mirror of
https://github.com/certd/certd.git
synced 2026-05-16 13:17:29 +08:00
xiaojunnuo
586 lines
18 KiB
TypeScript
586 lines
18 KiB
TypeScript
import {Inject, Provide, Scope, ScopeEnum} from "@midwayjs/core";
|
||
import {BaseService, Constants, NeedSuiteException, NeedVIPException, SysSettingsService} from "@certd/lib-server";
|
||
import {InjectEntityModel} from "@midwayjs/typeorm";
|
||
import {In, Repository} from "typeorm";
|
||
import {SiteInfoEntity} from "../entity/site-info.js";
|
||
import {siteTester} from "./site-tester.js";
|
||
import dayjs from "dayjs";
|
||
import {logger, utils} from "@certd/basic";
|
||
import {PeerCertificate} from "tls";
|
||
import {NotificationService} from "../../pipeline/service/notification-service.js";
|
||
import {isComm, isPlus} from "@certd/plus-core";
|
||
import {UserSuiteService} from "@certd/commercial-core";
|
||
import {UserSettingsService} from "../../mine/service/user-settings-service.js";
|
||
import {UserSiteMonitorSetting} from "../../mine/service/models.js";
|
||
import {SiteIpService} from "./site-ip-service.js";
|
||
import {SiteIpEntity} from "../entity/site-ip.js";
|
||
import {Cron} from "../../cron/cron.js";
|
||
import { dnsContainer } from "./dns-custom.js";
|
||
import { merge } from "lodash-es";
|
||
import { JobHistoryService } from "./job-history-service.js";
|
||
import { JobHistoryEntity } from "../entity/job-history.js";
|
||
import { UserService } from "../../sys/authority/service/user-service.js";
|
||
import { ProjectService } from "../../sys/enterprise/service/project-service.js";
|
||
|
||
@Provide()
|
||
@Scope(ScopeEnum.Request, {allowDowngrade: true})
|
||
export class SiteInfoService extends BaseService<SiteInfoEntity> {
|
||
@InjectEntityModel(SiteInfoEntity)
|
||
repository: Repository<SiteInfoEntity>;
|
||
|
||
@Inject()
|
||
notificationService: NotificationService;
|
||
|
||
@Inject()
|
||
sysSettingsService: SysSettingsService;
|
||
|
||
@Inject()
|
||
userSuiteService: UserSuiteService;
|
||
|
||
@Inject()
|
||
userSettingsService: UserSettingsService;
|
||
|
||
@Inject()
|
||
siteIpService: SiteIpService;
|
||
|
||
@Inject()
|
||
jobHistoryService: JobHistoryService;
|
||
|
||
@Inject()
|
||
userService: UserService;
|
||
@Inject()
|
||
projectService: ProjectService;
|
||
|
||
@Inject()
|
||
cron: Cron;
|
||
|
||
//@ts-ignore
|
||
getRepository() {
|
||
return this.repository;
|
||
}
|
||
|
||
async add(data: SiteInfoEntity) {
|
||
if (data.userId == null) {
|
||
throw new Error("userId is required");
|
||
}
|
||
|
||
if (isComm()) {
|
||
const suiteSetting = await this.userSuiteService.getSuiteSetting();
|
||
if (suiteSetting.enabled) {
|
||
const userSuite = await this.userSuiteService.getMySuiteDetail(data.userId);
|
||
if (userSuite.monitorCount.max != -1 && userSuite.monitorCount.max <= userSuite.monitorCount.used) {
|
||
throw new NeedSuiteException("站点监控数量已达上限，请购买或升级套餐");
|
||
}
|
||
}
|
||
} else if (!isPlus()) {
|
||
const count = await this.getUserMonitorCount(data.userId);
|
||
if (count >= 1) {
|
||
throw new NeedVIPException("站点监控数量已达上限，请升级专业版");
|
||
}
|
||
}
|
||
data.disabled = false;
|
||
|
||
const found = await this.repository.findOne({
|
||
where: {
|
||
domain: data.domain,
|
||
userId: data.userId,
|
||
httpsPort: data.httpsPort || 443
|
||
}
|
||
});
|
||
if (found) {
|
||
return {id: found.id};
|
||
}
|
||
|
||
return await super.add(data);
|
||
}
|
||
|
||
async update(data: any) {
|
||
if (!data.id) {
