befly 3.76.6 → 3.77.0

package/Befly.js

@@ -22,10 +22,9 @@ async function assertRuntimeReady(context) {
         if (!context[key]) throw createError(`启动失败：ctx.${key} 未初始化`, { code: "runtime", subsystem: "start", operation: "runtimeReady" });
     }
 
-    const missingTables = [];
-    for (const table of [BEFLY_API_TABLE, BEFLY_MENU_TABLE, BEFLY_ADMIN_TABLE, BEFLY_ROLE_TABLE]) {
-        if (!(await context.mysql.tableExists(table)).data) missingTables.push(table);
-    }
+    const coreTables = [BEFLY_API_TABLE, BEFLY_MENU_TABLE, BEFLY_ADMIN_TABLE, BEFLY_ROLE_TABLE];
+    const tableResults = await Promise.all(coreTables.map((table) => context.mysql.tableExists(table)));
+    const missingTables = coreTables.filter((table, index) => !tableResults[index].data);
     if (missingTables.length > 0) throw createError(`同步依赖表缺失: ${missingTables.join("、")}`, { code: "runtime", subsystem: "start", operation: "tableExists", missingTables: missingTables });
 }
 
@@ -41,9 +40,12 @@ export class Befly {
         this.apis = init.apis || [];
         this.hooks = init.hooks || [];
         this.plugins = init.plugins || [];
+        this.activePlugins = [];
         this.corns = init.corns || [];
         this.server = null;
         this.started = false;
+        this.stopping = null;
+        this.signalHandlers = null;
     }
 
     async start() {
@@ -55,6 +57,7 @@ export class Befly {
             for (const item of this.plugins.toSorted((a, b) => a.order - b.order)) {
                 const pluginStartTime = Bun.nanoseconds();
                 this.context[item.fileName] = await item.handler(this.context);
+                this.activePlugins.push(item);
                 Logger.info(`启动 插件 ${item.fileName} 耗时 ${calcPerfTime(pluginStartTime)}`);
             }
             Logger.info(`启动 插件初始化完成，耗时 ${calcPerfTime(pluginsStartTime)}`);
@@ -64,21 +67,16 @@ export class Befly {
             Logger.info(`启动 运行时依赖检查完成，耗时 ${calcPerfTime(runtimeReadyStartTime)}`);
 
             if (isPrimaryProcess()) {
-                const syncApiStartTime = Bun.nanoseconds();
-                await syncApi(this.context, this.apis);
-                Logger.info(`启动 API 同步完成，耗时 ${calcPerfTime(syncApiStartTime)}`);
-
-                const syncMenuStartTime = Bun.nanoseconds();
-                await syncMenu(this.context, this.menus);
-                Logger.info(`启动 菜单同步完成，耗时 ${calcPerfTime(syncMenuStartTime)}`);
-
-                const syncDevStartTime = Bun.nanoseconds();
+                const syncStartTime = Bun.nanoseconds();
+                const syncApiStart = Bun.nanoseconds();
+                const syncMenuStart = Bun.nanoseconds();
+                const syncDevStart = Bun.nanoseconds();
+                // api/menu 互不依赖可并行；syncDev 读取 api/menu 落库结果、syncCache 读取 syncDev 写入的角色表，需按序串行
+                await Promise.all([syncApi(this.context, this.apis).then(() => Logger.info(`启动 API 同步完成，耗时 ${calcPerfTime(syncApiStart)}`)), syncMenu(this.context, this.menus).then(() => Logger.info(`启动 菜单同步完成，耗时 ${calcPerfTime(syncMenuStart)}`))]);
                 await syncDev(this.context);
-                Logger.info(`启动 开发者数据同步完成，耗时 ${calcPerfTime(syncDevStartTime)}`);
-
-                const syncCacheStartTime = Bun.nanoseconds();
+                Logger.info(`启动 开发者数据同步完成，耗时 ${calcPerfTime(syncDevStart)}`);
                 await syncCache(this.context);
-                Logger.info(`启动 缓存同步完成，耗时 ${calcPerfTime(syncCacheStartTime)}`);
+                Logger.info(`启动 缓存同步完成，耗时 ${calcPerfTime(syncStartTime)}`);
 
