chanjs 2.7.8 → 2.7.11

package/security/checker.js

@@ -15,21 +15,28 @@ const BODY_EXCLUDED_CATEGORIES = [
 ];
 
 /**
- * 恶意关键词检测：单次遍历预排序的分类列表，利用捕获组直接定位命中关键词
+ * 恶意关键词检测：单次遍历分类列表，利用捕获组直接定位命中关键词
  * @param {string} fullText 待检测文本
- * @param {{scope?: 'body'|'url'}} [options] scope='body' 时跳过路径/文件特征类规则，降低正文误报
+ * @param {{scope?: 'body'|'url', categories?: string[]}} [options]
+ *   - scope='body' 时跳过路径/文件特征类规则，降低正文误报；
+ *   - categories 显式指定要扫描的分类（用于 URL 场景，只保留真正危险分类，避免正常词误伤）；
+ *   - 二者都不传则扫描全部分类。
  * @returns {{category: string; keyword: string}|null}
  */
-export const checkKeywords = (fullText, { scope } = {}) => {
+export const checkKeywords = (fullText, { scope, categories } = {}) => {
   const text = fullText?.trim();
   if (!text) return null;
 
-  const cats = scope === 'body'
-    ? SORTED_CATEGORIES.filter(c => !BODY_EXCLUDED_CATEGORIES.includes(c))
-    : SORTED_CATEGORIES;
+  const cats = Array.isArray(categories)
+    ? categories
+    : (scope === 'body'
+      ? SORTED_CATEGORIES.filter(c => !BODY_EXCLUDED_CATEGORIES.includes(c))
+      : SORTED_CATEGORIES);
 
   for (const cat of cats) {
-    const match = keywordRegexCache[cat].merged.exec(text);
+    const re = keywordRegexCache[cat]?.merged;
+    if (!re) continue;
+    const match = re.exec(text);
     if (!match) continue;
     // capture[0]是整体匹配，capture[1..]是每个关键词的捕获组
     const idx = match.findIndex((g, i) => i > 0 && g);

package/security/keywords.js

@@ -22,11 +22,10 @@ const KEYWORD_RULES = Object.freeze({
   commandInjection: [
     "cmd=", "system(", "exec(", "shell_exec(", "passthru(",
     "eval(", "assert(", "preg_replace", "bash -i", "rm -rf",
-    "wget ", "curl ", "base64_decode", "phpinfo()",
+    "wget ", "base64_decode", "phpinfo()",
     "killall", "shutdown", "fdisk", "mkfs", "dd ",
     "scp ", "rsync", "nc ", "netcat", "nmap", "iptables",
-    "systemctl", "service", "crontab", "sudo", "useradd",
-    "userdel", "usermod", "groupadd", "groupdel", "passwd", "chpasswd"
+    "systemctl"
   ],
   pathTraversal: [
     "../", "..\\", "/etc/passwd", "/etc/shadow", "/etc/hosts",

package/utils/logger.js

@@ -1,117 +1,86 @@
-/**
- * 统一日志工具
- * 1. 本地dev：彩色友好打印
- * 2. 线上prd：JSON单行字符串输出，供日志采集器解析
- * 3. 日志分级控制 LOG_LEVEL，线上关闭调试日志减少磁盘占用
- * 4. error/fatal 自动走 stderr
- * 5. 支持自定义模块标签、本地文件落盘、错误堆栈结构化解析
- */
-import fs from "fs";
-import path from "path";
-import { parseStack } from "../core/errors.js";
-
-const LOG_LEVELS = Object.freeze({
-  trace: 0, debug: 1, info: 2, warn: 3, error: 4, fatal: 5, silent: 99,
-});
-
-const COLORS = Object.freeze({
-  trace: "\x1b[90m",
-  debug: "\x1b[34m",
-  info: "\x1b[32m",
-  warn: "\x1b[33m",
-  error: "\x1b[31m",
-  fatal: "\x1b[41m\x1b[37m",
-  reset: "\x1b[0m",
-});
-
-const ERROR_LEVELS = new Set(["error", "fatal"]);
+import pino from "pino";
 
