abler-api 0.1.81 → 0.2.0

package/dist/cjs/pp-util.js

@@ -37,7 +37,7 @@ const {
   kvStorage: kvStorage$1,
   redisSimulator
 } = require$$4__default["default"];
-let conf$3, err$2;
+let conf$3, err$1;
 // const dbCheck = require('../dbupdate/dd-version');
 
 /**
@@ -57,7 +57,7 @@ class preconditions$2 {
   static setAppName(aName) {
     ppUtil$4.configNeeded();
     conf$3 = ppUtil$4.appConfig;
-    err$2 = ppUtil$4.appErrCfg;
+    err$1 = ppUtil$4.appErrCfg;
     preconditions$2.appName = aName || conf$3.thisApp;
     return preconditions$2;
   }
@@ -167,7 +167,7 @@ async function createEnvSettingFile(fileName, lastEnvSettingEx) {
     }
     return t_f$3("已創建新的本機環境配置文件\n%s\n请檢查並正確設置各項內容，然後將配置版本號修改為%s", fileName, conf$3._envSettings.default.cfgVersion);
   } catch (e) {
-    return t_f$3("創建本機環境配置文件失敗\n《%s》\n%s", fileName, err$2.ERROR(e).message);
+    return t_f$3("創建本機環境配置文件失敗\n《%s》\n%s", fileName, err$1.ERROR(e).message);
   }
 }
 async function checkExEnvSetting(loadjs) {
@@ -222,7 +222,7 @@ async function checkRedis() {
 }
 async function initDb(dbSql) {
   try {
-    dbUtil$1.config(conf$3, err$2, dbSql);
+    dbUtil$1.config(conf$3, err$1, dbSql);
   } catch (e) {
     if (e.reason === 'bad decrypt') {
       e = new Error(t_f$3("解密数据库密码(%s)失败", conf$3.dbconn.dbpwd));
@@ -235,7 +235,7 @@ async function initDb(dbSql) {
 }
 async function initKvStorage(dbSql) {
   try {
-    kvStorage$1.config(conf$3, err$2);
+    kvStorage$1.config(conf$3, err$1);
     if (conf$3.redis.enabled) {
       kvStorage$1.setRedis(ppRedis.newClient("kv"));
     } else {
@@ -258,7 +258,8 @@ const {
   t
 } = require$$2__default["default"];
 const {
-  ppUtil: ppUtil$3
+  ppUtil: ppUtil$3,
+  ppCrypto
 } = require$$3__default["default"];
 const {
   dbUtil,
@@ -268,7 +269,7 @@ const {
   netUtil: netUtil$1
 } = require$$6__default["default"];
 const preconditions$1 = ppPrecond;
-let conf$2, appSetting, err$1, dbSql;
+let conf$2, appSetting, errCfg, dbSql;
 const pnToken = "access_token",
   hnToken = pnToken,
   pnApiKey = "apiKey",
@@ -276,8 +277,6 @@ const pnToken = "access_token",
   // 我们接收到的 headers 中的字段名总是全小写的
   pnApiSecret = "apiSecret",
   hnApiSecret = pnApiSecret.toLowerCase();
-const MD5 = ppUtil$3.MD5,
-  moveProperty = ppUtil$3.moveProperty;
 class apiUtil$2 {
   static debugFlag = ppUtil$3.newGuid(); //应用必须设置，否则谁也不知道是啥
   static testFlag = ppUtil$3.newGuid();
@@ -288,13 +287,14 @@ class apiUtil$2 {
       message: 'no basic auth validator'
     };
   };
+  static appAsPrefix = '?';
 
   // static apiCallRecSaver;
 
   static config(appConfig, appErrCfg, appDbSql) {
     conf$2 = appConfig;
     appSetting = conf$2?.appSetting;
-    err$1 = appErrCfg;
+    errCfg = appErrCfg;
     dbSql = appDbSql;
     ppUtil$3.config(appConfig, appErrCfg);
     kvStorage.config(appConfig, appErrCfg);
@@ -302,6 +302,7 @@ class apiUtil$2 {
     apiUtil$2.testFlag = appSetting?.testFlag || apiUtil$2.testFlag;
     // apiUtil.apiCallRecSaver = apiCallRecSaver;
     preconditions$1.setAppName();
+    apiUtil$2.appAsPrefix = conf$2.thisApp.toLowerCase();
   }
 
   //#region ===== 需要应用系统重写的方法
