nolo-cli 0.1.23 → 0.1.29

package/auth/server/emailRuntimeConfig.ts

@@ -0,0 +1,86 @@
+import serverDb from "../../database/server/db";
+import {
+  checkAdminPermission,
+  createErrorResponse,
+  createSuccessResponse,
+  handleOptionsRequest,
+} from "./shared";
+import {
+  EMAIL_RUNTIME_CONFIG_KEY,
+  applyEmailRuntimeConfigFromDb,
+  isEmailRuntimeConfigKey,
+  readEmailRuntimeConfigFromDb,
+} from "./emailDbConfig";
+
+const normalizeConfigPatch = (input: unknown): Record<string, string | number | boolean | null> => {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return {};
+  const patch: Record<string, string | number | boolean | null> = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!isEmailRuntimeConfigKey(key)) continue;
+    if (value === null) {
+      patch[key] = null;
+      continue;
+    }
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      patch[key] = value;
+    }
+  }
+  return patch;
+};
+
+export async function handleGetEmailRuntimeConfig(req: Request) {
+  if (req.method === "OPTIONS") return handleOptionsRequest();
+
+  const user = (req as any).user;
+  if (!user?.userId) {
+    return createErrorResponse("Unauthorized", 401);
+  }
+  const permissionError = checkAdminPermission(user.userId);
+  if (permissionError) return permissionError;
+
+  const config = (await readEmailRuntimeConfigFromDb()) || {};
+  return createSuccessResponse({
+    key: EMAIL_RUNTIME_CONFIG_KEY,
+    config,
+  });
+}
+
+export async function handleUpdateEmailRuntimeConfig(req: Request) {
+  if (req.method === "OPTIONS") return handleOptionsRequest();
+
+  const user = (req as any).user;
+  if (!user?.userId) {
+    return createErrorResponse("Unauthorized", 401);
+  }
+  const permissionError = checkAdminPermission(user.userId);
+  if (permissionError) return permissionError;
+
+  const body = ((req as any).body || {}) as {
+    config?: Record<string, unknown>;
+  };
+  const patch = normalizeConfigPatch(body.config);
+  if (Object.keys(patch).length === 0) {
+    return createErrorResponse("No valid email runtime config fields provided", 400);
+  }
+
+  const currentRaw = (await readEmailRuntimeConfigFromDb()) || {};
+  const next: Record<string, unknown> = { ...currentRaw };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === null) {
+      delete next[key];
+      continue;
+    }
+    next[key] = value;
+  }
+
+  await serverDb.put(EMAIL_RUNTIME_CONFIG_KEY, next);
+  const { appliedKeys } = await applyEmailRuntimeConfigFromDb();
+
+  return createSuccessResponse({
+    message: "Email runtime config updated",
+    key: EMAIL_RUNTIME_CONFIG_KEY,
+    config: next,
+    appliedKeys,
+  });
+}
+

package/auth/server/emailScenarioNotifications.ts

@@ -0,0 +1,340 @@
+import { ulid } from "ulid";
+import serverDb from "../../database/server/db";
+import { DB_PREFIX } from "../../database/keys";
+import { canSendEmailToUser } from "./emailPolicy";
+import { sendManagedEmail } from "./emailDelivery";
+import { balanceLockManager } from "./locks";
+import { logger } from "./shared";
+
+interface NotificationUserRecord {
+  userId?: string;
+  email?: string;
+  username?: string;
+  emailOptOutAll?: boolean;
+  emailMutedUntil?: number;
+  emailOptOutTags?: string[];
+  isDisabled?: boolean;
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const parseNumber = (value: string | undefined, fallback: number, min = 1) => {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.max(min, Math.floor(parsed));
+};
+const getSecurityLoginConfig = () => ({
