@boostkit-dsh/auth-management 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 0.1.1 - 2026-09-22
+
+- 首次发布前将包名统一为 `@boostkit-dsh/auth-management`，去掉 scope 下重复的 `plugin-` 前缀。
+- 将 DSH 精确兼容基线升级为 `0.1.7-alpha.1`。
+- Client 产物改用 DSH `__ModuleLoader__` 包装，避免合并脚本中的 ESM `export` 使全部 Web Client Module 加载失败。
+
+## 0.1.0 - 2026-09-22
+
+- 增加 GitCode PAT 写入前验证、当前 `ActorRef`、登出和失效凭据清理。
+- 增加本地 JSONL 最小化审计、筛选接口和鉴权/审计管理页面。
+- 除健康检查、登录、凭据替换和登出外，所有接口要求有效 GitCode 身份。

package/README.md

@@ -0,0 +1,22 @@
+# 鉴权与审计管理
+
+`@boostkit-dsh/auth-management` 是鲲鹏 Demo 所有用户可见能力的身份前置插件。用户必须填写 GitCode PAT；插件通过 `GET https://api.gitcode.com/api/v5/user` 和 `Authorization: Bearer` 请求头验证后，才提供 `provider: gitcode` 的当前 `ActorRef`。
+
+PAT 由 DSH `ctx.credentials` 保存到 `auth-management/gitcode` 记录，默认落在 `$DSH_HOME/.credentials.yaml`（通常是 `~/.dsh/.credentials.yaml`）。它不会进入项目 `.dsh/`、HTTP 状态响应、审计、日志或诊断信息。该文件是同一 OS 用户可读的明文凭据存储，不是 Keychain，也不是同用户 Agent 的隔离边界。
+
+## MVP 能力
+
+- 登录、换号、状态检查和登出；
+- 每个受保护操作重新验证 GitCode 身份，401/403 后清除失效记录；
+- `ctx.authManagement.requireActor()` 统一返回当前 GitCode `ActorRef` 或抛出 `AUTH_REQUIRED`；
+- `ctx.authManagement.executeAudited()` 对变更动作写入开始与最终结果事件；
+- 本地 JSONL 审计查询，支持 action、outcome、actor、时间和 limit 筛选；
+- 独立登录与审计页面，未鉴权业务请求会引导回该页面。
+
+默认审计文件是 `$DSH_HOME/audit/kunpeng-demo.jsonl`。事件只包含身份、动作、目标、结果、时间、工作区、Session 和可选证据引用，不包含 PAT、完整提示词、模型原始输出或源码正文。
+
+真实 PAT、失效凭据、现有插件门禁和热重载按[手工验收说明](../../docs/auth-management-manual-test.md)执行。
+
+## 未包含
+
+首版不包含 OAuth、SSO、RBAC、组织同步、中央审计后台、提示词/源码采集、自动评分、导出和删除界面。真实 GitCode、Windows 权限行为和浏览器交互仍需按项目手工验收执行。

package/audit.js

@@ -0,0 +1,108 @@
+import { randomUUID } from 'node:crypto'
+import { appendFile, chmod, mkdir, readFile } from 'node:fs/promises'
+import { dirname } from 'node:path'
+
+const MAX_TEXT = 500
+const MAX_AUDIT_BYTES = 16 * 1024 * 1024
+const OUTCOMES = new Set(['started', 'succeeded', 'failed', 'cancelled', 'rejected'])
+
+function limited(value, field, { optional = false } = {}) {
+  if (value === undefined && optional) return undefined
+  if (typeof value !== 'string' || value === '' || value.length > MAX_TEXT || /[\r\n]/.test(value)) throw new TypeError(`AuditEvent.${field} 非法`)
+  return value
+}
+
+function normalizedActor(actor) {
+  if (actor?.provider !== 'gitcode') throw new TypeError('AuditEvent.actor 必须是 GitCode ActorRef')
+  return {
+    provider: 'gitcode',
+    id: limited(String(actor.id ?? ''), 'actor.id'),
+    login: limited(actor.login, 'actor.login'),
+    displayName: limited(actor.displayName, 'actor.displayName'),
+  }
+}
+
+function normalizedTarget(target) {
+  return {
+    type: limited(target?.type, 'target.type'),
+    id: limited(target?.id, 'target.id'),
+    ...(target?.label === undefined ? {} : { label: limited(target.label, 'target.label') }),
+  }
+}
+
+export function normalizeAuditEvent(value, { now = () => new Date(), id = randomUUID } = {}) {
+  const outcome = limited(value?.outcome, 'outcome')
+  if (!OUTCOMES.has(outcome)) throw new TypeError('AuditEvent.outcome 非法')
+  return {
+    schema: 1,
+    id: id(),
+    timestamp: now().toISOString(),
+    actor: normalizedActor(value.actor),
+    action: limited(value.action, 'action'),
+    target: normalizedTarget(value.target),
+    outcome,
+    ...(value.workspaceId === undefined ? {} : { workspaceId: limited(value.workspaceId, 'workspaceId') }),
+    ...(value.sessionId === undefined ? {} : { sessionId: limited(value.sessionId, 'sessionId') }),
+    ...(value.evidenceRef === undefined ? {} : { evidenceRef: limited(value.evidenceRef, 'evidenceRef') }),
+    ...(value.summary === undefined ? {} : { summary: limited(value.summary, 'summary') }),
+  }
+}
+
+function normalizeFilter(filter = {}) {
+  const limit = Number.isInteger(filter.limit) ? Math.min(Math.max(filter.limit, 1), 500) : 100
+  return {
+    limit,
+    action: typeof filter.action === 'string' && filter.action !== '' ? filter.action : undefined,
+    outcome: typeof filter.outcome === 'string' && filter.outcome !== '' ? filter.outcome : undefined,
+    actorId: typeof filter.actorId === 'string' && filter.actorId !== '' ? filter.actorId : undefined,