|
||
throw new Error("id is required");
|
||
}
|
||
delete data.userId;
|
||
await super.update(data);
|
||
}
|
||
|
||
async getUserMonitorCount(userId: number) {
|
||
if (userId==null) {
|
||
throw new Error("userId is required");
|
||
}
|
||
return await this.repository.count({
|
||
where: {userId}
|
||
});
|
||
}
|
||
|
||
/**
|
||
* 检查站点证书过期时间
|
||
* @param site
|
||
* @param notify
|
||
* @param retryTimes
|
||
*/
|
||
async doCheck(site: SiteInfoEntity, notify = true, retryTimes = null) {
|
||
if (!site?.domain) {
|
||
throw new Error("站点域名不能为空");
|
||
}
|
||
|
||
const setting = await this.userSettingsService.getSetting<UserSiteMonitorSetting>(site.userId,site.projectId, UserSiteMonitorSetting);
|
||
const dnsServer = setting.dnsServer
|
||
let customDns = null
|
||
if (dnsServer && dnsServer.length > 0) {
|
||
customDns = dnsContainer.getDns(dnsServer) as any
|
||
}
|
||
|
||
try {
|
||
await this.update({
|
||
id: site.id,
|
||
checkStatus: "checking",
|
||
lastCheckTime: dayjs().valueOf()
|
||
});
|
||
const res = await siteTester.test({
|
||
host: site.domain,
|
||
port: site.httpsPort,
|
||
retryTimes,
|
||
customDns,
|
||
ipAddress: site.ipAddress,
|
||
});
|
||
|
||
const certi: PeerCertificate = res.certificate;
|
||
if (!certi) {
|
||
throw new Error("没有发现证书");
|
||
}
|
||
const effective = certi.valid_from;
|
||
const expires = certi.valid_to;
|
||
const allDomains = certi.subjectaltname?.replaceAll("DNS:", "").split(",") || [];
|
||
const mainDomain = certi.subject?.CN;
|
||
let domains = allDomains;
|
||
if (!allDomains.includes(mainDomain)) {
|
||
domains = [mainDomain, ...allDomains];
|
||
}
|
||
const issuer = `${certi.issuer.O}<${certi.issuer.CN}>`;
|
||
const isExpired = dayjs().valueOf() > dayjs(expires).valueOf();
|
||
const status = isExpired ? "expired" : "ok";
|
||
const updateData = {
|
||
id: site.id,
|
||
certDomains: domains.join(","),
|
||
certStatus: status,
|
||
certProvider: issuer,
|
||
certEffectiveTime: dayjs(effective).valueOf(),
|
||
certExpiresTime: dayjs(expires).valueOf(),
|
||
lastCheckTime: dayjs().valueOf(),
|
||
error: null,
|
||
checkStatus: "ok"
|
||
};
|
||
logger.info(`测试站点成功：id=${updateData.id},site=${site.name},certEffectiveTime=${updateData.certEffectiveTime},expiresTime=${updateData.certExpiresTime}`)
|
||
if (site.ipCheck) {
|
||
delete updateData.checkStatus
|
||
}
|
||
await this.update(updateData);
|
||
|
||
const setting = await this.userSettingsService.getSetting<UserSiteMonitorSetting>(site.userId,site.projectId, UserSiteMonitorSetting)
|
||
|
||
merge(site,updateData)
|
||
//检查ip
|
||
await this.checkAllIp(site,retryTimes,setting);
|
||
|
||
if (!notify) {
|
||
return;
|
||
}
|
||
|
||
try {
|
||
await this.sendExpiresNotify(site.id,setting);
|
||
} catch (e) {
|
||
logger.error("send notify error", e);
|
||
}
|
||
} catch (e) {
|
||
logger.error("check site error", e);
|
||
let message = e.message
|
||
if (!message){
|
||
message = e.code
|
||
}
|
||
if (e.errors &&e.errors.length > 0){
|
||
message += "\n"+e.errors.map((item:any)=>item.message).join("\n")
|
||
}
|
||
await this.update({
|
||
id: site.id,
|
||
checkStatus: "error",
|
||
lastCheckTime: dayjs().valueOf(),
|
||
error: message
|
||
});
|
||
if (!notify) {
|
||
return;
|
||
}
|
||
try {
|
||
await this.sendCheckErrorNotify(site.id,false,setting);
|
||
} catch (e) {
|
||
logger.error("send notify error", e);
|
||
}
|
||
}
|
||
}
|
||
|
||
async checkAllIp(site: SiteInfoEntity,retryTimes = null,setting: UserSiteMonitorSetting) {
