@agentunion/kite 1.4.0 → 1.6.0

package/extensions/services/kite_console/auth_manager.py

@@ -0,0 +1,603 @@
+"""
+认证管理模块 - Token 缓存、验证、吊销
+
+使用 JSONL 格式存储 Token 历史记录，每次变更追加一条记录。
+查询时使用每个 Token 的最新记录。
+"""
+
+import hmac
+import json
+import os
+import secrets
+import time
+from datetime import datetime, timezone
+from typing import Optional
+
+
+class AuthManager:
+    """认证管理器"""
+
+    def __init__(self, data_dir: str):
+        """
+        初始化认证管理器
+
+        Args:
+            data_dir: 数据目录（$KITE_DATA/evol）
+        """
+        self.data_dir = data_dir
+        self.auth_dir = os.path.join(data_dir, "auth")
+        os.makedirs(self.auth_dir, exist_ok=True)
+
+        self.evol_tokens_file = os.path.join(self.auth_dir, "evol_tokens.jsonl")
+        self.kite_tokens_file = os.path.join(self.auth_dir, "kite_tokens.jsonl")
+
+        self.kite_token_ttl = 30 * 24 * 3600  # 30 days (sliding window)
+        self.kite_token_absolute_ttl = 180 * 24 * 3600  # 180 days (absolute max)
+        self.evol_token_ttl = 7 * 24 * 3600   # 7 days
+        self.token_update_interval = 24 * 3600  # 1 day - Token 更新间隔
+
+        # 内存缓存
+        self._kite_tokens_cache = None
+        self._kite_tokens_cache_time = 0
+        self._evol_tokens_cache = {}  # 改为字典：{phone: record}
+        self._evol_tokens_cache_time = 0
+        self.cache_ttl = 60 * 60  # 1 小时缓存
+
+    def save_evol_token(self, phone: str, token: str, data: dict):
+        """保存 Evol Token 到 JSONL"""
+        now = time.time()
+        record = {
+            "phone": phone,
+            "token": token,
+            "action": "login",
+            "obtainedAt": now,
+            "obtainedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "expiresAt": now + self.evol_token_ttl,
+            "expiresAt_human": datetime.fromtimestamp(now + self.evol_token_ttl, timezone.utc).isoformat(),
+            "lastUsedAt": now,
+            "lastUsedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "userInfo": data.get("userInfo", {}),
+            "accountInfo": data.get("accountInfo", {}),
+            "teamInfo": data.get("teamInfo", {}),
+            "gatewayInfo": data.get("gatewayInfo", {}),
+            "timestamp": now
+        }
+
+        self._append_evol_record(record)
+        # 清除缓存
+        self._evol_tokens_cache = {}
+        self._evol_tokens_cache_time = 0
+
+    def get_evol_token(self, phone: str) -> Optional[dict]:
+        """获取指定手机号的最新 Evol Token（带缓存）"""
+        now = time.time()
+
+        # 检查缓存是否有效
+        if self._evol_tokens_cache and (now - self._evol_tokens_cache_time < self.cache_ttl):
+            return self._evol_tokens_cache.get(phone)
+
+        # 从文件读取所有 Evol Token
+        if not os.path.exists(self.evol_tokens_file):
+            return None
+
+        try:
+            # 按 phone 分组，保留每个 phone 的最新记录
+            phone_tokens = {}
+            with open(self.evol_tokens_file, "r", encoding="utf-8") as f:
+                for line in f:
+                    line = line.strip()
+                    if not line:
+                        continue
+                    try:
+                        record = json.loads(line)
+                        record_phone = record.get("phone")
+                        if not record_phone:
+                            continue
+                        # 使用最新的记录（后面的覆盖前面的）
+                        phone_tokens[record_phone] = record
+                    except json.JSONDecodeError:
+                        continue
+
+            # 过滤掉已过期和已登出的 token
+            valid_tokens = {}
+            for p, record in phone_tokens.items():
+                # 检查是否登出
+                if record.get("action") == "logout":
+                    continue
+                # 检查是否过期
+                if time.time() > record.get("expiresAt", 0):
+                    continue
+                valid_tokens[p] = record
+
+            # 更新缓存
+            self._evol_tokens_cache = valid_tokens
+            self._evol_tokens_cache_time = now
+
+            return valid_tokens.get(phone)
+
+        except Exception:
+            return None
+
+    def update_evol_token_usage(self, phone: str):
+        """更新 Evol Token 使用时间（超过 1 天才记录）"""
+        latest_record = self.get_evol_token(phone)
+        if not latest_record:
+            return
+
+        now = time.time()
+        last_used = latest_record.get("lastUsedAt", 0)
+
+        # 如果距离上次使用不到 1 天，不记录
+        if now - last_used < self.token_update_interval:
+            return
+
+        # 追加使用记录
+        record = {
+            "phone": phone,
+            "token": latest_record.get("token"),
+            "action": "used",