+    since: typeof filter.since === 'string' && !Number.isNaN(Date.parse(filter.since)) ? filter.since : undefined,
+    until: typeof filter.until === 'string' && !Number.isNaN(Date.parse(filter.until)) ? filter.until : undefined,
+  }
+}
+
+export function createJsonlAuditStore(options) {
+  if (typeof options?.path !== 'string' || options.path === '') throw new TypeError('audit path 必填')
+  const path = options.path
+  const now = options.now ?? (() => new Date())
+  const id = options.id ?? randomUUID
+  let disposed = false
+  let tail = Promise.resolve()
+
+  async function append(value) {
+    if (disposed) throw new Error('audit store 已释放')
+    const event = normalizeAuditEvent(value, { now, id })
+    const write = tail.then(async () => {
+      await mkdir(dirname(path), { recursive: true, mode: 0o700 })
+      await appendFile(path, `${JSON.stringify(event)}\n`, { encoding: 'utf8', mode: 0o600 })
+      if (process.platform !== 'win32') await chmod(path, 0o600)
+    })
+    tail = write.catch(() => {})
+    await write
+    return event
+  }
+
+  async function query(filterValue = {}) {
+    if (disposed) throw new Error('audit store 已释放')
+    await tail
+    const filter = normalizeFilter(filterValue)
+    let contents
+    try { contents = await readFile(path) } catch (error) {
+      if (error?.code === 'ENOENT') return []
+      throw error
+    }
+    if (contents.length > MAX_AUDIT_BYTES) throw new Error('审计文件超过 Demo 查询上限')
+    const events = contents.toString('utf8').split(/\r?\n/).filter(Boolean).map((line) => JSON.parse(line))
+    return events.filter((event) => {
+      if (filter.action !== undefined && event.action !== filter.action) return false
+      if (filter.outcome !== undefined && event.outcome !== filter.outcome) return false
+      if (filter.actorId !== undefined && event.actor?.id !== filter.actorId) return false
+      if (filter.since !== undefined && event.timestamp < filter.since) return false
+      if (filter.until !== undefined && event.timestamp > filter.until) return false
+      return true
+    }).slice(-filter.limit).reverse()
+  }
+
+  return { path, append, query, dispose() { disposed = true } }
+}
+
+export const __testing = { normalizeFilter }

package/auth.js

@@ -0,0 +1,273 @@
+const DEFAULT_API_BASE = 'https://api.gitcode.com/api/v5'
+const DEFAULT_TIMEOUT_MS = 12_000
+const TOKEN_MAX_BYTES = 4096
+
+export const CREDENTIAL_KEY = 'auth-management/gitcode'
+export const AUTH_ERROR_CODES = Object.freeze({
+  required: 'AUTH_REQUIRED',
+  unavailable: 'AUTH_UNAVAILABLE',
+  disposed: 'AUTH_DISPOSED',
+  audit: 'AUDIT_UNAVAILABLE',
+})
+
+export class AuthManagementError extends Error {
+  constructor(code, message, options = {}) {
+    super(message, options)
+    this.name = 'AuthManagementError'
+    this.code = code
+  }
+}
+
+function authError(code, message) {
+  return new AuthManagementError(code, message)
+}
+
+function normalizedToken(value) {
+  if (typeof value !== 'string') throw authError(AUTH_ERROR_CODES.required, '请填写 GitCode key。')
+  const token = value.trim()
+  if (token === '' || Buffer.byteLength(token, 'utf8') > TOKEN_MAX_BYTES || /[\r\n]/.test(token)) {
+    throw authError(AUTH_ERROR_CODES.required, 'GitCode key 格式无效。')
+  }
+  return token
+}
+
+function actorFromUser(user, verifiedAt) {
+  const id = user?.id
+  const login = user?.username ?? user?.login
+  if ((typeof id !== 'string' && typeof id !== 'number') || typeof login !== 'string' || login === '') {
+    throw authError(AUTH_ERROR_CODES.unavailable, 'GitCode 返回了无法识别的用户信息。')
+  }
+  const displayName = typeof user.name === 'string' && user.name !== '' ? user.name : login
+  const actor = {
+    provider: 'gitcode',
+    id: String(id),
+    login,
+    displayName,
+    verifiedAt,
+  }
+  if (typeof user.avatar_url === 'string' && user.avatar_url !== '') actor.avatarUrl = user.avatar_url
+  return Object.freeze(actor)
+}
+
+function storedCredential(record) {
+  const payload = record?.kind === 'grant' ? record.payload : undefined
