aaden-cli 1.6.109 → 1.6.110

package/dist/index.js

@@ -250,6 +250,102 @@ function collectHostInfo() {
 module.exports = {collectHostInfo}
 
 
+/***/ }),
+
+/***/ 8226:
+/***/ ((module) => {
+
+// TSE 证书到期日：第一代 Swissbit TSE（BSI-DSZ-CC-1121）的证书只有 5.5 年，
+// 到期当天起 TSE 拒绝对时，之后每笔交易都报 WORM_ERROR_NO_TIME_SET，整店静默停签。
+// 门店上的 Node 是 14，没有 crypto.X509Certificate，这里只解析需要的几个字段：
+// 有效期（notBefore / notAfter）和 subject 里的 dnQualifier（区分第一代 / 第二代）。
+
+const OID_DN_QUALIFIER = '2.5.4.46'
+
+// 读一个 DER TLV，返回 tag、内容起止位置
+function readTlv(buf, pos) {
+    const tag = buf[pos]
+    let len = buf[pos + 1]
+    let start = pos + 2
+    if (len & 0x80) {
+        const n = len & 0x7f
+        len = 0
+        for (let i = 0; i < n; i++) len = len * 256 + buf[pos + 2 + i]
+        start += n
+    }
+    return {tag, start, end: start + len}
+}
+
+function children(buf, tlv) {
+    const list = []
+    let pos = tlv.start
+    while (pos < tlv.end) {
+        const child = readTlv(buf, pos)
+        list.push(child)
+        pos = child.end
+    }
+    return list
+}
+
+function decodeOid(bytes) {
+    const parts = [Math.floor(bytes[0] / 40), bytes[0] % 40]
+    let value = 0
+    for (let i = 1; i < bytes.length; i++) {
+        value = value * 128 + (bytes[i] & 0x7f)
+        if (!(bytes[i] & 0x80)) {
+            parts.push(value)
+            value = 0
+        }
+    }
+    return parts.join('.')
+}
+
+// UTCTime（0x17，两位年份）或 GeneralizedTime（0x18）
+function decodeTime(buf, tlv) {
+    const s = buf.slice(tlv.start, tlv.end).toString('ascii')
+    const full = tlv.tag === 0x17 ? (parseInt(s.slice(0, 2), 10) < 50 ? '20' : '19') + s : s
+    const m = full.match(/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/)
+    return m ? `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z` : null
+}
+
+function parseCertificateDer(der) {
+    const cert = readTlv(der, 0)
+    const tbs = children(der, cert)[0]
+    const fields = children(der, tbs)
+    // 有显式 version（[0]）时整体后移一位：serialNumber、signature、issuer、validity、subject
+    const offset = fields[0].tag === 0xa0 ? 1 : 0
+    const [notBefore, notAfter] = children(der, fields[offset + 3])
+    let profile = null
+    for (const rdn of children(der, fields[offset + 4])) {
+        for (const attr of children(der, rdn)) {
+            const [oid, value] = children(der, attr)
+            if (decodeOid(der.slice(oid.start, oid.end)) === OID_DN_QUALIFIER) {
+                profile = der.slice(value.start, value.end).toString('utf-8')
+            }
+        }
+    }
+    return {
+        tseCertNotBefore: decodeTime(der, notBefore),
+        tseCertNotAfter: decodeTime(der, notAfter),
+        tseCertProfile: profile,
+    }
+}
+
+/**
+ * TseHost 的 /certificate 和门店库 RealTseInfo.certificate 都是「证书链 PEM 整体再 base64」，
+ * 第一张是 TSE 自己的证书，后面是 CA。也兼容直接给 PEM 或 DER 的情况。
+ */
+function parseTseCertificate(encoded) {
+    const raw = String(encoded).trim()
+    const pem = raw.includes('-----BEGIN') ? raw : Buffer.from(raw, 'base64').toString('utf-8')
+    const block = pem.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/)
+    const der = block ? Buffer.from(block[1].replace(/\s+/g, ''), 'base64') : Buffer.from(raw, 'base64')
+    return parseCertificateDer(der)
+}
+
+module.exports = {parseTseCertificate}
+
+
 /***/ }),
 
