befly 3.76.6 → 3.77.0

package/libs/redis/redis.js

@@ -14,7 +14,9 @@ function buildRedisUrl(config) {
 }
 
 /**
- * Bun RedisClient 高层操作封装。除 ping 外，操作失败记录日志并返回约定 fallback。
+ * Bun RedisClient 高层操作封装。错误策略分级：
+ * - 读操作失败记录日志并返回约定 fallback，权限等判断按无数据处理（fail-closed）。
+ * - 写操作与计数器失败记录日志后抛出，由调用方决定降级策略，避免故障被静默吞掉。
  */
 export class RedisHelper {
     constructor(options) {
@@ -31,16 +33,21 @@ export class RedisHelper {
         }
     }
 
+    async strictCall(label, operation) {
+        try {
+            return await operation();
+        } catch (error) {
+            Logger.error(`Redis ${label} 错误`, error);
+            throw error;
+        }
+    }
+
     async setObject(key, obj, ttl = null) {
-        return this.safeCall(
-            "setObject",
-            async () => {
-                const data = JSON.stringify(obj);
-                const pkey = `${this.prefix}${key}`;
-                return ttl ? this.client.setex(pkey, ttl, data) : this.client.set(pkey, data);
-            },
-            null
-        );
+        return this.strictCall("setObject", () => {
+            const data = JSON.stringify(obj);
+            const pkey = `${this.prefix}${key}`;
+            return ttl ? this.client.setex(pkey, ttl, data) : this.client.set(pkey, data);
+        });
     }
 
     async getObject(key) {
@@ -55,20 +62,16 @@ export class RedisHelper {
     }
 
     async delObject(key) {
-        return this.safeCall("delObject", async () => {
+        return this.strictCall("delObject", async () => {
             await this.client.del(`${this.prefix}${key}`);
         });
     }
 
     async setString(key, value, ttl = null) {
-        return this.safeCall(
-            "setString",
-            async () => {
-                const pkey = `${this.prefix}${key}`;
-                return ttl ? this.client.setex(pkey, ttl, value) : this.client.set(pkey, value);
-            },
-            null
-        );
+        return this.strictCall("setString", () => {
+            const pkey = `${this.prefix}${key}`;
+            return ttl ? this.client.setex(pkey, ttl, value) : this.client.set(pkey, value);
+        });
     }
 
     async getString(key) {
@@ -84,20 +87,16 @@ export class RedisHelper {
     }
 
     async incrWithExpire(key, seconds) {
-        return this.safeCall(
-            "incrWithExpire",
-            async () => {
-                const pkey = `${this.prefix}${key}`;
-                const result = await this.client.incr(pkey);
-                if (result === 1) await this.client.expire(pkey, seconds);
-                return result;
-            },
-            0
-        );
+        // SET NX EX 先建键并带 TTL，再 INCR，保证计数键自创建起必有过期时间
+        return this.strictCall("incrWithExpire", async () => {
+            const pkey = `${this.prefix}${key}`;
+            await this.client.send("SET", [pkey, "0", "EX", String(seconds), "NX"]);
+            return this.client.incr(pkey);
+        });
     }
 
     async expire(key, seconds) {
-        return this.safeCall("expire", () => this.client.expire(`${this.prefix}${key}`, seconds), 0);
+        return this.strictCall("expire", () => this.client.expire(`${this.prefix}${key}`, seconds));
     }
 
     async ttl(key) {
@@ -105,14 +104,10 @@ export class RedisHelper {
     }
 
     async sadd(key, members) {
-        return this.safeCall(
-            "sadd",
-            async () => {
-                if (members.length === 0) return 0;
-                return this.client.sadd(`${this.prefix}${key}`, ...members);
-            },
-            0
-        );
+        return this.strictCall("sadd", async () => {
+            if (members.length === 0) return 0;
+            return this.client.sadd(`${this.prefix}${key}`, ...members);
+        });
     }
 
     async sismember(key, member) {
@@ -128,31 +123,23 @@ export class RedisHelper {
     }
 
