twikoo-func 1.7.24 → 2.0.0-beta.2

package/utils/notify.js

@@ -1,309 +0,0 @@
-const { equalsMail, getAvatar, isValidEmail } = require('.')
-const {
-  getHtmlToText,
-  getNodemailer,
-  getPushoo
-} = require('./lib')
-const htmlToText = getHtmlToText()
-const pushoo = getPushoo()
-const { RES_CODE } = require('./constants')
-const logger = require('./logger')
-
-// HTML 实体转义，防止用户可控字段（昵称、邮箱等）在邮件 HTML 模板中造成存储型 XSS
-// 仅在渲染邮件时转义，不修改数据库的存储内容
-function escapeHtml (str) {
-  if (typeof str !== 'string') return str
-  return str
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;')
-}
-
-let nodemailer
-
-function lazilyGetNodemailer () {
-  return nodemailer ?? (nodemailer = getNodemailer())
-}
-
-let transporter
-
-const fn = {
-  // 发送通知
-  async sendNotice (comment, config, getParentComment) {
-    if (comment.isSpam && config.NOTIFY_SPAM === 'false') return
-    await Promise.all([
-      fn.noticeMaster(comment, config),
-      fn.noticeReply(comment, config, getParentComment),
-      fn.noticePushoo(comment, config)
-    ]).catch(err => {
-      logger.error('通知异常：', err)
-    })
-  },
-  // 初始化邮件插件
-  async initMailer ({ config, throwErr = false } = {}) {
-    try {
-      if (!config || !config.SMTP_USER || !config.SMTP_PASS) {
-        throw new Error('数据库配置不存在')
-      }
-      const transportConfig = {
-        auth: {
-          user: config.SMTP_USER,
-          pass: config.SMTP_PASS
-        }
-      }
-      if (config.SMTP_SERVICE) {
-        transportConfig.service = config.SMTP_SERVICE
-      } else if (config.SMTP_HOST) {
-        transportConfig.host = config.SMTP_HOST
-        transportConfig.port = parseInt(config.SMTP_PORT)
-        transportConfig.secure = config.SMTP_SECURE === 'true'
-      } else {
-        throw new Error('SMTP 服务器没有配置')
-      }
-      transporter = lazilyGetNodemailer().createTransport(transportConfig)
-      try {
-        const success = await transporter.verify()
-        if (success) logger.info('SMTP 邮箱配置正常')
-      } catch (error) {
-        throw new Error('SMTP 邮箱配置异常：' + error.message)
-      }
-      return true
-    } catch (e) {
-      if (throwErr) {
-        logger.error('邮件初始化异常：', e.message)
-        throw e
-      } else {
-        logger.warn('邮件初始化异常：', e.message)
-      }
-      return false
-    }
-  },
-  // 博主通知
-  async noticeMaster (comment, config) {
-    if (!transporter && !await fn.initMailer({ config })) {
-      logger.info('未配置邮箱或邮箱配置有误，不通知')
-      return
-    }
-    if (equalsMail(config.BLOGGER_EMAIL, comment.mail)) {
-      logger.info('博主本人评论，不发送通知给博主')
-      return
-    }
-    // 判断是否存在即时消息推送配置
-    const hasIMPushConfig = config.PUSHOO_CHANNEL && config.PUSHOO_TOKEN
-    if (hasIMPushConfig && config.SC_MAIL_NOTIFY !== 'true') {
-      logger.info('存在即时消息推送配置，默认不发送邮件给博主，您可以在管理面板修改此行为')
-      return
-    }
-    const SITE_NAME = config.SITE_NAME
-    const NICK = escapeHtml(comment.nick)
-    const IMG = getAvatar(comment, config)
-    const IP = comment.ip
-    const MAIL = escapeHtml(comment.mail)
-    const COMMENT = comment.comment
-    const SITE_URL = config.SITE_URL
-    const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
-    const emailSubject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}上有新评论了`
-    let emailContent
-    if (config.MAIL_TEMPLATE_ADMIN) {
-      emailContent = config.MAIL_TEMPLATE_ADMIN
-        .replace(/\${SITE_URL}/g, SITE_URL)
-        .replace(/\${SITE_NAME}/g, SITE_NAME)
-        .replace(/\${NICK}/g, NICK)
-        .replace(/\${IMG}/g, IMG)
-        .replace(/\${IP}/g, IP)
-        .replace(/\${MAIL}/g, MAIL)
