@cloudbase/manager-node 5.5.3 → 5.5.5

package/lib/env/index.js

@@ -12,6 +12,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnvService = void 0;
 const cos_nodejs_sdk_v5_1 = __importDefault(require("cos-nodejs-sdk-v5"));
 const util_1 = __importDefault(require("util"));
+const http_request_1 = require("../utils/http-request");
+const signature_nodejs_1 = require("@cloudbase/signature-nodejs");
 const error_1 = require("../error");
 const utils_1 = require("../utils");
 const constant_1 = require("../constant");
@@ -26,6 +28,7 @@ class EnvService {
         this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
         this.commonService = environment.getCommonService('lowcode', '2021-01-08');
         this.billingService = new billing_1.BillingService(environment.cloudBaseContext);
+        this.tokenCache = new Map();
     }
     /**
      * 列出所有环境
@@ -410,6 +413,74 @@ class EnvService {
     async describeApiKeyList(options) {
         return this.tcbService.request('DescribeApiKeyList', Object.assign({ EnvId: this.envId }, options));
     }
+    /**
+     * 根据密钥信息获取管理员访问令牌
+     * 使用 secretId、secretKey 和 sessionToken 签发访问令牌
+     * 默认从初始化时的 cloudBaseContext 中读取密钥，也可显式传入 credentials 覆盖
+     * @param {Object} [credentials] 密钥信息，不传则使用初始化时的密钥
+     * @param {string} credentials.secretId 密钥ID
+     * @param {string} credentials.secretKey 密钥Key
+     * @param {string} [credentials.token] sessionToken
+     * @returns {Promise<string>} 访问令牌
+     */
+    async getAdminAccessToken(credentials) {
+        const { secretId, secretKey, token } = credentials || this.environment.cloudBaseContext;
+        if (!secretId || !secretKey) {
+            throw new error_1.CloudBaseError('missing secretId or secretKey of tencent cloud');
+        }
+        const envId = this.envId;
+        const cacheKey = `access_token_secret_${envId}_${secretId}`;
+        const cached = this.tokenCache.get(cacheKey);
+        if (cached && cached.expiry > Date.now()) {
+            return cached.token;
+        }
+        const host = `${envId}${this.environment.cloudBaseContext.isInternalEndpoint()
+            ? '.api.intl.tcloudbasegateway.com'
+            : '.api.tcloudbasegateway.com'}`;
+        const url = `https://${host}/auth/v1/token/clientCredential`;
+        const method = 'POST';
+        const headers = {
+            'Content-Type': 'application/json',
+            Host: host,
+        };
+        const data = { grant_type: 'client_credentials' };
+        const timestamp = Math.floor(new Date().getTime() / 1000) - 1;
+        const { authorization, timestamp: signTimestamp } = (0, signature_nodejs_1.sign)({
+            secretId,
+            secretKey,
+            method,
+            url,
+            headers,
+            params: data,
+            timestamp,
+            withSignedParams: false,
+            isCloudApi: true,
+        });
+        headers['Authorization'] = `${authorization}, Timestamp=${signTimestamp}${token ? `, Token=${token}` : ''}`;
+        headers['X-Signature-Expires'] = 600;
+        headers['X-Timestamp'] = signTimestamp;
+        try {
+            const response = await (0, http_request_1.fetch)(url, {
+                method,
+                headers,
+                body: JSON.stringify(data),
+            });
+            const res = await response.json();
+            const access_token = res === null || res === void 0 ? void 0 : res.access_token;
+            const expires_in = (res === null || res === void 0 ? void 0 : res.expires_in) || 0;
+            if (access_token && expires_in) {
+                this.tokenCache.set(cacheKey, {
+                    token: access_token,
+                    expiry: Date.now() + (expires_in * 1000) / 2,
+                });
+            }
+            return access_token;
+        }
+        catch (e) {
+            console.log(e);
+            throw e;
+        }
+    }
     // 创建自定义登录私钥
     async createCustomLoginKeys() {
         return this.cloudService.request('CreateCustomLoginKeys', {

