@southwind-ai/config 0.1.3 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@southwind-ai/config",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "license": "UNLICENSED",
   "type": "module",
   "engines": {
@@ -13,7 +13,7 @@
     "!src/**/*.test.ts"
   ],
   "dependencies": {
-    "@southwind-ai/shared": "0.1.2",
+    "@southwind-ai/shared": "0.2.0",
     "zod": "^4.4.3"
   },
   "exports": {

package/src/ai-openai-compatible.ts

@@ -2,6 +2,7 @@ import { isIP } from "node:net";
 import { z } from "zod";
 import { defineModuleConfig } from "./definition.js";
 import {
+  commaSeparated,
   loadModuleConfigSync,
   strictInteger,
   type ConfigEnvironment,
@@ -15,10 +16,11 @@ export interface OpenAiCompatibleDeploymentConfig {
   connectTimeoutMs: number;
   requestTimeoutMs: number;
   maxResponseBytes: number;
+  allowedHttpsHosts: string[];
 }
 
-const deploymentSchema: z.ZodType<OpenAiCompatibleDeploymentConfig> =
-  z.strictObject({
+const deploymentSchema: z.ZodType<OpenAiCompatibleDeploymentConfig> = z
+  .strictObject({
     baseUrl: z.string().transform(normalizeOpenAiCompatibleBaseUrl),
     model: z.string().trim().min(1).max(200),
     apiKey: z.string().trim().min(1).optional(),
@@ -29,6 +31,20 @@ const deploymentSchema: z.ZodType<OpenAiCompatibleDeploymentConfig> =
       .int()
       .min(1_024)
       .max(16 * 1_024 * 1_024),
+    allowedHttpsHosts: z.array(z.string()).max(32),
+  })
+  .superRefine((config, context) => {
+    const endpoint = new URL(config.baseUrl);
+    if (
+      endpoint.protocol === "https:" &&
+      !config.allowedHttpsHosts.includes(endpoint.hostname.toLowerCase())
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["allowedHttpsHosts"],
+        message: "Endpoint 未命中 HTTPS Host allowlist",
+      });
+    }
   });
 
 export const openAiCompatibleDeploymentConfigDefinition =
@@ -52,6 +68,12 @@ export const openAiCompatibleDeploymentConfigDefinition =
         "maxResponseBytes",
         2 * 1_024 * 1_024,
       ),
+      {
+        key: "AI_PROVIDER_HTTPS_HOST_ALLOWLIST",
+        path: "allowedHttpsHosts",
+        defaultValue: [],
+        decode: normalizeOpenAiCompatibleHttpsHostAllowlist,
+      },
     ],
   });
 
@@ -89,10 +111,44 @@ export function normalizeOpenAiCompatibleBaseUrl(raw: string): string {
   return url.toString().replace(/\/$/, "");
 }
 
+export function normalizeOpenAiCompatibleHttpsHostAllowlist(
+  raw: string,
+): string[] {
+  const hosts = commaSeparated(raw).map((host) => normalizeHttpsHostname(host));
+  if (hosts.length > 32 || new Set(hosts).size !== hosts.length) {
+    throw new Error("Provider HTTPS Host allowlist 无效");
+  }
+  return hosts;
+}
+
 function integer(key: string, path: string, defaultValue: number) {
   return { key, path, defaultValue, decode: strictInteger };
 }
 
+function normalizeHttpsHostname(raw: string): string {
+  const hostname = raw.trim().toLowerCase().replace(/\.$/, "");
+  if (
+    !hostname ||
+    hostname.includes("*") ||
+    hostname.includes("/") ||
+    hostname.includes(":") ||
+    hostname.length > 253
+  ) {
+    throw new Error("Provider HTTPS Host allowlist 无效");
+  }
+  const labels = hostname.split(".");
+  if (
+    labels.some(
+      (label) =>
+        !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label) &&
+        !/^[a-z0-9]$/.test(label),
+    )
+  ) {
+    throw new Error("Provider HTTPS Host allowlist 无效");
+  }
+  return hostname;
+}
+
 function isPrivateHost(hostname: string): boolean {
   if (
     hostname === "localhost" ||

package/src/platform.ts

@@ -34,7 +34,23 @@ export interface PlatformConfig {
     sessionCookieName: string;
     sessionTtlSeconds: number;
     passwordHash: "argon2id";
+    passwordMinLength: number;
+    passwordMaxLength: number;
   };
+  storage: {
+    bulkDataMaxByteSize: number;
+    brandingLogoMaxByteSize: number;
+  };
+  mail: {
+    enabled: boolean;
+    host: string;
+    port: number;
+    secure: boolean;
+    fromAddress: string;
+    connectTimeoutMs: number;
+    smtpUrl?: string;
+  };
+  regional: { timeZone: string };
   license: {
     enabled: boolean;
     publicKeyId?: string;
@@ -60,56 +76,111 @@ export interface ProjectConfig {
   modules: string[];
 }
 
