const express = require('express');
|
const multer = require('multer');
|
const { nanoid } = require('nanoid');
|
const QRCode = require('qrcode');
|
const path = require('path');
|
const fs = require('fs');
|
const os = require('os');
|
const session = require('express-session');
|
const crypto = require('crypto');
|
const Database = require('better-sqlite3');
|
const svgCaptcha = require('svg-captcha');
|
const Iconv = require('iconv-lite');
|
const bcrypt = require('bcrypt');
|
const rateLimit = require('express-rate-limit');
|
|
const app = express();
|
const PORT = process.env.PORT || 3344;
|
const BASE_URL = process.env.BASE_URL || `http://${getLocalIP()}:${PORT}`;
|
const UPLOAD_DIR = path.join(__dirname, 'uploads');
|
const DB_PATH = process.env.DB_PATH || path.join(__dirname, 'data', 'data.db');
|
|
// === 安全配置 ===
|
const BCRYPT_ROUNDS = 12;
|
const UPLOAD_EXTENSIONS = new Set([
|
// 文档类
|
'.pdf', '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx', '.txt',
|
// 图片类
|
'.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg',
|
// 压缩类
|
'.zip', '.rar', '.7z', '.tar', '.gz'
|
]);
|
|
// === 初始化 SQLite ===
|
const db = new Database(DB_PATH);
|
db.pragma('journal_mode = WAL');
|
db.pragma('foreign_keys = ON');
|
|
// 用户表
|
db.exec(`
|
CREATE TABLE IF NOT EXISTS users (
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
username TEXT NOT NULL UNIQUE,
|
password_hash TEXT NOT NULL,
|
role TEXT NOT NULL DEFAULT 'admin',
|
created_at INTEGER NOT NULL,
|
updated_at INTEGER NOT NULL
|
)
|
`);
|
|
// 文件表
|
db.exec(`
|
CREATE TABLE IF NOT EXISTS files (
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
code TEXT NOT NULL UNIQUE,
|
original_name TEXT NOT NULL,
|
saved_name TEXT NOT NULL,
|
size INTEGER NOT NULL,
|
mime_type TEXT,
|
uploaded_at INTEGER NOT NULL,
|
downloads INTEGER NOT NULL DEFAULT 0,
|
uploaded_by TEXT
|
)
|
`);
|
|
// 索引
|
db.exec(`CREATE INDEX IF NOT EXISTS idx_files_code ON files(code)`);
|
|
// === 初始化默认用户 ===
|
const SALT = process.env.SALT || 'docmgr-salt-2026';
|
|
// 密码哈希函数（使用 bcrypt）
|
async function hashPassword(pwd) {
|
return await bcrypt.hash(pwd, BCRYPT_ROUNDS);
|
}
|
|
function verifyPassword(pwd, hash) {
|
return bcrypt.compareSync(pwd, hash);
|
}
|
|
// 默认管理员（超级管理员，拥有所有权限）
|
const DEFAULT_ADMIN_USER = 'gwalrusadmin';
|
const DEFAULT_ADMIN_PASS = process.env.ADMIN_PASSWORD || 'admin123';
|
|
const USERS = parseUsers(process.env.USERS || `${DEFAULT_ADMIN_USER}:${DEFAULT_ADMIN_PASS}`);
|
function parseUsers(str) {
|
const map = {};
|
str.split(',').forEach(pair => {
|
const [u, p] = pair.split(':');
|
if (u && p) map[u.trim()] = p.trim();
|
});
|
return map;
|
}
|
|
async function initUsers() {
|
const now = Date.now();
|
const insert = db.prepare(
|
'INSERT OR IGNORE INTO users (username, password_hash, role, created_at, updated_at) VALUES (?, ?, ?, ?, ?)'
|
);
|
const updateRole = db.prepare(
|
'UPDATE users SET role = ?, updated_at = ? WHERE username = ?'
|
);
|
const updatePassword = db.prepare(
|
'UPDATE users SET password_hash = ?, updated_at = ? WHERE username = ?'
