@whyour/qinglong 2.20.2-3 → 2.21.0

package/static/build/api/cron.js

@@ -9,6 +9,8 @@ const cron_1 = __importDefault(require("../services/cron"));
 const cronView_1 = __importDefault(require("../services/cronView"));
 const celebrate_1 = require("celebrate");
 const schedule_1 = require("../validation/schedule");
+const runningInstance_1 = require("../data/runningInstance");
+const i18n_1 = require("../shared/i18n");
 const route = (0, express_1.Router)();
 exports.default = (app) => {
     app.use('/crons', route);
@@ -51,7 +53,7 @@ exports.default = (app) => {
         try {
             const cronViewService = typedi_1.Container.get(cronView_1.default);
             if (req.body.type === 1) {
-                return res.send({ code: 400, message: '参数错误' });
+                return res.send({ code: 400, message: (0, i18n_1.t)('参数错误') });
             }
             else {
                 const data = await cronViewService.update(req.body);
@@ -349,6 +351,41 @@ exports.default = (app) => {
             return next(e);
         }
     });
+    route.get('/:id/instances', (0, celebrate_1.celebrate)({
+        params: celebrate_1.Joi.object({
+            id: celebrate_1.Joi.number().required(),
+        }),
+    }), async (req, res, next) => {
+        try {
+            const instances = await runningInstance_1.RunningInstanceModel.findAll({
+                where: {
+                    cron_id: req.params.id,
+                    status: runningInstance_1.InstanceStatus.running,
+                },
+                order: [['started_at', 'DESC']],
+                raw: true,
+            });
+            return res.send({ code: 200, data: instances });
+        }
+        catch (e) {
+            return next(e);
+        }
+    });
+    route.post('/:id/instances/:instanceId/stop', (0, celebrate_1.celebrate)({
+        params: celebrate_1.Joi.object({
+            id: celebrate_1.Joi.number().required(),
+            instanceId: celebrate_1.Joi.number().required(),
+        }),
+    }), async (req, res, next) => {
+        try {
+            const cronService = typedi_1.Container.get(cron_1.default);
+            const data = await cronService.stopInstance(req.params.instanceId);
+            return res.send(data);
+        }
+        catch (e) {
+            return next(e);
+        }
+    });
     route.get('/:id/logs', (0, celebrate_1.celebrate)({
         params: celebrate_1.Joi.object({
             id: celebrate_1.Joi.number().required(),

