整合前端仓库并保留提交历史
This commit is contained in:
@@ -0,0 +1,276 @@
|
||||
interface PublicKeyResponse {
|
||||
enabled: boolean
|
||||
scope: string
|
||||
algorithm: string
|
||||
key_version: string
|
||||
public_key: string
|
||||
encrypted_paths?: string[]
|
||||
}
|
||||
|
||||
interface EncryptSession {
|
||||
aesKey: Uint8Array
|
||||
iv: Uint8Array
|
||||
keyVersion: string
|
||||
encryptedKey: string
|
||||
encryptedIv: string
|
||||
}
|
||||
|
||||
interface EncryptRequestResult {
|
||||
body: string
|
||||
headers: Record<string, string>
|
||||
session: EncryptSession | null
|
||||
}
|
||||
|
||||
const PUBLIC_KEY_PATH = '/system/security/api-encrypt/public-key'
|
||||
let publicKeyCache: PublicKeyResponse | null = null
|
||||
let publicKeyFailureAt = 0
|
||||
const PUBLIC_KEY_RETRY_INTERVAL = 30000
|
||||
|
||||
const textEncoder = new TextEncoder()
|
||||
const textDecoder = new TextDecoder()
|
||||
|
||||
function normalizeBaseUrl(baseURL: string): string {
|
||||
return baseURL.endsWith('/') ? baseURL.slice(0, -1) : baseURL
|
||||
}
|
||||
|
||||
function normalizePath(path: string): string {
|
||||
return path.startsWith('/') ? path : `/${path}`
|
||||
}
|
||||
|
||||
function resolveRequestPath(baseURL: string, path: string): string {
|
||||
const normalizedBaseUrl = normalizeBaseUrl(baseURL)
|
||||
const normalizedPath = normalizePath(path)
|
||||
|
||||
if (/^https?:\/\//i.test(normalizedPath)) {
|
||||
const url = new URL(normalizedPath)
|
||||
return url.pathname
|
||||
}
|
||||
|
||||
if (normalizedPath.startsWith('/api/') || normalizedPath.startsWith('/adminapi/')) {
|
||||
return normalizedPath
|
||||
}
|
||||
|
||||
try {
|
||||
const url = new URL(`${normalizedBaseUrl}${normalizedPath}`, window.location.origin)
|
||||
return url.pathname
|
||||
} catch {
|
||||
return normalizedPath
|
||||
}
|
||||
}
|
||||
|
||||
function shouldSkipEncrypt(path: string): boolean {
|
||||
return path === '/api/auth/refresh'
|
||||
|| path === '/adminapi/auth/refresh'
|
||||
|| path === '/api/system/security/api-encrypt/public-key'
|
||||
|| path === '/adminapi/system/security/api-encrypt/public-key'
|
||||
}
|
||||
|
||||
function matchesEncryptedPath(path: string, encryptedPaths: string[] = []): boolean {
|
||||
const normalizedPath = normalizePath(path)
|
||||
return encryptedPaths.some((encryptedPath) => {
|
||||
const normalizedEncryptedPath = normalizePath(encryptedPath)
|
||||
return normalizedEncryptedPath === normalizedPath || normalizedPath.startsWith(`${normalizedEncryptedPath}/`)
|
||||
})
|
||||
}
|
||||
|
||||
function toBase64(buffer: ArrayBuffer | Uint8Array): string {
|
||||
const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer)
|
||||
let binary = ''
|
||||
bytes.forEach((byte) => {
|
||||
binary += String.fromCharCode(byte)
|
||||
})
|
||||
return btoa(binary)
|
||||
}
|
||||
|
||||
function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
|
||||
return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer
|
||||
}
|
||||
|
||||
function fromPem(pem: string): ArrayBuffer {