-        .replace(/\${COMMENT}/g, COMMENT)
-        .replace(/\${POST_URL}/g, POST_URL)
-    } else {
-      emailContent = `
-        <div style="border-top:2px solid #12addb;box-shadow:0 1px 3px #aaaaaa;line-height:180%;padding:0 15px 12px;margin:50px auto;font-size:12px;">
-          <h2 style="border-bottom:1px solid #dddddd;font-size:14px;font-weight:normal;padding:13px 0 10px 8px;">
-            您在<a style="text-decoration:none;color: #12addb;" href="${SITE_URL}" target="_blank">${SITE_NAME}</a>上的文章有了新的评论
-          </h2>
-          <p><strong>${NICK}</strong>回复说：</p>
-          <div style="background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;">${COMMENT}</div>
-          <p>您可以点击<a style="text-decoration:none; color:#12addb" href="${POST_URL}" target="_blank">查看回复的完整內容</a><br></p>
-        </div>`
-    }
-    const toMail = config.BLOGGER_EMAIL || config.SENDER_EMAIL
-    if (!isValidEmail(toMail)) {
-      logger.warn('博主邮箱格式不合法，跳过发送博主通知：', toMail)
-      return
-    }
-    let sendResult
-    try {
-      sendResult = await transporter.sendMail({
-        from: `"${config.SENDER_NAME}" <${config.SENDER_EMAIL}>`,
-        to: toMail,
-        subject: emailSubject,
-        html: emailContent
-      })
-    } catch (e) {
-      sendResult = e
-    }
-    logger.log('博主通知结果：', sendResult)
-    return sendResult
-  },
-  // 即时消息通知
-  async noticePushoo (comment, config) {
-    if (!config.PUSHOO_CHANNEL || !config.PUSHOO_TOKEN) {
-      logger.info('没有配置 pushoo，放弃即时消息通知')
-      return
-    }
-    if (equalsMail(config.BLOGGER_EMAIL, comment.mail)) {
-      logger.info('博主本人评论，不发送通知给博主')
-      return
-    }
-    const pushContent = fn.getIMPushContent(comment, config)
-    const sendResult = await pushoo(config.PUSHOO_CHANNEL, {
-      token: config.PUSHOO_TOKEN,
-      title: pushContent.subject,
-      content: pushContent.content,
-      options: {
-        bark: {
-          url: pushContent.url
-        }
-      }
-    })
-    logger.info('即时消息通知结果：', sendResult)
-  },
-  // 即时消息推送内容获取
-  getIMPushContent (comment, config) {
-    const SITE_NAME = config.SITE_NAME
-    const NICK = escapeHtml(comment.nick)
-    const MAIL = escapeHtml(comment.mail)
-    const IP = comment.ip
-    const COMMENT = htmlToText(comment.comment)
-    const SITE_URL = config.SITE_URL
-    const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
-    const subject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}有新评论了`
-    const content = `评论人：${NICK} ([${MAIL}](mailto:${MAIL}))
-
-评论人IP：${IP}
-
-评论内容：${COMMENT}
-
-原文链接：[${POST_URL}](${POST_URL})`
-    return {
-      subject,
-      content,
-      url: POST_URL
-    }
-  },
-  // 回复通知
-  async noticeReply (currentComment, config, getParentComment) {
-    if (!currentComment.pid) {
-      logger.info('无父级评论，不通知')
-      return
-    }
-    if (!transporter && !await fn.initMailer({ config })) {
-      logger.info('未配置邮箱或邮箱配置有误，不通知')
-      return
-    }
-    const parentComment = await getParentComment(currentComment)
-    if (equalsMail(config.BLOGGER_EMAIL, parentComment.mail)) {
-      logger.info('回复给博主，因为会发博主通知邮件，所以不再重复通知')
-      return
-    }
-    if (equalsMail(currentComment.mail, parentComment.mail)) {
-      logger.info('回复自己的评论，不邮件通知')
-      return
-    }
-    const PARENT_NICK = escapeHtml(parentComment.nick)
-    const IMG = getAvatar(currentComment, config)
-    const PARENT_IMG = getAvatar(parentComment, config)
-    const SITE_NAME = config.SITE_NAME
-    const NICK = escapeHtml(currentComment.nick)
-    const COMMENT = currentComment.comment
-    const PARENT_COMMENT = parentComment.comment
