@downcity/agent 1.1.7 → 1.1.10

package/bin/plugin/builtins/auth/Plugin.js

@@ -0,0 +1,181 @@
+/**
+ * Auth Plugin。
+ *
+ * 关键点（中文）
+ * - auth 是内建且必需的 plugin，不走可选启停语义。
+ * - 所有 chat 授权配置仍然保存在 `downcity.db`，动态观测态仍落 `.downcity/chat/authorization/state.json`。
+ * - auth plugin 只负责统一暴露扩展点 / action 边界，不改变底层存储模型。
+ */
+import { CHAT_PLUGIN_POINTS } from "../../../service/builtins/chat/runtime/PluginPoints.js";
+import { AUTH_ACTIONS, } from "../../../plugin/builtins/auth/types/AuthPlugin.js";
+import { readChatAuthorizationConfig, setChatAuthorizationUserRole, writeChatAuthorizationConfig, } from "../../../plugin/builtins/auth/runtime/AuthorizationConfig.js";
+import { evaluateIncomingChatAuthorization, resolveAuthorizedUserRole, } from "../../../plugin/builtins/auth/runtime/AuthorizationPolicy.js";
+import { readAuthorizationSnapshot, recordObservedAuthorizationPrincipal, } from "../../../plugin/builtins/auth/runtime/AuthorizationStore.js";
+function toChannel(value) {
+    const text = String(value || "").trim().toLowerCase();
+    if (text === "telegram" || text === "feishu" || text === "qq")
+        return text;
+    return null;
+}
+function toRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    return value;
+}
+function toEvaluateInput(payload) {
+    const channel = toChannel(payload.channel);
+    if (!channel) {
+        throw new Error("auth.authorize_incoming requires a valid channel");
+    }
+    return {
+        channel,
+        chatId: String(payload.chatId || "").trim(),
+        ...(typeof payload.chatType === "string" ? { chatType: payload.chatType.trim() } : {}),
+        ...(typeof payload.userId === "string" ? { userId: payload.userId.trim() } : {}),
+        ...(typeof payload.username === "string" ? { username: payload.username.trim() } : {}),
+        ...(typeof payload.chatTitle === "string" ? { chatTitle: payload.chatTitle.trim() } : {}),
+    };
+}
+function toSnapshotData(snapshot) {
+    return {
+        config: snapshot.config,
+        users: snapshot.users,
+        chats: snapshot.chats,
+    };
+}
+/**
+ * authPlugin：统一承载授权能力。
+ */
+export const authPlugin = {
+    name: "auth",
+    title: "User Authorization System",
+    description: "Controls who can talk to the agent in chat channels, records observed users and chats, and resolves each user's effective role for downstream service decisions.",
+    availability() {
+        return {
+            enabled: true,
+            available: true,
+            reasons: [],
+        };
+    },
+    hooks: {
+        guard: {
+            [CHAT_PLUGIN_POINTS.authorizeIncoming]: [
+                async ({ context, value }) => {
+                    const input = value && typeof value === "object" && !Array.isArray(value)
+                        ? value
+                        : {};
+                    const evaluateInput = toEvaluateInput(input);
+                    const authorizationConfig = readChatAuthorizationConfig(context);
+                    const result = evaluateIncomingChatAuthorization({
+                        config: context.config,
+                        channel: evaluateInput.channel,
+                        input: evaluateInput,
+                        authorizationConfig,
+                    });
+                    if (result.decision !== "allow") {
+                        throw new Error(result.reason || "chat authorization blocked");
+                    }
+                },
+            ],
+        },
+        effect: {
+            [CHAT_PLUGIN_POINTS.observePrincipal]: [
+                async ({ context, value }) => {
+                    const input = toRecord(value);
+                    const channel = toChannel(input.channel);
+                    if (!channel) {
+                        throw new Error("chat.observePrincipal requires a valid channel");
+                    }
+                    await recordObservedAuthorizationPrincipal({
+                        context,
+                        channel,
+                        chatId: String(input.chatId || "").trim(),
+                        ...(typeof input.chatType === "string" ? { chatType: input.chatType.trim() } : {}),
+                        ...(typeof input.chatTitle === "string" ? { chatTitle: input.chatTitle.trim() } : {}),
+                        ...(typeof input.userId === "string" ? { userId: input.userId.trim() } : {}),
+                        ...(typeof input.username === "string" ? { username: input.username.trim() } : {}),
