hansjone/dsh-im-ops
1
0
Fork 0
mirror of https://github.com/hansjone/dsh-im-ops.git synced 2026-10-10 09:03:17 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(weixin): distinguish loopback Harness denial

Browse source
This commit is contained in:
xmanrui 2026-08-22 22:59:24 +08:00
parent 85aaecf1f2
commit dc10cb22c8
7 changed files with 126 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/channels/shared/harness-client.mjs
View file

@ -46,13 +46,23 @@ async function smallResponseText(response) {
return new TextDecoder().decode(bytes);
}
async function harnessHttpErrorCode(response) {
function isLoopbackHarnessHostname(hostname) {
if (hostname === 'localhost' || hostname === '[::1]') return true;
const parts = hostname.split('.');
return parts.length === 4
&& parts[0] === '127'
&& parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
}
async function harnessHttpErrorCode(response, hostname) {
if (response.status === 401) return 'harness-auth-required';
if (response.status === 407) return 'harness-proxy-auth-required';
if (response.status === 403) {
const body = await smallResponseText(response);
return body?.trim() === 'forbidden'
? 'harness-host-untrusted'
: 'harness-request-forbidden';
if (body?.trim() !== 'forbidden') return 'harness-request-forbidden';
return isLoopbackHarnessHostname(hostname)
? 'harness-loopback-forbidden'
: 'harness-host-untrusted';
}
if (response.status === 404) return 'harness-api-not-found';
return 'harness-http-failed';
@ -543,7 +553,7 @@ export class HarnessClient {
);
}
if (!response.ok) {
const code = await harnessHttpErrorCode(response);
const code = await harnessHttpErrorCode(response, this.#baseUrl.hostname);
throw new HarnessTransportError(code, method, { status: response.status });
}
let body;

4
src/channels/weixin/weixin-controller.mjs
View file

@ -28,7 +28,9 @@ const ACTIVATION_ERROR_MESSAGES = Object.freeze({
'harness-connect-failed': '微信已授权，但插件无法连接本机 Harness。请检查 dsh web 地址和端口。',
'harness-timeout': '微信已授权，但 Harness 健康检查超时。请确认 dsh web 未阻塞。',
'harness-auth-required': '微信已授权，但 Harness 健康检查需要身份认证。请检查代理、网关或自定义鉴权配置。',
'harness-host-untrusted': '微信已授权，但 Harness 的 Host 信任检查拒绝了本机请求。请检查 harnessBaseUrl 与 trustedHosts 配置。',
'harness-proxy-auth-required': '微信已授权，但本机 Harness 请求被代理要求认证。请让回环地址绕过代理，并检查 NO_PROXY 配置。',
'harness-loopback-forbidden': '微信已授权，但 Harness 异常拒绝了回环地址的健康检查。请检查 HTTP 代理、Harness 源码版本和构建产物。',
'harness-host-untrusted': '微信已授权，但 Harness 的 Host 信任检查拒绝了非回环地址请求。请检查 harnessBaseUrl 与 trustedHosts 配置。',
'harness-request-forbidden': '微信已授权，但健康检查收到了非 Harness 标准的 403 拒绝响应。请检查代理或网关配置。',
'harness-api-not-found': '微信已授权，但找不到 Harness 健康检查接口。请确认 Harness 与插件版本兼容。',
'harness-http-failed': '微信已授权，但 Harness 健康检查返回服务错误。请查看 dsh web 日志。',

2
src/channels/weixin/weixin-runtime.mjs
View file

@ -10,6 +10,8 @@ const HARNESS_HEALTH_ERROR_CODES = new Set([
'harness-connect-failed',
'harness-timeout',
'harness-auth-required',
'harness-proxy-auth-required',
'harness-loopback-forbidden',
'harness-host-untrusted',
'harness-request-forbidden',
'harness-api-not-found',