tkserver 1.7.23 → 2.0.0-beta.1

package/index.js

@@ -1,1224 +0,0 @@
-/*!
- * Twikoo self-hosted function
- * (c) 2020-present iMaeGoo
- * Released under the MIT License.
- */
-
-const { version: VERSION } = require('./package.json')
-const fs = require('fs')
-const path = require('path')
-const Loki = require('lokijs')
-const getUserIP = require('get-user-ip')
-const Lfsa = require('lokijs/src/loki-fs-structured-adapter')
-const { v4: uuidv4 } = require('uuid') // 用户 id 生成
-const {
-  getHtmlToText,
-  getDomPurify,
-  getMd5,
-  getSha256,
-  getXml2js
-} = require('twikoo-func/utils/lib')
-const {
-  getFuncVersion,
-  getUrlQuery,
-  getUrlsQuery,
-  parseComment,
-  parseCommentForAdmin,
-  normalizeMail,
-  equalsMail,
-  getMailMd5,
-  getAvatar,
-  isQQ,
-  addQQMailSuffix,
-  getQQAvatar,
-  getQQNick,
-  getPasswordStatus,
-  preCheckSpam,
-  checkTurnstileCaptcha,
-  checkGeeTestCaptcha,
-  checkCapCaptcha,
-  getConfig,
-  getConfigForAdmin,
-  validate,
-  checkCommentOwnership,
-  isValidEmail
-} = require('twikoo-func/utils')
-const {
-  createCap,
-  lokiStorage,
-  createChallenge,
-  redeemChallenge,
-  isBuiltinCap
-} = require('twikoo-func/utils/cap')
-const {
-  jsonParse,
-  commentImportValine,
-  commentImportDisqus,
-  commentImportArtalk,
-  commentImportArtalk2,
-  commentImportTwikoo
-} = require('twikoo-func/utils/import')
-const { postCheckSpam } = require('twikoo-func/utils/spam')
-const { sendNotice, emailTest } = require('twikoo-func/utils/notify')
-const { uploadImage } = require('twikoo-func/utils/image')
-const logger = require('twikoo-func/utils/logger')
-
-const htmlToText = getHtmlToText()
-const DOMPurify = getDomPurify()
-const md5 = getMd5()
-const sha256 = getSha256()
-const xml2js = getXml2js()
-
-// 常量 / constants
-const { RES_CODE, MAX_REQUEST_TIMES } = require('twikoo-func/utils/constants')
-const TWIKOO_REQ_TIMES_CLEAR_TIME = parseInt(process.env.TWIKOO_REQ_TIMES_CLEAR_TIME) || 10 * 60 * 1000
-
-// 全局变量 / variables
-let db = null
-let config
-let requestTimes = {}
-let requestTimesTimer = null
-
-connectToDatabase()
-
-module.exports = async (request, response) => {
-  let accessToken
-  let hasClientToken = false
-  const event = request.body || {}
-  logger.log('请求 IP：', getIp(request))
-  logger.log('请求函数：', event.event)
-  logger.log('请求参数：', event)
-  let res = {}
-  try {
-    protect(request)
-    // 判断客户端是否自带 accessToken，须在 anonymousSignIn 回填身份之前
-    hasClientToken = !!(request.body && request.body.accessToken)
-    accessToken = anonymousSignIn(request)
-    await readConfig()
-    allowCors(request, response)
-    if (request.method === 'OPTIONS') {
-      response.status(204).end()
-      return
-    }
-    switch (event.event) {
-      case 'GET_FUNC_VERSION':
-        res = getFuncVersion({ VERSION })
-        break
-      case 'COMMENT_GET':
-        res = await commentGet(event)
-        break
-      case 'COMMENT_GET_FOR_ADMIN':
-        res = await commentGetForAdmin(event)
-        break
-      case 'COMMENT_SET_FOR_ADMIN':
-        res = await commentSetForAdmin(event)
-        break
-      case 'COMMENT_DELETE_FOR_ADMIN':
-        res = await commentDeleteForAdmin(event)
-        break
-      case 'COMMENT_DELETE_FOR_USER':
-        res = await commentDeleteForUser(event)
-        break
-      case 'COMMENT_IMPORT_FOR_ADMIN':
-        res = await commentImportForAdmin(event)
-        break
-      case 'COMMENT_LIKE':
-        res = await commentLike(event)
-        break
-      case 'COMMENT_SUBMIT':
-        res = await commentSubmit(event, request)
-        break
-      case 'COUNTER_GET':
-        res = await counterGet(event)
-        break
-      case 'GET_PASSWORD_STATUS':
-        res = await getPasswordStatus(config, VERSION)
-        break
-      case 'SET_PASSWORD':
-        res = await setPassword(event)
-        break
-      case 'GET_CONFIG':
