feat: skin site UUID lookup - auto-fetch UUID from player name
- GET /settings/uuid-lookup?site=&name= : proxy Yggdrasil API
(POST {site}/api/yggdrasil/api/profiles/minecraft), SSRF guard,
10s timeout, name regex, UUID formatting (with dashes)
- GET /settings/skin-site : public read of configured skin site
- settings page: 皮肤站地址 config
- bind identity modals (player dashboard + admin users): 获取UUID button,
auto-fill site from settings, auto-fill UID from lookup
- verified live against littleskin.cn (Steve -> df273bda...)
- API docs updated
This commit is contained in:
@@ -43,4 +43,52 @@ router.put('/settings', authenticate, requireRole('owner','admin'), async (req,
|
||||
res.json({ message: '设置已保存' });
|
||||
});
|
||||
|
||||
// ---- 皮肤站 UUID 查询(Yggdrasil API: POST {site}/api/yggdrasil/api/profiles/minecraft) ----
|
||||
function formatUuid(id) {
|
||||
if (!id) return '';
|
||||
const s = String(id).replace(/-/g, '').toLowerCase();
|
||||
if (s.length !== 32) return String(id);
|
||||
return `${s.slice(0,8)}-${s.slice(8,12)}-${s.slice(12,16)}-${s.slice(16,20)}-${s.slice(20)}`;
|
||||
}
|
||||
|
||||
// 公开: 读取站点配置的皮肤站地址(玩家绑定身份时自动带出)
|
||||
router.get('/skin-site', async (req, res) => {
|
||||
try {
|
||||
const row = await getRow("SELECT v FROM settings WHERE k = 'skin_site'");
|
||||
res.json({ site: row?.v || '' });
|
||||
} catch { res.json({ site: '' }); }
|
||||
});
|
||||
|
||||
router.get('/uuid-lookup', authenticate, async (req, res) => {
|
||||
const { site, name } = req.query;
|
||||
if (!site || !name) return res.status(400).json({ error: '缺少参数 site 或 name' });
|
||||
if (!/^[A-Za-z0-9_]{1,32}$/.test(name)) return res.status(400).json({ error: '用户名仅允许字母数字下划线' });
|
||||
let u;
|
||||
try { u = new URL(site); } catch { return res.status(400).json({ error: '皮肤站地址无效' }); }
|
||||
if (u.protocol !== 'https:' && u.protocol !== 'http:') return res.status(400).json({ error: '协议不支持' });
|
||||
const host = u.hostname;
|
||||
if (host === 'localhost' || host === '127.0.0.1' || host === '0.0.0.0' ||
|
||||
host.startsWith('192.168.') || host.startsWith('10.') || host.startsWith('172.16.')) {
|
||||
return res.status(400).json({ error: '不允许内网地址(SSRF 防护)' });
|
||||
}
|
||||
try {
|
||||
const ctl = new AbortController();
|
||||
const t = setTimeout(() => ctl.abort(), 10000);
|
||||
const resp = await fetch(`${u.origin}/api/yggdrasil/api/profiles/minecraft`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json', 'User-Agent': 'MCReport/1.0' },
|
||||
body: JSON.stringify([name]),
|
||||
signal: ctl.signal,
|
||||
});
|
||||
clearTimeout(t);
|
||||
if (resp.status === 204) return res.json({ found: false, uuid: '', message: '皮肤站未找到该用户名' });
|
||||
const data = await resp.json();
|
||||
const hit = Array.isArray(data) ? data.find(x => x && x.name && String(x.name).toLowerCase() === name.toLowerCase()) : null;
|
||||
if (!hit?.id) return res.json({ found: false, uuid: '', message: '皮肤站未找到该用户名' });
|
||||
res.json({ found: true, uuid: formatUuid(hit.id), raw_id: String(hit.id).replace(/-/g, '') });
|
||||
} catch (e) {
|
||||
res.status(502).json({ error: '查询皮肤站失败: ' + (e.message || '网络错误') });
|
||||
}
|
||||
});
|
||||
|
||||
module.exports = router;
|
||||
|
||||
@@ -85,6 +85,8 @@ Base URL: `http://<host>:3100/api`
|
||||
| 同来源重复 | 拒绝(先删除再重新绑定) |
|
||||
| 至少保留一个 | 解绑时若只剩一个身份则拒绝 |
|
||||
|
||||
**皮肤站 UUID 自动查询**:皮肤站来源时,可通过 `GET /settings/uuid-lookup?site=<皮肤站地址>&name=<用户名>` 自动获取 UUID(调 Yggdrasil API `POST {site}/api/yggdrasil/api/profiles/minecraft`,带 SSRF 防护与 10s 超时)。站点皮肤站地址可在系统设置配置,前端绑定弹窗自动带出。
|
||||
|
||||
### DELETE /auth/identities/:id *(认证)*
|
||||
解绑身份。响应: `{ "message": "已解绑" }`
|
||||
|
||||
@@ -225,7 +227,7 @@ Base URL: `http://<host>:3100/api`
|
||||
```json
|
||||
{ "source": "skin", "game_name": "Alex", "game_uid": "SKIN_UUID" }
|
||||
```
|
||||
规则同 `POST /auth/identities`(同来源唯一、游戏名全局唯一、网易端必填 UID)。
