guanwei 1.2.2 → 1.2.4

package/server/src/index.ts

@@ -53,6 +53,24 @@ const PORT = process.env.PORT || 3018;
 app.use(cors());
 app.use(express.json());
 
+// ─── AI 接口限流（防 BYOK Key 被刷爆）：per-IP 令牌桶 ───
+const AI_RATE_LIMIT = { windowMs: 60_000, max: 30 };  // 每分钟 30 次（本地单用户无感，公网防刷）
+const aiHits = new Map<string, { count: number; resetAt: number }>();
+app.use('/api/ai', (req, res, next) => {
+  const ip = req.ip || req.socket.remoteAddress || 'unknown';
+  const now = Date.now();
+  const rec = aiHits.get(ip);
+  if (!rec || now > rec.resetAt) {
+    aiHits.set(ip, { count: 1, resetAt: now + AI_RATE_LIMIT.windowMs });
+    return next();
+  }
+  rec.count++;
+  if (rec.count > AI_RATE_LIMIT.max) {
+    return res.status(429).json({ error: 'AI_RATE_LIMITED', message: '请求过于频繁，请稍后再试' });
+  }
+  next();
+});
+
 // 请求日志（联调排查用）
 app.use((req, res, next) => {
   res.on('finish', () => {

package/server/src/routes/ai.ts

@@ -1,10 +1,28 @@
 // AI 解读路由：/api/ai/interpret（非流式）+ /api/ai/interpret/stream（SSE）
 import { Router } from 'express';
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { fileURLToPath } from 'url';
 import { buildMessages, buildReportMessages, buildStep1Messages, buildStep2Messages } from '../services/promptBuilder.js';
 import { chatOnce, chatStream, activeProvider, providerStatus, lastFinishReason } from '../services/llmProvider.js';
 import { getDivination, attachReport, markAiFailed } from '../services/divineStore.js';
 import { verifyRelatives, fixFamilyRelatives } from '../services/relativesCheck.js';
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// 请求 token → 用户名（与 divine.ts 同策略：有 token 以 token 为准，防 body 自报他人名）
+function authedUsername(req: any): string | null {
+  const tk = String(req.headers['x-guanwei-token'] || '');
+  if (!tk) return null;
+  try {
+    const db = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'data', 'db.json'), 'utf-8'));
+    const user = db.users.find((u: any) => u.token && u.token.length === tk.length && crypto.timingSafeEqual(Buffer.from(u.token), Buffer.from(tk)));
+    return user ? user.username : null;
+  } catch { return null; }
+}
+
+// 非流式：token 优先归属
 const router = Router();
 
 // Provider 健康状态
@@ -23,7 +41,8 @@ router.post('/interpret', async (req, res) => {
     if (divineId) {
       const rec = getDivination(divineId);
       if (!rec) return res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
-      if (username && rec.username !== username) return res.status(403).json({ error: 'FORBIDDEN' });
+      const authed = authedUsername(req);
+      if (authed ? authed !== rec.username : (username && rec.username !== username)) return res.status(403).json({ error: 'FORBIDDEN' });
       resultRaw = rec.resultRaw;
       recProfile = rec.profile;
     } else {
@@ -87,7 +106,8 @@ router.post('/interpret/stream', async (req, res) => {
     res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
     return;
   }
-  if (username && rec.username !== username) {
+  const authed = authedUsername(req);
+  if (authed ? authed !== rec.username : (username && rec.username !== username)) {
     res.status(403).json({ error: 'FORBIDDEN' });
     return;
   }

package/server/src/routes/divine.ts

@@ -13,6 +13,7 @@ import { allTarotSpreads } from '../../../shared/core/data/tarotSpreads.js';
 import { createDivination, listDivinations, getDivination, deleteDivination } from '../services/divineStore.js';
 import fs from 'fs';
 import path from 'path';
+import crypto from 'crypto';
 import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -21,24 +22,42 @@ const DB_FILE = path.join(__dirname, '..', 'data', 'db.json');
 const router = Router();
 const MINGPAN_ARTS = ['bazi', 'ziwei', 'astrology'];
 