package/lib/permission/index.js

@@ -18,7 +18,11 @@ class PermissionService {
     constructor(environment) {
         this.environment = environment;
         this.tcbService = new utils_1.CloudService(environment.cloudBaseContext, 'tcb', '2018-06-08');
+        this.lowcodeService = new utils_1.CloudService(environment.cloudBaseContext, 'lowcode', '2021-01-08');
     }
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 modifyEnvAuthzConfig 替代
+     */
     async modifyResourcePermission(options) {
         const { EnvId } = this.environment.lazyEnvironmentConfig;
         const { resourceType, resource, permission, securityRule } = options;
@@ -51,6 +55,9 @@ class PermissionService {
         }
         return this.tcbService.request('ModifyResourcePermission', reqData);
     }
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 describeResourcePolicyList 或 describeEnvAuthzConfig 替代
+     */
     async describeResourcePermission(options) {
         const { EnvId } = this.environment.lazyEnvironmentConfig;
         const { resourceType, resources } = options;
@@ -288,6 +295,104 @@ class PermissionService {
             RoleIds: roleIds
         });
     }
+    /**
+     * 拉取环境下的所有用户自定义的网关鉴权策略列表
+     * 注意：PG 环境无需调用，直接按照无存量策略处理；
+     * 若环境 meta 中 authz_engine 值为 opa，则网关策略不生效，无需调用
+     */
+    async describeResourcePolicyList(options = {}) {
+        const { resourceType } = options;
+        if (resourceType !== undefined && (typeof resourceType !== 'string' || resourceType.trim().length === 0)) {
+            throw new Error('Invalid resourceType');
+        }
+        // PG 环境无需调用，直接返回空策略列表
+        if (await this.isPostgresqlEnv()) {
+            const emptyData = { PolicyList: [], Total: '0' };
+            return {
+                Data: emptyData,
+                RequestId: ''
+            };
+        }
+        // authz_engine 为 opa 时网关策略不生效，无需调用，直接返回空策略列表
+        if (await this.isOpaAuthzEngine()) {
+            const emptyData = { PolicyList: [], Total: '0' };
+            return {
+                Data: emptyData,
+                RequestId: ''
+            };
+        }
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const reqData = {
+            EnvId,
+            ResourceType: resourceType || 'policy'
+        };
+        return this.lowcodeService.request('DescribeResourcePolicyList', reqData);
+    }
+    /**
+     * 拉取环境下的鉴权策略配置
+     * key: authz.platform.extension.rego - 单独为该环境配置的策略
+     * key: authz.user.rego - 用户配置的策略
+     */
+    async describeEnvAuthzConfig(options) {
+        const { key } = options;
+        if (!key || (key !== 'authz.platform.extension.rego' && key !== 'authz.user.rego')) {
+            throw new Error('key must be "authz.platform.extension.rego" or "authz.user.rego"');
+        }
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        return this.tcbService.request('DescribeEnvConfig', {
+            EnvId,
+            Key: key
+        });
+    }
+    /**
+     * 保存用户编写的 rego 策略，保存后旧网关鉴权将直接失效
+     */
+    async modifyEnvAuthzConfig(options) {
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const { key, value } = options;
+        if (key !== 'authz.user.rego') {
+            throw new Error('key must be "authz.user.rego"');
+        }
+        if (typeof value !== 'string' || value.trim().length === 0) {
+            throw new Error('value is required and must be a non-empty string');
+        }
+        return this.tcbService.request('ModifyEnvConfig', {
+            EnvId,
+            Key: key,
+            Value: value
+        });
+    }
+    /**
+     * 获取完整的环境基础信息（含 PostgreSQL、Meta 等字段）
+     */
+    async getEnvBaseInfo() {
+        var _a;
+        const { EnvId } = this.environment.lazyEnvironmentConfig;
+        const params = { EnvId };
+        const res = await this.environment.getEnvService().describeEnvInfo(params);
+        return ((_a = res === null || res === void 0 ? void 0 : res.EnvInfo) === null || _a === void 0 ? void 0 : _a.EnvBaseInfo) || {};
+    }
+    /**
+     * 判断当前环境是否为 PostgreSQL 环境
+     * PostgreSQL 是数组且长度 > 0 时为 PG 环境
+     */
+    async isPostgresqlEnv() {
+        const envBaseInfo = await this.getEnvBaseInfo();
+        return Array.isArray(envBaseInfo.PostgreSQL) && envBaseInfo.PostgreSQL.length > 0;
+    }
+    /**
+     * 判断当前环境的 authz_engine 是否为 opa
+     * 从环境 Meta 中查找 Key 为 authz_engine 的标签，Value 为 opa 表示已切到 OPA
+     */
+    async isOpaAuthzEngine() {
+        const envBaseInfo = await this.getEnvBaseInfo();
+        const meta = envBaseInfo === null || envBaseInfo === void 0 ? void 0 : envBaseInfo.Meta;
+        if (!Array.isArray(meta)) {
+            return false;
+        }
+        const authzEngineTag = meta.find(tag => tag.Key === 'authz_engine');
+        return (authzEngineTag === null || authzEngineTag === void 0 ? void 0 : authzEngineTag.Value) === 'opa';
+    }
 }
 exports.PermissionService = PermissionService;
 __decorate([
@@ -308,3 +413,12 @@ __decorate([
 __decorate([
     (0, utils_1.preLazy)()
 ], PermissionService.prototype, "deleteRoles", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeResourcePolicyList", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "describeEnvAuthzConfig", null);
+__decorate([
+    (0, utils_1.preLazy)()
+], PermissionService.prototype, "modifyEnvAuthzConfig", null);