+  failThreshold: parseNumber(process.env.EMAIL_SECURITY_LOGIN_FAIL_THRESHOLD, 5, 1),
+  alertCooldownDays: parseNumber(process.env.EMAIL_SECURITY_LOGIN_ALERT_COOLDOWN_DAYS, 1, 1),
+});
+
+const LOGIN_FAIL_KEY_PREFIX = "security:login-fail-count:";
+const LOGIN_ALERT_KEY_PREFIX = "security:login-fail-alert:";
+
+const getDayKey = (time: number = Date.now()) =>
+  new Date(time).toISOString().slice(0, 10).replace(/-/g, "");
+
+const isValidReasonForRechargeNotice = (reason: string) => {
+  const value = String(reason || "").trim().toLowerCase();
+  if (!value) return false;
+  if (value.startsWith("invite_reward_for_")) return false;
+  if (value.includes("bonus")) return false;
+  if (value.includes("reward")) return false;
+  if (value.includes("rollback")) return false;
+  return true;
+};
+
+const normalizeErrorMessage = (error?: string) => {
+  if (!error) return "系统未返回详细错误，请稍后重试。";
+  if (error.length <= 300) return error;
+  return `${error.slice(0, 297)}...`;
+};
+
+const getSafeUsername = (user: NotificationUserRecord) =>
+  user.username && user.username.trim() ? user.username.trim() : "用户";
+
+const getAppName = () => process.env.EMAIL_APP_NAME || "Nolo";
+const getAppUrl = () => process.env.EMAIL_APP_URL || "https://nolo.run";
+const escapeHtml = (value: string) =>
+  String(value || "")
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+const normalizePublicUrl = (url: string) => {
+  if (!url) return "";
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "";
+    return parsed.toString();
+  } catch {
+    return "";
+  }
+};
+
+const joinPublicUrl = (baseUrl: string, path: string) => {
+  if (!baseUrl) return "";
+  try {
+    return new URL(path, baseUrl).toString();
+  } catch {
+    return "";
+  }
+};
+
+const getUserById = async (userId: string): Promise<NotificationUserRecord | null> => {
+  if (!userId) return null;
+  const key = `${DB_PREFIX.USER}${userId}`;
+  const user = await serverDb.get(key).catch(() => null);
+  if (!user || typeof user !== "object") return null;
+  return user as NotificationUserRecord;
+};
+
+export async function notifyRechargeResultEmail(params: {
+  userId: string;
+  amount: number;
+  reason: string;
+  success: boolean;
+  error?: string;
+}) {
+  const user = await getUserById(params.userId);
+  if (!user?.email || !isValidReasonForRechargeNotice(params.reason)) return;
+
+  const tag = params.success ? "recharge-success" : "recharge-failed";
+  const allowed = canSendEmailToUser(user, tag);
+  if (!allowed.allowed) return;
+
+  const username = getSafeUsername(user);
+  const appName = getAppName();
+  const appUrl = normalizePublicUrl(getAppUrl());
+  const amountText = Number(params.amount || 0).toFixed(2);
+  const reasonText = params.reason || "recharge";
+  const safeUsername = escapeHtml(username);
+  const safeReasonText = escapeHtml(reasonText);
+  const safeAmountText = escapeHtml(amountText);
+  const accountUrl = joinPublicUrl(appUrl, "/account");
+  const safeAccountUrl = escapeHtml(accountUrl);
+
+  const subject = params.success
+    ? `[${appName}] 充值成功通知`
+    : `[${appName}] 充值失败通知`;
+
+  const textBody = params.success
+    ? `你好 ${username}，\n\n你的充值已成功到账。\n- 金额：${amountText}\n- 业务原因：${reasonText}\n\n${
+        accountUrl ? `查看账户：${accountUrl}` : "请在客户端查看最新余额与流水。"
+      }`
+    : `你好 ${username}，\n\n你的充值未成功。\n- 金额：${amountText}\n- 业务原因：${reasonText}\n- 失败详情：${normalizeErrorMessage(params.error)}\n\n请稍后重试；若持续失败，请联系支持。`;
+
+  const htmlBody = params.success