package/static/build/api/dashboard.js

@@ -0,0 +1,337 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const sequelize_1 = require("sequelize");
+const cron_1 = require("../data/cron");
+const cronStats_1 = require("../data/cronStats");
+const runningInstance_1 = require("../data/runningInstance");
+const dayjs_1 = __importDefault(require("dayjs"));
+const os_1 = __importDefault(require("os"));
+const route = (0, express_1.Router)();
+exports.default = (app) => {
+    app.use('/dashboard', route);
+    route.post('/record', async (req, res) => {
+        try {
+            const { ref_id, code, elapsed } = req.body;
+            if (!ref_id)
+                return res.send({ code: 400, message: 'ref_id required' });
+            const today = (0, dayjs_1.default)().format('YYYY-MM-DD');
+            const isSuccess = code === 0 ? 1 : 0;
+            const isFail = code !== 0 ? 1 : 0;
+            const elapsedMs = (Number(elapsed) || 0) * 1000;
+            const existing = await cronStats_1.CrontabStatModel.findOne({
+                where: { ref_id: Number(ref_id), date: today },
+            });
+            if (existing) {
+                await cronStats_1.CrontabStatModel.update({
+                    run_count: (existing.run_count || 0) + 1,
+                    success_count: (existing.success_count || 0) + isSuccess,
+                    fail_count: (existing.fail_count || 0) + isFail,
+                    total_time: (existing.total_time || 0) + elapsedMs,
+                    max_time: Math.max(existing.max_time || 0, elapsedMs),
+                }, { where: { id: existing.id } });
+            }
+            else {
+                await cronStats_1.CrontabStatModel.create({
+                    ref_id: Number(ref_id),
+                    date: today,
+                    run_count: 1,
+                    success_count: isSuccess,
+                    fail_count: isFail,
+                    total_time: elapsedMs,
+                    max_time: elapsedMs,
+                });
+            }
+            res.send({ code: 200 });
+        }
+        catch (e) {
+            res.send({ code: 500 });
+        }
+    });
+    route.get('/overview', async (req, res, next) => {
+        try {
+            const today = (0, dayjs_1.default)().format('YYYY-MM-DD');
+            const [total, enabled, disabled, stats] = await Promise.all([
+                cron_1.CrontabModel.count(),
+                cron_1.CrontabModel.count({ where: { isDisabled: 0 } }),
+                cron_1.CrontabModel.count({ where: { isDisabled: 1 } }),
+                cronStats_1.CrontabStatModel.findOne({
+                    attributes: [
+                        [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('run_count')), 'total_runs'],
+                        [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('success_count')), 'total_success'],
+                        [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('fail_count')), 'total_fail'],
+                        [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('total_time')), 'total_time'],
+                    ],
+                    where: { date: today },
+                    raw: true,
+                }),
+            ]);
+            const row = stats;
+            const totalRuns = Number(row === null || row === void 0 ? void 0 : row.total_runs) || 0;
+            const totalSuccess = Number(row === null || row === void 0 ? void 0 : row.total_success) || 0;
+            const totalFail = Number(row === null || row === void 0 ? void 0 : row.total_fail) || 0;
+            const totalTime = Number(row === null || row === void 0 ? void 0 : row.total_time) || 0;
+            res.send({
+                code: 200,
+                data: {
+                    total,
+                    enabled,
+                    disabled,
+                    todayRuns: totalRuns,
+                    todaySuccess: totalSuccess,
+                    todayFail: totalFail,
+                    successRate: totalRuns > 0 ? ((totalSuccess / totalRuns) * 100).toFixed(1) : '0',
+                    avgTime: totalRuns > 0 ? Math.round(totalTime / totalRuns) : 0,
+                },
+            });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    route.get('/trend', async (req, res, next) => {
+        try {
+            const days = parseInt(req.query.days) || 7;
+            const dates = [];
+            for (let i = days - 1; i >= 0; i--) {
+                dates.push((0, dayjs_1.default)().subtract(i, 'day').format('YYYY-MM-DD'));
+            }
+            const rows = (await cronStats_1.CrontabStatModel.findAll({
+                attributes: [
+                    'date',
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('run_count')), 'total_runs'],
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('success_count')), 'total_success'],
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('fail_count')), 'total_fail'],
+                ],
+                where: {
+                    date: { [sequelize_1.Op.in]: dates },
+                },
+                group: ['date'],
+                order: [['date', 'ASC']],
+                raw: true,
+            }));
+            const dataMap = {};
+            rows.forEach((r) => {
+                dataMap[r.date] = {
+                    total: Number(r.total_runs) || 0,
+                    success: Number(r.total_success) || 0,
+                    fail: Number(r.total_fail) || 0,
+                };
+            });
+            const data = dates.map((d) => (Object.assign({ date: (0, dayjs_1.default)(d).format('MM-DD') }, (dataMap[d] || { total: 0, success: 0, fail: 0 }))));
+            res.send({ code: 200, data });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    route.get('/top-time', async (req, res, next) => {
+        try {
+            const today = (0, dayjs_1.default)().format('YYYY-MM-DD');
+            const rows = (await cronStats_1.CrontabStatModel.findAll({
+                attributes: [
+                    'ref_id',
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('total_time')), 'total_time'],
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('run_count')), 'run_count'],
+                    [(0, sequelize_1.fn)('MAX', (0, sequelize_1.col)('max_time')), 'max_time'],
+                ],
+                where: { date: today, run_count: { [sequelize_1.Op.gt]: 0 } },
+                group: ['ref_id'],
+                order: [[(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('total_time')), 'DESC']],
+                limit: 5,
+                raw: true,
+            }));
+            const ids = rows.map((r) => Number(r.ref_id));
+            const crons = await cron_1.CrontabModel.findAll({
+                where: { id: { [sequelize_1.Op.in]: ids } },
+                raw: true,
+            });
+            const nameMap = {};
+            crons.forEach((c) => { nameMap[c.id] = c.name || c.command; });
+            const data = rows.map((r, i) => ({
+                rank: i + 1,
+                name: nameMap[Number(r.ref_id)] || `任务#${r.ref_id}`,
+                avgTime: Math.round(Number(r.total_time) / Number(r.run_count)),
+                maxTime: Number(r.max_time),
+            }));
+            res.send({ code: 200, data });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    route.get('/top-count', async (req, res, next) => {