+                    });
+                },
+            ],
+        },
+    },
+    resolves: {
+        [CHAT_PLUGIN_POINTS.resolveUserRole]: async ({ context, value }) => {
+            const input = value && typeof value === "object" && !Array.isArray(value)
+                ? value
+                : {};
+            const channel = toChannel(input.channel);
+            if (!channel) {
+                throw new Error("chat.resolveUserRole requires a valid channel");
+            }
+            const role = resolveAuthorizedUserRole({
+                channel,
+                userId: String(input.userId || "").trim(),
+                rootPath: context.rootPath,
+                platform: context.platform,
+            });
+            return (role || null);
+        },
+    },
+    actions: {
+        [AUTH_ACTIONS.snapshot]: {
+            execute: async ({ context }) => {
+                const snapshot = await readAuthorizationSnapshot({
+                    context,
+                });
+                return {
+                    success: true,
+                    data: toSnapshotData(snapshot),
+                };
+            },
+        },
+        [AUTH_ACTIONS.readConfig]: {
+            execute: async ({ context }) => {
+                return {
+                    success: true,
+                    data: readChatAuthorizationConfig(context),
+                };
+            },
+        },
+        [AUTH_ACTIONS.writeConfig]: {
+            execute: async ({ context, payload }) => {
+                const body = toRecord(payload);
+                const nextConfig = body.config && typeof body.config === "object" && !Array.isArray(body.config)
+                    ? body.config
+                    : {};
+                await writeChatAuthorizationConfig({
+                    context,
+                    nextConfig,
+                });
+                return {
+                    success: true,
+                    data: readChatAuthorizationConfig(context),
+                };
+            },
+        },
+        [AUTH_ACTIONS.setUserRole]: {
+            execute: async ({ context, payload }) => {
+                const body = toRecord(payload);
+                const channel = toChannel(body.channel);
+                if (!channel) {
+                    return {
+                        success: false,
+                        error: "set-user-role requires a valid channel",
+                        message: "set-user-role requires a valid channel",
+                    };
+                }
+                await setChatAuthorizationUserRole({
+                    context,
+                    channel,
+                    userId: String(body.userId || "").trim(),
+                    roleId: String(body.roleId || "").trim(),
+                });
+                return {
+                    success: true,
+                    data: readChatAuthorizationConfig(context),
+                };
+            },
+        },
+    },
+};
+//# sourceMappingURL=Plugin.js.map

package/bin/plugin/builtins/auth/Plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Plugin.js","sourceRoot":"","sources":["../../../../src/plugin/builtins/auth/Plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,EACL,YAAY,GAOb,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,oCAAoC,GACrC,MAAM,sDAAsD,CAAC;AAG9D,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3C,GAAG,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAmC;IACzD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAA8B;QAC/C,KAAK,EAAE,QAAQ,CAAC,KAA6B;QAC7C,KAAK,EAAE,QAAQ,CAAC,KAA6B;KAC9C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,kKAAkK;IACpK,YAAY;QACV,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IACD,KAAK,EAAE;QACL,KAAK,EAAE;YACL,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE;gBACtC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;oBAC3B,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBACzD,CAAC,CAAE,KAAiC;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;oBAC7C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;oBACjE,MAAM,MAAM,GAAG,iCAAiC,CAAC;wBAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,OAAO,EAAE,aAAa,CAAC,OAAO;wBAC9B,KAAK,EAAE,aAAa;wBACpB,mBAAmB;qBACpB,CAAC,CAAC;oBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;wBAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAC;oBACjE,CAAC;gBACH,CAAC;aACF;SACF;QACD,MAAM,EAAE;YACN,