|
);
|
|
// 确保超级管理员存在
|
const adminExists = db.prepare('SELECT id FROM users WHERE username = ?').get(DEFAULT_ADMIN_USER);
|
if (!adminExists) {
|
const hash = await hashPassword(DEFAULT_ADMIN_PASS);
|
insert.run(DEFAULT_ADMIN_USER, hash, 'super_admin', now, now);
|
} else {
|
// 确保超级管理员的角色正确
|
updateRole.run('super_admin', now, DEFAULT_ADMIN_USER);
|
}
|
|
// 初始化其他用户
|
for (const [username, password] of Object.entries(USERS)) {
|
if (username === DEFAULT_ADMIN_USER) continue;
|
const existing = db.prepare('SELECT id, password_hash FROM users WHERE username = ?').get(username);
|
if (!existing) {
|
const hash = await hashPassword(password);
|
insert.run(username, hash, 'admin', now, now);
|
}
|
}
|
}
|
|
initUsers().then(() => {
|
console.log('用户初始化完成');
|
}).catch(err => {
|
console.error('用户初始化失败:', err);
|
process.exit(1);
|
});
|
|
// 确保目录存在
|
if (!fs.existsSync(UPLOAD_DIR)) fs.mkdirSync(UPLOAD_DIR, { recursive: true });
|
const DB_DIR = path.dirname(DB_PATH);
|
if (!fs.existsSync(DB_DIR)) fs.mkdirSync(DB_DIR, { recursive: true });
|
|
// 获取本机局域网 IP
|
function getLocalIP() {
|
const nets = os.networkInterfaces();
|
for (const name of Object.keys(nets)) {
|
for (const net of nets[name]) {
|
if (net.family === 'IPv4' && !net.internal) return net.address;
|
}
|
}
|
return 'localhost';
|
}
|
|
// Session 配置
|
app.use(session({
|
secret: process.env.SESSION_SECRET || crypto.randomBytes(32).toString('hex'),
|
resave: false,
|
saveUninitialized: false,
|
name: 'docmgr.sid',
|
cookie: {
|
httpOnly: true,
|
secure: false, // 生产环境配合 nginx 应设为 true
|
sameSite: 'lax',
|
maxAge: 24 * 60 * 60 * 1000
|
}
|
}));
|
|
// === 安全响应头 ===
|
app.use((req, res, next) => {
|
res.setHeader('X-Content-Type-Options', 'nosniff');
|
res.setHeader('X-Frame-Options', 'DENY');
|
res.setHeader('X-XSS-Protection', '1; mode=block');
|
res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; font-src 'self' https://cdn.jsdelivr.net; img-src 'self' data: blob:;");
|
res.setHeader('Referrer-Policy', 'no-referrer');
|
res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
|
res.removeHeader('X-Powered-By'); // 隐藏技术栈
|
next();
|
});
|
|
// === 请求体解析 ===
|
app.use(express.urlencoded({ extended: true }));
|
app.use(express.json());
|
|
// 登录锁定记录（内存）
|
const LOGIN_MAX_ATTEMPTS = 3;
|
const LOGIN_LOCK_MINUTES = 10;
|
const loginAttempts = new Map();
|
|
function checkLoginLock(username, ip) {
|
const key = `${username}:${ip}`;
|
const record = loginAttempts.get(key);
|
if (!record) return null;
|
const elapsed = Date.now() - record.lockedAt;
|
const remaining = LOGIN_LOCK_MINUTES * 60 * 1000 - elapsed;
|
if (remaining > 0) {
|
return Math.ceil(remaining / 1000 / 60);
|
}
|
loginAttempts.delete(key);
|
return null;
|
}
|
|
function recordLoginAttempt(username, ip, success) {
|
const key = `${username}:${ip}`;
|
if (success) {
|
loginAttempts.delete(key);
|
return;
|
}
|
const record = loginAttempts.get(key) || { count: 0, lockedAt: 0 };
|
record.count++;
|
if (record.count >= LOGIN_MAX_ATTEMPTS) {
|
record.lockedAt = Date.now();
|
}
|
loginAttempts.set(key, record);
|
}
|
|
// Multer 配置
|
const storage = multer.diskStorage({
|
destination: (req, file, cb) => cb(null, UPLOAD_DIR),
|
filename: (req, file, cb) => {
|
const code = nanoid(10);
|
const ext = path.extname(file.originalname).toLowerCase();
|
cb(null, code + ext);
|
}
|
});
|
|
const upload = multer({
|
storage,
|
limits: { fileSize: 500 * 1024 * 1024 },
|
fileFilter: (req, file, cb) => {
|
const ext = path.extname(file.originalname).toLowerCase();