@@ -406,7 +407,7 @@ class apiUtil$2 {
       if (this[name] === undefined) return defaultValue;
       let result = +this[name];
       if (typeof result !== "number" || result < minValue || result > maxValue) {
-        throw [err$1.INVALID_PARAM, t_f$2("参数 %s 必须是 %s ~ %s 之间的数字", name, minValue, maxValue)];
+        throw [errCfg.INVALID_PARAM, t_f$2("参数 %s 必须是 %s ~ %s 之间的数字", name, minValue, maxValue)];
       }
       return result;
     });
@@ -471,7 +472,7 @@ class apiUtil$2 {
    */
   static apiFail(error, req, spOrderNum) {
     configNeeded();
-    let response = err$1.ERROR(error, err$1.errorLangParamFlag + ppUtil$3.getMsgLang(req));
+    let response = errCfg.ERROR(error, errCfg.errorLangParamFlag + ppUtil$3.getMsgLang(req));
     response.datetime = new Date();
     if (spOrderNum) {
       response.spOrderNum = spOrderNum;
@@ -679,11 +680,11 @@ class apiUtil$2 {
           delete params.token;
         } else {
           // 如果没有token，则返回错误
-          console.log(err$1.TOKEN_NEEDED);
+          console.log(errCfg.TOKEN_NEEDED);
           if (res) {
-            res.send(err$1.ERROR(err$1.TOKEN_NEEDED));
+            res.send(errCfg.ERROR(errCfg.TOKEN_NEEDED));
           } else if (!noErr) {
-            throw err$1.TOKEN_NEEDED;
+            throw errCfg.TOKEN_NEEDED;
           }
         }
       }
@@ -701,7 +702,7 @@ class apiUtil$2 {
     // return await checkInternalToken(req);
     const params = apiUtil$2.extractParams(req);
     req.accessToken = req.accessToken || apiUtil$2.extractToken(req);
-    if (req.accessToken === MD5(ppUtil$3.commonHashDisturbing)) {
+    if (req.accessToken === ppCrypto.MD5(ppUtil$3.commonHashDisturbing)) {
       //todo: 检查IP
       params.__internal__ = true;
       req.ignoreToken = true;
@@ -722,7 +723,7 @@ class apiUtil$2 {
       return true;
     } else {
       // console.log('token error.', req.accessToken);
-      throw err$1.TOKEN_INVALID;
+      throw errCfg.TOKEN_INVALID;
     }
   }
 
@@ -755,7 +756,7 @@ class apiUtil$2 {
       let dbgToken = req.headers['__debug__'] || req.headers[apiUtil$2.debugFlag];
       if (dbgToken) {
         let envId = process.env.ECS_DEPLOY_ID;
-        req.__debug__ = dbgToken && dbgToken === MD5(req.headers.timestamp, ppUtil$3.commonHashDisturbing) && (envId === "florist_longdan" || envId === "shuzi");
+        req.__debug__ = dbgToken && dbgToken === ppCrypto.MD5(req.headers.timestamp, ppUtil$3.commonHashDisturbing) && (envId === "florist_longdan" || envId === "shuzi");
       } else {
         req.__debug__ = false;
       }
@@ -775,7 +776,7 @@ class apiUtil$2 {
       let dbgToken = req.headers["__postman__"] || req.headers[apiUtil$2.testFlag];
       if (dbgToken) {
         let envId = process.env.ECS_DEPLOY_ID;
-        let testToken = MD5(req.headers.timestamp, apiUtil$2.extractToken(req, null, true) || req.headers.apikey);
+        let testToken = ppCrypto.MD5(req.headers.timestamp, apiUtil$2.extractToken(req, null, true) || req.headers.apikey);
         req.__postman__ = dbgToken === testToken && (envId.indexOf("myfacesign.com") < 0 || envId.indexOf(".dev.") > 0);
       } else {
