| ';\n\n /** 允许保留 href 的链接协议前缀 */\n private const ALLOWED_HREF_PREFIXES = ['https://', 'mailto:'];\n\n /**\n * 过滤协议 HTML 正文，去除危险标签、事件属性与非法链接。\n */\n public function sanitizeAgreementHtml(string $htmlContent): string\n {\n $htmlContent = trim($htmlContent);\n if ($htmlContent === '') {\n return '';\n }\n\n $strippedHtml = strip_tags($htmlContent, self::ALLOWED_TAGS);\n if ($strippedHtml === '') {\n return '';\n }\n\n return $this->sanitizeByDom($strippedHtml);\n }\n\n /**\n * 使用 DOM 解析清理允许标签上的危险属性，并规范化链接。\n */\n private function sanitizeByDom(string $htmlContent): string\n {\n $previousLibxmlState = libxml_use_internal_errors(true);\n $domDocument = new DOMDocument('1.0', 'UTF-8');\n $wrappedHtml = ' ' . $htmlContent . ' ';\n $domDocument->loadHTML($wrappedHtml, LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);\n libxml_clear_errors();\n libxml_use_internal_errors($previousLibxmlState);\n\n $rootNode = $domDocument->getElementsByTagName('div')->item(0);\n if (!$rootNode instanceof DOMElement) {\n return htmlspecialchars($htmlContent, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');\n }\n\n $this->sanitizeDomNodeTree($rootNode);\n\n $sanitizedHtml = '';\n foreach ($rootNode->childNodes as $childNode) {\n $sanitizedHtml .= $domDocument->saveHTML($childNode);\n }\n\n return trim($sanitizedHtml);\n }\n\n /**\n * 递归清理 DOM 节点属性与子节点。\n */\n private function sanitizeDomNodeTree(DOMNode $domNode): void\n {\n if ($domNode instanceof DOMElement) {\n $this->sanitizeElementAttributes($domNode);\n }\n\n if (!$domNode->hasChildNodes()) {\n return;\n }\n\n $childNodes = [];\n foreach ($domNode->childNodes as $childNode) {\n $childNodes[] = $childNode;\n }\n\n foreach ($childNodes as $childNode) {\n $this->sanitizeDomNodeTree($childNode);\n }\n }\n\n /**\n * 清理元素节点属性，仅保留 a 标签的合法 href。\n */\n private function sanitizeElementAttributes(DOMElement $domElement): void\n {\n if ($domElement->tagName === 'a') {\n $this->sanitizeAnchorElement($domElement);\n\n return;\n }\n\n while ($domElement->attributes->length > 0) {\n $domElement->removeAttributeNode($domElement->attributes->item(0));\n }\n }\n\n /**\n * 规范化 a 标签：仅保留 https/mailto 链接，并补全外链安全属性。\n */\n private function sanitizeAnchorElement(DOMElement $anchorElement): void\n {\n $href = trim((string) $anchorElement->getAttribute('href'));\n while ($anchorElement->attributes->length > 0) {\n $anchorElement->removeAttributeNode($anchorElement->attributes->item(0));\n }\n\n if (!$this->isAllowedHref($href)) {\n return;\n }\n\n $anchorElement->setAttribute('href', $href);\n if (str_starts_with(strtolower($href), 'https://')) {\n $anchorElement->setAttribute('target', '_blank');\n $anchorElement->setAttribute('rel', 'noopener noreferrer');\n }\n }\n\n /**\n * 判断链接是否为允许的 https 或 mailto 协议。\n */\n private function isAllowedHref(string $href): bool\n {\n if ($href === '') {\n return false;\n }\n\n $normalizedHref = strtolower($href);\n foreach (self::ALLOWED_HREF_PREFIXES as $allowedPrefix) {\n if (str_starts_with($normalizedHref, $allowedPrefix)) {\n return true;\n }\n }\n\n return false;\n }\n}\n"}},{"type":"tool_use","name":"Write","input":{"path":"/Users/ray/Documents/project/www/tenant/saas6.x/server/app/service/content/AgreementCacheService.php","contents":"deleteByShare(self::CACHE_KEY_LIST);\n\n if ($docCode !== null && $docCode !