+    ? `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
+      `<p>你好 ${safeUsername}，</p>` +
+      `<p>你的充值已成功到账。</p>` +
+      `<ul><li>金额：<b>${safeAmountText}</b></li><li>业务原因：${safeReasonText}</li></ul>` +
+      (accountUrl ? `<p><a href="${safeAccountUrl}">查看账户明细</a></p>` : `<p>请在客户端查看最新余额与流水。</p>`) +
+      `</div>`
+    : `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
+      `<p>你好 ${safeUsername}，</p>` +
+      `<p>你的充值未成功。</p>` +
+      `<ul><li>金额：<b>${safeAmountText}</b></li><li>业务原因：${safeReasonText}</li><li>失败详情：${escapeHtml(
+        normalizeErrorMessage(params.error)
+      )}</li></ul>` +
+      `<p>请稍后重试；若持续失败，请联系支持。</p>` +
+      `</div>`;
+
+  await sendManagedEmail({
+    userId: params.userId,
+    to: user.email,
+    subject,
+    textBody,
+    htmlBody,
+    tag,
+    metadata: {
+      reason: reasonText,
+      amount: params.amount,
+      success: params.success,
+    },
+  }).catch((error) => {
+    logger.warn({
+      userId: params.userId,
+      reason: reasonText,
+      error: error?.message || String(error),
+    }, "Failed to send recharge result email");
+  });
+}
+
+export async function notifyAccountStatusChangeEmail(params: {
+  userId: string;
+  disabled: boolean;
+  operator?: string;
+}) {
+  const user = await getUserById(params.userId);
+  if (!user?.email) return;
+  const tag = params.disabled ? "account-disabled" : "account-enabled";
+  const allowed = canSendEmailToUser(user, tag);
+  if (!allowed.allowed) return;
+
+  const username = getSafeUsername(user);
+  const appName = getAppName();
+  const appUrl = normalizePublicUrl(getAppUrl());
+  const settingsUrl = joinPublicUrl(appUrl, "/settings");
+  const actionText = params.disabled ? "已暂停" : "已恢复";
+  const safeUsername = escapeHtml(username);
+  const safeActionText = escapeHtml(actionText);
+  const safeOperator = params.operator ? escapeHtml(params.operator) : "";
+  const safeSettingsUrl = escapeHtml(settingsUrl);
+  const subject = params.disabled
+    ? `[${appName}] 账号暂停通知`
+    : `[${appName}] 账号恢复通知`;
+
+  const textBody = `你好 ${username}，\n\n你的账号${actionText}。\n${
+    params.operator ? `操作人：${params.operator}\n` : ""
+  }\n如有疑问，请联系支持。${settingsUrl ? `\n\n账号设置：${settingsUrl}` : ""}`;
+
+  const htmlBody =
+    `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
+    `<p>你好 ${safeUsername}，</p>` +
+    `<p>你的账号<strong>${safeActionText}</strong>。</p>` +
+    (safeOperator ? `<p>操作人：${safeOperator}</p>` : "") +
+    `<p>如有疑问，请联系支持。</p>` +
+    (settingsUrl ? `<p><a href="${safeSettingsUrl}">前往账号设置</a></p>` : "") +
+    `</div>`;
+
+  await sendManagedEmail({
+    userId: params.userId,
+    to: user.email,
+    subject,
+    textBody,
+    htmlBody,
+    tag,
+    metadata: {
+      disabled: params.disabled,
+      operator: params.operator,
+    },
+  }).catch((error) => {
+    logger.warn({
+      userId: params.userId,
+      disabled: params.disabled,
+      error: error?.message || String(error),
+    }, "Failed to send account status email");
+  });
+}
+
+export async function clearTodayLoginFailureCounter(userId: string) {
+  if (!userId) return;
+  const dayKey = getDayKey();
+  const countKey = `${LOGIN_FAIL_KEY_PREFIX}${userId}:${dayKey}`;
+  await serverDb.del(countKey).catch(() => undefined);
+}
+
+export async function recordLoginFailureAndMaybeNotify(params: {
+  userId: string;
+  ip?: string;
+  reason: string;
+  userAgent?: string;
+}) {
+  if (!params.userId) return;
+  const securityConfig = getSecurityLoginConfig();
