jpsclient 0.2.0

data/lib/jpsclient/auth/auth.rb

@@ -0,0 +1,676 @@
+#!/usr/bin/env ruby
+
+require 'webrick'
+require 'json'
+require 'net/http'
+require 'uri'
+require 'securerandom'
+require 'digest'
+require 'base64'
+require 'fileutils'
+require 'jpsclient/utils/aes'
+require 'jpsclient/base/exception'
+require 'jpsclient/utils/logger'
+
+module JPSClient
+
+  # JPS 登录配置类
+  class LoginConfig
+    attr_accessor :client_id, :feishu_auth_url, :redirect_uri, :api_endpoint, :state, :server_port
+    attr_accessor :aes_key, :token_verify_endpoint
+
+    def initialize
+      # 所有配置必须从外部配置文件加载，不提供硬编码的默认值
+      @client_id = nil
+      @feishu_auth_url = nil
+      @redirect_uri = nil
+      @api_endpoint = nil
+      @state = 'client_login'  # 仅此项可有默认值
+      @server_port = 8898  # 仅此项可有默认值
+      @aes_key = nil  # AES 加密密钥，必需配置
+      @token_verify_endpoint = nil  # Token 验证端点，必需配置
+    end
+
+    # 从 JSON 加载配置
+    def self.from_json(json_data)
+      config = new
+      return config if json_data.nil?
+
+      data = json_data.is_a?(String) ? JSON.parse(json_data) : json_data
+
+      # 加载所有配置字段
+      config.client_id = data['client_id'] if data['client_id']
+      config.feishu_auth_url = data['feishu_auth_url'] if data['feishu_auth_url']
+      config.redirect_uri = data['redirect_uri'] if data['redirect_uri']
+      config.api_endpoint = data['api_endpoint'] if data['api_endpoint']
+      config.state = data['state'] if data['state']
+      config.server_port = data['server_port'] if data['server_port']
+      config.token_verify_endpoint = data['token_verify_endpoint'] if data['token_verify_endpoint']
+      config.aes_key = data['aes_key'] if data['aes_key']
+
+      config
+    end
+
+    # 从配置文件加载
+    def self.from_file(file_path)
+      return new unless File.exist?(file_path)
+      from_json(File.read(file_path))
+    end
+  end
+
+  class Auth
+    attr_reader :access_token, :username, :expires_at
+
+    def initialize(config = nil)
+      # 只接受 LoginConfig 对象或默认配置
+      @config = config || LoginConfig.new
+
+      # 从配置对象获取值
+      @client_id = @config.client_id
+      @feishu_auth_url = @config.feishu_auth_url
+      @redirect_uri = @config.redirect_uri
+      @api_endpoint = @config.api_endpoint
+      @state = @config.state
+      @server_port = @config.server_port
+
+      @scope_list = [
+        'task:task:write',
+        'task:section:write',
+        'task:custom_field:write',
+        'task:tasklist:write'
+      ]
+
+      @access_token = nil
+      @username = nil
+      @expires_at = nil
+
+      # 调试模式，通过环境变量控制
+      @verbose = ENV['PINDO_DEBUG'] == 'true'
+    end
+
+    # 主登录入口
+    def login
+      puts "🔐 需要登录 JPS..."
+      result = authorize_and_login
+
+      # 如果用户主动取消，返回特殊标识
+      return :user_cancelled if result == :user_cancelled
+
+      return result
+    end
+
+    # 启动授权流程（保留兼容性）
+    def authorize
+      login
+    end
+
+    # 获取用户名（登录后可用）
+    def get_username
+      @username
+    end
+
+    # 获取 token 数据（供 Client 使用）
+    def get_token_data
+      return nil unless @access_token
+
+      {
+        'token' => @access_token,
+        'username' => @username,
+        'expires_at' => @expires_at
+      }
+    end
+
+    # 完整的授权和登录流程
+    def authorize_and_login
+      # 构建授权 URL
+      authorization_uri = build_authorization_uri
+      puts "正在打开浏览器进行飞书 OAuth 授权..."
