cfix 1.0.0

package/src/logger.js

@@ -0,0 +1,139 @@
+const winston = require("winston");
+const DailyRotateFile = require("winston-daily-rotate-file");
+const path = require("path");
+const crypto = require("crypto");
+
+// 日志目录
+const logDir = path.join(__dirname, "../logs");
+
+/**
+ * 生成请求ID
+ */
+function generateRequestId() {
+  return crypto.randomBytes(16).toString('hex');
+}
+
+// 结构化日志格式
+const logFormat = winston.format.combine(
+  winston.format.timestamp({ format: "YYYY-MM-DD HH:mm:ss" }),
+  winston.format.errors({ stack: true }),
+  winston.format.printf(({ timestamp, level, message, requestId, taskId, ...meta }) => {
+    // 开发环境：易读格式
+    if (process.env.NODE_ENV !== 'production') {
+      let log = `[${timestamp}] [${level.toUpperCase()}]`;
+
+      if (requestId) {
+        log += ` [${requestId.substring(0, 8)}]`;
+      }
+
+      if (taskId) {
+        log += ` [Task: ${taskId}]`;
+      }
+
+      log += `: ${message}`;
+
+      // 添加其他元数据
+      const otherMeta = { ...meta };
+      delete otherMeta.requestId;
+      delete otherMeta.taskId;
+
+      if (Object.keys(otherMeta).length > 0) {
+        log += ` ${JSON.stringify(otherMeta)}`;
+      }
+
+      return log;
+    }
+
+    // 生产环境：JSON 格式
+    return JSON.stringify({
+      timestamp,
+      level: level.toUpperCase(),
+      message,
+      requestId,
+      taskId,
+      ...meta,
+    });
+  })
+);
+
+// 创建 logger 实例
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || "info",
+  format: logFormat,
+  transports: [
+    // 控制台输出(开发模式)
+    new winston.transports.Console({
+      format: winston.format.combine(
+        winston.format.colorize(),
+        logFormat
+      ),
+    }),
+
+    // 所有日志 - 按天轮转
+    new DailyRotateFile({
+      dirname: logDir,
+      filename: "combined-%DATE%.log",
+      datePattern: "YYYY-MM-DD",
+      maxSize: "20m",
+      maxFiles: "14d", // 保留14天
+      format: logFormat,
+    }),
+
+    // 错误日志 - 单独文件
+    new DailyRotateFile({
+      dirname: logDir,
+      filename: "error-%DATE%.log",
+      datePattern: "YYYY-MM-DD",
+      level: "error",
+      maxSize: "20m",
+      maxFiles: "30d", // 错误日志保留30天
+      format: logFormat,
+    }),
+  ],
+});
+
+// 如果是生产环境,移除控制台输出
+if (process.env.NODE_ENV === "production") {
+  logger.remove(logger.transports[0]);
+}
+
+// 导出便捷方法
+module.exports = {
+  logger,
+
+  // 生成请求ID
+  generateRequestId,
+
+  /**
+   * 创建带上下文的 logger
+   */
+  createContextLogger(context) {
+    return {
+      debug: (message, meta = {}) => logger.debug(message, { ...context, ...meta }),
+      info: (message, meta = {}) => logger.info(message, { ...context, ...meta }),
+      warn: (message, meta = {}) => logger.warn(message, { ...context, ...meta }),
+      error: (message, meta = {}) => logger.error(message, { ...context, ...meta }),
+    };
+  },
+
+  // 带任务ID的日志方法
+  logWithTask(taskId, level, message, meta = {}) {
+    logger.log(level, message, { taskId, ...meta });
+  },
+
+  info(message, meta = {}) {
+    logger.info(message, meta);
+  },
+
+  error(message, meta = {}) {
+    logger.error(message, meta);
+  },
+
+  warn(message, meta = {}) {
+    logger.warn(message, meta);
+  },
+
+  debug(message, meta = {}) {
+    logger.debug(message, meta);
+  },
+};