package/lib/storage/index.js

@@ -1335,8 +1335,8 @@ class StorageService {
                 typeof cacheControl === 'number' ? `max-age=${cacheControl}` : String(cacheControl);
         }
         if (metadata) {
-            // X-Metadata 放在 Header 里，具体大小限制由服务端/网关决定
-            headers['X-Metadata'] = Buffer.from(JSON.stringify(metadata), 'utf8').toString('base64');
+            // x-metadata 放在 Header 里，具体大小限制由服务端/网关决定
+            headers['x-metadata'] = Buffer.from(JSON.stringify(metadata), 'utf8').toString('base64');
         }
         if (upsert) {
             headers['x-upsert'] = 'true';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cloudbase/manager-node",
-    "version": "5.5.3",
+    "version": "5.5.5",
     "description": "The node manage service api for cloudbase.",
     "main": "lib/index.js",
     "scripts": {
@@ -41,6 +41,7 @@
         "typescript": "^5.8.3"
     },
     "dependencies": {
+        "@cloudbase/signature-nodejs": "^1.0.0",
         "@cloudbase/database": "^0.6.2",
         "archiver": "^3.1.1",
         "cos-nodejs-sdk-v5": "^2.14.0",

package/types/env/index.d.ts

@@ -559,6 +559,7 @@ export declare class EnvService {
     private envType?;
     private commonService;
     private billingService;
+    private tokenCache;
     constructor(environment: Environment);
     /**
      * 列出所有环境
@@ -779,6 +780,21 @@ export declare class EnvService {
      * @returns {Promise<IDescribeApiKeyListRes>}
      */
     describeApiKeyList(options?: IDescribeApiKeyListParams): Promise<IDescribeApiKeyListRes>;
+    /**
+     * 根据密钥信息获取管理员访问令牌
+     * 使用 secretId、secretKey 和 sessionToken 签发访问令牌
+     * 默认从初始化时的 cloudBaseContext 中读取密钥，也可显式传入 credentials 覆盖
+     * @param {Object} [credentials] 密钥信息，不传则使用初始化时的密钥
+     * @param {string} credentials.secretId 密钥ID
+     * @param {string} credentials.secretKey 密钥Key
+     * @param {string} [credentials.token] sessionToken
+     * @returns {Promise<string>} 访问令牌
+     */
+    getAdminAccessToken(credentials?: {
+        secretId: string;
+        secretKey: string;
+        token?: string;
+    }): Promise<string>;
     createCustomLoginKeys(): Promise<{
         PrivateKey: string;
         KeyID: string;

package/types/interfaces/tcb.interface.d.ts

@@ -484,6 +484,10 @@ export interface EnvBaseInfo {
         Key: string;
         Value: string;
     }>;
+    Meta?: Array<{
+        Key: string;
+        Value: string;
+    }>;
     CreateTime?: string;
     UpdateTime?: string;
     EnvPreferences?: Record<string, any>;

