feat: align with upstream 1.5.9.9
This commit is contained in:
@@ -0,0 +1,808 @@
|
||||
import {
|
||||
RedisStateUnavailableError,
|
||||
setStore,
|
||||
getStore,
|
||||
delStore,
|
||||
incrStore
|
||||
} from '~~/server/utils/captchaStore'
|
||||
import { createSystemNotification } from './notificationService'
|
||||
import { sendMeowNotificationToUser } from './meowNotificationService'
|
||||
import { db } from '~/drizzle/db'
|
||||
import { users } from '~/drizzle/schema'
|
||||
import { eq } from 'drizzle-orm'
|
||||
import { getServerTimestamp, getServerDate } from '~~/server/utils/serverTime'
|
||||
|
||||
// 账户锁定信息接口
|
||||
interface AccountLockInfo {
|
||||
failedAttempts: number
|
||||
lockedUntil: Date | null
|
||||
lastAttemptTime: Date
|
||||
}
|
||||
|
||||
// IP监控信息接口
|
||||
interface IPMonitorInfo {
|
||||
attemptedAccounts: Set<string>
|
||||
firstAttemptTime: Date
|
||||
lastAttemptTime: Date
|
||||
}
|
||||
|
||||
// IP黑名单信息接口
|
||||
interface IPBlockInfo {
|
||||
blockedUntil: Date
|
||||
reason: string
|
||||
blockedTime: Date
|
||||
}
|
||||
|
||||
// 内存存储
|
||||
const ipMonitor = new Map<string, IPMonitorInfo>()
|
||||
const ipBlacklist = new Map<string, IPBlockInfo>()
|
||||
const accountIpSwitchMonitor = new Map<
|
||||
string,
|
||||
{ ipMap: Map<string, number>; windowStart: number }
|
||||
>()
|
||||
const userBlockUntil = new Map<number, Date>()
|
||||
const songVoteWindow = new Map<number, number[]>()
|
||||
const songProtectUntil = new Map<number, Date>()
|
||||
const songVoteIpBuckets = new Map<number, Map<string, number>>()
|
||||
const userVoteStats = new Map<
|
||||
number,
|
||||
{ emaPerMin: number; lastUpdate: number; windowTimestamps: number[] }
|
||||
>()
|
||||
|
||||
// 通知限流存储，记录最近发送的通知，避免重复发送
|
||||
const notificationRateLimit = new Map<string, Date>()
|
||||
const NOTIFICATION_RATE_LIMIT_MINUTES = 5 // 同一类型通知5分钟内只发送一次
|
||||
const fallbackLoginFailures = new Map<string, { count: number; expiresAt: number }>()
|
||||
const fallbackAccountLocks = new Map<string, number>()
|
||||
const REDIS_FALLBACK_LOG_INTERVAL_MS = 60 * 1000
|
||||
let lastRedisFallbackLogAt = 0
|
||||
|
||||
// 配置常量
|
||||
const SECURITY_CONFIG = {
|
||||
MAX_FAILED_ATTEMPTS: 5,
|
||||
LOCK_DURATION_MINUTES: 10,
|
||||
IP_MONITOR_WINDOW_MINUTES: 10,
|
||||
IP_MAX_DIFFERENT_ACCOUNTS: 3,
|
||||
IP_BLOCK_DURATION_MINUTES: 10
|
||||
}
|
||||
|
||||
const RISK_CONTROL = {
|
||||
IP_SWITCH_WINDOW_MS: 5 * 60 * 1000,
|
||||
IP_SWITCH_THRESHOLD: 3,
|
||||
IP_SWITCH_BLOCK_MINUTES: 10,
|
||||
USER_BLOCK_MINUTES: 10,
|
||||
SONG_VOTE_PROTECT_WINDOW_MS: 60 * 60 * 1000,
|
||||
SONG_VOTE_PROTECT_THRESHOLD: 10,
|
||||
SONG_VOTE_PROTECT_DURATION_MS: 10 * 60 * 1000,
|
||||
USER_BASELINE_MIN_PER_MIN: 0.5,
|
||||
USER_BASELINE_MULTIPLIER: 3,
|
||||
EMA_ALPHA: 0.2,
|
||||
SONG_IP_DOMINANCE_PERCENT: 0.6,
|
||||
SONG_IP_MIN_SAMPLE: 8
|
||||
}
|
||||
|
||||
const handleRedisStateUnavailable = (error: unknown) => {
|
||||
if (!(error instanceof RedisStateUnavailableError)) throw error
|
||||
|
||||
const now = getServerTimestamp()
|
||||
if (now - lastRedisFallbackLogAt >= REDIS_FALLBACK_LOG_INTERVAL_MS) {
|
||||
console.warn('[Security] Redis 暂不可用，登录失败计数临时回退到当前实例内存')
|
||||
lastRedisFallbackLogAt = now
|
||||
}
|
||||
}
|
||||
|
||||
const getFallbackFailureCount = (username: string) => {
|
||||
