feat: 支持 age 加密解密

Author: xream

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sub-store",
-  "version": "2.24.0",
+  "version": "2.24.1",
   "description": "Advanced Subscription Manager for QX, Loon, Surge, Stash and Shadowrocket.",
   "main": "src/main.js",
   "packageManager": "pnpm@11.0.9",
@@ -24,6 +24,7 @@
   },
   "dependencies": {
     "@maxmind/geoip2-node": "^5.0.0",
+    "age-encryption": "^0.3.0",
     "body-parser": "^1.19.0",
     "buffer": "^6.0.3",
     "connect-history-api-fallback": "^2.0.0",

backend/pnpm-lock.yaml

@@ -9,6 +9,7 @@ import $ from '@/core/app';
 import {
     markArtifactProducedWithoutUpload,
     produceArtifact,
+    produceSyncArtifactOutput,
     shouldUploadArtifact,
     uploadArtifactBatches,
 } from '@/restful/sync';
@@ -196,17 +197,9 @@ async function doSync(arg = {}, { canUpload = true } = {}) {
                                 `手动指定了 target 为 SurgeMac, 将使用 Mihomo External`,
                             );
                         }
-                        const output = await produceArtifact({
-                            type: artifact.type,
-                            name: artifact.source,
-                            platform: artifact.platform,
-                            produceOpts: {
-                                'include-unsupported-proxy':
-                                    artifact.includeUnsupportedProxy,
-                                useMihomoExternal,
-                                prettyYaml: artifact.prettyYaml,
-                            },
-                        });
+                        const output = await produceSyncArtifactOutput(
+                            artifact,
+                        );
 
                         // if (!output || output.length === 0)
                         //     throw new Error('该配置的结果为空 不进行上传');

backend/src/products/cron-sync-artifacts.js

@@ -25,6 +25,7 @@ import registerTokenRoutes from '@/restful/token';
 import registerArchiveRoutes from '@/restful/archives';
 import registerModuleRoutes from '@/restful/module';
 import registerLogRoutes from '@/restful/logs';
+import registerAgeRoutes from '@/restful/age';
 
 migrate();
 serve();
@@ -44,6 +45,7 @@ function serve() {
     registerArchiveRoutes($app);
     registerMiscRoutes($app);
     registerLogRoutes($app);
+    registerAgeRoutes($app);
 
     $app.start();
 }

backend/src/products/sub-store-0.js

@@ -0,0 +1,65 @@
+import { AGE_PUBLIC_KEY, encryptArmor } from '@/utils/age';
+
+const SHARE_AGE_PUBLIC_KEY_HEADER = 'x-sub-store-share-age-public-key';
+
+function normalizeAgePublicKey(value) {
+    return String(value ?? '').trim();
+}
+
+function createAgePublicKeyConfig(publicKey) {
+    const key = normalizeAgePublicKey(publicKey);
+    return key ? { [AGE_PUBLIC_KEY]: key } : undefined;
+}
+
+function resolveAgePublicKey(...configs) {
+    for (const config of configs) {
+        const key = normalizeAgePublicKey(config?.[AGE_PUBLIC_KEY]);
+        if (key) return key;
+    }
+
+    return '';
+}
+
+function resolveShareAgeConfig({ req, type, name, findShareToken }) {
+    if (!req?.path?.startsWith('/share/')) {
+        return undefined;
+    }
+
+    const consumedToken = req.subStoreShareToken;
+    const token =
+        consumedToken ||
+        (req.query?.token && typeof findShareToken === 'function'
+            ? findShareToken({
+                  token: req.query.token,
+                  type,
+                  name,
+                  pathname: req.path,
+              })
+            : null);
+    const headerKey = req.headers?.[SHARE_AGE_PUBLIC_KEY_HEADER];
+
+    return createAgePublicKeyConfig(token?.[AGE_PUBLIC_KEY] || headerKey);
+}
+
+async function applyAgeOutputEncryption({ body, res, configs = [] }) {
+    const publicKey = resolveAgePublicKey(...configs);
+
+    if (!publicKey) {
+        return body;
+    }
+
+    const armored = await encryptArmor(body ?? '', publicKey);
+    if (res?.set) {
+        res.set('Content-Type', 'text/plain; charset=utf-8');
+    }
+
+    return armored;
+}
+
+export {
+    SHARE_AGE_PUBLIC_KEY_HEADER,
+    applyAgeOutputEncryption,
+    createAgePublicKeyConfig,
+    resolveAgePublicKey,
+    resolveShareAgeConfig,
+};

