cfc/cfc-frontend/scripts/audit-duplicate-api-calls.js

/**
 * 重复 API 调用审计脚本
 *
 * 检测三类违规（违反 AGENTS.md「API 调用去重」规范）：
 *   A. 生命周期重复触发：同一个方法 / API 同时在 onLoad 和 onShow（或 onLoad+mounted 等
 *      两个生命周期钩子）里被调用，首次进入页面时会双发。
 *   B. 同接口多封装：utils/api.js 里多个导出函数指向同一个后端 URL（params 不同算
 *      合法变体，不算违规；纯重复封装算违规）。
 *   C. N+1 循环调用：在 .map / forEach / for 循环里调用 API 包装函数，N 个元素 → N 次请求。
 *
 * 用法：node scripts/audit-duplicate-api-calls.js [--pages-dir=pages]
 * 退出码：0 = 无违规；1 = 发现违规（CI 可直接用作门禁）
 */
var fs = require('fs')
var path = require('path')

var root = path.resolve(__dirname, '..')
var pagesDir = process.argv.slice(2).reduce(function (acc, a) {
  var m = a.match(/^--pages-dir=(.+)$/)
  return m ? m[1] : acc
}, 'pages')
var scanRoot = path.join(root, pagesDir)
if (!fs.existsSync(scanRoot)) {
  console.error('[audit] pages dir not found: ' + scanRoot)
  process.exit(2)
}

// ---------- 工具：递归收集 .vue ----------
function walk(dir, out) {
  var entries = fs.readdirSync(dir)
  for (var i = 0; i < entries.length; i++) {
    var p = path.join(dir, entries[i])
    var st = fs.statSync(p)
    if (st.isDirectory()) walk(p, out)
    else if (p.slice(-4) === '.vue') out.push(p)
  }
  return out
}

// ---------- 工具：取 <script> 块 ----------
function extractScript(src) {
  var m = src.match(/<script[^>]*>([\s\S]*?)<\/script>/)
  return m ? m[1] : ''
}

// ---------- 工具：按大括号深度截取某个方法体 ----------
// 在 script 文本里定位 `name(args) {`，从 `{` 开始做大括号配对，返回方法体字符串
function hookBody(script, hookName) {
  // 匹配 onShow / onLoad / onShow(options) / onTabItemTap(e) 等，允许前面有空格/换行
  var re = new RegExp('\\b' + hookName + '\\s*\\([^)]*\\)\\s*\\{', 'g')
  var m
  while ((m = re.exec(script)) !== null) {
    var braceStart = script.indexOf('{', m.index)
    if (braceStart < 0) return null
    var depth = 0
    var i = braceStart
    var inStr = null // ' " `
    var inLineComment = false
    var inBlockComment = false
    for (; i < script.length; i++) {
      var c = script[i]
      var next = script[i + 1]
      if (inLineComment) { if (c === '\n') inLineComment = false; continue }
      if (inBlockComment) { if (c === '*' && next === '/') { inBlockComment = false; i++ }; continue }
      if (inStr) {
        if (c === '\\') { i++; continue }
        if (c === inStr) inStr = null
        continue
      }
      if (c === '/' && next === '/') { inLineComment = true; i++; continue }
      if (c === '/' && next === '*') { inBlockComment = true; i++; continue }
      if (c === '"' || c === "'" || c === '`') { inStr = c; continue }
      if (c === '{') depth++
      else if (c === '}') {
        depth--
        if (depth === 0) return script.slice(braceStart + 1, i)
      }
    }
  }
  return null
}

// ---------- 工具：提取方法调用名 ----------
// this.foo(  -> foo ；以及裸函数调用 foo( 当作直接 API 调用候选
function callsIn(body) {
  var calls = []
  if (!body) return calls
  // this.xxx(  / that.xxx(  / self.xxx(
  var reThis = /\b(?:this|that|self)\.([A-Za-z_$][\w$]*)\s*\(/g
  var m
  while ((m = reThis.exec(body)) !== null) calls.push(m[1])
  return calls
}

// ---------- 规则 A：生命周期双发 ----------
var HOOKS = ['onLoad', 'onShow', 'onTabItemTap', 'mounted', 'created', 'beforeMount']
var violations = []

var files = walk(scanRoot, [])
for (var f = 0; f < files.length; f++) {
  var file = files[f]
  var rel = path.relative(root, file).replace(/\\/g, '/')
  var src = fs.readFileSync(file, 'utf8')
  var script = extractScript(src)
  if (!script) continue

  var hookCalls = {} // hookName -> Set(method)
  HOOKS.forEach(function (h) {
    var body = hookBody(script, h)
    hookCalls[h] = callsIn(body)
  })

  // 任两个钩子共享同一方法名 → 双发风险
  for (var i = 0; i < HOOKS.length; i++) {
    for (var j = i + 1; j < HOOKS.length; j++) {
      var a = HOOKS[i], b = HOOKS[j]
      if (!hookCalls[a] || !hookCalls[b]) continue
      var shared = hookCalls[a].filter(function (m) { return hookCalls[b].indexOf(m) !== -1 })
      if (shared.length === 0) continue
      // 看该方法体里有没有"已初始化"守卫标志（_initDone / _inited / _loaded 等）
      // 如果有守卫，降级为 warning 而非 error
      var guarded = false
      shared.forEach(function (m) {
        var mbody = hookBody(script, m)
        if (mbody && /(?:_initDone|_inited|_loaded|_hasInit|loggedInInitDone|_firstLoad|_onLoadFired|_initialLoadDone|_mounted|_pageShown)\b/.test(mbody)) guarded = true
      })
      // 也检查生命周期钩子本身是否含守卫标志（_onLoadFired 通常写在 onLoad/onShow 里）
      ;[a, b].forEach(function (h) {
        var hbody = hookBody(script, h)
        if (hbody && /(?:_initDone|_inited|_loaded|_hasInit|loggedInInitDone|_firstLoad|_onLoadFired|_initialLoadDone|_mounted|_pageShown)\b/.test(hbody)) guarded = true
      })
      violations.push({
        type: 'LIFECYCLE_DOUBLE',
        severity: guarded ? 'warn' : 'error',
        file: rel,
        hooks: a + ' + ' + b,
        methods: shared.join(', '),
        guarded: guarded
      })
    }
  }