+  if (payload?.schema !== 1 || payload.provider !== 'gitcode' || typeof payload.token !== 'string') return null
+  return { token: payload.token, actor: payload.actor }
+}
+
+function credentialRecord(token, actor) {
+  return {
+    kind: 'grant',
+    payload: { schema: 1, provider: 'gitcode', token, actor },
+  }
+}
+
+/** Validate one PAT without placing it in a URL, error, result or log message. */
+export async function verifyGitCodeToken(tokenValue, options = {}) {
+  const token = normalizedToken(tokenValue)
+  const fetchImpl = options.fetchImpl ?? fetch
+  const apiBase = String(options.apiBase ?? DEFAULT_API_BASE).replace(/\/+$/, '')
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  const controller = new AbortController()
+  const onAbort = () => controller.abort(options.signal?.reason)
+  options.signal?.addEventListener('abort', onAbort, { once: true })
+  const timer = setTimeout(() => controller.abort(), timeoutMs)
+  let response
+  try {
+    response = await fetchImpl(`${apiBase}/user`, {
+      method: 'GET',
+      headers: { accept: 'application/json', authorization: `Bearer ${token}` },
+      signal: controller.signal,
+    })
+  } catch {
+    throw authError(AUTH_ERROR_CODES.unavailable, '暂时无法验证 GitCode 身份，请检查网络后重试。')
+  } finally {
+    clearTimeout(timer)
+    options.signal?.removeEventListener('abort', onAbort)
+  }
+  if (response.status === 401 || response.status === 403) {
+    throw authError(AUTH_ERROR_CODES.required, 'GitCode key 无效或已失效，请重新填写。')
+  }
+  if (!response.ok) throw authError(AUTH_ERROR_CODES.unavailable, `GitCode 身份验证暂不可用（HTTP ${response.status}）。`)
+  let user
+  try { user = await response.json() } catch { throw authError(AUTH_ERROR_CODES.unavailable, 'GitCode 返回了无法解析的用户信息。') }
+  return actorFromUser(user, (options.now ?? (() => new Date()))().toISOString())
+}
+
+/** Create the current-actor and audit facade over DSH credentials. */
+export function createAuthManagementService(options) {
+  const credentials = options?.credentials
+  const auditStore = options?.auditStore
+  if (credentials === undefined || typeof credentials.readRecord !== 'function' || typeof credentials.modifyRecord !== 'function') {
+    throw new TypeError('auth-management 需要 DSH credentials 服务')
+  }
+  if (auditStore === undefined || typeof auditStore.append !== 'function') throw new TypeError('auth-management 需要 auditStore')
+  const controllers = new Set()
+  let disposed = false
+  let mutationTail = Promise.resolve()
+
+  function ensureLive() {
+    if (disposed) throw authError(AUTH_ERROR_CODES.disposed, '鉴权服务已释放。')
+  }
+
+  function serialized(task) {
+    const next = mutationTail.then(task, task)
+    mutationTail = next.catch(() => {})
+    return next
+  }
+
+  async function verify(token) {
+    ensureLive()
+    const controller = new AbortController()
+    controllers.add(controller)
+    try {
+      return await verifyGitCodeToken(token, {
+        fetchImpl: options.fetchImpl,
+        apiBase: options.apiBase,
+        timeoutMs: options.timeoutMs,
+        now: options.now,
+        signal: controller.signal,
+      })
+    } finally {
+      controllers.delete(controller)
+    }
+  }
+
+  async function readStored() {
+    ensureLive()
+    return storedCredential(await credentials.readRecord(CREDENTIAL_KEY))
+  }
+
+  async function invalidate(stored, reason) {
+    const latest = await readStored()
+    if (latest?.token !== stored?.token) return
+    await credentials.deleteRecord(CREDENTIAL_KEY)
+    if (stored?.actor !== undefined) {
+      await auditStore.append({
+        actor: stored.actor,
+        action: 'auth.invalidate',
+        target: { type: 'credential', id: 'gitcode' },
+        outcome: 'succeeded',
+        summary: reason,
+      }).catch(() => {})
+    }
+  }
+
+  async function requireActorUnlocked(context = {}) {
+    const stored = await readStored()
+    if (stored === null) throw authError(AUTH_ERROR_CODES.required, '请先填写有效的 GitCode key。')
+    try {
+      const actor = await verify(stored.token)
+      if (actor.id !== String(stored.actor?.id ?? '') || actor.login !== stored.actor?.login) {
