304 lines
15 KiB
PHP
304 lines
15 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace app\common\service\qywx;
|
|
|
|
use RuntimeException;
|
|
use think\file\UploadedFile;
|
|
|
|
/** 私有源文件 + 可刷新三天临时素材。欢迎语关键路径仅使用缓存，不下载/上传文件。 */
|
|
class QywxPromotionMediaService
|
|
{
|
|
private QywxPromotionContactApiService $api;
|
|
private QywxPromotionMediaStore $store;
|
|
private string $root;
|
|
|
|
public function __construct(?QywxPromotionContactApiService $api = null, ?QywxPromotionMediaStore $store = null, ?string $root = null)
|
|
{
|
|
$this->api = $api ?? new QywxPromotionContactApiService();
|
|
$this->store = $store ?? new QywxPromotionMediaStore();
|
|
// runtime_path()在adminapi/api/CLI间不同；使用项目级私有目录保证上传与worker共享。
|
|
$this->root = rtrim($root ?? (root_path('runtime') . 'qywx_promotion_private' . DIRECTORY_SEPARATOR . 'media'), '/\\');
|
|
}
|
|
|
|
/** @return array{asset_id:string,name:string,type:string} */
|
|
public function upload($file, string $type, int $adminId): array
|
|
{
|
|
if ($adminId <= 0 || !$file instanceof UploadedFile || !$file->isValid()) {
|
|
throw new RuntimeException('请上传有效文件');
|
|
}
|
|
if (!in_array($type, ['image', 'video', 'file'], true)) {
|
|
throw new RuntimeException('素材类型仅支持 image、video、file');
|
|
}
|
|
$size = (int) $file->getSize();
|
|
$limit = ($type === 'file' ? 20 : 10) * 1024 * 1024;
|
|
if ($size <= 5 || $size > $limit) {
|
|
throw new RuntimeException($type === 'file' ? '文件须大于5字节且不超过20MB' : '图片/视频须大于5字节且不超过10MB');
|
|
}
|
|
$mime = (new \finfo(FILEINFO_MIME_TYPE))->file($file->getPathname());
|
|
$name = str_replace('\\', '/', $file->getOriginalName());
|
|
$name = mb_substr(preg_replace('/[\x00-\x1f\x7f]/u', '', basename($name)) ?? '', 0, 180);
|
|
$extension = strtolower(pathinfo($name, PATHINFO_EXTENSION));
|
|
if ($type === 'image') {
|
|
$info = @getimagesize($file->getPathname());
|
|
if (!in_array($mime, ['image/jpeg', 'image/png'], true) || $info === false
|
|
|| !in_array($info[2], [IMAGETYPE_JPEG, IMAGETYPE_PNG], true)) {
|
|
throw new RuntimeException('图片仅支持真实 JPG/PNG 文件');
|
|
}
|
|
$extension = $mime === 'image/png' ? 'png' : 'jpg';
|
|
} elseif ($type === 'video') {
|
|
if ($mime !== 'video/mp4' || $extension !== 'mp4') {
|
|
throw new RuntimeException('视频仅支持 MP4');
|
|
}
|
|
} else {
|
|
// 私有存储也拒绝可执行内容/HTML/SVG；按实际 MIME 与扩展名双重检查。
|
|
$allowed = [
|
|
'pdf' => ['application/pdf'], 'txt' => ['text/plain'], 'csv' => ['text/plain', 'text/csv', 'application/csv'],
|
|
'doc' => ['application/msword', 'application/x-ole-storage', 'application/CDFV2'],
|
|
'xls' => ['application/vnd.ms-excel', 'application/x-ole-storage', 'application/CDFV2'],
|
|
'ppt' => ['application/vnd.ms-powerpoint', 'application/x-ole-storage', 'application/CDFV2'],
|
|
'docx' => ['application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/zip'],
|
|
'xlsx' => ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/zip'],
|
|
'pptx' => ['application/vnd.openxmlformats-officedocument.presentationml.presentation', 'application/zip'],
|
|
'zip' => ['application/zip'], 'jpg' => ['image/jpeg'], 'jpeg' => ['image/jpeg'], 'png' => ['image/png'],
