@zhin.js/console 1.0.48 → 1.0.50

package/lib/index.js

@@ -2,14 +2,43 @@ import { usePlugin } from '@zhin.js/core';
 import mime from 'mime';
 import * as fs from 'fs';
 import fs__default from 'fs';
-import * as path3 from 'path';
-import path3__default from 'path';
+import * as path from 'path';
+import path__default from 'path';
+import * as crypto from 'crypto';
 import WebSocket from 'ws';
 import { transform } from 'esbuild';
 
 // src/index.ts
 var { root, logger } = usePlugin();
 var ENV_WHITELIST = [".env", ".env.development", ".env.production"];
+var FILE_MANAGER_ALLOWED = [
+  "src",
+  "plugins",
+  "client",
+  "package.json",
+  "tsconfig.json",
+  "zhin.config.yml",
+  ".env",
+  ".env.development",
+  ".env.production",
+  "README.md"
+];
+var FILE_MANAGER_BLOCKED = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".env.local",
+  "data",
+  "lib",
+  "dist",
+  "coverage"
+]);
+function isPathAllowed(relativePath) {
+  if (relativePath.includes("..") || path__default.isAbsolute(relativePath)) return false;
+  const normalized = relativePath.replace(/\\/g, "/").replace(/^\.\//, "");
+  const firstSegment = normalized.split("/")[0];
+  if (FILE_MANAGER_BLOCKED.has(firstSegment)) return false;
+  return FILE_MANAGER_ALLOWED.some((p) => normalized === p || normalized.startsWith(p + "/"));
+}
 function resolveConfigKey(pluginName) {
   const schemaService = root.inject("schema");
   return schemaService?.resolveConfigKey(pluginName) ?? pluginName;
@@ -24,7 +53,7 @@ function getPluginKeys() {
   return Array.from(keys);
 }
 function getConfigFilePath() {
-  return path3__default.resolve(process.cwd(), "zhin.config.yml");
+  return path__default.resolve(process.cwd(), "zhin.config.yml");
 }
 function setupWebSocket(webServer) {
   webServer.ws.on("connection", (ws) => {
@@ -201,7 +230,7 @@ async function handleWebSocketMessage(ws, message, webServer) {
         const cwd = process.cwd();
         const files = ENV_WHITELIST.map((name) => ({
           name,
-          exists: fs__default.existsSync(path3__default.resolve(cwd, name))
+          exists: fs__default.existsSync(path__default.resolve(cwd, name))
         }));
         ws.send(JSON.stringify({ requestId, data: { files } }));
       } catch (error) {
@@ -215,7 +244,7 @@ async function handleWebSocketMessage(ws, message, webServer) {
           ws.send(JSON.stringify({ requestId, error: `Invalid env file: ${filename}` }));
           break;
         }
-        const envPath = path3__default.resolve(process.cwd(), filename);
+        const envPath = path__default.resolve(process.cwd(), filename);
         const content = fs__default.existsSync(envPath) ? fs__default.readFileSync(envPath, "utf-8") : "";
         ws.send(JSON.stringify({ requestId, data: { content } }));
       } catch (error) {
@@ -233,17 +262,420 @@ async function handleWebSocketMessage(ws, message, webServer) {
           ws.send(JSON.stringify({ requestId, error: "content field is required" }));
           break;
         }
-        const envPath = path3__default.resolve(process.cwd(), filename);
+        const envPath = path__default.resolve(process.cwd(), filename);
         fs__default.writeFileSync(envPath, content, "utf-8");
         ws.send(JSON.stringify({ requestId, data: { success: true, message: "\u73AF\u5883\u53D8\u91CF\u5DF2\u4FDD\u5B58\uFF0C\u9700\u91CD\u542F\u751F\u6548" } }));
       } catch (error) {
         ws.send(JSON.stringify({ requestId, error: `Failed to save env file: ${error.message}` }));
       }
       break;
+    // ================================================================
+    // 文件管理
+    // ================================================================
+    case "files:tree":
+      try {
+        const cwd = process.cwd();
+        const tree = buildFileTree(cwd, "", FILE_MANAGER_ALLOWED);
+        ws.send(JSON.stringify({ requestId, data: { tree } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to build file tree: ${error.message}` }));