+  const now = Date.now();
+  const dayKey = getDayKey(now);
+  const countKey = `${LOGIN_FAIL_KEY_PREFIX}${params.userId}:${dayKey}`;
+  const lock = balanceLockManager.getLock(`login-fail:${params.userId}:${dayKey}`);
+
+  let shouldNotify = false;
+  let failCount = 0;
+
+  await lock.runExclusive(async () => {
+    const currentCount = Number((await serverDb.get(countKey).catch(() => 0)) || 0);
+    failCount = currentCount + 1;
+    await serverDb.put(countKey, failCount);
+
+    const alertDayKey = getDayKey(now - (securityConfig.alertCooldownDays - 1) * DAY_MS);
+    const alertIter = serverDb.iterator({
+      gt: `${LOGIN_ALERT_KEY_PREFIX}${params.userId}:${alertDayKey}`,
+      lt: `${LOGIN_ALERT_KEY_PREFIX}${params.userId}:\xFF`,
+      reverse: true,
+      limit: 1,
+    });
+    let alreadyNotified = false;
+    try {
+      for await (const _entry of alertIter) {
+        alreadyNotified = true;
+        break;
+      }
+    } finally {
+      await alertIter.close();
+    }
+
+    if (failCount >= securityConfig.failThreshold && !alreadyNotified) {
+      const alertKey = `${LOGIN_ALERT_KEY_PREFIX}${params.userId}:${dayKey}:${ulid(now)}`;
+      await serverDb.put(alertKey, {
+        userId: params.userId,
+        dayKey,
+        failCount,
+        createdAt: now,
+      });
+      shouldNotify = true;
+    }
+  });
+
+  if (!shouldNotify) return;
+
+  const user = await getUserById(params.userId);
+  if (!user?.email) return;
+  const allowed = canSendEmailToUser(user, "security-login-alert");
+  if (!allowed.allowed) return;
+
+  const username = getSafeUsername(user);
+  const appName = getAppName();
+  const appUrl = normalizePublicUrl(getAppUrl());
+  const settingsUrl = joinPublicUrl(appUrl, "/settings");
+  const reasonText = params.reason || "登录验证失败";
+  const ipText = params.ip || "未知 IP";
+  const uaText = params.userAgent || "未知设备";
+  const safeUsername = escapeHtml(username);
+  const safeReasonText = escapeHtml(reasonText);
+  const safeIpText = escapeHtml(ipText);
+  const safeUaText = escapeHtml(uaText);
+  const safeSettingsUrl = escapeHtml(settingsUrl);
+  const subject = `[${appName}] 登录安全提醒`;
+  const textBody =
+    `你好 ${username}，\n\n系统检测到你的账号出现多次登录失败，请及时核查：\n` +
+    `- 今日失败次数：${failCount}\n` +
+    `- 最近失败原因：${reasonText}\n` +
+    `- 来源 IP：${ipText}\n` +
+    `- 设备：${uaText}\n\n` +
+    `如果这不是你本人操作，请尽快修改密码。` +
+    (settingsUrl ? `\n账号设置：${settingsUrl}` : "");
+
+  const htmlBody =
+    `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
+    `<p>你好 ${safeUsername}，</p>` +
+    `<p>系统检测到你的账号出现多次登录失败，请及时核查：</p>` +
+    `<ul>` +
+    `<li>今日失败次数：<b>${failCount}</b></li>` +
+    `<li>最近失败原因：${safeReasonText}</li>` +
+    `<li>来源 IP：${safeIpText}</li>` +
+    `<li>设备：${safeUaText}</li>` +
+    `</ul>` +
+    `<p>如果这不是你本人操作，请尽快修改密码。</p>` +
+    (settingsUrl ? `<p><a href="${safeSettingsUrl}">前往账号设置</a></p>` : "") +
+    `</div>`;
+
+  await sendManagedEmail({
+    userId: params.userId,
+    to: user.email,
+    subject,
+    textBody,
+    htmlBody,
+    tag: "security-login-alert",
+    metadata: {
+      failCount,
+      reason: reasonText,
+      ip: ipText,
+    },
+  }).catch((error) => {
+    logger.warn({
+      userId: params.userId,
+      failCount,
+      error: error?.message || String(error),
+    }, "Failed to send login security email");
+  });
+}

package/auth/server/enable.ts

@@ -0,0 +1,61 @@
+// auth/server/enable.ts
+import serverDb from "../../database/server/db";
+import { DB_PREFIX } from "../../database/keys";
