free-be-account 0.0.21 → 0.0.23

package/index.js

@@ -7,7 +7,7 @@ var svgCaptcha = require('svg-captcha');
 const passport = require('passport');
 const LocalStrategy = require('passport-local').Strategy;
 const {v1: uuidv1} = require('uuid');
-const RedisStore = require("connect-redis").default;
+const { RedisStore } = require("connect-redis");
 const session = require("express-session");
 
 const crypto = require("./crypto");
@@ -27,7 +27,7 @@ try {
 let __app_service_list_saved = false;
 let __saved_service_list;
 
-const __getServiceList = async (res, filter = { Enabled: true }) => {
+const __getServiceList = async (res, filter = { Enabled: true }, scopeFilter) => {
     // add app.serviceList into db if not yet
     if (!__app_service_list_saved) {
         await res.app.modules.account.utils.saveServiceList(res.app);
@@ -36,7 +36,7 @@ const __getServiceList = async (res, filter = { Enabled: true }) => {
         return __saved_service_list;
     }
 
-    const allPerms = await res.app.models.permission.find(filter);
+    const allPerms = await res.app.models.permission.find(filter).lean();
 
     const permList = {};
     if (allPerms && allPerms.length > 0) {
@@ -58,18 +58,39 @@ const __getServiceList = async (res, filter = { Enabled: true }) => {
                         Description: doc.Description,
                         Index: doc.Index,
                     },
-                    // TODO: only add data scope when no filter provided, correct?
-                    filter ? {} : {
-                        Scope: filter ? undefined: doc.Scope.map(sc => {
-                            const dso = res.app.getContainerContent('DataScope').find(ds => ds.Name === sc.Name);
-                            return dso ? {
+                    ((doc.Scope || []).length <= 0) ? {} : {
+                        Scope: doc.Scope.map(sc => {
+                            const dso = app.getContainerContent('DataScope').find(ds => ds.Name === sc.Name);
+
+                            if (!dso) {
+                                return {};
+                            }
+                            
+                            // the final scope options
+                            let scopeOptions = [];
+
+                            if (!scopeFilter) {
+                                scopeOptions = dso.Options;
+                            } else {
+                                // get the scope filter of the current doc
+                                const scopeFilterOfTheCurrentDoc = (scopeFilter && scopeFilter[doc.Path]) || {};
+                                // get the option level of the filter
+                                const filterOptionValue = scopeFilterOfTheCurrentDoc[sc.Name] || dso.Default;
+                                const filterOption = dso.Options.find(o => o.Value === filterOptionValue);
+
+                                if (filterOption && (filterOption.Level !== void 0)) {
+                                    scopeOptions = dso.Options.filter(o => (o.Level !== void 0) && (o.Level <= filterOption.Level));
+                                }
+                            }
+
+                            return {
                                 Label: dso.Label || '',
                                 Field: `${sc.Name}`,
                                 Type: dso.Component || 'Select',
-                                Options: dso.Options || [],
+                                Options: scopeOptions || [],
                                 Multiple: dso.Multiple || false,
-                            } : {};
-                        })
+                            };
+                        }),
                     })
                 }
             }
@@ -637,14 +658,17 @@ module.exports = (app) => ({
                     {
                         Label: mdl.t('Self'),
                         Value: 'self',
+                        Level: 1, // Level越大，越高权限
                     },
                     {
                         Label: mdl.t('My Org'),
                         Value: 'org',
+                        Level: 10,
                     },
                     {
                         Label: mdl.t('All'),
                         Value: 'all',
+                        Level: 20,
                     }
                 ],
                 Default: 'self',
@@ -1139,6 +1163,7 @@ module.exports = (app) => ({
 
                     res.addData({
                         Name: (req.user.Profile && req.user.Profile.Name) || req.user.PhoneNumber || req.user.UserName || '',
+                        Account: req.user.PhoneNumber || req.user.UserName,
                         Avatar: req.user.Profile && req.user.Profile.Avatar ? req.user.Profile.Avatar : '',
                         Status: req.user.Status,
                     }, false);
@@ -1451,12 +1476,22 @@ module.exports = (app) => ({
                     }
 