+      }
+      break;
+    case "files:read":
+      try {
+        const { filePath: fp } = message;
+        if (!fp || !isPathAllowed(fp)) {
+          ws.send(JSON.stringify({ requestId, error: `Access denied: ${fp}` }));
+          break;
+        }
+        const absPath = path__default.resolve(process.cwd(), fp);
+        if (!fs__default.existsSync(absPath)) {
+          ws.send(JSON.stringify({ requestId, error: `File not found: ${fp}` }));
+          break;
+        }
+        const stat = fs__default.statSync(absPath);
+        if (!stat.isFile()) {
+          ws.send(JSON.stringify({ requestId, error: `Not a file: ${fp}` }));
+          break;
+        }
+        if (stat.size > 1024 * 1024) {
+          ws.send(JSON.stringify({ requestId, error: `File too large: ${(stat.size / 1024).toFixed(0)}KB (max 1MB)` }));
+          break;
+        }
+        const fileContent = fs__default.readFileSync(absPath, "utf-8");
+        ws.send(JSON.stringify({ requestId, data: { content: fileContent, size: stat.size } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to read file: ${error.message}` }));
+      }
+      break;
+    case "files:save":
+      try {
+        const { filePath: fp, content: fileContent } = message;
+        if (!fp || !isPathAllowed(fp)) {
+          ws.send(JSON.stringify({ requestId, error: `Access denied: ${fp}` }));
+          break;
+        }
+        if (typeof fileContent !== "string") {
+          ws.send(JSON.stringify({ requestId, error: "content field is required" }));
+          break;
+        }
+        const absPath = path__default.resolve(process.cwd(), fp);
+        const dir = path__default.dirname(absPath);
+        if (!fs__default.existsSync(dir)) {
+          fs__default.mkdirSync(dir, { recursive: true });
+        }
+        fs__default.writeFileSync(absPath, fileContent, "utf-8");
+        ws.send(JSON.stringify({ requestId, data: { success: true, message: `\u6587\u4EF6\u5DF2\u4FDD\u5B58: ${fp}` } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to save file: ${error.message}` }));
+      }
+      break;
+    // ================================================================
+    // 数据库管理
+    // ================================================================
+    case "db:info":
+      try {
+        const dbInfo = getDatabaseInfo();
+        ws.send(JSON.stringify({ requestId, data: dbInfo }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to get db info: ${error.message}` }));
+      }
+      break;
+    case "db:tables":
+      try {
+        const tables = getDatabaseTables();
+        ws.send(JSON.stringify({ requestId, data: { tables } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to list tables: ${error.message}` }));
+      }
+      break;
+    case "db:select":
+      try {
+        const { table, page = 1, pageSize = 50, where } = message;
+        if (!table) {
+          ws.send(JSON.stringify({ requestId, error: "table is required" }));
+          break;
+        }
+        const selectResult = await dbSelect(table, page, pageSize, where);
+        ws.send(JSON.stringify({ requestId, data: selectResult }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to select: ${error.message}` }));
+      }
+      break;
+    case "db:insert":
+      try {
+        const { table, row } = message;
+        if (!table || !row) {
+          ws.send(JSON.stringify({ requestId, error: "table and row are required" }));
+          break;
+        }
+        await dbInsert(table, row);
+        ws.send(JSON.stringify({ requestId, data: { success: true } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to insert: ${error.message}` }));
+      }
+      break;
+    case "db:update":
+      try {
+        const { table, row, where: updateWhere } = message;
+        if (!table || !row || !updateWhere) {
+          ws.send(JSON.stringify({ requestId, error: "table, row, and where are required" }));
