oBAAI,IAAY;AAAA;AAAA;AAAA,EAGtC;AAAA,EACA;AAAA;AAEF,CAAC;AAED,SAAS,mBAAmB,GAAoB;AAM9C,MAAI,2BAA2B,KAAK,CAAC,EAAG,QAAO;AAC/C,SAAO,
|
|
4
|
+
"sourcesContent": ["/**\n * permission-gate.ts \u2014 \u6A21\u5757\u6743\u9650\u6821\u9A8C\n *\n * \u542F\u52A8\u671F:manifest.permissions \u5168\u5728\u767D\u540D\u5355(PERMISSION_KEYS),\u5426\u5219\u629B\u9519\u542F\u52A8\u5931\u8D25\u3002\n * (\u767D\u540D\u5355 = db:read:*, db:write:*, config:read:*, config:write:*,\n * service:* + \u901A\u914D ** / <table>)\n *\n * \u8FD0\u884C\u65F6:\u53D1\u8D77 db / config / service \u8C03\u7528\u65F6,gatesdb.<op>.requirePermission =\n * \"db:read:<table>\" / \"db:write:<table>\" / \"config:read:<key>\" /\n * \"config:write:<key>\" / \"service:<name>\"\n *\n * \u8BBE\u8BA1:gate \u4E0D\u66FF\u8DEF\u7531\u62E6\u622A,\u662F\u4E1A\u52A1\u903B\u8F91\u81EA\u5DF1\u68C0\u67E5(\u907F\u514D\u6BCF\u6761\u8DEF\u7531\u90FD\u9A8C)\u3002\n * \u8DEF\u7531\u5C42 fail-closed:\u4E0D\u901A\u8FC7 manifest.permissions \u8868\u7684\u8C03\u7528 = \u76F4\u63A5 403\u3002\n */\n\nexport type PermissionKey = string;\nexport type PermissionLevel = \"Any\" | \"Member\" | \"OP\" | \"Admin\";\n\nexport interface ManifestPermissionRule {\n /** \u6A21\u5757\u58F0\u660E\u7684\u6743\u9650\u5168\u96C6 */\n permissions: PermissionKey[];\n /** \u8DE8\u6A21\u5757\u8C03\u7528\u5BF9\u5E94\u662F\u5426\u9700\u8981\u663E\u5F0F\u58F0\u660E */\n serviceRequires: string[];\n}\n\nconst PERMISSION_KEYS = new Set<string>([\n // db:* \u8D70\u6A21\u5F0F\u5339\u914D db:read:* / db:write:*\n // \u914D\u7F6E\u6743\u9650\n \"config:read:*\",\n \"config:write:*\",\n // service \u5728\u8C03\u7528\u65F6\u6309 service \u540D\u5B57\u5339\u914D service:* \u901A\u914D\n]);\n\nfunction validPermissionKey(k: string): boolean {\n // \u4E09\u7C7B\u5408\u6CD5\u683C\u5F0F:\n // db:<op>:<table> (\u4F8B db:read:lands / db:write:land_members)\n // config:<op>:<key> (\u4F8B config:read:land / config:write:afk)\n // service:<name> (\u4F8B service:economy.debit / service:land.byId \u2014 \u540D\u5B57\u53EF\u542B .)\n // \u4E0D\u5141\u8BB8 raw \"*\"(\u8981\u6C42\u660E\u786E\u5BF9\u8C61) \u2014 \u8C03\u8BD5\u65F6\u4E00\u5F8B Resource-level\n if (/^service:[A-Za-z0-9_.]+$/.test(k)) return true;\n return /^[a-z]+:[a-z]+:[A-Za-z0-9_.