gavindiaz/PolyHermes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 添加WebSocket票据认证和钱包类型支持

Browse Source 
- 新增WebSocket票据服务，用于短期有效的WebSocket连接认证
- 支持Magic和Safe两种钱包类型，分别对应邮箱/OAuth登录和MetaMask用户
- 添加登录频率限制和安全防护
- 优化日志记录，屏蔽敏感信息
- 升级ethers.js到v6.16.0
- 新增多语言钱包类型说明
- 重构代理地址计算逻辑，支持CREATE2计算Magic代理地址
This commit is contained in:
wry5560
2026-01-03 12:27:59 +08:00
parent 591e678f73
commit 5a83444b56
26 changed files with 828 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/main/kotlin/com/wrbug/polymarketbot/config/JwtAuthenticationInterceptor.kt
+7 -8
View File
@@ -36,20 +36,19 @@ class JwtAuthenticationInterceptor(
handler: Any
): Boolean {
val path = request.requestURI
val method = request.method
// 只拦截POST请求
if (method != "POST") {
// 只拦截 /api/** 路径
if (!path.startsWith("/api/")) {
return true
}
// 排除不需要鉴权的路径
if (excludePaths.contains(path)) {
return true
}
// 只拦截 /api/** 路径
if (!path.startsWith("/api/")) {
// 允许 OPTIONS 请求（CORS 预检请求）
if (request.method == "OPTIONS") {
return true
}
backend/src/main/kotlin/com/wrbug/polymarketbot/config/WebMvcConfig.kt
-4
View File
@@ -21,10 +21,6 @@ class WebMvcConfig(
// 再注册JWT认证拦截器
registry.addInterceptor(jwtAuthenticationInterceptor)
.addPathPatterns("/api/**")
registry.addInterceptor(jwtAuthenticationInterceptor)
.addPathPatterns("/api/**")
registry.addInterceptor(jwtAuthenticationInterceptor)
.addPathPatterns("/api/**")
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/config/WebSocketAuthInterceptor.kt
+49 -18
View File
@@ -1,6 +1,7 @@
package com.wrbug.polymarketbot.config
import com.wrbug.polymarketbot.repository.UserRepository
import com.wrbug.polymarketbot.service.auth.WebSocketTicketService
import com.wrbug.polymarketbot.util.JwtUtils
import org.slf4j.LoggerFactory
import org.springframework.http.server.ServerHttpRequest
@@ -11,12 +12,13 @@ import org.springframework.web.socket.server.HandshakeInterceptor
/**
* WebSocket 握手拦截器
* 用于验证 JWT token
* 优先使用短期票据验证，其次使用 JWT token
*/
@Component
class WebSocketAuthInterceptor(
private val jwtUtils: JwtUtils,
private val userRepository: UserRepository
private val userRepository: UserRepository,
private val webSocketTicketService: WebSocketTicketService
) : HandshakeInterceptor {
private val logger = LoggerFactory.getLogger(WebSocketAuthInterceptor::class.java)
@@ -27,22 +29,36 @@ class WebSocketAuthInterceptor(
wsHandler: WebSocketHandler,
attributes: MutableMap<String, Any>
): Boolean {
// 从查询参数或请求头获取 token
val token = getTokenFromRequest(request)
if (token == null) {
logger.warn("WebSocket 连接缺少认证令牌: ${request.uri}")
// 优先使用票据验证（推荐方式，不暴露 JWT）
val ticket = getTicketFromRequest(request)
if (ticket != null) {
val username = webSocketTicketService.validateAndConsumeTicket(ticket)
if (username != null) {
attributes["username"] = username
logger.debug("WebSocket 连接票据认证成功: username=$username")
return true
}
logger.warn("WebSocket 连接票据验证失败（可能已过期或已使用）")
response.setStatusCode(org.springframework.http.HttpStatus.UNAUTHORIZED)
return false
}
// 兼容旧方式：使用 JWT token（不推荐，但保持向后兼容）
val token = getTokenFromRequest(request)
if (token == null) {
logger.warn("WebSocket 连接缺少认证令牌: ${request.uri.path}")
response.setStatusCode(org.springframework.http.HttpStatus.UNAUTHORIZED)
return false
}
// 验证 token
if (!jwtUtils.validateToken(token)) {
logger.warn("WebSocket 连接 token 验证失败: ${request.uri}")
logger.warn("WebSocket 连接 token 验证失败")
response.setStatusCode(org.springframework.http.HttpStatus.UNAUTHORIZED)
return false
}
// 验证tokenVersion（检查token是否因密码修改而失效）
val username = jwtUtils.getUsernameFromToken(token)
if (username != null) {
@@ -50,21 +66,21 @@ class WebSocketAuthInterceptor(
if (user != null) {
val tokenVersion = jwtUtils.getTokenVersionFromToken(token)
if (tokenVersion == null || tokenVersion != user.tokenVersion) {
logger.warn("WebSocket 连接 token 版本不匹配，token已失效: username=$username, tokenVersion=$tokenVersion, userTokenVersion=${user.tokenVersion}, uri=${request.uri}")
logger.warn("WebSocket 连接 token 版本不匹配，token已失效: username=$username")
response.setStatusCode(org.springframework.http.HttpStatus.UNAUTHORIZED)
return false
}
}
// 获取用户名并存入 attributes，供后续使用
attributes["username"] = username
logger.debug("WebSocket 连接认证成功: username=$username, uri=${request.uri}")
logger.debug("WebSocket 连接 JWT 认证成功: username=$username")
} else {
logger.warn("WebSocket 连接无法获取用户名: ${request.uri}")
logger.warn("WebSocket 连接无法获取用户名")
response.setStatusCode(org.springframework.http.HttpStatus.UNAUTHORIZED)
return false
}
return true
}
@@ -78,7 +94,22 @@ class WebSocketAuthInterceptor(
}
/**
* 从请求中获取 token
* 从请求中获取票据
*/
private fun getTicketFromRequest(request: ServerHttpRequest): String? {
val queryParams = request.uri.query ?: return null
val params = queryParams.split("&")
for (param in params) {
val parts = param.split("=", limit = 2)
if (parts.size == 2 && parts[0] == "ticket") {
return parts[1]
}
}
return null
}
/**
* 从请求中获取 token（兼容旧方式）
