@southwind-ai/config 0.1.2 → 0.2.0

package/index.ts

@@ -1,4 +1,5 @@
 export * from "./src/definition.js";
 export * from "./src/environment-loader.js";
+export * from "./src/ai-openai-compatible.js";
 export * from "./src/platform.js";
 export * from "./src/secrets.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/config",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -8,11 +8,12 @@
   },
   "files": [
     "index.ts",
+    "src/ai-openai-compatible.ts",
     "src/**/*.ts",
     "!src/**/*.test.ts"
   ],
   "dependencies": {
-    "@southwind-ai/shared": "0.1.2",
+    "@southwind-ai/shared": "0.2.0",
     "zod": "^4.4.3"
   },
   "exports": {

package/src/ai-openai-compatible.ts

@@ -0,0 +1,187 @@
+import { isIP } from "node:net";
+import { z } from "zod";
+import { defineModuleConfig } from "./definition.js";
+import {
+  commaSeparated,
+  loadModuleConfigSync,
+  strictInteger,
+  type ConfigEnvironment,
+} from "./environment-loader.js";
+import { EnvironmentSecretResolver } from "./secrets.js";
+
+export interface OpenAiCompatibleDeploymentConfig {
+  baseUrl: string;
+  model: string;
+  apiKey?: string;
+  connectTimeoutMs: number;
+  requestTimeoutMs: number;
+  maxResponseBytes: number;
+  allowedHttpsHosts: string[];
+}
+
+const deploymentSchema: z.ZodType<OpenAiCompatibleDeploymentConfig> = z
+  .strictObject({
+    baseUrl: z.string().transform(normalizeOpenAiCompatibleBaseUrl),
+    model: z.string().trim().min(1).max(200),
+    apiKey: z.string().trim().min(1).optional(),
+    connectTimeoutMs: z.number().int().min(100).max(30_000),
+    requestTimeoutMs: z.number().int().min(1_000).max(300_000),
+    maxResponseBytes: z
+      .number()
+      .int()
+      .min(1_024)
+      .max(16 * 1_024 * 1_024),
+    allowedHttpsHosts: z.array(z.string()).max(32),
+  })
+  .superRefine((config, context) => {
+    const endpoint = new URL(config.baseUrl);
+    if (
+      endpoint.protocol === "https:" &&
+      !config.allowedHttpsHosts.includes(endpoint.hostname.toLowerCase())
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["allowedHttpsHosts"],
+        message: "Endpoint 未命中 HTTPS Host allowlist",
+      });
+    }
+  });
+
+export const openAiCompatibleDeploymentConfigDefinition =
+  defineModuleConfig<OpenAiCompatibleDeploymentConfig>({
+    key: "ai.openai-compatible",
+    label: "OpenAI-compatible 模型部署",
+    ownedEnvironmentPrefixes: ["QWEN_", "AI_PROVIDER_"],
+    schema: deploymentSchema,
+    environment: [
+      { key: "QWEN_API_URL", path: "baseUrl" },
+      { key: "QWEN_MODEL", path: "model" },
+      {
+        key: "QWEN_API_KEY",
+        path: "apiKey",
+        secret: { provider: "env" },
+      },
+      integer("AI_PROVIDER_CONNECT_TIMEOUT_MS", "connectTimeoutMs", 5_000),
+      integer("AI_PROVIDER_REQUEST_TIMEOUT_MS", "requestTimeoutMs", 60_000),
+      integer(
+        "AI_PROVIDER_MAX_RESPONSE_BYTES",
+        "maxResponseBytes",
+        2 * 1_024 * 1_024,
+      ),
+      {
+        key: "AI_PROVIDER_HTTPS_HOST_ALLOWLIST",
+        path: "allowedHttpsHosts",
+        defaultValue: [],
+        decode: normalizeOpenAiCompatibleHttpsHostAllowlist,
+      },