const record = fallbackLoginFailures.get(username)
|
||||
if (!record) return 0
|
||||
if (record.expiresAt <= getServerTimestamp()) {
|
||||
fallbackLoginFailures.delete(username)
|
||||
return 0
|
||||
}
|
||||
return record.count
|
||||
}
|
||||
|
||||
const incrementFallbackFailureCount = (username: string) => {
|
||||
const now = getServerTimestamp()
|
||||
if (fallbackLoginFailures.size >= 10000) {
|
||||
for (const [key, record] of fallbackLoginFailures.entries()) {
|
||||
if (record.expiresAt <= now) fallbackLoginFailures.delete(key)
|
||||
}
|
||||
if (fallbackLoginFailures.size >= 10000 && !fallbackLoginFailures.has(username)) {
|
||||
const oldestKey = fallbackLoginFailures.keys().next().value
|
||||
if (oldestKey !== undefined) fallbackLoginFailures.delete(oldestKey)
|
||||
}
|
||||
}
|
||||
const current = fallbackLoginFailures.get(username)
|
||||
const count = current && current.expiresAt > now ? current.count + 1 : 1
|
||||
fallbackLoginFailures.set(username, {
|
||||
count,
|
||||
expiresAt: current && current.expiresAt > now ? current.expiresAt : now + 30 * 60 * 1000
|
||||
})
|
||||
return count
|
||||
}
|
||||
|
||||
const getFallbackLockedUntil = (username: string) => {
|
||||
const lockedUntil = fallbackAccountLocks.get(username) || 0
|
||||
if (lockedUntil <= getServerTimestamp()) {
|
||||
fallbackAccountLocks.delete(username)
|
||||
return 0
|
||||
}
|
||||
return lockedUntil
|
||||
}
|
||||
|
||||
/**
|
||||
* 清理过期的锁定记录
|
||||
*/
|
||||
function cleanupExpiredLocks() {
|
||||
const now = getServerDate()
|
||||
|
||||
for (const [username, record] of fallbackLoginFailures.entries()) {
|
||||
if (record.expiresAt <= now.getTime()) fallbackLoginFailures.delete(username)
|
||||
}
|
||||
for (const [username, lockedUntil] of fallbackAccountLocks.entries()) {
|
||||
if (lockedUntil <= now.getTime()) fallbackAccountLocks.delete(username)
|
||||
}
|
||||
|
||||
// 清理过期的IP监控记录
|
||||
for (const [ip, monitorInfo] of ipMonitor.entries()) {
|
||||
const windowStart = new Date(
|
||||
now.getTime() - SECURITY_CONFIG.IP_MONITOR_WINDOW_MINUTES * 60 * 1000
|
||||
)
|
||||
if (monitorInfo.firstAttemptTime < windowStart) {
|
||||
ipMonitor.delete(ip)
|
||||
}
|
||||
}
|
||||
|
||||
// 清理过期的IP黑名单记录
|
||||
for (const [ip, blockInfo] of ipBlacklist.entries()) {
|
||||
if (blockInfo.blockedUntil <= now) {
|
||||
ipBlacklist.delete(ip)
|
||||
console.log(`IP ${ip} 已从黑名单中移除`)
|
||||
}
|
||||
}
|
||||
|
||||
for (const [username, monitor] of accountIpSwitchMonitor.entries()) {
|
||||
const cutoff = getServerTimestamp() - RISK_CONTROL.IP_SWITCH_WINDOW_MS
|
||||
for (const [ip, ts] of monitor.ipMap.entries()) {
|
||||
if (ts < cutoff) {
|
||||
monitor.ipMap.delete(ip)
|
||||
}
|
||||
}
|
||||
if (monitor.ipMap.size === 0) {
|
||||
accountIpSwitchMonitor.delete(username)
|
||||
}
|
||||
}
|
||||
|
||||
for (const [songId, timestamps] of songVoteWindow.entries()) {
|
||||
const cutoff = getServerTimestamp() - RISK_CONTROL.SONG_VOTE_PROTECT_WINDOW_MS
|
||||
const filtered = timestamps.filter((t) => t >= cutoff)
|
||||
if (filtered.length) {
|
||||
songVoteWindow.set(songId, filtered)
|
||||
} else {
|
||||
songVoteWindow.delete(songId)
|
||||
}
|
||||
}
|
||||
|
||||
for (const [userId, stats] of userVoteStats.entries()) {
|
||||
const cutoff = getServerTimestamp() - 10 * 60 * 1000
|
||||