         req.__postman__ = false;
@@ -995,7 +996,7 @@ class apiUtil$2 {
       return certInfo;
     }).catch(e => {
       console.log('获取企业证书失败:\n', e);
-      throw [err$1.ACCESS_REFUSED, t_f$2("获取企业证书失败：%s", err$1.ERROR(e).message)];
+      throw [errCfg.ACCESS_REFUSED, t_f$2("获取企业证书失败：%s", errCfg.ERROR(e).message)];
     });
   }
 
@@ -1005,20 +1006,20 @@ class apiUtil$2 {
    * @param req
    * @returns {Promise<*|boolean>}
    */
-  static async verifyApiSignature(tokenData, req) {
+  static async verifyApiTokenSignature(tokenData, req) {
     try {
       if (!req.headers.timestamp) {
-        throw [err$1.ACCESS_REFUSED, t_f$2("必须在请求头中设置时戳")];
+        throw [errCfg.ACCESS_REFUSED, t_f$2("必须在请求头中设置时戳")];
       }
       let timestamp = parseInt(req.headers.timestamp);
       let currentTime = new Date().valueOf();
       let maxTimeDiff = apiUtil$2.isDebugMode(req) ? 7 * 24 * 3600 : apiUtil$2.isTestMode(req) ? 4 * 3600 : 100; // 100
       if (timestamp.toString() == "NaN" || currentTime < timestamp - 5000 || currentTime - timestamp > maxTimeDiff * 1000) {
-        throw [err$1.ACCESS_REFUSED, t_f$2("时戳(%s)无效，当前时戳：%s,时差 %s秒", timestamp, currentTime, (currentTime - timestamp) / 1000)];
+        throw [errCfg.ACCESS_REFUSED, t_f$2("时戳(%s)无效，当前时戳：%s,时差 %s秒", timestamp, currentTime, (currentTime - timestamp) / 1000)];
       }
       let signature = req.headers.signature;
       if (!signature) {
-        throw [err$1.ACCESS_REFUSED, t_f$2("必须在请求头中提供签名")];
+        throw [errCfg.ACCESS_REFUSED, t_f$2("必须在请求头中提供签名")];
       }
       let signData = apiUtil$2.extractToken(req, null, true) || tokenData.apiKey;
       signData += timestamp;
@@ -1064,7 +1065,7 @@ class apiUtil$2 {
         verifyOK = false;
         if (!tokenData.certPublicKeySpare) {
           throw {
-            eo: err$1.ACCESS_REFUSED,
+            eo: errCfg.ACCESS_REFUSED,
             msgArgv: t("签名验证异常"),
             data: e
           };
@@ -1109,7 +1110,7 @@ class apiUtil$2 {
         } catch (e) {
           console.log("SPO服务签名验证异常(备用证书), ", e);
           throw {
-            eo: err$1.ACCESS_REFUSED,
+            eo: errCfg.ACCESS_REFUSED,
             msgArgv: t("签名验证异常(spare)"),
             data: e
           };
@@ -1117,7 +1118,7 @@ class apiUtil$2 {
       }
       if (!verifyOK) {
         console.log("SPO服务签名验证失败, tokenData: ", tokenData);
-        throw [err$1.ACCESS_REFUSED, t("签名验证未通过")];
+        throw [errCfg.ACCESS_REFUSED, t("签名验证未通过")];
       }
       return verifyOK;
     }
@@ -1133,26 +1134,26 @@ class apiUtil$2 {
     if (!tokenData.companyInfo) {
       tokenData.companyInfo = await apiUtil$2.queryCompanyInfo(tokenData.apiKey, true).catch(e => {
         console.log("执行企业信息查询发生异常", e);
-        throw [err$1.API_KEY_INVALID, t("执行企业信息查询发生异常：") + e.message || ""];
+        throw [errCfg.API_KEY_INVALID, t("执行企业信息查询发生异常：") + e.message || ""];
       });
     }
     const companyInfo = tokenData.companyInfo;
     if (companyInfo != null) {
       let secret = apiUtil$2._getApiSecret(tokenData.apiKey);
-      if (secret !== tokenData.apiSecret) throw err$1.API_SCREPT_INVALID;
