flnxi-Wu/license-server/app/api/license/[projectCode]/verify/route.ts

import { NextRequest, NextResponse } from 'next/server';
import { signLicense } from '@/lib/crypto';
import { getPublicProjectDb } from '@/lib/project-auth';
import { verifyLicenseRequestSignature } from '@/lib/request-signature';
import { type HardwareFingerprint } from '@/lib/types';
import { buildLicenseSigningPayload } from '@/lib/license-payload';
import {
  calculateFingerprintMatchScore,
  createPendingAlertOnce,
  enforceDeviceAbusePolicy,
} from '@/lib/abuse-detection';
import { z } from 'zod';

const verifySchema = z.object({
  instanceId: z.string(),
  fingerprint: z.object({
    machineId: z.string(),
    hostname: z.string(),
    macAddress: z.string(),
    cpuId: z.string().optional(),
    instanceId: z.string(),
  }),
  timestamp: z.number(),
});

export async function POST(
  request: NextRequest,
  { params }: { params: Promise<{ projectCode: string }> }
) {
  try {
    const { projectCode } = await params;
    const projectDbResult = await getPublicProjectDb(projectCode);

    if (!projectDbResult.success) {
      return projectDbResult.response;
    }

    const body = await request.json();
    const signatureResult = verifyLicenseRequestSignature('verify', projectCode, body);
    if (!signatureResult.valid) {
      return NextResponse.json(
        { valid: false, error: '请求签名无效' },
        { status: signatureResult.response.status }
      );
    }

    const parsed = verifySchema.safeParse(body);

    if (!parsed.success) {
      return NextResponse.json(
        { valid: false, error: '请求参数无效' },
        { status: 400 }
      );
    }

    const { instanceId, fingerprint, timestamp } = parsed.data;
    const now = Date.now();

    if (Math.abs(now - timestamp) > 5 * 60 * 1000) {
      return NextResponse.json(
        { valid: false, error: '请求已过期' },
        { status: 400 }
      );
    }

    const activation = await projectDbResult.prisma.activation.findFirst({
      where: {
        instanceId,
        isActive: true,
      },
      include: {
        license: true,
      },
    });

    if (!activation) {
      return NextResponse.json(
        { valid: false, error: '未找到激活记录' },
        { status: 404 }
      );
    }

    const { license } = activation;

    if (license.status === 'disabled') {
      return NextResponse.json(
        { valid: false, error: '许可证已被禁用' },
        { status: 403 }
      );
    }

    if (license.status === 'expired' || (license.expiresAt && license.expiresAt < new Date())) {
      return NextResponse.json(
        { valid: false, error: '许可证已过期' },
        { status: 403 }
      );
    }

    const storedFingerprint = activation.fingerprint as unknown as HardwareFingerprint;
    const isFreeLicense = license.licenseType === 'FREE';
    const strictThreshold = isFreeLicense ? 90 : 70;
    const normalThreshold = isFreeLicense ? 70 : 50;
    const isInstanceIdMatch = storedFingerprint.instanceId === fingerprint.instanceId;
    const isMachineIdMatch = storedFingerprint.machineId === fingerprint.machineId;

    if (isInstanceIdMatch && !isMachineIdMatch) {
      const matchScore = calculateFingerprintMatchScore(storedFingerprint, fingerprint);
      if (matchScore < strictThreshold) {
        await createPendingAlertOnce(projectDbResult.prisma, license.id, 'fingerprint_mismatch', {
          instanceId,
          matchScore,
          threshold: strictThreshold,
          licenseType: license.licenseType,
        });

        return NextResponse.json(
          { valid: false, error: '硬件指纹不匹配，请重新激活' },
          { status: 403 }
        );
      }
    } else if (!isInstanceIdMatch) {
      const matchScore = calculateFingerprintMatchScore(storedFingerprint, fingerprint);
      if (matchScore < normalThreshold) {
        await createPendingAlertOnce(projectDbResult.prisma, license.id, 'fingerprint_mismatch', {
          instanceId,
          matchScore,
          threshold: normalThreshold,
          licenseType: license.licenseType,
        });

        return NextResponse.json(
          { valid: false, error: '硬件指纹不匹配，请重新激活' },
          { status: 403 }
        );
      }
    }

    const abusePolicy = await enforceDeviceAbusePolicy(projectDbResult.prisma, {
      licenseId: license.id,
      licenseType: license.licenseType,
      instanceId,
      fingerprint,
    });

    if (!abusePolicy.allowed) {
      return NextResponse.json(
        { valid: false, error: abusePolicy.error },
        { status: abusePolicy.status }
      );
    }

    await projectDbResult.prisma.activation.update({
      where: { id: activation.id },
      data: {
        fingerprint: fingerprint as object,
        lastHeartbeat: new Date(),
      },
    });

    const signedLicense = signLicense(buildLicenseSigningPayload({
      projectCode,
      licenseKey: license.licenseKey,
      licenseType: license.licenseType,
      expiresAt: license.expiresAt,
      fingerprint,
      activationId: activation.id,
    }));

    return NextResponse.json({
      valid: true,
      license: signedLicense,
    });
  } catch (error) {
    console.error('项目验证失败:', error);
    return NextResponse.json(
      { valid: false, error: '服务器内部错误' },
      { status: 500 }
    );
  }
}