stats.windowTimestamps = stats.windowTimestamps.filter((t) => t >= cutoff)
|
||||
if (
|
||||
stats.windowTimestamps.length === 0 &&
|
||||
getServerTimestamp() - stats.lastUpdate > 60 * 60 * 1000
|
||||
) {
|
||||
userVoteStats.delete(userId)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 检查账户是否被锁定
|
||||
*/
|
||||
export async function isAccountLocked(username: string): Promise<boolean> {
|
||||
const lockKey = `account_lock:${username}`
|
||||
let redisLockedUntil = 0
|
||||
try {
|
||||
const lockInfoStr = await getStore(lockKey)
|
||||
if (lockInfoStr) {
|
||||
const parsed = parseInt(lockInfoStr, 10)
|
||||
if (Number.isFinite(parsed)) redisLockedUntil = parsed
|
||||
}
|
||||
} catch (error) {
|
||||
handleRedisStateUnavailable(error)
|
||||
}
|
||||
|
||||
return Math.max(redisLockedUntil, getFallbackLockedUntil(username)) > getServerTimestamp()
|
||||
}
|
||||
|
||||
/**
|
||||
* 获取账户锁定剩余时间（分钟）
|
||||
*/
|
||||
export async function getAccountLockRemainingTime(username: string): Promise<number> {
|
||||
const lockKey = `account_lock:${username}`
|
||||
let redisLockedUntil = 0
|
||||
try {
|
||||
const lockInfoStr = await getStore(lockKey)
|
||||
if (lockInfoStr) {
|
||||
const parsed = parseInt(lockInfoStr, 10)
|
||||
if (Number.isFinite(parsed)) redisLockedUntil = parsed
|
||||
}
|
||||
} catch (error) {
|
||||
handleRedisStateUnavailable(error)
|
||||
}
|
||||
|
||||
const now = getServerTimestamp()
|
||||
const lockedUntil = Math.max(redisLockedUntil, getFallbackLockedUntil(username))
|
||||
if (lockedUntil <= now) return 0
|
||||
|
||||
return Math.ceil((lockedUntil - now) / (1000 * 60))
|
||||
}
|
||||
|
||||
/**
|
||||
* 检查IP是否被限制
|
||||
*/
|
||||
export function isIPBlocked(ip: string): boolean {
|
||||
cleanupExpiredLocks()
|
||||
|
||||
const blockInfo = ipBlacklist.get(ip)
|
||||
if (!blockInfo) {
|
||||
return false
|
||||
}
|
||||
|
||||
return blockInfo.blockedUntil > getServerDate()
|
||||
}
|
||||
|
||||
/**
|
||||
* 获取IP限制剩余时间（分钟）
|
||||
*/
|
||||
export function getIPBlockRemainingTime(ip: string): number {
|
||||
const blockInfo = ipBlacklist.get(ip)
|
||||
if (!blockInfo) {
|
||||
return 0
|
||||
}
|
||||
|
||||
const now = getServerDate()
|
||||
if (blockInfo.blockedUntil <= now) {
|
||||
return 0
|
||||
}
|
||||
|
||||
return Math.ceil((blockInfo.blockedUntil.getTime() - now.getTime()) / (1000 * 60))
|
||||
}
|
||||
|
||||
/**
|
||||
* 将IP加入黑名单
|
||||
*/
|
||||
function blockIP(ip: string, reason: string): void {
|
||||
const now = getServerDate()
|
||||
const blockedUntil = new Date(
|
||||
now.getTime() + SECURITY_CONFIG.IP_BLOCK_DURATION_MINUTES * 60 * 1000
|
||||
)
|
||||
|
||||
ipBlacklist.set(ip, {
|
||||
blockedUntil,
|
||||
reason,
|
||||
blockedTime: now
|
||||
})
|
||||
|
||||
console.log(
|
||||
`IP ${ip} 已被加入黑名单，限制时长 ${SECURITY_CONFIG.IP_BLOCK_DURATION_MINUTES} 分钟，原因：${reason}`
|
||||
)
|
||||
}
|
||||
|
||||
export function blockUser(userId: number, minutes: number = RISK_CONTROL.USER_BLOCK_MINUTES): void {
|
||||
const until = new Date(getServerTimestamp() + minutes * 60 * 1000)
|
||||
userBlockUntil.set(userId, until)
|
||||
}
|
||||
|
||||
export function isUserBlocked(userId: number): boolean {
|
||||
const until = userBlockUntil.get(userId)
|
||||
if (!until) return false
|
||||
return until > getServerDate()
|
||||
}
|
||||
|
||||
export function getUserBlockRemainingTime(userId: number): number {
