@cjhyy/code-shell-server 0.9.36 → 0.9.37

package/dist/project-runtime/cloud-account-auth.js

@@ -0,0 +1,287 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { isCloudAccountOrigin } from "./account-binding.js";
+import { ProjectRegistryError } from "./registry.js";
+export const CLOUD_MANAGEMENT_AUTHORITY_VERSION = 2;
+export const CLOUD_MANAGEMENT_COOKIE = "cs_cloud_management";
+const TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+const hash = (token) => createHash("sha256").update(token).digest("hex");
+export function cloudManagementSessionView(session) {
+    const { ownerId: _ownerId, ...view } = session;
+    return view;
+}
+function principalValid(value) {
+    return (value &&
+        Object.keys(value).sort().join() ===
+            ["accountOrigin", "accountId", "sessionId", "rootSessionId", "authorityEpoch", "expiresAt"]
+                .sort()
+                .join() &&
+        isCloudAccountOrigin(value.accountOrigin) &&
+        UUID.test(value.accountId) &&
+        UUID.test(value.sessionId) &&
+        value.sessionId === value.rootSessionId &&
+        UUID.test(value.authorityEpoch) &&
+        Number.isSafeInteger(value.expiresAt));
+}
+/** An explicitly bound Account controls one existing single-operator installation. */
+export function createCloudAccountAuth(options) {
+    const now = options.now ?? Date.now;
+    if (!isCloudAccountOrigin(options.publicOrigin) ||
+        options.authority.accountOrigin !== options.binding.accountOrigin ||
+        !UUID.test(options.installationId))
+        throw new Error("Cloud authority configuration does not match explicit ownership.");
+    const sessions = new Map();
+    const reading = new Set();
+    let closed = false;
+    let exchanging = 0;
+    let attempts = { until: now() + 60_000, count: 0 };
+    function revoke(entry) {
+        if (entry.revoked)
+            return;
+        entry.revoked = true;
+        options.onRevoke(entry.session.id);
+    }
+    function entryFor(session) {
+        if (closed || !("kind" in session))
+            return;
+        const entry = sessions.get(session.id);
+        if (!entry || entry.revoked || entry.session.expiresAt <= now()) {
+            if (entry)
+                revoke(entry);
+            return;
+        }
+        // Do not let a caller change owner, epoch or deadline using an existing id.
+        if (JSON.stringify(entry.session) !== JSON.stringify(session))
+            return;
+        return entry;
+    }
+    async function revalidate(session) {
+        const entry = entryFor(session);
+        if (!entry)
+            throw new ProjectRegistryError(401, "Cloud 管理登录已失效。");
+        try {
+            const current = await options.authority.validate({ ...entry.principal }, options.installationId);
+            if (!principalValid(current) ||
+                Object.keys(current).some((key) => current[key] !==
+                    entry.principal[key]) ||
+                !entryFor(session))
+                throw new Error("Cloud Account authority changed.");
+        }
+        catch {
+            revoke(entry);
+            throw new ProjectRegistryError(401, "Cloud 管理授权已失效，请重新登录云账号。");
+        }
+    }
+    function requestToken(req) {
+        let authorizations = 0;
+        for (let i = 0; i < req.rawHeaders.length; i += 2)
+            if (req.rawHeaders[i].toLowerCase() === "authorization")
+                authorizations++;
+        if (authorizations > 1)
+            return;
+        const bearer = req.headers.authorization;
+        const cookie = req.headers.cookie
+            ?.split(";")
+            .map((part) => part.trim())
+            .filter((part) => part.startsWith(`${CLOUD_MANAGEMENT_COOKIE}=`));
+        if (bearer !== undefined && cookie?.length)
+            return;
+        if (bearer !== undefined)
+            return /^Bearer ([A-Za-z0-9_-]{43})$/.exec(bearer)?.[1];
+        if (cookie?.length === 1)
+            return cookie[0].slice(CLOUD_MANAGEMENT_COOKIE.length + 1);
+    }
+    function isOriginAllowed(req) {
+        let hosts = 0;
+        for (let i = 0; i < req.rawHeaders.length; i += 2)
+            if (req.rawHeaders[i].toLowerCase() === "host")
+                hosts++;
+        if (hosts !== 1 ||
+            req.headers.host !== new URL(options.publicOrigin).host ||
+            req.headers["sec-fetch-site"] === "cross-site")
+            return false;
+        return req.headers.origin === undefined || req.headers.origin === options.publicOrigin;
+    }
+    async function authenticate(req) {
+        if (!isOriginAllowed(req))
+            return null;
+        const token = requestToken(req);
+        if (!token || !TOKEN.test(token))
+            return null;
+        const entry = [...sessions.values()].find((row) => row.hash === hash(token));
+        if (!entry || !entryFor(entry.session))
+            return null;
+        await revalidate(entry.session);
+        return { ...entry.session };
+    }
+    function json(res, status, value) {
+        res.writeHead(status, {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+            "X-Content-Type-Options": "nosniff",
+        });
+        res.end(JSON.stringify(value));
+    }
+    async function readBody(req) {
+        if (!/^application\/json(?:\s*;|$)/i.test(req.headers["content-type"] ?? ""))
+            throw new ProjectRegistryError(415, "请使用 JSON 提交。");
+        const chunks = [];
+        let size = 0;
+        const timer = setTimeout(() => req.destroy(), 5000);
+        timer.unref();
+        reading.add(req);
+        try {
+            for await (const chunk of req) {
+                size += chunk.length;
+                if (size > 4096)
+                    throw new ProjectRegistryError(413, "请求过大。");
+                chunks.push(Buffer.from(chunk));
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            reading.delete(req);
+        }
+        try {
+            const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            if (body && typeof body === "object" && !Array.isArray(body))
+                return body;
+        }
+        catch {
+            /* fixed public error below */
