@aalis/plugin-authority 0.1.0

package/README.md

@@ -0,0 +1,21 @@
+# @aalis/plugin-authority
+
+运行时插件
+
+## 角色
+
+运行时插件
+
+## 安装
+
+```bash
+pnpm add @aalis/plugin-authority
+```
+
+## 文档
+
+详见 [docs/plugins/plugin-authority.md](../../docs/plugins/plugin-authority.md)。
+
+## 许可
+
+见仓库根目录 LICENSE。

package/dist/i18n.d.ts

@@ -0,0 +1,3 @@
+import type { I18nResources } from '@aalis/core';
+export declare const i18n: I18nResources;
+//# sourceMappingURL=i18n.d.ts.map

package/dist/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,eAAO,MAAM,IAAI,EAAE,aASlB,CAAC"}

package/dist/i18n.js

@@ -0,0 +1,11 @@
+export const i18n = {
+    'zh-CN': {
+        'plugin.authority.displayName': '权限管理',
+        'webui.authority.page': '权限管理',
+    },
+    'en-US': {
+        'plugin.authority.displayName': 'Authority',
+        'webui.authority.page': 'Authority',
+    },
+};
+//# sourceMappingURL=i18n.js.map

package/dist/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,IAAI,GAAkB;IACjC,OAAO,EAAE;QACP,8BAA8B,EAAE,MAAM;QACtC,sBAAsB,EAAE,MAAM;KAC/B;IACD,OAAO,EAAE;QACP,8BAA8B,EAAE,WAAW;QAC3C,sBAAsB,EAAE,WAAW;KACpC;CACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,99 @@
+import type { ConfigManager, Context, Logger, PluginModule } from '@aalis/core';
+import type { UserIdentity } from '@aalis/plugin-authority-api';
+import { type StorageService } from '@aalis/plugin-storage-api';
+import type { AuthorityService, AuthorityUserEntry, AuthorizeRequest, DangerousConfirmHandler, DangerousConfirmRequest, DangerousGrant, UserCapabilityOverrides } from './types.js';
+export type { AuthorityService, DangerousConfirmHandler, DangerousConfirmRequest, DangerousConfirmResult, DangerousGrant, DangerousGrantRequest, } from './types.js';
+export declare class AuthorityManager implements AuthorityService {
+    private users;
+    /** 反向绑定索引：被绑平台身份键 → 主账户键（从 users[].links 重建） */
+    private linkIndex;
+    /** 待消费绑定码（内存态） */
+    private bindCodes;
+    private config;
+    private logger;
+    private storage;
+    private fileUri;
+    private dirty;
+    private saveChain;
+    private confirmHandlers;
+    private dangerousGrants;
+    private grantSeq;
+    /**
+     * dangerous 策略的开启时间（运行时状态，不序列化到 config）。
+     * 进程重启后重置为 null，对限时策略而言等同于「重启即失效」。
+     */
+    private dangerousEnabledAt;
+    constructor(config: ConfigManager, logger: Logger, storage: StorageService);
+    getAuthority(platform: string, userId?: string): number;
+    setAuthority(platform: string, userId: string, level: number): void;
+    removeUser(platform: string, userId: string): void;
+    /** 从 users[].links 重建反向索引（表很小，全量重建即可） */
+    private rebuildLinkIndex;
+    createBindCode(platform: string, userId: string): {
+        code: string;
+        expiresAt: number;
+    };
+    consumeBindCode(code: string, identity: UserIdentity): UserIdentity;
+    unlinkIdentity(platform: string, userId: string): boolean;
+    setPassword(platform: string, userId: string, password: string): Promise<void>;
+    verifyPassword(platform: string, userId: string, password: string): Promise<boolean>;
+    hasPassword(platform: string, userId: string): boolean;
+    setUserCapabilities(platform: string, userId: string, overrides: UserCapabilityOverrides): void;
+    /**
+     * capability 中心统一闸。裁决优先级（per-capability）：
+     * 全局 permissionPolicy > 用户 deny > 用户 grant > 角色链等级门槛。
+     *
+     * 等级门槛 = max(declaredAuthority, requiredAuthorityFor([cap]))——
+     * 即"操作声明的基础等级"与"capability 归属角色包"取较高者，只升不降。
+     */
+    authorize(identity: {
+        platform: string;
+        userId?: string;
+    }, request: AuthorizeRequest): string | null;
+    isDangerousAllowed(name: string, permissions?: string[]): boolean;
+    /** 刷新 dangerous 策略启动时间戳（运行时状态） */
+    markDangerousEnabled(): void;
+    /** 清除 dangerous 策略启动时间戳 */
+    clearDangerousEnabled(): void;
+    setConfirmHandler(platform: string, handler: DangerousConfirmHandler): void;
