@blod-nm/user-kit 0.1.6 → 0.1.8

package/src/token-broker.js

@@ -1,62 +0,0 @@
-/**
- * token-broker.js — 官方 token 托管（单飞刷新 · spec §3.6 · §3.7）
- *
- * 职责: get(uid) 查 __user_token_cache → 未过期直返；过期则单飞刷新（实例内 Map<uid, Promise>）→ 回写；
- *       upsert(uid, access_token, refresh_token, expiresAt) 供登录收尾落库；markInvalid(uid) 删行。
- * 失败语义: 刷新失败/无行 → 删行 + 401「官方凭证已失效，请重新登录」（fail-closed，refresh_token 不出域）。
- * 接缝: runSql=kit.ctx.run('pg.exec',…) 封装（§3.7 唯一表读写入口；未来换后端只换适配器）。
- * 禁止: 档案表（__user_access_key）读写——那是 access-key.js 的地盘。
- */
-const SQL_SELECT = 'SELECT uid, access_token, refresh_token, expires_at FROM __user_token_cache WHERE uid=$1'
-const SQL_UPSERT = `INSERT INTO __user_token_cache (uid, access_token, refresh_token, expires_at)
-     VALUES ($1, $2, $3, $4)
-     ON CONFLICT (uid) DO UPDATE SET access_token = EXCLUDED.access_token,
-       refresh_token = EXCLUDED.refresh_token, expires_at = EXCLUDED.expires_at, updated_at = now()`
-const SQL_DELETE = 'DELETE FROM __user_token_cache WHERE uid=$1'
-
-const err = (code, message) => Object.assign(new Error(message), { code })
-const nowSec = () => Math.floor(Date.now() / 1000)
-
-/** pg 适配器：全包唯一表读写接缝（kit.ctx.run('pg.exec') + cloudbase_postgres 角色） */
-export const makeRunSql = kit => (sql, parameters = []) =>
-  kit.ctx.run('pg.exec', { sql, parameters, role: 'cloudbase_postgres' })
-
-export function createCbTokenBroker({ cfg, refreshTokenRequest, runSql }) {
-  const inflight = new Map()   // uid → Promise（实例内单飞；跨实例靠 DB 幂等写兜底）
-
-  // 单飞刷新：失败删行 + 401；成功回写（expires_at=now+expires_in）
-  async function refresh(uid, row) {
-    let res
-    try {
-      res = await refreshTokenRequest({ grant_type: 'refresh_token', refresh_token: row.refresh_token, client_id: cfg.envId })
-    } catch {
-      await runSql(SQL_DELETE, [uid]).catch(() => {})
-      throw err(401, '官方凭证已失效，请重新登录')
-    }
-    const expiresAt = nowSec() + (Number(res?.expires_in) || 0)
-    await runSql(SQL_UPSERT, [uid, res.access_token, res.refresh_token, expiresAt])
-    return { access_token: res.access_token, expires_at: expiresAt, from_cache: false }
-  }
-
-  async function get(uid) {
-    const rows = await runSql(SQL_SELECT, [uid])
-    const row = rows?.[0]
-    if (row && Number(row.expires_at) > nowSec()) {
-      return { access_token: row.access_token, expires_at: Number(row.expires_at), from_cache: true }
-    }
-    if (!row) throw err(401, '官方凭证已失效，请重新登录')   // 无行 = 从未托管/已失效，无可刷新
-    if (inflight.has(uid)) return inflight.get(uid)
-    const task = refresh(uid, row).finally(() => inflight.delete(uid))
-    inflight.set(uid, task)
-    return task
-  }
-
-  const upsert = async (uid, access_token, refresh_token, expiresAt) => {
-    await runSql(SQL_UPSERT, [uid, access_token, refresh_token, expiresAt])
-    return { uid, expires_at: expiresAt }
-  }
-
-  const markInvalid = async uid => { await runSql(SQL_DELETE, [uid]); return { uid } }
-
-  return { get, upsert, markInvalid }
-}

package/src/user.js

@@ -1,241 +0,0 @@
-/**
- * user.js — user 域能力目录（10 条）+ SQL 纯函数 + token/网关共用件（spec §3.6 · §3.9 · §3.10）
- *
- * 建档面（本地 pg）:
- *   user.upsert { uid, profile?, env? } — 建档/刷 updated_at（ns 参数化 ARRAY['uid:'||$4]::text[]，ISSUE-01）
- *   user.get { uid } — 查档（不过滤 status/deleted_at，403 判定留调用方；无行 → null）
- *   user.patchProfile { uid, patch } — 档案段更新（jsonb_set 浅合并 profile 段）；0 行 → upsert 建档 →
