|
|
import { CARGO_LIMITS } from "@/lib/constants/cargo-limits";
|
|
|
import { z } from "zod";
|
|
|
import {
|
|
|
buildCargoHash,
|
|
|
serializeAddress,
|
|
|
} from "@/modules/quote/cargo-hash";
|
|
|
import type {
|
|
|
NormalizedCargo,
|
|
|
QuoteRequestBody,
|
|
|
ValidationError,
|
|
|
} from "@/modules/quote/types";
|
|
|
import {
|
|
|
SecurityValidationError,
|
|
|
ValidationError as ValidationErrorClass,
|
|
|
} from "@/modules/quote/types";
|
|
|
import { cmToIn, kgToLb } from "@/modules/quote/unit-converter";
|
|
|
|
|
|
/** 查价货物硬限（PRD §4.2.8） */
|
|
|
export const MOTHERSHIP_LIMITS = CARGO_LIMITS;
|
|
|
|
|
|
export const CARGO_TYPES = [
|
|
|
"general_freight",
|
|
|
"machinery",
|
|
|
"furniture",
|
|
|
"electronics",
|
|
|
"building_materials",
|
|
|
"auto_parts",
|
|
|
"food_nonperishable",
|
|
|
"apparel",
|
|
|
"other",
|
|
|
] as const;
|
|
|
|
|
|
const UUID_V4_REGEX =
|
|
|
/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
|
|
|
|
|
const US_ZIP_REGEX = /^\d{5}(-\d{4})?$/;
|
|
|
|
|
|
const SQL_INJECTION_PATTERNS = [
|
|
|
/(\bunion\b.*\bselect\b)/i,
|
|
|
/(\bdrop\b.*\btable\b)/i,
|
|
|
/(\binsert\b.*\binto\b)/i,
|
|
|
/(\bdelete\b.*\bfrom\b)/i,
|
|
|
/(--|\/\*|\*\/)/,
|
|
|
/(\bor\b\s+\d+\s*=\s*\d+)/i,
|
|
|
/(<script|javascript:)/i,
|
|
|
/(\bexec\b|\bxp_)/i,
|
|
|
];
|
|
|
|
|
|
const addressSchema = z.object({
|
|
|
street: z.string().min(1, "请填写街道地址"),
|
|
|
city: z.string().min(1, "请填写城市"),
|
|
|
state: z.string().min(2, "请填写州/省").max(2, "请填写州/省"),
|
|
|
zip: z
|
|
|
.string()
|
|
|
.refine((v) => v === "" || US_ZIP_REGEX.test(v), "邮编格式无效")
|
|
|
.default(""),
|
|
|
place_id: z.string().min(1, "请从地址列表中选择有效地址"),
|
|
|
formatted_address: z.string().min(1, "请填写完整地址"),
|
|
|
selected_from_suggestions: z.literal(true, {
|
|
|
errorMap: () => ({ message: "请从地址列表中选择有效地址" }),
|
|
|
}),
|
|
|
mothership_option_id: z.string().min(1, "请确认 MotherShip 精确地址"),
|
|
|
mothership_display_label: z.string().min(1, "请确认 MotherShip 精确地址"),
|
|
|
selected_from_mothership: z.literal(true, {
|
|
|
errorMap: () => ({
|
|
|
message: "提货/派送地址须在 MotherShip 候选列表中确认后再询价",
|
|
|
}),
|
|
|
}),
|
|
|
});
|
|
|
|
|
|
const weightSchema = z.object({
|
|
|
value: z.number({ invalid_type_error: "请填写重量" }),
|
|
|
unit: z.enum(["lb", "kg"], { errorMap: () => ({ message: "请选择有效的单位" }) }),
|
|
|
});
|
|
|
|
|
|
const dimensionsSchema = z.object({
|
|
|
length: z.number({ invalid_type_error: "请填写长度" }),
|
|
|
width: z.number({ invalid_type_error: "请填写宽度" }),
|
|
|
height: z.number({ invalid_type_error: "请填写高度" }),
|
|
|
unit: z.enum(["in", "cm"], {
|
|
|
errorMap: () => ({ message: "请选择有效的单位" }),
|
|
|
}),
|
|
|
});
|
|
|
|
|
|
const quoteBodySchema = z.object({
|
|
|
request_id: z.string().min(1, "请填写请求标识"),
