oak-backend-base 4.1.8 → 4.1.10

package/lib/Synchronizer.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
 const types_1 = require("oak-domain/lib/types");
 const relationPath_1 = require("oak-domain/lib/utils/relationPath");
 const assert_1 = tslib_1.__importDefault(require("assert"));
@@ -11,6 +12,52 @@ const uuid_1 = require("oak-domain/lib/utils/uuid");
 const lodash_2 = require("lodash");
 const OAK_SYNC_HEADER_ENTITY = 'oak-sync-entity';
 const OAK_SYNC_HEADER_ENTITY_ID = 'oak-sync-entity-id';
+const OAK_SYNC_HEADER_TIMESTAMP = 'oak-sync-timestamp';
+const OAK_SYNC_HEADER_NONCE = 'oak-sync-nonce';
+const OAK_SYNC_HEADER_SIGN = 'oak-sync-sign';
+function generateSignStr(body, ts, nonce) {
+    return `${body}\n${ts}\n${nonce}`;
+}
+async function sign(privateKey, body) {
+    const ts = Date.now();
+    const nonce = await (0, uuid_1.generateNewIdAsync)();
+    const sign2 = (0, crypto_1.createSign)('SHA256');
+    sign2.update(generateSignStr(body, `${ts}`, nonce));
+    sign2.end();
+    const signature = sign2.sign(privateKey).toString('hex');
+    return {
+        ts,
+        nonce,
+        signature,
+    };
+}
+function verify(publicKey, body, ts, nonce, signature) {
+    const verify2 = (0, crypto_1.createVerify)('SHA256');
+    verify2.update(generateSignStr(body, ts, nonce));
+    verify2.end();
+    return verify2.verify(publicKey, signature, 'hex');
+}
+async function fetchWithTimeout(url, options, timeout = 5000) {
+    const controller = new AbortController();
+    const signal = controller.signal;
+    // 设置超时
+    const timeoutId = setTimeout(() => {
+        controller.abort();
+    }, timeout);
+    // 发起 fetch 请求并传递 signal
+    return fetch(url, Object.assign({}, options, { signal }))
+        .then(response => {
+        clearTimeout(timeoutId); // 如果请求成功，清除超时
+        return response;
+    })
+        .catch(error => {
+        clearTimeout(timeoutId); // 如果请求失败，清除超时
+        if (error.name === 'AbortError') {
+            throw new types_1.OakRequestTimeoutException();
+        }
+        throw error; // 其他错误
+    });
+}
 class Synchronizer {
     config;
     schema;
@@ -19,7 +66,7 @@ class Synchronizer {
     contextBuilder;
     pushAccessMap = {};
     async startChannel2(context, channel) {
-        const { queue, api, selfEncryptInfo, entity, entityId, onFailed } = channel;
+        const { queue, api, selfEncryptInfo, entity, entityId, onFailed, timeout } = channel;
         // todo 加密
         const opers = queue.map(ele => ele.oper);
         if (process.env.NODE_ENV === 'development') {
@@ -31,15 +78,20 @@ class Synchronizer {
         const finalApi = (0, path_1.join)(api, selfEncryptInfo.id);
         channel.queue = [];
         try {
-            const res = await fetch(finalApi, {
+            const body = JSON.stringify(opers);
+            const { ts, nonce, signature } = await sign(selfEncryptInfo.privateKey, body);
+            const res = await fetchWithTimeout(finalApi, {
                 method: 'post',
                 headers: {
                     'Content-Type': 'application/json',
                     [OAK_SYNC_HEADER_ENTITY]: entity,
                     [OAK_SYNC_HEADER_ENTITY_ID]: entityId,
+                    [OAK_SYNC_HEADER_TIMESTAMP]: `${ts}`,
+                    [OAK_SYNC_HEADER_NONCE]: nonce,
+                    [OAK_SYNC_HEADER_SIGN]: signature,
                 },
-                body: JSON.stringify(opers),
-            });
+                body,
+            }, timeout || 5000);
             if (res.status !== 200) {
                 throw new Error(`sync数据时，访问api「${finalApi}」的结果不是200。「${res.status}」`);
             }
@@ -133,7 +185,7 @@ class Synchronizer {
             }
         }));
     }
-    pushOperToChannel(oper, userId, url, endpoint, remoteEntity, remoteEntityId, selfEncryptInfo, onSynchronized, onFailed) {
+    pushOperToChannel(oper, userId, url, endpoint, remoteEntity, remoteEntityId, selfEncryptInfo, onSynchronized, onFailed, timeout) {
         if (!this.channelDict[userId]) {
             // channel上缓存这些信息，暂不支持动态更新
             this.channelDict[userId] = {
@@ -143,6 +195,7 @@ class Synchronizer {
                 entityId: remoteEntityId,
                 selfEncryptInfo,
                 onFailed,
+                timeout,
             };
         }
         else {
@@ -189,7 +242,7 @@ class Synchronizer {
         if (pushEntityNodes && pushEntityNodes.length > 0) {