-    const POST_URL = escapeHtml(fn.appendHashToUrl(currentComment.href || config.SITE_URL + currentComment.url, currentComment.id))
-    const SITE_URL = config.SITE_URL
-    const emailSubject = config.MAIL_SUBJECT || `${PARENT_NICK}，您在『${SITE_NAME}』上的评论收到了回复`
-    let emailContent
-    if (config.MAIL_TEMPLATE) {
-      emailContent = config.MAIL_TEMPLATE
-        .replace(/\${IMG}/g, IMG)
-        .replace(/\${PARENT_IMG}/g, PARENT_IMG)
-        .replace(/\${SITE_URL}/g, SITE_URL)
-        .replace(/\${SITE_NAME}/g, SITE_NAME)
-        .replace(/\${PARENT_NICK}/g, PARENT_NICK)
-        .replace(/\${PARENT_COMMENT}/g, PARENT_COMMENT)
-        .replace(/\${NICK}/g, NICK)
-        .replace(/\${COMMENT}/g, COMMENT)
-        .replace(/\${POST_URL}/g, POST_URL)
-    } else {
-      emailContent = `
-        <div style="border-top:2px solid #12ADDB;box-shadow:0 1px 3px #AAAAAA;line-height:180%;padding:0 15px 12px;margin:50px auto;font-size:12px;">
-          <h2 style="border-bottom:1px solid #dddddd;font-size:14px;font-weight:normal;padding:13px 0 10px 8px;">
-            您在<a style="text-decoration:none;color: #12ADDB;" href="${SITE_URL}" target="_blank">${SITE_NAME}</a>上的评论有了新的回复
-          </h2>
-          ${PARENT_NICK} 同学，您曾发表评论：
-          <div style="padding:0 12px 0 12px;margin-top:18px">
-            <div style="background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;">${PARENT_COMMENT}</div>
-            <p><strong>${NICK}</strong>回复说：</p>
-            <div style="background-color: #f5f5f5;padding: 10px 15px;margin:18px 0;word-wrap:break-word;">${COMMENT}</div>
-            <p>
-              您可以点击<a style="text-decoration:none; color:#12addb" href="${POST_URL}" target="_blank">查看回复的完整內容</a>，
-              欢迎再次光临<a style="text-decoration:none; color:#12addb" href="${SITE_URL}" target="_blank">${SITE_NAME}</a>。<br>
-            </p>
-          </div>
-        </div>`
-    }
-    if (!isValidEmail(parentComment.mail)) {
-      logger.warn('回复通知邮箱格式不合法，跳过发送回复通知：', parentComment.mail)
-      return
-    }
-    let sendResult
-    try {
-      sendResult = await transporter.sendMail({
-        from: `"${config.SENDER_NAME}" <${config.SENDER_EMAIL}>`,
-        to: parentComment.mail,
-        subject: emailSubject,
-        html: emailContent
-      })
-    } catch (e) {
-      sendResult = e
-    }
-    logger.log('回复通知结果：', sendResult)
-    return sendResult
-  },
-  appendHashToUrl (url, hash) {
-    if (url.indexOf('#') === -1) {
-      return `${url}#${hash}`
-    } else {
-      return `${url.substring(0, url.indexOf('#'))}#${hash}`
-    }
-  },
-  async emailTest (event, config, isAdminUser) {
-    const res = {}
-    if (isAdminUser) {
-      try {
-        // 邮件测试前清除 transporter，保证读取的是最新的配置
-        transporter = null
-        await fn.initMailer({ config, throwErr: true })
-        const toMail = event.mail || config.BLOGGER_EMAIL || config.SENDER_EMAIL
-        if (!isValidEmail(toMail)) {
-          res.message = '邮箱格式不合法'
-          return res
-        }
-        const sendResult = await transporter.sendMail({
-          from: config.SENDER_EMAIL,
-          to: toMail,
-          subject: 'Twikoo 邮件通知测试邮件',
-          html: '如果您收到这封邮件，说明 Twikoo 邮件功能配置正确'
-        })
-        res.result = sendResult
-      } catch (e) {
-        res.message = e.message
-      }
-    } else {
-      res.code = RES_CODE.NEED_LOGIN
-      res.message = '请先登录'
-    }
-    return res
-  }
-}
-
-module.exports = fn

package/utils/spam.js

@@ -1,241 +0,0 @@
-const {
-  getAkismetClient,
-  getTencentcloudTms
-} = require('./lib')
-const {
-  equalsMail
-} = require('.')