package/src/metrics/collector.js

@@ -0,0 +1,184 @@
+const { logger } = require('../logger');
+
+/**
+ * 指标收集器
+ */
+class MetricsCollector {
+  constructor() {
+    this.metrics = {
+      tasks: {
+        total: 0,
+        completed: 0,
+        failed: 0,
+        cancelled: 0,
+      },
+      durations: [],
+      aiCalls: {
+        success: 0,
+        failure: 0,
+        totalTime: 0,
+      },
+      git: {
+        pushSuccess: 0,
+        pushFailure: 0,
+        mergeSuccess: 0,
+        mergeFailure: 0,
+      },
+      http: {
+        requests: 0,
+        errors: 0,
+        responseTime: [],
+      },
+    };
+  }
+
+  /**
+   * 记录任务完成
+   */
+  recordTaskComplete(duration, success) {
+    this.metrics.tasks.total++;
+
+    if (success) {
+      this.metrics.tasks.completed++;
+    } else {
+      this.metrics.tasks.failed++;
+    }
+
+    this.metrics.durations.push(duration);
+
+    // 只保留最近 100 条
+    if (this.metrics.durations.length > 100) {
+      this.metrics.durations.shift();
+    }
+  }
+
+  /**
+   * 记录任务取消
+   */
+  recordTaskCancelled() {
+    this.metrics.tasks.total++;
+    this.metrics.tasks.cancelled++;
+  }
+
+  /**
+   * 记录 AI 调用
+   */
+  recordAICall(duration, success) {
+    if (success) {
+      this.metrics.aiCalls.success++;
+    } else {
+      this.metrics.aiCalls.failure++;
+    }
+
+    this.metrics.aiCalls.totalTime += duration;
+  }
+
+  /**
+   * 记录 Git 操作
+   */
+  recordGitOperation(operation, success) {
+    const key = `${operation}${success ? 'Success' : 'Failure'}`;
+
+    if (this.metrics.git[key] !== undefined) {
+      this.metrics.git[key]++;
+    }
+  }
+
+  /**
+   * 记录 HTTP 请求
+   */
+  recordHTTPRequest(duration, isError = false) {
+    this.metrics.http.requests++;
+
+    if (isError) {
+      this.metrics.http.errors++;
+    }
+
+    this.metrics.http.responseTime.push(duration);
+
+    if (this.metrics.http.responseTime.length > 100) {
+      this.metrics.http.responseTime.shift();
+    }
+  }
+
+  /**
+   * 获取平均任务耗时
+   */
+  getAverageTaskDuration() {
+    if (this.metrics.durations.length === 0) return 0;
+
+    const sum = this.metrics.durations.reduce((a, b) => a + b, 0);
+    return Math.round(sum / this.metrics.durations.length);
+  }
+
+  /**
+   * 获取平均响应时间
+   */
+  getAverageResponseTime() {
+    if (this.metrics.http.responseTime.length === 0) return 0;
+
+    const sum = this.metrics.http.responseTime.reduce((a, b) => a + b, 0);
+    return Math.round(sum / this.metrics.http.responseTime.length);
+  }
+
+  /**
+   * 获取成功率
+   */
+  getSuccessRate() {
+    if (this.metrics.tasks.total === 0) return 100;
+
+    return Math.round(
+      (this.metrics.tasks.completed / this.metrics.tasks.total) * 100
+    );
+  }
+
+  /**
+   * 获取所有指标
+   */
+  getMetrics() {
+    return {
+      tasks: this.metrics.tasks,
+      performance: {
+        avgTaskDuration: this.getAverageTaskDuration(),
+        avgResponseTime: this.getAverageResponseTime(),
+        successRate: this.getSuccessRate(),
+      },
+      ai: {
+        ...this.metrics.aiCalls,
+        avgTime: this.metrics.aiCalls.success > 0
+          ? Math.round(this.metrics.aiCalls.totalTime / this.metrics.aiCalls.success)
+          : 0,
+      },
+      git: this.metrics.git,
+      http: {
+        total: this.metrics.http.requests,
+        errors: this.metrics.http.errors,
+        errorRate: this.metrics.http.requests > 0
+          ? Math.round((this.metrics.http.errors / this.metrics.http.requests) * 100)
+          : 0,
+      },
+    };
+  }
+
+  /**
+   * 重置指标
+   */
+  reset() {
+    this.metrics = {
+      tasks: { total: 0, completed: 0, failed: 0, cancelled: 0 },
+      durations: [],
+      aiCalls: { success: 0, failure: 0, totalTime: 0 },
+      git: {
+        pushSuccess: 0,
+        pushFailure: 0,
+        mergeSuccess: 0,
+        mergeFailure: 0,
+      },
+      http: { requests: 0, errors: 0, responseTime: [] },
+    };
+
+    logger.info('📊 指标已重置');
+  }
+}
+
+module.exports = new MetricsCollector();

