nolo-cli 0.1.31 → 0.1.32

package/auth/server/emailRuntimeConfig.ts

@@ -1,86 +0,0 @@
-import { getServerAuthorityStore } from "../../database/server/db";
-import {
-  checkAdminPermission,
-  createErrorResponse,
-  createSuccessResponse,
-  handleOptionsRequest,
-} from "./shared";
-import {
-  EMAIL_RUNTIME_CONFIG_KEY,
-  applyEmailRuntimeConfigFromDb,
-  isEmailRuntimeConfigKey,
-  readEmailRuntimeConfigFromDb,
-} from "./emailDbConfig";
-
-const normalizeConfigPatch = (input: unknown): Record<string, string | number | boolean | null> => {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return {};
-  const patch: Record<string, string | number | boolean | null> = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!isEmailRuntimeConfigKey(key)) continue;
-    if (value === null) {
-      patch[key] = null;
-      continue;
-    }
-    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      patch[key] = value;
-    }
-  }
-  return patch;
-};
-
-export async function handleGetEmailRuntimeConfig(req: Request) {
-  if (req.method === "OPTIONS") return handleOptionsRequest();
-
-  const user = (req as any).user;
-  if (!user?.userId) {
-    return createErrorResponse("Unauthorized", 401);
-  }
-  const permissionError = checkAdminPermission(user.userId);
-  if (permissionError) return permissionError;
-
-  const config = (await readEmailRuntimeConfigFromDb()) || {};
-  return createSuccessResponse({
-    key: EMAIL_RUNTIME_CONFIG_KEY,
-    config,
-  });
-}
-
-export async function handleUpdateEmailRuntimeConfig(req: Request) {
-  const store = getServerAuthorityStore();
-  if (req.method === "OPTIONS") return handleOptionsRequest();
-
-  const user = (req as any).user;
-  if (!user?.userId) {
-    return createErrorResponse("Unauthorized", 401);
-  }
-  const permissionError = checkAdminPermission(user.userId);
-  if (permissionError) return permissionError;
-
-  const body = ((req as any).body || {}) as {
-    config?: Record<string, unknown>;
-  };
-  const patch = normalizeConfigPatch(body.config);
-  if (Object.keys(patch).length === 0) {
-    return createErrorResponse("No valid email runtime config fields provided", 400);
-  }
-
-  const currentRaw = (await readEmailRuntimeConfigFromDb()) || {};
-  const next: Record<string, unknown> = { ...currentRaw };
-  for (const [key, value] of Object.entries(patch)) {
-    if (value === null) {
-      delete next[key];
-      continue;
-    }
-    next[key] = value;
-  }
-
-  await store.put(EMAIL_RUNTIME_CONFIG_KEY, next);
-  const { appliedKeys } = await applyEmailRuntimeConfigFromDb();
-
-  return createSuccessResponse({
-    message: "Email runtime config updated",
-    key: EMAIL_RUNTIME_CONFIG_KEY,
-    config: next,
-    appliedKeys,
-  });
-}

package/auth/server/emailScenarioNotifications.ts

@@ -1,341 +0,0 @@
-import { ulid } from "ulid";
-import { getServerAuthorityStore } from "../../database/server/db";
-import { DB_PREFIX } from "../../database/keys";
-import { canSendEmailToUser } from "./emailPolicy";
-import { sendManagedEmail } from "./emailDelivery";
-import { balanceLockManager } from "./locks";
-import { logger } from "./shared";
-
-interface NotificationUserRecord {
-  userId?: string;
-  email?: string;
-  username?: string;
-  emailOptOutAll?: boolean;
-  emailMutedUntil?: number;
-  emailOptOutTags?: string[];
-  isDisabled?: boolean;
-}
-
-const DAY_MS = 24 * 60 * 60 * 1000;
-const parseNumber = (value: string | undefined, fallback: number, min = 1) => {
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed)) return fallback;
-  return Math.max(min, Math.floor(parsed));
