export const AUDIT_BIZ_SIGN_HEADER = 'X-Audit-Biz-Sign';
|
|
const EVENT_TIMEOUT_MS = 5 * 60 * 1000;
|
const SIGN_PATTERN = /^[\w-]{1,40}$/;
|
|
interface AuditBizSignEvent {
|
bizSign: string;
|
expiresAt: number;
|
timeout: ReturnType<typeof setTimeout>;
|
token: symbol;
|
}
|
|
let activeEvent: AuditBizSignEvent | undefined;
|
let eventQueue: Promise<void> = Promise.resolve();
|
|
export async function runWithAuditBizSignEvent<T>(bizSign: unknown, submit: () => Promise<T> | T): Promise<T> {
|
const normalizedBizSign = normalizeBizSign(bizSign);
|
if (!normalizedBizSign) throw new Error('电子签名认证结果无效');
|
|
const previousEvent = eventQueue;
|
let releaseEvent!: () => void;
|
eventQueue = new Promise<void>((resolve) => {
|
releaseEvent = resolve;
|
});
|
await previousEvent;
|
|
const token = Symbol('audit-biz-sign-event');
|
const timeout = setTimeout(() => clearEvent(token), EVENT_TIMEOUT_MS);
|
activeEvent = {
|
bizSign: normalizedBizSign,
|
expiresAt: Date.now() + EVENT_TIMEOUT_MS,
|
timeout,
|
token,
|
};
|
|
try {
|
return await submit();
|
} finally {
|
clearEvent(token);
|
releaseEvent();
|
}
|
}
|
|
export function getActiveAuditBizSign(): string {
|
if (!activeEvent) return '';
|
if (activeEvent.expiresAt <= Date.now()) {
|
clearEvent(activeEvent.token);
|
return '';
|
}
|
return activeEvent.bizSign;
|
}
|
|
export function applyActiveAuditBizSign(headers: Record<string, any>, url: string | undefined, method: string | undefined, apiBaseUrl = ''): void {
|
const bizSign = getActiveAuditBizSign();
|
if (!bizSign || hasHeader(headers, AUDIT_BIZ_SIGN_HEADER) || !shouldAttachAuditBizSign(url, method, apiBaseUrl)) return;
|
headers[AUDIT_BIZ_SIGN_HEADER] = bizSign;
|
}
|
|
export function shouldAttachAuditBizSign(url: string | undefined, method: string | undefined, apiBaseUrl = ''): boolean {
|
if (!['delete', 'patch', 'post', 'put'].includes(String(method || '').toLowerCase())) return false;
|
if (!url || url.startsWith('//')) return false;
|
|
try {
|
const browserOrigin = globalThis.location?.origin || 'http://audit.local';
|
const resolved = new URL(url, browserOrigin);
|
const configuredApi = new URL(apiBaseUrl || '/', browserOrigin);
|
if (resolved.origin !== configuredApi.origin) return false;
|
const pathname = stripApiBasePath(resolved.pathname, configuredApi.pathname);
|
if (!pathname.startsWith('/api/')) return false;
|
return !isExcludedPath(pathname);
|
} catch {
|
return false;
|
}
|
}
|
|
function hasHeader(headers: Record<string, any>, name: string): boolean {
|
if (typeof headers?.has === 'function' && headers.has(name)) return true;
|
return Object.keys(headers || {}).some((key) => key.toLowerCase() === name.toLowerCase());
|
}
|
|
function normalizeBizSign(value: unknown): string {
|
const normalized = value == null ? '' : String(value).trim();
|
return SIGN_PATTERN.test(normalized) ? normalized : '';
|
}
|
|
function stripApiBasePath(pathname: string, apiBasePath: string): string {
|
const normalizedBasePath = apiBasePath.replace(/\/$/, '');
|
if (!normalizedBasePath || normalizedBasePath === '/') return pathname;
|
if (pathname === normalizedBasePath) return '/';
|
return pathname.startsWith(`${normalizedBasePath}/`) ? pathname.slice(normalizedBasePath.length) : pathname;
|
}
|
|
function clearEvent(token: symbol) {
|
if (activeEvent?.token !== token) return;
|
clearTimeout(activeEvent.timeout);
|
activeEvent = undefined;
|
}
|
|
function isExcludedPath(pathname: string): boolean {
|
return (
|
/\/sign\/(?:init-all|modify-password|verify|verify_user)\/?$/i.test(pathname) ||
|
/^\/api\/oauth(?:\/|$)/i.test(pathname) ||
|
/^\/api\/audit(?:\/|$)/i.test(pathname)
|
);
|
}
|
