序章 · 服务端积分后端

/* 序章 · 服务端积分后端  Cloudflare Workers + KV */

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    const path = url.pathname.replace(/\/+$/, '') || '/';
    const cors = {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'GET,POST,OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type',
      'Access-Control-Max-Age': '86400'
    };
    if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: cors });
    if (path === '/' || path === '/health') {
      return json({ ok: true, service: 'xuzhang-points', init: INIT_POINTS, cost: COST }, 200, cors);
    }

    let body = {};
    if (request.method === 'POST') {
      try { body = await request.json(); } catch (e) { body = {}; }
    } else {
      body = Object.fromEntries(url.searchParams);
    }

    try {
      if (path === '/api/points') return json(await getPoints(env, body), 200, cors);
      if (path === '/api/consume') return json(await consume(env, body, request), 200, cors);
      if (path === '/api/redeem') return json(await redeem(env, body), 200, cors);
      if (path === '/api/admin/grant') return json(await grant(env, body), 200, cors);
      if (path === '/api/admin/codes') return json(await makeCodes(env, body), 200, cors);
      if (path === '/api/admin/users') return json(await listUsers(env, body), 200, cors);
      if (path === '/api/admin/stats') return json(await stats(env, body), 200, cors);
      return json({ ok: false, error: 'not_found' }, 404, cors);
    } catch (err) {
      return json({ ok: false, error: 'server_error', detail: String(err) }, 500, cors);
    }
  }
};

const UNIT = 1000;
const INIT_POINTS = 10;
const COST = { chat: 1, diagram: 0.1, qrcode: 0.01 };
const NEW_UID_LIMIT = 20;

function json(data, status = 200, cors = {}) {
  return new Response(JSON.stringify(data), {
    status,
    headers: { 'Content-Type': 'application/json; charset=utf-8', ...cors }
  });
}
const toUnit = (p) => Math.round(Number(p) * UNIT);
const toPoint = (u) => Math.round(Number(u)) / UNIT;
const now = () => Date.now();

async function readUnits(env, uid) {
  const raw = await env.POINTS.get('u:' + uid);
  return raw === null ? null : (parseInt(raw, 10) || 0);
}
async function writeUnits(env, uid, units, extra) {
  await env.POINTS.put('u:' + uid, String(units), {
    metadata: { updatedAt: now(), ...extra }
  });
}

async function ensureUser(env, uid, req) {
  const cur = await readUnits(env, uid);
  if (cur !== null) return cur;
  const ip = (req && req.headers.get('cf-connecting-ip')) || (req && req.headers.get('x-forwarded-for')) || 'unknown';
  const day = Math.floor(now() / 86400000);
  const k = `ip:${ip}:${day}`;
  const used = parseInt((await env.POINTS.get(k)) || '0', 10);
  const limit = parseInt(env.NEW_UID_LIMIT || String(NEW_UID_LIMIT), 10);
  if (used >= limit) return 'LIMIT';
  await env.POINTS.put(k, String(used + 1), { expirationTtl: 172800 });
  const units = toUnit(parseFloat(env.INIT_POINTS || String(INIT_POINTS)));
  await writeUnits(env, uid, units, { createdAt: now(), ip });
  return units;
}

async function costOf(env, action, custom) {
  if (action === 'custom' && custom != null) return toUnit(Number(custom));
  const table = { chat: 1, diagram: 0.1, qrcode: 0.01 };
  const c = table[action];
  if (c == null) return null;
  return toUnit(parseFloat(env.COST_CHAT ? env.COST_CHAT : c));
}

async function getPoints(env, body) {
  const uid = String(body.uid || '').trim();
  if (!uid) return { ok: false, error: 'missing_uid' };
  let units = await readUnits(env, uid);
  if (units === null) units = await ensureUser(env, uid, null);
  if (units === 'LIMIT') return { ok: false, error: 'new_uid_limit' };
  return { ok: true, uid, points: toPoint(units), units };
}

async function consume(env, body, request) {
  const uid = String(body.uid || '').trim();
  const action = String(body.action || 'chat');
  if (!uid) return { ok: false, error: 'missing_uid' };
  if (!(await checkSign(env, body))) return { ok: false, error: 'bad_sign' };
  const cost = await costOf(env, action, body.cost);
  if (cost === null) return { ok: false, error: 'unknown_action' };