|
||||
const until = userBlockUntil.get(userId)
|
||||
if (!until) return 0
|
||||
const now = getServerTimestamp()
|
||||
if (until.getTime() <= now) return 0
|
||||
return Math.ceil((until.getTime() - now) / (1000 * 60))
|
||||
}
|
||||
|
||||
/**
|
||||
* 记录登录失败
|
||||
*/
|
||||
export async function recordLoginFailure(username: string, ip: string): Promise<void> {
|
||||
const failKey = `login_fail:${username}`
|
||||
const lockKey = `account_lock:${username}`
|
||||
let failedAttempts: number | null = null
|
||||
|
||||
try {
|
||||
// 增加失败计数，有效期为 30 分钟
|
||||
failedAttempts = Math.max(await incrStore(failKey, 30 * 60), getFallbackFailureCount(username))
|
||||
|
||||
if (failedAttempts >= SECURITY_CONFIG.MAX_FAILED_ATTEMPTS) {
|
||||
const lockedUntil = getServerTimestamp() + SECURITY_CONFIG.LOCK_DURATION_MINUTES * 60 * 1000
|
||||
await setStore(lockKey, lockedUntil.toString(), SECURITY_CONFIG.LOCK_DURATION_MINUTES * 60)
|
||||
}
|
||||
} catch (error) {
|
||||
handleRedisStateUnavailable(error)
|
||||
failedAttempts = Math.max(failedAttempts || 0, incrementFallbackFailureCount(username))
|
||||
if (failedAttempts >= SECURITY_CONFIG.MAX_FAILED_ATTEMPTS) {
|
||||
fallbackAccountLocks.set(
|
||||
username,
|
||||
getServerTimestamp() + SECURITY_CONFIG.LOCK_DURATION_MINUTES * 60 * 1000
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
if (failedAttempts >= SECURITY_CONFIG.MAX_FAILED_ATTEMPTS) {
|
||||
console.log(
|
||||
`账户 ${username} 因连续 ${SECURITY_CONFIG.MAX_FAILED_ATTEMPTS} 次登录失败被锁定 ${SECURITY_CONFIG.LOCK_DURATION_MINUTES} 分钟`
|
||||
)
|
||||
}
|
||||
|
||||
// 记录IP监控信息
|
||||
recordIPAttempt(ip, username)
|
||||
}
|
||||
|
||||
/**
|
||||
* 记录成功登录（清除失败记录）
|
||||
*/
|
||||
export async function recordLoginSuccess(username: string, ip: string): Promise<void> {
|
||||
const failKey = `login_fail:${username}`
|
||||
const lockKey = `account_lock:${username}`
|
||||
try {
|
||||
await Promise.all([delStore(failKey), delStore(lockKey)])
|
||||
} catch (error) {
|
||||
handleRedisStateUnavailable(error)
|
||||
}
|
||||
fallbackLoginFailures.delete(username)
|
||||
fallbackAccountLocks.delete(username)
|
||||
|
||||
// 记录IP监控信息（成功登录也需要监控）
|
||||
recordIPAttempt(ip, username)
|
||||
}
|
||||
|
||||
export function recordAccountIpLogin(username: string, ip: string): boolean {
|
||||
const now = getServerTimestamp()
|
||||
let monitor = accountIpSwitchMonitor.get(username)
|
||||
if (!monitor) {
|
||||
monitor = { ipMap: new Map<string, number>(), windowStart: now }
|
||||
accountIpSwitchMonitor.set(username, monitor)
|
||||
}
|
||||
const cutoff = now - RISK_CONTROL.IP_SWITCH_WINDOW_MS
|
||||
for (const [k, ts] of monitor.ipMap.entries()) {
|
||||
if (ts < cutoff) monitor.ipMap.delete(k)
|
||||
}
|
||||
monitor.ipMap.set(ip, now)
|
||||
const exceeded = monitor.ipMap.size > RISK_CONTROL.IP_SWITCH_THRESHOLD
|
||||
if (exceeded) {
|
||||
blockIP(ip, '账号短期内多IP登录超限')
|
||||
triggerAccountIpSwitchAlert(username, Array.from(monitor.ipMap.keys()))
|
||||
}
|
||||
return exceeded
|
||||
}
|
||||
|
||||
/**
|
||||
* 记录IP登录尝试
|
||||
*/
|
||||
function recordIPAttempt(ip: string, username: string): void {
|
||||
const now = getServerDate()
|
||||
const windowStart = new Date(
|
||||
now.getTime() - SECURITY_CONFIG.IP_MONITOR_WINDOW_MINUTES * 60 * 1000
|
||||
)
|
||||
|
||||
