abler-api 0.1.0

package/dist/es/pp-util.js

@@ -0,0 +1,1191 @@
+import require$$0 from 'crypto';
+import require$$1 from 'abler-util';
+import require$$2 from 'abler-db';
+
+const crypto = require$$0;
+const ppUtil$1 = require$$1.ppUtil;
+const {
+  dbUtil,
+  kvStorage
+} = require$$2;
+let conf, appSetting, err, dbSql;
+const pnToken = "access_token",
+      hnToken = pnToken,
+      pnApiKey = "apiKey",
+      hnApiKey = pnApiKey.toLowerCase(),
+      // 我们接收到的 headers 中的字段名总是全小写的
+pnApiSecret = "apiSecret",
+      hnApiSecret = pnApiSecret.toLowerCase();
+const MD5 = ppUtil$1.MD5,
+      moveProperty = ppUtil$1.moveProperty,
+      commonUtils = ppUtil$1;
+
+class apiUtil$1 {
+  static debugFlag = pputil.newGuid(); //应用必须设置，否则谁也不知道是啥
+
+  static testFlag = pputil.newGuid();
+  static envId_dev = "?"; // static apiCallRecSaver;
+
+  static config(appConfig, appErrCfg, appDbSql) {
+    ppUtil$1.config(appConfig, appErrCfg);
+    conf = appConfig;
+    appSetting = conf?.appSetting;
+    err = appErrCfg, dbSql = appDbSql;
+    apiUtil$1.debugFlag = appSetting?.debugFlag || apiUtil$1.debugFlag;
+    apiUtil$1.testFlag = appSetting?.testFlag || apiUtil$1.testFlag; // apiUtil.apiCallRecSaver = apiCallRecSaver;
+  } //#region ===== 需要应用系统重写的方法
+
+  /**
+   * 根据机构标识获取机构的 ApiSecret
+   * @param companyId
+   * @returns {*}
+   */
+
+
+  static _getApiSecret(companyId) {
+    return ppUtil$1.newGuid();
+  }
+  /**
+   * 保存 API 调用记录,应用系统必须重写此方法
+   * @param rec
+   * @param responseData
+   * @returns {Promise<unknown>}
+   */
+
+
+  static async _saveApiCallRec(rec, responseData) {
+    return false;
+  }
+  /**
+   * 检查API调用签名是否已经完成了验证
+   * @param req
+   */
+
+
+  static signatureVerified(req) {
+    return req.signatureVerified;
+  } //#endregion
+  //#region ===== API服务相关工具
+
+  /**
+   * 获取客户端IP地址
+   * @param req
+   * @returns {*|string|string}
+   */
+
+
+  static getClientIp(req) {
+    let ip = req.headers["x-real-ip"] || req.headers["x-true-ip"] || req.headers['x-forwarded-for'] || req.headers['x-forward-for'] || req.connection.remoteAddress || req.socket.remoteAddress || req.headers['host'] || ""; // console.log("Request IP:", ip, "req: ", req);
+
+    if (ip.indexOf(",") >= 0) {
+      ip = ip.split(',')[0];
+    }
+
+    if (ip.indexOf(":") >= 0) {
+      ip = ip.substring(ip.lastIndexOf(':') + 1);
+    }
+
+    return ip;
+  }
+  /**
+   * 从请求中解出数据，包括路径参数、查询参数和Body
+   * @param req
+   * @returns {*}
+   */
+
+
+  static extractParams(req) {
+    if (!req._requestParams) {
+      if (req.method === "POST" || req.method === "PUT") {
+        let contentType = req.headers["content-type"] || "application/json";
+
+        if (contentType.startsWith("multipart/form-data")) {
+          req._requestParams = new Object();
+
+          for (let k in req.body) {
+            req._requestParams[k] = req.body[k];
+          }
+        } else {
+          req._requestParams = req.body;
+        }
+      } else {
+        req._requestParams = req.query;
+      }
+
+      if (req.headers["content-type"] !== "application/json") {
+        const obj = req._requestParams;
+
+        for (let key in obj) {
+          if (!obj.hasOwnProperty(key)) continue;
+          let value = obj[key];
+
+          if (typeof value === "string" && value.length > 0) {
+            if (value[0] === "{" || value[0] === "[") {
+              try {
+                obj[key] = JSON.parse(value);
+                continue;
+              } catch (e) {}
+            }
+
+            let x = JSON.hbDateConv(key, value);
+
+            if (x !== value) {
+              obj[key] = x;
+            }
+          }
+        }
+      }
+
+      if (req.params) {
+        req._requestParams = Object.assign(req.params, req._requestParams);
+      }
+
+      apiUtil$1.setParamsFunctions(req._requestParams);
+    }
+
+    return req._requestParams;
+  }
+
+  static extractTokenData(req) {
+    if (req.tokenData) {
+      return req.tokenData;
+    }
+
+    let params = apiUtil$1.extractParams(req);
+    let tokenData = {
+      apiKey: req.headers[hnApiKey] || params[pnApiKey],
+      apiSecret: req.headers[hnApiSecret] || params[pnApiSecret],
