@actiondock/core 2.7.0 → 2.9.0

package/dist/server/routes/actions.js

@@ -1,14 +1,13 @@
-import { randomUUID } from "node:crypto";
-import { ActionResolver } from "../../catalog/action-resolver.js";
+import { parseActionRef } from "../../catalog/resolve-action.js";
 import { filterByIntent } from "../../filter/index.js";
-import { ACTION_NOT_FOUND, ACTION_TIMEOUT, IDEMPOTENCY_CONFLICT, INPUT_VALIDATION_FAILED, PACKAGE_NOT_FOUND } from "../../errors.js";
+import { ACTION_EXECUTION_ERROR, ACTION_FORBIDDEN, ACTION_NOT_FOUND, ACTION_START_FAILED, ACTION_TIMEOUT, ACTIONS_LIST_ERROR, IDEMPOTENCY_CONFLICT, INPUT_VALIDATION_FAILED, INVALID_JSON, PACKAGE_FORBIDDEN, PACKAGE_NOT_FOUND, REQUEST_TOO_LARGE, } from "../../errors.js";
 import { InvalidJsonError, readJsonBody, RequestTooLargeError } from "../body.js";
-import { getSubPath, jsonResponse } from "./common.js";
+import { filterActionsByPolicy, getSubPath, isActionAllowedByPolicy, isPackageAllowedByPolicy, jsonResponse, } from "./common.js";
 /**
  * 处理 Action 相关的 HTTP 路由（列表、规范查询、同步执行与异步启动）。
  */
 export async function handleActionsRoutes(ctx) {
-    const { req, url, pathname, corsHeaders, options, target } = ctx;
+    const { req, url, pathname, corsHeaders, options, service, activePolicy: policy } = ctx;
     const subpath = getSubPath(pathname);
     // 1. Actions List: GET /api/v2/actions, GET /actions
     if (subpath === "/actions" && req.method === "GET") {
@@ -18,7 +17,7 @@ export async function handleActionsRoutes(ctx) {
             const targetPkg = url.searchParams.get("package") || url.searchParams.get("packageId") || undefined;
             const prefix = url.searchParams.get("prefix") || undefined;
             const tags = url.searchParams.getAll("tag");
-            let actions = await target.listActions({
+            let actions = await service.discovery.listActions({
                 query,
                 prefix,
                 tags: tags.length > 0 ? tags : undefined,
@@ -26,9 +25,7 @@ export async function handleActionsRoutes(ctx) {
             if (targetPkg) {
                 actions = actions.filter((a) => a.packageId === targetPkg || a.id.startsWith(`${targetPkg}/`));
             }
-            if (options.packageAllowlist && options.packageAllowlist.length > 0) {
-                actions = actions.filter((a) => a.packageId && options.packageAllowlist.includes(a.packageId));
-            }
+            actions = filterActionsByPolicy(actions, policy);
             if (intent) {
                 actions = filterByIntent(actions, intent, [(a) => a.id, (a) => a.description || "", (a) => a.packageId || ""], false);
             }
@@ -37,7 +34,7 @@ export async function handleActionsRoutes(ctx) {
         catch (err) {
             return jsonResponse({
                 ok: false,
-                error: { code: "ACTIONS_LIST_ERROR", message: err.message },
+                error: { code: ACTIONS_LIST_ERROR, message: err.message },
             }, 500, corsHeaders);
         }
     }
@@ -46,20 +43,27 @@ export async function handleActionsRoutes(ctx) {
     if (pkgActionShowMatch && req.method === "GET") {
         const packageId = decodeURIComponent(pkgActionShowMatch[1]);
         const actionId = decodeURIComponent(pkgActionShowMatch[2]);
-        if (options.packageAllowlist && options.packageAllowlist.length > 0) {
-            if (!options.packageAllowlist.includes(packageId)) {
-                return jsonResponse({
-                    ok: false,
-                    error: {
-                        code: "PACKAGE_FORBIDDEN",
-                        message: `Package '${packageId}' is not in the allowed package list`,
-                    },
-                }, 403, corsHeaders);
-            }
+        if (!isPackageAllowedByPolicy(packageId, policy)) {
+            return jsonResponse({
+                ok: false,
+                error: {
+                    code: PACKAGE_FORBIDDEN,