+        }
+        throw new ProjectRegistryError(400, "请求格式无效。");
+    }
+    async function handle(req, res) {
+        const path = (req.url ?? "/").split("?", 1)[0];
+        if (!path.startsWith("/api/v1/cloud-management/") && !path.startsWith("/api/v1/auth/"))
+            return false;
+        if (!isOriginAllowed(req))
+            throw new ProjectRegistryError(403, "请求来源无效。");
+        if (closed)
+            throw new ProjectRegistryError(503, "Cloud 管理服务正在关闭。");
+        if (req.url !== path)
+            throw new ProjectRegistryError(400, "请求参数无效。");
+        if (path === "/api/v1/cloud-management/capabilities" && req.method === "GET") {
+            json(res, 200, {
+                version: CLOUD_MANAGEMENT_AUTHORITY_VERSION,
+                mode: "cloud-account",
+                cloudOrigin: options.publicOrigin,
+                installationId: options.installationId,
+                accountOrigin: options.binding.accountOrigin,
+            });
+            return true;
+        }
+        if (path === "/api/v1/cloud-management/session" && req.method === "POST") {
+            // Main sends an Account-issued target-bound single-use ticket, never its root credential.
+            if (req.headers.origin !== undefined ||
+                req.headers.cookie !== undefined ||
+                req.headers.authorization !== undefined ||
+                req.headers["sec-fetch-site"] !== undefined)
+                throw new ProjectRegistryError(403, "请从桌面 Cloud 管理器登录。");
+            if (now() >= attempts.until)
+                attempts = { until: now() + 60_000, count: 0 };
+            if (++attempts.count > 60 || exchanging >= 4)
+                throw new ProjectRegistryError(429, "Cloud 管理登录请求过多。");
+            exchanging++;
+            try {
+                const body = await readBody(req);
+                if (Object.keys(body).join() !== "ticket" ||
+                    typeof body.ticket !== "string" ||
+                    !TOKEN.test(body.ticket))
+                    throw new ProjectRegistryError(400, "Cloud 管理票据格式无效。");
+                let principal;
+                try {
+                    principal = await options.authority.redeem(body.ticket, options.installationId);
+                }
+                catch {
+                    throw new ProjectRegistryError(401, "云账号验证失败。");
+                }
+                if (closed ||
+                    !principalValid(principal) ||
+                    principal.accountOrigin !== options.binding.accountOrigin ||
+                    principal.accountId !== options.binding.accountId ||
+                    principal.expiresAt <= now())
+                    throw new ProjectRegistryError(403, "此账号没有 Cloud 管理权限。");
+                for (const [id, row] of sessions)
+                    if (row.session.expiresAt + 600_000 <= now())
+                        sessions.delete(id);
+                if (sessions.size >= 128)
+                    throw new ProjectRegistryError(429, "Cloud 管理会话数量已达上限。");
+                const token = randomBytes(32).toString("base64url");
+                const session = {
+                    id: randomUUID(),
+                    kind: "cloud-management",
+                    audience: options.publicOrigin,
+                    installationId: options.installationId,
+                    accountOrigin: principal.accountOrigin,
+                    accountId: principal.accountId,
+                    managementEpoch: options.binding.managementEpoch,
+                    expiresAt: Math.min(now() + 600_000, principal.expiresAt),
+                    ownerId: options.binding.ownerId,
+                };
+                sessions.set(session.id, {
+                    hash: hash(token),
+                    session,
+                    principal: { ...principal },
+                    revoked: false,
+                });
+                json(res, 201, { token, session: cloudManagementSessionView(session) });
+            }
+            finally {
+                exchanging--;
+            }
+            return true;
+        }
+        if (path === "/api/v1/auth/status" && req.method === "GET") {
+            const session = await authenticate(req);
+            json(res, 200, {
+                initialized: true,
+                mode: "cloud-account",
+                authenticated: !!session,
+                ...(session && "kind" in session ? { session: cloudManagementSessionView(session) } : {}),
+            });
+            return true;
+        }
+        if (["/api/v1/cloud-management/logout", "/api/v1/auth/logout"].includes(path) &&
+            req.method === "POST") {
+            const body = await readBody(req);
+            if (Object.keys(body).length)
+                throw new ProjectRegistryError(400, "退出不接受额外参数。");
+            const token = requestToken(req);
+            const entry = token &&
+                TOKEN.test(token) &&
+                [...sessions.values()].find((row) => row.hash === hash(token));
+            if (!entry)
+                throw new ProjectRegistryError(401, "Cloud 管理登录已失效。");
+            revoke(entry);
+            res.setHeader("Set-Cookie", `${CLOUD_MANAGEMENT_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${options.publicOrigin.startsWith("https:") ? "; Secure" : ""}`);
+            json(res, 200, { revoked: true });
+            return true;
+        }
+        throw new ProjectRegistryError(403, "此 Cloud 只接受明确绑定的云账号管理。");
+    }
+    return {
+        cookieName: CLOUD_MANAGEMENT_COOKIE,
+        store: {
+            listSessions: () => [...sessions.values()]
+                .filter((row) => entryFor(row.session))
+                .map((row) => ({ ...row.session })),
+        },
+        handle,
+        authenticate,
+        isOriginAllowed,
+        isActive: (session) => !!entryFor(session),
+        revalidate,
+        close() {
+            closed = true;
+            for (const request of reading)
+                request.destroy();
+            reading.clear();
+            for (const row of sessions.values())
+                revoke(row);
+            sessions.clear();
+        },
+    };
+}

