twikoo-func 1.7.14 → 1.7.15

package/index.js

@@ -38,6 +38,13 @@ const {
   checkCommentOwnership,
   isValidEmail
 } = require('./utils')
+const {
+  createCap,
+  tcbStorage,
+  createChallenge,
+  redeemChallenge,
+  isBuiltinCap
+} = require('./utils/cap')
 const {
   jsonParse,
   commentImportValine,
@@ -151,6 +158,12 @@ exports.main = async (event, context) => {
       case 'COMMENT_DELETE_FOR_USER':
         res = await commentDeleteForUser(event)
         break
+      case 'CAP_CHALLENGE': // embedded Cap.js
+        res = await capChallenge()
+        break
+      case 'CAP_REDEEM':
+        res = await capRedeem(event)
+        break
       default:
         if (event.event) {
           res.code = RES_CODE.EVENT_NOT_EXIST
@@ -760,6 +773,14 @@ async function checkCaptcha (comment) {
       geeTestPassToken: comment.geeTestPassToken,
       geeTestGenTime: comment.geeTestGenTime
     })
+  } else if (provider === 'Cap' && isBuiltinCap(config)) {
+    if (!comment.capToken) {
+      throw new Error('验证码 token 缺失，请刷新页面重试')
+    }
+    await checkCapCaptcha({
+      capToken: comment.capToken,
+      cap: createCap(tcbStorage(db))
+    })
   } else if (provider === 'Cap' && config.CAP_API_ENDPOINT && config.CAP_SECRET_KEY) {
     if (!comment.capToken) {
       throw new Error('验证码 token 缺失，请刷新页面重试')
@@ -770,7 +791,7 @@ async function checkCaptcha (comment) {
       capApiEndpoint: config.CAP_API_ENDPOINT
     })
   } else if (provider === 'Cap') {
-    throw new Error('Cap 验证码配置不完整，请联系管理员')
+    throw new Error('Cap 验证码配置不完整：内嵌模式无需额外配置，外部模式需填写 CAP_API_ENDPOINT 与 CAP_SECRET_KEY')
   } else if (provider) {
     throw new Error(`不支持的验证码类型: ${provider}`)
   }
@@ -1027,9 +1048,27 @@ function isRecursion (context) {
   return envObj.TCB_SOURCE.substr(-3, 3) === 'scf'
 }
 
+async function capChallenge () {
+  if (!isBuiltinCap(config)) {
+    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
+  }
+  const cap = createCap(tcbStorage(db))
+  const data = await createChallenge(cap)
+  return { code: RES_CODE.SUCCESS, ...data }
+}
+
+async function capRedeem (event) {
+  if (!isBuiltinCap(config)) {
+    return { code: RES_CODE.FAIL, message: '内嵌 Cap 未启用' }
+  }
+  const cap = createCap(tcbStorage(db))
+  const data = await redeemChallenge(cap, event)
+  return { code: RES_CODE.SUCCESS, ...data }
+}
+
 // 建立数据库 collections
 async function createCollections () {
-  const collections = ['comment', 'config', 'counter']
+  const collections = ['comment', 'config', 'counter', 'cap_challenges', 'cap_tokens']
   const res = {}
   for (const collection of collections) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.7.14",
+  "version": "1.7.15",
   "description": "A simple comment system.",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",
@@ -11,6 +11,7 @@
   },
   "homepage": "https://twikoo.js.org",
   "dependencies": {
+    "@cap.js/server": "^4.0.5",
     "@cloudbase/manager-node": "^3.9.0",
     "@cloudbase/node-sdk": "^2.5.0",
     "@imaegoo/node-ip2region": "^2.1.1",
@@ -25,9 +26,9 @@
     "jsdom": "^16.4.0",
     "marked": "^4.0.12",
     "nodemailer": "^7.0.11",
-    "openai": "^6.45.0",
     "pushoo": "latest",
     "tencentcloud-sdk-nodejs": "^4.0.65",
-    "xml2js": "^0.6.0"
+    "xml2js": "^0.6.0",
+    "xsai": "^0.2.2"
   }
 }

