382 lines
13 KiB
JavaScript
382 lines
13 KiB
JavaScript
import { createHash, randomBytes } from "node:crypto";
|
|
import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { parse, serialize } from "parse5";
|
|
import subsetFont from "subset-font";
|
|
|
|
const projectRoot = fileURLToPath(new URL("../", import.meta.url));
|
|
const distRoot = path.join(projectRoot, "dist");
|
|
const fontSourcePath = path.join(
|
|
projectRoot,
|
|
"node_modules",
|
|
"@openfonts",
|
|
"noto-sans-sc_chinese-simplified",
|
|
"files",
|
|
"noto-sans-sc-chinese-simplified-400.woff2"
|
|
);
|
|
const fontOutputRoot = path.join(distRoot, "assets", "fonts");
|
|
const cipherFamily = "ClassMemoryCipher";
|
|
const puaStart = 0xe000;
|
|
const puaEnd = 0xf8ff;
|
|
const skippedElements = new Set([
|
|
"code",
|
|
"head",
|
|
"noscript",
|
|
"pre",
|
|
"script",
|
|
"style",
|
|
"template",
|
|
"textarea"
|
|
]);
|
|
const isHan = (character) => /\p{Script=Han}/u.test(character);
|
|
|
|
const listHtmlFiles = async (directory) => {
|
|
const entries = await readdir(directory, { withFileTypes: true });
|
|
const files = await Promise.all(
|
|
entries.map((entry) => {
|
|
const entryPath = path.join(directory, entry.name);
|
|
return entry.isDirectory()
|
|
? listHtmlFiles(entryPath)
|
|
: entry.isFile() && entry.name.endsWith(".html")
|
|
? [entryPath]
|
|
: [];
|
|
})
|
|
);
|
|
|
|
return files.flat();
|
|
};
|
|
|
|
const visitTextNodes = (node, visitor, isSkipped = false) => {
|
|
const skipChildren = isSkipped || (node.tagName && skippedElements.has(node.tagName));
|
|
|
|
if (node.nodeName === "#text" && !skipChildren) {
|
|
visitor(node);
|
|
return;
|
|
}
|
|
|
|
for (const child of node.childNodes ?? []) {
|
|
visitTextNodes(child, visitor, skipChildren);
|
|
}
|
|
};
|
|
|
|
const seededRandom = (seed) => {
|
|
let counter = 0;
|
|
return () => {
|
|
const digest = createHash("sha256")
|
|
.update(seed)
|
|
.update(String(counter++))
|
|
.digest();
|
|
return digest.readUInt32BE(0) / 0x1_0000_0000;
|
|
};
|
|
};
|
|
|
|
const createCipherMap = (characters) => {
|
|
if (characters.length > puaEnd - puaStart + 1) {
|
|
throw new Error(`待加密字符 ${characters.length} 个，超过 BMP 私用区容量。`);
|
|
}
|
|
|
|
const puaCodes = Array.from(
|
|
{ length: puaEnd - puaStart + 1 },
|
|
(_, index) => puaStart + index
|
|
);
|
|
const buildSeed = process.env.FONT_ENCRYPTION_SEED || randomBytes(32).toString("hex");
|
|
const random = seededRandom(buildSeed);
|
|
|
|
for (let index = puaCodes.length - 1; index > 0; index -= 1) {
|
|
const swapIndex = Math.floor(random() * (index + 1));
|
|
[puaCodes[index], puaCodes[swapIndex]] = [puaCodes[swapIndex], puaCodes[index]];
|
|
}
|
|
|
|
return new Map(
|
|
characters.map((character, index) => [character, String.fromCodePoint(puaCodes[index])])
|
|
);
|
|
};
|
|
|
|
const readSfntTables = (fontBuffer) => {
|
|
const tableCount = fontBuffer.readUInt16BE(4);
|
|
const tables = [];
|
|
|
|
for (let index = 0; index < tableCount; index += 1) {
|
|
const recordOffset = 12 + index * 16;
|
|
const tag = fontBuffer.toString("ascii", recordOffset, recordOffset + 4);
|
|
const offset = fontBuffer.readUInt32BE(recordOffset + 8);
|
|
const length = fontBuffer.readUInt32BE(recordOffset + 12);
|
|
tables.push({ tag, data: Buffer.from(fontBuffer.subarray(offset, offset + length)) });
|
|
}
|
|
|
|
return tables;
|
|
};
|
|
|
|
const readCmapGlyphMap = (fontBuffer, characters) => {
