befly 3.70.0 → 3.71.0

package/apis/admin/insert.js

@@ -1,5 +1,5 @@
 import adminTable from "#befly/tables/admin.json";
-import { isString } from "#befly/utils/is.js";
+import { hashPassword } from "#befly/utils/crypto.js";
 
 export default {
     name: "添加管理员",
@@ -43,9 +43,7 @@ export default {
             return befly.tool.No("角色不存在");
         }
 
-        const passwordSource = isString(ctx.body.password) ? ctx.body.password.toLowerCase() : "";
-        const isSha256Hex = /^[a-f0-9]{64}$/.test(passwordSource);
-        const hashedPassword = isSha256Hex ? befly.tool.sha256(passwordSource) : befly.tool.sha256(befly.tool.sha256(ctx.body.password));
+        const hashedPassword = await hashPassword(ctx.body.password);
 
         const adminId = await befly.mysql.insData({
             table: "beflyAdmin",

package/apis/admin/update.js

@@ -1,4 +1,5 @@
 import adminTable from "#befly/tables/admin.json";
+import { hashPassword } from "#befly/utils/crypto.js";
 
 export default {
     name: "更新管理员",
@@ -74,7 +75,9 @@ export default {
         if (ctx.body.email !== undefined) updateData.email = ctx.body.email;
         if (ctx.body.lastLoginIp !== undefined) updateData.lastLoginIp = ctx.body.lastLoginIp;
         if (ctx.body.lastLoginTime !== undefined) updateData.lastLoginTime = ctx.body.lastLoginTime;
-        if (ctx.body.password !== undefined) updateData.password = ctx.body.password;
+        if (ctx.body.password !== undefined) {
+            updateData.password = await hashPassword(ctx.body.password);
+        }
         if (ctx.body.phone !== undefined) updateData.phone = ctx.body.phone;
         if (ctx.body.roleType !== undefined) updateData.roleType = ctx.body.roleType;
         if (ctx.body.username !== undefined) updateData.username = ctx.body.username;

package/apis/auth/login.js

@@ -1,5 +1,6 @@
 import adminTable from "#befly/tables/admin.json";
 import loginLogTable from "#befly/tables/loginLog.json";
+import { verifyPassword } from "#befly/utils/crypto.js";
 import { toSessionTtlSeconds } from "#befly/utils/util.js";
 
 export default {
@@ -79,7 +80,7 @@ export default {
         logData.username = admin.data.username;
         logData.nickname = admin.data.nickname;
 
-        if (befly.tool.sha256(ctx.body.password) !== admin.data.password) {
+        if (!(await verifyPassword(ctx.body.password, admin.data.password))) {
             logData.failReason = "密码错误";
             await befly.mysql.insData({ table: "beflyLoginLog", data: logData });
             return befly.tool.No("账号或密码错误");

package/lib/dbHelper.js

@@ -79,10 +79,6 @@ function safeStringify(value) {
 }
 
 function getExecuteErrorMessage(error) {
-    if (error instanceof Error && typeof error.message === "string" && error.message.trim().length > 0) {
-        return error.message.trim();
-    }
-
     if (!error || typeof error !== "object") {
         return String(error);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "befly",
-    "version": "3.70.0",
+    "version": "3.71.0",
     "gitHead": "49c39d36695036e85fc64083cc43c1652fff96cb",
     "private": false,
     "description": "Befly - 为 Bun 专属打造的 JavaScript API 接口框架核心引擎",

package/plugins/tool.js

@@ -103,53 +103,13 @@ export function Raw(ctx, data, options = {}) {
     });
 }
 
-/**
- * 计算 md5（hex）
- * @param value 输入字符串
- * @returns md5 hex
- */
-export function md5(value) {
-    if (!isString(value) || value.length < 1) {
-        throw new Error("md5 输入必须是非空字符串", {
-            cause: null,
-            code: "validation",
-            subsystem: "tool",
-            operation: "md5"
-        });
-    }
-    const hasher = new Bun.CryptoHasher("md5");
-    hasher.update(value);
-    return hasher.digest("hex");
-}
-
-/**
- * 计算 sha256（hex）
- * @param value 输入字符串
- * @returns sha256 hex
- */
-export function sha256(value) {
-    if (!isString(value) || value.length < 1) {
-        throw new Error("sha256 输入必须是非空字符串", {
-            cause: null,
-            code: "validation",
-            subsystem: "tool",
-            operation: "sha256"
-        });
-    }
-    const hasher = new Bun.CryptoHasher("sha256");
-    hasher.update(value);
-    return hasher.digest("hex");
-}
-
 export default {
     order: 3,
     handler: () => {
         return {
             Yes: Yes,
             No: No,
-            Raw: Raw,
-            md5: md5,
-            sha256: sha256
+            Raw: Raw
         };
     }
 };

package/sync/dev.js

@@ -1,3 +1,4 @@
+import { hashPassword } from "../utils/crypto.js";
 import { isNumber } from "../utils/is.js";
 
 const MENU_TABLE_NAME = "beflyMenu";
@@ -72,7 +73,7 @@ export async function syncDev(ctx) {
             });
         }
 
-        const password = ctx.tool.sha256(ctx.tool.sha256(ctx.config.devPassword));
+        const password = await hashPassword(ctx.config.devPassword);
 
         const devAdminData = {
             nickname: "开发者",

package/utils/crypto.js

@@ -0,0 +1,62 @@
+/**
+ * 通用加密/哈希工具
+ */
+
+import { isString } from "./is.js";
+
+/**
+ * 计算 md5（hex）
+ * @param value 输入字符串
+ * @returns md5 hex
+ */
+export function md5(value) {
+    if (!isString(value) || value.length < 1) {
+        throw new Error("md5 输入必须是非空字符串", {
+            cause: null,
+            code: "validation",
+            subsystem: "crypto",
+            operation: "md5"
+        });
+    }
+    const hasher = new Bun.CryptoHasher("md5");
+    hasher.update(value);
+    return hasher.digest("hex");
+}
+
+/**
+ * 计算 sha256（hex）
+ * @param value 输入字符串
+ * @returns sha256 hex
+ */
+export function sha256(value) {
+    if (!isString(value) || value.length < 1) {
+        throw new Error("sha256 输入必须是非空字符串", {
+            cause: null,
+            code: "validation",
+            subsystem: "crypto",
+            operation: "sha256"
+        });
+    }
+    const hasher = new Bun.CryptoHasher("sha256");
+    hasher.update(value);
+    return hasher.digest("hex");
+}
+
+/**
+ * 使用 bcrypt 对密码进行哈希
+ * @param password 原始密码
+ * @returns bcrypt hash 字符串
+ */
+export async function hashPassword(password) {
+    return Bun.password.hash(password, { algorithm: "bcrypt" });
+}
+
+/**
+ * 校验密码与 bcrypt hash 是否匹配
+ * @param password 原始密码
+ * @param hashedPassword 数据库中存储的 bcrypt hash
+ * @returns 是否匹配
+ */
+export async function verifyPassword(password, hashedPassword) {
+    return Bun.password.verify(password, hashedPassword);
+}