perf: add rate limiting, validation, logging, and error handling

- Add express-rate-limit with tiered rate limits per endpoint
- Add express-validator for input validation on all API routes
- Add winston + morgan for structured logging
- Add node-cache for lottery result caching (5min TTL, 1000 max keys)
- Convert OCR to async task queue with max 2 concurrent jobs
- Add global error handler middleware
- Add React ErrorBoundary for client-side error handling
- Fix memory leaks in OCR task queue and lottery cache
- Add per-item error handling in batch ticket updates
- Fix SQL UPDATE to include user_id in WHERE clause

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/services/logger.js

@@ -0,0 +1,27 @@
+const winston = require('winston');
+const path = require('path');
+
+const logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || 'info',
+  format: winston.format.combine(
+    winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
+    winston.format.errors({ stack: true }),
+    winston.format.json()
+  ),
+  defaultMeta: { service: 'lottery-api' },
+  transports: [
+    new winston.transports.File({ filename: path.join(__dirname, '../logs/error.log'), level: 'error' }),
+    new winston.transports.File({ filename: path.join(__dirname, '../logs/combined.log') }),
+    new winston.transports.Console({
+      format: winston.format.combine(
+        winston.format.colorize(),
+        winston.format.printf(({ timestamp, level, message, ...meta }) => {
+          const metaStr = Object.keys(meta).length ? JSON.stringify(meta) : '';
+          return `${timestamp} [${level}]: ${message} ${metaStr}`;
+        })
+      )
+    })
+  ]
+});
+
+module.exports = logger;

server/services/lottery.js

@@ -1,7 +1,12 @@
 const axios = require('axios');
 const cheerio = require('cheerio');
+const NodeCache = require('node-cache');
+const logger = require('./logger');
 const db = require('../db/init');
 
+// 内存缓存 - 5分钟TTL, 最多1000个键防止内存溢出
+const cache = new NodeCache({ stdTTL: 300, checkperiod: 60, maxKeys: 1000 });
+
 // 获取预计开奖时间
 function getEstimatedDrawTime(game, issue) {
   const now = new Date();
@@ -51,10 +56,21 @@ function getEstimatedDrawTime(game, issue) {
 
 // 获取开奖结果
 async function fetchLotteryResult(game, issue) {
-  // 先查本地缓存
-  const cached = db.prepare('SELECT * FROM lottery_results WHERE game = ? AND issue = ?').get(game, issue);
+  const cacheKey = `lottery:${game}:${issue}`;
+
+  // 先查内存缓存
+  const cached = cache.get(cacheKey);
   if (cached) {
-    return { ...cached, numbers: JSON.parse(cached.numbers) };
+    logger.debug(`内存缓存命中: ${cacheKey}`);
+    return cached;
+  }
+
+  // 查本地数据库
+  const dbCached = db.prepare('SELECT * FROM lottery_results WHERE game = ? AND issue = ?').get(game, issue);
+  if (dbCached) {
+    const result = { ...dbCached, numbers: JSON.parse(dbCached.numbers) };
+    cache.set(cacheKey, result);
+    return result;
   }
 
   // 从网络获取
@@ -66,26 +82,41 @@ async function fetchLotteryResult(game, issue) {
         INSERT OR REPLACE INTO lottery_results (game, issue, numbers, draw_date)
         VALUES (?, ?, ?, ?)
       `).run(game, issue, JSON.stringify(result.numbers), result.draw_date);
+      cache.set(cacheKey, result);
     }
     return result;
   } catch (err) {
-    console.error('获取开奖数据失败:', err.message);
+    logger.error('获取开奖数据失败:', err.message);
     return null;
   }
 }
 
 // 从500.com获取数据
 async function fetchFromWeb(game, issue) {
+  // 检查是否在冷却期 (防止频繁请求)
+  const cooldownKey = `cooldown:${game}`;
+  if (cache.get(cooldownKey)) {
+    logger.warn(`请求冷却中: ${game}`);
+    return null;
+  }
+
+  let result = null;
   try {
     if (game === '双色球') {
-      return await fetchSSQ(issue);
+      result = await fetchSSQ(issue);
     } else if (game === '大乐透') {
-      return await fetchDLT(issue);
+      result = await fetchDLT(issue);
     }
   } catch (err) {
-    console.error(`获取${game}开奖数据失败:`, err.message);
+    logger.error(`获取${game}开奖数据失败:`, err.message);
   }
-  return null;
+
+  // 设置请求冷却 (5分钟)
+  if (!result) {
+    cache.set(cooldownKey, true, 300);
+  }
+
+  return result;
 }
 
