@allbluecn/web-app 0.3.0

package/src/lib/anyhub/types.ts

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+export type AnyHubAppSource = "market" | "github" | "local"
+export type AnyHubAppStatus = "installing" | "ready" | "error"
+
+export interface AnyHubManifest {
+  name: string
+  displayName: string
+  description?: string
+  entryUrl: string
+  icon?: string
+  version?: string
+  capabilities: Record<string, boolean>
+}
+
+export interface AnyHubAppData {
+  id: string
+  name: string
+  displayName: string
+  description: string | null
+  version: string
+  source: AnyHubAppSource
+  url: string | null
+  localPath: string | null
+  proxyBasePath: string | null
+  iconUrl: string | null
+  pinned: boolean
+  status: AnyHubAppStatus
+  userId: string
+  githubUrl: string | null
+  createdAt: Date
+  updatedAt: Date
+  permissions?: AnyHubPermissionData[]
+}
+
+export interface AnyHubPermissionData {
+  id: string
+  appId: string
+  capability: string
+  granted: boolean
+  userId: string
+}
+
+export interface AnyHubInstallParams {
+  source: AnyHubAppSource
+  marketplaceAppId?: string
+  githubUrl?: string
+  localPath?: string
+}
+
+export interface AnyHubMarketAppData {
+  id: string
+  name: string
+  displayName: string
+  description: string | null
+  entryUrl: string
+  icon: string | null
+  category: string | null
+  tags: string | null
+  downloads: number
+  capabilities: Record<string, boolean>
+  status: string
+}
+
+export function getAnyHubBaseDir(): string {
+  return process.env.ANYHUB_DIR
+    || `${require("os").homedir()}/.anyhub`
+}

package/src/lib/auth/__tests__/sso-authorize.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    user: { findUnique: vi.fn() },
+    loginLog: { create: vi.fn().mockResolvedValue({}) },
+  },
+}))
+
+const { prisma } = await import('@allbluecn/database')
+const { resolveSsoTokenUser } = await import('../sso-authorize')
+const { signSsoToken } = await import('@/server/sso/tokens')
+
+describe('resolveSsoTokenUser', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('有效 token + ACTIVE 用户返回 user', async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      id: 'u1',
+      email: 'a@corp.com',
+      username: 'a',
+      role: 'USER',
+      status: 'ACTIVE',
+    } as never)
+    const token = signSsoToken('u1', 'w1')
+    const user = await resolveSsoTokenUser(token)
+    expect(user).toMatchObject({ id: 'u1' })
+    expect(prisma.loginLog.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ success: true, message: 'SSO' }) }),
+    )
+  })
+
+  it('无效 token 返回 null 且不查库', async () => {
+    const user = await resolveSsoTokenUser('garbage.token')
+    expect(user).toBeNull()
+    expect(prisma.user.findUnique).not.toHaveBeenCalled()
+  })
+
+  it('BANNED 用户返回 null 并记日志', async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      id: 'u1',
+      email: 'a@x.com',
+      username: 'a',
+      role: 'USER',
+      status: 'BANNED',
+    } as never)
+    const token = signSsoToken('u1', 'w1')
+    expect(await resolveSsoTokenUser(token)).toBeNull()
+    expect(prisma.loginLog.create).toHaveBeenCalledWith(
+      expect.objectContaining({ data: expect.objectContaining({ success: false }) }),
+    )
+  })
+})

package/src/lib/auth/auth-client.ts

@@ -0,0 +1 @@
+export * from '@allbluecn/ui/auth-client'