     async saddBatch(items) {
-        return this.safeCall(
-            "saddBatch",
-            async () => {
-                if (items.length === 0) return 0;
-                const results = await Promise.all(items.map((item) => this.sadd(item.key, item.members)));
-                return results.reduce((sum, count) => sum + count, 0);
-            },
-            0
-        );
+        return this.strictCall("saddBatch", async () => {
+            if (items.length === 0) return 0;
+            const results = await Promise.all(items.map((item) => this.sadd(item.key, item.members)));
+            return results.reduce((sum, count) => sum + count, 0);
+        });
     }
 
     async del(key) {
-        return this.safeCall("del", () => this.client.del(`${this.prefix}${key}`), 0);
+        return this.strictCall("del", () => this.client.del(`${this.prefix}${key}`));
     }
 
     async delBatch(keys) {
-        return this.safeCall(
-            "delBatch",
-            async () => {
-                if (keys.length === 0) return 0;
-                const results = await Promise.all(keys.map((key) => this.client.del(`${this.prefix}${key}`)));
-                return results.reduce((sum, count) => sum + count, 0);
-            },
-            0
-        );
+        return this.strictCall("delBatch", async () => {
+            if (keys.length === 0) return 0;
+            const results = await Promise.all(keys.map((key) => this.client.del(`${this.prefix}${key}`)));
+            return results.reduce((sum, count) => sum + count, 0);
+        });
     }
 
     async info(section) {

package/libs/smtpText.js

@@ -30,7 +30,9 @@ function parseAddressList(value) {
         .map(function (item) {
             const trimmed = item.trim();
             const matched = /<([^<>]+)>/.exec(trimmed);
-            return matched ? matched[1].trim() : trimmed;
+            // 收件人最终拼入 RCPT TO 命令，必须剥离 CR/LF 防 SMTP 命令注入
+            const address = matched ? matched[1].trim() : trimmed;
+            return address.replace(/[\r\n]+/g, "");
         })
         .filter(function (item) {
             return item.length > 0;
@@ -198,6 +200,20 @@ function writeCommand(socket, command) {
     socket.write(`${command}\r\n`);
 }
 
+// 连接建立阶段默认 10 秒超时，避免网络黑洞下 sendMail 长时间挂起
+function connectWithTimeout(options, timeoutMs) {
+    let timer;
+    const connectPromise = Bun.connect(options);
+    const timeoutPromise = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            reject(createError(`SMTP 连接超时（${timeoutMs}ms）：${options.hostname}:${options.port}`, { code: "runtime", subsystem: "smtp", operation: "connect" }));
+            // 超时后才建立的连接直接关闭，避免孤儿 socket
+            connectPromise.then((late) => late.end()).catch(() => {});
+        }, timeoutMs);
+    });
+    return Promise.race([connectPromise, timeoutPromise]).finally(() => clearTimeout(timer));
+}
+
 export async function sendSmtpTextMail(config, options) {
     const mail = createSmtpTextMessage(config, options);
     if (mail.recipients.length === 0) {
@@ -205,28 +221,31 @@ export async function sendSmtpTextMail(config, options) {
     }
 
     const reader = createResponseReader();
-    const socket = await Bun.connect({
-        hostname: config.host,
-        port: config.port || 25,
-        tls: normalizeSecureValue(config.secure),
-        socket: {
-            data: function (_socket, data) {
-                reader.append(data);
-            },
-            close: function (_socket, error) {
-                reader.close(error || null);
-            },
-            error: function (_socket, error) {
-                reader.close(error);
-            },
-            connectError: function (_socket, error) {
-                reader.close(error);
-            },
-            end: function () {
-                reader.close(null);
+    const socket = await connectWithTimeout(
+        {
+            hostname: config.host,
+            port: config.port || 25,
+            tls: normalizeSecureValue(config.secure),
+            socket: {
+                data: function (_socket, data) {
+                    reader.append(data);
+                },
+                close: function (_socket, error) {
+                    reader.close(error || null);
+                },
+                error: function (_socket, error) {
+                    reader.close(error);
+                },
+                connectError: function (_socket, error) {
+                    reader.close(error);
+                },
+                end: function () {
+                    reader.close(null);
+                }
             }
-        }
-    });
+        },
+        10000
+    );
 