-const platformSchema: z.ZodType<PlatformConfig> = z.strictObject({
-  name: z.string().trim().min(1).max(120),
-  logoUrl: z.string().trim().url().optional(),
-  enableAI: z.boolean(),
-  database: z.strictObject({
-    dialect: z.enum(["postgresql", "mysql", "dm", "kingbase"]),
-    url: z.string().trim().min(1).optional(),
-    legacyRuoYiMysqlUrl: z.string().trim().min(1).optional(),
-    legacyRuoYiRedisUrl: z.string().trim().min(1).optional(),
-  }),
-  cache: z.strictObject({
-    redisUrl: z.string().trim().min(1).optional(),
-    healthTimeoutMs: z.number().int().min(50).max(10_000),
-  }),
-  security: z.strictObject({
-    sessionCookieName: z.string().trim().min(1).max(120),
-    sessionTtlSeconds: z.number().int().min(60).max(2_592_000),
-    passwordHash: z.literal("argon2id"),
-  }),
-  license: z.strictObject({
-    enabled: z.boolean(),
-    publicKeyId: z.string().trim().min(1).optional(),
-    publicKey: z.string().trim().min(1).optional(),
-    machineCode: z.string().trim().min(1).optional(),
-    versions: z
-      .unknown()
-      .transform((value, context) => {
-        try {
-          return parseLicenseCatalog(value);
-        } catch (error) {
-          context.addIssue({
-            code: "custom",
-            message: error instanceof Error ? error.message : "版本目录无效",
-          });
-          return z.NEVER;
-        }
-      })
-      .optional(),
-  }),
-  audit: z.strictObject({
-    enabled: z.boolean(),
-    redactFields: z.array(z.string().min(1)).min(1),
-  }),
-  compatibility: z.strictObject({
-    ruoyiVue: z.strictObject({
+const platformSchema: z.ZodType<PlatformConfig> = z
+  .strictObject({
+    name: z.string().trim().min(1).max(120),
+    logoUrl: z.string().trim().url().optional(),
+    enableAI: z.boolean(),
+    database: z.strictObject({
+      dialect: z.enum(["postgresql", "mysql", "dm", "kingbase"]),
+      url: z.string().trim().min(1).optional(),
+      legacyRuoYiMysqlUrl: z.string().trim().min(1).optional(),
+      legacyRuoYiRedisUrl: z.string().trim().min(1).optional(),
+    }),
+    cache: z.strictObject({
+      redisUrl: z.string().trim().min(1).optional(),
+      healthTimeoutMs: z.number().int().min(50).max(10_000),
+    }),
+    security: z.strictObject({
+      sessionCookieName: z.string().trim().min(1).max(120),
+      sessionTtlSeconds: z.number().int().min(60).max(2_592_000),
+      passwordHash: z.literal("argon2id"),
+      passwordMinLength: z.number().int().min(8).max(128),
+      passwordMaxLength: z.number().int().min(12).max(512),
+    }),
+    storage: z.strictObject({
+      bulkDataMaxByteSize: z
+        .number()
+        .int()
+        .min(1024)
+        .max(10 * 1024 ** 3),
+      brandingLogoMaxByteSize: z
+        .number()
+        .int()
+        .min(1024)
+        .max(50 * 1024 ** 2),
+    }),
+    mail: z.strictObject({
       enabled: z.boolean(),
-      runtimeReadonly: z.boolean(),
+      host: z.string().trim().max(253),
+      port: z.number().int().min(1).max(65_535),
+      secure: z.boolean(),
+      fromAddress: z.string().trim().max(320),
+      connectTimeoutMs: z.number().int().min(100).max(120_000),
+      smtpUrl: z.string().trim().min(1).optional(),
     }),
-  }),
-});
+    regional: z.strictObject({
+      timeZone: z
+        .string()
+        .trim()
+        .min(1)
+        .max(100)
+        .refine(isSupportedTimeZone, "时区必须是有效的 IANA 时区"),
+    }),
+    license: z.strictObject({
+      enabled: z.boolean(),
+      publicKeyId: z.string().trim().min(1).optional(),
+      publicKey: z.string().trim().min(1).optional(),
+      machineCode: z.string().trim().min(1).optional(),
+      versions: z
+        .unknown()
+        .transform((value, context) => {
+          try {
+            return parseLicenseCatalog(value);
+          } catch (error) {
+            context.addIssue({
+              code: "custom",
+              message: error instanceof Error ? error.message : "版本目录无效",
+            });
+            return z.NEVER;
+          }
+        })
+        .optional(),
+    }),
+    audit: z.strictObject({
+      enabled: z.boolean(),
+      redactFields: z.array(z.string().min(1)).min(1),
+    }),
+    compatibility: z.strictObject({
+      ruoyiVue: z.strictObject({
+        enabled: z.boolean(),
+        runtimeReadonly: z.boolean(),
+      }),
+    }),
+  })
+  .superRefine((config, context) => {
+    if (config.security.passwordMinLength > config.security.passwordMaxLength) {
+      context.addIssue({
+        code: "custom",
+        path: ["security", "passwordMinLength"],
+        message: "密码最小长度不能大于最大长度",
+      });
+    }
+    if (config.mail.enabled && !config.mail.fromAddress) {
+      context.addIssue({
+        code: "custom",
+        path: ["mail", "fromAddress"],
+        message: "启用邮件传输时必须配置发件地址",
+      });
+    }
+    if (config.mail.enabled && !config.mail.smtpUrl && !config.mail.host) {
+      context.addIssue({
+        code: "custom",
+        path: ["mail", "host"],
+        message: "启用邮件传输时必须配置 SMTP URL 或主机",
+      });
+    }
+  });
 
