xinyu-pro 0.22.6 → 0.23.0

package/app/api/plugins/files-write/all/route.ts

@@ -0,0 +1,250 @@
+// app/api/plugins/files-write/all/route.ts
+
+import {NextRequest, NextResponse} from 'next/server';
+import {ensureDb} from '@/lib/server/db-init';
+import {execute} from '@/lib/server/db';
+import {getPluginDir, writePluginResource} from '@/lib/server/plugin-files';
+import path from 'path';
+import {promises as fs} from 'fs';
+
+function isValidPluginId(id: string): boolean {
+  return /^[a-zA-Z0-9._-]+$/.test(id) && id.length <= 200 && !id.includes('..');
+}
+
+function isSafePath(filePath: string): boolean {
+  const normalized = path.normalize(filePath);
+  return !normalized.includes('..') && !path.isAbsolute(normalized) && normalized !== '';
+}
+
+/** 验证插件存在 */
+async function verifyPlugin(pluginId: string) {
+  await ensureDb();
+  const [rows] = await execute(
+    'SELECT id, file_entry FROM extensions WHERE id = ?',
+    [pluginId]
+  );
+  const list = rows as Record<string, unknown>[];
+  return list.length > 0 ? list[0] : null;
+}
+
+/** 验证插件存在 */
+async function deleteOrphanedFiles(pluginId: string, existingFiles: Set<string>, currentFiles: Set<string>) {
+  const pluginDir = getPluginDir(pluginId);
+
+  // 使用 Array.from 或 for...of 配合 downlevelIteration 的替代方案
+  const existingFilesArray = Array.from(existingFiles);
+
+  for (const filePath of existingFilesArray) {
+    if (!currentFiles.has(filePath)) {
+      const fullPath = path.join(pluginDir, filePath);
+      try {
+        const stat = await fs.stat(fullPath);
+        if (stat.isFile()) {
+          await fs.unlink(fullPath);
+          console.log(`删除孤儿文件: ${filePath}`);
+        }
+      } catch (e) {
+        console.error(`删除文件失败 ${filePath}:`, e);
+      }
+    }
+  }
+}
+
+/** 获取插件当前所有文件列表 */
+async function getExistingFiles(pluginId: string): Promise<Set<string>> {
+  const pluginDir = getPluginDir(pluginId);
+  const files = new Set<string>();
+
+  try {
+    await fs.access(pluginDir);
+  } catch {
+    return files; // 目录不存在，返回空集合
+  }
+
+  const walk = async (dir: string, basePath: string) => {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name);
+      const relativePath = path.join(basePath, entry.name).replace(/\\/g, '/');
+
+      if (entry.isDirectory()) {
+        await walk(fullPath, relativePath);
+      } else {
+        files.add(relativePath);
+      }
+    }
+  };
+
+  await walk(pluginDir, '');
+  return files;
+}
+
+// ==================== PUT: 批量保存所有文件 ====================
+
+export async function PUT(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const pluginId = searchParams.get('pluginId');
+    const deleteOrphans = searchParams.get('deleteOrphans') !== 'false'; // 默认删除孤儿文件
+
+    if (!pluginId) {
+      return NextResponse.json({ error: '缺少 pluginId 参数' }, { status: 400 });
+    }
+    if (!isValidPluginId(pluginId)) {
+      return NextResponse.json({ error: '非法插件 ID' }, { status: 400 });
+    }
+
+    const plugin = await verifyPlugin(pluginId);
+    if (!plugin) {
+      return NextResponse.json({ error: '插件不存在' }, { status: 404 });
+    }
+
+    const body = await request.json();
+    const { files, manifest, currentFile } = body;
+
+    if (!files || typeof files !== 'object') {
+      return NextResponse.json({ error: '缺少 files 参数或格式错误' }, { status: 400 });
+    }
+
+    const errors: Array<{ path: string; error: string }> = [];
+    const savedFiles: string[] = [];
+
+    // 获取现有文件列表（用于删除孤儿文件）
+    let existingFiles: Set<string> = new Set();
+    if (deleteOrphans) {
+      existingFiles = await getExistingFiles(pluginId);
+    }
+
+    // 保存所有文件
+    const fileEntries = Object.entries(files);
+    for (const [filePath, content] of fileEntries) {
