free-be-account 0.0.25 → 0.0.27

package/index.js

@@ -451,6 +451,16 @@ module.exports = (app) => ({
             Read: { type: 'Boolean', default: false },
             Category: { type: 'String' },
         },
+
+        // 静态资源访问权限控制
+        staticResourcePermissionControl: {
+            User: { type: 'String', refer: 'account', required: true }, // 创建用户
+            ResourcePath: { type: 'String', index: true, required: true, unique: true }, // 资源路径
+
+            Users: { type: 'String' },       // 逗号分割的字符串，每一个代表一个允许访问的用户ID, self代表资源创建者本人
+            Referers: { type: 'String' },    // 逗号分割的字符串，每一个代表一个允许访问的来源
+            Permissions: { type: 'String' }, // 逗号分割的字符串，每一个代表一个api路径
+        },
     },
     utils: {
         verify_api_permission,
@@ -959,7 +969,7 @@ module.exports = (app) => ({
                             }).then(async (user) => {
                                 if (!user) { 
                                     // auto create new user
-                                    if (m.config.autoCreateNewUser && await app.modules['account'].verify(username, password)) {
+                                    if (m.config.autoCreateNewUser && await app.modules['account'].sms.verify(username, password)) {
                                         const valid_phone = (d) => {
                                             return /^(0|86|17951)?(13[0-9]|14[0-9]|15[0-9]|16[0-9]|17[0-9]|18[0-9]|19[0-9])[0-9]{8}$/.test(d);
                                         };
@@ -1106,7 +1116,12 @@ module.exports = (app) => ({
                 // update token in cookies
                 const token = req.cookies.token;
                 if (token) {
-                    res.cookie('token', token, { maxAge: app.config['cookieTimeout'] });
+                    res.cookie('token', token, {
+                        httpOnly: true,     // 防止 XSS 读取
+                        secure: true,       // 仅 HTTPS 传输
+                        sameSite: 'strict', // CSRF 防护
+                        maxAge: app.config['cookieTimeout'],
+                    });
                 }
 
                 // check for force reset pwd
@@ -1159,7 +1174,12 @@ module.exports = (app) => ({
                         token = await generate_new_access_token_pwd(app, req.user.id, access_token, null, req.user.isWx);
                     }
 
-                    res.cookie('token', token, { maxAge: app.config['cookieTimeout'] });
+                    res.cookie('token', token, {
+                        httpOnly: true,     // 防止 XSS 读取
+                        secure: true,       // 仅 HTTPS 传输
+                        sameSite: 'strict', // CSRF 防护
+                        maxAge: app.config['cookieTimeout'],
+                    });
 
                     res.addData({
                         Name: (req.user.Profile && req.user.Profile.Name) || req.user.PhoneNumber || req.user.UserName || '',
@@ -1550,6 +1570,153 @@ module.exports = (app) => ({
             }
         },
         onRoutersReady: async (app, m) => {
+            // file uploads
+            app.post(
+                `${app.config.baseUrl}/upload`,
+                async (req, res, next) => {
+                    if (!res.locals.data?.id) return next();
+                    if (!req.body?.perms && !req.body?.refs && !req.body?.users) return next();
+
+                    // save the permission control info
+                    const assetsFilePath = res.locals.data?.id.split(/[\\|/]/g).slice(-2).join('/');
+                    await app.models.staticResourcePermissionControl.create({
+                        User: req.user?.id,
+                        ResourcePath: assetsFilePath,
+
+                        Users: req.body?.users || '',
+                        Permissions: req.body?.perms || '',
+                        Referers: req.body?.refs || '',
+                    })
+        
+                    return next();
+                }
+            );
+            // multiple files upload
+            app.post(
+                `${app.config.baseUrl}/uploads`,
+                async (req, res, next) => {
+                    if (!res.locals.data?.length) return next();
+                    if (!req.body?.perms && !req.body?.refs && !req.body?.users) return next();
+
+                    // save the permission control info
+                    for (let i = 0; i < res.loals.data.length; i += 1) {
+                        const resi = res.locals.data[i];
+                        if (!resi?.id) continue;
+
+                        const assetsFilePath = resi?.id.split(/[\\|/]/g).slice(-2).join('/');
+                        await app.models.staticResourcePermissionControl.create({
+                            User: req.user?.id,
+                            ResourcePath: assetsFilePath,
+
+                            Users: req.body?.users || '',
+                            Permissions: req.body?.perms || '',
+                            Referers: req.body?.refs || '',
+                        })
+                    }
+        
+                    return next();
+                }
+            );
+
+            // 静态资源身份验证
+            async function checkPerm (req) {
+                // 验证是静态资源请求
+                const assetsPath = req.originalUrl;
+                if (!assetsPath || !assetsPath.startsWith(app.config.assetsUrlPrefix)) {
+                    return false;
+                }
+
+                // 获取当前资源的权限控制
+                const assetsFilePath = assetsPath.replace(app.config.assetsUrlPrefix, '').split(/[\\|/]/g).slice(-2).join('/');
+                const assetsPerm = await app.models.staticResourcePermissionControl.findOne({ ResourcePath: assetsFilePath }).lean();
+
+                // 如果没有保存对应的权限控制，说明是公开资源
+                if (!assetsPerm || (!assetsPerm.Users && !assetsPerm.Permissions && !assetsPerm.Referers)) {
+                    return true;
+                }
+
+                // 验证referer。并不完全可靠，但能防一部分无脑盗链
+                // 配置可能太复杂，所以先不需要
+                const neededReferer = assetsPerm.Referers || '';
+
+                // check referrer
+                const referer = req.get('Referer') || '';
+                let refererPath = '/';
+                try {
+                    const urlObj = new URL(referer);
+                    refererPath = urlObj.pathname;
+                } catch (ex) {
+                    refererPath = '/';
+                }
+
+                if (!refererPath || refererPath === '/') {
+                    return false;
+                }
+
+                const refererMatched = /^\/pdfjs(_.+)?\/web\/viewer.html$/.test(refererPath) || neededReferer.split(/,|，/).map((nr) => new RegExp(nr)).some((reg) => reg.test(refererPath));
+
+                if (!refererMatched) {
+                    return false;
+                }
+
+                // 验证host。并不完全可靠，但能防一部分无脑盗链
+                const host = req.get('Host') || '';
+
+                if (!host || (app.config.host !== host && app.config.host !== `https://${host}` && app.config.host !== `http://${host}`)) {
+                    return false;
+                }
+
+                // 验证用户
+                const neededUsers = assetsPerm.Users || '';
+                if (neededUsers) {
+                    if (!req.user?.id) return false;
+
+                    const userList = neededUsers.split(/,|，/) || [];
+                    let userMatched = false;
+                    for (let i = 0; i < userList.length; i += 1) {
+                        const u = userList[i];
+                        if ((u.toLowerCase() === 'self' && req.user.id === assetsPerm.User.toString()) || req.user.id === u) {
+                            userMatched = true;
+                            break;
+                        }
+                    }
+
+                    if (!userMatched) {
+                        return false;
+                    }
+                }
+
+                // 验证权限
+                const neededPerms = assetsPerm.Permissions || '';
+                const permList = neededPerms.split(/,|，/) || [];
+                if (permList.length <= 0) {
+                    return true;
+                }
+
+                // 验证权限列表
+                if (!req.user?.id) {
+                    return false;
+                }
+
+                let hasPerm = false;
+                for (let i = 0; i < permList.length; i += 1) {
+                    const p = permList[i];
+                    if (verify_api_permission(req.app, m, req.user, p)) {
+                        hasPerm = true;
+                        break;
+                    }
+                }
+
+                return hasPerm;
+            }
+            app.use(`/assets`, async (req, res, next) => {
+                if (await checkPerm(req)) {
+                    return next()
+                } else {
+                    res.status(404).end();
+                }
+            });
+
             // create default user if it's an empty db
             if (await m.models['account'].countDocuments({}) <= 0) {
                 // let perms = app.ctx.serviceList()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-be-account",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "main": "index.js",
   "license": "UNLICENSED",
   "repository": {