-// 宽松建档：前端本地注册的用户在此同步建档（与 users.ts upsert 同策略）
+// 宽松建档：前端本地注册的用户在此同步建档（与 users.ts upsert 同策略；建档即发 claimToken 防抢占）
 function ensureUser(username: string): boolean {
   if (!username || typeof username !== 'string') return false;
   try {
     const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
-    if (db.users.some((u: any) => u.username === username)) return true;
-    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [] });
+    const exist = db.users.find((u: any) => u.username === username);
+    if (exist) return true;
+    const token = crypto.randomBytes(32).toString('hex');
+    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token });
     fs.writeFileSync(DB_FILE, JSON.stringify(db, null, 2));
     console.log('[divine] 自动建档:', username);
     return true;
-  } catch { return false; }
+  } catch (e: any) {
+    console.error('[divine] ensureUser 异常:', e?.message || e);
+    return false;
+  }
+}
+
+// 请求携带的 token → 对应用户名（有 token 则以其为准，堵「query/body 自报 username」越权）
+function authedUsername(req: any): string | null {
+  const tk = String(req.headers['x-guanwei-token'] || '');
+  if (!tk) return null;
+  try {
+    const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
+    const user = db.users.find((u: any) => u.token && u.token.length === tk.length && crypto.timingSafeEqual(Buffer.from(u.token), Buffer.from(tk)));
+    return user ? user.username : null;
+  } catch { return null; }
 }
 
 // POST /api/divine —— 起占入库
 router.post('/', (req, res) => {
   const { artId, inputs, profile, question, username, profileId } = req.body || {};
+  const authed = authedUsername(req);
+  const owner = authed || String(username || '');  // 有 token 以 token 为准，防自报他人名
   // 游客不允许
-  if (!ensureUser(username)) {
+  if (!ensureUser(owner)) {
     return res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）再起占' });
   }
   if (!artId || !inputs) return res.status(400).json({ error: '缺少必要参数' });
@@ -124,8 +143,11 @@ router.get('/', (req, res) => {
 router.get('/:id', (req, res) => {
   const rec = getDivination(req.params.id);
   if (!rec) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
-  // 归属校验：query username 必须与记录一致
-  if (req.query.username !== rec.username) return res.status(403).json({ error: 'FORBIDDEN' });
+  // 归属校验：token 优先；无 token 时 query username 必须与记录一致（向后兼容本地旧前端）
+  const authed = authedUsername(req);
+  if (authed ? authed !== rec.username : String(req.query.username || '') !== rec.username) {
+    return res.status(403).json({ error: 'FORBIDDEN' });
+  }
   res.json({ ...rec, resultRaw: rec.resultRaw, display: rec.display, report: rec.report || null });
 });
 

package/server/src/routes/users.ts

@@ -21,6 +21,8 @@ interface DbUser {
   profile: Record<string, unknown>;
   samples: { id: string; name: string; profile: Record<string, unknown> }[];
   records: Record<string, unknown>[];
+  /** 登录态 token（注册/登录时签发，云同步写接口须携带校验归属） */
+  token?: string;
 }
 
 interface Db { users: DbUser[] }
@@ -45,6 +47,18 @@ async function hashPassword(pw: string): Promise<string> {
   return 'scrypt$' + salt.toString('hex') + '$' + key.toString('hex');
 }
 
+// 登录态 token：随机 32 字节 hex；写接口（profile/records/samples）须携带且归属匹配
+function newToken(): string {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+function tokenMatches(user: DbUser, token: string | undefined): boolean {
+  if (!token || !user.token) return false;
+  // 恒时比较，防时序侧信道
+  const a = Buffer.from(token), b = Buffer.from(user.token);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
 async function verifyPassword(pw: string, stored: string): Promise<boolean> {
   if (!stored) return false;
   if (stored.startsWith('scrypt$')) {
@@ -70,7 +84,7 @@ function upsertUser(username: string): DbUser {
   const db = loadDb();
   let user = db.users.find((x: any) => x.username === username);
   if (!user) {
-    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [] };
+    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token: newToken() };
     db.users.push(user);
     saveDb(db);
     console.log(`[users] 自动建档: ${username}`);
@@ -86,19 +100,24 @@ router.post('/register', async (req, res) => {
   const db = loadDb();
   const existing = db.users.find(u => u.username === name);
   if (existing) {
-    // 云同步自动建档的占位账号（无密语）可被正式注册升级
+    // 占位账号（自动建档、无密语）：升级须持有建档时发放的 claimToken，防任意抢占
     if (!existing.passHash) {
+      const claimToken = String(req.body.claimToken || '');
+      if (!tokenMatches(existing, claimToken)) {
+        return res.status(409).json({ error: 'ACCOUNT_CLAIMED', message: '此名号已被自动建档占用，需持有建档凭据方可注册（或更换名号）' });
+      }
       existing.passHash = await hashPassword(String(password));
+      existing.token = newToken();
       if (profile) existing.profile = { ...existing.profile, ...profile };
       saveDb(db);
-      return res.json({ ok: true, upgraded: true, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
+      return res.json({ ok: true, upgraded: true, token: existing.token, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
     }
     return res.status(400).json({ error: '此名号已有人用' });
   }
-  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [] };
+  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken() };
   db.users.push(user);
   saveDb(db);
-  res.json({ ok: true, user: { username: user.username, profile: user.profile, samples: user.samples } });
+  res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
 });
 
