@agentunion/kite 1.5.0 → 1.6.0

package/extensions/services/web/mfa_totp.py

@@ -0,0 +1,77 @@
+"""
+MFA/TOTP 验证模块
+
+功能：
+- TOTP (Time-based One-Time Password) 验证
+- 密钥生成与管理
+- 支持 30 秒时间窗口 + 前后各 1 个窗口容忍
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import hashlib
+import hmac
+import struct
+import time
+import secrets
+import base64
+from typing import Optional
+
+
+class TOTPVerifier:
+    """TOTP 验证器"""
+
+    def __init__(self, window: int = 1, step: int = 30):
+        """
+        Args:
+            window: 容忍窗口数（前后各 N 个窗口）
+            step: 时间步长（秒，默认 30）
+        """
+        self.window = window
+        self.step = step
+
+    @staticmethod
+    def generate_secret() -> str:
+        """生成 Base32 编码的 TOTP 密钥"""
+        raw = secrets.token_bytes(20)
+        return base64.b32encode(raw).decode("ascii")
+
+    def generate_code(self, secret: str, timestamp: Optional[float] = None) -> str:
+        """生成当前 TOTP 码（6 位数字）"""
+        if timestamp is None:
+            timestamp = time.time()
+        counter = int(timestamp) // self.step
+        return self._hotp(secret, counter)
+
+    def verify(self, secret: str, code: str, timestamp: Optional[float] = None) -> bool:
+        """
+        验证 TOTP 码（含时间窗口容忍）。
+
+        Args:
+            secret: Base32 密钥
+            code: 用户输入的 6 位码
+            timestamp: 验证时间（默认当前时间）
+        """
+        if timestamp is None:
+            timestamp = time.time()
+        counter = int(timestamp) // self.step
+
+        for offset in range(-self.window, self.window + 1):
+            expected = self._hotp(secret, counter + offset)
+            if hmac.compare_digest(code, expected):
+                return True
+        return False
+
+    def _hotp(self, secret: str, counter: int) -> str:
+        """HOTP 算法（RFC 4226）"""
+        # 解码 Base32 密钥
+        key = base64.b32decode(secret, casefold=True)
+        # 计数器转 8 字节大端
+        msg = struct.pack(">Q", counter)
+        # HMAC-SHA1
+        digest = hmac.new(key, msg, hashlib.sha1).digest()
+        # 动态截断
+        offset = digest[-1] & 0x0F
+        code_int = struct.unpack(">I", digest[offset:offset + 4])[0] & 0x7FFFFFFF
+        # 取 6 位
+        return str(code_int % 1000000).zfill(6)

package/extensions/services/web/module.md

@@ -1,12 +1,13 @@
 ---
 name: web
-display_name: Web Management
+display_name: Web控制台
 version: '1.0'
 type: service
 state: manual
+max_connections: 3
 runtime: python
 entry: entry.py
-preferred_port: 18766
+preferred_port: 18767
 advertise_ip: 0.0.0.0
 events:
 - web.test
@@ -14,18 +15,20 @@ subscriptions:
 - module.started
 - module.stopped
 - module.shutdown
-
-# 业务配置列表
 businesses:
-  - name: web_server
-    type: http_service
-    description: Web 管理界面和 API 服务
-    config_file: web_config.json5
-
-  - name: relay_service
-    type: kernel_relay
-    description: Kernel WebSocket 中转服务
-    config_file: relay_config.json5
+- name: web_main
+  type: main_config
+  description: Web 主配置
+  config_file: config.json5
+- name: web_server
+  type: http_service
+  description: Web 管理界面和 API 服务
+  config_file: web_config.json5
+- name: relay_service
+  type: kernel_relay
+  description: Kernel WebSocket 中转服务
+  config_file: relay_config.json5
+monitor: true
 ---
 # Web Management（Web 管理界面）
 

