mirror of
https://github.com/Silentely/eSIM-Tools.git
synced 2026-09-03 06:24:20 +08:00
49be510892
新用户默认 MFA 时经 v2 verifyOTP 换正式会话；老用户未开启 MFA 时跳过步骤 2。 补齐 v2 代理、5 步 UI、i18n 与单元测试，抽取 requireSessionToken 避免业务接口遗漏守卫。
309 lines
12 KiB
JavaScript
309 lines
12 KiB
JavaScript
/**
|
||
* 本地开发服务器
|
||
* 提供静态文件服务和API代理功能
|
||
*/
|
||
|
||
const express = require('express');
|
||
const cors = require('cors');
|
||
const path = require('path');
|
||
const fs = require('fs');
|
||
const helmet = require('helmet');
|
||
const morgan = require('morgan');
|
||
require('dotenv').config();
|
||
|
||
if (typeof global.File === 'undefined') {
|
||
global.File = class File {};
|
||
}
|
||
|
||
const Logger = {
|
||
log: (...args) => console.log('[INFO]', ...args),
|
||
warn: (...args) => console.warn('[WARN]', ...args),
|
||
error: (...args) => console.error('[ERROR]', ...args)
|
||
};
|
||
|
||
const app = express();
|
||
const PORT = process.env.PORT || 3000;
|
||
const STATIC_ROOT = path.join(__dirname, process.env.STATIC_ROOT || 'dist');
|
||
const INTERNAL_FUNCTION_KEY = process.env.ACCESS_KEY || '';
|
||
const { parseOrigins, isAllowedOrigin: _isAllowedOrigin, resolveCorsOrigin: _resolveCorsOrigin } = require('./netlify/functions/_shared/cors');
|
||
const origins = parseOrigins(process.env.ALLOWED_ORIGIN);
|
||
const isAllowedOrigin = (origin) => _isAllowedOrigin(origin, origins);
|
||
const getCorsOrigin = (origin) => _resolveCorsOrigin(origin, origins);
|
||
// 与 src/simyo/js/modules/client-identity.js 保持同步
|
||
const DEFAULT_SIMYO_CLIENT_PLATFORM = 'ios';
|
||
const DEFAULT_SIMYO_CLIENT_VERSION = '4.28.0';
|
||
const DEFAULT_SIMYO_IOS_VERSION = '18.2';
|
||
const DEFAULT_SIMYO_DEVICE_MODEL = 'iPhone12,8';
|
||
// 版本号与括号之间为两个空格
|
||
const DEFAULT_SIMYO_USER_AGENT =
|
||
`MijnSimyoFT/${DEFAULT_SIMYO_CLIENT_VERSION} (iOS ${DEFAULT_SIMYO_IOS_VERSION}; ${DEFAULT_SIMYO_DEVICE_MODEL})`;
|
||
const crypto = require('crypto');
|
||
function getDefaultSimyoDeviceId() {
|
||
if (process.env.SIMYO_DEVICE_ID) return process.env.SIMYO_DEVICE_ID;
|
||
// 进程内稳定 ID，避免每次请求换设备身份
|
||
if (!global.__simyoDeviceId) {
|
||
global.__simyoDeviceId = crypto.randomUUID().toUpperCase();
|
||
}
|
||
return global.__simyoDeviceId;
|
||
}
|
||
|
||
// 启动时环境检查
|
||
if (!INTERNAL_FUNCTION_KEY) {
|
||
console.error('❌ ACCESS_KEY 未配置');
|
||
console.error('💡 请在 .env 文件或环境变量中设置 ACCESS_KEY');
|
||
console.error('⚠️ Netlify Functions 将无法正常工作，请修复后重启');
|
||
}
|
||
|
||
if (!process.env.SIMYO_CLIENT_TOKEN) {
|
||
console.warn('⚠️ SIMYO_CLIENT_TOKEN 未配置，Simyo 代理请求可能失败');
|
||
console.warn('💡 请在 .env 文件中设置 SIMYO_CLIENT_TOKEN');
|
||
}
|
||
|
||
if (!fs.existsSync(STATIC_ROOT)) {
|
||
console.warn(`⚠️ 静态目录 ${STATIC_ROOT} 不存在，请先运行 npm run build`);
|
||
console.warn('💡 运行: npm run build');
|
||
}
|
||
|
||
if (origins.allowAll) {
|
||
Logger.warn('⚠️ ALLOWED_ORIGIN 包含通配符(*)，所有来源均可访问。请勿在生产环境使用');
|
||
}
|
||
|
||
// 中间件配置
|
||
app.use(helmet({
|
||
contentSecurityPolicy: {
|
||
directives: {
|
||
defaultSrc: ["'self'"],
|
||
scriptSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net", "https://browser.sentry-cdn.com", "https://sentry.io", "https://*.sentry.io"],
|
||
styleSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net", "https://cdnjs.cloudflare.com", "https://fonts.googleapis.com"],
|
||
imgSrc: ["'self'", "data:", "https:", "http:"],
|
||
// jsdelivr：Bootstrap source map；sentry-cdn：SDK 回退加载
|
||
connectSrc: ["'self'", "https://cdn.jsdelivr.net", "https://cdnjs.cloudflare.com", "https://appapi.simyo.nl", "https://api.giffgaff.com", "https://id.giffgaff.com", "https://publicapi.giffgaff.com", "https://browser.sentry-cdn.com", "https://sentry.io", "https://*.sentry.io"],
|
||
fontSrc: ["'self'", "https://cdn.jsdelivr.net", "https://cdnjs.cloudflare.com", "https://fonts.gstatic.com"],
|
||
frameSrc: ["'self'", "https://*.sentry.io"],
|
||
workerSrc: ["'self'", "blob:"],
|
||
childSrc: ["'self'", "blob:"]
|
||
}
|
||
}
|
||
}));
|
||
|
||
// 仅允许特定来源访问本地API（前端文件本地打开时可能 Origin 为 undefined）
|
||
app.use(cors({
|
||
origin: function(origin, callback) {
|
||
if (isAllowedOrigin(origin)) return callback(null, true); // 非浏览器/本地文件放行
|
||
return callback(new Error('Not allowed by CORS'));
|
||
},
|
||
credentials: false
|
||
}));
|
||
app.use(morgan('combined'));
|
||
app.use(express.json());
|
||
app.use(express.urlencoded({ extended: true }));
|
||
|
||
const staticMiddleware = express.static(STATIC_ROOT, { fallthrough: true, index: false });
|
||
|
||
// 全局限流：每 IP 每分钟最多 200 次请求
|
||
const { createRateLimiter } = require('./src/js/middleware/validation.js');
|
||
app.use(createRateLimiter({ windowMs: 60000, maxRequests: 200 }));
|
||
app.use((req, res, next) => {
|
||
if (!['GET', 'HEAD'].includes(req.method)) {
|
||
return next();
|
||
}
|
||
if (/\.html?$/i.test(req.path)) {
|
||
return next();
|
||
}
|
||
return staticMiddleware(req, res, next);
|
||
});
|
||
|
||
// API路由 - 模拟Netlify Functions
|
||
const giffgaffMfaChallenge = require('./netlify/functions/giffgaff-mfa-challenge');
|
||
const giffgaffMfaValidation = require('./netlify/functions/giffgaff-mfa-validation');
|
||
const giffgaffGraphql = require('./netlify/functions/giffgaff-graphql');
|
||
const giffgaffTokenExchange = require('./netlify/functions/giffgaff-token-exchange');
|
||
const verifyCookie = require('./netlify/functions/verify-cookie');
|
||
const giffgaffSmsActivate = require('./netlify/functions/giffgaff-sms-activate');
|
||
const autoActivateEsim = require('./netlify/functions/auto-activate-esim');
|
||
const publicConfig = require('./netlify/functions/public-config');
|
||
|
||
// 包装Netlify Functions为Express路由
|
||
function wrapNetlifyFunction(handler) {
|
||
return async (req, res) => {
|
||
try {
|
||
const headers = Object.assign({}, req.headers);
|
||
// 仅在客户端未提供密钥时注入内部密钥（避免覆盖）
|
||
if (INTERNAL_FUNCTION_KEY && !headers['x-esim-key'] && !headers['x-app-key']) {
|
||
headers['x-esim-key'] = INTERNAL_FUNCTION_KEY;
|
||
}
|
||
const event = {
|
||
httpMethod: req.method,
|
||
headers,
|
||
body: JSON.stringify(req.body),
|
||
