583 lines
30 KiB
JavaScript
583 lines
30 KiB
JavaScript
// Footprints 自建同步 + Web 服务（零依赖：node:http + node:sqlite）
|
||
import http from 'node:http';
|
||
import fs from 'node:fs';
|
||
import zlib from 'node:zlib';
|
||
|
||
// 图床网关：Lsky Pro（已对接 COS），附件直传对象存储，应用服务器不做搬运工
|
||
const LSKY_API = (process.env.LSKY_API || '').trim().replace(/\/$/, '');
|
||
const LSKY_TOKEN = (process.env.LSKY_TOKEN || '').trim().replace(/^Bearer\s+/i, '');
|
||
const LSKY_STRATEGY_ID = process.env.LSKY_STRATEGY_ID || ''; // 存储策略（如 2=COS），不填用默认策略
|
||
function sanitizeImageUrl(u) {
|
||
// 裸 IP:port 的 http 地址在 HTTPS 站点会被拦截；域名地址统一切 https
|
||
if (!u) return u;
|
||
return /^http:\/\/\d+\./.test(u) ? u : u.replace(/^http:\/\//, 'https://');
|
||
}
|
||
async function lskyUpload(buf, fileName, mime) {
|
||
const fd = new FormData();
|
||
fd.append('file', new Blob([buf], { type: mime || 'application/octet-stream' }), fileName);
|
||
if (LSKY_STRATEGY_ID) fd.append('strategy_id', LSKY_STRATEGY_ID);
|
||
const r = await fetch(LSKY_API + '/upload', {
|
||
method: 'POST',
|
||
headers: { authorization: 'Bearer ' + LSKY_TOKEN, accept: 'application/json' },
|
||
body: fd,
|
||
signal: AbortSignal.timeout(60_000),
|
||
});
|
||
const j = await r.json().catch(() => null);
|
||
const url = sanitizeImageUrl(j?.data?.links?.url || j?.data?.url);
|
||
if (!j || j.status !== true || !url) throw new Error('LSKY ' + r.status + ': ' + (j?.message || 'no url'));
|
||
return { url, thumb_url: sanitizeImageUrl(j?.data?.thumbnail_url) || undefined, key: j.data.key };
|
||
}
|
||
|
||
async function deleteUserCascade(db, target) {
|
||
// 图床远端：附件 remote keys + 用户资产（头像等）
|
||
let remote = 0;
|
||
if (LSKY_API && LSKY_TOKEN) {
|
||
try {
|
||
const atts = commandsFor(target.id).getDb().prepare('SELECT remote_key, remote_thumb_key FROM attachment WHERE deleted_at IS NULL').all();
|
||
for (const a of atts) {
|
||
for (const k of [a.remote_key, a.remote_thumb_key]) {
|
||
if (k) { try { await lskyDelete(k); remote++; } catch {} }
|
||
}
|
||
}
|
||
} catch {}
|
||
try {
|
||
const assets = db.prepare('SELECT key FROM user_assets WHERE user_id=?').all(target.id);
|
||
for (const a of assets) { try { await lskyDelete(a.key); remote++; } catch {} }
|
||
} catch {}
|
||
}
|
||
try { db.prepare('DELETE FROM user_assets WHERE user_id=?').run(target.id); } catch {}
|
||
try { commandsFor(target.id).close(); } catch {}
|
||
userCommands.delete(target.id);
|
||
if (demoUserId === target.id) demoUserId = undefined;
|
||
for (const f of [target.id + '.db', target.id + '.db-wal', target.id + '.db-shm']) {
|
||
try { fs.rmSync(path.join(USERS_DIR, f), { force: true }); } catch {}
|
||
}
|
||
try { fs.rmSync(path.join(USERS_DIR, String(target.id)), { recursive: true, force: true }); } catch {}
|
||
db.exec('BEGIN');
|
||
try {
|
||
db.prepare('DELETE FROM tokens WHERE user_id=?').run(target.id);
|
||
db.prepare('DELETE FROM current WHERE user_id=?').run(target.id);
|
||
db.prepare('DELETE FROM attachments WHERE user_id=?').run(target.id);
|
||
db.prepare('DELETE FROM devices WHERE user_id=?').run(target.id);
|
||
db.prepare('DELETE FROM users WHERE id=?').run(target.id);
|
||
db.exec('COMMIT');
|
||
} catch (e) { db.exec('ROLLBACK'); throw e; }
|
||
return remote;
|
||
}
|
||
async function lskyDelete(key) {
|
||
const r = await fetch(LSKY_API + '/images/' + encodeURIComponent(key), {
|
||
method: 'DELETE', headers: { authorization: 'Bearer ' + LSKY_TOKEN, accept: 'application/json' },