|
||||
const clean = pem.replace(/-----BEGIN PUBLIC KEY-----/g, '')
|
||||
.replace(/-----END PUBLIC KEY-----/g, '')
|
||||
.replace(/\s+/g, '')
|
||||
const binary = atob(clean)
|
||||
const bytes = new Uint8Array(binary.length)
|
||||
for (let i = 0; i < binary.length; i += 1) {
|
||||
bytes[i] = binary.charCodeAt(i)
|
||||
}
|
||||
return bytes.buffer
|
||||
}
|
||||
|
||||
async function importPublicKey(publicKeyPem: string): Promise<CryptoKey> {
|
||||
return crypto.subtle.importKey(
|
||||
'spki',
|
||||
fromPem(publicKeyPem),
|
||||
{
|
||||
name: 'RSA-OAEP',
|
||||
hash: 'SHA-256'
|
||||
},
|
||||
true,
|
||||
['encrypt']
|
||||
)
|
||||
}
|
||||
|
||||
async function rsaEncrypt(publicKeyPem: string, data: Uint8Array): Promise<string> {
|
||||
const publicKey = await importPublicKey(publicKeyPem)
|
||||
const encrypted = await crypto.subtle.encrypt({ name: 'RSA-OAEP' }, publicKey, data)
|
||||
return toBase64(encrypted)
|
||||
}
|
||||
|
||||
async function aesEncrypt(plainText: string, aesKey: Uint8Array, iv: Uint8Array): Promise<string> {
|
||||
const cryptoKey = await crypto.subtle.importKey(
|
||||
'raw',
|
||||
toArrayBuffer(aesKey),
|
||||
{ name: 'AES-CBC' },
|
||||
false,
|
||||
['encrypt']
|
||||
)
|
||||
const encrypted = await crypto.subtle.encrypt({ name: 'AES-CBC', iv: toArrayBuffer(iv) }, cryptoKey, textEncoder.encode(plainText))
|
||||
return toBase64(encrypted)
|
||||
}
|
||||
|
||||
async function aesDecrypt(cipherText: string, aesKey: Uint8Array, iv: Uint8Array): Promise<string> {
|
||||
const cryptoKey = await crypto.subtle.importKey(
|
||||
'raw',
|
||||
toArrayBuffer(aesKey),
|
||||
{ name: 'AES-CBC' },
|
||||
false,
|
||||
['decrypt']
|
||||
)
|
||||
const binary = atob(cipherText)
|
||||
const bytes = new Uint8Array(binary.length)
|
||||
for (let i = 0; i < binary.length; i += 1) {
|
||||
bytes[i] = binary.charCodeAt(i)
|
||||
}
|
||||
const decrypted = await crypto.subtle.decrypt({ name: 'AES-CBC', iv: toArrayBuffer(iv) }, cryptoKey, toArrayBuffer(bytes))
|
||||
return textDecoder.decode(decrypted)
|
||||
}
|
||||
|
||||
async function fetchPublicKey(baseURL: string): Promise<PublicKeyResponse | null> {
|
||||
const requestUrl = `${normalizeBaseUrl(baseURL)}${PUBLIC_KEY_PATH}`
|
||||
const response = await fetch(requestUrl, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Content-Type': 'application/json'
|
||||
}
|
||||
})
|
||||
|
||||
const result = await response.json()
|
||||
if (!result || result.code !== 0 || !result.data) {
|
||||
return null
|
||||
}
|
||||
|
||||
return result.data as PublicKeyResponse
|
||||
}
|
||||
|
||||
async function ensurePublicKey(baseURL: string): Promise<PublicKeyResponse | null> {
|
||||
if (publicKeyCache) {
|
||||
return publicKeyCache
|
||||
}
|
||||
|
||||
if (publicKeyFailureAt > 0 && Date.now() - publicKeyFailureAt < PUBLIC_KEY_RETRY_INTERVAL) {
|
||||
return null
|
||||
}
|
||||
|
||||
let data: PublicKeyResponse | null = null
|
||||
try {
|
||||
data = await fetchPublicKey(baseURL)
|
||||
} catch {
|
||||
