PAWPLAY · WEEKLY REVIEW
运营概览
收支台账
现金、分摊、预估分别保留PAWPLAY · EVOLUTION
演变路径
从起因到下一步，回看每次探索的依据与决定。
正在打开运营台…
diff --git a/ops-portal/server.mjs b/ops-portal/server.mjs index 7a717eb..1d48f76 100644 --- a/ops-portal/server.mjs +++ b/ops-portal/server.mjs @@ -67,6 +67,31 @@ export function createApp(options = process.env) { return results.sort((a, b) => String(b.period_end || b.id).localeCompare(String(a.period_end || a.id))); } + async function dailyRecords() { + let directory; + try { directory = await realpath(path.join(dataDir, 'daily')); } + catch (error) { if (error.code === 'ENOENT') return { records: [], invalid_count: 0 }; throw error; } + const actualRoot = await realpath(dataDir); + if (!directory.startsWith(actualRoot + path.sep)) throw new Error('Data path escapes DATA_DIR'); + const names = await readdir(directory); + const fields = ['planned', 'executed', 'evidence', 'costs', 'review', 'tomorrow']; + const records = []; let invalidCount = 0; + for (const name of names.filter(n => /^\d{4}-\d{2}-\d{2}\.json$/.test(n)).sort().reverse()) { + const day = name.slice(0, -5); + const parsed = new Date(day + 'T00:00:00Z'); + if (!Number.isFinite(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== day) { invalidCount++; continue; } + try { + const item = await jsonFile(`daily/${name}`, null); + if (!item || Array.isArray(item) || typeof item !== 'object' || item.date !== day || + fields.some(field => item[field] !== undefined && (!Array.isArray(item[field]) || item[field].some(value => typeof value !== 'string')))) { + invalidCount++; continue; + } + records.push({ date: day, ...Object.fromEntries(fields.map(field => [field, item[field] || []])) }); + } catch { invalidCount++; } + } + return { records, invalid_count: invalidCount }; + } + function json(res, status, body, extra = {}) { res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', ...extra }); res.end(JSON.stringify(body)); @@ -130,6 +155,7 @@ export function createApp(options = process.env) { if (route.startsWith('/api/')) { if (!session(req)) return json(res, 401, { error: '请先登录' }); if (req.method === 'GET' && route === '/api/evolution') return json(res, 200, await jsonFile('evolution.json', { schema_version: 1, events: [] })); + if (req.method === 'GET' && route === '/api/daily') return json(res, 200, await dailyRecords()); if (req.method === 'GET' && route === '/api/dashboard') { const list = await reports(); const config = await jsonFile('config.json', { title: 'PawPlay 运营台', timezone: 'Asia/Shanghai', budget: { billing_period: 'pending' } }); diff --git a/ops-portal/test/server.test.mjs b/ops-portal/test/server.test.mjs index 7e91a50..5550186 100644 --- a/ops-portal/test/server.test.mjs +++ b/ops-portal/test/server.test.mjs @@ -125,3 +125,39 @@ test('evolution is private, readable after login, and empty when absent', async const empty = await request('/api/evolution', { headers: { Cookie: cookie } }); assert.equal(empty.status, 200); assert.deepEqual(await empty.json(), { schema_version: 1, events: [] }); }); + +test('daily records require authentication, sort by date, validate input and remain read-only', async t => { + const { directory, request, login } = await fixture(t); + await mkdir(path.join(directory, 'daily')); + const write = (name, value) => writeFile(path.join(directory, 'daily', name), value); + await write('2026-11-02.json', JSON.stringify({ date: '2026-11-02', planned: [''], costs: ['未知'] })); + await write('2026-11-03.json', JSON.stringify({ date: '2026-11-03', executed: ['完成'], evidence: ['证据'] })); + await write('2026-11-04.json', '{broken'); + await write('2026-11-05.json', JSON.stringify({ date: '2026-11-05', planned: 'wrong type' })); + await write('2026-02-30.json', JSON.stringify({ date: '2026-02-30' })); + await write('ignored.json', 'bad'); + const anonymous = await request('/api/daily'); assert.equal(anonymous.status, 401); assert.doesNotMatch(await anonymous.text(), /private|完成/); + assert.equal((await request('/daily/2026-11-02.json')).status, 404); + const cookie = (await login()).headers.get('set-cookie').split(';')[0]; + const headers = { Cookie: cookie }; + const result = await request('/api/daily', { headers }); assert.equal(result.status, 200); + const body = await result.json(); assert.equal(body.invalid_count, 3); + assert.deepEqual(body.records.map(r => r.date), ['2026-11-03', '2026-11-02']); + assert.deepEqual(body.records[0].planned, []); assert.deepEqual(body.records[0].executed, ['完成']); + assert.deepEqual(body.records[1].costs, ['未知']); + assert.equal((await request('/api/daily', { method: 'POST', headers: { ...headers, Origin: origin }, body: '{}' })).status, 404); + await rm(path.join(directory, 'daily'), { recursive: true }); + assert.deepEqual(await (await request('/api/daily', { headers })).json(), { records: [], invalid_count: 0 }); +}); + +test('daily symlinks cannot disclose files outside DATA_DIR', async t => { + const { directory, request, login } = await fixture(t); + const outside = await mkdtemp(path.join(tmpdir(), 'pawplay-daily-outside-')); t.after(() => rm(outside, { recursive: true, force: true })); + await mkdir(path.join(directory, 'daily')); + await writeFile(path.join(outside, 'secret.json'), JSON.stringify({ date: '2026-11-03', executed: ['OUTSIDE-SECRET'] })); + await symlink(path.join(outside, 'secret.json'), path.join(directory, 'daily/2026-11-03.json')); + const cookie = (await login()).headers.get('set-cookie').split(';')[0]; + const response = await request('/api/daily', { headers: { Cookie: cookie } }); + assert.equal(response.status, 200); const text = await response.text(); assert.doesNotMatch(text, /OUTSIDE-SECRET/); + assert.deepEqual(JSON.parse(text), { records: [], invalid_count: 1 }); +});