 const NODE_ENV = (process.env.NODE_ENV || "dev").toLowerCase();
 const IS_PROD = ["prd", "prod", "production"].includes(NODE_ENV);
-const DEFAULT_LOG_LEVEL = IS_PROD ? "info" : "debug";
-const CURRENT_LEVEL = LOG_LEVELS[(process.env.LOG_LEVEL || DEFAULT_LOG_LEVEL).toLowerCase()] ?? LOG_LEVELS.info;
+const LOG_LEVEL = process.env.LOG_LEVEL || (IS_PROD ? "info" : "debug");
 
-const LOG_FILE = process.env.LOG_FILE || "";
-let writeStream = null;
-
-/** 判断当前级别是否允许输出 */
-const isLevelEnable = level => (LOG_LEVELS[level] ?? 99) >= CURRENT_LEVEL;
+/**
+ * pino 基础配置
+ * - dev：pino-pretty 彩色输出，单行易读
+ * - prod：纯 JSON，pm2 捕获 stdout
+ */
+const baseOptions = {
+  level: LOG_LEVEL,
+  timestamp: pino.stdTimeFunctions.isoTime,
+};
 
-/** 格式化毫秒级时间戳 YYYY-MM-DD HH:mm:ss.SSS */
-function getTime() {
-  const now = new Date();
-  const pad = (n, len = 2) => String(n).padStart(len, "0");
-  return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())} ${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}.${pad(now.getMilliseconds(), 3)}`;
+if (!IS_PROD) {
+  baseOptions.transport = {
+    target: "pino-pretty",
+    options: {
+      colorize: true,
+      translateTime: "yyyy-mm-dd HH:mm:ss.l",
+      // dev 终端只做单进程开发，module 恒为 "Chan" 无区分意义，隐藏以精简输出
+      // （prod 仍保留 module 字段，便于日志聚合时按模块过滤）
+      ignore: "pid,hostname,module",
+    },
+  };
 }
 
-/** 本地日志文件写入（仅开发环境） */
-function writeFile(line) {
-  if (!LOG_FILE.trim() || IS_PROD) return;
-  try {
-    if (!writeStream) {
-      const dir = path.dirname(LOG_FILE);
-      if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-      writeStream = fs.createWriteStream(LOG_FILE, { flags: "a" });
-      writeStream.on("error", () => {}); // 静默吞掉流异常，不阻塞业务
-      process.once("exit", () => writeStream?.end());
-    }
-    writeStream.write(`${line}\n`);
-  } catch { /* 写入失败静默 */ }
-}
+/** pino 根实例 */
+export const root = pino(baseOptions);
+
+/**
+ * 将多参数调用适配为 pino 格式
+ * 兼容现有用法：logger.info("msg")、logger.error("msg", err)、logger.warn("msg", obj)
+ *
+ * @param {string} level - 日志级别
+ * @param {import("pino").Logger} instance - pino 实例
+ * @param {...any} args - 业务传入的参数
+ */
+function emit(level, instance, ...args) {
+  const msgParts = [];
+  const mergeObj = {};
 
-/** 解析日志入参，分离普通文本与错误堆栈 */
-function parseArgs(args) {
-  let stackInfo = null;
-  const parts = [];
   for (const arg of args) {
     if (arg instanceof Error) {
-      const stackData = parseStack(arg.stack);
-      stackInfo = { ...stackData, raw: arg.stack };
-      parts.push(arg.message);
+      // Error 对象转为 pino 的 err 字段（自动序列化 stack）
+      mergeObj.err = arg;
+      msgParts.push(arg.message);
     } else if (arg !== null && typeof arg === "object") {
-      try { parts.push(JSON.stringify(arg)); }
-      catch { parts.push(String(arg)); }
+      Object.assign(mergeObj, arg);
     } else {
-      parts.push(arg);
+      msgParts.push(String(arg));
     }
   }
-  return { message: parts.join(" "), stackInfo };
-}
 
