MC_Report/backend/routes/notifications.js

/*
 * MC Report System
 * Copyright (C) 2026 Sea Network Technology Studio
 * Author: CangLan <admin@sea-studio.top>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published
 * by the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

const express = require('express');
const { query, getRow } = require('../db');
const { authenticate, requireRole } = require('../middleware/auth');
const { sendWebhook, isPrivateUrl } = require('../webhook');

const router = express.Router();

const NOTIFY_TYPES = ['webhook', 'email', 'generic'];
const NOTIFY_EVENTS = ['all', 'ticket_created', 'ticket_claimed', 'ticket_transferred', 'ticket_updated'];

// 校验通知配置字段(创建/更新共用)
async function validateNotify(body) {
  const { name, type, webhook_url, events } = body;
  if (name !== undefined && (!name || String(name).length > 100)) return '名称不能为空且不超过100字符';
  if (type !== undefined && !NOTIFY_TYPES.includes(type)) return '无效的通知类型';
  if (webhook_url !== undefined && webhook_url !== '') {
    if (type === 'email') {
      // email 类型: webhook_url 复用为收件人邮箱(逗号分隔)
      const emails = String(webhook_url).split(',').map(s => s.trim()).filter(Boolean);
      if (!emails.length) return '收件人邮箱不能为空';
      if (!emails.every(e => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e))) return '收件人邮箱格式无效';
    } else {
      let u;
      try { u = new URL(webhook_url); } catch { return 'Webhook地址格式无效'; }
      if (u.protocol !== 'https:' && u.protocol !== 'http:') return 'Webhook地址协议不支持';
      if (await isPrivateUrl(webhook_url)) return 'Webhook地址不允许指向内网';
    }
  }
  if (type === 'email' && !webhook_url) return '邮件通知需填写收件人邮箱';
  if (events !== undefined) {
    const list = String(events).split(',').map(s => s.trim());
    if (!list.every(e => NOTIFY_EVENTS.includes(e))) return '无效的触发事件';
  }
  return null;
}

router.get('/', authenticate, requireRole('owner','admin'), async (req, res) => {
  res.json(await query('SELECT * FROM notification_configs ORDER BY id'));
});

router.post('/', authenticate, requireRole('owner','admin'), async (req, res) => {
  const { name, type, webhook_url, events } = req.body;
  if (!name || !type) return res.status(400).json({ error: '名称和类型为必填' });
  const err = await validateNotify({ name, type, webhook_url, events });
  if (err) return res.status(400).json({ error: err });
  if (type === 'webhook' && !webhook_url) return res.status(400).json({ error: 'Webhook地址必填' });
  const r = await query('INSERT INTO notification_configs(name, type, webhook_url, events) VALUES (?,?,?,?)', [name, type, webhook_url||'', events||'all']);
  await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'create_notification', 'notification_config', r.insertId, `创建通知: ${name}`]);
  res.status(201).json({ id: r.insertId, message: '创建成功' });
});

router.put('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
  const id = parseInt(req.params.id);
  if (!id) return res.status(400).json({ error: '无效的ID' });
  const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]);
  if (!cfg) return res.status(404).json({ error: '配置不存在' });
  const err = await validateNotify(req.body);
  if (err) return res.status(400).json({ error: err });
  const fields = {};
  if (req.body.name) fields.name = req.body.name;
  if (req.body.webhook_url !== undefined) fields.webhook_url = req.body.webhook_url;
  if (req.body.type) fields.type = req.body.type;
  if (req.body.active !== undefined) { if (typeof req.body.active !== 'boolean' && ![0,1,'0','1'].includes(req.body.active)) return res.status(400).json({ error: 'active 必须为布尔值' }); fields.active = req.body.active ? 1 : 0; }
  if (req.body.events !== undefined) fields.events = req.body.events;
  if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
  const sets = Object.keys(fields).map(k=>`${k}=?`).join(',');
  await query(`UPDATE notification_configs SET ${sets} WHERE id = ?`, [...Object.values(fields), id]);
  res.json({ message: '更新成功' });
});

router.delete('/:id', authenticate, requireRole('owner','admin'), async (req, res) => {
  const id = parseInt(req.params.id);
  if (!id) return res.status(400).json({ error: '无效的ID' });
  await query('DELETE FROM notification_configs WHERE id = ?', [id]);
  res.json({ message: '已删除' });
});

router.post('/:id/test', authenticate, requireRole('owner','admin'), async (req, res) => {
  const id = parseInt(req.params.id);
  if (!id) return res.status(400).json({ error: '无效的ID' });
  const cfg = await getRow('SELECT * FROM notification_configs WHERE id = ?', [id]);
  if (!cfg||!cfg.webhook_url) return res.status(404).json({ error: '配置不存在' });
  sendWebhook('ticket_created', { ticket_id:'TEST', ticket_title:'测试通知', ticket_type:'测试', reporter_game_name:'TestPlayer', reporter_game_uid:'TEST001', ticket_reason:'这是一条测试消息' }).then(() => res.json({ message:'测试消息已发送' })).catch(e => res.status(500).json({ error:e.message }));
});

module.exports = router;