== '') {\n $this->deleteByShare(self::CACHE_KEY_DETAIL_PREFIX . $docCode);\n }\n }\n}\n"}},{"type":"tool_use","name":"Write","input":{"path":"/Users/ray/Documents/project/www/tenant/saas6.x/server/app/validate/operation/ContentAgreementValidate.php","contents":" 'require|integer|between:1,9',\n 'doc_code' => 'require|max:64|regex:^[a-z0-9_]+$',\n 'title' => 'require|max:200',\n 'content' => 'require',\n 'content_type' => 'require|in:1,2,3',\n 'version' => 'require|max:32',\n 'effective_at' => 'date',\n 'sort' => 'integer',\n 'status' => 'in:0,1',\n ];\n\n protected $message = [\n 'doc_type.require' => '文档类型必须选择',\n 'doc_type.between' => '文档类型参数不合法',\n 'doc_code.require' => '文档编码必须填写',\n 'doc_code.max' => '文档编码最长64个字符',\n 'doc_code.regex' => '文档编码只允许小写字母、数字、下划线',\n 'title.require' => '文档标题必须填写',\n 'title.max' => '文档标题最长200个字符',\n 'content.require' => '协议内容必须填写',\n 'content_type.require' => '内容类型必须选择',\n 'content_type.in' => '内容类型参数不合法',\n 'version.require' => '版本号必须填写',\n 'version.max' => '版本号最长32个字符',\n 'effective_at.date' => '生效时间格式不合法',\n 'status.in' => '状态参数不合法',\n ];\n\n protected $scene = [\n 'save' => [\n 'doc_type',\n 'doc_code',\n 'title',\n 'content',\n 'content_type',\n 'version',\n 'effective_at',\n 'sort',\n 'status',\n ],\n 'update' => [\n 'doc_type',\n 'title',\n 'content',\n 'content_type',\n 'version',\n 'effective_at',\n 'sort',\n 'status',\n ],\n 'preview' => [\n 'content',\n ],\n ];\n}\n"}}]}}
{"role":"assistant","message":{"content":[{"type":"text","text":"[REDACTED]"},{"type":"tool_use","name":"Write","input":{"contents":"model = new ContentAgreementModel();\n $this->orderField = 'sort';\n $this->orderType = 'ASC';\n }\n\n /**\n * 分页查询协议文档列表（sort ASC, id ASC）。\n *\n * @param mixed $agreementQuery\n *\n * @return array|list>\n */\n public function getList($agreementQuery): array\n {\n $saiType = request()->input('saiType', 'list');\n $page = (int) request()->input('page', 1);\n $limit = (int) request()->input('limit', 10);\n $agreementQuery->order('sort', 'asc')->order('id', 'asc');\n\n if ($saiType === 'all') {\n return $agreementQuery->select()->toArray();\n }\n\n return $agreementQuery->paginate($limit, false, ['page' => $page])->toArray();\n }\n\n /**\n * 新增协议文档。\n *\n * @param array $agreementPayload\n */\n public function add($agreementPayload): mixed\n {\n $normalizedPayload = $this->normalizeAgreementPayload($agreementPayload, true);\n $this->ensureDocCodeAvailable((string) $normalizedPayload['doc_code']);\n $normalizedPayload['content'] = $this->sanitizeAgreementContent(\n (string) $normalizedPayload['content'],\n (int) $normalizedPayload['content_type']\n );\n\n $agreementId = parent::add($normalizedPayload);\n $this->getAgreementCacheService()->clearAgreementCache((string) $normalizedPayload['doc_code']);\n\n return $agreementId;\n }\n\n /**\n * 更新协议文档（doc_code 创建后不可修改）。\n *\n * @param int|string $agreementId\n * @param array $agreementPayload\n */\n public function edit($agreementId, $agreementPayload): mixed\n {\n unset($agreementPayload['doc_code']);\n\n $agreementRow = $this->findOrEmpty($agreementId);\n if ($agreementRow->isEmpty()) {\n throw new ApiException('协议文档不存在');\n }\n\n $normalizedPayload = $this->normalizeAgreementPayload($agreementPayload, false);\n $normalizedPayload['content'] = $this->sanitizeAgreementContent(\n (string) $normalizedPayload['content'],\n (int) $normalizedPayload['content_type']\n );\n\n $updated = parent::edit($agreementId, $normalizedPayload);\n $this->getAgreementCacheService()->clearAgreementCache((string) $agreementRow->doc_code);\n\n return $updated;\n }\n\n /**\n * 切换协议文档启用状态。