befly 3.74.2 → 3.75.0

package/apis/dashboard/systemResources.js

@@ -24,7 +24,9 @@ export default {
             };
         });
 
-        await new Promise((resolve) => setTimeout(resolve, 100));
+        await new Promise((resolve) => {
+            setTimeout(resolve, 100);
+        });
 
         const endCpus = os.cpus();
         const endMeasure = endCpus.map((cpu) => {

package/apis/dict/_dict.js

@@ -12,7 +12,7 @@ export async function getDictTypeByCode(befly, typeCode) {
     });
 }
 
-export async function getDictByTypeCodeAndKey(befly, typeCode, key, dictId = undefined) {
+export async function getDictByTypeCodeAndKey(befly, typeCode, key, dictId) {
     return await befly.mysql.getOne({
         table: "beflyDict",
         where: {

package/apis/role/_role.js

@@ -1,6 +1,6 @@
 export const systemRoleCodes = ["dev", "user", "admin", "guest"];
 
-export async function getRoleByCode(befly, roleCode, fields = undefined) {
+export async function getRoleByCode(befly, roleCode, fields) {
     return await befly.mysql.getOne({
         table: "beflyRole",
         fields: fields,
@@ -10,7 +10,7 @@ export async function getRoleByCode(befly, roleCode, fields = undefined) {
     });
 }
 
-export async function getRoleById(befly, id, fields = undefined) {
+export async function getRoleById(befly, id, fields) {
     return await befly.mysql.getOne({
         table: "beflyRole",
         fields: fields,

package/apis/tongJi/dailyStats.js

@@ -149,8 +149,8 @@ export default {
         const productCode = ctx.body?.productCode ?? "";
         const dateStats = {
             reportDate: reportDate,
-            yesterdayDate: recentDateList[recentDateList.length - 2],
-            dayBeforeYesterdayDate: recentDateList[recentDateList.length - 3],
+            yesterdayDate: recentDateList.at(-2),
+            dayBeforeYesterdayDate: recentDateList.at(-3),
             monthStartDate: monthStartDate,
             previousMonthStartDate: previousMonthStartDate,
             previousMonthEndDate: previousMonthEndDate,

package/apis/tongJi/dailyStatsDistribution.js

@@ -14,19 +14,19 @@ function getDateRangeBounds(dateRange, now, timeZone) {
     }
 
     if (dateRange === "yesterday") {
-        const yesterdayDate = recentDateList[recentDateList.length - 2];
+        const yesterdayDate = recentDateList.at(-2);
 
         return [yesterdayDate, yesterdayDate];
     }
 
     if (dateRange === "dayBeforeYesterday") {
-        const dayBeforeYesterdayDate = recentDateList[recentDateList.length - 3];
+        const dayBeforeYesterdayDate = recentDateList.at(-3);
 
         return [dayBeforeYesterdayDate, dayBeforeYesterdayDate];
     }
 
     if (dateRange === "recent30") {
-        return [recentDateList[0], recentDateList[recentDateList.length - 1]];
+        return [recentDateList[0], recentDateList.at(-1)];
     }
 
     const monthStartDate = getTongJiMonthStartDate(now, timeZone);

package/apis/tongJi/errorList.js

@@ -58,7 +58,7 @@ export default {
         });
 
         const lists = (result.data?.lists || []).map((item) => {
-            const row = Object.assign({}, item);
+            const row = { ...item };
 
             for (const field of NUMBER_FIELDS) {
                 row[field] = Number(item[field]) || 0;
@@ -67,7 +67,7 @@ export default {
             return row;
         });
 