+        try {
+            const today = (0, dayjs_1.default)().format('YYYY-MM-DD');
+            const rows = (await cronStats_1.CrontabStatModel.findAll({
+                attributes: [
+                    'ref_id',
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('run_count')), 'run_count'],
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('total_time')), 'total_time'],
+                    [(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('success_count')), 'success_count'],
+                ],
+                where: { date: today, run_count: { [sequelize_1.Op.gt]: 0 } },
+                group: ['ref_id'],
+                order: [[(0, sequelize_1.fn)('SUM', (0, sequelize_1.col)('run_count')), 'DESC']],
+                limit: 5,
+                raw: true,
+            }));
+            const ids = rows.map((r) => Number(r.ref_id));
+            const crons = await cron_1.CrontabModel.findAll({
+                where: { id: { [sequelize_1.Op.in]: ids } },
+                raw: true,
+            });
+            const nameMap = {};
+            crons.forEach((c) => { nameMap[c.id] = c.name || c.command; });
+            const data = rows.map((r, i) => ({
+                rank: i + 1,
+                name: nameMap[Number(r.ref_id)] || `任务#${r.ref_id}`,
+                runCount: Number(r.run_count),
+                avgTime: Math.round(Number(r.total_time) / Number(r.run_count)),
+                successRate: Number(r.run_count) > 0
+                    ? ((Number(r.success_count) / Number(r.run_count)) * 100).toFixed(1)
+                    : '0',
+            }));
+            res.send({ code: 200, data });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    route.get('/runtime', async (req, res, next) => {
+        try {
+            const runningInstances = await runningInstance_1.RunningInstanceModel.findAll({
+                where: {
+                    status: runningInstance_1.InstanceStatus.running,
+                },
+                raw: true,
+            });
+            const queuedCrons = await cron_1.CrontabModel.findAll({
+                where: {
+                    status: 3, // queued
+                },
+                raw: true,
+            });
+            // Fetch cron names for running instances
+            const cronIds = [
+                ...new Set(runningInstances.map((i) => i.cron_id)),
+            ];
+            const crons = cronIds.length > 0
+                ? await cron_1.CrontabModel.findAll({
+                    where: { id: cronIds },
+                    raw: true,
+                })
+                : [];
+            const cronMap = new Map(crons.map((c) => [c.id, c]));
+            const now = (0, dayjs_1.default)().unix();
+            const running = runningInstances.map((inst) => {
+                const cron = cronMap.get(inst.cron_id);
+                return {
+                    instanceId: inst.id,
+                    id: inst.cron_id,
+                    name: (cron === null || cron === void 0 ? void 0 : cron.name) || (cron === null || cron === void 0 ? void 0 : cron.command) || `任务#${inst.cron_id}`,
+                    pid: inst.pid,
+                    elapsed: inst.started_at ? now - inst.started_at : 0,
+                    logPath: inst.log_path,
+                };
+            });
+            const dayAgo = (0, dayjs_1.default)().subtract(24, 'hour').unix();
+            const idleTasks = await cron_1.CrontabModel.findAll({
+                where: {
+                    isDisabled: 0,
+                    status: 1,
+                    last_execution_time: { [sequelize_1.Op.lt]: dayAgo },
+                },
+                order: [['last_execution_time', 'ASC']],
+                limit: 5,
+                raw: true,
+            });
+            res.send({
+                code: 200,
+                data: {
+                    runningCount: running.length,
+                    queuedCount: queuedCrons.length,
+                    running,
+                    idleTasks: idleTasks.map((c) => ({
+                        id: c.id,
+                        name: c.name || c.command || `任务#${c.id}`,
+                        lastRun: c.last_execution_time
+                            ? dayjs_1.default.unix(c.last_execution_time).format('MM-DD HH:mm')
+                            : '-',
+                    })),
+                },
+            });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    route.get('/labels', async (req, res, next) => {
+        try {
+            const today = (0, dayjs_1.default)().format('YYYY-MM-DD');
+            const [crons, stats] = (await Promise.all([
+                cron_1.CrontabModel.findAll({ where: { isDisabled: 0 }, raw: true }),
+                cronStats_1.CrontabStatModel.findAll({ where: { date: today }, raw: true }),
+            ]));
+            const statMap = {};
+            stats.forEach((s) => { statMap[s.ref_id] = s; });
+            const labelMap = {};
+            crons.forEach((c) => {
+                let rawLabels = c.labels;
+                if (typeof rawLabels === 'string')
+                    rawLabels = JSON.parse(rawLabels);
+                const labels = Array.isArray(rawLabels) && rawLabels.length > 0 ? rawLabels : ['未分类'];
+                const st = statMap[c.id];
+                labels.forEach((label) => {
+                    if (!labelMap[label])
+                        labelMap[label] = { count: 0, runs: 0, success: 0, totalTime: 0 };
+                    labelMap[label].count += 1;
+                    if (st) {
+                        labelMap[label].runs += Number(st.run_count) || 0;
+                        labelMap[label].success += Number(st.success_count) || 0;
+                        labelMap[label].totalTime += Number(st.total_time) || 0;
+                    }
+                });
+            });
+            const data = Object.entries(labelMap)
+                .map(([label, v]) => ({
+                label,
+                count: v.count,
+                todayRuns: v.runs,
+                successRate: v.runs > 0 ? ((v.success / v.runs) * 100).toFixed(1) : '0',
+                avgTime: v.runs > 0 ? Math.round(v.totalTime / v.runs) : 0,
+            }))
+                .sort((a, b) => b.todayRuns - a.todayRuns);
+            res.send({ code: 200, data });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+    route.get('/system', async (req, res, next) => {
+        try {
+            const memUsage = process.memoryUsage();
+            res.send({
+                code: 200,
+                data: {
+                    platform: os_1.default.platform(),
+                    uptime: Math.floor(os_1.default.uptime()),
+                    memTotal: os_1.default.totalmem(),
+                    memFree: os_1.default.freemem(),
+                    memUsagePercent: ((1 - os_1.default.freemem() / os_1.default.totalmem()) * 100).toFixed(1),
+                    heapUsed: Math.round(memUsage.heapUsed / 1024 / 1024),
+                    heapTotal: Math.round(memUsage.heapTotal / 1024 / 1024),
+                    loadAvg: os_1.default.loadavg().map((v) => Number(v.toFixed(2))),
+                    cpus: os_1.default.cpus().length,
+                },
+            });
+        }
+        catch (e) {
+            next(e);
+        }
+    });
+};
+//# sourceMappingURL=dashboard.js.map

