atm-droid 1.0.0 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atm-droid",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "ATM Token Manager CLI - 跨平台 Factory Token 管理工具",
   "main": "src/index.js",
   "bin": {
@@ -9,7 +9,12 @@
   "scripts": {
     "start": "node bin/atm.js"
   },
-  "keywords": ["factory", "token", "manager", "cli"],
+  "keywords": [
+    "factory",
+    "token",
+    "manager",
+    "cli"
+  ],
   "author": "ATM Team",
   "license": "MIT",
   "dependencies": {

package/src/api.js

@@ -1,15 +1,64 @@
 const fetch = require('node-fetch');
+const crypto = require('crypto');
 const { config, getDeviceId } = require('./config');
 
 const getServerUrl = () => config.get('serverUrl');
 
+// 生成加密密钥（与服务器一致）
+function getEncryptionKey() {
+  const key = Buffer.alloc(32);
+  const base = Buffer.from([
+    0x4a, 0x7b, 0x2c, 0x9d, 0x1e, 0x5f, 0x8a, 0x3b,
+    0x6c, 0x0d, 0x4e, 0x9f, 0x2a, 0x7b, 0x1c, 0x5d,
+    0x8e, 0x3f, 0x6a, 0x0b, 0x4c, 0x9d, 0x2e, 0x7f,
+    0x1a, 0x5b, 0x8c, 0x3d, 0x6e, 0x0f, 0x4a, 0x9b,
+  ]);
+  for (let i = 0; i < 32; i++) {
+    key[i] = base[i] ^ ((i * 0x17) & 0xff);
+  }
+  return key;
+}
+
+// 生成签名
+function generateSignature(data, timestamp, deviceId) {
+  const message = `${data}|${timestamp}|${deviceId}`;
+  const key = getEncryptionKey();
+  const hmac = crypto.createHmac('sha256', key);
+  hmac.update(message);
+  return hmac.digest('hex');
+}
+
+// 解密服务器返回的数据
+function decryptPayload(encryptedData, ivHex, tagHex) {
+  try {
+    const key = getEncryptionKey();
+    const iv = Buffer.from(ivHex, 'hex');
+    const tag = Buffer.from(tagHex, 'hex');
+    const encrypted = Buffer.from(encryptedData, 'hex');
+    
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    
+    let decrypted = decipher.update(encrypted, null, 'utf8');
+    decrypted += decipher.final('utf8');
+    
+    return JSON.parse(decrypted);
+  } catch (e) {
+    console.error('解密失败:', e.message);
+    return null;
+  }
+}
+
 // 激活码登录
 async function activate(code) {
   const deviceId = getDeviceId();
-  const response = await fetch(`${getServerUrl()}/api/activate`, {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = generateSignature(code, timestamp, deviceId);
+  
+  const response = await fetch(`${getServerUrl()}/api/v1/auth/activate`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ code, device_id: deviceId })
+    body: JSON.stringify({ code, device_id: deviceId, timestamp, signature })
   });
   return response.json();
 }
@@ -23,19 +72,27 @@ async function getTokens() {
     throw new Error('未登录');
   }
   
-  const response = await fetch(`${getServerUrl()}/api/tokens`, {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = generateSignature(sessionToken, timestamp, deviceId);
+  
+  const response = await fetch(`${getServerUrl()}/api/v1/tokens`, {
     headers: {
       'Authorization': `Bearer ${sessionToken}`,
-      'X-Device-ID': deviceId
+      'X-Device-ID': deviceId,
+      'X-Timestamp': timestamp.toString(),
+      'X-Signature': signature
     }
   });
   
   const result = await response.json();
   
   // 如果返回加密数据，需要解密
-  if (result.success && result.data && result.iv) {
-    // 简化版：假设服务器返回明文（或添加解密逻辑）
-    return result;
+  if (result.success && result.data && result.iv && result.tag) {
+    const decrypted = decryptPayload(result.data, result.iv, result.tag);
+    if (decrypted) {
+      return { success: true, data: decrypted };
+    }
+    return { success: false, error: '解密失败' };
   }
   
   return result;
@@ -45,13 +102,17 @@ async function getTokens() {
 async function activateToken(tokenId) {
   const sessionToken = config.get('sessionToken');
   const deviceId = getDeviceId();
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = generateSignature(sessionToken, timestamp, deviceId);
   
-  const response = await fetch(`${getServerUrl()}/api/tokens/activate`, {
+  const response = await fetch(`${getServerUrl()}/api/v1/tokens/activate`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       'Authorization': `Bearer ${sessionToken}`,
-      'X-Device-ID': deviceId
+      'X-Device-ID': deviceId,
+      'X-Timestamp': timestamp.toString(),
+      'X-Signature': signature
     },
     body: JSON.stringify({ token_id: tokenId })
   });
@@ -66,12 +127,17 @@ async function heartbeat() {
   
   if (!sessionToken) return { valid: false };
   
-  const response = await fetch(`${getServerUrl()}/api/heartbeat`, {
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = generateSignature(sessionToken, timestamp, deviceId);
+  
+  const response = await fetch(`${getServerUrl()}/api/v1/auth/heartbeat`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       'Authorization': `Bearer ${sessionToken}`,
-      'X-Device-ID': deviceId
+      'X-Device-ID': deviceId,
+      'X-Timestamp': timestamp.toString(),
+      'X-Signature': signature
     }
   });
   
@@ -82,13 +148,17 @@ async function heartbeat() {
 async function unbind() {
   const sessionToken = config.get('sessionToken');
   const deviceId = getDeviceId();
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signature = generateSignature(sessionToken, timestamp, deviceId);
   
-  const response = await fetch(`${getServerUrl()}/api/unbind`, {
+  const response = await fetch(`${getServerUrl()}/api/v1/auth/unbind`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       'Authorization': `Bearer ${sessionToken}`,
-      'X-Device-ID': deviceId
+      'X-Device-ID': deviceId,
+      'X-Timestamp': timestamp.toString(),
+      'X-Signature': signature
     }
   });