+          break;
+        }
+        const affected = await dbUpdate(table, row, updateWhere);
+        ws.send(JSON.stringify({ requestId, data: { success: true, affected } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to update: ${error.message}` }));
+      }
+      break;
+    case "db:delete":
+      try {
+        const { table, where: deleteWhere } = message;
+        if (!table || !deleteWhere) {
+          ws.send(JSON.stringify({ requestId, error: "table and where are required" }));
+          break;
+        }
+        const deleted = await dbDelete(table, deleteWhere);
+        ws.send(JSON.stringify({ requestId, data: { success: true, deleted } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to delete: ${error.message}` }));
+      }
+      break;
+    case "db:drop-table":
+      try {
+        const { table: dropTableName } = message;
+        if (!dropTableName) {
+          ws.send(JSON.stringify({ requestId, error: "table is required" }));
+          break;
+        }
+        await dbDropTable(dropTableName);
+        ws.send(JSON.stringify({ requestId, data: { success: true } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to drop table: ${error.message}` }));
+      }
+      break;
+    // KV 专用操作
+    case "db:kv:get":
+      try {
+        const { table, key } = message;
+        if (!table || !key) {
+          ws.send(JSON.stringify({ requestId, error: "table and key are required" }));
+          break;
+        }
+        const kvValue = await kvGet(table, key);
+        ws.send(JSON.stringify({ requestId, data: { key, value: kvValue } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to get kv: ${error.message}` }));
+      }
+      break;
+    case "db:kv:set":
+      try {
+        const { table, key, value, ttl } = message;
+        if (!table || !key) {
+          ws.send(JSON.stringify({ requestId, error: "table and key are required" }));
+          break;
+        }
+        await kvSet(table, key, value, ttl);
+        ws.send(JSON.stringify({ requestId, data: { success: true } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to set kv: ${error.message}` }));
+      }
+      break;
+    case "db:kv:delete":
+      try {
+        const { table, key } = message;
+        if (!table || !key) {
+          ws.send(JSON.stringify({ requestId, error: "table and key are required" }));
+          break;
+        }
+        await kvDelete(table, key);
+        ws.send(JSON.stringify({ requestId, data: { success: true } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to delete kv: ${error.message}` }));
+      }
+      break;
+    case "db:kv:entries":
+      try {
+        const { table } = message;
+        if (!table) {
+          ws.send(JSON.stringify({ requestId, error: "table is required" }));
+          break;
+        }
+        const kvEntries = await kvGetEntries(table);
+        ws.send(JSON.stringify({ requestId, data: { entries: kvEntries } }));
+      } catch (error) {
+        ws.send(JSON.stringify({ requestId, error: `Failed to get entries: ${error.message}` }));
+      }
+      break;
     default:
       ws.send(JSON.stringify({ requestId, error: `Unknown message type: ${type}` }));
   }
 }
+function getDb() {
+  return root.inject("database");
+}
+function getDbType() {
+  const dbFeature = getDb();
+  const dialectName = dbFeature.db.dialect.name;
+  if (["mongodb"].includes(dialectName)) return "document";
+  if (["redis"].includes(dialectName)) return "keyvalue";
+  return "related";
+}
+function getDatabaseInfo() {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  return {
+    dialect: db.dialectName,
+    type: getDbType(),
+    tables: Array.from(db.models.keys())
+  };
+}
+function getDatabaseTables() {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  getDbType();
+  const tables = [];
+  for (const [name] of db.models) {
+    const def = db.definitions.get(name);