                     let filter;
+                    let scopeFilter = {};
                     if (req.user.Permission !== '*') {
                         const permPathList = getPermissionPathList(req.user.Permission);
                         filter = { Path: { $in: permPathList } };
+
+                        for (let i = 0; i < permPathList.length; i += 1) {
+                            const p = permPathList[i];
+                            const pScope = Object.nestValue(req.user.Permission, p.replace(/^\//,'').replace(/\//g, '.'));
+
+                            if (pScope && pScope.Scope) {
+                                scopeFilter[p] = pScope.Scope;
+                            }
+                        }
                     }
 
-                    res.addData(await __getServiceList(res, filter));
+                    res.addData(await __getServiceList(res, filter, scopeFilter));
 
                     return next();
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-be-account",
-  "version": "0.0.21",
+  "version": "0.0.23",
   "main": "index.js",
   "license": "UNLICENSED",
   "repository": {
@@ -8,20 +8,21 @@
     "url": "https://github.com/freeeis/free-be-account.git"
   },
   "dependencies": {
-    "@alicloud/pop-core": "^1.7.13",
-    "axios": "^1.7.7",
-    "bcrypt": "^5.1.1",
-    "connect-redis": "^7.1.1",
+    "@alicloud/pop-core": "^1.8.0",
+    "axios": "^1.10.0",
+    "bcrypt": "^6.0.0",
+    "connect-redis": "^8.1.0",
     "crypto-js": "^4.2.0",
     "express-session": "^1.18.1",
     "js-md5": "^0.8.3",
-    "minimatch": "^10.0.1",
-    "nodemailer": "^6.9.16",
+    "minimatch": "^10.0.3",
+    "nodemailer": "^7.0.4",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
-    "semver": "^7.6.3",
+    "semver": "^7.7.2",
     "svg-captcha": "^1.4.0",
     "tar": "^7.4.3",
-    "uuid": "^11.0.2"
+    "tencentcloud-sdk-nodejs-sms": "^4.1.71",
+    "uuid": "^11.1.0"
   }
 }

package/routers/mgmt/route.js

@@ -128,7 +128,7 @@ router.get('/:id',
 );
 
 router.post('/', 
-    (req, res, next) => {
+    async (req, res, next) => {
         req.body.Status = AccountAuditStatus.Passed;
         req.body.Saved = true;
 
@@ -144,7 +144,58 @@ router.post('/',
         // make sure the provided permission is in the scope of the current user permission!!
         if(req.user.Permission){
             if(req.user.Permission !== '*') {
+                // 根据当前账号的权限，检查所传入的权限中的数据权限配置是否合理，
+                // 如果合理，将传入的数据权限保存，并合并到最后的权限中
+                const permPathList = router.mdl.utils.getPermissionPathList(req.body.Permission);
+                const allPerms = await res.app.models.permission.find({ 
+                    Path: { $in: permPathList } , 
+                    Enabled: true 
+                }).lean();
+
+                const dsScope = {};
+                for (let i = 0; i < allPerms.length; i += 1) {
+                    const p = allPerms[i].Path;
+                    const pDot = p.replace(/^\//, '').replace(/\//g, '.');
+                    const uPerm = Object.nestValue(req.user.Permission, pDot);
+                    const bPerm = Object.nestValue(req.body.Permission, pDot);
+
+                    if (uPerm && uPerm.Scope && bPerm && bPerm.Scope) {
+                        // 当前账号此权限中的数据权限定义
+                        for (let j = 0; j < (allPerms[i].Scope || []).length; j += 1) {
+                            const sc = allPerms[i].Scope[j];
+
+                            if (!uPerm.Scope[sc.Name] || !bPerm.Scope[sc.Name]) {
+                                continue;
+                            }
+
+                            const dso = res.app.getContainerContent('DataScope').find(ds => ds.Name === sc.Name);
+
+                            if (dso) {
+                                const dsoOptions = dso.Options || [];
+
+                                const dsOpOfCurrentUser = dsoOptions.find(o => o.Value === uPerm.Scope[sc.Name]);
+                                const dsOpInBody = dsoOptions.find(o => o.Value === bPerm.Scope[sc.Name]);
+
+                                if (dsOpOfCurrentUser 
+                                    && dsOpInBody
+                                ) {
+                                    if (
+                                        (dsOpOfCurrentUser.Level !== void 0) 
+                                        && (dsOpInBody.Level !== void 0)
+                                        && (dsOpInBody.Level <= dsOpOfCurrentUser.Level)
+                                    ) {
+                                        Object.setValue(dsScope, `${pDot}.Scope.${sc.Name}`, dsOpInBody.Value);
+                                    } else {
+                                        Object.setValue(dsScope, `${pDot}.Scope.${sc.Name}`, dsOpOfCurrentUser.Value);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+
                 req.body.Permission = Object.intersection(req.body.Permission, req.user.Permission);
+                Object.assign(req.body.Permission, dsScope);
             }
         } else {
             delete req.body.Permission;
@@ -215,7 +266,7 @@ router.post('/audit',
 );
 
