feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,181 @@
|
||||
<?php
|
||||
// +----------------------------------------------------------------------
|
||||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||||
// +----------------------------------------------------------------------
|
||||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||||
// +----------------------------------------------------------------------
|
||||
// | Author: ywxapp<admin@ywxapp.cn>
|
||||
// +----------------------------------------------------------------------
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace addon\iot\service;
|
||||
|
||||
use think\facade\Db;
|
||||
|
||||
/**
|
||||
* 设备分组服务（智慧生活：房间/自定义分组）
|
||||
*
|
||||
* 权限模型：
|
||||
* - member_id=0 → 后台全局分组（所有会员可见）
|
||||
* - member_id>0 → 仅归属会员可见/可管理
|
||||
*/
|
||||
class GroupService
|
||||
{
|
||||
/** 确保分组表存在（自愈） */
|
||||
public static function ensureTables(): bool
|
||||
{
|
||||
$prefix = Db::connect()->getConfig('prefix') ?: 'wxapp_';
|
||||
try {
|
||||
Db::execute("CREATE TABLE IF NOT EXISTS `{$prefix}iot_group` (
|
||||
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
||||
`member_id` int unsigned NOT NULL DEFAULT '0',
|
||||
`title` varchar(64) NOT NULL DEFAULT '', `type` varchar(16) NOT NULL DEFAULT 'room',
|
||||
`sort` int NOT NULL DEFAULT '0',
|
||||
`create_at` int DEFAULT NULL, `update_at` int DEFAULT NULL,
|
||||
PRIMARY KEY (`id`), KEY `idx_member` (`member_id`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
|
||||
Db::execute("CREATE TABLE IF NOT EXISTS `{$prefix}iot_group_device` (
|
||||
`id` int unsigned NOT NULL AUTO_INCREMENT,
|
||||
`group_id` int unsigned NOT NULL DEFAULT '0',
|
||||
`device_id` int unsigned NOT NULL DEFAULT '0',
|
||||
`create_at` int DEFAULT NULL,
|
||||
PRIMARY KEY (`id`), UNIQUE KEY `uk_group_device` (`group_id`,`device_id`),
|
||||
KEY `idx_device` (`device_id`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
|
||||
return true;
|
||||
} catch (\Throwable $e) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/** 校验分组归属（memberId>0 时仅自己；0 可见全局+自己） */
|
||||
protected static function checkOwner(int $groupId, int $memberId): void
|
||||
{
|
||||
$g = Db::name('iot_group')->where('id', $groupId)->find();
|
||||
if (!$g) {
|
||||
throw new \RuntimeException('分组不存在');
|
||||
}
|
||||
if ($memberId > 0 && (int) $g['member_id'] !== $memberId && (int) $g['member_id'] !== 0) {
|
||||
throw new \RuntimeException('无权操作该分组');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 创建/编辑分组
|
||||
* @return int 分组ID
|
||||
*/
|
||||
public static function save(array $data): int
|
||||
{
|
||||
self::ensureTables();
|
||||
$id = (int) ($data['id'] ?? 0);
|
||||
$title = mb_substr(trim((string) ($data['title'] ?? '')), 0, 64);
|
||||
if ($title === '') {
|
||||
throw new \InvalidArgumentException('分组名不能为空');
|
||||
}
|
||||
$now = time();
|
||||
$row = [
|
||||
'member_id' => (int) ($data['member_id'] ?? 0),
|
||||
'title' => $title,
|
||||
'type' => ($data['type'] ?? 'room') === 'custom' ? 'custom' : 'room',
|
||||
'sort' => max(0, (int) ($data['sort'] ?? 0)),
|
||||
'update_at' => $now,
|
||||
];
|
||||
if ($id > 0) {
|
||||
self::checkOwner($id, $row['member_id']);
|
||||
Db::name('iot_group')->where('id', $id)->update($row);
|
||||
} else {
|
||||
$row['create_at'] = $now;
|
||||