+      if (typeof content !== 'string') {
+        errors.push({ path: filePath, error: '内容必须是字符串' });
+        continue;
+      }
+
+      if (!isSafePath(filePath)) {
+        errors.push({ path: filePath, error: '非法文件路径' });
+        continue;
+      }
+
+      // 禁止写入关键目录检查
+      if (filePath.includes('..') || filePath.startsWith('.')) {
+        errors.push({ path: filePath, error: '非法文件路径' });
+        continue;
+      }
+
+      try {
+        await writePluginResource(pluginId, filePath, content);
+        savedFiles.push(filePath);
+      } catch (e) {
+        console.error(`保存文件失败 ${filePath}:`, e);
+        errors.push({ path: filePath, error: '写入失败' });
+      }
+    }
+
+    // 处理 manifest 单独传入的情况
+    if (manifest && !files['manifest.json']) {
+      try {
+        const manifestContent = JSON.stringify(manifest, null, 2);
+        await writePluginResource(pluginId, 'manifest.json', manifestContent);
+        savedFiles.push('manifest.json');
+      } catch (e) {
+        errors.push({ path: 'manifest.json', error: '保存失败' });
+      }
+    }
+
+    // 删除孤儿文件
+    let deletedCount = 0;
+    if (deleteOrphans && existingFiles.size > 0) {
+      const currentFilesSet = new Set(Object.keys(files));
+      await deleteOrphanedFiles(pluginId, existingFiles, currentFilesSet);
+      // 计算删除数量
+      const existingArray = Array.from(existingFiles);
+      const currentArray = Array.from(currentFilesSet);
+      deletedCount = existingArray.filter(f => !currentArray.includes(f)).length;
+    }
+
+    // 返回结果
+    if (errors.length > 0 && savedFiles.length === 0) {
+      return NextResponse.json({
+        error: '所有文件保存失败',
+        errors,
+        savedFiles: [],
+        deletedCount
+      }, { status: 500 });
+    }
+
+    return NextResponse.json({
+      success: true,
+      savedFiles,
+      savedCount: savedFiles.length,
+      deletedCount,
+      errors: errors.length > 0 ? errors : undefined,
+      currentFile: currentFile || null
+    });
+
+  } catch (e) {
+    console.error('批量保存插件文件失败:', e);
+    return NextResponse.json({
+      error: '批量保存失败',
+      message: e instanceof Error ? e.message : String(e)
+    }, { status: 500 });
+  }
+}
+
+// ==================== POST: 获取所有文件内容 ====================
+
+export async function POST(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const pluginId = searchParams.get('pluginId');
+
+    if (!pluginId) {
+      return NextResponse.json({ error: '缺少 pluginId 参数' }, { status: 400 });
+    }
+    if (!isValidPluginId(pluginId)) {
+      return NextResponse.json({ error: '非法插件 ID' }, { status: 400 });
+    }
+
+    const plugin = await verifyPlugin(pluginId);
+    if (!plugin) {
+      return NextResponse.json({ error: '插件不存在' }, { status: 404 });
+    }
+
+    const pluginDir = getPluginDir(pluginId);
+    const files: Record<string, string> = {};
+
+    try {
+      await fs.access(pluginDir);
+    } catch {
+      return NextResponse.json({ files: {}, message: '插件目录不存在' });
+    }
+
+    const walk = async (dir: string, basePath: string) => {
+      const entries = await fs.readdir(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        const relativePath = path.join(basePath, entry.name).replace(/\\/g, '/');
+
+        if (entry.isDirectory()) {
+          await walk(fullPath, relativePath);
+        } else {
+          files[relativePath] = await fs.readFile(fullPath, 'utf-8');
+        }
+      }
+    };
+
+    await walk(pluginDir, '');
+
+    return NextResponse.json({
+      success: true,
+      files,
+      fileCount: Object.keys(files).length
+    });
+
+  } catch (e) {
+    console.error('读取插件所有文件失败:', e);
+    return NextResponse.json({ error: '读取文件失败' }, { status: 500 });
+  }
+}