package/dist/project-runtime/control-authority.d.ts

@@ -0,0 +1,46 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { HubAuth } from "../hub/auth-http.js";
+import type { HubSession } from "../hub/auth-store.js";
+/** Public Account identity; access/refresh credentials never enter project workers. */
+export interface CloudAccountPrincipal {
+    accountOrigin: string;
+    accountId: string;
+    sessionId: string;
+    rootSessionId: string;
+    authorityEpoch: string;
+    expiresAt: number;
+}
+export interface CloudManagementSession {
+    id: string;
+    kind: "cloud-management";
+    audience: string;
+    installationId: string;
+    accountOrigin: string;
+    accountId: string;
+    managementEpoch: string;
+    expiresAt: number;
+    /** Internal owner scope, excluded from every response. */
+    ownerId: string;
+}
+export type ProjectControlSession = HubSession | CloudManagementSession;
+export interface ProjectControlAuthority {
+    bootstrapToken?: string;
+    cookieName: string;
+    store: {
+        listSessions(): ProjectControlSession[];
+    };
+    handle(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    authenticate(req: IncomingMessage): Promise<ProjectControlSession | null>;
+    isOriginAllowed(req: IncomingMessage): boolean;
+    /** Local lifetime check, synchronous so an already revoked transport closes promptly. */
+    isActive(session: ProjectControlSession): boolean;
+    /** Continuous authority check, also called around asynchronous lifecycle work. */
+    revalidate(session: ProjectControlSession): Promise<void>;
+    close?(): void;
+}
+export interface CloudAccountAuthority {
+    accountOrigin: string;
+    redeem(ticket: string, installationId: string): Promise<CloudAccountPrincipal>;
+    validate(principal: CloudAccountPrincipal, installationId: string): Promise<CloudAccountPrincipal>;
+}
+export declare function legacyProjectAuthority(auth: HubAuth): ProjectControlAuthority;

