befly 3.76.0 → 3.76.2

package/checks/menu.js

@@ -1,49 +1,38 @@
-import { Logger } from "../lib/logger.js";
-import { formatValidationIssues } from "../utils/formatValidationIssues.js";
-import { isFiniteNumber, isPlainObject, isString } from "../utils/is.js";
-
-const menuPathSegmentRegexSource = "[a-z][a-z0-9]*(?:-[a-z0-9]+)*";
-const fullMenuPathRegex = new RegExp(`^/(?:core(?:/${menuPathSegmentRegexSource})*|(?:${menuPathSegmentRegexSource}(?:/${menuPathSegmentRegexSource})*)?)$`);
-const childMenuPathRegex = new RegExp(`^/${menuPathSegmentRegexSource}$`);
-const menuKeys = new Set(["path", "name", "sort", "children"]);
-
-function checkMenuItem(issues, menu, path, child = false) {
-    if (!isPlainObject(menu)) {
-        issues.push({ path: path, message: "必须是对象格式" });
-        return;
-    }
-    for (const key of Object.keys(menu)) {
-        if (!menuKeys.has(key)) issues.push({ path: [...path, key], message: "不允许出现" });
-    }
-    const pathRegex = child ? childMenuPathRegex : fullMenuPathRegex;
-    if (!isString(menu.path) || !pathRegex.test(menu.path)) issues.push({ path: [...path, "path"], message: "路径格式无效" });
-    if (!isString(menu.name) || menu.name.trim() !== menu.name || menu.name.length === 0) issues.push({ path: [...path, "name"], message: "必须是非空且无首尾空格的字符串" });
-    if (!isFiniteNumber(menu.sort)) issues.push({ path: [...path, "sort"], message: "必须是有限数字" });
-
-    if (child) {
-        if (menu.children !== undefined && (!Array.isArray(menu.children) || menu.children.length > 0)) issues.push({ path: [...path, "children"], message: "只能为空数组" });
-        return;
-    }
+import { Logger } from "#befly/libs/logger/index.js";
+import { compile } from "#befly/libs/validator/index.js";
 
-    if (menu.children !== undefined && !Array.isArray(menu.children)) {
-        issues.push({ path: [...path, "children"], message: "必须是数组" });
-        return;
-    }
-    for (const [index, item] of (menu.children || []).entries()) {
-        checkMenuItem(issues, item, [...path, "children", index], true);
-        if (isPlainObject(item) && isString(menu.path) && isString(item.path) && !fullMenuPathRegex.test(`${menu.path}${item.path}`)) {
-            issues.push({ path: [...path, "children", index, "path"], message: "菜单完整路径必须是 /core/xxx 或无前缀路径" });
+import menuSchema from "../schemas/menu.json";
+import { formatIssues } from "./validation.js";
+
+const validate = compile(menuSchema);
+
+const menuPathRegex = /^\/(?:core(?:\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*)*|(?:[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*)*)?)$/;
+
+function checkMenuPaths(issues, menus) {
+    const paths = new Map();
+    for (const [index, menu] of menus.entries()) {
+        if (paths.has(menu.path)) issues.push({ path: [index, "path"], message: `菜单路径与第 ${paths.get(menu.path) + 1} 项重复` });
+        else paths.set(menu.path, index);
+
+        if (!Array.isArray(menu?.children)) continue;
+        for (const [childIndex, child] of menu.children.entries()) {
+            const fullPath = `${menu.path}${child.path}`;
+            if (paths.has(fullPath)) issues.push({ path: [index, "children", childIndex, "path"], message: `菜单完整路径与第 ${paths.get(fullPath) + 1} 项重复` });
+            else paths.set(fullPath, index);
+
+            if (typeof menu.path === "string" && typeof child?.path === "string" && !menuPathRegex.test(fullPath)) {
+                issues.push({ path: [index, "children", childIndex, "path"], message: "菜单完整路径必须是 /core/xxx 或无前缀路径" });
+            }
         }
     }
 }
 
