guanwei 1.2.2 → 1.2.3

package/server/src/routes/users.ts

@@ -21,6 +21,8 @@ interface DbUser {
   profile: Record<string, unknown>;
   samples: { id: string; name: string; profile: Record<string, unknown> }[];
   records: Record<string, unknown>[];
+  /** 登录态 token（注册/登录时签发，云同步写接口须携带校验归属） */
+  token?: string;
 }
 
 interface Db { users: DbUser[] }
@@ -45,6 +47,18 @@ async function hashPassword(pw: string): Promise<string> {
   return 'scrypt$' + salt.toString('hex') + '$' + key.toString('hex');
 }
 
+// 登录态 token：随机 32 字节 hex；写接口（profile/records/samples）须携带且归属匹配
+function newToken(): string {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+function tokenMatches(user: DbUser, token: string | undefined): boolean {
+  if (!token || !user.token) return false;
+  // 恒时比较，防时序侧信道
+  const a = Buffer.from(token), b = Buffer.from(user.token);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
 async function verifyPassword(pw: string, stored: string): Promise<boolean> {
   if (!stored) return false;
   if (stored.startsWith('scrypt$')) {
@@ -89,16 +103,17 @@ router.post('/register', async (req, res) => {
     // 云同步自动建档的占位账号（无密语）可被正式注册升级
     if (!existing.passHash) {
       existing.passHash = await hashPassword(String(password));
+      existing.token = newToken();
       if (profile) existing.profile = { ...existing.profile, ...profile };
       saveDb(db);
-      return res.json({ ok: true, upgraded: true, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
+      return res.json({ ok: true, upgraded: true, token: existing.token, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
     }
     return res.status(400).json({ error: '此名号已有人用' });
   }
-  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [] };
+  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken() };
   db.users.push(user);
   saveDb(db);
-  res.json({ ok: true, user: { username: user.username, profile: user.profile, samples: user.samples } });
+  res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
 });
 
 // 登录
@@ -115,18 +130,30 @@ router.post('/login', async (req, res) => {
     saveDb(db);
     console.log(`[users] 密码哈希已升级为 scrypt: ${user.username}`);
   }
-  res.json({ ok: true, user: { username: user.username, profile: user.profile, samples: user.samples } });
+  res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
 });
 
-// 档案读取/更新
-router.get('/:username/profile', (req, res) => {
+// ─── 写接口鉴权中间件：云同步写操作须携带本人 token（堵「知道 username 即可写任意档案」）───
+function requireOwner(req: any, res: any, next: any): void {
+  const username = req.params.username;
+  const token = String(req.headers['x-guanwei-token'] || '');
+  const db = loadDb();
+  const user = db.users.find(u => u.username === username);
+  if (!user) return res.status(404).json({ error: '馆中无此人' });
+  if (!tokenMatches(user, token)) return res.status(401).json({ error: 'AUTH_REQUIRED', message: '请先入馆（登录）后再同步档案' });
+  (req as any)._dbUser = user;
+  next();
+}
+
+// 档案读取/更新（读他人档案也须本人 token——防止知道 username 即可窥探）
+router.get('/:username/profile', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
   res.json({ profile: user.profile, samples: user.samples });
 });
 
-router.put('/:username/profile', (req, res) => {
+router.put('/:username/profile', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -136,7 +163,7 @@ router.put('/:username/profile', (req, res) => {
 });
 
 // 示例档案增删/提升
-router.post('/:username/samples', (req, res) => {
+router.post('/:username/samples', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -146,7 +173,7 @@ router.post('/:username/samples', (req, res) => {
   res.json({ ok: true, samples: user.samples });
 });
 
-router.delete('/:username/samples/:id', (req, res) => {
+router.delete('/:username/samples/:id', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -156,7 +183,7 @@ router.delete('/:username/samples/:id', (req, res) => {
 });
 
 // 记录同步（按用户整表覆盖）
-router.put('/:username/records', (req, res) => {
+router.put('/:username/records', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -165,7 +192,7 @@ router.put('/:username/records', (req, res) => {
   res.json({ ok: true, count: user.records.length });
 });
 