-};
-const getSecurityLoginConfig = () => ({
-  failThreshold: parseNumber(process.env.EMAIL_SECURITY_LOGIN_FAIL_THRESHOLD, 5, 1),
-  alertCooldownDays: parseNumber(process.env.EMAIL_SECURITY_LOGIN_ALERT_COOLDOWN_DAYS, 1, 1),
-});
-
-const LOGIN_FAIL_KEY_PREFIX = "security:login-fail-count:";
-const LOGIN_ALERT_KEY_PREFIX = "security:login-fail-alert:";
-
-const getDayKey = (time: number = Date.now()) =>
-  new Date(time).toISOString().slice(0, 10).replace(/-/g, "");
-
-const isValidReasonForRechargeNotice = (reason: string) => {
-  const value = String(reason || "").trim().toLowerCase();
-  if (!value) return false;
-  if (value.startsWith("invite_reward_for_")) return false;
-  if (value.includes("bonus")) return false;
-  if (value.includes("reward")) return false;
-  if (value.includes("rollback")) return false;
-  return true;
-};
-
-const normalizeErrorMessage = (error?: string) => {
-  if (!error) return "系统未返回详细错误，请稍后重试。";
-  if (error.length <= 300) return error;
-  return `${error.slice(0, 297)}...`;
-};
-
-const getSafeUsername = (user: NotificationUserRecord) =>
-  user.username && user.username.trim() ? user.username.trim() : "用户";
-
-const getAppName = () => process.env.EMAIL_APP_NAME || "Nolo";
-const getAppUrl = () => process.env.EMAIL_APP_URL || "https://nolo.run";
-const escapeHtml = (value: string) =>
-  String(value || "")
-    .replaceAll("&", "&amp;")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;")
-    .replaceAll("'", "&#39;");
-const normalizePublicUrl = (url: string) => {
-  if (!url) return "";
-  try {
-    const parsed = new URL(url);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "";
-    return parsed.toString();
-  } catch {
-    return "";
-  }
-};
-
-const joinPublicUrl = (baseUrl: string, path: string) => {
-  if (!baseUrl) return "";
-  try {
-    return new URL(path, baseUrl).toString();
-  } catch {
-    return "";
-  }
-};
-
-const getUserById = async (userId: string): Promise<NotificationUserRecord | null> => {
-  if (!userId) return null;
-  const key = `${DB_PREFIX.USER}${userId}`;
-  const user = await getServerAuthorityStore().get(key).catch(() => null);
-  if (!user || typeof user !== "object") return null;
-  return user as NotificationUserRecord;
-};
-
-export async function notifyRechargeResultEmail(params: {
-  userId: string;
-  amount: number;
-  reason: string;
-  success: boolean;
-  error?: string;
-}) {
-  const user = await getUserById(params.userId);
-  if (!user?.email || !isValidReasonForRechargeNotice(params.reason)) return;
-
-  const tag = params.success ? "recharge-success" : "recharge-failed";
-  const allowed = canSendEmailToUser(user, tag);
-  if (!allowed.allowed) return;
-
-  const username = getSafeUsername(user);
-  const appName = getAppName();
-  const appUrl = normalizePublicUrl(getAppUrl());
-  const amountText = Number(params.amount || 0).toFixed(2);
-  const reasonText = params.reason || "recharge";
-  const safeUsername = escapeHtml(username);
-  const safeReasonText = escapeHtml(reasonText);
-  const safeAmountText = escapeHtml(amountText);
-  const accountUrl = joinPublicUrl(appUrl, "/account");
-  const safeAccountUrl = escapeHtml(accountUrl);
-
-  const subject = params.success
-    ? `[${appName}] 充值成功通知`
-    : `[${appName}] 充值失败通知`;
-
-  const textBody = params.success
-    ? `你好 ${username}，\n\n你的充值已成功到账。\n- 金额：${amountText}\n- 业务原因：${reasonText}\n\n${
-        accountUrl ? `查看账户：${accountUrl}` : "请在客户端查看最新余额与流水。"
-      }`
-    : `你好 ${username}，\n\n你的充值未成功。\n- 金额：${amountText}\n- 业务原因：${reasonText}\n- 失败详情：${normalizeErrorMessage(params.error)}\n\n请稍后重试；若持续失败，请联系支持。`;