+    ],
+  });
+
+export function loadOpenAiCompatibleDeploymentConfig(
+  environment: ConfigEnvironment = process.env,
+): OpenAiCompatibleDeploymentConfig {
+  return loadModuleConfigSync(
+    openAiCompatibleDeploymentConfigDefinition,
+    environment,
+    new EnvironmentSecretResolver(environment),
+  );
+}
+
+export function normalizeOpenAiCompatibleBaseUrl(raw: string): string {
+  let url: URL;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    throw new Error("OpenAI-compatible Endpoint 无效");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("OpenAI-compatible Endpoint 只允许 HTTP 或 HTTPS");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error("OpenAI-compatible Endpoint 不允许凭据、查询串或片段");
+  }
+  const hostname = url.hostname.toLowerCase();
+  if (isCloudMetadataHost(hostname)) {
+    throw new Error("OpenAI-compatible Endpoint 禁止访问云 metadata");
+  }
+  if (url.protocol === "http:" && !isPrivateHost(hostname)) {
+    throw new Error("公网 OpenAI-compatible Endpoint 必须使用 HTTPS");
+  }
+  url.pathname = url.pathname.replace(/\/+$/, "");
+  return url.toString().replace(/\/$/, "");
+}
+
+export function normalizeOpenAiCompatibleHttpsHostAllowlist(
+  raw: string,
+): string[] {
+  const hosts = commaSeparated(raw).map((host) => normalizeHttpsHostname(host));
+  if (hosts.length > 32 || new Set(hosts).size !== hosts.length) {
+    throw new Error("Provider HTTPS Host allowlist 无效");
+  }
+  return hosts;
+}
+
+function integer(key: string, path: string, defaultValue: number) {
+  return { key, path, defaultValue, decode: strictInteger };
+}
+
+function normalizeHttpsHostname(raw: string): string {
+  const hostname = raw.trim().toLowerCase().replace(/\.$/, "");
+  if (
+    !hostname ||
+    hostname.includes("*") ||
+    hostname.includes("/") ||
+    hostname.includes(":") ||
+    hostname.length > 253
+  ) {
+    throw new Error("Provider HTTPS Host allowlist 无效");
+  }
+  const labels = hostname.split(".");
+  if (
+    labels.some(
+      (label) =>
+        !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label) &&
+        !/^[a-z0-9]$/.test(label),
+    )
+  ) {
+    throw new Error("Provider HTTPS Host allowlist 无效");
+  }
+  return hostname;
+}
+
+function isPrivateHost(hostname: string): boolean {
+  if (
+    hostname === "localhost" ||
+    hostname.endsWith(".localhost") ||
+    hostname.endsWith(".internal") ||
+    hostname.endsWith(".local") ||
+    (!hostname.includes(".") && isIP(hostname) === 0)
+  ) {
+    return true;
+  }
+  if (isIP(hostname) === 4) {
+    const [first = 0, second = 0] = hostname.split(".").map(Number);
+    return (
+      first === 10 ||
+      first === 127 ||
+      (first === 172 && second >= 16 && second <= 31) ||
+      (first === 192 && second === 168)
+    );
+  }
+  if (isIP(hostname) === 6) {
+    return (
+      hostname === "::1" ||
+      hostname.startsWith("fc") ||
+      hostname.startsWith("fd")
+    );
+  }
+  return false;
+}
+
+function isCloudMetadataHost(hostname: string): boolean {
+  return (
+    hostname === "169.254.169.254" ||
+    hostname === "metadata.google.internal" ||
+    hostname === "metadata.azure.internal"
+  );
+}

