twikoo-func 1.7.13 → 1.7.15

package/index.js

@@ -38,6 +38,13 @@ const {
   checkCommentOwnership,
   isValidEmail
 } = require('./utils')
+const {
+  createCap,
+  tcbStorage,
+  createChallenge,
+  redeemChallenge,
+  isBuiltinCap
+} = require('./utils/cap')
 const {
   jsonParse,
   commentImportValine,
@@ -151,6 +158,12 @@ exports.main = async (event, context) => {
       case 'COMMENT_DELETE_FOR_USER':
         res = await commentDeleteForUser(event)
         break
+      case 'CAP_CHALLENGE': // embedded Cap.js
+        res = await capChallenge()
+        break
+      case 'CAP_REDEEM':
+        res = await capRedeem(event)
+        break
       default:
         if (event.event) {
           res.code = RES_CODE.EVENT_NOT_EXIST
@@ -760,6 +773,14 @@ async function checkCaptcha (comment) {
       geeTestPassToken: comment.geeTestPassToken,
       geeTestGenTime: comment.geeTestGenTime
     })
+  } else if (provider === 'Cap' && isBuiltinCap(config)) {
+    if (!comment.capToken) {
+      throw new Error('验证码 token 缺失，请刷新页面重试')
+    }
+    await checkCapCaptcha({
+      capToken: comment.capToken,
+      cap: createCap(tcbStorage(db))
+    })
   } else if (provider === 'Cap' && config.CAP_API_ENDPOINT && config.CAP_SECRET_KEY) {
     if (!comment.capToken) {
       throw new Error('验证码 token 缺失，请刷新页面重试')
@@ -770,7 +791,7 @@ async function checkCaptcha (comment) {
       capApiEndpoint: config.CAP_API_ENDPOINT
     })
   } else if (provider === 'Cap') {
-    throw new Error('Cap 验证码配置不完整，请联系管理员')
+    throw new Error('Cap 验证码配置不完整：内嵌模式无需额外配置，外部模式需填写 CAP_API_ENDPOINT 与 CAP_SECRET_KEY')
   } else if (provider) {
     throw new Error(`不支持的验证码类型: ${provider}`)
   }
@@ -1027,9 +1048,27 @@ function isRecursion (context) {
   return envObj.TCB_SOURCE.substr(-3, 3) === 'scf'
 }
 
+async function capChallenge () {
+  if (!isBuiltinCap(config)) {
+    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
+  }
+  const cap = createCap(tcbStorage(db))
+  const data = await createChallenge(cap)
+  return { code: RES_CODE.SUCCESS, ...data }
+}
+
+async function capRedeem (event) {
+  if (!isBuiltinCap(config)) {
+    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
+  }
+  const cap = createCap(tcbStorage(db))
+  const data = await redeemChallenge(cap, event)
+  return { code: RES_CODE.SUCCESS, ...data }
+}
+
 // 建立数据库 collections
 async function createCollections () {
-  const collections = ['comment', 'config', 'counter']
+  const collections = ['comment', 'config', 'counter', 'cap_challenges', 'cap_tokens']
   const res = {}
   for (const collection of collections) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.7.13",
+  "version": "1.7.15",
   "description": "A simple comment system.",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",
@@ -11,6 +11,7 @@
   },
   "homepage": "https://twikoo.js.org",
   "dependencies": {
+    "@cap.js/server": "^4.0.5",
     "@cloudbase/manager-node": "^3.9.0",
     "@cloudbase/node-sdk": "^2.5.0",
     "@imaegoo/node-ip2region": "^2.1.1",
@@ -27,6 +28,7 @@
     "nodemailer": "^7.0.11",
     "pushoo": "latest",
     "tencentcloud-sdk-nodejs": "^4.0.65",
-    "xml2js": "^0.6.0"
+    "xml2js": "^0.6.0",
+    "xsai": "^0.2.2"
   }
 }