*]+$/.test(k);\n}\n\n/**\n * \u542F\u52A8\u671F\u4E00\u6B21\u6027\u6821\u9A8C:manifest.permissions \u662F\u5426\u90FD\u5408\u89C4\u3002\n * \u5931\u8D25 = \u629B\u9519(\u542F\u52A8\u5931\u8D25)\u3002\n */\nexport function validateManifestPermissions(\n moduleId: string,\n permissions: readonly string[]\n): void {\n const seen = new Set<string>();\n for (const k of permissions) {\n if (!k || typeof k !== \"string\") throw new Error(`[perm] ${moduleId}: permission \u4E0D\u662F\u5B57\u7B26\u4E32 \"${k}\"`);\n if (!validPermissionKey(k)) {\n throw new Error(\n `[perm] ${moduleId}: permission \u683C\u5F0F\u4E0D\u5408\u6CD5 \"${k}\"\u3002\\n` +\n ` manifest.permissions \u4EC5\u7528\u4E8E\u58F0\u660E\u5E73\u53F0\u5E95\u5C42\u8D44\u6E90\u6743\u9650\uFF08db:read:*, db:write:*, config:read:*, config:write:*, service:*\uFF09\u3002\\n` +\n ` \u73A9\u5BB6\u547D\u4EE4\u4E0E\u6E38\u620F\u5185\u6743\u9650\u8BF7\u5728\u4EE3\u7801\u4E2D\u4F7F\u7528 Command.register / Permission.register \u767B\u8BB0\uFF0C\u4E0D\u8981\u5199\u5165 manifest.json\u3002`\n );\n }\n if (seen.has(k)) throw new Error(`[perm] ${moduleId}: permission \u91CD\u590D \"${k}\"`);\n seen.add(k);\n }\n}\n\n/**\n * \u8FD0\u884C\u65F6:\u6A21\u5757 id \u662F\u5426\u62E5\u6709\u6240\u9700 permission\u3002\n * \u5F53\u524D\u5B9E\u73B0:\u5FC5\u987B\u7CBE\u786E\u7B49\u4E8E\u624D\u653E\u884C,\u4E0D\u89E3\u91CA\u901A\u914D\u3002\n * (PoC \u7B80\u5316;\u751F\u4EA7\u53EF\u52A0 db:read:* \u2192 \u901A\u914D)\n */\nexport function moduleHasPermission(\n modulePermissions: readonly string[] | undefined,\n required: string\n): boolean {\n if (!modulePermissions) return false;\n if (modulePermissions.includes(required)) return true;\n // db:read:* / db:write:* / config:read:* / config:write:* \u901A\u914D\n const parts = required.split(\":\");\n if (parts.length === 3) {\n const wildcard = `${parts[0]}:${parts[1]}:*`;\n if (modulePermissions.includes(wildcard)) return true;\n }\n return false;\n}\n\nexport function assertModulePermission(\n moduleId: string,\n modulePermissions: readonly string[] | undefined,\n required: string\n): void {\n if (!moduleHasPermission(modulePermissions, required)) {\n throw new PermissionDeniedError(moduleId, required);\n }\n}\n\nexport class PermissionDeniedError extends Error {\n code = \"permission_denied\";\n status = 403;\n constructor(public moduleId: string, public permission: string) {\n super(`[perm] \u6A21\u5757 ${moduleId} \u7F3A\u5C11\u6743\u9650 \"${permission}\"`);\n }\n}\n\n/**\n * \u6240\u6709 platform \u6D3E\u53D1\u7684 required permission key \u8BA1\u7B97\u52A9\u624B\u3002\n */\nexport const Perm = {\n dbRead: (table: string) => `db:read:${table}`,\n dbWrite: (table: string) => `db:write:${table}`,\n configRead: (key: string) => `config:read:${key}`,\n configWrite: (key: string) => `config:write:${key}`,\n service: (name: string) => `service:${name}`,\n} as const;\n\nexport const PlatformTablePermissions = PERMISSION_KEYS;\n"],