\n */\n public function changeAgreementStatus(int $agreementId, int $status): bool\n {\n $this->ensureValidAgreementStatus($status);\n\n $agreementRow = $this->findOrEmpty($agreementId);\n if ($agreementRow->isEmpty()) {\n throw new ApiException('协议文档不存在');\n }\n\n $saved = $agreementRow->save(['status' => $status]);\n if ($saved) {\n $this->getAgreementCacheService()->clearAgreementCache((string) $agreementRow->doc_code);\n }\n\n return (bool) $saved;\n }\n\n /**\n * 预览协议 HTML 正文（保存前过滤危险内容）。\n *\n * @param array $previewPayload\n *\n * @return array{\n * title: string,\n * version: string,\n * effective_at: string|null,\n * content: string\n * }\n */\n public function buildPreviewPayload(array $previewPayload): array\n {\n $contentType = (int) ($previewPayload['content_type'] ?? ContentAgreementModel::CONTENT_TYPE_HTML);\n $sanitizedContent = $this->sanitizeAgreementContent((string) ($previewPayload['content'] ?? ''), $contentType);\n\n return [\n 'title' => (string) ($previewPayload['title'] ?? ''),\n 'version' => (string) ($previewPayload['version'] ?? ''),\n 'effective_at' => $previewPayload['effective_at'] ?? null,\n 'content' => $sanitizedContent,\n ];\n }\n\n /**\n * 规范化协议文档写入字段。\n *\n * @param array $agreementPayload\n *\n * @return array\n */\n private function normalizeAgreementPayload(array $agreementPayload, bool $isCreate): array\n {\n if ($isCreate) {\n $agreementPayload['doc_code'] = strtolower(trim((string) ($agreementPayload['doc_code'] ?? '')));\n }\n\n if (!isset($agreementPayload['sort']) || $agreementPayload['sort'] === '') {\n $agreementPayload['sort'] = 99;\n }\n\n if (!isset($agreementPayload['status']) || $agreementPayload['status'] === '') {\n $agreementPayload['status'] = ContentAgreementModel::STATUS_ON;\n }\n\n if (!isset($agreementPayload['content_type']) || $agreementPayload['content_type'] === '') {\n $agreementPayload['content_type'] = ContentAgreementModel::CONTENT_TYPE_HTML;\n }\n\n if (!isset($agreementPayload['version']) || trim((string) $agreementPayload['version']) === '') {\n $agreementPayload['version'] = '1.0';\n }\n\n if (array_key_exists('effective_at', $agreementPayload) && $agreementPayload['effective_at'] === '') {\n $agreementPayload['effective_at'] = null;\n }\n\n return $agreementPayload;\n }\n\n /**\n * 按内容类型过滤协议正文 HTML。\n */\n private function sanitizeAgreementContent(string $content, int $contentType): string\n {\n if ($contentType !== ContentAgreementModel::CONTENT_TYPE_HTML) {\n return $content;\n }\n\n return $this->getContentHtmlSanitizeService()->sanitizeAgreementHtml($content);\n }\n\n /**\n * 校验文档编码未被占用。\n *\n * @throws ApiException\n */\n private function ensureDocCodeAvailable(string $docCode, int $excludeAgreementId = 0): void\n {\n if ($docCode === '') {\n throw new ApiException('文档编码不能为空');\n }\n\n if (ContentAgreementModel::existsByDocCode($docCode, $excludeAgreementId)) {\n throw new ApiException('文档编码已存在');\n }\n }\n\n /**\n * 校验协议状态枚举合法。\n *\n * @throws ApiException\n */\n private function ensureValidAgreementStatus(int $status): void\n {\n if (!in_array($status, [ContentAgreementModel::STATUS_OFF, ContentAgreementModel::STATUS_ON], true)) {\n throw new ApiException('状态参数不合法');\n }\n }\n\n /**\n * 获取协议 HTML 过滤服务。\n */\n private function getContentHtmlSanitizeService(): ContentHtmlSanitizeService\n {\n return new ContentHtmlSanitizeService();\n }\n\n /**\n * 获取协议文档缓存清理服务。\n */\n private function getAgreementCacheService(): AgreementCacheService\n {\n return new AgreementCacheService();\n }\n}\n","path":"/Users/ray/Documents/project/www/tenant/saas6.x/server/app/logic/operation/ContentAgreementLogic.php"}},{"type":"tool_use","name":"Write","input":{"contents":"logic = new ContentAgreementLogic();\n $this->validate = new ContentAgreementValidate();\n parent::__construct();\n }\n\n /**\n * 协议文档分页列表。