  for (let i = 0; i < 6; i++) {
    let units = await readUnits(env, uid);
    if (units === null) units = await ensureUser(env, uid, request);
    if (units === 'LIMIT') return { ok: false, error: 'new_uid_limit' };
    if (units < cost) return { ok: false, error: 'insufficient', points: toPoint(units), need: toPoint(cost) };
    const next = units - cost;
    await writeUnits(env, uid, next, { lastAction: action });
    const check = await readUnits(env, uid);
    if (check === next || i === 5) {
      return { ok: true, uid, action, cost: toPoint(cost), points: toPoint(next) };
    }
  }
  return { ok: false, error: 'busy' };
}

async function redeem(env, body) {
  const uid = String(body.uid || '').trim();
  const code = String(body.code || '').trim().toUpperCase().replace(/[^A-Z0-9]/g, '');
  if (!uid || !code) return { ok: false, error: 'missing_params' };
  const key = 'c:' + code;
  const val = await env.POINTS.get(key);
  if (val === null) return { ok: false, error: 'invalid_code' };
  const data = JSON.parse(val);
  if (data.used) return { ok: false, error: 'used_code' };
  await env.POINTS.delete(key);
  let units = await readUnits(env, uid);
  if (units === null) units = 0;
  const next = units + toUnit(data.points);
  await writeUnits(env, uid, next, { redeemed: code });
  return { ok: true, uid, add: data.points, points: toPoint(next) };
}

async function grant(env, body) {
  if (!adminOk(env, body.token)) return { ok: false, error: 'forbidden' };
  const uid = String(body.uid || '').trim();
  const amount = Number(body.amount);
  if (!uid || isNaN(amount)) return { ok: false, error: 'missing_params' };
  let units = await readUnits(env, uid);
  if (units === null) units = 0;
  const next = Math.max(0, units + toUnit(amount));
  await writeUnits(env, uid, next, { byAdmin: true });
  return { ok: true, uid, delta: amount, points: toPoint(next) };
}

async function makeCodes(env, body) {
  if (!adminOk(env, body.token)) return { ok: false, error: 'forbidden' };
  const count = Math.min(parseInt(body.count || '1', 10), 200);
  const points = Number(body.points || '10');
  const out = [];
  const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
  for (let i = 0; i < count; i++) {
    let raw = '';
    const arr = new Uint8Array(12);
    crypto.getRandomValues(arr);
    for (let j = 0; j < 12; j++) raw += chars[arr[j] % chars.length];
    const code = raw.match(/.{4}/g).join('-');
    await env.POINTS.put('c:' + raw, JSON.stringify({ points, used: false, at: now() }));
    out.push(code);
  }
  return { ok: true, count, points, codes: out };
}

async function listUsers(env, body) {
  if (!adminOk(env, body.token)) return { ok: false, error: 'forbidden' };
  const limit = Math.min(parseInt(body.limit || '100', 10), 500);
  const list = await env.POINTS.list({ prefix: 'u:', limit });
  const items = [];
  for (const k of list.keys) {
    const v = await env.POINTS.get(k.name);
    const meta = k.metadata || {};
    items.push({ uid: k.name.slice(2), points: toPoint(parseInt(v || '0', 10)), createdAt: meta.createdAt || 0, updatedAt: meta.updatedAt || 0 });
  }
  items.sort((a, b) => b.updatedAt - a.updatedAt);
  return { ok: true, count: items.length, users: items };
}

async function stats(env, body) {
  if (!adminOk(env, body.token)) return { ok: false, error: 'forbidden' };
  const u = await env.POINTS.list({ prefix: 'u:', limit: 1000 });
  const c = await env.POINTS.list({ prefix: 'c:', limit: 1000 });
  let total = 0;
  for (const k of u.keys) total += parseInt((await env.POINTS.get(k.name)) || '0', 10);
  return { ok: true, users: u.keys.length, codesLeft: c.keys.length, totalPoints: toPoint(total) };
}

function adminOk(env, token) {
  const t = String(token || '');
  const r = String(env.ADMIN_TOKEN || '');
  if (!r) return false;
  if (t.length !== r.length) return false;
  let diff = 0;
  for (let i = 0; i < t.length; i++) diff |= t.charCodeAt(i) ^ r.charCodeAt(i);
  return diff === 0;
}

async function checkSign(env, body) {
  const secret = env.SIGN_SECRET;
  if (!secret) return true;
  const { uid, action, ts, sign } = body;
  if (!ts || !sign || Math.abs(now() - Number(ts)) > 300000) return false;
  const enc = new TextEncoder();
  const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(`${uid}:${action}:${ts}`));
  const hex = [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, '0')).join('');
  return hex === String(sign).toLowerCase();
}