nolo-cli 0.1.31 → 0.1.33

package/auth/server/sendEmail.ts

@@ -1,177 +0,0 @@
-import { DB_PREFIX } from "../../database/keys";
-import { getServerAuthorityStore } from "../../database/server/db";
-import {
-  checkAdminPermission,
-  createErrorResponse,
-  createSuccessResponse,
-  handleOptionsRequest,
-  logger,
-} from "../../auth/server/shared";
-import { sendManagedEmailBatch } from "./emailDelivery";
-import { canSendEmailToUser } from "./emailPolicy";
-
-interface SendEmailRequest {
-  subject: string;
-  body: string;
-  isHtml?: boolean;
-  userIds?: string[]; // Optional: if provided, only send to these users
-  tag?: string;
-}
-
-const parseNumber = (value: string | undefined, fallback: number, min = 1) => {
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed)) return fallback;
-  return Math.max(min, Math.floor(parsed));
-};
-
-const getBroadcastConfig = () => ({
-  batchSize: Math.min(100, parseNumber(process.env.EMAIL_BROADCAST_BATCH_SIZE, 20, 1)),
-  batchDelayMs: parseNumber(process.env.EMAIL_BROADCAST_BATCH_DELAY_MS, 500, 0),
-});
-
-const sleep = (ms: number) =>
-  ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
-
-export async function handleSendEmail(req: Request) {
-  if (req.method === "OPTIONS") {
-    return handleOptionsRequest();
-  }
-
-  const user = (req as any).user;
-  if (!user?.userId) {
-    return createErrorResponse("Unauthorized", 401);
-  }
-
-  const permissionError = checkAdminPermission(user.userId);
-  if (permissionError) return permissionError;
-
-  try {
-    const store = getServerAuthorityStore();
-    const broadcastConfig = getBroadcastConfig();
-    const { subject, body, isHtml, userIds, tag } = ((req as any).body ||
-      {}) as SendEmailRequest;
-
-    if (!subject || !body) {
-      return createErrorResponse("Subject and Body are required", 400);
-    }
-
-    const emailTag = tag?.trim() || "admin-broadcast";
-    const prefix = DB_PREFIX.USER;
-    const recipients: { email: string; id: string }[] = [];
-    const skippedRecipients: { id: string; reason: string }[] = [];
-    const now = Date.now();
-
-    if (userIds && userIds.length > 0) {
-      const uniqueIds = [...new Set(userIds.map((id: string) => id.trim()).filter(Boolean))];
-      for (const id of uniqueIds) {
-        try {
-          const userData = await store.get(prefix + id);
-          const decision = canSendEmailToUser(userData, emailTag, now);
-          if (decision.allowed) {
-            recipients.push({ email: String(userData.email), id });
-          } else {
-            skippedRecipients.push({ id, reason: decision.reason || "policy" });
-          }
-        } catch (error) {
-          logger.warn({ id, error }, "Failed to fetch user for email");
-        }
-      }
-    } else {
-      const iter = store.iterator({
-        gt: prefix,
-        lt: prefix + "\xFF",
-      });
-      try {
-        for await (const [key, value] of iter) {
-          const decision = canSendEmailToUser(value, emailTag, now);
-          if (decision.allowed) {
-            recipients.push({
-              email: String(value.email),
-              id: key.slice(prefix.length),
-            });
-          } else {
-            skippedRecipients.push({
-              id: key.slice(prefix.length),
-              reason: decision.reason || "policy",
-            });
-          }
-        }
-      } finally {
-        await (iter as any).close?.();
-      }
-    }
-
-    if (recipients.length === 0) {
-      return createSuccessResponse({
-        message: "No eligible recipients found (all skipped by policy)",