$id = (int) Db::name('iot_group')->insertGetId($row);
|
||||
}
|
||||
return $id;
|
||||
}
|
||||
|
||||
/** 删除分组（连带关联） */
|
||||
public static function remove(int $groupId, int $memberId = 0): void
|
||||
{
|
||||
self::checkOwner($groupId, $memberId);
|
||||
Db::name('iot_group')->where('id', $groupId)->delete();
|
||||
Db::name('iot_group_device')->where('group_id', $groupId)->delete();
|
||||
}
|
||||
|
||||
/** 分组列表（会员可见：全局 + 自己的），带设备数与在线数 */
|
||||
public static function groups(int $memberId = 0): array
|
||||
{
|
||||
self::ensureTables();
|
||||
$q = Db::name('iot_group');
|
||||
if ($memberId > 0) {
|
||||
$q->where('member_id', 0)->whereOr('member_id', $memberId);
|
||||
}
|
||||
$rows = $q->order('sort', 'asc')->order('id', 'asc')->select()->toArray();
|
||||
foreach ($rows as &$g) {
|
||||
$deviceIds = Db::name('iot_group_device')->where('group_id', $g['id'])->column('device_id');
|
||||
$g['device_count'] = count($deviceIds);
|
||||
$g['online_count'] = 0;
|
||||
if ($deviceIds) {
|
||||
$uuids = Db::name('iot_device')->whereIn('id', $deviceIds)->column('uuid');
|
||||
foreach ($uuids as $u) {
|
||||
if (DeviceService::isOnline($u)) {
|
||||
$g['online_count']++;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return $rows;
|
||||
}
|
||||
|
||||
/** 设备加入分组（幂等） */
|
||||
public static function addDevice(int $groupId, int $deviceId, int $memberId = 0): void
|
||||
{
|
||||
self::checkOwner($groupId, $memberId);
|
||||
$exists = Db::name('iot_group_device')
|
||||
->where('group_id', $groupId)->where('device_id', $deviceId)->count();
|
||||
if ($exists > 0) {
|
||||
return;
|
||||
}
|
||||
Db::name('iot_group_device')->insert([
|
||||
'group_id' => $groupId, 'device_id' => $deviceId, 'create_at' => time(),
|
||||
]);
|
||||
}
|
||||
|
||||
/** 设备移出分组 */
|
||||
public static function removeDevice(int $groupId, int $deviceId, int $memberId = 0): void
|
||||
{
|
||||
self::checkOwner($groupId, $memberId);
|
||||
Db::name('iot_group_device')
|
||||
->where('group_id', $groupId)->where('device_id', $deviceId)->delete();
|
||||
}
|
||||
|
||||
/** 组内设备（含在线/影子增强字段） */
|
||||
public static function devicesByGroup(int $groupId, int $memberId = 0): array
|
||||
{
|
||||
self::checkOwner($groupId, $memberId);
|
||||
$deviceIds = Db::name('iot_group_device')->where('group_id', $groupId)->column('device_id');
|
||||
if (!$deviceIds) {
|
||||
return ['list' => [], 'total' => 0];
|
||||
}
|
||||
$devices = Db::name('iot_device')->whereIn('id', $deviceIds)->select()->toArray();
|
||||
foreach ($devices as &$d) {
|
||||
$d['online'] = DeviceService::isOnline($d['uuid']);
|
||||
$shadow = DeviceService::shadow($d['uuid']);
|
||||
$d['shadow'] = $shadow ? $shadow['payload'] : '';
|
||||
}
|
||||
return ['list' => $devices, 'total' => count($devices)];
|
||||
}
|
||||
|
||||
/** 设备所在分组（供设备详情展示） */
|
||||
public static function groupsOfDevice(int $deviceId): array
|
||||
{
|
||||
$gids = Db::name('iot_group_device')->where('device_id', $deviceId)->column('group_id');
|
||||
if (!$gids) {
|
||||
return [];
|
||||
}
|
||||
return Db::name('iot_group')->whereIn('id', $gids)->column('title');
|
||||
}
|
||||
|
||||
/** 解绑/删除设备时清关联 */
|
||||
public static function clearDevice(int $deviceId): void
|
||||
{
|
||||
Db::name('iot_group_device')->where('device_id', $deviceId)->delete();
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user