+    confirmDangerous(request: DangerousConfirmRequest): Promise<boolean>;
+    /**
+     * 计算一组细粒度权限所要求的最低权限等级（参数级动态提权）。
+     *
+     * 例如 file_write 写普通文件只需声明的 authority:3，但写 data:/users.json
+     * （用户权限表）或 data:/scheduler-jobs.json（计划任务，可注入 owner 身份的
+     * actor）这类敏感文件、或写 aalis:/ 源码根（重启后即任意代码执行）时要求
+     * owner 等级，防止低权限用户借文件写入自我提权。
+     *
+     * 默认保护清单可被 config.permissionAuthority 覆盖/扩展（同模式取配置值，
+     * 新模式叠加；命中多个模式时取最大要求）。只提高门槛，不降低声明值。
+     */
+    /** 参数级提权完整清单（内置保护 + config.permissionAuthority 合并后；展示与裁决共用同一真源） */
+    getEscalationMap(): Record<string, number>;
+    requiredAuthorityFor(permissions: string[]): number;
+    checkPermissionPolicy(permissions: string[]): string | null;
+    private matchAny;
+    private matchPattern;
+    listDangerousGrants(): DangerousGrant[];
+    revokeDangerousGrant(id: string): boolean;
+    private normalizeConfirmResult;
+    private consumeDangerousGrant;
+    private createDangerousGrant;
+    private pruneDangerousGrants;
+    private samePermissions;
+    isOwner(platform: string, userId?: string): boolean;
+    listUsers(): AuthorityUserEntry[];
+    save(): void;
+    init(): Promise<void>;
+}
+export declare const name = "@aalis/plugin-authority";
+export declare const displayName = "\u6743\u9650\u7BA1\u7406";
+export declare const subsystem = "authority";
+export declare const provides: string[];
+export declare const inject: {
+    optional: string[];
+};
+export declare function apply(ctx: Context, _config: Record<string, unknown>): Promise<void>;
+export declare const actions: PluginModule['actions'];
+export declare const actionsMeta: PluginModule['actionsMeta'];
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAIpG,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAItF,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EAEvB,cAAc,EACd,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AA4DpB,qBAAa,gBAAiB,YAAW,gBAAgB;IACvD,OAAO,CAAC,KAAK,CAAiC;IAC9C,gDAAgD;IAChD,OAAO,CAAC,SAAS,CAA6B;IAC9C,kBAAkB;IAClB,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,QAAQ,CAAK;IACrB;;;OAGG;IACH,OAAO,CAAC,kBAAkB,CAAuB;gBAErC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc;IAO1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAmBvD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAOnE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAUlD,yCAAyC;IACzC,OAAO,CAAC,gBAAgB;IAOxB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAerF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,YAAY;IAqCnE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAenD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU1F,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAItD,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,GAAG,IAAI;IAsB/F;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI;IA8BpG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,EAAO,GAAG,OAAO;IAerE,kCAAkC;IAClC,oBAAoB,IAAI,IAAI;IAI5B,2BAA2B;IAC3B,qBAAqB,IAAI,IAAI;IAI7B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAIrE,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B1E;;;;;;;;;;OAUG;IACH,mEAAmE;IACnE,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAa1C,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM;IASnD,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAc3D,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,YAAY;IAMpB,mBAAmB,IAAI,cAAc,EAAE;IAKvC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAMzC,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAOnD,SAAS,IAAI,kBAAkB,EAAE;IA+BjC,IAAI,IAAI,IAAI;IAmBN,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B5B;AAID,eAAO,MAAM,IAAI,4BAA4B,CAAC;AAC9C,eAAO,MAAM,WAAW,6BAAS,CAAC;AAClC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,QAAQ,UAAgB,CAAC;AACtC,eAAO,MAAM,MAAM;;CAElB,CAAC;AA0CF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkIzF;AAID,eAAO,MAAM,OAAO,EAAE,YAAY,CAAC,SAAS,CAikB3C,CAAC;AAMF,eAAO,MAAM,WAAW,EAAE,YAAY,CAAC,aAAa,CAKnD,CAAC"}