 export async function checkMenu(menus) {
-    const issues = [];
-    if (!Array.isArray(menus)) issues.push({ path: [], message: "必须是数组" });
-    else menus.forEach((menu, index) => checkMenuItem(issues, menu, [index]));
-
+    const issues = validate(menus).issues;
+    if (Array.isArray(menus)) checkMenuPaths(issues, menus);
     if (issues.length === 0) return [];
-    const errors = formatValidationIssues(issues, { items: menus, itemLabel: "menus" });
+
+    const errors = formatIssues(issues, { items: menus, itemLabel: "menus" });
     Logger.warn("菜单校验失败", { errors: errors });
     return errors;
 }

package/checks/table.js

@@ -1,42 +1,122 @@
-import { Logger } from "../lib/logger.js";
-import { validateFieldRule } from "../lib/validator.js";
-import { formatValidationIssues } from "../utils/formatValidationIssues.js";
-import { isLowerCamelCaseName, isPlainObject } from "../utils/is.js";
+import { Logger } from "#befly/libs/logger/index.js";
+import { compile } from "#befly/libs/validator/index.js";
+
+import { isTableAutoFieldName } from "../libs/tableModel.js";
+import tableSchema from "../schemas/table.json";
 import { snakeCase } from "../utils/util.js";
+import { getFieldSchema } from "./field.js";
+import { formatIssues } from "./validation.js";
 
-const lowerSnakeRegex = /^_?[a-z][a-z0-9]*(?:_[a-z0-9]+)+$/;
+const validate = compile(tableSchema);
+const fieldParamTypes = {
+    integer: new Set(["integer"]),
+    number: new Set(["number"]),
+    varchar: new Set(["string"]),
+    text: new Set(["string", "array", "object", "record"])
+};
 
-function isValidFieldName(fieldName) {
-    return fieldName.includes("_") ? lowerSnakeRegex.test(fieldName) : isLowerCamelCaseName(fieldName);
+function addIssue(issues, path, message) {
+    issues.push({ path: path, code: "rule", message: message });
 }
 