-        const data = Object.assign({}, result.data);
+        const data = { ...result.data };
         data.lists = lists;
 
         return befly.tool.Yes("获取成功", data);

package/apis/tongJi/errorStats.js

@@ -15,11 +15,11 @@ function buildErrorStatsResponse(bucketDate, monthStartDate, recentDateList, tod
             count: todaySummary.count
         },
         yesterday: {
-            bucketDate: recentDateList[recentDateList.length - 2] || bucketDate,
+            bucketDate: recentDateList.at(-2) || bucketDate,
             count: yesterdaySummary.count
         },
         dayBeforeYesterday: {
-            bucketDate: recentDateList[recentDateList.length - 3] || recentDateList[recentDateList.length - 2] || bucketDate,
+            bucketDate: recentDateList.at(-3) || recentDateList.at(-2) || bucketDate,
             count: dayBeforeYesterdaySummary.count
         },
         month: {
@@ -54,8 +54,8 @@ function sumDateCounts(map, dateList) {
 }
 
 async function getErrorStatsFromMysql(befly, bucketDate, monthStartDate, recentDateList) {
-    const yesterdayDate = recentDateList[recentDateList.length - 2] || bucketDate;
-    const dayBeforeYesterdayDate = recentDateList[recentDateList.length - 3] || yesterdayDate;
+    const yesterdayDate = recentDateList.at(-2) || bucketDate;
+    const dayBeforeYesterdayDate = recentDateList.at(-3) || yesterdayDate;
     const monthDateList = getTongJiDateRangeList(monthStartDate, bucketDate);
 
     const [dayCountMap, trendRes, topTypesRes] = await Promise.all([
@@ -111,11 +111,11 @@ function buildEmptyErrorStats(bucketDate, monthStartDate, recentDateList) {
             count: 0
         },
         yesterday: {
-            bucketDate: recentDateList[recentDateList.length - 2] || bucketDate,
+            bucketDate: recentDateList.at(-2) || bucketDate,
             count: 0
         },
         dayBeforeYesterday: {
-            bucketDate: recentDateList[recentDateList.length - 3] || recentDateList[recentDateList.length - 2] || bucketDate,
+            bucketDate: recentDateList.at(-3) || recentDateList.at(-2) || bucketDate,
             count: 0
         },
         month: {

package/checks/api.js

@@ -1,9 +1,8 @@
 import { Logger } from "../lib/logger.js";
 import { validateFieldRule } from "../lib/validator.js";
 import { formatValidationIssues } from "../utils/formatValidationIssues.js";
-import { isBoolean, isFunction, isPlainObject, isString } from "../utils/is.js";
+import { isBoolean, isFunction, isLowerCamelCaseName, isPlainObject, isString } from "../utils/is.js";
 
-const lowerCamelRegex = /^_?[a-z][a-z0-9]*(?:[A-Z][a-z0-9]*)*$/;
 const apiPathRegex = /^\/api\/[a-z][a-zA-Z0-9]*(?:\/[a-z][a-zA-Z0-9]*)*$/;
 const apiKeys = new Set(["source", "type", "filePath", "relativePath", "fileName", "name", "handler", "apiPath", "method", "body", "auth", "fields", "required"]);
 
@@ -29,11 +28,18 @@ function checkApiItem(api, index) {
     }
     for (const key of ["source", "type", "filePath", "relativePath"]) checkNoTrimString(issues, api[key], [index, key], 1);
     checkNoTrimString(issues, api.name, [index, "name"], 1, 100);
-    if (!isString(api.fileName) || !lowerCamelRegex.test(api.fileName)) issues.push({ path: [index, "fileName"], message: "必须是 lowerCamelCase" });
+    if (!isString(api.fileName) || !isLowerCamelCaseName(api.fileName)) issues.push({ path: [index, "fileName"], message: "必须是 lowerCamelCase" });
     if (!isFunction(api.handler)) issues.push({ path: [index, "handler"], message: "必须是函数" });
     if (!isString(api.apiPath) || !apiPathRegex.test(api.apiPath)) issues.push({ path: [index, "apiPath"], message: "路径格式无效" });
     if (!["GET", "POST", "ALL"].includes(api.method)) issues.push({ path: [index, "method"], message: "仅允许 GET|POST|ALL" });
     if (!["none", "raw"].includes(api.body)) issues.push({ path: [index, "body"], message: "仅允许 none|raw" });
+    // body 为 raw 时不允许配置 fields/required：parser 跳过解析，参数校验由 handler 自行承担
+    if (api.body === "raw" && isPlainObject(api.fields) && Object.keys(api.fields).length > 0) {
+        issues.push({ path: [index, "body"], message: 'body 为 "raw" 时不允许配置 fields，由 handler 自行解析校验' });
+    }
+    if (api.body === "raw" && Array.isArray(api.required) && api.required.length > 0) {
+        issues.push({ path: [index, "body"], message: 'body 为 "raw" 时不允许配置 required，由 handler 自行解析校验' });
+    }
 
