midway-fatcms 0.0.1-beta.65 → 0.0.1-beta.66

package/src/controller/base/BaseApiController.ts

@@ -10,6 +10,9 @@ import { BaseService } from '@/service/base/BaseService';
 import * as moment from 'moment';
 import { CommonException } from '@/libs/crud-pro/exceptions';
 import { RedisKeys } from '@/models/RedisKeys';
+import { Aes128CBC } from 'aes-128-cbc';
+import * as md5 from 'md5';
+import { AsymmetricCrypto } from '@/libs/utils/AsymmetricCrypto';
 
 export interface IExecuteSimpleSqlParams {
   updateCfg?: Record<string, IFuncCfgModel>;
@@ -19,6 +22,11 @@ export interface IExecuteSimpleSqlParams {
   columns?: string | string[]; // ..."columns": "id,name,age,sex,addr",
 }
 
+export interface ISecretBody {
+  secretPayload: string;
+  secretKey: string; // 使用RSA公钥加密的AES密钥
+}
+
 @Controller('/api/BaseApiController')
 export class BaseApiController extends BaseService {
   @Inject()
@@ -167,4 +175,35 @@ export class BaseApiController extends BaseService {
       columnsRelation.push(createdByRelation2);
     }
   }
+
+
+  protected async decodeBodyBySession<T>(body: any): Promise<any> {
+    const sessionInfo = this.getUserSessionInfo();
+    const sessionId = sessionInfo?.sessionId;
+    if (!sessionId) {
+      throw new Error('[decodeBodyBySessionId] sessionId is null');
+    }
+
+    const secretBody = body as ISecretBody;
+
+    if (!secretBody.secretPayload || !secretBody.secretKey) {
+      return body;
+    }
+
+    const { privateKey } = sessionInfo;
+
+    const secretPayload: string = secretBody.secretPayload;
+    const secretKey: string = secretBody.secretKey; // 使用RSA加密的AES密钥  
+    const aesKey = await AsymmetricCrypto.decrypt(privateKey, secretKey); // 解密AES密钥
+
+    const createAes128 = () => {
+      const iv = md5(aesKey + sessionId);
+      return new Aes128CBC(aesKey, iv);
+    }
+    const aes128 = createAes128();
+    const decryptedPayload = await aes128.time_decrypt_base64_utf8(secretPayload);
+    return JSON.parse(decryptedPayload);
+  }
+
+
 }

package/src/controller/gateway/CrudStdGatewayController.ts

@@ -4,13 +4,16 @@ import { BaseApiController } from '../base/BaseApiController';
 import { CrudStdService, SPECIAL_SETTING_KEY, ICrudStdActionParams, IRequestModelCrudProExt } from '@/service/crudstd/CrudStdService';
 import { KeysOfSimpleSQL } from '@/libs/crud-pro/models/keys';
 import { CommonResult } from '@/libs/utils/common-dto';
+import { checkLogin } from '@/middleware/permission.middleware';
 
 type ICrudStdParams = { stdAction: ICrudStdActionParams } & IRequestModelCrudProExt;
 
+
+
 /**
- * 零代码配置的界面，相关的接口的执行
+ * 零代码配置的界面，相关的接口的执行。这里的接口都需要登录。
  */
-@Controller('/ns/gw/api/crudStd')
+@Controller('/ns/gw/api/crudStd', { middleware: [checkLogin()] })
 export class CrudStdGatewayController extends BaseApiController {
   @Inject()
   protected ctx: Context;
@@ -23,18 +26,36 @@ export class CrudStdGatewayController extends BaseApiController {
    */
   @Post('/getParsedCrudStdAppInfo')
   async getParsedCrudStdAppInfo(): Promise<CommonResult> {
-    const body = this.ctx.request.body as ICrudStdParams;
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
     const appCode = body.stdAction.appCode;
     const parsedAppInfo = await this.crudStdService.getParsedCrudStdAppInfo(appCode);
-    return CommonResult.successNotNull(parsedAppInfo);
+    if (parsedAppInfo) {
+      const parsedAppInfo2: any = { ...parsedAppInfo };
+      delete parsedAppInfo2.created_at;
+      delete parsedAppInfo2.created_by;
+      delete parsedAppInfo2.workbench_code_array;
+      delete parsedAppInfo2.modified_at;
+      delete parsedAppInfo2.modified_by;
+      delete parsedAppInfo2.modified_desc;
+      delete parsedAppInfo2.std_crud_db;
+      delete parsedAppInfo2.std_crud_tbl;
+      return CommonResult.successNotNull(parsedAppInfo2);
+    }
+    return CommonResult.successNotNull(null);
   }
 