-        res = await getConfig({ config, VERSION, isAdmin: isAdmin(event.accessToken) })
-        break
-      case 'GET_CONFIG_FOR_ADMIN':
-        res = await getConfigForAdmin({ config, isAdmin: isAdmin(event.accessToken) })
-        break
-      case 'SET_CONFIG':
-        res = await setConfig(event)
-        break
-      case 'LOGIN':
-        res = await login(event.password)
-        break
-      case 'GET_COMMENTS_COUNT': // >= 0.2.7
-        res = await getCommentsCount(event)
-        break
-      case 'GET_RECENT_COMMENTS': // >= 0.2.7
-        res = await getRecentComments(event)
-        break
-      case 'EMAIL_TEST': // >= 1.4.6
-        res = await emailTest(event, config, isAdmin(event.accessToken))
-        break
-      case 'UPLOAD_IMAGE': // >= 1.5.0
-        res = await uploadImage(event, config)
-        break
-      case 'GET_QQ_NICK': // >= 1.7.0
-        res = await qqNickGet(event)
-        break
-      case 'COMMENT_EXPORT_FOR_ADMIN': // >= 1.6.13
-        res = await commentExportForAdmin(event)
-        break
-      case 'CAP_CHALLENGE':
-        res = await capChallenge()
-        break
-      case 'CAP_REDEEM':
-        res = await capRedeem(event)
-        break
-      default:
-        if (event.event) {
-          res.code = RES_CODE.EVENT_NOT_EXIST
-          res.message = '请更新 Twikoo 云函数至最新版本'
-        } else {
-          res.code = RES_CODE.NO_PARAM
-          res.message = 'Twikoo 云函数运行正常，请参考 https://twikoo.js.org/frontend.html 完成前端的配置'
-          res.version = VERSION
-        }
-    }
-  } catch (e) {
-    logger.error('Twikoo 遇到错误，请参考以下错误信息。如有疑问，请反馈至 https://github.com/twikoojs/twikoo/issues')
-    logger.error('请求参数：', event)
-    logger.error('错误信息：', e)
-    res.code = RES_CODE.FAIL
-    res.message = e.message
-  }
-  // 客户端未携带 accessToken 时，将本次绑定的身份令牌随响应返回，
-  // 客户端会持久化并在后续请求中携带，从而获得稳定的匿名身份
-  if (!res.code && !hasClientToken) {
-    res.accessToken = accessToken
-  }
-  logger.log('请求返回：', res)
-  response.status(200).json(res)
-}
-
-function allowCors (request, response) {
-  if (request.headers.origin) {
-    response.setHeader('Access-Control-Allow-Credentials', true)
-    response.setHeader('Access-Control-Allow-Origin', getAllowedOrigin(request))
-    response.setHeader('Access-Control-Allow-Methods', 'POST')
-    response.setHeader(
-      'Access-Control-Allow-Headers',
-      'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version'
-    )
-    response.setHeader('Access-Control-Max-Age', '600')
-  }
-}
-
-function getAllowedOrigin (request) {
-  const localhostRegex = /^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:\d{1,5})?$/
-  if (localhostRegex.test(request.headers.origin)) { // 判断是否为本地主机，如是则允许跨域
-    return request.headers.origin // Allow
-  } else if (config.CORS_ALLOW_ORIGIN) { // 如设置了安全域名则检查
-    // 适配多条 CORS 规则
-    // 以逗号分隔 CORS
-    const corsList = config.CORS_ALLOW_ORIGIN.split(',')
-    // 遍历 CORS 列表
-    for (let i = 0; i < corsList.length; i++) {
-      const cors = corsList[i].replace(/\/$/, '') // 获取当前 CORS 并去除末尾的斜杠
-      if (cors === request.headers.origin) {
-        return request.headers.origin // Allow
-      }
-    }
-    return '' // 不在安全域名列表中则禁止跨域
-  } else {
-    return request.headers.origin // 未设置安全域名直接 Allow
-  }
-}
-
-function anonymousSignIn (request) {
-  if (request.body) {
-    if (request.body.accessToken) {
-      return request.body.accessToken
-    } else {
-      // 为匿名访客签发固定身份令牌，写回请求体供本次请求的
-      // 评论存储（uid）与归属校验使用，避免出现 undefined 身份
-      request.body.accessToken = uuidv4().replace(/-/g, '')
-      return request.body.accessToken
-    }
-  }
-}
-
-async function connectToDatabase () {
-  if (db) return db
-  const dataDir = path.resolve(process.cwd(), process.env.TWIKOO_DATA || './data')
-  if (!fs.existsSync(dataDir)) {
-    fs.mkdirSync(dataDir)
-  }
-  logger.info(`Twikoo database stored at ${dataDir}`)
-  await new Promise((resolve) => {
-    logger.info('Connecting to database...')