|
||
signal: AbortSignal.timeout(30_000),
|
||
});
|
||
const j = await r.json().catch(() => null);
|
||
if (!j || j.status !== true) throw new Error('LSKY delete ' + r.status + ': ' + (j?.message || ''));
|
||
return true;
|
||
}
|
||
|
||
// 历史 URL 反查 key：按 pathname 在图床相册里匹配（最多翻 5 页）
|
||
async function lskyFindKeyByUrl(url) {
|
||
try {
|
||
const pathname = new URL(url).pathname.replace(/^\/i\//, '');
|
||
for (let page = 1; page <= 5; page++) {
|
||
const r = await fetch(LSKY_API + '/images?per_page=100&page=' + page, {
|
||
headers: { authorization: 'Bearer ' + LSKY_TOKEN, accept: 'application/json' },
|
||
signal: AbortSignal.timeout(30_000),
|
||
});
|
||
const j = await r.json().catch(() => null);
|
||
const items = j?.data?.data || [];
|
||
const hit = items.find(x => x.pathname === pathname);
|
||
if (hit) return hit.key;
|
||
if (page >= (j?.data?.last_page || 1)) break;
|
||
}
|
||
} catch (e) { console.log('[lsky] 反查 key 失败:', e.message); }
|
||
return null;
|
||
}
|
||
|
||
// 删除联动：记录/附件删除后清理图床（后台异步）
|
||
function lskyCleanupRemote(items) {
|
||
if (!LSKY_API || !LSKY_TOKEN) return;
|
||
(async () => {
|
||
for (const it of items) {
|
||
try {
|
||
let k = it.remote_key;
|
||
if (!k && it.remote_url) k = await lskyFindKeyByUrl(it.remote_url);
|
||
if (k) await lskyDelete(k);
|
||
let tk = it.remote_thumb_key;
|
||
if (!tk && it.remote_thumb) tk = await lskyFindKeyByUrl(it.remote_thumb);
|
||
if (tk) await lskyDelete(tk);
|
||
if (k || tk) console.log('[lsky] 图床已清理:', it.file_name || it.id);
|
||
} catch (e) { console.log('[lsky] 图床清理失败:', it.file_name || it.id, e.message); }
|
||
}
|
||
})();
|
||
}
|
||
import path from 'node:path';
|
||
import { fileURLToPath } from 'node:url';
|
||
import { getDb } from './db.mjs';
|
||
import { createAppCommands } from './app-commands.mjs';
|
||
import { register, login, authUser, isUserAdmin } from './auth.mjs';
|
||
import crypto from 'node:crypto';
|
||
import { push, pull } from './sync.mjs';
|
||
import { upload, download } from './attachments.mjs';
|
||
|
||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||
const PORT = Number(process.env.PORT || 8788);
|
||
const WWW_DIR = process.env.WWW_DIR || path.join(__dirname, '..', 'www');
|
||
const USERS_DIR = path.join(process.env.DATA_DIR || path.join(__dirname, '..', 'data'), 'users');
|
||
const REGISTER_ENABLED = (process.env.REGISTER_ENABLED ?? 'true') === 'true';
|
||
const MAX_BODY = 160 * 1024 * 1024; // 160MB
|
||
|
||
const MIME = {
|
||
'.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8',
|
||
'.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml', '.png': 'image/png',
|
||
'.ico': 'image/x-icon', '.json': 'application/json', '.webp': 'image/webp',
|
||
'.webmanifest': 'application/manifest+json', '.woff2': 'font/woff2', '.txt': 'text/plain; charset=utf-8'
|
||
};
|
||
|
||
// 按用户惰性创建命令集（每个用户一个独立 SQLite 档案库）
|
||
const userCommands = new Map();
|
||
const gzipCache = new Map(); // 指纹资产 gzip 预压缩缓存
|
||
let demoUserId;
|
||
function commandsFor(userId) {
|
||
let c = userCommands.get(userId);
|
||
if (!c) {
|
||
fs.mkdirSync(USERS_DIR, { recursive: true });
|
||
c = createAppCommands(path.join(USERS_DIR, userId + '.db'));
|
||
userCommands.set(userId, c);
|
||
// demo 用户：档案库首次打开时播种演示数据（demo_seed 幂等，失败不影响请求）
|
||
try {
|
||
if (demoUserId === undefined) {
|
||
demoUserId = getDb().prepare('SELECT id FROM users WHERE username=?').get('demo')?.id ?? null;
|
||
}
|
||
if (userId === demoUserId) {