+            "obtainedAt": latest_record.get("obtainedAt"),
+            "obtainedAt_human": latest_record.get("obtainedAt_human"),
+            "expiresAt": latest_record.get("expiresAt"),
+            "expiresAt_human": latest_record.get("expiresAt_human"),
+            "lastUsedAt": now,
+            "lastUsedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "userInfo": latest_record.get("userInfo", {}),
+            "accountInfo": latest_record.get("accountInfo", {}),
+            "teamInfo": latest_record.get("teamInfo", {}),
+            "gatewayInfo": latest_record.get("gatewayInfo", {}),
+            "timestamp": now
+        }
+
+        self._append_evol_record(record)
+        # 清除缓存
+        self._evol_tokens_cache = {}
+        self._evol_tokens_cache_time = 0
+
+    def _append_evol_record(self, record: dict):
+        """追加 Evol Token 记录到 JSONL"""
+        try:
+            with open(self.evol_tokens_file, "a", encoding="utf-8") as f:
+                f.write(json.dumps(record, ensure_ascii=False) + "\n")
+        except Exception as e:
+            print(f"[auth] Failed to append evol token record: {e}")
+
+    def revoke_evol_token(self, phone: str):
+        """吊销 Evol Token（追加 logout 记录）"""
+        latest_record = self.get_evol_token(phone)
+        if not latest_record:
+            return
+
+        now = time.time()
+        record = {
+            "phone": phone,
+            "token": latest_record.get("token"),
+            "action": "logout",
+            "obtainedAt": latest_record.get("obtainedAt"),
+            "obtainedAt_human": latest_record.get("obtainedAt_human"),
+            "expiresAt": latest_record.get("expiresAt"),
+            "expiresAt_human": latest_record.get("expiresAt_human"),
+            "lastUsedAt": now,
+            "lastUsedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "userInfo": latest_record.get("userInfo", {}),
+            "accountInfo": latest_record.get("accountInfo", {}),
+            "teamInfo": latest_record.get("teamInfo", {}),
+            "gatewayInfo": latest_record.get("gatewayInfo", {}),
+            "timestamp": now
+        }
+
+        self._append_evol_record(record)
+        # 精确移除缓存中的该 phone（而非清除整个缓存）
+        if self._evol_tokens_cache and phone in self._evol_tokens_cache:
+            self._evol_tokens_cache.pop(phone)
+
+    def revoke_evol_token_by_token(self, token: str):
+        """通过 token 吊销 Evol Token（查找对应的 phone 后调用 revoke_evol_token）"""
+        if not os.path.exists(self.evol_tokens_file):
+            raise ValueError("Token not found")
+
+        # 查找 token 对应的 phone
+        phone = None
+        try:
+            with open(self.evol_tokens_file, "r", encoding="utf-8") as f:
+                for line in f:
+                    line = line.strip()
+                    if not line:
+                        continue
+                    try:
+                        record = json.loads(line)
+                        if hmac.compare_digest(record.get("token", "").encode(), token.encode()):
+                            phone = record.get("phone")
+                            break
+                    except json.JSONDecodeError:
+                        continue
+        except Exception:
+            raise ValueError("Failed to read token file")
+
+        if not phone:
+            raise ValueError("Token not found")
+
+        # 调用现有的吊销方法
+        self.revoke_evol_token(phone)
+
+    def generate_kite_token(self, device_info: dict, trust_level: str = "medium") -> str:
+        """生成 Kite Token 并追加到 JSONL
+
+        Args:
+            device_info: 设备信息
+            trust_level: 信任等级（high/medium/low），根据认证方式自动分级：
+                         pairing_code=high, kite_token=medium, oauth=medium
+        """
+        token = "kite_" + secrets.token_urlsafe(32)
+        now = time.time()
+        sliding_expires = now + self.kite_token_ttl
+        absolute_expires = now + self.kite_token_absolute_ttl
+
+        record = {
+            "token": token,
+            "deviceId": device_info.get("deviceId", "unknown"),
+            "deviceName": device_info.get("deviceName", "Unknown Device"),
+            "phone": None,  # 初始未绑定手机号
+            "action": "created",
+            "trustLevel": trust_level,
+            "createdAt": now,
+            "createdAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "lastUsedAt": now,
+            "lastUsedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "expiresAt": sliding_expires,
+            "expiresAt_human": datetime.fromtimestamp(sliding_expires, timezone.utc).isoformat(),
+            "absoluteExpiresAt": absolute_expires,