let monitorInfo = ipMonitor.get(ip)
|
||||
if (!monitorInfo) {
|
||||
monitorInfo = {
|
||||
attemptedAccounts: new Set<string>(),
|
||||
firstAttemptTime: now,
|
||||
lastAttemptTime: now
|
||||
}
|
||||
ipMonitor.set(ip, monitorInfo)
|
||||
}
|
||||
|
||||
// 如果监控窗口已过期，重置记录
|
||||
if (monitorInfo.firstAttemptTime < windowStart) {
|
||||
monitorInfo.attemptedAccounts.clear()
|
||||
monitorInfo.firstAttemptTime = now
|
||||
}
|
||||
|
||||
monitorInfo.attemptedAccounts.add(username)
|
||||
monitorInfo.lastAttemptTime = now
|
||||
|
||||
// 检查是否触发异常行为警报
|
||||
if (monitorInfo.attemptedAccounts.size > SECURITY_CONFIG.IP_MAX_DIFFERENT_ACCOUNTS) {
|
||||
triggerSecurityAlert(ip, Array.from(monitorInfo.attemptedAccounts))
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 触发安全警报
|
||||
*/
|
||||
async function triggerSecurityAlert(ip: string, attemptedAccounts: string[]): Promise<void> {
|
||||
try {
|
||||
const now = getServerDate()
|
||||
const alertTitle = '安全警报：检测到异常登录行为'
|
||||
const alertContent = `
|
||||
检测时间：${now.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })}
|
||||
异常IP：${ip}
|
||||
时间窗口：${SECURITY_CONFIG.IP_MONITOR_WINDOW_MINUTES}分钟内
|
||||
尝试登录账户数：${attemptedAccounts.length}
|
||||
涉及账户：${attemptedAccounts.join(', ')}
|
||||
|
||||
建议立即检查该IP的登录活动并采取必要的安全措施。
|
||||
`.trim()
|
||||
|
||||
// Meow通知内容，包含完整的涉及账户信息
|
||||
const meowAlertContent = `
|
||||
检测时间：${now.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })}
|
||||
异常IP：${ip}
|
||||
时间窗口：${SECURITY_CONFIG.IP_MONITOR_WINDOW_MINUTES}分钟内
|
||||
尝试登录账户数：${attemptedAccounts.length}
|
||||
涉及账户：${attemptedAccounts.join(', ')}
|
||||
|
||||
建议立即检查该IP的登录活动并采取必要的安全措施。
|
||||
`.trim()
|
||||
|
||||
console.log(
|
||||
`安全警报：IP ${ip} 在 ${SECURITY_CONFIG.IP_MONITOR_WINDOW_MINUTES} 分钟内尝试登录 ${attemptedAccounts.length} 个不同账户`
|
||||
)
|
||||
|
||||
// 将触发警报的IP加入黑名单
|
||||
blockIP(
|
||||
ip,
|
||||
`异常登录行为：${SECURITY_CONFIG.IP_MONITOR_WINDOW_MINUTES}分钟内尝试登录${attemptedAccounts.length}个不同账户`
|
||||
)
|
||||
|
||||
// 获取所有超级管理员
|
||||
const superAdmins = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
meowNickname: users.meowNickname
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.role, 'SUPER_ADMIN'))
|
||||
|
||||
// 向所有超级管理员发送站内信
|
||||
for (const admin of superAdmins) {
|
||||
try {
|
||||
await createSystemNotification(admin.id, alertTitle, alertContent)
|
||||
console.log(`已向超级管理员 ${admin.name} 发送安全警报站内信`)
|
||||
|
||||
// 如果管理员绑定了Meow推送，同时发送推送通知
|
||||
if (admin.meowNickname) {
|
||||
const success = await sendMeowNotificationToUser(admin.id, alertTitle, meowAlertContent)
|
||||
|
||||
if (success) {
|
||||
console.log(`已向超级管理员 ${admin.name} 发送Meow推送警报`)
|
||||
} else {
|
||||
console.log(`向超级管理员 ${admin.name} 发送Meow推送警报失败`)
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error(`向超级管理员 ${admin.name} 发送安全警报失败:`, error)
|
||||
}
|
||||
}
|
||||
|
||||
// 重置该IP的监控记录，避免重复警报
|
||||
ipMonitor.delete(ip)
|
||||
} catch (error) {
|
||||
console.error('触发安全警报时发生错误:', error)
|
||||
}
|
||||
}
|
||||
|
||||
async function triggerAccountIpSwitchAlert(username: string, ips: string[]): Promise<void> {
|
||||
try {
|
||||
const now = getServerDate()
|
||||
const alertTitle = '安全警报：账号短期内多IP登录'
|
||||
const alertContent = `检测时间：${now.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })}
|
||||
账号：${username}
|
||||