                 const syncReadyStartTime = Bun.nanoseconds();
                 await this.context.redis.setString(SYNC_READY_KEY, String(Date.now()), 300);
@@ -88,7 +86,11 @@ export class Befly {
                 const startAt = Date.now();
                 await waitFor({
                     label: "主进程同步完成",
-                    check: async () => Number(await this.context.redis.getString(SYNC_READY_KEY)) > startAt
+                    // 主进程先于本进程完成同步时标记时间早于 startAt，60 秒内的近期标记视为就绪
+                    check: async () => {
+                        const marker = Number(await this.context.redis.getString(SYNC_READY_KEY));
+                        return marker > startAt || (marker > 0 && startAt - marker < 60_000);
+                    }
                 });
                 Logger.info(`启动 等待主进程同步完成，耗时 ${calcPerfTime(syncWaitStartTime)}`);
             }
@@ -131,29 +133,95 @@ export class Befly {
             });
 
             this.started = true;
+            const startupTime = calcPerfTime(serverStartTime);
             Logger.info(`启动 Bun.serve 监听完成，耗时 ${calcPerfTime(listenStartTime)}`);
-            Logger.info(`启动总耗时 ${calcPerfTime(serverStartTime)}`);
-            Logger.info(`${this.context.config.appName} 启动成功`, { url: this.server.url, startupTime: calcPerfTime(serverStartTime) });
+            Logger.info(`启动总耗时 ${startupTime}`);
+            Logger.info(`${this.context.config.appName} 启动成功`, { url: this.server.url, startupTime: startupTime });
+
+            this.signalHandlers = {
+                SIGINT: async () => {
+                    let exitCode = 130;
+                    try {
+                        await this.stop();
+                    } catch {
+                        exitCode = 1;
+                    }
+                    process.exit(exitCode);
+                },
+                SIGTERM: async () => {
+                    let exitCode = 143;
+                    try {
+                        await this.stop();
+                    } catch {
+                        exitCode = 1;
+                    }
+                    process.exit(exitCode);
+                }
+            };
+            process.once("SIGINT", this.signalHandlers.SIGINT);
+            process.once("SIGTERM", this.signalHandlers.SIGTERM);
             return this.server;
         } catch (error) {
             Logger.error("项目启动失败", error);
-            await this.stop();
+            try {
+                await this.stop();
+            } catch {}
             throw createError("运行时错误", { cause: error, code: error?.code || "runtime", subsystem: "start", operation: "start" });
         }
     }
 
     async stop() {
-        this.server?.stop();
-        this.server = null;
-        this.context.cron?.stopAll();
+        if (this.stopping) return this.stopping;
 
-        for (const item of this.plugins.toSorted((a, b) => b.order - a.order)) {
-            const resource = this.context[item.fileName];
-            if (resource?.close) await resource.close();
-            else if (resource?.stop) await resource.stop();
-        }
+        const stopping = (async () => {
+            let stopError;
 
-        this.started = false;
-        await Logger.flush();
+            if (this.signalHandlers) {
+                process.off("SIGINT", this.signalHandlers.SIGINT);
+                process.off("SIGTERM", this.signalHandlers.SIGTERM);
+                this.signalHandlers = null;
+            }
+
+            try {
+                this.server?.stop();
+            } catch (error) {
+                stopError = error;
+                Logger.error("停止 HTTP 服务失败", error);
+            }
+            this.server = null;
+
+            const cron = this.context.cron;
+            this.context.cron = null;
+            try {
+                cron?.stopAll();
+            } catch (error) {
+                stopError ||= error;
+                Logger.error("停止定时器失败", error);
+            }
+
+            for (const item of this.activePlugins.toReversed()) {
+                const resource = this.context[item.fileName];
+                try {
+                    if (resource?.close) await resource.close();
+                    else if (resource?.stop) await resource.stop();
+                } catch (error) {
+                    stopError ||= error;
+                    Logger.error(`关闭插件 ${item.fileName} 失败`, error);
+                }
+            }
+            this.activePlugins = [];
+
+            this.started = false;
+            await Logger.shutdown();
+
+            if (stopError) throw createError("项目停止失败", { cause: stopError, code: "runtime", subsystem: "stop", operation: "stop" });
+        })();
+        this.stopping = stopping;
+
+        try {
+            return await stopping;
+        } finally {
+            if (this.stopping === stopping) this.stopping = null;
+        }
     }
 }