package/utils/cap.js

@@ -0,0 +1,311 @@
+/**
+ * Embedded Cap.js (https://capjs.js.org) — no external Cap Standalone required.
+ * Storage adapters follow the same hooks as @cap.js/server / ink-battles.
+ */
+
+const Cap = require('@cap.js/server')
+const logger = require('./logger')
+
+const CHALLENGE_OPTS = {
+  challengeCount: 50,
+  challengeSize: 32,
+  challengeDifficulty: 4,
+  expiresMs: 600000 // 10 min
+}
+
+function memoryStorage () {
+  const challenges = new Map()
+  const tokens = new Map()
+  return {
+    challenges: {
+      store: async (token, data) => { challenges.set(token, data) },
+      read: async (token) => challenges.get(token) || null,
+      delete: async (token) => { challenges.delete(token) },
+      deleteExpired: async () => {
+        const now = Date.now()
+        for (const [k, v] of challenges) {
+          if (!v || v.expires < now) challenges.delete(k)
+        }
+      }
+    },
+    tokens: {
+      store: async (key, expires) => { tokens.set(key, expires) },
+      get: async (key) => {
+        const exp = tokens.get(key)
+        if (!exp) return null
+        if (exp < Date.now()) {
+          tokens.delete(key)
+          return null
+        }
+        return exp
+      },
+      delete: async (key) => { tokens.delete(key) },
+      deleteExpired: async () => {
+        const now = Date.now()
+        for (const [k, v] of tokens) {
+          if (v < now) tokens.delete(k)
+        }
+      }
+    }
+  }
+}
+
+/** MongoDB (native driver) — Vercel / self-hosted mongo */
+function mongoStorage (db) {
+  const challenges = () => db.collection('cap_challenges')
+  const tokens = () => db.collection('cap_tokens')
+  let indexed = false
+  const ensureIndex = () => {
+    if (indexed) return
+    indexed = true
+    challenges().createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(() => {})
+    tokens().createIndex({ expiresAt: 1 }, { expireAfterSeconds: 0 }).catch(() => {})
+  }
+  return {
+    challenges: {
+      store: async (token, data) => {
+        ensureIndex()
+        await challenges().updateOne(
+          { token },
+          { $set: { token, challenge: data.challenge, expiresAt: new Date(data.expires) } },
+          { upsert: true }
+        )
+      },
+      read: async (token) => {
+        const doc = await challenges().findOne({ token, expiresAt: { $gt: new Date() } })
+        return doc ? { challenge: doc.challenge, expires: doc.expiresAt.getTime() } : null
+      },
+      delete: async (token) => { await challenges().deleteOne({ token }) },
+      deleteExpired: async () => { await challenges().deleteMany({ expiresAt: { $lte: new Date() } }) }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        ensureIndex()
+        await tokens().updateOne(
+          { key },
+          { $set: { key, expiresAt: new Date(expires) } },
+          { upsert: true }
+        )
+      },
+      get: async (key) => {
+        const doc = await tokens().findOne({ key, expiresAt: { $gt: new Date() } })
+        return doc ? doc.expiresAt.getTime() : null
+      },
+      delete: async (key) => { await tokens().deleteOne({ key }) },
+      deleteExpired: async () => { await tokens().deleteMany({ expiresAt: { $lte: new Date() } }) }
+    }
+  }
+}
+
+/** LokiJS — self-hosted default */
+function lokiStorage (db) {
+  const getCol = (name) => {
+    let col = db.getCollection(name)
+    if (!col) col = db.addCollection(name, { unique: ['key'] })
+    return col
+  }
+  // challenges use token field; tokens use key field
+  const getChallengeCol = () => {
+    let col = db.getCollection('cap_challenges')
+    if (!col) col = db.addCollection('cap_challenges', { unique: ['token'] })
+    return col
+  }
+  const getTokenCol = () => getCol('cap_tokens')
+  return {
+    challenges: {
+      store: async (token, data) => {
+        const col = getChallengeCol()
+        const existing = col.findOne({ token })
+        const row = { token, challenge: data.challenge, expires: data.expires }
+        if (existing) {
+          Object.assign(existing, row)
+          col.update(existing)
+        } else col.insert(row)
+      },
+      read: async (token) => {
+        const doc = getChallengeCol().findOne({ token })
+        if (!doc || doc.expires < Date.now()) return null
+        return { challenge: doc.challenge, expires: doc.expires }
+      },
+      delete: async (token) => { getChallengeCol().findAndRemove({ token }) },
+      deleteExpired: async () => {
+        getChallengeCol().findAndRemove({ expires: { $lte: Date.now() } })
+      }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        const col = getTokenCol()
+        const existing = col.findOne({ key })
+        const row = { key, expires }
+        if (existing) {
+          Object.assign(existing, row)
+          col.update(existing)
+        } else col.insert(row)
+      },