|
|
const cmapTable = readSfntTables(fontBuffer).find((table) => table.tag === "cmap");
|
|
if (!cmapTable) throw new Error("字体缺少 cmap 字符映射表。 ");
|
|
|
|
const cmap = cmapTable.data;
|
|
const recordCount = cmap.readUInt16BE(2);
|
|
const subtableOffsets = new Set();
|
|
|
|
for (let index = 0; index < recordCount; index += 1) {
|
|
subtableOffsets.add(cmap.readUInt32BE(4 + index * 8 + 4));
|
|
}
|
|
|
|
const subtables = [...subtableOffsets]
|
|
.map((offset) => ({ offset, format: cmap.readUInt16BE(offset) }))
|
|
.filter(({ format }) => format === 4 || format === 12)
|
|
.sort((left, right) => right.format - left.format);
|
|
|
|
const readFormat4Glyph = (offset, codePoint) => {
|
|
if (codePoint > 0xffff) return 0;
|
|
const segmentCount = cmap.readUInt16BE(offset + 6) / 2;
|
|
const endCodesOffset = offset + 14;
|
|
const startCodesOffset = endCodesOffset + segmentCount * 2 + 2;
|
|
const deltasOffset = startCodesOffset + segmentCount * 2;
|
|
const rangeOffsetsOffset = deltasOffset + segmentCount * 2;
|
|
|
|
for (let index = 0; index < segmentCount; index += 1) {
|
|
const start = cmap.readUInt16BE(startCodesOffset + index * 2);
|
|
const end = cmap.readUInt16BE(endCodesOffset + index * 2);
|
|
if (codePoint < start || codePoint > end) continue;
|
|
|
|
const delta = cmap.readInt16BE(deltasOffset + index * 2);
|
|
const rangeOffsetPosition = rangeOffsetsOffset + index * 2;
|
|
const rangeOffset = cmap.readUInt16BE(rangeOffsetPosition);
|
|
if (rangeOffset === 0) return (codePoint + delta) & 0xffff;
|
|
|
|
const glyphPosition = rangeOffsetPosition + rangeOffset + (codePoint - start) * 2;
|
|
if (glyphPosition + 2 > cmap.length) return 0;
|
|
const glyph = cmap.readUInt16BE(glyphPosition);
|
|
return glyph === 0 ? 0 : (glyph + delta) & 0xffff;
|
|
}
|
|
|
|
return 0;
|
|
};
|
|
|
|
const readFormat12Glyph = (offset, codePoint) => {
|
|
const groupCount = cmap.readUInt32BE(offset + 12);
|
|
let low = 0;
|
|
let high = groupCount - 1;
|
|
|
|
while (low <= high) {
|
|
const middle = Math.floor((low + high) / 2);
|
|
const groupOffset = offset + 16 + middle * 12;
|
|
const start = cmap.readUInt32BE(groupOffset);
|
|
const end = cmap.readUInt32BE(groupOffset + 4);
|
|
if (codePoint < start) high = middle - 1;
|
|
else if (codePoint > end) low = middle + 1;
|
|
else return cmap.readUInt32BE(groupOffset + 8) + codePoint - start;
|
|
}
|
|
|
|
return 0;
|
|
};
|
|
|
|
const glyphMap = new Map();
|
|
for (const character of characters) {
|
|
const codePoint = character.codePointAt(0);
|
|
for (const subtable of subtables) {
|
|
const glyph =
|
|
subtable.format === 12
|
|
? readFormat12Glyph(subtable.offset, codePoint)
|
|
: readFormat4Glyph(subtable.offset, codePoint);
|
|
if (glyph > 0) {
|
|
glyphMap.set(character, glyph);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
return glyphMap;
|
|
};
|
|
|
|
const buildCipherCmap = (cipherMap, glyphMap) => {
|
|
const entries = [...cipherMap.entries()]
|
|
.map(([original, encrypted]) => ({
|
|
codePoint: encrypted.codePointAt(0),
|
|
glyph: glyphMap.get(original)
|
|
}))
|
|
.sort((left, right) => left.codePoint - right.codePoint);
|
|
entries.push({ codePoint: 0xffff, glyph: 0 });
|
|
|
|
const segmentCount = entries.length;
|
|
const subtableLength = 16 + segmentCount * 8;
|
|
const cmap = Buffer.alloc(20 + subtableLength);
|
|
cmap.writeUInt16BE(0, 0);
|
|
cmap.writeUInt16BE(2, 2);
|
|
cmap.writeUInt16BE(0, 4);