queryStringParameters: req.query
|
||
};
|
||
|
||
const context = {};
|
||
const result = await handler.handler(event, context);
|
||
|
||
res.status(result.statusCode);
|
||
|
||
if (result.headers) {
|
||
Object.entries(result.headers).forEach(([key, value]) => {
|
||
res.set(key, value);
|
||
});
|
||
}
|
||
|
||
if (result.body) {
|
||
const body = typeof result.body === 'string' ? result.body : JSON.stringify(result.body);
|
||
res.send(body);
|
||
} else {
|
||
res.end();
|
||
}
|
||
} catch (error) {
|
||
console.error('API Error:', error);
|
||
res.status(500).json({
|
||
error: 'Internal Server Error',
|
||
message: error.message
|
||
});
|
||
}
|
||
};
|
||
}
|
||
|
||
// API端点（同时挂 /.netlify/functions/* 与 /bff/*，本地模拟 Edge BFF 代理）
|
||
const functionRoutes = [
|
||
['giffgaff-mfa-challenge', giffgaffMfaChallenge],
|
||
['giffgaff-mfa-validation', giffgaffMfaValidation],
|
||
['giffgaff-graphql', giffgaffGraphql],
|
||
['giffgaff-token-exchange', giffgaffTokenExchange],
|
||
['verify-cookie', verifyCookie],
|
||
['giffgaff-sms-activate', giffgaffSmsActivate],
|
||
['auto-activate-esim', autoActivateEsim],
|
||
['public-config', publicConfig]
|
||
];
|
||
app.locals.bffRoutes = functionRoutes.map(([name]) => `/bff/${name}`);
|
||
app.locals.functionRoutes = functionRoutes.map(([name]) => `/.netlify/functions/${name}`);
|
||
functionRoutes.forEach(([name, handler]) => {
|
||
const wrapped = wrapNetlifyFunction(handler);
|
||
app.use(`/.netlify/functions/${name}`, wrapped);
|
||
app.use(`/bff/${name}`, wrapped);
|
||
});
|
||
|
||
// Simyo API代理路由（支持 /api/simyo/v2/* → webapi/api/v2，其余 → webapi/api/v1）
|
||
app.use('/api/simyo/*', (req, res) => {
|
||
const [pathPart, queryPart] = req.originalUrl.replace(/^\/api\/simyo/, '').split('?');
|
||
const proxyPath = pathPart || '/';
|
||
const queryString = queryPart ? `?${queryPart}` : '';
|
||
const isV2 = proxyPath === '/v2' || proxyPath.startsWith('/v2/');
|
||
const apiVersionPath = isV2 ? proxyPath.replace(/^\/v2/, '') || '/' : proxyPath;
|
||
const targetUrl = isV2
|
||
? `https://appapi.simyo.nl/webapi/api/v2${apiVersionPath}${queryString}`
|
||
: `https://appapi.simyo.nl/webapi/api/v1${proxyPath}${queryString}`;
|
||
Logger.log(`[Simyo Proxy] ${req.method} ${req.path} -> ${targetUrl}`);
|
||
|
||
// 设置CORS头（仅允许指定域）
|
||
res.header('Access-Control-Allow-Origin', getCorsOrigin(req.headers.origin));
|
||
res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
|
||
res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Accept, X-Client-Token, X-Client-Platform, X-Client-Version, X-Device-ID, X-Session-Token');
|
||
res.header('Vary', 'Origin');
|
||
|
||
if (req.method === 'OPTIONS') {
|
||
return res.status(200).end();
|
||
}
|
||
|
||
const simyoClientToken = process.env.SIMYO_CLIENT_TOKEN;
|
||
if (!simyoClientToken) {
|
||
return res.status(500).json({
|
||
error: 'Server Misconfigured',
|
||
message: 'SIMYO_CLIENT_TOKEN 未配置'
|
||
});
|
||
}
|
||
|
||
// 代理请求：强制使用客户端身份头（浏览器 UA 不可靠，禁止透传）
|
||
// X-Device-ID 必填，优先使用前端持久化 ID
|
||