 /***/ 6677:
@@ -259,6 +355,8 @@ const fs = __nccwpck_require__(7147)
 const os = __nccwpck_require__(2037)
 const http = __nccwpck_require__(3685)
 const https = __nccwpck_require__(5687)
+const {execFileSync} = __nccwpck_require__(2081)
+const {parseTseCertificate} = __nccwpck_require__(8226)
 
 // do-log 顺带上报的 TSE 适配服务（TseHost）信息，用来在云端看车队的 TSE 版本和服务状态。
 // WSL 门店的 TseHost 跑在 Windows 侧，网站目录里的 jar 不一定是实际在跑的那个，
@@ -286,18 +384,18 @@ async function safe(fn, fallback = null) {
     }
 }
 
-function readTseSection() {
+function readIniSection(name) {
     const section = {}
-    let inTse = false
+    let inSection = false
     for (const raw of fs.readFileSync(CONFIG_INI, 'utf-8').split(/\r?\n/)) {
         const line = raw.trim()
         if (!line || line.startsWith(';') || line.startsWith('#')) continue
         const header = line.match(/^\[(.+)]$/)
         if (header) {
-            inTse = header[1].trim() === 'TSE'
+            inSection = header[1].trim() === name
             continue
         }
-        if (!inTse) continue
+        if (!inSection) continue
         const eq = line.indexOf('=')
         if (eq < 0) continue
         section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim().replace(/^"(.*)"$/, '$1')
@@ -358,8 +456,42 @@ function servingJarPath() {
     return match ? match[1] : LINUX_DEFAULT_JAR
 }
 
+// 门店库里最新的那块 TSE（换过 TSE 会有多行）；只读数据库，TSE 坏了也读得到
+function readCertFromDb() {
+    const db = readIniSection('DB')
+    const out = execFileSync('mysql', [
+        '-h', db.host || 'localhost', '-u', db.user || 'aaden', '-N', '-B', '--raw', db.name || 'aaden',
+        '-e', 'select serialNumber, certificate from RealTseInfo order by id desc limit 1',
+    ], {
+        encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+        // 密码走环境变量，不出现在进程列表里
+        env: Object.assign({}, process.env, {MYSQL_PWD: db.password || ''}),
+    }).trim()
+    if (!out) return null
+    const [serial, certificate] = out.split('\t')
+    return {serial, certificate: certificate && certificate !== 'NULL' ? certificate : null}
+}
+
+// TSE 自己的序列号、证书有效期和型号（dnQualifier：BSI-DSZ-CC-1121 是第一代，-V2 是第二代）
+async function collectCert(tseHost, serviceUp) {
+    const fromDb = await safe(readCertFromDb)
+    let certificate = fromDb && fromDb.certificate
+    // 库里还没存证书（新装、或从没取到过）时再问服务；服务连不上就算了
+    if (!certificate && serviceUp) {
+        const res = await httpGet(`${tseHost}/certificate`)
+        if (res.status === 200) certificate = await safe(() => JSON.parse(res.body).certificate)
+    }
+    const parsed = certificate ? await safe(() => parseTseCertificate(certificate), {}) : {}
+    return {
+        tseSerial: (fromDb && fromDb.serial) || null,
+        tseCertNotBefore: parsed.tseCertNotBefore || null,
+        tseCertNotAfter: parsed.tseCertNotAfter || null,
+        tseCertProfile: parsed.tseCertProfile || null,
+    }
+}
+
 async function probeTse() {
-    const section = await safe(readTseSection, {})
+    const section = await safe(() => readIniSection('TSE'), {})
     const tseEnabled = parseEnabled(section.TseEnabled)
     const tseHost = (section.TseHost || DEFAULT_TSE_HOST).replace(/\/+$/, '')
     // 不同版本的 jar 大小不同，没有 /adapterVersion 的老版本只能靠它区分
@@ -390,7 +522,9 @@ async function probeTse() {
         }
     }
 
-    return {tseEnabled, tseHost, tseStatus, tseAdapterVersion, tseJarSize}
+    const cert = await collectCert(tseHost, ping.status !== 0)
+
+    return {tseEnabled, tseHost, tseStatus, tseAdapterVersion, tseJarSize, ...cert}
 }
 
 // 整体出错就什么都不报，云端保留上次的值
@@ -18729,7 +18863,7 @@ module.exports = JSON.parse('{"name":"axios","version":"0.19.2","description":"P
 /***/ ((module) => {
 