package/src/lib/auth/auth.config.ts

@@ -0,0 +1,383 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import type { StartAuthJSConfig } from 'start-authjs'
+import type { SessionUser } from '@/lib/session'
+import CredentialsProvider from '@auth/core/providers/credentials'
+import GoogleProvider from '@auth/core/providers/google'
+import { prisma } from '@allbluecn/database'
+import bcrypt from 'bcryptjs'
+import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
+import { resolveIpLocation, getClientIp } from '@allbluecn/shared'
+
+type CachedProfile = {
+  username: string
+  avatarConfig: unknown
+  bgShape: string | null
+  bgColor: string | null
+  aiProvider: string | null
+  aiModel: string | null
+  timezone: string | null
+  hasAiKey: boolean
+  locale: string | null
+}
+
+const profileCache = new Map<string, { data: CachedProfile; at: number }>()
+const PROFILE_CACHE_TTL = 30_000
+
+async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
+  const cached = profileCache.get(userId)
+  if (cached && Date.now() - cached.at < PROFILE_CACHE_TTL) return cached.data
+  try {
+    const dbUser = await prisma.user.findUnique({
+      where: { id: userId },
+      select: {
+        avatarConfig: true,
+        bgShape: true,
+        bgColor: true,
+        username: true,
+        aiProvider: true,
+        aiModel: true,
+        timezone: true,
+        aiApiKey: true,
+        locale: true,
+      },
+    })
+    if (!dbUser) return null
+    // 新表：用户启用且配置了 apiKey 的服务商也算「已配置 AI」
+    const providerConfigs = await prisma.aiProviderConfig.findMany({
+      where: { userId, enabled: true },
+      select: { apiKey: true },
+    })
+    const hasProviderConfig = providerConfigs.some((c) => !!c.apiKey)
+    const { aiApiKey, ...rest } = dbUser
+    const data: CachedProfile = { ...rest, hasAiKey: !!aiApiKey || hasProviderConfig }
+    profileCache.set(userId, { data, at: Date.now() })
+    return data
+  } catch (e) {
+    // DB 异常（如 Prisma Client 未 generate、字段缺失、连接失败）不应导致整个 session 崩溃。
+    // @auth/core 的 session action 会把 session callback 的任何异常误判为 JWTSessionError 并删除 cookie，
+    // 导致用户被登出。此处降级返回最小有效 profile，保持用户登录态。
+    console.error('[auth] getCachedProfile 查询失败，降级返回默认 profile:', e)
+    return {
+      username: '用户',
+      avatarConfig: null,
+      bgShape: 'square',
+      bgColor: '#fff',
+      aiProvider: 'openrouter',
+      aiModel: 'openai/gpt-4o-mini',
+      timezone: null,
+      hasAiKey: false,
+      locale: null,
+    }
+  }
+}
+function pickBgColor(seed: string) {
+  let hash = 0
+  for (let i = 0; i < seed.length; i++) hash = seed.charCodeAt(i) + ((hash << 5) - hash)
+  return presetBgColors[Math.abs(hash) % presetBgColors.length]
+}
+
+export const authConfig: StartAuthJSConfig = {
+  basePath: '/api/auth',
+  session: { strategy: 'jwt', maxAge: 30 * 24 * 60 * 60 },
+  pages: { signIn: '/login', error: '/login' },
+  secret: process.env.AUTH_SECRET,
+  trustHost: true,
+  cookies: {
+    sessionToken: {
+      name: 'auth.session-token',
+      options: {
+        httpOnly: true,
+        sameSite: 'lax',
+        path: '/',
+        secure: process.env.NODE_ENV === 'production',
+        domain: process.env.COOKIE_DOMAIN || undefined,
+      },
+    },
+  },
+  providers: [
+    CredentialsProvider({
+      name: 'credentials',
+      credentials: {
+        email: { label: 'Email', type: 'email' },
+        password: { label: 'Password', type: 'password' },
+        ssoToken: { label: 'SSO Token', type: 'text' },
+      },
+      async authorize(credentials, request) {
+        const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string; ssoToken?: string }
+        if (creds.ssoToken) {
+          const { resolveSsoTokenUser } = await import('./sso-authorize')
+          const user = await resolveSsoTokenUser(creds.ssoToken)
+          if (!user) return null
+          return { id: user.id, email: user.email, name: user.name, role: user.role }
+        }
+        if (!creds.email || !creds.password) return null
+
+        const user = await prisma.user.findUnique({
+          where: { email: creds.email },
+          select: { id: true, email: true, username: true, password: true, role: true, status: true },
+        })
+
+        // 用户不存在：userId 为外键，无法记录日志（保持现状）
+        if (!user) return null
+
+        // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
+        let ip: string | null = null
+        let userAgent: string | null = null
+        try {
+          const headers = request?.headers as { get?: (name: string) => string | null } | undefined
+          if (headers && typeof headers.get === 'function') {
+            ip = getClientIp(request as Request)