- *     重查 → active 未删重试一次；仍不可用 → 403「用户不可用」（tag/status/ns 形状同 upsert，不新增表）。
- *
- * schema 面（§3.11，幂等初始化；不在 createKit/登录链路隐式执行，调用方显式调）:
- *   user.schemaStatus — 只读探测（表/四索引/主键）；user.ensureSchema — 缺什么补什么（DDL 全 if not exists，
- *     每条单独 pg.exec（网关不支持多语句，实测 DATABASE_42601）；顺序：建表→主键→唯一→gin→owner/identity_type；
- *     主键仅缺失时补；DDL 失败原样抛 { code: 网关状态, payload }，不静默降级）。
- *
- * token 面（4 条，网关透传不裁剪；inject.gateway(method, path, { body, token }) 统一覆盖）:
- *   user.me — GET；user.updateBasic — POST /auth/v1/user/basic/edit（body 只发传入字段，
- *     成功 → patchProfile({ uid: verify.uidRef, patch: 可入档字段 })，verification_token 不入档）；
- *   user.changePassword PATCH /auth/v1/user/password；user.deleteMe DELETE /auth/v1/user/me。
- *
- * 硬规则（§3.3）: token 类能力入参 access_token → apikey；统一序 verify(apikey) → 401「apikey 无效」→
- *   broker.get(uid) → 官方 Bearer；**不接收调用方传 uid** 防越权。changePassword/deleteMe 不自动写档。
- *
- * 数据流: 入参（uid 校验/token 解码）→ gateway 网关原样 / build*Query → ctx.run('pg.exec',
- *         { sql, parameters, role:'cloudbase_postgres' })；网关非 2xx → { code: 网关状态, payload } 原样，
- *         网络异常 → 502「登录请求失败」。
- * 下期留白（不实现）：user.updateSection 旧接口（patchProfile 取代）/ user.bindPhone（crm_cache access_token）。
- */
-
-import { withSchemas } from './schemas.js'
-import { DDL_USER_TOKEN_CACHE, DDL_USER_ACCESS_KEY, DDL_USER_ACCESS_KEY_INDEX } from './access-key.js'
-
-const DEFAULT_DOMAIN = 'api.tcloudbasegateway.com'
-
-/* —— 共用件：JWT 不验签解码 / token 身份硬规则 / 网关错误透传 / gateway 注入缺省 —— */
-export function decodeJWT(token) {
-  try { return JSON.parse(Buffer.from(String(token).split('.')[1], 'base64url').toString('utf8')) } catch { return {} }
-}
-
-// token 类能力身份来源：uid 只认 JWT.sub（防越权）；解码失败 → 400「access_token 无效」
-export function uidFromToken(access_token) {
-  const sub = decodeJWT(access_token)?.sub
-  if (!sub) throw Object.assign(new Error('access_token 无效'), { code: 400 })
-  return sub
-}
-
-// 网关错误透传：非 2xx → { code: 网关状态, payload } 原样（不改写错误码）；无 status = 网络层 → 502
-export const throwGatewayError = e => {
-  throw e?.status
-    ? Object.assign(new Error(e.message), { code: e.status, payload: e.payload })
-    : Object.assign(new Error('登录请求失败'), { code: 502 })
-}
-
-// inject.gateway(method, path, { body, token }) — §3.8/§3.9 全部网关调用的统一注入口（缺省 kit.req + Bearer）
-export function makeGateway(cfg, kit) {
-  return cfg.inject?.gateway || ((method, path, { body, token } = {}) =>
-    kit.req(`https://${cfg.envId}.${cfg.domain || DEFAULT_DOMAIN}${path}`, {
-      method,
-      ...(body !== undefined ? { body } : {}),
-      ...(token ? { headers: { Authorization: `Bearer ${token}` } } : {}),
-    }))
-}
-
-/* —— uid 校验（建档面入口；ISSUE-01）—— */
-export const assertUid = uid => {
-  if (typeof uid !== 'string' || uid === '') throw Object.assign(new Error('缺少 uid'), { code: 400 })
-  if (uid.length > 128 || /[\u0000-\u001f\u007f]/.test(uid)) throw Object.assign(new Error('缺少 uid'), { code: 400 })
-  return uid
-}
-
-/* —— SQL 纯函数（逐字对齐现网形状）—— */
-export function buildUpsertUserQuery(uid, profile, env) {
-  return {
-    // 只 upsert data：冲突分支逐字照抄 spec §3.6（主场已实库验证；t = 本表别名）
-    sql: `INSERT INTO public.crm_user_detail AS t (ns, data, ext, tag, status)
-     VALUES (ARRAY['uid:' || $4]::text[], $1::jsonb, NULL, $2::text[] || ARRAY['from_env:'||$3]::text[], 'active')
-     ON CONFLICT (ns) WHERE (deleted_at IS NULL)