+                    message: `Package '${packageId}' is not in the allowed package list`,
+                },
+            }, 403, corsHeaders);
+        }
+        if (!isActionAllowedByPolicy({ packageId, actionId }, policy)) {
+            return jsonResponse({
+                ok: false,
+                error: {
+                    code: ACTION_FORBIDDEN,
+                    message: `Action '${packageId}/${actionId}' is not in the allowed action list`,
+                },
+            }, 403, corsHeaders);
         }
         const ref = `${packageId}/${actionId}`;
         try {
-            const spec = await target.describeAction(ref);
+            const spec = await service.discovery.describeAction(ref);
             return jsonResponse(spec, 200, corsHeaders);
         }
         catch (err) {
@@ -77,30 +81,46 @@ export async function handleActionsRoutes(ctx) {
     if (actionShowMatch && req.method === "GET") {
         const actionId = decodeURIComponent(actionShowMatch[1]);
         try {
-            const parsed = ActionResolver.parseRef(actionId);
-            if (parsed.packageId && options.packageAllowlist && options.packageAllowlist.length > 0) {
-                if (!options.packageAllowlist.includes(parsed.packageId)) {
+            const parsed = parseActionRef(actionId);
+            if (parsed.packageId) {
+                if (!isPackageAllowedByPolicy(parsed.packageId, policy)) {
                     return jsonResponse({
                         ok: false,
                         error: {
-                            code: "PACKAGE_FORBIDDEN",
+                            code: PACKAGE_FORBIDDEN,
                             message: `Package '${parsed.packageId}' is not in the allowed package list`,
                         },
                     }, 403, corsHeaders);
                 }
+                if (!isActionAllowedByPolicy({ packageId: parsed.packageId, actionId: parsed.actionId }, policy)) {
+                    return jsonResponse({
+                        ok: false,
+                        error: {
+                            code: ACTION_FORBIDDEN,
+                            message: `Action '${actionId}' is not in the allowed action list`,
+                        },
+                    }, 403, corsHeaders);
+                }
             }
         }
         catch { }
         try {
-            const spec = await target.describeAction(actionId);
-            if (options.packageAllowlist &&
-                options.packageAllowlist.length > 0 &&
-                (!spec.packageId || !options.packageAllowlist.includes(spec.packageId))) {
+            const spec = await service.discovery.describeAction(actionId);
+            if (!isPackageAllowedByPolicy(spec.packageId, policy)) {
+                return jsonResponse({
+                    ok: false,
+                    error: {
+                        code: PACKAGE_FORBIDDEN,
+                        message: `Package '${spec.packageId || "unknown"}' is not in the allowed package list`,
+                    },
+                }, 403, corsHeaders);
+            }
+            if (!isActionAllowedByPolicy({ packageId: spec.packageId, actionId: spec.id }, policy)) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: "PACKAGE_FORBIDDEN",
-                        message: `Package '${spec.packageId}' is not in the allowed package list`,
+                        code: ACTION_FORBIDDEN,
+                        message: `Action '${spec.packageId ? `${spec.packageId}/${spec.id}` : spec.id}' is not in the allowed action list`,
                     },
                 }, 403, corsHeaders);
             }
@@ -128,9 +148,10 @@ export async function handleActionsRoutes(ctx) {
         let actionRef;
         let endpointMode;
         let pkgId;
+        let actId;
         if (pkgRunMatch) {
             pkgId = decodeURIComponent(pkgRunMatch[1]);
-            const actId = decodeURIComponent(pkgRunMatch[2]);