\n */\n #[Permission('协议列表', 'saimulti:operation:contentAgreement:index')]\n public function index(Request $request): Response\n {\n $searchWhere = $request->more([\n ['doc_type', ''],\n ['status', ''],\n ['keyword', ''],\n ]);\n $agreementQuery = $this->logic->search($searchWhere);\n $pageList = $this->logic->getList($agreementQuery);\n\n return $this->success($this->stripContentFromList($pageList));\n }\n\n /**\n * 读取单条协议文档详情。\n */\n #[Permission('协议读取', 'saimulti:operation:contentAgreement:read')]\n public function read(Request $request): Response\n {\n $agreementId = $request->input('id', '');\n $agreementRow = $this->logic->read($agreementId);\n if ($agreementRow) {\n return $this->success(is_array($agreementRow) ? $agreementRow : $agreementRow->toArray());\n }\n\n return $this->fail('未查找到信息');\n }\n\n /**\n * 新增协议文档。\n */\n #[Permission('协议新增', 'saimulti:operation:contentAgreement:save')]\n public function save(Request $request): Response\n {\n $agreementPayload = $request->post();\n $this->validate('save', $agreementPayload);\n\n try {\n $agreementId = $this->logic->add($agreementPayload);\n } catch (ApiException $apiException) {\n return $this->fail($apiException->getMessage());\n }\n\n if ($agreementId) {\n return $this->success('添加成功');\n }\n\n return $this->fail('添加失败');\n }\n\n /**\n * 更新协议文档。\n */\n #[Permission('协议修改', 'saimulti:operation:contentAgreement:update')]\n public function update(Request $request): Response\n {\n $agreementPayload = $request->post();\n $this->validate('update', $agreementPayload);\n\n try {\n $updated = $this->logic->edit($agreementPayload['id'], $agreementPayload);\n } catch (ApiException $apiException) {\n return $this->fail($apiException->getMessage());\n }\n\n if ($updated) {\n return $this->success('修改成功');\n }\n\n return $this->fail('修改失败');\n }\n\n /**\n * 列表页切换协议启用状态（0=禁用 1=启用）。\n */\n #[Permission('协议状态修改', 'saimulti:operation:contentAgreement:changeStatus')]\n public function changeStatus(Request $request): Response\n {\n $agreementId = (int) $request->input('id', 0);\n $status = (int) $request->input('status', ContentAgreementModel::STATUS_ON);\n if ($agreementId <= 0) {\n return $this->fail('参数错误');\n }\n\n try {\n $saved = $this->logic->changeAgreementStatus($agreementId, $status);\n } catch (ApiException $apiException) {\n return $this->fail($apiException->getMessage());\n }\n\n if ($saved) {\n return $this->success('操作成功');\n }\n\n return $this->fail('操作失败');\n }\n\n /**\n * 预览协议 HTML 正文（无需保存）。\n */\n #[Permission('协议预览', 'saimulti:operation:contentAgreement:preview')]\n public function preview(Request $request): Response\n {\n $previewPayload = $request->post();\n $this->validate('preview', $previewPayload);\n\n return $this->success($this->logic->buildPreviewPayload($previewPayload));\n }\n\n /**\n * 列表接口移除协议正文，避免分页列表载荷过大。\n *\n * @param array $pageList\n *\n * @return array\n */\n private function stripContentFromList(array $pageList): array\n {\n $agreementRows = $pageList['data'] ?? [];\n if (!is_array($agreementRows)) {\n return $pageList;\n }\n\n foreach ($agreementRows as &$agreementRow) {\n unset($agreementRow['content']);\n }\n unset($agreementRow);\n\n $pageList['data'] = $agreementRows;\n\n return $pageList;\n }\n}\n","path":"/Users/ray/Documents/project/www/tenant/saas6.x/server/app/controller/operation/ContentAgreementController.php"}}]}}