-
-  const htmlBody = params.success
-    ? `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
-      `<p>你好 ${safeUsername}，</p>` +
-      `<p>你的充值已成功到账。</p>` +
-      `<ul><li>金额：<b>${safeAmountText}</b></li><li>业务原因：${safeReasonText}</li></ul>` +
-      (accountUrl ? `<p><a href="${safeAccountUrl}">查看账户明细</a></p>` : `<p>请在客户端查看最新余额与流水。</p>`) +
-      `</div>`
-    : `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
-      `<p>你好 ${safeUsername}，</p>` +
-      `<p>你的充值未成功。</p>` +
-      `<ul><li>金额：<b>${safeAmountText}</b></li><li>业务原因：${safeReasonText}</li><li>失败详情：${escapeHtml(
-        normalizeErrorMessage(params.error)
-      )}</li></ul>` +
-      `<p>请稍后重试；若持续失败，请联系支持。</p>` +
-      `</div>`;
-
-  await sendManagedEmail({
-    userId: params.userId,
-    to: user.email,
-    subject,
-    textBody,
-    htmlBody,
-    tag,
-    metadata: {
-      reason: reasonText,
-      amount: params.amount,
-      success: params.success,
-    },
-  }).catch((error) => {
-    logger.warn({
-      userId: params.userId,
-      reason: reasonText,
-      error: error?.message || String(error),
-    }, "Failed to send recharge result email");
-  });
-}
-
-export async function notifyAccountStatusChangeEmail(params: {
-  userId: string;
-  disabled: boolean;
-  operator?: string;
-}) {
-  const user = await getUserById(params.userId);
-  if (!user?.email) return;
-  const tag = params.disabled ? "account-disabled" : "account-enabled";
-  const allowed = canSendEmailToUser(user, tag);
-  if (!allowed.allowed) return;
-
-  const username = getSafeUsername(user);
-  const appName = getAppName();
-  const appUrl = normalizePublicUrl(getAppUrl());
-  const settingsUrl = joinPublicUrl(appUrl, "/settings");
-  const actionText = params.disabled ? "已暂停" : "已恢复";
-  const safeUsername = escapeHtml(username);
-  const safeActionText = escapeHtml(actionText);
-  const safeOperator = params.operator ? escapeHtml(params.operator) : "";
-  const safeSettingsUrl = escapeHtml(settingsUrl);
-  const subject = params.disabled
-    ? `[${appName}] 账号暂停通知`
-    : `[${appName}] 账号恢复通知`;
-
-  const textBody = `你好 ${username}，\n\n你的账号${actionText}。\n${
-    params.operator ? `操作人：${params.operator}\n` : ""
-  }\n如有疑问，请联系支持。${settingsUrl ? `\n\n账号设置：${settingsUrl}` : ""}`;
-
-  const htmlBody =
-    `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
-    `<p>你好 ${safeUsername}，</p>` +
-    `<p>你的账号<strong>${safeActionText}</strong>。</p>` +
-    (safeOperator ? `<p>操作人：${safeOperator}</p>` : "") +
-    `<p>如有疑问，请联系支持。</p>` +
-    (settingsUrl ? `<p><a href="${safeSettingsUrl}">前往账号设置</a></p>` : "") +
-    `</div>`;
-
-  await sendManagedEmail({
-    userId: params.userId,
-    to: user.email,
-    subject,
-    textBody,
-    htmlBody,
-    tag,
-    metadata: {
-      disabled: params.disabled,
-      operator: params.operator,
-    },
-  }).catch((error) => {
-    logger.warn({
-      userId: params.userId,
-      disabled: params.disabled,
-      error: error?.message || String(error),
-    }, "Failed to send account status email");
-  });
-}
-
-export async function clearTodayLoginFailureCounter(userId: string) {
-  if (!userId) return;
-  const dayKey = getDayKey();
-  const countKey = `${LOGIN_FAIL_KEY_PREFIX}${userId}:${dayKey}`;
-  await getServerAuthorityStore().del(countKey).catch(() => undefined);
-}
-
-export async function recordLoginFailureAndMaybeNotify(params: {
-  userId: string;
-  ip?: string;
-  reason: string;
-  userAgent?: string;
-}) {
-  if (!params.userId) return;
-  const securityConfig = getSecurityLoginConfig();