+            "absoluteExpiresAt_human": datetime.fromtimestamp(absolute_expires, timezone.utc).isoformat(),
+            "isValid": True,
+            "timestamp": now
+        }
+
+        # 追加到 JSONL
+        self._append_token_record(record)
+        # 清除缓存
+        self._kite_tokens_cache = None
+        self._kite_tokens_cache_time = 0
+
+        return token
+
+    def verify_kite_token(self, token: str) -> bool:
+        """验证 Kite Token 并更新使用时间（超过 1 天才记录）"""
+        latest_tokens = self._get_latest_tokens()
+        now = time.time()
+
+        token_info = latest_tokens.get(token)
+        if not token_info:
+            return False
+
+        if not token_info.get("isValid", True):
+            return False
+
+        # 检查滑动过期
+        if now > token_info.get("expiresAt", 0):
+            return False
+
+        # 检查绝对过期（兼容旧 token：无 absoluteExpiresAt 则跳过）
+        absolute_expires = token_info.get("absoluteExpiresAt")
+        if absolute_expires and now > absolute_expires:
+            return False
+
+        # 检查距离上次使用是否超过 1 天
+        last_used = token_info.get("lastUsedAt", 0)
+        if now - last_used < self.token_update_interval:
+            # 不到 1 天，不记录
+            return True
+
+        # 续期：滑动 30 天，但不超过绝对上限
+        sliding_expires = now + self.kite_token_ttl
+        if absolute_expires:
+            sliding_expires = min(sliding_expires, absolute_expires)
+
+        record = {
+            "token": token,
+            "deviceId": token_info.get("deviceId"),
+            "deviceName": token_info.get("deviceName"),
+            "phone": token_info.get("phone"),  # 保留绑定的手机号
+            "action": "used",
+            "trustLevel": token_info.get("trustLevel", "medium"),
+            "createdAt": token_info.get("createdAt"),
+            "createdAt_human": token_info.get("createdAt_human"),
+            "lastUsedAt": now,
+            "lastUsedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "expiresAt": sliding_expires,
+            "expiresAt_human": datetime.fromtimestamp(sliding_expires, timezone.utc).isoformat(),
+            "absoluteExpiresAt": token_info.get("absoluteExpiresAt"),
+            "absoluteExpiresAt_human": token_info.get("absoluteExpiresAt_human"),
+            "isValid": True,
+            "timestamp": now
+        }
+        self._append_token_record(record)
+        # 清除缓存
+        self._kite_tokens_cache = None
+        self._kite_tokens_cache_time = 0
+
+        return True
+
+    def revoke_kite_token(self, token: str):
+        """吊销 Kite Token"""
+        latest_tokens = self._get_latest_tokens()
+        token_info = latest_tokens.get(token)
+
+        if not token_info:
+            return
+
+        now = time.time()
+        record = {
+            "token": token,
+            "deviceId": token_info.get("deviceId"),
+            "deviceName": token_info.get("deviceName"),
+            "phone": token_info.get("phone"),  # 保留绑定的手机号
+            "action": "revoked",
+            "trustLevel": token_info.get("trustLevel", "medium"),
+            "createdAt": token_info.get("createdAt"),
+            "createdAt_human": token_info.get("createdAt_human"),
+            "lastUsedAt": token_info.get("lastUsedAt"),
+            "lastUsedAt_human": token_info.get("lastUsedAt_human"),
+            "expiresAt": token_info.get("expiresAt"),
+            "expiresAt_human": token_info.get("expiresAt_human"),
+            "absoluteExpiresAt": token_info.get("absoluteExpiresAt"),
+            "absoluteExpiresAt_human": token_info.get("absoluteExpiresAt_human"),
+            "isValid": False,
+            "timestamp": now
+        }
+        self._append_token_record(record)
+        # 精确移除缓存中的该 token（而非清除整个缓存）
+        if self._kite_tokens_cache and token in self._kite_tokens_cache:
+            self._kite_tokens_cache.pop(token)
+
+    def bind_kite_token_to_phone(self, token: str, phone: str):
+        """绑定 Kite Token 到手机号"""
+        latest_tokens = self._get_latest_tokens()
+        token_info = latest_tokens.get(token)
+
+        if not token_info:
+            raise ValueError(f"Token not found: {token}")
+
+        # 如果已经绑定到同一个手机号，不需要重复记录
+        existing_phone = token_info.get("phone") or ""
+        if existing_phone and hmac.compare_digest(existing_phone.encode(), phone.encode()):
+            return
+
+        now = time.time()
+        record = {
+            "token": token,
+            "deviceId": token_info.get("deviceId"),
+            "deviceName": token_info.get("deviceName"),
+            "phone": phone,  # 绑定手机号
+            "action": "bound",
+            "trustLevel": token_info.get("trustLevel", "medium"),