+      if (secret !== tokenData.apiSecret) throw errCfg.API_SCREPT_INVALID;
       // 不再检查 IP 白名单，改为验证证书签名
       // console.log("fromIp:", tokenData.clientIp, "ipWhiteList:", companyInfo.ipWhiteList);
       // let whiteList = companyInfo.ipWhiteList || "";
       // // 没有设置ip白名单的就不检查了
       // if (whiteList == "" || ipMatched(tokenData.clientIp, whiteList + ",127.0.0.1,1"))
       if (apiUtil$2.signatureVerified(req)) return companyInfo;
-      return apiUtil$2.verifyApiSignature(tokenData, req).then(x => {
+      return apiUtil$2.verifyApiTokenSignature(tokenData, req).then(x => {
         return companyInfo;
       }, e => {
         throw e;
       });
     }
-    throw [err$1.API_KEY_INVALID, tokenData.apiKey];
+    throw [errCfg.API_KEY_INVALID, tokenData.apiKey];
   }
 
   /**
@@ -1195,7 +1196,7 @@ class apiUtil$2 {
       } else {
         paramExists = typeof params[paramName] != 'undefined' || typeof params[paramName + paramSufix] != 'undefined';
       }
-      if (!paramExists) return ppUtil$3.errorPormise(err$1.ERROR(err$1.PARAMETER_NEEDED, paramName));
+      if (!paramExists) return ppUtil$3.errorPormise(errCfg.ERROR(errCfg.PARAMETER_NEEDED, paramName));
     }
     return Promise.resolve(paramSufix);
   }
@@ -1261,7 +1262,7 @@ class apiUtil$2 {
     const myEnvHosts = apiUtil$2.getEnvHosts(params);
     const myIp = ppUtil$3.getMyIp();
     const host = params.host || myIp;
-    if (!myEnvHosts.hosts.contains(host)) throw [err$1.ACCESS_REFUSED, t_f$2("环境%s貌似无此主机：%s", conf$2.envId, params.host)];
+    if (!myEnvHosts.hosts.contains(host)) throw [errCfg.ACCESS_REFUSED, t_f$2("环境%s貌似无此主机：%s", conf$2.envId, params.host)];
     if (!apiUtil$2.hostIsMySelf(host, options._res.req)) {
       let result = await apiUtil$2.forwardsTo(host, myEnvHosts.port, params, options._res.req, myIp);
       options._res.send(result);
@@ -1292,7 +1293,7 @@ class apiUtil$2 {
     let result = await netUtil$1.apiRequest(reqOptions);
     if (result.status !== 200) {
       console.log(t_f$2("访问 %s 出错", reqOptions.url), result.status, result.res.statusMessage);
-      throw [err$1.EXCEPTION, `[${result.status}] - ${result.res.statusMessage}`];
+      throw [errCfg.EXCEPTION, `[${result.status}] - ${result.res.statusMessage}`];
     }
     return result.data;
   }
@@ -1314,7 +1315,7 @@ class apiUtil$2 {
       key = keys[i];
       value = parent[key];
       if (value === undefined) {
-        throw [err$1.INVALID_PARAM, t_f$2("无此配置项: %s", key)];
+        throw [errCfg.INVALID_PARAM, t_f$2("无此配置项: %s", key)];
       }
     }
     return {
@@ -1350,6 +1351,246 @@ class apiUtil$2 {
   static corsCheckOrigin(origin, callback) {
     callback(null, apiUtil$2.isOriginAllowed(origin));
   }
+  static validCek(cek, checkExpired = true) {
+    if (!cek) {
+      throw [errCfg.ACCESS_REFUSED, t("CEK(内容加密密钥)尚未申请或已过期")];
+    }
+    if (checkExpired && new Date().valueOf() >= cek.expireAt) {
+      throw errCfg.CEK_EXPIRED;
+    }
+  }
+  static encryptContent(content, cek) {
+    return ppCrypto.encryptData(content, cek.key, 'base64');
+  }
+  static decryptContent(content, cek) {
