guanwei 1.2.6 → 1.2.7

package/server/src/routes/ai.ts

@@ -22,6 +22,20 @@ function authedUsername(req: any): string | null {
   } catch { return null; }
 }
 
+
+// 解读归属校验（与 divine.resolveOwner 同策略）：正式账号须本人 token，占位账号兼容无 token
+function canReadChart(req: any, recUsername: string, fallbackUsername: string): boolean {
+  const authed = authedUsername(req);
+  if (authed) return authed === recUsername;
+  // 无 token：仅当目标是占位账号（未正式注册）时允许 fallback username
+  if (fallbackUsername && fallbackUsername !== recUsername) return false;
+  try {
+    const db = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'data', 'db.json'), 'utf-8'));
+    const user = db.users.find((u: any) => u.username === recUsername);
+    return !user || !user.passHash;  // 占位账号放行
+  } catch { return true; }
+}
+
 // 非流式：token 优先归属
 const router = Router();
 
@@ -41,8 +55,7 @@ router.post('/interpret', async (req, res) => {
     if (divineId) {
       const rec = getDivination(divineId);
       if (!rec) return res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
-      const authed = authedUsername(req);
-      if (authed ? authed !== rec.username : (username && rec.username !== username)) return res.status(403).json({ error: 'FORBIDDEN' });
+      if (!canReadChart(req, rec.username, String(username || ''))) return res.status(403).json({ error: 'FORBIDDEN' });
       resultRaw = rec.resultRaw;
       recProfile = rec.profile;
     } else {
@@ -106,8 +119,7 @@ router.post('/interpret/stream', async (req, res) => {
     res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
     return;
   }
-  const authed = authedUsername(req);
-  if (authed ? authed !== rec.username : (username && rec.username !== username)) {
+  if (!canReadChart(req, rec.username, String(username || ''))) {
     res.status(403).json({ error: 'FORBIDDEN' });
     return;
   }

package/server/src/routes/divine.ts

@@ -23,20 +23,21 @@ const router = Router();
 const MINGPAN_ARTS = ['bazi', 'ziwei', 'astrology'];
 
 // 宽松建档：前端本地注册的用户在此同步建档（与 users.ts upsert 同策略；建档即发 claimToken 防抢占）
-function ensureUser(username: string): boolean {
-  if (!username || typeof username !== 'string') return false;
+// 返回 null=失败；否则 { existed: 是否已存在, claimToken: 该账号当前 token（新建时返回，供前端保存用于后续注册升级）}
+function ensureUser(username: string): { existed: boolean; claimToken: string } | null {
+  if (!username || typeof username !== 'string') return null;
   try {
     const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
     const exist = db.users.find((u: any) => u.username === username);
-    if (exist) return true;
+    if (exist) return { existed: true, claimToken: exist.token || '' };
     const token = crypto.randomBytes(32).toString('hex');
-    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token });
+    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token, tokenExpires: Date.now() + 30 * 24 * 3600 * 1000 });
     fs.writeFileSync(DB_FILE, JSON.stringify(db, null, 2));
     console.log('[divine] 自动建档:', username);
-    return true;
+    return { existed: false, claimToken: token };
   } catch (e: any) {
     console.error('[divine] ensureUser 异常:', e?.message || e);
-    return false;
+    return null;
   }
 }
 
@@ -51,15 +52,41 @@ function authedUsername(req: any): string | null {
   } catch { return null; }
 }
 
+// 归属校验统一入口：
+// - 带有效 token → 以 token 用户为准（堵自报 username 越权）
+// - 无 token：
+//   · 目标为占位账号（passHash 空，自动建档/未正式注册）→ 允许（本地单机流程）
+//   · 目标为正式账号（注册过，passHash 非空）→ 401（必须持本人 token，H-NEW1~3）
+// 返回 { owner, isPlaceholder }；null = 校验失败（已 res 响应）
+function resolveOwner(req: any, res: any, fallbackUsername: string): { owner: string; isPlaceholder: boolean } | null {
+  const authed = authedUsername(req);
+  let owner = authed || String(fallbackUsername || '');
+  if (!owner) { res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）' }); return null; }
+  let user: any = null;
+  try {
+    const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
+    user = db.users.find((u: any) => u.username === owner) || null;
+  } catch { /* 读失败按占位处理 */ }
+  const isPlaceholder = !user || !user.passHash;
+  if (!authed && !isPlaceholder) {
+    // 无 token 但目标是正式账号 → 拒绝（防自报他人 username 越权）
+    res.status(401).json({ error: 'AUTH_REQUIRED', message: '请先入馆（登录）后操作' });
+    return null;
+  }
+  return { owner, isPlaceholder };
+}
+
 // POST /api/divine —— 起占入库
 router.post('/', (req, res) => {
   const { artId, inputs, profile, question, username, profileId } = req.body || {};
-  const authed = authedUsername(req);
-  const owner = authed || String(username || '');  // 有 token 以 token 为准，防自报他人名
-  // 游客不允许
-  if (!ensureUser(owner)) {
+  const resolved = resolveOwner(req, res, String(username || ''));
+  if (!resolved) return;
+  const owner = resolved.owner;
+  const ensured = ensureUser(owner);
+  if (!ensured) {
     return res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）再起占' });
   }
+  const claimToken = ensured.claimToken;  // 新建占位账号时返回，供前端保存（L-NEW1）
   if (!artId || !inputs) return res.status(400).json({ error: '缺少必要参数' });
 