package/apis/admin/delete.js

@@ -2,7 +2,7 @@ export default {
     name: "删除管理员",
     method: "POST",
     body: "none",
-    auth: true,
+    auth: "dev",
     fields: {
         id: { name: "ID", paramType: "integer", minValue: 1 }
     },

package/apis/admin/detail.js

@@ -1,5 +1,6 @@
 export default {
     name: "获取管理员信息",
+    category: "select",
     method: "POST",
     body: "none",
     auth: true,

package/apis/admin/insert.js

@@ -5,7 +5,7 @@ export default {
     name: "添加管理员",
     method: "POST",
     body: "none",
-    auth: true,
+    auth: "dev",
     fields: {
         username: adminTable.username,
         password: adminTable.password,

package/apis/admin/update.js

@@ -5,7 +5,7 @@ export default {
     name: "更新管理员",
     method: "POST",
     body: "none",
-    auth: true,
+    auth: "dev",
     fields: {
         id: { name: "ID", paramType: "integer", minValue: 1 },
         username: adminTable.username,

package/apis/auth/login.js

@@ -105,8 +105,9 @@ export default {
             loginAt: Date.now()
         };
 
-        const sessionResult = await befly.redis.setObject(sessionKey, sessionData, ttlSeconds);
-        if (!sessionResult) {
+        try {
+            await befly.redis.setObject(sessionKey, sessionData, ttlSeconds);
+        } catch {
             return befly.tool.No("登录失败，请稍后重试");
         }
 

package/apis/dashboard/systemResources.js

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import os from "node:os";
 import { promisify } from "node:util";
 
+import { memRemember } from "#befly/libs/memCache.js";
+
 export default {
     name: "获取系统资源",
     method: "POST",
@@ -9,7 +11,16 @@ export default {
     auth: true,
     fields: {},
     required: [],
+    // CPU 采样含 100ms 等待，快照缓存 3 秒避免高并发下请求积压
     handler: async (befly) => {
+        return await memRemember("dashboard:systemResources", 3000, async () => {
+            return await collectSystemResources(befly);
+        });
+    }
+};
+
+async function collectSystemResources(befly) {
+    {
         const cpus = os.cpus();
         const cpuCount = cpus.length;
 
@@ -105,4 +116,4 @@ export default {
             }
         });
     }
-};
+}

package/apis/dict/detail.js

@@ -2,6 +2,7 @@ import { dictReadFields, dictReadLeftJoin, dictReadTable } from "./_dict.js";
 
 export default {
     name: "获取字典详情",
+    category: "select",
     method: "POST",
     body: "none",
     auth: false,

package/apis/dictType/detail.js

@@ -1,5 +1,6 @@
 export default {
     name: "字典类型详情",
+    category: "select",
     method: "POST",
     body: "none",
     auth: true,

package/apis/email/config.js

@@ -2,7 +2,7 @@ export default {
     name: "获取邮件配置",
     method: "POST",
     body: "none",
-    auth: true,
+    auth: "dev",
     fields: {},
     required: [],
     handler: async (befly) => {

package/apis/role/apiSave.js

@@ -6,7 +6,7 @@ export default {
     name: "保存角色接口权限",
     method: "POST",
     body: "none",
-    auth: true,
+    auth: "dev",
     fields: {
         roleCode: roleTable.code,
         apiPaths: roleTable.apis
@@ -21,6 +21,19 @@ export default {
             return befly.tool.No("角色不存在");
         }
 