+      clientIp: apiUtil$1.getClientIp(req)
+    };
+    return tokenData;
+  }
+  /**
+   * 为从传入请求中解出的参数对象设置一些函数属性，包括 asNumber, asBool
+   * @param params
+   */
+
+
+  static setParamsFunctions(params) {
+    ppUtil$1.defUnenumProp(params, "asNumber", function (name, minValue, maxValue, defaultValue) {
+      // if (!this.hasOwnProperty(name)) // {} 定义的对象没有 hasOwnProperty 函数
+      if (this[name] === undefined) return defaultValue;
+      let result = +this[name];
+
+      if (typeof result !== "number" || result < minValue || result > maxValue) {
+        throw [err.INVALID_PARAM, `参数 ${name} 必须是 ${minValue} ~ ${maxValue} 之间的数字`];
+      }
+
+      return result;
+    });
+    ppUtil$1.defUnenumProp(params, "asBool", function (name, defaultValue) {
+      if (this[name] === undefined) return defaultValue;
+      let result = JSON.parse(this[name]);
+      return !!result;
+    });
+  }
+  /**
+   * 将返回结果转向到指定地址或者通过response发送返回结果
+   * @param res
+   * @param redirectUrl
+   * @param data
+   */
+
+
+  static sendOrRedirect(res, redirectUrl, data) {
+    if (redirectUrl) {
+      redirectUrl = urlAppendParams(redirectUrl, data, true);
+      res.redirect(redirectUrl);
+    } else {
+      res.send(data);
+    }
+  }
+  /**
+   * 生成 API 成功返回结果
+   * @param data
+   * @param req
+   * @returns {{datetime: Date, success: boolean, stateCode: number, message: string}}
+   */
+
+
+  static apiSuccess(data, req) {
+    let response = {
+      success: true,
+      stateCode: 0,
+      message: '',
+      datetime: new Date()
+    };
+
+    if (req && req.headers) {
+      let userAgent = req.headers["user-agent"];
+
+      if (userAgent && userAgent.startsWith("Postman")) {
+        response._elapse = (new Date().valueOf() - req.headers.timestamp) / 1000;
+      }
+    }
+
+    if (data && data._message_) {
+      response.message = data._message_;
+      delete data._message_;
+    }
+
+    response.data = data;
+    if (Array.isArray(data) && typeof data.recordCount != 'undefined') response.recordCount = data.recordCount;
+    return response;
+  }
+  /**
+   * 生成 API 失败返回结果
+   * @param error
+   * @param req
+   * @returns {*}
+   */
+
+
+  static apiFail(error, req) {
+    configNeeded();
+    let response = err.ERROR(error, err.errorLangParamFlag + ppUtil$1.getMsgLang(req));
+    response.datetime = new Date();
+
+    if (req && req.headers) {
+      let userAgent = req.headers["user-agent"];
+
+      if (userAgent && userAgent.startsWith("Postman")) {
+        response._elapse = (new Date().valueOf() - req.headers.timestamp) / 1000;
+      }
+    }
+
+    return response;
+  }
+  /**
+   * 生成面向服务商的API成功返回结果
+   * @param data
+   * @param req
+   * @returns {*}
+   */
+
+
+  static spoApiSucc(data, req) {
+    let params = apiUtil$1.extractParams(req);
+    return apiUtil$1.apiSuccess(data, req, params.spOrderNum);
+  }
+  /**
+   * 生成面向服务商的API失败返回结果
+   * @param error
+   * @param req
+   * @returns {*}
+   */
+
+
+  static spoApiFail(error, req) {
+    let params = apiUtil$1.extractParams(req);
+    return apiUtil$1.apiFail(error, req, params.spOrderNum);
+  }
+  /**
+   * API 服务结束，发送响应
+   * @param response
+   * @param promise
+   */
+
+
+  static async responseOf(response, promise) {
+    promise.then(function (data) {
+      // console.log('RES:', apiSuccess(data));
+      if (!response.finished) response.send(apiUtil$1.apiSuccess(data, response.req));
+    }, function (error) {
+      console.log('ERROR:', error);
+      if (!response.finished) response.send(apiUtil$1.apiFail(error, response.req));
+    });
+  }
+  /**
+   * 面向服务商的API结束，发送响应
+   * @param response
+   * @param promise
+   */
+
+
+  static async spoApiResponse(response, promise) {
+    promise.then(function (result) {
+      let responseData = apiUtil$1.spoApiSucc(result, response.req);
+
+      apiUtil$1._saveApiCallRec(response.req.apiCallRec, responseData);
+
+      if (!response.finished) response.send(responseData);
+    }, function (error) {
+      console.log('ERROR:', error);
+      let responseData = apiUtil$1.spoApiFail(error, response.req);
+
+      apiUtil$1._saveApiCallRec(response.req.apiCallRec, responseData);