-/** 日志核心输出 */
-function emit(level, label, args) {
-  if (!isLevelEnable(level)) return;
+  const msg = msgParts.join(" ");
+  const hasMerge = Object.keys(mergeObj).length > 0;
 
-  const { message, stackInfo } = parseArgs(args);
-  const time = getTime();
-  const isErrLog = ERROR_LEVELS.has(level);
-  const printFn = isErrLog ? console.error : console.log;
-
-  if (IS_PROD) {
-    const logLine = JSON.stringify({ time, env: NODE_ENV, level, label, message, stack: stackInfo, pid: process.pid });
-    printFn(logLine);
-    return;
+  if (hasMerge) {
+    instance[level](mergeObj, msg);
+  } else {
+    instance[level](msg);
   }
-
-  const color = COLORS[level] ?? "";
-  printFn(`${color}[${time}] [${level.toUpperCase()}] [${label}]${COLORS.reset}`, ...args);
-  if (stackInfo) console.error(`${color}>>>> 错误堆栈详情:${COLORS.reset}`, stackInfo);
-  writeFile(`[${time}] [${level.toUpperCase()}] [${label}] ${message}`);
 }
 
-/** 创建带固定业务标签的日志实例 */
+/**
+ * 创建带固定标签的日志实例
+ * @param {string} [label="Chan"] - 模块标签
+ * @returns {{trace: Function, debug: Function, info: Function, warn: Function, error: Function, fatal: Function}}
+ */
 export function createLogger(label = "Chan") {
-  const safeLabel = String(label).trim() || "Chan";
-  const make = level => (...args) => emit(level, safeLabel, args);
+  const instance = root.child({ module: label });
   return {
-    trace: make("trace"),
-    debug: make("debug"),
-    info: make("info"),
-    warn: make("warn"),
-    error: make("error"),
-    fatal: make("fatal"),
+    trace: (...args) => emit("trace", instance, ...args),
+    debug: (...args) => emit("debug", instance, ...args),
+    info:  (...args) => emit("info", instance, ...args),
+    warn:  (...args) => emit("warn", instance, ...args),
+    error: (...args) => emit("error", instance, ...args),
+    fatal: (...args) => emit("fatal", instance, ...args),
   };
 }
 
+/** 默认导出：全局 logger 实例（标签 "Chan"） */
 const logger = createLogger("Chan");
 export default logger;

package/utils/pages.js

@@ -1,12 +1,8 @@
 /**
  * 分页工具函数
- * 样式采用 Tailwind CSS 原子类，紧凑精致布局
+ * 输出无 ul/li 的干净 HTML：普通页码直接用 <a>，当前页/禁用/省略号用 <span class="current|disabled|ellipsis">
+ * 样式由项目 CSS（如 .blince-pagination）统一维护，不依赖 Tailwind 等第三方框架
  */
-const LI_DISABLED = 'inline-flex items-center px-3 py-1.5 text-sm text-slate-400 cursor-not-allowed rounded-md border border-slate-100 bg-slate-50';
-const LI_ELLIPSIS = 'inline-flex items-center px-2 py-1.5 text-sm text-slate-400';
-const LI_CURRENT = 'inline-flex items-center px-3 py-1.5 text-sm font-medium text-white bg-lime-600 border border-lime-600 rounded-md';
-const LI_LINK = 'inline-flex items-center text-sm text-slate-700 bg-white border border-slate-200 rounded-md hover:border-lime-600 hover:text-lime-600 transition-colors';
-const A_LINK = 'block px-3 py-1.5';
 