     try {
         const timeout = 10000;

package/libs/validator/compiler.js

@@ -200,6 +200,7 @@ export function compileNode(schema, path, parents) {
         node.maxItem = schema.maxItem;
         node.unique = schema.unique === true;
         node.items = schema.items === undefined ? null : compileNode(schema.items, [...path, "items"], parents);
+        if (node.unique && node.items && node.items.kind === "object") schemaError([...path, "unique"], "对象数组判重请使用 uniqueBy，unique 仅对标量数组有效");
         if (schema.uniqueBy !== undefined) {
             if (typeof schema.uniqueBy !== "string" || !schema.uniqueBy || schema.uniqueBy !== schema.uniqueBy.trim()) schemaError([...path, "uniqueBy"], "必须是非空无首尾空白字符串");
             if (!node.items || node.items.kind !== "object" || !node.items.fieldSet.has(schema.uniqueBy)) schemaError([...path, "uniqueBy"], "必须引用 items.fields 中的字段");

package/libs/validator/parser.js

@@ -44,11 +44,13 @@ export function parseNode(value, node, path, useDefault = true) {
     if (value === null) return failure([{ path: path, code: "null", message: "不允许为 null" }]);
 
     if (node.kind === "anyOf") {
+        const branchMessages = [];
         for (const branch of node.branches) {
             const result = parseNode(value, branch, path);
             if (result.ok) return result;
+            branchMessages.push(result.issues[0]?.message || typeMessage(branch.kind));
         }
-        return failure([{ path: path, code: "anyOf", message: "不符合任一允许类型" }]);
+        return failure([{ path: path, code: "anyOf", message: `不符合任一允许类型：${branchMessages.join("；")}` }]);
     }
 
     if (node.kind === "any") return success(value);
@@ -79,8 +81,9 @@ export function parseNode(value, node, path, useDefault = true) {
     }
 
     if (node.kind === "array") {
-        if (node.minItem !== undefined && value.length < node.minItem) addIssue(issues, path, "minItem", `至少需要${node.minItem}项`);
-        if (node.maxItem !== undefined && value.length > node.maxItem) addIssue(issues, path, "maxItem", `最多允许${node.maxItem}项`);
+        // 数量违规提前返回，避免后续对超大数组的遍历与拷贝
+        if (node.minItem !== undefined && value.length < node.minItem) return failure([{ path: path, code: "minItem", message: `至少需要${node.minItem}项` }]);
+        if (node.maxItem !== undefined && value.length > node.maxItem) return failure([{ path: path, code: "maxItem", message: `最多允许${node.maxItem}项` }]);
         if (node.unique && new Set(value).size !== value.length) addIssue(issues, path, "unique", "数组项不能重复");
         if (node.uniqueBy) {
             const seen = new Set();
@@ -97,7 +100,10 @@ export function parseNode(value, node, path, useDefault = true) {
                 if (result.ok) data.push(result.data);
                 else issues.push(...result.issues);
             });
-        } else data.push(...value);
+        } else {
+            // 逐项拷贝而非 spread，避免超大数组触发调用栈溢出
+            for (const item of value) data.push(item);
+        }
         return issues.length > 0 ? failure(issues) : success(data);
     }
 

package/libs/validator/util.js

@@ -1,5 +1 @@
-export function isPlainObject(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
+export { isPlainObject } from "../../utils/is.js";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "befly",
-    "version": "3.76.6",
+    "version": "3.77.0",
     "gitHead": "49c39d36695036e85fc64083cc43c1652fff96cb",
     "private": false,
     "description": "Befly - 为 Bun 专属打造的 JavaScript API 接口框架核心引擎",

package/paths.js

@@ -10,7 +10,8 @@
  *
  */
 
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // 当前文件的路径信息
@@ -25,12 +26,6 @@ const moduleDir = dirname(moduleFilePath);
  */
 export const coreDir = moduleDir;
 