|
||
if (!site.ipCheck) {
|
||
return;
|
||
}
|
||
const certExpiresTime = site.certExpiresTime;
|
||
const tipDays = setting?.certValidDays || 10;
|
||
const onFinished = async (list: SiteIpEntity[]) => {
|
||
let errorCount = 0;
|
||
let errorMessage = "";
|
||
for (const item of list) {
|
||
if (!item) {
|
||
continue;
|
||
}
|
||
errorCount++;
|
||
|
||
const isExpired = dayjs().valueOf() > dayjs(item.certExpiresTime).valueOf();
|
||
const isWillExpired = dayjs().valueOf() > dayjs(item.certExpiresTime).subtract(tipDays, "day").valueOf();
|
||
|
||
if (item.error) {
|
||
errorMessage += `${item.ipAddress}：${item.error}； \n`;
|
||
} else if (item.certExpiresTime !== certExpiresTime && !site.ipIgnoreCoherence) {
|
||
errorMessage += `${item.ipAddress}：与主站证书过期时间不一致(主站：${dayjs(certExpiresTime).format("YYYY-MM-DD")}，IP：${dayjs(item.certExpiresTime).format("YYYY-MM-DD")})； \n`;
|
||
} else if (isExpired){
|
||
errorMessage += `${item.ipAddress}：证书已过期(过期时间：${dayjs(item.certExpiresTime).format("YYYY-MM-DD")})； \n`;
|
||
}else if (isWillExpired){
|
||
errorMessage += `${item.ipAddress}：证书将过期(过期时间：${dayjs(item.certExpiresTime).format("YYYY-MM-DD")})； \n`;
|
||
}else {
|
||
errorCount--;
|
||
}
|
||
}
|
||
if (errorCount <= 0) {
|
||
//检查正常
|
||
await this.update({
|
||
id: site.id,
|
||
checkStatus: "ok",
|
||
error: "",
|
||
ipErrorCount: 0
|
||
});
|
||
return;
|
||
}
|
||
await this.update({
|
||
id: site.id,
|
||
checkStatus: "error",
|
||
error: errorMessage,
|
||
ipErrorCount: errorCount
|
||
});
|
||
try {
|
||
await this.sendCheckErrorNotify(site.id, true,setting);
|
||
} catch (e) {
|
||
logger.error("send notify error", e);
|
||
}
|
||
};
|
||
if (site.ipSyncAuto === false) {
|
||
await this.siteIpService.checkAll(site, retryTimes,onFinished);
|
||
}else{
|
||
await this.siteIpService.syncAndCheck(site, retryTimes,onFinished);
|
||
}
|
||
|
||
}
|
||
|
||
/**
|
||
* 检查,不等待返回
|
||
* @param id
|
||
* @param notify
|
||
* @param retryTimes
|
||
*/
|
||
async check(id: number, notify = false, retryTimes = null) {
|
||
const site = await this.info(id);
|
||
if (!site) {
|
||
throw new Error("站点不存在");
|
||
}
|
||
|
||
this.doCheck(site, notify, retryTimes).catch((err) => {
|
||
logger.error("check site error", err);
|
||
});
|
||
return
|
||
}
|
||
|
||
async sendCheckErrorNotify(siteId: number, fromIpCheck = false,setting: UserSiteMonitorSetting) {
|
||
const site = await this.info(siteId);
|
||
const url = await this.notificationService.getBindUrl("#/certd/monitor/site");
|
||
// 发邮件
|
||
await this.notificationService.send(
|
||
{
|
||
id: setting?.notificationId,
|
||
useDefault: true,
|
||
logger: logger,
|
||
body: {
|
||
url,
|
||
title: `站点证书${fromIpCheck ? "(IP)" : ""}检查出错<${site.name}>`,
|
||
content: `站点名称： ${site.name} \n站点域名： ${site.domain} \n错误信息：${site.error}`,
|
||
errorMessage: site.error,
|
||
notificationType: "siteCheckError",
|
||
}
|
||
},
|
||
site.userId
|
||
);
|
||
}
|
||
|
||
async sendExpiresNotify(siteId: number,setting: UserSiteMonitorSetting) {
|
||
const tipDays = setting?.certValidDays || 10;
|
||
const site = await this.info(siteId);
|
||
const expires = site.certExpiresTime;
|
||
const validDays = dayjs(expires).diff(dayjs(), "day");
|
||
const url = await this.notificationService.getBindUrl("#/certd/monitor/site");
|
||
const content = `站点名称： ${site.name} \n站点域名： ${site.domain} \n证书域名： ${site.certDomains} \n颁发机构： ${site.certProvider} \n过期时间： ${dayjs(site.certExpiresTime).format("YYYY-MM-DD")} \n`;