{"role":"assistant","message":{"content":[{"type":"text","text":"[REDACTED]"},{"type":"tool_use","name":"StrReplace","input":{"path":"/Users/ray/Documents/project/www/tenant/saas6.x/server/app/validate/operation/ContentAgreementValidate.php","old_string":" 'version' => 'require|max:32',\n 'effective_at' => 'date',\n 'sort' => 'integer',","new_string":" 'version' => 'require|max:32',\n 'sort' => 'integer',"}},{"type":"tool_use","name":"StrReplace","input":{"path":"/Users/ray/Documents/project/www/tenant/saas6.x/server/app/validate/operation/ContentAgreementValidate.php","old_string":" 'version.max' => '版本号最长32个字符',\n 'effective_at.date' => '生效时间格式不合法',\n 'status.in' => '状态参数不合法',","new_string":" 'version.max' => '版本号最长32个字符',\n 'status.in' => '状态参数不合法',"}},{"type":"tool_use","name":"Write","input":{"contents":"import request from '@/utils/http'\n\n/**\n * 协议文档管理 API\n */\nexport default {\n list(params: Record) {\n return request.get({\n url: '/operation/ContentAgreement/index',\n params\n })\n },\n\n read(id: number | string) {\n return request.get({\n url: '/operation/ContentAgreement/read?id=' + id\n })\n },\n\n save(params: Record) {\n return request.post({\n url: '/operation/ContentAgreement/save',\n data: params\n })\n },\n\n update(id: number | string, params: Record) {\n return request.put({\n url: '/operation/ContentAgreement/update?id=' + id,\n data: params\n })\n },\n\n changeStatus(params: Record) {\n return request.post({\n url: '/operation/ContentAgreement/changeStatus',\n data: params\n })\n },\n\n preview(params: Record) {\n return request.post({\n url: '/operation/ContentAgreement/preview',\n data: params\n })\n }\n}\n","path":"/Users/ray/Documents/project/www/tenant/saas6.x/admin-vue/src/api/admin/operation/contentAgreement.ts"}},{"type":"tool_use","name":"Write","input":{"contents":"/** 协议文档类型 Tab 与新增表单的默认编码/标题映射 */\nexport const AGREEMENT_DOC_TYPE_PRESETS: Record<\n number,\n {\n docCode: string\n title: string\n }\n> = {\n 1: { docCode: 'terms', title: 'Terms of Service' },\n 2: { docCode: 'privacy', title: 'Privacy Policy' },\n 3: { docCode: 'responsible_gaming', title: 'Responsible Gaming' },\n 4: { docCode: 'bonus_terms', title: 'Bonus Terms' },\n 5: { docCode: 'withdrawal_policy', title: 'Withdrawal Policy' },\n 6: { docCode: 'cookie_policy', title: 'Cookie Policy' },\n 7: { docCode: 'kyc_policy', title: 'KYC / Verification Policy' },\n 8: { docCode: 'aml_policy', title: 'AML Policy' },\n 9: { docCode: 'general_rules', title: 'General Rules' }\n}\n\nexport const AGREEMENT_DOC_TYPE_TABS = [\n { label: '全部', value: '' },\n { label: '用户协议', value: 1 },\n { label: '隐私政策', value: 2 },\n { label: '责任博彩', value: 3 },\n { label: 'Bonus条款', value: 4 },\n { label: '提现政策', value: 5 },\n { label: 'Cookie政策', value: 6 },\n { label: 'KYC/验证', value: 7 },\n { label: 'AML政策', value: 8 },\n { label: '通用规则', value: 9 }\n]\n","path":"/Users/ray/Documents/project/www/tenant/saas6.x/admin-vue/src/views/admin/operationManage/contentManage/agreement/constants.ts"}}]}}
{"role":"assistant","message":{"content":[{"type":"text","text":"[REDACTED]"},{"type":"tool_use","name":"Write","input":{"contents":"\n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n 新增协议\n \n \n \n\n \n \n handleChangeStatus(value, row.id)\"\n />\n \n \n \n \n \n 预览\n \n \n \n \n \n\n \n\n \n \n {{ previewData.title || '协议预览' }}\n \n Version: {{ previewData.version }}\n Effective: {{ previewData.effective_at }}\n Updated: {{ previewData.updated_at }}\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n 新增协议\n \n \n \n\n \n \n handleChangeStatus(value, row.id)\"\n />\n \n \n \n \n \n 预览\n \n \n \n \n \n\n \n\n \n |
|---|