+        await credentials.modifyRecord(CREDENTIAL_KEY, (current) => {
+          const latest = storedCredential(current)
+          return latest?.token === stored.token ? Promise.resolve(credentialRecord(stored.token, actor)) : Promise.resolve(undefined)
+        })
+      }
+      return actor
+    } catch (error) {
+      if (error?.code === AUTH_ERROR_CODES.required) await invalidate(stored, 'GitCode key 已失效')
+      throw error
+    }
+  }
+
+  function requireActor(context = {}) {
+    return serialized(() => requireActorUnlocked(context))
+  }
+
+  async function login(tokenValue, context = {}) {
+    const token = normalizedToken(tokenValue)
+    return serialized(async () => {
+      ensureLive()
+      const actor = await verify(token)
+      const previous = await credentials.readRecord(CREDENTIAL_KEY)
+      const event = {
+        actor,
+        action: 'auth.login',
+        target: { type: 'account', id: actor.id, label: actor.login },
+        workspaceId: context.workspaceId,
+        sessionId: context.sessionId,
+      }
+      await auditStore.append({ ...event, outcome: 'started' })
+      await credentials.modifyRecord(CREDENTIAL_KEY, () => Promise.resolve(credentialRecord(token, actor)))
+      try {
+        await auditStore.append({ ...event, outcome: 'succeeded' })
+      } catch {
+        if (previous === undefined) await credentials.deleteRecord(CREDENTIAL_KEY)
+        else await credentials.modifyRecord(CREDENTIAL_KEY, () => Promise.resolve(previous))
+        throw authError(AUTH_ERROR_CODES.audit, '审计不可用，GitCode 登录没有生效。')
+      }
+      return actor
+    })
+  }
+
+  async function logout(context = {}) {
+    return serialized(async () => {
+      ensureLive()
+      const stored = await readStored()
+      await credentials.deleteRecord(CREDENTIAL_KEY)
+      if (stored?.actor !== undefined) {
+        await auditStore.append({
+          actor: stored.actor,
+          action: 'auth.logout',
+          target: { type: 'account', id: String(stored.actor.id), label: stored.actor.login },
+          outcome: 'succeeded',
+          workspaceId: context.workspaceId,
+          sessionId: context.sessionId,
+        })
+      }
+      return { authenticated: false }
+    })
+  }
+
+  async function status() {
+    try { return { authenticated: true, actor: await requireActor() } } catch (error) {
+      if (error?.code === AUTH_ERROR_CODES.required) return { authenticated: false }
+      throw error
+    }
+  }
+
+  async function executeAudited(event, task) {
+    const actor = await requireActor(event)
+    const base = { ...event, actor }
+    await auditStore.append({ ...base, outcome: 'started' })
+    try {
+      const result = await task(actor)
+      const outcome = typeof event.outcome === 'function' ? event.outcome(result) : 'succeeded'
+      await auditStore.append({ ...base, outcome })
+      return result
+    } catch (error) {
+      await auditStore.append({ ...base, outcome: 'failed', summary: safeFailureSummary(error) }).catch(() => {})
+      throw error
+    }
+  }
+
+  return {
+    login,
+    logout,
+    status,
+    requireActor,
+    executeAudited,
+    queryAudit: (filter) => requireActor().then(() => auditStore.query(filter)),
+    dispose() {
+      if (disposed) return
+      disposed = true
+      for (const controller of controllers) controller.abort()
+      controllers.clear()
+      auditStore.dispose?.()
+    },
+  }
+}
+
+function safeFailureSummary(error) {
+  const code = typeof error?.code === 'string' && /^[A-Z0-9_-]{1,80}$/.test(error.code) ? error.code : 'OPERATION_FAILED'
+  return code
+}
+
+export function publicAuthError(error) {
+  const code = Object.values(AUTH_ERROR_CODES).includes(error?.code) ? error.code : 'INTERNAL_ERROR'
+  const message = code === 'INTERNAL_ERROR' ? '操作失败，请查看脱敏后的主机日志。' : String(error.message)
+  return { code, message }
+}
+
+export const __testing = { actorFromUser, credentialRecord, normalizedToken, storedCredential }

package/client.js

@@ -0,0 +1,197 @@
+// Generated from src/client.ts by scripts/build-clients.mjs. Do not edit.