|
||
const r = c.handleCommand('demo_seed', {});
|
||
console.log('[footprints-sync] demo 演示数据:', JSON.stringify(r));
|
||
}
|
||
} catch (e) { console.log('[footprints-sync] demo 数据播种跳过:', e.message); }
|
||
}
|
||
return c;
|
||
}
|
||
|
||
const server = http.createServer(async (req, res) => {
|
||
const url = new URL(req.url, 'http://localhost');
|
||
const route = url.pathname;
|
||
const send = (code, ok, data) => {
|
||
let body = Buffer.from(JSON.stringify(ok ? { ok: true, data } : { ok: false, error: data }));
|
||
const headers = { 'Content-Type': 'application/json; charset=utf-8' };
|
||
// API JSON gzip：附件 base64 / 列表大负载体积降 70%+
|
||
if (body.length >= 1024 && /\bgzip\b/.test(String(req.headers['accept-encoding'] || ''))) {
|
||
body = zlib.gzipSync(body, { level: 6 });
|
||
headers['Content-Encoding'] = 'gzip';
|
||
headers.Vary = 'Accept-Encoding';
|
||
}
|
||
res.writeHead(code, headers);
|
||
res.end(body);
|
||
};
|
||
|
||
res.setHeader('Access-Control-Allow-Origin', '*');
|
||
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
|
||
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
|
||
if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
|
||
|
||
try {
|
||
if (req.method === 'GET' && route === '/health') {
|
||
getDb();
|
||
return send(200, true, { status: 'ok', service: 'footprints-sync', time: new Date().toISOString() });
|
||
}
|
||
|
||
// ---- 认证 ----
|
||
if (req.method === 'POST' && (route === '/auth/register' || route === '/auth/login')) {
|
||
const body = await readJson(req);
|
||
if (route === '/auth/register') {
|
||
if (!REGISTER_ENABLED) return send(403, false, '注册已关闭');
|
||
return send(200, true, register(body));
|
||
}
|
||
return send(200, true, login(body));
|
||
}
|
||
|
||
// ---- 管理（仅 is_admin 登录会话） ----
|
||
if (route === '/admin/users' || route === '/admin/users/delete' || route === '/admin/demo-rebuild' || route === '/admin/invites' || route === '/admin/demo-seed' || route === '/admin/attachments/sync-lsky' || route.startsWith('/admin/invites/')) {
|
||
let auth;
|
||
try { auth = authUser(req); }
|
||
catch (e) { return send(e.code || 401, false, e.message); }
|
||
if (!isUserAdmin(auth.user_id)) return send(403, false, '需要管理员账号');
|
||
|
||
const db = getDb();
|
||
if (req.method === 'GET' && route === '/admin/users') {
|
||
const users = db.prepare(`
|
||
SELECT u.id, u.username, u.is_admin, u.created_at,
|
||
(SELECT COUNT(*) FROM devices dv WHERE dv.user_id = u.id) AS devices,
|
||
(SELECT COUNT(*) FROM current c WHERE c.user_id = u.id AND c.op = 'upsert') AS records,
|
||
(SELECT COUNT(*) FROM attachments a WHERE a.user_id = u.id) AS attachments,
|
||
(SELECT COALESCE(SUM(size), 0) FROM attachments a WHERE a.user_id = u.id) AS attachment_bytes
|
||
FROM users u ORDER BY u.created_at`).all()
|
||
.map(u => ({ ...u, is_admin: !!u.is_admin }));
|
||
return send(200, true, { total: users.length, users });
|
||
}
|
||
// 用户删除：高危操作，级联清理（图床文件 → 用户库 → 附件目录 → 认证数据）
|
||
if (req.method === 'POST' && route === '/admin/users/delete') {
|
||
const body = await readJson(req);
|
||
const uid = String(body.user_id ?? '').trim();
|
||
const target = db.prepare('SELECT id, username, is_admin FROM users WHERE id=?').get(uid);
|
||
if (!target) return send(404, false, '用户不存在');
|
||
if (target.id === auth.user_id) return send(400, false, '不能删除当前登录的账号自己');
|
||
if (target.is_admin && db.prepare('SELECT COUNT(*) AS c FROM users WHERE is_admin=1').get().c <= 1) {
|
||