|
|
'mp4' => ['video/mp4'],
|
|
];
|
|
if (!isset($allowed[$extension]) || !in_array($mime, $allowed[$extension], true)) {
|
|
throw new RuntimeException('不支持该文件格式，请上传PDF、Office、文本、ZIP、JPG/PNG或MP4');
|
|
}
|
|
}
|
|
if ($name === '') {
|
|
$name = '素材.' . $extension;
|
|
}
|
|
$this->ensureRoot();
|
|
$assetId = bin2hex(random_bytes(24));
|
|
$storageName = $assetId . '.' . $extension;
|
|
$hash = hash_file('sha256', $file->getPathname());
|
|
$file->move($this->root, $storageName);
|
|
@chmod($this->root . DIRECTORY_SEPARATOR . $storageName, 0600);
|
|
try {
|
|
$this->store->insert([
|
|
'asset_id' => $assetId, 'admin_id' => $adminId, 'name' => $name, 'type' => $type,
|
|
'mime' => $mime, 'size' => $size, 'sha256' => $hash, 'storage_name' => $storageName,
|
|
'media_id' => '', 'media_expires_at' => 0, 'credential_hash' => '',
|
|
'last_error' => '', 'create_time' => time(), 'update_time' => time(),
|
|
]);
|
|
} catch (\Throwable $e) {
|
|
@unlink($this->root . DIRECTORY_SEPARATOR . $storageName);
|
|
throw new RuntimeException('素材入库失败，请确认已安装推广自动化数据表', 0, $e);
|
|
}
|
|
// 配置阶段就上传企微素材。失败保留私有文件供后续排障，不对外提供文件路径。
|
|
$this->mediaId($assetId, $type, true);
|
|
return ['asset_id' => $assetId, 'name' => $name, 'type' => $type];
|
|
}
|
|
|
|
/** 旧方案授权由上层完成；只白名单旧配置实际已有资产，不接受请求单独声明的白名单。 */
|
|
public function validateConfig(array $config, int $adminId, array $existingConfig = []): array
|
|
{
|
|
$allowed = self::assetIds($existingConfig);
|
|
$config['welcome']['attachments'] = $this->validateAttachments((array) ($config['welcome']['attachments'] ?? []), $adminId, $allowed);
|
|
foreach ((array) ($config['welcome_schedule'] ?? []) as $index => $slot) {
|
|
$config['welcome_schedule'][$index]['attachments'] = $this->validateAttachments((array) ($slot['attachments'] ?? []), $adminId, $allowed);
|
|
}
|
|
return $config;
|
|
}
|
|
|
|
public function validateAttachments(array $attachments, int $adminId, array $allowedAssetIds = []): array
|
|
{
|
|
if (count($attachments) > 9) {
|
|
throw new RuntimeException('欢迎语最多9个附件');
|
|
}
|
|
$clean = [];
|
|
foreach ($attachments as $attachment) {
|
|
if (!is_array($attachment)) {
|
|
throw new RuntimeException('附件格式不正确');
|
|
}
|
|
$type = (string) ($attachment['msgtype'] ?? '');
|
|
$body = $attachment[$type] ?? null;
|
|
if (!is_array($body)) {
|
|
throw new RuntimeException('附件内容类型不匹配');
|
|
}
|
|
if (in_array($type, ['image', 'video', 'file'], true)) {
|
|
// image.pic_url 限企微 uploadimg URL；本服务仅接受私有资产，避免伪装任意外部地址。
|
|
$asset = $this->authorizedAsset((string) ($body['asset_id'] ?? ''), $type, $adminId, $allowedAssetIds);
|
|
$body = ['asset_id' => $asset['asset_id']];
|
|
} elseif ($type === 'link') {
|
|
$body = [
|
|
'title' => self::bytes($body['title'] ?? '', 128, '链接标题', true),
|
|
'url' => self::url($body['url'] ?? ''),
|
|
'desc' => self::bytes($body['desc'] ?? '', 512, '链接描述'),
|
|
] + (!empty($body['picurl']) ? ['picurl' => self::url($body['picurl'])] : []);
|
|
} elseif ($type === 'miniprogram') {
|
|
$asset = $this->authorizedAsset((string) ($body['pic_asset_id'] ?? ''), 'image', $adminId, $allowedAssetIds);
|
|