+window.__ModuleLoader__.load({ id: "@boostkit-dsh/auth-management", factory: (require2) => {
+  const module = { exports: {} };
+  const exports = module.exports;
+  const { createElement: h, useCallback, useEffect, useMemo, useState } = require2("react");
+  const NS = "auth-management";
+  const PANEL_ID = "auth-management";
+  const AUTH_REQUIRED_EVENT = "kunpeng-auth-required";
+  const dictionaries = {
+    zh: {
+      nav: "\u9274\u6743\u4E0E\u5BA1\u8BA1",
+      title: "GitCode \u9274\u6743\u4E0E\u5BA1\u8BA1",
+      subtitle: "Demo \u7684\u4E1A\u52A1\u9875\u9762\u3001\u8BFB\u53D6\u63A5\u53E3\u3001\u5DE5\u5177\u548C\u5199\u64CD\u4F5C\u5747\u4E0D\u5141\u8BB8\u533F\u540D\u8BBF\u95EE\u3002",
+      key: "GitCode key",
+      keyHint: "\u4EC5\u5199\u5165 DSH credentials\uFF0C\u4E0D\u4F1A\u8FDB\u5165\u9879\u76EE\u3001\u5BA1\u8BA1\u6216\u65E5\u5FD7\u3002",
+      login: "\u9A8C\u8BC1\u5E76\u767B\u5F55",
+      loggingIn: "\u6B63\u5728\u9A8C\u8BC1\u2026",
+      authenticated: "\u5DF2\u9274\u6743",
+      unauthenticated: "\u672A\u9274\u6743",
+      logout: "\u9000\u51FA\u5E76\u6E05\u9664\u51ED\u636E",
+      refresh: "\u5237\u65B0",
+      account: "GitCode \u8D26\u53F7",
+      storage: "\u51ED\u636E\u9ED8\u8BA4\u4FDD\u5B58\u5728 $DSH_HOME/.credentials.yaml\uFF1B\u8FD9\u662F OS \u7528\u6237\u6743\u9650\u4FDD\u62A4\u7684\u660E\u6587\u6587\u4EF6\uFF0C\u4E0D\u662F Keychain\u3002",
+      audit: "\u6700\u8FD1\u5BA1\u8BA1",
+      noAudit: "\u6682\u65E0\u5BA1\u8BA1\u4E8B\u4EF6",
+      action: "\u52A8\u4F5C",
+      target: "\u76EE\u6807",
+      outcome: "\u7ED3\u679C",
+      time: "\u65F6\u95F4",
+      actor: "\u64CD\u4F5C\u8005",
+      failed: "\u64CD\u4F5C\u5931\u8D25",
+      required: "\u8BF7\u586B\u5199\u6709\u6548 GitCode key \u540E\u7EE7\u7EED\u3002",
+      auditHelp: "\u9ED8\u8BA4\u4E0D\u8BB0\u5F55 PAT\u3001\u5B8C\u6574\u63D0\u793A\u8BCD\u3001\u6A21\u578B\u539F\u59CB\u8F93\u51FA\u6216\u6E90\u7801\u6B63\u6587\u3002"
+    },
+    en: {
+      nav: "Auth & Audit",
+      title: "GitCode Authentication & Audit",
+      subtitle: "Anonymous access to Demo pages, reads, tools, and writes is disabled.",
+      key: "GitCode key",
+      keyHint: "Stored only in DSH credentials; never in the project, audit, or logs.",
+      login: "Verify and sign in",
+      loggingIn: "Verifying\u2026",
+      authenticated: "Authenticated",
+      unauthenticated: "Authentication required",
+      logout: "Sign out and remove credential",
+      refresh: "Refresh",
+      account: "GitCode account",
+      storage: "Credentials default to $DSH_HOME/.credentials.yaml, an OS-user-protected plaintext file rather than a keychain.",
+      audit: "Recent audit",
+      noAudit: "No audit events yet",
+      action: "Action",
+      target: "Target",
+      outcome: "Outcome",
+      time: "Time",
+      actor: "Actor",
+      failed: "Operation failed",
+      required: "Enter a valid GitCode key to continue.",
+      auditHelp: "PATs, full prompts, raw model output, and source bodies are not recorded by default."
+    }
+  };
+  const styles = {
+    page: { flex: 1, minHeight: 0, overflow: "auto", boxSizing: "border-box", padding: "24px clamp(18px,4vw,48px)", background: "var(--dsw-alias-bg-base)" },
+    content: { width: "100%", maxWidth: 980, margin: "0 auto", display: "flex", flexDirection: "column", gap: 14 },
+    row: { display: "flex", gap: 10, alignItems: "center", flexWrap: "wrap" },
+    title: { margin: 0, fontSize: 20, color: "var(--dsw-alias-label-primary)" },
+    muted: { color: "var(--dsw-alias-label-tertiary)", fontSize: 12, lineHeight: 1.6 },
+    card: { padding: 16, border: "1px solid var(--dsw-alias-border-l1)", borderRadius: 10, background: "var(--dsw-alias-bg-layer-1)", display: "flex", flexDirection: "column", gap: 10 },
+    input: { minWidth: 300, flex: 1, padding: "8px 10px", border: "1px solid var(--dsw-alias-border-l2)", borderRadius: 7, color: "var(--dsw-alias-label-primary)", background: "var(--dsw-alias-bg-base)", font: "inherit" },
+    button: { padding: "7px 12px", border: "1px solid var(--dsw-alias-border-l2)", borderRadius: 7, color: "var(--dsw-alias-label-primary)", background: "var(--dsw-alias-bg-layer-2)", cursor: "pointer", font: "inherit" },
+    primary: { borderColor: "var(--dsw-alias-state-business-primary)", color: "var(--dsw-alias-state-business-primary)" },
+    status: { padding: "2px 8px", borderRadius: 999, border: "1px solid var(--dsw-alias-border-l2)", fontSize: 12 },
+    error: { padding: 10, borderRadius: 8, border: "1px solid var(--dsw-alias-state-error-primary)", color: "var(--dsw-alias-state-error-primary)", fontSize: 12 },