     if (!isBoolean(api.auth) && (!Array.isArray(api.auth) || api.auth.length === 0 || api.auth.some((item) => !isString(item) || (item !== "" && item.trim() !== item)))) {
         issues.push({ path: [index, "auth"], message: "必须是 boolean 或非空字符串数组" });
@@ -43,13 +49,12 @@ function checkApiItem(api, index) {
         issues.push({ path: [index, "fields"], message: "必须是对象格式" });
     } else {
         for (const [fieldName, rule] of Object.entries(api.fields)) {
-            if (!lowerCamelRegex.test(fieldName)) issues.push({ path: [index, "fields", fieldName], message: "字段名必须为 lowerCamelCase" });
+            if (!isLowerCamelCaseName(fieldName)) issues.push({ path: [index, "fields", fieldName], message: "字段名必须为 lowerCamelCase" });
             for (const issue of validateFieldRule(rule)) issues.push({ path: [index, "fields", fieldName, ...issue.path], message: issue.message });
         }
     }
 
     if (!Array.isArray(api.required) || api.required.some((item) => !isString(item) || (item !== "" && item.trim() !== item))) issues.push({ path: [index, "required"], message: "必须是字符串数组" });
-    if (api.source === "app" && isString(api.relativePath) && api.relativePath.split("/")[0] === "core") issues.push({ path: [index, "relativePath"], message: "app API 不能使用 core 作为一级目录，避免占用 /api/core 命名空间" });
 
     return issues;
 }
@@ -63,6 +68,6 @@ export async function checkApi(apis) {
     }
 
     if (issues.length === 0) return false;
-    Logger.warn("接口校验失败", { errors: formatValidationIssues(issues, { items: apis, itemLabel: "api" }) }, false);
+    Logger.warn("接口校验失败", { errors: formatValidationIssues(issues, { items: apis, itemLabel: "api" }) });
     return true;
 }