-  const now = Date.now();
-  const dayKey = getDayKey(now);
-  const countKey = `${LOGIN_FAIL_KEY_PREFIX}${params.userId}:${dayKey}`;
-  const lock = balanceLockManager.getLock(`login-fail:${params.userId}:${dayKey}`);
-  const store = getServerAuthorityStore();
-
-  let shouldNotify = false;
-  let failCount = 0;
-
-  await lock.runExclusive(async () => {
-    const currentCount = Number((await store.get(countKey).catch(() => 0)) || 0);
-    failCount = currentCount + 1;
-    await store.put(countKey, failCount);
-
-    const alertDayKey = getDayKey(now - (securityConfig.alertCooldownDays - 1) * DAY_MS);
-    const alertIter = store.iterator({
-      gt: `${LOGIN_ALERT_KEY_PREFIX}${params.userId}:${alertDayKey}`,
-      lt: `${LOGIN_ALERT_KEY_PREFIX}${params.userId}:\xFF`,
-      reverse: true,
-      limit: 1,
-    });
-    let alreadyNotified = false;
-    try {
-      for await (const _entry of alertIter) {
-        alreadyNotified = true;
-        break;
-      }
-    } finally {
-      await (alertIter as any).close?.();
-    }
-
-    if (failCount >= securityConfig.failThreshold && !alreadyNotified) {
-      const alertKey = `${LOGIN_ALERT_KEY_PREFIX}${params.userId}:${dayKey}:${ulid(now)}`;
-      await store.put(alertKey, {
-        userId: params.userId,
-        dayKey,
-        failCount,
-        createdAt: now,
-      });
-      shouldNotify = true;
-    }
-  });
-
-  if (!shouldNotify) return;
-
-  const user = await getUserById(params.userId);
-  if (!user?.email) return;
-  const allowed = canSendEmailToUser(user, "security-login-alert");
-  if (!allowed.allowed) return;
-
-  const username = getSafeUsername(user);
-  const appName = getAppName();
-  const appUrl = normalizePublicUrl(getAppUrl());
-  const settingsUrl = joinPublicUrl(appUrl, "/settings");
-  const reasonText = params.reason || "登录验证失败";
-  const ipText = params.ip || "未知 IP";
-  const uaText = params.userAgent || "未知设备";
-  const safeUsername = escapeHtml(username);
-  const safeReasonText = escapeHtml(reasonText);
-  const safeIpText = escapeHtml(ipText);
-  const safeUaText = escapeHtml(uaText);
-  const safeSettingsUrl = escapeHtml(settingsUrl);
-  const subject = `[${appName}] 登录安全提醒`;
-  const textBody =
-    `你好 ${username}，\n\n系统检测到你的账号出现多次登录失败，请及时核查：\n` +
-    `- 今日失败次数：${failCount}\n` +
-    `- 最近失败原因：${reasonText}\n` +
-    `- 来源 IP：${ipText}\n` +
-    `- 设备：${uaText}\n\n` +
-    `如果这不是你本人操作，请尽快修改密码。` +
-    (settingsUrl ? `\n账号设置：${settingsUrl}` : "");
-
-  const htmlBody =
-    `<div style="font-family:Arial,sans-serif;line-height:1.6;color:#111;">` +
-    `<p>你好 ${safeUsername}，</p>` +
-    `<p>系统检测到你的账号出现多次登录失败，请及时核查：</p>` +
-    `<ul>` +
-    `<li>今日失败次数：<b>${failCount}</b></li>` +
-    `<li>最近失败原因：${safeReasonText}</li>` +
-    `<li>来源 IP：${safeIpText}</li>` +
-    `<li>设备：${safeUaText}</li>` +
-    `</ul>` +
-    `<p>如果这不是你本人操作，请尽快修改密码。</p>` +
-    (settingsUrl ? `<p><a href="${safeSettingsUrl}">前往账号设置</a></p>` : "") +
-    `</div>`;
-
-  await sendManagedEmail({
-    userId: params.userId,
-    to: user.email,
-    subject,
-    textBody,
-    htmlBody,
-    tag: "security-login-alert",
-    metadata: {
-      failCount,
-      reason: reasonText,
-      ip: ipText,
-    },
-  }).catch((error) => {
-    logger.warn({
-      userId: params.userId,
-      failCount,
-      error: error?.message || String(error),
-    }, "Failed to send login security email");
-  });
-}

package/auth/server/enable.ts

@@ -1,62 +0,0 @@
-// auth/server/enable.ts
-import { getServerAuthorityStore } from "../../database/server/db";
-import { DB_PREFIX } from "../../database/keys";