+    table: { width: "100%", borderCollapse: "collapse", fontSize: 12 },
+    cell: { padding: "7px 8px", borderBottom: "1px solid var(--dsw-alias-border-l1)", textAlign: "left", verticalAlign: "top", wordBreak: "break-word" }
+  };
+  async function responseJson(response) {
+    const value = await response.json();
+    if (!response.ok || value?.ok === false) throw Object.assign(new Error(value?.error?.message ?? value?.error ?? `HTTP ${response.status}`), { code: value?.error?.code });
+    return value;
+  }
+  function AuthIcon({ size = 16, active = false }) {
+    const color = active ? "var(--dsw-alias-state-business-primary)" : "currentColor";
+    return h(
+      "svg",
+      { width: size, height: size, viewBox: "0 0 24 24", fill: "none", "aria-hidden": true },
+      h("path", { d: "M7 10V7a5 5 0 0 1 10 0v3m-11 0h12v10H6V10Zm6 4v2", stroke: color, strokeWidth: 1.7, strokeLinecap: "round", strokeLinejoin: "round" })
+    );
+  }
+  function AuthPage({ t }) {
+    const [state, setState] = useState(null);
+    const [events, setEvents] = useState([]);
+    const [key, setKey] = useState("");
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    const load = useCallback(async () => {
+      setError(null);
+      try {
+        const next = await fetch("/kunpeng-auth/status", { cache: "no-store" }).then(responseJson);
+        setState(next);
+        if (next.authenticated) {
+          const audit = await fetch("/kunpeng-auth/audit?limit=100", { cache: "no-store" }).then(responseJson);
+          setEvents(audit.events ?? []);
+        } else setEvents([]);
+      } catch (err) {
+        setState(null);
+        setEvents([]);
+        setError(err?.message ?? String(err));
+      }
+    }, []);
+    useEffect(() => {
+      void load();
+    }, [load]);
+    const login = useCallback(async () => {
+      setBusy(true);
+      setError(null);
+      try {
+        await fetch("/kunpeng-auth/login", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ key }) }).then(responseJson);
+        setKey("");
+        await load();
+      } catch (err) {
+        setError(err?.message ?? String(err));
+      } finally {
+        setBusy(false);
+      }
+    }, [key, load]);
+    const logout = useCallback(async () => {
+      setBusy(true);
+      setError(null);
+      try {
+        await fetch("/kunpeng-auth/logout", { method: "POST" }).then(responseJson);
+        await load();
+      } catch (err) {
+        setError(err?.message ?? String(err));
+      } finally {
+        setBusy(false);
+      }
+    }, [load]);
+    const actorLabel = useMemo(() => state?.actor ? `${state.actor.displayName} (@${state.actor.login})` : "", [state]);
+    return h("main", { style: styles.page }, h(
+      "div",
+      { style: styles.content },
+      h("div", null, h("h2", { style: styles.title }, t("title")), h("div", { style: styles.muted }, t("subtitle"))),
+      h(
+        "section",
+        { style: styles.card },
+        h("div", { style: styles.row }, h("span", { style: styles.status }, state?.authenticated ? t("authenticated") : t("unauthenticated")), state?.authenticated ? h("strong", null, `${t("account")}\uFF1A${actorLabel}`) : null),
+        state?.authenticated ? h("div", { style: styles.row }, h("button", { type: "button", style: styles.button, disabled: busy, onClick: () => void logout() }, t("logout")), h("button", { type: "button", style: styles.button, disabled: busy, onClick: () => void load() }, t("refresh"))) : h(
+          "form",
+          { style: styles.row, onSubmit: (event) => {
+            event.preventDefault();
+            void login();
+          } },
+          h("input", { type: "password", autoComplete: "off", value: key, disabled: busy, placeholder: t("key"), style: styles.input, onChange: (event) => setKey(event.target.value) }),
+          h("button", { type: "submit", disabled: busy || key.trim() === "", style: { ...styles.button, ...styles.primary } }, busy ? t("loggingIn") : t("login"))
+        ),
+        h("div", { style: styles.muted }, state?.authenticated ? t("storage") : `${t("required")} ${t("keyHint")}`),
+        error ? h("div", { style: styles.error }, `${t("failed")}\uFF1A${error}`) : null
+      ),
+      h(
+        "section",
+        { style: styles.card },
+        h("div", { style: styles.row }, h("strong", null, t("audit")), h("span", { style: styles.muted }, t("auditHelp"))),
+        events.length === 0 ? h("div", { style: styles.muted }, t("noAudit")) : h("div", { style: { overflowX: "auto" } }, h(
+          "table",
+          { style: styles.table },
+          h("thead", null, h("tr", null, ...["time", "actor", "action", "target", "outcome"].map((name) => h("th", { key: name, style: styles.cell }, t(name))))),