-    db = new Loki(path.resolve(dataDir, './db.json'), {
-      adapter: new Lfsa(),
-      autoload: true,
-      autoloadCallback: resolve,
-      autosave: true,
-      autosaveInterval: 4000
-    })
-  })
-  await createCollections()
-  logger.info('Connected to database')
-  return db
-}
-
-// 写入管理密码
-async function setPassword (event) {
-  const isAdminUser = isAdmin(event.accessToken)
-  // 如果数据库里没有密码，则写入密码
-  // 如果数据库里有密码，则只有管理员可以写入密码
-  if (config.ADMIN_PASS && !isAdminUser) {
-    return { code: RES_CODE.PASS_EXIST, message: '请先登录再修改密码' }
-  }
-  const ADMIN_PASS = md5(event.password)
-  await writeConfig({ ADMIN_PASS })
-  return {
-    code: RES_CODE.SUCCESS
-  }
-}
-
-// 管理员登录
-async function login (password) {
-  if (!config) {
-    return { code: RES_CODE.CONFIG_NOT_EXIST, message: '数据库无配置' }
-  }
-  if (!config.ADMIN_PASS) {
-    return { code: RES_CODE.PASS_NOT_EXIST, message: '未配置管理密码' }
-  }
-  if (config.ADMIN_PASS !== md5(password)) {
-    return { code: RES_CODE.PASS_NOT_MATCH, message: '密码错误' }
-  }
-  return {
-    code: RES_CODE.SUCCESS
-  }
-}
-
-function getSearchKeyword (event) {
-  if (event.keyword === undefined || event.keyword === null) return ''
-  if (typeof event.keyword !== 'string') throw new Error('搜索关键词必须是字符串')
-  const keyword = event.keyword.trim()
-  if (keyword.length > 100) throw new Error('搜索关键词不能超过 100 个字符')
-  return keyword
-}
-
-function commentMatchesKeyword (comment, keyword) {
-  return [comment.nick, comment.comment].some(value =>
-    typeof value === 'string' && value.toLowerCase().includes(keyword)
-  )
-}
-
-function escapeRegExp (value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-}
-
-// 读取评论
-async function commentGet (event) {
-  const res = {}
-  try {
-    validate(event, ['url'])
-    if (getSearchKeyword(event)) return commentSearch(event)
-    const uid = event.accessToken
-    const isAdminUser = isAdmin(event.accessToken)
-    const limit = parseInt(config.COMMENT_PAGE_SIZE) || 8
-    const sort = event.sort || 'newest'
-    let more = false
-    let condition
-    let query
-    condition = {
-      url: { $in: getUrlQuery(event.url) },
-      rid: { $exists: false }
-    }
-    // 按当前用户和配置查询可见评论
-    query = getCommentQuery({ condition, uid, isAdminUser })
-    // 读取总条数
-    const count = db
-      .getCollection('comment')
-      .count(query)
-    // 读取主楼
-    if (event.before) {
-      condition.created = { $lt: event.before }
-    }
-    // 不包含置顶
-    condition.top = { $ne: true }
-    query = getCommentQuery({ condition, uid, isAdminUser })
-
-    let sortOrder
-    if (sort === 'oldest') {
-      sortOrder = [['created', false]]
-    } else if (sort === 'popular') {
-      sortOrder = [['ups', true], ['created', true]]
-    } else {
-      sortOrder = [['created', true]]
-    }
-
-    let main = db
-      .getCollection('comment')
-      .chain()
-      .find(query)
-      .compoundsort(sortOrder)
-      // 流式分页，通过多读 1 条的方式，确认是否还有更多评论
-      .limit(limit + 1)
-      .data()
-    if (main.length > limit) {
-      // 还有更多评论
-      more = true
-      // 删除多读的 1 条
-      main.splice(limit, 1)
-    }
-    let top = []
-    if (!config.TOP_DISABLED && !event.before) {
-      // 查询置顶评论
-      query = getCommentQuery({ condition: { ...condition, top: true }, uid, isAdminUser })
-      top = db
-        .getCollection('comment')
-        .chain()
-        .find(query)
-        .compoundsort([['created', true]])
-        .data()
-      // 合并置顶评论和非置顶评论
-      main = [
-        ...top,
-        ...main
-      ]
-    }
-    condition = {
-      rid: { $in: main.map((item) => item._id.toString()) }
-    }
-    query = getCommentQuery({ condition, uid, isAdminUser })
-    // 读取回复楼
-    const reply = db
-      .getCollection('comment')
-      .chain()
-      .find(query)
-      .data()
-    res.data = parseComment([...main, ...reply], uid, config)
-    res.more = more
-    res.count = count
-  } catch (e) {
-    res.data = []
-    res.message = e.message
-  }
-  return res
-}
-
-async function commentSearch (event) {
-  const res = {}
-  try {
-    validate(event, ['url'])
-    const keyword = getSearchKeyword(event).toLowerCase()
-    const page = Math.max(parseInt(event.page) || 1, 1)
-    const uid = event.accessToken
-    const isAdminUser = isAdmin(event.accessToken)
