jacy/dukang
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

fix(courier): log XFX track callback rawBody and Content-Type

Browse Source 
Capture raw request for courier track callbacks regardless of Content-Type and persist contentType/rawBody/query into log_third_party for empty-body diagnosis.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
jacy
2026-08-07 18:57:31 +08:00
parent b626db5d84
commit 155426b669
3 changed files with 163 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/dukang-api/src/callbacks/delivery-callback.service.ts
+68 -5
View File
@@ -6,6 +6,13 @@ import { logCourierCall } from '../integrations/courier/courier-log.util';
import { TradeService } from '../modules/trade/trade.service';
const XFX_PROVIDER_ALIASES = new Set(['xfx', 'xiaofeixia']);
const RAW_BODY_LOG_LIMIT = 4000;
export type TrackCallbackRequestMeta = {
contentType?: string | null;
rawBody?: string | null;
query?: Record<string, unknown>;
};
@Injectable()
export class DeliveryCallbackService {
@@ -16,15 +23,17 @@ export class DeliveryCallbackService {
private readonly tradeService: TradeService,
) {}
async handleTrackCallback(providerKey: string, body: unknown, requestUrl: string) {
async handleTrackCallback(
providerKey: string,
body: unknown,
requestUrl: string,
meta?: TrackCallbackRequestMeta,
) {
const normalized = providerKey.trim().toLowerCase();
const baseLog = {
scene: 'TRACK_CALLBACK',
requestUrl,
requestBody: (body && typeof body === 'object' ? body : { value: body }) as Record<
string,
unknown
>,
requestBody: this.buildRequestBodyForLog(body, meta),
};
if (!XFX_PROVIDER_ALIASES.has(normalized) && normalized !== 'logistics') {
@@ -105,4 +114,58 @@ export class DeliveryCallbackService {
return response;
}
/** 第三方日志：保留解析后字段，并附带 Content-Type / rawBody / query 便于排查空 body */
private buildRequestBodyForLog(
body: unknown,
meta?: TrackCallbackRequestMeta,
): Record<string, unknown> {
const parsed =
body && typeof body === 'object'
? ({ ...(body as Record<string, unknown>) } as Record<string, unknown>)
: body === undefined || body === null
? {}
: { value: body };
const rawBody = meta?.rawBody != null ? this.redactSecrets(String(meta.rawBody)) : null;
const query =
meta?.query && Object.keys(meta.query).length > 0
? this.redactSecretFields({ ...meta.query })
: undefined;
return {
...this.redactSecretFields(parsed),
_meta: {
contentType: meta?.contentType ?? null,
rawBody:
rawBody && rawBody.length > RAW_BODY_LOG_LIMIT
? `${rawBody.slice(0, RAW_BODY_LOG_LIMIT)}…(truncated)`
: rawBody,
rawBodyLength: meta?.rawBody != null ? Buffer.byteLength(meta.rawBody, 'utf8') : 0,
query,
},
};
}
private redactSecretFields(input: Record<string, unknown>): Record<string, unknown> {
const out: Record<string, unknown> = {};
for (const [key, value] of Object.entries(input)) {
if (/^sign$/i.test(key) || /api[_-]?key/i.test(key)) {
out[key] = '[REDACTED]';
} else if (key === 'mchId' && value != null) {
const s = String(value);
out[key] = s.length <= 4 ? '****' : `${s.slice(0, 4)}****`;
} else {
out[key] = value;
}
}
return out;
}
private redactSecrets(raw: string): string {
return raw
.replace(/(sign=)[^&\s]*/gi, '$1[REDACTED]')
.replace(/("sign"\s*:\s*")[^"]*/gi, '$1[REDACTED]')
.replace(/(api[_-]?key=)[^&\s]*/gi, '$1[REDACTED]');
}
}
server/dukang-api/src/callbacks/delivery-track.controller.ts
+24 -3
View File
@@ -1,7 +1,9 @@
import { Body, Controller, Param, Post, Res } from '@nestjs/common';
import type { Response } from 'express';
import { Body, Controller, Param, Post, Req, Res } from '@nestjs/common';
import type { Request, Response } from 'express';
import { DeliveryCallbackService } from './delivery-callback.service';
type CourierCallbackRequest = Request & { rawBody?: Buffer };
@Controller('callbacks')
export class DeliveryCallbackController {
constructor(private readonly deliveryCallbackService: DeliveryCallbackService) {}
@@ -11,12 +13,14 @@ export class DeliveryCallbackController {
async trackByProvider(
@Param('provider') provider: string,
@Body() body: unknown,
@Req() req: CourierCallbackRequest,
@Res() res: Response,
) {
const result = await this.deliveryCallbackService.handleTrackCallback(
provider,
body,
`/api/v1/callbacks/courier/${provider}/track`,
this.buildRequestMeta(req),
);
// 直出承运商约定结构，避免被全局 { code:0, data } 包装
return res.status(200).json(result);
@@ -24,12 +28,29 @@ export class DeliveryCallbackController {
/** 兼容旧路径，默认按小飞侠解析 */
@Post('delivery/track')
async trackLegacy(@Body() body: unknown, @Res() res: Response) {