  // 规则 C：N+1 —— methods 里某方法在 .map( / .forEach( / for(...) 里调用 API 包装
  // 粗略检测：方法体里同时出现 \.(map|forEach)\s*\( 和某个形如 getXxx( 的调用
  // 进一步限定：只看 methods 块。这里简化：在整个 script 里查 .map(/.forEach( 后续出现
  // 的 API 包装函数调用（名称以 get/fetch/load/list 开头）。
  var nplus = script.match(/\.map\s*\([^]*?\b(get|fetch|load|list)[A-Za-z]*\s*\(/)
  if (nplus) {
    // 更精确：逐方法体检查
    var methodRe = /\b([A-Za-z_$][\w$]*)\s*\([^)]*\)\s*\{/g
    var mm
    while ((mm = methodRe.exec(script)) !== null) {
      // 跳过生命周期钩子
      if (HOOKS.indexOf(mm[1]) !== -1) continue
      var mbody = hookBody(script, mm[1])
      if (!mbody) continue
      if (/\.(map|forEach)\s*\(/.test(mbody) && /\b(get|fetch|load|list)[A-Za-z]*\s*\(/.test(mbody)) {
        violations.push({
          type: 'N_PLUS_1',
          severity: 'warn',
          file: rel,
          hooks: 'method:' + mm[1],
          methods: mm[1],
          guarded: false
        })
      }
    }
  }
}

// ---------- 规则 B：同接口多封装（扫 utils/api.js）----------
var apiFile = path.join(root, 'utils', 'api.js')
if (fs.existsSync(apiFile)) {
  var apiSrc = fs.readFileSync(apiFile, 'utf8')
  // url -> [{ name, params }]  params = request() 第 3 个参数字符串
  var urlMap = {}
  var reWrap = /export\s+const\s+([A-Za-z_$][\w$]*)\s*=\s*\([^)]*\)\s*=>\s*\{[^}]*?request\(\s*([^,)]+),\s*['"`]POST['"`]\s*(?:,\s*([^)]+?))?\s*\)/g
  var mw
  while ((mw = reWrap.exec(apiSrc)) !== null) {
    var name = mw[1]
    var urlRaw = mw[2].trim()
    var url = urlRaw.replace(/['"`]/g, '')
    if (/\$\{/.test(urlRaw)) url = url.replace(/\$\{[^}]+\}/g, '{id}')
    var params = (mw[3] || '').trim()
    if (!urlMap[url]) urlMap[url] = []
    if (!urlMap[url].some(function (e) { return e.name === name })) urlMap[url].push({ name: name, params: params })
  }
  Object.keys(urlMap).forEach(function (url) {
    var entries = urlMap[url]
    if (entries.length <= 1) return
    // 判断"真重复"（参数实质相同）vs"过滤变体/不同操作"（参数不同）
    var isTrueDup = true
    for (var i = 0; i < entries.length - 1; i++) {
      var a = entries[i].params, b = entries[i + 1].params
      var am = a.match(/_method:\s*['"`](\w+)['"`]/)
      var bm = b.match(/_method:\s*['"`](\w+)['"`]/)
      if (am && bm && am[1] !== bm[1]) { isTrueDup = false; break }
      var aVar = /^[A-Za-z_$][\w$]*$/.test(a)
      var bVar = /^[A-Za-z_$][\w$]*$/.test(b)
      var aEmpty = a === '' || a === '{}' || /\|\|\s*\{\}/.test(a)
      var bEmpty = b === '' || b === '{}' || /\|\|\s*\{\}/.test(b)
      if ((aVar && bEmpty) || (bVar && aEmpty)) { isTrueDup = false; break }
      if (a && b && a !== b && !/\|\|\s*\{\}/.test(a) && !/\|\|\s*\{\}/.test(b)) { isTrueDup = false; break }
    }
    violations.push({
      type: 'DUPLICATE_WRAPPER',
      severity: isTrueDup ? 'error' : 'warn',
      file: 'utils/api.js',
      hooks: url,
      methods: entries.map(function (e) { return e.name }).join(', '),
      guarded: !isTrueDup
    })
  })
}

// ---------- 输出 ----------
var errors = violations.filter(function (v) { return v.severity === 'error' })
var warns = violations.filter(function (v) { return v.severity === 'warn' })

function print(list) {
  list.forEach(function (v) {
    var tag = v.severity === 'error' ? 'ERROR' : 'WARN '
    var extra = v.guarded ? ' [guarded]' : ''
    console.log('[' + tag + '] ' + v.type + ' ' + v.file + ' | ' + v.hooks + ' | ' + v.methods + extra)
  })
}

console.log('=== Duplicate API Call Audit ===')
console.log('Scanned ' + files.length + ' .vue files in ' + pagesDir + '/\n')
if (errors.length) { console.log('--- ERRORS (' + errors.length + ') ---'); print(errors) }
if (warns.length) { console.log('\n--- WARNINGS (' + warns.length + ') ---'); print(warns) }
if (!errors.length && !warns.length) console.log('No violations found.')
console.log('\nSummary: ' + errors.length + ' error(s), ' + warns.length + ' warning(s)')
process.exit(errors.length > 0 ? 1 : 0)