+
+      if (!response.finished) response.send(responseData);
+    });
+  }
+  /**
+   * 从请求参数中获取查询参数
+    * @param req
+   * @param res
+   * @returns {*}
+   */
+
+
+  static getQueryOptions(req, res) {
+    req.headers.timestamp = new Date().valueOf(); // let options = {replacements: {}};
+
+    let options = {};
+    let parameters = apiUtil$1.extractParams(req);
+
+    for (let qryParam in parameters) {
+      if (qryParam !== 'token') {
+        if (['start', 'limit', 'orderby', 'orderBy'].indexOf(qryParam) >= 0) {
+          options[qryParam] = parameters[qryParam];
+          delete parameters[qryParam];
+        } // else
+        //     options.replacements[qryParam] = parameters[qryParam];
+
+      }
+    }
+
+    if (options.limit && !options.start) {
+      options.start = 0;
+    }
+
+    if (options.orderby) {
+      options.orderBy = options.orderby;
+    } // options.__debug__ = req.headers['__debug__'] && req.headers['__debug__'] == "true";
+
+
+    options.replacements = parameters; // if (arguments.length > 1) //其后的每个参数是要求必须存在的参数名称
+    // {
+    //     for(i=1; i<arguments.length; i++){
+    //         var paramName = arguments[i];
+    //         if (!qryOptions.replacements[paramName])
+    //             error();
+    //     }
+    // }
+
+    options.userInfo = req.userInfo;
+    return apiUtil$1.setOptionsPropFuncions(options, res);
+  }
+  /**
+   * 为API请求 options 设置属性
+   * @param options
+   * @param res
+   * @returns {{identifyLimit}|*}
+   */
+
+
+  static setOptionsPropFuncions(options, res) {
+    // if (!options.identifyLimit) {
+    //     // 根据企业标识获取身份认证限制相关设置，如果没有传递企业标识，
+    //     // 则尝试从options.companyInfo或options.contractOrder中获取
+    //     Object.defineProperty(options, "companyId", {
+    //         get: function () {
+    //             var result;
+    //             if (this.companyInfo) {
+    //                 result = this.companyInfo.companyId;
+    //             } else if (this.contractOrder) {
+    //                 result = this.contractOrder.companyId;
+    //             } else if (this._companyId) {
+    //                 result = this._companyId;
+    //             }
+    //             return result;
+    //         }
+    //     });
+    //     Object.defineProperty(options, "identifyLimit", {
+    //         get: function () {
+    //             if (!this._identifyLimit) {
+    //                 // this._identifyLimit = hb.waitPromise(_getIdentifyLimit(this.companyId));
+    //                 throw "options._identifyLimit 没有赋值";
+    //             }
+    //
+    //             return this._identifyLimit;
+    //         },
+    //         // configurable : true
+    //     });
+    // }
+    if (res) {
+      Object.defineProperty(options, '_res', {
+        value: res,
+        enumerable: false
+      });
+    }
+
+    return options;
+  }
+  /**
+   * 从请求头获取token
+   * @param req
+   * @param res
+   * @param noErr
+   * @returns {Promise<*>}
+   */
+
+
+  static async extractToken(req, res, noErr) {
+    configNeeded();
+
+    if (!req.accessToken) {
+      //检查post的信息或者url查询参数或者头信息
+      let token = req.headers[hnToken] || req.headers['x-access-token']; //向后兼容
+
+      if (!token) {
+        let params = apiUtil$1.extractParams(req);
+        token = params[pnToken];
+
+        if (token) {
+          delete params[pnToken];
+        } else if (params.token) {
+          token = params.token; //向后兼容
+
+          delete params.token;
+        } else {
+          // 如果没有token，则返回错误
+          console.log(err.TOKEN_NEEDED);
+
+          if (res) {
+            res.send(err.ERROR(err.TOKEN_NEEDED));
+          } else if (!noErr) {
+            throw err.TOKEN_NEEDED;
+          }
+        }
+      }
+
+      req.accessToken = token;
+    }
+
+    return req.accessToken;
+  }
+  /**
+   * 检查是不是内部调用，应用系统可替换此函数实施更隐秘的检查
+   * @param req
+   * @returns {Promise<boolean|undefined>}
+   */
+
+
+  static async checkInternalToken(req) {
+    // return await checkInternalToken(req);
+    const params = apiUtil$1.extractParams(req);
+    req.accessToken = req.accessToken || apiUtil$1.extractToken(req);
+
