tkserver 1.7.19 → 1.7.21

package/index.js

@@ -12,7 +12,7 @@ const getUserIP = require('get-user-ip')
 const Lfsa = require('lokijs/src/loki-fs-structured-adapter')
 const { v4: uuidv4 } = require('uuid') // 用户 id 生成
 const {
-  getCheerio,
+  getHtmlToText,
   getDomPurify,
   getMd5,
   getSha256,
@@ -63,7 +63,7 @@ const { sendNotice, emailTest } = require('twikoo-func/utils/notify')
 const { uploadImage } = require('twikoo-func/utils/image')
 const logger = require('twikoo-func/utils/logger')
 
-const $ = getCheerio()
+const htmlToText = getHtmlToText()
 const DOMPurify = getDomPurify()
 const md5 = getMd5()
 const sha256 = getSha256()
@@ -83,6 +83,7 @@ connectToDatabase()
 
 module.exports = async (request, response) => {
   let accessToken
+  let hasClientToken = false
   const event = request.body || {}
   logger.log('请求 IP：', getIp(request))
   logger.log('请求函数：', event.event)
@@ -90,6 +91,8 @@ module.exports = async (request, response) => {
   let res = {}
   try {
     protect(request)
+    // 判断客户端是否自带 accessToken，须在 anonymousSignIn 回填身份之前
+    hasClientToken = !!(request.body && request.body.accessToken)
     accessToken = anonymousSignIn(request)
     await readConfig()
     allowCors(request, response)
@@ -187,7 +190,9 @@ module.exports = async (request, response) => {
     res.code = RES_CODE.FAIL
     res.message = e.message
   }
-  if (!res.code && !request.body.accessToken) {
+  // 客户端未携带 accessToken 时，将本次绑定的身份令牌随响应返回，
+  // 客户端会持久化并在后续请求中携带，从而获得稳定的匿名身份
+  if (!res.code && !hasClientToken) {
     res.accessToken = accessToken
   }
   logger.log('请求返回：', res)
@@ -233,7 +238,10 @@ function anonymousSignIn (request) {
     if (request.body.accessToken) {
       return request.body.accessToken
     } else {
-      return uuidv4().replace(/-/g, '')
+      // 为匿名访客签发固定身份令牌，写回请求体供本次请求的
+      // 评论存储（uid）与归属校验使用，避免出现 undefined 身份
+      request.body.accessToken = uuidv4().replace(/-/g, '')
+      return request.body.accessToken
     }
   }
 }
@@ -1039,7 +1047,7 @@ async function getRecentComments (event) {
         mailMd5: getMailMd5(comment),
         link: comment.link,
         comment: comment.comment,
-        commentText: $(comment.comment).text(),
+        commentText: htmlToText(comment.comment),
         created: comment.created
       }
     })

package/mongo.js

@@ -10,7 +10,7 @@ const getUserIP = require('get-user-ip')
 const { URL } = require('url')
 const { v4: uuidv4 } = require('uuid') // 用户 id 生成
 const {
-  getCheerio,
+  getHtmlToText,
   getDomPurify,
   getMd5,
   getSha256,
@@ -59,7 +59,7 @@ const { sendNotice, emailTest } = require('twikoo-func/utils/notify')
 const { uploadImage } = require('twikoo-func/utils/image')
 const logger = require('twikoo-func/utils/logger')
 
-const $ = getCheerio()
+const htmlToText = getHtmlToText()
 const DOMPurify = getDomPurify()
 const md5 = getMd5()
 const sha256 = getSha256()
@@ -78,6 +78,7 @@ let requestTimesTimer = null
 
 module.exports = async (request, response) => {
   let accessToken
+  let hasClientToken = false
   const event = request.body || {}
   logger.log('请求 IP：', getIp(request))
   logger.log('请求函数：', event.event)
@@ -85,6 +86,8 @@ module.exports = async (request, response) => {
   let res = {}
   try {
     protect(request)
+    // 判断客户端是否自带 accessToken，须在 anonymousSignIn 回填身份之前
+    hasClientToken = !!(request.body && request.body.accessToken)
     accessToken = anonymousSignIn(request)
     await connectToDatabase(process.env.MONGODB_URI || process.env.MONGO_URL)
     await readConfig()
@@ -180,7 +183,9 @@ module.exports = async (request, response) => {
     res.code = RES_CODE.FAIL
     res.message = e.message
   }
-  if (!res.code && !request.body.accessToken) {
+  // 客户端未携带 accessToken 时，将本次绑定的身份令牌随响应返回，
+  // 客户端会持久化并在后续请求中携带，从而获得稳定的匿名身份
+  if (!res.code && !hasClientToken) {
     res.accessToken = accessToken
   }
   logger.log('请求返回：', res)
@@ -226,7 +231,10 @@ function anonymousSignIn (request) {
     if (request.body.accessToken) {
       return request.body.accessToken
     } else {
-      return uuidv4().replace(/-/g, '')
+      // 为匿名访客签发固定身份令牌，写回请求体供本次请求的
+      // 评论存储（uid）与归属校验使用，避免出现 undefined 身份
+      request.body.accessToken = uuidv4().replace(/-/g, '')
+      return request.body.accessToken
     }
   }
 }
@@ -1026,7 +1034,7 @@ async function getRecentComments (event) {
         mailMd5: getMailMd5(comment),
         link: comment.link,
         comment: comment.comment,
-        commentText: $(comment.comment).text(),
+        commentText: htmlToText(comment.comment),
         created: comment.created
       }
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tkserver",
-  "version": "1.7.19",
+  "version": "1.7.21",
   "description": "A simple comment system.",
   "keywords": [
     "twikoo",
@@ -31,7 +31,7 @@
     "get-user-ip": "^1.0.1",
     "lokijs": "^1.5.12",
     "mongodb": "^6.3.0",
-    "twikoo-func": "1.7.19",
+    "twikoo-func": "1.7.21",
     "uuid": "^8.3.2"
   }
 }