package/utils/cap.js

@@ -0,0 +1,311 @@
+/**
+ * Embedded Cap.js (https://capjs.js.org) — no external Cap Standalone required.
+ * Storage adapters follow the same hooks as @cap.js/server / ink-battles.
+ */
+
+const Cap = require('@cap.js/server')
+const logger = require('./logger')
+
+const CHALLENGE_OPTS = {
+  challengeCount: 50,
+  challengeSize: 32,
+  challengeDifficulty: 4,
+  expiresMs: 600000 // 10 min
+}
+
+function memoryStorage () {
+  const challenges = new Map()
+  const tokens = new Map()
+  return {
+    challenges: {
+      store: async (token, data) => { challenges.set(token, data) },
+      read: async (token) => challenges.get(token) || null,
+      delete: async (token) => { challenges.delete(token) },
+      deleteExpired: async () => {
+        const now = Date.now()
+        for (const [k, v] of challenges) {
+          if (!v || v.expires < now) challenges.delete(k)
+        }
+      }
+    },
+    tokens: {
+      store: async (key, expires) => { tokens.set(key, expires) },
+      get: async (key) => {
+        const exp = tokens.get(key)
+        if (!exp) return null
+        if (exp < Date.now()) {
+          tokens.delete(key)
+          return null
+        }
+        return exp
+      },
+      delete: async (key) => { tokens.delete(key) },
+      deleteExpired: async () => {
+        const now = Date.now()
+        for (const [k, v] of tokens) {
+          if (v < now) tokens.delete(k)
+        }
+      }
+    }
+  }
+}
+
+/** MongoDB (native driver) — Vercel / self-hosted mongo */
+function mongoStorage (db) {
+  const challenges = () => db.collection('cap_challenges')
+  const tokens = () => db.collection('cap_tokens')
+  let indexed = false
+  const ensureIndex = () => {
+    if (indexed) return
+    indexed = true
+    challenges().createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(() => {})
+    tokens().createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(() => {})
+  }
+  return {
+    challenges: {
+      store: async (token, data) => {
+        ensureIndex()
+        await challenges().updateOne(
+          { token },
+          { $set: { token, challenge: data.challenge, expiresAt: new Date(data.expires) } },
+          { upsert: true }
+        )
+      },
+      read: async (token) => {
+        const doc = await challenges().findOne({ token, expiresAt: { $gt: new Date() } })
+        return doc ? { challenge: doc.challenge, expires: doc.expiresAt.getTime() } : null
+      },
+      delete: async (token) => { await challenges().deleteOne({ token }) },
+      deleteExpired: async () => { await challenges().deleteMany({ expiresAt: { $lte: new Date() } }) }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        ensureIndex()
+        await tokens().updateOne(
+          { key },
+          { $set: { key, expiresAt: new Date(expires) } },
+          { upsert: true }
+        )
+      },
+      get: async (key) => {
+        const doc = await tokens().findOne({ key, expiresAt: { $gt: new Date() } })
+        return doc ? doc.expiresAt.getTime() : null
+      },
+      delete: async (key) => { await tokens().deleteOne({ key }) },
+      deleteExpired: async () => { await tokens().deleteMany({ expiresAt: { $lte: new Date() } }) }
+    }
+  }
+}
+
+/** LokiJS — self-hosted default */
+function lokiStorage (db) {
+  const getCol = (name) => {
+    let col = db.getCollection(name)
+    if (!col) col = db.addCollection(name, { unique: ['key'] })
+    return col
+  }
+  // challenges use token field; tokens use key field
+  const getChallengeCol = () => {
+    let col = db.getCollection('cap_challenges')
+    if (!col) col = db.addCollection('cap_challenges', { unique: ['token'] })
+    return col
+  }
+  const getTokenCol = () => getCol('cap_tokens')
+  return {
+    challenges: {
+      store: async (token, data) => {
+        const col = getChallengeCol()
+        const existing = col.findOne({ token })
+        const row = { token, challenge: data.challenge, expires: data.expires }
+        if (existing) {
+          Object.assign(existing, row)
+          col.update(existing)
+        } else col.insert(row)
+      },
+      read: async (token) => {
+        const doc = getChallengeCol().findOne({ token })
+        if (!doc || doc.expires < Date.now()) return null
+        return { challenge: doc.challenge, expires: doc.expires }
+      },
+      delete: async (token) => { getChallengeCol().findAndRemove({ token }) },
+      deleteExpired: async () => {
+        getChallengeCol().findAndRemove({ expires: { $lte: Date.now() } })
+      }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        const col = getTokenCol()
+        const existing = col.findOne({ key })
+        const row = { key, expires }
+        if (existing) {
+          Object.assign(existing, row)
+          col.update(existing)
+        } else col.insert(row)
