jpsclient 2.4.1 → 2.7.0

data/lib/jpsclient/auth/auth.rb

@@ -1,37 +1,41 @@
 #!/usr/bin/env ruby
 
-require 'webrick'
 require 'json'
 require 'net/http'
 require 'net/https'
 require 'uri'
+require 'cgi'
 require 'securerandom'
-require 'digest'
-require 'base64'
-require 'fileutils'
-require 'jpsclient/utils/aes'
 require 'jpsclient/base/exception'
+require 'jpsclient/utils/debug'
 require 'jpsclient/utils/logger'
+require 'jpsclient/auth/endpoints'
+require 'jpsclient/version'
 
 module JPSClient
 
   # JPS 登录配置类
+  #
+  # 迁移到 BFF 中心化 OIDC 后，多数字段（client_id / feishu_auth_url / server_port / scope）已不
+  # 再使用，仅保留以兼容旧配置文件。当前实际使用：
+  #   - api_endpoint  → 推导 API 域（authorize / oidc token / logout）
+  #   - redirect_uri  → 推导 WEB 域（Origin / Referer / redirectUri）
+  #   - aes_key       → 凭证加解密
   class LoginConfig
     attr_accessor :client_id, :feishu_auth_url, :redirect_uri, :api_endpoint, :state, :server_port
     attr_accessor :aes_key
     attr_accessor :token_dir, :token_file_name
 
     def initialize
-      # 所有配置必须从外部配置文件加载，不提供硬编码的默认值
       @client_id = nil
       @feishu_auth_url = nil
       @redirect_uri = nil
       @api_endpoint = nil
-      @state = 'client_login'  # 仅此项可有默认值
-      @server_port = 8898  # 仅此项可有默认值
-      @aes_key = nil  # AES 加密密钥，必需配置
-      @token_dir = nil  # Token 存储目录，可选配置
-      @token_file_name = nil  # Token 文件名，可选配置
+      @state = 'oidc_login'
+      @server_port = nil
+      @aes_key = nil
+      @token_dir = nil
+      @token_file_name = nil
     end
 
     # 从 JSON 加载配置
@@ -41,7 +45,6 @@ module JPSClient
 
       data = json_data.is_a?(String) ? JSON.parse(json_data) : json_data
 
-      # 加载所有配置字段
       config.client_id = data['client_id'] if data['client_id']
       config.feishu_auth_url = data['feishu_auth_url'] if data['feishu_auth_url']
       config.redirect_uri = data['redirect_uri'] if data['redirect_uri']
@@ -49,8 +52,8 @@ module JPSClient
       config.state = data['state'] if data['state']
       config.server_port = data['server_port'] if data['server_port']
       config.aes_key = data['aes_key'] if data['aes_key']
-      config.token_dir = data['token_dir'] if data['token_dir']  # 加载 token 目录配置
-      config.token_file_name = data['token_file_name'] if data['token_file_name']  # 加载 token 文件名配置
+      config.token_dir = data['token_dir'] if data['token_dir']
+      config.token_file_name = data['token_file_name'] if data['token_file_name']
 
       config
     end
@@ -62,43 +65,30 @@ module JPSClient
     end
   end
 
+  # JPS 中心化登录（BFF OIDC）。
+  #
+  # 流程（见 OIDC 接入文档 §5.2/§5.3）：自生成一次性 code → 拉起系统浏览器打开 authorize →
+  # 浏览器侧完成飞书 SSO 并按 code 绑定登录态 → 客户端凭同一 code 轮询 /api/oidc/token 取回登录态。
+  # 拿到的 token 即会话凭证（业务请求作 SESSION Cookie 携带）。
   class Auth
     attr_reader :access_token, :username
     attr_reader :user_id, :permissions, :lark_user_id, :tenant_manager
+    attr_reader :avatar, :token_expire_timestamp
+
+    LOGIN_ENTRY_PATH = '/auth/jwt/login'.freeze
+    OIDC_TOKEN_PATH  = '/api/oidc/token'.freeze
+    OIDC_STATE       = 'oidc_login'.freeze
+
+    # 轮询：覆盖用户在浏览器里扫码 + 飞书 SSO 的耗时，取宽松值
+    POLL_INTERVAL = 2.0
+    POLL_TIMEOUT  = 300.0
 
     def initialize(config = nil)
-      # 只接受 LoginConfig 对象或默认配置
       @config = config || LoginConfig.new
 