package/app/api/plugins/files-write/route.ts

@@ -1,9 +1,9 @@
 // app/api/plugins/files-write/route.ts - 插件文件写入/删除/新建/重命名
 
 import { NextRequest, NextResponse } from 'next/server';
-import { ensureDb } from '@/lib/db-init';
-import { execute } from '@/lib/db';
-import { writePluginResource, getPluginDir } from '@/lib/plugin-files';
+import { ensureDb } from '@/lib/server/db-init';
+import { execute } from '@/lib/server/db';
+import {writePluginResource, getPluginDir, getPluginCodeRelativePath} from '@/lib/server/plugin-files';
 import path from 'path';
 import { promises as fs } from 'fs';
 
@@ -168,35 +168,33 @@ export async function DELETE(request: NextRequest) {
       return NextResponse.json({ error: '非法文件路径' }, { status: 400 });
     }
 
-    // 禁止删除关键文件：manifest.json、入口文件、resources 目录本身
+    // 禁止删除关键文件：manifest.json、入口文件
     if (filePath === 'manifest.json') {
       return NextResponse.json({ error: '不能删除 manifest.json' }, { status: 400 });
     }
-    if (filePath === 'resources') {
-      return NextResponse.json({ error: '不能删除 resources 目录（资源文件目录，仅支持删除其中的文件）' }, { status: 400 });
-    }
 
     const exists = await verifyPlugin(pluginId);
     if (!exists) {
       return NextResponse.json({ error: '插件不存在' }, { status: 404 });
     }
 
-    // 从数据库读取 code_path，提取入口文件名，禁止删除入口文件
+    const pluginDir = getPluginDir(pluginId);
+    const fullPath = path.join(pluginDir, filePath);
+    const relativePath = getPluginCodeRelativePath(pluginId, filePath);
+
+    // 从数据库读取 file_entry，提取入口文件名，禁止删除入口文件
     const [codeRows] = await execute(
-      'SELECT code_path FROM extensions WHERE id = ?',
+      'SELECT file_entry FROM extensions WHERE id = ?',
       [pluginId]
     );
     const codeRowList = codeRows as Record<string, unknown>[];
-    if (codeRowList.length > 0 && codeRowList[0].code_path) {
-      const entryFile = (codeRowList[0].code_path as string).split('/').pop();
-      if (entryFile && filePath === entryFile) {
+    if (codeRowList.length > 0 && codeRowList[0].file_entry) {
+      const entryFile = codeRowList[0].file_entry as string;
+      if (entryFile && relativePath === entryFile) {
         return NextResponse.json({ error: `不能删除入口文件 ${entryFile}` }, { status: 400 });
       }
     }
 
-    const pluginDir = getPluginDir(pluginId);
-    const fullPath = path.join(pluginDir, filePath);
-
     try {
       const stat = await fs.stat(fullPath);
       if (stat.isDirectory()) {

package/app/api/plugins/import/route.ts

@@ -1,10 +1,10 @@
 // app/api/plugins/import/route.ts - 插件导入 API
 
 import { NextRequest, NextResponse } from 'next/server';
-import { execute } from '@/lib/db';
-import { ensureDb } from '@/lib/db-init';
-import { parseManifestFromCode } from '@/lib/manifest-parser';
-import { writePluginCode } from '@/lib/plugin-files';
+import { execute } from '@/lib/server/db';
+import { ensureDb } from '@/lib/server/db-init';
+import { parseManifestFromCode } from '@/lib/shared/manifest-parser';
+import { writePluginCode } from '@/lib/server/plugin-files';
 
 /** 校验插件 ID 合法性（只允许字母、数字、连字符、下划线、点） */
 function isValidPluginId(id: string): boolean {
@@ -88,7 +88,7 @@ export async function POST(request: NextRequest) {
       // 将代码写入文件
       const codePath = await writePluginCode(pId, pCode);
 
-      const sql = `INSERT INTO extensions (id, name, version, description, author, type, icon, min_app_version, code_path, config_schema, ui_slots, ui_permissions, public_exports, dependencies) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET name = excluded.name, version = excluded.version, description = excluded.description, author = excluded.author, type = excluded.type, icon = excluded.icon, min_app_version = excluded.min_app_version, code_path = excluded.code_path, config_schema = excluded.config_schema, ui_slots = excluded.ui_slots, ui_permissions = excluded.ui_permissions, public_exports = excluded.public_exports, dependencies = excluded.dependencies`;
+      const sql = `INSERT INTO extensions (id, name, version, description, author, type, icon, min_app_version, file_entry, config_schema, ui_slots, ui_permissions, public_exports, dependencies) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(id) DO UPDATE SET name = excluded.name, version = excluded.version, description = excluded.description, author = excluded.author, type = excluded.type, icon = excluded.icon, min_app_version = excluded.min_app_version, file_entry = excluded.file_entry, config_schema = excluded.config_schema, ui_slots = excluded.ui_slots, ui_permissions = excluded.ui_permissions, public_exports = excluded.public_exports, dependencies = excluded.dependencies`;
       await execute(sql, [pId, pName, pVersion, pDescription, pAuthor, pType, pIcon, pMinAppVersion, codePath, pConfigSchema, pUiSlots, pUiPermissions, pPublicExports, pDependencies]);
 
