493 lines
15 KiB
JavaScript
493 lines
15 KiB
JavaScript
'use strict';
|
|
|
|
const crypto = require('crypto');
|
|
const net = require('net');
|
|
const database = require('../config/database');
|
|
|
|
const API_KEY_TABLE = 'external_api_keys';
|
|
const API_KEY_META_TABLE = 'external_api_key_meta';
|
|
const SELECTION_FISSION_SCOPE = 'selection_fission';
|
|
const LEGACY_MIGRATION_KEY = 'selection_fission_env_keys_migrated_v1';
|
|
const MIN_API_KEY_LENGTH = 16;
|
|
const MAX_API_KEY_LENGTH = 500;
|
|
|
|
let schemaReady = false;
|
|
let schemaPromise = null;
|
|
|
|
function normalizeText(value, maxLength = 255) {
|
|
return String(value ?? '').trim().slice(0, maxLength);
|
|
}
|
|
|
|
function getLegacyEnvironmentKeys() {
|
|
return [
|
|
process.env.SELECTION_FISSION_PUBLIC_API_KEY,
|
|
process.env.SELECTION_FISSION_PUBLIC_API_KEYS,
|
|
process.env.EXTERNAL_SELECTION_FISSION_API_KEY,
|
|
process.env.EXTERNAL_SELECTION_FISSION_API_KEYS,
|
|
]
|
|
.filter(Boolean)
|
|
.flatMap((value) => String(value).split(','))
|
|
.map((value) => value.trim())
|
|
.filter(Boolean);
|
|
}
|
|
|
|
function hashApiKey(apiKey) {
|
|
return crypto.createHash('sha256').update(String(apiKey || ''), 'utf8').digest('hex');
|
|
}
|
|
|
|
function generateApiKey() {
|
|
return `sf_live_${crypto.randomBytes(32).toString('base64url')}`;
|
|
}
|
|
|
|
function buildKeyPreview(apiKey) {
|
|
const normalized = normalizeText(apiKey, MAX_API_KEY_LENGTH);
|
|
return {
|
|
keyPrefix: normalized.slice(0, 10),
|
|
keySuffix: normalized.slice(-4),
|
|
};
|
|
}
|
|
|
|
function maskApiKey(keyPrefix, keySuffix) {
|
|
const prefix = normalizeText(keyPrefix, 20);
|
|
const suffix = normalizeText(keySuffix, 8);
|
|
return prefix && suffix ? `${prefix}••••••••${suffix}` : '••••••••••••';
|
|
}
|
|
|
|
function normalizeApiKeyInput(value, { required = false } = {}) {
|
|
const apiKey = normalizeText(value, MAX_API_KEY_LENGTH);
|
|
if (!apiKey && !required) return '';
|
|
if (!apiKey) {
|
|
const error = new Error('API Key 不能为空');
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
if (apiKey.length < MIN_API_KEY_LENGTH) {
|
|
const error = new Error(`API Key 长度不能少于 ${MIN_API_KEY_LENGTH} 位`);
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
return apiKey;
|
|
}
|
|
|
|
function normalizeExpiresAt(value) {
|
|
if (value === undefined) return undefined;
|
|
if (value === null || value === '') return null;
|
|
const date = new Date(value);
|
|
if (Number.isNaN(date.getTime())) {
|
|
const error = new Error('过期时间格式不正确');
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
return date;
|
|
}
|
|
|
|
function getActor(user = {}) {
|
|
return {
|
|
id: normalizeText(user.sub || user.id || user.userId, 120) || null,
