check duplicated certificates

Ylarod · Ylarod · commit 5706ce7332b7 · 2025-11-25T23:02:54.000+08:00
diff --git a/cert-manager.js b/cert-manager.js
@@ -0,0 +1,271 @@
+const { getOctokit } = require('@actions/github')
+
+/**
+ * 使用 GraphQL 查询用户的证书和吊销记录
+ * @param {string} token - GitHub token
+ * @param {string} owner - 仓库所有者
+ * @param {string} repo - 仓库名
+ * @param {string} username - 用户名
+ * @returns {Promise<{keyringIssues: Array, revokeIssues: Array}>}
+ */
+async function fetchUserCertificateIssues (token, owner, repo, username) {
+  const octokit = getOctokit(token)
+
+  const query = `
+    query($owner: String!, $repo: String!, $username: String!) {
+      repository(owner: $owner, name: $repo) {
+        keyringIssues: issues(
+          first: 100
+          filterBy: { createdBy: $username, states: CLOSED, labels: ["approved"] }
+          orderBy: { field: CREATED_AT, direction: DESC }
+        ) {
+          nodes {
+            number
+            title
+            createdAt
+            closedAt
+            body
+            labels(first: 10) {
+              nodes {
+                name
+              }
+            }
+            comments(first: 100) {
+              nodes {
+                id
+                body
+                createdAt
+                author {
+                  login
+                }
+              }
+            }
+          }
+        }
+        revokeIssues: issues(
+          first: 100
+          filterBy: { createdBy: $username, states: CLOSED, labels: ["revoked"] }
+          orderBy: { field: CREATED_AT, direction: DESC }
+        ) {
+          nodes {
+            number
+            title
+            body
+            createdAt
+            closedAt
+          }
+        }
+      }
+    }
+  `
+
+  try {
+    const result = await octokit.graphql(query, {
+      owner,
+      repo,
+      username
+    })
+
+    return {
+      keyringIssues: result.repository.keyringIssues.nodes || [],
+      revokeIssues: result.repository.revokeIssues.nodes || []
+    }
+  } catch (error) {
+    console.error('GraphQL query failed:', error)
+    throw new Error(`Failed to fetch certificate issues: ${error.message}`)
+  }
+}
+
+/**
+ * 从 issue 评论中提取证书信息
+ * @param {Array} comments - Issue 评论列表
+ * @returns {{serialNumber: string, fingerprint: string, issuedAt: Date, expiresAt: Date} | null}
+ */
+function extractCertificateInfo (comments) {
+  // 查找证书签发评论
+  const certComment = comments.find(c =>
+    c.body &&
+    c.body.includes('✅ Certificate successfully issued') &&
+    c.body.includes('Serial Number')
+  )
+
+  if (!certComment) {
+    return null
+  }
+
+  // 提取序列号
+  const serialMatch = certComment.body.match(/Serial Number.*?`([^`]+)`/i)
+  const serialNumber = serialMatch ? serialMatch[1] : null
+
+  // 提取指纹
+  const fingerprintMatch = certComment.body.match(/Fingerprint \(SHA-256\).*?`([^`]+)`/i)
+  const fingerprint = fingerprintMatch ? fingerprintMatch[1] : null
+
+  if (!serialNumber) {
+    return null
+  }
+
+  // 计算有效期（1年）
+  const issuedAt = new Date(certComment.createdAt)
+  const expiresAt = new Date(issuedAt.getTime() + 365 * 24 * 60 * 60 * 1000)
+
+  return {
+    serialNumber,
+    fingerprint,
+    issuedAt,
+    expiresAt
+  }
+}
+
+/**
+ * 检查证书是否在吊销列表中
+ * @param {string} serialNumber - 证书序列号
+ * @param {Array} revokeIssues - 吊销 issue 列表
+ * @returns {boolean}
+ */
+function isCertificateRevoked (serialNumber, revokeIssues) {
+  return revokeIssues.some(issue =>
+    issue.title.toLowerCase().includes('[revoke]') &&
+    issue.body &&
+    issue.body.includes(serialNumber)
+  )
+}
+
+/**
+ * 检查用户是否已有有效证书