|
if (!UPLOAD_EXTENSIONS.has(ext)) {
|
return cb(new Error(`不支持的文件类型：${ext}，允许的类型：${Array.from(UPLOAD_EXTENSIONS).join(', ')}`));
|
}
|
cb(null, true);
|
}
|
});
|
|
// EJS 模板引擎
|
app.set('view engine', 'ejs');
|
app.set('views', path.join(__dirname, 'views'));
|
|
// 模板辅助函数
|
app.locals.formatSize = (bytes) => {
|
if (!bytes) return '0 B';
|
const units = ['B', 'KB', 'MB', 'GB'];
|
let i = 0;
|
let size = bytes;
|
while (size >= 1024 && i < units.length - 1) { size /= 1024; i++; }
|
return size.toFixed(i > 0 ? 1 : 0) + ' ' + units[i];
|
};
|
app.locals.formatDate = (ts) => {
|
const d = new Date(ts);
|
return d.getFullYear() + '-' + String(d.getMonth() + 1).padStart(2, '0') + '-' + String(d.getDate()).padStart(2, '0') + ' ' + String(d.getHours()).padStart(2, '0') + ':' + String(d.getMinutes()).padStart(2, '0');
|
};
|
app.locals.getFileIconClass = (name) => {
|
const ext = path.extname(name).toLowerCase();
|
if (['.zip', '.rar', '.7z', '.tar', '.gz'].includes(ext)) return 'archive';
|
if (['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'].includes(ext)) return 'image';
|
if (['.pdf'].includes(ext)) return 'pdf';
|
if (['.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx', '.txt'].includes(ext)) return 'doc';
|
return 'other';
|
};
|
app.locals.getFileIcon = (name) => {
|
const ext = path.extname(name).toLowerCase();
|
if (['.zip', '.rar', '.7z', '.tar', '.gz'].includes(ext)) return 'fa-regular fa-file-zipper';
|
if (['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'].includes(ext)) return 'fa-regular fa-file-image';
|
if (['.pdf'].includes(ext)) return 'fa-regular fa-file-pdf';
|
if (['.doc', '.docx'].includes(ext)) return 'fa-regular fa-file-word';
|
if (['.xls', '.xlsx'].includes(ext)) return 'fa-regular fa-file-excel';
|
if (['.ppt', '.pptx'].includes(ext)) return 'fa-regular fa-file-powerpoint';
|
if (['.txt'].includes(ext)) return 'fa-regular fa-file-lines';
|
if (['.mp4', '.avi', '.mov', '.mkv'].includes(ext)) return 'fa-regular fa-file-video';
|
if (['.mp3', '.wav', '.flac'].includes(ext)) return 'fa-regular fa-file-audio';
|
return 'fa-regular fa-file';
|
};
|
|
// 静态文件（防止目录遍历攻击）
|
app.use('/uploads', (req, res, next) => {
|
// 只允许访问文件，禁止目录浏览
|
if (req.path.includes('..')) {
|
return res.status(403).send('禁止访问');
|
}
|
next();
|
}, express.static(UPLOAD_DIR, {
|
dotfiles: 'ignore',
|
index: false // 禁止列出目录
|
}));
|
app.use('/static', express.static(path.join(__dirname, 'public')));
|
|
// ========== 登录中间件 ==========
|
function requireAuth(req, res, next) {
|
if (req.session && req.session.user) return next();
|
if (req.xhr || req.headers.accept?.includes('json')) {
|
return res.status(401).json({ error: '未登录', loginUrl: '/login' });
|
}
|
res.redirect('/login');
|
}
|
|
// 超级管理员权限中间件（只有 gwalrusadmin 可访问）
|
function requireSuperAdmin(req, res, next) {
|
if (!req.session || !req.session.user) {
|
return res.status(401).json({ error: '未登录' });
|
}
|
if (req.session.user.username !== 'gwalrusadmin') {
|
return res.status(403).json({ error: '权限不足：仅超级管理员可访问' });
|
}
|
next();
|
}
|
|
// === 速率限制配置 ===
|
const loginLimiter = rateLimit({
|
windowMs: 15 * 60 * 1000, // 15 分钟
|
max: 10, // 最多 10 次请求
|
message: { error: '操作太频繁，请稍后再试' },
|
standardHeaders: true,
|
legacyHeaders: false
|
});
|
|
const apiLimiter = rateLimit({
|
windowMs: 15 * 60 * 1000,
|
max: 100, // API 最多 100 次请求
|
message: { error: '操作太频繁，请稍后再试' },
|
standardHeaders: true,
|
legacyHeaders: false
|
});
|
|
// ========== 生成验证码 ==========
|
app.get('/captcha', (req, res) => {