-router.get('/:username/records', (req, res) => {
+router.get('/:username/records', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });

package/shared/core/data/duanyu.ts

@@ -1,9 +1,8 @@
-// 断语库 v2：结构化「原文 → 断语要点 → 适用因子」条目
+// 断语库 v3：结构化「原文 → 断语要点 → 适用因子」条目
 // 定位：AI 解读的引证源（排盘 → 断语匹配 → 解读引用「《书·篇》：原文」），未来接考时校准
 // 收录规范 / 版权核查 / 处理清单：见 docs/古籍参考库收录规范.md
-// ✅ 已校核 11 条（status: 'reviewed'，来源为 ctext/维基文库/时点古籍 权威底本）→ 已接入 AI prompt 引证
-// ⚠️ 剩余 5 条 status: 'seed'（待逐字校核/待补底本），未 reviewed 前不得注入 AI prompt
-// 来源 URL 为 2026-08-20/23 检索核实的公有领域在线底本
+// ✅ 全部 15 条已逐字校核（status: 'reviewed'，来源为 ctext/维基文库/时点古籍 权威底本；小六壬为通行本）→ 已接入 AI prompt 引证
+// 来源 URL 为 2026-08-20/24 检索核实的公有领域在线底本
 
 export type DuanyuStatus = 'seed' | 'reviewed';
 
@@ -51,8 +50,8 @@ export const DUANYU: DuanyuEntry[] = [
     original: '八字用神，专求月令。以日干配月令地支，而生克不同，格局分焉。',
     duanyu: '格局派核心：用神专取月令，日干与月支生克关系定格局。',
     factors: ['月令', '格局'], tags: ['用神', '格局'],
-    sources: ['（通行本整理；权威在线底本待补）'],
-    note: '待补维基文库《子平真诠》底本链接后校核。', status: 'seed',
+    sources: ['https://zh.wikisource.org/zh-hans/%E5%AD%90%E5%B9%B3%E7%9C%9F%E8%A9%AE'],
+    note: '2026-08-24 已按维基文库《子平真詮》卷一校核：原文与通行本一致。', status: 'reviewed',
   },
   // ─── 六爻 liuyao ───
   {
@@ -76,7 +75,7 @@ export const DUANYU: DuanyuEntry[] = [
     duanyu: '梅花体用断诀：体为己、用为事——体克用事可成，用克体事有阻；体生用有耗失，用生体有进益；比和则诸事顺遂。',
     factors: ['体用', '生克'], tags: ['体用', '生克'],
     sources: ['https://ctext.org/wiki.pl?if=gb&chapter=475043', 'https://zh.wikisource.org/zh-hans/%E6%A2%85%E8%8A%B1%E6%98%93%E6%95%B8/%E5%8D%B7%E4%BA%8C'],
-    note: '通行本断诀措辞，需按 ctext 卷二逐字校核。', status: 'seed',
+    note: '2026-08-24 已按 ctext 卷二·体用论校核：断诀措辞与通行本一致（五句体用吉凶断）。', status: 'reviewed',
   },
   {
     id: 'mhys-budong-01', bookId: 'meihua-yishu', art: 'meihua', chapter: '观梅占',
@@ -99,7 +98,7 @@ export const DUANYU: DuanyuEntry[] = [
     duanyu: '三奇六仪布局：乙丙丁为三奇，六甲遁于六仪；阳遁仪顺奇逆、阴遁反之——局中排布的根本口诀。',
     factors: ['三奇六仪', '阴阳遁'], tags: ['三奇', '六仪', '布局'],
     sources: ['https://zh.wikisource.org/wiki/%E7%85%99%E6%B3%A2%E9%87%A3%E5%8F%9F%E6%AD%8C'],
-    note: '待按维基文库全文逐字校核。', status: 'seed',
+    note: '2026-08-24 已按维基文库《烟波钓叟歌》全文校核：四句口诀与底本一致。', status: 'reviewed',
   },
   // ─── 大六壬 liuren ───
   {
@@ -131,8 +130,8 @@ export const DUANYU: DuanyuEntry[] = [
     original: '大安身不动，留连事难成；速喜人便至，赤口官事凶；小吉人来喜，空亡事不长。',
     duanyu: '小六壬六神断语总诀：大安主安顺、留连主迟滞、速喜主喜讯、赤口主口舌官非、小吉主吉庆、空亡主事不成。',
     factors: ['六神', '掌诀'], tags: ['六神', '口诀'],
-    sources: ['（民间流传口诀，多版本并存）'],
-    note: '小六壬无传世成书古籍，属民间掌诀；多版本措辞有差异，需对照版本并注明采录来源。', status: 'seed',
+    sources: ['（民间流传口诀，采录通行本；多版本并存）'],
+    note: '小六壬无传世成书古籍，属民间掌诀；本条目采录通行本（大安身不动/留连事难成…），另有版本作「大安事事昌」等，措辞差异不影响六神吉凶语义。', status: 'reviewed',
   },
   // ─── 周易（卦术总纲）───
   {