-    const limit = parseInt(config.COMMENT_PAGE_SIZE) || 8
-    const sort = event.sort || 'newest'
-    let more = false
-
-    const visible = db.getCollection('comment').chain()
-      .find(getCommentQuery({ condition: { url: { $in: getUrlQuery(event.url) } }, uid, isAdminUser }))
-      .data()
-    const matchedRoots = new Set(visible
-      .filter(comment => commentMatchesKeyword(comment, keyword))
-      .map(comment => String(comment.rid || comment._id)))
-    let main = visible.filter(comment => !comment.rid && matchedRoots.has(String(comment._id)))
-    const count = main.length
-    let replies = visible
-
-    if (sort === 'oldest') {
-      main.sort((a, b) => a.created - b.created)
-    } else if (sort === 'popular') {
-      main.sort((a, b) => {
-        const ups = (b.ups || []).length - (a.ups || []).length
-        return ups || b.created - a.created
-      })
-    } else {
-      main.sort((a, b) => b.created - a.created)
-    }
-    let top = []
-    if (!config.TOP_DISABLED) {
-      if (page === 1) top = main.filter(comment => comment.top === true)
-      main = main.filter(comment => comment.top !== true)
-    }
-    main = main.slice((page - 1) * limit, page * limit + 1)
-    if (main.length > limit) {
-      more = true
-      main = main.slice(0, limit)
-    }
-    main = [...top, ...main]
-
-    const mainIds = new Set(main.map(comment => comment._id.toString()))
-    replies = replies.filter(comment => mainIds.has(String(comment.rid)))
-    res.data = parseComment([...main, ...replies], uid, config)
-    res.more = more
-    res.count = count
-  } catch (e) {
-    res.data = []
-    res.message = e.message
-  }
-  return res
-}
-
-function getCommentQuery ({ condition, uid, isAdminUser }) {
-  if (config.HIDE_SPAM === 'true') {
-    return { ...condition, isSpam: { $ne: true } }
-  }
-  return {
-    $or: [
-      { ...condition, isSpam: { $ne: isAdminUser ? 'imaegoo' : true } },
-      { ...condition, uid }
-    ]
-  }
-}
-
-// 管理员读取评论
-async function commentGetForAdmin (event) {
-  const res = {}
-  const isAdminUser = isAdmin(event.accessToken)
-  if (isAdminUser) {
-    validate(event, ['per', 'page'])
-    const collection = db
-      .getCollection('comment')
-    const condition = getCommentSearchCondition(event)
-    const count = await collection.count(condition)
-    const data = await collection
-      .chain()
-      .find(condition)
-      .compoundsort([['created', true]])
-      .offset(event.per * (event.page - 1))
-      .limit(event.per)
-      .data()
-    res.code = RES_CODE.SUCCESS
-    res.count = count
-    res.data = parseCommentForAdmin(data)
-  } else {
-    res.code = RES_CODE.NEED_LOGIN
-    res.message = '请先登录'
-  }
-  return res
-}
-
-function getCommentSearchCondition (event) {
-  let condition
-  if (event.type) {
-    switch (event.type) {
-      case 'VISIBLE':
-        condition = { isSpam: { $ne: true } }
-        break
-      case 'HIDDEN':
-        condition = { isSpam: true }
-        break
-    }
-  }
-  const keyword = getSearchKeyword(event)
-  if (keyword) {
-    const regExp = {
-      $regex: escapeRegExp(keyword),
-      $options: 'i'
-    }
-    condition = {
-      $or: [
-        { ...condition, nick: regExp },
-        { ...condition, mail: regExp },
-        { ...condition, link: regExp },
-        { ...condition, ip: regExp },
-        { ...condition, comment: regExp },
-        { ...condition, url: regExp },
-        { ...condition, href: regExp }
-      ]
-    }
-  }
-  return condition
-}
-
-// 管理员修改评论
-async function commentSetForAdmin (event) {
-  const res = {}
-  const isAdminUser = isAdmin(event.accessToken)
-  if (isAdminUser) {
-    validate(event, ['id', 'set'])
-    db
-      .getCollection('comment')
-      .findAndUpdate({ _id: event.id }, (obj) => {
-        for (const key of Object.keys(event.set)) {
-          obj[key] = event.set[key]
-        }
-        obj.updated = Date.now()
-        return obj
-      })
-    res.code = RES_CODE.SUCCESS
-    res.updated = 1
-  } else {
-    res.code = RES_CODE.NEED_LOGIN
-    res.message = '请先登录'
-  }
-  return res
-}
-
-// 管理员删除评论
-async function commentDeleteForAdmin (event) {
-  const res = {}
-  const isAdminUser = isAdmin(event.accessToken)
-  if (isAdminUser) {
-    validate(event, ['id'])
-    db
-      .getCollection('comment')