-        sentCount: 0,
-        failedCount: 0,
-        skippedCount: skippedRecipients.length,
-        skipped: skippedRecipients.slice(0, 100),
-      });
-    }
-
-    const sentIds = [];
-    const errors = [];
-
-    for (let start = 0; start < recipients.length; start += broadcastConfig.batchSize) {
-      const batch = recipients.slice(start, start + broadcastConfig.batchSize);
-      const batchResults = await sendManagedEmailBatch(
-        batch.map((recipient) => ({
-          userId: recipient.id,
-          to: recipient.email,
-          subject,
-          textBody: isHtml ? undefined : body,
-          htmlBody: isHtml ? body : undefined,
-          tag: emailTag,
-        }))
-      );
-
-      const queuedIds: string[] = [];
-      batchResults.forEach((result, index) => {
-        const recipient = batch[index];
-        if (result.suppressed) {
-          skippedRecipients.push({ id: recipient.id, reason: "frozen" });
-          return;
-        }
-        if (result.success || result.queued) {
-          sentIds.push(recipient.id);
-          if (result.queued) {
-            queuedIds.push(recipient.id);
-          }
-          return;
-        }
-        logger.error(
-          { recipientId: recipient.id, email: recipient.email, error: result.error },
-          "Failed to send admin email"
-        );
-        errors.push({ id: recipient.id, error: result.error || "Failed to send email" });
-      });
-
-      if (queuedIds.length > 0) {
-        logger.warn(
-          { queuedCount: queuedIds.length, queuedIds: queuedIds.slice(0, 20), emailTag },
-          "Some broadcast emails queued for retry"
-        );
-      }
-
-      if (start + broadcastConfig.batchSize < recipients.length) {
-        await sleep(broadcastConfig.batchDelayMs);
-      }
-    }
-
-    return createSuccessResponse({
-      message: `Attempted ${recipients.length} eligible emails (skipped ${skippedRecipients.length})`,
-      sentCount: sentIds.length,
-      failedCount: errors.length,
-      skippedCount: skippedRecipients.length,
-      skipped: skippedRecipients.slice(0, 100),
-      batchSize: broadcastConfig.batchSize,
-      batchDelayMs: broadcastConfig.batchDelayMs,
-      errors: errors.length > 0 ? errors : undefined,
-    });
-  } catch (error: any) {
-    logger.error({ error }, "Error in handleSendEmail");
-    return createErrorResponse(error.message || "Internal server error");
-  }
-}

package/auth/server/shared.ts

@@ -1,51 +0,0 @@
-// auth/server/shared.ts
-import { isSystemAdmin } from "../../core/init";
-import pino from "pino";
-
-export const logger = pino({
-  // transport: {
-  //   target: "pino-pretty",
-  //   options: {
-  //     colorize: true,
-  //     translateTime: "SYS:standard",
-  //     ignore: "pid,hostname",
-  //     messageFormat: "{msg}",
-  //     levelFirst: true,
-  //   },
-  // },
-  level: process.env.NODE_ENV === "production" ? "info" : "debug",
-});
-
-export const CORS_HEADERS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization",
-  "Content-Type": "application/json",
-};
-
-export function createErrorResponse(error: string, status: number = 500) {
-  logger.error({ error, status }, "Error response created");
-
-  return new Response(JSON.stringify({ error }), {
-    status,
-    headers: CORS_HEADERS,
-  });
-}
-
-export function createSuccessResponse(data: any, status: number = 200) {
-  return new Response(JSON.stringify(data), { status, headers: CORS_HEADERS });
-}
-
-export function handleOptionsRequest() {