* 支持从查询参数 token 或请求头 Authorization 获取
*/
private fun getTokenFromRequest(request: ServerHttpRequest): String? {
@@ -93,13 +124,13 @@ class WebSocketAuthInterceptor(
}
}
}
// 从请求头获取
val authHeader = request.headers.getFirst("Authorization")
if (authHeader != null && authHeader.startsWith("Bearer ")) {
return authHeader.substring(7)
}
return null
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/config/WebSocketConfig.kt
+35 -9
View File
@@ -2,6 +2,7 @@ package com.wrbug.polymarketbot.config
import com.wrbug.polymarketbot.websocket.PolymarketWebSocketHandler
import com.wrbug.polymarketbot.websocket.UnifiedWebSocketHandler
import org.springframework.beans.factory.annotation.Value
import org.springframework.context.annotation.Configuration
import org.springframework.web.socket.config.annotation.EnableWebSocket
import org.springframework.web.socket.config.annotation.WebSocketConfigurer
@@ -16,21 +17,46 @@ import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry
class WebSocketConfig(
private val polymarketWebSocketHandler: PolymarketWebSocketHandler,
private val unifiedWebSocketHandler: UnifiedWebSocketHandler,
private val webSocketAuthInterceptor: WebSocketAuthInterceptor
private val webSocketAuthInterceptor: WebSocketAuthInterceptor,
@Value("\${websocket.allowed-origins:}") private val allowedOriginsConfig: String
) : WebSocketConfigurer {
/**
* 获取允许的 WebSocket 来源
* 如果配置了 WEBSOCKET_ALLOWED_ORIGINS 环境变量，使用配置的域名
* 否则使用 setAllowedOriginPatterns 允许同源访问
*/
private fun getAllowedOrigins(): Array<String> {
return if (allowedOriginsConfig.isNotBlank()) {
allowedOriginsConfig.split(",").map { it.trim() }.toTypedArray()
} else {
emptyArray()
}
}
override fun registerWebSocketHandlers(registry: WebSocketHandlerRegistry) {
val origins = getAllowedOrigins()
// Polymarket RTDS 转发端点（转发外部 Polymarket 实时数据流）
// 注意：此端点不需要鉴权，因为它只是转发外部数据
registry.addHandler(polymarketWebSocketHandler, "/ws/polymarket")
.setAllowedOrigins("*") // 生产环境应该配置具体的域名
val polymarketHandler = registry.addHandler(polymarketWebSocketHandler, "/ws/polymarket")
if (origins.isNotEmpty()) {
polymarketHandler.setAllowedOrigins(*origins)
} else {
// 使用 setAllowedOriginPatterns 替代 setAllowedOrigins("*")，更安全
polymarketHandler.setAllowedOriginPatterns("*")
}
// 统一 WebSocket 端点（所有推送服务统一使用此路径，通过 channel 区分）
// 支持的频道：position（仓位推送）、order（订单推送，待实现）等
// 支持的频道：position（仓位推送）、order（订单推送）等
// 需要 JWT 鉴权
registry.addHandler(unifiedWebSocketHandler, "/ws")
.addInterceptors(webSocketAuthInterceptor) // 添加鉴权拦截器
.setAllowedOrigins("*") // 生产环境应该配置具体的域名
val unifiedHandler = registry.addHandler(unifiedWebSocketHandler, "/ws")
.addInterceptors(webSocketAuthInterceptor)
if (origins.isNotEmpty()) {
unifiedHandler.setAllowedOrigins(*origins)
} else {
unifiedHandler.setAllowedOriginPatterns("*")
}
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/controller/accounts/AccountController.kt
+59
View File
@@ -95,6 +95,65 @@ class AccountController(
}
}
/**
* 刷新账户的代理地址
* 使用最新的代理地址计算逻辑（支持 Magic 和 Safe 两种类型）
*/
@PostMapping("/refresh-proxy")
fun refreshProxyAddress(@RequestBody request: AccountDetailRequest): ResponseEntity<ApiResponse<AccountDto>> {
return try {
if (request.accountId == null || request.accountId <= 0) {
return ResponseEntity.ok(ApiResponse.error(ErrorCode.PARAM_ACCOUNT_ID_INVALID, messageSource = messageSource))
}
val result = accountService.refreshProxyAddress(request.accountId)
result.fold(
onSuccess = { account ->
ResponseEntity.ok(ApiResponse.success(account))
},
onFailure = { e ->
logger.error("刷新代理地址失败: ${e.message}", e)
when (e) {
is IllegalArgumentException -> ResponseEntity.ok(
ApiResponse.error(
ErrorCode.PARAM_ERROR,
e.message,
messageSource
)
)
else -> ResponseEntity.ok(ApiResponse.error(ErrorCode.SERVER_ERROR, e.message, messageSource))
}
}
)
} catch (e: Exception) {
logger.error("刷新代理地址异常: ${e.message}", e)
ResponseEntity.ok(ApiResponse.error(ErrorCode.SERVER_ERROR, e.message, messageSource))
}
}
/**
* 批量刷新所有账户的代理地址
*/
@PostMapping("/refresh-all-proxies")
fun refreshAllProxyAddresses(): ResponseEntity<ApiResponse<List<AccountDto>>> {
return try {
val result = accountService.refreshAllProxyAddresses()
result.fold(
onSuccess = { accounts ->
ResponseEntity.ok(ApiResponse.success(accounts))
},
onFailure = { e ->
logger.error("批量刷新代理地址失败: ${e.message}", e)
ResponseEntity.ok(ApiResponse.error(ErrorCode.SERVER_ERROR, e.message, messageSource))
}
)
} catch (e: Exception) {
logger.error("批量刷新代理地址异常: ${e.message}", e)
ResponseEntity.ok(ApiResponse.error(ErrorCode.SERVER_ERROR, e.message, messageSource))
}
}
/**
* 删除账户
*/
backend/src/main/kotlin/com/wrbug/polymarketbot/controller/auth/AuthController.kt
+59 -7
View File
@@ -3,6 +3,7 @@ package com.wrbug.polymarketbot.controller.auth
import com.wrbug.polymarketbot.dto.*
import com.wrbug.polymarketbot.enums.ErrorCode
import com.wrbug.polymarketbot.service.auth.AuthService
import com.wrbug.polymarketbot.service.auth.WebSocketTicketService