-export async function checkTable(tables) {
-    const issues = [];
-    if (!isPlainObject(tables)) {
-        issues.push({ path: [], message: "必须是对象格式" });
+function checkFieldDefinition(issues, tableName, fieldName, field) {
+    const path = [tableName, "fields", fieldName];
+    if (!field || typeof field !== "object" || Array.isArray(field)) return;
+
+    if (typeof field.name !== "string" || !field.name || field.name !== field.name.trim() || field.name.includes("\n") || field.name.length > 20) addIssue(issues, [...path, "name"], "必须是 1..20 字符的简短名称，不允许首尾空白或换行");
+    if (field.detail !== undefined && (typeof field.detail !== "string" || !field.detail || field.detail !== field.detail.trim())) addIssue(issues, [...path, "detail"], "必须是非空无首尾空白字符串");
+    if (!fieldParamTypes[field.fieldType]) addIssue(issues, [...path, "fieldType"], "必须是 integer、number、varchar、text");
+    if (typeof field.fieldNullable !== "boolean") addIssue(issues, [...path, "fieldNullable"], "必须是 boolean");
+
+    let parseField;
+    try {
+        parseField = compile(getFieldSchema(field));
+    } catch (error) {
+        addIssue(issues, path, error.message);
+    }
+
+    if (!fieldParamTypes[field.fieldType]?.has(field.paramType)) addIssue(issues, [...path, "paramType"], `不允许与 fieldType=${field.fieldType} 搭配`);
+
+    if (Object.hasOwn(field, "fieldDefault")) {
+        if (field.fieldDefault === null) addIssue(issues, [...path, "fieldDefault"], "不允许为 null");
+        else if (parseField && !(field.paramType === "string" && field.fieldDefault === "")) {
+            const result = parseField(field.fieldDefault);
+            for (const issue of result.issues) addIssue(issues, [...path, "fieldDefault", ...issue.path], issue.message);
+        }
+    }
+
+    if (field.fieldType === "varchar" && (!Number.isSafeInteger(field.maxValue) || field.maxValue < 1 || field.maxValue > 10000)) addIssue(issues, [...path, "maxValue"], "varchar.maxValue 必须是 1..10000 的整数");
+    if (field.fieldType === "number") {
+        if (!Number.isSafeInteger(field.precision) || field.precision < 1 || field.precision > 15) addIssue(issues, [...path, "precision"], "必须是 1..15 的整数");
+        if (!Number.isSafeInteger(field.scale) || field.scale < 0 || field.scale > field.precision) addIssue(issues, [...path, "scale"], "必须是 0..precision 的整数");
     } else {
-        for (const [tableName, fields] of Object.entries(tables)) {
-            if (!isLowerCamelCaseName(tableName)) issues.push({ path: [tableName], message: "表名必须为 lowerCamelCase" });
-            if (!isPlainObject(fields)) {
-                issues.push({ path: [tableName], message: "必须是对象格式" });
-                continue;
-            }
+        if (field.precision !== undefined) addIssue(issues, [...path, "precision"], "仅 fieldType=number 允许使用");
+        if (field.scale !== undefined) addIssue(issues, [...path, "scale"], "仅 fieldType=number 允许使用");
+    }
+    if (field.fieldType === "text" && Object.hasOwn(field, "fieldDefault")) addIssue(issues, [...path, "fieldDefault"], "text 不允许默认值");
+}
+
+function checkIndex(issues, tableName, table, indexName, index) {
+    if (!Array.isArray(index?.fields)) return;
+    let varcharBytes = 0;
+    for (const fieldName of index.fields) {
+        const field = table.fields?.[fieldName];
+        if (!field) {
+            addIssue(issues, [tableName, "indexes", indexName, "fields"], `索引字段不存在: ${fieldName}`);
+            continue;
+        }
+        if (field.fieldType === "text") addIssue(issues, [tableName, "indexes", indexName, "fields"], `text 字段不能直接建立索引: ${fieldName}`);
+        if (field.fieldType === "varchar") varcharBytes += field.maxValue * 4;
+    }
+    if (varcharBytes > 3072) addIssue(issues, [tableName, "indexes", indexName, "fields"], `utf8mb4 varchar 索引估算长度 ${varcharBytes} 超过 3072 字节`);
+}
+
+function checkTableRelations(issues, tables) {
+    for (const [tableName, table] of Object.entries(tables)) {
+        if (!table || typeof table !== "object" || Array.isArray(table)) continue;
+        if (table.codeName !== tableName) addIssue(issues, [tableName, "codeName"], "必须与注册键一致");
+        if (typeof table.codeName === "string" && table.dbName !== snakeCase(table.codeName)) addIssue(issues, [tableName, "dbName"], "必须由 codeName 转为 snake_case");
 
-            const fieldNameMap = new Map();
-            for (const [fieldName, rule] of Object.entries(fields)) {
-                if (!isValidFieldName(fieldName)) issues.push({ path: [tableName, fieldName], message: "字段名必须为 lowerCamelCase 或 snake_case" });
-                for (const issue of validateFieldRule(rule)) issues.push({ path: [tableName, fieldName, ...issue.path], message: issue.message });
+        const auto = table.fields?.id?.automatic === true;
+        const dbFieldNames = new Map();
+        for (const [fieldName, field] of Object.entries(table.fields || {})) {
+            const path = [tableName, "fields", fieldName];
+            const shouldBeAutomatic = auto && isTableAutoFieldName(fieldName);
+            if (field?.automatic !== shouldBeAutomatic) addIssue(issues, [...path, "automatic"], "自动字段标记与表模式不一致");
+            const dbFieldName = snakeCase(fieldName);
+            if (dbFieldNames.has(dbFieldName)) addIssue(issues, path, `字段名 ${fieldName} 与 ${dbFieldNames.get(dbFieldName)} 指向同一数据库字段 ${dbFieldName}`);
+            else dbFieldNames.set(dbFieldName, fieldName);
+            checkFieldDefinition(issues, tableName, fieldName, field);
+        }
 