+
   /**
    * 列表查询: 分页查询
    */
   @Post('/getObjectList')
   async getObjectList() {
-    const { stdAction, ...otherParams } = this.ctx.request.body as ICrudStdParams;
+
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
+
+    const { stdAction, ...otherParams } = body;
     stdAction.settingKey = SPECIAL_SETTING_KEY.QUERY_LIST;
     return this.crudStdService.executeStdQuery(stdAction, otherParams, KeysOfSimpleSQL.SIMPLE_QUERY_PAGE);
   }
@@ -44,7 +65,10 @@ export class CrudStdGatewayController extends BaseApiController {
    */
   @Post('/getObjectOne')
   async getObjectOne() {
-    const { stdAction, ...otherParams } = this.ctx.request.body as ICrudStdParams;
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
+
+    const { stdAction, ...otherParams } = body;
     stdAction.settingKey = SPECIAL_SETTING_KEY.QUERY_ONE;
     return this.crudStdService.executeStdQuery(stdAction, otherParams, KeysOfSimpleSQL.SIMPLE_QUERY_ONE);
   }
@@ -54,7 +78,9 @@ export class CrudStdGatewayController extends BaseApiController {
    */
   @Post('/deleteObject')
   async deleteObject() {
-    const { stdAction, ...otherParams } = this.ctx.request.body as ICrudStdParams;
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
+    const { stdAction, ...otherParams } = body;
     return this.crudStdService.executeStdQuery(stdAction, otherParams, KeysOfSimpleSQL.SIMPLE_DELETE);
   }
 
@@ -63,7 +89,9 @@ export class CrudStdGatewayController extends BaseApiController {
    */
   @Post('/createObject')
   async createObject() {
-    const { stdAction, ...otherParams } = this.ctx.request.body as ICrudStdParams;
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
+    const { stdAction, ...otherParams } = body;
     return this.crudStdService.executeStdQuery(stdAction, otherParams, KeysOfSimpleSQL.SIMPLE_INSERT);
   }
 
@@ -72,7 +100,9 @@ export class CrudStdGatewayController extends BaseApiController {
    */
   @Post('/updateObject')
   async updateObject() {
-    const { stdAction, ...otherParams } = this.ctx.request.body as ICrudStdParams;
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
+    const { stdAction, ...otherParams } = body;
     return this.crudStdService.executeStdQuery(stdAction, otherParams, KeysOfSimpleSQL.SIMPLE_UPDATE);
   }
 
@@ -81,7 +111,9 @@ export class CrudStdGatewayController extends BaseApiController {
    */
   @Post('/executeStdAction')
   async executeStdAction() {
-    const { stdAction, ...otherParams } = this.ctx.request.body as ICrudStdParams;
+    const decodeBody = await this.decodeBodyBySession(this.ctx.request.body);
+    const body = decodeBody as ICrudStdParams;
+    const { stdAction, ...otherParams } = body;
     return await this.crudStdService.executeStdActionByReq(stdAction, otherParams);
   }
 }

package/src/controller/gateway/FileController.ts

@@ -8,6 +8,7 @@ import { FileCenterService, PATH_PREFIX, toDownloadPaths, isImageFile } from '@/
 import { checkLogin, checkPermission } from '@/middleware/permission.middleware';
 import { CommonResult } from '@/libs/utils/common-dto';
 import { SystemFuncCode } from '@/models/SystemPerm';
+import { formatHost } from '@/libs/utils/format-url';
 
 function isTrue(obj: any) {
   return obj === true || obj === 'true';
@@ -55,8 +56,7 @@ export class FileController extends BaseApiController {
 
     const { fileKey, filename, storageUrl } = await this.fileCenterService.uploadFileToOSS(files, accessType, referer);
 