+          h("tbody", null, ...events.map((event) => h(
+            "tr",
+            { key: event.id },
+            h("td", { style: styles.cell }, new Date(event.timestamp).toLocaleString()),
+            h("td", { style: styles.cell }, `@${event.actor.login}`),
+            h("td", { style: styles.cell }, event.action),
+            h("td", { style: styles.cell }, `${event.target.type}:${event.target.label ?? event.target.id}`),
+            h("td", { style: styles.cell }, event.outcome)
+          )))
+        ))
+      )
+    ));
+  }
+  function apply(ctx) {
+    ctx.effect(() => ctx.locale.register(NS, dictionaries), "auth-management: dictionaries");
+    const t = ctx.locale.bind(NS);
+    ctx.slots.inject("main", () => ctx.slots.register({ name: "main", key: PANEL_ID, locale: NS, inject: () => ({ t }) }, AuthPage));
+    ctx.slots.inject("sidebar.panellist", () => ctx.slots.register({ name: "sidebar.panellist", id: PANEL_ID, order: 4, label: () => t("nav"), locale: NS }, AuthIcon));
+    const requireLogin = () => ctx.layout.selectPanel(PANEL_ID);
+    ctx.provide("authManagementClient", { openLogin: requireLogin });
+    window.addEventListener(AUTH_REQUIRED_EVENT, requireLogin);
+    ctx.effect(() => () => window.removeEventListener(AUTH_REQUIRED_EVENT, requireLogin), "auth-management: auth-required-listener");
+    void fetch("/kunpeng-auth/status", { cache: "no-store" }).then(responseJson).then((state) => {
+      if (!state.authenticated) requireLogin();
+    }).catch(requireLogin);
+  }
+  exports.name = "auth-management-client";
+  exports.inject = ["slots", "locale", "layout"];
+  exports.apply = apply;
+  return module.exports;
+} });

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+# 鉴权与审计管理：GitCode 当前操作者、本地审计和登录页面。
+- insert:
+    - id: auth-management
+      name: '@boostkit-dsh/auth-management'

package/http.js

@@ -0,0 +1,56 @@
+import { AUTH_ERROR_CODES, publicAuthError } from './auth.js'
+
+const REQUEST_BYTES = 8192
+
+export function sameOrigin(request) {
+  const origin = request.headers.origin
+  const host = request.headers.host
+  if (origin === undefined || host === undefined) return false
+  const remote = request.socket?.remoteAddress
+  const loopback = remote === '::1' || remote === '127.0.0.1' || (typeof remote === 'string' && remote.startsWith('127.')) || (typeof remote === 'string' && remote.startsWith('::ffff:127.'))
+  if (!loopback) return false
+  try { return new URL(origin).host === host } catch { return false }
+}
+
+export function sendJson(response, status, payload) {
+  if (response.destroyed || response.writableEnded) return
+  response.writeHead(status, { 'cache-control': 'no-store', 'content-type': 'application/json; charset=utf-8' })
+  response.end(JSON.stringify(payload))
+}
+
+export async function readJsonBody(request) {
+  const chunks = []
+  let size = 0
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > REQUEST_BYTES) throw new Error('request body too large')
+    chunks.push(buffer)
+  }
+  const text = Buffer.concat(chunks).toString('utf8').trim()
+  return text === '' ? {} : JSON.parse(text)
+}
+
+export function sendError(response, error) {
+  const body = publicAuthError(error)
+  const status = body.code === AUTH_ERROR_CODES.required ? 401 : body.code === AUTH_ERROR_CODES.unavailable ? 503 : 500
+  sendJson(response, status, { ok: false, error: body })
+}
+
+function stringQuery(url, name) {
+  const value = url.searchParams.get(name)
+  return typeof value === 'string' && value.length > 0 && value.length <= 500 ? value : undefined
+}
+
+export function auditFilter(url) {
+  const limitText = url.searchParams.get('limit')
+  const limit = limitText === null ? undefined : Number(limitText)
+  return {
+    action: stringQuery(url, 'action'),
+    outcome: stringQuery(url, 'outcome'),
+    actorId: stringQuery(url, 'actorId'),
+    since: stringQuery(url, 'since'),
+    until: stringQuery(url, 'until'),
+    limit: Number.isInteger(limit) ? limit : undefined,
+  }
+}

package/index.js

@@ -0,0 +1,90 @@
+import { homedir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+import { createJsonlAuditStore } from './audit.js'
+import { createAuthManagementService } from './auth.js'
+import { auditFilter, readJsonBody, sameOrigin, sendError, sendJson } from './http.js'
+
+export const name = 'auth-management'
+export const inject = ['credentials']
+
+const API_PREFIX = '/kunpeng-auth'
+
+function defaultAuditPath() {
+  const dshHome = typeof process.env.DSH_HOME === 'string' && process.env.DSH_HOME !== '' ? process.env.DSH_HOME : join(homedir(), '.dsh')