package/types/permission/index.d.ts

@@ -1,13 +1,20 @@
 import { Environment } from '../environment';
-import { ModifyResourcePermissionOptions, ModifyResourcePermissionResp, DescribeResourcePermissionOptions, DescribeResourcePermissionResp, CreateRoleOptions, CreateRoleResp, DescribeRoleListOptions, DescribeRoleListResp, ModifyRoleOptions, ModifyRoleResp, DeleteRolesOptions, DeleteRolesResp } from './types';
+import { ModifyResourcePermissionOptions, ModifyResourcePermissionResp, DescribeResourcePermissionOptions, DescribeResourcePermissionResp, CreateRoleOptions, CreateRoleResp, DescribeRoleListOptions, DescribeRoleListResp, ModifyRoleOptions, ModifyRoleResp, DeleteRolesOptions, DeleteRolesResp, DescribeResourcePolicyListOptions, DescribeResourcePolicyListResp, DescribeEnvAuthzConfigOptions, DescribeEnvAuthzConfigResp, ModifyEnvAuthzConfigOptions } from './types';
 export declare class PermissionService {
     private environment;
     private tcbService;
+    private lowcodeService;
     constructor(environment: Environment);
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 modifyEnvAuthzConfig 替代
+     */
     modifyResourcePermission(options: ModifyResourcePermissionOptions): Promise<{
         Data: ModifyResourcePermissionResp;
         RequestId: string;
     }>;
+    /**
+     * @deprecated 已废弃，网关鉴权策略已由 OPA 接管，请使用 describeResourcePolicyList 或 describeEnvAuthzConfig 替代
+     */
     describeResourcePermission(options: DescribeResourcePermissionOptions): Promise<{
         Data: DescribeResourcePermissionResp;
         RequestId: string;
@@ -28,4 +35,43 @@ export declare class PermissionService {
         Data: DeleteRolesResp;
         RequestId: string;
     }>;
+    /**
+     * 拉取环境下的所有用户自定义的网关鉴权策略列表
+     * 注意：PG 环境无需调用，直接按照无存量策略处理；
+     * 若环境 meta 中 authz_engine 值为 opa，则网关策略不生效，无需调用
+     */
+    describeResourcePolicyList(options?: DescribeResourcePolicyListOptions): Promise<{
+        Data: DescribeResourcePolicyListResp;
+        RequestId: string;
+    }>;
+    /**
+     * 拉取环境下的鉴权策略配置
+     * key: authz.platform.extension.rego - 单独为该环境配置的策略
+     * key: authz.user.rego - 用户配置的策略
+     */
+    describeEnvAuthzConfig(options: DescribeEnvAuthzConfigOptions): Promise<{
+        Item: DescribeEnvAuthzConfigResp;
+        RequestId: string;
+    }>;
+    /**
+     * 保存用户编写的 rego 策略，保存后旧网关鉴权将直接失效
+     */
+    modifyEnvAuthzConfig(options: ModifyEnvAuthzConfigOptions): Promise<{
+        AffectedRows: number;
+        RequestId: string;
+    }>;
+    /**
+     * 获取完整的环境基础信息（含 PostgreSQL、Meta 等字段）
+     */
+    private getEnvBaseInfo;
+    /**
+     * 判断当前环境是否为 PostgreSQL 环境
+     * PostgreSQL 是数组且长度 > 0 时为 PG 环境
+     */
+    private isPostgresqlEnv;
+    /**
+     * 判断当前环境的 authz_engine 是否为 opa
+     * 从环境 Meta 中查找 Key 为 authz_engine 的标签，Value 为 opa 表示已切到 OPA
+     */
+    private isOpaAuthzEngine;
 }

package/types/permission/types.d.ts

@@ -125,3 +125,37 @@ export interface DeleteRolesResp {
     SuccessCount?: number;
     FailedCount?: number;
 }
+export interface ResourcePolicyItem {
+    Effect?: string;
+    IsAccess?: boolean;
+    PolicyId?: string;
+    ResourceId?: string;
+    ResourceName?: string;
+    ResourceTitle?: string;
+    ResourceType?: string;
+    RoleId?: string;
+    RoleIdentity?: string;
+    RoleName?: string;
+    SafeRule?: string;
+}
+export interface DescribeResourcePolicyListOptions {
+    resourceType?: string;
+}
+export interface DescribeResourcePolicyListResp {
+    PolicyList: ResourcePolicyItem[];
+    Total: string;
+}
+export interface DescribeEnvAuthzConfigOptions {
+    key: 'authz.platform.extension.rego' | 'authz.user.rego';
+}
+export interface DescribeEnvAuthzConfigResp {
+    Key: string;
+    Value: string;
+}
+export interface ModifyEnvAuthzConfigOptions {
+    key: 'authz.user.rego';
+    value: string;
+}
+export interface ModifyEnvAuthzConfigResp {
+    AffectedRows: number;
+}

package/types/storage/type.d.ts

@@ -18,7 +18,7 @@ export interface IUploadObjectHttpOptions {
      * 缓存控制；传 number 自动转换为 max-age=<value>，传 string 直接作为 Cache-Control 头值
      */
     cacheControl?: number | string;
-    /** 自定义 metadata（JSON 对象），将以 Base64 编码后放入 X-Metadata 头 */
+    /** 自定义 metadata（JSON 对象），将以 Base64 编码后放入 x-metadata 头 */
     metadata?: Record<string, any>;
     /** 爬虫指令（X-Robots-Tag 头） */
     xRobotsTag?: string;