+            actId = decodeURIComponent(pkgRunMatch[2]);
             endpointMode = pkgRunMatch[3];
             actionRef = `${pkgId}/${actId}`;
         }
@@ -138,33 +159,55 @@ export async function handleActionsRoutes(ctx) {
             actionRef = decodeURIComponent(shortRunMatch[1]);
             endpointMode = shortRunMatch[2];
             try {
-                const parsed = ActionResolver.parseRef(actionRef);
+                const parsed = parseActionRef(actionRef);
                 pkgId = parsed.packageId;
+                actId = parsed.actionId;
             }
             catch { }
         }
-        // 校验 Package 允许白名单
-        if (options.packageAllowlist && options.packageAllowlist.length > 0) {
-            if (!pkgId) {
-                try {
-                    const spec = await target.describeAction(actionRef);
-                    pkgId = spec?.packageId;
-                }
-                catch { }
+        // 解析并补全包与动作标识（仅在必要时单次查询 spec）
+        if ((!pkgId || !actId) && (policy.packageAllowlist?.length || policy.actionAllowlist?.length)) {
+            try {
+                const spec = await service.discovery.describeAction(actionRef);
+                pkgId = pkgId || spec?.packageId;
+                actId = actId || spec?.id;
             }
-            if (!pkgId || !options.packageAllowlist.includes(pkgId)) {
-                return jsonResponse({
-                    ok: false,
-                    runId: randomUUID(),
-                    error: {
-                        code: "PACKAGE_FORBIDDEN",
-                        message: pkgId
-                            ? `Package '${pkgId}' is not in the allowed package list`
-                            : `Action '${actionRef}' does not belong to any allowed package`,
-                    },
-                }, 403, corsHeaders);
+            catch { }
+        }
+        if (!actId) {
+            try {
+                const parsed = parseActionRef(actionRef);
+                actId = parsed.actionId;
+                pkgId = pkgId || parsed.packageId;
+            }
+            catch {
+                actId = actionRef;
             }
         }
+        // 校验 Package 允许白名单
+        if (!isPackageAllowedByPolicy(pkgId, policy)) {
+            return jsonResponse({
+                ok: false,
+                runId: "",
+                error: {
+                    code: PACKAGE_FORBIDDEN,
+                    message: pkgId
+                        ? `Package '${pkgId}' is not in the allowed package list`
+                        : `Action '${actionRef}' does not belong to any allowed package`,
+                },
+            }, 403, corsHeaders);
+        }
+        // 校验 Action 允许白名单
+        if (!isActionAllowedByPolicy({ packageId: pkgId, actionId: actId }, policy)) {
+            return jsonResponse({
+                ok: false,
+                runId: "",
+                error: {
+                    code: ACTION_FORBIDDEN,
+                    message: `Action '${actionRef}' is not in the allowed action list`,
+                },
+            }, 403, corsHeaders);
+        }
         let body = {};
         try {
             body = await readJsonBody(req, { maxBytes: options.maxBodyBytes });
@@ -173,21 +216,21 @@ export async function handleActionsRoutes(ctx) {
             if (err instanceof RequestTooLargeError) {
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
-                    error: { code: "REQUEST_TOO_LARGE", message: err.message },
+                    runId: "",
+                    error: { code: REQUEST_TOO_LARGE, message: err.message },
                 }, 413, corsHeaders);
             }
             if (err instanceof InvalidJsonError) {
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
-                    error: { code: "INVALID_JSON", message: err.message },
+                    runId: "",
+                    error: { code: INVALID_JSON, message: err.message },