时间窗口：${Math.floor(RISK_CONTROL.IP_SWITCH_WINDOW_MS / 60000)}分钟内
|
||||
涉及IP数：${ips.length}
|
||||
|
||||
建议立即检查该账号的登录活动并采取必要的安全措施。`
|
||||
const meowAlertContent = alertContent
|
||||
const superAdmins = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
meowNickname: users.meowNickname
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.role, 'SUPER_ADMIN'))
|
||||
for (const admin of superAdmins) {
|
||||
try {
|
||||
await createSystemNotification(admin.id, alertTitle, alertContent)
|
||||
if (admin.meowNickname) {
|
||||
await sendMeowNotificationToUser(admin.id, alertTitle, meowAlertContent)
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('触发账号IP切换警报时发生错误:', error)
|
||||
}
|
||||
}
|
||||
|
||||
function ipBucketOf(ip: string): string {
|
||||
const parts = ip.split('.')
|
||||
if (parts.length === 4) return `${parts[0]}.${parts[1]}.${parts[2]}`
|
||||
return ip
|
||||
}
|
||||
|
||||
export function isSongProtected(songId: number): boolean {
|
||||
const until = songProtectUntil.get(songId)
|
||||
if (!until) return false
|
||||
return until > getServerDate()
|
||||
}
|
||||
|
||||
export function getSongProtectRemainingSeconds(songId: number): number {
|
||||
const until = songProtectUntil.get(songId)
|
||||
if (!until) return 0
|
||||
const now = getServerTimestamp()
|
||||
if (until.getTime() <= now) return 0
|
||||
return Math.ceil((until.getTime() - now) / 1000)
|
||||
}
|
||||
|
||||
export function recordSongVote(songId: number, ip: string, userId: number): boolean {
|
||||
const now = getServerTimestamp()
|
||||
const arr = songVoteWindow.get(songId) || []
|
||||
const cutoff = now - RISK_CONTROL.SONG_VOTE_PROTECT_WINDOW_MS
|
||||
const filtered = arr.filter((t) => t >= cutoff)
|
||||
filtered.push(now)
|
||||
songVoteWindow.set(songId, filtered)
|
||||
const buckets = songVoteIpBuckets.get(songId) || new Map<string, number>()
|
||||
const b = ipBucketOf(ip)
|
||||
buckets.set(b, (buckets.get(b) || 0) + 1)
|
||||
songVoteIpBuckets.set(songId, buckets)
|
||||
if (filtered.length > RISK_CONTROL.SONG_VOTE_PROTECT_THRESHOLD) {
|
||||
songProtectUntil.set(songId, new Date(now + RISK_CONTROL.SONG_VOTE_PROTECT_DURATION_MS))
|
||||
triggerSongVoteBurstAlert(songId, filtered.length, buckets)
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
export function recordUserVoteActivity(userId: number, songTitle?: string): { anomaly: boolean } {
|
||||
const now = getServerTimestamp()
|
||||
let stats = userVoteStats.get(userId)
|
||||
if (!stats) {
|
||||
stats = { emaPerMin: 0, lastUpdate: now, windowTimestamps: [] }
|
||||
userVoteStats.set(userId, stats)
|
||||
}
|
||||
|
||||
// 更新时间窗口，保留最近10分钟的投票记录
|
||||
const cutoff = now - 10 * 60 * 1000
|
||||
stats.windowTimestamps = stats.windowTimestamps.filter((t) => t >= cutoff)
|
||||
stats.windowTimestamps.push(now)
|
||||
|
||||
// 计算当前10分钟窗口内的平均速率，而不仅仅是两次投票的间隔
|
||||
// 如果只有一个投票记录，无法计算速率（时间跨度为0），且单个投票不构成"速率"，直接视为0
|
||||
let currentRate = 0
|
||||
if (stats.windowTimestamps.length > 1) {
|
||||
const windowDurationMin = Math.max(1e-6, (now - Math.min(...stats.windowTimestamps)) / 60000)
|
||||
currentRate = stats.windowTimestamps.length / windowDurationMin
|
||||
}
|
||||
|
||||
// 调整EMA_ALPHA值为0.1，使EMA更平滑，减少短期波动影响
|
||||
const smoothedEmaAlpha = 0.1
|
||||
stats.emaPerMin = smoothedEmaAlpha * currentRate + (1 - smoothedEmaAlpha) * stats.emaPerMin