-  return new Response(null, {
-    status: 204,
-    headers: CORS_HEADERS,
-  });
-}
-
-export function checkAdminPermission(actionUserId?: string | null) {
-  if (!isSystemAdmin(actionUserId)) {
-    return createErrorResponse("Unauthorized: Admin access required", 403);
-  }
-  return null;
-}

package/auth/server/signup.ts

@@ -1,430 +0,0 @@
-// database/server/signup.ts
-// 注册接口（按 IP 配额限制，默认：同一 IP 每日仅允许注册 1 个；支持灵活扩展周/月窗口）
-
-import i18nServer from "../../app/i18n/i18n.server";
-import { getServerAuthorityStore } from "../../database/server/db";
-import { writeStoreOps } from "../../database/server/storeBatchCompat";
-import { signMessage } from "../../core/crypto";
-import { generateUserIdV1 } from "../../core/generateMainKey";
-import {
-  createErrorResponse,
-  createSuccessResponse,
-  handleOptionsRequest,
-} from "./shared";
-import { DB_PREFIX, createUserKey } from "../../database/keys";
-import pino from "pino";
-import { ulid } from "ulid";
-import { Mutex } from "async-mutex";
-import { rechargeUserBalance } from "../server/recharge";
-import { prepareUserSettings } from "../../app/settings/prepareUserSetting";
-import {
-  creditInviterReward,
-  resolveValidInviterId,
-} from "../server/inviteReward";
-import { sendWelcomeEmailForUser } from "../server/emailAutomation";
-import { CORE_FLOW_STAGES } from "../server/emailAutomationTypes";
-import {
-  DEFAULT_SIGNUP_IP_QUOTAS,
-  shouldBypassSignupIpQuota,
-} from "./signupIpQuota";
-
-const logger = pino({ name: "signup" });
-const signupLocks = new Map<string, Mutex>();
-const signupIpLocks = new Map<string, Mutex>();
-const getSignupStore = () => getServerAuthorityStore();
-
-function getSignupLock(userId: string): Mutex {
-  let lock = signupLocks.get(userId);
-  if (!lock) {
-    lock = new Mutex();
-    signupLocks.set(userId, lock);
-  }
-  return lock;
-}
-
-function getSignupIpLock(ip: string): Mutex {
-  let lock = signupIpLocks.get(ip);
-  if (!lock) {
-    lock = new Mutex();
-    signupIpLocks.set(ip, lock);
-  }
-  return lock;
-}
-
-/**
- * 可配置的 IP 配额：
- * - 当前默认：每日 1 个
- * - 示例（未来可改）：[{ days: 1, limit: 2 }, { days: 7, limit: 5 }, { days: 30, limit: 10 }]
- */
-const IP_QUOTAS: Array<{ days: number; limit: number }> = [
-  ...DEFAULT_SIGNUP_IP_QUOTAS,
-];
-
-/** ========== IP 配额计数 ========== */
-
-const ABUSE_PREFIX = {
-  byIpDay: (ip: string, day: string) => `abuse:signup:ip:${ip}:${day}`, // value: string number
-};
-
-function isDbNotFoundError(err: any) {
-  return err?.code === "LEVEL_NOT_FOUND" || err?.notFound === true;
-}
-
-function getDayKey(d: Date = new Date()) {
-  // e.g., 2025-11-01 -> 20251101
-  return d.toISOString().slice(0, 10).replace(/-/g, "");
-}
-
-function getDayKeysBackwards(days: number): string[] {
-  const keys: string[] = [];
-  const now = new Date();
-  for (let i = 0; i < days; i++) {
-    const d = new Date(now);
-    d.setDate(now.getDate() - i);
-    keys.push(getDayKey(d));
-  }
-  return keys;
-}
-
-async function getIpDayCount(ip: string, dayKey: string): Promise<number> {
-  const serverDb = getSignupStore();
-  try {
-    const val = await serverDb.get(ABUSE_PREFIX.byIpDay(ip, dayKey));
-    const n = Number(val);
-    return Number.isFinite(n) ? n : 0;
-  } catch (e: any) {
-    if (isDbNotFoundError(e)) return 0;
-    throw e;
-  }
-}
-
-async function getIpCountInDays(ip: string, days: number): Promise<number> {
-  const keys = getDayKeysBackwards(days);
-  const counts = await Promise.all(keys.map((k) => getIpDayCount(ip, k)));
-  return counts.reduce((a, b) => a + b, 0);
-}
-