import jakarta.servlet.http.HttpServletRequest
import org.slf4j.LoggerFactory
import org.springframework.context.MessageSource
@@ -16,7 +17,8 @@ import org.springframework.web.bind.annotation.*
@RequestMapping("/api/auth")
class AuthController(
private val authService: AuthService,
private val messageSource: MessageSource
private val messageSource: MessageSource,
private val webSocketTicketService: WebSocketTicketService
) {
private val logger = LoggerFactory.getLogger(AuthController::class.java)
@@ -25,7 +27,10 @@ class AuthController(
* 登录接口
*/
@PostMapping("/login")
fun login(@RequestBody request: LoginRequest): ResponseEntity<ApiResponse<LoginResponse>> {
fun login(
@RequestBody request: LoginRequest,
httpRequest: HttpServletRequest
): ResponseEntity<ApiResponse<LoginResponse>> {
return try {
if (request.username.isBlank()) {
return ResponseEntity.ok(ApiResponse.error(ErrorCode.PARAM_EMPTY, "用户名不能为空", messageSource))
@@ -33,15 +38,19 @@ class AuthController(
if (request.password.isBlank()) {
return ResponseEntity.ok(ApiResponse.error(ErrorCode.PARAM_EMPTY, "密码不能为空", messageSource))
}
val result = authService.login(request.username, request.password)
val ipAddress = getClientIpAddress(httpRequest)
val result = authService.login(request.username, request.password, ipAddress)
result.fold(
onSuccess = { loginResponse ->
ResponseEntity.ok(ApiResponse.success(loginResponse))
},
onFailure = { e ->
logger.error("登录失败: ${e.message}", e)
when (e) {
is IllegalStateException -> {
// 限速或锁定错误
ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_ERROR, e.message ?: "登录失败", messageSource))
}
is IllegalArgumentException -> {
if (e.message == ErrorCode.AUTH_USERNAME_OR_PASSWORD_ERROR.message) {
ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_USERNAME_OR_PASSWORD_ERROR, messageSource = messageSource))
@@ -49,15 +58,36 @@ class AuthController(
ResponseEntity.ok(ApiResponse.error(ErrorCode.PARAM_ERROR, e.message, messageSource))
}
}
else -> ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_ERROR, "登录失败: ${e.message}", messageSource))
else -> ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_ERROR, "登录失败", messageSource))
}
}
)
} catch (e: Exception) {
logger.error("登录异常: ${e.message}", e)
ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_ERROR, "登录失败: ${e.message}", messageSource))
ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_ERROR, "登录失败", messageSource))
}
}
/**
* 获取客户端IP地址
*/
private fun getClientIpAddress(request: HttpServletRequest): String {
var ip = request.getHeader("X-Forwarded-For")
if (ip.isNullOrBlank() || "unknown".equals(ip, ignoreCase = true)) {
ip = request.getHeader("X-Real-IP")
}
if (ip.isNullOrBlank() || "unknown".equals(ip, ignoreCase = true)) {
ip = request.getHeader("Proxy-Client-IP")
}
if (ip.isNullOrBlank() || "unknown".equals(ip, ignoreCase = true)) {
ip = request.remoteAddr
}
// 处理多个IP的情况
if (ip.contains(",")) {
ip = ip.split(",")[0].trim()
}
return ip
}
/**
* 重置密码接口
@@ -132,5 +162,27 @@ class AuthController(
ResponseEntity.ok(ApiResponse.error(ErrorCode.SERVER_ERROR, "检查首次使用失败: ${e.message}", messageSource))
}
}
/**
* 获取 WebSocket 连接票据
* 返回一个短期有效（30秒）的一次性票据，用于 WebSocket 连接认证
* 避免在 WebSocket URL 中暴露 JWT
*/
@PostMapping("/ws-ticket")
fun getWebSocketTicket(httpRequest: HttpServletRequest): ResponseEntity<ApiResponse<WebSocketTicketResponse>> {
return try {
// 从请求属性中获取用户名（由 JWT 拦截器设置）
val username = httpRequest.getAttribute("username") as? String
if (username == null) {
return ResponseEntity.ok(ApiResponse.error(ErrorCode.AUTH_ERROR, "未认证", messageSource))
}
val ticket = webSocketTicketService.generateTicket(username)
ResponseEntity.ok(ApiResponse.success(WebSocketTicketResponse(ticket = ticket)))
} catch (e: Exception) {
logger.error("获取 WebSocket 票据异常: ${e.message}", e)
ResponseEntity.ok(ApiResponse.error(ErrorCode.SERVER_ERROR, "获取票据失败", messageSource))
}
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/dto/AccountDto.kt
+2 -1
View File
@@ -7,7 +7,8 @@ data class AccountImportRequest(
val privateKey: String, // 私钥（前端加密后传输）
val walletAddress: String, // 钱包地址（前端从私钥推导，用于验证）
val accountName: String? = null,
val isEnabled: Boolean = true // 是否启用（用于订单推送等功能的开关）
val isEnabled: Boolean = true, // 是否启用（用于订单推送等功能的开关）
val walletType: String = "magic" // 钱包类型：magic（邮箱/OAuth登录）或 safe（MetaMask浏览器钱包）
)
/**
backend/src/main/kotlin/com/wrbug/polymarketbot/dto/AuthResponse.kt
+7
View File
@@ -14,3 +14,10 @@ data class CheckFirstUseResponse(
val isFirstUse: Boolean
)
/**
* WebSocket 票据响应
*/
data class WebSocketTicketResponse(
val ticket: String
)
backend/src/main/kotlin/com/wrbug/polymarketbot/service/accounts/AccountService.kt
+81 -1
View File
@@ -99,8 +99,9 @@ class AccountService(
}
// 5. 获取代理地址（必须成功，否则导入失败）
// 根据用户选择的钱包类型计算代理地址
val proxyAddress = runBlocking {
val proxyResult = blockchainService.getProxyAddress(request.walletAddress)