+    if (req.accessToken === MD5(commonUtils.idNumDisturbing)) {
+      //todo: 检查IP
+      params.__internal__ = true;
+      req.ignoreToken = true; // if (params.idNum || params.personId) {
+      //     return queryPersonUser(params.idNum, params.personId)
+      //         .then(async userInfo => {
+      //             if (!userInfo) {
+      //                 // console.log('queryPersonUser error.', e);
+      //                 throw err.TOKEN_INVALID;
+      //             }
+      //             if (req.tokenValidater) await req.tokenValidater(userInfo, req)
+      //             req.userInfo = userInfo;
+      //             return true
+      //         })
+      // } else {
+      //     return true
+      // }
+
+      return true;
+    } else {
+      // console.log('token error.', req.accessToken);
+      throw err.TOKEN_INVALID;
+    }
+  }
+  /**
+   * 检查请求是否存在合法的token，若不存在则抛出异常
+   * @param req
+   * @returns {Promise<void>}
+   */
+
+
+  static async checkRequestToken(req) {
+    req.accessToken = req.accessToken || apiUtil$1.extractToken(req);
+    await apiUtil$1.restoreTokenData(apiUtil$1.userTokenStoreKey(req.accessToken), apiUtil$1.tokenExpireTime(req)).then(async function (data) {
+      req.userInfo = apiUtil$1.setUserIdNo(data, data._idNo);
+      if (req.tokenValidater) await req.tokenValidater(req.userInfo, req);
+      return true;
+    }, async function (e) {
+      // 如果给定的token不存在，看看是不是平台内部调用
+      return await apiUtil$1.checkInternalToken(req);
+    });
+  }
+  /**
+   * 检查是不是调试模式
+   * @param req
+   * @returns {*|boolean|boolean}
+   */
+
+
+  static isDebugMode(req) {
+    if (req.__debug__ === undefined) {
+      let dbgToken = req.headers['__debug__'] || req.headers[apiUtil$1.debugFlag];
+
+      if (dbgToken) {
+        let envId = process.env.ECS_DEPLOY_ID;
+        req.__debug__ = dbgToken && dbgToken === MD5(req.headers.timestamp, commonUtils.commonHashDisturbing) && (envId === "florist_longdan" || envId === "shuzi");
+      } else {
+        req.__debug__ = false;
+      } // console.log("__debug__:", req.__debug__, "dbgToken:", dbgToken);
+
+    }
+
+    return req.__debug__; // return req.headers["postman-token"] || req.headers['__debug__'] && req.headers['__debug__'] == "true";
+  }
+  /**
+   * 检查是不是测试模式
+   * @param req
+   * @returns {*|boolean}
+   */
+
+
+  static isTestMode(req) {
+    if (req.__postman__ === undefined) {
+      let dbgToken = req.headers["__postman__"] || req.headers[apiUtil$1.testFlag];
+
+      if (dbgToken) {
+        let envId = process.env.ECS_DEPLOY_ID;
+        let testToken = MD5(req.headers.timestamp, apiUtil$1.extractToken(req, null, true) || req.headers.apikey);
+        req.__postman__ = dbgToken === testToken && (envId.indexOf("myfacesign.com") < 0 || envId.indexOf(".dev.") > 0);
+      } else {
+        req.__postman__ = false;
+      }
+    }
+
+    return req.__postman__;
+  }
+  /**
+   * 获取令牌过期时长
+   * @param req
+   * @returns {any}
+   */
+
+
+  static tokenExpireTime(req) {
+    return apiUtil$1.isDebugMode(req) ? 30 * 24 * 60 * 60 : apiUtil$1.isTestMode(req) ? 4 * 60 * 60 : appSetting.tokenExpireTime;
+  }
+  /**
+   * 获取用户令牌保存键
+   * @param token
+   * @returns {string}
+   */
+
+
+  static userTokenStoreKey(token) {
+    return "ut_" + token;
+  }
+  /**
+   * 获取机构令牌保存键
+   * @param token
+   * @returns {string}
+   */
+
+
+  static apiTokenStoreKey(token) {
+    return "api_" + token;
+  }
+  /**
+   * 判断是不是香港身份证
+   * @param idNum
+   * @returns {boolean}
+   */
+
+
+  static checkIsHKIC(idNum) {
+    return idNum.length === 8;
+  }
+  /**
+   * 将身份证号码暂存到用户信息中
+   * @param userInfo
+   * @param idNum
+   * @returns {*}
+   */
+
+
+  static setUserIdNo(userInfo, idNum) {
+    if (userInfo && idNum) {
+      userInfo._idNo = idNum;
+      userInfo.isHKIC = apiUtil$1.checkIsHKIC(idNum);
+    }
+
+    return userInfo;
+  }
+  /**
+   * 暂存令牌
+   * @param token
+   * @param tokenData
+   * @param dataId
+   * @param req
+   * @returns {Promise<void>}
+   */
+
+
+  static async storeToken(token, tokenData, dataId, req) {
+    // let timeout = tokenData.clientIp.substring(0, 8) == "192.168." ? 90 * 24 : 1;