|
||
if (validDays >= 0 && validDays < tipDays) {
|
||
// 发通知
|
||
await this.notificationService.send(
|
||
{
|
||
id: setting?.notificationId,
|
||
useDefault: true,
|
||
logger: logger,
|
||
body: {
|
||
title: `站点证书即将过期，剩余${validDays}天，<${site.name}>`,
|
||
content,
|
||
url,
|
||
errorMessage: "站点证书即将过期",
|
||
notificationType: "siteCertExpireRemind",
|
||
}
|
||
},
|
||
site.userId
|
||
);
|
||
} else if (validDays < 0) {
|
||
//发过期通知
|
||
await this.notificationService.send(
|
||
{
|
||
id: setting?.notificationId,
|
||
useDefault: true,
|
||
logger: logger,
|
||
body: {
|
||
title: `站点证书已过期${-validDays}天<${site.name}>`,
|
||
content,
|
||
url,
|
||
errorMessage: "站点证书已过期",
|
||
notificationType: "siteCertExpireRemind",
|
||
}
|
||
},
|
||
site.userId
|
||
);
|
||
}
|
||
}
|
||
|
||
async checkList(sites: SiteInfoEntity[]) {
|
||
const cache = {}
|
||
const getFromCache = async (userId: number,projectId?: number) =>{
|
||
const key = `${userId}_${projectId??""}`
|
||
if (cache[key]) {
|
||
return cache[key];
|
||
}
|
||
const setting = await this.userSettingsService.getSetting<UserSiteMonitorSetting>(userId,projectId, UserSiteMonitorSetting)
|
||
cache[key] = setting
|
||
return setting;
|
||
}
|
||
for (const site of sites) {
|
||
const setting = await getFromCache(site.userId,site.projectId)
|
||
let retryTimes = setting?.retryTimes
|
||
this.doCheck(site,true,retryTimes).catch(e => {
|
||
logger.error(`检查站点证书失败，${site.domain}`, e.message);
|
||
});
|
||
await utils.sleep(100);
|
||
}
|
||
}
|
||
|
||
async getSetting(userId: number,projectId?: number) {
|
||
return await this.userSettingsService.getSetting<UserSiteMonitorSetting>(userId,projectId, UserSiteMonitorSetting);
|
||
}
|
||
|
||
async saveSetting(userId: number,projectId: number, bean: UserSiteMonitorSetting) {
|
||
await this.userSettingsService.saveSetting(userId,projectId, bean);
|
||
if(bean.cron){
|
||
//注册job
|
||
await this.registerSiteMonitorJob(userId,projectId);
|
||
}else{
|
||
this.clearSiteMonitorJob(userId,projectId);
|
||
}
|
||
}
|
||
|
||
async ipCheckChange(req: { id: any; ipCheck: any }) {
|
||
|
||
await this.update({
|
||
id: req.id,
|
||
ipCheck: req.ipCheck
|
||
});
|
||
if (req.ipCheck) {
|
||
const site = await this.info(req.id);
|
||
await this.siteIpService.sync(site);
|
||
}
|
||
}
|
||
|
||
async disabledChange(req: { disabled: any; id: any }) {
|
||
await this.update({
|
||
id: req.id,
|
||
disabled: req.disabled
|
||
});
|
||
if (!req.disabled) {
|
||
const site = await this.info(req.id);
|
||
await this.doCheck(site);
|
||
}
|
||
}
|
||
|
||
async doImport(req: { text: string; userId: number,groupId?:number,projectId?:number }) {
|
||
if (!req.text) {
|
||
throw new Error("text is required");
|
||
}
|
||
if (req.userId == null) {
|
||
throw new Error("userId is required");
|
||
}
|
||
|
||
const rows = req.text.split("\n");
|
||
|
||
const list = [];
|
||
for (const item of rows) {
|
||
if (!item) {
|
||
continue;
|
||
}
|
||
const arr = item.trim().split(":");
|
||
if (arr.length === 0) {
|
||
continue;
|
||
}
|
||
const domain = arr[0];
|
||
let port = 443;
|
||
let name = domain;
|
||
if (arr.length > 1) {
|
||
try {
|
||
port = parseInt(arr[1] || "443");
|
||
} catch (e) {
|
||
throw new Error(`${item}格式错误`);
|
||
}
|
||
}
|
||
if (arr.length > 2) {
|
||
name = arr[2] || domain;
|
||
}
|
||
let remark:string = "";
|
||
if (arr.length > 3) {
|
||