+      puts "\n授权 URL（如自动打开失败，请手动复制下面的链接到浏览器）:"
+      puts "=" * 80
+      puts authorization_uri
+      puts "=" * 80
+      puts ""
+
+      # 在浏览器中打开授权 URL
+      open_browser(authorization_uri)
+
+      # 启动本地服务器处理回调
+      code = start_callback_server
+
+      # 如果自动获取失败，提示用户手动输入
+      if code.nil?
+        loop do
+          puts "\n自动获取授权码失败，请选择："
+          puts "1. 输入授权码 (直接复制 'code=' 后面的内容)"
+          puts "2. 输入完整回调 URL"
+          puts "3. 重新打开授权网页"
+          puts "4. 退出"
+          print "> "
+
+          begin
+            choice = STDIN.gets&.chomp
+
+            # 处理 Ctrl+C 中断
+            if choice.nil?
+              puts "\n用户中断操作"
+              return :user_cancelled
+            end
+
+            case choice
+            when "1"
+              puts "请输入授权码："
+              print "> "
+              code_input = STDIN.gets&.chomp
+              if code_input.nil?
+                puts "用户中断操作"
+                return :user_cancelled
+              elsif !code_input.empty?
+                code = code_input
+                break
+              else
+                puts "授权码不能为空，请重新选择"
+              end
+            when "2"
+              puts "请输入完整回调 URL："
+              print "> "
+              url_input = STDIN.gets&.chomp
+              if url_input.nil?
+                puts "用户中断操作"
+                return :user_cancelled
+              elsif url_input.start_with?("http")
+                # 尝试从 URL 中提取 code
+                begin
+                  uri = URI(url_input)
+                  query_params = URI.decode_www_form(uri.query || '').to_h
+                  code = query_params['code']
+                  if code
+                    puts "✓ 从 URL 中成功提取授权码"
+                    break
+                  else
+                    puts "✗ URL 中没有找到授权码，请重新选择"
+                  end
+                rescue => e
+                  puts "✗ 无法从 URL 中提取授权码: #{e.message}"
+                end
+              else
+                puts "✗ 无效的 URL 格式，请重新选择"
+              end
+            when "3"
+              # 重新打开授权网页
+              puts "正在重新打开授权网页..."
+              open_browser(authorization_uri)
+              # 重新启动服务器尝试获取授权码
+              code = start_callback_server
+              if code
+                break
+              end
+              # 如果还是失败，继续循环让用户选择
+            when "4"
+              puts "已退出授权流程"
+              return :user_cancelled
+            else
+              puts "无效的选择，请输入 1-4 之间的数字"
+            end
+          rescue Interrupt
+            puts "\n\n用户中断操作"
+            return :user_cancelled
+          end
+        end
+      end
+
+      if code
+        if exchange_code_for_token(code)
+          puts "✓ JPS 登录成功！用户名: #{@username}"
+          return true
+        end
+        return false
+      else
+        puts "✗ 授权失败"
+        return false
+      end
+    end
+
+    # 检查 token 是否有效
+    def validate_token(token = nil)
+      token_to_check = token || @access_token
+      return false unless token_to_check
+
+      # 检查过期时间
+      if @expires_at && Time.now.to_i > @expires_at
+        puts "Token 已过期，需要重新登录"
+        return false
+      end
+
+      # 简单验证（实际项目中可以调用 API 验证）
+      return true
+    end
+
+    # 验证Pgyer令牌（保留兼容性）
+    def validate_pgyer_token(token = nil, expires_at = nil)
+      validate_token(token)
+    end
+
+    # 使用授权码换取 token
+    def exchange_code_for_token(code)
+      begin
+        request_data = {
+          'code' => code,
+          'redirectUri' => @redirect_uri,
+          'scope' => @scope_list.join(' ')
+        }
+
+        uri = URI(@api_endpoint)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = (uri.scheme == 'https')
+
+        request = Net::HTTP::Post.new(uri)
+        request['Content-Type'] = 'application/json'
+        request.body = request_data.to_json