|
|
|
customer_id: z.string().min(1, "请填写客户标识"),
|
|
|
pickup_address: addressSchema,
|
|
|
delivery_address: addressSchema,
|
|
|
weight: weightSchema,
|
|
|
dimensions: dimensionsSchema,
|
|
|
pallet_count: z.number({ invalid_type_error: "请填写托盘数" }),
|
|
|
cargo_type: z.enum(CARGO_TYPES, {
|
|
|
errorMap: () => ({ message: "请选择有效的货物类型" }),
|
|
|
}),
|
|
|
service_level: z.enum(["standard", "guaranteed"]).optional(),
|
|
|
rate_option: z.enum(["lowest", "fastest"]).optional(),
|
|
|
display_unit: z.enum(["imperial", "metric"]).optional(),
|
|
|
quote_session_id: z.string().uuid("会话标识无效").optional(),
|
|
|
});
|
|
|
|
|
|
function containsSqlInjection(value: string): boolean {
|
|
|
return SQL_INJECTION_PATTERNS.some((pattern) => pattern.test(value));
|
|
|
}
|
|
|
|
|
|
function checkAddressInjection(
|
|
|
addr: {
|
|
|
street: string;
|
|
|
city: string;
|
|
|
state: string;
|
|
|
zip: string;
|
|
|
place_id: string;
|
|
|
formatted_address: string;
|
|
|
},
|
|
|
label: string,
|
|
|
): void {
|
|
|
const fields = [
|
|
|
addr.street,
|
|
|
addr.city,
|
|
|
addr.state,
|
|
|
addr.zip,
|
|
|
addr.formatted_address,
|
|
|
addr.place_id,
|
|
|
];
|
|
|
if (fields.some(containsSqlInjection)) {
|
|
|
throw new SecurityValidationError(`${label}无效，请检查`);
|
|
|
}
|
|
|
}
|
|
|
|
|
|
function validateZip(zip: string, label: string): void {
|
|
|
if (zip.trim() === "") {
|
|
|
return;
|
|
|
}
|
|
|
if (!US_ZIP_REGEX.test(zip)) {
|
|
|
throw new ValidationErrorClass(`${label}邮编无效`);
|
|
|
}
|
|
|
}
|
|
|
|
|
|
function validateMothershipLimits(
|
|
|
weightLb: number,
|
|
|
dimLIn: number,
|
|
|
dimWIn: number,
|
|
|
dimHIn: number,
|
|
|
palletCount: number,
|
|
|
): void {
|
|
|
const { palletCount: pc, dimIn, weightLbPerPallet, totalWeightLbMax } =
|
|
|
MOTHERSHIP_LIMITS;
|
|
|
|
|
|
if (
|
|
|
!Number.isInteger(palletCount) ||
|
|
|
palletCount < pc.min ||
|
|
|
palletCount > pc.max
|
|
|
) {
|
|
|
throw new ValidationErrorClass(
|
|
|
`托盘数超出 Mothership 允许范围（${pc.min}–${pc.max}）`,
|
|
|
);
|
|
|
}
|
|
|
|
|
|
if (weightLb < weightLbPerPallet.min || weightLb > weightLbPerPallet.max) {
|
|
|
throw new ValidationErrorClass("重量超出 Mothership 允许范围");
|
|
|
}
|
|
|
|
|
|
if (
|
|
|
dimLIn < dimIn.min ||
|
|
|
dimLIn > dimIn.lengthMax ||
|
|
|
dimWIn < dimIn.min ||
|
|
|
dimWIn > dimIn.widthMax ||
|
|
|
dimHIn < dimIn.min ||
|
|
|
dimHIn > dimIn.heightMax
|
|
|
) {
|
|
|
throw new ValidationErrorClass("尺寸超出 Mothership 允许范围");
|
|
|
}
|
|
|
|
|
|
const totalWeight = weightLb * palletCount;
|
|
|
if (totalWeight > totalWeightLbMax) {
|
|
|
throw new ValidationErrorClass(
|
|
|
`整票总重超出 Mothership 允许范围（≤${totalWeightLbMax} lb）`,
|
|
|
);
|
|
|
}
|
|
|
}
|
|
|
|
|
|
/** E4.7：拒绝 quantity 件数字段 */
|
|
|