   let resultRaw: unknown;
@@ -120,41 +147,49 @@ router.post('/', (req, res) => {
 
   const kind = MINGPAN_ARTS.includes(artId) ? 'mingpan' : 'zhanwen';
   const rec = createDivination({
-    username, artId, kind,
+    username: owner, artId, kind,
     question: question || undefined,
     profileId: profileId || 'main',
     profile: profile || undefined,
     params: inputs,
     resultRaw,
   });
-  res.json({ ok: true, divineId: rec.id, resultRaw, display: rec.display });
+  const authed = authedUsername(req);
+  res.json({
+    ok: true, divineId: rec.id, resultRaw, display: rec.display,
+    // L-NEW1：请求未带 token（本地占位流程）→ 返回 claimToken，前端保存后注册可升级；带 token 则无需
+    claimToken: authed ? undefined : ensured.claimToken,
+  });
 });
 
-// GET /api/divine?username=&page=&pageSize= —— 占卜历史
+// GET /api/divine?username=&page=&pageSize= —— 占卜历史（H-NEW2：正式账号须本人 token）
 router.get('/', (req, res) => {
   const username = String(req.query.username || '');
   const page = Number(req.query.page || 1);
   const pageSize = Number(req.query.pageSize || 20);
-  if (!ensureUser(username)) return res.status(401).json({ error: 'UNAUTHORIZED' });
-  res.json(listDivinations(username, page, pageSize, String(req.query.profileId || '')));
+  const resolved = resolveOwner(req, res, username);
+  if (!resolved) return;
+  if (!ensureUser(resolved.owner)) return res.status(401).json({ error: 'UNAUTHORIZED' });
+  res.json(listDivinations(resolved.owner, page, pageSize, String(req.query.profileId || '')));
 });
 
-// GET /api/divine/:id —— 详情（排盘 + AI 报告）
+// GET /api/divine/:id —— 详情（排盘 + AI 报告；正式账号须本人 token）
 router.get('/:id', (req, res) => {
   const rec = getDivination(req.params.id);
   if (!rec) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
-  // 归属校验：token 优先；无 token 时 query username 必须与记录一致（向后兼容本地旧前端）
-  const authed = authedUsername(req);
-  if (authed ? authed !== rec.username : String(req.query.username || '') !== rec.username) {
-    return res.status(403).json({ error: 'FORBIDDEN' });
-  }
+  // 归属校验：token 优先；无 token 仅占位账号可经 query username 访问
+  const resolved = resolveOwner(req, res, String(req.query.username || ''));
+  if (!resolved) return;
+  if (resolved.owner !== rec.username) return res.status(403).json({ error: 'FORBIDDEN' });
   res.json({ ...rec, resultRaw: rec.resultRaw, display: rec.display, report: rec.report || null });
 });
 
-// DELETE /api/divine/:id?username= —— 删除（校验归属）
+// DELETE /api/divine/:id?username= —— 删除（H-NEW3：正式账号须本人 token）
 router.delete('/:id', (req, res) => {
   const username = String(req.query.username || '');
-  const ok = deleteDivination(req.params.id, username);
+  const resolved = resolveOwner(req, res, username);
+  if (!resolved) return;
+  const ok = deleteDivination(req.params.id, resolved.owner);
   if (!ok) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
   res.json({ ok: true });
 });

package/server/src/routes/users.ts

@@ -23,6 +23,8 @@ interface DbUser {
   records: Record<string, unknown>[];
   /** 登录态 token（注册/登录时签发，云同步写接口须携带校验归属） */
   token?: string;
+  /** token 过期时间（ms；30 天滚动，登录时轮换续期） */
+  tokenExpires?: number;
 }
 
 interface Db { users: DbUser[] }
@@ -47,13 +49,15 @@ async function hashPassword(pw: string): Promise<string> {
   return 'scrypt$' + salt.toString('hex') + '$' + key.toString('hex');
 }
 
-// 登录态 token：随机 32 字节 hex；写接口（profile/records/samples）须携带且归属匹配
+const TOKEN_TTL = 30 * 24 * 3600 * 1000;  // 30 天
+
 function newToken(): string {
   return crypto.randomBytes(32).toString('hex');
 }
 