|
const captcha = svgCaptcha.create({
|
size: 4,
|
noise: 2,
|
color: true,
|
background: '#f0f4ff',
|
width: 120,
|
height: 40
|
});
|
req.session.captcha = captcha.text.toLowerCase();
|
res.type('svg');
|
res.send(captcha.data);
|
});
|
|
// ========== 登录 ==========
|
app.get('/login', (req, res) => {
|
if (req.session && req.session.user) return res.redirect('/');
|
const clientIp = req.ip || req.connection.remoteAddress || '';
|
const lockRemaining = checkLoginLock(req.query.u || '', clientIp);
|
res.render('login', {
|
error: req.query.error || null,
|
username: req.query.u || '',
|
password: req.query.p || '',
|
lockedUsername: req.query.u || '',
|
lockRemaining,
|
baseUrl: BASE_URL
|
});
|
});
|
|
app.post('/login', loginLimiter, async (req, res) => {
|
const { username, password, captcha } = req.body;
|
const clientIp = req.ip || req.connection.remoteAddress || '';
|
|
// 检查是否被锁定
|
const lockRemaining = checkLoginLock(username, clientIp);
|
if (lockRemaining !== null) {
|
return res.redirect('/login?error=' + encodeURIComponent('账户已锁定，请稍后再试') + '&u=' + encodeURIComponent(username));
|
}
|
|
if (!username || !password) {
|
return res.redirect('/login?error=' + encodeURIComponent('请输入用户名和密码') + '&u=' + encodeURIComponent(username || ''));
|
}
|
|
// 验证验证码
|
const sessionCaptcha = req.session.captcha || '';
|
delete req.session.captcha;
|
if (!captcha || captcha.toLowerCase() !== sessionCaptcha) {
|
return res.redirect('/login?error=' + encodeURIComponent('验证码错误') + '&u=' + encodeURIComponent(username) + '&p=' + encodeURIComponent(password || ''));
|
}
|
|
const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
|
if (!user || !verifyPassword(password, user.password_hash)) {
|
recordLoginAttempt(username, clientIp, false);
|
return res.redirect('/login?error=' + encodeURIComponent('用户名或密码错误') + '&u=' + encodeURIComponent(username) + '&p=' + encodeURIComponent(password || ''));
|
}
|
|
// 登录成功，重新生成 Session ID（防止 Session 固定攻击）
|
recordLoginAttempt(username, clientIp, true);
|
|
return new Promise((resolve) => {
|
req.session.regenerate((err) => {
|
if (err) {
|
console.error('Session 重新生成失败:', err);
|
return res.redirect('/login?error=' + encodeURIComponent('登录失败，请重试'));
|
}
|
req.session.user = { username: user.username, role: user.role };
|
res.redirect(req.session.returnTo || '/');
|
resolve();
|
});
|
});
|
});
|
|
app.get('/logout', (req, res) => {
|
req.session.destroy(() => res.redirect('/login'));
|
});
|
|
// ========== 管理后台首页 ==========
|
app.get('/', requireAuth, (req, res) => {
|
const files = db.prepare('SELECT * FROM files ORDER BY uploaded_at DESC').all();
|
const list = files.map(f => ({
|
code: f.code,
|
originalName: f.original_name,
|
savedName: f.saved_name,
|
size: f.size,
|
mimeType: f.mime_type,
|
uploadedAt: f.uploaded_at,
|
downloads: f.downloads,
|
uploadedBy: f.uploaded_by,
|
downloadUrl: `${BASE_URL}/d/${f.code}`,
|
qrUrl: `${BASE_URL}/qr/${f.code}`
|
}));
|
res.render('index', { files: list, baseUrl: BASE_URL, user: req.session.user });
|
});
|
|
// ========== 账号管理页面 ==========
|
app.get('/users', requireAuth, (req, res) => {
|
if (req.session.user.username !== 'gwalrusadmin') {
|
return res.status(403).send('权限不足：仅超级管理员可访问');
|
}
|
res.render('users', { user: req.session.user, baseUrl: BASE_URL });
|
});
|
|
// ========== 上传文件 ==========
|
app.post('/api/upload', requireAuth, upload.single('file'), (req, res) => {
|
if (!req.file) return res.status(400).json({ error: '请选择文件' });
|
|
const code = path.parse(req.file.filename).name;