+      get: async (key) => {
+        const doc = getTokenCol().findOne({ key })
+        if (!doc || doc.expires < Date.now()) return null
+        return doc.expires
+      },
+      delete: async (key) => { getTokenCol().findAndRemove({ key }) },
+      deleteExpired: async () => {
+        getTokenCol().findAndRemove({ expires: { $lte: Date.now() } })
+      }
+    }
+  }
+}
+
+/** CloudBase / TCB database */
+function tcbStorage (db) {
+  const _ = db.command
+  return {
+    challenges: {
+      store: async (token, data) => {
+        const col = db.collection('cap_challenges')
+        try {
+          await col.doc(token).set({
+            token,
+            challenge: data.challenge,
+            expires: data.expires
+          })
+        } catch (e) {
+          // doc may exist
+          await col.doc(token).update({
+            challenge: data.challenge,
+            expires: data.expires
+          })
+        }
+      },
+      read: async (token) => {
+        try {
+          const res = await db.collection('cap_challenges').doc(token).get()
+          const doc = res.data && res.data[0]
+          if (!doc || doc.expires < Date.now()) return null
+          return { challenge: doc.challenge, expires: doc.expires }
+        } catch (e) {
+          return null
+        }
+      },
+      delete: async (token) => {
+        try { await db.collection('cap_challenges').doc(token).remove() } catch (e) {}
+      },
+      deleteExpired: async () => {
+        try {
+          await db.collection('cap_challenges').where({ expires: _.lte(Date.now()) }).remove()
+        } catch (e) {}
+      }
+    },
+    tokens: {
+      store: async (key, expires) => {
+        // CloudBase doc id cannot contain ':'
+        const id = key.replace(/:/g, '_')
+        try {
+          await db.collection('cap_tokens').doc(id).set({ key, expires })
+        } catch (e) {
+          await db.collection('cap_tokens').doc(id).update({ key, expires })
+        }
+      },
+      get: async (key) => {
+        try {
+          const id = key.replace(/:/g, '_')
+          const res = await db.collection('cap_tokens').doc(id).get()
+          const doc = res.data && res.data[0]
+          if (!doc || doc.expires < Date.now()) return null
+          return doc.expires
+        } catch (e) {
+          return null
+        }
+      },
+      delete: async (key) => {
+        try {
+          const id = key.replace(/:/g, '_')
+          await db.collection('cap_tokens').doc(id).remove()
+        } catch (e) {}
+      },
+      deleteExpired: async () => {
+        try {
+          await db.collection('cap_tokens').where({ expires: _.lte(Date.now()) }).remove()
+        } catch (e) {}
+      }
+    }
+  }
+}
+
+/**
+ * EdgeOne Blob-style store: expects { get(key), set(key, value), del(key) }
+ * value is JSON-serializable.
+ */
+function kvStorage (kv) {
+  return {
+    challenges: {
+      store: async (token, data) => { await kv.set(`cap:c:${token}`, data) },
+      read: async (token) => {
+        const data = await kv.get(`cap:c:${token}`)
+        if (!data || data.expires < Date.now()) return null
+        return data
+      },
+      delete: async (token) => { await kv.del(`cap:c:${token}`) },
+      deleteExpired: async () => {}
+    },
+    tokens: {
+      store: async (key, expires) => { await kv.set(`cap:t:${key}`, { expires }) },
+      get: async (key) => {
+        const data = await kv.get(`cap:t:${key}`)
+        if (!data || data.expires < Date.now()) return null
+        return data.expires
+      },
+      delete: async (key) => { await kv.del(`cap:t:${key}`) },
+      deleteExpired: async () => {}
+    }
+  }
+}
+
+function createCap (storage) {
+  return new Cap({
+    noFSState: true,
+    storage: storage || memoryStorage()
+  })
+}
+
+async function createChallenge (cap) {
+  return cap.createChallenge(CHALLENGE_OPTS)
+}
+
+async function redeemChallenge (cap, body) {
+  const token = body && body.token
+  const solutions = body && body.solutions
+  if (!token || !solutions || !Array.isArray(solutions)) {
+    return { success: false, error: 'Missing token or solutions' }
+  }
+  return cap.redeemChallenge({ token, solutions })
+}
+
+async function validateToken (cap, token) {
+  if (!token) return false
+  try {
+    const { success } = await cap.validateToken(token)
+    return !!success
+  } catch (e) {
+    logger.error('Cap validateToken failed:', e)
+    return false
+  }
+}
+
+/** CAPTCHA_PROVIDER=Cap and no CAP_API_ENDPOINT → use embedded Cap */
+function isBuiltinCap (config) {
+  return config && config.CAPTCHA_PROVIDER === 'Cap' && !config.CAP_API_ENDPOINT
+}
+
+module.exports = {
+  createCap,
+  memoryStorage,
+  mongoStorage,
+  lokiStorage,
+  tcbStorage,
+  kvStorage,
+  createChallenge,
+  redeemChallenge,
+  validateToken,
+  isBuiltinCap,
+  CHALLENGE_OPTS
+}