+    this.validCek(cek);
+    try {
+      const result = ppCrypto.decryptData(content, cek.key, 'utf8');
+      if (result.startsWith('{') || result.startsWith('[')) {
+        return JSON.parse(result);
+      }
+      return result;
+    } catch (e) {
+      throw [errCfg.DECRYPT_FAIL, e.message];
+    }
+  }
+  static decryptRequestContent(req, res) {
+    if (!appSetting.e2eEncryptionNeeded) return;
+    let params = apiUtil$2.extractParams(req);
+    if (params.encryptedContent) {
+      if (['DELETE', 'GET'].contains(req.method)) {
+        params.encryptedContent = decodeURIComponent(params.encryptedContent);
+      }
+      if (!req.appInfo) {
+        throw t('应用系统信息未知');
+      }
+      const decryptedContent = apiUtil$2.decryptContent(params.encryptedContent, req.appInfo.cek);
+      delete params.encryptedContent;
+      Object.assign(req.params, decryptedContent);
+    }
+    if (res) {
+      apiUtil$2.validCek(req.appInfo.cek);
+      res.cek = req.appInfo.cek; // 设置用于对称加密的CEK
+    }
+  }
+  static async restoreObj(key) {
+    return kvStorage.restoreObj(key).catch(() => null);
+  }
+  static cekStoreKey(apiKey, req) {
+    return `cek_${this.appAsPrefix}_${apiKey}_${apiUtil$2.getClientIp(req)}`;
+  }
+  static async generateCek(appInfo, req, key) {
+    //todo: 检查既有 cek
+    let t = new Date().valueOf();
+    const cek = {
+      key: key || ppUtil$3.newGuid() + ppUtil$3.newGuid(),
+      //要求32字节
+      issueAt: t,
+      expireAt: t + appSetting.cekExpireTime * 1000
+    };
+    if (appInfo) {
+      // appInfo.cek = cek;
+      await kvStorage.storeObj(cekStoreKey(appInfo.apiKey, req), cek, appSetting.cekExpireTime);
+    }
+    return cek;
+  }
+  static async getContentEncKey(options) {
+    const req = options._res.req;
+    try {
+      const appInfo = req.appInfo;
+      //todo: 检查既有CEK，限制频繁申请
+      const apiKey = appInfo.apiKey;
+      let cek = null;
+      if (appSetting.e2eEncryptionNeeded) {
+        const cekKey = apiUtil$2.cekStoreKey(apiKey, req);
+        // cek = await apiUtil.restoreObj(cekKey);
+        cek = await apiUtil$2.restoreObj(cekKey);
+        if (cek && new Date().valueOf() + 60 * 1000 >= cek.expireAt) cek = null;
+        if (!cek) {
+          cek = await apiUtil$2.generateCek(appInfo, req);
+        }
+      }
+      let result = apiUtil$2.apiSuccess(cek, req);
+      delete result.message; //减少数据尺寸，否则数据太长无法用公钥加密
+      delete result._elapse;
+      // options._res.publicKey = appInfo.publicKey; // 设置用于加密结果的公钥
+      return result;
+    } catch (e) {
+      return apiUtil$2.apiFail(e, req);
+    }
+  }
+  static async restoreAppInfo(apiKey, req) {
+    let appInfo = await apiUtil$2.restoreObj(`${this.appAsPrefix}App_${apiKey}`, appSetting.tokenExpireTime);
+    if (!appInfo) {
+      appInfo = await dbUtil.dbQueryOneAndUnstringify(dbSql.APP_QUERY, {
+        apiKey
+      }, "exData");
+      if (appInfo) {
+        // await generateCek(appInfo);
+        await kvStorage.storeObj(`cbpApp_${appInfo.apiKey}`, appInfo, appSetting.tokenExpireTime);
+      }
+    }
+    // if (appInfo && !appInfo.cek && appSetting.e2eEncryptionNeeded) {