backend/src/restful/age-output.js

@@ -0,0 +1,37 @@
+import { failed, success } from '@/restful/response';
+import {
+    AGE_KEY_TYPES,
+    AGE_PUBLIC_KEY,
+    AGE_SECRET_KEY,
+    derivePublicKey,
+    generateKeyPair,
+} from '@/utils/age';
+
+export default function register($app) {
+    $app.post('/api/utils/age/key-pair', createAgeKeyPair);
+    $app.post('/api/utils/age/public-key', createAgePublicKey);
+}
+
+async function createAgeKeyPair(req, res) {
+    try {
+        const pair = await generateKeyPair(req.body?.type || AGE_KEY_TYPES.X25519);
+        success(res, {
+            type: pair.type,
+            [AGE_SECRET_KEY]: pair[AGE_SECRET_KEY],
+            [AGE_PUBLIC_KEY]: pair[AGE_PUBLIC_KEY],
+        });
+    } catch (error) {
+        failed(res, error);
+    }
+}
+
+async function createAgePublicKey(req, res) {
+    try {
+        const publicKey = await derivePublicKey(req.body?.[AGE_SECRET_KEY]);
+        success(res, {
+            [AGE_PUBLIC_KEY]: publicKey,
+        });
+    } catch (error) {
+        failed(res, error);
+    }
+}

backend/src/restful/age.js

@@ -24,6 +24,7 @@ import {
     normalizeArtifactCron,
     refreshArtifactCronJobs,
 } from '@/utils/artifact-cron';
+import { normalizeAgePublicKeyConfig } from '@/utils/age';
 
 const ARTIFACT_GIST_PLACEHOLDER_FILENAME = '.sub-store-placeholder';
 const ARTIFACT_GIST_PLACEHOLDER_CONTENT = [
@@ -140,6 +141,7 @@ function getAllArtifacts(req, res) {
 function replaceArtifact(req, res) {
     try {
         const allArtifacts = req.body;
+        allArtifacts.forEach(normalizeAgePublicKeyConfig);
         allArtifacts.forEach(normalizeArtifactCron);
         $.write(allArtifacts, ARTIFACTS_KEY);
         refreshArtifactCronJobs();
@@ -189,6 +191,7 @@ function updateArtifact(req, res) {
             ...oldArtifact,
             ...artifact,
         };
+        normalizeAgePublicKeyConfig(newArtifact);
         if (!validateArtifactName(newArtifact.name)) {
             failed(
                 res,
@@ -254,6 +257,7 @@ function validateArtifactName(name) {
 }
 
 function createArtifactItem(artifact) {
+    normalizeAgePublicKeyConfig(artifact);
     if (!validateArtifactName(artifact.name)) {
         throw new RequestInvalidError(
             'INVALID_ARTIFACT_NAME',

backend/src/restful/artifacts.js

@@ -11,6 +11,7 @@ import { failed, success } from '@/restful/response';
 import $ from '@/core/app';
 import { RequestInvalidError, ResourceNotFoundError } from '@/restful/errors';
 import { formatDateTime } from '@/utils';
+import { normalizeAgePublicKeyConfig } from '@/utils/age';
 
 export default function register($app) {
     if (!$.read(COLLECTIONS_KEY)) $.write({}, COLLECTIONS_KEY);
@@ -79,6 +80,7 @@ function updateCollection(req, res) {
             ...oldCol,
             ...collection,
         };
+        normalizeAgePublicKeyConfig(newCol);
         $.info(`正在更新组合订阅：${name}...`);
 
         if (name !== newCol.name) {
@@ -141,12 +143,18 @@ function getAllCollections(req, res) {
 }
 
 function replaceCollection(req, res) {
-    const allCols = req.body;
-    $.write(allCols, COLLECTIONS_KEY);
-    success(res);
+    try {
+        const allCols = req.body;
+        allCols.forEach(normalizeAgePublicKeyConfig);
+        $.write(allCols, COLLECTIONS_KEY);
+        success(res);
+    } catch (error) {
+        failed(res, error);
+    }
 }
 
 function createCollectionItem(collection) {
+    normalizeAgePublicKeyConfig(collection);
     $.info(`正在创建组合订阅：${collection.name}`);
     if (/\//.test(collection.name)) {
         throw new RequestInvalidError(