publicKeyFailureAt = Date.now()
|
||||
return null
|
||||
}
|
||||
|
||||
if (!data) {
|
||||
publicKeyFailureAt = Date.now()
|
||||
return null
|
||||
}
|
||||
|
||||
publicKeyFailureAt = 0
|
||||
publicKeyCache = data
|
||||
return publicKeyCache
|
||||
}
|
||||
|
||||
export function clearApiEncryptPublicKeyCache() {
|
||||
publicKeyCache = null
|
||||
publicKeyFailureAt = 0
|
||||
}
|
||||
|
||||
export async function prepareEncryptedRequest(baseURL: string, path: string, method: string, body?: unknown): Promise<EncryptRequestResult> {
|
||||
const resolvedPath = resolveRequestPath(baseURL, path)
|
||||
|
||||
if (!resolvedPath.startsWith('/api/') && !resolvedPath.startsWith('/adminapi/')) {
|
||||
return {
|
||||
body: body ? JSON.stringify(body) : '',
|
||||
headers: {},
|
||||
session: null
|
||||
}
|
||||
}
|
||||
|
||||
if (shouldSkipEncrypt(resolvedPath)) {
|
||||
return {
|
||||
body: body ? JSON.stringify(body) : '',
|
||||
headers: {},
|
||||
session: null
|
||||
}
|
||||
}
|
||||
|
||||
const publicKeyData = await ensurePublicKey(baseURL)
|
||||
if (!publicKeyData || !publicKeyData.enabled || publicKeyData.scope === 'off') {
|
||||
return {
|
||||
body: body ? JSON.stringify(body) : '',
|
||||
headers: {},
|
||||
session: null
|
||||
}
|
||||
}
|
||||
|
||||
if (publicKeyData.scope === 'partial' && !matchesEncryptedPath(resolvedPath, publicKeyData.encrypted_paths || [])) {
|
||||
return {
|
||||
body: body ? JSON.stringify(body) : '',
|
||||
headers: {},
|
||||
session: null
|
||||
}
|
||||
}
|
||||
|
||||
const aesKey = crypto.getRandomValues(new Uint8Array(32))
|
||||
const iv = crypto.getRandomValues(new Uint8Array(16))
|
||||
const encryptedKey = await rsaEncrypt(publicKeyData.public_key, aesKey)
|
||||
const encryptedIv = await rsaEncrypt(publicKeyData.public_key, iv)
|
||||
|
||||
let encryptedBody = ''
|
||||
if (body !== undefined && !['GET', 'HEAD'].includes(method.toUpperCase())) {
|
||||
const payload = JSON.stringify(body)
|
||||
encryptedBody = await aesEncrypt(payload, aesKey, iv)
|
||||
}
|
||||
|
||||
return {
|
||||
body: encryptedBody === '' ? '' : JSON.stringify({
|
||||
encrypted: true,
|
||||
algorithm: publicKeyData.algorithm,
|
||||
key_version: publicKeyData.key_version,
|
||||
data: encryptedBody,
|
||||
method
|
||||
}),
|
||||
headers: {
|
||||
'X-Api-Encrypt': '1',
|
||||
'X-Api-Encrypt-Version': publicKeyData.key_version,
|
||||
'X-Api-Encrypt-Key': encryptedKey,
|
||||
'X-Api-Encrypt-Iv': encryptedIv
|
||||
},
|
||||
session: {
|
||||
aesKey,
|
||||
iv,
|
||||
keyVersion: publicKeyData.key_version,
|
||||
encryptedKey,
|
||||
encryptedIv
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
export async function decryptEncryptedResponse(data: any, session: EncryptSession | null): Promise<any> {
|
||||
if (!data || data.encrypted !== true || !session) {
|
||||
return data
|
||||
}
|
||||
|
||||
const plainText = await aesDecrypt(String(data.data || ''), session.aesKey, session.iv)
|
||||
return JSON.parse(plainText)
|
||||
}
|
||||
Reference in New Issue
Block a user