                 }, 400, corsHeaders);
             }
             return jsonResponse({
                 ok: false,
-                runId: randomUUID(),
-                error: { code: "INVALID_JSON", message: `Failed to parse request body: ${err.message}` },
+                runId: "",
+                error: { code: INVALID_JSON, message: `Failed to parse request body: ${err.message}` },
             }, 400, corsHeaders);
         }
         const isAsync = endpointMode === "start" ||
@@ -205,9 +248,16 @@ export async function handleActionsRoutes(ctx) {
             body?.requestId ||
             body?.execution?.requestId ||
             undefined;
+        let actionRefObj;
+        try {
+            actionRefObj = parseActionRef(actionRef);
+        }
+        catch {
+            actionRefObj = { actionId: actionRef };
+        }
         if (isAsync) {
             try {
-                const ticket = await target.startAction(actionRef, input, {
+                const ticket = await service.execution.start(actionRefObj, input, {
                     timeoutMs,
                     config: configOverrides,
                     requestId,
@@ -236,9 +286,9 @@ export async function handleActionsRoutes(ctx) {
                 }
                 return jsonResponse({
                     ok: false,
-                    runId: randomUUID(),
+                    runId: "",
                     error: {
-                        code: "ACTION_START_FAILED",
+                        code: ACTION_START_FAILED,
                         message: err.message || String(err),
                     },
                 }, 500, corsHeaders);
@@ -246,7 +296,7 @@ export async function handleActionsRoutes(ctx) {
         }
         // 同步执行模式
         try {
-            const result = await target.runAction(actionRef, input, {
+            const result = await service.execution.run(actionRefObj, input, {
                 signal: req.signal,
                 timeoutMs,
                 config: configOverrides,
@@ -286,9 +336,9 @@ export async function handleActionsRoutes(ctx) {
             }
             return jsonResponse({
                 ok: false,
-                runId: randomUUID(),
+                runId: "",
                 error: {
-                    code: "ACTION_EXECUTION_ERROR",
+                    code: ACTION_EXECUTION_ERROR,
                     message: err.message || String(err),
                 },
             }, 500, corsHeaders);

package/dist/server/routes/common.d.ts

@@ -1,47 +1,32 @@
-import type { ActionDockApp } from "../../app/types.js";
-import type { ActionDockHost } from "../../host/types.js";
-import type { ActionDockTarget } from "../../target/types.js";
-import type { ServerOptions } from "../types.js";
-/**
- * 路由处理统一上下文对象。
- */
-export interface RouteContext {
-    req: Request;
-    url: URL;
-    pathname: string;
-    corsHeaders: Record<string, string>;
-    projectRoot: string | null;
-    customHome?: string;
-    host?: ActionDockHost;
-    target: ActionDockTarget;
-    options: ServerOptions;
-}
+import type { PackageInfo } from "../../package/types.js";
+import type { EffectiveServerPolicy, RouteContext, ServerOptions } from "../types.js";
+import { ActionForbiddenError, assertActionAllowedByPolicy, assertPackageAllowedByPolicy, filterActionsByPolicy, filterPackagesByPolicy, isActionAllowed, isActionAllowedByPolicy, isManagementAllowedByPolicy, isPackageAllowedByPolicy, PackageNotAllowedError } from "../policy.js";
+export type { RouteContext };
+export { ActionForbiddenError, PackageNotAllowedError, isActionAllowed, isActionAllowedByPolicy, isPackageAllowedByPolicy, isManagementAllowedByPolicy, filterActionsByPolicy, filterPackagesByPolicy, assertActionAllowedByPolicy, assertPackageAllowedByPolicy, };
 /**
  * 构造带 CORS 头的标准 JSON HTTP 响应。
  */
 export declare function jsonResponse(data: unknown, status?: number, corsHeaders?: Record<string, string>): Response;
