嵌入第三方web系统

package nexus.io.mosskb.controller;

import com.alibaba.fastjson2.JSONObject;

import nexus.io.annotation.Get;
import nexus.io.annotation.Post;
import nexus.io.annotation.RequestPath;
import nexus.io.jfinal.aop.Aop;
import nexus.io.mosskb.service.kb.MossKbApplicationEmbedService;
import nexus.io.model.result.ResultVo;
import nexus.io.tio.boot.http.TioRequestContext;
import nexus.io.tio.http.common.HttpRequest;
import nexus.io.tio.http.common.HttpResponse;
import nexus.io.tio.http.server.util.Resps;
import nexus.io.tio.utils.hutool.StrUtil;

@RequestPath("/api/application")
public class ApiApplicationController {

  /**
   * 浮窗嵌入：返回一段脚本，第三方页面引入后在右下角挂出对话入口。
   * 脚本按站点地址拼出对话页地址，并带上编排声明的接口入参。
   */
  @Get("/embed")
  public HttpResponse embed(HttpRequest request) {
    String protocol = request.getParam("protocol");
    String host = request.getParam("host");
    Long token = longParam(request, "token");
    return Resps.js(request, Aop.get(MossKbApplicationEmbedService.class).script(protocol, host, token, request.getParam()));
  }

  /** 查询串里的整型参数：缺省或不是数字时返回 null，由调用方给出默认行为。 */
  private Long longParam(HttpRequest request, String name) {
    String value = request.getParam(name);
    if (StrUtil.isBlank(value)) {
      return null;
    }
    try {
      return Long.valueOf(value.trim());
    } catch (NumberFormatException e) {
      return null;
    }
  }
}

package nexus.io.mosskb.service.kb;

import java.util.List;
import java.util.Map;
import java.util.regex.Pattern;

import com.alibaba.fastjson2.JSONObject;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;
import nexus.io.tio.utils.hutool.StrUtil;

public class MossKbApplicationEmbedService {

  /** 允许的协议：只有 http 与 https 能拼进脚本里的地址。 */
  private static final List<String> SUPPORTED_PROTOCOLS = List.of("http", "https");

  /** 主机名（含可选端口）。取值来自查询串，限制字符集后拼进地址，避免注入。 */
  private static final Pattern HOST = Pattern.compile("[A-Za-z0-9._-]{1,253}(:[0-9]{1,5})?");

  /** 浮窗图标：随前端一起发布的图片，与前端同源。 */
  private static final String FLOAT_ICON_PATH = "/ui/MossKB.gif";

  private static final String FIND_ACCESS_TOKEN = """
      select application_id, is_active, white_active, white_list
      from moss_kb_application_access_token
      where access_token = ?
        and deleted = 0
      """;

  public String script(String protocol, String host, Long token, Map<String, Object> params) {
    String scheme = StrUtil.isBlank(protocol) ? null : protocol.toLowerCase();
    boolean valid = SUPPORTED_PROTOCOLS.contains(scheme) && StrUtil.isNotBlank(host) && HOST.matcher(host).matches()
        && token != null;
    Row accessToken = valid ? Db.findFirst(FIND_ACCESS_TOKEN, token) : null;
    if (accessToken == null || !Boolean.TRUE.equals(accessToken.getBoolean("is_active"))) {
      JSONObject denied = new JSONObject();
      denied.put("isAuth", false);
      return render(denied);
    }

    Long applicationId = accessToken.getLong("application_id");
    JSONObject config = new JSONObject();
    config.put("isAuth", true);
    config.put("protocol", scheme);
    config.put("host", host);
    config.put("token", token.toString());
    config.put("query", apiInputQuery(applicationId, params));
    config.put("floatIcon", scheme + "://" + host + FLOAT_ICON_PATH);
    config.put("whiteActive", Boolean.TRUE.equals(accessToken.getBoolean("white_active")));
    config.put("whiteList", whiteList(accessToken.getStringArray("white_list")));
    return render(config);
  }