-     DO UPDATE SET
-       data = CASE WHEN EXCLUDED.data ? 'profile' THEN
-         (COALESCE(t.data,'{}'::jsonb) || EXCLUDED.data)
-         || jsonb_build_object('profile', COALESCE(t.data->'profile','{}'::jsonb) || COALESCE(EXCLUDED.data->'profile','{}'::jsonb))
-       ELSE COALESCE(t.data,'{}'::jsonb) || EXCLUDED.data END,
-       updated_at = NOW()
-     RETURNING id, data`,
-    parameters: [JSON.stringify({ profile: profile ?? {} }), [], env || 'prod', uid],
-  }
-}
-
-export function buildSelectUserQuery(uid) {
-  return {
-    sql: `SELECT id, data, status, deleted_at
-     FROM public.crm_user_detail
-     WHERE $1 = ANY(ns)
-     ORDER BY created_at ASC
-     LIMIT 1`,
-    // uid 是绑定参数值（=ANY(ns) 比较），无注入面；拼接避免模板字面量（ISSUE-01 grep 白名单）
-    parameters: ['uid:' + uid],
-  }
-}
-
-// patchProfile：profile 段内浅合并（对齐 nuxt-layer-api-user updateUserSection 语义）
-export function buildPatchProfileQuery(uid, patch) {
-  return {
-    sql: `UPDATE public.crm_user_detail
-     SET data = jsonb_set(
-           COALESCE(data, '{}'::jsonb),
-           ARRAY['profile'],
-           COALESCE(data->'profile', '{}'::jsonb) || $2::jsonb,
-           true
-         ),
-         updated_at = NOW()
-     WHERE $1 = ANY(ns)
-       AND status = 'active'
-       AND deleted_at IS NULL
-     RETURNING id, data`,
-    parameters: ['uid:' + uid, JSON.stringify(patch ?? {})],
-  }
-}
-
-/* —— schema 面（§3.11 建档表 + §3.1 两张新表；DDL 全 if not exists，先探后建）—— */
-const PROBE_TABLE = `select to_regclass('public.crm_user_detail') is not null as "table", to_regclass('public.__user_token_cache') is not null as "token_cache", to_regclass('public.__user_access_key') is not null as "access_key"`
-const PROBE_INDEXES = `select indexname from pg_indexes where schemaname='public' and tablename='crm_user_detail'`
-const PROBE_PKEY = `select 1 from pg_constraint where conrelid='public.crm_user_detail'::regclass and contype='p'`
-const DDL_TABLE = `create table if not exists public.crm_user_detail (id uuid default gen_random_uuid() not null, ns text[] not null, data jsonb default '{}'::jsonb not null, ext jsonb, tag text[] default '{}'::text[], status text default 'active' not null, created_at timestamptz default now() not null, updated_at timestamptz default now() not null, deleted_at timestamptz)`
-const DDL_PKEY = `alter table public.crm_user_detail add constraint crm_user_detail_pkey primary key (id)`   // 建表不带 pk（与 schema.full.sql 一致），仅缺失时单独补
-const DDL_INDEXES = {
-  idx_crm_user_detail_ns_unique: `create unique index if not exists idx_crm_user_detail_ns_unique on public.crm_user_detail using btree (ns) where (deleted_at is null)`,   // upsert 的 ON CONFLICT 依赖它，必须有
-  idx_crm_user_detail_ns: `create index if not exists idx_crm_user_detail_ns on public.crm_user_detail using gin (ns)`,
-  idx_crm_user_detail_owner: `create index if not exists idx_crm_user_detail_owner on public.crm_user_detail using btree (((data #>> '{identity,owner_uid}'::text[]))) where (deleted_at is null)`,
-  idx_crm_user_detail_identity_type: `create index if not exists idx_crm_user_detail_identity_type on public.crm_user_detail using btree (((data #>> '{identity,type}'::text[]))) where (deleted_at is null)`,
-}
-const INDEX_ORDER = ['idx_crm_user_detail_ns_unique', 'idx_crm_user_detail_ns', 'idx_crm_user_detail_owner', 'idx_crm_user_detail_identity_type']