 router.put('/',
-    (req, res, next) => {
+    async (req, res, next) => {
         if (req.body.Permission) {
             if (!clearPermission(req.body.Permission)) {
                 req.body.Permission = {};
@@ -228,7 +279,58 @@ router.put('/',
         // make sure the provided permission is in the scope of the current user permission!!
         if(req.user.Permission){
             if(req.user.Permission !== '*') {
+                // 根据当前账号的权限，检查所传入的权限中的数据权限配置是否合理，
+                // 如果合理，将传入的数据权限保存，并合并到最后的权限中
+                const permPathList = router.mdl.utils.getPermissionPathList(req.body.Permission);
+                const allPerms = await res.app.models.permission.find({ 
+                    Path: { $in: permPathList } , 
+                    Enabled: true 
+                }).lean();
+
+                const dsScope = {};
+                for (let i = 0; i < allPerms.length; i += 1) {
+                    const p = allPerms[i].Path;
+                    const pDot = p.replace(/^\//, '').replace(/\//g, '.');
+                    const uPerm = Object.nestValue(req.user.Permission, pDot);
+                    const bPerm = Object.nestValue(req.body.Permission, pDot);
+
+                    if (uPerm && uPerm.Scope && bPerm && bPerm.Scope) {
+                        // 当前账号此权限中的数据权限定义
+                        for (let j = 0; j < (allPerms[i].Scope || []).length; j += 1) {
+                            const sc = allPerms[i].Scope[j];
+
+                            if (!uPerm.Scope[sc.Name] || !bPerm.Scope[sc.Name]) {
+                                continue;
+                            }
+
+                            const dso = res.app.getContainerContent('DataScope').find(ds => ds.Name === sc.Name);
+
+                            if (dso) {
+                                const dsoOptions = dso.Options || [];
+
+                                const dsOpOfCurrentUser = dsoOptions.find(o => o.Value === uPerm.Scope[sc.Name]);
+                                const dsOpInBody = dsoOptions.find(o => o.Value === bPerm.Scope[sc.Name]);
+
+                                if (dsOpOfCurrentUser 
+                                    && dsOpInBody
+                                ) {
+                                    if (
+                                        (dsOpOfCurrentUser.Level !== void 0) 
+                                        && (dsOpInBody.Level !== void 0)
+                                        && (dsOpInBody.Level <= dsOpOfCurrentUser.Level)
+                                    ) {
+                                        Object.setValue(dsScope, `${pDot}.Scope.${sc.Name}`, dsOpInBody.Value);
+                                    } else {
+                                        Object.setValue(dsScope, `${pDot}.Scope.${sc.Name}`, dsOpOfCurrentUser.Value);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+
                 req.body.Permission = Object.intersection(req.body.Permission, req.user.Permission);
+                Object.assign(req.body.Permission, dsScope);
             }
         } else {
             delete req.body.Permission;

package/routers/perm/route.js

@@ -79,7 +79,7 @@ router.post('/',
             }
         }
 
-        req.body.Path = `${parent ? parent.Path + '/' : ''}${req.body.Name}`
+        req.body.Path = `${parent ? parent.Path : ''}/${req.body.Name}`
         req.body.BuiltIn = false;
 
         return next();

package/sms/index.js

@@ -3,6 +3,9 @@ const path = require('path');
 const AliyunCore = require('@alicloud/pop-core');
 const nodemailer = require('nodemailer');
 
