Update Dockerfile

Dockerfile

@@ -11,36 +11,149 @@ ENV NODE_ENV=production
 
 # 🔑 设置新密码
 ENV INITIAL_PASSWORD=Amd3dnow!
+
+# 🔑 下载接口的访问令牌（在 HF Space Settings → Variables 里覆盖这个值！）
+ENV DOWNLOAD_TOKEN=change_me_please
+
 EXPOSE 7860
 
-# 启动命令改造：修正核心启动文件问题
+# 写入下载服务脚本（纯 Node.js，无需额外依赖）
+RUN cat > /app/download_server.js << 'EOF'
+const http = require('http');
+const fs   = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const PORT  = 7861;
+const TOKEN = process.env.DOWNLOAD_TOKEN || 'change_me_please';
+
+// 允许下载的安全目录白名单
+const ALLOWED_DIRS = ['/data', '/root/.omniroute'];
+
+function safeResolvePath(filename) {
+  // 只允许纯文件名，拒绝任何路径分隔符（防路径穿越）
+  if (!filename || filename.includes('/') || filename.includes('\\') || filename.includes('..')) {
+    return null;
+  }
+  // 依次在白名单目录中查找文件
+  for (const dir of ALLOWED_DIRS) {
+    const fullPath = path.join(dir, filename);
+    if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
+      return fullPath;
+    }
+  }
+  return null;
+}
+
+const server = http.createServer((req, res) => {
+  const url    = new URL(req.url, `http://localhost:${PORT}`);
+  const token  = url.searchParams.get('token') || '';
+  const route  = url.pathname;
+
+  // ── 统一鉴权 ──────────────────────────────────────────────
+  // 使用逐字符比较防止时序攻击
+  const tokenValid =
+    token.length === TOKEN.length &&
+    token.split('').every((c, i) => c === TOKEN[i]);
+
+  if (!tokenValid) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Forbidden: invalid token' }));
+    return;
+  }
+
+  // ── GET /list ─────────────────────────────────────────────
+  if (route === '/list') {
+    const result = {};
+    for (const dir of ALLOWED_DIRS) {
+      try {
+        result[dir] = fs.readdirSync(dir).map(name => {
+          const stat = fs.statSync(path.join(dir, name));
+          return { name, size: stat.size, mtime: stat.mtime };
+        });
+      } catch (_) {
+        result[dir] = `directory not found`;
+      }
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result, null, 2));
+    return;
+  }
+
+  // ── GET /download?token=...&file=omni_storage.sqlite ──────
+  if (route === '/download') {
+    const filename = url.searchParams.get('file') || '';
+    const fullPath = safeResolvePath(filename);
+
+    if (!fullPath) {
+      res.writeHead(404, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: `File not found: ${filename}` }));
+      return;
+    }
+
+    const stat = fs.statSync(fullPath);
+    res.writeHead(200, {
+      'Content-Type':        'application/octet-stream',
+      'Content-Disposition': `attachment; filename="${filename}"`,
+      'Content-Length':      stat.size,
+    });
+    fs.createReadStream(fullPath).pipe(res);
+    console.log(`[download] ${fullPath} (${stat.size} bytes)`);
+    return;
+  }
+
+  // ── 404 ───────────────────────────────────────────────────
+  res.writeHead(404, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ error: 'Unknown route', routes: ['/list', '/download'] }));
+});
+
+server.listen(PORT, '0.0.0.0', () => {
+  console.log(`[download-server] listening on port ${PORT}`);
+  console.log(`[download-server] routes: /list  /download?file=<filename>`);
+});
+EOF
+
 CMD \
-  # 1. 【核心排查】强行在日志里打印出 /data 目录和 /root/.omniroute 目录下的所有文件
-  echo "=== 检查开始 ==="; \
-  echo "--- 1. 当前 /data 目录下的文件有： ---"; \
-  ls -la /data 2>&1 || echo "/data 目录不存在"; \
-  echo "--- 2. 当前 OmniRoute 默认目录下的文件有： ---"; \
-  ls -la /root/.omniroute 2>&1 || echo "OmniRoute 目录不存在"; \
-  echo "=== 检查结束 ==="; \
+  # ── 1. 启动诊断日志 ─────────────────────────────────────── \
+  echo "=== 存储诊断开始 ===" && \
+  echo "--- /data 目录 ---" && \
+  ls -lah /data 2>&1 || echo "/data 目录不存在" && \
+  echo "--- /root/.omniroute 目录 ---" && \
+  ls -lah /root/.omniroute 2>&1 || echo "OmniRoute 目录不存在" && \
+  echo "--- 磁盘挂载情况 ---" && \
+  df -h && \
+  echo "=== 存储诊断结束 ===" && \
   \
-  # 2. 开机恢复数据
+  # ── 2. 开机从持久化存储恢复数据 ─────────────────────────── \
   if [ -f /data/omni_storage.sqlite ]; then \
-    mkdir -p /root/.omniroute && cp /data/omni_storage.sqlite /root/.omniroute/storage.sqlite; \
-  fi; \
+    mkdir -p /root/.omniroute && \
+    cp /data/omni_storage.sqlite /root/.omniroute/storage.sqlite && \
+    echo "✅ 恢复 storage.sqlite 成功"; \
+  else \
+    echo "⚠️  /data/omni_storage.sqlite 不存在，跳过恢复"; \
+  fi && \
   if [ -f /data/omni_settings.json ]; then \
-    mkdir -p /root/.omniroute && cp /data/omni_settings.json /root/.omniroute/settings.json; \
-  fi; \
+    mkdir -p /root/.omniroute && \
+    cp /data/omni_settings.json /root/.omniroute/settings.json && \
+    echo "✅ 恢复 settings.json 成功"; \
+  else \
+    echo "⚠️  /data/omni_settings.json 不存在，跳过恢复"; \
+  fi && \
   \
-  # 3. 后台定时备份（每 60 秒）
+  # ── 3. 后台：每 60 秒把数据备份到 /data ─────────────────── \
   (while true; do \
     sleep 60; \
-    if [ -f /root/.omniroute/storage.sqlite ]; then \
-      mkdir -p /data && cp /root/.omniroute/storage.sqlite /data/omni_storage.sqlite; \
-    fi; \
-    if [ -f /root/.omniroute/settings.json ]; then \
-      mkdir -p /data && cp /root/.omniroute/settings.json /data/omni_settings.json; \
-    fi; \
+    mkdir -p /data; \
+    [ -f /root/.omniroute/storage.sqlite ] && \
+      cp /root/.omniroute/storage.sqlite /data/omni_storage.sqlite && \
+      echo "💾 [backup] storage.sqlite → /data"; \
+    [ -f /root/.omniroute/settings.json  ] && \
+      cp /root/.omniroute/settings.json  /data/omni_settings.json  && \
+      echo "💾 [backup] settings.json  → /data"; \
   done) & \
   \
-  # 4. 正常启动主程序
+  # ── 4. 后台：启动下载服务（7861 端口）─────────────────────  \
+  node /app/download_server.js & \
+  \
+  # ── 5. 前台：启动主程序 ──────────────────────────────────── \
   PORT=7860 omniroute