-
-/* —— user 域 token 面字段表 —— */
-const EDIT_BODY = ['nickname', 'username', 'phone', 'email', 'avatar_url', 'gender', 'description', 'verification_token']
-const ARCHIVABLE = ['nickname', 'username', 'phone', 'email', 'avatar_url', 'gender', 'description']
-
-// deps（index.js 注入）: verify（apikey 裁决）/ broker（token 托管，官方 Bearer 来源）
-export function createUserAbilities(cfg, kit, deps = {}) {
-  const gateway = makeGateway(cfg, kit)
-  // 网关调用统一翻错（非 2xx 原样 / 网络 502）
-  const gw = async (method, path, opts) => { try { return await gateway(method, path, opts) } catch (e) { throwGatewayError(e) } }
-  // 凭证类统一序（§3.3）：verify(apikey) → 401 → broker.get(uid) → 官方 Bearer
-  const sessionOf = async apikey => {
-    const v = await deps.verify(apikey)
-    if (!v.ok) throw Object.assign(new Error('apikey 无效'), { code: 401 })
-    const token = await deps.broker.get(v.auth.uidRef)
-    return { uid: v.auth.uidRef, access_token: token.access_token }
-  }
-  const pg = q => kit.ctx.run('pg.exec', { sql: q.sql, parameters: q.parameters, role: 'cloudbase_postgres' })
-  // 探测：表在不在 / 四索引在不在 / 主键在不在（只读，三次 pg.exec）
-  const probe = async () => {
-    const [t, i, k] = [await pg({ sql: PROBE_TABLE, parameters: [] }), await pg({ sql: PROBE_INDEXES, parameters: [] }), await pg({ sql: PROBE_PKEY, parameters: [] })]
-    const names = new Set(i.map(r => r.indexname))
-    return {
-      table: !!t[0]?.table, tokenCache: !!t[0]?.token_cache, accessKey: !!t[0]?.access_key,
-      indexes: Object.fromEntries(INDEX_ORDER.map(n => [n, names.has(n)])), primaryKey: k.length > 0,
-    }
-  }
-
-  return withSchemas([
-    /* 建档面（本地 pg） */
-    ['user.upsert', { describe: '建档/刷 updated_at（crm_user_detail；写走 cloudbase_postgres）', run: async (args = {}) => {
-      const { uid, profile, env } = args
-      const rows = await pg(buildUpsertUserQuery(assertUid(uid), profile, env ?? cfg.env))
-      return rows?.[0] ?? null
-    } }],
-
-    ['user.get', { describe: '查档（不过滤 status/deleted_at；无行 → null）', run: async (args = {}) => {
-      const rows = await pg(buildSelectUserQuery(assertUid(args.uid)))
-      return rows?.[0] ?? null
-    } }],
-
-    ['user.patchProfile', { describe: '档案段更新（profile 浅合并；0 行→建档→重试一次→403 用户不可用）', run: async (args = {}) => {
-      const uid = assertUid(args.uid)
-      const rows = await pg(buildPatchProfileQuery(uid, args.patch))
-      if (rows?.length) return rows[0]
-      await kit.ctx.run('user.upsert', { uid })                       // 0 行 → 先建档
-      const check = await kit.ctx.run('user.get', { uid })            // 重查
-      if (check?.status === 'active' && !check.deleted_at) {
-        const rows2 = await pg(buildPatchProfileQuery(uid, args.patch)) // active 未删 → 重试一次
-        if (rows2?.length) return rows2[0]
-      }
-      throw Object.assign(new Error('用户不可用'), { code: 403 })
-    } }],
-
-    /* token 面（网关透传；身份 = apikey → verify.uidRef → broker 托管 token） */
-    ['user.me', { describe: '当前用户（资料/绑定/角色）：GET /auth/v1/user/me，网关原样', run: async ({ apikey } = {}) => {
-      const { access_token } = await sessionOf(apikey)
-      return gw('GET', '/auth/v1/user/me', { token: access_token })
-    } }],
-
-    ['user.updateBasic', { describe: '资料/手机/邮箱变更：POST /auth/v1/user/basic/edit（body 只发传入字段）→ 成功 patchProfile', run: async (args = {}) => {
-      const { uid, access_token } = await sessionOf(args.apikey)