-      # 从配置对象获取值
-      @client_id = @config.client_id
-      @feishu_auth_url = @config.feishu_auth_url
-      @redirect_uri = @config.redirect_uri
-      @api_endpoint = @config.api_endpoint
-      @state = @config.state
-      @server_port = @config.server_port
-
-      @scope_list = [
-        'offline_access',
-        'task:task:write',
-        'task:section:write',
-        'task:custom_field:write',
-        'task:tasklist:write',
-        'drive:drive',
-        'wiki:wiki',
-        'docx:document',
-        'bitable:app',
-        'contact:user.employee_id:readonly',
-        'docs:document.content:read',
-        'im:chat',
-        'base:app:copy',
-        'base:record:update',
-        'task:comment:write',
-        'task:comment',
-        'task:attachment:write',
-        'vc:room:readonly',
-        'vc:meeting:readonly'
-      ]
+      # 从 config 推导 API / WEB 域，缺失时回退固定正式服地址
+      @api_base   = Endpoints.origin_of(@config.api_endpoint, Endpoints::DEFAULT_API_BASE)
+      @web_origin = Endpoints.origin_of(@config.redirect_uri, Endpoints::DEFAULT_WEB_ORIGIN)
 
       @access_token = nil
       @username = nil
@@ -106,595 +96,220 @@ module JPSClient
       @permissions = nil
       @lark_user_id = nil
       @tenant_manager = false
+      @avatar = nil
+      @token_expire_timestamp = 0
 
-      # 调试模式，通过环境变量控制
-      @verbose = ENV['PINDO_DEBUG'] == 'true'
+      @verbose = JPSClient.debug?
     end
 
-    # 主登录入口
+    # 主登录入口。成功返回 true，用户取消返回 :user_cancelled，失败返回 false
     def login
       puts "🔐 需要登录 JPS..."
-      result = authorize_and_login
-
-      # 如果用户主动取消，返回特殊标识
-      return :user_cancelled if result == :user_cancelled
-
-      return result
+      oidc_login
+    rescue Interrupt
+      puts "\n用户中断登录操作"
+      :user_cancelled
     end
 
-    # 启动授权流程（保留兼容性）
+    # 兼容旧接口
     def authorize
       login
     end
 
-    # 获取用户名（登录后可用）
     def get_username
       @username
     end
 
-    # 获取 token 数据（供 Client 使用）
+    # 获取 token 数据（供 Token#save 使用，内部 snake 键）
     def get_token_data
       return nil unless @access_token
 
       {
-        'token' => @access_token,
-        'username' => @username,
-        'user_id' => @user_id,
-        'permissions' => @permissions,
-        'lark_user_id' => @lark_user_id,
-        'tenant_manager' => @tenant_manager
+        'token'                  => @access_token,
+        'username'               => @username,
+        'user_id'                => @user_id,
+        'permissions'            => @permissions,
+        'lark_user_id'           => @lark_user_id,
+        'tenant_manager'         => @tenant_manager,
+        'avatar'                 => @avatar,
+        'token_expire_timestamp' => @token_expire_timestamp
       }
     end
 