+      },
+      get: async (key) => {
+        const doc = getTokenCol().findOne({ key })
+        if (!doc || doc.expires < Date.now()) return null
+        return doc.expires
+      },
+      delete: async (key) => { getTokenCol().findAndRemove({ key }) },
+      deleteExpired: async () => {
+        getTokenCol().findAndRemove({ expires: { $lte: Date.now() } })
+      }
+    }
+  }
+}
+
+/** CloudBase / TCB database */
+function tcbStorage (db) {
+  const _ = db.command
+  return {
+    challenges: {
+      store: async (token, data) => {
+        const col = db.collection('cap_challenges')
+        try {
+          await col.doc(token).set({
+            token,
+            challenge: data.challenge,
+            expires: data.expires
+          })
+        } catch (e) {
+          // doc may exist
+          await col.doc(token).update({
+            challenge: data.challenge,
+            expires: data.expires
+          })
+        }
+      },
+      read: async (token) => {
+        try {
+          const res = await db.collection('cap_challenges').doc(token).get()
+          const doc = res.data && res.data[0]
+          if (!doc || doc.expires < Date.now()) return null
+          return { challenge: doc.challenge, expires: doc.expires }
+        } catch (e) {
+          return null
+        }
+      },
+      delete: async (token) => {
+        try { await db.collection('cap_challenges').doc(token).remove() } catch (e) {}
+      },
+      deleteExpired: async () => {
+        try {
+          await db.collection('cap_challenges').where({ expires: _.lte(Date.now()) }).remove()
+        } catch (e) {}
+      }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        // CloudBase doc id cannot contain ':'
+        const id = key.replace(/:/g, '_')
+        try {
+          await db.collection('cap_tokens').doc(id).set({ key, expires })
+        } catch (e) {
+          await db.collection('cap_tokens').doc(id).update({ key, expires })
+        }
+      },
+      get: async (key) => {
+        try {
+          const id = key.replace(/:/g, '_')
+          const res = await db.collection('cap_tokens').doc(id).get()
+          const doc = res.data && res.data[0]
+          if (!doc || doc.expires < Date.now()) return null
+          return doc.expires
+        } catch (e) {
+          return null
+        }
+      },
+      delete: async (key) => {
+        try {
+          const id = key.replace(/:/g, '_')
+          await db.collection('cap_tokens').doc(id).remove()
+        } catch (e) {}
+      },
+      deleteExpired: async () => {
+        try {
+          await db.collection('cap_tokens').where({ expires: _.lte(Date.now()) }).remove()
+        } catch (e) {}
+      }
+    }
+  }
+}
+
+/**
+ * EdgeOne Blob-style store: expects { get(key), set(key, value), del(key) }
+ * value is JSON-serializable.
+ */
+function kvStorage (kv) {
+  return {
+    challenges: {
+      store: async (token, data) => { await kv.set(`cap:c:${token}`, data) },
+      read: async (token) => {
+        const data = await kv.get(`cap:c:${token}`)
+        if (!data || data.expires < Date.now()) return null
+        return data
+      },
+      delete: async (token) => { await kv.del(`cap:c:${token}`) },
+      deleteExpired: async () => {}
+    },
+    tokens: {
+      store: async (key, expires) => { await kv.set(`cap:t:${key}`, { expires }) },
+      get: async (key) => {
+        const data = await kv.get(`cap:t:${key}`)
+        if (!data || data.expires < Date.now()) return null
+        return data.expires
+      },
+      delete: async (key) => { await kv.del(`cap:t:${key}`) },
+      deleteExpired: async () => {}
+    }
+  }
+}
+
+function createCap (storage) {
+  return new Cap({
+    noFSState: true,
+    storage: storage || memoryStorage()
+  })
+}
+
+async function createChallenge (cap) {
+  return cap.createChallenge(CHALLENGE_OPTS)
+}
+
+async function redeemChallenge (cap, body) {
+  const token = body && body.token
+  const solutions = body && body.solutions
+  if (!token || !solutions || !Array.isArray(solutions)) {
+    return { success: false, error: 'Missing token or solutions' }
+  }
+  return cap.redeemChallenge({ token, solutions })
+}
+
+async function validateToken (cap, token) {
+  if (!token) return false
+  try {
+    const { success } = await cap.validateToken(token)
+    return !!success
+  } catch (e) {
+    logger.error('Cap validateToken failed:', e)
+    return false
+  }
+}
+
+/** CAPTCHA_PROVIDER=Cap and no CAP_API_ENDPOINT → use embedded Cap */
+function isBuiltinCap (config) {
+  return config && config.CAPTCHA_PROVIDER === 'Cap' && !config.CAP_API_ENDPOINT
+}
+
+module.exports = {
+  createCap,
+  memoryStorage,
+  mongoStorage,
+  lokiStorage,
+  tcbStorage,
+  kvStorage,
+  createChallenge,
+  redeemChallenge,
+  validateToken,
+  isBuiltinCap,
+  CHALLENGE_OPTS
+}