package/src/platform.ts

@@ -34,7 +34,23 @@ export interface PlatformConfig {
     sessionCookieName: string;
     sessionTtlSeconds: number;
     passwordHash: "argon2id";
+    passwordMinLength: number;
+    passwordMaxLength: number;
   };
+  storage: {
+    bulkDataMaxByteSize: number;
+    brandingLogoMaxByteSize: number;
+  };
+  mail: {
+    enabled: boolean;
+    host: string;
+    port: number;
+    secure: boolean;
+    fromAddress: string;
+    connectTimeoutMs: number;
+    smtpUrl?: string;
+  };
+  regional: { timeZone: string };
   license: {
     enabled: boolean;
     publicKeyId?: string;
@@ -60,56 +76,111 @@ export interface ProjectConfig {
   modules: string[];
 }
 
-const platformSchema: z.ZodType<PlatformConfig> = z.strictObject({
-  name: z.string().trim().min(1).max(120),
-  logoUrl: z.string().trim().url().optional(),
-  enableAI: z.boolean(),
-  database: z.strictObject({
-    dialect: z.enum(["postgresql", "mysql", "dm", "kingbase"]),
-    url: z.string().trim().min(1).optional(),
-    legacyRuoYiMysqlUrl: z.string().trim().min(1).optional(),
-    legacyRuoYiRedisUrl: z.string().trim().min(1).optional(),
-  }),
-  cache: z.strictObject({
-    redisUrl: z.string().trim().min(1).optional(),
-    healthTimeoutMs: z.number().int().min(50).max(10_000),
-  }),
-  security: z.strictObject({
-    sessionCookieName: z.string().trim().min(1).max(120),
-    sessionTtlSeconds: z.number().int().min(60).max(2_592_000),
-    passwordHash: z.literal("argon2id"),
-  }),
-  license: z.strictObject({
-    enabled: z.boolean(),
-    publicKeyId: z.string().trim().min(1).optional(),
-    publicKey: z.string().trim().min(1).optional(),
-    machineCode: z.string().trim().min(1).optional(),
-    versions: z
-      .unknown()
-      .transform((value, context) => {
-        try {
-          return parseLicenseCatalog(value);
-        } catch (error) {
-          context.addIssue({
-            code: "custom",
-            message: error instanceof Error ? error.message : "版本目录无效",
-          });
-          return z.NEVER;
-        }
-      })
-      .optional(),
-  }),
-  audit: z.strictObject({
-    enabled: z.boolean(),
-    redactFields: z.array(z.string().min(1)).min(1),
-  }),
-  compatibility: z.strictObject({
-    ruoyiVue: z.strictObject({
+const platformSchema: z.ZodType<PlatformConfig> = z
+  .strictObject({
+    name: z.string().trim().min(1).max(120),
+    logoUrl: z.string().trim().url().optional(),
+    enableAI: z.boolean(),
+    database: z.strictObject({
+      dialect: z.enum(["postgresql", "mysql", "dm", "kingbase"]),
+      url: z.string().trim().min(1).optional(),
+      legacyRuoYiMysqlUrl: z.string().trim().min(1).optional(),
+      legacyRuoYiRedisUrl: z.string().trim().min(1).optional(),
+    }),
+    cache: z.strictObject({
+      redisUrl: z.string().trim().min(1).optional(),
+      healthTimeoutMs: z.number().int().min(50).max(10_000),
+    }),
+    security: z.strictObject({
+      sessionCookieName: z.string().trim().min(1).max(120),
+      sessionTtlSeconds: z.number().int().min(60).max(2_592_000),
+      passwordHash: z.literal("argon2id"),
+      passwordMinLength: z.number().int().min(8).max(128),
+      passwordMaxLength: z.number().int().min(12).max(512),
+    }),
+    storage: z.strictObject({
+      bulkDataMaxByteSize: z
+        .number()
+        .int()
+        .min(1024)
+        .max(10 * 1024 ** 3),
+      brandingLogoMaxByteSize: z
+        .number()
+        .int()
+        .min(1024)
+        .max(50 * 1024 ** 2),
+    }),
+    mail: z.strictObject({
       enabled: z.boolean(),
-      runtimeReadonly: z.boolean(),
+      host: z.string().trim().max(253),
+      port: z.number().int().min(1).max(65_535),
+      secure: z.boolean(),
+      fromAddress: z.string().trim().max(320),
+      connectTimeoutMs: z.number().int().min(100).max(120_000),
+      smtpUrl: z.string().trim().min(1).optional(),
     }),
-  }),
-});
+    regional: z.strictObject({
+      timeZone: z
+        .string()
+        .trim()
+        .min(1)
+        .max(100)
+        .refine(isSupportedTimeZone, "时区必须是有效的 IANA 时区"),
+    }),
+    license: z.strictObject({
+      enabled: z.boolean(),
+      publicKeyId: z.string().trim().min(1).optional(),
+      publicKey: z.string().trim().min(1).optional(),
+      machineCode: z.string().trim().min(1).optional(),
+      versions: z
+        .unknown()
+        .transform((value, context) => {
+          try {
+            return parseLicenseCatalog(value);
+          } catch (error) {
+            context.addIssue({
+              code: "custom",
+              message: error instanceof Error ? error.message : "版本目录无效",
+            });
+            return z.NEVER;
+          }
+        })
+        .optional(),
+    }),
+    audit: z.strictObject({
+      enabled: z.boolean(),
+      redactFields: z.array(z.string().min(1)).min(1),
+    }),
+    compatibility: z.strictObject({
+      ruoyiVue: z.strictObject({
+        enabled: z.boolean(),
+        runtimeReadonly: z.boolean(),
+      }),
+    }),
+  })
+  .superRefine((config, context) => {
+    if (config.security.passwordMinLength > config.security.passwordMaxLength) {
+      context.addIssue({
+        code: "custom",
+        path: ["security", "passwordMinLength"],
+        message: "密码最小长度不能大于最大长度",
+      });
+    }
+    if (config.mail.enabled && !config.mail.fromAddress) {
+      context.addIssue({
+        code: "custom",
+        path: ["mail", "fromAddress"],
+        message: "启用邮件传输时必须配置发件地址",
+      });
+    }
+    if (config.mail.enabled && !config.mail.smtpUrl && !config.mail.host) {
+      context.addIssue({
+        code: "custom",
+        path: ["mail", "host"],
+        message: "启用邮件传输时必须配置 SMTP URL 或主机",
+      });
+    }
+  });
 