package/extensions/services/web/nonce_pool.py

@@ -0,0 +1,113 @@
+"""
+Nonce 池管理模块
+
+功能：
+- Challenge-nonce 生成与验证（防重放攻击）
+- TTL 自动过期（默认 600 秒）
+- 容量上限保护（默认 10000）
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import secrets
+import time
+import threading
+from typing import Optional
+
+
+class NoncePool:
+    """Nonce 池（TTL 字典实现）"""
+
+    def __init__(self, max_size: int = 10000, ttl: int = 600):
+        """
+        初始化 Nonce 池。
+
+        Args:
+            max_size: 最大容量（超出时清理最旧的条目）
+            ttl: Nonce 有效期（秒，默认 600）
+        """
+        self.max_size = max_size
+        self.ttl = ttl
+        self._lock = threading.Lock()
+        # nonce -> (created_at, metadata)
+        self._pool: dict[str, tuple[float, dict]] = {}
+
+    def generate(self, metadata: Optional[dict] = None) -> str:
+        """
+        生成新的 nonce。
+
+        Args:
+            metadata: 附加元数据（如 client_ip, module_id 等）
+
+        Returns:
+            nonce 字符串
+        """
+        nonce = secrets.token_urlsafe(32)
+        now = time.time()
+
+        with self._lock:
+            # 容量保护：先清理过期的
+            self._cleanup_expired_locked(now)
+
+            # 如果仍然超出容量，移除最旧的
+            if len(self._pool) >= self.max_size:
+                self._evict_oldest_locked()
+
+            self._pool[nonce] = (now, metadata or {})
+
+        return nonce
+
+    def verify(self, nonce: str) -> Optional[dict]:
+        """
+        验证并消费 nonce（一次性使用）。
+
+        Args:
+            nonce: 待验证的 nonce
+
+        Returns:
+            如果有效，返回 metadata；否则返回 None
+        """
+        now = time.time()
+
+        with self._lock:
+            entry = self._pool.get(nonce)
+            if entry is None:
+                return None
+
+            created_at, metadata = entry
+
+            # 检查是否过期
+            if now - created_at > self.ttl:
+                del self._pool[nonce]
+                return None
+
+            # 一次性消费
+            del self._pool[nonce]
+            return metadata
+
+    def cleanup(self):
+        """手动触发过期清理"""
+        now = time.time()
+        with self._lock:
+            self._cleanup_expired_locked(now)
+
+    @property
+    def size(self) -> int:
+        """当前池大小"""
+        return len(self._pool)
+
+    def _cleanup_expired_locked(self, now: float):
+        """清理过期条目（需持有锁）"""
+        expired = [
+            n for n, (ts, _) in self._pool.items()
+            if now - ts > self.ttl
+        ]
+        for n in expired:
+            del self._pool[n]
+
+    def _evict_oldest_locked(self):
+        """移除最旧的条目（需持有锁）"""
+        if not self._pool:
+            return
+        oldest_nonce = min(self._pool, key=lambda n: self._pool[n][0])
+        del self._pool[oldest_nonce]