 /**
- * 剥离标准版本前缀 (/api/v2/ 与兼容的 /api/v1/)，获取相对路由子路径。
+ * 剥离标准版本前缀 (/api/v2/)，获取相对路由子路径。
  */
 export declare function getSubPath(pathname: string): string;
 /**
- * 包未列入白名单拒绝访问异常。
+ * 校验目标 action 是否属于允许动作白名单。
+ * 当 options 或 policy 中的 actionAllowlist 存在且目标 action 不在白名单中时抛出 403 ACTION_FORBIDDEN 异常。
  */
-export declare class PackageNotAllowedError extends Error {
-    status: number;
-    statusCode: number;
-    code: string;
-    constructor(packageId: string);
-}
+export declare function assertActionAllowed(action: {
+    actionId?: string;
+    id?: string;
+    packageId?: string;
+} | string, options?: ServerOptions | EffectiveServerPolicy): void;
 /**
  * 校验目标 packageId 是否属于允许包白名单。
- * 当 options.packageAllowlist 存在且目标 packageId 不在白名单中时抛出 403 PACKAGE_NOT_ALLOWED 异常。
+ * 当 options 或 policy 中的 packageAllowlist 存在且目标 packageId 不在白名单中时抛出 403 PACKAGE_NOT_ALLOWED 异常。
  */
-export declare function assertPackageAllowed(packageId: string | undefined | null, options?: {
-    packageAllowlist?: string[];
-}): void;
+export declare function assertPackageAllowed(packageId: string, options?: ServerOptions | EffectiveServerPolicy): void;
 /**
- * 从 Host 或 Target 中依据 packageId 解析对应的 ActionDockApp 实例。
- * 若提供了 options，过滤或优先选择白名单内的 app。
+ * 解析并确定生效的目标 packageId。
+ * 遵循严格的解析规则与白名单检查。
  */
-export declare function resolveAppForPackage(packageIdOrPath: string | undefined, host?: ActionDockHost, target?: ActionDockTarget, options?: ServerOptions): ActionDockApp;
+export declare function resolveTargetPackageId(packages: PackageInfo[], requestedPackageId?: string, options?: ServerOptions | EffectiveServerPolicy): string;

package/dist/server/routes/common.js

@@ -1,4 +1,7 @@
 import { assertValidPackageId } from "../../utils/index.js";
+import { ActionDockError, PACKAGE_NOT_FOUND } from "../../errors.js";
+import { ActionForbiddenError, assertActionAllowedByPolicy, assertPackageAllowedByPolicy, filterActionsByPolicy, filterPackagesByPolicy, isActionAllowed, isActionAllowedByPolicy, isManagementAllowedByPolicy, isPackageAllowedByPolicy, PackageNotAllowedError, } from "../policy.js";
+export { ActionForbiddenError, PackageNotAllowedError, isActionAllowed, isActionAllowedByPolicy, isPackageAllowedByPolicy, isManagementAllowedByPolicy, filterActionsByPolicy, filterPackagesByPolicy, assertActionAllowedByPolicy, assertPackageAllowedByPolicy, };
 /**
  * 构造带 CORS 头的标准 JSON HTTP 响应。
  */
@@ -12,93 +15,70 @@ export function jsonResponse(data, status = 200, corsHeaders = {}) {
     });
 }
 /**
- * 剥离标准版本前缀 (/api/v2/ 与兼容的 /api/v1/)，获取相对路由子路径。
+ * 剥离标准版本前缀 (/api/v2/)，获取相对路由子路径。
  */
 export function getSubPath(pathname) {
     if (pathname.startsWith("/api/v2/")) {
         return pathname.slice(7);
     }
-    if (pathname.startsWith("/api/v1/")) {
-        return pathname.slice(7);
-    }
     return pathname;
 }
 /**
- * 包未列入白名单拒绝访问异常。
+ * 校验目标 action 是否属于允许动作白名单。
+ * 当 options 或 policy 中的 actionAllowlist 存在且目标 action 不在白名单中时抛出 403 ACTION_FORBIDDEN 异常。
  */
-export class PackageNotAllowedError extends Error {
-    status = 403;
-    statusCode = 403;
-    code = "PACKAGE_NOT_ALLOWED";
-    constructor(packageId) {
-        super(`Package '${packageId}' is not in the allowed package list`);
-        this.name = "PackageNotAllowedError";
-    }
+export function assertActionAllowed(action, options) {
+    const policy = options
+        ? {
+            packageAllowlist: options.packageAllowlist,
+            actionAllowlist: options.actionAllowlist,
+        }
+        : undefined;
+    assertActionAllowedByPolicy(action, policy);
 }
 /**
  * 校验目标 packageId 是否属于允许包白名单。
- * 当 options.packageAllowlist 存在且目标 packageId 不在白名单中时抛出 403 PACKAGE_NOT_ALLOWED 异常。
+ * 当 options 或 policy 中的 packageAllowlist 存在且目标 packageId 不在白名单中时抛出 403 PACKAGE_NOT_ALLOWED 异常。
  */
 export function assertPackageAllowed(packageId, options) {
-    if (options?.packageAllowlist &&
-        Array.isArray(options.packageAllowlist) &&