-                const dbFieldName = snakeCase(fieldName);
-                const previousFieldName = fieldNameMap.get(dbFieldName);
-                if (previousFieldName) issues.push({ path: [tableName, fieldName], message: `字段名 ${fieldName} 与 ${previousFieldName} 指向同一数据库字段 ${dbFieldName}` });
-                else fieldNameMap.set(dbFieldName, fieldName);
+        const primaryField = table.fields?.[table.primary];
+        if (auto) {
+            if (table.primary !== "id") addIssue(issues, [tableName, "primary"], "auto 模式主键必须是 id");
+            if (!primaryField?.primary || primaryField?.autoIncrement) addIssue(issues, [tableName, "fields", "id"], "auto 模式 id 必须是非自增主键");
+        } else {
+            if (!table.primary) addIssue(issues, [tableName, "primary"], "manual 模式必须配置 $tablePrimary");
+            if (!primaryField) addIssue(issues, [tableName, "primary"], "manual 模式必须通过 $tablePrimary 指定已定义字段");
+            else {
+                if (primaryField.fieldType !== "integer" || primaryField.paramType !== "integer") addIssue(issues, [tableName, "fields", table.primary], "manual 模式主键必须是 integer 字段");
+                if (primaryField.fieldNullable !== false) addIssue(issues, [tableName, "fields", table.primary, "fieldNullable"], "manual 模式主键不允许 NULL");
+                if (Object.hasOwn(primaryField, "fieldDefault")) addIssue(issues, [tableName, "fields", table.primary, "fieldDefault"], "manual 模式主键不允许默认值");
+                if (!primaryField.primary || !primaryField.autoIncrement) addIssue(issues, [tableName, "fields", table.primary], "manual 模式主键必须自动自增");
             }
         }
+
+        if (Object.values(table.fields || {}).filter((field) => field?.primary).length !== 1) addIssue(issues, [tableName, "fields"], "每张表必须且只能有一个主键");
+        if (Object.values(table.fields || {}).filter((field) => field?.autoIncrement).length > 1) addIssue(issues, [tableName, "fields"], "每张表最多只能有一个自增字段");
+
+        for (const [indexName, index] of Object.entries(table.indexes || {})) checkIndex(issues, tableName, table, indexName, index);
     }
+}
 
+export async function checkTable(tables) {
+    const issues = validate(tables).issues;
+    if (tables && typeof tables === "object" && !Array.isArray(tables)) checkTableRelations(issues, tables);
     if (issues.length === 0) return [];
-    const errors = formatValidationIssues(issues, { item: tables, itemLabel: "table" });
+
+    const errors = formatIssues(issues, { item: tables, itemLabel: "table" });
     Logger.warn("表结构校验失败", { errors: errors });
     return errors;
 }

package/checks/validation.js

@@ -0,0 +1,13 @@
+export function formatIssues(issues, options = {}) {
+    const items = Array.isArray(options.items) ? options.items : null;
+    return issues.map((issue) => {
+        const hasIndex = items && typeof issue.path[0] === "number";
+        const index = hasIndex ? issue.path[0] : null;
+        const item = hasIndex ? items[index] : options.item;
+        const fieldPath = (hasIndex ? issue.path.slice(1) : issue.path).join(".") || "(root)";
+        return {
+            file: item?.filePath || item?.relativePath || item?.fileName || item?.name || (index === null ? options.itemLabel : `${options.itemLabel}[${index}]`),
+            expected: `字段 ${fieldPath} ${issue.message}`
+        };
+    });
+}

package/configs/beflyConfig.json

@@ -3,7 +3,8 @@
     "appPort": 3000,
     "appHost": "127.0.0.1",
     "devEmail": "dev@qq.com",
-    "devPassword": "",
+    "devPassword": "123456",
+    "trustProxy": false,
     "bodyLimit": 1048576,
     "upload": {
         "maxSize": 20,
@@ -17,7 +18,7 @@
     "apiHost": "http://127.0.0.1",
     "excludeApisLog": ["/api/core/tongJi/*Report"],
     "logger": {
-        "debug": 1,
+        "debug": true,
         "excludeFields": ["password", "token", "secret"]
     },
     "mysql": {
@@ -50,18 +51,17 @@
         "label": "befly"
     },
     "cors": {
-        "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
         "allowedHeaders": "Content-Type,Authorization",
         "exposedHeaders": "",
         "maxAge": 86400,
-        "credentials": "false"
+        "credentials": false
     },
     "rateLimit": {
-        "enable": 1,
+        "enable": true,
         "defaultLimit": 1000,
         "defaultWindow": 60,
         "key": "ip",
         "skipRoutes": [],
-        "failOpen": 1
+        "failOpen": true
     }
 }