-/**
- * Core 框架 dist 目录
- * @description 源码态为 packages/core/dist；dist 运行态为 packages/core/dist
- */
-export const coreDistDir = basename(moduleDir) === "dist" ? moduleDir : join(moduleDir, "dist");
-
 /**
  * Core 框架检查目录
  * @description packages/core/checks/
@@ -75,12 +70,30 @@ export const coreTableDir = join(moduleDir, "tables");
 
 // ==================== 用户项目路径 ====================
 
+/**
+ * 定位项目根目录：从 cwd 逐级向上查找 bm2.toml（项目根标识文件）。
+ * 找不到时回退 cwd——此时项目源码目录（apis/tables 等）将扫描不到，
+ * 由 scanSources 在启动期对"app 源码目录全部缺失"的场景统一告警。
+ */
+function findAppRoot() {
+    let dir = process.cwd();
+    for (;;) {
+        if (existsSync(join(dir, "bm2.toml"))) {
+            return dir;
+        }
+        const parent = dirname(dir);
+        if (parent === dir) {
+            return process.cwd();
+        }
+        dir = parent;
+    }
+}
+
 /**
  * 项目根目录
- * @description process.cwd()
- * @usage 用户项目的根目录
+ * @description 含 bm2.toml 的目录
  */
-export const appDir = process.cwd();
+export const appDir = findAppRoot();
 
 /**
  * 项目检查目录

package/router/static.js

@@ -62,14 +62,21 @@ export function staticHandler(corsConfig, uploadConfig) {
 
             const file = Bun.file(filePath);
             if (await file.exists()) {
-                const headers = {};
-                if (corsHeaders && typeof corsHeaders === "object") {
-                    for (const key of Object.keys(corsHeaders)) {
-                        headers[key] = corsHeaders[key];
-                    }
-                }
+                const headers = { ...corsHeaders };
                 headers["Content-Type"] = file.type || "application/octet-stream";
                 headers["X-Content-Type-Options"] = "nosniff";
+
+                // ETag 协商缓存：命中 If-None-Match 直接返回 304，避免重复传输文件体
+                const etag = `"${file.size}-${file.lastModified}"`;
+                headers["ETag"] = etag;
+                headers["Cache-Control"] = "public, max-age=86400";
+                if (req.headers.get("if-none-match") === etag) {
+                    return new Response(null, {
+                        status: 304,
+                        headers: headers
+                    });
+                }
+
                 if (uploadConfig.forceDownloadExtensions.split(",").includes(extname(filePath).toLowerCase())) {
                     headers["Content-Disposition"] = `attachment; filename="${basename(filePath).replaceAll('"', "")}"`;
                 }

package/schemas/api.json

@@ -52,6 +52,10 @@
                             "paramType": "string",
                             "minValue": 1
                         }
+                    },
+                    {
+                        "paramType": "string",
+                        "enum": ["dev"]
                     }
                 ]
             },

package/schemas/config.json

@@ -248,6 +248,26 @@
                     "items": {
                         "paramType": "string"
                     }
+                },
+                "rules": {
+                    "paramType": "array",
+                    "items": {
+                        "paramType": "object",
+                        "fields": {
+                            "path": {
+                                "paramType": "string",
+                                "minValue": 1
+                            },
+                            "limit": {
+                                "paramType": "integer",
+                                "minValue": 1
+                            },
+                            "window": {
+                                "paramType": "integer",
+                                "minValue": 1
+                            }
+                        }
+                    }
                 }
             }
         }

package/sync/api.js

@@ -1,6 +1,13 @@
 import { BEFLY_API_TABLE } from "../configs/constConfig.js";
 import { buildPathSyncLists, serializeAuth } from "./syncUtil.js";
 
+// insBatch 单批上限 1000 行，超出分批写入
+async function insBatchChunked(mysql, table, list) {
+    for (let start = 0; start < list.length; start += 1000) {
+        await mysql.insBatch(table, list.slice(start, start + 1000));
+    }
+}
+
 const getApiParentPath = (apiPath) => {
     const segments = apiPath
         .split("/")
@@ -19,7 +26,7 @@ const getApiParentPath = (apiPath) => {
 export async function syncApi(ctx, apis) {
     const allDbApis = await ctx.mysql.getAll({
         table: BEFLY_API_TABLE,
-        fields: ["id", "path", "parentPath", "name", "auth", "state"],
+        fields: ["id", "path", "parentPath", "name", "method", "auth", "category", "state"],
         where: { state$gte: 0 }
     });
 