-      .findAndRemove({ _id: event.id })
-    res.code = RES_CODE.SUCCESS
-    res.deleted = 1
-  } else {
-    res.code = RES_CODE.NEED_LOGIN
-    res.message = '请先登录'
-  }
-  return res
-}
-
-// 用户删除自己的评论
-async function commentDeleteForUser (event) {
-  const res = {}
-  try {
-    const uid = event.accessToken
-    await checkCommentOwnership(event.id, uid, (id) => {
-      return db.getCollection('comment').findOne({ _id: id })
-    })
-    db.getCollection('comment').findAndRemove({ _id: event.id })
-    res.code = RES_CODE.SUCCESS
-    res.deleted = 1
-  } catch (e) {
-    res.code = RES_CODE.FAIL
-    res.message = e.message
-  }
-  return res
-}
-
-// 管理员导入评论
-async function commentImportForAdmin (event) {
-  const res = {}
-  let logText = ''
-  const log = (message) => {
-    logText += `${new Date().toLocaleString()} ${message}\n`
-  }
-  const isAdminUser = isAdmin(event.accessToken)
-  if (isAdminUser) {
-    try {
-      validate(event, ['source', 'file'])
-      log(`开始导入 ${event.source}`)
-      let comments
-      switch (event.source) {
-        case 'valine': {
-          const valineDb = await readFile(event.file, 'json', log)
-          comments = await commentImportValine(valineDb, log)
-          break
-        }
-        case 'disqus': {
-          const disqusDb = await readFile(event.file, 'xml', log)
-          comments = await commentImportDisqus(disqusDb, log)
-          break
-        }
-        case 'artalk': {
-          const artalkDb = await readFile(event.file, 'json', log)
-          comments = await commentImportArtalk(artalkDb, log)
-          break
-        }
-        case 'artalk2': {
-          const artalkDb = await readFile(event.file, 'json', log)
-          comments = await commentImportArtalk2(artalkDb, log)
-          break
-        }
-        case 'twikoo': {
-          const twikooDb = await readFile(event.file, 'json', log)
-          comments = await commentImportTwikoo(twikooDb, log)
-          break
-        }
-        default:
-          throw new Error(`不支持 ${event.source} 的导入，请更新 Twikoo 云函数至最新版本`)
-      }
-      await bulkSaveComments(comments)
-      log('导入成功')
-    } catch (e) {
-      log(e.message)
-    }
-    res.code = RES_CODE.SUCCESS
-    res.log = logText
-    logger.info(logText)
-  } else {
-    res.code = RES_CODE.NEED_LOGIN
-    res.message = '请先登录'
-  }
-  return res
-}
-
-async function commentExportForAdmin (event) {
-  const res = {}
-  const isAdminUser = isAdmin(event.accessToken)
-  if (isAdminUser) {
-    const collection = event.collection || 'comment'
-    const data = db
-      .getCollection(collection)
-      .chain()
-      .find({})
-      .data({ removeMeta: true })
-    res.code = RES_CODE.SUCCESS
-    res.data = data
-  } else {
-    res.code = RES_CODE.NEED_LOGIN
-    res.message = '请先登录'
-  }
-  return res
-}
-
-// 读取文件并转为 js object
-async function readFile (file, type, log) {
-  try {
-    let content = file.toString('utf8')
-    log('评论文件读取成功')
-    if (type === 'json') {
-      content = jsonParse(content)
-      log('评论文件 JSON 解析成功')
-    } else if (type === 'xml') {
-      content = await xml2js.parseStringPromise(content)
-      log('评论文件 XML 解析成功')
-    }
-    return content
-  } catch (e) {
-    log(`评论文件读取失败：${e.message}`)
-  }
-}
-
-// 批量导入评论
-async function bulkSaveComments (comments) {
-  db
-    .getCollection('comment')
-    .insert(comments)
-}
-
-// 点赞 / 反对 / 取消
-async function commentLike (event) {
-  const res = {}
-  validate(event, ['id'])
-  const type = event.type || 'up'
-  res.updated = await like(event.id, event.accessToken, type)
-  return res
-}
-
-// 点赞 / 反对 / 取消
-async function like (id, uid, type) {
-  const record = db
-    .getCollection('comment')
-  const comment = await record
-    .findOne({ _id: id })
-  const commentData = comment || {}
-  const ups = commentData.ups || []
-  const downs = commentData.downs || []
-
-  let newUps = [...ups]
-  let newDowns = [...downs]
-
-  if (type === 'up') {
-    if (ups.includes(uid)) {
-      newUps = ups.filter((item) => item !== uid)
-    } else {
-      newUps.push(uid)
-      newDowns = downs.filter((item) => item !== uid)
-    }
-  } else if (type === 'down') {
-    if (downs.includes(uid)) {
-      newDowns = downs.filter((item) => item !== uid)
-    } else {