+
+        puts "正在请求 JPS API: #{@api_endpoint}" if @verbose
+        response = http.request(request)
+
+        puts "API 响应状态码: #{response.code}" if @verbose
+
+        if response.body
+          result = JSON.parse(response.body)
+          puts "API 响应: #{result.inspect}" if @verbose
+
+          if result['meta'] && result['meta']['code'] == 200 && result['data']
+            data = result['data']
+            @access_token = data['token'] if data['token']
+            @username = data['username'] if data['username']
+            # 设置过期时间为 6 天后
+            @expires_at = Time.now.to_i + 6 * 24 * 60 * 60
+
+            return true if @access_token
+          else
+            error_msg = result['meta'] && result['meta']['message'] ? result['meta']['message'] : '未知错误'
+            puts "JPS 登录失败: #{error_msg}"
+          end
+        else
+          puts "API 返回空响应" if @verbose
+        end
+
+        return false
+      rescue => e
+        puts "请求 JPS API 失败: #{e.class} - #{e.message}"
+        return false
+      end
+    end
+
+
+    private
+
+    # 获取跨平台的 null 设备路径
+    def get_null_device
+      case RbConfig::CONFIG['host_os']
+      when /mswin|mingw|cygwin/
+        'NUL'
+      else
+        '/dev/null'
+      end
+    end
+
+
+    # 构建授权URI
+    def build_authorization_uri
+      uri = URI(@feishu_auth_url)
+
+      params = {
+        'client_id' => @client_id,
+        'redirect_uri' => @redirect_uri,
+        'response_type' => 'code',
+        'state' => @state,
+        'scope' => @scope_list.join(' ')
+      }
+
+      uri.query = URI.encode_www_form(params)
+      uri.to_s
+    end
+
+    # 在浏览器中打开URL
+    def open_browser(url)
+      case RbConfig::CONFIG['host_os']
+      when /mswin|mingw|cygwin/
+        # Windows: 使用双引号包围URL避免参数解析问题
+        system("start \"\" \"#{url}\"")
+      when /darwin/
+        system("open", url)
+      when /linux|bsd/
+        system("xdg-open", url)
+      else
+        puts "无法自动打开浏览器，请手动访问: #{url}"
+      end
+    end
+
+    # 启动本地服务器处理回调
+    def start_callback_server
+      code = nil
+
+      # 检查并处理端口占用
+      unless ensure_port_available(@server_port)
+        puts "✗ 无法使用端口 #{@server_port}，登录失败"
+        return nil
+      end
+
+      puts "启动本地服务器，监听端口 #{@server_port}..."
+      puts "提示：按 Ctrl+C 可以中断并获得更多选择"
+      puts "🔄 正在使用飞书身份登录 JPS..."
+
+      begin
+        server = WEBrick::HTTPServer.new(
+          Port: @server_port,
+          BindAddress: '127.0.0.1',
+          Logger: WEBrick::Log.new(get_null_device),
+          AccessLog: []
+        )
+      rescue Errno::EADDRINUSE
+        puts "✗ 端口 #{@server_port} 仍被占用，无法启动服务器"
+        return nil
+      rescue Errno::ENOENT
+        puts "✗ 启动服务器失败: 系统找不到指定的路径或文件"
+        return nil
+      rescue => e
+        puts "✗ 启动服务器失败: #{e.message}"
+        if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
+          puts "  提示: 如果是Windows系统，请确保防火墙允许Ruby访问网络"
+        end
+        return nil
+      end
+
+      # 处理根路径的请求
+      server.mount_proc '/' do |req, res|
+        begin
+          # 解析请求参数
+          query_params = URI.decode_www_form(req.query_string || '').to_h
+          puts "接收到回调请求，参数: #{query_params.inspect}" if @verbose
+
+          if query_params['error']
+            puts "授权错误: #{query_params['error']}" if @verbose
+            res.content_type = "text/html; charset=UTF-8"
+            res.body = build_error_page(query_params['error'])
+          elsif query_params['code']
+            code = query_params['code']
+            # 静默处理，避免重复输出
+            res.content_type = "text/html; charset=UTF-8"
+            res.body = build_success_page
+          else
+            # 忽略没有参数的请求（如 favicon.ico 等）
+            res.content_type = "text/html; charset=UTF-8"
+            res.body = "等待授权中..."