|
||||
规则同 `POST /auth/identities`(同来源唯一、游戏名全局唯一、网易端必填 UID)。皮肤站来源同样支持「获取 UUID」辅助查询。
|
||||
|
||||
### DELETE /users/:id/identities/:identityId *(admin/owner)*
|
||||
管理员解绑用户身份(至少保留一个)。
|
||||
|
||||
@@ -93,14 +93,47 @@ const Dashboard = {
|
||||
<div class="form-group"><label>来源</label><select id="ident-source"><option value="netease">网易端</option><option value="skin">皮肤站</option></select></div>
|
||||
<div class="form-group"><label>游戏名 *</label><input id="ident-name" required placeholder="Minecraft ID"></div>
|
||||
<div class="form-group" id="ident-uid-group"><label>网易UID</label><input id="ident-uid" placeholder="仅网易端必填"></div>
|
||||
<div class="form-group hidden" id="ident-skin-group">
|
||||
<label>皮肤站地址</label>
|
||||
<div style="display:flex;gap:6px">
|
||||
<input id="ident-site" placeholder="https://littleskin.cn" style="flex:1">
|
||||
<button type="button" class="btn btn-o btn-sm" id="ident-fetch-btn" style="flex:0 0 auto;white-space:nowrap"><i class="fas fa-magnifying-glass"></i> 获取UUID</button>
|
||||
</div>
|
||||
<span class="help">输入皮肤站用户名后点「获取UUID」，自动填入下方UID</span>
|
||||
</div>
|
||||
<div id="ident-err" class="alert alert-e hidden"></div>
|
||||
<div class="modal-f"><button type="button" class="btn btn-o" onclick="App.closeModal()">取消</button><button type="submit" class="btn btn-p">绑定</button></div>
|
||||
</form>
|
||||
`);
|
||||
document.getElementById('ident-source').onchange = () => {
|
||||
const toggleSource = () => {
|
||||
const isNetease = document.getElementById('ident-source').value === 'netease';
|
||||
document.getElementById('ident-uid-group').style.display = isNetease ? '' : 'none';
|
||||
document.getElementById('ident-uid').required = isNetease;
|
||||
document.getElementById('ident-skin-group').classList.toggle('hidden', isNetease);
|
||||
};
|
||||
document.getElementById('ident-source').onchange = toggleSource;
|
||||
toggleSource();
|
||||
// 自动带出站点配置的皮肤站地址
|
||||
API.get('/settings/skin-site').then(r => {
|
||||
if (r.site && !document.getElementById('ident-site').value) document.getElementById('ident-site').value = r.site;
|
||||
}).catch(()=>{});
|
||||
document.getElementById('ident-fetch-btn').onclick = async () => {
|
||||
const site = document.getElementById('ident-site').value.trim();
|
||||
const name = document.getElementById('ident-name').value.trim();
|
||||
if (!site) return alert('请填写皮肤站地址');
|
||||
if (!name) return alert('请先填写游戏名(皮肤站用户名)');
|
||||
const btn = document.getElementById('ident-fetch-btn');
|
||||
btn.disabled = true; btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i> 查询中';
|
||||
try {
|
||||
const r = await API.get(`/settings/uuid-lookup?site=${encodeURIComponent(site)}&name=${encodeURIComponent(name)}`);
|
||||
if (r.found) {
|
||||
document.getElementById('ident-uid').value = r.uuid;
|
||||
alert('已获取 UUID: ' + r.uuid);
|
||||
} else {
|
||||
alert(r.message || '未找到该用户名');
|
||||
}
|
||||
} catch (ex) { alert(ex.message); }
|
||||
btn.disabled = false; btn.innerHTML = '<i class="fas fa-magnifying-glass"></i> 获取UUID';
|
||||
};
|
||||
document.getElementById('ident-form').onsubmit = async e => {
|
||||
e.preventDefault();
|
||||
|
||||
@@ -14,6 +14,7 @@ const SettingsPage = {
|
||||
<div class="form-group"><label>站点地址</label><input id="s-url" value="${U.esc(settings.site_url?.value||'')}"></div></div>
|
||||
<div class="grid-2"><div class="form-group"><label>页尾版权</label><input id="s-copyright" value="${U.esc(settings.copyright?.value||'')}" placeholder="© 2024 MC举报系统"></div>
|
||||
<div class="form-group"><label>ICP备案号</label><input id="s-icp" value="${U.esc(settings.icp?.value||'')}" placeholder="沪ICP备XXXXXXXX号"></div></div>
|
||||
<div class="form-group"><label>皮肤站地址</label><input id="s-skin-site" value="${U.esc(settings.skin_site?.value||'')}" placeholder="https://littleskin.cn（用于绑定皮肤站身份时自动查询UUID）"></div>
