新增了客户端打包成sdk的功能和服务端docker镜像打包的功能，并修复了一些问题

2026-07-07 09:48:01 +00:00
parent cd3dca042d
commit 9e545cb328
50 changed files with 5251 additions and 875 deletions
@@ -0,0 +1,91 @@
+#include "TicketHelper.h"
+#include <QCoreApplication>
+#include <QDateTime>
+#include <QDir>
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+#include <QMessageAuthenticationCode>
+#include <QSaveFile>
+#include <QStandardPaths>
+#include <QUuid>
+
+static QByteArray ticketMac(const QJsonObject& payload, const QString& secret)
+{
+    return QMessageAuthenticationCode::hash(
+        QJsonDocument(payload).toJson(QJsonDocument::Compact), secret.toUtf8(), QCryptographicHash::Sha256).toHex();
+}
+
+bool TicketHelper::createTicket(const QString& appId, const QString& deviceId,
+                                const QString& version, const QString& secret,
+                                QString* ticketPath, QString* errorMessage)
+{
+    if (appId.isEmpty() || version.isEmpty() || secret.isEmpty()) {
+        if (errorMessage) *errorMessage = "ticket identity or secret is empty";
+        return false;
+    }
+    const QDateTime now = QDateTime::currentDateTimeUtc();
+    QJsonObject payload{
+        {"app_id", appId}, {"device_id", deviceId}, {"version", version},
+        {"nonce", QUuid::createUuid().toString(QUuid::WithoutBraces)},
+        {"issued_at", now.toString(Qt::ISODate)},
+        {"expires_at", now.addSecs(60).toString(Qt::ISODate)},
+        {"signature_alg", "HMAC-SHA256"}
+    };
+    QJsonObject wrapper{{"payload", payload}, {"signature", QString::fromLatin1(ticketMac(payload, secret))}};
+    const QString dirPath = QDir(QStandardPaths::writableLocation(QStandardPaths::TempLocation)).filePath("marsco_tickets");
+    if (!QDir().mkpath(dirPath)) { if (errorMessage) *errorMessage = "cannot create ticket directory"; return false; }
+    const QString path = QDir(dirPath).filePath("ticket_" + QUuid::createUuid().toString(QUuid::WithoutBraces) + ".json");
+    QSaveFile file(path);
+    const QByteArray bytes = QJsonDocument(wrapper).toJson(QJsonDocument::Compact);
+    if (!file.open(QIODevice::WriteOnly) || file.write(bytes) != bytes.size() || !file.commit()) {
+        if (errorMessage) *errorMessage = "cannot save ticket";
+        return false;
+    }
+    QFile::setPermissions(path, QFileDevice::ReadOwner | QFileDevice::WriteOwner);
+    if (ticketPath) *ticketPath = path;
+    return true;
+}
+
+bool TicketHelper::consumeAndVerify(const QString& ticketPath, const QString& expectedAppId,
+                                    const QString& expectedDeviceId, const QString& expectedVersion,
+                                    const QString& secret, QString* errorMessage)
+{
+    const QString consumingPath = ticketPath + ".consuming."
+        + QString::number(QCoreApplication::applicationPid());
+    if (!QFile::rename(ticketPath, consumingPath)) {
+        if (errorMessage) *errorMessage = "ticket missing or already consumed";
+        return false;
+    }
+    QFile file(consumingPath);
+    if (!file.open(QIODevice::ReadOnly)) {
+        QFile::remove(consumingPath);
+        if (errorMessage) *errorMessage = "cannot read claimed ticket";
+        return false;
+    }
+    const QByteArray raw = file.readAll(); file.close();
+    QFile::remove(consumingPath); // 一次性消费；无论成功失败都不能重放。
+    QJsonParseError parseError;
+    const QJsonDocument doc = QJsonDocument::fromJson(raw, &parseError);
+    if (parseError.error != QJsonParseError::NoError || !doc.isObject()) {
+        if (errorMessage) *errorMessage = "invalid ticket JSON"; return false;
+    }
+    const QJsonObject wrapper = doc.object();
+    const QJsonObject payload = wrapper.value("payload").toObject();
+    const QByteArray actual = wrapper.value("signature").toString().toLatin1();
+    const QByteArray expected = ticketMac(payload, secret);
+    const QDateTime issued = QDateTime::fromString(payload.value("issued_at").toString(), Qt::ISODate);
+    const QDateTime expires = QDateTime::fromString(payload.value("expires_at").toString(), Qt::ISODate);
+    const QDateTime now = QDateTime::currentDateTimeUtc();
+    const bool identityOk = payload.value("app_id").toString() == expectedAppId
+        && payload.value("device_id").toString() == expectedDeviceId
+        && payload.value("version").toString() == expectedVersion;
+    const bool timeOk = issued.isValid() && expires.isValid() && issued <= now.addSecs(5)
+        && expires >= now && issued.secsTo(expires) <= 65;
+    if (actual.isEmpty() || actual != expected || !identityOk || !timeOk
+        || payload.value("nonce").toString().isEmpty()) {
+        if (errorMessage) *errorMessage = "ticket signature, identity, time or nonce invalid";
+        return false;
+    }
+    return true;
+}