trustbase-seller-backend 0.5.9 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/middleware/api-key-auth.js +19 -2
- package/package.json +1 -1
|
@@ -158,14 +158,31 @@ function listAPIKeys() {
|
|
|
158
158
|
/**
|
|
159
159
|
* API Key 认证中间件（集成入侵检测）
|
|
160
160
|
*/
|
|
161
|
-
|
|
162
|
-
|
|
161
|
+
/** 隧道买家面放行判定 (2026-10-03, T2/Lane B)
|
|
162
|
+
* 三条同时成立才放行: ① 来源回环 ② X-TB-Tunnel: 1 头 ③ 买家只读路径 */
|
|
163
|
+
const TUNNEL_BUYER_PATHS = ['/api/products', '/api/orders'];
|
|
164
|
+
function isTunnelBuyerRequest(req, clientIP) {
|
|
165
|
+
const fromLoopback = clientIP === '127.0.0.1' || clientIP === '::1' || /^127\./.test(clientIP);
|
|
166
|
+
if (!fromLoopback) return false;
|
|
167
|
+
if (String(req.headers['x-tb-tunnel'] || '') !== '1') return false;
|
|
168
|
+
return TUNNEL_BUYER_PATHS.some(p => req.path.startsWith(p));
|
|
169
|
+
}
|
|
170
|
+
|
|
171
|
+
function requireAPIKey(skipLAN = true, exemptPaths = []) { return (req, res, next) => {
|
|
163
172
|
// 获取客户端 IP
|
|
164
173
|
const clientIP = (req.ip || req.connection.remoteAddress || '').replace('::ffff:', '');
|
|
165
174
|
// 跳过豁免路径（如 P2P MCP 路由已有 X-Signature 认证）
|
|
166
175
|
if (exemptPaths.some(p => req.path.startsWith(p))) {
|
|
167
176
|
return next();
|
|
168
177
|
}
|
|
178
|
+
// 隧道可信放行 (2026-10-03, T2/Lane B 真机发现):
|
|
179
|
+
// 商户机的店铺要经隧道(tunnel-client.js 本机 127.0.0.1 转发)对公网买家开放商品面,
|
|
180
|
+
// 而商户机默认 REQUIRE_API_KEY_FOR_LAN=1 → 回环也不放行 → 买家拿到 401, 公网店店等于不可用。
|
|
181
|
+
// 口径收窄到三者同时成立: ① 来源是回环(只有本机进程能发这个头) ② 带 X-TB-Tunnel 头(隧道客户端转发时加)
|
|
182
|
+
// ③ 命中买家面路径(商品/订单读)。管理面 API 一律仍要密钥。
|
|
183
|
+
if (isTunnelBuyerRequest(req, clientIP)) {
|
|
184
|
+
return next();
|
|
185
|
+
}
|
|
169
186
|
// 1. 检查 IP 黑名单
|
|
170
187
|
if ((0, intrusion_detection_1.isIPBlacklisted)(clientIP)) {
|
|
171
188
|
return res.status(403).json({
|
package/package.json
CHANGED