package/utils/image.js

@@ -242,13 +242,18 @@ const fn = {
     // 构建对象 key
     const prefix = config.S3_PATH_PREFIX ? config.S3_PATH_PREFIX.replace(/\/$/, '') + '/' : ''
     const key = `${prefix}${Date.now()}-${fileName}`
+    const forcePathStyle = String(config.S3_FORCE_PATH_STYLE).trim().toLowerCase() !== 'false'
     let endpoint
+    let s3Base
     if (config.S3_ENDPOINT) {
-      // 兼容 R2
-      endpoint = `${config.S3_ENDPOINT.replace(/\/$/, '')}/${config.S3_BUCKET}/${key}`
+      // 自定义 S3 Endpoint
+      const endpointBase = config.S3_ENDPOINT.replace(/\/$/, '')
+      s3Base = forcePathStyle ? `${endpointBase}/${config.S3_BUCKET}` : endpointBase
+      endpoint = `${s3Base}/${key}`
     } else {
       // 标准 AWS S3：virtual-hosted-style URL
-      endpoint = `https://${config.S3_BUCKET}.s3.${region}.amazonaws.com/${key}`
+      s3Base = `https://${config.S3_BUCKET}.s3.${region}.amazonaws.com`
+      endpoint = `${s3Base}/${key}`
     }
     const endpointUrl = new URL(endpoint)
     const host = endpointUrl.host
@@ -305,10 +310,8 @@ const fn = {
     let fileUrl
     if (config.S3_CDN_URL) {
       fileUrl = `${config.S3_CDN_URL.replace(/\/$/, '')}/${key}`
-    } else if (config.S3_ENDPOINT) {
-      fileUrl = `${config.S3_ENDPOINT.replace(/\/$/, '')}/${config.S3_BUCKET}/${key}`
     } else {
-      fileUrl = `https://${config.S3_BUCKET}.s3.${region}.amazonaws.com/${key}`
+      fileUrl = `${s3Base}/${key}`
     }
     res.data = { url: fileUrl }
   },

package/utils/index.js

@@ -268,7 +268,7 @@ const fn = {
       if (qqApiKey) {
         headers.Authorization = `Bearer ${qqApiKey}`
       }
-      const result = await axios.get(`https://v1.nsuuu.com/api/qqname?qq=${qqNum}`, { headers })
+      const result = await axios.get(`https://v1.tqq.me/v1/qqname?qq=${qqNum}`, { headers })
       if (result.data?.code === 200 && result.data?.data?.nick) {
         return result.data.data.nick
       }
@@ -366,11 +366,17 @@ const fn = {
       throw new Error('极验验证码检测失败: ' + e.message)
     }
   },
-  async checkCapCaptcha ({ capToken, capSecretKey, capApiEndpoint }) {
+  async checkCapCaptcha ({ capToken, capSecretKey, capApiEndpoint, cap }) {
     try {
-      // 移除末尾的斜杠，避免双斜杠
+      // 内嵌 Cap：直接 validateToken，无需外部 Standalone
+      if (cap) {
+        const { validateToken } = require('./cap')
+        const ok = await validateToken(cap, capToken)
+        if (!ok) throw new Error('验证码错误')
+        return
+      }
+      // 外部 Cap Standalone：HTTP siteverify
       const endpoint = capApiEndpoint.replace(/\/$/, '')
-      // Cap 的 siteverify 端点
       const url = `${endpoint}/siteverify`
       logger.log('Cap验证码验证URL:', url)
       logger.log('Cap验证码验证参数:', { secret: capSecretKey ? '***' : undefined, response: capToken.substring(0, 20) + '...' })
@@ -426,9 +432,13 @@ const fn = {
       baseConfig.GEETEST_CAPTCHA_ID = config.GEETEST_CAPTCHA_ID
     }
 