package/configs/constConfig.js

@@ -1,66 +1,11 @@
-// ==========================
-// 数据库类型分类
-// ==========================
+export const TABLE_AUTO_FIELD_NAMES = ["id", "state", "createdAt", "updatedAt", "deletedAt"];
 
-// 字符串类数据库类型
-export const STRING_KIND_TYPES = ["char", "varchar", "enum", "tinytext", "text", "mediumtext", "longtext"];
-
-// 文本类数据库类型
-export const TEXT_KIND_TYPES = ["tinytext", "text", "mediumtext", "longtext"];
-
-// 整数类数据库类型
-export const INT_KIND_TYPES = ["tinyint", "smallint", "mediumint", "int", "bigint"];
-
-// 小数类数据库类型
-export const DECIMAL_KIND_TYPES = ["decimal"];
-
-// 浮点类数据库类型
-export const FLOAT_KIND_TYPES = ["float", "double"];
-
-// JSON 类数据库类型
-export const JSON_KIND_TYPES = ["json"];
-
-// 枚举类数据库类型
-export const ENUM_KIND_TYPES = ["enum"];
-
-// ==========================
-// 运行配置可选值
-// ==========================
-
-// ==========================
-// 字段验证规则配置
-// ==========================
-
-// 字段 input 可选值（统一用于 validator / checkTable / checkApi）
-export const FIELD_RULE_INPUT_TYPES = ["number", "integer", "string", "char", "array", "arrayNumber", "arrayInteger", "arrayObject", "json", "jsonNumber", "jsonInteger", "regexp", "enum", "enumNumber", "enumInteger"];
-
-// 字段 min/max 缺省值
-export const FIELD_RULE_DEFAULT_MIN = 0;
-export const FIELD_RULE_DEFAULT_MAX = Number.MAX_SAFE_INTEGER;
-
-// ==========================
-// 框架系统表名
-// ==========================
-
-// 系统表前缀（syncDb 对比时跳过）
 export const BEFLY_TABLE_PREFIX = "befly_";
-
-// 接口表（sync 层与启动检查共用）
 export const BEFLY_API_TABLE = "beflyApi";
-// 菜单表
 export const BEFLY_MENU_TABLE = "beflyMenu";
-
-// 角色表
 export const BEFLY_ROLE_TABLE = "beflyRole";
-
-// 管理员表
 export const BEFLY_ADMIN_TABLE = "beflyAdmin";
 
-// ==========================
-// 钩子与插件执行顺序（大间隔编号，插入用中间值如 15/25/35）
-// ==========================
-
-// 钩子执行顺序（按请求生命周期：鉴权 → 限流 → 解析 → 校验 → 权限）
 export const HOOK_ORDER = {
     AUTH: 10,
     RATE_LIMIT: 20,
@@ -69,15 +14,9 @@ export const HOOK_ORDER = {
     PERMISSION: 50
 };
 
-// 插件初始化顺序（按依赖：配置 → 日志 → 工具 → Redis → XML → MySQL → 缓存 → 邮件 → 定时任务）
 export const PLUGIN_ORDER = {
-    CONFIG: 10,
-    LOGGER: 20,
-    TOOL: 30,
     REDIS: 40,
-    XML_PARSE: 50,
     MYSQL: 60,
     CACHE: 70,
-    EMAIL: 80,
-    CRON: 90
+    EMAIL: 80
 };

package/exports.js

@@ -0,0 +1,2 @@
+export { Logger } from "./libs/logger/index.js";
+export { syncDb } from "./scripts/syncDb/index.js";

