小程序第三方 SDK 集成与治理

{
  "requestDomain": ["https://api.example.com", "https://sdk.vendor.com"],
  "uploadFileDomain": ["https://upload.example.com"],
  "downloadFileDomain": ["https://cdn.example.com"],
  "socketDomain": ["wss://push.example.com"]
}

{
  "requiredPrivateInfos": [
    "getLocation",
    "chooseLocation",
    "chooseAddress"
  ]
}

npm install --save vendor-analytics-sdk
# 开发者工具 → 工具 → 构建 npm

{
  "plugins": {
    "myPlugin": {
      "version": "1.3.0",
      "provider": "wxidxxxxxxxxxxxxxx"
    }
  }
}

<plugin-view plugin="myPlugin" />

const plugin = requirePlugin('myPlugin')
plugin.init({ appId: 'your-appid' })

# 构建基线（不装 SDK）
npm run build:weapp && du -sk dist/ > baseline.txt

# 安装 SDK 后再构建
npm install vendor-sdk
npm run build:weapp && du -sk dist/ > with-sdk.txt

# 对比
diff baseline.txt with-sdk.txt

// services/analytics/index.js —— 统一门面
const drivers = {
  vendor: require('./vendor-driver'),
  noop: require('./noop-driver')
}

let driver = drivers.noop
let ready = false

export function initAnalytics(config) {
  try {
    driver = drivers.vendor
    driver.init(config)
    ready = true
  } catch (e) {
    // 初始化失败自动降级到 noop，业务不受影响
    console.error('[analytics] init failed, fallback to noop', e)
    driver = drivers.noop
    ready = false
  }
}

export function track(event, props = {}) {
  // 统一清洗：去掉 undefined、超长字段、敏感字段
  const payload = sanitize(props)
  try {
    driver.track(event, payload)
  } catch (e) {
    // 埋点失败绝不能影响业务
    console.error('[analytics] track failed', event, e)
  }
}

// services/analytics/noop-driver.js —— 兜底实现
export function init() {}
export function track() {}
export function flush() {}

// services/analytics/vendor-driver.js —— 唯一 import 第三方 SDK 的文件
import VendorSDK from 'vendor-analytics-sdk'

export function init(config) {
  VendorSDK.setup({ appKey: config.key, autoTrack: false })
}

export function track(event, props) {
  VendorSDK.log(event, props)
}

export function flush() {
  VendorSDK.flush()
}

// 统一接口，所有 driver 必须实现
export interface AnalyticsDriver {
  init(config: object): void
  track(event: string, props: object): void
  flush(): Promise<void>
}

{
  "dependencies": {
    "vendor-analytics-sdk": "3.2.1"
  }
}

// app.js
onLaunch() {
  // 首屏渲染完成后再初始化非关键 SDK
  wx.nextTick(() => {
    initAnalytics({ key: 'xxx' })
    initPushSDK()
  })
}

class CircuitBreaker {
  constructor(threshold = 5, cooldown = 60000) {
    this.failures = 0; this.threshold = threshold
    this.cooldown = cooldown; this.openedAt = 0
  }
  get isOpen() {
    if (this.failures < this.threshold) return false
    if (Date.now() - this.openedAt > this.cooldown) {
      this.failures = 0   // 冷却期结束，半开允许重试
      return false
    }
    return true
  }
  recordFailure() {
    this.failures++
    if (this.failures >= this.threshold) this.openedAt = Date.now()
  }
}

try {
  driver.track(event, payload)
} catch (e) {
  wx.reportMonitor('sdk_analytics_track_fail', 1)
  wx.reportEvent('sdk_error', {
    sdk: 'analytics',
    version: '3.2.1',
    message: String(e && e.message).slice(0, 200)
  })
}

const SENSITIVE_KEYS = ['phone', 'idCard', 'password', 'token', 'address']

function sanitize(props) {
  const out = {}
  for (const [k, v] of Object.entries(props)) {
    if (SENSITIVE_KEYS.some(s => k.toLowerCase().includes(s))) continue
    if (v === undefined || v === null) continue
    out[k] = typeof v === 'string' ? v.slice(0, 200) : v
  }
  return out
}

// scripts/sdk-audit.js
const pkg = require('./package.json')
const manifest = require('./sdk-manifest.json')  // 人工维护的 SDK 元数据
const REQUIRED_FIELDS = ['vendor', 'version', 'purpose', 'dataCollected', 'domains']

let failed = false
for (const [name, meta] of Object.entries(manifest)) {
  for (const field of REQUIRED_FIELDS) {
    if (!meta[field]) { console.error(`[sdk-audit] ${name} 缺少字段: ${field}`); failed = true }
  }
  const installed = pkg.dependencies[name]
  if (installed && installed !== meta.version) {
    console.error(`[sdk-audit] ${name} 版本不一致: package.json=${installed}`)
    failed = true
  }
}
process.exit(failed ? 1 : 0)