|
|
name: normalizeText(user.name || user.username || user.userName || user.email, 120) || null,
|
|
};
|
|
}
|
|
|
|
function normalizeAllowedIps(value) {
|
|
const entries = Array.isArray(value)
|
|
? value
|
|
: String(value || '').split(/[\s,;]+/);
|
|
const normalized = entries
|
|
.map((entry) => normalizeText(entry, 80).replace(/^::ffff:/i, ''))
|
|
.filter(Boolean);
|
|
for (const ip of normalized) {
|
|
if (!net.isIP(ip)) {
|
|
const error = new Error(`IP 白名单包含无效地址：${ip}`);
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
}
|
|
return Array.from(new Set(normalized));
|
|
}
|
|
|
|
function mapApiKeyRow(row = {}) {
|
|
const expiresAt = row.expires_at || null;
|
|
const allowedIps = normalizeAllowedIps(row.allowed_ips || '');
|
|
return {
|
|
id: Number(row.id),
|
|
name: row.name || '',
|
|
serviceScope: row.service_scope || SELECTION_FISSION_SCOPE,
|
|
serviceName: '自动上架与预售对外 API',
|
|
keyMasked: maskApiKey(row.key_prefix, row.key_suffix),
|
|
keyPrefix: row.key_prefix || '',
|
|
status: row.status || 'disabled',
|
|
enabled: row.status === 'active',
|
|
description: row.description || '',
|
|
allowedIps,
|
|
hmacRequired: Number(row.hmac_required || 0) === 1,
|
|
expiresAt,
|
|
expired: Boolean(expiresAt && new Date(expiresAt).getTime() <= Date.now()),
|
|
lastUsedAt: row.last_used_at || null,
|
|
createdBy: row.created_by_name || row.created_by_user_id || '',
|
|
updatedBy: row.updated_by_name || row.updated_by_user_id || '',
|
|
createdAt: row.created_at || null,
|
|
updatedAt: row.updated_at || null,
|
|
};
|
|
}
|
|
|
|
async function migrateLegacyEnvironmentKeys() {
|
|
const markers = await database.local.query(
|
|
`SELECT setting_value
|
|
FROM ${API_KEY_META_TABLE}
|
|
WHERE setting_key = ?
|
|
LIMIT 1`,
|
|
[LEGACY_MIGRATION_KEY]
|
|
);
|
|
if (markers[0]) return;
|
|
|
|
const legacyKeys = Array.from(new Set(getLegacyEnvironmentKeys()));
|
|
for (let index = 0; index < legacyKeys.length; index += 1) {
|
|
const apiKey = normalizeText(legacyKeys[index], MAX_API_KEY_LENGTH);
|
|
if (!apiKey) continue;
|
|
const preview = buildKeyPreview(apiKey);
|
|
await database.local.query(
|
|
`INSERT IGNORE INTO ${API_KEY_TABLE}
|
|
(
|
|
service_scope, name, key_hash, key_prefix, key_suffix, status,
|
|
description, created_by_name, updated_by_name
|
|
)
|
|
VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?)`,
|
|
[
|
|
SELECTION_FISSION_SCOPE,
|
|
legacyKeys.length > 1 ? `原统一 Key ${index + 1}` : '原统一 Key',
|
|
hashApiKey(apiKey),
|
|
preview.keyPrefix,
|
|
preview.keySuffix,
|
|
'由服务器环境变量自动迁移',
|
|
'系统迁移',
|
|
'系统迁移',
|
|
]
|
|
);
|
|
}
|
|
|
|
await database.local.query(
|
|
`INSERT INTO ${API_KEY_META_TABLE} (setting_key, setting_value)
|
|
VALUES (?, ?)