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE;gBACrC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;oBAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAA2C,CAAC;oBACxE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBACpE,CAAC;oBACD,MAAM,oCAAoC,CAAC;wBACzC,OAAO;wBACP,OAAO;wBACP,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;wBACzC,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClF,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrF,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5E,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnF,CAAC,CAAC;gBACL,CAAC;aACF;SACF;KACF;IACD,QAAQ,EAAE;QACR,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;YACjE,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAE,KAAiC;gBACpC,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,yBAAyB,CAAC;gBACrC,OAAO;gBACP,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,OAAQ,CAAC,IAAI,IAAI,IAAI,CAA0B,CAAC;QAClD,CAAC;KACF;IACD,OAAO,EAAE;QACP,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;YACvB,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC7B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;oBAC/C,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC;iBAC/B,CAAC;YACJ,CAAC;SACF;QACD,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE;YACzB,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC7B,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAyB;iBACnE,CAAC;YACJ,CAAC;SACF;QACD,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE;YAC1B,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAsC,CAAC;gBACpE,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC3E,CAAC,CAAE,IAAI,CAAC,MAAkC;oBAC1C,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,4BAA4B,CAAC;oBACjC,OAAO;oBACP,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAyB;iBACnE,CAAC;YACJ,CAAC;SACF;QACD,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE;YAC1B,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAsC,CAAC;gBACpE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,wCAAwC;wBAC/C,OAAO,EAAE,wCAAwC;qBAClD,CAAC;gBACJ,CAAC;gBACD,MAAM,4BAA4B,CAAC;oBACjC,OAAO;oBACP,OAAO;oBACP,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACxC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;iBACzC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAyB;iBACnE,CAAC;YACJ,CAAC;SACF;KACF;CACF,CAAC"}

package/bin/plugin/builtins/auth/runtime/AuthorizationConfig.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Auth 授权配置读写工具。
+ *
+ * 关键点（中文）
+ * - 静态授权规则通过宿主注入的平台能力读写。
+ * - 授权核心模型为 role / permission / binding。
+ */
+import type { AgentContext } from "../../../../agent/AgentContextTypes.js";
+import type { ChatAuthorizationConfig, ChatAuthorizationChannel, ChatAuthorizationPermission, ChatAuthorizationRole } from "../../../../plugin/builtins/auth/types/AuthPlugin.js";
+export declare const DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS: ChatAuthorizationPermission[];
+/**
+ * 同步读取当前 agent 的授权配置。
+ */
+export declare function readChatAuthorizationConfigSync(projectRoot: string): ChatAuthorizationConfig;
+/**
+ * 读取当前 agent 的授权配置。
+ */
+export declare function readChatAuthorizationConfig(contextOrProjectRoot: Pick<AgentContext, "rootPath" | "platform"> | string): ChatAuthorizationConfig;
+/**
+ * 覆盖写入整份授权配置。
+ */
+export declare function writeChatAuthorizationConfig(params: {
+    context: Pick<AgentContext, "rootPath" | "platform">;
+    nextConfig: ChatAuthorizationConfig;
+}): Promise<void>;
+/**
+ * 读取角色列表。
+ */
+export declare function listChatAuthorizationRoles(params: {
+    config: ChatAuthorizationConfig;
+}): ChatAuthorizationRole[];
+/**
+ * 设置用户角色。
+ */
+export declare function setChatAuthorizationUserRole(params: {
+    context: Pick<AgentContext, "rootPath" | "platform">;
+    channel: ChatAuthorizationChannel;
+    userId: string;
+    roleId: string;
+}): Promise<void>;
+//# sourceMappingURL=AuthorizationConfig.d.ts.map

package/bin/plugin/builtins/auth/runtime/AuthorizationConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationConfig.d.ts","sourceRoot":"","sources":["../../../../../src/plugin/builtins/auth/runtime/AuthorizationConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EAEtB,MAAM,4CAA4C,CAAC;AASpD,eAAO,MAAM,sCAAsC,EAAE,2BAA2B,EAE/E,CAAC;AAgKF;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAE5F;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG,MAAM,GACzE,uBAAuB,CASzB;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC;IACrD,UAAU,EAAE,uBAAuB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,uBAAuB,CAAC;CACjC,GAAG,qBAAqB,EAAE,CAG1B;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC;IACrD,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB"}