-    const origin = this.ctx.request.origin;
-
+    const origin = formatHost(this.ctx.request.origin);
     const downloadUrls = toDownloadPaths(origin, fileKey);
 
     const data = {

package/src/controller/gateway/PublicApiController.ts

@@ -10,6 +10,14 @@ import { parseJsonObject } from '@/libs/utils/functions';
 import { WorkbenchService } from '@/service/WorkbenchService';
 import { SystemRoleCode } from '@/models/SystemPerm';
 import { KeysOfAuthType } from '@/libs/crud-pro/models/keys';
+import { CacheServiceFactory } from '@/service/base/cache/CacheServiceFactory';
+import md5 = require('md5');
+import { CacheLevelEnum, CacheNameEnum } from '@/models/SystemEntities';
+
+
+const DEFAULT_CACHE_LEVEL = CacheLevelEnum.MEMORY;
+const DEFAULT_CACHE_SECOND = 60 * 5;
+
 
 /**
  * 公开的API，无需鉴权，所有人可以直接访问
@@ -25,6 +33,9 @@ export class PublicApiController extends BaseApiController {
   @Inject()
   private workbenchService: WorkbenchService;
 
+  @Inject()
+  private cacheServiceFactory: CacheServiceFactory;
+
   /**
    * 获取所有站点列表
    */
@@ -53,39 +64,51 @@ export class PublicApiController extends BaseApiController {
       return CommonResult.errorRes('param workbenchMenuCode is null');
     }
 
-    const workbenchMenuCodeStr = '' + workbenchMenuCode;
-    const workbenchMenuCodeArray = workbenchMenuCodeStr.split(',');
+    const { publicApiMenuCacheLevel, publicApiMenuCacheSecond } = this.ctx.workbenchInfoTools.getWorkbenchConfig();
+
+    const mapResult = await this.cacheServiceFactory.getJsonObjectCache({
+      cacheLevel: publicApiMenuCacheLevel || DEFAULT_CACHE_LEVEL,
+      cacheKey: "" + workbenchMenuCode,
+      cacheSecond: publicApiMenuCacheSecond || DEFAULT_CACHE_SECOND,
+      cacheName: CacheNameEnum.GetWorkbenchMenu,
+      getter: async () => {
+
+        const workbenchMenuCodeStr = '' + workbenchMenuCode;
+        const workbenchMenuCodeArray = workbenchMenuCodeStr.split(',');
+        const condition = {
+          menu_code: {
+            $in: workbenchMenuCodeArray,
+          },
+        };
 
-    const condition = {
-      menu_code: {
-        $in: workbenchMenuCodeArray,
-      },
-    };
+        const rows = await this.sysDBUtil.getList({ condition }, SystemTables.sys_menus);
 
-    const rows = await this.sysDBUtil.getList({ condition }, SystemTables.sys_menus);
+        const map = {};
+        for (let i = 0; i < rows.length; i++) {
+          const rowElement = rows[i];
+          const menu_code = rowElement.menu_code;
+          const view_auth_config = rowElement.view_auth_config;
+          const view_auth_type = rowElement.view_auth_type;
 
-    const map = {};
-    for (let i = 0; i < rows.length; i++) {
-      const rowElement = rows[i];
-      const menu_code = rowElement.menu_code;
-      const view_auth_config = rowElement.view_auth_config;
-      const view_auth_type = rowElement.view_auth_type;
+          const hasPermission = this.ctx.userSession.isAuthPass(view_auth_type, view_auth_config);
 
-      const hasPermission = this.ctx.userSession.isAuthPass(view_auth_type, view_auth_config);
+          const menu_config_content = rowElement.menu_config_content;
+          delete rowElement.menu_config_content;
+          const menu_list = parseJsonObject(menu_config_content) || [];
+          map[menu_code] = { ...rowElement, menu_list, hasPermission };
+        }
 
-      const menu_config_content = rowElement.menu_config_content;
-      delete rowElement.menu_config_content;
-      const menu_list = parseJsonObject(menu_config_content) || [];
-      map[menu_code] = { ...rowElement, menu_list, hasPermission };
-    }
+        // 特殊的devops菜单
+        map['devops'] = {
+          menu_list: [], // 这个特殊的菜单在前端写死。
+          hasPermission: this.ctx.userSession.isAuthPass(KeysOfAuthType.byRoleCode, [SystemRoleCode.DevOpsWriter, SystemRoleCode.DevOpsViewer, SystemRoleCode.SuperAdmin]),
+        };
 