package/hooks/auth.js

@@ -1,11 +1,14 @@
+import { Logger } from "#befly/libs/logger/index.js";
+
 import { HOOK_ORDER } from "../configs/constConfig.js";
 import { toSessionTtlSeconds } from "../utils/util.js";
 
 export default {
+    name: "身份识别",
     order: HOOK_ORDER.AUTH,
     handler: async (befly, ctx) => {
         const authHeader = ctx.headers.get("authorization");
-        const ttlSeconds = toSessionTtlSeconds(befly.config?.session?.expireDays);
+        const ttlSeconds = toSessionTtlSeconds(befly.config.session.expireDays);
 
         if (authHeader && authHeader.startsWith("Bearer ")) {
             const sid = authHeader.slice(7).trim();
@@ -21,14 +24,15 @@ export default {
                 return;
             }
 
+            ctx.userId = sessionData.id;
+            ctx.nickname = sessionData.nickname;
+            ctx.roleCode = sessionData.roleCode;
+            ctx.roleType = sessionData.roleType;
+
             try {
                 await befly.redis.expire(sessionKey, ttlSeconds);
-                ctx.userId = sessionData.id;
-                ctx.nickname = sessionData.nickname;
-                ctx.roleCode = sessionData.roleCode;
-                ctx.roleType = sessionData.roleType;
-            } catch {
-                return;
+            } catch (error) {
+                Logger.warn("刷新会话有效期失败", { error: error, sessionKey: sessionKey });
             }
         }
     }

package/hooks/parser.js

@@ -1,81 +1,77 @@
-import { xmlParse } from "#befly/lib/xmlParse.js";
 import { ErrorResponse } from "#befly/utils/response.js";
 
 import { HOOK_ORDER } from "../configs/constConfig.js";
+import { snakeCase } from "../utils/util.js";
+
+function parseScalar(value, schema) {
+    if (schema.paramType === "integer" && /^-?\d+$/.test(value)) return Number(value);
+    if (schema.paramType === "number" && value.trim() && Number.isFinite(Number(value))) return Number(value);
+    if (schema.paramType === "boolean" && ["true", "1"].includes(value)) return true;
+    if (schema.paramType === "boolean" && ["false", "0"].includes(value)) return false;
+    return value;
+}
+
+function parseQuery(url, fields) {
+    const params = new URL(url).searchParams;
+    const body = {};
+
+    for (const [field, schema] of Object.entries(fields)) {
+        const key = params.has(field) ? field : snakeCase(field);
+        if (!params.has(key)) continue;
+        const values = params.getAll(key);
+
+        if (schema.paramType === "array") {
+            body[field] = values.map((value) => parseScalar(value, schema.items || {}));
+        } else if (["object", "record"].includes(schema.paramType)) {
+            try {
+                body[field] = JSON.parse(values.at(-1));
+            } catch {
+                body[field] = values.at(-1);
+            }
+        } else {
+            body[field] = parseScalar(values.at(-1), schema);
+        }
+    }
+
+    return body;
+}
 
-/**
- * 请求参数解析钩子
- * - GET 请求：解析 URL 查询参数
- * - POST 请求：解析 JSON 或 XML 请求体
- * - 仅负责解析与合并参数；字段过滤/映射/校验由 validator hook 处理
- * - body: "raw" 时跳过解析，由 handler 自行处理原始请求
- */
 export default {
+    name: "参数解析",
     order: HOOK_ORDER.PARSER,
     handler: async (befly, ctx) => {
-        // apiBody=raw 模式：跳过解析，保留原始请求供 handler 自行处理
-        // 适用于：微信回调、支付回调、webhook 等需要手动解密/验签的场景（大小由 handler/upload.maxSize 控制）
         if (ctx.apiBody === "raw") {
             ctx.body = {};
             return;
         }
 