package/dist/project-runtime/control-authority.js

@@ -0,0 +1,15 @@
+export function legacyProjectAuthority(auth) {
+    const isActive = (session) => !("kind" in session) &&
+        auth.store
+            .listSessions()
+            .some((row) => row.id === session.id && row.username === session.username);
+    return {
+        ...auth,
+        cookieName: "cs_hub_session",
+        isActive,
+        async revalidate(session) {
+            if (!isActive(session))
+                throw new Error("Project control authority expired.");
+        },
+    };
+}

package/dist/project-runtime/control-server.d.ts

@@ -1,4 +1,5 @@
 import type { RemoteLinkConfiguration } from "@cjhyy/code-shell-core";
+import { type CloudAccountAuthority } from "./control-authority.js";
 import type { ProjectRuntimeProvider } from "./types.js";
 export interface ProjectControlServerOptions {
     host: string;
@@ -12,6 +13,8 @@ export interface ProjectControlServerOptions {
     runtimeSeccompProfile?: string;
     /** Dependency injection for lifecycle/transport integration tests. */
     provider?: ProjectRuntimeProvider;
+    /** Trusted fixed Account-origin verifier. Requires explicit offline ownership adoption. */
+    accountAuthority?: CloudAccountAuthority;
 }
 /** A small account/project gateway. It never creates a worker, executes tools or mounts cwd. */
 export declare function startProjectControlServer(options: ProjectControlServerOptions): Promise<{