 function tokenMatches(user: DbUser, token: string | undefined): boolean {
   if (!token || !user.token) return false;
+  if (user.tokenExpires && Date.now() > user.tokenExpires) return false;  // 过期即失效
   // 恒时比较，防时序侧信道
   const a = Buffer.from(token), b = Buffer.from(user.token);
   return a.length === b.length && crypto.timingSafeEqual(a, b);
@@ -84,7 +88,7 @@ function upsertUser(username: string): DbUser {
   const db = loadDb();
   let user = db.users.find((x: any) => x.username === username);
   if (!user) {
-    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token: newToken() };
+    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token: newToken(), tokenExpires: Date.now() + TOKEN_TTL };
     db.users.push(user);
     saveDb(db);
     console.log(`[users] 自动建档: ${username}`);
@@ -108,13 +112,14 @@ router.post('/register', async (req, res) => {
       }
       existing.passHash = await hashPassword(String(password));
       existing.token = newToken();
+      existing.tokenExpires = Date.now() + TOKEN_TTL;
       if (profile) existing.profile = { ...existing.profile, ...profile };
       saveDb(db);
       return res.json({ ok: true, upgraded: true, token: existing.token, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
     }
     return res.status(400).json({ error: '此名号已有人用' });
   }
-  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken() };
+  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken(), tokenExpires: Date.now() + TOKEN_TTL };
   db.users.push(user);
   saveDb(db);
   res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
@@ -134,6 +139,10 @@ router.post('/login', async (req, res) => {
     saveDb(db);
     console.log(`[users] 密码哈希已升级为 scrypt: ${user.username}`);
   }
+  // 登录成功 → 轮换 token（旧 token 即失效；防泄露长期有效）
+  user.token = newToken();
+  user.tokenExpires = Date.now() + TOKEN_TTL;
+  saveDb(db);
   res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
 });
 

package/src/services/api.ts

@@ -3,6 +3,16 @@ import type { InterpretationResult } from '@core/engine/tarotEngine';
 
 // 开发环境直连后端（规避 proxy/IPv6 组合的 SSE 不确定性）；生产同域 /api
 const API_BASE = (import.meta.env.VITE_API_BASE as string | undefined) || '/api';
+
+// 云同步 token（登录后 localStorage 会话中保存）：所有需要归属校验的请求带上，
+// 后端有 token 即以 token 解析用户，堵「自报 username」越权（H-NEW1 修复）
+function authHeaders(): Record<string, string> {
+  try {
+    const sess = JSON.parse(localStorage.getItem('guanwei_session') || 'null');
+    if (sess?.token) return { 'X-Guanwei-Token': sess.token };
+  } catch { /* ignore */ }
+  return {};
+}
 // 诊断：全局暴露当前 API 基址
 if (typeof window !== 'undefined') { (window as any).__API_BASE__ = API_BASE; }
 console.log('[观微] API_BASE =', API_BASE);
@@ -11,6 +21,7 @@ async function request<T>(endpoint: string, options: RequestInit = {}): Promise<
   const res = await fetch(`${API_BASE}${endpoint}`, {
     headers: {
       'Content-Type': 'application/json',
+      ...authHeaders(),
       ...options.headers,
     },
     ...options,
@@ -169,7 +180,7 @@ export async function aiInterpretStream(
   try {
     const res = await fetch(API_BASE + '/ai/interpret/stream', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...authHeaders() },
       body: JSON.stringify(params),
       signal: controller.signal,
     });
@@ -238,12 +249,14 @@ export interface DivineResult {
   divineId: string;
   resultRaw: unknown;
   display?: unknown;
+  /** 起占建档返回的 claimToken（本地占位账号注册升级用，L-NEW1） */
+  claimToken?: string;
 }
 
 export async function apiDivine(username: string, artId: string, inputs: unknown, profile?: unknown, question?: string, _profileId?: string): Promise<DivineResult> {
   const res = await fetch(API_BASE + '/divine', {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...authHeaders() },
     body: JSON.stringify({ username, artId, inputs, profile, question }),
   });
   if (!res.ok) {
@@ -264,19 +277,19 @@ export interface DivineHistoryItem {
 }
 
 export async function apiDivineHistory(username: string, page = 1, pageSize = 20, profileId?: string): Promise<{ list: DivineHistoryItem[]; total: number }> {
-  const res = await fetch(API_BASE + '/divine?username=' + encodeURIComponent(username) + '&page=' + page + '&pageSize=' + pageSize + (profileId ? '&profileId=' + encodeURIComponent(profileId) : ''));
+  const res = await fetch(API_BASE + '/divine?username=' + encodeURIComponent(username) + '&page=' + page + '&pageSize=' + pageSize + (profileId ? '&profileId=' + encodeURIComponent(profileId) : ''), { headers: authHeaders() });
   if (!res.ok) return { list: [], total: 0 };
   return res.json();
 }
 
 export async function apiDivineDetail(id: string, username: string): Promise<Record<string, unknown> | null> {
-  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username));
+  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { headers: authHeaders() });
   if (!res.ok) return null;
   return res.json();
 }
 
 export async function apiDivineDelete(id: string, username: string): Promise<boolean> {
-  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { method: 'DELETE' });
+  const res = await fetch(API_BASE + '/divine/' + id + '?username=' + encodeURIComponent(username), { method: 'DELETE', headers: authHeaders() });
   return res.ok;
 }
 
@@ -330,7 +343,7 @@ export async function apiHourInfer(params: {
 }): Promise<HourInferResult> {
   const res = await fetch(API_BASE + '/hour-infer', {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...authHeaders() },
     body: JSON.stringify(params),
   });
   if (!res.ok) {