+    let timeout = apiUtil$1.tokenExpireTime(req);
+
+    if (req.certPublicKey) {
+      tokenData.certPublicKey = req.certPublicKey;
+    }
+
+    kvStorage.storeObj(token, tokenData, timeout);
+
+    if (dataId) {
+      kvStorage.restoreValue("token_" + dataId).then(function (oldToken) {
+        if (oldToken !== token) {
+          kvStorage.unstoreValue(oldToken);
+        } else {
+          dataId = "";
+        }
+      }, function (e) {}).then(() => {
+        if (dataId !== "") kvStorage.storeValue("token_" + dataId, token, timeout);
+      });
+    }
+  }
+  /**
+   * 恢复令牌数据
+   * @param accessToken
+   * @param expireTime
+   * @returns {Promise<any>}
+   */
+
+
+  static async restoreTokenData(accessToken, expireTime) {
+    return await kvStorage.restoreObj(accessToken, expireTime);
+  }
+  /**
+   * 创建 API 调用记录
+   * @param tokenData
+   * @param req
+   * @returns {any}
+   */
+
+
+  static createApiCallRec(tokenData, req) {
+    if (!req.apiCallRec) {
+      if (req.apiCallRecId) {
+        return dbQueryOne(dbSql.loadApiUsage, {
+          replacements: {
+            id: req.apiCallRecId
+          }
+        }).then(rec => {
+          req.apiCallRec = rec;
+          return req.apiCallRec;
+        });
+      } else {
+        let params = extractParams(req); // let contentLength = parseInt(req.headers["content-length"]) || 0;
+
+        let rec = {
+          id: newGuid(),
+          companyId: tokenData.apiKey || '',
+          orderId: params.orderId || '',
+          signerId: params.signerId || '',
+          userId: params.userId || '',
+          contractName: params.contractName || '',
+          spOrderNum: params.spOrderNum || '',
+          notifyUri: params.notifyUri || '',
+          fileName: params.fileName || '',
+          fileHash: params.fileHash || '',
+          fileKeyHash: params.fileKeyHash || '',
+          fileSignedHash: params.fileSignedHash || '',
+          createTime: new Date(),
+          secret: tokenData.apiSecret || '',
+          fromIp: tokenData.clientIp || '',
+          method: req.method,
+          uri: req.route.path,
+          urlParams: req.url.split("?")[1] || "",
+          contentType: (req.headers["content-type"] || '').substring(0, 45),
+          // body: contentLength < 500 ? req.rawBody || '' : 'lob data, size:' + contentLength,
+          body: _getBodyLogStr(req),
+          resultCode: params.resultCode || '0',
+          resultInfo: params.resultInfo || '',
+          resultData: params.resultData || ''
+        };
+
+        if (rec.secret !== "") {
+          rec.secret = hb.getEncAse192(rec.secret);
+        }
+
+        req.apiCallRec = rec;
+      }
+    }
+
+    return req.apiCallRec;
+  }
+  /**
+   * 查询机构信息
+   * @param companyId
+   * @param nullable
+   * @returns {Promise<null|*>}
+   */
+
+
+  static async queryCompanyInfo(companyId, nullable) {
+    return await dbUtil.dbQueryOne(dbSql.queryCompanyInfo, {
+      companyId
+    }, nullable);
+  }
+  /**
+   * 获取企业有效证书
+   * @param companyId: 企业标识
+   */
+
+
+  static async getCompanyCertificate(companyId) {
+    let certInfo = {
+      // 正式启用的证书
+      certLiving: null,
+      certLivingId: '',
+      // 备用证书
+      certSpare: null,
+      certSpareId: ''
+    };
+    return await dbUtil.dbQueryOne(dbSql.queryCertDataByOwner, {
+      ownerId: companyId,
+      applyId: "company"
+    }, false).then(certRec => {
+      // console.log('当前证书:\n', certRec);
+      // checkCertStatus(certRec);
+      let certData = JSON.parse(certRec.certBody);
+      let pubKeyData = Buffer.from(certData.cert, "base64").toString(); // 公司正式证书
+
+      certInfo.certLiving = pubKeyData;
+      certInfo.certLivingId = certRec.id;
+      return dbUtil.dbQueryOne(dbSql.queryCertDataByOwner, {
+        ownerId: companyId,
+        applyId: "company_spare"
+      }, false).then(certRec1 => {
+        // console.log('备用证书:\n', certRec1);
+        // checkCertStatus(certRec1);
+        let certData1 = JSON.parse(certRec1.certBody);
+        let pubKeyData1 = Buffer.from(certData1.cert, "base64").toString(); // 公司备用证书
+
+        certInfo.certSpare = pubKeyData1;
+        certInfo.certSpareId = certRec1.id;