$appid = (string) ($body['appid'] ?? '');
|
|
$page = self::bytes($body['page'] ?? '', 1024, '小程序页面', true);
|
|
if (!preg_match('/^wx[0-9a-fA-F]{16}$/', $appid) || str_contains($page, '://')
|
|
|| str_contains($page, '..') || preg_match('/[\x00-\x1f]/', $page)) {
|
|
throw new RuntimeException('小程序 appid 或页面路径不正确');
|
|
}
|
|
$body = ['title' => self::bytes($body['title'] ?? '', 64, '小程序标题', true),
|
|
'appid' => $appid, 'page' => $page, 'pic_asset_id' => $asset['asset_id']];
|
|
} else {
|
|
throw new RuntimeException('不支持的附件类型');
|
|
}
|
|
$clean[] = ['msgtype' => $type, $type => $body];
|
|
}
|
|
return $clean;
|
|
}
|
|
|
|
/** 仅处理已授权并持久化的配置快照；绝不在欢迎语发送时进行网络文件上传。 */
|
|
public function materialize(array $attachments, array $config): array
|
|
{
|
|
$attachments = $this->validateAttachments($attachments, 0, self::assetIds($config));
|
|
foreach ($attachments as &$attachment) {
|
|
$type = $attachment['msgtype'];
|
|
if (in_array($type, ['image', 'video', 'file'], true)) {
|
|
$attachment[$type] = ['media_id' => $this->mediaId($attachment[$type]['asset_id'], $type, false)];
|
|
} elseif ($type === 'miniprogram') {
|
|
$attachment[$type]['pic_media_id'] = $this->mediaId($attachment[$type]['pic_asset_id'], 'image', false);
|
|
unset($attachment[$type]['pic_asset_id']);
|
|
}
|
|
}
|
|
unset($attachment);
|
|
return $attachments;
|
|
}
|
|
|
|
public function refreshReferenced(int $limit = 100): array
|
|
{
|
|
$result = ['selected' => 0, 'refreshed' => 0, 'failed' => 0];
|
|
foreach ($this->store->referencedAssetIds() as $id) {
|
|
$asset = $this->store->find($id);
|
|
if (!$asset || ($this->cacheValid($asset, 3600))) {
|
|
continue;
|
|
}
|
|
if ($result['selected'] >= max(1, $limit)) {
|
|
break;
|
|
}
|
|
++$result['selected'];
|
|
try {
|
|
$this->mediaId($id, $asset['type'], true, 3600);
|
|
++$result['refreshed'];
|
|
} catch (\Throwable) {
|
|
++$result['failed'];
|
|
}
|
|
}
|
|
return $result;
|
|
}
|
|
|
|
public static function assetIds(array $config): array
|
|
{
|
|
$ids = [];
|
|
$messages = array_merge([(array) ($config['welcome'] ?? [])], (array) ($config['welcome_schedule'] ?? []));
|
|
foreach ($messages as $message) {
|
|
foreach ((array) ($message['attachments'] ?? []) as $attachment) {
|
|
$type = $attachment['msgtype'] ?? '';
|
|
$key = $type === 'miniprogram' ? 'pic_asset_id' : 'asset_id';
|
|
$id = (string) ($attachment[$type][$key] ?? '');
|
|
if (preg_match('/^[0-9a-f]{48}$/', $id)) {
|
|
$ids[] = $id;
|
|
}
|
|
}
|
|
}
|
|
return array_values(array_unique($ids));
|
|
}
|
|
|
|
private function authorizedAsset(string $id, string $type, int $adminId, array $allowed): array
|
|
{
|
|
if (!preg_match('/^[0-9a-f]{48}$/', $id)) {
|
|
throw new RuntimeException('请先上传欢迎语素材');
|
|
}
|
|
$asset = $this->store->find($id);
|
|
if (!$asset || $asset['type'] !== $type || ((int) $asset['admin_id'] !== $adminId && !in_array($id, $allowed, true))) {
|
|
throw new RuntimeException('素材不存在、类型不匹配或无权使用');
|
|
}
|
|
return $asset;
|
|
}
|
|
|
|
private function mediaId(string $id, string $type, bool $allowUpload, int $margin = 300): string
|
|
{
|
|