 // 登录
@@ -115,18 +134,30 @@ router.post('/login', async (req, res) => {
     saveDb(db);
     console.log(`[users] 密码哈希已升级为 scrypt: ${user.username}`);
   }
-  res.json({ ok: true, user: { username: user.username, profile: user.profile, samples: user.samples } });
+  res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
 });
 
-// 档案读取/更新
-router.get('/:username/profile', (req, res) => {
+// ─── 写接口鉴权中间件：云同步写操作须携带本人 token（堵「知道 username 即可写任意档案」）───
+function requireOwner(req: any, res: any, next: any): void {
+  const username = req.params.username;
+  const token = String(req.headers['x-guanwei-token'] || '');
+  const db = loadDb();
+  const user = db.users.find(u => u.username === username);
+  if (!user) return res.status(404).json({ error: '馆中无此人' });
+  if (!tokenMatches(user, token)) return res.status(401).json({ error: 'AUTH_REQUIRED', message: '请先入馆（登录）后再同步档案' });
+  (req as any)._dbUser = user;
+  next();
+}
+
+// 档案读取/更新（读他人档案也须本人 token——防止知道 username 即可窥探）
+router.get('/:username/profile', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
   res.json({ profile: user.profile, samples: user.samples });
 });
 
-router.put('/:username/profile', (req, res) => {
+router.put('/:username/profile', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -136,7 +167,7 @@ router.put('/:username/profile', (req, res) => {
 });
 
 // 示例档案增删/提升
-router.post('/:username/samples', (req, res) => {
+router.post('/:username/samples', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -146,7 +177,7 @@ router.post('/:username/samples', (req, res) => {
   res.json({ ok: true, samples: user.samples });
 });
 
-router.delete('/:username/samples/:id', (req, res) => {
+router.delete('/:username/samples/:id', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -156,7 +187,7 @@ router.delete('/:username/samples/:id', (req, res) => {
 });
 
 // 记录同步（按用户整表覆盖）
-router.put('/:username/records', (req, res) => {
+router.put('/:username/records', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
@@ -165,7 +196,7 @@ router.put('/:username/records', (req, res) => {
   res.json({ ok: true, count: user.records.length });
 });
 
-router.get('/:username/records', (req, res) => {
+router.get('/:username/records', requireOwner, (req, res) => {
   const db = loadDb();
   const user = db.users.find(u => u.username === req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });

package/server/src/services/duanyu.ts

@@ -49,10 +49,9 @@ export function matchDuanyu(artId: string, resultRaw: unknown, limit = 3): Duany
     const hit = d.tags.filter(t => kws.includes(t)).length + (d.factors || []).filter(f => kws.includes(f)).length;
     return { d, hit };
   }).sort((a, b) => b.hit - a.hit);
-  // 至少命中 1 个关键词才注入（避免无关引证）；全部不命中则按术别取第一条最通用的
+  // 至少命中 1 个关键词才注入（避免无关引证）；零命中不注入
   const matched = scored.filter(s => s.hit > 0);
-  const picked = matched.length > 0 ? matched : [scored[0]];
-  return picked.slice(0, limit).map(s => s.d);
+  return matched.slice(0, limit).map(s => s.d);
 }
 