+            userAgent = headers.get('user-agent') || null
+          }
+        } catch {
+          // 忽略：IP/UA 仅用于日志，获取失败不影响登录
+        }
+
+        // 安全记录登录日志（DB 异常不阻塞登录流程）
+        const recordLog = async (success: boolean, message?: string, location?: string) => {
+          try {
+            await prisma.loginLog.create({
+              data: {
+                userId: user.id,
+                ip,
+                userAgent,
+                location: location ?? null,
+                success,
+                ...(message ? { message } : {}),
+              },
+            })
+          } catch (err) {
+            console.error('[auth] 记录登录日志失败:', err)
+          }
+        }
+
+        // 账号状态异常：记录失败原因
+        if (user.status === 'BANNED') {
+          await recordLog(false, '账号已封禁')
+          return null
+        }
+        if (user.status === 'INACTIVE') {
+          await recordLog(false, '账号未激活')
+          return null
+        }
+        if (user.status !== 'ACTIVE') {
+          await recordLog(false, '账号状态异常')
+          return null
+        }
+
+        const isValid = await bcrypt.compare(creds.password, user.password)
+        if (!isValid) {
+          await recordLog(false, '密码错误')
+          return null
+        }
+
+        // 登录成功：记录 IP/UA/地理位置
+        const location = await resolveIpLocation(ip)
+        await recordLog(true, undefined, location)
+        await prisma.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } })
+
+        const remember = creds.remember === 'true'
+        const stayLoggedIn = creds.stayLoggedIn === 'true'
+        return {
+          id: user.id,
+          email: user.email,
+          name: user.username,
+          role: user.role,
+          remember,
+          stayLoggedIn,
+        }
+      },
+    }),
+    ...(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET
+      ? [GoogleProvider({
+          clientId: process.env.AUTH_GOOGLE_ID,
+          clientSecret: process.env.AUTH_GOOGLE_SECRET,
+          authorization: {
+            url: 'https://accounts.google.com/o/oauth2/v2/auth',
+            params: { prompt: 'consent', access_type: 'offline', response_type: 'code' },
+          },
+          token: 'https://oauth2.googleapis.com/token',
+          userinfo: 'https://www.googleapis.com/oauth2/v3/userinfo',
+        })]
+      : []),
+  ],
+  callbacks: {
+    async signIn({ user, account, profile }) {
+      if (account?.provider === 'google') {
+        const email = profile?.email as string | undefined
+        if (!email) return false
+
+        const dbUser = await prisma.user.findUnique({ where: { email } })
+
+        if (dbUser) {
+          if (dbUser.status !== 'ACTIVE') return false
+          await prisma.$transaction(async (tx) => {
+            if (profile?.picture && profile.picture !== dbUser.image) {
+              await tx.user.update({ where: { id: dbUser.id }, data: { image: profile.picture as string } })
+            }
+            await tx.user.update({ where: { id: dbUser.id }, data: { lastLoginAt: new Date() } })
+            await tx.account.upsert({
+              where: { provider_providerAccountId: { provider: account.provider, providerAccountId: account.providerAccountId as string } },
+              update: { access_token: account.access_token as string, refresh_token: account.refresh_token as string | null },
+              create: {
+                userId: dbUser.id,
+                type: account.type,
+                provider: account.provider,
+                providerAccountId: account.providerAccountId as string,
+                access_token: account.access_token as string,
+                refresh_token: account.refresh_token as string | null,
+                expires_at: account.expires_at as number | null,
+                token_type: account.token_type as string | null,
+                scope: account.scope as string | null,
+                id_token: account.id_token as string | null,
+                session_state: account.session_state as string | null,
+              },
+            })
+          })
+          user.id = dbUser.id
+          ;(user as { role: string }).role = dbUser.role
+        } else {
+          const name = (profile?.name as string | undefined) || email.split('@')[0]
+          let username = name.replace(/[^a-zA-Z0-9_]/g, '_').toLowerCase()
+          const existing = await prisma.user.findUnique({ where: { username } })
+          if (existing) username = `${username}_${Math.random().toString(36).slice(2, 6)}`
+
+          const newUser = await prisma.$transaction(async (tx) => {
+            const u = await tx.user.create({
+              data: {
+                email,
+                username,