+        // 超级管理员专属接口是天生权限，不允许分配给任何角色（前端授权 UI 也应过滤 auth=dev）
+        if (apiPaths.length > 0) {
+            const checkResult = await befly.mysql.getAll({
+                table: "beflyApi",
+                fields: ["path", "auth"],
+                where: { path$in: apiPaths }
+            });
+            const devPaths = checkResult.data.lists.filter((row) => row.auth === "dev").map((row) => row.path);
+            if (devPaths.length > 0) {
+                return befly.tool.No(`超级管理员专属接口不允许分配：${devPaths.join("、")}`);
+            }
+        }
+
         await befly.mysql.updData({
             table: "beflyRole",
             where: { code: ctx.body.roleCode },

package/apis/role/detail.js

@@ -4,6 +4,7 @@ import { getRoleByCode } from "./_role.js";
 
 export default {
     name: "获取用户角色",
+    category: "select",
     method: "POST",
     body: "none",
     auth: true,

package/apis/role/menuSave.js

@@ -6,7 +6,7 @@ export default {
     name: "保存角色菜单权限",
     method: "POST",
     body: "none",
-    auth: true,
+    auth: "dev",
     fields: {
         roleCode: roleTable.code,
         menuPaths: roleTable.menus

package/apis/tongJi/_tongJi.js

@@ -1,3 +1,4 @@
+import { memRemember } from "#befly/libs/memCache.js";
 import { DAY_MS } from "#befly/utils/datetime.js";
 
 const DEFAULT_TIME_ZONE = "Asia/Shanghai";
@@ -118,3 +119,18 @@ export function getTongJiDateRangeList(startDateYmd, endDateYmd, timeZone = DEFA
 
     return list;
 }
+
+// 上报接口的 productCode 必须是已注册项目（空值视为未分组上报，放行）；结果进程内缓存 60 秒
+export async function isRegisteredProductCode(befly, productCode) {
+    if (!productCode) {
+        return true;
+    }
+    return await memRemember(`tongJi:project:${productCode}`, 60000, async () => {
+        const result = await befly.mysql.getOne({
+            table: "beflyProject",
+            fields: ["id"],
+            where: { code: productCode }
+        });
+        return Boolean(result.data?.id);
+    });
+}

package/apis/tongJi/dailyReport.js

@@ -1,6 +1,6 @@
 import { isValidPositiveInt } from "#befly/utils/is.js";
 
-import { getTongJiDateYmdNumber } from "./_tongJi.js";
+import { getTongJiDateYmdNumber, isRegisteredProductCode } from "./_tongJi.js";
 
 const DAILY_STATS_REDIS_TTL_SECONDS = 24 * 60 * 60;
 
@@ -29,6 +29,10 @@ export default {
 
         const productCode = ctx.body?.productCode || "";
 
+        if (!(await isRegisteredProductCode(befly, productCode))) {
+            return befly.tool.No("productCode 未注册");
+        }
+
         let memberMeta;
 
         if (isValidPositiveInt(ctx?.userId)) {

package/apis/tongJi/dailyStatsDistribution.js

@@ -75,11 +75,12 @@ export default {
         }
 
         const [startDate, endDate] = getDateRangeBounds(dateRange, Date.now(), befly.config?.tz);
+        const dimensionList = Array.from(DISTRIBUTION_DIMENSIONS);
+        const rows = await Promise.all(dimensionList.map((dimension) => queryDimensionDistribution(befly, dimension, startDate, endDate, productCode)));
         const result = {};
-
-        for (const dimension of DISTRIBUTION_DIMENSIONS) {
-            result[dimension] = await queryDimensionDistribution(befly, dimension, startDate, endDate, productCode);
-        }
+        dimensionList.forEach((dimension, index) => {
+            result[dimension] = rows[index];
+        });
 
         return befly.tool.Yes("获取成功", result);
     }

package/apis/tongJi/errorReport.js

@@ -1,7 +1,9 @@
 import errorReportTable from "#befly/tables/errorReport.json";
-import { getDateYmdNumber, getTimeBucketStart } from "#befly/utils/datetime.js";
+import { getTimeBucketStart } from "#befly/utils/datetime.js";
 import { isValidPositiveInt } from "#befly/utils/is.js";
 