 // 获取双色球开奖数据
@@ -224,25 +255,29 @@ async function updateTicketsStatus(userId) {
   `).all(userId);
 
   for (const ticket of pendingTickets) {
-    const result = await fetchLotteryResult(ticket.game, ticket.issue);
-    if (result) {
-      const ticketNumbers = ticket.numbers ? JSON.parse(ticket.numbers) : null;
-      if (ticketNumbers && ticketNumbers.length > 0) {
-        let totalPrize = 0;
-        for (const num of ticketNumbers) {
-          const winning = checkWinning(ticket.game, num, result.numbers);
-          if (winning.won) {
-            totalPrize += winning.prize * ticket.multiple;
-            // 大乐透只有1等奖和2等奖追加才有80%浮动奖金，其他等级没有
-            if (ticket.is_additional && winning.level >= 1 && winning.level <= 2) {
-              totalPrize += Math.floor(winning.prize * 0.8) * ticket.multiple;
+    try {
+      const result = await fetchLotteryResult(ticket.game, ticket.issue);
+      if (result) {
+        const ticketNumbers = ticket.numbers ? JSON.parse(ticket.numbers) : null;
+        if (ticketNumbers && ticketNumbers.length > 0) {
+          let totalPrize = 0;
+          for (const num of ticketNumbers) {
+            const winning = checkWinning(ticket.game, num, result.numbers);
+            if (winning.won) {
+              totalPrize += winning.prize * ticket.multiple;
+              if (ticket.is_additional && winning.level >= 1 && winning.level <= 2) {
+                totalPrize += Math.floor(winning.prize * 0.8) * ticket.multiple;
+              }
             }
           }
-        }
 
-        db.prepare('UPDATE tickets SET prize = ?, status = ? WHERE id = ?')
-          .run(totalPrize, totalPrize > 0 ? 'won' : 'lost', ticket.id);
+          db.prepare('UPDATE tickets SET prize = ?, status = ? WHERE id = ?')
+            .run(totalPrize, totalPrize > 0 ? 'won' : 'lost', ticket.id);
+        }
       }
+    } catch (err) {
+      logger.error(`更新彩票 ${ticket.id} 状态失败`, { error: err.message });
+      // 继续处理其他彩票，不因单个失败中止
     }
   }
 }

server/services/ocr.js

@@ -1,53 +1,119 @@
 const Tesseract = require('tesseract.js');
 const path = require('path');
+const logger = require('./logger');
 
-// 彩票类型识别规则
+// 彩票类型识别规则 (模块级别常量，避免每次调用时重建)
 const LOTTERY_PATTERNS = {
-  // 福利彩票
   ssq: { name: '双色球', type: 'welfare', pattern: /双\s*色\s*球|SSQ/i, price: 2 },
-  fc3d: { name: '福彩3D', type: 'welfare', pattern: /福彩\s*3D|3D/i, price: 2 },
+  fc3d: { name: '福彩3D', type: 'welfare', pattern: /福\s*彩\s*3D|3D/i, price: 2 },
   qlc: { name: '七乐彩', type: 'welfare', pattern: /七\s*乐\s*彩/i, price: 2 },
-  // 体育彩票
   dlt: { name: '大乐透', type: 'sports', pattern: /大\s*乐\s*透|超级\s*大\s*乐\s*透/i, price: 2 },
   pl3: { name: '排列3', type: 'sports', pattern: /排列\s*3|排列\s*三/i, price: 2 },
   pl5: { name: '排列5', type: 'sports', pattern: /排列\s*5|排列\s*五/i, price: 2 },
   qxc: { name: '七星彩', type: 'sports', pattern: /七\s*星\s*彩/i, price: 2 },
 };
 