|
|
ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value), updated_at = CURRENT_TIMESTAMP`,
|
|
[LEGACY_MIGRATION_KEY, new Date().toISOString()]
|
|
);
|
|
}
|
|
|
|
async function ensureApiKeySchema() {
|
|
if (schemaReady) return;
|
|
if (schemaPromise) {
|
|
await schemaPromise;
|
|
return;
|
|
}
|
|
|
|
schemaPromise = (async () => {
|
|
await database.local.query(
|
|
`CREATE TABLE IF NOT EXISTS ${API_KEY_TABLE} (
|
|
id BIGINT PRIMARY KEY AUTO_INCREMENT COMMENT '主键',
|
|
service_scope VARCHAR(80) NOT NULL DEFAULT 'selection_fission' COMMENT 'API用途',
|
|
name VARCHAR(120) NOT NULL COMMENT 'Key名称',
|
|
key_hash CHAR(64) NOT NULL COMMENT 'SHA-256摘要',
|
|
key_prefix VARCHAR(20) NOT NULL COMMENT '掩码前缀',
|
|
key_suffix VARCHAR(8) NOT NULL COMMENT '掩码后缀',
|
|
status ENUM('active', 'disabled') NOT NULL DEFAULT 'active' COMMENT '状态',
|
|
description VARCHAR(500) NULL COMMENT '备注',
|
|
expires_at DATETIME NULL COMMENT '过期时间',
|
|
last_used_at DATETIME NULL COMMENT '最近使用时间',
|
|
created_by_user_id VARCHAR(120) NULL COMMENT '创建人ID',
|
|
created_by_name VARCHAR(120) NULL COMMENT '创建人',
|
|
updated_by_user_id VARCHAR(120) NULL COMMENT '更新人ID',
|
|
updated_by_name VARCHAR(120) NULL COMMENT '更新人',
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
|
|
updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间',
|
|
UNIQUE KEY uk_external_api_key_hash (key_hash),
|
|
KEY idx_external_api_key_scope_status (service_scope, status),
|
|
KEY idx_external_api_key_updated (updated_at)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='第三方 API Key'`
|
|
);
|
|
const apiKeyColumns = await database.local.query(`SHOW COLUMNS FROM ${API_KEY_TABLE}`);
|
|
const existingColumns = new Set(apiKeyColumns.map((column) => column.Field));
|
|
if (!existingColumns.has('allowed_ips')) {
|
|
await database.local.query(
|
|
`ALTER TABLE ${API_KEY_TABLE}
|
|
ADD COLUMN allowed_ips VARCHAR(2000) NULL COMMENT '允许访问的IP白名单' AFTER description`
|
|
);
|
|
}
|
|
if (!existingColumns.has('hmac_required')) {
|
|
await database.local.query(
|
|
`ALTER TABLE ${API_KEY_TABLE}
|
|
ADD COLUMN hmac_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT '是否强制HMAC签名' AFTER allowed_ips`
|
|
);
|
|
}
|
|
|
|
await database.local.query(
|
|
`CREATE TABLE IF NOT EXISTS ${API_KEY_META_TABLE} (
|
|
setting_key VARCHAR(120) PRIMARY KEY COMMENT '配置键',
|
|
setting_value VARCHAR(500) NULL COMMENT '配置值',
|
|
updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT '更新时间'
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='第三方 API Key 元数据'`
|
|
);
|
|
|
|
await migrateLegacyEnvironmentKeys();
|
|
schemaReady = true;
|
|
})();
|
|
|
|
try {
|
|
await schemaPromise;
|
|
} finally {
|
|
schemaPromise = null;
|
|
}
|
|
}
|
|
|
|
async function getApiKeyById(id) {
|
|
const normalizedId = Number.parseInt(id, 10);
|
|
if (!Number.isFinite(normalizedId) || normalizedId <= 0) {
|
|
const error = new Error('API Key ID 不正确');
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
const rows = await database.local.query(
|
|
`SELECT *
|
|
FROM ${API_KEY_TABLE}
|
|
WHERE id = ? AND service_scope = ?
|
|
LIMIT 1`,
|
|
[normalizedId, SELECTION_FISSION_SCOPE]
|
|
);
|
|
if (!rows[0]) {
|
|
const error = new Error('API Key 不存在');
|
|
error.status = 404;
|
|
throw error;
|
|
}
|
|
return rows[0];
|
|
}
|
|
|
|
async function listSelectionFissionApiKeys() {
|
|
await ensureApiKeySchema();
|
|
const rows = await database.local.query(
|
|
`SELECT *
|
|
FROM ${API_KEY_TABLE}
|
|
WHERE service_scope = ?