|
||||
stats.lastUpdate = now
|
||||
|
||||
// 动态调整阈值：基础阈值 + EMA的动态倍数
|
||||
// 当EMA较低时，使用较高倍数；当EMA较高时，使用较低倍数，避免误报
|
||||
const baseThreshold = 5 // 基础阈值：每分钟5票
|
||||
const dynamicMultiplier = Math.max(2, 5 - Math.min(3, stats.emaPerMin / 100)) // 动态倍数：2-5倍
|
||||
const threshold = Math.max(baseThreshold, stats.emaPerMin * dynamicMultiplier)
|
||||
|
||||
// 只有当当前速率显著超过阈值（1.5倍）时，才触发异常
|
||||
const anomaly = currentRate > threshold * 1.5
|
||||
if (anomaly) triggerVoteAnomalyAlert(userId, stats.emaPerMin, currentRate, songTitle)
|
||||
return { anomaly }
|
||||
}
|
||||
|
||||
async function triggerSongVoteBurstAlert(
|
||||
songId: number,
|
||||
count: number,
|
||||
buckets: Map<string, number>
|
||||
): Promise<void> {
|
||||
try {
|
||||
const now = getServerDate()
|
||||
const top = Array.from(buckets.entries()).sort((a, b) => b[1] - a[1])[0]
|
||||
const alertTitle = '风险告警：歌曲投票短时激增'
|
||||
const alertContent = `检测时间：${now.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })}
|
||||
歌曲ID：${songId}
|
||||
窗口内票数：${count}
|
||||
主导IP段：${top ? `${top[0]}.* (${top[1]})` : '无'}
|
||||
|
||||
已启动临时保护，暂停投票10分钟。`
|
||||
const meowAlertContent = alertContent
|
||||
const superAdmins = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
meowNickname: users.meowNickname
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.role, 'SUPER_ADMIN'))
|
||||
for (const admin of superAdmins) {
|
||||
try {
|
||||
await createSystemNotification(admin.id, alertTitle, alertContent)
|
||||
if (admin.meowNickname) {
|
||||
await sendMeowNotificationToUser(admin.id, alertTitle, meowAlertContent)
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('触发歌曲投票激增警报时发生错误:', error)
|
||||
}
|
||||
}
|
||||
|
||||
// 检查通知是否可以发送（限流控制）
|
||||
function canSendNotification(key: string): boolean {
|
||||
const now = getServerDate()
|
||||
const lastSent = notificationRateLimit.get(key)
|
||||
if (
|
||||
lastSent &&
|
||||
now.getTime() - lastSent.getTime() < NOTIFICATION_RATE_LIMIT_MINUTES * 60 * 1000
|
||||
) {
|
||||
return false
|
||||
}
|
||||
notificationRateLimit.set(key, now)
|
||||
return true
|
||||
}
|
||||
|
||||
interface AnomalyEvent {
|
||||
userId: number
|
||||
ema: number
|
||||
rate: number
|
||||
songTitle?: string
|
||||
time: Date
|
||||
}
|
||||
|
||||
const pendingAnomalies: AnomalyEvent[] = []
|
||||
let anomalyAggregationTimer: NodeJS.Timeout | null = null
|
||||
const ANOMALY_AGGREGATION_WINDOW_MS = 60 * 1000 // 1分钟聚合窗口
|
||||
|
||||
async function flushAnomalyAggregation() {
|
||||
if (pendingAnomalies.length === 0) {
|
||||
anomalyAggregationTimer = null
|
||||
return
|
||||
}
|
||||
|
||||
try {
|
||||
const count = pendingAnomalies.length
|
||||
// 统计涉及的歌曲
|
||||
const songStats = new Map<string, number>()
|
||||
pendingAnomalies.forEach((e) => {
|
||||
const title = e.songTitle || '未知歌曲'
|
||||
songStats.set(title, (songStats.get(title) || 0) + 1)
|
||||
})
|
||||
|
||||
// 按次数排序，取前5
|
||||
const topSongs = Array.from(songStats.entries())
|
||||
.sort((a, b) => b[1] - a[1])
|
||||
.slice(0, 5)
|
||||
.map(([title, c]) => `- ${title} (${c}人)`)
|
||||
.join('\n')
|
||||
|
||||
const alertTitle = '风险告警：检测到多名用户异常投票（汇总）'
|
||||
const alertContent = `在过去 1 分钟内，除已通知的用户外，还检测到 ${count} 名用户存在异常投票行为。
|
||||
|
||||
涉及主要歌曲：
|
||||
${topSongs}
|
||||
|
||||
请关注后台日志或进行相关处理。`
|
||||
|
||||