-// 使用本地tesseract.js-core进行OCR识别
-async function parseWithLocalTesseract(imagePath) {
+// 简单的内存任务队列 (有界队列防止内存溢出)
+const MAX_QUEUE_SIZE = 100;
+const taskQueue = [];
+const processingTasks = new Set();
+const completedTasks = new Map(); // taskId -> result
+const TASK_TIMEOUT = 5 * 60 * 1000; // 5分钟超时
+
+// OCR处理函数
+async function processOCR(task) {
+  const { taskId, imagePath } = task;
+
   try {
-    // 使用本地core文件
-    const corePath = path.join(__dirname, '../node_modules/tesseract.js-core');
-    
-    const { data } = await Tesseract.recognize(imagePath, 'chi_sim+eng', {
-      corePath: corePath,
-      logger: m => console.log('OCR:', m.status, m.progress)
-    });
-    
-    return data.text;
+    logger.info(`OCR任务开始: ${taskId}`);
+    const text = await parseWithLocalTesseract(imagePath);
+    const result = parseTicketText(text);
+
+    completedTasks.set(taskId, { success: true, data: result });
+    // 5分钟后清理已完成的任务 (只设置一次)
+    setTimeout(() => {
+      completedTasks.delete(taskId);
+      logger.debug(`OCR任务已清理: ${taskId}`);
+    }, 5 * 60 * 1000);
+    logger.info(`OCR任务完成: ${taskId}`);
   } catch (err) {
-    console.error('tesseract.js识别失败:', err.message);
-    throw err;
+    logger.error(`OCR任务失败: ${taskId}`, { error: err.message });
+    completedTasks.set(taskId, { success: false, error: err.message });
+    setTimeout(() => {
+      completedTasks.delete(taskId);
+    }, 5 * 60 * 1000);
+  } finally {
+    processingTasks.delete(taskId);
+    processNextTask();
   }
 }
 
-// 解析彩票图片
-async function parseTicketImage(imagePath) {
-  let text = '';
-  
-  try {
-    text = await parseWithLocalTesseract(imagePath);
-    console.log('OCR识别完成, 文本长度:', text.length);
-  } catch (err) {
-    console.error('OCR识别失败:', err);
-    throw new Error('图片识别失败');
+// 处理下一个任务
+function processNextTask() {
+  if (processingTasks.size >= 2) return; // 最多同时处理2个
+
+  const nextTask = taskQueue.shift();
+  if (nextTask) {
+    processingTasks.add(nextTask.taskId);
+    processOCR(nextTask);
+  }
+}
+
+// 提交OCR任务 (同步返回taskId)
+function submitOCRTask(imagePath) {
+  if (taskQueue.length >= MAX_QUEUE_SIZE) {
+    throw new Error('任务队列已满，请稍后再试');
   }
 
-  // 调试：打印识别的文本
-  console.log('识别的文本:', text.substring(0, 500));
+  const taskId = `ocr_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+  taskQueue.push({ taskId, imagePath, submittedAt: Date.now() });
+  logger.info(`OCR任务已提交: ${taskId}, 队列长度: ${taskQueue.length}`);
 
-  return parseTicketText(text);
+  processNextTask();
+
+  return taskId;
+}
+
+// 查询任务状态
+function getOCRTaskStatus(taskId) {
+  if (completedTasks.has(taskId)) {
+    return { completed: true, ...completedTasks.get(taskId) };
+  }
+
+  // 检查是否超时 - O(n) scan (可接受，队列通常很小)
+  const task = taskQueue.find(t => t.taskId === taskId);
+  if (task && Date.now() - task.submittedAt > TASK_TIMEOUT) {
+    return { completed: true, success: false, error: '任务处理超时' };
+  }
+
+  if (processingTasks.has(taskId)) {
+    return { completed: false, processing: true };
+  }
+
+  return { completed: false };
+}
+
+// 使用本地tesseract.js-core进行OCR识别
+async function parseWithLocalTesseract(imagePath) {
+  const corePath = path.join(__dirname, '../node_modules/tesseract.js-core');
+
+  const { data } = await Tesseract.recognize(imagePath, 'chi_sim+eng', {
+    corePath: corePath,
+    logger: m => logger.debug(`OCR: ${m.status} ${m.progress || ''}`)
+  });
+
+  return data.text;
+}
+
+// 解析彩票图片 (改为异步提交)
+function parseTicketImage(imagePath) {
+  const taskId = submitOCRTask(imagePath);
+  return { taskId, status: 'pending' };
+}
+
+// 查询OCR结果 (轮询)
+function getOCRResult(taskId) {
+  return getOCRTaskStatus(taskId);
 }
 
 // 解析彩票文本
@@ -64,7 +130,7 @@ function parseTicketText(text) {
     raw_text: text
   };
 
-  // 识别彩票类型
+  // 识别彩票类型 (使用模块级别的 LOTTERY_PATTERNS)
   for (const [key, lottery] of Object.entries(LOTTERY_PATTERNS)) {
     if (lottery.pattern.test(text)) {
       result.type = lottery.type;
@@ -73,7 +139,7 @@ function parseTicketText(text) {
     }
   }
 