|
|
cmap.writeUInt16BE(3, 6);
|
|
cmap.writeUInt32BE(20, 8);
|
|
cmap.writeUInt16BE(3, 12);
|
|
cmap.writeUInt16BE(1, 14);
|
|
cmap.writeUInt32BE(20, 16);
|
|
|
|
const subtableOffset = 20;
|
|
const entrySelector = Math.floor(Math.log2(segmentCount));
|
|
const searchRange = 2 * 2 ** entrySelector;
|
|
cmap.writeUInt16BE(4, subtableOffset);
|
|
cmap.writeUInt16BE(subtableLength, subtableOffset + 2);
|
|
cmap.writeUInt16BE(0, subtableOffset + 4);
|
|
cmap.writeUInt16BE(segmentCount * 2, subtableOffset + 6);
|
|
cmap.writeUInt16BE(searchRange, subtableOffset + 8);
|
|
cmap.writeUInt16BE(entrySelector, subtableOffset + 10);
|
|
cmap.writeUInt16BE(segmentCount * 2 - searchRange, subtableOffset + 12);
|
|
|
|
const endCodesOffset = subtableOffset + 14;
|
|
const startCodesOffset = endCodesOffset + segmentCount * 2 + 2;
|
|
const deltasOffset = startCodesOffset + segmentCount * 2;
|
|
const rangeOffsetsOffset = deltasOffset + segmentCount * 2;
|
|
entries.forEach(({ codePoint, glyph }, index) => {
|
|
cmap.writeUInt16BE(codePoint, endCodesOffset + index * 2);
|
|
cmap.writeUInt16BE(codePoint, startCodesOffset + index * 2);
|
|
cmap.writeUInt16BE((glyph - codePoint) & 0xffff, deltasOffset + index * 2);
|
|
cmap.writeUInt16BE(0, rangeOffsetsOffset + index * 2);
|
|
});
|
|
|
|
return cmap;
|
|
};
|
|
|
|
const calculateChecksum = (buffer) => {
|
|
const paddedLength = Math.ceil(buffer.length / 4) * 4;
|
|
const padded = Buffer.alloc(paddedLength);
|
|
buffer.copy(padded);
|
|
let checksum = 0;
|
|
for (let offset = 0; offset < padded.length; offset += 4) {
|
|
checksum = (checksum + padded.readUInt32BE(offset)) >>> 0;
|
|
}
|
|
return checksum;
|
|
};
|
|
|
|
const replaceSfntTable = (fontBuffer, tag, replacement) => {
|
|
const tables = readSfntTables(fontBuffer)
|
|
.filter((table) => table.tag !== "DSIG")
|
|
.map((table) => ({ ...table, data: table.tag === tag ? replacement : table.data }));
|
|
const head = tables.find((table) => table.tag === "head");
|
|
if (!head) throw new Error("字体缺少 head 表。 ");
|
|
head.data.writeUInt32BE(0, 8);
|
|
|
|
const tableCount = tables.length;
|
|
const entrySelector = Math.floor(Math.log2(tableCount));
|
|
const searchRange = 16 * 2 ** entrySelector;
|
|
const headerLength = 12 + tableCount * 16;
|
|
let fontLength = headerLength;
|
|
for (const table of tables) fontLength += Math.ceil(table.data.length / 4) * 4;
|
|
|
|
const output = Buffer.alloc(fontLength);
|
|
fontBuffer.copy(output, 0, 0, 4);
|
|
output.writeUInt16BE(tableCount, 4);
|
|
output.writeUInt16BE(searchRange, 6);
|
|
output.writeUInt16BE(entrySelector, 8);
|
|
output.writeUInt16BE(tableCount * 16 - searchRange, 10);
|
|
|
|
let dataOffset = headerLength;
|
|
let headOffset = 0;
|
|
tables.forEach((table, index) => {
|
|
const recordOffset = 12 + index * 16;
|
|
output.write(table.tag, recordOffset, 4, "ascii");
|
|
output.writeUInt32BE(calculateChecksum(table.data), recordOffset + 4);
|
|
output.writeUInt32BE(dataOffset, recordOffset + 8);
|
|
output.writeUInt32BE(table.data.length, recordOffset + 12);
|
|
table.data.copy(output, dataOffset);
|
|
if (table.tag === "head") headOffset = dataOffset;
|
|
dataOffset += Math.ceil(table.data.length / 4) * 4;
|
|
});
|
|
|
|
const adjustment = (0xb1b0afba - calculateChecksum(output)) >>> 0;
|
|
output.writeUInt32BE(adjustment, headOffset + 8);
|
|
return output;
|
|
};
|
|
|
|
const injectFontLoader = (html, fontUrl) => {
