From 479565f737080ea37fa8b40482e571d5e6605b45 Mon Sep 17 00:00:00 2001 From: shunli Date: Sun, 8 Feb 2026 23:58:55 +0800 Subject: [PATCH] =?UTF-8?q?feat(server):=20=E5=AE=89=E5=85=A8=E5=9F=BA?= =?UTF-8?q?=E7=BA=BF=EF=BC=88Helmet+=E9=99=90=E6=B5=81+=E8=84=B1=E6=95=8F?= =?UTF-8?q?=EF=BC=89=EF=BC=88E10=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 注册 @fastify/helmet（CSP 关闭） - 引入 @fastify/rate-limit，并对 login/forgot/reset 按开关启用 - Fastify logger 增加敏感字段 redaction（authorization/cookie/password 等） --- .../2026-02-08_21-50-09-p4-trialrun-ready.csv | 2 +- server/README.md | 12 +++++ server/package-lock.json | 52 +++++++++++++++++++ server/package.json | 8 +-- server/src/app.js | 37 ++++++++++++- server/src/config.js | 7 +++ server/src/routes/auth.js | 14 +++-- 7 files changed, 124 insertions(+), 8 deletions(-) diff --git a/issues/2026-02-08_21-50-09-p4-trialrun-ready.csv b/issues/2026-02-08_21-50-09-p4-trialrun-ready.csv index b7c13c1f..d7a3fcf3 100644 --- a/issues/2026-02-08_21-50-09-p4-trialrun-ready.csv +++ b/issues/2026-02-08_21-50-09-p4-trialrun-ready.csv @@ -8,7 +8,7 @@ E6,票据中心精修（OCR与预览）,收敛上传列表详情并强化OCR状 E7,委派管理前端页（运营可用）,新增委派管理页与API封装支持创建列表撤销并加菜单入口与守卫,可创建委派撤销后delegate不可代办且无权限用户403提示正确,"manual: manager创建委派让delegate代办一次后撤销再验证PERM_002",manual,DONE,TODO,TODO,client/src/pages/DelegationsPage.tsx | client/src/api/delegations.ts | client/src/router/index.tsx | client/src/components/navigation/Sidebar.tsx,"[""E3""]",权限码沿用expense.proxy_manage E8,默认账号与失败体验收敛,补dev seed默认账号文档并让前端对网络失败给出可操作提示（含“忘记密码请联系管理员重置”）,登录页后端不可达提示服务未启动且README列出默认账号且SYS_001提示可读,"manual: 停后端访问登录页看到提示并按README默认账号登录成功",manual,DONE,TODO,TODO,client/src/pages/LoginPage.tsx | client/src/api/errorMessages.ts | server/README.md | client/README.md,"[""E1""]",仅写dev seed账号不写生产密码与密钥 E9,DB索引补强（试运行性能）,为列表分页与筛选补组合索引以降低试运行慢查询风险,迁移可重复执行且回归全绿,cd server && npm run prisma:migrate:deploy && ./scripts/regression-all.sh,manual,DONE,TODO,TODO,server/prisma/schema.prisma | server/prisma/migrations/*,"[""E1""]",新增组合索引仅增不破回滚成本低 -E10,后端安全基线（上线级）,增加安全头与关键接口限流并完善上传校验与日志脱敏约定,限流触发行为正确安全头存在上传非法类型被拒绝且不泄露token,"manual: curl压测login并验证429与headers并做一次上传非法类型校验",manual,TODO,TODO,TODO,server/src/app.js | server/src/config.js | server/src/routes/auth.js | server/src/routes/invoicePool.js | server/README.md | server/package.json,"[""E1""]",优先使用@fastify/helmet与@fastify/rate-limit并写回滚说明 +E10,后端安全基线（上线级）,增加安全头与关键接口限流并完善上传校验与日志脱敏约定,限流触发行为正确安全头存在上传非法类型被拒绝且不泄露token,"manual: curl压测login并验证429与headers并做一次上传非法类型校验",manual,DONE,TODO,TODO,server/src/app.js | server/src/config.js | server/src/routes/auth.js | server/src/routes/invoicePool.js | server/README.md | server/package.json,"[""E1""]",优先使用@fastify/helmet与@fastify/rate-limit并写回滚说明 E11,可观测性基线（ready与作业统计）,新增/ready进行DB探活并为OCR与委派回收作业输出结构化统计,ready可反映db状态且作业日志输出claimed updated audited等计数便于排障,"manual: 启动服务curl /ready并触发一次job观察日志字段",manual,TODO,TODO,TODO,server/src/app.js | server/src/jobs/delegationRevokeJob.js | server/src/jobs/ocrJob.js | server/README.md,"[""E10""]",不引入外部监控先提供最小可观测字段 E12,单域部署（server托管client静态）,支持server托管client dist实现同域cookie并提供开关与SPA回退,开启后通过server根路径访问前端且登录刷新正常,"manual: cd client && npm run build 然后SERVE_CLIENT_DIST=true启动server访问http://127.0.0.1:3000完成登录",manual,TODO,TODO,TODO,server/src/app.js | server/src/config.js | server/README.md | docker-compose.yml,"[""E10""]",优先复用@fastify/static并用正则fallback避开/api E13,部署与运维包（试运行）,提供deploy/trialrun含env模板compose示例反向代理示例与启动停止runbook,按runbook可在新机器完成启动升级迁移与回滚演练一次,"manual: 按deploy/trialrun/runbook执行docker compose启动并验证ready与登录与回归入口",manual,TODO,TODO,TODO,deploy/trialrun/* | docker-compose.yml | server/.env.example | server/README.md | client/README.md,"[""E12""]",先覆盖试运行环境后续再细化生产 diff --git a/server/README.md b/server/README.md index e40b5e27..f744e6b2 100644 --- a/server/README.md +++ b/server/README.md @@ -223,6 +223,9 @@ npm run job:ocr-once - `STORAGE_DIR`: 默认 `generated/storage`（相对 `server/`） - `SIGNED_URL_TTL_SECONDS`: 默认 `600` - `MAX_UPLOAD_SIZE_BYTES`: 默认 `10485760`（10MB） +- `RATE_LIMIT_ENABLED`: 是否启用关键接口限流（默认：production=true，其它环境=false） +- `RATE_LIMIT_LOGIN_MAX`: `/api/auth/login` 等接口限流次数（默认 `10`） +- `RATE_LIMIT_LOGIN_WINDOW`: 限流时间窗（默认 `1 minute`，支持 ms 格式如 `30s`/`1m`） - `DELEGATION_REVOKE_CRON`: 委派自动回收定时表达式（默认 `0 * * * *`） - `OCR_PROVIDER`: `off` / `mock` / `tencent`（默认 `off`） - `OCR_BATCH_SIZE`: 每轮 OCR 认领数量（默认 `10`） @@ -232,6 +235,15 @@ npm run job:ocr-once - `OCR_TIMEOUT_MS`: 腾讯 OCR SDK 超时（默认 `5000`） - `TENCENT_SECRET_ID` / `TENCENT_SECRET_KEY` / `TENCENT_OCR_REGION`: 腾讯 OCR 配置 +安全基线（P4）： +- 安全头：默认启用 `@fastify/helmet`（CSP 默认关闭，避免误伤 SPA 本地调试）。 +- 限流：`/api/auth/login`、`/api/auth/forgot-password`、`/api/auth/reset-password` 在 `RATE_LIMIT_ENABLED=true` 时启用限流。 +- 日志脱敏：`authorization/cookie/password/code/newPassword` 等敏感字段会被 redaction。 + +回滚策略： +- 若限流误伤，可先设置 `RATE_LIMIT_ENABLED=false`（无需改代码）。 +- 若安全头造成兼容性问题，可回退 `server/src/app.js` 中 helmet 注册逻辑。 + > 生产提示：大表加索引需评估 `CREATE INDEX CONCURRENTLY`，避免锁表影响。 --- diff --git a/server/package-lock.json b/server/package-lock.json index 82c7eb65..478a7b69 100644 --- a/server/package-lock.json +++ b/server/package-lock.json @@ -11,8 +11,10 @@ "dependencies": { "@fastify/cookie": "^11.0.2", "@fastify/cors": "^11.2.0", + "@fastify/helmet": "^13.0.2", "@fastify/jwt": "^10.0.0", "@fastify/multipart": "^9.3.0", + "@fastify/rate-limit": "^10.3.0", "@fastify/static": "^9.0.0", "@prisma/adapter-pg": "^7.3.0", "@prisma/client": "^7.3.0", @@ -239,6 +241,26 @@ ], "license": "MIT" }, + "node_modules/@fastify/helmet": { + "version": "13.0.2", + "resolved": "https://registry.npmjs.org/@fastify/helmet/-/helmet-13.0.2.tgz", + "integrity": "sha512-tO1QMkOfNeCt9l4sG/FiWErH4QMm+RjHzbMTrgew1DYOQ2vb/6M1G2iNABBrD7Xq6dUk+HLzWW8u+rmmhQHifA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fastify" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/fastify" + } + ], + "license": "MIT", + "dependencies": { + "fastify-plugin": "^5.0.0", + "helmet": "^8.0.0" + } + }, "node_modules/@fastify/jwt": { "version": "10.0.0", "resolved": "https://registry.npmjs.org/@fastify/jwt/-/jwt-10.0.0.tgz", @@ -324,6 +346,27 @@ "ipaddr.js": "^2.1.0" } }, + "node_modules/@fastify/rate-limit": { + "version": "10.3.0", + "resolved": "https://registry.npmjs.org/@fastify/rate-limit/-/rate-limit-10.3.0.tgz", + "integrity": "sha512-eIGkG9XKQs0nyynatApA3EVrojHOuq4l6fhB4eeCk4PIOeadvOJz9/4w3vGI44Go17uaXOWEcPkaD8kuKm7g6Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fastify" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/fastify" + } + ], + "license": "MIT", + "dependencies": { + "@lukeed/ms": "^2.0.2", + "fastify-plugin": "^5.0.0", + "toad-cache": "^3.7.0" + } + }, "node_modules/@fastify/send": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/@fastify/send/-/send-4.1.0.tgz", @@ -1489,6 +1532,15 @@ "node": ">= 0.4" } }, + "node_modules/helmet": { + "version": "8.1.0", + "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz", + "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==", + "license": "MIT", + "engines": { + "node": ">=18.0.0" + } + }, "node_modules/hono": { "version": "4.11.4", "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.4.tgz", diff --git a/server/package.json b/server/package.json index 0e689f2a..d3d9eef4 100644 --- a/server/package.json +++ b/server/package.json @@ -24,19 +24,21 @@ "dependencies": { "@fastify/cookie": "^11.0.2", "@fastify/cors": "^11.2.0", + "@fastify/helmet": "^13.0.2", "@fastify/jwt": "^10.0.0", "@fastify/multipart": "^9.3.0", + "@fastify/rate-limit": "^10.3.0", "@fastify/static": "^9.0.0", "@prisma/adapter-pg": "^7.3.0", "@prisma/client": "^7.3.0", "bcryptjs": "^3.0.3", "fastify": "^5.7.4", "fastify-plugin": "^5.1.0", + "node-cron": "^4.2.1", "pg": "^8.18.0", "prisma": "^7.3.0", - "zod": "^4.3.6", - "node-cron": "^4.2.1", - "tencentcloud-sdk-nodejs": "^4.1.14" + "tencentcloud-sdk-nodejs": "^4.1.14", + "zod": "^4.3.6" }, "devDependencies": { "dotenv": "^16.4.5" diff --git a/server/src/app.js b/server/src/app.js index a4565c34..937f162c 100644 --- a/server/src/app.js +++ b/server/src/app.js @@ -7,6 +7,8 @@ const fastify = require("fastify"); const cors = require("@fastify/cors"); const cookie = require("@fastify/cookie"); const multipart = require("@fastify/multipart"); +const helmet = require("@fastify/helmet"); +const rateLimit = require("@fastify/rate-limit"); const { getConfig } = require("./config"); const authPlugin = require("./plugins/auth"); @@ -26,7 +28,20 @@ async function buildApp() { const config = getConfig(); const app = fastify({ - logger: true, + logger: { + redact: { + paths: [ + "req.headers.authorization", + "req.headers.cookie", + "req.headers['set-cookie']", + "res.headers['set-cookie']", + "req.body.password", + "req.body.newPassword", + "req.body.code", + ], + censor: "[REDACTED]", + }, + }, trustProxy: true, genReqId: () => crypto.randomUUID(), }); @@ -60,6 +75,26 @@ async function buildApp() { }, }); + await app.register(helmet, { + contentSecurityPolicy: false, + }); + + await app.register(rateLimit, { + global: false, + errorResponseBuilder: (request, context) => { + return new AppError({ + code: "SYS_429", + message: "请求过于频繁，请稍后重试", + statusCode: context.statusCode, + details: { + retryAfter: context.after, + max: context.max, + ban: context.ban, + }, + }); + }, + }); + app.addHook("onRequest", async (request, reply) => { reply.header("x-request-id", request.id); }); diff --git a/server/src/config.js b/server/src/config.js index e9b31ee0..07a101b1 100644 --- a/server/src/config.js +++ b/server/src/config.js @@ -43,6 +43,13 @@ function getConfig() { signedUrlTtlSeconds: Number(process.env.SIGNED_URL_TTL_SECONDS ?? 600), maxUploadSizeBytes: Number(process.env.MAX_UPLOAD_SIZE_BYTES ?? 10 * 1024 * 1024), + rateLimitEnabled: + process.env.RATE_LIMIT_ENABLED != null + ? process.env.RATE_LIMIT_ENABLED === "true" + : nodeEnv === "production", + rateLimitLoginMax: Number(process.env.RATE_LIMIT_LOGIN_MAX ?? 10), + rateLimitLoginWindow: process.env.RATE_LIMIT_LOGIN_WINDOW ?? "1 minute", + delegationRevokeCron: process.env.DELEGATION_REVOKE_CRON ?? "0 * * * *", ocrProvider: process.env.OCR_PROVIDER ?? "off", diff --git a/server/src/routes/auth.js b/server/src/routes/auth.js index 87ed5483..c74e307a 100644 --- a/server/src/routes/auth.js +++ b/server/src/routes/auth.js @@ -39,7 +39,15 @@ async function authRoutes(fastify) { password: z.string().min(1), }); - fastify.post("/login", async (request, reply) => { + const authRateLimit = + fastify.config.rateLimitEnabled && typeof fastify.rateLimit === "function" + ? fastify.rateLimit({ + max: fastify.config.rateLimitLoginMax, + timeWindow: fastify.config.rateLimitLoginWindow, + }) + : undefined; + + fastify.post("/login", { preHandler: authRateLimit }, async (request, reply) => { const parsed = loginBodySchema.safeParse(request.body); if (!parsed.success) { throw new AppError({ @@ -374,7 +382,7 @@ async function authRoutes(fastify) { email: z.string().email(), }); - fastify.post("/forgot-password", async (request, reply) => { + fastify.post("/forgot-password", { preHandler: authRateLimit }, async (request, reply) => { const parsed = forgotPasswordBodySchema.safeParse(request.body); if (!parsed.success) { throw new AppError({ @@ -436,7 +444,7 @@ async function authRoutes(fastify) { newPassword: z.string().min(12), }); - fastify.post("/reset-password", async (request, reply) => { + fastify.post("/reset-password", { preHandler: authRateLimit }, async (request, reply) => { const parsed = resetPasswordBodySchema.safeParse(request.body); if (!parsed.success) { throw new AppError({