+      }).catch(e => {
+        // console.log('获取备用证书失败。', e);
+        certInfo.certSpare = null;
+      });
+    }).then(() => {
+      return certInfo;
+    }).catch(e => {
+      console.log('获取企业证书失败:\n', e);
+      throw [err.ACCESS_REFUSED, `获取企业证书失败：${err.ERROR(e).message}`];
+    });
+  }
+  /**
+   * 验证API调用签名
+   * @param tokenData
+   * @param req
+   * @returns {Promise<*|boolean>}
+   */
+
+
+  static async verifyApiSignature(tokenData, req) {
+    try {
+      if (!req.headers.timestamp) {
+        throw [err.ACCESS_REFUSED, `必须在请求头中设置时戳`];
+      }
+
+      let timestamp = parseInt(req.headers.timestamp);
+      let currentTime = new Date().valueOf();
+      let maxTimeDiff = apiUtil$1.isDebugMode(req) ? 7 * 24 * 3600 : apiUtil$1.isTestMode(req) ? 4 * 3600 : 100; // 100
+
+      if (timestamp.toString() == "NaN" || currentTime < timestamp - 5000 || currentTime - timestamp > maxTimeDiff * 1000) {
+        throw [err.ACCESS_REFUSED, `时戳(${timestamp})无效，当前时戳：${currentTime},时差 ${(currentTime - timestamp) / 1000}秒`];
+      }
+
+      let signature = req.headers.signature;
+
+      if (!signature) {
+        throw [err.ACCESS_REFUSED, `必须在请求头中提供签名`];
+      }
+
+      let signData = apiUtil$1.extractToken(req, null, true) || tokenData.apiKey;
+      signData += timestamp;
+
+      if (apiUtil$1.isDebugMode(req) || apiUtil$1.isTestMode(req)) {
+        let publicKey = req.headers.publickey || req.body.publicKey || req.query.publicKey;
+
+        if (publicKey) {
+          publicKey = decodeURIComponent(publicKey);
+          tokenData.certPublicKey = publicKey;
+          req.certPublicKey = publicKey;
+        }
+      }
+
+      if (tokenData.certPublicKey) {
+        let verifyResult = doVerify(signData, signature, tokenData.certPublicKey);
+        return await verifyResult;
+      }
+
+      return apiUtil$1.getCompanyCertificate(tokenData.apiKey).then(info => {
+        tokenData.certPublicKey = info.certLiving;
+        tokenData.certPublicKeySpare = info.certSpare;
+        tokenData.certLivingId = info.certLivingId;
+        tokenData.certSpareId = info.certSpareId;
+        req.certPublicKey = info.certLiving;
+        let token = apiUtil$1.extractToken(req, null, true);
+
+        if (token) {
+          apiUtil$1.storeToken(apiUtil$1.apiTokenStoreKey(token), tokenData, tokenData.apiKey, req);
+        }
+      }).then(() => {
+        return doVerify(signData, signature, tokenData.certPublicKey);
+      });
+    } catch (e) {
+      // return Promise.reject(e);
+      throw e;
+    }
+
+    function doVerify(signData, signature) {
+      let verify = crypto.createVerify('SHA256');
+      verify.write(signData);
+      verify.end();
+      let verifyOK = false;
+
+      try {
+        // 先用正式证书验证
+        verifyOK = verify.verify(tokenData.certPublicKey, signature, 'base64');
+      } catch (e) {
+        console.log("SPO服务签名验证异常(正式证书), ", e);
+        verifyOK = false;
+
+        if (!tokenData.certPublicKeySpare) {
+          throw {
+            eo: err.ACCESS_REFUSED,
+            msgArgv: "签名验证异常",
+            data: e
+          };
+        }
+      }
+
+      if (!verifyOK && tokenData.certPublicKeySpare) {
+        try {
+          // 再用备用证书验证
+          let verifySpare = crypto.createVerify('SHA256');
+          verifySpare.write(signData);
+          verifySpare.end();
+          verifyOK = verifySpare.verify(tokenData.certPublicKeySpare, signature, 'base64');
+
+          if (verifyOK) {
+            // 备用证书验证成功了，则将备用证书替换为正式证书
+            console.log(`公司(${tokenData.apiKey})备用证书验签成功，正式启用...`);
+            return dbUtil.dbTrans(trans => {
+              let p1 = dbUtil.dbExec(dbSql.deleteCertRecById, {
+                replacements: {
+                  id: tokenData.certLivingId
+                },
+                transaction: trans
+              });
+              let p2 = dbUtil.dbExec(dbSql.spareCertToLiving, {
+                replacements: {
+                  id: tokenData.certSpareId
+                },
+                transaction: trans
+              });
+              return Promise.all([p1, p2]);
+            }).then(() => {