+            "createdAt": token_info.get("createdAt"),
+            "createdAt_human": token_info.get("createdAt_human"),
+            "lastUsedAt": now,
+            "lastUsedAt_human": datetime.fromtimestamp(now, timezone.utc).isoformat(),
+            "expiresAt": token_info.get("expiresAt"),
+            "expiresAt_human": token_info.get("expiresAt_human"),
+            "absoluteExpiresAt": token_info.get("absoluteExpiresAt"),
+            "absoluteExpiresAt_human": token_info.get("absoluteExpiresAt_human"),
+            "isValid": token_info.get("isValid", True),
+            "timestamp": now
+        }
+        self._append_token_record(record)
+        # 清除缓存
+        self._kite_tokens_cache = None
+        self._kite_tokens_cache_time = 0
+
+    def get_phone_by_kite_token(self, token: str) -> Optional[str]:
+        """根据 Kite Token 获取绑定的手机号"""
+        latest_tokens = self._get_latest_tokens()
+        token_info = latest_tokens.get(token)
+
+        if not token_info:
+            return None
+
+        return token_info.get("phone")
+
+    def list_all_evol_tokens(self) -> list:
+        """列出所有有效的 Evol Token（用于前端显示）"""
+        if not os.path.exists(self.evol_tokens_file):
+            return []
+
+        try:
+            # 按 phone 分组，保留每个 phone 的最新记录
+            phone_tokens = {}
+            with open(self.evol_tokens_file, "r", encoding="utf-8") as f:
+                for line in f:
+                    line = line.strip()
+                    if not line:
+                        continue
+                    try:
+                        record = json.loads(line)
+                        record_phone = record.get("phone")
+                        if not record_phone:
+                            continue
+                        # 使用最新的记录（后面的覆盖前面的）
+                        phone_tokens[record_phone] = record
+                    except json.JSONDecodeError:
+                        continue
+
+            # 过滤掉已过期和已登出的 token，返回列表
+            valid_tokens = []
+            for phone, record in phone_tokens.items():
+                # 检查是否登出
+                if record.get("action") == "logout":
+                    continue
+                # 检查是否过期
+                if time.time() > record.get("expiresAt", 0):
+                    continue
+                valid_tokens.append(record)
+
+            return valid_tokens
+
+        except Exception:
+            return []
+
+    def list_devices(self, current_token: str) -> list:
+        """列出所有已配对设备"""
+        latest_tokens = self._get_latest_tokens()
+        devices = []
+
+        for token, info in latest_tokens.items():
+            devices.append({
+                "deviceId": info.get("deviceId"),
+                "deviceName": info.get("deviceName"),
+                "trustLevel": info.get("trustLevel", "medium"),
+                "createdAt": info.get("createdAt"),
+                "lastUsedAt": info.get("lastUsedAt"),
+                "expiresAt": info.get("expiresAt"),
+                "isValid": info.get("isValid", True),
+                "isCurrent": token == current_token
+            })
+
+        return devices
+
+    def _get_latest_tokens(self) -> dict:
+        """
+        获取所有 Token 的最新状态（带缓存）
+
+        Returns:
+            {token: latest_record} 字典
+        """
+        now = time.time()
+
+        # 检查缓存是否有效
+        if self._kite_tokens_cache and (now - self._kite_tokens_cache_time < self.cache_ttl):
+            return self._kite_tokens_cache
+
+        # 从文件读取
+        if not os.path.exists(self.kite_tokens_file):
+            return {}
+
+        tokens = {}
+        try:
+            with open(self.kite_tokens_file, "r", encoding="utf-8") as f:
+                for line in f:
+                    line = line.strip()
+                    if not line:
+                        continue
+
+                    try:
+                        record = json.loads(line)
+                        token = record.get("token")
+                        if token:
+                            # 使用最新的记录（后面的覆盖前面的）
+                            tokens[token] = record
+                    except json.JSONDecodeError:
+                        continue
+        except Exception:
+            return {}
+
+        # 更新缓存
+        self._kite_tokens_cache = tokens
+        self._kite_tokens_cache_time = now
+
+        return tokens
+
+    def _append_token_record(self, record: dict):
+        """追加 Token 记录到 JSONL"""
+        try:
+            with open(self.kite_tokens_file, "a", encoding="utf-8") as f:
+                f.write(json.dumps(record, ensure_ascii=False) + "\n")
+        except Exception as e:
+            print(f"[auth] Failed to append token record: {e}")
+
+    # ── JSONL 月度归档 ──
+
+    def archive_old_records(self):
+        """
+        归档旧记录：将非当月的记录移到 archive/YYYY-MM.jsonl.gz。
+        主文件只保留当月数据 + 每个 token/phone 的最新状态快照。
+        """
+        import gzip
+
+        current_month = datetime.now().strftime("%Y-%m")
+
+        for jsonl_file in [self.kite_tokens_file, self.evol_tokens_file]:
+            if not os.path.exists(jsonl_file):
+                continue
+
+            try:
+                # 读取所有记录
+                all_records = []
+                with open(jsonl_file, "r", encoding="utf-8") as f:
+                    for line in f:
+                        line = line.strip()
+                        if line:
+                            try:
+                                all_records.append(json.loads(line))
+                            except json.JSONDecodeError:
+                                continue
+
+                if not all_records:
+                    continue
+
+                # 按月分组
+                monthly: dict[str, list] = {}
+                current_month_records = []
+
+                for record in all_records:
+                    ts = record.get("timestamp", 0)
+                    month = datetime.fromtimestamp(ts, timezone.utc).strftime("%Y-%m") if ts else current_month
+                    if month == current_month:
+                        current_month_records.append(record)
+                    else:
+                        monthly.setdefault(month, []).append(record)
+
+                if not monthly:
+                    continue  # 没有旧记录，无需归档
+
+                # 写入归档文件
+                archive_dir = os.path.join(self.auth_dir, "archive")
+                os.makedirs(archive_dir, exist_ok=True)
+
+                for month, records in monthly.items():
+                    archive_path = os.path.join(archive_dir, f"{month}.jsonl.gz")
+                    # 追加模式：先读取已有归档
+                    existing = []
+                    if os.path.exists(archive_path):
+                        try:
+                            with gzip.open(archive_path, "rt", encoding="utf-8") as f:
+                                for line in f:
+                                    line = line.strip()
+                                    if line:
+                                        existing.append(line)
+                        except Exception:
+                            pass
+
+                    with gzip.open(archive_path, "wt", encoding="utf-8") as f:
+                        for line in existing:
+                            f.write(line + "\n")
+                        for record in records:
+                            f.write(json.dumps(record, ensure_ascii=False) + "\n")
+
+                    print(f"[auth] Archived {len(records)} records to {month}.jsonl.gz")
+
+                # 构建最新状态快照（确保归档后不丢失 token 状态）
+                key_field = "token" if jsonl_file == self.kite_tokens_file else "phone"
+                latest_state = {}
+                for record in all_records:
+                    key = record.get(key_field)
+                    if key:
+                        latest_state[key] = record
+
+                # 重写主文件：最新状态快照 + 当月记录
+                snapshot_keys = set()
+                with open(jsonl_file, "w", encoding="utf-8") as f:
+                    # 先写快照（仅写不在当月记录中的 key）
+                    current_keys = {r.get(key_field) for r in current_month_records}
+                    for key, record in latest_state.items():
+                        if key not in current_keys:
+                            f.write(json.dumps(record, ensure_ascii=False) + "\n")
+                            snapshot_keys.add(key)
+                    # 再写当月记录
+                    for record in current_month_records:
+                        f.write(json.dumps(record, ensure_ascii=False) + "\n")
+
+                archived_count = sum(len(r) for r in monthly.values())
+                print(f"[auth] Compacted {jsonl_file}: archived {archived_count} old records, kept {len(snapshot_keys)} snapshots + {len(current_month_records)} current")
+
+            except Exception as e:
+                print(f"[auth] Archive failed for {jsonl_file}: {e}")

package/extensions/services/kite_console/config.json5

@@ -0,0 +1,19 @@
+{
+  oauth: {
+    state_mode: "memory",
+    state_ttl: "60",
+    jwt_secret: "",
+    providers: {
+      github: {
+        client_id: "",
+        client_secret: "",
+        redirect_uri: "",
+      },
+      google: {
+        client_id: "",
+        client_secret: "",
+        redirect_uri: "",
+      },
+    },
+  },
+}