-    # 完整的授权和登录流程
-    def authorize_and_login
-      # 构建授权 URL
-      authorization_uri = build_authorization_uri
-      puts "正在打开浏览器进行飞书 OAuth 授权..."
-      puts "\n授权 URL（如自动打开失败，请手动复制下面的链接到浏览器）:"
-      puts "=" * 80
-      puts authorization_uri
-      puts "=" * 80
-      puts ""
-
-      # 在浏览器中打开授权 URL
-      open_browser(authorization_uri)
-
-      # 启动本地服务器处理回调
-      code = start_callback_server
-
-      # 如果自动获取失败，提示用户手动输入
-      if code.nil?
-        loop do
-          puts "\n自动获取授权码失败，请选择："
-          puts "1. 输入授权码 (直接复制 'code=' 后面的内容)"
-          puts "2. 输入完整回调 URL"
-          puts "3. 重新打开授权网页"
-          puts "4. 退出"
-          print "> "
-
-          begin
-            choice = STDIN.gets&.chomp
-
-            # 处理 Ctrl+C 中断
-            if choice.nil?
-              puts "\n用户中断操作"
-              return :user_cancelled
-            end
-
-            case choice
-            when "1"
-              puts "请输入授权码："
-              print "> "
-              code_input = STDIN.gets&.chomp
-              if code_input.nil?
-                puts "用户中断操作"
-                return :user_cancelled
-              elsif !code_input.empty?
-                code = code_input
-                break
-              else
-                puts "授权码不能为空，请重新选择"
-              end
-            when "2"
-              puts "请输入完整回调 URL："
-              print "> "
-              url_input = STDIN.gets&.chomp
-              if url_input.nil?
-                puts "用户中断操作"
-                return :user_cancelled
-              elsif url_input.start_with?("http")
-                # 尝试从 URL 中提取 code
-                begin
-                  uri = URI(url_input)
-                  query_params = URI.decode_www_form(uri.query || '').to_h
-                  code = query_params['code']
-                  if code
-                    puts "✓ 从 URL 中成功提取授权码"
-                    break
-                  else
-                    puts "✗ URL 中没有找到授权码，请重新选择"
-                  end
-                rescue => e
-                  puts "✗ 无法从 URL 中提取授权码: #{e.message}"
-                end
-              else
-                puts "✗ 无效的 URL 格式，请重新选择"
-              end
-            when "3"
-              # 重新打开授权网页
-              puts "正在重新打开授权网页..."
-              open_browser(authorization_uri)
-              # 重新启动服务器尝试获取授权码
-              code = start_callback_server
-              if code
-                break
-              end
-              # 如果还是失败，继续循环让用户选择
-            when "4"
-              puts "已退出授权流程"
-              return :user_cancelled
-            else
-              puts "无效的选择，请输入 1-4 之间的数字"
-            end
-          rescue Interrupt
-            puts "\n\n用户中断操作"
-            return :user_cancelled
-          end
-        end
-      end
+    private
 
-      if code
-        if exchange_code_for_token(code)
-          puts "✓ JPS 登录成功！用户名: #{@username}"
-          return true
-        end
-        return false
-      else
-        puts "✗ 授权失败"
+    # OIDC 登录：自生成 code → 拉起浏览器 → 轮询取登录态
+    def oidc_login
+      # 非交互 / CI 环境无法完成浏览器飞书授权，直接快速失败提示，避免弹浏览器并空转 5 分钟
+      unless interactive?
+        puts "⚠️  检测到非交互环境（无 TTY 或 CI），无法弹出浏览器完成飞书授权。"
+        puts "    请在交互式终端登录后再运行。"
         return false
       end
-    end
-
-    # 使用授权码换取 token
-    def exchange_code_for_token(code)
-      begin
-        puts "🔄 获取授权码成功: #{code[0..10]}..."
-        puts "🔄 正在换取访问令牌..."
-
-        request_data = {
-          'code' => code,
-          'redirectUri' => @redirect_uri,
-          'scope' => @scope_list.join(' ')
-        }
-
-        uri = URI(@api_endpoint)
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = (uri.scheme == 'https')
-
-        # 配置 SSL 以兼容 OpenSSL 3.x（避免 CRL 检查失败）
-        if http.use_ssl?
-          http.verify_mode = OpenSSL::SSL::VERIFY_PEER
-          # 创建 SSL 上下文并禁用 CRL 检查
-          http.cert_store = OpenSSL::X509::Store.new
-          http.cert_store.set_default_paths
-          # verify_flags = 0 表示不检查 CRL
-          http.cert_store.flags = 0
-        end
-
-        request = Net::HTTP::Post.new(uri)
-        request['Content-Type'] = 'application/json'
-        request.body = request_data.to_json
-
-        puts "正在请求 JPS API: #{@api_endpoint}" if @verbose
-        response = http.request(request)
-
-        puts "API 响应状态码: #{response.code}" if @verbose
-
-        if response.body
-          result = JSON.parse(response.body)
-          puts "API 响应: #{result.inspect}" if @verbose
-
-          if result['meta'] && result['meta']['code'] == 0 && result['data']
-            data = result['data']
-            # 兼容 snake_case 和 camelCase 两种响应格式
-            @access_token = data['token'] if data['token']
-            @username = data['username'] if data['username']
-            @user_id = data['user_id'] || data['userId']
-            @permissions = data['permissions']
-            @lark_user_id = data['lark_user_id'] || data['larkUserId']
-            @tenant_manager = data['tenant_manager'] || data['tenantManager'] || false
-
-            return true if @access_token
-          else
-            error_msg = result['meta'] && result['meta']['message'] ? result['meta']['message'] : '未知错误'
-            puts "JPS 登录失败: #{error_msg}"
-          end
-        else
-          puts "API 返回空响应" if @verbose
-        end
 
