@twikoojs/edgeone-makers 2.0.13 → 2.0.15

package/dist/cloud-functions/index.js

@@ -43,7 +43,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 //#region ../shared/dist/index.mjs
-/*! @twikoojs/shared v2.0.13 */
+/*! @twikoojs/shared v2.0.15 */
 /**
 * Twikoo 统一版本号常量（构建期占位符）。
 *
@@ -56,7 +56,7 @@ var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 * 占位符字面量由 `@twikoojs/tsdown-config` 的 `VERSION_PLACEHOLDER` 常量定义，
 * 客户端与服务端统一读取本常量，避免版本号在多包之间手工同步。
 */
-const VERSION = "2.0.13";
+const VERSION = "2.0.15";
 /**
 * 后端事件名常量（Scope E：24 个客户端事件 + 1 个服务端内部事件）。
 *
@@ -24334,19 +24334,33 @@ async function getXml2js() {
 	return pickDefault(await loadLib("xml2js"));
 }
 /**
-* 获取 html-to-text 编译产物（通知纯文本；配置 1.x 对齐：忽略链接 href、跳过图片）。
+* 获取 html-to-text 编译产物；通知忽略图片，长度检查按替代文本或固定占位计数。
+* @param options 是否使用评论长度计数规则
 * @returns 编译后的转换函数
 */
-async function getHtmlToText() {
+async function getHtmlToText(options = {}) {
 	return pickDefault(await loadLib("html-to-text")).compile({
 		wordwrap: false,
-		selectors: [{
-			selector: "a",
-			options: { ignoreHref: true }
-		}, {
-			selector: "img",
-			format: "skip"
-		}]
+		formatters: { 
+		/** 图片按替代文本计数；无替代文本的图片和分隔线各占 10 个字符。 */
+wordCount(elem, _walk, builder) {
+			const text = elem.name === "img" ? elem.attribs.alt?.trim() : "";
+			builder.addInline(text || "-".repeat(10), { noWordTransform: true });
+		} },
+		selectors: [
+			{
+				selector: "a",
+				options: { ignoreHref: true }
+			},
+			{
+				selector: "img",
+				format: options.forWordCount ? "wordCount" : "skip"
+			},
+			...options.forWordCount ? [{
+				selector: "hr",
+				format: "wordCount"
+			}] : []
+		]
 	});
 }
 /**
@@ -24755,22 +24769,25 @@ async function parseCommentForAdmin(comments, caps) {
 * 语义对齐）。
 *
 * 链路（COMMENT_SUBMIT）：
-* 1. preCheckSpam 预检（长度 / 屏蔽词 / 人工审核标记 / 违禁词）——同步快速路径；
+* 1. preCheckSpam 预检（长度 / 屏蔽词 / 人工审核标记 / 违禁词）——按需加载纯文本转换器；
 * 2. checkCaptcha 验证码（Turnstile / Geetest / Cap 内嵌或外部）；
 * 3. limitFilter 频率限制（单 IP 与全站 10 分钟窗口）；
 * 4. postCheckSpam 后检（腾讯云 TMS / Akismet / Jev / LLM，postSubmit 异步阶段）。
 */
 /**
-* 预垃圾评论检测（1.x preCheckSpam 逐行对齐）。
+* 预垃圾评论检测；长度限制按 HTML 转换后的文本计算。
 * @param comment 待检评论字段
 * @param config 全量配置
 * @param logger 请求日志
 * @returns 是否标记为垃圾（MANUAL_REVIEW / 违禁词）
 */
-function preCheckSpam(comment, config, logger) {
+async function preCheckSpam(comment, config, logger) {
 	let limitLength = parseInt(String(config.LIMIT_LENGTH ?? ""));
 	if (Number.isNaN(limitLength)) limitLength = 500;
-	if (limitLength && comment.comment.length > limitLength) throw new Error("评论内容过长");
+	if (limitLength) {
+		if (comment.comment.length > limitLength * 10) throw new Error("评论内容过长");
+		if ((await getHtmlToText({ forWordCount: true }))(comment.comment).length > limitLength) throw new Error("评论内容过长");
+	}
 	if (config.BLOCKED_WORDS) {
 		const commentLowerCase = comment.comment.toLowerCase();
 		const nickLowerCase = comment.nick.toLowerCase();
@@ -26540,7 +26557,7 @@ async function parseCommentDoc(ctx) {
 		}),
 		pid: comment.pid ? toStr(comment.pid) : toStr(comment.rid),
 		rid: comment.rid,
-		isSpam: isAdminUser ? false : preCheckSpam({