+          end
+
+          # 4秒后关闭服务器
+          Thread.new do
+            sleep 4
+            server.shutdown
+          end
+        rescue => e
+          puts "处理请求时出错: #{e.class} - #{e.message}" if @verbose
+          res.content_type = "text/html; charset=UTF-8"
+          res.body = build_error_page("处理请求时出错")
+
+          Thread.new do
+            sleep 4
+            server.shutdown
+          end
+        end
+      end
+
+      # 捕获 Ctrl+C
+      trap('INT') { server.shutdown }
+
+      # 在线程中运行服务器，最多等待 3 分钟
+      thread = Thread.new { server.start }
+      begin
+        thread.join(180) # 最多等待 3 分钟
+      rescue => e
+        puts "服务器等待超时"
+        server.shutdown
+      end
+
+      code
+    end
+
+    # 确保端口可用，处理端口占用问题
+    def ensure_port_available(port)
+      return true unless port_occupied?(port)
+
+      puts "⚠️  端口 #{port} 被占用，正在检查占用进程..."
+
+      # 获取占用端口的进程信息
+      process_info = get_port_process_info(port)
+
+      if process_info.nil?
+        puts "✗ 无法获取端口占用信息"
+        return false
+      end
+
+      puts "占用进程信息："
+      puts "  PID: #{process_info[:pid]}"
+      puts "  进程名: #{process_info[:name]}"
+      puts "  命令: #{process_info[:command]}"
+
+      # 检查是否是自己的进程（可能是之前未正常关闭的实例）
+      if process_info[:name].include?('ruby') && (process_info[:command].include?('pindo') || process_info[:command].include?('jps'))
+        puts "检测到可能是 Pindo/JPS 之前的遗留进程"
+        if ask_user_kill_process?
+          return kill_process_by_pid(process_info[:pid])
+        end
+      else
+        puts "端口被其他应用程序占用"
+        if ask_user_kill_process?
+          return kill_process_by_pid(process_info[:pid])
+        end
+      end
+
+      return false
+    end
+
+    # 检查端口是否被占用
+    def port_occupied?(port)
+      require 'socket'
+
+      begin
+        server = TCPServer.new('127.0.0.1', port)
+        server.close
+        false  # 端口未被占用
+      rescue Errno::EADDRINUSE
+        true   # 端口被占用
+      rescue => e
+        puts "⚠️  检查端口时出错: #{e.message}"
+        true   # 出错时假设端口被占用，避免冲突
+      end
+    end
+
+    # 获取占用指定端口的进程信息
+    def get_port_process_info(port)
+      begin
+        # macOS/Linux 使用 lsof 命令
+        if system('which lsof > /dev/null 2>&1')
+          output = `lsof -ti :#{port} 2>/dev/null`.strip
+          return nil if output.empty?
+
+          pid = output.split("\n").first
+          return nil if pid.nil? || pid.empty?
+
+          # 获取进程详细信息
+          ps_output = `ps -p #{pid} -o pid,comm,args 2>/dev/null`.lines
+          return nil if ps_output.length < 2
+
+          process_line = ps_output[1].strip
+          parts = process_line.split(/\s+/, 3)
+
+          return {
+            pid: parts[0],
+            name: parts[1] || 'unknown',
+            command: parts[2] || 'unknown'
+          }
+        end
+
+        # Windows 使用 netstat 命令
+        if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
+          output = `netstat -ano | findstr :#{port}`.strip
+          return nil if output.empty?
+
+          lines = output.split("\n")
+          listening_line = lines.find { |line| line.include?('LISTENING') }
+          return nil unless listening_line
+
+          pid = listening_line.split.last
+          return nil if pid.nil? || pid.empty?
+
+          # 获取进程名称
+          task_output = `tasklist /FI "PID eq #{pid}" /FO CSV /NH 2>nul`.strip
+          if !task_output.empty?
+            process_name = task_output.split(',').first.gsub('"', '')
+            return {
+              pid: pid,
+              name: process_name,
+              command: process_name
+            }
+          end
+        end
+
+        return nil
+      rescue => e
+        puts "获取进程信息时出错: #{e.message}"
+        return nil
+      end
+    end
+
+    # 询问用户是否终止占用端口的进程
+    def ask_user_kill_process?