+const submail = require('./platforms/submail');
+const tencent = require('./platforms/tencent');
+
 let global;
 
 if (fs.existsSync(path.resolve(__dirname, '../../../global.js'))) {
@@ -66,7 +69,18 @@ const _sms_lib = {
             });
 
             var codeAndValue = {};
-            codeAndValue[k.templateParamName] = v;
+            // codeAndValue[k.templateParamName] = v;
+
+            if (Array.isArray(k.templateParamName)) {
+                for (let i = 0; i < k.templateParamName.length; i += 1) {
+                    const paramName = k.templateParamName[i];
+                    if (paramName && v && v[paramName]) {
+                        codeAndValue[paramName] = v[paramName];
+                    }
+                }
+            } else {
+                codeAndValue[k.templateParamName] = v;
+            }
 
             var params = {
                 "PhoneNumbers": p,
@@ -106,7 +120,7 @@ const _sms_lib = {
                 }
             });
 
-            const result = await MAIL_TRANS.sendMail({ 
+            const result = await MAIL_TRANS[k.mail].sendMail({ 
                 from: k.from,
                 to: p,
                 subject: typeof k.title === 'function' ? k.title(v) : k.title,
@@ -121,6 +135,8 @@ const _sms_lib = {
             return result && result.accepted && result.accepted.length >= 1;
         }
     },
+    submail,
+    tencent,
 }
 
 module.exports = (app) => ({
@@ -137,7 +153,7 @@ module.exports = (app) => ({
         
         // const keys = (global && global.sms && global.sms[t]) || app.modules.account.config.sms.keys[t] || app.modules.account.config.sms.keys;
         
-        if (keys.platform) {
+        if (keys && keys.platform) {
             // should not send too frequent!
             const lastSentTime = await app.cache.get(`${p}_lastSentTime`);
             if (lastSentTime && (Date.now() - lastSentTime) < (keys.resentGap || (60 * 1000))) {
@@ -182,7 +198,7 @@ module.exports = (app) => ({
         let v = _generateMSG(f);
         return await this.send(p, v, c, t);
     },
-    verify: async function (p, v, del) {
+    verify: async function (p, v, del = true) {
         const cached = await app.cache.get(p);
 