|
|
ORDER BY status = 'active' DESC, updated_at DESC, id DESC`,
|
|
[SELECTION_FISSION_SCOPE]
|
|
);
|
|
return rows.map(mapApiKeyRow);
|
|
}
|
|
|
|
async function createSelectionFissionApiKey(input = {}, user = {}) {
|
|
await ensureApiKeySchema();
|
|
const name = normalizeText(input.name, 120);
|
|
if (!name) {
|
|
const error = new Error('请输入 API Key 名称');
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
|
|
const plainApiKey = input.apiKey
|
|
? normalizeApiKeyInput(input.apiKey, { required: true })
|
|
: generateApiKey();
|
|
const preview = buildKeyPreview(plainApiKey);
|
|
const actor = getActor(user);
|
|
const status = input.enabled === false || input.status === 'disabled' ? 'disabled' : 'active';
|
|
const expiresAt = normalizeExpiresAt(input.expiresAt);
|
|
|
|
try {
|
|
const result = await database.local.insert(
|
|
`INSERT INTO ${API_KEY_TABLE}
|
|
(
|
|
service_scope, name, key_hash, key_prefix, key_suffix, status,
|
|
description, allowed_ips, hmac_required, expires_at, created_by_user_id, created_by_name,
|
|
updated_by_user_id, updated_by_name
|
|
)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
|
[
|
|
SELECTION_FISSION_SCOPE,
|
|
name,
|
|
hashApiKey(plainApiKey),
|
|
preview.keyPrefix,
|
|
preview.keySuffix,
|
|
status,
|
|
normalizeText(input.description, 500) || null,
|
|
normalizeAllowedIps(input.allowedIps || input.allowed_ips).join(',') || null,
|
|
input.hmacRequired === true || input.hmac_required === true ? 1 : 0,
|
|
expiresAt ?? null,
|
|
actor.id,
|
|
actor.name,
|
|
actor.id,
|
|
actor.name,
|
|
]
|
|
);
|
|
const row = await getApiKeyById(result.insertId);
|
|
return {
|
|
...mapApiKeyRow(row),
|
|
plainApiKey,
|
|
};
|
|
} catch (error) {
|
|
if (error?.code === 'ER_DUP_ENTRY') {
|
|
const conflict = new Error('该 API Key 已存在');
|
|
conflict.status = 409;
|
|
throw conflict;
|
|
}
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
async function updateSelectionFissionApiKey(id, input = {}, user = {}) {
|
|
await ensureApiKeySchema();
|
|
const existing = await getApiKeyById(id);
|
|
const actor = getActor(user);
|
|
const updates = [];
|
|
const params = [];
|
|
let plainApiKey = null;
|
|
|
|
if (Object.prototype.hasOwnProperty.call(input, 'name')) {
|
|
const name = normalizeText(input.name, 120);
|
|
if (!name) {
|
|
const error = new Error('请输入 API Key 名称');
|
|
error.status = 400;
|
|
throw error;
|
|
}
|
|
updates.push('name = ?');
|
|
params.push(name);
|
|
}
|
|
|
|
if (Object.prototype.hasOwnProperty.call(input, 'description')) {
|
|
updates.push('description = ?');
|
|
params.push(normalizeText(input.description, 500) || null);
|
|
}
|
|
|
|
if (
|
|
Object.prototype.hasOwnProperty.call(input, 'allowedIps')
|
|
|| Object.prototype.hasOwnProperty.call(input, 'allowed_ips')
|
|
) {
|
|
updates.push('allowed_ips = ?');
|
|
params.push(normalizeAllowedIps(input.allowedIps || input.allowed_ips).join(',') || null);
|
|
}
|
|
|
|
if (
|
|
Object.prototype.hasOwnProperty.call(input, 'hmacRequired')
|
|
|| Object.prototype.hasOwnProperty.call(input, 'hmac_required')
|
|
) {
|
|
updates.push('hmac_required = ?');
|
|
params.push(input.hmacRequired === true || input.hmac_required === true ? 1 : 0);
|
|
}
|
|
|
|
if (
|
|
Object.prototype.hasOwnProperty.call(input, 'enabled')
|
|
|| Object.prototype.hasOwnProperty.call(input, 'status')
|
|
) {
|
|