package/dist/project-runtime/control-server.js

@@ -1,10 +1,12 @@
 import { remoteLinkHostConfiguration } from "../links/remote-configuration.js";
 import { describeEnvironment } from "../environment-identity.js";
 import { createServer } from "node:http";
-import { existsSync, readFileSync } from "node:fs";
+import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { extname } from "node:path";
 import { createHubAuth } from "../hub/auth-http.js";
+import { createCloudAccountAuth } from "./cloud-account-auth.js";
+import { legacyProjectAuthority } from "./control-authority.js";
 import { resolveSafe } from "../mobile-remote/mobile-static.js";
 import { contentTypeFor } from "../static-files.js";
 import { createDockerProjectProvider } from "./docker-provider.js";
@@ -69,8 +71,16 @@ async function readBody(request) {
 /** A small account/project gateway. It never creates a worker, executes tools or mounts cwd. */
 export async function startProjectControlServer(options) {
     const remoteLink = remoteLinkHostConfiguration(options.remoteLink, options.publicOrigin);
-    if (existsSync(join(options.dataDir, "restore-in-progress")))
+    // Any entry is a barrier, including dangling symlinks. Only ENOENT means absent;
+    // permission/I/O failures must abort before registry or Hub initialization.
+    try {
+        lstatSync(join(options.dataDir, "restore-in-progress"));
         throw new Error("Cloud installation restore is incomplete; do not start this directory.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
     const registry = new ProjectRegistry(options.dataDir);
     let proxy;
     let manager;
@@ -78,26 +88,38 @@ export async function startProjectControlServer(options) {
     let server;
     let shuttingDown = false;
     try {
-        const auth = await createHubAuth({
-            dataDir: options.dataDir,
-            publicOrigin: options.publicOrigin,
-            onRevoke: (sessionId) => {
+        const onRevoke = (sessionId) => {
+            if (shuttingDown)
+                return;
+            void proxy?.revokeOwner(sessionId).catch(async () => {
                 if (shuttingDown)
                     return;
-                void proxy?.revokeOwner(sessionId).catch(async () => {
-                    if (shuttingDown)
-                        return;
-                    // The revoked browser's transports are already closed. If its inner
-                    // session cannot be revoked, stop the single administrator's runtimes.
-                    try {
-                        await manager?.stopAll();
-                    }
-                    catch {
-                        console.error("[project-control] could not confirm project termination after session revocation.");
-                    }
-                });
-            },
-        });
+                // The revoked browser's transports are already closed. If its inner
+                // session cannot be revoked, stop the single administrator's runtimes.
+                try {
+                    await manager?.stopAll();
+                }
+                catch {
+                    console.error("[project-control] could not confirm project termination after session revocation.");
+                }
+            });
+        };
+        const binding = registry.accountBinding;
+        if (!!binding !== !!options.accountAuthority || (binding && !options.publicOrigin))
+            throw new Error("Cloud account authority requires explicit matching ownership and public origin.");
+        const auth = binding
+            ? createCloudAccountAuth({
+                binding,
+                installationId: registry.installationId,
+                publicOrigin: options.publicOrigin,
+                authority: options.accountAuthority,
+                onRevoke,
+            })
+            : legacyProjectAuthority(await createHubAuth({
+                dataDir: options.dataDir,
+                publicOrigin: options.publicOrigin,
+                onRevoke,
+            }));
         let listeningOrigin = "";
         const publicOrigin = () => options.publicOrigin ?? listeningOrigin;
         provider =
@@ -113,9 +135,12 @@ export async function startProjectControlServer(options) {
             registry,
             provider,
             publicOrigin,
-            isSessionActive: (session) => auth.store
-                .listSessions()
-                .some((item) => item.id === session.id && item.username === session.username),
+            isSessionActive: (session) => auth.isActive(session),
+            ...(binding
+                ? {
+                    revalidateSession: (session) => auth.revalidate(session),
+                }
+                : {}),
             revokeProject: async (id) => {
                 await proxy?.revokeProject(id);
             },
@@ -172,6 +197,7 @@ export async function startProjectControlServer(options) {
                     throw new ProjectRegistryError(400, "项目请求参数无效。");
                 if (pathname === "/api/v1/projects" && request.method === "GET") {
                     const availability = await provider.availability();
+                    await auth.revalidate(session);
                     json(response, 200, {
                         runtime: "docker",
                         ...availability,
@@ -183,10 +209,11 @@ export async function startProjectControlServer(options) {
                     const body = await readBody(request);
                     if (Object.keys(body).some((key) => key !== "name"))
                         throw new ProjectRegistryError(400, "仅支持设置项目名称。");
+                    await auth.revalidate(session);
                     json(response, 201, { project: projects.create(session, body.name) });
                     return;
                 }
-                const match = /^\/api\/v1\/projects\/([a-f0-9-]{36})(?:\/(start|stop))?$/.exec(pathname);
+                const match = /^\/api\/v1\/projects\/([a-f0-9-]{36})(?:\/(start|stop|open))?$/.exec(pathname);
                 if (match && request.method === "GET" && !match[2]) {
                     json(response, 200, { project: projects.get(session, match[1]) });
                     return;
@@ -195,6 +222,14 @@ export async function startProjectControlServer(options) {
                     const body = await readBody(request);
                     if (Object.keys(body).length)
                         throw new ProjectRegistryError(400, "启动和停止不接受额外参数。");
+                    if (match[2] === "open") {
+                        await projects.resolveTarget(session, match[1]);
+                        json(response, 200, {
+                            project: projects.get(session, match[1]),
+                            url: `${publicOrigin()}/?project=${match[1]}`,
+                        });
+                        return;
+                    }
                     const project = match[2] === "start"
                         ? await projects.start(session, match[1])
                         : await projects.stop(session, match[1]);
@@ -286,6 +321,7 @@ export async function startProjectControlServer(options) {
                         // Revoke streams and inner sessions before stopping their servers.
                         // If logout is unreachable, confirmed runtime termination is the
                         // fallback; a real stop failure must still reject close().
+                        auth.close?.();
                         await transport.close().catch(() => { });
                         await projects.close();
                     }