+  return join(dshHome, 'audit', 'kunpeng-demo.jsonl')
+}
+
+function method(request, response, expected) {
+  if (request.method === expected) return true
+  response.writeHead(405, { allow: expected })
+  response.end()
+  return false
+}
+
+/** Register GitCode authentication, current ActorRef, local audit and HTTP/UI endpoints. */
+export function apply(ctx, config = {}) {
+  const credentials = ctx.get?.('credentials') ?? ctx.credentials
+  const auditStore = createJsonlAuditStore({
+    path: config.auditPath === undefined ? defaultAuditPath() : resolve(config.auditPath),
+    now: config.now,
+    id: config.auditId,
+  })
+  const service = createAuthManagementService({
+    credentials,
+    auditStore,
+    fetchImpl: config.fetchImpl,
+    apiBase: config.apiBase,
+    timeoutMs: config.timeoutMs,
+    now: config.now,
+  })
+  ctx.provide('authManagement', service)
+  ctx.effect?.(() => () => service.dispose(), 'auth-management.dispose')
+
+  ctx.inject(['webServer'], (host) => {
+    host.effect(() => {
+      const routes = [
+        {
+          kind: 'exact', path: `${API_PREFIX}/health`, handler: (request, response) => {
+            if (!method(request, response, 'GET')) return
+            sendJson(response, 200, { ok: true, service: 'auth-management' })
+          },
+        },
+        {
+          kind: 'exact', path: `${API_PREFIX}/status`, handler: (request, response) => {
+            if (!method(request, response, 'GET')) return
+            void service.status().then((value) => sendJson(response, 200, { ok: true, ...value })).catch((error) => sendError(response, error))
+          },
+        },
+        {
+          kind: 'exact', path: `${API_PREFIX}/login`, handler: (request, response) => {
+            if (!method(request, response, 'POST')) return
+            if (!sameOrigin(request)) return sendJson(response, 403, { ok: false, error: { code: 'ORIGIN_REQUIRED', message: '只允许 DSH 本机页面写入凭据。' } })
+            void readJsonBody(request).then((body) => service.login(body.key, { workspaceId: body.workspaceId, sessionId: body.sessionId })).then((actor) => sendJson(response, 200, { ok: true, authenticated: true, actor })).catch((error) => sendError(response, error))
+          },
+        },
+        {
+          kind: 'exact', path: `${API_PREFIX}/logout`, handler: (request, response) => {
+            if (!method(request, response, 'POST')) return
+            if (!sameOrigin(request)) return sendJson(response, 403, { ok: false, error: { code: 'ORIGIN_REQUIRED', message: '只允许 DSH 本机页面清除凭据。' } })
+            void service.logout().then((value) => sendJson(response, 200, { ok: true, ...value })).catch((error) => sendError(response, error))
+          },
+        },
+        {
+          kind: 'exact', path: `${API_PREFIX}/audit`, handler: (request, response) => {
+            if (!method(request, response, 'GET')) return
+            let filter
+            try { filter = auditFilter(new URL(request.url ?? '', 'http://localhost')) } catch { return sendJson(response, 400, { ok: false, error: { code: 'INVALID_REQUEST', message: '查询参数无效。' } }) }
+            void service.queryAudit(filter).then((events) => sendJson(response, 200, { ok: true, events })).catch((error) => sendError(response, error))
+          },
+        },
+      ]
+      const disposers = routes.map((route) => host.webServer.register(route))
+      return () => { for (const dispose of disposers) dispose() }
+    }, 'auth-management.http')
+  })
+}
+
+export { createJsonlAuditStore, normalizeAuditEvent } from './audit.js'
+export { AUTH_ERROR_CODES, AuthManagementError, createAuthManagementService, publicAuthError, verifyGitCodeToken } from './auth.js'
+export const __testing = { defaultAuditPath, sameOrigin }

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@boostkit-dsh/auth-management",
+  "version": "0.1.1",
+  "type": "module",
+  "description": "GitCode 强制鉴权、当前操作者与本地最小化使用审计管理",
+  "main": "index.js",
+  "files": [
+    "CHANGELOG.md",
+    "README.md",
+    "audit.js",
+    "auth.js",
+    "client.js",
+    "cordis.patch.yml",
+    "http.js",
+    "index.js"
+  ],
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitcode.com/lujinxing/kunpeng-dsh-demo.git",
+    "directory": "plugins/auth-management"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    },
+    "market": {
+      "displayName": {
+        "zh": "鉴权与审计管理",
+        "en": "Authentication & Audit"
+      },
+      "category": "kunpeng-rd",
+      "maintainers": [
+        "@lujinxing"
+      ],
+      "compatibility": {
+        "dsh": "0.1.7-alpha.1"
+      },
+      "allowedBuilds": []
+    }
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json"
+  }
+}