-    // 仅在明确指定使用 Cap 时下发 Cap 的 api endpoint
+    // Cap：有外部 endpoint 则下发；否则标记 builtin，前端走 twikoo 事件代理
     if (config.CAPTCHA_PROVIDER === 'Cap') {
-      baseConfig.CAP_API_ENDPOINT = config.CAP_API_ENDPOINT
+      if (config.CAP_API_ENDPOINT) {
+        baseConfig.CAP_API_ENDPOINT = config.CAP_API_ENDPOINT
+      } else {
+        baseConfig.CAP_BUILTIN = true
+      }
     }
 
     return {

package/utils/lib.js

@@ -71,5 +71,13 @@ module.exports = {
   getXml2js () {
     const xml2js = require('xml2js') // XML 解析
     return xml2js
+  },
+  getOpenAIClient (config) {
+    const { createXSClient } = require('xsai') // xsai SDK
+    const openaiClient = createXSClient({
+      apiKey: config.LLM_API_KEY,
+      baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com/v1'
+    })
+    return openaiClient
   }
 }

package/utils/spam.js

@@ -24,6 +24,139 @@ function getTencentCloud () {
   return tencentcloud
 }
 
+// 提取json结构的函数
+function extractJson (rawText) {
+  if (!rawText) return ''
+  const trimmed = rawText.trim()
+  const match = trimmed.match(/\{[\s\S]*\}/)
+  return match ? match[0] : trimmed
+}
+
+// 移除多余的字符
+function repairJson (jsonStr) {
+  if (!jsonStr) return ''
+  let cleaned = jsonStr.trim()
+  cleaned = cleaned.replace(/,\s*([}\]])/g, '$1')
+  return cleaned
+}
+
+// validateJson 返回的 error 信息会被拼接进 prompt
+function validateJson (jsonStr) {
+  try {
+    const obj = JSON.parse(jsonStr)
+    if (typeof obj !== 'object' || obj === null) {
+      return { valid: false, error: 'Parsed JSON is not an object' }
+    }
+    if (!('spam' in obj)) {
+      return { valid: false, error: 'Missing required key "spam"' }
+    }
+    if (typeof obj.spam !== 'boolean') {
+      return { valid: false, error: 'Key "spam" must be a boolean value' }
+    }
+    return { valid: true, data: obj }
+  } catch (err) {
+    return { valid: false, error: `JSON Parse failed: ${err.message}` }
+  }
+}
+
+// 生成提示词的函数: system 为管理员指令，user 为待审核的评论数据
+// errorMsg 用于重试，customPrompt 替代默认的 system 指令
+function buildMessages (commentData, errorMsg = '', customPrompt = '') {
+  // 1. system 指令（管理员自定义或内置默认）
+  const systemContent = customPrompt || `You are a blog comment moderation assistant. Analyze ALL fields below and determine if this submission is spam or ham.
+
+Spam includes ANY of the following in ANY field:
+- Commercial ads, promotions, or buying/selling offers (e.g., "代开发票", "加微信", "兼职", "办证", "AI中转站").
+- Special case: If the comment text is harmless, but the nickname is suspicious (e.g., contains ads or promotions) AND a website link is provided, treat it as SPAM.
+- Meaningless gibberish or spammy repetition (e.g., "顶顶顶", "111111", "asdfgh", "好" repeated).
+- Abusive language, insults, or offensive Chinese slang.
+- Suspicious links or SEO spam in the website field.
+- Bot-like automated greetings.
+
+Ham includes:
+- Genuine questions, constructive feedback, technical discussions, or normal greetings in Chinese/English.
+
+Strictly follow these rules:
+1. If ANY field contains spam content, output exactly {"spam": true}.