@@ -30,7 +37,8 @@ export async function syncApi(ctx, apis) {
             path: api.apiPath,
             method: api.method,
             parentPath: getApiParentPath(api.apiPath),
-            auth: serializeAuth(api.auth)
+            auth: serializeAuth(api.auth),
+            category: api.category || "other"
         });
     }
 
@@ -42,14 +50,16 @@ export async function syncApi(ctx, apis) {
             path: def.path,
             method: def.method,
             parentPath: def.parentPath,
-            auth: def.auth
+            auth: def.auth,
+            category: def.category
         }),
         (def) => ({
             name: def.name,
             path: def.path,
             method: def.method,
             parentPath: def.parentPath,
-            auth: def.auth
+            auth: def.auth,
+            category: def.category
         })
     );
 
@@ -57,9 +67,7 @@ export async function syncApi(ctx, apis) {
         await ctx.mysql.updBatch(BEFLY_API_TABLE, syncLists.updList);
     }
 
-    if (syncLists.insList.length > 0) {
-        await ctx.mysql.insBatch(BEFLY_API_TABLE, syncLists.insList);
-    }
+    await insBatchChunked(ctx.mysql, BEFLY_API_TABLE, syncLists.insList);
 
     if (syncLists.delIds.length > 0) {
         await ctx.mysql.delForceBatch(BEFLY_API_TABLE, syncLists.delIds);

package/sync/dev.js

@@ -38,6 +38,12 @@ export async function syncDev(ctx) {
             where: { username: "dev", state$gte: 0 }
         });
 
+        const adminAccount = await ctx.mysql.getOne({
+            table: BEFLY_ADMIN_TABLE,
+            fields: ["id"],
+            where: { username: "admin", state$gte: 0 }
+        });
+
         const menuPaths = [];
         for (const item of allMenus.data.lists) {
             menuPaths.push(item.path);
@@ -72,7 +78,6 @@ export async function syncDev(ctx) {
 
         // devPassword 为必填项（校验见函数开头），此处直接使用
         const password = await hashPassword(ctx.config.devPassword);
-        // 【临时诊断】hashPassword 后连接预检
 
         const devAdminData = {
             nickname: "开发者",
@@ -92,7 +97,24 @@ export async function syncDev(ctx) {
         } else {
             await ctx.mysql.insData({
                 table: BEFLY_ADMIN_TABLE,
-                data: { ...devAdminData, state: 1 }
+                data: devAdminData
+            });
+        }
+
+        // admin 管理员账号：仅首次创建，已存在则不覆盖（密码与资料以库内为准，改密后重启不受影响）
+        // 初始密码为固定默认值 admin123456，首次登录后应立即修改
+        if (!isNumber(adminAccount.data.id)) {
+            await ctx.mysql.insData({
+                table: BEFLY_ADMIN_TABLE,
+                data: {
+                    nickname: "管理员",
+                    email: "admin@qq.com",
+                    username: "admin",
+                    password: await hashPassword("admin123456"),
+                    roleCode: "admin",
+                    roleType: "admin",
+                    state: 1
+                }
             });
         }
 
@@ -141,6 +163,8 @@ export async function syncDev(ctx) {
 
             const mergedApis = [];
             const mergedApiSet = new Set();
+            // 仅保留当前仍存在的接口路径，已删除/改名的旧 path 不再永久残留
+            const validApiSet = new Set(allApis.data.lists.map((api) => api.path));
 
             if (Array.isArray(existingRole.data?.apis)) {
                 for (const apiPath of existingRole.data.apis) {
@@ -148,7 +172,7 @@ export async function syncDev(ctx) {
                         continue;
                     }
                     const value = apiPath.trim();
-                    if (value.length === 0 || mergedApiSet.has(value)) {
+                    if (value.length === 0 || !validApiSet.has(value) || mergedApiSet.has(value)) {
                         continue;
                     }
                     mergedApiSet.add(value);

package/sync/menu.js

@@ -40,7 +40,7 @@ export function flattenMenusToDefMap(menus) {
 export async function syncMenu(ctx, menus) {
     const menuDefMap = flattenMenusToDefMap(menus);
 