package/extensions/services/web/oauth_manager.py

@@ -0,0 +1,223 @@
+"""
+OAuth 认证管理模块
+
+功能：
+- OAuth state 生成与验证（内存/JWT 双模式）
+- 支持多个 OAuth 提供商（GitHub/Google/等）
+- CSRF 防护
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import hmac
+import secrets
+import time
+from typing import Optional
+
+
+class OAuthManager:
+    """OAuth 认证管理器"""
+
+    def __init__(self, state_mode: str = "memory", state_ttl: int = 60, jwt_secret: str = ""):
+        """
+        初始化 OAuth 管理器
+
+        Args:
+            state_mode: state 存储模式（"memory" 或 "jwt"）
+            state_ttl: state 有效期（秒，默认 60 秒）
+            jwt_secret: JWT 签名密钥（仅 jwt 模式需要）
+        """
+        self.state_mode = state_mode
+        self.state_ttl = state_ttl
+        self.jwt_secret = jwt_secret
+
+        # 内存模式：state -> (timestamp, provider, redirect_uri)
+        self.states: dict[str, tuple[float, str, str]] = {}
+
+        # auth_ticket 存储：ticket -> (timestamp, provider, user_info)
+        # OAuth 回调后生成一次性 ticket，供 WebSocket 客户端认证
+        self.auth_tickets: dict[str, tuple[float, str, dict]] = {}
+
+    def generate_state(self, provider: str, redirect_uri: str = "") -> str:
+        """
+        生成 OAuth state
+
+        Args:
+            provider: OAuth 提供商（github/google/等）
+            redirect_uri: 重定向 URI（可选）
+
+        Returns:
+            state 字符串
+        """
+        if self.state_mode == "jwt":
+            return self._generate_jwt_state(provider, redirect_uri)
+        else:
+            return self._generate_memory_state(provider, redirect_uri)
+
+    def verify_state(self, state: str) -> Optional[dict]:
+        """
+        验证 OAuth state
+
+        Args:
+            state: state 字符串
+
+        Returns:
+            如果有效，返回 {"provider": "...", "redirect_uri": "..."}；否则返回 None
+        """
+        if self.state_mode == "jwt":
+            return self._verify_jwt_state(state)
+        else:
+            return self._verify_memory_state(state)
+
+    def cleanup_expired_states(self):
+        """清理过期的 state（仅内存模式）"""
+        if self.state_mode != "memory":
+            return
+
+        now = time.time()
+        expired = [s for s, (ts, _, _) in self.states.items() if now - ts > self.state_ttl]
+        for s in expired:
+            del self.states[s]
+
+    # ── Auth Ticket（OAuth → WebSocket 桥接） ──
+
+    def generate_auth_ticket(self, provider: str, user_info: dict) -> str:
+        """
+        OAuth 回调成功后生成一次性 auth_ticket。
+
+        Args:
+            provider: OAuth 提供商
+            user_info: 用户信息（id, email, name 等）
+
+        Returns:
+            ticket 字符串（60 秒有效，一次性使用）
+        """
+        ticket = secrets.token_urlsafe(32)
+        self.auth_tickets[ticket] = (time.time(), provider, user_info)
+        return ticket
+
+    def verify_auth_ticket(self, ticket: str) -> Optional[dict]:
+        """
+        验证并消费 auth_ticket（一次性）。
+
+        Returns:
+            如果有效，返回 {"provider": "...", "user_info": {...}}；否则返回 None
+        """
+        if ticket not in self.auth_tickets:
+            return None
+
+        timestamp, provider, user_info = self.auth_tickets[ticket]
+
+        # 60 秒有效期
+        if time.time() - timestamp > 60:
+            del self.auth_tickets[ticket]
+            return None
+
+        # 一次性使用
+        del self.auth_tickets[ticket]
+        return {"provider": provider, "user_info": user_info}
+
+    def cleanup_expired_tickets(self):
+        """清理过期的 auth_ticket"""
+        now = time.time()
+        expired = [t for t, (ts, _, _) in self.auth_tickets.items() if now - ts > 60]
+        for t in expired:
+            del self.auth_tickets[t]
+
+    # ── 内存模式 ──
+
+    def _generate_memory_state(self, provider: str, redirect_uri: str) -> str:
+        """生成内存模式 state"""
+        state = secrets.token_urlsafe(32)
+        self.states[state] = (time.time(), provider, redirect_uri)
+        return state
+
+    def _verify_memory_state(self, state: str) -> Optional[dict]:
+        """验证内存模式 state"""
+        if state not in self.states:
+            return None
+
+        timestamp, provider, redirect_uri = self.states[state]
+        now = time.time()
+
+        # 检查是否过期
+        if now - timestamp > self.state_ttl:
+            del self.states[state]
+            return None
+
+        # 验证成功后删除（一次性使用）
+        del self.states[state]
+        return {"provider": provider, "redirect_uri": redirect_uri}
+
+    # ── JWT 模式 ──
+
+    def _generate_jwt_state(self, provider: str, redirect_uri: str) -> str:
+        """生成 JWT 模式 state"""
+        import json
+        import base64
+
+        # Payload: {"provider": "...", "redirect_uri": "...", "exp": timestamp}
+        payload = {
+            "provider": provider,
+            "redirect_uri": redirect_uri,
+            "exp": int(time.time()) + self.state_ttl
+        }
+
+        # Base64 编码 payload
+        payload_json = json.dumps(payload, separators=(',', ':'))
+        payload_b64 = base64.urlsafe_b64encode(payload_json.encode()).decode().rstrip('=')
+
+        # HMAC 签名
+        signature = hmac.new(
+            self.jwt_secret.encode(),
+            payload_b64.encode(),
+            'sha256'
+        ).hexdigest()
+
+        # 返回 payload.signature
+        return f"{payload_b64}.{signature}"
+
+    def _verify_jwt_state(self, state: str) -> Optional[dict]:
+        """验证 JWT 模式 state"""
+        import json
+        import base64
+
+        try:
+            # 分离 payload 和 signature
+            parts = state.split('.')
+            if len(parts) != 2:
+                return None
+
+            payload_b64, signature = parts
+
+            # 验证签名
+            expected_signature = hmac.new(
+                self.jwt_secret.encode(),
+                payload_b64.encode(),
+                'sha256'
+            ).hexdigest()
+
+            if not hmac.compare_digest(signature, expected_signature):
+                return None
+
+            # 解码 payload
+            # 补齐 padding
+            padding = 4 - len(payload_b64) % 4
+            if padding != 4:
+                payload_b64 += '=' * padding
+
+            payload_json = base64.urlsafe_b64decode(payload_b64).decode()
+            payload = json.loads(payload_json)
+
+            # 检查过期时间
+            exp = payload.get("exp", 0)
+            if time.time() > exp:
+                return None
+
+            return {
+                "provider": payload.get("provider", ""),
+                "redirect_uri": payload.get("redirect_uri", "")
+            }
+
+        except Exception:
+            return None