 "use strict";
-module.exports = {"i8":"1.6.109"};
+module.exports = {"i8":"1.6.110"};
 
 /***/ })
 

package/modules/tse-cert.js

@@ -0,0 +1,89 @@
+// TSE 证书到期日：第一代 Swissbit TSE（BSI-DSZ-CC-1121）的证书只有 5.5 年，
+// 到期当天起 TSE 拒绝对时，之后每笔交易都报 WORM_ERROR_NO_TIME_SET，整店静默停签。
+// 门店上的 Node 是 14，没有 crypto.X509Certificate，这里只解析需要的几个字段：
+// 有效期（notBefore / notAfter）和 subject 里的 dnQualifier（区分第一代 / 第二代）。
+
+const OID_DN_QUALIFIER = '2.5.4.46'
+
+// 读一个 DER TLV，返回 tag、内容起止位置
+function readTlv(buf, pos) {
+    const tag = buf[pos]
+    let len = buf[pos + 1]
+    let start = pos + 2
+    if (len & 0x80) {
+        const n = len & 0x7f
+        len = 0
+        for (let i = 0; i < n; i++) len = len * 256 + buf[pos + 2 + i]
+        start += n
+    }
+    return {tag, start, end: start + len}
+}
+
+function children(buf, tlv) {
+    const list = []
+    let pos = tlv.start
+    while (pos < tlv.end) {
+        const child = readTlv(buf, pos)
+        list.push(child)
+        pos = child.end
+    }
+    return list
+}
+
+function decodeOid(bytes) {
+    const parts = [Math.floor(bytes[0] / 40), bytes[0] % 40]
+    let value = 0
+    for (let i = 1; i < bytes.length; i++) {
+        value = value * 128 + (bytes[i] & 0x7f)
+        if (!(bytes[i] & 0x80)) {
+            parts.push(value)
+            value = 0
+        }
+    }
+    return parts.join('.')
+}
+
+// UTCTime（0x17，两位年份）或 GeneralizedTime（0x18）
+function decodeTime(buf, tlv) {
+    const s = buf.slice(tlv.start, tlv.end).toString('ascii')
+    const full = tlv.tag === 0x17 ? (parseInt(s.slice(0, 2), 10) < 50 ? '20' : '19') + s : s
+    const m = full.match(/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/)
+    return m ? `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z` : null
+}
+
+function parseCertificateDer(der) {
+    const cert = readTlv(der, 0)
+    const tbs = children(der, cert)[0]
+    const fields = children(der, tbs)
+    // 有显式 version（[0]）时整体后移一位：serialNumber、signature、issuer、validity、subject
+    const offset = fields[0].tag === 0xa0 ? 1 : 0
+    const [notBefore, notAfter] = children(der, fields[offset + 3])
+    let profile = null
+    for (const rdn of children(der, fields[offset + 4])) {
+        for (const attr of children(der, rdn)) {
+            const [oid, value] = children(der, attr)
+            if (decodeOid(der.slice(oid.start, oid.end)) === OID_DN_QUALIFIER) {
+                profile = der.slice(value.start, value.end).toString('utf-8')
+            }
+        }
+    }
+    return {
+        tseCertNotBefore: decodeTime(der, notBefore),
+        tseCertNotAfter: decodeTime(der, notAfter),
+        tseCertProfile: profile,
+    }
+}
+
+/**
+ * TseHost 的 /certificate 和门店库 RealTseInfo.certificate 都是「证书链 PEM 整体再 base64」，
+ * 第一张是 TSE 自己的证书，后面是 CA。也兼容直接给 PEM 或 DER 的情况。
+ */
+function parseTseCertificate(encoded) {
+    const raw = String(encoded).trim()
+    const pem = raw.includes('-----BEGIN') ? raw : Buffer.from(raw, 'base64').toString('utf-8')
+    const block = pem.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/)
+    const der = block ? Buffer.from(block[1].replace(/\s+/g, ''), 'base64') : Buffer.from(raw, 'base64')
+    return parseCertificateDer(der)
+}
+
+module.exports = {parseTseCertificate}

package/modules/tse-info.js

@@ -2,6 +2,8 @@ const fs = require('fs')
 const os = require('os')
 const http = require('http')
 const https = require('https')
+const {execFileSync} = require('child_process')
+const {parseTseCertificate} = require('./tse-cert')
 