+    tables.push({ name, columns: def ? Object.fromEntries(Object.entries(def).map(([col, colDef]) => [col, colDef])) : void 0 });
+  }
+  return tables;
+}
+async function dbSelect(table, page, pageSize, where) {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  const dbType = getDbType();
+  const model = db.models.get(table);
+  if (!model) throw new Error(`Table '${table}' not found`);
+  if (dbType === "keyvalue") {
+    const kvModel = model;
+    const allEntries = await kvModel.entries();
+    const total2 = allEntries.length;
+    const start = (page - 1) * pageSize;
+    const rows2 = allEntries.slice(start, start + pageSize).map(([k, v]) => ({ key: k, value: v }));
+    return { rows: rows2, total: total2, page, pageSize };
+  }
+  let selection = model.select();
+  if (where && Object.keys(where).length > 0) {
+    selection = selection.where(where);
+  }
+  let total;
+  try {
+    const countResult = await db.aggregate(table).count("*", "total").where(where || {});
+    total = countResult?.[0]?.total ?? 0;
+  } catch {
+    const all = await model.select();
+    total = all.length;
+  }
+  const offset = (page - 1) * pageSize;
+  let query = model.select();
+  if (where && Object.keys(where).length > 0) {
+    query = query.where(where);
+  }
+  const rows = await query.limit(pageSize).offset(offset);
+  return { rows, total, page, pageSize };
+}
+async function dbInsert(table, row) {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  const dbType = getDbType();
+  const model = db.models.get(table);
+  if (!model) throw new Error(`Table '${table}' not found`);
+  if (dbType === "keyvalue") {
+    const kvModel = model;
+    if (!row.key) throw new Error("key is required for KV insert");
+    await kvModel.set(row.key, row.value);
+    return;
+  }
+  if (dbType === "document") {
+    await model.create(row);
+    return;
+  }
+  await model.insert(row);
+}
+async function dbUpdate(table, row, where) {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  const dbType = getDbType();
+  const model = db.models.get(table);
+  if (!model) throw new Error(`Table '${table}' not found`);
+  if (dbType === "keyvalue") {
+    const kvModel = model;
+    if (!where.key) throw new Error("key is required for KV update");
+    await kvModel.set(where.key, row.value);
+    return 1;
+  }
+  if (dbType === "document") {
+    if (where._id) {
+      return await model.updateById(where._id, row);
+    }
+  }
+  return await model.update(row).where(where);
+}
+async function dbDelete(table, where) {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  const dbType = getDbType();
+  const model = db.models.get(table);
+  if (!model) throw new Error(`Table '${table}' not found`);
+  if (dbType === "keyvalue") {
+    const kvModel = model;
+    if (!where.key) throw new Error("key is required for KV delete");
+    await kvModel.deleteByKey(where.key);
+    return 1;
+  }
+  if (dbType === "document") {
+    if (where._id) {
+      return await model.deleteById(where._id);
+    }
+  }
+  return await model.delete(where);
+}
+async function dbDropTable(table) {
+  const dbFeature = getDb();
+  const db = dbFeature.db;
+  const model = db.models.get(table);
+  if (!model) throw new Error(`Table '${table}' not found`);
+  const sql = db.dialect.formatDropTable(table, true);
+  await db.query(sql);
+  db.models.delete(table);
+  db.definitions.delete(table);
+}
+async function kvGet(table, key) {
+  const dbFeature = getDb();
+  const model = dbFeature.db.models.get(table);
+  if (!model) throw new Error(`Bucket '${table}' not found`);
+  return await model.get(key);
+}
+async function kvSet(table, key, value, ttl) {
+  const dbFeature = getDb();
+  const model = dbFeature.db.models.get(table);
+  if (!model) throw new Error(`Bucket '${table}' not found`);
+  await model.set(key, value, ttl);
+}
+async function kvDelete(table, key) {
+  const dbFeature = getDb();
+  const model = dbFeature.db.models.get(table);