return send(400, false, '不能删除最后一位管理员');
|
||
}
|
||
const remote = await deleteUserCascade(db, target);
|
||
console.log('[footprints-sync] 用户已删除:', target.username, '（图床文件 ' + remote + ' 个）');
|
||
return send(200, true, { ok: true, username: target.username, remote_deleted: remote });
|
||
}
|
||
|
||
// 重建演示账号：级联删除现有 demo → 重新注册 → 重新播种
|
||
if (req.method === 'POST' && route === '/admin/demo-rebuild') {
|
||
const existing = db.prepare('SELECT id, username FROM users WHERE username=?').get('demo');
|
||
if (existing && existing.id !== auth.user_id) await deleteUserCascade(db, existing);
|
||
const { register } = await import('./auth.mjs');
|
||
const uid = register({ username: 'demo', password: 'demo1234', device_name: 'seed-demo', seed: true }).user_id;
|
||
db.prepare('UPDATE users SET is_admin=0 WHERE username=?').run('demo');
|
||
const seeded = commandsFor(uid).handleCommand('demo_seed', {});
|
||
console.log('[footprints-sync] demo 账号已重建:', JSON.stringify(seeded));
|
||
return send(200, true, { ok: true, seeded });
|
||
}
|
||
|
||
if (req.method === 'GET' && route === '/admin/invites') {
|
||
const invites = db.prepare(`
|
||
SELECT i.id, i.code, i.remark, i.created_at, i.used_by, i.used_at, i.valid,
|
||
u.username AS used_by_name, cu.username AS created_by_name
|
||
FROM invite_codes i
|
||
LEFT JOIN users u ON u.id = i.used_by
|
||
LEFT JOIN users cu ON cu.id = i.created_by
|
||
ORDER BY i.id DESC`).all()
|
||
.map(i => ({ ...i, valid: !!i.valid }));
|
||
return send(200, true, { total: invites.length, invites });
|
||
}
|
||
if (req.method === 'POST' && route === '/admin/invites/generate') {
|
||
const body = await readJson(req);
|
||
const count = Math.min(50, Math.max(1, Number(body.count) || 1));
|
||
const codes = [];
|
||
const ins = db.prepare('INSERT INTO invite_codes (code, created_by) VALUES (?,?)');
|
||
for (let i = 0; i < count; i++) {
|
||
const code = 'FP-' + crypto.randomBytes(5).toString('hex').toUpperCase();
|
||
ins.run(code, auth.user_id);
|
||
codes.push(code);
|
||
}
|
||
return send(200, true, { codes });
|
||
}
|
||
if (req.method === 'POST' && route === '/admin/invites/revoke') {
|
||
const body = await readJson(req);
|
||
const r = db.prepare('UPDATE invite_codes SET valid=0 WHERE id=?').run(Number(body.id));
|
||
return send(200, true, { revoked: r });
|
||
}
|
||
if (req.method === 'POST' && route === '/admin/invites/create') {
|
||
const body = await readJson(req);
|
||
const code = String(body.code || '').trim().toUpperCase();
|
||
if (!/^[A-Z0-9_-]{4,32}$/.test(code)) return send(400, false, '邀请码需为 4-32 位字母、数字、- 或 _');
|
||
const remark = String(body.remark || '').trim().slice(0, 64) || null;
|
||
try {
|
||
db.prepare('INSERT INTO invite_codes (code, remark, created_by) VALUES (?,?,?)').run(code, remark, auth.user_id);
|
||
} catch (e) {
|
||
return send(400, false, String(e.message).includes('UNIQUE') ? ('邀请码已存在：' + code) : (e.message || String(e)));
|
||
}
|
||
return send(200, true, { code });
|
||
}
|
||
if (req.method === 'POST' && route === '/admin/invites/update') {
|
||
const body = await readJson(req);
|
||
const row = db.prepare('SELECT id, used_by FROM invite_codes WHERE id=?').get(Number(body.id));
|
||
if (!row) return send(404, false, '邀请码不存在');
|
||
const sets = []; const args = [];
|
||
if (typeof body.remark === 'string') { sets.push('remark=?'); args.push(body.remark.trim().slice(0, 64) || null); }
|
||
if (typeof body.valid === 'boolean') {
|
||