package/checks/items.js

@@ -0,0 +1,56 @@
+import { Logger } from "../lib/logger.js";
+import { formatValidationIssues } from "../utils/formatValidationIssues.js";
+import { isFunction, isFiniteNumber, isPlainObject, isString } from "../utils/is.js";
+
+const itemKeys = new Set(["source", "type", "filePath", "relativePath", "fileName", "apiPath", "handler", "order"]);
+
+function checkItem(item) {
+    const issues = [];
+    if (!isPlainObject(item)) {
+        issues.push({ path: [], message: "必须是对象格式" });
+        return issues;
+    }
+
+    for (const key of Object.keys(item)) {
+        if (!itemKeys.has(key)) issues.push({ path: [key], message: "不允许出现" });
+    }
+    for (const key of ["source", "type", "filePath", "relativePath", "fileName", "apiPath"]) {
+        if (!isString(item[key]) || item[key].length === 0 || item[key].trim() !== item[key]) issues.push({ path: [key], message: "必须是非空且无首尾空格的字符串" });
+    }
+    if (!isFunction(item.handler)) issues.push({ path: ["handler"], message: "必须是函数" });
+    if (!isFiniteNumber(item.order)) issues.push({ path: ["order"], message: "必须是有限数字" });
+    return issues;
+}
+
+function checkItemList(items, label, labelEn) {
+    if (!Array.isArray(items)) {
+        Logger.warn(`${label}校验失败`, { errors: formatValidationIssues([{ path: [], message: "必须是数组" }], { item: items, itemLabel: labelEn }) });
+        return true;
+    }
+
+    let hasError = false;
+
+    // order 冲突校验：同 order 的执行顺序依赖扫描顺序，要求显式区分
+    const orderMap = new Map();
+    for (const item of items) {
+        if (!isFiniteNumber(item.order)) continue;
+        orderMap.set(item.order, (orderMap.get(item.order) || 0) + 1);
+    }
+    const duplicateOrders = [...orderMap].filter(([, count]) => count > 1).map(([order]) => order);
+    if (duplicateOrders.length > 0) {
+        Logger.warn(`${label}校验失败`, { errors: [{ path: [], message: `order 重复: ${duplicateOrders.join("、")}` }] });
+        hasError = true;
+    }
+
+    for (const item of items) {
+        const issues = checkItem(item);
+        if (issues.length === 0) continue;
+        Logger.warn(`${label}校验失败`, { errors: formatValidationIssues(issues, { item: item, itemLabel: labelEn }) });
+        hasError = true;
+    }
+    return hasError;
+}
+
+export const checkHook = (hooks) => checkItemList(hooks, "钩子", "hook");
+
+export const checkPlugin = (plugins) => checkItemList(plugins, "插件", "plugin");

package/checks/menu.js

@@ -43,6 +43,6 @@ export async function checkMenu(menus) {
     else menus.forEach((menu, index) => checkMenuItem(issues, menu, [index]));
 
     if (issues.length === 0) return false;
-    Logger.warn("菜单校验失败", { errors: formatValidationIssues(issues, { items: menus, itemLabel: "menus" }) }, false);
+    Logger.warn("菜单校验失败", { errors: formatValidationIssues(issues, { items: menus, itemLabel: "menus" }) });
     return true;
 }

package/checks/table.js

@@ -1,14 +1,13 @@
 import { Logger } from "../lib/logger.js";
 import { validateFieldRule } from "../lib/validator.js";
 import { formatValidationIssues } from "../utils/formatValidationIssues.js";
-import { isPlainObject } from "../utils/is.js";
+import { isLowerCamelCaseName, isPlainObject } from "../utils/is.js";
 import { snakeCase } from "../utils/util.js";
 
-const lowerCamelRegex = /^_?[a-z][a-z0-9]*(?:[A-Z][a-z0-9]*)*$/;
 const lowerSnakeRegex = /^_?[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/;
 
 function isValidFieldName(fieldName) {
-    return fieldName.includes("_") ? lowerSnakeRegex.test(fieldName) : lowerCamelRegex.test(fieldName);
+    return fieldName.includes("_") ? lowerSnakeRegex.test(fieldName) : isLowerCamelCaseName(fieldName);
 }
 
 export async function checkTable(tables) {
@@ -17,7 +16,7 @@ export async function checkTable(tables) {
         issues.push({ path: [], message: "必须是对象格式" });
     } else {
         for (const [tableName, fields] of Object.entries(tables)) {
-            if (!lowerCamelRegex.test(tableName)) issues.push({ path: [tableName], message: "表名必须为 lowerCamelCase" });
+            if (!isLowerCamelCaseName(tableName)) issues.push({ path: [tableName], message: "表名必须为 lowerCamelCase" });
             if (!isPlainObject(fields)) {
                 issues.push({ path: [tableName], message: "必须是对象格式" });
                 continue;
@@ -37,6 +36,6 @@ export async function checkTable(tables) {
     }
 
     if (issues.length === 0) return false;
-    Logger.warn("表结构校验失败", { errors: formatValidationIssues(issues, { item: tables, itemLabel: "table" }) }, false);
+    Logger.warn("表结构校验失败", { errors: formatValidationIssues(issues, { item: tables, itemLabel: "table" }) });
     return true;
 }