-        return false
-      rescue => e
-        puts "请求 JPS API 失败: #{e.class} - #{e.message}"
-        return false
+      code = SecureRandom.hex(16)
+      authorize_url = build_authorize_url(code)
+
+      puts "正在打开系统浏览器完成飞书授权..."
+      opened = open_browser(authorize_url)
+      unless opened
+        # 仅在自动打开失败时才输出含一次性 code 的完整链接，避免 code 泄露进日志被竞速利用
+        puts "\n自动打开浏览器失败，请手动复制下面的链接到浏览器:"
+        puts "=" * 80
+        puts authorize_url
+        puts "=" * 80
       end
-    end
+      puts ""
 
+      puts "🔄 正在等待浏览器完成授权（请在弹出的页面用飞书扫码/授权）..."
+      data = poll_login_vo(code)
+      return false unless data
 
-    private
+      apply_login_vo(data)
+      return false if @access_token.to_s.empty?
 
-    # 获取跨平台的 null 设备路径
-    def get_null_device
-      case RbConfig::CONFIG['host_os']
-      when /mswin|mingw|cygwin/
-        'NUL'
-      else
-        '/dev/null'
-      end
+      puts "✓ JPS 登录成功！用户名: #{@username}"
+      true
     end
 
-
-    # 构建授权URI
-    def build_authorization_uri
-      uri = URI(@feishu_auth_url)
-
-      params = {
-        'client_id' => @client_id,
-        'redirect_uri' => @redirect_uri,
-        'response_type' => 'code',
-        'state' => @state,
-        'scope' => @scope_list.join(' ')
-      }
-
-      uri.query = URI.encode_www_form(params)
-      uri.to_s
+    # 交互式判定：CI 或无 TTY 视为非交互（无法完成浏览器 SSO）
+    def interactive?
+      return false if truthy_env?(ENV['CI'])
+      $stdin.tty?
+    rescue StandardError
+      false
     end
 
-    # 在浏览器中打开URL
-    def open_browser(url)
-      case RbConfig::CONFIG['host_os']
-      when /mswin|mingw|cygwin/
-        # Windows: 使用双引号包围URL避免参数解析问题
-        system("start \"\" \"#{url}\"")
-      when /darwin/
-        system("open", url)
-      when /linux|bsd/
-        system("xdg-open", url)
-      else
-        puts "无法自动打开浏览器，请手动访问: #{url}"
-      end
+    def truthy_env?(value)
+      s = value.to_s.strip.downcase
+      !s.empty? && !%w[0 false no].include?(s)
     end
 