remark = arr[3] || "";
|
||
}
|
||
|
||
list.push({
|
||
domain,
|
||
name,
|
||
httpsPort: port,
|
||
userId: req.userId,
|
||
remark,
|
||
groupId: req.groupId,
|
||
projectId: req.projectId
|
||
});
|
||
}
|
||
|
||
const batchAdd = async (list: any[]) => {
|
||
for (const item of list) {
|
||
await this.add(item);
|
||
}
|
||
|
||
// await this.checkAllByUsers(req.userId);
|
||
};
|
||
await batchAdd(list);
|
||
}
|
||
|
||
clearSiteMonitorJob(userId: number,projectId?: number) {
|
||
this.cron.remove(`siteMonitor_${userId}_${projectId||""}`);
|
||
}
|
||
|
||
async registerSiteMonitorJob(userId?: number,projectId?: number) {
|
||
const setting = await this.userSettingsService.getSetting<UserSiteMonitorSetting>(userId,projectId, UserSiteMonitorSetting);
|
||
if (!setting.cron) {
|
||
return;
|
||
}
|
||
//注册个人的 或项目的
|
||
this.cron.register({
|
||
name: `siteMonitor_${userId}_${projectId||""}`,
|
||
cron: setting.cron,
|
||
job: () => this.triggerJobOnce(userId,projectId),
|
||
});
|
||
}
|
||
|
||
async triggerCommonJob(){
|
||
//遍历用户
|
||
const userIds = await this.userService.getAllUserIds()
|
||
for (const userId of userIds) {
|
||
const setting = await this.userSettingsService.getSetting<UserSiteMonitorSetting>(userId,null,UserSiteMonitorSetting)
|
||
if(setting && setting.cron){
|
||
//该用户有自定义检查时间，跳过公共job
|
||
continue
|
||
}
|
||
await this.triggerJobOnce(userId)
|
||
}
|
||
|
||
//遍历项目
|
||
const projectIds = await this.projectService.getAllProjectIds()
|
||
for (const projectId of projectIds) {
|
||
const userId = Constants.enterpriseUserId
|
||
const setting = await this.userSettingsService.getSetting<UserSiteMonitorSetting>(userId,projectId,UserSiteMonitorSetting)
|
||
if(setting && setting.cron){
|
||
//该项目有自定义检查时间，跳过公共job
|
||
continue
|
||
}
|
||
await this.triggerJobOnce(userId,projectId)
|
||
}
|
||
}
|
||
|
||
async triggerJobOnce(userId?:number,projectId?:number) {
|
||
if(userId==null){
|
||
throw new Error("userId is required");
|
||
}
|
||
const query:any = { disabled: false };
|
||
query.userId = userId;
|
||
if(projectId){
|
||
query.projectId = projectId;
|
||
}
|
||
const siteCount = await this.repository.count({
|
||
where: query,
|
||
});
|
||
if (siteCount === 0) {
|
||
logger.info(`用户/项目[${userId}_${projectId||""}]没有站点证书需要检查`)
|
||
return;
|
||
}
|
||
|
||
logger.info(`站点证书检查开始执行[${userId}_${projectId||""}]`);
|
||
|
||
let jobEntity :Partial<JobHistoryEntity> = null;
|
||
|
||
jobEntity = {
|
||
userId,
|
||
projectId,
|
||
type:"siteCertMonitor",
|
||
title: '站点证书检查',
|
||
result:"start",
|
||
startAt:new Date().getTime(),
|
||
}
|
||
await this.jobHistoryService.add(jobEntity);
|
||
let offset = 0;
|
||
const limit = 50;
|
||
let count = 0;
|
||
while (true) {
|
||
const res = await this.page({
|
||
query: query,
|
||
page: { offset, limit },
|
||
});
|
||
const { records } = res;
|
||
|
||
if (records.length === 0) {
|
||
break;
|
||
}
|
||
offset += records.length;
|
||
count += records.length;
|
||
await this.checkList(records);
|
||
}
|
||
|
||
logger.info(`站点证书检查完成[${userId}_${projectId||""}]`);
|
||
await this.jobHistoryService.update({
|
||
id: jobEntity.id,
|
||
result: "done",
|
||
content:`共检查${count}个站点`,
|
||
endAt:new Date().getTime(),
|
||
updateTime:new Date(),
|
||
});
|
||
}
|
||
|
||
async batchDelete(ids: number[], userId: number,projectId?:number): Promise<void> {
|
||
await this.repository.delete({
|
||
id: In(ids),
|
||
userId,
|
||
projectId,
|
||
});
|
||
}
|
||
}
|