+import { getTongJiDateYmdNumber, isRegisteredProductCode } from "./_tongJi.js";
+
 const ERROR_STATS_BUCKET_MS = 30 * 60 * 1000;
 const ERROR_STATS_REDIS_TTL_SECONDS = 24 * 60 * 60;
 
@@ -44,10 +46,14 @@ export default {
     handler: async (befly, ctx) => {
         const now = Date.now();
         const bucketTime = getTimeBucketStart(now, ERROR_STATS_BUCKET_MS);
-        const bucketDate = getDateYmdNumber(now);
+        const bucketDate = getTongJiDateYmdNumber(now, befly.config?.tz);
 
         const body = ctx.body || {};
         const productCode = body.productCode || "";
+
+        if (!(await isRegisteredProductCode(befly, productCode))) {
+            return befly.tool.No("productCode 未注册");
+        }
         const rawMessage = body.message || "";
         const extractedMessage = extractErrorMessage(rawMessage);
 

package/apis/tongJi/todayOnline.js

@@ -32,11 +32,8 @@ export default {
     handler: async (befly, _ctx) => {
         const reportDate = getTongJiDateYmdNumber(Date.now(), befly.config?.tz);
         const projects = await loadProjects(befly);
-        let total = 0;
-
-        for (const item of projects) {
-            total += await getTodayCount(befly, reportDate, item.code);
-        }
+        const counts = await Promise.all(projects.map((item) => getTodayCount(befly, reportDate, item.code)));
+        const total = counts.reduce((sum, count) => sum + count, 0);
 
         return befly.tool.Yes("获取成功", {
             today: {

package/checks/api.js

@@ -2,7 +2,7 @@ import { Logger } from "#befly/libs/logger/index.js";
 import { compile } from "#befly/libs/validator/index.js";
 
 import apiSchema from "../schemas/api.json";
-import { getFieldSchema } from "./field.js";
+import { buildApiSchema, getFieldSchema } from "./field.js";
 import { formatIssues } from "./validation.js";
 
 const validate = compile(apiSchema);
@@ -23,11 +23,7 @@ function checkApiRules(issues, apis) {
             }
         }
         try {
-            compile({
-                paramType: "object",
-                fields: Object.fromEntries(Object.entries(fields).map(([field, definition]) => [field, { ...getFieldSchema(definition), optional: !(api.required || []).includes(field) }])),
-                constraints: api.constraints
-            });
+            compile(buildApiSchema(fields, api.required, api.constraints));
         } catch (error) {
             issues.push({ path: [index, "constraints"], code: "rule", message: error.message });
         }

package/checks/field.js

@@ -9,10 +9,34 @@ export function getFieldSchema(field) {
 }
 
 export function getFieldErrors(issues, fields) {
-    return Object.fromEntries(
-        issues.map((issue) => {
-            const field = issue.path[0];
-            return [field, `${fields[field]?.name || field}${issue.message}`];
-        })
-    );
+    const errors = {};
+    for (const issue of issues) {
+        const field = issue.path[0];
+        // 同字段保留首条错误，避免后者覆盖更根本的原因
+        if (errors[field] === undefined) {
+            errors[field] = `${fields[field]?.name || field}${issue.message}`;
+        }
+    }
+    return errors;
+}
+
+/**
+ * 构造 API 请求体验证 schema：fields 剥离领域元数据、required 映射 optional、附加 constraints。
+ * 启动检查（checkApi）与运行时验证 hook 共用此构造，保证两处行为完全一致。
+ */
+export function buildApiSchema(fields, required, constraints) {
+    const requiredSet = new Set(required || []);
+    return {
+        paramType: "object",
+        fields: Object.fromEntries(
+            Object.entries(fields || {}).map(([field, definition]) => [
+                field,
+                {
+                    ...getFieldSchema(definition),
+                    optional: !requiredSet.has(field)
+                }
+            ])
+        ),
+        constraints: constraints
+    };
 }

package/checks/menu.js

@@ -6,7 +6,8 @@ import { formatIssues } from "./validation.js";
 
 const validate = compile(menuSchema);
 
