JOJO
9edc366cf9
①图鉴隐藏测试模式：连点标题'军'字10次开关，纯内存标志位全部军械可见可演示，不动SAVE.codex（persist/submitRun读它，动了会污染后端），刷新失效 ②24件主武器说明文案全部替换（用户提供梗文案）；演示页介绍单行显示、去掉类别前缀、删'实战模拟·自动驾驶'提示行 ③新主武器'巡飞弹'(loiter)：慢攻速追踪导弹（制导引擎新增maxSpd上限5保持中速），命中留火场（zones新kind:fire纯粒子火舌，无圆形区域）+分裂4枚小炸弹快爆；新精灵loms；CODEX_KEYS同步63 ④存档云同步：星币/机体/选中机体/永久强化/本地纪录上服务端（player_state表+POST /api/state+vState白名单清洗）；login/me/register响应带state；客户端persist()钩子防抖600ms自动上传；服务端整体替换本地防串号，登出全清；老账号首登自动上传本地存档迁移 ⑤机体选择/购买从出击准备并入机库强化（buildShips）；出击默认无尽模式 服务端已重启生效；/api/state全链路在独立测试库curl验证通过（合法推送/回读/非法拦截清洗/401）
187 lines
10 KiB
JavaScript
187 lines
10 KiB
JavaScript
"use strict";
|
||
/* ================= API 处理器 =================
|
||
所有 SQL 均为 prepared statement，禁止字符串拼接用户输入 */
|
||
const db = require("./db");
|
||
const auth = require("./auth");
|
||
const { vUsername, vEmail, vPassword, vInt, rateLimit, clientIp } = require("./util");
|
||
|
||
/* 图鉴合法 key 白名单（与 js/data.js 保持同步：24主武+17副武+13僚机+8被动=62） */
|
||
const CODEX_KEYS = new Set([
|
||
"vulcan", "shotgun", "needle", "flame", "shotgun2", "tesla", "railgun", "deathray",
|
||
"crescent", "fission", "frost", "swarm", "bubble", "starfall", "boomerang", "singularity",
|
||
"wavecannon", "holy", "thundercall", "arcshu", "volt", "dawn", "proto", "nebula", "loiter",
|
||
"broad", "sweep", "leech", "orbit", "sats", "pd", "slowfield", "flares", "seeker",
|
||
"beamdrone", "frostnova", "thorns", "sticky", "magnetar", "executor", "airstrike", "repair",
|
||
"gunner", "gunner2", "sniperd", "beamer", "bomber", "frostd", "teslaD", "rammer",
|
||
"healer", "shieldd", "missileD", "bladeD", "sweeper",
|
||
"fire", "crit", "shield", "nano", "mag", "bounty", "odcore", "ghost",
|
||
]);
|
||
const CODEX_TOTAL = CODEX_KEYS.size;
|
||
const RUN_MODES = new Set(["stage", "endless", "rush"]);
|
||
/* 存档白名单（与 js/data.js SHIPS、js/ui.js META 保持同步） */
|
||
const SHIP_KEYS = new Set(["falcon", "ghost", "bastion", "valkyrie"]);
|
||
const META_MAX = { weapon: 2, armor: 2, hpup: 2, luck: 2, wallet: 3, mag2: 2, odstart: 1 };
|
||
const DEFAULT_STATE = { coins: 0, ships: ["falcon"], ship: "falcon", m: {}, best: { s0: 0, s1: 0, e0: 0, e1: 0, stage: 0 }, rush: {} };
|
||
|
||
const qInsUser = db.prepare("INSERT INTO users(username,email,pass_hash,created_at) VALUES(?,?,?,?)");
|
||
const qInsStats = db.prepare("INSERT OR IGNORE INTO user_stats(user_id) VALUES(?)");
|
||
const qByName = db.prepare("SELECT * FROM users WHERE username=?");
|
||
const qByEmail = db.prepare("SELECT * FROM users WHERE email=?");
|
||
const qCodex = db.prepare("SELECT entry_key FROM codex_unlocks WHERE user_id=?");
|
||
const qInsCodex = db.prepare("INSERT OR IGNORE INTO codex_unlocks(user_id,entry_key,unlocked_at) VALUES(?,?,?)");
|
||
const qStats = db.prepare("SELECT * FROM user_stats WHERE user_id=?");
|
||
const qInsRun = db.prepare("INSERT INTO runs(user_id,mode,diff,score,wave,stage,time_sec,boss_kills,win,created_at) VALUES(?,?,?,?,?,?,?,?,?,?)");
|
||
const qUpdStats = db.prepare(`INSERT INTO user_stats(user_id,boss_kills,endless_high,runs,updated_at) VALUES(?,?,?,?,?)