-import {
-  createErrorResponse,
-  createSuccessResponse,
-  handleOptionsRequest,
-  checkAdminPermission,
-} from "./shared";
-import { balanceLockManager } from "./locks";
-import { notifyAccountStatusChangeEmail } from "./emailScenarioNotifications";
-
-async function enableUser(userId: string) {
-  const store = getServerAuthorityStore();
-  const lock = balanceLockManager.getLock(userId);
-  await lock.runExclusive(async () => {
-    const userKey = `${DB_PREFIX.USER}${userId}`;
-    const userData = await store.get(userKey).catch(() => null);
-
-    if (!userData) {
-      throw new Error("User not found");
-    }
-
-    // 更新用户数据，取消停用状态
-    const updatedUserData = {
-      ...userData,
-      isDisabled: false,
-      enabledAt: new Date().toISOString(), // 记录启用时间，可选
-    };
-    await store.put(userKey, updatedUserData);
-  });
-}
-
-export async function handleEnableUser(req: Request, userId: string) {
-  if (req.method === "OPTIONS") {
-    return handleOptionsRequest();
-  }
-
-  const { userId: actionUserId } = req.user;
-
-  const permissionError = checkAdminPermission(actionUserId);
-  if (permissionError) return permissionError;
-
-  try {
-    if (!userId) {
-      return createErrorResponse("User ID is required", 400);
-    }
-
-    await enableUser(userId);
-    void notifyAccountStatusChangeEmail({
-      userId,
-      disabled: false,
-      operator: actionUserId,
-    });
-    return createSuccessResponse({ success: true });
-  } catch (error) {
-    if (error.message === "User not found") {
-      return createErrorResponse("User not found", 404);
-    }
-    return createErrorResponse("Failed to enable user");
-  }
-}

package/auth/server/getRechargeHistory.ts

@@ -1,111 +0,0 @@
-// auth/server/getRechargeHistory.ts
-
-import { authenticateRequest } from "../utils";
-import { createTransactionKey } from "../../database/keys";
-import { getServerAuthorityStore } from "../../database/server/db";
-import {
-  checkAdminPermission,
-  createErrorResponse,
-  createSuccessResponse,
-  logger,
-} from "./shared";
-
-/**
- * Admin-only handler to retrieve recharge history for a specific user.
- * Supports cursor-based pagination.
- */
-export const handleGetRechargeHistory = async (
-  req: Request,
-  params?: { userId?: string }
-) => {
-  const store = getServerAuthorityStore();
-  try {
-    // Step 1: Authenticate request
-    const authResult = await authenticateRequest(req);
-    if (authResult instanceof Response) {
-      return authResult;
-    }
-    const { userId: requestUserId } = authResult;
-
-    // Step 2: Check admin permission
-    const adminCheck = checkAdminPermission(requestUserId);
-    if (adminCheck) {
-      return adminCheck;
-    }
-
-    // Step 3: Extract target userId from params
-    const targetUserId = params?.userId;
-    if (!targetUserId) {
-      return createErrorResponse("Missing userId parameter", 400);
-    }
-
-    // Step 4: Parse request body for pagination parameters
-    let body: { limit?: number; cursor?: string } = {};
-    try {
-      body = await req.json();
-    } catch (e) {
-      // Request body empty or invalid, use defaults
-    }
-
-    const limit = body.limit || 20;
-    const cursor = body.cursor;
-
-    // Step 5: Build query using transaction key range
-    const { start, end } = createTransactionKey.range(targetUserId);
-
-    const queryOptions: any = {
-      gte: start,
-      lte: end,
-    };
-
-    // Step 6: Query database and filter for recharge records. Transaction keys
-    // are keyed by txId, so sort by persisted timestamp instead of key order.