-      const body = {}
-      for (const k of EDIT_BODY) if (args[k] !== undefined) body[k] = args[k]
-      const payload = await gw('POST', '/auth/v1/user/basic/edit', { body, token: access_token })
-      const patch = {}
-      for (const k of ARCHIVABLE) if (k in body) patch[k] = body[k]    // verification_token 不入档
-      await kit.ctx.run('user.patchProfile', { uid, patch })
-      return payload
-    } }],
-
-    ['user.changePassword', { describe: '改密（前置 reauthenticate）：PATCH /auth/v1/user/password，网关原样（不写档）', run: async (args = {}) => {
-      const { apikey, ...rest } = args
-      const { access_token } = await sessionOf(apikey)
-      return gw('PATCH', '/auth/v1/user/password', { body: rest, token: access_token })
-    } }],
-
-    ['user.deleteMe', { describe: '删号（前置 reauthenticate）：DELETE /auth/v1/user/me，网关原样（不自行标删/不写档）', run: async (args = {}) => {
-      const { apikey, ...rest } = args
-      const { access_token } = await sessionOf(apikey)
-      return gw('DELETE', '/auth/v1/user/me', { body: rest, token: access_token })
-    } }],
-
-    /* schema 面（§3.11：探测只读；补齐逐条 DDL，失败原样透传不静默降级） */
-    ['user.schemaStatus', { describe: '建档表只读探测：表/四索引/主键在位状态', run: async () => probe() }],
-
-    ['user.ensureSchema', { describe: '建档表幂等初始化：缺什么补什么（DDL 逐条 pg.exec；调用方显式执行，登录不做 DDL）', run: async () => {
-      const before = await probe()
-      const plan = []
-      if (!before.table) plan.push(DDL_TABLE)
-      if (!before.tokenCache) plan.push(DDL_USER_TOKEN_CACHE)         // §3.1 token 托管表
-      if (!before.accessKey) plan.push(DDL_USER_ACCESS_KEY, DDL_USER_ACCESS_KEY_INDEX)   // §3.1 key 档案表 + uid 索引
-      if (!before.primaryKey) plan.push(DDL_PKEY)                     // 主键仅缺失时补（alter 无 if not exists）
-      const missing = INDEX_ORDER.filter(n => !before.indexes[n])
-      for (const name of missing) plan.push(DDL_INDEXES[name])
-      for (const sql of plan) {
-        try { await pg({ sql, parameters: [] }) } catch (e) {
-          throw e?.status ? Object.assign(new Error(e.message), { code: e.status, payload: e.payload }) : e   // 原样透传
-        }
-      }
-      return {
-        table: before.table ? 'exists' : 'created',
-        tokenCache: before.tokenCache ? 'exists' : 'created',
-        accessKey: before.accessKey ? 'exists' : 'created',
-        indexes: { created: missing, existing: INDEX_ORDER.filter(n => !missing.includes(n)) },
-        status: await probe(),
-      }
-    } }],
-  ])
-}

package/src/wechat.js

@@ -1,20 +0,0 @@
-/**
- * wechat.js — 微信接口缺省实现（code2Session · 稳定叶，不在能力面待定范围）
- *
- * 职责: wx.login 的 code 换 openid/unionid/session_key（URLSearchParams 直连，不走 kit 代理）。
- * 数据流: code + cfg.wxAppid/wxSecret → GET api.weixin.qq.com/sns/jscode2session
- *         → { openid, unionid?, errcode? }；errcode 交给调用方翻译（auth 域 → {code:400, errcode, errmsg}）
- *         网络失败抛错由调用方兜底（与 nuxt-layer-api-cb-dependences/server/utils/wechat.ts 同语义）。
- */
-
-export async function code2Session(cfg, code) {
-  const params = new URLSearchParams({
-    appid: cfg.wxAppid,
-    secret: cfg.wxSecret,
-    js_code: code,
-    grant_type: 'authorization_code',
-  })
-  const res = await fetch(`https://api.weixin.qq.com/sns/jscode2session?${params}`)
-  if (!res.ok) throw new Error(`code2Session request failed with status ${res.status}`)
-  return await res.json()
-}