package/sms/index.js

@@ -136,6 +136,9 @@ const _sms_lib = {
         }
     },
     submail,
+    submail_mail: {
+        send: submail.sendMail,
+    },
     tencent,
 }
 

package/sms/platforms/submail.js

@@ -39,11 +39,14 @@ module.exports = {
             codeAndValue[k.templateParamName] = v;
         }
 
+        const tsResponse = await client.get('/service/timestamp');
+        const ts = (tsResponse && tsResponse.data && tsResponse.data.timestamp) || Math.floor(Date.now() / 1000);
+        
         const requestBody = {
             appid: k.appid,          // 在 SUBMAIL 应用集成中创建的短信应用 ID
             to: p,                   // 收件人手机号码
             project: k.templateCode, // 模版 ID
-            timestamp: Math.floor(Date.now() / 1000),   // Timestamp UNIX 时间戳
+            timestamp: `${ts}`,      // Timestamp UNIX 时间戳
             sign_type: 'md5',        // md5 or sha1 or normal
             sign_version: 2,         // signature 加密计算方式(当 sign_version 传 2 时，vars 参数不参与加密计算)
         };
@@ -66,5 +69,42 @@ module.exports = {
         }).catch(() => {
             return false;
         });
-    }
+    },
+    sendMail: async function (k, p, v) {
+        if (!k || !k.appid || !k.appkey) {
+            throw new Error('Email parameters not configured correctly for platform (Submail)');
+        }
+
+        const tsResponse = await client.get('/service/timestamp');
+        const ts = (tsResponse && tsResponse.data && tsResponse.data.timestamp) || Math.floor(Date.now() / 1000);
+        
+        const requestBody = {
+            appid: k.appid,          // 在 SUBMAIL 应用集成中创建的邮件应用 ID
+            from: k.from,                // 发件人邮箱地址
+            to: p,                       // 收件人邮箱地址
+            timestamp: `${ts}`,               // Timestamp UNIX 时间戳
+            sign_type: 'md5',            // md5 or sha1 or normal
+            sign_version: 2,             // signature 加密计算方式(当 sign_version 传 2 时，vars 参数不参与加密计算)
+        };
+
+        const signature = sign(k.appid, k.appkey, requestBody);
+
+        return await client.post('/mail/send', {
+            ...requestBody,
+            subject: typeof k.title === 'function' ? k.title(v) : k.title,         // 邮件标题
+            html: typeof k.template === 'function' ? k.template(v) : k.template,   // 邮件 HTML 内容
+            signature,                   // 应用密匙或数字签名
+        }).then(({data}) => {
+            if (data.status === 'success') {
+                return true;
+            } else {
+                console.error('Email send error:', data.msg);
+            }
+
+            return false;            
+        }).catch((error) => {
+            console.error('Email send exception:', error);
+            return false;
+        });
+    },
 };