export function rejectQuantityField(body: Record<string, unknown>): void {
|
|
|
if ("quantity" in body) {
|
|
|
throw new ValidationErrorClass("请使用托盘数 pallet_count");
|
|
|
}
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
* 校验 + 单位换算 + cargo_hash 生成
|
|
|
* @throws ValidationError
|
|
|
*/
|
|
|
export function validateQuoteInput(
|
|
|
body: unknown,
|
|
|
): NormalizedCargo {
|
|
|
if (typeof body !== "object" || body === null) {
|
|
|
throw new ValidationErrorClass("请求体无效");
|
|
|
}
|
|
|
|
|
|
rejectQuantityField(body as Record<string, unknown>);
|
|
|
|
|
|
const parsed = quoteBodySchema.safeParse(body);
|
|
|
if (!parsed.success) {
|
|
|
const first = parsed.error.errors[0];
|
|
|
throw new ValidationErrorClass(first?.message ?? "请求参数无效");
|
|
|
}
|
|
|
|
|
|
const data = parsed.data as QuoteRequestBody;
|
|
|
|
|
|
if (!UUID_V4_REGEX.test(data.request_id)) {
|
|
|
throw new ValidationErrorClass("请求标识无效");
|
|
|
}
|
|
|
|
|
|
checkAddressInjection(data.pickup_address, "发货地址");
|
|
|
checkAddressInjection(data.delivery_address, "收货地址");
|
|
|
validateZip(data.pickup_address.zip, "发货地址");
|
|
|
validateZip(data.delivery_address.zip, "收货地址");
|
|
|
|
|
|
const weightLb =
|
|
|
data.weight.unit === "kg" ? kgToLb(data.weight.value) : data.weight.value;
|
|
|
const dimLIn =
|
|
|
data.dimensions.unit === "cm"
|
|
|
? cmToIn(data.dimensions.length)
|
|
|
: data.dimensions.length;
|
|
|
const dimWIn =
|
|
|
data.dimensions.unit === "cm"
|
|
|
? cmToIn(data.dimensions.width)
|
|
|
: data.dimensions.width;
|
|
|
const dimHIn =
|
|
|
data.dimensions.unit === "cm"
|
|
|
? cmToIn(data.dimensions.height)
|
|
|
: data.dimensions.height;
|
|
|
|
|
|
validateMothershipLimits(
|
|
|
weightLb,
|
|
|
dimLIn,
|
|
|
dimWIn,
|
|
|
dimHIn,
|
|
|
data.pallet_count,
|
|
|
);
|
|
|
|
|
|
const pickupSerialized = serializeAddress(data.pickup_address);
|
|
|
const deliverySerialized = serializeAddress(data.delivery_address);
|
|
|
|
|
|
const cargoHash = buildCargoHash({
|
|
|
pickupSerialized,
|
|
|
deliverySerialized,
|
|
|
weightLb,
|
|
|
dimLIn,
|
|
|
dimWIn,
|
|
|
dimHIn,
|
|
|
palletCount: data.pallet_count,
|
|
|
cargoType: data.cargo_type,
|
|
|
});
|
|
|
|
|
|
return {
|
|
|
requestId: data.request_id,
|
|
|
customerId: data.customer_id,
|
|
|
pickupAddress: data.pickup_address,
|
|
|
deliveryAddress: data.delivery_address,
|
|
|
weightLb,
|
|
|
dimLIn,
|
|
|
dimWIn,
|
|
|
dimHIn,
|
|
|
palletCount: data.pallet_count,
|
|
|
cargoType: data.cargo_type,
|
|
|
serviceLevel: data.service_level ?? "standard",
|
|
|
rateOption: data.rate_option ?? "lowest",
|
|
|
cargoHash,
|
|
|
pickupSerialized,
|
|
|
deliverySerialized,
|
|
|
quoteSessionId: data.quote_session_id,
|
|
|
};
|
|
|
}
|
|
|
|
|
|
export type { ValidationError };
|