+		isSpam: isAdminUser ? false : await preCheckSpam({
 			comment: toStr(comment.comment),
 			nick: toStr(comment.nick),
 			link: comment.link,
@@ -27580,6 +27597,34 @@ function allowCors(request, config) {
 		"Access-Control-Max-Age": "600"
 	};
 }
+/** 错误路径共用进行中的配置读取，避免并发拒绝请求堆积查询。 */
+const pendingCorsConfig = /* @__PURE__ */ new WeakMap();
+/** 错误响应只读取已有数据库的配置，最多等待 100ms；失败或超时不放行跨域，也不改变原错误。 */
+async function allowCorsForError(request, database) {
+	if (!request.headers.origin) return {};
+	let pending = pendingCorsConfig.get(database);
+	if (!pending) {
+		pending = (async () => {
+			try {
+				return await database.getConfig() ?? {};
+			} catch (e) {
+				console.error("Twikoo CORS configuration failed:", e);
+				return null;
+			}
+		})();
+		pendingCorsConfig.set(database, pending);
+		pending.then(() => pendingCorsConfig.delete(database));
+	}
+	let timer;
+	try {
+		const config = await Promise.race([pending, new Promise((resolve) => {
+			timer = setTimeout(() => resolve(null), 100);
+		})]);
+		return config === null ? {} : allowCors(request, config);
+	} finally {
+		clearTimeout(timer);
+	}
+}
 /**
 * 计算放行的 Origin（1.x getAllowedOrigin 逐行对齐）。
 * @param origin 请求 Origin
@@ -27649,13 +27694,15 @@ function createPipeline(adapters) {
 		let status = 200;
 		/** 步骤 3 产出，步骤 9 回填判断用 */
 		let accessToken = "";
+		let corsAttempted = false;
 		try {
 			protect(request, logger);
 			validateClientFields(request.body);
 			accessToken = anonymousSignIn(request);
+			corsAttempted = true;
 			await adapters.database.init();
 			const { config, failed: configReadFailed } = await readConfig(adapters, logger);
-			Object.assign(headers, allowCors(request, config));
+			if (!configReadFailed) Object.assign(headers, allowCors(request, config));
 			if (request.method === "OPTIONS") return {
 				status: 204,
 				body: {},
@@ -27681,6 +27728,7 @@ function createPipeline(adapters) {
 				message: getErrorMessage(e)
 			};
 			if (e instanceof RateLimitError) status = 429;
+			if (!corsAttempted) Object.assign(headers, await allowCorsForError(request, adapters.database));
 		}
 		if (!body.code && !request.body.accessToken) body.accessToken = accessToken;
 		logger.verbose("请求返回：", body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twikoojs/edgeone-makers",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "Twikoo comment system backend for Tencent EdgeOne Makers",
   "license": "MIT",
   "repository": {
@@ -21,19 +21,19 @@
   "dependencies": {
     "@cap.js/server": "^4.0.5",
     "@edgeone/pages-blob": "latest",
-    "@twikoojs/common": "2.0.13",
-    "@twikoojs/shared": "2.0.13",
+    "@twikoojs/common": "2.0.15",
+    "@twikoojs/shared": "2.0.15",
     "bowser": "^2.14.1",
     "form-data": "^4.0.6",
     "html-to-text": "^10.0.1",
     "marked": "^18.0.13",
     "pako": "^3.0.2",
-    "pushoo": "^2.0.13",
+    "pushoo": "^2.0.15",
     "xml2js": "^0.6.2"
   },
   "devDependencies": {
     "@imaegoo/node-ip2region": "^2.1.1",
-    "@types/node": "^26.6.1"
+    "@types/node": "^26.6.4"
   },
   "scripts": {
     "build": "node scripts/build-ip2region-data.mjs && tsdown && node scripts/build-zip.mjs",