package/utils/index.js

@@ -268,7 +268,7 @@ const fn = {
       if (qqApiKey) {
         headers.Authorization = `Bearer ${qqApiKey}`
       }
-      const result = await axios.get(`https://v1.nsuuu.com/api/qqname?qq=${qqNum}`, { headers })
+      const result = await axios.get(`https://v1.tqq.me/v1/qqname?qq=${qqNum}`, { headers })
       if (result.data?.code === 200 && result.data?.data?.nick) {
         return result.data.data.nick
       }
@@ -366,11 +366,17 @@ const fn = {
       throw new Error('极验验证码检测失败: ' + e.message)
     }
   },
-  async checkCapCaptcha ({ capToken, capSecretKey, capApiEndpoint }) {
+  async checkCapCaptcha ({ capToken, capSecretKey, capApiEndpoint, cap }) {
     try {
-      // 移除末尾的斜杠，避免双斜杠
+      // 内嵌 Cap：直接 validateToken，无需外部 Standalone
+      if (cap) {
+        const { validateToken } = require('./cap')
+        const ok = await validateToken(cap, capToken)
+        if (!ok) throw new Error('验证码错误')
+        return
+      }
+      // 外部 Cap Standalone：HTTP siteverify
       const endpoint = capApiEndpoint.replace(/\/$/, '')
-      // Cap 的 siteverify 端点
       const url = `${endpoint}/siteverify`
       logger.log('Cap验证码验证URL:', url)
       logger.log('Cap验证码验证参数:', { secret: capSecretKey ? '***' : undefined, response: capToken.substring(0, 20) + '...' })
@@ -426,9 +432,13 @@ const fn = {
       baseConfig.GEETEST_CAPTCHA_ID = config.GEETEST_CAPTCHA_ID
     }
 
-    // 仅在明确指定使用 Cap 时下发 Cap 的 api endpoint
+    // Cap：有外部 endpoint 则下发；否则标记 builtin，前端走 twikoo 事件代理
     if (config.CAPTCHA_PROVIDER === 'Cap') {
-      baseConfig.CAP_API_ENDPOINT = config.CAP_API_ENDPOINT
+      if (config.CAP_API_ENDPOINT) {
+        baseConfig.CAP_API_ENDPOINT = config.CAP_API_ENDPOINT
+      } else {
+        baseConfig.CAP_BUILTIN = true
+      }
     }
 
     return {

package/utils/lib.js

@@ -73,10 +73,10 @@ module.exports = {
     return xml2js
   },
   getOpenAIClient (config) {
-    const OpenAI = require('openai') // OpenAI 的 SDK，用于反垃圾
-    const openaiClient = new OpenAI({
+    const { createXSClient } = require('xsai') // xsai SDK
+    const openaiClient = createXSClient({
       apiKey: config.LLM_API_KEY,
-      baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com'
+      baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com/v1'
     })
     return openaiClient
   }

package/utils/spam.js

@@ -1,8 +1,7 @@
 const {
   getAkismetClient,
   getCryptoJS,
-  getTencentcloud,
-  getOpenAIClient
+  getTencentcloud
 } = require('./lib')
 const {
   equalsMail
@@ -13,9 +12,6 @@ const CryptoJS = getCryptoJS()
 const logger = require('./logger')
 
 let tencentcloud
-let openai
-let _openaiApiKey
-let _openaiEndpoint
 
 function getTencentCloud () {
   if (!tencentcloud) {
@@ -28,21 +24,6 @@ function getTencentCloud () {
   return tencentcloud
 }
 
-function getOpenAI (config) {
-  if (isConfigChanged(config)) {
-    _openaiApiKey = config.LLM_API_KEY || ''
-    _openaiEndpoint = config.LLM_API_ENDPOINT || ''
-    openai = getOpenAIClient(config)
-  }
-  return openai
-}
-
-function isConfigChanged (config) {
-  return !openai ||
-    _openaiApiKey !== (config.LLM_API_KEY || '') ||
-    _openaiEndpoint !== (config.LLM_API_ENDPOINT || '')
-}
-
 // 提取json结构的函数
 function extractJson (rawText) {
   if (!rawText) return ''
@@ -126,8 +107,6 @@ async function checkByLLM (comment, config) {
   const maxRetries = Number(config.LLM_MAX_RETRIES) || 3
   let lastError = ''
 
-  const openai = getOpenAI(config)
-
   // 网络/Provider 异常或者格式校验不通过会进入重试逻辑
   for (let attempt = 1; attempt <= maxRetries; attempt++) {
     if (attempt > 1) {
@@ -142,13 +121,14 @@ async function checkByLLM (comment, config) {
         messages = buildMessages(comment, lastError)
       }
 
-      const chatCompletion = await openai.chat.completions.create({
-        model: config.LLM_MODEL || 'deepseek-v4-pro',
-        response_format: { type: 'json_object' },
+      const { generateText } = require('xsai')
+      const chatCompletion = await generateText({
+        model: config.LLM_MODEL || 'deepseek-chat',
+        responseFormat: { type: 'json_object' },
         messages
       })
 
-      const rawText = chatCompletion.choices[0].message.content || ''
+      const rawText = chatCompletion.text || ''
 
       const extracted = extractJson(rawText)
       const repaired = repairJson(extracted)