-      newDowns.push(uid)
-      newUps = ups.filter((item) => item !== uid)
-    }
-  }
-
-  await record.findAndUpdate({ _id: id }, (obj) => {
-    obj.ups = newUps
-    obj.downs = newDowns
-    return obj
-  })
-  return 1
-}
-
-/**
- * 提交评论。分为多个步骤
- * 1. 参数校验
- * 2. 预检测垃圾评论（包括限流、人工审核、违禁词检测等）
- * 3. 保存到数据库
- * 4. 触发异步任务（包括 IM 通知、邮件通知、第三方垃圾评论检测
- *    等，因为这些任务比较耗时，所以要放在另一个线程进行）
- * @param {String} event.nick 昵称
- * @param {String} event.mail 邮箱
- * @param {String} event.link 网址
- * @param {String} event.ua UserAgent
- * @param {String} event.url 评论页地址
- * @param {String} event.comment 评论内容
- * @param {String} event.pid 回复的 ID
- * @param {String} event.rid 评论楼 ID
- */
-async function commentSubmit (event, request) {
-  const res = {}
-  // 参数校验
-  validate(event, ['url', 'ua', 'comment'])
-  // 限流
-  await limitFilter(request)
-  // 验证码
-  await checkCaptcha(event, request)
-  // 预检测、转换
-  const data = await parse(event, request)
-  // 保存
-  const comment = await save(data)
-  res.id = comment.id
-  // 异步垃圾检测、发送评论通知
-  logger.log('开始异步垃圾检测、发送评论通知')
-  // 私有部署支持直接异步调用
-  postSubmit(comment)
-  return res
-}
-
-// 保存评论
-async function save (data) {
-  db
-    .getCollection('comment')
-    .insert(data)
-  data.id = data._id
-  return data
-}
-
-async function getParentComment (currentComment) {
-  const parentComment = db
-    .getCollection('comment')
-    .findOne({ _id: currentComment.pid })
-  return parentComment
-}
-
-// 异步垃圾检测、发送评论通知
-async function postSubmit (comment) {
-  try {
-    logger.log('POST_SUBMIT')
-    // 垃圾检测
-    const isSpam = await postCheckSpam(comment, config)
-    await saveSpamCheckResult(comment, isSpam)
-    // 发送通知
-    await sendNotice(comment, config, getParentComment)
-  } catch (e) {
-    logger.warn('POST_SUBMIT 失败', e)
-  }
-}
-
-// 将评论转为数据库存储格式
-async function parse (comment, request) {
-  const timestamp = Date.now()
-  const isAdminUser = isAdmin(request.body.accessToken)
-  const isBloggerMail = equalsMail(comment.mail, config.BLOGGER_EMAIL)
-  if (isBloggerMail && !isAdminUser) throw new Error('请先登录管理面板，再使用博主身份发送评论')
-  if (comment.mail && !isValidEmail(comment.mail)) throw new Error('邮箱格式不合法')
-  const hashMethod = config.GRAVATAR_CDN === 'cravatar.cn' ? md5 : sha256
-  const commentDo = {
-    _id: uuidv4().replace(/-/g, ''),
-    uid: request.body.accessToken,
-    nick: comment.nick ? comment.nick : '匿名',
-    mail: comment.mail ? comment.mail : '',
-    mailMd5: comment.mail ? hashMethod(normalizeMail(comment.mail)) : '',
-    link: comment.link ? comment.link : '',
-    ua: comment.ua,
-    ip: getIp(request),
-    master: isBloggerMail,
-    url: comment.url,
-    href: comment.href,
-    comment: DOMPurify.sanitize(comment.comment, { FORBID_TAGS: ['style'], FORBID_ATTR: ['style'] }),
-    pid: comment.pid ? comment.pid : comment.rid,
-    rid: comment.rid,
-    isSpam: isAdminUser ? false : preCheckSpam(comment, config),
-    created: timestamp,
-    updated: timestamp
-  }
-  if (isQQ(comment.mail)) {
-    commentDo.mail = addQQMailSuffix(comment.mail)
-    commentDo.mailMd5 = hashMethod(normalizeMail(commentDo.mail))
-    commentDo.avatar = await getQQAvatar(comment.mail)
-  }
-  return commentDo
-}
-
-// 限流
-async function limitFilter (request) {
-  // 限制每个 IP 每 10 分钟发表的评论数量
-  let limitPerMinute = parseInt(config.LIMIT_PER_MINUTE)
-  if (Number.isNaN(limitPerMinute)) limitPerMinute = 10
-  if (limitPerMinute) {
-    const count = db
-      .getCollection('comment')
-      .count({
-        ip: getIp(request),
-        created: { $gt: Date.now() - 600000 }
-      })
-    if (count > limitPerMinute) {
-      throw new Error('发言频率过高')
-    }
-  }
-  // 限制所有 IP 每 10 分钟发表的评论数量
-  let limitPerMinuteAll = parseInt(config.LIMIT_PER_MINUTE_ALL)
-  if (Number.isNaN(limitPerMinuteAll)) limitPerMinuteAll = 10
-  if (limitPerMinuteAll) {
-    const count = db
-      .getCollection('comment')
-      .count({
-        created: { $gt: Date.now() - 600000 }
-      })
-    if (count > limitPerMinuteAll) {
-      throw new Error('评论太火爆啦 >_< 请稍后再试')
-    }
-  }
-}
-
-async function checkCaptcha (comment, request) {
-  logger.log('验证码配置:', {
-    CAPTCHA_PROVIDER: config.CAPTCHA_PROVIDER,
-    TURNSTILE_SITE_KEY: config.TURNSTILE_SITE_KEY,
-    GEETEST_CAPTCHA_ID: config.GEETEST_CAPTCHA_ID,