-        options.packageAllowlist.length > 0) {
-        if (!packageId || !options.packageAllowlist.includes(packageId)) {
-            throw new PackageNotAllowedError(packageId || "");
+    const policy = options
+        ? {
+            packageAllowlist: options.packageAllowlist,
         }
-    }
+        : undefined;
+    assertPackageAllowedByPolicy(packageId, policy);
 }
 /**
- * 从 Host 或 Target 中依据 packageId 解析对应的 ActionDockApp 实例。
- * 若提供了 options，过滤或优先选择白名单内的 app。
+ * 解析并确定生效的目标 packageId。
+ * 遵循严格的解析规则与白名单检查。
  */
-export function resolveAppForPackage(packageIdOrPath, host, target, options) {
-    if (packageIdOrPath) {
-        assertPackageAllowed(packageIdOrPath, options);
-        assertValidPackageId(packageIdOrPath);
-        if (host) {
-            const app = host.getApp(packageIdOrPath);
-            if (app)
-                return app;
-        }
-        const innerTarget = target?.unwrap?.();
-        if (innerTarget && "packageId" in innerTarget && innerTarget.packageId === packageIdOrPath) {
-            return innerTarget;
+export function resolveTargetPackageId(packages, requestedPackageId, options) {
+    const allowlist = options?.packageAllowlist;
+    if (requestedPackageId) {
+        if (requestedPackageId === "global") {
+            return "global";
         }
-        if (innerTarget && "getApp" in innerTarget) {
-            const app = innerTarget.getApp(packageIdOrPath);
-            if (app)
-                return app;
+        assertValidPackageId(requestedPackageId);
+        assertPackageAllowed(requestedPackageId, options);
+        const matched = packages.find((p) => p.id === requestedPackageId || p.packageRoot === requestedPackageId);
+        if (!matched) {
+            throw new ActionDockError(PACKAGE_NOT_FOUND, `Unknown or unregistered package: '${requestedPackageId}'`);
         }
-        throw new Error(`Unknown or unregistered package: '${packageIdOrPath}'`);
+        return matched.id;
     }
-    if (host) {
-        const apps = host.listApps();
-        if (options?.packageAllowlist &&
-            Array.isArray(options.packageAllowlist) &&
-            options.packageAllowlist.length > 0) {
-            const allowedApp = apps.find((a) => options.packageAllowlist.includes(a.packageId));
-            if (allowedApp)
-                return allowedApp;
-        }
-        if (apps.length > 0)
-            return apps[0];
+    let targetId;
+    if (allowlist &&
+        Array.isArray(allowlist) &&
+        allowlist.length > 0) {
+        const allowed = packages.find((p) => allowlist.includes(p.id));
+        targetId = allowed ? allowed.id : (packages[0]?.id || "");
     }
-    const innerTarget = target?.unwrap?.();
-    if (innerTarget && "listApps" in innerTarget) {
-        const apps = innerTarget.listApps();
-        if (options?.packageAllowlist &&
-            Array.isArray(options.packageAllowlist) &&
-            options.packageAllowlist.length > 0) {
-            const allowedApp = apps.find((a) => options.packageAllowlist.includes(a.packageId));
-            if (allowedApp)
-                return allowedApp;
-        }
-        if (apps.length > 0)
-            return apps[0];
+    else if (packages.length > 0) {
+        targetId = packages[0].id;
     }
-    if (innerTarget && "packageId" in innerTarget) {
-        return innerTarget;
+    else {
+        throw new ActionDockError(PACKAGE_NOT_FOUND, "No registered package found in service");
     }
-    throw new Error("No registered package found in host or target");
+    assertPackageAllowed(targetId, options);
+    return targetId;
 }

package/dist/server/routes/config.d.ts

@@ -1,6 +1,6 @@
 import { type RouteContext } from "./common.js";
 /**
  * 处理配置元数据与当前值读取、更新及删除接口。
- * 在未显式开启管理功能 (options.enableManagement !== true) 时返回 403 拒绝。
+ * 在未显式开启管理功能时返回 403 拒绝。
  */
 export declare function handleConfigRoutes(ctx: RouteContext): Promise<Response | null>;