-    # 启动本地服务器处理回调
-    def start_callback_server
-      code = nil
-
-      # 检查并处理端口占用
-      unless ensure_port_available(@server_port)
-        puts "✗ 无法使用端口 #{@server_port}，登录失败"
-        return nil
-      end
-
-      puts "启动本地服务器，监听端口 #{@server_port}..."
-      puts "提示：按 Ctrl+C 可以中断并获得更多选择"
-      puts "🔄 正在使用飞书身份登录 JPS..."
-
-      begin
-        server = WEBrick::HTTPServer.new(
-          Port: @server_port,
-          BindAddress: '127.0.0.1',
-          Logger: WEBrick::Log.new(get_null_device),
-          AccessLog: []
-        )
-      rescue Errno::EADDRINUSE
-        puts "✗ 端口 #{@server_port} 仍被占用，无法启动服务器"
-        return nil
-      rescue Errno::ENOENT
-        puts "✗ 启动服务器失败: 系统找不到指定的路径或文件"
-        return nil
-      rescue => e
-        puts "✗ 启动服务器失败: #{e.message}"
-        if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
-          puts "  提示: 如果是Windows系统，请确保防火墙允许Ruby访问网络"
-        end
-        return nil
-      end
-
-      # 处理根路径的请求
-      server.mount_proc '/' do |req, res|
-        begin
-          # 解析请求参数
-          query_params = URI.decode_www_form(req.query_string || '').to_h
-          puts "接收到回调请求，参数: #{query_params.inspect}" if @verbose
-
-          if query_params['error']
-            puts "授权错误: #{query_params['error']}" if @verbose
-            res.content_type = "text/html; charset=UTF-8"
-            res.body = build_error_page(query_params['error'])
-          elsif query_params['code']
-            code = query_params['code']
-            # 静默处理，避免重复输出
-            res.content_type = "text/html; charset=UTF-8"
-            res.body = build_success_page
-          else
-            # 忽略没有参数的请求（如 favicon.ico 等）
-            res.content_type = "text/html; charset=UTF-8"
-            res.body = "等待授权中..."
-          end
+    # authorize 入口：redirectUri 内含 code 与 state=oidc_login
+    def build_authorize_url(code)
+      redirect_uri = "#{@web_origin}#{LOGIN_ENTRY_PATH}?" +
+                     URI.encode_www_form('code' => code, 'state' => OIDC_STATE)
+      "#{@api_base}/oauth2/authorization/jps?" +
+        URI.encode_www_form('redirectUri' => redirect_uri)
+    end
 
-          # 4秒后关闭服务器
-          Thread.new do
-            sleep 4
-            server.shutdown
-          end
-        rescue => e
-          puts "处理请求时出错: #{e.class} - #{e.message}" if @verbose
-          res.content_type = "text/html; charset=UTF-8"
-          res.body = build_error_page("处理请求时出错")
-
-          Thread.new do
-            sleep 4
-            server.shutdown
+    # 连续网络硬错误达到此次数即中止轮询（区别于"服务端已应答但尚未就绪"的正常重试）
+    MAX_NET_ERRORS = 3
+
+    # 传输层硬错误（DNS / 连接拒绝 / TLS / 超时），持续出现说明连不上，应尽早失败而非空转到超时
+    NETWORK_ERRORS = [
+      SocketError, Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EHOSTUNREACH,
+      Errno::ENETUNREACH, Errno::ETIMEDOUT, Net::OpenTimeout, Net::ReadTimeout,
+      OpenSSL::SSL::SSLError
+    ].freeze
+
+    # 凭 code 轮询 /api/oidc/token 取 LoginVo；就绪判定 meta.code==0 && data.token
+    def poll_login_vo(code)
+      url = URI("#{@api_base}#{OIDC_TOKEN_PATH}?" + URI.encode_www_form('code' => code))
+      deadline = Time.now + POLL_TIMEOUT
+      last_hint = ''
+      net_errors = 0
+
+      loop do
+        data, hint, net_error = poll_once(url)
+        return data if data
+
+        if net_error
+          net_errors += 1
+          if net_errors >= MAX_NET_ERRORS
+            puts "✗ 无法连接 JPS 登录服务（#{hint}），请检查网络后重试"
+            return nil
           end
+        else
+          net_errors = 0
+          last_hint = hint unless hint.to_s.empty?
         end
-      end
 