 /**
  * 渲染分页HTML
@@ -26,8 +22,13 @@ export function pages(current, total, pageSize, href, query = '') {
   if (totalPage <= 1) return '';
   if (current > totalPage) current = totalPage;
 
-  const pageLink = (i, text) => `<li class="${i === current ? LI_CURRENT : LI_LINK}"><a class="${A_LINK}" href='${href}${i}.html${query}'>${text || i}</a></li>`;
-  const navLink = (i, text) => i ? pageLink(i, text) : `<li class="${LI_DISABLED}">${text}</li>`;
+  const pageLink = (i, text) => i === current
+    ? `<span class="current">${text || i}</span>`
+    : `<a href="${href}${i}.html${query}">${text || i}</a>`;
+  const navLink = (i, text) => i
+    ? pageLink(i, text)
+    : `<span class="disabled">${text}</span>`;
+  const ellipsis = () => `<span class="ellipsis">...</span>`;
   const items = [];
 
   // 上一页
@@ -38,14 +39,14 @@ export function pages(current, total, pageSize, href, query = '') {
     for (let i = 1; i <= totalPage; i++) items.push(pageLink(i));
   } else if (current <= 4) {
     for (let i = 1; i <= 5; i++) items.push(pageLink(i));
-    items.push(`<li class="${LI_ELLIPSIS}">...</li>`, pageLink(totalPage));
+    items.push(ellipsis(), pageLink(totalPage));
   } else if (current >= totalPage - 3) {
-    items.push(pageLink(1), `<li class="${LI_ELLIPSIS}">...</li>`);
+    items.push(pageLink(1), ellipsis());
     for (let i = totalPage - 4; i <= totalPage; i++) items.push(pageLink(i));
   } else {
-    items.push(pageLink(1), `<li class="${LI_ELLIPSIS}">...</li>`);
+    items.push(pageLink(1), ellipsis());
     for (let i = current - 1; i <= current + 1; i++) items.push(pageLink(i));
-    items.push(`<li class="${LI_ELLIPSIS}">...</li>`, pageLink(totalPage));
+    items.push(ellipsis(), pageLink(totalPage));
   }
 
   // 下一页

package/utils/signal.js

@@ -10,9 +10,16 @@ import { SHUTDOWN_TIMEOUT } from "../config/index.js";
 let registered = false;
 let shuttingDown = false;
 
-/** 关闭 HTTP 服务、缓存存储、数据库连接 */
+/**
+ * 优雅停机资源关闭顺序：
+ * 1. HTTP 服务 → 拒绝新连接
+ * 2. 定时任务 → 停止调度，防止停机期间仍触发任务
+ * 3. 缓存存储 → 关闭 Redis/内存
+ * 4. 数据库连接 → 释放连接池
+ * 5. 事件总线 → 清理监听器防内存泄漏
+ */
 async function doShutdown(chan) {
-  const { dbManager, server } = chan;
+  const { dbManager, server, task, event } = chan;
 
   if (server) {
     try {
@@ -25,6 +32,12 @@ async function doShutdown(chan) {
 
   const errors = [];
 
+  // 停止定时任务（同步操作，异常极少，单独捕获）
+  if (task) {
+    try { task.stopAll(); }
+    catch (e) { errors.push({ type: "task", err: e.message }); }
+  }
+
   try { await store.close(); }
   catch (e) { errors.push({ type: "store", err: e.message }); }
 
@@ -33,6 +46,12 @@ async function doShutdown(chan) {
     results.filter(item => !item.success).forEach(item => errors.push({ type: `db:${item.name}`, err: item.error }));
   }
 
+  // 清理事件总线全部监听器（防内存泄漏）
+  if (event) {
+    try { event.destroy(); }
+    catch (e) { errors.push({ type: "event", err: e.message }); }
+  }
+
   if (errors.length) logger.warn(`[Chan] 停机存在${errors.length}处资源关闭失败`, errors);
   setApp(null);
 }