@agentunion/kite 1.4.0 → 1.6.0

package/extensions/services/kite_console/oauth_manager.py

@@ -0,0 +1,223 @@
+"""
+OAuth 认证管理模块
+
+功能：
+- OAuth state 生成与验证（内存/JWT 双模式）
+- 支持多个 OAuth 提供商（GitHub/Google/等）
+- CSRF 防护
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import hmac
+import secrets
+import time
+from typing import Optional
+
+
+class OAuthManager:
+    """OAuth 认证管理器"""
+
+    def __init__(self, state_mode: str = "memory", state_ttl: int = 60, jwt_secret: str = ""):
+        """
+        初始化 OAuth 管理器
+
+        Args:
+            state_mode: state 存储模式（"memory" 或 "jwt"）
+            state_ttl: state 有效期（秒，默认 60 秒）
+            jwt_secret: JWT 签名密钥（仅 jwt 模式需要）
+        """
+        self.state_mode = state_mode
+        self.state_ttl = state_ttl
+        self.jwt_secret = jwt_secret
+
+        # 内存模式：state -> (timestamp, provider, redirect_uri)
+        self.states: dict[str, tuple[float, str, str]] = {}
+
+        # auth_ticket 存储：ticket -> (timestamp, provider, user_info)
+        # OAuth 回调后生成一次性 ticket，供 WebSocket 客户端认证
+        self.auth_tickets: dict[str, tuple[float, str, dict]] = {}
+
+    def generate_state(self, provider: str, redirect_uri: str = "") -> str:
+        """
+        生成 OAuth state
+
+        Args:
+            provider: OAuth 提供商（github/google/等）
+            redirect_uri: 重定向 URI（可选）
+
+        Returns:
+            state 字符串
+        """
+        if self.state_mode == "jwt":
+            return self._generate_jwt_state(provider, redirect_uri)
+        else:
+            return self._generate_memory_state(provider, redirect_uri)
+
+    def verify_state(self, state: str) -> Optional[dict]:
+        """
+        验证 OAuth state
+
+        Args:
+            state: state 字符串
+
+        Returns:
+            如果有效，返回 {"provider": "...", "redirect_uri": "..."}；否则返回 None
+        """
+        if self.state_mode == "jwt":
+            return self._verify_jwt_state(state)
+        else:
+            return self._verify_memory_state(state)
+
+    def cleanup_expired_states(self):
+        """清理过期的 state（仅内存模式）"""
+        if self.state_mode != "memory":
+            return
+
+        now = time.time()
+        expired = [s for s, (ts, _, _) in self.states.items() if now - ts > self.state_ttl]
+        for s in expired:
+            del self.states[s]
+
+    # ── Auth Ticket（OAuth → WebSocket 桥接） ──
+
+    def generate_auth_ticket(self, provider: str, user_info: dict) -> str:
+        """
+        OAuth 回调成功后生成一次性 auth_ticket。
+
+        Args:
+            provider: OAuth 提供商
+            user_info: 用户信息（id, email, name 等）
+
+        Returns:
+            ticket 字符串（60 秒有效，一次性使用）
+        """
+        ticket = secrets.token_urlsafe(32)
+        self.auth_tickets[ticket] = (time.time(), provider, user_info)
+        return ticket
+
+    def verify_auth_ticket(self, ticket: str) -> Optional[dict]:
+        """
+        验证并消费 auth_ticket（一次性）。
+
+        Returns:
+            如果有效，返回 {"provider": "...", "user_info": {...}}；否则返回 None
+        """
+        if ticket not in self.auth_tickets:
+            return None
+
+        timestamp, provider, user_info = self.auth_tickets[ticket]
+
+        # 60 秒有效期
+        if time.time() - timestamp > 60:
+            del self.auth_tickets[ticket]
+            return None
+
+        # 一次性使用
+        del self.auth_tickets[ticket]
+        return {"provider": provider, "user_info": user_info}
+
+    def cleanup_expired_tickets(self):
+        """清理过期的 auth_ticket"""
+        now = time.time()
+        expired = [t for t, (ts, _, _) in self.auth_tickets.items() if now - ts > 60]
+        for t in expired:
+            del self.auth_tickets[t]
+
+    # ── 内存模式 ──
+
+    def _generate_memory_state(self, provider: str, redirect_uri: str) -> str:
+        """生成内存模式 state"""
+        state = secrets.token_urlsafe(32)