package/static/build/api/env.js

@@ -10,6 +10,7 @@ const multer_1 = __importDefault(require("multer"));
 const typedi_1 = require("typedi");
 const config_1 = __importDefault(require("../config"));
 const util_1 = require("../config/util");
+const i18n_1 = require("../shared/i18n");
 const env_1 = __importDefault(require("../services/env"));
 const route = (0, express_1.Router)();
 const storage = multer_1.default.diskStorage({
@@ -21,6 +22,10 @@ const storage = multer_1.default.diskStorage({
     },
 });
 const upload = (0, multer_1.default)({ storage: storage });
+const labelSchema = celebrate_1.Joi.array()
+    .items(celebrate_1.Joi.string().trim().required())
+    .min(1)
+    .required();
 exports.default = (app) => {
     app.use('/envs', route);
     route.get('/', async (req, res, next) => {
@@ -42,6 +47,7 @@ exports.default = (app) => {
                 .required()
                 .pattern(/^[a-zA-Z_][0-9a-zA-Z_]*$/),
             remarks: celebrate_1.Joi.string().optional().allow(''),
+            labels: celebrate_1.Joi.array().items(celebrate_1.Joi.string().trim()).optional(),
         })),
     }), async (req, res, next) => {
         var _a;
@@ -49,7 +55,7 @@ exports.default = (app) => {
         try {
             const envService = typedi_1.Container.get(env_1.default);
             if (!((_a = req.body) === null || _a === void 0 ? void 0 : _a.length)) {
-                return res.send({ code: 400, message: '参数不正确' });
+                return res.send({ code: 400, message: (0, i18n_1.t)('参数不正确') });
             }
             const data = await envService.create(req.body);
             return res.send({ code: 200, data });
@@ -64,6 +70,7 @@ exports.default = (app) => {
             name: celebrate_1.Joi.string().required(),
             remarks: celebrate_1.Joi.string().optional().allow('').allow(null),
             id: celebrate_1.Joi.number().required(),
+            labels: celebrate_1.Joi.array().items(celebrate_1.Joi.string().trim()).optional(),
         }),
     }), async (req, res, next) => {
         const logger = typedi_1.Container.get('logger');
@@ -190,6 +197,36 @@ exports.default = (app) => {
             return next(e);
         }
     });
+    route.post('/labels', (0, celebrate_1.celebrate)({
+        body: celebrate_1.Joi.object({
+            ids: celebrate_1.Joi.array().items(celebrate_1.Joi.number().required()).min(1).required(),
+            labels: labelSchema,
+        }),
+    }), async (req, res, next) => {
+        try {
+            const envService = typedi_1.Container.get(env_1.default);
+            const data = await envService.addLabels(req.body.ids, req.body.labels);
+            return res.send({ code: 200, data });
+        }
+        catch (e) {
+            return next(e);
+        }
+    });
+    route.delete('/labels', (0, celebrate_1.celebrate)({
+        body: celebrate_1.Joi.object({
+            ids: celebrate_1.Joi.array().items(celebrate_1.Joi.number().required()).min(1).required(),
+            labels: labelSchema,
+        }),
+    }), async (req, res, next) => {
+        try {
+            const envService = typedi_1.Container.get(env_1.default);
+            const data = await envService.removeLabels(req.body.ids, req.body.labels);
+            return res.send({ code: 200, data });
+        }
+        catch (e) {
+            return next(e);
+        }
+    });
     route.post('/upload', upload.single('env'), async (req, res, next) => {
         const logger = typedi_1.Container.get('logger');
         try {
@@ -204,13 +241,14 @@ exports.default = (app) => {
                     name: x.name,
                     value: x.value,
                     remarks: x.remarks,
+                    labels: x.labels,
                 })));
                 return res.send({ code: 200, data: result });
             }
             else {
                 return res.send({
                     code: 400,
-                    message: '每条数据 name 或者 value 字段不能为空，参考导出文件格式',
+                    message: (0, i18n_1.t)('每条数据 name 或者 value 字段不能为空，参考导出文件格式'),
                 });
             }
         }