val proxyResult = blockchainService.getProxyAddress(request.walletAddress, request.walletType)
if (proxyResult.isSuccess) {
val address = proxyResult.getOrNull()
if (address != null) {
@@ -200,6 +201,85 @@ class AccountService(
}
}
/**
* 刷新账户的代理地址
* 使用最新的代理地址计算逻辑（支持 Magic 和 Safe 两种类型）
*/
@Transactional
fun refreshProxyAddress(accountId: Long): Result<AccountDto> {
return try {
val account = accountRepository.findById(accountId)
.orElse(null) ?: return Result.failure(IllegalArgumentException("账户不存在"))
// 重新获取代理地址
val proxyAddress = runBlocking {
val proxyResult = blockchainService.getProxyAddress(account.walletAddress)
if (proxyResult.isSuccess) {
proxyResult.getOrNull()
?: throw IllegalStateException("获取代理地址返回空值")
} else {
val error = proxyResult.exceptionOrNull()
throw IllegalStateException("获取代理地址失败: ${error?.message}")
}
}
// 更新账户
val updated = account.copy(
proxyAddress = proxyAddress,
updatedAt = System.currentTimeMillis()
)
val saved = accountRepository.save(updated)
logger.info("刷新代理地址成功: accountId=${accountId}, oldProxy=${account.proxyAddress}, newProxy=${proxyAddress}")
Result.success(toDto(saved))
} catch (e: Exception) {
logger.error("刷新代理地址失败: accountId=${accountId}", e)
Result.failure(e)
}
}
/**
* 刷新所有账户的代理地址
*/
@Transactional
fun refreshAllProxyAddresses(): Result<List<AccountDto>> {
return try {
val accounts = accountRepository.findAll()
val updatedAccounts = mutableListOf<AccountDto>()
accounts.forEach { account ->
try {
val proxyAddress = runBlocking {
val proxyResult = blockchainService.getProxyAddress(account.walletAddress)
if (proxyResult.isSuccess) {
proxyResult.getOrNull()
} else {
null
}
}
if (proxyAddress != null && proxyAddress != account.proxyAddress) {
val updated = account.copy(
proxyAddress = proxyAddress,
updatedAt = System.currentTimeMillis()
)
val saved = accountRepository.save(updated)
logger.info("刷新代理地址成功: accountId=${account.id}, oldProxy=${account.proxyAddress}, newProxy=${proxyAddress}")
updatedAccounts.add(toDto(saved))
}
} catch (e: Exception) {
logger.warn("刷新账户 ${account.id} 代理地址失败: ${e.message}")
}
}
logger.info("批量刷新代理地址完成: 更新了 ${updatedAccounts.size} 个账户")
Result.success(updatedAccounts)
} catch (e: Exception) {
logger.error("批量刷新代理地址失败", e)
Result.failure(e)
}
}
/**
* 删除账户
*/
backend/src/main/kotlin/com/wrbug/polymarketbot/service/auth/AuthService.kt
+31 -9
View File
@@ -31,22 +31,44 @@ class AuthService(
private lateinit var resetPasswordKey: String
/**
* 登录
* 登录（带IP限速保护）
*/
fun login(username: String, password: String): Result<LoginResponse> {
fun login(username: String, password: String, ipAddress: String): Result<LoginResponse> {
return try {
// 检查登录频率限制
rateLimitService.checkLoginRateLimit(ipAddress).fold(
onSuccess = { },
onFailure = { e ->
return Result.failure(IllegalStateException(e.message ?: "登录频率限制"))
}
)
val user = userRepository.findByUsername(username)
?: return Result.failure(IllegalArgumentException(ErrorCode.AUTH_USERNAME_OR_PASSWORD_ERROR.message))
// 验证密码
if (!passwordEncoder.matches(password, user.password)) {
logger.warn("登录失败：密码错误，username=$username")
if (user == null) {
// 记录失败尝试
val lockoutMsg = rateLimitService.recordLoginFailure(ipAddress)
if (lockoutMsg != null) {
return Result.failure(IllegalStateException(lockoutMsg))
}
return Result.failure(IllegalArgumentException(ErrorCode.AUTH_USERNAME_OR_PASSWORD_ERROR.message))
}
// 验证密码
if (!passwordEncoder.matches(password, user.password)) {
// 记录失败尝试
val lockoutMsg = rateLimitService.recordLoginFailure(ipAddress)
if (lockoutMsg != null) {
return Result.failure(IllegalStateException(lockoutMsg))
}
return Result.failure(IllegalArgumentException(ErrorCode.AUTH_USERNAME_OR_PASSWORD_ERROR.message))
}
// 登录成功，清除失败记录
rateLimitService.clearLoginFailures(ipAddress)
// 生成JWT token（包含tokenVersion，用于使修改密码后的旧token失效）
val token = jwtUtils.generateToken(username, user.tokenVersion)
logger.info("用户登录成功：username=$username")
Result.success(LoginResponse(token = token))
} catch (e: Exception) {
backend/src/main/kotlin/com/wrbug/polymarketbot/service/auth/WebSocketTicketService.kt
+83
View File
@@ -0,0 +1,83 @@
package com.wrbug.polymarketbot.service.auth
import org.springframework.stereotype.Service
import java.security.SecureRandom
import java.util.concurrent.ConcurrentHashMap
/**
* WebSocket 票据服务
* 用于生成短期有效的一次性票据，避免在 WebSocket URL 中暴露 JWT
*/
@Service
class WebSocketTicketService {
companion object {
// 票据有效期（30秒）
private const val TICKET_VALIDITY_MS = 30_000L
// 票据长度（32字节 = 64个十六进制字符）
private const val TICKET_LENGTH = 32
}
private val secureRandom = SecureRandom()
// 存储票据：ticket -> TicketInfo
private val tickets = ConcurrentHashMap<String, TicketInfo>()
/**
* 票据信息
*/
data class TicketInfo(
val username: String,
val createdAt: Long,
val expiresAt: Long
)
/**
* 为用户生成 WebSocket 连接票据
* @param username 用户名
* @return 一次性票据
*/
fun generateTicket(username: String): String {
// 清理过期票据
cleanupExpiredTickets()
// 生成随机票据
