@agentunion/kite 1.5.0 → 1.6.1

package/extensions/services/auth/module.md

@@ -0,0 +1,31 @@
+---
+name: auth
+display_name: Auth
+version: '1.0'
+type: service
+state: enabled
+max_connections: 3
+runtime: python
+entry: entry.py
+events:
+- auth.success
+- auth.failed
+- auth.code_generated
+- auth.token.created
+- auth.token.revoked
+subscriptions:
+- module.ready
+- module.shutdown
+monitor: true
+---
+# Auth（认证模块）
+
+纯 RPC 认证服务，负责配对码验证、Kite Token 管理和审计。
+
+## RPC 方法
+
+- `auth.verify` — 统一认证入口，根据 method 分发到各 verifier
+- `auth.request_pairing_code` — 生成配对码
+- `auth.list_tokens` — 列出所有 Kite Token
+- `auth.revoke_token` — 撤销指定 Token
+- `auth.get_supported_methods` — 返回支持的认证方式列表

package/extensions/services/auth/token_store.py

@@ -0,0 +1,185 @@
+"""
+Token 元数据持久化（JSONL）
+
+负责 Kite Token 的创建、验证、续期、撤销和列表。
+零共享代码依赖 - 独立实现。
+"""
+
+import hmac
+import json
+import os
+import secrets
+import time
+from datetime import datetime, timezone
+from typing import Optional
+
+
+class TokenStore:
+    """Kite Token 持久化存储"""
+
+    def __init__(self, data_dir: str):
+        """
+        Args:
+            data_dir: 数据目录（如 {KITE_INSTANCE_DIR}/auth/data）
+        """
+        self.data_dir = data_dir
+        os.makedirs(data_dir, exist_ok=True)
+        self._tokens_file = os.path.join(data_dir, "kite_tokens.jsonl")
+
+        self.token_ttl = 30 * 24 * 3600          # 30 天滑动窗口
+        self.token_absolute_ttl = 180 * 24 * 3600 # 180 天绝对上限
+        self.update_interval = 24 * 3600           # 1 天更新间隔
+
+        # 内存缓存: {token_str: record}
+        self._cache: Optional[dict] = None
+        self._cache_time: float = 0
+        self._cache_ttl: float = 3600  # 1 小时
+
+    def create_token(self, auth_method: str, client_info: dict,
+                     trust_level: str = "low", role: str = "admin") -> str:
+        """
+        创建新的 Kite Token。
+
+        Returns:
+            token 字符串
+        """
+        token = "kite_" + secrets.token_urlsafe(32)
+        now = time.time()
+        sliding_expires = now + self.token_ttl
+        absolute_expires = now + self.token_absolute_ttl
+
+        record = {
+            "token": token,
+            "device_id": client_info.get("device_id", "unknown"),
+            "device_name": client_info.get("device_name", "Unknown Device"),
+            "auth_method": auth_method,
+            "role": role,
+            "trust_level": trust_level,
+            "phone": client_info.get("phone"),
+            "action": "created",
+            "is_valid": True,
+            "created_at": now,
+            "last_used_at": now,
+            "expires_at": sliding_expires,
+            "absolute_expires_at": absolute_expires,
+            "timestamp": now,
+        }
+
+        self._append_record(record)
+        self._invalidate_cache()
+        return token
+
+    def get_valid_token(self, token: str) -> Optional[dict]:
+        """获取有效的 token 信息，无效返回 None。"""
+        tokens = self._load_latest()
+        info = tokens.get(token)
+        if info is None:
+            return None
+        if not info.get("is_valid", True):
+            return None
+        now = time.time()
+        if now > info.get("expires_at", 0):
+            return None
+        abs_exp = info.get("absolute_expires_at")
+        if abs_exp and now > abs_exp:
+            return None
+        return info
+
+    def touch(self, token: str):
+        """更新 token 使用时间（超过 1 天才写入记录）。"""
+        tokens = self._load_latest()
+        info = tokens.get(token)
+        if info is None:
+            return
+        now = time.time()
+        last_used = info.get("last_used_at", 0)
+        if now - last_used < self.update_interval:
+            return
+        # 续期滑动窗口
+        sliding_expires = now + self.token_ttl
+        abs_exp = info.get("absolute_expires_at")
+        if abs_exp:
+            sliding_expires = min(sliding_expires, abs_exp)
+        record = {**info, "action": "used", "last_used_at": now,
+                  "expires_at": sliding_expires, "timestamp": now}
+        self._append_record(record)
+        self._invalidate_cache()
+
+    def revoke(self, token: str) -> bool:
+        """撤销 token。返回是否找到并撤销。"""
+        tokens = self._load_latest()
+        info = tokens.get(token)
+        if info is None:
+            return False
+        record = {**info, "action": "revoked", "is_valid": False,
+                  "timestamp": time.time()}
+        self._append_record(record)
+        self._invalidate_cache()
+        return True
+
+    def list_tokens(self) -> list:
+        """列出所有有效的 Kite Token（用于管理界面）。"""
+        tokens = self._load_latest()
+        now = time.time()
+        result = []
+        for token_str, info in tokens.items():
+            if not info.get("is_valid", True):
+                continue
+            if now > info.get("expires_at", 0):
+                continue
+            abs_exp = info.get("absolute_expires_at")
+            if abs_exp and now > abs_exp:
+                continue
+            result.append({
+                "token": token_str,
+                "token_prefix": token_str[:10] + "...",
+                "device_id": info.get("device_id"),
+                "device_name": info.get("device_name"),
+                "auth_method": info.get("auth_method"),
+                "role": info.get("role"),
+                "trust_level": info.get("trust_level"),
+                "phone": info.get("phone"),
+                "created_at": info.get("created_at"),
+                "last_used_at": info.get("last_used_at"),
+                "expires_at": info.get("expires_at"),
+            })
+        return result
+
+    def _load_latest(self) -> dict:
+        """加载所有 token 的最新状态（带缓存）。"""
+        now = time.time()
+        if self._cache is not None and (now - self._cache_time < self._cache_ttl):
+            return self._cache
+        if not os.path.exists(self._tokens_file):
+            return {}
+        tokens = {}
+        try:
+            with open(self._tokens_file, "r", encoding="utf-8") as f:
+                for line in f:
+                    line = line.strip()
+                    if not line:
+                        continue
+                    try:
+                        record = json.loads(line)
+                        t = record.get("token")
+                        if t:
+                            tokens[t] = record
+                    except json.JSONDecodeError:
+                        continue
+        except Exception:
+            return {}
+        self._cache = tokens
+        self._cache_time = now
+        return tokens
+
+    def _append_record(self, record: dict):
+        """追加记录到 JSONL。"""
+        try:
+            with open(self._tokens_file, "a", encoding="utf-8") as f:
+                f.write(json.dumps(record, ensure_ascii=False) + "\n")
+        except Exception as e:
+            print(f"[auth] Failed to append token record: {e}")
+
+    def _invalidate_cache(self):
+        self._cache = None
+        self._cache_time = 0