|
||
ON CONFLICT(user_id) DO UPDATE SET
|
||
boss_kills=boss_kills+excluded.boss_kills,
|
||
endless_high=MAX(endless_high,excluded.endless_high),
|
||
runs=runs+1,
|
||
updated_at=excluded.updated_at`);
|
||
const qGetState = db.prepare("SELECT state FROM player_state WHERE user_id=?");
|
||
const qPutState = db.prepare(`INSERT INTO player_state(user_id,state,updated_at) VALUES(?,?,?)
|
||
ON CONFLICT(user_id) DO UPDATE SET state=excluded.state, updated_at=excluded.updated_at`);
|
||
|
||
function statsOf(userId) {
|
||
const s = qStats.get(userId) || { boss_kills: 0, endless_high: 0, runs: 0 };
|
||
return { bossKills: s.boss_kills, endlessHigh: s.endless_high, runs: s.runs };
|
||
}
|
||
function codexOf(userId) {
|
||
return qCodex.all(userId).map((r) => r.entry_key);
|
||
}
|
||
function stateOf(userId) {
|
||
const r = qGetState.get(userId);
|
||
if (!r) return null; // null=从未同步（老账号首次登陆：客户端用本地存档初始化上传）
|
||
try { return JSON.parse(r.state); } catch (e) { return null; }
|
||
}
|
||
|
||
/* 存档白名单校验：只留合法字段并 clamp，任何字段非法则整体拒收 */
|
||
function vState(s) {
|
||
if (!s || typeof s !== "object" || Array.isArray(s)) return null;
|
||
if (!vInt(s.coins, 0, 1e7)) return null;
|
||
if (!Array.isArray(s.ships)) return null;
|
||
const ships = [...new Set(s.ships.filter((k) => SHIP_KEYS.has(k)))].slice(0, 8);
|
||
if (!ships.includes("falcon")) ships.unshift("falcon");
|
||
const ship = SHIP_KEYS.has(s.ship) ? s.ship : "falcon";
|
||
const m = {};
|
||
if (s.m && typeof s.m === "object") for (const k of Object.keys(META_MAX))
|
||
if (vInt(s.m[k], 0, META_MAX[k])) m[k] = s.m[k];
|
||
const best = { s0: 0, s1: 0, e0: 0, e1: 0, stage: 0 };
|
||
if (s.best && typeof s.best === "object") for (const k of Object.keys(best))
|
||
if (vInt(s.best[k], 0, 1e8)) best[k] = s.best[k];
|
||
const rush = {};
|
||
if (s.rush && typeof s.rush === "object") for (const k of Object.keys(s.rush).slice(0, 32))
|
||
if (/^\d{1,2}$/.test(k) && vInt(s.rush[k], 0, 8640000)) rush[k] = s.rush[k];
|
||
return { coins: s.coins, ships, ship, m, best, rush };
|
||
}
|
||
|
||
/* ---------- POST /api/register ---------- */
|
||
function register(req, res, ctx, body) {
|
||
if (!rateLimit("reg:" + ctx.ip, 10, 5 * 60000)) return ctx.fail(429, "操作太频繁，请稍后再试");
|
||
const username = body && body.username, email = body && body.email, password = body && body.password;
|
||
if (!vUsername(username)) return ctx.fail(400, "用户名需为 2-16 位（中文/英文/数字/下划线）");
|
||
if (!vEmail(email)) return ctx.fail(400, "邮箱格式不正确");
|
||
if (!vPassword(password)) return ctx.fail(400, "密码需为 8-72 位");
|
||