package/bin/plugin/builtins/auth/runtime/AuthorizationConfig.js

@@ -0,0 +1,187 @@
+/**
+ * Auth 授权配置读写工具。
+ *
+ * 关键点（中文）
+ * - 静态授权规则通过宿主注入的平台能力读写。
+ * - 授权核心模型为 role / permission / binding。
+ */
+import { CHAT_AUTHORIZATION_CHANNELS, CHAT_AUTHORIZATION_PERMISSIONS, createDefaultChatAuthorizationRoles, } from "../../../../plugin/builtins/auth/types/AuthPlugin.js";
+const CHANNELS = [...CHAT_AUTHORIZATION_CHANNELS];
+export const DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS = [
+    ...CHAT_AUTHORIZATION_PERMISSIONS,
+];
+function normalizeText(value) {
+    const text = String(value || "").trim();
+    return text ? text : undefined;
+}
+function normalizePermissionList(values) {
+    const allowed = new Set(DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS);
+    if (!Array.isArray(values))
+        return [];
+    return [
+        ...new Set(values
+            .map((value) => normalizeText(value))
+            .filter((value) => Boolean(value && allowed.has(value)))),
+    ];
+}
+function buildDefaultRole(roleId) {
+    return createDefaultChatAuthorizationRoles()[roleId];
+}
+function normalizeRoleMap(input) {
+    const defaultRoles = createDefaultChatAuthorizationRoles();
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return defaultRoles;
+    const roles = {};
+    for (const [rawRoleId, rawRole] of Object.entries(input)) {
+        const roleId = normalizeText(rawRoleId);
+        if (!roleId)
+            continue;
+        const roleObj = rawRole && typeof rawRole === "object" && !Array.isArray(rawRole)
+            ? rawRole
+            : null;
+        if (!roleObj)
+            continue;
+        const builtinRole = defaultRoles[roleId];
+        roles[roleId] = {
+            roleId,
+            name: normalizeText(roleObj.name) || builtinRole?.name || roleId,
+            ...(normalizeText(roleObj.description) || builtinRole?.description
+                ? {
+                    description: normalizeText(roleObj.description) || builtinRole?.description || undefined,
+                }
+                : {}),
+            permissions: normalizePermissionList(roleObj.permissions),
+        };
+    }
+    if (Object.keys(roles).length === 0)
+        return defaultRoles;
+    if (!roles.default)
+        roles.default = buildDefaultRole("default");
+    return roles;
+}
+function normalizeBindingMap(input, roles) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return {};
+    const out = {};
+    for (const [rawId, rawRoleId] of Object.entries(input)) {
+        const entityId = normalizeText(rawId);
+        const roleId = normalizeText(rawRoleId);
+        if (!entityId || !roleId || !roles[roleId])
+            continue;
+        out[entityId] = roleId;
+    }
+    return out;
+}
+function normalizeChannelConfig(input, roles) {
+    const raw = input && typeof input === "object" && !Array.isArray(input)
+        ? input
+        : {};
+    const defaultUserRoleId = normalizeText(raw.defaultUserRoleId) || "default";
+    return {
+        defaultUserRoleId: roles[defaultUserRoleId] ? defaultUserRoleId : "default",
+        userRoles: normalizeBindingMap(raw.userRoles, roles),
+    };
+}
+function normalizeAuthorizationConfig(input) {
+    const raw = input && typeof input === "object" && !Array.isArray(input)
+        ? input
+        : {};
+    const roles = normalizeRoleMap(raw.roles);
+    const channels = {};
+    for (const channel of CHANNELS) {
+        channels[channel] = normalizeChannelConfig(raw.channels?.[channel], roles);
+    }
+    return { roles, channels };
+}
+function cloneAuthorizationConfig(input) {
+    return normalizeAuthorizationConfig(input ? JSON.parse(JSON.stringify(input)) : {});
+}
+function readAuthorizationConfigFromPlatformSync(params) {
+    const normalizedProjectRoot = normalizeText(params.projectRoot);
+    if (!normalizedProjectRoot)
+        return normalizeAuthorizationConfig({});
+    try {
+        return normalizeAuthorizationConfig(params.readConfig(normalizedProjectRoot) || {});
+    }
+    catch {
+        return normalizeAuthorizationConfig({});
+    }
+}
+function readAuthorizationConfigFromProjectRoot(projectRoot) {
+    const normalizedProjectRoot = normalizeText(projectRoot);