+  if (!model) throw new Error(`Bucket '${table}' not found`);
+  await model.deleteByKey(key);
+}
+async function kvGetEntries(table) {
+  const dbFeature = getDb();
+  const model = dbFeature.db.models.get(table);
+  if (!model) throw new Error(`Bucket '${table}' not found`);
+  const entries = await model.entries();
+  return entries.map(([k, v]) => ({ key: k, value: v }));
+}
+function buildFileTree(cwd, relativePath, allowed) {
+  const tree = [];
+  path__default.resolve(cwd, relativePath);
+  for (const entry of allowed) {
+    const entryRelative = entry;
+    if (entryRelative.includes("/")) continue;
+    const absPath = path__default.resolve(cwd, entry);
+    if (!fs__default.existsSync(absPath)) continue;
+    const stat = fs__default.statSync(absPath);
+    if (stat.isDirectory()) {
+      tree.push({
+        name: entryRelative,
+        path: entry,
+        type: "directory",
+        children: buildDirectoryTree(cwd, entry, 3)
+      });
+    } else if (stat.isFile()) {
+      tree.push({ name: entryRelative, path: entry, type: "file" });
+    }
+  }
+  return tree.sort((a, b) => {
+    if (a.type !== b.type) return a.type === "directory" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+}
+function buildDirectoryTree(cwd, relativePath, maxDepth) {
+  if (maxDepth <= 0) return [];
+  const absDir = path__default.resolve(cwd, relativePath);
+  if (!fs__default.existsSync(absDir) || !fs__default.statSync(absDir).isDirectory()) return [];
+  const entries = fs__default.readdirSync(absDir, { withFileTypes: true });
+  const result = [];
+  for (const entry of entries) {
+    if (FILE_MANAGER_BLOCKED.has(entry.name) || entry.name.startsWith(".")) continue;
+    const childRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      result.push({
+        name: entry.name,
+        path: childRelative,
+        type: "directory",
+        children: buildDirectoryTree(cwd, childRelative, maxDepth - 1)
+      });
+    } else if (entry.isFile()) {
+      result.push({ name: entry.name, path: childRelative, type: "file" });
+    }
+  }
+  return result.sort((a, b) => {
+    if (a.type !== b.type) return a.type === "directory" ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+}
 function findPluginByConfigKey(rootPlugin, configKey) {
   for (const child of rootPlugin.children) {
     if (child.name === configKey || child.name.endsWith(`-${configKey}`) || child.name.includes(configKey)) {
@@ -268,7 +700,7 @@ var cache = /* @__PURE__ */ new Map();
 var TRANSFORMABLE_EXTS = [".ts", ".tsx", ".jsx"];
 var RESOLVE_EXTS = [".tsx", ".ts", ".jsx", ".js"];
 function isTransformable(filePath) {
-  const ext = path3.extname(filePath).toLowerCase();
+  const ext = path.extname(filePath).toLowerCase();
   return TRANSFORMABLE_EXTS.includes(ext);
 }
 var IMPORT_RE = /(?:import|export)\s+.*?\s+from\s+['"]([^'"]+)['"]|import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
@@ -277,14 +709,14 @@ function isRelative(specifier) {
   return specifier.startsWith("./") || specifier.startsWith("../");
 }
 function hasExtension(specifier) {
-  const base = path3.basename(specifier);
+  const base = path.basename(specifier);
   return base.includes(".") && !base.startsWith(".");
 }
 function resolveRelativeImport(specifier, fromFile) {
   if (!isRelative(specifier)) return specifier;
   if (hasExtension(specifier)) return specifier;
-  const dir = path3.dirname(fromFile);
-  const target = path3.resolve(dir, specifier);
+  const dir = path.dirname(fromFile);
+  const target = path.resolve(dir, specifier);
   for (const ext of RESOLVE_EXTS) {
     if (fs.existsSync(target + ext)) {
       return specifier + ext;
@@ -292,7 +724,7 @@ function resolveRelativeImport(specifier, fromFile) {
   }
   if (fs.existsSync(target) && fs.statSync(target).isDirectory()) {
     for (const ext of RESOLVE_EXTS) {
-      if (fs.existsSync(path3.join(target, `index${ext}`))) {
+      if (fs.existsSync(path.join(target, `index${ext}`))) {