+              tokenData.certPublicKey = tokenData.certPublicKeySpare;
+              delete tokenData.certLivingId;
+              delete tokenData.certSpareId;
+              delete tokenData.certPublicKeySpare;
+              let token = apiUtil$1.extractToken(req);
+
+              if (token) {
+                apiUtil$1.storeToken(apiTokenStoreKey(token), tokenData, tokenData.apiKey, req);
+              }
+
+              console.log(`公司(${tokenData.apiKey})备用证书成功转换为正式证书`);
+            });
+          }
+        } catch (e) {
+          console.log("SPO服务签名验证异常(备用证书), ", e);
+          throw {
+            eo: err.ACCESS_REFUSED,
+            msgArgv: "签名验证异常(spare)",
+            data: e
+          };
+        }
+      }
+
+      if (!verifyOK) {
+        console.log("SPO服务签名验证失败, tokenData: ", tokenData);
+        throw [err.ACCESS_REFUSED, "签名验证未通过"];
+      }
+
+      return verifyOK;
+    }
+  }
+  /**
+   * 检查API调用之合法性
+   * @param tokenData
+   * @param req
+   * @returns {Promise<any>}
+   */
+
+
+  static async checkApiCallValid(tokenData, req) {
+    if (!tokenData.companyInfo) {
+      tokenData.companyInfo = await apiUtil$1.queryCompanyInfo(tokenData.apiKey, true).catch(e => {
+        console.log("执行企业信息查询发生异常", e);
+        throw [err.API_KEY_INVALID, "执行企业信息查询发生异常：" + e.message || ""];
+      });
+    }
+
+    const companyInfo = tokenData.companyInfo;
+
+    if (companyInfo != null) {
+      let secret = apiUtil$1._getApiSecret(tokenData.apiKey);
+
+      if (secret !== tokenData.apiSecret) throw err.API_SCREPT_INVALID; // 不再检查 IP 白名单，改为验证证书签名
+      // console.log("fromIp:", tokenData.clientIp, "ipWhiteList:", companyInfo.ipWhiteList);
+      // let whiteList = companyInfo.ipWhiteList || "";
+      // // 没有设置ip白名单的就不检查了
+      // if (whiteList == "" || ipMatched(tokenData.clientIp, whiteList + ",127.0.0.1,1"))
+
+      if (apiUtil$1.signatureVerified()) return companyInfo;
+      return apiUtil$1.verifyApiSignature(tokenData, req).then(x => {
+        return companyInfo;
+      }, e => {
+        throw e;
+      });
+    }
+
+    throw [err.API_KEY_INVALID, tokenData.apiKey];
+  }
+  /**
+   * 检查令牌数据是否存在
+   * @param token
+   * @returns {*}
+   */
+
+
+  static tokenDataExist(token) {
+    return kvStorage.stored(token);
+  } //#endregion
+  //region ====中间件
+
+  /**
+   * 检查令牌，若存在则将其的用户信息置入req，否则返回错误信息
+   */
+
+
+  static async $checkToken(req, res, next) {
+    try {
+      await apiUtil$1.checkRequestToken(req);
+      return true;
+    } catch (e) {
+      res.send(err.ERROR(e));
+      return false;
+    }
+  }
+  /**
+   * 检查令牌，若存在则将其用户信息置入req
+   */
+
+
+  static async $getToken(req, res, next) {
+    function extractToken(req, res) {
+      if (!req.accessToken) {
+        //检查post的信息或者url查询参数或者头信息
+        let token = req.headers["access_token"] || req.headers['x-access-token']; //向后兼容
+
+        if (!token) {
+          let params = apiUtil$1.extractParams(req);
+          token = params["access_token"];
+
+          if (token) {
+            delete params["access_token"];
+          } else if (params.token) {
+            token = params.token; //向后兼容
+
+            delete params.token; // } else if (res) {
+            //     // 如果没有token，则返回错误
+            //     console.log(err.TOKEN_NEEDED);
+            //     res.send(err.ERROR(err.TOKEN_NEEDED));
+          }
+        }
+
+        req.accessToken = token;
+      }
+
+      return req.accessToken;
+    }
+
+    try {
+      if (extractToken(req, res)) {
+        await apiUtil$1.restoreTokenData(apiUtil$1.userTokenStoreKey(req.accessToken), apiUtil$1.tokenExpireTime(req)).then(function (data) {
+          req.userInfo = apiUtil$1.setUserIdNo(data, data._idNo);
+        }, function (e) {//no token
+        });
+      }
+
+      return true;
+    } catch (e) {
+      res.send(err.ERROR(e));
+      return false;
+    }
+  }
+  /**
+   * 标识此请求已经完成了签名验证或者无需进行签名验证
+   */
+
+
+  static $signatureVerified(req, res, next) {
+    req.signatureVerified = true;
+    return true;
+  }
+  /**
+   * 标识此请求是从前端发过来的，比如移动端、PC浏览器等，区别于SPO一般的服务端后台请求。
+   * 如果在请求参数中包含有签名参数，则将其移到请求头中
+   */
+
+
+  static $isMobile(req, res, next) {