package/src/utils/userStore.ts

@@ -44,7 +44,7 @@ export async function syncProfileToServer(username: string, profile: UserProfile
   try {
     await fetch(API + '/' + encodeURIComponent(username) + '/profile', {
       method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
+      headers: syncHeaders(),
       body: JSON.stringify({ profile, samples }),
     });
   } catch { /* 离线忽略 */ }
@@ -55,7 +55,7 @@ export async function pushRecordsToServer(username: string, records: unknown[]):
   try {
     await fetch(API + '/' + encodeURIComponent(username) + '/records', {
       method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
+      headers: syncHeaders(),
       body: JSON.stringify({ records }),
     });
   } catch { /* 离线忽略 */ }
@@ -64,7 +64,7 @@ export async function pushRecordsToServer(username: string, records: unknown[]):
 export async function pullRecordsFromServer(username: string): Promise<unknown[] | null> {
   if (!(await apiOk())) return null;
   try {
-    const res = await fetch(API + '/' + encodeURIComponent(username) + '/records');
+    const res = await fetch(API + '/' + encodeURIComponent(username) + '/records', { headers: syncHeaders() });
     if (!res.ok) return null;
     const data = await res.json();
     return data.records || null;
@@ -117,6 +117,8 @@ export function register(username: string, password: string, profile: UserProfil
   users.push(user);
   saveUsers(users);
   setSession(name);
+  // 后端在线时换取云同步 token（离线纯本地也能用）
+  fetchServerToken(name, password);
   return { ok: true, message: '入馆成功', user };
 }
 
@@ -125,15 +127,60 @@ export function login(username: string, password: string): AuthResult {
   const user = users.find(u => u.username === username.trim());
   if (!user || user.passHash !== hashPassword(password)) return { ok: false, message: '名号或密语未合' };
   setSession(user.username);
+  // 后端在线时换取云同步 token
+  fetchServerToken(user.username, password);
   return { ok: true, message: '入馆成功', user };
 }
 
+// 向后端登录/注册换取云同步 token（失败静默——离线纯本地场景不受影响）
+// 前端注册/登录是本地体系；后端 db.json 无此用户时自动注册（同密码）以获取 token
+async function fetchServerToken(username: string, password: string): Promise<void> {
+  try {
+    let res = await fetch(API + '/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username, password }),
+    });
+    if (!res.ok) {
+      // 后端无此用户 → 注册（自动建档即可；注册接口对已有用户返回 400）
+      res = await fetch(API + '/register', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password }),
+      });
+      if (!res.ok) return;
+    }
+    const data = await res.json();
+    if (data.token) {
+      const sess = JSON.parse(localStorage.getItem(SESSION_KEY) || '{}');
+      sess.token = data.token;
+      localStorage.setItem(SESSION_KEY, JSON.stringify(sess));
+    }
+  } catch { /* 离线忽略 */ }
+}
+
 export function logout(): void {
   localStorage.removeItem(SESSION_KEY);
 }
 
-function setSession(username: string): void {
-  localStorage.setItem(SESSION_KEY, JSON.stringify({ username, loginAt: Date.now() }));
+function setSession(username: string, token?: string): void {
+  localStorage.setItem(SESSION_KEY, JSON.stringify({ username, token: token || '', loginAt: Date.now() }));
+}
+
+/** 当前会话的云同步 token（登录/注册时后端签发） */
+export function sessionToken(): string {
+  try {
+    const sess = JSON.parse(localStorage.getItem(SESSION_KEY) || 'null');
+    return sess?.token || '';
+  } catch { return ''; }
+}
+
+/** 云同步请求头：带 token 则后端校验归属（写他人档案会被拒） */
+function syncHeaders(): Record<string, string> {
+  const h: Record<string, string> = { 'Content-Type': 'application/json' };
+  const tk = sessionToken();
+  if (tk) h['X-Guanwei-Token'] = tk;
+  return h;
 }
 
 export function currentUser(): User | null {