-function windowLabel(days: number) {
-  if (days === 1) return "今日";
-  if (days === 7) return "近7日";
-  if (days === 30) return "近30日";
-  return `近${days}日`;
-}
-
-async function checkIpQuotas(ip: string, t: any) {
-  for (const q of IP_QUOTAS) {
-    const used = await getIpCountInDays(ip, q.days);
-    if (used >= q.limit) {
-      const defaultMsg = `${windowLabel(q.days)}该 IP 注册数已达上限（限制：${q.limit}）`;
-      const msg =
-        typeof t === "function"
-          ? t("errors.ipQuotaExceeded") || defaultMsg
-          : defaultMsg;
-      return createErrorResponse(msg, 429);
-    }
-  }
-  return null;
-}
-
-async function recordIpRegistration(ip: string) {
-  const serverDb = getSignupStore();
-  const today = getDayKey();
-  const key = ABUSE_PREFIX.byIpDay(ip, today);
-  let count = 0;
-  try {
-    count = Number(await serverDb.get(key)) || 0;
-  } catch (e: any) {
-    // LEVEL_NOT_FOUND => 从 0 开始
-  }
-  await serverDb.put(key, String(count + 1));
-}
-
-/** ========== 原有辅助函数（传入 t） ========== */
-
-function validateRequestMethod(method: string, t: any) {
-  if (method === "OPTIONS") {
-    return handleOptionsRequest();
-  }
-  if (method !== "POST") {
-    return createErrorResponse(t("errors.methodNotAllowed"), 405);
-  }
-  return null;
-}
-
-function extractUserData(body: any, t: any) {
-  const { username, publicKey, locale, email, inviterId } = body || {};
-  if (!username || !publicKey || !locale) {
-    return createErrorResponse(t("errors.missingFields"), 400);
-  }
-  const normalizedInviterId =
-    typeof inviterId === "string" ? inviterId.trim() : undefined;
-  return {
-    username,
-    publicKey,
-    locale,
-    email,
-    inviterId: normalizedInviterId || undefined,
-  };
-}
-
-function generateUserId(publicKey: string, username: string, locale: string) {
-  return generateUserIdV1(publicKey, username, locale);
-}
-
-async function checkUserExists(userId: string, t: any) {
-  const serverDb = getSignupStore();
-  try {
-    const existingUser = await serverDb.get(DB_PREFIX.USER + userId);
-    if (existingUser) {
-      return createErrorResponse(t("errors.dataExists", { id: userId }), 409);
-    }
-  } catch (err: any) {
-    if (!isDbNotFoundError(err)) {
-      throw err;
-    }
-  }
-  return null;
-}
-
-/**
- * 显式构造对象，只在有值时写入可选字段，行为等价但更直观。
- */
-function prepareUserData(userData: any) {
-  const now = Date.now();
-  const prepared: any = {
-    username: userData.username,
-    publicKey: userData.publicKey,
-    locale: userData.locale,
-    createdAt: now,
-    lastActiveAt: now,
-    lastLoginAt: now,
-    balance: 0,
-    balanceUpdatedAt: now,
-    tokenVersion: 0,
-    tokenVersionUpdatedAt: now,
-    coreFlowStage: CORE_FLOW_STAGES.signupStarted,
-    coreFlowStageUpdatedAt: now,
-  };
-
-  if (userData.email != null) {
-    prepared.email = userData.email;
-  }
-  if (userData.inviterId != null) {
-    prepared.inviterId = userData.inviterId;
-  }
-
-  return prepared;
-}
-
-function prepareUserProfile(username: string, email?: string) {
-  const now = Date.now();
-  return {
-    nickname: username,
-    avatar: "",
-    bio: "",
-    createdAt: now,
-    updatedAt: now,
-    email,
-  };
-}
-
-async function saveUserDataToDb(
-  userId: string,
-  userData: any,
-  userSettings: any,
-  userProfile: any
-) {
-  const serverDb = getSignupStore();
-  await writeStoreOps(serverDb, [
-    { type: "put", key: DB_PREFIX.USER + userId, value: userData },
-    { type: "put", key: createUserKey.settings(userId), value: userSettings },
-    { type: "put", key: createUserKey.profile(userId), value: userProfile },
