@agentunion/fastaun 0.5.27 → 0.5.28

package/dist/auth.js

@@ -551,6 +551,26 @@ export class AuthFlow {
     // 调用方注入的内存私钥（由 AUNClient.loadIdentity 传入，不走 tokenStore 解密）
     _memIdentity = null;
     _identityPkiContext = '';
+    _requestAdmission = null;
+    _riskCapabilityEnabled = null;
+    _httpHandler = null;
+    setRequestAdmission(admission) { this._requestAdmission = admission; }
+    setRiskSupport(enabled) { this._riskCapabilityEnabled = enabled; }
+    setHttpHandler(handler) { this._httpHandler = handler; }
+    async _fetchRiskText(url) {
+        if (!this._httpHandler)
+            return _fetchText(url, this._verifySsl, this._net);
+        const response = await this._fetchOwnershipPki(url);
+        if (response.status < 200 || response.status >= 300)
+            throw new AuthError(`HTTP ${response.status} from ${url}`);
+        return response.body;
+    }
+    async _fetchRiskJson(url) {
+        const result = JSON.parse(await this._fetchRiskText(url));
+        if (!isJsonObject(result))
+            throw new ValidationError(`invalid JSON response from ${url}`);
+        return result;
+    }
     constructor(opts) {
         this._logger = opts.logger ?? _noopLogger;
         this._tokenStore = opts.tokenStore;
@@ -1215,6 +1235,16 @@ export class AuthFlow {
         }
     }
     async _fetchOwnershipPki(url) {
+        if (!this._httpHandler)
+            return this._fetchOwnershipPkiDirect(url);
+        const perform = async () => {
+            const result = await this._fetchOwnershipPkiDirect(url);
+            return new Response([204, 205, 304].includes(result.status) ? null : result.body, { status: result.status, headers: result.headers });
+        };
+        const response = await this._httpHandler(url, { method: 'GET' }, perform);
+        return { status: response.status, headers: Object.fromEntries(response.headers), body: await response.text() };
+    }
+    async _fetchOwnershipPkiDirect(url) {
         const fetch = (target, originalHost) => new Promise((resolve, reject) => {
             const parsed = new URL(target);
             const module = parsed.protocol === 'https:' ? https : http;
@@ -1279,6 +1309,15 @@ export class AuthFlow {
      * 流程：连接 → 接收 challenge → 发送请求 → 接收响应 → 关闭。
      */
     async _shortRpc(gatewayUrl, method, params) {
+        const release = this._requestAdmission?.(`rpc:${method}`);
+        try {
+            return await this._shortRpcAdmitted(gatewayUrl, method, params);
+        }
+        finally {
+            release?.();
+        }
+    }
+    async _shortRpcAdmitted(gatewayUrl, method, params) {
         this._logger.debug(`_shortRpc enter: method=${method}, gateway=${gatewayUrl}`);
         if (this._connectionFactory === null) {
             const call = shortRpcViaNetworkActor(gatewayUrl, method, params);
@@ -1523,6 +1562,7 @@ export class AuthFlow {
             agent_md_validation_v1: true,
             p2p_peer_pull_v1: true,
             gateway_migrate_v1: true,
+            ...(this._requestAdmission && this._verifySsl && this._riskCapabilityEnabled?.() ? { risk_test_v1: true } : {}),
         };
         const request = {
             nonce,
@@ -1766,7 +1806,7 @@ export class AuthFlow {
         const response = fresh ? await this._fetchOwnershipPki(url) : undefined;
         if (response && response.status !== 200)
             throw new AuthError('service event certificate chain is unavailable');
-        const text = response ? response.body : await _fetchText(url, this._verifySsl, this._net);
+        const text = response ? response.body : await this._fetchRiskText(url);
         return _splitPemBundle(text);
     }
     /**
@@ -1821,7 +1861,7 @@ export class AuthFlow {
      */
     async _fetchGatewayCrl(gatewayUrl, _issuerCert, fresh = false) {
         const url = _gatewayHttpUrl(gatewayUrl, '/pki/crl.json');
-        const payload = fresh ? await this._fetchFreshPkiJson(url) : await _fetchJson(url, this._verifySsl, this._net);
+        const payload = fresh ? await this._fetchFreshPkiJson(url) : await this._fetchRiskJson(url);
         const crlPem = String(payload.crl_pem || '');
         if (!crlPem) {
             throw new AuthError('gateway CRL endpoint returned no signed CRL');
@@ -2012,7 +2052,7 @@ export class AuthFlow {
     async _fetchGatewayOcspStatus(gatewayUrl, authCert, issuerCert, strictCurrent = false) {
         const serialHex = _certSerialHex(authCert);
         const url = _gatewayHttpUrl(gatewayUrl, `/pki/ocsp/${serialHex}`);
-        const payload = strictCurrent ? await this._fetchFreshPkiJson(url) : await _fetchJson(url, this._verifySsl, this._net);
+        const payload = strictCurrent ? await this._fetchFreshPkiJson(url) : await this._fetchRiskJson(url);
         const status = String(payload.status || '');
         const ocspB64 = String(payload.ocsp_response || '');
         if (strictCurrent) {
@@ -2369,7 +2409,7 @@ export class AuthFlow {
     async _downloadRegisteredCert(gatewayUrl, aid) {
         const certUrl = _gatewayHttpUrl(gatewayUrl, `/pki/cert/${aid}`);
         try {
-            const certPem = await _fetchText(certUrl, this._verifySsl);
+            const certPem = await this._fetchRiskText(certUrl);
             if (!certPem || !certPem.includes('BEGIN CERTIFICATE')) {
                 return null;
             }