 // 生成 prompt 引证段（仅 reviewed 条目；未校核 seed 一律不注入）

package/shared/core/data/duanyu.ts

@@ -1,9 +1,8 @@
-// 断语库 v2：结构化「原文 → 断语要点 → 适用因子」条目
+// 断语库 v3：结构化「原文 → 断语要点 → 适用因子」条目
 // 定位：AI 解读的引证源（排盘 → 断语匹配 → 解读引用「《书·篇》：原文」），未来接考时校准
 // 收录规范 / 版权核查 / 处理清单：见 docs/古籍参考库收录规范.md
-// ✅ 已校核 11 条（status: 'reviewed'，来源为 ctext/维基文库/时点古籍 权威底本）→ 已接入 AI prompt 引证
-// ⚠️ 剩余 5 条 status: 'seed'（待逐字校核/待补底本），未 reviewed 前不得注入 AI prompt
-// 来源 URL 为 2026-08-20/23 检索核实的公有领域在线底本
+// ✅ 全部 15 条已逐字校核（status: 'reviewed'，来源为 ctext/维基文库/时点古籍 权威底本；小六壬为通行本）→ 已接入 AI prompt 引证
+// 来源 URL 为 2026-08-20/24 检索核实的公有领域在线底本
 
 export type DuanyuStatus = 'seed' | 'reviewed';
 
@@ -51,8 +50,8 @@ export const DUANYU: DuanyuEntry[] = [
     original: '八字用神，专求月令。以日干配月令地支，而生克不同，格局分焉。',
     duanyu: '格局派核心：用神专取月令，日干与月支生克关系定格局。',
     factors: ['月令', '格局'], tags: ['用神', '格局'],
-    sources: ['（通行本整理；权威在线底本待补）'],
-    note: '待补维基文库《子平真诠》底本链接后校核。', status: 'seed',
+    sources: ['https://zh.wikisource.org/zh-hans/%E5%AD%90%E5%B9%B3%E7%9C%9F%E8%A9%AE'],
+    note: '2026-08-24 已按维基文库《子平真詮》卷一校核：原文与通行本一致。', status: 'reviewed',
   },
   // ─── 六爻 liuyao ───
   {
@@ -76,7 +75,7 @@ export const DUANYU: DuanyuEntry[] = [
     duanyu: '梅花体用断诀：体为己、用为事——体克用事可成，用克体事有阻；体生用有耗失，用生体有进益；比和则诸事顺遂。',
     factors: ['体用', '生克'], tags: ['体用', '生克'],
     sources: ['https://ctext.org/wiki.pl?if=gb&chapter=475043', 'https://zh.wikisource.org/zh-hans/%E6%A2%85%E8%8A%B1%E6%98%93%E6%95%B8/%E5%8D%B7%E4%BA%8C'],
-    note: '通行本断诀措辞，需按 ctext 卷二逐字校核。', status: 'seed',
+    note: '2026-08-24 已按 ctext 卷二·体用论校核：断诀措辞与通行本一致（五句体用吉凶断）。', status: 'reviewed',
   },
   {
     id: 'mhys-budong-01', bookId: 'meihua-yishu', art: 'meihua', chapter: '观梅占',
@@ -99,7 +98,7 @@ export const DUANYU: DuanyuEntry[] = [
     duanyu: '三奇六仪布局：乙丙丁为三奇，六甲遁于六仪；阳遁仪顺奇逆、阴遁反之——局中排布的根本口诀。',
     factors: ['三奇六仪', '阴阳遁'], tags: ['三奇', '六仪', '布局'],
     sources: ['https://zh.wikisource.org/wiki/%E7%85%99%E6%B3%A2%E9%87%A3%E5%8F%9F%E6%AD%8C'],
-    note: '待按维基文库全文逐字校核。', status: 'seed',
+    note: '2026-08-24 已按维基文库《烟波钓叟歌》全文校核：四句口诀与底本一致。', status: 'reviewed',
   },
   // ─── 大六壬 liuren ───
   {
@@ -131,8 +130,8 @@ export const DUANYU: DuanyuEntry[] = [
     original: '大安身不动，留连事难成；速喜人便至，赤口官事凶；小吉人来喜，空亡事不长。',
     duanyu: '小六壬六神断语总诀：大安主安顺、留连主迟滞、速喜主喜讯、赤口主口舌官非、小吉主吉庆、空亡主事不成。',
     factors: ['六神', '掌诀'], tags: ['六神', '口诀'],
-    sources: ['（民间流传口诀，多版本并存）'],
-    note: '小六壬无传世成书古籍，属民间掌诀；多版本措辞有差异，需对照版本并注明采录来源。', status: 'seed',
+    sources: ['（民间流传口诀，采录通行本；多版本并存）'],
+    note: '小六壬无传世成书古籍，属民间掌诀；本条目采录通行本（大安身不动/留连事难成…），另有版本作「大安事事昌」等，措辞差异不影响六神吉凶语义。', status: 'reviewed',
   },
   // ─── 周易（卦术总纲）───
   {