-const menuPathRegex = /^\/(?:core(?:\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*)*|(?:[a-z][a-z0-9]*(?:-[a-z0-9]+)*(?:\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*)*)?)$/;
+// 路径正则以 schemas/menu.json 的 children.path pattern 为唯一来源，避免双份维护漂移
+const menuPathRegex = new RegExp(menuSchema.items.fields.path.pattern);
 
 function checkMenuPaths(issues, menus) {
     const paths = new Map();

package/configs/beflyConfig.json

@@ -3,7 +3,7 @@
     "appPort": 3000,
     "appHost": "127.0.0.1",
     "devEmail": "dev@qq.com",
-    "devPassword": "123456",
+    "devPassword": "",
     "trustProxy": false,
     "bodyLimit": 1048576,
     "upload": {
@@ -62,6 +62,7 @@
         "defaultWindow": 60,
         "key": "ip",
         "skipRoutes": [],
-        "failOpen": true
+        "failOpen": true,
+        "rules": [{ "path": "/api/core/tongJi/*Report", "limit": 120, "window": 60 }]
     }
 }

package/exports.js

@@ -1,2 +1,3 @@
 export { Logger } from "./libs/logger/index.js";
+export { genShortId, snakeCase, toSessionTtlSeconds } from "./utils/util.js";
 export { syncDb } from "./scripts/syncDb/index.js";

package/hooks/auth.js

@@ -29,8 +29,14 @@ export default {
             ctx.roleCode = sessionData.roleCode;
             ctx.roleType = sessionData.roleType;
 
+            // 距上次续期不足半衰期时不续，避免每个请求两次 Redis 往返
+            const renewedAt = Number(sessionData.renewedAt || sessionData.loginAt || 0);
+            if (Date.now() - renewedAt < (ttlSeconds * 1000) / 2) {
+                return;
+            }
+
             try {
-                await befly.redis.expire(sessionKey, ttlSeconds);
+                await Promise.all([befly.redis.expire(sessionKey, ttlSeconds), befly.redis.setObject(sessionKey, { ...sessionData, renewedAt: Date.now() }, ttlSeconds)]);
             } catch (error) {
                 Logger.warn("刷新会话有效期失败", { error: error, sessionKey: sessionKey });
             }

package/hooks/permission.js

@@ -1,11 +1,12 @@
 import { HOOK_ORDER } from "../configs/constConfig.js";
-import { isValidPositiveInt } from "../utils/is.js";
+import { isSuperAdminContext, isValidPositiveInt } from "../utils/is.js";
 // 相对导入
 import { ErrorResponse } from "../utils/response.js";
 
 /**
  * 权限检查钩子
  * - 接口无需权限（auth=false）：直接通过
+ * - 超级管理员专属（auth="dev"）：仅管理员表 dev/admin 角色可用，不参与角色授权
  * - auth 为角色类型白名单（string[]，如 ["admin"] / ["user"]）：按 ctx.roleType 校验。
  *   类型与角色解耦：管理员表（beflyAdmin）roleType 固定 "admin"，用户表固定 "user"，
  *   任意角色 code 的管理员共享 "admin" 类型门槛，细粒度授权由下方集合检查（roleCode）负责
@@ -33,6 +34,26 @@ export default {
             return;
         }
 
+        // 3.4 超级管理员专属接口（auth="dev"）：仅管理员表 dev/admin 角色可用，
+        // 为天生权限，不查角色权限集合，也不允许分配给任何角色
+        if (ctx.apiAuth === "dev") {
+            if (isSuperAdminContext(ctx)) {
+                return;
+            }
+            ctx.response = ErrorResponse(
+                ctx,
+                `无权访问 ${ctx.apiName} 接口`,
+                1,
+                null,
+                {
+                    apiName: ctx.apiName,
+                    apiPath: ctx.apiPath
+                },
+                "permission"
+            );
+            return;
+        }
+
         // 3.5 apiAuth 为角色类型白名单时，仅做 ctx.roleType 校验
         if (Array.isArray(ctx.apiAuth) && ctx.apiAuth.includes(ctx.roleType) === false) {
             ctx.response = ErrorResponse(