package/static/build/api/index.js

@@ -15,6 +15,7 @@ const dependence_1 = __importDefault(require("./dependence"));
 const system_1 = __importDefault(require("./system"));
 const subscription_1 = __importDefault(require("./subscription"));
 const update_1 = __importDefault(require("./update"));
+const dashboard_1 = __importDefault(require("./dashboard"));
 const health_1 = __importDefault(require("./health"));
 exports.default = () => {
     const app = (0, express_1.Router)();
@@ -29,6 +30,7 @@ exports.default = () => {
     (0, system_1.default)(app);
     (0, subscription_1.default)(app);
     (0, update_1.default)(app);
+    (0, dashboard_1.default)(app);
     (0, health_1.default)(app);
     return app;
 };

package/static/build/api/log.js

@@ -7,6 +7,7 @@ const celebrate_1 = require("celebrate");
 const express_1 = require("express");
 const typedi_1 = require("typedi");
 const config_1 = __importDefault(require("../config"));
+const i18n_1 = require("../shared/i18n");
 const util_1 = require("../config/util");
 const log_1 = __importDefault(require("../services/log"));
 const route = (0, express_1.Router)();
@@ -34,7 +35,7 @@ exports.default = (app) => {
             if (!finalPath || blacklist.includes(req.query.path)) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             const content = await (0, util_1.getFileContentByName)(finalPath);
@@ -51,7 +52,7 @@ exports.default = (app) => {
             if (!finalPath || blacklist.includes(req.query.path)) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             const content = await (0, util_1.getFileContentByName)(finalPath);
@@ -75,7 +76,7 @@ exports.default = (app) => {
             if (!finalPath || blacklist.includes(path)) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             await (0, util_1.rmPath)(finalPath);
@@ -98,7 +99,7 @@ exports.default = (app) => {
             if (!filePath) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             return res.download(filePath, filename, (err) => {