if (qByName.get(username)) return ctx.fail(409, "用户名已被注册");
|
||
if (qByEmail.get(email)) return ctx.fail(409, "邮箱已被注册");
|
||
const info = qInsUser.run(username.trim(), email.trim().toLowerCase(), auth.hashPassword(password), Date.now());
|
||
const uid = Number(info.lastInsertRowid);
|
||
qInsStats.run(uid);
|
||
const token = auth.createSession(db, uid);
|
||
ctx.setCookie = auth.sessionCookie(token, ctx.secure);
|
||
return ctx.ok({ user: { username, email: email.trim().toLowerCase() }, stats: statsOf(uid), codex: [], codexTotal: CODEX_TOTAL, state: DEFAULT_STATE });
|
||
}
|
||
|
||
/* ---------- POST /api/login ---------- */
|
||
function login(req, res, ctx, body) {
|
||
if (!rateLimit("login:" + ctx.ip, 20, 5 * 60000)) return ctx.fail(429, "尝试太频繁，请稍后再试");
|
||
const id = body && body.id, password = body && body.password;
|
||
if (typeof id !== "string" || typeof password !== "string" || id.length > 64 || password.length > 72)
|
||
return ctx.fail(401, "用户名或密码错误");
|
||
const u = id.includes("@") ? qByEmail.get(id.trim().toLowerCase()) : qByName.get(id.trim());
|
||
/* 统一错误信息，不泄露账号是否存在；对不存在账号也跑一次哈希，防时序探测 */
|
||
const hash = u ? u.pass_hash : "0".repeat(32) + ":" + "0".repeat(128);
|
||
if (!auth.verifyPassword(password, hash) || !u) return ctx.fail(401, "用户名或密码错误");
|
||
qInsStats.run(u.id);
|
||
const token = auth.createSession(db, u.id);
|
||
ctx.setCookie = auth.sessionCookie(token, ctx.secure);
|
||
return ctx.ok({ user: { username: u.username, email: u.email }, stats: statsOf(u.id), codex: codexOf(u.id), codexTotal: CODEX_TOTAL, state: stateOf(u.id) });
|
||
}
|
||
|
||
/* ---------- POST /api/logout ---------- */
|
||
function logout(req, res, ctx) {
|
||
auth.destroySession(db, ctx.token);
|
||
ctx.setCookie = auth.clearCookie(ctx.secure);
|
||
return ctx.ok({ bye: true });
|
||
}
|
||
|
||
/* ---------- GET /api/me（未登录返回 user:null，不产生 401 控制台噪音） ---------- */
|
||
function me(req, res, ctx) {
|
||
const u = ctx.user;
|
||
if (!u) return ctx.ok({ user: null });
|
||
return ctx.ok({ user: { username: u.username, email: u.email, createdAt: u.created_at }, stats: statsOf(u.id), codex: codexOf(u.id), codexTotal: CODEX_TOTAL, state: stateOf(u.id) });
|
||
}
|
||
|
||
/* ---------- GET /api/leaderboard?sort=endless|boss|codex ---------- */
|
||
const LB_COLS = { endless: "endless_high", boss: "boss_kills", codex: "codexN" };
|
||
function leaderboard(req, res, ctx, _body, query) {
|
||
const col = LB_COLS[(query && query.get("sort")) || ""] || "endless_high";
|
||
/* col 来自上方白名单映射，非用户输入直接拼接 */
|
||
const rows = db.prepare(`
|
||