package/extensions/services/auth/verifiers/evol_account.py

@@ -0,0 +1,101 @@
+"""
+Evol 账号验证器（手机号 + 短信验证码）
+
+调用 Evol 云端 API 完成验证：
+- send_sms_code(phone) → 发送短信验证码
+- verify(phone, code) → 验证手机号 + 验证码
+
+零共享代码依赖 - 独立实现。
+"""
+
+import re
+import time
+from typing import Optional
+
+import httpx
+
+
+EVOL_API_BASE = "https://api.evolai.cn:8550"
+
+
+class EvolAccountVerifier:
+    """Evol 手机号验证器"""
+
+    def __init__(self, base_url: str = EVOL_API_BASE, timeout: float = 30.0):
+        self.base_url = base_url
+        self.timeout = timeout
+        # 速率限制: {phone: last_send_time}
+        self._sms_cooldown: dict[str, float] = {}
+        self.sms_cooldown_seconds = 60  # 60 秒冷却
+
+    def _validate_phone(self, phone: str) -> bool:
+        """验证中国大陆手机号格式"""
+        return bool(re.match(r'^1[3-9]\d{9}$', phone))
+
+    async def send_sms_code(self, phone: str) -> dict:
+        """
+        发送短信验证码。
+
+        Returns:
+            {"success": True/False, "msg": "...", "ttl": 60}
+        """
+        if not self._validate_phone(phone):
+            return {"success": False, "msg": "手机号格式无效"}
+
+        # 速率限制检查
+        now = time.time()
+        last_send = self._sms_cooldown.get(phone, 0)
+        if now - last_send < self.sms_cooldown_seconds:
+            remaining = int(self.sms_cooldown_seconds - (now - last_send))
+            return {"success": False, "msg": f"请{remaining}秒后重试"}
+
+        url = f"{self.base_url}/api/auth/sms/send"
+        data = {"phone": phone, "codeType": "LOGIN"}
+
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(url, json=data)
+                result = response.json()
+
+                if result.get("code") == 200:
+                    self._sms_cooldown[phone] = now
+                    masked = phone[:3] + "****" + phone[-4:]
+                    print(f"[auth] 短信验证码已发送到 {masked}")
+                    return {"success": True, "msg": "验证码发送成功", "ttl": self.sms_cooldown_seconds}
+                else:
+                    return {"success": False, "msg": result.get("msg", "发送失败")}
+        except Exception as e:
+            print(f"[auth] 发送短信失败: {e}")
+            return {"success": False, "msg": f"网络错误: {e}"}
+
+    async def verify(self, phone: str, code: str) -> Optional[dict]:
+        """
+        验证手机号 + 验证码。
+
+        Returns:
+            成功返回 {"role": "admin", "phone": "138xxxx"}, 失败返回 None
+        """
+        if not self._validate_phone(phone):
+            return None
+
+        if not code or len(code) < 4:
+            return None
+
+        url = f"{self.base_url}/api/auth/sms/login"
+        data = {"phone": phone, "code": code, "source": "WEB"}
+
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(url, json=data)
+                result = response.json()
+
+                if result.get("code") == 200:
+                    masked = phone[:3] + "****" + phone[-4:]
+                    print(f"[auth] Evol 账号验证成功: {masked}")
+                    return {"role": "admin", "phone": phone}
+                else:
+                    print(f"[auth] Evol 账号验证失败: {result.get('msg', '未知错误')}")
+                    return None
+        except Exception as e:
+            print(f"[auth] Evol 账号验证异常: {e}")
+            return None