|
|
const loader = [
|
|
`<link rel="preload" href="${fontUrl}" as="font" type="font/woff2" crossorigin>`,
|
|
`<style data-font-encryption>@font-face{font-family:"${cipherFamily}";src:url("${fontUrl}") format("woff2");font-style:normal;font-weight:100 900;font-display:block}</style>`
|
|
].join("");
|
|
|
|
if (!html.includes("</head>")) {
|
|
throw new Error("构建页面缺少 </head>，无法注入加密字体。 ");
|
|
}
|
|
|
|
return html.replace("</head>", `${loader}</head>`);
|
|
};
|
|
|
|
const htmlFiles = await listHtmlFiles(distRoot);
|
|
if (htmlFiles.length === 0) {
|
|
throw new Error("dist 中没有 HTML 文件，请先执行 Astro 构建。 ");
|
|
}
|
|
|
|
const pages = await Promise.all(
|
|
htmlFiles.map(async (filePath) => {
|
|
const source = await readFile(filePath, "utf8");
|
|
return { filePath, document: parse(source) };
|
|
})
|
|
);
|
|
|
|
const requestedCharacters = new Set();
|
|
for (const page of pages) {
|
|
visitTextNodes(page.document, (node) => {
|
|
for (const character of node.value) {
|
|
if (isHan(character)) requestedCharacters.add(character);
|
|
}
|
|
});
|
|
}
|
|
|
|
const sourceFontBuffer = await readFile(fontSourcePath);
|
|
const subsetFontBuffer = await subsetFont(sourceFontBuffer, [...requestedCharacters].join(""), {
|
|
targetFormat: "sfnt"
|
|
});
|
|
const glyphMap = readCmapGlyphMap(subsetFontBuffer, requestedCharacters);
|
|
const availableCharacters = new Set(glyphMap.keys());
|
|
const cipherMap = createCipherMap([...availableCharacters].sort());
|
|
const encryptedSfnt = replaceSfntTable(
|
|
subsetFontBuffer,
|
|
"cmap",
|
|
buildCipherCmap(cipherMap, glyphMap)
|
|
);
|
|
const encryptedText = [...cipherMap.values()].join("");
|
|
const encryptedFont = await subsetFont(encryptedSfnt, encryptedText, {
|
|
targetFormat: "woff2"
|
|
});
|
|
const verificationSfnt = await subsetFont(encryptedFont, encryptedText, {
|
|
targetFormat: "sfnt"
|
|
});
|
|
const verifiedGlyphs = readCmapGlyphMap(verificationSfnt, cipherMap.values());
|
|
if (verifiedGlyphs.size !== cipherMap.size) {
|
|
throw new Error(
|
|
`加密字体校验失败：缺少 ${cipherMap.size - verifiedGlyphs.size} 个映射字形。`
|
|
);
|
|
}
|
|
|
|
const fontHash = createHash("sha256").update(encryptedFont).digest("hex").slice(0, 12);
|
|
const fontFileName = `class-memory-cipher.${fontHash}.woff2`;
|
|
const fontUrl = `/assets/fonts/${fontFileName}`;
|
|
|
|
await mkdir(fontOutputRoot, { recursive: true });
|
|
await writeFile(path.join(fontOutputRoot, fontFileName), encryptedFont);
|
|
|
|
let replacementCount = 0;
|
|
for (const page of pages) {
|
|
visitTextNodes(page.document, (node) => {
|
|
node.value = [...node.value]
|
|
.map((character) => {
|
|
const encrypted = cipherMap.get(character);
|
|
if (encrypted) replacementCount += 1;
|
|
return encrypted ?? character;
|
|
})
|
|
.join("");
|
|
});
|
|
|
|
const encryptedHtml = injectFontLoader(serialize(page.document), fontUrl);
|
|
await writeFile(page.filePath, encryptedHtml, "utf8");
|
|
}
|
|
|
|
const missingCharacters = [...requestedCharacters].filter(
|
|
(character) => !availableCharacters.has(character)
|
|
);
|
|
console.log(
|
|
`[font-encryption] 已处理 ${pages.length} 个页面、${availableCharacters.size} 个汉字、${replacementCount} 处文本，字体 ${Math.ceil(encryptedFont.length / 1024)} KiB。`
|
|
);
|
|
if (missingCharacters.length > 0) {
|
|
console.warn(
|
|
`[font-encryption] 源字体缺少 ${missingCharacters.length} 个汉字（${missingCharacters.join("、")}），已保留原文。`
|
|
);
|
|
}
|