package/configs/beflyConfig.json

@@ -1,10 +1,9 @@
 {
-    "runMode": "development",
     "appName": "野蜂飞舞",
     "appPort": 3000,
     "appHost": "127.0.0.1",
     "devEmail": "dev@qq.com",
-    "devPassword": "111111",
+    "devPassword": "",
     "bodyLimit": 1048576,
     "upload": {
         "maxSize": 20,
@@ -21,7 +20,6 @@
         "debug": 1,
         "excludeFields": ["password", "token", "secret"]
     },
-
     "mysql": {
         "hostname": "127.0.0.1",
         "port": 3306,
@@ -29,9 +27,9 @@
         "password": "root",
         "database": "befly",
         "max": 10,
-        "beflyMode": "auto"
+        "beflyMode": "auto",
+        "queryTimeout": 30
     },
-
     "redis": {
         "hostname": "127.0.0.1",
         "port": 6379,
@@ -40,11 +38,9 @@
         "db": 0,
         "prefix": "befly"
     },
-
     "session": {
         "expireDays": 7
     },
-
     "email": {
         "host": "smtp.qq.com",
         "port": 465,
@@ -53,7 +49,6 @@
         "pass": "",
         "label": "befly"
     },
-
     "cors": {
         "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
         "allowedHeaders": "Content-Type,Authorization",
@@ -61,12 +56,12 @@
         "maxAge": 86400,
         "credentials": "false"
     },
-
     "rateLimit": {
         "enable": 1,
         "defaultLimit": 1000,
         "defaultWindow": 60,
         "key": "ip",
-        "skipRoutes": []
+        "skipRoutes": [],
+        "failOpen": 1
     }
 }

package/configs/constConfig.js

@@ -27,9 +27,6 @@ export const ENUM_KIND_TYPES = ["enum"];
 // 运行配置可选值
 // ==========================
 
-// 运行模式可选值
-export const RUN_MODE_VALUES = ["development", "production"];
-
 // ==========================
 // 字段验证规则配置
 // ==========================
@@ -40,3 +37,47 @@ export const FIELD_RULE_INPUT_TYPES = ["number", "integer", "string", "char", "a
 // 字段 min/max 缺省值
 export const FIELD_RULE_DEFAULT_MIN = 0;
 export const FIELD_RULE_DEFAULT_MAX = Number.MAX_SAFE_INTEGER;
+
+// ==========================
+// 框架系统表名
+// ==========================
+
+// 系统表前缀（syncDb 对比时跳过）
+export const BEFLY_TABLE_PREFIX = "befly_";
+
+// 接口表（sync 层与启动检查共用）
+export const BEFLY_API_TABLE = "beflyApi";
+// 菜单表
+export const BEFLY_MENU_TABLE = "beflyMenu";
+
+// 角色表
+export const BEFLY_ROLE_TABLE = "beflyRole";
+
+// 管理员表
+export const BEFLY_ADMIN_TABLE = "beflyAdmin";
+
+// ==========================
+// 钩子与插件执行顺序（大间隔编号，插入用中间值如 15/25/35）
+// ==========================
+
+// 钩子执行顺序（按请求生命周期：鉴权 → 限流 → 解析 → 校验 → 权限）
+export const HOOK_ORDER = {
+    AUTH: 10,
+    RATE_LIMIT: 20,
+    PARSER: 30,
+    VALIDATOR: 40,
+    PERMISSION: 50
+};
+
+// 插件初始化顺序（按依赖：配置 → 日志 → 工具 → Redis → XML → MySQL → 缓存 → 邮件 → 定时任务）
+export const PLUGIN_ORDER = {
+    CONFIG: 10,
+    LOGGER: 20,
+    TOOL: 30,
+    REDIS: 40,
+    XML_PARSE: 50,
+    MYSQL: 60,
+    CACHE: 70,
+    EMAIL: 80,
+    CRON: 90
+};