 export const platformConfigDefinition = defineModuleConfig<PlatformConfig>({
   key: "platform.runtime",
@@ -118,9 +189,13 @@ export const platformConfigDefinition = defineModuleConfig<PlatformConfig>({
   ownedEnvironmentPrefixes: [
     "PLATFORM_",
     "DATABASE_",
+    "PASSWORD_",
     "REDIS_",
     "RUOYI_",
     "SESSION_",
+    "STORAGE_",
+    "MAIL_",
+    "REGIONAL_",
     "AUDIT_",
   ],
   ownedEnvironmentKeys: [
@@ -153,6 +228,43 @@ export const platformConfigDefinition = defineModuleConfig<PlatformConfig>({
       strictInteger,
     ),
     value("PLATFORM_PASSWORD_HASH", "security.passwordHash", "argon2id"),
+    value(
+      "PASSWORD_MIN_LENGTH",
+      "security.passwordMinLength",
+      12,
+      strictInteger,
+    ),
+    value(
+      "PASSWORD_MAX_LENGTH",
+      "security.passwordMaxLength",
+      128,
+      strictInteger,
+    ),
+    value(
+      "STORAGE_BULK_DATA_MAX_BYTE_SIZE",
+      "storage.bulkDataMaxByteSize",
+      512 * 1024 * 1024,
+      strictInteger,
+    ),
+    value(
+      "STORAGE_BRANDING_LOGO_MAX_BYTE_SIZE",
+      "storage.brandingLogoMaxByteSize",
+      5 * 1024 * 1024,
+      strictInteger,
+    ),
+    value("MAIL_ENABLED", "mail.enabled", false, strictBoolean),
+    value("MAIL_HOST", "mail.host", ""),
+    value("MAIL_PORT", "mail.port", 587, strictInteger),
+    value("MAIL_SECURE", "mail.secure", false, strictBoolean),
+    value("MAIL_FROM_ADDRESS", "mail.fromAddress", ""),
+    value(
+      "MAIL_CONNECT_TIMEOUT_MS",
+      "mail.connectTimeoutMs",
+      10_000,
+      strictInteger,
+    ),
+    secret("MAIL_SMTP_URL", "mail.smtpUrl"),
+    value("REGIONAL_TIME_ZONE", "regional.timeZone", "Asia/Shanghai"),
     value("LICENSE_ENABLED", "license.enabled", true, strictBoolean),
     value("LICENSE_PUBLIC_KEY_ID", "license.publicKeyId"),
     value("LICENSE_PUBLIC_KEY", "license.publicKey"),
@@ -210,3 +322,12 @@ function value(
 function secret(key: string, path: string) {
   return { key, path, secret: { provider: "env" as const } };
 }
+
+function isSupportedTimeZone(value: string): boolean {
+  try {
+    new Intl.DateTimeFormat("zh-CN", { timeZone: value });
+    return true;
+  } catch {
+    return false;
+  }
+}