-  ]);
-}
-
-async function rollbackUserDataFromDb(userId: string) {
-  const serverDb = getSignupStore();
-  await writeStoreOps(serverDb, [
-    { type: "del", key: DB_PREFIX.USER + userId },
-    { type: "del", key: createUserKey.settings(userId) },
-    { type: "del", key: createUserKey.profile(userId) },
-  ]);
-}
-
-function signUserMessage(
-  username: string,
-  userId: string,
-  publicKey: string,
-  tokenVersion: number,
-  t: any
-) {
-  const message = JSON.stringify({ username, userId, publicKey, tokenVersion });
-  const secretKey = process.env.SECRET_KEY;
-  if (!secretKey) {
-    return createErrorResponse(t("errors.secretKeyMissing"), 500);
-  }
-  return signMessage(message, secretKey);
-}
-
-/** ========== 主处理函数（仅依赖 req.ip，不再从 headers 回退解析） ========== */
-
-export async function handleSignUp(req: any) {
-  let t: any = null; // 在 try 外声明 t，catch 中可用
-  try {
-    // i18n（仍从 headers 读取语言，这个在上游已透传）
-    const acceptLanguage: string | null = req.headers?.get("accept-language");
-    const lng = acceptLanguage?.split(",")[0] || "zh-CN";
-    t = await i18nServer.cloneInstance({ lng }).init();
-
-    // 1) 方法校验
-    const methodValidation = validateRequestMethod(req.method, t);
-    if (methodValidation) return methodValidation;
-
-    // 2) 解析 body 并校验
-    const userDataResult = extractUserData(req.body, t);
-    if (userDataResult instanceof Response) return userDataResult;
-    const { username, publicKey, locale, email, inviterId } = userDataResult;
-
-    // 3) 取 IP：仅依赖上游注入的 req.ip
-    const ip: string | null = req.ip || null;
-
-    if (!ip) {
-      // 若上游没有提供 IP，这里仅记录；如需严格限制，可改为直接返回 400/403
-      logger.warn(
-        { username, reportedClientIp: req?.reportedClientIp },
-        "Could not determine client IP for signup."
-      );
-    }
-
-    const runSignup = async () => {
-      // 4) 生成 userId 并查重
-      const userId = generateUserId(publicKey, username, locale);
-      const validatedInviterId = await resolveValidInviterId(
-        inviterId,
-        userId,
-        logger
-      );
-
-      const signupLock = getSignupLock(userId);
-      return await signupLock.runExclusive(async () => {
-        const userExistsResult = await checkUserExists(userId, t);
-        if (userExistsResult) return userExistsResult;
-
-        // 5) 组装并写入
-        const userData = prepareUserData({
-          ...userDataResult,
-          inviterId: validatedInviterId,
-        });
-        const userSettings = prepareUserSettings(locale);
-        const userProfile = prepareUserProfile(username, email);
-        await saveUserDataToDb(userId, userData, userSettings, userProfile);
-
-        // 6) 赠送余额（失败则回滚，避免“注册成功但余额未到账”）
-        const initialBalance = validatedInviterId ? 6 : 3;
-        const reason = validatedInviterId
-          ? "invited_signup_bonus"
-          : "new_user_bonus";
-        const initialRechargeResult = await rechargeUserBalance(
-          userId,
-          initialBalance,
-          reason,
-          `signup_${userId}_${ulid()}`
-        );
-        if (!initialRechargeResult.success) {
-          logger.error(
-            { userId, initialBalance, error: initialRechargeResult.error },
-            "CRITICAL: Failed to credit initial balance for new user."
-          );
-          try {
-            await rollbackUserDataFromDb(userId);
-          } catch (rollbackError) {
-            logger.error(
-              { userId, rollbackError },
-              "Failed to rollback signup data after initial balance credit failure."