+import {
+  createErrorResponse,
+  createSuccessResponse,
+  handleOptionsRequest,
+  checkAdminPermission,
+} from "./shared";
+import { balanceLockManager } from "./locks";
+import { notifyAccountStatusChangeEmail } from "./emailScenarioNotifications";
+
+async function enableUser(userId: string) {
+  const lock = balanceLockManager.getLock(userId);
+  await lock.runExclusive(async () => {
+    const userKey = `${DB_PREFIX.USER}${userId}`;
+    const userData = await serverDb.get(userKey).catch(() => null);
+
+    if (!userData) {
+      throw new Error("User not found");
+    }
+
+    // 更新用户数据，取消停用状态
+    const updatedUserData = {
+      ...userData,
+      isDisabled: false,
+      enabledAt: new Date().toISOString(), // 记录启用时间，可选
+    };
+    await serverDb.put(userKey, updatedUserData);
+  });
+}
+
+export async function handleEnableUser(req: Request, userId: string) {
+  if (req.method === "OPTIONS") {
+    return handleOptionsRequest();
+  }
+
+  const { userId: actionUserId } = req.user;
+
+  const permissionError = checkAdminPermission(actionUserId);
+  if (permissionError) return permissionError;
+
+  try {
+    if (!userId) {
+      return createErrorResponse("User ID is required", 400);
+    }
+
+    await enableUser(userId);
+    void notifyAccountStatusChangeEmail({
+      userId,
+      disabled: false,
+      operator: actionUserId,
+    });
+    return createSuccessResponse({ success: true });
+  } catch (error) {
+    if (error.message === "User not found") {
+      return createErrorResponse("User not found", 404);
+    }
+    return createErrorResponse("Failed to enable user");
+  }
+}

package/auth/server/getRechargeHistory.ts

@@ -0,0 +1,110 @@
+// auth/server/getRechargeHistory.ts
+
+import { authenticateRequest } from "../utils";
+import { createTransactionKey } from "../../database/keys";
+import serverDb from "../../database/server/db";
+import {
+  checkAdminPermission,
+  createErrorResponse,
+  createSuccessResponse,
+  logger,
+} from "./shared";
+
+/**
+ * Admin-only handler to retrieve recharge history for a specific user.
+ * Supports cursor-based pagination.
+ */
+export const handleGetRechargeHistory = async (
+  req: Request,
+  params?: { userId?: string }
+) => {
+  try {
+    // Step 1: Authenticate request
+    const authResult = await authenticateRequest(req);
+    if (authResult instanceof Response) {
+      return authResult;
+    }
+    const { userId: requestUserId } = authResult;
+
+    // Step 2: Check admin permission
+    const adminCheck = checkAdminPermission(requestUserId);
+    if (adminCheck) {
+      return adminCheck;
+    }
+
+    // Step 3: Extract target userId from params
+    const targetUserId = params?.userId;
+    if (!targetUserId) {
+      return createErrorResponse("Missing userId parameter", 400);
+    }
+
+    // Step 4: Parse request body for pagination parameters
+    let body: { limit?: number; cursor?: string } = {};
+    try {
+      body = await req.json();
+    } catch (e) {
+      // Request body empty or invalid, use defaults
+    }
+
+    const limit = body.limit || 20;
+    const cursor = body.cursor;
+
+    // Step 5: Build query using transaction key range
+    const { start, end } = createTransactionKey.range(targetUserId);
+
+    const queryOptions: any = {
+      gte: start,
+      lte: end,
+    };
+
+    // Step 6: Query database and filter for recharge records. Transaction keys
+    // are keyed by txId, so sort by persisted timestamp instead of key order.