-      # 捕获 Ctrl+C，结束后恢复默认行为
-      previous_trap = trap('INT') { server.shutdown }
-
-      # 在线程中运行服务器，最多等待 3 分钟
-      thread = Thread.new { server.start }
-      begin
-        thread.join(180) # 最多等待 3 分钟
-      rescue => e
-        puts "服务器等待超时"
-        server.shutdown
-      ensure
-        trap('INT', previous_trap || 'DEFAULT')
-      end
-
-      code
-    end
-
-    # 确保端口可用，处理端口占用问题
-    def ensure_port_available(port)
-      return true unless port_occupied?(port)
-
-      puts "⚠️  端口 #{port} 被占用，正在检查占用进程..."
-
-      # 获取占用端口的进程信息
-      process_info = get_port_process_info(port)
-
-      if process_info.nil?
-        puts "✗ 无法获取端口占用信息"
-        return false
-      end
-
-      puts "占用进程信息："
-      puts "  PID: #{process_info[:pid]}"
-      puts "  进程名: #{process_info[:name]}"
-      puts "  命令: #{process_info[:command]}"
-
-      # 检查是否是自己的进程（可能是之前未正常关闭的实例）
-      if process_info[:name].include?('ruby') && (process_info[:command].include?('pindo') || process_info[:command].include?('jps'))
-        puts "检测到可能是 Pindo/JPS 之前的遗留进程"
-        if ask_user_kill_process?
-          return kill_process_by_pid(process_info[:pid])
-        end
-      else
-        puts "端口被其他应用程序占用"
-        if ask_user_kill_process?
-          return kill_process_by_pid(process_info[:pid])
+        if Time.now >= deadline
+          puts "✗ 登录超时（#{POLL_TIMEOUT.to_i}s 内未完成授权，#{last_hint}），请重试"
+          return nil
         end
+        sleep POLL_INTERVAL
       end
-
-      return false
     end
 
-    # 检查端口是否被占用
-    def port_occupied?(port)
-      require 'socket'
-
-      begin
-        server = TCPServer.new('127.0.0.1', port)
-        server.close
-        false  # 端口未被占用
-      rescue Errno::EADDRINUSE
-        true   # 端口被占用
-      rescue => e
-        puts "⚠️  检查端口时出错: #{e.message}"
-        true   # 出错时假设端口被占用，避免冲突
+    # 单次轮询。返回 [data_hash, nil, false] / [nil, hint, false(未就绪)] / [nil, hint, true(网络错)]
+    def poll_once(url)
+      http = Net::HTTP.new(url.host, url.port)
+      http.use_ssl = (url.scheme == 'https')
+      configure_ssl(http)
+
+      req = Net::HTTP::Get.new(url)
+      req['accept'] = 'application/json, text/plain, */*'
+      req['disable-snake'] = 'true'
+      req['origin'] = @web_origin
+      req['referer'] = @web_origin + '/'
+      req['user-agent'] = "jpsclient/#{JPSClient::VERSION}"
+
+      response = http.request(req)
+      # 4xx/5xx 也可能带 envelope（如尚未 bind），一律读出按 meta 判定
+      body = response.body.to_s.dup.force_encoding('UTF-8')
+      envelope = parse_json(body)
+      meta = envelope.is_a?(Hash) ? (envelope['meta'] || {}) : {}
+      data = envelope.is_a?(Hash) ? envelope['data'] : nil
+
+      if meta['code'] == 0 && data.is_a?(Hash) && !data['token'].to_s.empty?
+        return [data, nil, false]
       end
-    end
 
