zmdms-utils 0.0.96 → 0.0.97

package/dist/es/file.js

@@ -1,7 +1,7 @@
 import { getPreToken } from './auth.js';
 import { dangerouslyXss, specialString, getFileExtension, isImageExtension } from './common.js';
 import { BASIC_KEY, TOKEN_KEY, FILE_SERVICE, FILE_PRVIEW_SERVICE_URL } from './constants.js';
-import { Crypto } from './crypto.js';
+import { getOssCrypto } from './securityKey.js';
 
 /**
  * 附件相关接口
@@ -418,7 +418,10 @@ function getBasicInfo(baseURL, token) {
  */
 function encodeFileId(fileId, encodeNum) {
     if (encodeNum === void 0) { encodeNum = 1; }
-    var crypto = new Crypto(window.__CRYPTO_AES_KEY__, window.__CRYPTO_DES_KEY__);
+    var crypto = getOssCrypto();
+    if (!crypto) {
+        throw new Error("缺少附件加密密钥，请先调用initSecurityKeys初始化或设置window.__CRYPTO_AES_KEY__");
+    }
     if (encodeNum === 0) {
         return crypto.encrypt(fileId);
     }

package/dist/es/securityKey.d.ts

@@ -0,0 +1,49 @@
+import { Crypto } from './crypto.js';
+
+/**
+ * 密钥集合
+ */
+interface ISecurityKeys {
+    /** 接口请求参数加密用 AES 密钥 */
+    apiAesKey: string;
+    /** 接口请求参数加密用 DES 密钥 */
+    apiDesKey: string;
+    /** 附件(OSS)相关加密用 AES 密钥 */
+    ossAesKey: string;
+    /** 附件(OSS)相关加密用 DES 密钥 */
+    ossDesKey: string;
+}
+interface ISecurityKeysOptions {
+    /** 接口请求的前缀地址 必传 */
+    baseURL: string;
+}
+/**
+ * 初始化安全密钥
+ * 应用启动时(render之前)调用一次 并发调用会共享同一个请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+declare function initSecurityKeys(options: ISecurityKeysOptions): Promise<ISecurityKeys>;
+/**
+ * 强制刷新安全密钥
+ * 后端轮换密钥后可调用 会忽略已有缓存重新请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+declare function refreshSecurityKeys(options: ISecurityKeysOptions): Promise<ISecurityKeys>;
+/**
+ * 获取接口请求参数加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+declare function getApiCrypto(): Crypto | undefined;
+/**
+ * 获取附件(OSS)相关加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+declare function getOssCrypto(): Crypto | undefined;
+
+export { ISecurityKeys, getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys };

package/dist/es/securityKey.js

@@ -0,0 +1,121 @@
+import { __awaiter, __generator } from './_virtual/_tslib.js';
+import axios from 'axios';
+import { getPreToken } from './auth.js';
+import { TOKEN_KEY, BASIC_KEY } from './constants.js';
+import { Crypto } from './crypto.js';
+
+// 密钥内存缓存 不挂载到window 避免产生新的明文全局变量
+var securityKeys = null;
+// 进行中的密钥请求 并发调用initSecurityKeys/refreshSecurityKeys时共享同一个请求
+var securityKeysPromise = null;
+/**
+ * 初始化安全密钥
+ * 应用启动时(render之前)调用一次 并发调用会共享同一个请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+function initSecurityKeys(options) {
+    if (securityKeys) {
+        return Promise.resolve(securityKeys);
+    }
+    if (securityKeysPromise) {
+        return securityKeysPromise;
+    }
+    return requestSecurityKeys(options);
+}
+/**
+ * 强制刷新安全密钥
+ * 后端轮换密钥后可调用 会忽略已有缓存重新请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+function refreshSecurityKeys(options) {
+    return requestSecurityKeys(options);
+}
+/**
+ * 获取接口请求参数加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+function getApiCrypto() {
+    if (securityKeys === null || securityKeys === void 0 ? void 0 : securityKeys.apiAesKey) {
+        return new Crypto(securityKeys.apiAesKey, securityKeys.apiDesKey);
+    }
+    return createCryptoFromWindow();
+}
+/**
+ * 获取附件(OSS)相关加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+function getOssCrypto() {
+    if (securityKeys === null || securityKeys === void 0 ? void 0 : securityKeys.ossAesKey) {
+        return new Crypto(securityKeys.ossAesKey, securityKeys.ossDesKey);
+    }
+    return createCryptoFromWindow();
+}
+/**
+ * 请求密钥并缓存
+ */
+function requestSecurityKeys(options) {
+    securityKeysPromise = fetchSecurityKeys(options).then(function (keys) {
+        securityKeys = keys;
+        securityKeysPromise = null;
+        return keys;
+    }, function (err) {
+        securityKeysPromise = null;
+        throw err;
+    });
+    return securityKeysPromise;
+}
+/**
+ * 请求密钥接口
+ * 使用裸axios请求(不走AxiosRequest) 避免请求本身依赖密钥或触发统一的异常处理
+ */
+function fetchSecurityKeys(options) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function () {
+        var apiBaseURL, headers, token, response, _c, code, data, msg;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    apiBaseURL = ((_b = (_a = options.baseURL) === null || _a === void 0 ? void 0 : _a.endsWith) === null || _b === void 0 ? void 0 : _b.call(_a, "/"))
+                        ? options.baseURL.slice(0, options.baseURL.length - 1)
+                        : options.baseURL;
+                    headers = {};
+                    token = getPreToken();
+                    if (token) {
+                        headers[TOKEN_KEY] = token;
+                    }
+                    return [4 /*yield*/, axios.get("".concat(apiBaseURL, "/api/").concat(BASIC_KEY, "-resource/resource/get-security-key"), { headers: headers, timeout: 60000 })];
+                case 1:
+                    response = _d.sent();
+                    _c = (response === null || response === void 0 ? void 0 : response.data) || {}, code = _c.code, data = _c.data, msg = _c.msg;
+                    if (code === 200 && data) {
+                        return [2 /*return*/, {
+                                apiAesKey: data.apiAesKey,
+                                apiDesKey: data.apiDesKey,
+                                ossAesKey: data.ossAesKey,
+                                ossDesKey: data.ossDesKey,
+                            }];
+                    }
+                    throw new Error(msg || "获取安全密钥失败");
+            }
+        });
+    });
+}
+/**
+ * 从window旧密钥创建Crypto实例 兼容未改造的应用
+ */
+function createCryptoFromWindow() {
+    var aesKey = window.__CRYPTO_AES_KEY__;
+    var desKey = window.__CRYPTO_DES_KEY__;
+    if (aesKey) {
+        return new Crypto(aesKey, desKey);
+    }
+    return undefined;
+}
+
+export { getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys };

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { getPreToken, getToken, parseToken, removeToken, setToken } from './es/a
 export { AxiosRequest, IOptions, IOtherOptions } from './es/request.js';
 export { getBaseUrl } from './es/baseUrl.js';
 export { Crypto, md5 } from './es/crypto.js';
+export { ISecurityKeys, getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys } from './es/securityKey.js';
 export { addThousedSeparator, appendQueryParamsToUrl, copyToClipboard, dangerouslyXss, delay, emitter, getFileExtension, isChinese, isImageExtension, isNonEmpty, parseJoin, parseQueryParams, specialString, unescapeString } from './es/common.js';
 export { divide, exactRound, formatUnit, minus, plus, times } from './es/math.js';
 export { validatePassword } from './es/passwordValidate.js';

package/dist/index.js

@@ -5,6 +5,7 @@ export { getPreToken, getToken, parseToken, removeToken, setToken } from './es/a
 export { AxiosRequest } from './es/request.js';
 export { getBaseUrl } from './es/baseUrl.js';
 export { Crypto, md5 } from './es/crypto.js';
+export { getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys } from './es/securityKey.js';
 export { addThousedSeparator, appendQueryParamsToUrl, copyToClipboard, dangerouslyXss, delay, emitter, getFileExtension, isChinese, isImageExtension, isNonEmpty, parseJoin, parseQueryParams, specialString, unescapeString } from './es/common.js';
 export { divide, exactRound, formatUnit, minus, plus, times } from './es/math.js';
 export { validatePassword } from './es/passwordValidate.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zmdms-utils",
-  "version": "0.0.96",
+  "version": "0.0.97",
   "description": "",
   "main": "dist/index.js",
   "module": "dist/index.js",

package/src/file.ts

@@ -15,7 +15,7 @@ import {
   FILE_PRVIEW_SERVICE_URL,
 } from "./constants";
 import { AxiosResponse } from "axios";
-import { Crypto } from "./crypto";
+import { getOssCrypto } from "./securityKey";
 
 // 是否是中拓的附件服务
 const isZmdmsFileService = FILE_SERVICE === "zmdms";
@@ -546,10 +546,12 @@ interface IThumbnailLinkOptions extends Partial<IOptions> {
  * 3. 如果参数是通过body传输的，只需要encode一次
  */
 export function encodeFileId(fileId: string, encodeNum: number = 1) {
-  const crypto = new Crypto(
-    (window as any).__CRYPTO_AES_KEY__,
-    (window as any).__CRYPTO_DES_KEY__,
-  );
+  const crypto = getOssCrypto();
+  if (!crypto) {
+    throw new Error(
+      "缺少附件加密密钥，请先调用initSecurityKeys初始化或设置window.__CRYPTO_AES_KEY__",
+    );
+  }
   if (encodeNum === 0) {
     return crypto.encrypt(fileId);
   }