$asset = $this->store->find($id);
|
|
if (!$asset || $asset['type'] !== $type) {
|
|
throw new RuntimeException('欢迎语素材不存在');
|
|
}
|
|
if ($this->cacheValid($asset, $margin)) {
|
|
return (string) $asset['media_id'];
|
|
}
|
|
if (!$allowUpload) {
|
|
throw new RuntimeException('欢迎语素材未预热或已过期，请检查素材刷新任务');
|
|
}
|
|
$stream = null;
|
|
try {
|
|
$path = $this->privatePath((string) $asset['storage_name']);
|
|
if (!is_file($path) || hash_file('sha256', $path) !== $asset['sha256']) {
|
|
throw new RuntimeException('欢迎语源文件缺失或完整性检查失败');
|
|
}
|
|
$stream = fopen($path, 'rb');
|
|
$result = $this->api->uploadMedia($stream, $type, (string) $asset['name']);
|
|
if (empty($result['media_id'])) {
|
|
throw new RuntimeException('企微素材接口未返回 media_id');
|
|
}
|
|
$created = min(time(), (int) ($result['created_at'] ?? time()));
|
|
$this->store->update($id, ['media_id' => (string) $result['media_id'],
|
|
'media_expires_at' => $created + 3 * 86400, 'credential_hash' => $this->api->credentialFingerprint(),
|
|
'last_error' => '', 'update_time' => time()]);
|
|
return (string) $result['media_id'];
|
|
} catch (\Throwable $e) {
|
|
$this->store->update($id, ['last_error' => '素材预热失败[' . (int) $e->getCode() . ']', 'update_time' => time()]);
|
|
throw $e;
|
|
} finally {
|
|
if (is_resource($stream)) {
|
|
fclose($stream);
|
|
}
|
|
}
|
|
}
|
|
|
|
private function cacheValid(array $asset, int $margin): bool
|
|
{
|
|
return !empty($asset['media_id']) && (int) $asset['media_expires_at'] > time() + $margin
|
|
&& hash_equals((string) $asset['credential_hash'], $this->api->credentialFingerprint());
|
|
}
|
|
|
|
private function privatePath(string $name): string
|
|
{
|
|
if (!preg_match('/^[0-9a-f]{48}\.[a-z0-9]{1,8}$/', $name)) {
|
|
throw new RuntimeException('素材存储标识不正确');
|
|
}
|
|
$root = realpath($this->root);
|
|
$path = realpath($this->root . DIRECTORY_SEPARATOR . $name);
|
|
if ($root === false || $path === false || !str_starts_with($path, $root . DIRECTORY_SEPARATOR)) {
|
|
throw new RuntimeException('素材文件不在私有存储目录');
|
|
}
|
|
return $path;
|
|
}
|
|
|
|
private function ensureRoot(): void
|
|
{
|
|
if (!is_dir($this->root) && !mkdir($this->root, 0700, true) && !is_dir($this->root)) {
|
|
throw new RuntimeException('无法创建私有素材目录');
|
|
}
|
|
}
|
|
|
|
private static function bytes(mixed $value, int $limit, string $label, bool $required = false): string
|
|
{
|
|
if (!is_string($value) || strlen($value) > $limit || ($required && trim($value) === '')) {
|
|
throw new RuntimeException($label . '须' . ($required ? '非空且' : '') . '不超过' . $limit . '字节');
|
|
}
|
|
return trim($value);
|
|
}
|
|
|
|
private static function url(mixed $value): string
|
|
{
|
|
if (!is_string($value) || strlen($value) > 2048 || filter_var($value, FILTER_VALIDATE_URL) === false) {
|
|
throw new RuntimeException('链接地址不正确');
|
|
}
|
|
$parts = parse_url($value);
|
|
if (!in_array(strtolower((string) ($parts['scheme'] ?? '')), ['http', 'https'], true)
|
|
|| isset($parts['user']) || isset($parts['pass'])) {
|
|
throw new RuntimeException('链接仅支持不含账号密码的HTTP(S)地址');
|
|
}
|
|
// 仅向企微传递链接；服务端永远不会抓取这些URL。
|
|
return $value;
|
|
}
|
|
}
|