async trackLegacy(
@Body() body: unknown,
@Req() req: CourierCallbackRequest,
@Res() res: Response,
) {
const result = await this.deliveryCallbackService.handleTrackCallback(
'xfx',
body,
'/api/v1/callbacks/delivery/track',
this.buildRequestMeta(req),
);
return res.status(200).json(result);
}
private buildRequestMeta(req: CourierCallbackRequest) {
const contentType = req.headers['content-type'];
return {
contentType: Array.isArray(contentType) ? contentType.join(', ') : contentType || null,
rawBody: req.rawBody?.toString('utf8') ?? null,
query:
req.query && typeof req.query === 'object'
? (req.query as Record<string, unknown>)
: undefined,
};
}
}
server/dukang-api/src/main.ts
+71 -3
View File
@@ -3,7 +3,8 @@ import { NestFactory } from '@nestjs/core';
import { loadAppConfig } from '@dukang/shared-types';
import { NestExpressApplication } from '@nestjs/platform-express';
import { ValidationPipe } from '@nestjs/common';
import { json, urlencoded } from 'express';
import { json, urlencoded, type NextFunction, type Request, type Response } from 'express';
import { parse as parseQueryString } from 'node:querystring';
import { AppModule } from './app.module';
import { HttpExceptionFilter } from './common/filters/http-exception.filter';
import { ResponseInterceptor } from './common/interceptors/response.interceptor';
@@ -12,6 +13,61 @@ import { preloadSystemConfigEnv } from './common/system-config/system-config.env
import { AlertService } from './common/alert/alert.service';
import { initSentryIfConfigured } from './integrations/sentry/sentry.bootstrap';
function isCourierTrackCallbackUrl(url?: string): boolean {
if (!url) return false;
const path = url.split('?')[0] ?? '';
return (
(path.includes('/callbacks/courier/') && path.endsWith('/track')) ||
path.endsWith('/callbacks/delivery/track')
);
}
function parseCourierCallbackBody(
rawText: string,
contentType: string,
): Record<string, unknown> {
const ct = contentType.toLowerCase();
const trimmed = rawText.trim();
if (!trimmed) return {};
if (ct.includes('application/json') || trimmed.startsWith('{') || trimmed.startsWith('[')) {
try {
const parsed = JSON.parse(trimmed) as unknown;
return parsed && typeof parsed === 'object'
? (parsed as Record<string, unknown>)
: { value: parsed };
} catch {
return { _rawText: rawText.slice(0, 4000) };
}
}
if (ct.includes('application/x-www-form-urlencoded') || /[=&]/.test(trimmed)) {
return parseQueryString(trimmed) as Record<string, unknown>;
}
return { _rawText: rawText.slice(0, 4000) };
}
/** 小飞侠回调：无论 Content-Type，先吃下 rawBody 再尽力解析（便于第三方日志排查） */
function courierTrackRawBodyMiddleware(req: Request, _res: Response, next: NextFunction) {
if (req.method !== 'POST' || !isCourierTrackCallbackUrl(req.originalUrl || req.url)) {
return next();
}
const chunks: Buffer[] = [];
req.on('data', (chunk: Buffer | string) => {
chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
});
req.on('error', (err) => next(err));
req.on('end', () => {
const buf = Buffer.concat(chunks);
const rawText = buf.toString('utf8');
(req as Request & { rawBody?: Buffer }).rawBody = buf;
req.body = parseCourierCallbackBody(rawText, String(req.headers['content-type'] || ''));
next();
});
}
async function bootstrap() {
const preloaded = await preloadSystemConfigEnv().catch((e) => {
console.warn('[config] system_config preload skipped:', e instanceof Error ? e.message : e);
@@ -26,9 +82,14 @@ async function bootstrap() {
app.setGlobalPrefix('api/v1');
app.set('trust proxy', true);
app.enableCors({ origin: true, credentials: true });
// 微信支付等需 rawBody；小飞侠回调多为 x-www-form-urlencoded
// 小飞侠路由回调：优先捕获 rawBody（Content-Type 异常时也能入第三方日志）
app.use(courierTrackRawBodyMiddleware);
// 微信支付等需 rawBody；其它 JSON / form 请求走常规解析（跳过已由上面吃掉 body 的小飞侠回调）
app.use(
json({
type: (req) =>
!isCourierTrackCallbackUrl(req.originalUrl || req.url) &&
Boolean(req.headers['content-type']?.includes('json')),
verify: (req, _res, buf) => {
if (
req.url?.includes('/callbacks/wechat/pay') ||
@@ -40,7 +101,14 @@ async function bootstrap() {
},
}),
);
app.use(urlencoded({ extended: true }));
app.use(
urlencoded({
extended: true,
type: (req) =>
!isCourierTrackCallbackUrl(req.originalUrl || req.url) &&
Boolean(req.headers['content-type']?.includes('urlencoded')),
}),
);
app.useGlobalPipes(new ValidationPipe({ transform: true, whitelist: true }));
app.useGlobalFilters(new HttpExceptionFilter(app.get(AlertService)));
app.useGlobalInterceptors(new ResponseInterceptor(), app.get(LoggingInterceptor));