-    // 2) 批量同步（事务内）：按 path diff 执行批量 insert/update/delete
+    // 2) 批量同步：按 path diff 执行批量 insert/update/delete（幂等收敛，非原子事务）
     // 读取全部菜单
     const allExistingMenus = await ctx.mysql.getAll({
         table: BEFLY_MENU_TABLE,
@@ -69,8 +69,8 @@ export async function syncMenu(ctx, menus) {
         await ctx.mysql.updBatch(BEFLY_MENU_TABLE, syncLists.updList);
     }
 
-    if (syncLists.insList.length > 0) {
-        await ctx.mysql.insBatch(BEFLY_MENU_TABLE, syncLists.insList);
+    for (let start = 0; start < syncLists.insList.length; start += 1000) {
+        await ctx.mysql.insBatch(BEFLY_MENU_TABLE, syncLists.insList.slice(start, start + 1000));
     }
 
     // 3) 删除差集（DB - 配置）

package/sync/syncUtil.js

@@ -1,9 +1,10 @@
 // 接口 auth 的存储协议（serializeAuth 与 authAllowsRole 配套使用）：
 // - true -> 1（需登录）
 // - false -> 0（免登录）
+// - "dev" -> "dev"（超级管理员专属：管理员表中 roleCode 为 dev/admin 的账号，不参与角色授权）
 // - string[] -> "a,b,c"（角色类型白名单，如 admin/user）
 export function serializeAuth(auth) {
-    return auth === false ? 0 : Array.isArray(auth) ? auth.join(",") : 1;
+    return auth === false ? 0 : auth === "dev" ? "dev" : Array.isArray(auth) ? auth.join(",") : 1;
 }
 
 /**
@@ -17,6 +18,10 @@ export function authAllowsRole(auth, roleCode) {
     return false;
 }
 
+function isSameRecord(data, existing) {
+    return Object.entries(data).every(([key, value]) => existing[key] === value);
+}
+
 export function buildPathSyncLists(existingList, defList, buildUpdateData, buildInsertData) {
     const existingMap = new Map();
     const delIdSet = new Set();
@@ -24,8 +29,9 @@ export function buildPathSyncLists(existingList, defList, buildUpdateData, build
     for (const record of existingList) {
         if (!existingMap.has(record.path)) {
             existingMap.set(record.path, record);
-            delIdSet.add(record.id);
         }
+        // 全部行先进删除集，命中配置的再移出；同 path 重复行（历史并发同步产物）因此按孤儿清理
+        delIdSet.add(record.id);
     }
 
     const updList = [];
@@ -36,10 +42,10 @@ export function buildPathSyncLists(existingList, defList, buildUpdateData, build
 
         if (existing) {
             delIdSet.delete(existing.id);
-            updList.push({
-                id: existing.id,
-                data: buildUpdateData(def, existing)
-            });
+            const data = buildUpdateData(def, existing);
+            if (!isSameRecord(data, existing)) {
+                updList.push({ id: existing.id, data: data });
+            }
             continue;
         }
 

package/tables/api.json

@@ -1,5 +1,8 @@
 {
     "$tableName": "接口表",
+    "$tableIndexes": {
+        "uk_befly_api_path": "unique#path"
+    },
     "name": {
         "name": "接口名称",
         "minValue": 2,
@@ -17,6 +20,15 @@
         "fieldType": "varchar",
         "fieldDefault": ""
     },
+    "category": {
+        "name": "接口分类",
+        "detail": "select=查询类，other=其他",
+        "minValue": 1,
+        "maxValue": 50,
+        "paramType": "string",
+        "fieldType": "varchar",
+        "fieldDefault": "other"
+    },
     "method": {
         "name": "请求方式",
         "minValue": 1,