|
||||
<button type="submit" class="btn btn-p btn-sm"><i class="fas fa-save"></i> 保存站点设置</button>
|
||||
</form>
|
||||
</div></div>
|
||||
@@ -39,6 +40,7 @@ const SettingsPage = {
|
||||
site_url: {value: document.getElementById('s-url').value, label:'站点地址'},
|
||||
copyright: {value: document.getElementById('s-copyright').value, label:'页尾版权'},
|
||||
icp: {value: document.getElementById('s-icp').value, label:'ICP备案号'},
|
||||
skin_site: {value: document.getElementById('s-skin-site').value.trim(), label:'皮肤站地址'},
|
||||
});
|
||||
alert('已保存');
|
||||
} catch (ex) { alert(ex.message); }
|
||||
|
||||
@@ -114,8 +114,13 @@ const UsersPage = {
|
||||
</select>
|
||||
<input id="eu-ident-name" placeholder="游戏名" style="flex:1 1 30%;min-width:0;width:auto;padding:6px 8px;border:1px solid var(--g300);border-radius:var(--r);font-size:12px">
|
||||
<input id="eu-ident-uid" placeholder="UID(网易必填)" style="flex:1 1 30%;min-width:0;width:auto;padding:6px 8px;border:1px solid var(--g300);border-radius:var(--r);font-size:12px">
|
||||
<button type="button" class="btn btn-o btn-sm" id="eu-ident-fetch" style="flex:0 0 auto;white-space:nowrap" title="皮肤站用户名查UUID"><i class="fas fa-magnifying-glass"></i></button>
|
||||
<button type="button" class="btn btn-p btn-sm" style="flex:0 0 auto;white-space:nowrap" onclick="UsersPage.addIdentity(${id})"><i class="fas fa-plus"></i> 绑定</button>
|
||||
</div>
|
||||
<div class="form-group hidden" id="eu-ident-site-group" style="margin-top:6px">
|
||||
<input id="eu-ident-site" placeholder="皮肤站地址 (如 https://littleskin.cn)" style="padding:6px 8px;border:1px solid var(--g300);border-radius:var(--r);font-size:12px;width:100%">
|
||||
<span class="help">选皮肤站来源时,可输入用户名点搜索图标自动获取UUID</span>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal-f"><button type="button" class="btn btn-o" data-action="App:closeModal">取消</button><button type="submit" class="btn btn-p">保存</button></div>
|
||||
</form>
|
||||
@@ -133,6 +138,34 @@ const UsersPage = {
|
||||
const pw = document.getElementById('eu-p').value; if (pw) data.password = pw;
|
||||
try { await API.put('/users/'+id, data); App.closeModal(); this.load(); } catch (ex) { alert(ex.message); }
|
||||
};
|
||||
|
||||
// 来源切换: 皮肤站时显示 UUID 查询辅助
|
||||
const euToggleSource = () => {
|
||||
const isSkin = document.getElementById('eu-ident-source').value === 'skin';
|
||||
document.getElementById('eu-ident-site-group').classList.toggle('hidden', !isSkin);
|
||||
};
|
||||
document.getElementById('eu-ident-source').onchange = euToggleSource;
|
||||
euToggleSource();
|
||||
// 自动带出站点配置的皮肤站地址
|
||||
API.get('/settings/skin-site').then(r => {
|
||||
if (r.site && !document.getElementById('eu-ident-site').value) document.getElementById('eu-ident-site').value = r.site;
|
||||
}).catch(()=>{});
|
||||
|
||||
// 皮肤站用户名 → UUID 查询
|
||||
document.getElementById('eu-ident-fetch').onclick = async () => {
|
||||
const site = document.getElementById('eu-ident-site').value.trim();
|
||||
const name = document.getElementById('eu-ident-name').value.trim();
|
||||
if (!site) return alert('请填写皮肤站地址(来源为皮肤站时显示)');
|
||||
if (!name) return alert('请先填写游戏名(皮肤站用户名)');
|
||||
const btn = document.getElementById('eu-ident-fetch');
|
||||
btn.disabled = true; btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i>';
|
||||
try {
|
||||
const r = await API.get(`/settings/uuid-lookup?site=${encodeURIComponent(site)}&name=${encodeURIComponent(name)}`);
|
||||
if (r.found) { document.getElementById('eu-ident-uid').value = r.uuid; alert('已获取 UUID: ' + r.uuid); }
|
||||
else alert(r.message || '未找到该用户名');
|
||||
} catch (ex) { alert(ex.message); }
|
||||
btn.disabled = false; btn.innerHTML = '<i class="fas fa-magnifying-glass"></i>';
|
||||
};
|
||||
},
|
||||
|
||||
async addIdentity(userId) {
|
||||
|
||||
Reference in New Issue
Block a user