-            );
-          }
-          const errorMessage = t
-            ? t("errors.internalServerError")
-            : "Internal Server Error";
-          return createErrorResponse(errorMessage, 500);
-        }
-
-        try {
-          await creditInviterReward(validatedInviterId, userId, logger);
-        } catch (error) {
-          logger.warn(
-            { userId, inviterId: validatedInviterId, error },
-            "Failed to credit inviter reward after signup"
-          );
-        }
-
-        try {
-          await sendWelcomeEmailForUser(userId, userData);
-        } catch (error) {
-          logger.warn(
-            { userId, email: userData.email, error },
-            "Welcome email send failed after signup"
-          );
-        }
-
-        // 7) 成功后计入“今日 +1”
-        if (ip) {
-          try {
-            await recordIpRegistration(ip);
-          } catch (e) {
-            logger.warn(
-              { ip, userId, err: e },
-              "Failed to record IP registration count."
-            );
-          }
-        }
-
-        // 8) 签名返回
-        const encryptedDataResult = signUserMessage(
-          username,
-          userId,
-          publicKey,
-          userData.tokenVersion,
-          t
-        );
-        if (encryptedDataResult instanceof Response) return encryptedDataResult;
-        const encryptedData = encryptedDataResult;
-
-        return createSuccessResponse({ encryptedData });
-      });
-    };
-
-    if (!ip) {
-      return await runSignup();
-    }
-
-    if (
-      shouldBypassSignupIpQuota({
-        ip,
-        hostHeader: req.headers?.get?.("host"),
-        nodeEnv: process.env.NODE_ENV,
-      })
-    ) {
-      return runSignup();
-    }
-
-    const ipLock = getSignupIpLock(ip);
-    return await ipLock.runExclusive(async () => {
-      const quotaRes = await checkIpQuotas(ip, t);
-      if (quotaRes) {
-        logger.warn(
-          { ip, username, reportedClientIp: req?.reportedClientIp },
-          "Blocked signup due to IP quota limit."
-        );
-        return quotaRes;
-      }
-      return runSignup();
-    });
-  } catch (error) {
-    logger.error({ error }, "An unexpected error occurred during signup.");
-    const errorMessage = t
-      ? t("errors.internalServerError")
-      : "Internal Server Error";
-    return createErrorResponse(errorMessage, 500);
-  }
-}

package/auth/server/signupIpQuota.ts

@@ -1,44 +0,0 @@
-export const DEFAULT_SIGNUP_IP_QUOTAS: Array<{ days: number; limit: number }> = [
-  { days: 1, limit: 1 },
-];
-
-const normalizeHost = (hostHeader?: string | null) => {
-  const raw = String(hostHeader || "").trim().toLowerCase();
-  if (!raw) return "";
-  if (raw.startsWith("[") && raw.includes("]")) {
-    const end = raw.indexOf("]");
-    return raw.slice(1, end);
-  }
-  return raw.split(":")[0];
-};
-
-const isLoopbackIp = (ip: string) => {
-  const normalized = String(ip || "").trim().toLowerCase();
-  if (!normalized) return false;
-  return (
-    normalized === "::1" ||
-    normalized === "::ffff:127.0.0.1" ||
-    normalized === "127.0.0.1" ||
-    normalized.startsWith("127.")
-  );
-};
-
-const isLocalHost = (hostHeader?: string | null) => {
-  const host = normalizeHost(hostHeader);
-  return host === "localhost" || host === "127.0.0.1" || host === "::1";
-};
-
-export const shouldBypassSignupIpQuota = ({
-  ip,
-  hostHeader,
-  nodeEnv,
-}: {
-  ip: string;
-  hostHeader?: string | null;
-  nodeEnv?: string;
-}) => {
-  if (String(nodeEnv || "").toLowerCase() === "production") {
-    return false;
-  }
-  return isLoopbackIp(ip) || isLocalHost(hostHeader);
-};