package/hooks/auth.js

@@ -1,13 +1,14 @@
+import { HOOK_ORDER } from "../configs/constConfig.js";
 import { toSessionTtlSeconds } from "../utils/util.js";
 
 export default {
-    order: 1,
+    order: HOOK_ORDER.AUTH,
     handler: async (befly, ctx) => {
         const authHeader = ctx.headers.get("authorization");
         const ttlSeconds = toSessionTtlSeconds(befly.config?.session?.expireDays);
 
         if (authHeader && authHeader.startsWith("Bearer ")) {
-            const sid = authHeader.substring(7).trim();
+            const sid = authHeader.slice(7).trim();
 
             if (!sid) {
                 return;

package/hooks/parser.js

@@ -1,6 +1,8 @@
 import { xmlParse } from "#befly/lib/xmlParse.js";
 import { ErrorResponse } from "#befly/utils/response.js";
 
+import { HOOK_ORDER } from "../configs/constConfig.js";
+
 /**
  * 请求参数解析钩子
  * - GET 请求：解析 URL 查询参数
@@ -9,14 +11,23 @@ import { ErrorResponse } from "#befly/utils/response.js";
  * - body: "raw" 时跳过解析，由 handler 自行处理原始请求
  */
 export default {
-    order: 2,
+    order: HOOK_ORDER.PARSER,
     handler: async (befly, ctx) => {
         // apiBody=raw 模式：跳过解析，保留原始请求供 handler 自行处理
-        // 适用于：微信回调、支付回调、webhook 等需要手动解密/验签的场景
+        // 适用于：微信回调、支付回调、webhook 等需要手动解密/验签的场景（大小由 handler/upload.maxSize 控制）
         if (ctx.apiBody === "raw") {
             ctx.body = {};
             return;
         }
+
+        // 请求体大小限制（bodyLimit）：按 Content-Length 前置拦截，避免 JSON/XML 整体读入内存
+        const contentLength = Number(ctx.headers.get("content-length") || 0);
+        const bodyLimit = befly.config?.bodyLimit;
+        if (bodyLimit !== undefined && contentLength > bodyLimit) {
+            ctx.response = ErrorResponse(ctx, "请求体过大", 1, null, { limit: bodyLimit, actual: contentLength }, "parser");
+            return;
+        }
+
         const queryParams = Object.fromEntries(new URL(ctx.url).searchParams);
         const contentType = ctx.headers.get("content-type") || "";
         // GET 请求：解析查询参数
@@ -29,12 +40,12 @@ export default {
                 if (contentType.includes("application/json")) {
                     const body = await ctx.req.json();
                     // 合并 URL 参数和请求体（请求体优先）
-                    ctx.body = Object.assign({}, queryParams, body);
+                    ctx.body = { ...queryParams, ...body };
                 } else if (contentType.includes("application/xml") || contentType.includes("text/xml")) {
                     // XML 格式
                     const text = await ctx.req.text();
                     // 合并 URL 参数和请求体（请求体优先）
-                    ctx.body = Object.assign({}, queryParams, xmlParse(text));
+                    ctx.body = { ...queryParams, ...xmlParse(text) };
                 } else {
                     // 不支持的 Content-Type
                     ctx.response = ErrorResponse(

package/hooks/permission.js

@@ -1,3 +1,4 @@
+import { HOOK_ORDER } from "../configs/constConfig.js";
 import { isValidPositiveInt } from "../utils/is.js";
 // 相对导入
 import { ErrorResponse } from "../utils/response.js";
@@ -11,7 +12,7 @@ import { ErrorResponse } from "../utils/response.js";
  * - 其他角色：检查 Redis 中的角色权限集合
  */
 export default {
-    order: 4,
+    order: HOOK_ORDER.PERMISSION,
     handler: async (befly, ctx) => {
         // 1. 接口无需权限
         if (ctx.apiAuth === false) {
@@ -47,7 +48,7 @@ export default {
 