val bytes = ByteArray(TICKET_LENGTH)
secureRandom.nextBytes(bytes)
val ticket = bytes.joinToString("") { "%02x".format(it) }
val now = System.currentTimeMillis()
tickets[ticket] = TicketInfo(
username = username,
createdAt = now,
expiresAt = now + TICKET_VALIDITY_MS
)
return ticket
}
/**
* 验证并消费票据（一次性使用）
* @param ticket 票据
* @return 用户名，如果票据无效则返回 null
*/
fun validateAndConsumeTicket(ticket: String): String? {
val ticketInfo = tickets.remove(ticket) ?: return null
// 检查是否过期
if (System.currentTimeMillis() > ticketInfo.expiresAt) {
return null
}
return ticketInfo.username
}
/**
* 清理过期票据
*/
private fun cleanupExpiredTickets() {
val now = System.currentTimeMillis()
tickets.entries.removeIf { it.value.expiresAt < now }
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/service/common/BlockchainService.kt
+128 -19
View File
@@ -39,9 +39,16 @@ class BlockchainService(
// USDC 合约地址（Polygon 主网，Polymarket 使用 Polygon）
private val usdcContractAddress = "0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174"
// Polymarket 代理工厂合约地址（Polygon 主网）
// Polymarket Safe 代理工厂合约地址（Polygon 主网，用于 MetaMask 用户）
// 合约地址: 0xaacFeEa03eb1561C4e67d661e40682Bd20E3541b
private val proxyFactoryContractAddress = "0xaacFeEa03eb1561C4e67d661e40682Bd20E3541b"
private val safeProxyFactoryAddress = "0xaacFeEa03eb1561C4e67d661e40682Bd20E3541b"
// Polymarket Magic 代理工厂合约地址（Polygon 主网，用于邮箱/OAuth 登录用户）
// 合约地址: 0xaB45c5A4B0c941a2F231C04C3f49182e1A254052
private val magicProxyFactoryAddress = "0xaB45c5A4B0c941a2F231C04C3f49182e1A254052"
// Magic Proxy 的 init code hash（用于 CREATE2 计算）
private val magicProxyInitCodeHash = "0xd21df8dc65880a8606f09fe0ce3df9b8869287ab0b058be05aa9e8af6330a00b"
// ConditionalTokens 合约地址（Polygon 主网）
private val conditionalTokensAddress = "0x4D97DCd97eC945f40cF65F87097ACe5EA0476045"
@@ -78,60 +85,162 @@ class BlockchainService(
/**
* 获取 Polymarket 代理钱包地址
* 通过 RPC 调用代理工厂合约获取用户的代理钱包地址
* 根据指定的钱包类型返回对应的代理地址
*
* Polymarket 有两种代理钱包类型：
* 1. Magic Proxy（邮箱/OAuth 登录用户）- 使用 CREATE2 计算地址
* 2. Safe Proxy（MetaMask 钱包用户）- 通过合约调用获取地址
*
* @param walletAddress 用户的钱包地址（EOA）
* @param walletType 钱包类型："magic"（默认）或 "safe"
* @return 代理钱包地址
*/
suspend fun getProxyAddress(walletAddress: String, walletType: String = "magic"): Result<String> {
return try {
when (walletType.lowercase()) {
"safe" -> {
// Safe Proxy（MetaMask 用户）
val safeProxyResult = getSafeProxyAddress(walletAddress)
if (safeProxyResult.isSuccess) {
val safeProxyAddress = safeProxyResult.getOrNull()!!
logger.debug("使用 Safe Proxy 地址: $safeProxyAddress")
Result.success(safeProxyAddress)
} else {
Result.failure(safeProxyResult.exceptionOrNull() ?: Exception("获取 Safe Proxy 地址失败"))
}
}
else -> {
// Magic Proxy（邮箱/OAuth 登录用户）- 默认
val magicProxyAddress = calculateMagicProxyAddress(walletAddress)
logger.debug("使用 Magic Proxy 地址: $magicProxyAddress")
Result.success(magicProxyAddress)
}
}
} catch (e: Exception) {
logger.error("获取代理地址失败: ${e.message}", e)
Result.failure(e)
}
}
/**
* 计算 Magic Proxy 地址（使用 CREATE2）
* 用于邮箱/OAuth 登录的用户
*
* CREATE2 地址计算公式：
* address = keccak256(0xff ++ factory ++ salt ++ initCodeHash)[12:]
* salt = keccak256(eoaAddress)
*
* @param walletAddress 用户的钱包地址（EOA）
* @return Magic 代理钱包地址
*/
fun calculateMagicProxyAddress(walletAddress: String): String {
// 计算 salt = keccak256(eoaAddress)
val eoaBytes = EthereumUtils.hexToBytes(walletAddress.lowercase())
val salt = EthereumUtils.keccak256(eoaBytes)
// 计算 CREATE2 地址
// data = 0xff ++ factory ++ salt ++ initCodeHash
val prefix = byteArrayOf(0xff.toByte())
val factoryBytes = EthereumUtils.hexToBytes(magicProxyFactoryAddress)
val initCodeHashBytes = EthereumUtils.hexToBytes(magicProxyInitCodeHash)
val data = prefix + factoryBytes + salt + initCodeHashBytes
val hash = EthereumUtils.keccak256(data)
// 取后 20 字节作为地址
return "0x" + hash.copyOfRange(12, 32).joinToString("") { "%02x".format(it) }
}
/**
* 获取 Safe Proxy 地址
* 通过 RPC 调用 Safe 代理工厂合约获取用户的代理钱包地址
* 用于 MetaMask 钱包用户
*
* @param walletAddress 用户的钱包地址
* @return 代理钱包地址
*/
suspend fun getProxyAddress(walletAddress: String): Result<String> {
private suspend fun getSafeProxyAddress(walletAddress: String): Result<String> {
return try {
val rpcApi = polygonRpcApi
// 计算函数选择器
val functionSelector = EthereumUtils.getFunctionSelector(computeProxyAddressFunctionSignature)
// 编码地址参数
val encodedAddress = EthereumUtils.encodeAddress(walletAddress)
// 构建调用数据
val data = functionSelector + encodedAddress
// 构建 JSON-RPC 请求
val rpcRequest = JsonRpcRequest(
method = "eth_call",
params = listOf(
mapOf(
"to" to proxyFactoryContractAddress,
"to" to safeProxyFactoryAddress,
"data" to data
),
"latest"
)
)
// 发送 RPC 请求
val response = rpcApi.call(rpcRequest)
if (!response.isSuccessful || response.body() == null) {
throw Exception("RPC 请求失败: ${response.code()} ${response.message()}")
return Result.failure(Exception("RPC 请求失败: ${response.code()} ${response.message()}"))
}
val rpcResponse = response.body()!!