-    const iterator = store.iterator(queryOptions);
-    const records = [];
-
-    for await (const [, value] of iterator) {
-      if (value.type === "recharge") {
-        records.push(value);
-      }
-    }
-
-    records.sort((a, b) => {
-      const timestampDiff = Number(b.timestamp || 0) - Number(a.timestamp || 0);
-      if (timestampDiff !== 0) return timestampDiff;
-      return String(b.txId || "").localeCompare(String(a.txId || ""));
-    });
-
-    const totalCount = records.length;
-    const totalAmount = records.reduce(
-      (sum, record) => sum + Number(record.amount || 0),
-      0
-    );
-
-    // Step 7: Prepare response with pagination
-    const startIndex = cursor
-      ? Math.max(
-          records.findIndex((record) => record.txId === cursor) + 1,
-          0
-        )
-      : 0;
-    const pageRecords = records.slice(startIndex, startIndex + limit);
-    let nextCursor: string | null = null;
-    if (startIndex + pageRecords.length < records.length) {
-      nextCursor = pageRecords[pageRecords.length - 1]?.txId || null;
-    }
-
-    return createSuccessResponse({
-      success: true,
-      data: pageRecords,
-      nextCursor,
-      totalAmount,
-      totalCount,
-    });
-  } catch (error: any) {
-    logger.error({ error }, "Failed to get recharge history");
-    return createErrorResponse(
-      "Internal server error while fetching recharge history.",
-      500
-    );
-  }
-};

package/auth/server/getUser.ts

@@ -1,72 +0,0 @@
-// auth/server/getUser.ts
-import { getServerAuthorityStore } from "../../database/server/db";
-import {
-  createErrorResponse,
-  createSuccessResponse,
-  handleOptionsRequest,
-} from "./shared";
-import { isSystemAdmin } from "../../core/init";
-import { DB_PREFIX } from "../../database/keys";
-
-interface User {
-  id: string;
-  username: string;
-  email: string;
-  balance: number;
-  createdAt: string;
-  [key: string]: any;
-}
-
-// 权限检查工具函数，复用性更强
-function canViewUserProfile(
-  requestUserId: string | undefined,
-  targetUserId: string
-) {
-  if (!requestUserId) return false;
-  return requestUserId === targetUserId || isSystemAdmin(requestUserId);
-}
-
-export async function getUser(userId: string): Promise<User | null> {
-  const store = getServerAuthorityStore();
-  const key = `${DB_PREFIX.USER}${userId}`;
-
-  try {
-    const userData = await store.get(key);
-    if (!userData) return null;
-
-    return {
-      id: userId,
-      username: userData.username,
-      email: userData.email || "",
-      balance: userData.balance || 0,
-      createdAt: userData.createdAt,
-      ...userData,
-    };
-  } catch (error) {
-    throw new Error(
-      `Failed to fetch user: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
-export async function handleGetUser(req: Request, userId: string) {
-  if (req.method === "OPTIONS") {
-    return handleOptionsRequest();
-  }
-
-  try {
-    // 权限检查
-    if (!canViewUserProfile(req.user?.userId, userId)) {
-      return createErrorResponse("Unauthorized: Insufficient permissions", 403);
-    }
-
-    const user = await getUser(userId);
-    if (!user) {
-      return createErrorResponse("User not found", 404);
-    }
-
-    return createSuccessResponse(user);
-  } catch (error) {
-    return createErrorResponse("Internal server error");
-  }
-}