+                password: '',
+                role: 'USER',
+                status: 'ACTIVE',
+                image: (profile?.picture as string | undefined) ?? null,
+                emailVerified: new Date(),
+                lastLoginAt: new Date(),
+                avatarConfig: getRandomConfig(),
+                bgShape: 'square',
+                bgColor: pickBgColor(username),
+              },
+            })
+            await tx.account.upsert({
+              where: { provider_providerAccountId: { provider: account.provider, providerAccountId: account.providerAccountId as string } },
+              update: { access_token: account.access_token as string, refresh_token: account.refresh_token as string | null },
+              create: {
+                userId: u.id,
+                type: account.type,
+                provider: account.provider,
+                providerAccountId: account.providerAccountId as string,
+                access_token: account.access_token as string,
+                refresh_token: account.refresh_token as string | null,
+                expires_at: account.expires_at as number | null,
+                token_type: account.token_type as string | null,
+                scope: account.scope as string | null,
+                id_token: account.id_token as string | null,
+                session_state: account.session_state as string | null,
+              },
+            })
+            return u
+          })
+          user.id = newUser.id
+          ;(user as { role: string }).role = 'USER'
+        }
+
+        return true
+      }
+      return true
+    },
+
+    async jwt({ token, user, account, trigger }) {
+      // OAuth sign-in
+      if (account) {
+        token.id = user.id
+        token.role = (user as { role: string }).role
+        token.picture = (user as { image?: string }).image
+        token.maxAge = 30 * 24 * 60 * 60
+      }
+      // credentials sign-in
+      if (user && !account) {
+        token.role = (user as { role: string }).role
+        token.id = user.id
+        const remember = (user as { remember?: boolean }).remember
+        token.maxAge = remember ? 30 * 24 * 60 * 60 : 3 * 24 * 60 * 60
+      }
+      if (token.id && trigger === 'update') {
+        const dbUser = await prisma.user.findUnique({
+          where: { id: token.id as string },
+          select: { role: true, locale: true },
+        })
+        if (dbUser) {
+          token.role = dbUser.role
+          token.locale = dbUser.locale ?? null
+        }
+      }
+      return token
+    },
+
+    async session({ session, token }) {
+      if (session.user && token.id) {
+        const user = session.user as unknown as SessionUser
+        user.role = token.role as string
+        user.id = token.id as string
+        if (token.name) user.name = token.name as string | null
+        if (token.email) user.email = token.email as string | null
+        user.image = (token.picture as string | null) ?? null
+
+        const dbUser = await getCachedProfile(token.id as string)
+        // token 指向的用户在 DB 不存在（DB 重置 / 用户被删 + 旧 JWT 残留）
+        // 返回 user:null，触发 _nav session 校验失败 → 重定向登录页
+        if (!dbUser) {
+          return { ...session, user: null } as unknown as typeof session
+        }
+        if (dbUser.avatarConfig) {
+          user.avatarConfig = dbUser.avatarConfig as Record<string, number>
+          user.bgShape = dbUser.bgShape ?? 'square'
+          user.bgColor = dbUser.bgColor ?? '#fff'
+        } else {
+          const avatarConfig = getRandomConfig()
+          const bgColor = pickBgColor(dbUser.username ?? 'user')
+          await prisma.user.update({
+            where: { id: token.id as string },
+            data: { avatarConfig, bgShape: 'square', bgColor },
+          })
+          user.avatarConfig = avatarConfig as Record<string, number>
+          user.bgShape = 'square'
+          user.bgColor = bgColor
+        }
+        user.aiProvider = (dbUser.aiProvider as string) ?? 'openrouter'
+        user.aiModel = (dbUser.aiModel as string) ?? 'openai/gpt-4o-mini'
+        user.hasAiKey = dbUser.hasAiKey
+        user.timezone = (dbUser.timezone as string | null) ?? null
+        user.locale = (dbUser.locale as string | null) ?? null
+
+        try {
+          const sub = await prisma.subscription.findUnique({
+            where: { userId: token.id as string },
+            select: { status: true, plan: { select: { name: true } } },
+          })
+          user.planLabel =
+            sub?.status === 'ACTIVE' && sub.plan.name === 'pro' ? 'pro' : 'free'
+        } catch {
+          user.planLabel = 'free'
+        }
+      }
+      return session
+    },
+  },
+}