SELECT u.username AS username, s.boss_kills AS bossKills, s.endless_high AS endlessHigh,
|
||
(SELECT COUNT(*) FROM codex_unlocks c WHERE c.user_id=u.id) AS codexN
|
||
FROM users u JOIN user_stats s ON s.user_id=u.id
|
||
ORDER BY ${col} DESC, u.id ASC LIMIT 100`).all();
|
||
return ctx.ok({ rows, codexTotal: CODEX_TOTAL, sort: col });
|
||
}
|
||
|
||
/* ---------- POST /api/run ----------
|
||
结算上报：基础合理性校验（客户端游戏无法杜绝作弊，只挡低级伪造） */
|
||
function run(req, res, ctx, body) {
|
||
if (!rateLimit("run:" + ctx.user.id, 20, 5 * 60000)) return ctx.fail(429, "上报太频繁");
|
||
const b = body || {};
|
||
if (!RUN_MODES.has(b.mode)) return ctx.fail(400, "非法模式");
|
||
if (!vInt(b.diff, 0, 1)) return ctx.fail(400, "非法难度");
|
||
if (!vInt(b.score, 0, 1e8)) return ctx.fail(400, "非法分数");
|
||
if (!vInt(b.wave, 0, 9999) || !vInt(b.stage, 0, 99)) return ctx.fail(400, "非法进度");
|
||
if (!vInt(b.timeSec, 0, 86400)) return ctx.fail(400, "非法时长");
|
||
if (!vInt(b.bossKills, 0, 60)) return ctx.fail(400, "非法击坠数");
|
||
const keys = Array.isArray(b.codex) ? b.codex.slice(0, 100).filter((k) => CODEX_KEYS.has(k)) : [];
|
||
|
||
const uid = ctx.user.id, now = Date.now();
|
||
/* endless_high 只认本账号实际上报的无尽对局分数（不收 localStorage 历史值——浏览器级共享会串号，已踩坑） */
|
||
const endlessCand = b.mode === "endless" ? b.score : 0;
|
||
db.exec("BEGIN");
|
||
try {
|
||
qInsRun.run(uid, b.mode, b.diff, b.score, b.wave, b.stage, b.timeSec, b.bossKills, b.win ? 1 : 0, now);
|
||
qUpdStats.run(uid, b.bossKills, endlessCand, 1, now);
|
||
for (const k of keys) qInsCodex.run(uid, k, now);
|
||
db.exec("COMMIT");
|
||
} catch (e) {
|
||
db.exec("ROLLBACK");
|
||
throw e;
|
||
}
|
||
return ctx.ok({ stats: statsOf(uid), codex: codexOf(uid), codexTotal: CODEX_TOTAL });
|
||
}
|
||
|
||
/* ---------- POST /api/state ----------
|
||
存档云同步：星币/机体/选中机体/永久强化/本地纪录（防抖由客户端负责） */
|
||
function saveState(req, res, ctx, body) {
|
||
if (!rateLimit("state:" + ctx.user.id, 60, 5 * 60000)) return ctx.fail(429, "同步太频繁");
|
||
const st = vState(body && body.state);
|
||
if (!st) return ctx.fail(400, "非法存档数据");
|
||
qPutState.run(ctx.user.id, JSON.stringify(st), Date.now());
|
||
return ctx.ok({ saved: true });
|
||
}
|
||
|
||
const ROUTES = {
|
||
"POST /api/register": { fn: register, auth: false },
|
||
"POST /api/login": { fn: login, auth: false },
|
||
"POST /api/logout": { fn: logout, auth: true },
|
||
"GET /api/me": { fn: me, auth: false },
|
||
"GET /api/leaderboard": { fn: leaderboard, auth: true },
|
||
"POST /api/run": { fn: run, auth: true },
|
||
"POST /api/state": { fn: saveState, auth: true },
|
||
};
|
||
|
||
module.exports = { ROUTES, CODEX_TOTAL };
|