+    const iterator = serverDb.iterator(queryOptions);
+    const records = [];
+
+    for await (const [, value] of iterator) {
+      if (value.type === "recharge") {
+        records.push(value);
+      }
+    }
+
+    records.sort((a, b) => {
+      const timestampDiff = Number(b.timestamp || 0) - Number(a.timestamp || 0);
+      if (timestampDiff !== 0) return timestampDiff;
+      return String(b.txId || "").localeCompare(String(a.txId || ""));
+    });
+
+    const totalCount = records.length;
+    const totalAmount = records.reduce(
+      (sum, record) => sum + Number(record.amount || 0),
+      0
+    );
+
+    // Step 7: Prepare response with pagination
+    const startIndex = cursor
+      ? Math.max(
+          records.findIndex((record) => record.txId === cursor) + 1,
+          0
+        )
+      : 0;
+    const pageRecords = records.slice(startIndex, startIndex + limit);
+    let nextCursor: string | null = null;
+    if (startIndex + pageRecords.length < records.length) {
+      nextCursor = pageRecords[pageRecords.length - 1]?.txId || null;
+    }
+
+    return createSuccessResponse({
+      success: true,
+      data: pageRecords,
+      nextCursor,
+      totalAmount,
+      totalCount,
+    });
+  } catch (error: any) {
+    logger.error({ error }, "Failed to get recharge history");
+    return createErrorResponse(
+      "Internal server error while fetching recharge history.",
+      500
+    );
+  }
+};

package/auth/server/getUser.ts

@@ -0,0 +1,71 @@
+// auth/server/getUser.ts
+import serverDb from "../../database/server/db";
+import {
+  createErrorResponse,
+  createSuccessResponse,
+  handleOptionsRequest,
+} from "./shared";
+import { isSystemAdmin } from "../../core/init";
+import { DB_PREFIX } from "../../database/keys";
+
+interface User {
+  id: string;
+  username: string;
+  email: string;
+  balance: number;
+  createdAt: string;
+  [key: string]: any;
+}
+
+// 权限检查工具函数，复用性更强
+function canViewUserProfile(
+  requestUserId: string | undefined,
+  targetUserId: string
+) {
+  if (!requestUserId) return false;
+  return requestUserId === targetUserId || isSystemAdmin(requestUserId);
+}
+
+export async function getUser(userId: string): Promise<User | null> {
+  const key = `${DB_PREFIX.USER}${userId}`;
+
+  try {
+    const userData = await serverDb.get(key);
+    if (!userData) return null;
+
+    return {
+      id: userId,
+      username: userData.username,
+      email: userData.email || "",
+      balance: userData.balance || 0,
+      createdAt: userData.createdAt,
+      ...userData,
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to fetch user: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
+export async function handleGetUser(req: Request, userId: string) {
+  if (req.method === "OPTIONS") {
+    return handleOptionsRequest();
+  }
+
+  try {
+    // 权限检查
+    if (!canViewUserProfile(req.user?.userId, userId)) {
+      return createErrorResponse("Unauthorized: Insufficient permissions", 403);
+    }
+
+    const user = await getUser(userId);
+    if (!user) {
+      return createErrorResponse("User not found", 404);
+    }
+
+    return createSuccessResponse(user);
+  } catch (error) {
+    return createErrorResponse("Internal server error");
+  }
+}