// 检查错误
if (rpcResponse.error != null) {
throw Exception("RPC 错误: ${rpcResponse.error.message}")
return Result.failure(Exception("RPC 错误: ${rpcResponse.error.message}"))
}
// 使用 Gson 解析 result（JsonElement）
val hexResult = rpcResponse.result?.asString
?: throw Exception("RPC 响应格式错误: result 为空")
val hexResult = rpcResponse.result?.asString
?: return Result.failure(Exception("RPC 响应格式错误: result 为空"))
// 解析代理地址
val proxyAddress = EthereumUtils.decodeAddress(hexResult)
Result.success(proxyAddress)
} catch (e: Exception) {
logger.error("获取代理地址失败: ${e.message}", e)
Result.failure(e)
}
}
/**
* 检查地址是否是合约
* @param address 地址
* @return 如果地址有代码（是合约）返回 true
*/
private suspend fun isContract(address: String): Boolean {
return try {
val rpcApi = polygonRpcApi
val rpcRequest = JsonRpcRequest(
method = "eth_getCode",
params = listOf(address, "latest")
)
val response = rpcApi.call(rpcRequest)
if (!response.isSuccessful || response.body() == null) {
return false
}
val rpcResponse = response.body()!!
if (rpcResponse.error != null) {
return false
}
val code = rpcResponse.result?.asString ?: "0x"
// 如果代码不是 "0x" 或 "0x0"，则是合约
code != "0x" && code != "0x0"
} catch (e: Exception) {
logger.warn("检查合约地址失败: ${e.message}")
false
}
}
/**
* 查询账户 USDC 余额
backend/src/main/kotlin/com/wrbug/polymarketbot/service/common/PolymarketApiKeyService.kt
+9 -7
View File
@@ -54,34 +54,36 @@ class PolymarketApiKeyService(
try {
// 先尝试获取现有的 API Key（derive）
val deriveResult = deriveApiKey(privateKey, walletAddress, chainId)
val maskedAddress = "${walletAddress.take(6)}...${walletAddress.takeLast(4)}"
if (deriveResult.isSuccess) {
val creds = deriveResult.getOrNull()
if (creds != null && isApiCreds(creds)) {
logger.info("成功获取现有 API Key: ${walletAddress}")
logger.debug("成功获取现有 API Key: $maskedAddress")
return@runBlocking Result.success(creds)
}
}
// 如果获取失败或返回无效，尝试创建新的
logger.info("获取现有 API Key 失败，尝试创建新的: ${walletAddress}")
logger.debug("获取现有 API Key 失败，尝试创建新的: $maskedAddress")
val createResult = createApiKey(privateKey, walletAddress, chainId)
if (createResult.isSuccess) {
val creds = createResult.getOrNull()
if (creds != null && isApiCreds(creds)) {
logger.info("成功创建新 API Key: ${walletAddress}")
logger.debug("成功创建新 API Key: $maskedAddress")
return@runBlocking Result.success(creds)
}
}
// 两个都失败
val error = createResult.exceptionOrNull() ?: deriveResult.exceptionOrNull()
val errorMsg = error?.message ?: "未知错误"
logger.error("获取和创建 API Key 都失败: ${walletAddress}", error)
logger.error("获取和创建 API Key 都失败: $maskedAddress", error)
Result.failure(
IllegalStateException("无法获取或创建 API Key: $errorMsg")
)
} catch (e: Exception) {
logger.error("创建或获取 API Key 异常: ${walletAddress}", e)
val maskedAddress = "${walletAddress.take(6)}...${walletAddress.takeLast(4)}"
logger.error("创建或获取 API Key 异常: $maskedAddress", e)
Result.failure(e)
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/service/common/RateLimitService.kt
+100 -17
View File
@@ -3,50 +3,133 @@ package com.wrbug.polymarketbot.service.common
import org.slf4j.LoggerFactory
import org.springframework.beans.factory.annotation.Value
import org.springframework.stereotype.Service
import java.util.concurrent.ConcurrentHashMap
import java.util.concurrent.atomic.AtomicReference
/**
* 频率限制服务（使用内存缓存，全局限制）
* 频率限制服务（使用内存缓存）
*/
@Service
class RateLimitService {
private val logger = LoggerFactory.getLogger(RateLimitService::class.java)
// 重置密码限速配置
@Value("\${rate-limit.reset-password.max-attempts:3}")
private var maxAttempts: Int = 3
private var resetPasswordMaxAttempts: Int = 3
@Value("\${rate-limit.reset-password.window-seconds:60}")
private var windowSeconds: Long = 60
private var resetPasswordWindowSeconds: Long = 60
// 登录限速配置
@Value("\${rate-limit.login.max-attempts:5}")
private var loginMaxAttempts: Int = 5
@Value("\${rate-limit.login.window-seconds:300}")
private var loginWindowSeconds: Long = 300 // 5分钟
@Value("\${rate-limit.login.lockout-seconds:900}")
private var loginLockoutSeconds: Long = 900 // 15分钟
// 全局尝试记录列表（时间戳），所有请求共享
private val resetPasswordAttempts = AtomicReference<MutableList<Long>>(mutableListOf())
// 登录失败尝试记录（IP -> 时间戳列表）
private val loginFailedAttempts = ConcurrentHashMap<String, MutableList<Long>>()
// 登录锁定记录（IP -> 锁定结束时间）
private val loginLockouts = ConcurrentHashMap<String, Long>()
/**
* 检查重置密码频率限制（全局限制，不按IP）
* @return Result，如果超过限制则返回失败
*/