  /** 配置以 JSON 注入，脚本正文保持静态，取值不参与脚本拼接。 */
  private String render(JSONObject config) {
    return "window.__MOSSKB_EMBED_CONFIG__ = " + config.toJSONString() + ";\n" + SCRIPT;
  }
}

package nexus.io.mosskb.service.kb;

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;

import com.alibaba.fastjson2.JSON;
import com.alibaba.fastjson2.JSONArray;
import com.alibaba.fastjson2.JSONObject;

import nexus.io.db.activerecord.Db;
import nexus.io.tio.utils.hutool.StrUtil;

/** 后续对话要带上的入参：编排里声明为接口入参的变量，以及提问人标识。 */
private static final String ASKER = "asker";

private static final String FIND_WORK_FLOW = """
    select work_flow
    from moss_kb_application
    where id = ?
    """;

private String apiInputQuery(Long applicationId, Map<String, Object> params) {
  if (params == null || params.isEmpty()) {
    return "";
  }
  Set<String> names = new LinkedHashSet<>(apiInputVariables(applicationId));
  names.add(ASKER);
  StringBuilder query = new StringBuilder();
  for (String name : names) {
    append(query, name, params.get(name));
  }
  return query.toString();
}

private void append(StringBuilder query, String name, Object value) {
  if (value == null) {
    return;
  }
  String text = value.toString();
  if (StrUtil.isBlank(text)) {
    return;
  }
  query.append('&').append(name).append('=').append(URLEncoder.encode(text, StandardCharsets.UTF_8));
}

private List<String> apiInputVariables(Long applicationId) {
  List<String> variables = new ArrayList<>();
  String workFlow = Db.queryStr(FIND_WORK_FLOW, applicationId);
  if (StrUtil.isBlank(workFlow)) {
    return variables;
  }
  JSONObject json = null;
  try {
    json = JSON.parseObject(workFlow);
  } catch (RuntimeException e) {
    return variables;
  }
  JSONArray nodes = json == null ? null : json.getJSONArray("nodes");
  if (nodes == null) {
    return variables;
  }
  for (int i = 0; i < nodes.size(); i++) {
    JSONObject node = nodes.getJSONObject(i);
    if (node == null || !"base-node".equals(node.getString("id"))) {
      continue;
    }
    collectInputVariables(node.getJSONObject("properties"), variables);
  }
  return variables;
}

private void collectInputVariables(JSONObject properties, List<String> variables) {
  if (properties == null) {
    return;
  }
  // 声明了 api_input_field_list 时以它为准，否则从输入表单里挑出接口入参
  JSONArray fields = properties.getJSONArray("api_input_field_list");
  boolean declaredByApi = fields != null;
  if (!declaredByApi) {
    fields = properties.getJSONArray("input_field_list");
  }
  if (fields == null) {
    return;
  }
  for (int i = 0; i < fields.size(); i++) {
    JSONObject field = fields.getJSONObject(i);
    if (field == null) {
      continue;
    }
    if (!declaredByApi && !"api_input".equals(field.getString("assignment_method"))) {
      continue;
    }
    String variable = field.getString("variable");
    if (StrUtil.isNotBlank(variable) && !variables.contains(variable)) {
      variables.add(variable);
    }
  }
}

package nexus.io.mosskb.service.kb;

import nexus.io.db.activerecord.Db;
import nexus.io.db.activerecord.Row;

public final class ApplicationAccess {

  private static final String FIND_ACCESS_NUM = """
      select access_num
      from moss_kb_application_access_token
      where application_id = ?
        and deleted = 0
      """;

  private static final String FIND_PUBLIC_CLIENT = """
      select intraday_access_num
      from moss_kb_application_public_access_client
      where client_id = ?
        and application_id = ?
        and deleted = 0
      order by id desc
      limit 1
      """;

  /** 跨天时把当日计数归零，只动前一天留下的记录。 */
  private static final String RESET_INTRADAY_ACCESS_NUM = """
      update moss_kb_application_public_access_client
      set intraday_access_num = 0,
          update_time = now()
      where client_id = ?
        and application_id = ?
        and deleted = 0
        and update_time < date_trunc('day', now())
      """;

  private static final String COUNT_QUESTION = """
      update moss_kb_application_public_access_client
      set access_num = access_num + 1,
          intraday_access_num = intraday_access_num + 1,
          update_time = now()
      where client_id = ?
        and application_id = ?
        and deleted = 0
      """;