+    if (appInfo && appSetting.e2eEncryptionNeeded) {
+      appInfo.cek = await apiUtil$2.restoreObj(apiUtil$2.cekStoreKey(apiKey, req));
+    }
+    return appInfo;
+  }
+  static async generateApiSignature(options) {
+    const params = options.replacements || options;
+    await this.parametersOK(params, 'apiKey', 'privateKey');
+    // console.log("generateApiSignature for apiKey", params.apiKey);
+    // console.log("privateKey", params.privateKey);
+    const result = {
+      headers: {
+        "api-key": params.apiKey
+      },
+      body: {
+        encryptedContent: ''
+      }
+    };
+    const appInfo = await this.restoreAppInfo(params.apiKey, options._res.req);
+    if (!appInfo) {
+      throw [errCfg.ACCESS_REFUSED, t_f$2("apiKey (%s) 无效", params.apiKey)];
+    }
+    let content = '';
+    if (appSetting.e2eEncryptionNeeded) {
+      if (params.decryptedContent) {
+        // if (!appInfo.cek) {
+        //     await generateCek(appInfo);
+        // }
+        await this.parametersOK(params, 'cek');
+        const cek = await this.generateCek(undefined, undefined, params.cek.key || params.cek); //避免过期
+        // commonUtil.validCek(params.cek);
+        content = this.encryptContent(params.decryptedContent, cek);
+        result.body.encryptedContent = content;
+      }
+    } else {
+      // result.body = null
+      content = JSON.stringify(params.decryptedContent);
+    }
+    if (appSetting.reqSignatureNeeded) {
+      result.headers.timestamp = new Date().valueOf();
+      result.headers.signature = this.getRequestSignature(appInfo.apiKey, result.headers.timestamp, content, params.privateKey);
+    }
+    return result;
+  }
+  static getRequestSignature(apiKey, timestamp, content, privateKey) {
+    let dataToSign = apiKey + timestamp + (content || '');
+    const sign = crypto.createSign('RSA-SHA256');
+    sign.update(dataToSign);
+    return sign.sign(privateKey, 'base64');
+  }
+  static async decryptApiResponse(options) {
+    const params = options.replacements || options;
+    await this.parametersOK(params, 'encryptedContent', 'cek/privateKey');
+    let result;
+    if (params.cek) {
+      const cek = await this.generateCek(undefined, undefined, params.cek.key || params.cek); //避免过期
+      result = this.decryptContent(params.encryptedContent, cek);
+      console.log('CEK 解密结果：', result);
+    } else {
+      let content = await ppCrypto.rsaDecrypt(params);
+      result = JSON.parse(content.decryptedContent);
+      // result = await commonUtil.rsaDecrypt(params);
+    }
+    return result;
+  }
+  static async reqAppInfoNeeded(req) {
+    if (!req.appInfo) {
+      let apiKey = req.headers["api-key"] || req.leInfo?.apiKey || req.userInfo?.apiKey;
+      if (!apiKey) {
+        throw [errCfg.ACCESS_REFUSED, t("必须在请求头中设置api-key")];
+      }
+      req.appInfo = await this.restoreAppInfo(apiKey, req);
+      if (!req.appInfo) {
+        throw [errCfg.ACCESS_REFUSED, t_f$2("api-key (%s) 无效", apiKey)];
+      }
+    }
+  }
+  static async verifyApiSignature(req) {
+    if (req.appInfo) {
+      return true;
+    }
