内容审核指南

curl -sS -X POST "http://127.0.0.1:8080/api/admin/apps/demo/sensitive-words" \
  -H 'X-Admin-Secret: dev-admin' \
  -H 'content-type: application/json' \
  -d '{"words":["审核演示"],"action":"replace"}'

# 通过控制台调试器/客户端发送「这是审核演示消息」后：
curl -sS -X GET "http://127.0.0.1:8080/api/admin/apps/demo/moderation/tasks?status=pending&limit=20" \
  -H 'X-Admin-Secret: dev-admin'

curl -sS -X POST "http://127.0.0.1:8080/api/admin/apps/demo/moderation/tasks/mt_1001/decide" \
  -H 'X-Admin-Secret: dev-admin' \
  -H 'content-type: application/json' \
  -d '{"decision":"reject","reason":"违反社区规范"}'

# 查看审核结果回调是否投递成功
curl -sS -X GET "http://127.0.0.1:8080/api/admin/apps/demo/callbacks/deliveries?eventType=message.audit_result&limit=20" \
  -H 'X-Admin-Secret: dev-admin'

# 失败可重试（用 items[].deliveryId）
curl -sS -X POST "http://127.0.0.1:8080/api/admin/apps/demo/callbacks/deliveries/dlv_3001/retry" \
  -H 'X-Admin-Secret: dev-admin'

import crypto from 'node:crypto';

// 必须使用 raw body（不要用 JSON.parse 后再 stringify，字段顺序/空格会变）
export function verifyCallback(rawBody, headers, secret) {
  const timestamp = headers['x-im-timestamp'];
  const nonce = headers['x-im-nonce'];
  const signature = headers['x-im-signature'];
  if (!timestamp || !nonce || !signature) return false;

  // 时间窗 5 分钟，防重放
  if (Math.abs(Date.now() - Number(timestamp)) > 5 * 60 * 1000) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(String(timestamp) + '.' + String(nonce) + '.' + rawBody)
    .digest('hex');

  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(signature, 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// 幂等：同一 eventId 只处理一次
export async function handle(rawBody, headers, secret, seen) {
  if (!verifyCallback(rawBody, headers, secret)) return 401;
  const event = JSON.parse(rawBody);
  if (event.eventType !== 'message.audit_result') return 200;
  if (seen.has(event.eventId)) return 200;
  seen.add(event.eventId);
  // event.data: { messageId, decision, reason, taskId, ... }
  return 200;
}

{
  "eventType": "message.audit_result",
  "eventId": "evt_9f2c1a",
  "appkey": "demo",
  "timestamp": 1750000000000,
  "nonce": "6b1d0f3a",
  "data": {
    "messageId": "m_1001",
    "conversationType": 1,
    "targetId": "bob",
    "senderId": "alice",
    "decision": "reject",
    "reason": "违反社区规范",
    "operator": "admin",
    "taskId": "mt_1001",
    "timestamp": 1750000000000
  }
}