const status = input.enabled === false || input.status === 'disabled' ? 'disabled' : 'active';
|
|
updates.push('status = ?');
|
|
params.push(status);
|
|
}
|
|
|
|
if (Object.prototype.hasOwnProperty.call(input, 'expiresAt')) {
|
|
updates.push('expires_at = ?');
|
|
params.push(normalizeExpiresAt(input.expiresAt) ?? null);
|
|
}
|
|
|
|
if (normalizeText(input.apiKey, MAX_API_KEY_LENGTH)) {
|
|
plainApiKey = normalizeApiKeyInput(input.apiKey, { required: true });
|
|
const preview = buildKeyPreview(plainApiKey);
|
|
updates.push('key_hash = ?', 'key_prefix = ?', 'key_suffix = ?');
|
|
params.push(hashApiKey(plainApiKey), preview.keyPrefix, preview.keySuffix);
|
|
}
|
|
|
|
updates.push('updated_by_user_id = ?', 'updated_by_name = ?');
|
|
params.push(actor.id, actor.name);
|
|
|
|
try {
|
|
await database.local.query(
|
|
`UPDATE ${API_KEY_TABLE}
|
|
SET ${updates.join(', ')}
|
|
WHERE id = ? AND service_scope = ?`,
|
|
[...params, existing.id, SELECTION_FISSION_SCOPE]
|
|
);
|
|
} catch (error) {
|
|
if (error?.code === 'ER_DUP_ENTRY') {
|
|
const conflict = new Error('该 API Key 已存在');
|
|
conflict.status = 409;
|
|
throw conflict;
|
|
}
|
|
throw error;
|
|
}
|
|
|
|
const row = await getApiKeyById(existing.id);
|
|
return {
|
|
...mapApiKeyRow(row),
|
|
plainApiKey,
|
|
};
|
|
}
|
|
|
|
async function deleteSelectionFissionApiKey(id) {
|
|
await ensureApiKeySchema();
|
|
const existing = await getApiKeyById(id);
|
|
await database.local.query(
|
|
`DELETE FROM ${API_KEY_TABLE}
|
|
WHERE id = ? AND service_scope = ?`,
|
|
[existing.id, SELECTION_FISSION_SCOPE]
|
|
);
|
|
return mapApiKeyRow(existing);
|
|
}
|
|
|
|
async function authenticateSelectionFissionApiKey(apiKey) {
|
|
await ensureApiKeySchema();
|
|
const activeCountRows = await database.local.query(
|
|
`SELECT COUNT(*) AS total
|
|
FROM ${API_KEY_TABLE}
|
|
WHERE service_scope = ?
|
|
AND status = 'active'
|
|
AND (expires_at IS NULL OR expires_at > CURRENT_TIMESTAMP)`,
|
|
[SELECTION_FISSION_SCOPE]
|
|
);
|
|
const configured = Number(activeCountRows[0]?.total || 0) > 0;
|
|
const normalizedApiKey = normalizeText(apiKey, MAX_API_KEY_LENGTH);
|
|
if (!normalizedApiKey) {
|
|
return { configured, valid: false };
|
|
}
|
|
|
|
const rows = await database.local.query(
|
|
`SELECT id, name, allowed_ips, hmac_required
|
|
FROM ${API_KEY_TABLE}
|
|
WHERE service_scope = ?
|
|
AND key_hash = ?
|
|
AND status = 'active'
|
|
AND (expires_at IS NULL OR expires_at > CURRENT_TIMESTAMP)
|
|
LIMIT 1`,
|
|
[SELECTION_FISSION_SCOPE, hashApiKey(normalizedApiKey)]
|
|
);
|
|
if (!rows[0]) {
|
|
return { configured, valid: false };
|
|
}
|
|
|
|
await database.local.query(
|
|
`UPDATE ${API_KEY_TABLE}
|
|
SET last_used_at = CURRENT_TIMESTAMP
|
|
WHERE id = ?`,
|
|
[rows[0].id]
|
|
);
|
|
return {
|
|
configured: true,
|
|
valid: true,
|
|
keyId: Number(rows[0].id),
|
|
keyName: rows[0].name || '',
|
|
allowedIps: normalizeAllowedIps(rows[0].allowed_ips || ''),
|
|
hmacRequired: Number(rows[0].hmac_required || 0) === 1,
|
|
};
|
|
}
|
|
|
|
module.exports = {
|
|
authenticateSelectionFissionApiKey,
|
|
createSelectionFissionApiKey,
|
|
deleteSelectionFissionApiKey,
|
|
ensureApiKeySchema,
|
|
listSelectionFissionApiKeys,
|
|
updateSelectionFissionApiKey,
|
|
_test: {
|
|
buildKeyPreview,
|
|
generateApiKey,
|
|
hashApiKey,
|
|
maskApiKey,
|
|
normalizeApiKeyInput,
|
|
normalizeAllowedIps,
|
|
},
|
|
};
|