         // 4. 角色权限检查
         // apiPath 在 apiHandler 中已统一生成并写入 ctx.apiPath
-        let hasPermission = false;
+        let hasPermission;
 
         if (befly.cache && typeof befly.cache.checkRoleApis === "function") {
             hasPermission = await befly.cache.checkRoleApis(ctx.roleCode, ctx.apiPath);

package/hooks/rateLimit.js

@@ -1,5 +1,6 @@
 import picomatch from "picomatch";
 
+import { HOOK_ORDER } from "../configs/constConfig.js";
 import { isValidPositiveInt } from "../utils/is.js";
 import { ErrorResponse } from "../utils/response.js";
 
@@ -31,6 +32,8 @@ function normalizeConfig(config) {
 
     return {
         enabled: RATE_LIMIT_ENABLED_VALUES.has(config?.enable),
+        // failOpen：限流服务（Redis）不可用时是否放行；默认放行（保持兼容），可配置为 failClosed
+        failOpen: config?.failOpen === undefined ? true : RATE_LIMIT_ENABLED_VALUES.has(config?.failOpen),
         limit: toPositiveInt(config?.defaultLimit, 1000),
         window: toPositiveInt(config?.defaultWindow, 60),
         keyType: toSafeString(config?.key, "ip"),
@@ -55,16 +58,26 @@ function buildRateLimitRedisKey(ctx, keyType, scope) {
 }
 
 export default {
-    order: 1.5,
+    order: HOOK_ORDER.RATE_LIMIT,
     handler: async (befly, ctx) => {
         const rateLimit = normalizeConfig(befly?.config?.rateLimit);
-        if (!rateLimit.enabled || !befly?.redis || typeof befly.redis.incrWithExpire !== "function" || shouldSkipRateLimit(rateLimit, ctx)) return;
+        if (!rateLimit.enabled || shouldSkipRateLimit(rateLimit, ctx)) return;
+
+        // 限流服务（Redis）不可用：failOpen 放行（默认），failClosed 直接拒绝
+        if (!befly?.redis || typeof befly.redis.incrWithExpire !== "function") {
+            if (!rateLimit.failOpen) {
+                ctx.corsHeaders ||= {};
+                ctx.corsHeaders["Retry-After"] = String(rateLimit.window);
+                ctx.response = ErrorResponse(ctx, "服务繁忙，请稍后再试", 1, null, { reason: "rate_limit_unavailable" }, "rateLimit");
+            }
+            return;
+        }
 
         const scope = resolveScopeByKeyType(rateLimit.keyType, ctx);
         const current = await befly.redis.incrWithExpire(buildRateLimitRedisKey(ctx, rateLimit.keyType, scope), rateLimit.window);
         if (current <= rateLimit.limit) return;
 
-        ctx.corsHeaders = ctx.corsHeaders || {};
+        ctx.corsHeaders ||= {};
         ctx.corsHeaders["Retry-After"] = String(rateLimit.window);
         ctx.response = ErrorResponse(
             ctx,

package/hooks/validator.js

@@ -1,3 +1,4 @@
+import { HOOK_ORDER } from "../configs/constConfig.js";
 // 相对导入
 import { validateFields } from "../lib/validator.js";
 import { isPlainObject, isString } from "../utils/is.js";
@@ -9,7 +10,7 @@ import { snakeCase } from "../utils/util.js";
  * 根据 API 定义的 fields 和 required 验证请求参数
  */
 export default {
-    order: 3,
+    order: HOOK_ORDER.VALIDATOR,
     handler: async (befly, ctx) => {
         // 仅保留 fields 中声明的字段，并支持 snake_case 入参回退（例如 agent_id -> agentId）
         const rawBody = isPlainObject(ctx.body) ? ctx.body : {};