-    # 获取占用指定端口的进程信息
-    def get_port_process_info(port)
-      begin
-        # macOS/Linux 使用 lsof 命令
-        if system('which lsof > /dev/null 2>&1')
-          output = `lsof -ti :#{port} 2>/dev/null`.strip
-          return nil if output.empty?
-
-          pid = output.split("\n").first
-          return nil if pid.nil? || pid.empty?
-
-          # 获取进程详细信息
-          ps_output = `ps -p #{pid} -o pid,comm,args 2>/dev/null`.lines
-          return nil if ps_output.length < 2
-
-          process_line = ps_output[1].strip
-          parts = process_line.split(/\s+/, 3)
-
-          return {
-            pid: parts[0],
-            name: parts[1] || 'unknown',
-            command: parts[2] || 'unknown'
-          }
-        end
-
-        # Windows 使用 netstat 命令
-        if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
-          output = `netstat -ano | findstr :#{port}`.strip
-          return nil if output.empty?
-
-          lines = output.split("\n")
-          listening_line = lines.find { |line| line.include?('LISTENING') }
-          return nil unless listening_line
-
-          pid = listening_line.split.last
-          return nil if pid.nil? || pid.empty?
-
-          # 获取进程名称
-          task_output = `tasklist /FI "PID eq #{pid}" /FO CSV /NH 2>nul`.strip
-          if !task_output.empty?
-            process_name = task_output.split(',').first.gsub('"', '')
-            return {
-              pid: pid,
-              name: process_name,
-              command: process_name
-            }
-          end
-        end
-
-        return nil
-      rescue => e
-        puts "获取进程信息时出错: #{e.message}"
-        return nil
-      end
+      hint = (meta['message'] || meta['code'] || '登录态未就绪').to_s
+      puts "[oidc] 授权尚未完成，继续等待...（服务端: #{hint}）" if @verbose
+      [nil, hint, false]
+    rescue *NETWORK_ERRORS => e
+      # 网络硬错误：连续多次即中止（见 poll_login_vo）
+      puts "[oidc] 网络错误: #{e.class} - #{e.message}" if @verbose
+      [nil, "#{e.class}: #{e.message}", true]
+    rescue => e
+      # 其它异常（如解析失败）当作未就绪，继续重试
+      puts "[oidc] 轮询出错: #{e.class} - #{e.message}" if @verbose
+      [nil, e.message, false]
     end
 
-    # 询问用户是否终止占用端口的进程
-    def ask_user_kill_process?
-      puts "\n是否终止占用端口的进程？"
-      puts "  y/yes - 终止进程并继续 (可能影响其他应用)"
-      puts "  n/no  - 取消登录 (默认)"
-      print "> "
-
-      begin
-        response = STDIN.gets&.chomp&.downcase
-        return ['y', 'yes'].include?(response)
-      rescue Interrupt
-        puts "\n\n用户中断操作"
-        return false
-      rescue => e
-        puts "无法读取用户输入: #{e.message}"
-        return false
-      end
+    # LoginVo（camelCase）→ 内部字段
+    def apply_login_vo(data)
+      @access_token           = data['token']
+      @username               = data['username']
+      @user_id                = (data['userId'] || data['user_id']).to_s
+      @permissions            = data['permissions']
+      @lark_user_id           = data['larkUserId'] || data['lark_user_id']
+      @tenant_manager         = !!(data['tenantManager'] || data['tenant_manager'])
+      @avatar                 = data['avatar']
+      @token_expire_timestamp = (data['tokenExpireTimestamp'] || data['token_expire_timestamp'] || 0).to_i
     end
 
-    # 根据 PID 终止进程
-    def kill_process_by_pid(pid)
-      return false if pid.nil? || pid.empty?
-
-      begin
-        puts "正在终止进程 #{pid}..."
-
-        # 跨平台的进程终止命令
-        if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
-          # Windows
-          success = system("taskkill /PID #{pid} /F >nul 2>&1")
-        else
-          # macOS/Linux - 先尝试优雅终止，再强制终止
-          success = system("kill -TERM #{pid} 2>/dev/null")
-          sleep(2)
-          # 检查进程是否还存在
-          if system("kill -0 #{pid} 2>/dev/null")
-            puts "优雅终止失败，使用强制终止..."
-            success = system("kill -KILL #{pid} 2>/dev/null")
-          end
-        end
-
-        if success
-          puts "✓ 进程 #{pid} 已终止"
-          sleep(1) # 等待端口释放
-
-          # 再次检查端口是否可用
-          unless port_occupied?(@server_port)
-            puts "✓ 端口 #{@server_port} 现在可用"
-            return true
-          else
-            puts "⚠️  端口仍被占用，可能需要等待更长时间"
-            return false
-          end
-        else
-          puts "✗ 终止进程失败，可能需要管理员权限"
-          return false
-        end
-      rescue => e
-        puts "终止进程时出错: #{e.message}"
-        return false
-      end
+    def parse_json(text)
+      JSON.parse(text)
+    rescue JSON::ParserError
+      {}
     end
 