-const AkismetClient = getAkismetClient()
-
-const logger = require('./logger')
-
-let tencentcloudTms
-let generateTextPromise
-
-function getTencentCloudTms () {
-  if (!tencentcloudTms) {
-    try {
-      tencentcloudTms = getTencentcloudTms()
-    } catch (e) {
-      logger.warn('加载 "tencentcloud-sdk-nodejs-tms" 失败', e)
-    }
-  }
-  return tencentcloudTms
-}
-
-function getGenerateText () {
-  if (!generateTextPromise) {
-    generateTextPromise = import('@xsai/generate-text')
-      .then(({ generateText }) => generateText)
-      .catch((error) => {
-        generateTextPromise = null
-        throw error
-      })
-  }
-  return generateTextPromise
-}
-
-// 提取json结构的函数
-function extractJson (rawText) {
-  if (!rawText) return ''
-  const trimmed = rawText.trim()
-  const match = trimmed.match(/\{[\s\S]*\}/)
-  return match ? match[0] : trimmed
-}
-
-// 移除多余的字符
-function repairJson (jsonStr) {
-  if (!jsonStr) return ''
-  let cleaned = jsonStr.trim()
-  cleaned = cleaned.replace(/,\s*([}\]])/g, '$1')
-  return cleaned
-}
-
-// validateJson 返回的 error 信息会被拼接进 prompt
-function validateJson (jsonStr) {
-  try {
-    const obj = JSON.parse(jsonStr)
-    if (typeof obj !== 'object' || obj === null) {
-      return { valid: false, error: 'Parsed JSON is not an object' }
-    }
-    if (!('spam' in obj)) {
-      return { valid: false, error: 'Missing required key "spam"' }
-    }
-    if (typeof obj.spam !== 'boolean') {
-      return { valid: false, error: 'Key "spam" must be a boolean value' }
-    }
-    return { valid: true, data: obj }
-  } catch (err) {
-    return { valid: false, error: `JSON Parse failed: ${err.message}` }
-  }
-}
-
-// 生成提示词的函数: system 为管理员指令，user 为待审核的评论数据
-// errorMsg 用于重试，customPrompt 替代默认的 system 指令
-function buildMessages (commentData, errorMsg = '', customPrompt = '') {
-  // 1. system 指令（管理员自定义或内置默认）
-  const systemContent = customPrompt || `You are a blog comment moderation assistant. Analyze ALL fields below and determine if this submission is spam or ham.
-
-Spam includes ANY of the following in ANY field:
-- Commercial ads, promotions, or buying/selling offers (e.g., "代开发票", "加微信", "兼职", "办证", "AI中转站").
-- Special case: If the comment text is harmless, but the nickname is suspicious (e.g., contains ads or promotions) AND a website link is provided, treat it as SPAM.
-- Meaningless gibberish or spammy repetition (e.g., "顶顶顶", "111111", "asdfgh", "好" repeated).
-- Abusive language, insults, or offensive Chinese slang.
-- Suspicious links or SEO spam in the website field.
-- Bot-like automated greetings.
-
-Ham includes:
-- Genuine questions, constructive feedback, technical discussions, or normal greetings in Chinese/English.
-
-Strictly follow these rules:
-1. If ANY field contains spam content, output exactly {"spam": true}.
-2. If ALL fields are legitimate, output exactly {"spam": false}.
-3. Do not include any explanations, introduction, punctuation, or extra spaces. Output only the JSON object.
-
-Your response MUST be a single valid JSON object, like:
-{"spam": true} or {"spam": false}`
-
-  // 2. user 数据（始终是待审核的评论内容）
-  let userContent = `Comment: ${commentData.comment}
-Nickname: ${commentData.nick || ''}
-Website: ${commentData.link || ''}`
-
-  // 3. 如果有错误信息，追加到用户消息末尾
-  if (errorMsg) {
-    userContent += `\n\n[ERROR FROM PREVIOUS ATTEMPT]: Your last response failed verification with error: "${errorMsg}". Please correct your output format and make sure to return exactly valid JSON.`
-  }
-
-  // 4. 返回 messages 数组
-  const finalPrompt = [
-    { role: 'system', content: systemContent },
-    { role: 'user', content: userContent }
-  ]
-  logger.log('提示词是：', finalPrompt)
-  return finalPrompt
-}
-
-async function checkByLLM (comment, config) {
-  const maxRetries = Number(config.LLM_MAX_RETRIES) || 3
-  let lastError = ''
-
-  // 网络/Provider 异常或者格式校验不通过会进入重试逻辑
-  for (let attempt = 1; attempt <= maxRetries; attempt++) {
-    if (attempt > 1) {
-      await new Promise(resolve => setTimeout(resolve, 1000))
-    }
-    try {
-      let messages
-      // 自定义提示词和内置提示词的 message 构建逻辑全交给 buildMessages 函数