if (body.valid && row.used_by) return send(400, false, '已使用的邀请码不可启用');
|
||
sets.push('valid=?'); args.push(body.valid ? 1 : 0);
|
||
}
|
||
if (!sets.length) return send(400, false, '没有需要更新的字段');
|
||
args.push(row.id);
|
||
db.prepare('UPDATE invite_codes SET ' + sets.join(', ') + ' WHERE id=?').run(...args);
|
||
return send(200, true, { id: row.id });
|
||
}
|
||
if (req.method === 'POST' && route === '/admin/invites/delete') {
|
||
const body = await readJson(req);
|
||
const r = db.prepare('DELETE FROM invite_codes WHERE id=?').run(Number(body.id));
|
||
if (!r.changes) return send(404, false, '邀请码不存在');
|
||
return send(200, true, { deleted: r.changes });
|
||
}
|
||
if (req.method === 'POST' && route === '/admin/attachments/sync-lsky') {
|
||
// 存量迁移：本用户所有未上图的附件推送到 Lsky（逐个，失败跳过）
|
||
if (!LSKY_API || !LSKY_TOKEN) return send(400, false, '未配置 LSKY_API/LSKY_TOKEN');
|
||
const cmds = commandsFor(auth.user_id);
|
||
const rows = cmds.getDb().prepare("SELECT id, file_name, mime FROM attachment WHERE owner_type='footprint' AND deleted_at IS NULL AND (remote_url IS NULL OR remote_url='')").all();
|
||
let done = 0, failed = 0;
|
||
for (const row of rows) {
|
||
try {
|
||
const orig = cmds.handleCommand('attachment_read', { id: row.id });
|
||
const up = await lskyUpload(Buffer.from(orig.data_b64, 'base64'), row.file_name, row.mime);
|
||
let thumbUrl = null;
|
||
if (row.mime?.startsWith('image/')) {
|
||
const td = cmds.handleCommand('attachment_thumb', { id: row.id });
|
||
const tUp = await lskyUpload(Buffer.from(td.data_b64, 'base64'), 'thumb-' + row.file_name + '.webp', td.mime || 'image/webp');
|
||
thumbUrl = tUp.thumb_url || tUp.url;
|
||
}
|
||
cmds.handleCommand('attachment_set_remote', { id: row.id, remote_url: up.url, remote_thumb: thumbUrl, remote_key: up.key, remote_thumb_key: thumbKey });
|
||
done++;
|
||
} catch (e) { failed++; console.log('[lsky-migrate]', row.id, e.message); }
|
||
}
|
||
return send(200, true, { total: rows.length, done, failed });
|
||
}
|
||
|
||
if (req.method === 'POST' && route === '/admin/demo-seed') {
|
||
const demoRow = db.prepare('SELECT id FROM users WHERE username=?').get('demo');
|
||
if (!demoRow) return send(404, false, 'demo 账号不存在');
|
||
try {
|
||
const r = commandsFor(demoRow.id).handleCommand('demo_seed', {});
|
||
return send(200, true, r);
|
||
} catch (e) {
|
||
return send(500, false, 'demo_seed 失败: ' + (e.message || String(e)));
|
||
}
|
||
}
|
||
return send(404, false, 'not found');
|
||
}
|
||
|
||
// ---- 同步与 Web API（鉴权区） ----
|
||
if (route.startsWith('/sync/') || route.startsWith('/api/') || route.startsWith('/auth/')) {
|
||
let auth;
|
||
try { auth = authUser(req); }
|
||
catch (e) { return send(e.code || 401, false, e.message); }
|
||
|
||
if (req.method === 'GET' && route === '/auth/me') {
|
||
const row = getDb().prepare('SELECT id, username, is_admin FROM users WHERE id=?').get(auth.user_id);
|
||
return send(200, true, { user_id: auth.user_id, username: row?.username ?? '', is_admin: !!row?.is_admin, device_id: auth.device_id });
|
||
}
|
||
|
||
if (req.method === 'POST' && route === '/sync/push') {
|
||
const body = await readJson(req);
|
||
// wire 变更直接应用到该用户档案库（网页版立即可见）；generate_changes 由档案库 oplog 驱动
|
||
return send(200, true, commandsFor(auth.user_id).applyWireBatch(body.changes));
|
||
}
|
||
if (req.method === 'GET' && route === '/sync/pull') {
|
||
return send(200, true, commandsFor(auth.user_id).pullWire(url.searchParams.get('cursor'), url.searchParams.get('limit')));