package/extensions/services/auth/verifiers/kite_token.py

@@ -0,0 +1,38 @@
+"""
+Kite Token 验证器
+
+负责 Kite Token 的验证逻辑，依赖 TokenStore 做持久化。
+零共享代码依赖 - 独立实现。
+"""
+
+from typing import Optional
+
+
+class KiteTokenVerifier:
+    """Kite Token 验证器"""
+
+    def __init__(self, token_store):
+        """
+        Args:
+            token_store: TokenStore 实例
+        """
+        self._store = token_store
+
+    def verify(self, token: str) -> Optional[dict]:
+        """
+        验证 Kite Token。
+
+        Returns:
+            成功返回 {"role": str, "trust_level": str, "device_id": str}
+            失败返回 None
+        """
+        info = self._store.get_valid_token(token)
+        if info is None:
+            return None
+        # 更新 last_used
+        self._store.touch(token)
+        return {
+            "role": info.get("role", "admin"),
+            "trust_level": info.get("trust_level", "low"),
+            "device_id": info.get("device_id", "unknown"),
+        }

package/extensions/services/auth/verifiers/pairing_code.py

@@ -0,0 +1,71 @@
+"""
+配对码验证器
+
+负责配对码的生成、验证和消费。
+零共享代码依赖 - 独立实现，不依赖 kite_console。
+"""
+
+import secrets
+import string
+import time
+from typing import Optional
+
+
+class PairingCodeVerifier:
+    """配对码验证器"""
+
+    def __init__(self, code_length: int = 6, code_ttl: int = 300, max_pending_codes: int = 3):
+        """
+        Args:
+            code_length: 配对码长度（默认 6）
+            code_ttl: 配对码有效期（秒，默认 300 = 5 分钟）
+            max_pending_codes: 同时有效码上限（默认 3）
+        """
+        self.code_length = code_length
+        self.code_ttl = code_ttl
+        self.max_pending_codes = max_pending_codes
+        # {code: {"role": str, "created_at": float}}
+        self._pending_codes: dict[str, dict] = {}
+
+    def generate(self, role: str = "admin") -> str:
+        """生成临时配对码。"""
+        self._cleanup_expired()
+        if len(self._pending_codes) >= self.max_pending_codes:
+            raise RuntimeError("Too many pending codes")
+        code = self._make_code()
+        self._pending_codes[code] = {
+            "role": role,
+            "created_at": time.time(),
+        }
+        return code
+
+    def verify(self, code: str) -> Optional[dict]:
+        """
+        验证并消费配对码（一次性使用）。
+
+        Returns:
+            成功返回 {"role": str}，失败返回 None
+        """
+        self._cleanup_expired()
+        info = self._pending_codes.get(code)
+        if info is None:
+            return None
+        if time.time() - info["created_at"] > self.code_ttl:
+            del self._pending_codes[code]
+            return None
+        # 一次性消费
+        del self._pending_codes[code]
+        return {"role": info["role"]}
+
+    def _make_code(self) -> str:
+        chars = string.ascii_uppercase + string.digits
+        return "".join(secrets.choice(chars) for _ in range(self.code_length))
+
+    def _cleanup_expired(self):
+        now = time.time()
+        expired = [
+            c for c, info in self._pending_codes.items()
+            if now - info["created_at"] > self.code_ttl
+        ]
+        for c in expired:
+            del self._pending_codes[c]