+2. If ALL fields are legitimate, output exactly {"spam": false}.
+3. Do not include any explanations, introduction, punctuation, or extra spaces. Output only the JSON object.
+
+Your response MUST be a single valid JSON object, like:
+{"spam": true} or {"spam": false}`
+
+  // 2. user 数据（始终是待审核的评论内容）
+  let userContent = `Comment: ${commentData.comment}
+Nickname: ${commentData.nick || ''}
+Website: ${commentData.link || ''}`
+
+  // 3. 如果有错误信息，追加到用户消息末尾
+  if (errorMsg) {
+    userContent += `\n\n[ERROR FROM PREVIOUS ATTEMPT]: Your last response failed verification with error: "${errorMsg}". Please correct your output format and make sure to return exactly valid JSON.`
+  }
+
+  // 4. 返回 messages 数组
+  const finalPrompt = [
+    { role: 'system', content: systemContent },
+    { role: 'user', content: userContent }
+  ]
+  logger.log('提示词是：', finalPrompt)
+  return finalPrompt
+}
+
+async function checkByLLM (comment, config) {
+  const maxRetries = Number(config.LLM_MAX_RETRIES) || 3
+  let lastError = ''
+
+  // 网络/Provider 异常或者格式校验不通过会进入重试逻辑
+  for (let attempt = 1; attempt <= maxRetries; attempt++) {
+    if (attempt > 1) {
+      await new Promise(resolve => setTimeout(resolve, 1000))
+    }
+    try {
+      let messages
+      // 自定义提示词和内置提示词的 message 构建逻辑全交给 buildMessages 函数
+      if (config.LLM_SPAM_PROMPT) {
+        messages = buildMessages(comment, lastError, config.LLM_SPAM_PROMPT)
+      } else {
+        messages = buildMessages(comment, lastError)
+      }
+
+      const { generateText } = require('xsai')
+      const chatCompletion = await generateText({
+        model: config.LLM_MODEL || 'deepseek-chat',
+        responseFormat: { type: 'json_object' },
+        messages
+      })
+
+      const rawText = chatCompletion.text || ''
+
+      const extracted = extractJson(rawText)
+      const repaired = repairJson(extracted)
+      const validation = validateJson(repaired)
+
+      // 校验通过返回，不通过继续循环
+      if (validation.valid) {
+        const isSpam = validation.data.spam
+        if (isSpam) {
+          logger.info(`LLM 判定为 SPAM (尝试第 ${attempt} 次): id="${comment.id}" nick="${comment.nick}"`)
+        } else {
+          logger.log(`LLM 判定为 HAM (尝试第 ${attempt} 次): id="${comment.id}" nick="${comment.nick}"`)
+        }
+        return isSpam
+      } else {
+        lastError = validation.error
+        logger.warn(`LLM 返回校验失败 (尝试第 ${attempt}/${maxRetries} 次), 错误: ${lastError}. 原始返回: "${rawText}"`)
+      }
+    } catch (error) {
+      lastError = error.message
+      logger.error(`LLM 请求异常 (尝试第 ${attempt}/${maxRetries} 次), 错误: ${lastError}`)
+    }
+  }
+
+  logger.error(`LLM 垃圾评论检测历经 ${maxRetries} 次尝试均失败，执行终极放行兜底（返回 false）`)
+  return false
+}
+
 const fn = {
   // 后垃圾评论检测
   async postCheckSpam (comment, config) {
@@ -77,6 +210,9 @@ const fn = {
           comment_author_url: comment.link,
           comment_content: comment.comment
         })
+      } else if (config.LLM_API_KEY) {
+        // 大语言模型检测
+        isSpam = await checkByLLM(comment, config)
       }
       logger.log('垃圾评论检测结果：', isSpam)
       return isSpam