         // clear cache if the code is correct

package/sms/platforms/submail.js

@@ -0,0 +1,70 @@
+const axios = require('axios');
+const crypto = require("crypto");
+
+const client = axios.create({
+    baseURL: 'https://api-v4.mysubmail.com',
+    timeout: 308 * 1000,
+    headers: {
+        'Content-Type':'application/json',
+    }
+});
+
+const sign = (appid, appkey, obj) => {
+    // 排序obj并转为json字符串
+    const bodyStr = Object.keys(obj).sort((a, b) => a > b ? 1 : (a < b ? -1 : 0)).map((k) => `${k}=${obj[k]}`).join('&');
+
+    // md5
+    var md5 = crypto.createHash('md5');
+
+    return md5.update(`${appid}${appkey}${bodyStr}${appid}${appkey}`).digest('hex');
+};
+
+// https://www.mysubmail.com/documents/OOVyh
+module.exports = {
+    send: async function (k, p, v) {
+        if (!k || !k.templateCode || !k.templateParamName) {
+            throw new Error('SMS parameters not configured correctly for platform (Submail)');
+        }
+
+        var codeAndValue = {};
+
+        if (Array.isArray(k.templateParamName)) {
+            for (let i = 0; i < k.templateParamName.length; i += 1) {
+                const paramName = k.templateParamName[i];
+                if (paramName && v && v[paramName]) {
+                    codeAndValue[paramName] = v[paramName];
+                }
+            }
+        } else {
+            codeAndValue[k.templateParamName] = v;
+        }
+
+        const requestBody = {
+            appid: k.appid,          // 在 SUBMAIL 应用集成中创建的短信应用 ID
+            to: p,                   // 收件人手机号码
+            project: k.templateCode, // 模版 ID
+            timestamp: Math.floor(Date.now() / 1000),   // Timestamp UNIX 时间戳
+            sign_type: 'md5',        // md5 or sha1 or normal
+            sign_version: 2,         // signature 加密计算方式(当 sign_version 传 2 时，vars 参数不参与加密计算)
+        };
+
+        const signature = sign(k.appid, k.appkey, requestBody);
+
+        return await client.post('/sms/xsend', {
+            ...requestBody,
+            signature,                          // 应用密匙或数字签名
+            vars: JSON.stringify(codeAndValue), // 使用文本变量动态控制短信中的文本。
+            // sms_signature: '',               // 自定义短信签名，如果忽略此参数，将使用模板的默认签名作为签名（此参数不参与加密计算）
+        }).then(({data}) => {
+            if (data.status === 'success') {
+                return true;
+            } else {
+                console.error('SMS send error:', data.msg);
+            }
+
+            return false;            
+        }).catch(() => {
+            return false;
+        });
+    }
+};

package/sms/platforms/tencent.js

@@ -0,0 +1,73 @@
+const tencentcloud = require("tencentcloud-sdk-nodejs-sms");
+
+const smsClient = tencentcloud.sms.v20210111.Client;
+
+// https://cloud.tencent.com/document/product/382/55981
+module.exports = {
+    send: async function (k, p, v) {
+        if (!k || !k.SecretId || !k.SecretKey || !k.appid || !k.templateCode || !k.signName || !k.templateParamName) {
+            throw new Error('SMS parameters not configured correctly for platform (Tencent)');
+        }
+
+        var paramValues = [];
+
+        if (Array.isArray(k.templateParamName)) {
+            for (let i = 0; i < k.templateParamName.length; i += 1) {
+                const paramName = k.templateParamName[i];
+                if (paramName && v && v[paramName]) {
+                    paramValues.push(v[paramName]);
+                }
+            }
+        } else {
+            paramValues.push(v);
+        }
+
+        const client = new smsClient({
+            credential: {
+                secretId: k.SecretId,
+                secretKey: k.SecretKey,
+            },
+            region: "ap-beijing",
+            // 可选配置实例
+            profile: {
+                signMethod: "TC3-HMAC-SHA256", // 签名方法
+                httpProfile: {
+                    reqMethod: "POST", // 请求方法
+                    reqTimeout: 30, // 请求超时时间，默认60s
+                    headers: {
+                        Action: 'SendSms',
+                        Region: 'ap-beijing',
+                        Version: '2021-01-11',
+                        Language: 'zh-CN',
+                    },
+                },
+            },
+        });
+
+        return await client
+            .SendSms({
+                PhoneNumberSet: [p],
+
+                SmsSdkAppId: k.appid,
+                TemplateId: k.templateCode,
+                SignName: k.signName,
+
+                TemplateParamSet: paramValues,
+            })
+            .then((response) => {
+                const data = (response.SendStatusSet || [])[0] || {};
+
+                if (data.Code === 'Ok') {
+                    return true;
+                } else {
+                    console.error('SMS send error:', data.Code);
+                }
+
+                return false;
+            })
+            .catch((err) => {
+                console.log('SMS send error:', err);
+                return false;
+            });
+    }
+};

package/utils.js

@@ -49,7 +49,9 @@ function clearPermission(perm) {
             }
         });
 
-        // TODO: add a field if nothing here, otherwise the db will not save it??? should be fixed!!
+        // add a field if nothing here, otherwise the db will not save it??? should be fixed!!
+        // fixed by disabling the minimize option in mongoose, but we still should add this field
+        // so we can indicate whether the account has this permission clearly
         if (Object.keys(p).length <= 0) {
             p.has = true;
         }