       // 自动创建全局绑定，config 从 configSchema 的 defaultValue 填充

package/app/api/plugins/import-package/route.ts

@@ -1,10 +1,10 @@
 // app/api/plugins/import-package/route.ts - .xye 插件包导入 API
 
 import { NextRequest, NextResponse } from 'next/server';
-import { execute } from '@/lib/db';
-import { ensureDb } from '@/lib/db-init';
-import { parseManifestFromCode } from '@/lib/manifest-parser';
-import { getPluginDir } from '@/lib/plugin-files';
+import { execute } from '@/lib/server/db';
+import { ensureDb } from '@/lib/server/db-init';
+import { parseManifestFromCode } from '@/lib/shared/manifest-parser';
+import {getPluginCodeRelativePath, getPluginDir} from '@/lib/server/plugin-files';
 import AdmZip from 'adm-zip';
 import path from 'path';
 import { promises as fs } from 'fs';
@@ -84,7 +84,7 @@ export async function POST(request: NextRequest) {
     }
 
     // 查找入口文件
-    const entryPath = pluginEntry.startsWith('/') ? pluginEntry.slice(1) : pluginEntry;
+    const entryPath = path.basename(pluginEntry) || 'plugin.js';
     const codeEntry = entries.find(e => e.entryName === entryPath || e.entryName === `/${entryPath}`);
 
     if (!codeEntry) {
@@ -133,16 +133,16 @@ export async function POST(request: NextRequest) {
     await fs.mkdir(pluginDir, { recursive: true });
     const codeFilePath = path.join(pluginDir, entryPath);
     await fs.writeFile(codeFilePath, pluginCode, 'utf-8');
-    const codePath = `data/plugins/${pluginId}/${entryPath}`;
+    const fileEntry = getPluginCodeRelativePath(pluginId, entryPath);
 
     // 写入数据库
     await execute(
-      `INSERT INTO extensions (id, name, version, description, author, type, icon, min_app_version, code_path, config_schema, ui_slots, ui_permissions, public_exports, dependencies)
+      `INSERT INTO extensions (id, name, version, description, author, type, icon, min_app_version, file_entry, config_schema, ui_slots, ui_permissions, public_exports, dependencies)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(id) DO UPDATE SET
        name = excluded.name, version = excluded.version, description = excluded.description,
        author = excluded.author, type = excluded.type, icon = excluded.icon,
-       min_app_version = excluded.min_app_version, code_path = excluded.code_path,
+       min_app_version = excluded.min_app_version, file_entry = excluded.file_entry,
        config_schema = excluded.config_schema, ui_slots = excluded.ui_slots,
        ui_permissions = excluded.ui_permissions,
        public_exports = excluded.public_exports, dependencies = excluded.dependencies`,
@@ -150,7 +150,7 @@ export async function POST(request: NextRequest) {
         pluginId, pluginName, pluginVersion,
         String(manifest.description || ''), String(manifest.author || ''),
         pluginType, String(manifest.icon || ''), String(manifest.minAppVersion || ''),
-        codePath, pConfigSchema, pUiSlots, pUiPermissions, pPublicExports, pDependencies,
+        fileEntry, pConfigSchema, pUiSlots, pUiPermissions, pPublicExports, pDependencies,
       ]
     );
 

package/app/api/plugins/resources/route.ts

@@ -1,8 +1,11 @@
 // app/api/plugins/resources/route.ts - 插件资源文件 HTTP 访问
 
 import { NextRequest, NextResponse } from 'next/server';
-import { ensureDb } from '@/lib/db-init';
-import { execute } from '@/lib/db';
+
+export const dynamic = 'force-dynamic';
+
+import { ensureDb } from '@/lib/server/db-init';
+import { execute } from '@/lib/server/db';
 import path from 'path';
 import { promises as fs } from 'fs';
 
@@ -72,6 +75,7 @@ export async function GET(request: NextRequest) {
       [pluginId]
     );
 
+    // @ts-ignore
     if (rows.length === 0) {
       return NextResponse.json({ error: '插件不存在' }, { status: 404 });
     }