+      puts "\n是否终止占用端口的进程？"
+      puts "  y/yes - 终止进程并继续 (可能影响其他应用)"
+      puts "  n/no  - 取消登录 (默认)"
+      print "> "
+
+      begin
+        response = STDIN.gets&.chomp&.downcase
+        return ['y', 'yes'].include?(response)
+      rescue Interrupt
+        puts "\n\n用户中断操作"
+        return false
+      rescue => e
+        puts "无法读取用户输入: #{e.message}"
+        return false
+      end
+    end
+
+    # 根据 PID 终止进程
+    def kill_process_by_pid(pid)
+      return false if pid.nil? || pid.empty?
+
+      begin
+        puts "正在终止进程 #{pid}..."
+
+        # 跨平台的进程终止命令
+        if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
+          # Windows
+          success = system("taskkill /PID #{pid} /F >nul 2>&1")
+        else
+          # macOS/Linux - 先尝试优雅终止，再强制终止
+          success = system("kill -TERM #{pid} 2>/dev/null")
+          sleep(2)
+          # 检查进程是否还存在
+          if system("kill -0 #{pid} 2>/dev/null")
+            puts "优雅终止失败，使用强制终止..."
+            success = system("kill -KILL #{pid} 2>/dev/null")
+          end
+        end
+
+        if success
+          puts "✓ 进程 #{pid} 已终止"
+          sleep(1) # 等待端口释放
+
+          # 再次检查端口是否可用
+          unless port_occupied?(@server_port)
+            puts "✓ 端口 #{@server_port} 现在可用"
+            return true
+          else
+            puts "⚠️  端口仍被占用，可能需要等待更长时间"
+            return false
+          end
+        else
+          puts "✗ 终止进程失败，可能需要管理员权限"
+          return false
+        end
+      rescue => e
+        puts "终止进程时出错: #{e.message}"
+        return false
+      end
+    end
+
+    # 构建成功页面
+    def build_success_page
+      <<~HTML
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="UTF-8">
+        <title>JPS 授权成功</title>
+        <style>
+          body { font-family: Arial, sans-serif; text-align: center; padding: 40px; background-color: #f5f5f5; }
+          .container { max-width: 600px; margin: 0 auto; background: white; padding: 40px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
+          .success { color: #4CAF50; margin-bottom: 20px; }
+          .countdown { font-weight: bold; color: #FF5722; }
+          .close-btn { background: #4CAF50; color: white; border: none; padding: 10px 20px; cursor: pointer; border-radius: 4px; font-size: 16px; }
+        </style>
+        <script>
+          var secondsLeft = 3;
+          function updateCountdown() {
+            document.getElementById('countdown').innerText = secondsLeft;
+            if (secondsLeft <= 0) {
+              window.close();
+            } else {
+              secondsLeft -= 1;
+              setTimeout(updateCountdown, 1000);
+            }
+          }
+          window.onload = function() { updateCountdown(); }
+        </script>
+      </head>
+      <body>
+        <div class="container">
+          <h1 class="success">✓ JPS 授权成功！</h1>
+          <p>已获取授权码，正在返回命令行...</p>
+          <p>此窗口将在 <span id="countdown" class="countdown">3</span> 秒后自动关闭</p>
+          <button class="close-btn" onclick="window.close()">立即关闭</button>
+        </div>
+      </body>
+      </html>
+      HTML
+    end
+
+    # 构建错误页面
+    def build_error_page(error_msg)
+      <<~HTML
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="UTF-8">
+        <title>JPS 授权失败</title>
+        <style>
+          body { font-family: Arial, sans-serif; text-align: center; padding: 40px; background-color: #f5f5f5; }
+          .container { max-width: 600px; margin: 0 auto; background: white; padding: 40px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
+          .error { color: #f44336; margin-bottom: 20px; }
+          .close-btn { background: #f44336; color: white; border: none; padding: 10px 20px; cursor: pointer; border-radius: 4px; font-size: 16px; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1 class="error">✗ JPS 授权失败</h1>
+          <p>错误信息: #{error_msg}</p>
+          <p>请返回命令行重试</p>
+          <button class="close-btn" onclick="window.close()">关闭窗口</button>
+        </div>
+      </body>
+      </html>
+      HTML
+    end
+
+  end
+
+end