fun checkResetPasswordRateLimit(): Result<Unit> {
val now = System.currentTimeMillis()
val windowStart = now - (windowSeconds * 1000)
val windowStart = now - (resetPasswordWindowSeconds * 1000)
// 获取当前尝试记录列表
val attempts = resetPasswordAttempts.get()
// 清理过期记录（超过时间窗口的记录）
val validAttempts = attempts.filter { it >= windowStart }.toMutableList()
// 检查是否超过限制
if (validAttempts.size >= maxAttempts) {
logger.warn("重置密码频率限制触发: attempts=${validAttempts.size}/$maxAttempts")
return Result.failure(IllegalStateException("频率限制：1分钟内最多尝试${maxAttempts}次，请稍后再试"))
if (validAttempts.size >= resetPasswordMaxAttempts) {
logger.warn("重置密码频率限制触发: attempts=${validAttempts.size}/$resetPasswordMaxAttempts")
return Result.failure(IllegalStateException("频率限制：1分钟内最多尝试${resetPasswordMaxAttempts}次，请稍后再试"))
}
// 记录本次尝试
validAttempts.add(now)
resetPasswordAttempts.set(validAttempts)
return Result.success(Unit)
}
/**
* 检查登录频率限制（按IP限制）
* @param ipAddress 客户端IP地址
* @return Result，如果被锁定或超过限制则返回失败
*/
fun checkLoginRateLimit(ipAddress: String): Result<Unit> {
val now = System.currentTimeMillis()
// 检查是否被锁定
val lockoutEndTime = loginLockouts[ipAddress]
if (lockoutEndTime != null) {
if (now < lockoutEndTime) {
val remainingSeconds = (lockoutEndTime - now) / 1000
logger.warn("登录锁定中: ip=$ipAddress, remainingSeconds=$remainingSeconds")
return Result.failure(IllegalStateException("账户已被锁定，请${remainingSeconds}秒后再试"))
} else {
// 锁定已过期，清除锁定记录
loginLockouts.remove(ipAddress)
loginFailedAttempts.remove(ipAddress)
}
}
return Result.success(Unit)
}
/**
* 记录登录失败尝试
* @param ipAddress 客户端IP地址
* @return 如果触发锁定返回锁定信息，否则返回 null
*/
fun recordLoginFailure(ipAddress: String): String? {
val now = System.currentTimeMillis()
val windowStart = now - (loginWindowSeconds * 1000)
// 获取或创建该IP的尝试记录
val attempts = loginFailedAttempts.computeIfAbsent(ipAddress) { mutableListOf() }
// 清理过期记录并添加新记录
synchronized(attempts) {
attempts.removeIf { it < windowStart }
attempts.add(now)
// 检查是否需要锁定
if (attempts.size >= loginMaxAttempts) {
val lockoutEndTime = now + (loginLockoutSeconds * 1000)
loginLockouts[ipAddress] = lockoutEndTime
logger.warn("登录锁定触发: ip=$ipAddress, attempts=${attempts.size}, lockoutSeconds=$loginLockoutSeconds")
return "登录失败次数过多，账户已被锁定${loginLockoutSeconds / 60}分钟"
}
}
val remainingAttempts = loginMaxAttempts - attempts.size
logger.warn("登录失败: ip=$ipAddress, attempts=${attempts.size}/$loginMaxAttempts, remainingAttempts=$remainingAttempts")
return null
}
/**
* 登录成功时清除失败记录
* @param ipAddress 客户端IP地址
*/
fun clearLoginFailures(ipAddress: String) {
loginFailedAttempts.remove(ipAddress)
loginLockouts.remove(ipAddress)
}
}
backend/src/main/kotlin/com/wrbug/polymarketbot/service/copytrading/orders/OrderSigningService.kt
+9 -19
View File
@@ -172,25 +172,15 @@ class OrderSigningService {
// 5. 确保 maker 地址也是小写格式
val makerAddressLower = makerAddress.lowercase()
// 打印签名前的订单参数
logger.info("========== 订单签名前参数 ==========")
logger.info("订单方向: $side")
logger.info("价格: $price")
logger.info("数量: $size")
logger.info("Token ID: $tokenId")
logger.info("Maker 地址: $makerAddressLower")
logger.info("Signer 地址: $signerAddress")
logger.info("Taker 地址: $taker")
logger.info("Maker Amount (wei): ${amounts.makerAmount}")
logger.info("Taker Amount (wei): ${amounts.takerAmount}")
logger.info("Salt: $salt")
logger.info("Expiration: $expiration")
logger.info("Nonce: $nonce")
logger.info("Fee Rate BPS: $feeRateBps")
logger.info("Signature Type: $signatureType")
logger.info("Exchange Contract: $EXCHANGE_CONTRACT")
logger.info("Chain ID: $CHAIN_ID")
logger.info("====================================")
// 打印签名前的订单参数（DEBUG 级别，避免敏感信息泄露）
logger.debug("========== 订单签名前参数 ==========")
logger.debug("订单方向: $side, 价格: $price, 数量: $size")
logger.debug("Token ID: $tokenId")
logger.debug("Maker: ${makerAddressLower.take(10)}...${makerAddressLower.takeLast(6)}")
logger.debug("Signer: ${signerAddress.take(10)}...${signerAddress.takeLast(6)}")
logger.debug("Amounts - Maker: ${amounts.makerAmount}, Taker: ${amounts.takerAmount}")
logger.debug("Salt: $salt, Expiration: $expiration, Nonce: $nonce, FeeRateBPS: $feeRateBps")
logger.debug("Signature Type: $signatureType, Chain ID: $CHAIN_ID")
// 6. 构建订单数据并签名
val signature = signOrder(
backend/src/main/kotlin/com/wrbug/polymarketbot/service/system/RelayClientService.kt
+4 -15
View File
@@ -333,15 +333,10 @@ class RelayClientService(