|
||
}
|
||
if (req.method === 'POST' && route === '/sync/attachment') {
|
||
const body = await readJson(req);
|
||
return send(200, true, upload(auth.user_id, body));
|
||
}
|
||
if (req.method === 'GET' && route.startsWith('/sync/attachment/')) {
|
||
const sha = route.slice('/sync/attachment/'.length);
|
||
const file = download(auth.user_id, sha);
|
||
if (!file) return send(404, false, '附件不存在');
|
||
res.writeHead(200, {
|
||
'Content-Type': file.mime || 'application/octet-stream',
|
||
'Content-Length': file.buf.length,
|
||
// 内容寻址 = 不可变：浏览器一年缓存（private：不进共享缓存，杜绝跨账号串缓存）
|
||
'Cache-Control': 'private, max-age=31536000, immutable'
|
||
});
|
||
return res.end(file.buf);
|
||
}
|
||
if (req.method === 'GET' && route === '/sync/status') {
|
||
const db = getDb();
|
||
const changes = db.prepare('SELECT COUNT(*) AS c FROM changes WHERE user_id=?').get(auth.user_id).c;
|
||
const att = db.prepare('SELECT COUNT(*) AS c, COALESCE(SUM(size),0) AS bytes FROM attachments WHERE user_id=?').get(auth.user_id);
|
||
return send(200, true, {
|
||
user_id: auth.user_id, device_id: auth.device_id,
|
||
total_changes: changes, attachments: att.c, attachment_bytes: att.bytes
|
||
});
|
||
}
|
||
|
||
// 个人信息证件照：经图床网关直传 COS，返回访问 URL
|
||
if (req.method === 'POST' && route === '/api/profile_photo') {
|
||
const body = await readJson(req);
|
||
if (!LSKY_API || !LSKY_TOKEN) return send(400, false, '未配置图床，无法上传证件照');
|
||
try {
|
||
const buf = Buffer.from(body.data_b64 || '', 'base64');
|
||
if (!buf.length) return send(400, false, '空文件');
|
||
const up = await lskyUpload(buf, body.file_name || 'profile-photo.png', body.mime || 'image/png');
|
||
try { getDb().prepare('INSERT OR REPLACE INTO user_assets (user_id, kind, key, url) VALUES (?,?,?,?)')
|
||
.run(auth.user_id, 'photo', up.key || sanitizeImageUrl(up.url), sanitizeImageUrl(up.url)); } catch {}
|
||
return send(200, true, { url: sanitizeImageUrl(up.url) });
|
||
} catch (e) {
|
||
return send(500, false, '证件照上传失败: ' + e.message);
|
||
}
|
||
}
|
||
|
||
// 附件上传（原始二进制 PUT）：无 base64 膨胀；图床上传改为后台异步，保存立即返回
|
||
if (req.method === 'PUT' && route === '/sync/attachment/raw') {
|
||
const q = url.searchParams;
|
||
const name = (q.get('name') || 'file').slice(0, 200);
|
||
const mime = (q.get('mime') || 'application/octet-stream').slice(0, 120);
|
||
const ownerId = Number(q.get('owner') || 0);
|
||
if (!ownerId) return send(400, false, '缺少 owner');
|
||
const chunks = [];
|
||
for await (const c of req) chunks.push(c);
|
||
const buf = Buffer.concat(chunks);
|
||
if (!buf.length) return send(400, false, '空请求体');
|
||
if (buf.length > 80 * 1024 * 1024) return send(400, false, '单个文件不超过 80MB');
|
||
const thumbB64 = String(q.get('thumb') || '');
|
||
const data = commandsFor(auth.user_id).handleCommand('attachment_add', {
|
||
owner_id: ownerId, file_name: name, mime, size: buf.length, data_b64: buf.toString('base64')
|
||
});
|
||
const cmds = commandsFor(auth.user_id);
|
||
const itemId = data.item.id;
|
||
// 缩略图回填（带 base64，跟随本响应返回后由客户端二次调用亦可；此处直接从 query 收）
|
||
// 图床异步直传：失败仅记日志，可用 /admin/attachments/sync-lsky 补传
|
||
if (LSKY_API && LSKY_TOKEN) {
|
||
(async () => {
|
||
try {
|
||
const up = await lskyUpload(buf, name, mime);
|
||
let thumbUrl = null, thumbKey = null;
|
||
if (thumbB64) {
|
||
const tUp = await lskyUpload(Buffer.from(thumbB64, 'base64'), 'thumb-' + name + '.webp', 'image/webp');
|
||
thumbUrl = tUp.thumb_url || tUp.url;
|
||
thumbKey = tUp.key;