|
const now = Date.now();
|
|
// 修复 multer 接收的中文文件名乱码
|
// 浏览器 multipart/form-data 中文件名是 UTF-8 编码
|
// 但有时被错误地按 latin1 解析，导致中文显示为 丠这类乱码
|
let originalName = req.file.originalname;
|
const latin1Buf = Buffer.from(originalName, 'latin1');
|
const utf8Candidate = Iconv.decode(latin1Buf, 'utf-8');
|
// 如果 latin1→utf8 解码后有明显的 CJK 字符（一-鿿），就用它
|
if (/[\u4e00-\u9fff]/.test(utf8Candidate)) {
|
originalName = utf8Candidate;
|
}
|
|
db.prepare(`
|
INSERT INTO files (code, original_name, saved_name, size, mime_type, uploaded_at, downloads, uploaded_by)
|
VALUES (?, ?, ?, ?, ?, ?, 0, ?)
|
`).run(code, originalName, req.file.filename, req.file.size, req.file.mimetype, now, req.session.user.username);
|
req.file.originalname = originalName;
|
|
res.json({
|
code,
|
downloadUrl: `${BASE_URL}/d/${code}`,
|
qrUrl: `${BASE_URL}/qr/${code}`,
|
originalName: req.file.originalname
|
});
|
});
|
|
// ========== 删除文件 ==========
|
app.post('/api/delete/:code', requireAuth, (req, res) => {
|
const file = db.prepare('SELECT * FROM files WHERE code = ?').get(req.params.code);
|
if (!file) return res.status(404).json({ error: '文件不存在' });
|
|
const filePath = path.join(UPLOAD_DIR, file.saved_name);
|
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
|
db.prepare('DELETE FROM files WHERE code = ?').run(req.params.code);
|
res.json({ success: true });
|
});
|
|
// ========== 获取文件列表（API） ==========
|
app.get('/api/files', requireAuth, (req, res) => {
|
const files = db.prepare('SELECT * FROM files ORDER BY uploaded_at DESC').all();
|
res.json(files.map(f => ({
|
code: f.code,
|
originalName: f.original_name,
|
savedName: f.saved_name,
|
size: f.size,
|
mimeType: f.mime_type,
|
uploadedAt: f.uploaded_at,
|
downloads: f.downloads,
|
uploadedBy: f.uploaded_by,
|
downloadUrl: `${BASE_URL}/d/${f.code}`,
|
qrUrl: `${BASE_URL}/qr/${f.code}`
|
})));
|
});
|
|
// ========== 二维码数据 API ==========
|
app.get('/api/qr/:code', requireAuth, async (req, res) => {
|
const file = db.prepare('SELECT * FROM files WHERE code = ?').get(req.params.code);
|
if (!file) return res.status(404).json({ error: '文件不存在' });
|
|
const downloadUrl = `${BASE_URL}/d/${req.params.code}`;
|
try {
|
const qrDataUrl = await QRCode.toDataURL(downloadUrl, { width: 400, margin: 2 });
|
res.json({ downloadUrl, qrDataUrl });
|
} catch (err) {
|
res.status(500).json({ error: '生成二维码失败' });
|
}
|
});
|
|
// ========== 修改密码 ==========
|
app.get('/settings', requireAuth, (req, res) => {
|
res.render('settings', {
|
success: req.query.success || null,
|
error: req.query.error || null,
|
user: req.session.user,
|
baseUrl: BASE_URL
|
});
|
});
|
|
app.post('/api/change-password', requireAuth, async (req, res) => {
|
const { oldPassword, newPassword, confirmPassword } = req.body;
|
const username = req.session.user.username;
|
|
if (!oldPassword || !newPassword || !confirmPassword) {
|
return res.redirect('/settings?error=' + encodeURIComponent('请填写所有字段'));
|
}
|
if (newPassword.length < 6) {
|
return res.redirect('/settings?error=' + encodeURIComponent('新密码至少 6 位'));
|
}
|
if (newPassword !== confirmPassword) {
|
return res.redirect('/settings?error=' + encodeURIComponent('两次密码输入不一致'));
|
}
|
|
const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
|
if (!user || !verifyPassword(oldPassword, user.password_hash)) {
|
return res.redirect('/settings?error=' + encodeURIComponent('原密码错误'));
|
}
|
|
const newHash = await hashPassword(newPassword);
|
db.prepare('UPDATE users SET password_hash = ?, updated_at = ? WHERE username = ?')