 // do-log 顺带上报的 TSE 适配服务（TseHost）信息，用来在云端看车队的 TSE 版本和服务状态。
 // WSL 门店的 TseHost 跑在 Windows 侧，网站目录里的 jar 不一定是实际在跑的那个，
@@ -29,18 +31,18 @@ async function safe(fn, fallback = null) {
     }
 }
 
-function readTseSection() {
+function readIniSection(name) {
     const section = {}
-    let inTse = false
+    let inSection = false
     for (const raw of fs.readFileSync(CONFIG_INI, 'utf-8').split(/\r?\n/)) {
         const line = raw.trim()
         if (!line || line.startsWith(';') || line.startsWith('#')) continue
         const header = line.match(/^\[(.+)]$/)
         if (header) {
-            inTse = header[1].trim() === 'TSE'
+            inSection = header[1].trim() === name
             continue
         }
-        if (!inTse) continue
+        if (!inSection) continue
         const eq = line.indexOf('=')
         if (eq < 0) continue
         section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim().replace(/^"(.*)"$/, '$1')
@@ -101,8 +103,42 @@ function servingJarPath() {
     return match ? match[1] : LINUX_DEFAULT_JAR
 }
 
+// 门店库里最新的那块 TSE（换过 TSE 会有多行）；只读数据库，TSE 坏了也读得到
+function readCertFromDb() {
+    const db = readIniSection('DB')
+    const out = execFileSync('mysql', [
+        '-h', db.host || 'localhost', '-u', db.user || 'aaden', '-N', '-B', '--raw', db.name || 'aaden',
+        '-e', 'select serialNumber, certificate from RealTseInfo order by id desc limit 1',
+    ], {
+        encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+        // 密码走环境变量，不出现在进程列表里
+        env: Object.assign({}, process.env, {MYSQL_PWD: db.password || ''}),
+    }).trim()
+    if (!out) return null
+    const [serial, certificate] = out.split('\t')
+    return {serial, certificate: certificate && certificate !== 'NULL' ? certificate : null}
+}
+
+// TSE 自己的序列号、证书有效期和型号（dnQualifier：BSI-DSZ-CC-1121 是第一代，-V2 是第二代）
+async function collectCert(tseHost, serviceUp) {
+    const fromDb = await safe(readCertFromDb)
+    let certificate = fromDb && fromDb.certificate
+    // 库里还没存证书（新装、或从没取到过）时再问服务；服务连不上就算了
+    if (!certificate && serviceUp) {
+        const res = await httpGet(`${tseHost}/certificate`)
+        if (res.status === 200) certificate = await safe(() => JSON.parse(res.body).certificate)
+    }
+    const parsed = certificate ? await safe(() => parseTseCertificate(certificate), {}) : {}
+    return {
+        tseSerial: (fromDb && fromDb.serial) || null,
+        tseCertNotBefore: parsed.tseCertNotBefore || null,
+        tseCertNotAfter: parsed.tseCertNotAfter || null,
+        tseCertProfile: parsed.tseCertProfile || null,
+    }
+}
+
 async function probeTse() {
-    const section = await safe(readTseSection, {})
+    const section = await safe(() => readIniSection('TSE'), {})
     const tseEnabled = parseEnabled(section.TseEnabled)
     const tseHost = (section.TseHost || DEFAULT_TSE_HOST).replace(/\/+$/, '')
     // 不同版本的 jar 大小不同，没有 /adapterVersion 的老版本只能靠它区分
@@ -133,7 +169,9 @@ async function probeTse() {
         }
     }
 
-    return {tseEnabled, tseHost, tseStatus, tseAdapterVersion, tseJarSize}
+    const cert = await collectCert(tseHost, ping.status !== 0)
+
+    return {tseEnabled, tseHost, tseStatus, tseAdapterVersion, tseJarSize, ...cert}
 }
 
 // 整体出错就什么都不报，云端保留上次的值

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aaden-cli",
-  "version": "1.6.109",
+  "version": "1.6.110",
   "description": "",
   "main": "dist/index.js",
   "scripts": {