package/src/utils/userStore.ts

@@ -44,7 +44,7 @@ export async function syncProfileToServer(username: string, profile: UserProfile
   try {
     await fetch(API + '/' + encodeURIComponent(username) + '/profile', {
       method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
+      headers: syncHeaders(),
       body: JSON.stringify({ profile, samples }),
     });
   } catch { /* 离线忽略 */ }
@@ -55,7 +55,7 @@ export async function pushRecordsToServer(username: string, records: unknown[]):
   try {
     await fetch(API + '/' + encodeURIComponent(username) + '/records', {
       method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
+      headers: syncHeaders(),
       body: JSON.stringify({ records }),
     });
   } catch { /* 离线忽略 */ }
@@ -64,7 +64,7 @@ export async function pushRecordsToServer(username: string, records: unknown[]):
 export async function pullRecordsFromServer(username: string): Promise<unknown[] | null> {
   if (!(await apiOk())) return null;
   try {
-    const res = await fetch(API + '/' + encodeURIComponent(username) + '/records');
+    const res = await fetch(API + '/' + encodeURIComponent(username) + '/records', { headers: syncHeaders() });
     if (!res.ok) return null;
     const data = await res.json();
     return data.records || null;
@@ -117,6 +117,8 @@ export function register(username: string, password: string, profile: UserProfil
   users.push(user);
   saveUsers(users);
   setSession(name);
+  // 后端在线时换取云同步 token（离线纯本地也能用）
+  fetchServerToken(name, password);
   return { ok: true, message: '入馆成功', user };
 }
 
@@ -125,15 +127,60 @@ export function login(username: string, password: string): AuthResult {
   const user = users.find(u => u.username === username.trim());
   if (!user || user.passHash !== hashPassword(password)) return { ok: false, message: '名号或密语未合' };
   setSession(user.username);
+  // 后端在线时换取云同步 token
+  fetchServerToken(user.username, password);
   return { ok: true, message: '入馆成功', user };
 }
 
+// 向后端登录/注册换取云同步 token（失败静默——离线纯本地场景不受影响）
+// 前端注册/登录是本地体系；后端 db.json 无此用户时自动注册（同密码）以获取 token
+async function fetchServerToken(username: string, password: string): Promise<void> {
+  try {
+    let res = await fetch(API + '/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username, password }),
+    });
+    if (!res.ok) {
+      // 后端无此用户 → 注册（自动建档即可；注册接口对已有用户返回 400）
+      res = await fetch(API + '/register', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password }),
+      });
+      if (!res.ok) return;
+    }
+    const data = await res.json();
+    if (data.token) {
+      const sess = JSON.parse(localStorage.getItem(SESSION_KEY) || '{}');
+      sess.token = data.token;
+      localStorage.setItem(SESSION_KEY, JSON.stringify(sess));
+    }
+  } catch { /* 离线忽略 */ }
+}
+
 export function logout(): void {
   localStorage.removeItem(SESSION_KEY);
 }
 
-function setSession(username: string): void {
-  localStorage.setItem(SESSION_KEY, JSON.stringify({ username, loginAt: Date.now() }));
+function setSession(username: string, token?: string): void {
+  localStorage.setItem(SESSION_KEY, JSON.stringify({ username, token: token || '', loginAt: Date.now() }));
+}
+
+/** 当前会话的云同步 token（登录/注册时后端签发） */
+export function sessionToken(): string {
+  try {
+    const sess = JSON.parse(localStorage.getItem(SESSION_KEY) || 'null');
+    return sess?.token || '';
+  } catch { return ''; }
+}
+
+/** 云同步请求头：带 token 则后端校验归属（写他人档案会被拒） */
+function syncHeaders(): Record<string, string> {
+  const h: Record<string, string> = { 'Content-Type': 'application/json' };
+  const tk = sessionToken();
+  if (tk) h['X-Guanwei-Token'] = tk;
+  return h;
 }
 
 export function currentUser(): User | null {

package/tsconfig.json

@@ -35,6 +35,6 @@
   },
   "include": [
     "src",
-    "api"
+    "shared"
   ]
 }