+    await this.reqAppInfoNeeded(req);
+    if (!appSetting.reqSignatureNeeded) return true;
+    if (!req.headers.timestamp) {
+      throw [errCfg.ACCESS_REFUSED, t_f$2("必须在请求头中设置时戳")];
+    }
+    let timestamp = parseInt(req.headers.timestamp);
+    let currentTime = new Date().valueOf();
+    let maxTimeDiff = apiUtil$2.isDebugMode(req) ? 7 * 24 * 3600 : apiUtil$2.isTestMode(req) ? 4 * 3600 : 300; // 100
+    if (timestamp.toString() === "NaN" || currentTime < timestamp - 5000 || currentTime - timestamp > maxTimeDiff * 1000) {
+      throw [errCfg.ACCESS_REFUSED, t_f$2("时戳(%s)无效，当前时戳：%s,时差 %s秒", timestamp, currentTime, (currentTime - timestamp) / 1000)];
+    }
+    let signature = req.headers.signature;
+    if (!signature) {
+      throw [errCfg.ACCESS_REFUSED, t_f$2("必须在请求头中提供签名")];
+    }
+    const params = apiUtil$2.extractParams(req);
+    const content = appSetting.e2eEncryptionNeeded ? params?.encryptedContent || '' : JSON.stringify(params || null);
+    const apiKey = req.appInfo.apiKey;
+    let signData = apiKey + timestamp + content;
+    let verify = crypto.createVerify('RSA-SHA256');
+    verify.update(signData);
+    let verifyOK = false;
+    try {
+      verifyOK = verify.verify(req.appInfo.publicKey, signature, 'base64');
+    } catch (e) {
+      console.log("服务签名验证异常, ", e);
+      verifyOK = false;
+    }
+    if (!verifyOK) {
+      // console.log("服务签名验证失败, tokenData: ", tokenData);
+      throw [errCfg.ACCESS_REFUSED, t("签名验证未通过")];
+    }
+    return verifyOK;
+  }
+  static checkWhiteList(req) {
+    const ipWhiteList = req.appInfo.exData?.ipWhiteList;
+    if (!ipWhiteList || ipWhiteList.length === 0) {
+      // 没有设置ip白名单的就不检查了
+      return true;
+    }
+    let clientIp = apiUtil$2.getClientIp(req);
+    console.log("fromIp:", clientIp, "ipWhiteList:", ipWhiteList);
+    if (!clientIp) {
+      throw errCfg.GET_CLIENTIP_FAIL;
+    }
+    return this.ipMatched(clientIp, ipWhiteList, true);
+  }
+  static ipMatched(fromIp, whiteList, localAllowed) {
+    let ips = Array.isArray(whiteList) ? whiteList : (whiteList || '').split(',');
+    for (let i = 0; i < ips.length; i++) {
+      let ip = ips[i];
+      if (ip === fromIp) return true;
+      if (ip.indexOf("*") > 0) {
+        let l = ip.indexOf("*");
+        if (fromIp.substring(0, l) === ip.substring(0, l)) return true;
+      }
+    }
+    return localAllowed && (fromIp === "127.0.0.1" || fromIp === "1");
+  }
 
   //#endregion
 
@@ -1363,7 +1604,7 @@ class apiUtil$2 {
       await apiUtil$2.checkRequestToken(req);
       next();
     } catch (e) {
-      res.send(err$1.ERROR(e));
+      res.send(errCfg.ERROR(e));
     }
     return false;
   }
@@ -1405,7 +1646,7 @@ class apiUtil$2 {
       }
       return true;
     } catch (e) {
-      res.send(err$1.ERROR(e));
+      res.send(errCfg.ERROR(e));
       return false;
     }
   }
@@ -1426,9 +1667,9 @@ class apiUtil$2 {
     req.isMobile = true;
     if (!apiUtil$2.signatureVerified(req)) {
       let params = apiUtil$2.extractParams(req);
-      moveProperty(params, req.headers, "access_token");
-      moveProperty(params, req.headers, "timestamp");