-    // 特殊的devops菜单
-    map['devops'] = {
-      menu_list: [], // 这个特殊的菜单在前端写死。
-      hasPermission: this.ctx.userSession.isAuthPass(KeysOfAuthType.byRoleCode, [SystemRoleCode.DevOpsWriter, SystemRoleCode.DevOpsViewer, SystemRoleCode.SuperAdmin]),
-    };
+        return map;
+      }
+    })
 
-    return CommonResult.successRes(map);
+    return CommonResult.successRes(mapResult);
   }
 
   /**
@@ -96,14 +119,35 @@ export class PublicApiController extends BaseApiController {
     const body = this.ctx.request.body as any;
     const { workbenchCode, appCode, pathname } = body;
     const resultData: any = {};
-    const getOne = async (condition: any, tablenName: string, key: string) => {
+
+    const getOneImpl = async (condition: any, tableName: string) => {
       const values = Object.values(condition).filter(Boolean);
       // 查询条件不能为空
       if (values.length > 0) {
-        const oneData = await this.sysDBUtil.getOne({ condition }, tablenName);
+        const oneData = await this.sysDBUtil.getOne({ condition }, tableName);
         if (oneData && oneData['app_schema']) {
           oneData['app_schema'] = parseJsonObject(oneData['app_schema']);
         }
+        return oneData;
+      }
+      return null;
+    };
+
+
+    const { publicApiNavPageInfoCacheLevel, publicApiNavPageInfoCacheSecond } = this.ctx.workbenchInfoTools.getWorkbenchConfig();
+
+    const getOne = async (condition: any, tableName: string, key: string) => {
+      const cacheKey = md5(tableName + ':' + JSON.stringify(condition) + ":" + key);
+      const oneData = await this.cacheServiceFactory.getJsonObjectCache({
+        cacheLevel: publicApiNavPageInfoCacheLevel || DEFAULT_CACHE_LEVEL,
+        cacheSecond: publicApiNavPageInfoCacheSecond || DEFAULT_CACHE_SECOND,
+        cacheKey,
+        cacheName: CacheNameEnum.GetNavPageInfo,
+        getter: async () => {
+          return await getOneImpl(condition, tableName);
+        },
+      });
+      if (oneData) {
         resultData[key] = oneData;
       }
     };

package/src/index.ts

@@ -54,7 +54,7 @@ export * from './service/anyapi/AnyApiSandboxService';
 export * from './service/anyapi/AnyApiService';
 export * from './service/base/ApiBaseService';
 export * from './service/base/BaseService';
-export * from './service/base/RedisCacheService';
+export * from './service/base/cache/FatcmsBaseRedisCache';
 export * from './service/crudstd/CrudStdActionService';
 export * from './service/crudstd/CrudStdRelationService';
 export * from './service/crudstd/CrudStdService';

package/src/interface.ts

@@ -3,12 +3,14 @@ import { Transaction } from './libs/crud-pro/models/Transaction';
 import { UserSessionInfo } from './models/userSession';
 import { ContextLogger } from './models/contextLogger';
 import { IWorkbenchEntity } from './models/SystemEntities';
+import { WorkbenchInfoTools } from './models/WorkbenchInfoTools';
 
 declare module '@midwayjs/core' {
   interface Context {
     transaction: Transaction;
     userSession: UserSessionInfo;
     workbenchInfo: IWorkbenchEntity;
+    workbenchInfoTools: WorkbenchInfoTools;
     contextLogger: ContextLogger;
   }
 }

package/src/libs/crud-pro/exceptions.ts

@@ -47,6 +47,8 @@ export enum Exceptions {
   CFG_PARSE_ERROR = 'CFG_PARSE_ERROR',
   CFG_ERROR_POSTGRES_UNIQUE_COLUMNS_NULL = 'CFG_ERROR_POSTGRES_UNIQUE_COLUMNS_NULL',
   CFG_UNIQUE_COLUMN_COUNT_MUST_ONE = 'CFG_UNIQUE_COLUMN_COUNT_MUST_ONE',
+  CFG_ORDER_BY_TYPE_ERROR = 'CFG_ORDER_BY_TYPE_ERROR',
+  CFG_ERROR_POSTGRES_COLUMN_NAME_INVALID = 'CFG_ERROR_POSTGRES_COLUMN_NAME_INVALID',
 