+ * @param {string} username - GitHub 用户名
+ * @param {string} token - GitHub token
+ * @param {string} owner - 仓库所有者
+ * @param {string} repo - 仓库名
+ * @returns {Promise<{hasActiveCert: boolean, certificate?: object, issueNumber?: number}>}
+ */
+async function checkExistingCertificate (username, token, owner, repo) {
+  try {
+    console.log(`Checking existing certificates for user: ${username}`)
+
+    // 使用 GraphQL 获取用户的 issue
+    const { keyringIssues, revokeIssues } = await fetchUserCertificateIssues(
+      token,
+      owner,
+      repo,
+      username
+    )
+
+    console.log(`Found ${keyringIssues.length} keyring issues and ${revokeIssues.length} revoke issues`)
+
+    // 过滤出真正的 keyring issue（标题包含 [keyring]）
+    const validKeyringIssues = keyringIssues.filter(issue =>
+      issue.title.toLowerCase().includes('[keyring]')
+    )
+
+    if (validKeyringIssues.length === 0) {
+      console.log('No keyring issues found for user')
+      return { hasActiveCert: false }
+    }
+
+    const now = new Date()
+
+    // 检查每个 keyring issue，从最新到最旧
+    for (const issue of validKeyringIssues) {
+      const certInfo = extractCertificateInfo(issue.comments.nodes)
+
+      if (!certInfo) {
+        console.log(`Issue #${issue.number}: No certificate info found`)
+        continue
+      }
+
+      console.log(`Issue #${issue.number}: Found certificate ${certInfo.serialNumber}`)
+      console.log(`  Issued: ${certInfo.issuedAt.toISOString()}`)
+      console.log(`  Expires: ${certInfo.expiresAt.toISOString()}`)
+
+      // 检查是否过期
+      if (now > certInfo.expiresAt) {
+        console.log(`  Status: EXPIRED`)
+        continue
+      }
+
+      // 检查是否被吊销
+      const isRevoked = isCertificateRevoked(certInfo.serialNumber, revokeIssues)
+      if (isRevoked) {
+        console.log(`  Status: REVOKED`)
+        continue
+      }
+
+      // 找到有效证书
+      console.log(`  Status: ACTIVE`)
+      return {
+        hasActiveCert: true,
+        certificate: {
+          serialNumber: certInfo.serialNumber,
+          fingerprint: certInfo.fingerprint,
+          issuedAt: certInfo.issuedAt.toISOString(),
+          expiresAt: certInfo.expiresAt.toISOString()
+        },
+        issueNumber: issue.number
+      }
+    }
+
+    console.log('No active certificate found')
+    return { hasActiveCert: false }
+  } catch (error) {
+    console.error('Error checking existing certificate:', error)
+    // 如果检查失败，为了安全起见，假设没有证书（允许签发）
+    // 但记录错误以便调试
+    console.error('Certificate check failed, allowing issuance by default')
+    return { hasActiveCert: false, error: error.message }
+  }
+}
+
+/**
+ * 统计用户的证书情况
+ * @param {string} username - GitHub 用户名
+ * @param {string} token - GitHub token
+ * @param {string} owner - 仓库所有者
+ * @param {string} repo - 仓库名
+ * @returns {Promise<{total: number, active: number, expired: number, revoked: number}>}
+ */
+async function getCertificateStatistics (username, token, owner, repo) {
+  const { keyringIssues, revokeIssues } = await fetchUserCertificateIssues(
+    token,
+    owner,
+    repo,
+    username
+  )
+
+  const validKeyringIssues = keyringIssues.filter(issue =>
+    issue.title.toLowerCase().includes('[keyring]')
+  )
+
+  let total = 0
+  let active = 0
+  let expired = 0
+  let revoked = 0
+
+  const now = new Date()
+
+  for (const issue of validKeyringIssues) {
+    const certInfo = extractCertificateInfo(issue.comments.nodes)
+    if (!certInfo) continue
+
+    total++
+
+    const isRevoked = isCertificateRevoked(certInfo.serialNumber, revokeIssues)
+    if (isRevoked) {
+      revoked++
+    } else if (now > certInfo.expiresAt) {
+      expired++