// 打包签名（参考 builder-relayer-client/src/utils/index.ts 的 splitAndPackSig）
val packedSignature = splitAndPackSig(safeSignature)
// 调试日志
// 调试日志（地址已遮蔽）
logger.debug("=== Builder Relayer 签名调试 ===")
logger.debug("Safe Address: $proxyAddress")
logger.debug("From Address: $fromAddress")
logger.debug("To: ${safeTx.to}")
logger.debug("Data: $redeemCallData")
logger.debug("Nonce: $proxyNonce")
logger.debug("Packed Signature: $packedSignature")
logger.debug("Signature Length: ${packedSignature.length} (expected: 132 with 0x)")
logger.debug("Safe: ${proxyAddress.take(10)}..., From: ${fromAddress.take(10)}..., Nonce: $proxyNonce")
logger.debug("Signature Length: ${packedSignature.length}")
// 构建 TransactionRequest（参考 builder-relayer-client/src/builder/safe.ts）
// 注意：根据 TypeScript 实现，data 和 signature 都应该带 0x 前缀
@@ -364,13 +359,7 @@ class RelayClientService(
metadata = "Redeem positions via Builder Relayer"
)
logger.debug("Request Type: ${request.type}")
logger.debug("Request From: ${request.from}")
logger.debug("Request To: ${request.to}")
logger.debug("Request ProxyWallet: ${request.proxyWallet}")
logger.debug("Request Data Length: ${request.data.length}")
logger.debug("Request Signature Length: ${request.signature.length}")
logger.debug("Request Nonce: ${request.nonce}")
logger.debug("Request: type=${request.type}, dataLen=${request.data.length}, sigLen=${request.signature.length}, nonce=${request.nonce}")
// 调用 Builder Relayer API（认证头通过拦截器添加）
val response = relayerApi.submitTransaction(request)
backend/src/main/kotlin/com/wrbug/polymarketbot/service/system/SystemConfigService.kt
+20 -7
View File
@@ -25,6 +25,19 @@ class SystemConfigService(
const val CONFIG_KEY_BUILDER_SECRET = "builder.secret"
const val CONFIG_KEY_BUILDER_PASSPHRASE = "builder.passphrase"
const val CONFIG_KEY_AUTO_REDEEM = "auto_redeem"
/**
* 遮蔽敏感信息，仅显示前4位和后4位
* 例如：abcd1234...wxyz5678
*/
fun maskSensitiveValue(value: String?): String? {
if (value == null) return null
return when {
value.length <= 8 -> "****" // 太短则完全遮蔽
value.length <= 16 -> "${value.take(2)}...${value.takeLast(2)}"
else -> "${value.take(4)}...${value.takeLast(4)}"
}
}
}
/**
@@ -36,26 +49,26 @@ class SystemConfigService(
val builderPassphrase = getConfigValue(CONFIG_KEY_BUILDER_PASSPHRASE)
val autoRedeem = isAutoRedeemEnabled()
// 获取完整的 API Key（用于前端展示）
val builderApiKeyDisplay = builderApiKey?.let {
// 获取遮蔽后的显示值（仅显示部分字符，用于前端确认配置）
val builderApiKeyDisplay = builderApiKey?.let {
try {
cryptoUtils.decrypt(it)
maskSensitiveValue(cryptoUtils.decrypt(it))
} catch (e: Exception) {
null
}
}
val builderSecretDisplay = builderSecret?.let {
try {
cryptoUtils.decrypt(it)
maskSensitiveValue(cryptoUtils.decrypt(it))
} catch (e: Exception) {
null
}
}
val builderPassphraseDisplay = builderPassphrase?.let {
try {
cryptoUtils.decrypt(it)
maskSensitiveValue(cryptoUtils.decrypt(it))
} catch (e: Exception) {
null
}
backend/src/main/kotlin/com/wrbug/polymarketbot/util/EthereumUtils.kt
+35 -3
View File
@@ -19,7 +19,7 @@ object EthereumUtils {
* @return 函数选择器，例如 "0x12345678"
*/
fun getFunctionSelector(functionSignature: String): String {
val hash = keccak256(functionSignature.toByteArray())
val hash = keccak256Hex(functionSignature.toByteArray())
return "0x" + hash.substring(0, 8)
}
@@ -138,16 +138,48 @@ object EthereumUtils {
return Pair(payoutDenominator, payouts)
}
/**
* 将十六进制字符串转换为字节数组
* @param hex 十六进制字符串（带或不带 0x 前缀）
* @return 字节数组
*/
fun hexToBytes(hex: String): ByteArray {
val cleanHex = hex.removePrefix("0x")
return ByteArray(cleanHex.length / 2) { i ->
cleanHex.substring(i * 2, i * 2 + 2).toInt(16).toByte()
}
}
/**
* 将字节数组转换为十六进制字符串
* @param bytes 字节数组
* @return 十六进制字符串（带 0x 前缀）
*/
fun bytesToHex(bytes: ByteArray): String {
return "0x" + bytes.joinToString("") { "%02x".format(it) }
}
/**
* 计算 Keccak-256 哈希（Ethereum 标准）
* 使用 BouncyCastle 库实现真正的 Keccak-256
* @param data 输入数据
* @return 32 字节的哈希值
*/
private fun keccak256(data: ByteArray): String {
fun keccak256(data: ByteArray): ByteArray {
val digest = KeccakDigest(256)
digest.update(data, 0, data.size)
val hash = ByteArray(digest.digestSize)
digest.doFinal(hash, 0)
return hash.joinToString("") { "%02x".format(it) }
return hash
}
/**
* 计算 Keccak-256 哈希并返回十六进制字符串
* @param data 输入数据
* @return 十六进制哈希字符串
*/
fun keccak256Hex(data: ByteArray): String {
return keccak256(data).joinToString("") { "%02x".format(it) }
}
}