+    req.isMobile = true;
+
+    if (!req.signatureVerified) {
+      let params = apiUtil$1.extractParams(req);
+      moveProperty(params, req.headers, "access_token");
+      moveProperty(params, req.headers, "timestamp");
+
+      if (moveProperty(params, req.headers, "signature")) {
+        req.headers.signature = decodeURIComponent(req.headers.signature);
+      }
+    }
+
+    next();
+  }
+  /**
+   * 检查企业 API 调用合法性 (apiKey, apiSecret)
+   * @param req
+   * @param res
+   * @param next
+   */
+
+
+  static $checkApiKeyOld(req, res, next) {
+    //检查post的信息或者url查询参数或者头信息
+    let tokenData = apiUtil$1.extractTokenData(req);
+    let params = apiUtil$1.extractParams(req);
+    apiUtil$1.createApiCallRec(tokenData, req);
+    let errResponse = null;
+
+    if (!tokenData.clientIp) {
+      errResponse = apiUtil$1.spoApiFail(err.GET_CLIENTIP_FAIL, req);
+    } else if (!tokenData.apiKey) {
+      errResponse = apiUtil$1.spoApiFail([err.PARAMETER_NEEDED, "apiKey"], req);
+    } else if (!tokenData.apiSecret) {
+      errResponse = apiUtil$1.spoApiFail([err.PARAMETER_NEEDED, "apiSecret"], req);
+    }
+
+    if (errResponse != null) {
+      apiUtil$1._saveApiCallRec(req.apiCallRec, errResponse);
+
+      apiUtil$1.sendOrRedirect(req, res, errResponse);
+    } else {
+      apiUtil$1.checkApiCallValid(tokenData, req).then(companyInfo => {
+        params.companyId = params.companyId || companyInfo.companyId;
+        req.companyInfo = companyInfo;
+        next();
+      }, e => {
+        console.log('apiCallInvalid:', e);
+        let errResponse = spoApiFail(e, req);
+
+        apiUtil$1._saveApiCallRec(req.apiCallRec, errResponse);
+
+        apiUtil$1.sendOrRedirect(req, res, errResponse);
+      });
+    }
+  }
+  /**
+   * 检查机构令牌
+   */
+
+
+  static $checkApiKey(req, res, next) {
+    if (req.ignoreToken) {
+      next();
+      return;
+    }
+
+    let accessToken = apiUtil$1.extractToken(req);
+
+    if (!accessToken) {
+      res.send(apiUtil$1.spoApiFail(err.TOKEN_NEEDED, req)); // apiUtil.sendOrRedirect(req, res, spoApiFail(err.TOKEN_NEEDED, req));
+
+      return;
+    }
+
+    apiUtil$1.restoreTokenData(apiUtil$1.apiTokenStoreKey(accessToken)).then(p => {
+      // req.headers[hnApiKey] = p.apiKey || '';
+      // req.headers[hnApiSecret] = p.apiSecret || '';
+      if (req.isMobile) {
+        // GET 请求的应该都是H5页面，由手机前端发起，需要把headers中的请求方ip换成服务端的
+        // todo: 如何在API访问记录中记住请求者（手机端）的真实IP
+        req.headers['x-phone-ip'] = hb.getClientIp(req);
+        req.headers['x-real-ip'] = p.clientIp;
+      } else {
+        p.clientIp = hb.getClientIp(req);
+      }
+
+      req.isApiCall = true;
+      req.tokenData = p;
+      apiUtil$1.$checkApiKeyOld(req, res, next);
+    }).catch(e => {
+      // res.send(hb.showError("授权令牌不存在或已过期"));
+      // res.send(spoApiFail(err.TOKEN_INVALID, req));
+      apiUtil$1.sendOrRedirect(req, res, apiUtil$1.spoApiFail(err.TOKEN_INVALID, req));
+    });
+  }
+  /**
+   * 检查请求令牌，允许个人用户令牌和机构令牌，若不存在或不合法，则返回错误信息
+   * @param req
+   * @param res
+   * @param next
+   * @returns {Promise<void|boolean|boolean|undefined>}
+   */
+
+
+  static async $checkTokenOrApiKey(req, res, next) {
+    let accessToken = apiUtil$1.extractToken(req, res);
+
+    if (accessToken) {
+      let tokenExist = await apiUtil$1.tokenDataExist(apiUtil$1.userTokenStoreKey(accessToken));
+
+      if (tokenExist) {
+        return apiUtil$1.$checkToken(req, res, next);
+      }
+
+      tokenExist = await apiUtil$1.tokenDataExist(apiUtil$1.apiTokenStoreKey(accessToken));
+
+      if (tokenExist) {
+        return apiUtil$1.$checkApiKey(req, res, next);
+      } // 如果给定的token不存在，看看是不是平台内部调用
+
+
+      return await apiUtil$1.checkInternalToken(req).catch(e => {
+        res.send(apiUtil$1.apiFail(e, req));
+        return false;
+      });
+    }
+  } //#endregion
+
+
+}
+
+function configNeeded() {
+  if (!conf || !err) {
+    ppUtil$1.configNeeded();
+    conf = ppUtil$1.appConfig;
+    appSetting = conf.appSetting;
+    err = ppUtil$1.appErrCfg;
+  }
+}
+
+var ppUtilApi = apiUtil$1;
+
+const apiUtil = ppUtilApi;
+var ppUtil = {
+  apiUtil
+};
+
+export { ppUtil as default };