package/src/middleware/auth.js

@@ -0,0 +1,86 @@
+const { logger } = require('../logger');
+const crypto = require('crypto');
+
+/**
+ * API Key 认证中间件（Koa 版本）
+ */
+function authenticateAPI(ctx, next) {
+  const apiKey = ctx.headers['x-api-key'];
+  const expectedKey = process.env.API_KEY;
+
+  // 如果未配置 API Key，则跳过验证
+  if (!expectedKey) {
+    logger.warn('⚠️ API_KEY 未配置，建议在生产环境中配置');
+    return next();
+  }
+
+  if (!apiKey) {
+    logger.warn('未授权的访问尝试 - 缺少 API Key', {
+      ip: ctx.ip,
+      path: ctx.path
+    });
+
+    ctx.status = 401;
+    ctx.body = {
+      success: false,
+      error: '未授权访问：缺少 API Key'
+    };
+    return;
+  }
+
+  // 使用时间常数比较防止时序攻击
+  const apiKeyBuffer = Buffer.from(apiKey);
+  const expectedKeyBuffer = Buffer.from(expectedKey);
+
+  if (apiKeyBuffer.length !== expectedKeyBuffer.length ||
+      !crypto.timingSafeEqual(apiKeyBuffer, expectedKeyBuffer)) {
+    logger.warn('未授权的访问尝试 - API Key 无效', {
+      ip: ctx.ip,
+      path: ctx.path
+    });
+
+    ctx.status = 401;
+    ctx.body = {
+      success: false,
+      error: '未授权访问：API Key 无效'
+    };
+    return;
+  }
+
+  return next();
+}
+
+/**
+ * IP 白名单中间件（Koa 版本）
+ */
+function ipWhitelist(ctx, next) {
+  const allowedIPs = (process.env.ALLOWED_IPS || '').split(',').map(ip => ip.trim()).filter(ip => ip);
+
+  // 如果未配置白名单，则跳过检查
+  if (allowedIPs.length === 0) {
+    return next();
+  }
+
+  const clientIP = ctx.ip;
+
+  if (!allowedIPs.includes(clientIP)) {
+    logger.warn('IP 不在白名单中', {
+      ip: clientIP,
+      path: ctx.path
+    });
+
+    ctx.status = 403;
+    ctx.body = {
+      success: false,
+      error: '访问被拒绝：IP 不在白名单中'
+    };
+    return;
+  }
+
+  return next();
+}
+
+module.exports = {
+  authenticateAPI,
+  ipWhitelist
+};

package/src/middleware/rate-limit.js

@@ -0,0 +1,85 @@
+const ratelimit = require("koa-ratelimit");
+const { logger } = require("../logger");
+
+/**
+ * 内存存储 Map（用于频率限制）
+ */
+const rateLimitDB = new Map();
+
+/**
+ * 创建速率限制器
+ * @param {Object} options - 配置选项
+ * @param {number} options.duration - 时间窗口（毫秒）
+ * @param {number} options.max - 最大请求数
+ * @param {string} options.name - 限制器名称
+ * @returns {Function} Koa 中间件
+ */
+function createRateLimiter(options = {}) {
+  const {
+    duration = 60 * 60 * 1000, // 0.5 分钟
+    max = 30, // 最多 30 个请求
+    name = "default",
+  } = options;
+
+  return ratelimit({
+    driver: "memory",
+    db: rateLimitDB,
+    duration, // 时间窗口（毫秒）
+    max, // 最大请求数
+    errorMessage: "请求过于频繁，请稍后再试",
+    id: (ctx) => ctx.ip, // 使用 IP 地址作为标识
+    headers: {
+      remaining: "Rate-Limit-Remaining",
+      reset: "Rate-Limit-Reset",
+      total: "Rate-Limit-Total",
+    },
+    disableHeader: false,
+    whitelist: (ctx) => {
+      // 跳过健康检查接口
+      if (ctx.path === "/health") {
+        return true;
+      }
+      return false;
+    },
+    handler: async (ctx) => {
+      logger.warn("请求频率超限", {
+        ip: ctx.ip,
+        path: ctx.path,
+        limiter: name,
+      });
+
+      ctx.status = 429;
+      ctx.body = {
+        success: false,
+        error: "请求过于频繁，请稍后再试",
+        retryAfter: Math.ceil(duration / 1000),
+      };
+    },
+  });
+}
+
+/**
+ * 通用 API 限流器
+ * 15 分钟内最多 20 个请求
+ */
+const apiLimiter = createRateLimiter({
+  duration: 10 * 1000,
+  max: 30,
+  name: "api",
+});
+
+/**
+ * 严格限流器（用于敏感接口）
+ * 1 小时内最多 20 个请求
+ */
+const strictLimiter = createRateLimiter({
+  duration: 60 * 60 * 1000,
+  max: 20,
+  name: "strict",
+});
+
+module.exports = {
+  apiLimiter,
+  strictLimiter,
+  createRateLimiter,
+};