|
.run(newHash, Date.now(), username);
|
|
res.redirect('/settings?success=' + encodeURIComponent('密码修改成功'));
|
});
|
|
// ========== 检查登录状态 ==========
|
app.get('/api/me', (req, res) => {
|
if (req.session && req.session.user) {
|
return res.json({ loggedIn: true, user: req.session.user });
|
}
|
res.json({ loggedIn: false });
|
});
|
|
// ========== 账号管理 API（仅 gwalrusadmin） ==========
|
|
// 获取用户列表
|
app.get('/api/users', requireAuth, requireSuperAdmin, apiLimiter, (req, res) => {
|
const users = db.prepare('SELECT id, username, role, created_at, updated_at FROM users ORDER BY created_at DESC').all();
|
res.json({ success: true, users });
|
});
|
|
// 创建用户
|
app.post('/api/users', requireAuth, requireSuperAdmin, apiLimiter, async (req, res) => {
|
const { username, password, role } = req.body;
|
|
if (!username || !password) {
|
return res.status(400).json({ error: '用户名和密码不能为空' });
|
}
|
if (username.length < 3 || username.length > 30) {
|
return res.status(400).json({ error: '用户名长度必须在 3-30 个字符之间' });
|
}
|
if (!/^[a-zA-Z0-9_]+$/.test(username)) {
|
return res.status(400).json({ error: '用户名只能包含字母、数字和下划线' });
|
}
|
if (password.length < 6) {
|
return res.status(400).json({ error: '密码长度至少 6 位' });
|
}
|
if (!['admin', 'viewer'].includes(role)) {
|
return res.status(400).json({ error: '角色必须是 admin 或 viewer' });
|
}
|
|
const existing = db.prepare('SELECT id FROM users WHERE username = ?').get(username);
|
if (existing) {
|
return res.status(409).json({ error: '用户名已存在' });
|
}
|
|
const hash = await hashPassword(password);
|
const now = Date.now();
|
db.prepare('INSERT INTO users (username, password_hash, role, created_at, updated_at) VALUES (?, ?, ?, ?, ?)')
|
.run(username, hash, role, now, now);
|
|
res.json({ success: true, message: '用户创建成功' });
|
});
|
|
// 更新用户
|
app.put('/api/users/:id', requireAuth, requireSuperAdmin, apiLimiter, async (req, res) => {
|
const userId = parseInt(req.params.id);
|
const { password, role } = req.body;
|
|
const user = db.prepare('SELECT id, username, role FROM users WHERE id = ?').get(userId);
|
if (!user) {
|
return res.status(404).json({ error: '用户不存在' });
|
}
|
|
// 不允许修改超级管理员
|
if (user.username === 'gwalrusadmin') {
|
return res.status(403).json({ error: '不能修改超级管理员账号' });
|
}
|
|
const updates = [];
|
const params = [];
|
|
if (password) {
|
if (password.length < 6) {
|
return res.status(400).json({ error: '密码长度至少 6 位' });
|
}
|
const hash = await hashPassword(password);
|
updates.push('password_hash = ?');
|
params.push(hash);
|
}
|
|
if (role) {
|
if (!['admin', 'viewer'].includes(role)) {
|
return res.status(400).json({ error: '角色必须是 admin 或 viewer' });
|
}
|
updates.push('role = ?');
|
params.push(role);
|
}
|
|
if (updates.length === 0) {
|
return res.status(400).json({ error: '没有要更新的字段' });
|
}
|
|
updates.push('updated_at = ?');
|
params.push(Date.now());
|
params.push(userId);
|
|
db.prepare(`UPDATE users SET ${updates.join(', ')} WHERE id = ?`).run(...params);