package/src/lib/auth/sso-authorize.ts

@@ -0,0 +1,47 @@
+import { prisma } from '@allbluecn/database'
+import { verifySsoToken } from '@/server/sso/tokens'
+
+export interface SsoAuthUser {
+  id: string
+  email: string
+  name: string
+  role: string
+}
+
+export async function resolveSsoTokenUser(ssoToken: string): Promise<SsoAuthUser | null> {
+  const payload = verifySsoToken(ssoToken)
+  if (!payload) {
+    console.error('[sso] 桥接 token 无效或已过期')
+    return null
+  }
+
+  const user = await prisma.user.findUnique({
+    where: { id: payload.userId },
+    select: { id: true, email: true, username: true, role: true, status: true },
+  })
+  if (!user) return null
+
+  const recordLog = async (success: boolean, message?: string) => {
+    try {
+      await prisma.loginLog.create({
+        data: {
+          userId: user.id,
+          ip: null,
+          userAgent: null,
+          success,
+          ...(message ? { message } : {}),
+        },
+      })
+    } catch (err) {
+      console.error('[auth] 记录 SSO 登录日志失败:', err)
+    }
+  }
+
+  if (user.status !== 'ACTIVE') {
+    await recordLog(false, `SSO 登录被拒（状态 ${user.status}）`)
+    return null
+  }
+
+  await recordLog(true, 'SSO')
+  return { id: user.id, email: user.email, name: user.username, role: user.role }
+}

package/src/lib/avatar.ts

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+const DICE_BEAR_BASE = "https://api.dicebear.com/7.x";
+
+const DICE_BEAR_STYLES = ["avataaars", "micah", "notionists", "lorelei", "adventurer"] as const;
+
+type DiceBearStyle = (typeof DICE_BEAR_STYLES)[number];
+
+export interface AvatarOptions {
+  style?: DiceBearStyle;
+  size?: number;
+  square?: boolean;
+}
+
+export function getBoringAvatarUrl(
+  seed: string,
+  options: AvatarOptions = {}
+): string {
+  const { style = "avataaars", size = 80 } = options;
+
+  return `${DICE_BEAR_BASE}/${style}/svg?seed=${encodeURIComponent(seed)}&size=${size}`;
+}
+
+export function getAvatarFallback(name: string): string {
+  return name.charAt(0).toUpperCase();
+}

package/src/lib/builtin-project.ts

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+export const BUILTIN_INDEPENDENT_DISPLAY_ID = "STORY"
+export const BUILTIN_INDEPENDENT_NAME = "独立需求"
+export const BUILTIN_INDEPENDENT_ICON = "sprout"