package/extensions/services/web/pairing.py

@@ -6,6 +6,7 @@
 零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
 """
 
+import hmac
 import json
 import os
 import secrets
@@ -192,12 +193,12 @@ class PairingManager:
 
         # 检查 token 是否被吊销
         for record in reversed(codes):
-            if record.get("token") == token and record.get("status") == "revoked":
+            if hmac.compare_digest(record.get("token", "").encode(), token.encode()) and record.get("status") == "revoked":
                 return None  # Token 已被吊销
 
         # 查找 token 对应的记录
         for record in reversed(codes):
-            if record.get("token") == token and record.get("status") == "used":
+            if hmac.compare_digest(record.get("token", "").encode(), token.encode()) and record.get("status") == "used":
                 # 检查是否过期
                 expires_at = record.get("expires_at")
                 if expires_at:

package/extensions/services/web/pairing_codes.jsonl

@@ -14,3 +14,4 @@
 {"code": "15Q4QJ", "role": "admin", "status": "used", "token": "tok_byVOicuvkitvDTQRuh05XQpmtAdyUineSddRCi5MHbs", "paired_at": "2026-03-05T17:38:50.616922+00:00", "expires_at": "2026-04-04T17:38:50.616932+00:00"}
 {"token": "tok_byVOicuvkitvDTQRuh05XQpmtAdyUineSddRCi5MHbs", "status": "revoked", "revoked_at": "2026-03-06T07:55:02.015491+00:00"}
 {"code": "7N5Q43", "role": "admin", "status": "used", "token": "tok_J8zYOS5OKcHkEyOzIFRD_sHbq61ngWqyoxlVQrDdhyA", "paired_at": "2026-03-06T07:55:19.446442+00:00", "expires_at": "2026-04-05T07:55:19.446452+00:00"}
+{"code": "UKDBK6", "role": "admin", "status": "used", "token": "tok_ZtFQV_U6utz-g6cpQlzoU1eP2Da6vL8nQvnAWt7bqGk", "paired_at": "2026-03-11T12:22:20.739366+00:00", "expires_at": "2026-04-10T12:22:20.739377+00:00"}