|
res.json({ success: true, message: '用户更新成功' });
|
});
|
|
// 删除用户
|
app.delete('/api/users/:id', requireAuth, requireSuperAdmin, apiLimiter, (req, res) => {
|
const userId = parseInt(req.params.id);
|
|
const user = db.prepare('SELECT id, username FROM users WHERE id = ?').get(userId);
|
if (!user) {
|
return res.status(404).json({ error: '用户不存在' });
|
}
|
|
// 不允许删除超级管理员
|
if (user.username === 'gwalrusadmin') {
|
return res.status(403).json({ error: '不能删除超级管理员账号' });
|
}
|
|
// 不允许删除自己
|
if (user.username === req.session.user.username) {
|
return res.status(403).json({ error: '不能删除当前登录的账号' });
|
}
|
|
db.prepare('DELETE FROM users WHERE id = ?').run(userId);
|
res.json({ success: true, message: '用户删除成功' });
|
});
|
|
// ========== 公开下载 / 二维码 ==========
|
|
app.get('/d/:code', (req, res) => {
|
const file = db.prepare('SELECT * FROM files WHERE code = ?').get(req.params.code);
|
if (!file) return res.status(404).send('文件不存在或已过期');
|
|
const filePath = path.join(UPLOAD_DIR, file.saved_name);
|
if (!fs.existsSync(filePath)) {
|
db.prepare('DELETE FROM files WHERE code = ?').run(req.params.code);
|
return res.status(404).send('文件已被删除');
|
}
|
|
db.prepare('UPDATE files SET downloads = downloads + 1 WHERE code = ?').run(req.params.code);
|
|
// 中文文件名编码处理
|
const encodedName = encodeURIComponent(file.original_name);
|
res.setHeader('Content-Disposition', `attachment; filename="${encodedName}"; filename*=UTF-8''${encodedName}`);
|
|
// 设置正确的 Content-Type 和 Content-Length
|
const stat = fs.statSync(filePath);
|
res.setHeader('Content-Length', stat.size);
|
res.setHeader('Content-Type', file.mime_type || 'application/octet-stream');
|
|
// 使用流式传输，添加完整的错误处理
|
const fileStream = fs.createReadStream(filePath);
|
fileStream.on('error', (err) => {
|
console.error(`下载文件时出错: ${err.message}`);
|
if (!res.headersSent) {
|
res.status(500).send('文件读取失败');
|
}
|
});
|
fileStream.on('open', () => {
|
fileStream.pipe(res);
|
});
|
});
|
|
app.get('/qr/:code', async (req, res) => {
|
const file = db.prepare('SELECT * FROM files WHERE code = ?').get(req.params.code);
|
if (!file) return res.status(404).send('文件不存在');
|
|
const downloadUrl = `${BASE_URL}/d/${req.params.code}`;
|
try {
|
const qrDataUrl = await QRCode.toDataURL(downloadUrl, { width: 400, margin: 2 });
|
const base64 = qrDataUrl.replace(/^data:image\/png;base64,/, '');
|
const img = Buffer.from(base64, 'base64');
|
res.writeHead(200, {
|
'Content-Type': 'image/png',
|
'Content-Length': img.length
|
});
|
res.end(img);
|
} catch (err) {
|
res.status(500).send('生成二维码失败');
|
}
|
});
|
|
// ========== 启动 ==========
|
app.listen(PORT, '0.0.0.0', () => {
|
console.log(`📄 文档管理系统启动成功！`);
|
console.log(`🌐 管理后台: ${BASE_URL}`);
|
console.log(`📂 上传目录: ${UPLOAD_DIR}`);
|
console.log(`🗄️ 数据库: ${DB_PATH} (SQLite)`);
|
console.log(`👤 默认超级管理员: gwalrusadmin / ${process.env.ADMIN_PASSWORD || 'admin123'}`);
|
console.log(`🔒 安全加固：bcrypt 密码加密 + 速率限制 + 文件类型白名单`);
|
});
|