+        self.states[state] = (time.time(), provider, redirect_uri)
+        return state
+
+    def _verify_memory_state(self, state: str) -> Optional[dict]:
+        """验证内存模式 state"""
+        if state not in self.states:
+            return None
+
+        timestamp, provider, redirect_uri = self.states[state]
+        now = time.time()
+
+        # 检查是否过期
+        if now - timestamp > self.state_ttl:
+            del self.states[state]
+            return None
+
+        # 验证成功后删除（一次性使用）
+        del self.states[state]
+        return {"provider": provider, "redirect_uri": redirect_uri}
+
+    # ── JWT 模式 ──
+
+    def _generate_jwt_state(self, provider: str, redirect_uri: str) -> str:
+        """生成 JWT 模式 state"""
+        import json
+        import base64
+
+        # Payload: {"provider": "...", "redirect_uri": "...", "exp": timestamp}
+        payload = {
+            "provider": provider,
+            "redirect_uri": redirect_uri,
+            "exp": int(time.time()) + self.state_ttl
+        }
+
+        # Base64 编码 payload
+        payload_json = json.dumps(payload, separators=(',', ':'))
+        payload_b64 = base64.urlsafe_b64encode(payload_json.encode()).decode().rstrip('=')
+
+        # HMAC 签名
+        signature = hmac.new(
+            self.jwt_secret.encode(),
+            payload_b64.encode(),
+            'sha256'
+        ).hexdigest()
+
+        # 返回 payload.signature
+        return f"{payload_b64}.{signature}"
+
+    def _verify_jwt_state(self, state: str) -> Optional[dict]:
+        """验证 JWT 模式 state"""
+        import json
+        import base64
+
+        try:
+            # 分离 payload 和 signature
+            parts = state.split('.')
+            if len(parts) != 2:
+                return None
+
+            payload_b64, signature = parts
+
+            # 验证签名
+            expected_signature = hmac.new(
+                self.jwt_secret.encode(),
+                payload_b64.encode(),
+                'sha256'
+            ).hexdigest()
+
+            if not hmac.compare_digest(signature, expected_signature):
+                return None
+
+            # 解码 payload
+            # 补齐 padding
+            padding = 4 - len(payload_b64) % 4
+            if padding != 4:
+                payload_b64 += '=' * padding
+
+            payload_json = base64.urlsafe_b64decode(payload_b64).decode()
+            payload = json.loads(payload_json)
+
+            # 检查过期时间
+            exp = payload.get("exp", 0)
+            if time.time() > exp:
+                return None
+
+            return {
+                "provider": payload.get("provider", ""),
+                "redirect_uri": payload.get("redirect_uri", "")
+            }
+
+        except Exception:
+            return None

package/extensions/services/kite_console/pairing.py

@@ -0,0 +1,280 @@
+"""
+配对码管理模块
+
+负责配对码的生成、验证、使用和 frontend_token 的管理。
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import hmac
+import json
+import os
+import secrets
+import string
+import time
+from datetime import datetime, timezone
+from typing import Optional
+
+
+class PairingManager:
+    """配对码管理器"""
+
+    def __init__(self, pairing_file: str, code_length: int = 6, token_expiry: int = 2592000):
+        """
+        初始化配对码管理器。
+
+        Args:
+            pairing_file: 配对码文件路径（JSONL 格式）
+            code_length: 配对码长度（默认 6）
+            token_expiry: frontend_token 有效期（秒，默认 30 天）
+        """
+        self.pairing_file = pairing_file
+        self.code_length = code_length
+        self.token_expiry = token_expiry
+
+        # 临时配对码（未持久化）
+        self.pending_codes = {}  # {code: {"role": "admin", "created_at": timestamp}}
+
+        # 确保文件存在
+        if not os.path.exists(pairing_file):
+            os.makedirs(os.path.dirname(pairing_file), exist_ok=True)
+
+    def generate_pairing_code(self, role: str = "admin") -> str:
+        """
+        生成临时配对码（不持久化）。
+
+        Args:
+            role: 用户角色
+
+        Returns:
+            配对码
+        """
+        code = self._generate_code()
+        self.pending_codes[code] = {
+            "role": role,
+            "created_at": time.time()
+        }
+
+        # 清理过期的配对码（超过 5 分钟）
+        self._cleanup_expired_codes()
+
+        return code
+
+    def _cleanup_expired_codes(self):
+        """清理过期的临时配对码"""
+        now = time.time()
+        expired = [
+            code for code, info in self.pending_codes.items()
+            if now - info["created_at"] > 300  # 5 分钟
+        ]
+        for code in expired:
+            del self.pending_codes[code]
+
+    def _ensure_active_code(self):
+        """确保有 active 状态的配对码，如果没有则生成（已废弃）"""
+        pass
+
+    def _print_pairing_code(self, code: str, is_new: bool):
+        """在控制台绿色高亮显示配对码（已废弃，改为通过事件发送给 Launcher）"""
+        pass
+
+    def _create_initial_code(self):
+        """创建初始配对码（已废弃，由 _ensure_active_code 替代）"""
+        pass
+
+    def _generate_code(self) -> str:
+        """生成随机配对码"""
+        chars = string.ascii_uppercase + string.digits
+        return ''.join(secrets.choice(chars) for _ in range(self.code_length))
+
+    def _generate_token(self) -> str:
+        """生成 frontend_token"""
+        return "tok_" + secrets.token_urlsafe(32)
+
+    def _read_codes(self) -> list[dict]:
+        """读取所有配对码记录"""
+        if not os.path.exists(self.pairing_file):
+            return []
+
+        codes = []
+        with open(self.pairing_file, "r", encoding="utf-8") as f:
+            for line in f:
+                line = line.strip()
+                if line:
+                    try:
+                        codes.append(json.loads(line))
+                    except json.JSONDecodeError:
+                        pass
+        return codes
+
+    def _write_code(self, code_record: dict):
+        """追加配对码记录"""
+        with open(self.pairing_file, "a", encoding="utf-8") as f:
+            f.write(json.dumps(code_record, ensure_ascii=False) + "\n")
+
+    def verify_code(self, code: str) -> Optional[dict]:
+        """
+        验证配对码（包括临时配对码和持久化配对码）。
+
+        Args:
+            code: 配对码
+
+        Returns:
+            如果有效，返回配对码信息（包含 role）；否则返回 None
+        """
+        # 先检查临时配对码
+        if code in self.pending_codes:
+            info = self.pending_codes[code]
+            # 检查是否过期（5 分钟）
+            if time.time() - info["created_at"] < 300:
+                return {"code": code, "role": info["role"], "status": "pending"}
+
+        # 再检查持久化配对码（向后兼容）
+        codes = self._read_codes()
+        for record in reversed(codes):
+            if record.get("code") == code and record.get("status") == "active":
+                return record
+
+        return None
+
+    def pair(self, code: str) -> Optional[dict]:
+        """
+        使用配对码进行配对。
+
+        Args:
+            code: 配对码
+
+        Returns:
+            如果成功，返回 {"token": "...", "role": "..."}；否则返回 None
+        """
+        # 验证配对码
+        code_info = self.verify_code(code)
+        if not code_info:
+            return None
+
+        # 生成 frontend_token
+        token = self._generate_token()
+        role = code_info.get("role", "viewer")
+
+        # 持久化保存 token
+        used_record = {
+            "code": code,
+            "role": role,
+            "status": "used",
+            "token": token,
+            "paired_at": datetime.now(timezone.utc).isoformat(),
+            "expires_at": datetime.fromtimestamp(
+                time.time() + self.token_expiry, tz=timezone.utc
+            ).isoformat()
+        }
+        self._write_code(used_record)
+
+        # 从临时配对码中删除
+        if code in self.pending_codes:
+            del self.pending_codes[code]
+
+        return {
+            "token": token,