-  // 提取期号 - 优先匹配"期号:xxx"格式
+  // 提取期号
   const issueMatch = text.match(/期\s*号\s*[:：]\s*(\d{5,})/);
   if (issueMatch) {
     result.issue = issueMatch[1];
@@ -99,22 +165,20 @@ function parseTicketText(text) {
   // 检测是否追加
   result.is_additional = /追加|追加投注/.test(text);
 
-  // 提取金额 - 支持多种格式
+  // 提取金额
   const costMatch = text.match(/金额\s*[:：]\s*(\d+(?:[.,]\d+)?)\s*元|合计[：:]\s*(\d+(?:\.\d+)?)\s*元|(\d+(?:\.\d+)?)\s*元/);
   if (costMatch) {
     const costStr = (costMatch[1] || costMatch[2] || costMatch[3]).replace(',', '.');
     result.cost = parseFloat(costStr);
   }
 
-  // 提取号码 - 根据不同彩票类型
+  // 提取号码
   result.numbers = extractNumbers(text, result.game);
 
-  // 根据识别到的号码数量更新注数
   if (result.numbers.length > 0) {
     result.bet_count = result.numbers.length;
   }
 
-  // 如果没有识别到金额，根据注数和倍数计算
   if (!result.cost && result.game && result.numbers.length > 0) {
     const lottery = Object.values(LOTTERY_PATTERNS).find(l => l.name === result.game);
     if (lottery) {
@@ -131,32 +195,27 @@ function parseTicketText(text) {
 function extractNumbers(text, game) {
   const numbers = [];
 
-  // 预处理文本：修复常见OCR错误
   let cleanText = text
-    .replace(/[oO]/g, '0')  // o和O经常被误识别为0
-    .replace(/[D]/g, '0')   // D经常被误识别
-    .replace(/[lI|]/g, '1') // l和I和|经常被误识别为1
-    .replace(/[S\$§]/g, '5') // S和$和§经常被误识别为5
-    .replace(/[@®»«]/g, '')  // 去掉这些特殊字符
-    .replace(/[:：]/g, ' ')  // 冒号替换为空格
-    .replace(/[g]/g, '9');   // g经常被误识别为9
+    .replace(/[oO]/g, '0')
+    .replace(/[D]/g, '0')
+    .replace(/[lI|]/g, '1')
+    .replace(/[S$§]/g, '5')
+    .replace(/[@®»«]/g, '')
+    .replace(/[:：]/g, ' ')
+    .replace(/[g]/g, '9');
 
-  // 处理连在一起的数字：将6位以上连续数字按每2位分割
   cleanText = cleanText.replace(/\b(\d{6,})\b/g, (match) => {
     return match.match(/.{1,2}/g).join(' ');
   });
-  // 处理4位连续数字
   cleanText = cleanText.replace(/\b(\d{4})\b/g, (match) => {
     return match.slice(0, 2) + ' ' + match.slice(2);
   });
 
-  // 移除开奖号码行（包含"开奖号码"的行）
   cleanText = cleanText.split('\n')
     .filter(line => !line.includes('开奖') && !line.includes('号码'))
     .join('\n');
 
   if (game === '双色球') {
-    // 双色球: 6红+1蓝，支持多种格式
     const patterns = [
       /(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})[-+](\d{2})/g,
       /(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s*[+|]\s*(\d{2})/g,
@@ -173,12 +232,9 @@ function extractNumbers(text, game) {
       if (numbers.length > 0) break;
     }
   } else if (game === '大乐透') {
-    // 大乐透: 5前区+2后区
     const patterns = [
-      // 带空格的标准格式
       /(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})[-+](\d{2})\s+(\d{2})/g,
       /(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s+(\d{2})\s*[+|]\s*(\d{2})\s+(\d{2})/g,
-      // 连在一起无空格的格式（第一注可能这样）
       /(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})[-+](\d{2})(\d{2})/g,
       /(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})[+|](\d{2})(\d{2})/g,
     ];
@@ -194,7 +250,6 @@ function extractNumbers(text, game) {
       if (numbers.length > 0) break;
     }
   } else if (game === '福彩3D' || game === '排列3') {
-    // 3位数
     const matches = cleanText.matchAll(/[^\d](\d)\s*(\d)\s*(\d)[^\d]/g);
     for (const match of matches) {
       numbers.push([match[1], match[2], match[3]]);
@@ -204,4 +259,4 @@ function extractNumbers(text, game) {
   return numbers;
 }
 
-module.exports = { parseTicketImage, parseTicketText };
+module.exports = { parseTicketImage, parseTicketText, getOCRResult };