             // 每个pushEntityNode代表配置的一个remoteEntity 
             await Promise.all(pushEntityNodes.map(async (node) => {
-                const { projection, groupByUsers, getRemotePushInfo: getRemoteAccessInfo, groupBySelfEntity, endpoint, actions, onSynchronized, onFailed } = node;
+                const { projection, groupByUsers, getRemotePushInfo: getRemoteAccessInfo, groupBySelfEntity, endpoint, actions, onSynchronized, onFailed, timeout } = node;
                 // 定义中应该不可能没有actions
                 if (!actions || actions.includes(action)) {
                     const rows = await context.select(targetEntity, {
@@ -223,7 +276,7 @@ class Synchronizer {
                             userId,
                             remoteEntityId: entityId,
                         });
-                        this.pushOperToChannel(oper2, userId, url, endpoint, entity, entityId, selfEncryptInfo, onSynchronized, onFailed);
+                        this.pushOperToChannel(oper2, userId, url, endpoint, entity, entityId, selfEncryptInfo, onSynchronized, onFailed, timeout);
                     };
                     for (const userId in userSendDict) {
                         if (userId !== operatorId || !oper.bornAt) {
@@ -334,7 +387,7 @@ class Synchronizer {
         const { remotes, self } = config;
         // 根据remotes定义，建立从entity到需要同步的远端结点信息的Map
         remotes.forEach((remote) => {
-            const { getPushInfo, pushEntities: pushEntityDefs, endpoint, pathToUser, relationName: rnRemote, onFailed } = remote;
+            const { getPushInfo, pushEntities: pushEntityDefs, endpoint, pathToUser, relationName: rnRemote, onFailed, timeout } = remote;
             if (pushEntityDefs) {
                 const pushEntities = [];
                 const endpoint2 = (0, path_1.join)(endpoint || 'sync', self.entity);
@@ -402,6 +455,7 @@ class Synchronizer {
                                 actions,
                                 onSynchronized,
                                 onFailed,
+                                timeout,
                             }];
                     }
                     else {
@@ -415,6 +469,7 @@ class Synchronizer {
                             actions,
                             onSynchronized,
                             onFailed,
+                            timeout,
                         });
                     }
                 }
@@ -462,7 +517,7 @@ class Synchronizer {
             fn: async (context, params, headers, req, body) => {
                 // body中是传过来的oper数组信息
                 const { entity, entityId } = params;
-                const { [OAK_SYNC_HEADER_ENTITY]: meEntity, [OAK_SYNC_HEADER_ENTITY_ID]: meEntityId } = headers;
+                const { [OAK_SYNC_HEADER_ENTITY]: meEntity, [OAK_SYNC_HEADER_ENTITY_ID]: meEntityId, [OAK_SYNC_HEADER_NONCE]: syncNonce, [OAK_SYNC_HEADER_TIMESTAMP]: syncTs, [OAK_SYNC_HEADER_SIGN]: syncSign } = headers;
                 if (process.env.NODE_ENV === 'development') {
                     console.log('接收到来自远端的sync数据', entity, JSON.stringify(body));
                 }
@@ -493,7 +548,13 @@ class Synchronizer {
                 if (cxtInfo) {
                     await context.initialize(cxtInfo);
                 }
-                // todo 解密
+                const syncTimestamp = parseInt(syncTs, 10);
+                if (!(Date.now() - syncTimestamp < 10000)) {
+                    throw new Error('同步时钟漂移过长');
+                }
+                if (!verify(publicKey, JSON.stringify(body), syncTs, syncNonce, syncSign)) {
+                    throw new Error('sync验签失败');
+                }
                 const opers = body;
                 const ids = opers.map(ele => ele.id);
                 const existsIds = (await context.select('oper', {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "oak-backend-base",
-    "version": "4.1.8",
+    "version": "4.1.10",
     "description": "oak-backend-base",
     "main": "lib/index",
     "author": {
@@ -20,10 +20,10 @@
         "mysql": "^2.18.1",
         "mysql2": "^2.3.3",
         "node-schedule": "^2.1.0",
-        "oak-common-aspect": "^3.0.2",
+        "oak-common-aspect": "^3.0.4",
         "oak-db": "^3.3.2",
-        "oak-domain": "^5.1.9",
-        "oak-frontend-base": "^5.3.18",
+        "oak-domain": "^5.1.10",
+        "oak-frontend-base": "^5.3.19",
         "socket.io": "^4.7.2",
         "socket.io-client": "^4.7.2",
         "uuid": "^8.3.2"