|
|
5
|
+
"mappings": "AAyBA,MAAM,kBAAkB,oBAAI,IAAY;AAAA;AAAA;AAAA,EAGtC;AAAA,EACA;AAAA;AAEF,CAAC;AAED,SAAS,mBAAmB,GAAoB;AAM9C,MAAI,2BAA2B,KAAK,CAAC,EAAG,QAAO;AAC/C,SAAO,kCAAkC,KAAK,CAAC;AACjD;AAMO,SAAS,4BACd,UACA,aACM;AACN,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,aAAa;AAC3B,QAAI,CAAC,KAAK,OAAO,MAAM,SAAU,OAAM,IAAI,MAAM,UAAU,QAAQ,gDAAuB,CAAC,GAAG;AAC9F,QAAI,CAAC,mBAAmB,CAAC,GAAG;AAC1B,YAAM,IAAI;AAAA,QACR,UAAU,QAAQ,gDAAuB,CAAC;AAAA;AAAA;AAAA,MAG5C;AAAA,IACF;AACA,QAAI,KAAK,IAAI,CAAC,EAAG,OAAM,IAAI,MAAM,UAAU,QAAQ,8BAAoB,CAAC,GAAG;AAC3E,SAAK,IAAI,CAAC;AAAA,EACZ;AACF;AAOO,SAAS,oBACd,mBACA,UACS;AACT,MAAI,CAAC,kBAAmB,QAAO;AAC/B,MAAI,kBAAkB,SAAS,QAAQ,EAAG,QAAO;AAEjD,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,WAAW,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AACxC,QAAI,kBAAkB,SAAS,QAAQ,EAAG,QAAO;AAAA,EACnD;AACA,SAAO;AACT;AAEO,SAAS,uBACd,UACA,mBACA,UACM;AACN,MAAI,CAAC,oBAAoB,mBAAmB,QAAQ,GAAG;AACrD,UAAM,IAAI,sBAAsB,UAAU,QAAQ;AAAA,EACpD;AACF;AAEO,MAAM,8BAA8B,MAAM;AAAA,EAG/C,YAAmB,UAAyB,YAAoB;AAC9D,UAAM,uBAAa,QAAQ,8BAAU,UAAU,GAAG;AADjC;AAAyB;AAAA,EAE5C;AAAA,EAFmB;AAAA,EAAyB;AAAA,EAF5C,OAAO;AAAA,EACP,SAAS;AAIX;AAKO,MAAM,OAAO;AAAA,EAClB,QAAQ,CAAC,UAAkB,WAAW,KAAK;AAAA,EAC3C,SAAS,CAAC,UAAkB,YAAY,KAAK;AAAA,EAC7C,YAAY,CAAC,QAAgB,eAAe,GAAG;AAAA,EAC/C,aAAa,CAAC,QAAgB,gBAAgB,GAAG;AAAA,EACjD,SAAS,CAAC,SAAiB,WAAW,IAAI;AAC5C;AAEO,MAAM,2BAA2B;",
|
|
6
6
|
"names": []
|
|
7
7
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@sfmc-bds/db-server",
|
|
3
|
-
"version": "0.2.0-beta.
|
|
3
|
+
"version": "0.2.0-beta.7",
|
|
4
4
|
"description": "SFMC SQLite HTTP REST backend — configs, modules, gameplay data",
|
|
5
5
|
"author": "Shiroha7z",
|
|
6
6
|
"license": "AGPL-3.0-only",
|
|
@@ -32,10 +32,10 @@
|
|
|
32
32
|
],
|
|
33
33
|
"dependencies": {
|
|
34
34
|
"sql-template-strings": "^2.2.2",
|
|
35
|
-
"@sfmc-bds/sdk": "0.2.0-beta.
|
|
35
|
+
"@sfmc-bds/sdk": "0.2.0-beta.11"
|
|
36
36
|
},
|
|
37
37
|
"devDependencies": {
|
|
38
|
-
"@sfmc-bds/tools": "0.2.0-beta.
|
|
38
|
+
"@sfmc-bds/tools": "0.2.0-beta.12"
|
|
39
39
|
},
|
|
40
40
|
"publishConfig": {
|
|
41
41
|
"access": "public",
|