-    # 构建成功页面
-    def build_success_page
-      <<~HTML
-      <!DOCTYPE html>
-      <html>
-      <head>
-        <meta charset="UTF-8">
-        <title>JPS 授权成功</title>
-        <style>
-          body { font-family: Arial, sans-serif; text-align: center; padding: 40px; background-color: #f5f5f5; }
-          .container { max-width: 600px; margin: 0 auto; background: white; padding: 40px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
-          .success { color: #4CAF50; margin-bottom: 20px; }
-          .countdown { font-weight: bold; color: #FF5722; }
-          .close-btn { background: #4CAF50; color: white; border: none; padding: 10px 20px; cursor: pointer; border-radius: 4px; font-size: 16px; }
-        </style>
-        <script>
-          var secondsLeft = 3;
-          function updateCountdown() {
-            document.getElementById('countdown').innerText = secondsLeft;
-            if (secondsLeft <= 0) {
-              window.close();
-            } else {
-              secondsLeft -= 1;
-              setTimeout(updateCountdown, 1000);
-            }
-          }
-          window.onload = function() { updateCountdown(); }
-        </script>
-      </head>
-      <body>
-        <div class="container">
-          <h1 class="success">✓ JPS 授权成功！</h1>
-          <p>已获取授权码，正在返回命令行...</p>
-          <p>此窗口将在 <span id="countdown" class="countdown">3</span> 秒后自动关闭</p>
-          <button class="close-btn" onclick="window.close()">立即关闭</button>
-        </div>
-      </body>
-      </html>
-      HTML
+    # 兼容 OpenSSL 3.x（避免 CRL 检查失败）
+    def configure_ssl(http)
+      return unless http.use_ssl?
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.cert_store = OpenSSL::X509::Store.new
+      http.cert_store.set_default_paths
+      http.cert_store.flags = 0
     end
 
-    # 构建错误页面
-    def build_error_page(error_msg)
-      <<~HTML
-      <!DOCTYPE html>
-      <html>
-      <head>
-        <meta charset="UTF-8">
-        <title>JPS 授权失败</title>
-        <style>
-          body { font-family: Arial, sans-serif; text-align: center; padding: 40px; background-color: #f5f5f5; }
-          .container { max-width: 600px; margin: 0 auto; background: white; padding: 40px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
-          .error { color: #f44336; margin-bottom: 20px; }
-          .close-btn { background: #f44336; color: white; border: none; padding: 10px 20px; cursor: pointer; border-radius: 4px; font-size: 16px; }
-        </style>
-      </head>
-      <body>
-        <div class="container">
-          <h1 class="error">✗ JPS 授权失败</h1>
-          <p>错误信息: #{error_msg}</p>
-          <p>请返回命令行重试</p>
-          <button class="close-btn" onclick="window.close()">关闭窗口</button>
-        </div>
-      </body>
-      </html>
-      HTML
+    # 跨平台打开浏览器
+    def open_browser(url)
+      case RbConfig::CONFIG['host_os']
+      when /mswin|mingw|cygwin/
+        system("start \"\" \"#{url}\"")
+      when /darwin/
+        system("open", url)
+      when /linux|bsd/
+        system("xdg-open", url)
+      else
+        puts "无法自动打开浏览器，请手动访问上面的链接"
+      end
     end
-
   end
 
-end
+end