|
||
}
|
||
cmds.handleCommand('attachment_set_remote', { id: itemId, remote_url: up.url, remote_thumb: thumbUrl, remote_key: up.key, remote_thumb_key: thumbKey });
|
||
console.log('[lsky] 附件 #' + itemId + ' 已上图床');
|
||
} catch (e) { console.log('[lsky] 附件 #' + itemId + ' 后台上传失败（可用 sync-lsky 补传）:', e.message); }
|
||
})();
|
||
}
|
||
return send(200, true, data);
|
||
}
|
||
|
||
// 附件下载（带原始文件名的 Content-Disposition，浏览器直接落盘）
|
||
if (req.method === 'POST' && route === '/api/attachment_download') {
|
||
const body = await readJson(req);
|
||
const data = commandsFor(auth.user_id).handleCommand('attachment_read', { id: Number(body.id) });
|
||
const buf = Buffer.from(data.data_b64, 'base64');
|
||
res.writeHead(200, {
|
||
'Content-Type': data.mime || 'application/octet-stream',
|
||
'Content-Length': buf.length,
|
||
'Content-Disposition': "attachment; filename*=UTF-8''" + encodeURIComponent(data.file_name || 'file')
|
||
});
|
||
return res.end(buf);
|
||
}
|
||
|
||
// 附件删除：本地清理 + 图床异步清理
|
||
if (req.method === 'POST' && route === '/api/attachment_delete') {
|
||
const body = await readJson(req);
|
||
const cmds = commandsFor(auth.user_id);
|
||
const row = cmds.getDb().prepare('SELECT id, file_name, remote_url, remote_thumb, remote_key, remote_thumb_key FROM attachment WHERE id=?').get(Number(body.id));
|
||
const data = cmds.handleCommand('attachment_delete', body);
|
||
if (row && (row.remote_key || row.remote_url || row.remote_thumb)) lskyCleanupRemote([row]);
|
||
return send(200, true, data);
|
||
}
|
||
|
||
// 记录删除：级联清理附件 + 图床
|
||
if (req.method === 'POST' && route === '/api/footprint_delete') {
|
||
const body = await readJson(req);
|
||
const cmds = commandsFor(auth.user_id);
|
||
const atts = cmds.getDb().prepare("SELECT id, file_name, remote_url, remote_thumb, remote_key, remote_thumb_key FROM attachment WHERE owner_type='footprint' AND owner_id=? AND deleted_at IS NULL AND (remote_url IS NOT NULL OR remote_key IS NOT NULL)").all(Number(body.id));
|
||
const data = cmds.handleCommand('footprint_delete', body);
|
||
if (atts.length) lskyCleanupRemote(atts);
|
||
return send(200, true, data);
|
||
}
|
||
|
||
// 附件直传图床（兼容旧 base64 通道）：同样异步
|
||
if (req.method === 'POST' && route === '/api/attachment_add') {
|
||
const body = await readJson(req);
|
||
const data = commandsFor(auth.user_id).handleCommand('attachment_add', body);
|
||
if (LSKY_API && LSKY_TOKEN) {
|
||
const orig = Buffer.from(body.data_b64 || '', 'base64');
|
||
const itemId = data.item.id;
|
||
(async () => {
|
||
try {
|
||
const up = await lskyUpload(orig, body.file_name || ('file-' + itemId), body.mime);
|
||
let thumbUrl = null, thumbKey = null;
|
||
if (body.thumb_b64) {
|
||
const tUp = await lskyUpload(Buffer.from(body.thumb_b64, 'base64'), 'thumb-' + (body.file_name || 'img') + '.webp', 'image/webp');
|
||
thumbUrl = tUp.thumb_url || tUp.url;
|
||
thumbKey = tUp.key;
|
||
}
|
||
commandsFor(auth.user_id).handleCommand('attachment_set_remote', { id: itemId, remote_url: up.url, remote_thumb: thumbUrl, remote_key: up.key, remote_thumb_key: thumbKey });
|
||
console.log('[lsky] 附件 #' + itemId + ' 已上图床');
|
||
} catch (e) { console.log('[lsky] 附件 #' + itemId + ' 后台上传失败:', e.message); }
|
||
})();
|
||
}
|
||
return send(200, true, data);
|
||
}
|
||
|
||
// Web 应用命令层：/api/<command>（与桌面端同一契约，按用户隔离的档案库）
|
||
if (req.method === 'POST' && route.startsWith('/api/')) {
|
||
const cmd = route.slice(5);
|
||