+    } else {
+      active++
+    }
+  }
+
+  return { total, active, expired, revoked }
+}
+
+module.exports = {
+  checkExistingCertificate,
+  fetchUserCertificateIssues,
+  getCertificateStatistics,
+  extractCertificateInfo,
+  isCertificateRevoked
+}
diff --git a/keyring.js b/keyring.js
@@ -2,8 +2,9 @@ const core = require('@actions/core')
 const { context } = require('@actions/github')
 const crypto = require('crypto')
 const x509 = require('@peculiar/x509')
-const { getRepo, createComment, removeLabel, closeIssue, addLabel } = require('./github-utils')
+const { getRepo, createComment, removeLabel, closeIssue, addLabel, setLabel } = require('./github-utils')
 const { fetchUserStats, evaluateUser, generateReport } = require('./rank')
+const { checkExistingCertificate } = require('./cert-manager')
 
 // Set crypto provider for @peculiar/x509
 x509.cryptoProvider.set(crypto.webcrypto)
@@ -299,6 +300,54 @@ async function handleKeyringIssue () {
     // Handle newly opened keyring issues
     if (action === 'opened') {
       console.log('Handling opened keyring issue')
+
+      // 检查用户是否已有有效证书
+      console.log('Checking for existing certificates...')
+      const existingCert = await checkExistingCertificate(username, token, owner, repo)
+
+      if (existingCert.hasActiveCert) {
+        console.log('User already has an active certificate, rejecting request')
+        const cert = existingCert.certificate
+        await createComment(
+          token,
+          owner,
+          repo,
+          issueNumber,
+          `⚠️ **证书申请被拒绝 / Certificate Request Rejected**\n\n` +
+          `@${username}，您已经拥有一个有效的开发者证书 / You already have an active developer certificate:\n\n` +
+          `- **序列号 / Serial Number**: \`${cert.serialNumber}\`\n` +
+          `- **指纹 / Fingerprint**: \`${cert.fingerprint || 'N/A'}\`\n` +
+          `- **签发时间 / Issued**: ${new Date(cert.issuedAt).toLocaleDateString('zh-CN')}\n` +
+          `- **过期时间 / Expires**: ${new Date(cert.expiresAt).toLocaleDateString('zh-CN')}\n` +
+          `- **原始 Issue**: #${existingCert.issueNumber}\n\n` +
+          `---\n\n` +
+          `**策略 / Policy**: 每个开发者同一时间只能持有**一个**有效证书 / Each developer can only hold **ONE** active certificate at a time.\n\n` +
+          `**选项 / Options**:\n` +
+          `1. 等待当前证书过期后重新申请 / Wait for your current certificate to expire before reapplying\n` +
+          `2. 如果需要更换证书，请先创建 \`[revoke]\` issue 吊销当前证书 / To replace your certificate, create a \`[revoke]\` issue first\n` +
+          `3. 如果您丢失了私钥，请先创建 \`[revoke]\` issue，然后重新申请 / If you lost your private key, create a \`[revoke]\` issue first, then reapply\n\n` +
+          `**安全提示 / Security Note**: 此策略可防止证书滥用和吊销绕过 / This policy prevents certificate abuse and revocation bypass.`
+        )
+        await setLabel(token, owner, repo, issueNumber, 'duplicate')
+        await closeIssue(token, owner, repo, issueNumber, false)
+        return
+      }
+
+      if (existingCert.error) {
+        console.log('Certificate check had errors, but proceeding with issuance')
+        await createComment(
+          token,
+          owner,
+          repo,
+          issueNumber,
+          `⚠️ **注意 / Note**: 无法完全验证您的证书历史记录，但申请将继续处理。\n\n` +
+          `Unable to fully verify your certificate history, but your application will proceed.\n\n` +
+          `错误信息 / Error: ${existingCert.error}`
+        )
+      } else {
+        console.log('No active certificate found, proceeding with evaluation')
+      }
+
       await autoEvaluateDeveloper(token, owner, repo, issueNumber, username)
       return
     }
diff --git a/utils/cert-check.js b/utils/cert-check.js