const meowAlertContent = alertContent
|
||||
const superAdmins = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
meowNickname: users.meowNickname
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.role, 'SUPER_ADMIN'))
|
||||
|
||||
for (const admin of superAdmins) {
|
||||
try {
|
||||
await createSystemNotification(admin.id, alertTitle, alertContent)
|
||||
if (admin.meowNickname) {
|
||||
await sendMeowNotificationToUser(admin.id, alertTitle, meowAlertContent)
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('发送异常投票汇总通知失败:', error)
|
||||
} finally {
|
||||
// 清空队列和定时器
|
||||
pendingAnomalies.length = 0
|
||||
anomalyAggregationTimer = null
|
||||
}
|
||||
}
|
||||
|
||||
async function triggerVoteAnomalyAlert(
|
||||
userId: number,
|
||||
ema: number,
|
||||
rate: number,
|
||||
songTitle?: string
|
||||
): Promise<void> {
|
||||
try {
|
||||
// 通知限流，同一用户的投票异常通知5分钟内只发送一次
|
||||
const notificationKey = `vote_anomaly_${userId}`
|
||||
if (!canSendNotification(notificationKey)) {
|
||||
return
|
||||
}
|
||||
|
||||
// 如果正在聚合窗口期，则加入缓冲区
|
||||
if (anomalyAggregationTimer) {
|
||||
pendingAnomalies.push({
|
||||
userId,
|
||||
ema,
|
||||
rate,
|
||||
songTitle,
|
||||
time: getServerDate()
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
// 否则，立即发送第一条，并开启聚合窗口
|
||||
const now = getServerDate()
|
||||
const alertTitle = '风险告警：检测到异常投票速率'
|
||||
const alertContent = `检测时间：${now.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })}\n用户ID：${userId}\nEMA基线：${ema.toFixed(2)} 次/分钟\n当前速率：${rate.toFixed(2)} 次/分钟\n${songTitle ? `涉及歌曲：${songTitle}\n` : ''}\n提示：该用户的投票行为异常，已触发限流机制。`
|
||||
const meowAlertContent = alertContent
|
||||
const superAdmins = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
name: users.name,
|
||||
meowNickname: users.meowNickname
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.role, 'SUPER_ADMIN'))
|
||||
for (const admin of superAdmins) {
|
||||
try {
|
||||
await createSystemNotification(admin.id, alertTitle, alertContent)
|
||||
if (admin.meowNickname) {
|
||||
await sendMeowNotificationToUser(admin.id, alertTitle, meowAlertContent)
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
|
||||
// 启动聚合定时器
|
||||
anomalyAggregationTimer = setTimeout(flushAnomalyAggregation, ANOMALY_AGGREGATION_WINDOW_MS)
|
||||
} catch (error) {
|
||||
console.error('触发投票异常警报时发生错误:', error)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 获取安全统计信息
|
||||
*/
|
||||
export async function getSecurityStats() {
|
||||
cleanupExpiredLocks()
|
||||
|
||||
return {
|
||||
lockedAccounts: 0,
|
||||
monitoredIPs: ipMonitor.size,
|
||||
blockedIPs: ipBlacklist.size,
|
||||
config: SECURITY_CONFIG
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 获取账户当前的登录失败次数（用于判断是否需要图形验证码）
|
||||
*/
|
||||
export async function getLoginFailureCount(username: string): Promise<number> {
|
||||
const failKey = `login_fail:${username}`
|
||||
try {
|
||||
const val = await getStore(failKey)
|
||||
const redisCount = val ? parseInt(val, 10) : 0
|
||||
return Math.max(Number.isFinite(redisCount) ? redisCount : 0, getFallbackFailureCount(username))
|
||||
} catch (error) {
|
||||
handleRedisStateUnavailable(error)
|
||||
return getFallbackFailureCount(username)
|
||||
}
|
||||
}
|
||||
|
||||
// 定期清理过期记录（每5分钟执行一次）
|
||||
setInterval(cleanupExpiredLocks, 5 * 60 * 1000)
|
||||
Reference in New Issue
Block a user