if (!cmd || cmd.includes('/')) return send(404, false, 'not found');
|
||
const body = await readJson(req);
|
||
const data = commandsFor(auth.user_id).handleCommand(cmd, body);
|
||
return send(200, true, data);
|
||
}
|
||
}
|
||
|
||
// ---- 静态前端（www/，指纹资源长缓存，index 禁缓存）----
|
||
if (req.method === 'GET' && fs.existsSync(WWW_DIR)) {
|
||
let p = route === '/' ? '/index.html' : decodeURIComponent(route);
|
||
const abs = path.join(WWW_DIR, path.normalize(p).replace(/^([.][.][\\/])+/, ''));
|
||
if (abs.startsWith(WWW_DIR) && fs.existsSync(abs) && fs.statSync(abs).isFile()) {
|
||
const headers = {
|
||
'Content-Type': MIME[path.extname(abs).toLowerCase()] || 'application/octet-stream',
|
||
'Cache-Control': p.startsWith('/assets/') ? 'public, max-age=31536000, immutable' : 'no-cache'
|
||
};
|
||
// 指纹资产预压缩缓存（首次 gzip 后驻留内存，后续零 CPU）
|
||
if (p.startsWith('/assets/') && /\.(js|css|svg|json)$/.test(p) && /\bgzip\b/.test(String(req.headers['accept-encoding'] || ''))) {
|
||
let gz = gzipCache.get(abs);
|
||
if (!gz) { gz = zlib.gzipSync(fs.readFileSync(abs), { level: 6 }); gzipCache.set(abs, gz); }
|
||
headers['Content-Encoding'] = 'gzip';
|
||
headers['Content-Length'] = gz.length;
|
||
headers.Vary = 'Accept-Encoding';
|
||
res.writeHead(200, headers);
|
||
return res.end(gz);
|
||
}
|
||
res.writeHead(200, headers);
|
||
return res.end(fs.readFileSync(abs));
|
||
}
|
||
const indexHtml = path.join(WWW_DIR, 'index.html');
|
||
if (fs.existsSync(indexHtml)) {
|
||
res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache' });
|
||
return res.end(fs.readFileSync(indexHtml));
|
||
}
|
||
}
|
||
|
||
return send(404, false, 'not found');
|
||
} catch (err) {
|
||
return send(400, false, err.message || String(err));
|
||
}
|
||
});
|
||
|
||
function readJson(req) {
|
||
return new Promise((resolve, reject) => {
|
||
let size = 0;
|
||
const chunks = [];
|
||
req.on('data', chunk => {
|
||
size += chunk.length;
|
||
if (size > MAX_BODY) { reject(new Error('请求体过大')); req.destroy(); return; }
|
||
chunks.push(chunk);
|
||
});
|
||
req.on('end', () => {
|
||
try { resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {}); }
|
||
catch { reject(new Error('JSON 解析失败')); }
|
||
});
|
||
req.on('error', reject);
|
||
});
|
||
}
|
||
|
||
getDb();
|
||
|
||
// 种子演示账号（demo / demo1234）+ 演示数据；seed 标记绕过邀请码/名额校验
|
||
try {
|
||
const d = getDb();
|
||
const existing = d.prepare('SELECT id FROM users WHERE username=?').get('demo');
|
||
let demoId = existing?.id;
|
||
if (!demoId) {
|
||
const { register } = await import('./auth.mjs');
|
||
demoId = register({ username: 'demo', password: 'demo1234', device_name: 'seed-demo', seed: true }).user_id;
|
||
console.log('[footprints-sync] demo 账号已创建 (demo / demo1234)');
|
||
} else {
|
||
console.log('[footprints-sync] demo 账号已存在 (demo / demo1234)');
|
||
}
|
||
// demo 永远不是管理员（历史库也一并纠正）
|
||
d.prepare('UPDATE users SET is_admin=0 WHERE username=?').run('demo');
|
||
const seeded = commandsFor(demoId).handleCommand('demo_seed', {});
|
||
console.log('[footprints-sync] demo 演示数据:', JSON.stringify(seeded));
|
||
} catch (e) { console.log('[footprints-sync] demo 种子跳过:', e.message); }
|
||
|
||
server.listen(PORT, '0.0.0.0', () => {
|
||
console.log('[footprints-sync] listening on 0.0.0.0:' + PORT);
|
||
console.log('[footprints-sync] data dir:', process.env.DATA_DIR || path.join(__dirname, '..', 'data'));
|
||
console.log('[footprints-sync] web dir:', WWW_DIR, fs.existsSync(WWW_DIR) ? '(已托管)' : '(未部署前端)');
|
||
});
|