         return specifier + `/index${ext}`;
       }
     }
@@ -318,7 +750,7 @@ async function transformFile(filePath) {
     return cached.code;
   }
   const source = fs.readFileSync(filePath, "utf-8");
-  const ext = path3.extname(filePath).toLowerCase();
+  const ext = path.extname(filePath).toLowerCase();
   const loader = ext === ".tsx" ? "tsx" : ext === ".ts" ? "ts" : ext === ".jsx" ? "jsx" : "js";
   const result = await transform(source, {
     loader,
@@ -353,23 +785,23 @@ if (enabled) {
   });
   useContext("router", async (router) => {
     const entryBases = /* @__PURE__ */ new Map();
-    const genToken = () => Math.random().toString(36).slice(2, 8);
+    const genToken = () => crypto.randomBytes(6).toString("hex");
     const watchedDirs = /* @__PURE__ */ new Set();
     const watchers = [];
-    path3.join(import.meta.dirname, "../client");
-    const distDir = path3.join(import.meta.dirname, "../dist");
+    path.join(import.meta.dirname, "../client");
+    const distDir = path.join(import.meta.dirname, "../dist");
     const resolveFile = (name) => {
-      const distPath = path3.resolve(distDir, name);
+      const distPath = path.resolve(distDir, name);
       if (fs.existsSync(distPath)) return distPath;
       return null;
     };
     const webServer = {
       entries: {},
       addEntry(entry) {
-        const hash = Date.now().toString(16) + Math.random().toString(16).slice(2, 8);
+        const hash = crypto.randomBytes(8).toString("hex");
         const entryFile = typeof entry === "string" ? entry : entry.production;
-        const dir = path3.dirname(entryFile);
-        const filename = path3.basename(entryFile);
+        const dir = path.dirname(entryFile);
+        const filename = path.basename(entryFile);
         let token;
         for (const [t, d] of entryBases) {
           if (d === dir) {
@@ -399,6 +831,32 @@ if (enabled) {
       ws: router.ws("/server")
     };
     logger2.info(`Web \u63A7\u5236\u53F0\u5DF2\u542F\u52A8 (${"\u751F\u4EA7\u6A21\u5F0F, \u9759\u6001\u6587\u4EF6 + \u6309\u9700\u8F6C\u8BD1"})`);
+    const loginAssist = root2.inject("loginAssist");
+    if (loginAssist) {
+      router.get("/api/login-assist/pending", (ctx) => {
+        ctx.body = loginAssist.listPending();
+      });
+      router.post("/api/login-assist/submit", async (ctx) => {
+        const body = ctx.request?.body;
+        if (!body?.id) {
+          ctx.status = 400;
+          ctx.body = { error: "missing id" };
+          return;
+        }
+        const ok = loginAssist.submit(body.id, body.value ?? "");
+        ctx.body = { ok };
+      });
+      router.post("/api/login-assist/cancel", async (ctx) => {
+        const body = ctx.request?.body;
+        if (!body?.id) {
+          ctx.status = 400;
+          ctx.body = { error: "missing id" };
+          return;
+        }
+        const ok = loginAssist.cancel(body.id, body.reason);
+        ctx.body = { ok };
+      });
+    }
     router.all("*all", async (ctx, next) => {
       if (ctx.path.startsWith("/api/") || ctx.path === "/api" || ctx.path.startsWith("/pub/") || ctx.path === "/pub") {
         return next();
@@ -433,7 +891,7 @@ if (enabled) {
             return;
           }
         }
-        ctx.type = path3.extname(filename);
+        ctx.type = path.extname(filename);
         ctx.type = mime.getType(filename) || ctx.type;
         return ctx.body = fs.createReadStream(filename);
       };
@@ -451,8 +909,8 @@ if (enabled) {
           ctx.status = 404;
           return;
         }
-        const fullPath = path3.resolve(baseDir, relPath);
-        const safePfx = baseDir.endsWith(path3.sep) ? baseDir : baseDir + path3.sep;
+        const fullPath = path.resolve(baseDir, relPath);
+        const safePfx = baseDir.endsWith(path.sep) ? baseDir : baseDir + path.sep;
         if (!fullPath.startsWith(safePfx) && fullPath !== baseDir) {
           ctx.status = 403;
           return;