+            "role": role,
+            "expires_at": used_record["expires_at"]
+        }
+
+    def verify_token(self, token: str) -> Optional[dict]:
+        """
+        验证 frontend_token。
+
+        Args:
+            token: frontend_token
+
+        Returns:
+            如果有效，返回 {"role": "...", "expires_at": "..."}；否则返回 None
+        """
+        codes = self._read_codes()
+
+        # 检查 token 是否被吊销
+        for record in reversed(codes):
+            if hmac.compare_digest(record.get("token", "").encode(), token.encode()) and record.get("status") == "revoked":
+                return None  # Token 已被吊销
+
+        # 查找 token 对应的记录
+        for record in reversed(codes):
+            if hmac.compare_digest(record.get("token", "").encode(), token.encode()) and record.get("status") == "used":
+                # 检查是否过期
+                expires_at = record.get("expires_at")
+                if expires_at:
+                    expire_time = datetime.fromisoformat(expires_at)
+                    if datetime.now(timezone.utc) < expire_time:
+                        return {
+                            "role": record.get("role", "viewer"),
+                            "expires_at": expires_at
+                        }
+
+        return None
+
+    def renew_token(self, old_token: str) -> Optional[str]:
+        """
+        续期 frontend_token。
+
+        Args:
+            old_token: 旧的 frontend_token
+
+        Returns:
+            如果成功，返回新的 token；否则返回 None
+        """
+        # 验证旧 token
+        token_info = self.verify_token(old_token)
+        if not token_info:
+            return None
+
+        # 生成新 token
+        new_token = self._generate_token()
+        role = token_info["role"]
+
+        # 写入新 token 记录
+        new_record = {
+            "token": new_token,
+            "role": role,
+            "status": "used",
+            "renewed_from": old_token,
+            "paired_at": datetime.now(timezone.utc).isoformat(),
+            "expires_at": datetime.fromtimestamp(
+                time.time() + self.token_expiry, tz=timezone.utc
+            ).isoformat()
+        }
+        self._write_code(new_record)
+
+        return new_token
+
+    def get_active_codes(self) -> list[dict]:
+        """获取所有 active 状态的配对码"""
+        codes = self._read_codes()
+        return [c for c in codes if c.get("status") == "active"]
+
+    def revoke_token(self, token: str) -> bool:
+        """
+        吊销 frontend_token。
+
+        Args:
+            token: frontend_token
+
+        Returns:
+            如果成功吊销返回 True；如果 token 不存在或已被吊销返回 False
+        """
+        codes = self._read_codes()
+
+        # 查找 token 对应的记录
+        for record in reversed(codes):
+            if hmac.compare_digest(record.get("token", "").encode(), token.encode()):
+                if record.get("status") == "revoked":
+                    return False  # 已被吊销
+                if record.get("status") == "used":
+                    # 写入 revoked 记录
+                    revoked_record = {
+                        "token": token,
+                        "status": "revoked",
+                        "revoked_at": datetime.now(timezone.utc).isoformat()
+                    }
+                    self._write_code(revoked_record)
+                    return True
+
+        return False  # Token 不存在

package/extensions/services/kite_console/pairing_codes.jsonl

@@ -0,0 +1,2 @@
+{"code": "EAJU5I", "role": "admin", "status": "used", "token": "tok_eO59UiqTxQZvUXKPMkLzV293iwQR2EfU806I_4wjuqc", "paired_at": "2026-03-08T13:25:35.375089+00:00", "expires_at": "2026-04-07T13:25:35.375099+00:00"}
+{"code": "9TO5GS", "role": "admin", "status": "used", "token": "tok_NokwDtU2g7ezL9zI1rmpqvL-UN8SExD2XsO3_6ICtm8", "paired_at": "2026-03-10T01:32:20.271538+00:00", "expires_at": "2026-04-09T01:32:20.271560+00:00"}