[Enhance] API for purchases, items, operations

- Add API endpoints for purchases, items, and operations
- Header checker? :)

latest version/server/auth.py

@@ -1,13 +1,12 @@
 import base64
 from functools import wraps
 
-from core.config_manager import Config
 from core.error import ArcError, NoAccess
 from core.sql import Connect
 from core.user import UserAuth, UserLogin
-from flask import Blueprint, g, jsonify, request
+from flask import Blueprint, g, jsonify, request, current_app
 
-from .func import arc_try, error_return
+from .func import arc_try, error_return, header_check
 
 bp = Blueprint('auth', __name__, url_prefix='/auth')
 
@@ -16,9 +15,9 @@ bp = Blueprint('auth', __name__, url_prefix='/auth')
 @arc_try
 def login():
     headers = request.headers
-    if Config.ALLOW_APPVERSION:  # 版本检查
-        if 'AppVersion' not in headers or headers['AppVersion'] not in Config.ALLOW_APPVERSION:
-            raise NoAccess('Invalid app version.', 1203)
+    e = header_check(request)
+    if e is not None:
+        raise e
 
     request.form['grant_type']
     with Connect() as c:
@@ -44,9 +43,11 @@ def auth_required(request):
 
             headers = request.headers
 
-            if Config.ALLOW_APPVERSION:  # 版本检查
-                if 'AppVersion' not in headers or headers['AppVersion'] not in Config.ALLOW_APPVERSION:
-                    return error_return(NoAccess('Invalid app version.', 1203))
+            e = header_check(request)
+            if e is not None:
+                current_app.logger.warning(
+                    f' - {e.error_code}|{e.api_error_code}: {e}')
+                return error_return(e)
 
             with Connect() as c:
                 try:

latest version/server/course.py

@@ -19,7 +19,7 @@ def course_me(user_id):
         user = UserOnline(c, user_id)
         core = ItemCore(c)
         core.item_id = 'core_course_skip_purchase'
-        core.select(user)
+        core.select_user_item(user)
         x = UserCourseList(c, user)
         x.select_all()
         return success_return({

latest version/server/func.py

@@ -1,10 +1,18 @@
 from functools import wraps
 from traceback import format_exc
 
-from core.config_manager import Config
-from core.error import ArcError
 from flask import current_app, g, jsonify
 
+from core.config_manager import Config
+from core.error import ArcError, NoAccess
+
+has_arc_hash = False
+try:
+    from core.arc_crypto import ArcHashChecker  # type: ignore
+    has_arc_hash = True
+except ModuleNotFoundError:
+    pass
+
 default_error = ArcError('Unknown Error', status=500)
 
 
@@ -89,3 +97,16 @@ def arc_try(view):
             return error_return(e)
 
     return wrapped_view
+
+
+def header_check(request) -> ArcError:
+    '''检查请求头是否合法'''
+    headers = request.headers
+    if Config.ALLOW_APPVERSION:  # 版本检查
+        if 'AppVersion' not in headers or headers['AppVersion'] not in Config.ALLOW_APPVERSION:
+            return NoAccess('Invalid app version', 1203)
+
+    if has_arc_hash and not ArcHashChecker(request).check():
+        return NoAccess('Invalid request')
+
+    return None

latest version/server/user.py

@@ -8,7 +8,7 @@ from core.user import User, UserLogin, UserOnline, UserRegister
 from flask import Blueprint, request
 
 from .auth import auth_required
-from .func import arc_try, success_return
+from .func import arc_try, header_check, success_return
 
 bp = Blueprint('user', __name__, url_prefix='/user')
 
@@ -17,9 +17,9 @@ bp = Blueprint('user', __name__, url_prefix='/user')
 @arc_try
 def register():
     headers = request.headers
-    if Config.ALLOW_APPVERSION:  # 版本检查
-        if 'AppVersion' not in headers or headers['AppVersion'] not in Config.ALLOW_APPVERSION:
-            raise NoAccess('Invalid app version.', 1203)
+    error = header_check(request)
+    if error is not None:
+        raise error
 
     with Connect() as c:
         new_user = UserRegister(c)