   /**
    * 数据传错

package/src/libs/crud-pro/models/keys.ts

@@ -112,19 +112,19 @@ export const KeysOfConditions = {
   $NOT_NULL: '$notNull', // is not null
   $NULL: '$null', // is null
   $RANGE: '$range', // between 1 and 2
-  $LIKE: '$like', // A% 以A开头 {age:1, name:{"$like":"张"} }
-  $NOT_LIKE: '$notLike', // A% 以A开头 {age:1, name:{"$notLike":"张"} }
+  $LIKE: '$like', //前缀匹配， A% 以A开头 {age:1, name:{"$like":"张"} }
+  $NOT_LIKE: '$notLike', // 前缀匹配 A% 以A开头 {age:1, name:{"$notLike":"张"} }
 
   $LIKE_INCLUDE: '$likeInclude', // %A% 包含A {age:1, name:{"$like":"张"} }
   $NOT_LIKE_INCLUDE: '$notLikeInclude', // %A%  包含A {age:1, name:{"$notLike":"张"} }
 
-  $MATCH: '$match', // 全文索引 {age:1, name:{"$match":"张"} }
-  $MATCH_BOOL: '$matchBool', // 全文索引 {age:1, name:{"$matchBool":"张"} }
+  $MATCH: '$match', // MYSQL 全文索引 {age:1, name:{"$match":"张"} }
+  $MATCH_BOOL: '$matchBool', // MYSQL 全文索引 {age:1, name:{"$matchBool":"张"} }
 
   /**
-   * SELECT * FROM tms_biz.表 WHERE JSON_CONTAINS(`related_user1`, JSON_ARRAY('2512274'), '$');
+   * SELECT * FROM table WHERE JSON_CONTAINS(`related_user1`, JSON_ARRAY('aaaaa'), '$');
    */
-  $JSON_ARRAY_CONTAINS: '$jsonArrayContains', // 全文索引 { related_user1:{"$jsonArrayContains":"2512274"} }
+  $JSON_ARRAY_CONTAINS: '$jsonArrayContains', // 全文索引 { related_user1:{"$jsonArrayContains":"aaaaa"} }
 
   COMPARE_KEYS: new Set<string>([]),
   ALL_KEYS: new Set<string>([]),

package/src/libs/crud-pro/services/CrudProOriginToExecuteSql.ts

@@ -238,8 +238,14 @@ class CrudProOriginToExecuteSql extends CrudProServiceBase {
     if (MixinUtils.isEmpty(orderBys)) {
       return null;
     }
+    const ORDER_BY_TYPE_ARR = ['asc', 'desc'];
+
     const orderByArr = orderBys.map(orderBy => {
-      return toSqlColumnName(orderBy.fieldName, sqlCfgModel) + ' ' + orderBy.orderType;
+      const orderType = (orderBy.orderType || 'asc').toLowerCase();
+      if (!ORDER_BY_TYPE_ARR.includes(orderType)) {
+        throw new CommonException(Exceptions.CFG_ORDER_BY_TYPE_ERROR, 'orderType must be asc or desc : ' + orderType);
+      }
+      return toSqlColumnName(orderBy.fieldName, sqlCfgModel) + ' ' + orderType;
     });
     const sql = 'order by ' + orderByArr.join(',');
     return new SqlSegArg(sql);

package/src/libs/crud-pro/utils/sqlConvert/convertColumnName.ts

@@ -1,7 +1,25 @@
+import { CommonException, Exceptions } from '../../exceptions';
 import { SqlCfgModel } from '../../models/SqlCfgModel';
 import { SqlDbType } from '../../models/keys';
 
+const COLUMN_NAME_REGEX = /^[a-zA-Z0-9_]+$/;
+function isColumnNameValid(str: string): boolean {
+  if (typeof str !== 'string') {
+    return false;
+  }
+  if (str === '') {
+    return false;
+  }
+  return COLUMN_NAME_REGEX.test(str);
+}
+
+
 function toSqlColumnName(columnName: string, sqlCfgModel: SqlCfgModel): string {
+
+  if (!isColumnNameValid(columnName)) {
+    throw new CommonException(Exceptions.CFG_ERROR_POSTGRES_COLUMN_NAME_INVALID, 'column name is invalid : ' + columnName);
+  }
+
   if (sqlCfgModel.sqlDbType === SqlDbType.postgres) {
     return '"' + columnName + '"';
   }