-    GEETEST_CAPTCHA_KEY: config.GEETEST_CAPTCHA_KEY ? '***' : undefined,
-    CAP_API_ENDPOINT: config.CAP_API_ENDPOINT
-  })
-  const provider = config.CAPTCHA_PROVIDER
-  if (provider === 'Turnstile' && config.TURNSTILE_SITE_KEY && config.TURNSTILE_SECRET_KEY) {
-    await checkTurnstileCaptcha({
-      ip: getIp(request),
-      turnstileToken: comment.turnstileToken,
-      turnstileTokenSecretKey: config.TURNSTILE_SECRET_KEY
-    })
-  } else if (provider === 'Geetest' && config.GEETEST_CAPTCHA_ID && config.GEETEST_CAPTCHA_KEY) {
-    await checkGeeTestCaptcha({
-      geeTestCaptchaId: config.GEETEST_CAPTCHA_ID,
-      geeTestCaptchaKey: config.GEETEST_CAPTCHA_KEY,
-      geeTestLotNumber: comment.geeTestLotNumber,
-      geeTestCaptchaOutput: comment.geeTestCaptchaOutput,
-      geeTestPassToken: comment.geeTestPassToken,
-      geeTestGenTime: comment.geeTestGenTime
-    })
-  } else if (provider === 'Cap' && isBuiltinCap(config)) {
-    if (!comment.capToken) {
-      throw new Error('验证码 token 缺失，请刷新页面重试')
-    }
-    await checkCapCaptcha({
-      capToken: comment.capToken,
-      cap: createCap(lokiStorage(db))
-    })
-  } else if (provider === 'Cap' && config.CAP_API_ENDPOINT && config.CAP_SECRET_KEY) {
-    if (!comment.capToken) {
-      throw new Error('验证码 token 缺失，请刷新页面重试')
-    }
-    await checkCapCaptcha({
-      capToken: comment.capToken,
-      capSecretKey: config.CAP_SECRET_KEY,
-      capApiEndpoint: config.CAP_API_ENDPOINT
-    })
-  } else if (provider === 'Cap') {
-    throw new Error('Cap 验证码配置不完整：内嵌模式无需额外配置，外部模式需填写 CAP_API_ENDPOINT 与 CAP_SECRET_KEY')
-  } else if (provider) {
-    throw new Error(`不支持的验证码类型: ${provider}`)
-  }
-}
-
-async function saveSpamCheckResult (comment, isSpam) {
-  comment.isSpam = isSpam
-  if (isSpam) {
-    db
-      .getCollection('comment')
-      .findAndUpdate({ created: comment.created }, (obj) => {
-        obj.isSpam = isSpam
-        obj.updated = Date.now()
-        return obj
-      })
-  }
-}
-
-/**
- * 获取文章点击量
- * @param {String} event.url 文章地址
- */
-async function counterGet (event) {
-  const res = {}
-  try {
-    validate(event, ['url'])
-    const record = await readCounter(event.url)
-    res.data = record || {}
-    res.time = res.data ? res.data.time : 0
-    res.updated = await incCounter(event)
-  } catch (e) {
-    res.message = e.message
-    return res
-  }
-  return res
-}
-
-// 读取阅读数
-async function readCounter (url) {
-  return db
-    .getCollection('counter')
-    .findOne({ url })
-}
-
-/**
- * 更新阅读数
- * @param {String} event.url 文章地址
- * @param {String} event.title 文章标题
- */
-async function incCounter (event) {
-  const counter = db.getCollection('counter')
-  const result = counter.find({ url: event.url })[0]
-  if (result) {
-    result.time = result.time ? result.time + 1 : 1
-    result.title = event.title
-    result.updated = Date.now()
-    counter.update(result)
-  } else {
-    counter.insert({
-      url: event.url,
-      title: event.title,
-      time: 1,
-      created: Date.now(),
-      updated: Date.now()
-    })
-  }
-  return 1
-}
-
-/**
- * 批量获取文章评论数 API
- * @param {Array} event.urls 不包含协议和域名的文章路径列表，必传参数
- * @param {Boolean} event.includeReply 评论数是否包括回复，默认：false
- */
-async function getCommentsCount (event) {
-  const res = {}
-  try {
-    validate(event, ['urls'])
-    const query = {}
-    query.isSpam = { $ne: true }
-    query.url = { $in: getUrlsQuery(event.urls) }
-    if (!event.includeReply) {
-      query.rid = { $exists: false }
-    }
-    res.data = []
-    const commentCollection = db.getCollection('comment')
-    for (const url of event.urls) {
-      const record = commentCollection.count({ ...query, url })
-      res.data.push({
-        url,
-        count: record || 0
-      })
-    }
-  } catch (e) {
-    res.message = e.message
-    return res
-  }
-  return res
-}
-
-/**
- * 获取最新评论 API
- * @param {Boolean} event.includeReply 评论数是否包括回复，默认：false
- */
-async function getRecentComments (event) {
-  const res = {}
-  try {
-    const query = {}
-    query.isSpam = { $ne: true }
-    if (event.urls && event.urls.length) {
-      query.url = { $in: getUrlsQuery(event.urls) }
-    }
-    if (!event.includeReply) query.rid = { $exists: false }
-    if (event.pageSize > 100) event.pageSize = 100
-    const result = db
-      .getCollection('comment')