package/src/index.ts

@@ -11,6 +11,13 @@ export {
 export { AxiosRequest, type IOtherOptions, type IOptions } from "./request";
 export { getBaseUrl } from "./baseUrl";
 export { Crypto, md5, Base64 } from "./crypto";
+export {
+  initSecurityKeys,
+  refreshSecurityKeys,
+  getApiCrypto,
+  getOssCrypto,
+  type ISecurityKeys,
+} from "./securityKey";
 export {
   delay,
   emitter,

package/src/securityKey.ts

@@ -0,0 +1,151 @@
+/**
+ * 安全密钥管理
+ * 从后端接口获取前端加解密密钥，替代打包时的硬编码密钥，避免密钥随JS泄露
+ */
+import axios from "axios";
+import { getPreToken } from "./auth";
+import { BASIC_KEY, TOKEN_KEY } from "./constants";
+import { Crypto } from "./crypto";
+
+/**
+ * 密钥集合
+ */
+export interface ISecurityKeys {
+  /** 接口请求参数加密用 AES 密钥 */
+  apiAesKey: string;
+  /** 接口请求参数加密用 DES 密钥 */
+  apiDesKey: string;
+  /** 附件(OSS)相关加密用 AES 密钥 */
+  ossAesKey: string;
+  /** 附件(OSS)相关加密用 DES 密钥 */
+  ossDesKey: string;
+}
+
+interface ISecurityKeysOptions {
+  /** 接口请求的前缀地址 必传 */
+  baseURL: string;
+}
+
+// 密钥内存缓存 不挂载到window 避免产生新的明文全局变量
+let securityKeys: ISecurityKeys | null = null;
+// 进行中的密钥请求 并发调用initSecurityKeys/refreshSecurityKeys时共享同一个请求
+let securityKeysPromise: Promise<ISecurityKeys> | null = null;
+
+/**
+ * 初始化安全密钥
+ * 应用启动时(render之前)调用一次 并发调用会共享同一个请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+export function initSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  if (securityKeys) {
+    return Promise.resolve(securityKeys);
+  }
+  if (securityKeysPromise) {
+    return securityKeysPromise;
+  }
+  return requestSecurityKeys(options);
+}
+
+/**
+ * 强制刷新安全密钥
+ * 后端轮换密钥后可调用 会忽略已有缓存重新请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+export function refreshSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  return requestSecurityKeys(options);
+}
+
+/**
+ * 获取接口请求参数加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+export function getApiCrypto(): Crypto | undefined {
+  if (securityKeys?.apiAesKey) {
+    return new Crypto(securityKeys.apiAesKey, securityKeys.apiDesKey);
+  }
+  return createCryptoFromWindow();
+}
+
+/**
+ * 获取附件(OSS)相关加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+export function getOssCrypto(): Crypto | undefined {
+  if (securityKeys?.ossAesKey) {
+    return new Crypto(securityKeys.ossAesKey, securityKeys.ossDesKey);
+  }
+  return createCryptoFromWindow();
+}
+
+/**
+ * 请求密钥并缓存
+ */
+function requestSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  securityKeysPromise = fetchSecurityKeys(options).then(
+    (keys) => {
+      securityKeys = keys;
+      securityKeysPromise = null;
+      return keys;
+    },
+    (err) => {
+      securityKeysPromise = null;
+      throw err;
+    },
+  );
+  return securityKeysPromise;
+}
+
+/**
+ * 请求密钥接口
+ * 使用裸axios请求(不走AxiosRequest) 避免请求本身依赖密钥或触发统一的异常处理
+ */
+async function fetchSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  const apiBaseURL = options.baseURL?.endsWith?.("/")
+    ? options.baseURL.slice(0, options.baseURL.length - 1)
+    : options.baseURL;
+  const headers: { [prop: string]: string } = {};
+  const token = getPreToken();
+  if (token) {
+    headers[TOKEN_KEY] = token;
+  }
+  const response = await axios.get(
+    `${apiBaseURL}/api/${BASIC_KEY}-resource/resource/get-security-key`,
+    { headers, timeout: 60000 },
+  );
+  const { code, data, msg } = response?.data || {};
+  if (code === 200 && data) {
+    return {
+      apiAesKey: data.apiAesKey,
+      apiDesKey: data.apiDesKey,
+      ossAesKey: data.ossAesKey,
+      ossDesKey: data.ossDesKey,
+    };
+  }
+  throw new Error(msg || "获取安全密钥失败");
+}
+
+/**
+ * 从window旧密钥创建Crypto实例 兼容未改造的应用
+ */
+function createCryptoFromWindow(): Crypto | undefined {
+  const aesKey = (window as any).__CRYPTO_AES_KEY__;
+  const desKey = (window as any).__CRYPTO_DES_KEY__;
+  if (aesKey) {
+    return new Crypto(aesKey, desKey);
+  }
+  return undefined;
+}