-      if (config.LLM_SPAM_PROMPT) {
-        messages = buildMessages(comment, lastError, config.LLM_SPAM_PROMPT)
-      } else {
-        messages = buildMessages(comment, lastError)
-      }
-
-      const generateText = await getGenerateText()
-      const chatCompletion = await generateText({
-        apiKey: config.LLM_API_KEY,
-        baseURL: config.LLM_API_ENDPOINT || 'https://api.deepseek.com/v1',
-        model: config.LLM_MODEL || 'deepseek-chat',
-        responseFormat: { type: 'json_object' },
-        messages
-      })
-
-      const rawText = chatCompletion.text || ''
-
-      const extracted = extractJson(rawText)
-      const repaired = repairJson(extracted)
-      const validation = validateJson(repaired)
-
-      // 校验通过返回，不通过继续循环
-      if (validation.valid) {
-        const isSpam = validation.data.spam
-        if (isSpam) {
-          logger.info(`LLM 判定为 SPAM (尝试第 ${attempt} 次): id="${comment.id}" nick="${comment.nick}"`)
-        } else {
-          logger.log(`LLM 判定为 HAM (尝试第 ${attempt} 次): id="${comment.id}" nick="${comment.nick}"`)
-        }
-        return isSpam
-      } else {
-        lastError = validation.error
-        logger.warn(`LLM 返回校验失败 (尝试第 ${attempt}/${maxRetries} 次), 错误: ${lastError}. 原始返回: "${rawText}"`)
-      }
-    } catch (error) {
-      lastError = error.message
-      logger.error(`LLM 请求异常 (尝试第 ${attempt}/${maxRetries} 次), 错误: ${lastError}`)
-    }
-  }
-
-  logger.error(`LLM 垃圾评论检测历经 ${maxRetries} 次尝试均失败，执行终极放行兜底（返回 false）`)
-  return false
-}
-
-const fn = {
-  // 后垃圾评论检测
-  async postCheckSpam (comment, config) {
-    try {
-      let isSpam
-      if (comment.isSpam) {
-        // 预检测没过的，就不再检测了
-        isSpam = true
-      } else if (equalsMail(config.BLOGGER_EMAIL, comment.mail)) {
-        // 博主本人评论，不再检测了
-        isSpam = false
-      } else if (config.QCLOUD_SECRET_ID && config.QCLOUD_SECRET_KEY) {
-        // 腾讯云内容安全
-        const client = new (getTencentCloudTms().tms.v20201229.Client)({
-          credential: { secretId: config.QCLOUD_SECRET_ID, secretKey: config.QCLOUD_SECRET_KEY },
-          region: 'ap-shanghai',
-          profile: { httpProfile: { endpoint: 'tms.tencentcloudapi.com' } }
-        })
-        const textModerationParams = {
-          // 文档: https://cloud.tencent.com/document/api/1124/51860
-          Content: Buffer.from(comment.comment, 'utf8').toString('base64'),
-          DataId: comment.id,
-          User: { Nickname: comment.nick },
-          Device: { IP: comment.ip }
-        }
-        if (config.QCLOUD_CMS_BIZTYPE) {
-          textModerationParams.BizType = config.QCLOUD_CMS_BIZTYPE
-        }
-        logger.log('腾讯云请求参数：', textModerationParams)
-        const checkResult = await client.TextModeration(textModerationParams)
-        logger.log('腾讯云返回结果：', checkResult)
-        isSpam = checkResult.Suggestion !== 'Pass'
-        if (isSpam) {
-          logger.warn(`腾讯云判定不通过: id="${comment.id}" nick="${comment.nick}" suggestion="${checkResult.Suggestion}" label="${checkResult.Label}" subLabel="${checkResult.SubLabel}"`)
-        }
-      } else if (config.AKISMET_KEY) {
-        // Akismet
-        const akismetClient = new AkismetClient({
-          key: config.AKISMET_KEY,
-          blog: config.SITE_URL
-        })
-        const isValid = await akismetClient.verifyKey()
-        if (!isValid) {
-          logger.warn('Akismet key 不可用：', config.AKISMET_KEY)
-          return
-        }
-        isSpam = await akismetClient.checkSpam({
-          user_ip: comment.ip,
-          user_agent: comment.ua,
-          permalink: comment.href,
-          comment_type: comment.rid ? 'reply' : 'comment',
-          comment_author: comment.nick,
-          comment_author_email: comment.mail,
-          comment_author_url: comment.link,
-          comment_content: comment.comment
-        })
-      } else if (config.LLM_API_KEY) {
-        // 大语言模型检测
-        isSpam = await checkByLLM(comment, config)
-      }
-      logger.log('垃圾评论检测结果：', isSpam)
-      return isSpam
-    } catch (err) {
-      logger.error('垃圾评论检测异常：', err)
-    }
-  }
-}
-
-module.exports = fn