const axios = require('axios');
|
||
const config = {
|
||
method: req.method.toLowerCase(),
|
||
url: targetUrl,
|
||
headers: {
|
||
'Content-Type': 'application/json',
|
||
Accept: 'application/json',
|
||
'Accept-Encoding': 'gzip',
|
||
'User-Agent': process.env.SIMYO_USER_AGENT || DEFAULT_SIMYO_USER_AGENT,
|
||
'X-Client-Token': simyoClientToken,
|
||
'X-Client-Platform': process.env.SIMYO_CLIENT_PLATFORM || DEFAULT_SIMYO_CLIENT_PLATFORM,
|
||
'X-Client-Version': process.env.SIMYO_CLIENT_VERSION || DEFAULT_SIMYO_CLIENT_VERSION,
|
||
'X-Device-ID': req.headers['x-device-id'] || process.env.SIMYO_DEVICE_ID || getDefaultSimyoDeviceId(),
|
||
...(req.headers['x-session-token'] ? { 'X-Session-Token': req.headers['x-session-token'] } : {})
|
||
},
|
||
timeout: 30000
|
||
};
|
||
|
||
if (req.body && Object.keys(req.body).length > 0) {
|
||
config.data = req.body;
|
||
}
|
||
|
||
axios(config)
|
||
.then(response => {
|
||
res.status(response.status).json(response.data);
|
||
})
|
||
.catch(error => {
|
||
console.error('[Simyo Proxy Error]:', error.message);
|
||
const status = error.response?.status || 500;
|
||
const data = error.response?.data || { error: 'Proxy Error', message: error.message };
|
||
res.status(status).json(data);
|
||
});
|
||
});
|
||
|
||
// 路由配置
|
||
const htmlRoutes = [
|
||
{ url: '/giffgaff', file: 'src/giffgaff/giffgaff_modular.html' },
|
||
{ url: '/simyo', file: 'src/simyo/simyo_modular.html' },
|
||
// 兼容静态路径访问（与 Netlify 重写保持一致）
|
||
{ url: '/src/giffgaff/giffgaff_modular.html', file: 'src/giffgaff/giffgaff_modular.html' },
|
||
{ url: '/src/simyo/simyo_modular.html', file: 'src/simyo/simyo_modular.html' },
|
||
{ url: '/', file: 'index.html' }
|
||
];
|
||
|
||
htmlRoutes.forEach(({ url, file }) => {
|
||
app.get(url, (req, res) => {
|
||
res.sendFile(path.join(STATIC_ROOT, file));
|
||
});
|
||
});
|
||
|
||
// 错误处理
|
||
app.use((err, req, res, next) => {
|
||
console.error('Server Error:', err);
|
||
const safeMessage = process.env.NODE_ENV === 'development'
|
||
? String(err.message || '').replace(/[<>"'&]/g, '')
|
||
: '服务器内部错误';
|
||
res.status(500).json({
|
||
error: 'Internal Server Error',
|
||
message: safeMessage
|
||
});
|
||
});
|
||
|
||
// 404处理
|
||
app.use((req, res) => {
|
||
// 优先返回 HTML 404 页面（如果存在）
|
||
const html404Path = path.join(STATIC_ROOT, '404.html');
|
||
if (fs.existsSync(html404Path) && req.accepts('html')) {
|
||
return res.status(404).sendFile(html404Path);
|
||
}
|
||
|
||
// API 请求或无 404 页面时返回 JSON
|
||
res.status(404).json({
|
||
error: 'Not Found',
|
||
message: '请求的资源不存在'
|
||
});
|
||
});
|
||
|
||
// 启动服务器。被测试或其他模块 require 时不自动占用端口。
|
||
if (require.main === module) {
|
||
app.listen(PORT, () => {
|
||
Logger.log(`🚀 eSIM工具服务器已启动`);
|
||
Logger.log(`📍 本地地址: http://localhost:${PORT}`);
|
||
Logger.log(`🔧 Giffgaff工具: http://localhost:${PORT}/giffgaff`);
|
||
Logger.log(`📱 Simyo工具: http://localhost:${PORT}/simyo`);
|
||
Logger.log(`🌐 环境: ${process.env.NODE_ENV || 'development'}`);
|
||
});
|
||
}
|
||
|
||
module.exports = app;
|