-        // 请求体大小限制（bodyLimit）：按 Content-Length 前置拦截，避免 JSON/XML 整体读入内存
         const contentLength = Number(ctx.headers.get("content-length") || 0);
-        const bodyLimit = befly.config?.bodyLimit;
-        if (bodyLimit !== undefined && contentLength > bodyLimit) {
-            ctx.response = ErrorResponse(ctx, "请求体过大", 1, null, { limit: bodyLimit, actual: contentLength }, "parser");
+        if (contentLength > befly.config.bodyLimit) {
+            ctx.response = ErrorResponse(ctx, "请求体过大", 1, null, { limit: befly.config.bodyLimit, actual: contentLength }, "parser");
             return;
         }
 
-        const queryParams = Object.fromEntries(new URL(ctx.url).searchParams);
-        const contentType = ctx.headers.get("content-type") || "";
-        // GET 请求：解析查询参数
+        const query = parseQuery(ctx.url, ctx.apiFields);
         if (ctx.method === "GET") {
-            ctx.body = queryParams;
-        } else if (ctx.method === "POST") {
-            // POST 请求：解析请求体
-            try {
-                // JSON 格式
-                if (contentType.includes("application/json")) {
-                    const body = await ctx.req.json();
-                    // 合并 URL 参数和请求体（请求体优先）
-                    ctx.body = { ...queryParams, ...body };
-                } else if (contentType.includes("application/xml") || contentType.includes("text/xml")) {
-                    // XML 格式
-                    const text = await ctx.req.text();
-                    // 合并 URL 参数和请求体（请求体优先）
-                    ctx.body = { ...queryParams, ...xmlParse(text) };
-                } else {
-                    // 不支持的 Content-Type
-                    ctx.response = ErrorResponse(
-                        ctx,
-                        "无效的请求参数格式",
-                        1,
-                        null,
-                        {
-                            location: "content-type",
-                            value: contentType
-                        },
-                        "parser"
-                    );
-                    return;
-                }
-            } catch {
-                // 解析失败：属于客户端输入错误，返回安全 detail（不回传异常栈/原始 body）
-                ctx.response = ErrorResponse(
-                    ctx,
-                    "无效的请求参数格式",
-                    1,
-                    null,
-                    {
-                        location: "body",
-                        reason: contentType.includes("application/json") ? "invalid_json" : contentType.includes("xml") ? "invalid_xml" : "invalid_body"
-                    },
-                    "parser"
-                );
+            ctx.body = query;
+            return;
+        }
+
+        const contentType = ctx.headers.get("content-type") || "";
+        try {
+            if (contentType.includes("application/json")) {
+                ctx.body = { ...query, ...(await ctx.req.json()) };
+                return;
+            }
+            if (contentType.includes("application/xml") || contentType.includes("text/xml")) {
+                ctx.body = { ...query, ...Bun.XML.parse(await ctx.req.text()) };
                 return;
             }
+        } catch {
+            ctx.response = ErrorResponse(ctx, "无效的请求参数格式", 1, null, { location: "body", reason: contentType.includes("json") ? "invalid_json" : "invalid_xml" }, "parser");
+            return;
         }
+
+        ctx.response = ErrorResponse(ctx, "无效的请求参数格式", 1, null, { location: "content-type", value: contentType }, "parser");
     }
 };

package/hooks/permission.js

@@ -6,12 +6,15 @@ import { ErrorResponse } from "../utils/response.js";
 /**
  * 权限检查钩子
  * - 接口无需权限（auth=false）：直接通过
- * - auth 为 ctx.roleType 白名单（string[]）：登录后按 ctx.roleType 放行
+ * - auth 为角色类型白名单（string[]，如 ["admin"] / ["user"]）：按 ctx.roleType 校验。
+ *   类型与角色解耦：管理员表（beflyAdmin）roleType 固定 "admin"，用户表固定 "user"，
+ *   任意角色 code 的管理员共享 "admin" 类型门槛，细粒度授权由下方集合检查（roleCode）负责
  * - 用户未登录：返回 401
- * - 开发者角色（dev）：最高权限，直接通过
+ * - 开发者角色（dev）：最高权限，直接通过（唯一内置角色，不可创建）
  * - 其他角色：检查 Redis 中的角色权限集合
  */
 export default {
+    name: "权限检查",
     order: HOOK_ORDER.PERMISSION,
     handler: async (befly, ctx) => {
         // 1. 接口无需权限