  /**
   * 访客的当日提问上限：公开访问链接上配置了次数（0 表示不限）时按访客分别累计。
   * 返回 null 表示可以提问，否则返回拒绝原因；应用所有者不受该限制。
   */
  public static String refuseReason(Long clientId, Long applicationId) {
    if (owns(clientId, applicationId)) {
      return null;
    }
    Row client = publicClient(clientId, applicationId);
    if (client == null) {
      return null;
    }
    Integer limit = Db.queryInt(FIND_ACCESS_NUM, applicationId);
    if (limit == null || limit <= 0) {
      return null;
    }
    Integer used = client.getInt("intraday_access_num");
    if (used != null && used >= limit) {
      return "今日提问次数已用完，请明天再试";
    }
    return null;
  }

  /** 记一次访客提问，当日次数与累计次数同时加一。 */
  public static void countQuestion(Long clientId, Long applicationId) {
    if (owns(clientId, applicationId)) {
      return;
    }
    Db.update(COUNT_QUESTION, clientId, applicationId);
  }

  private static Row publicClient(Long clientId, Long applicationId) {
    if (clientId == null || applicationId == null) {
      return null;
    }
    // 取记录之前先把上一天的计数归零，零点任务还没跑到也能按自然日计算
    Db.update(RESET_INTRADAY_ACCESS_NUM, clientId, applicationId);
    return Db.findFirst(FIND_PUBLIC_CLIENT, clientId, applicationId);
  }
}

Long application_id = record.getLong("application_id");
if (!ApplicationAccess.canChat(caller, application_id)) {
  return ResultVo.fail("应用已停用或无权访问");
}
// 分享页访客按公开访问链接上配置的当日次数限制
String refuseReason = ApplicationAccess.refuseReason(caller, application_id);
if (refuseReason != null) {
  return ResultVo.fail(refuseReason);
}

chatWichApplication(channelContext, quesiton, applicationVo, chatId, messageId, mossKbSearchStep, context.messages());
ApplicationAccess.countQuestion(caller, application_id);
started = true;

package nexus.io.mosskb.task;

import org.quartz.JobExecutionContext;

import lombok.extern.slf4j.Slf4j;
import nexus.io.db.activerecord.Db;
import nexus.io.tio.utils.quartz.AbstractJobWithLog;

/** 每天把分享页访客的当日提问次数归零，次数上限按自然日重新计算。 */
@Slf4j
public class ResetClientAccessNumJob extends AbstractJobWithLog {

  private static final String RESET_INTRADAY_ACCESS_NUM = """
      update moss_kb_application_public_access_client
      set intraday_access_num = 0,
          update_time = now()
      where intraday_access_num <> 0
      """;

  @Override
  public void run(JobExecutionContext context) throws Exception {
    int updated = Db.update(RESET_INTRADAY_ACCESS_NUM);
    log.info("reset client access num job finished, updated rows: {}", updated);
  }
}

package nexus.io.mosskb.config;

import nexus.io.mosskb.inteceptor.MossKbAuthInterceptor;
import nexus.io.tio.boot.http.interceptor.HttpInteceptorConfigure;
import nexus.io.tio.boot.http.interceptor.HttpInterceptorModel;
import nexus.io.tio.boot.server.TioBootServer;

public class MossKbInterceptorConfiguration {

  public void config() {
    MossKbAuthInterceptor authTokenInterceptor = new MossKbAuthInterceptor();
    HttpInterceptorModel model = new HttpInterceptorModel();
    model.setInterceptor(authTokenInterceptor);
    model.addBlockUrl("/**");

    model.addAllowUrls("/api/profile", "/api/application/authentication");

    // 浮窗脚本由第三方页面直接引入，没有本地登录令牌
    model.addAllowUrls("/api/application/embed");
  }
}