-      if (moveProperty(params, req.headers, "signature")) {
+      ppUtil$3.moveProperty(params, req.headers, "access_token");
+      ppUtil$3.moveProperty(params, req.headers, "timestamp");
+      if (ppUtil$3.moveProperty(params, req.headers, "signature")) {
         req.headers.signature = decodeURIComponent(req.headers.signature);
       }
     }
@@ -1448,11 +1689,11 @@ class apiUtil$2 {
     apiUtil$2.createApiCallRec(tokenData, req);
     let errResponse = null;
     if (!tokenData.clientIp) {
-      errResponse = apiUtil$2.spoApiFail(err$1.GET_CLIENTIP_FAIL, req);
+      errResponse = apiUtil$2.spoApiFail(errCfg.GET_CLIENTIP_FAIL, req);
     } else if (!tokenData.apiKey) {
-      errResponse = apiUtil$2.spoApiFail([err$1.PARAMETER_NEEDED, "apiKey"], req);
+      errResponse = apiUtil$2.spoApiFail([errCfg.PARAMETER_NEEDED, "apiKey"], req);
     } else if (!tokenData.apiSecret) {
-      errResponse = apiUtil$2.spoApiFail([err$1.PARAMETER_NEEDED, "apiSecret"], req);
+      errResponse = apiUtil$2.spoApiFail([errCfg.PARAMETER_NEEDED, "apiSecret"], req);
     }
     if (errResponse != null) {
       apiUtil$2._saveApiCallRec(req.apiCallRec, errResponse);
@@ -1481,7 +1722,7 @@ class apiUtil$2 {
     }
     let accessToken = apiUtil$2.extractToken(req);
     if (!accessToken) {
-      res.send(apiUtil$2.spoApiFail(err$1.TOKEN_NEEDED, req));
+      res.send(apiUtil$2.spoApiFail(errCfg.TOKEN_NEEDED, req));
       // apiUtil.sendOrRedirect(req, res, spoApiFail(err.TOKEN_NEEDED, req));
       return;
     }
@@ -1501,7 +1742,7 @@ class apiUtil$2 {
       return apiUtil$2.$checkApiKeyOld(req, res, next);
     }).catch(e => {
       const params = apiUtil$2.extractParams(req);
-      apiUtil$2.sendOrRedirect(res, params.redirectUrl || params.callbackUrl, apiUtil$2.spoApiFail(err$1.TOKEN_INVALID, req));
+      apiUtil$2.sendOrRedirect(res, params.redirectUrl || params.callbackUrl, apiUtil$2.spoApiFail(errCfg.TOKEN_INVALID, req));
     });
   }
 
@@ -1611,7 +1852,7 @@ class apiUtil$2 {
     await apiUtil$2.parametersOK(params, "value");
     let c = apiUtil$2.parseCfgPath(cfgItem);
     if (typeof c.value === "object") {
-      throw [err$1.ACCESS_REFUSED, t_f$2("暂不支持修改复杂配置")];
+      throw [errCfg.ACCESS_REFUSED, t_f$2("暂不支持修改复杂配置")];
     }
     // c.oldValue = c.value;
     c.newValue = params.value;
@@ -1664,11 +1905,11 @@ class apiUtil$2 {
   //#endregion
 }
 function configNeeded() {
-  if (!conf$2 || !err$1) {
+  if (!conf$2 || !errCfg) {
     ppUtil$3.configNeeded();
     conf$2 = ppUtil$3.appConfig;
     appSetting = conf$2.appSetting;
-    err$1 = ppUtil$3.appErrCfg;
+    errCfg = ppUtil$3.appErrCfg;
   }
 }
 var ppUtilApi = apiUtil$2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abler-api",
-  "version": "0.1.81",
+  "version": "0.2.0",
   "description": "API服务相关工具",
   "main": "./dist/cjs/pp-util.js",
   "-module": "./dist/es/pp-util.js",
@@ -16,7 +16,7 @@
   "license": "ISC",
   "dependencies": {
     "q": "^1.5.1",
-    "abler-util": ">=0.1.1",
+    "abler-util": ">=0.3.0",
     "abler-db": ">=0.1.1",
     "abler-i18n": "^0.1.20",
     "abler-messenger": ">=0.1.1",