 export const platformConfigDefinition = defineModuleConfig<PlatformConfig>({
   key: "platform.runtime",
@@ -118,9 +189,13 @@ export const platformConfigDefinition = defineModuleConfig<PlatformConfig>({
   ownedEnvironmentPrefixes: [
     "PLATFORM_",
     "DATABASE_",
+    "PASSWORD_",
     "REDIS_",
     "RUOYI_",
     "SESSION_",
+    "STORAGE_",
+    "MAIL_",
+    "REGIONAL_",
     "AUDIT_",
   ],
   ownedEnvironmentKeys: [
@@ -153,6 +228,43 @@ export const platformConfigDefinition = defineModuleConfig<PlatformConfig>({
       strictInteger,
     ),
     value("PLATFORM_PASSWORD_HASH", "security.passwordHash", "argon2id"),
+    value(
+      "PASSWORD_MIN_LENGTH",
+      "security.passwordMinLength",
+      12,
+      strictInteger,
+    ),
+    value(
+      "PASSWORD_MAX_LENGTH",
+      "security.passwordMaxLength",
+      128,
+      strictInteger,
+    ),
+    value(
+      "STORAGE_BULK_DATA_MAX_BYTE_SIZE",
+      "storage.bulkDataMaxByteSize",
+      512 * 1024 * 1024,
+      strictInteger,
+    ),
+    value(
+      "STORAGE_BRANDING_LOGO_MAX_BYTE_SIZE",
+      "storage.brandingLogoMaxByteSize",
+      5 * 1024 * 1024,
+      strictInteger,
+    ),
+    value("MAIL_ENABLED", "mail.enabled", false, strictBoolean),
+    value("MAIL_HOST", "mail.host", ""),
+    value("MAIL_PORT", "mail.port", 587, strictInteger),
+    value("MAIL_SECURE", "mail.secure", false, strictBoolean),
+    value("MAIL_FROM_ADDRESS", "mail.fromAddress", ""),
+    value(
+      "MAIL_CONNECT_TIMEOUT_MS",
+      "mail.connectTimeoutMs",
+      10_000,
+      strictInteger,
+    ),
+    secret("MAIL_SMTP_URL", "mail.smtpUrl"),
+    value("REGIONAL_TIME_ZONE", "regional.timeZone", "Asia/Shanghai"),
     value("LICENSE_ENABLED", "license.enabled", true, strictBoolean),
     value("LICENSE_PUBLIC_KEY_ID", "license.publicKeyId"),
     value("LICENSE_PUBLIC_KEY", "license.publicKey"),
@@ -210,3 +322,12 @@ function value(
 function secret(key: string, path: string) {
   return { key, path, secret: { provider: "env" as const } };
 }
+
+function isSupportedTimeZone(value: string): boolean {
+  try {
+    new Intl.DateTimeFormat("zh-CN", { timeZone: value });
+    return true;
+  } catch {
+    return false;
+  }
+}