-      .chain()
-      .find(query)
-      .compoundsort([['created', true]])
-      .limit(event.pageSize || 10)
-      .data()
-    res.data = result.map((comment) => {
-      return {
-        id: comment._id.toString(),
-        url: comment.url,
-        nick: comment.nick,
-        avatar: getAvatar(comment, config),
-        mailMd5: getMailMd5(comment),
-        link: comment.link,
-        comment: comment.comment,
-        commentText: htmlToText(comment.comment),
-        created: comment.created
-      }
-    })
-  } catch (e) {
-    res.message = e.message
-    return res
-  }
-  return res
-}
-
-// 获取 QQ 昵称
-async function qqNickGet (event) {
-  const res = {}
-  try {
-    validate(event, ['qq'])
-    const nick = await getQQNick(event.qq, config.QQ_API_KEY)
-    res.code = RES_CODE.SUCCESS
-    res.nick = nick
-  } catch (e) {
-    res.code = RES_CODE.FAIL
-    res.message = e.message
-  }
-  return res
-}
-
-// 修改配置
-async function setConfig (event) {
-  const isAdminUser = isAdmin(event.accessToken)
-  if (isAdminUser) {
-    writeConfig(event.config)
-    return {
-      code: RES_CODE.SUCCESS
-    }
-  } else {
-    return {
-      code: RES_CODE.NEED_LOGIN,
-      message: '请先登录'
-    }
-  }
-}
-
-function protect (request) {
-  // 防御
-  const ip = getIp(request)
-  requestTimes[ip] = (requestTimes[ip] || 0) + 1
-  if (requestTimes[ip] > MAX_REQUEST_TIMES) {
-    logger.warn(`${ip} 当前请求次数为 ${requestTimes[ip]}，已超过最大请求次数`)
-    throw new Error('Too Many Requests')
-  } else {
-    logger.log(`${ip} 当前请求次数为 ${requestTimes[ip]}`)
-  }
-}
-
-// 读取配置
-async function readConfig () {
-  try {
-    const res = db
-      .getCollection('config')
-      .findOne({})
-    config = res || {}
-    return config
-  } catch (e) {
-    logger.error('读取配置失败：', e)
-    await createCollections()
-    config = {}
-    return config
-  }
-}
-
-// 写入配置
-async function writeConfig (newConfig) {
-  if (!Object.keys(newConfig).length) return 0
-  logger.info('写入配置：', newConfig)
-  try {
-    const oldConfig = db
-      .getCollection('config')
-      .chain()
-      .find({})
-      .limit(1)
-      .data()[0]
-    if (oldConfig) {
-      db.getCollection('config').update({
-        ...oldConfig,
-        ...newConfig
-      })
-    } else {
-      db.getCollection('config').insert(newConfig)
-    }
-    // 更新后重置配置缓存
-    config = null
-    return 1
-  } catch (e) {
-    logger.error('写入配置失败：', e)
-    return null
-  }
-}
-
-// 判断用户是否管理员
-function isAdmin (accessToken) {
-  return config.ADMIN_PASS === md5(accessToken)
-}
-
-// 建立数据库 collections
-async function createCollections () {
-  const collections = ['comment', 'config', 'counter', 'cap_challenges', 'cap_tokens']
-  const res = {}
-  for (const collection of collections) {
-    if (db.getCollection(collection) === null) {
-      db.addCollection(collection)
-    }
-  }
-  return res
-}
-
-async function capChallenge () {
-  if (!isBuiltinCap(config)) {
-    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
-  }
-  const data = await createChallenge(createCap(lokiStorage(db)))
-  return { code: RES_CODE.SUCCESS, ...data }
-}
-
-async function capRedeem (event) {
-  if (!isBuiltinCap(config)) {
-    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
-  }
-  const data = await redeemChallenge(createCap(lokiStorage(db)), event)
-  return { code: RES_CODE.SUCCESS, ...data }
-}
-
-function getIp (request) {
-  try {
-    const { TWIKOO_IP_HEADERS } = process.env
-    const headers = TWIKOO_IP_HEADERS ? JSON.parse(TWIKOO_IP_HEADERS) : []
-    return getUserIP(request, headers)
-  } catch (e) {
-    logger.error('获取 IP 错误信息：', e)
-  }
-  return getUserIP(request)
-}
-
-async function closeDatabase () {
-  if (!db) return
-  try {
-    await new Promise((resolve, reject) => {
-      db.saveDatabase((err) => {
-        if (err) {
-          reject(err)
-        } else {
-          resolve()
-        }
-      })
-    })
-  } finally {
-    db.close()
-    db = null
-  }
-}
-
-async function shutdown () {
-  if (requestTimesTimer) {
-    clearInterval(requestTimesTimer)
-    requestTimesTimer = null
-  }
-  await closeDatabase()
-}
-
-function clearRequestTimes () {
-  requestTimes = {}
-}
-
-requestTimesTimer = setInterval(clearRequestTimes, TWIKOO_REQ_TIMES_CLEAR_TIME)
-
-module.exports.shutdown = shutdown