package/static/build/api/script.js

@@ -32,11 +32,16 @@ const typedi_1 = require("typedi");
 const config_1 = __importDefault(require("../config"));
 const fs = __importStar(require("fs/promises"));
 const celebrate_1 = require("celebrate");
-const path_1 = require("path");
+const path_1 = __importStar(require("path"));
 const script_1 = __importDefault(require("../services/script"));
+const i18n_1 = require("../shared/i18n");
 const multer_1 = __importDefault(require("multer"));
 const utils_1 = require("../shared/utils");
 const route = (0, express_1.Router)();
+function isPathAllowed(targetPath) {
+    const resolved = path_1.default.resolve(targetPath);
+    return config_1.default.writePathList.some((x) => resolved.startsWith(x));
+}
 const storage = multer_1.default.diskStorage({
     destination: function (req, file, cb) {
         cb(null, config_1.default.scriptPath);
@@ -145,23 +150,34 @@ exports.default = (app) => {
             if (config_1.default.writePathList.every((x) => !path.startsWith(x))) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             if (req.file) {
-                await fs.rename(req.file.path, (0, path_1.join)(path, filename));
+                const uploadPath = (0, path_1.join)(path, filename);
+                if (!isPathAllowed(uploadPath)) {
+                    return res.send({ code: 403, message: (0, i18n_1.t)('暂无权限') });
+                }
+                await fs.rename(req.file.path, uploadPath);
                 return res.send({ code: 200 });
             }
             if (directory) {
-                await fs.mkdir((0, path_1.join)(path, directory), { recursive: true });
+                const dirPath = (0, path_1.join)(path, directory);
+                if (!isPathAllowed(dirPath)) {
+                    return res.send({ code: 403, message: (0, i18n_1.t)('暂无权限') });
+                }
+                await fs.mkdir(dirPath, { recursive: true });
                 return res.send({ code: 200 });
             }
             if (!originFilename) {
                 originFilename = filename;
             }
-            const originFilePath = (0, path_1.join)(path, `${originFilename.replace(/\//g, '')}`);
+            const originFilePath = (0, path_1.join)(path, originFilename);
+            const filePath = (0, path_1.join)(path, filename);
+            if (!isPathAllowed(filePath) || !isPathAllowed(originFilePath)) {
+                return res.send({ code: 403, message: (0, i18n_1.t)('暂无权限') });
+            }
             await fs.mkdir(path, { recursive: true });
-            const filePath = (0, path_1.join)(path, `${filename.replace(/\//g, '')}`);
             const fileExists = await (0, util_1.fileExist)(filePath);
             if (fileExists) {
                 await fs.copyFile(originFilePath, (0, path_1.join)(config_1.default.bakPath, originFilename.replace(/\//g, '')));
@@ -190,7 +206,7 @@ exports.default = (app) => {
             if (!filePath) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             await (0, utils_1.writeFileWithLock)(filePath, content);
@@ -217,7 +233,7 @@ exports.default = (app) => {
             if (!filePath) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             await (0, util_1.rmPath)(filePath);
@@ -243,7 +259,7 @@ exports.default = (app) => {
             if (!filePath) {
                 return res.send({
                     code: 403,
-                    message: '暂无权限',
+                    message: (0, i18n_1.t)('暂无权限'),
                 });
             }
             return res.download(filePath, filename, (err) => {
@@ -271,6 +287,9 @@ exports.default = (app) => {
             }
             const { name, ext } = (0, path_1.parse)(filename);
             const filePath = (0, path_1.join)(config_1.default.scriptPath, path, `${name}.swap${ext}`);
+            if (!isPathAllowed(filePath)) {
+                return res.send({ code: 403, message: (0, i18n_1.t)('暂无权限') });
+            }
             await (0, utils_1.writeFileWithLock)(filePath, content || '');
             const scriptService = typedi_1.Container.get(script_1.default);
             const result = await scriptService.runScript(filePath);
@@ -294,6 +313,9 @@ exports.default = (app) => {
             }
             const { name, ext } = (0, path_1.parse)(filename);
             const filePath = (0, path_1.join)(config_1.default.scriptPath, path, `${name}.swap${ext}`);
+            if (!isPathAllowed(filePath)) {
+                return res.send({ code: 403, message: (0, i18n_1.t)('暂无权限') });
+            }
             const logPath = (0, path_1.join)(config_1.default.logPath, path, `${name}.swap`);
             const scriptService = typedi_1.Container.get(script_1.default);
             const result = await scriptService.stopScript(filePath, pid);
@@ -320,6 +342,9 @@ exports.default = (app) => {
             }
             const filePath = (0, path_1.join)(config_1.default.scriptPath, path, filename);
             const newPath = (0, path_1.join)(config_1.default.scriptPath, path, newFilename);
+            if (!isPathAllowed(filePath) || !isPathAllowed(newPath)) {
+                return res.send({ code: 403, message: (0, i18n_1.t)('暂无权限') });
+            }
             await fs.rename(filePath, newPath);
             res.send({ code: 200 });
         }