+    if (!normalizedProjectRoot)
+        return normalizeAuthorizationConfig({});
+    throw new Error(`Platform authorization runtime is not available for project: ${normalizedProjectRoot}`);
+}
+async function writeAuthorizationConfigToPlatform(params) {
+    const normalizedProjectRoot = normalizeText(params.projectRoot);
+    if (!normalizedProjectRoot)
+        throw new Error("projectRoot is required");
+    await params.writeConfig(normalizedProjectRoot, normalizeAuthorizationConfig(params.nextConfig));
+}
+function ensureChannelConfig(config, channel) {
+    config.roles = normalizeRoleMap(config.roles);
+    config.channels ??= {};
+    config.channels[channel] = normalizeChannelConfig(config.channels[channel], config.roles);
+    return config.channels[channel];
+}
+/**
+ * 同步读取当前 agent 的授权配置。
+ */
+export function readChatAuthorizationConfigSync(projectRoot) {
+    return readAuthorizationConfigFromProjectRoot(projectRoot);
+}
+/**
+ * 读取当前 agent 的授权配置。
+ */
+export function readChatAuthorizationConfig(contextOrProjectRoot) {
+    if (typeof contextOrProjectRoot === "string") {
+        return readAuthorizationConfigFromProjectRoot(contextOrProjectRoot);
+    }
+    return readAuthorizationConfigFromPlatformSync({
+        projectRoot: contextOrProjectRoot.rootPath,
+        readConfig: (projectRoot) => contextOrProjectRoot.platform.readChatAuthorizationConfig(projectRoot),
+    });
+}
+/**
+ * 覆盖写入整份授权配置。
+ */
+export async function writeChatAuthorizationConfig(params) {
+    await writeAuthorizationConfigToPlatform({
+        projectRoot: params.context.rootPath,
+        nextConfig: params.nextConfig,
+        writeConfig: (projectRoot, nextConfig) => params.context.platform.writeChatAuthorizationConfig(projectRoot, nextConfig),
+    });
+}
+/**
+ * 读取角色列表。
+ */
+export function listChatAuthorizationRoles(params) {
+    const config = normalizeAuthorizationConfig(params.config);
+    return Object.values(config.roles || {}).sort((a, b) => a.roleId.localeCompare(b.roleId));
+}
+/**
+ * 设置用户角色。
+ */
+export async function setChatAuthorizationUserRole(params) {
+    const userId = normalizeText(params.userId);
+    const roleId = normalizeText(params.roleId);
+    if (!userId || !roleId)
+        throw new Error("userId and roleId are required");
+    const authorization = cloneAuthorizationConfig(readAuthorizationConfigFromPlatformSync({
+        projectRoot: params.context.rootPath,
+        readConfig: (projectRoot) => params.context.platform.readChatAuthorizationConfig(projectRoot),
+    }));
+    authorization.roles = normalizeRoleMap(authorization.roles);
+    const channelConfig = ensureChannelConfig(authorization, params.channel);
+    if (!authorization.roles?.[roleId])
+        throw new Error(`Unknown roleId: ${roleId}`);
+    channelConfig.userRoles ??= {};
+    channelConfig.userRoles[userId] = roleId;
+    await writeAuthorizationConfigToPlatform({
+        projectRoot: params.context.rootPath,
+        nextConfig: authorization,
+        writeConfig: (projectRoot, nextConfig) => params.context.platform.writeChatAuthorizationConfig(projectRoot, nextConfig),
+    });
+}
+//# sourceMappingURL=AuthorizationConfig.js.map

package/bin/plugin/builtins/auth/runtime/AuthorizationConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationConfig.js","sourceRoot":"","sources":["../../../../../src/plugin/builtins/auth/runtime/AuthorizationConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,MAAM,QAAQ,GAA+B,CAAC,GAAG,2BAA2B,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,sCAAsC,GAAkC;IACnF,GAAG,8BAA8B;CAClC,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA6B;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,sCAAsC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM;aACH,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpC,MAAM,CACL,CAAC,KAAK,EAAwC,EAAE,CAC9C,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACvC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsC;IAC9D,OAAO,mCAAmC,EAAE,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,YAAY,GAAG,mCAAmC,EAAE,CAAC;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACrF,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,OAAO,GACX,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,OAKC;YACJ,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM;YACN,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,IAAI,IAAI,MAAM;YAChE,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,WAAW;gBAChE,CAAC,CAAC;oBACE,WAAW,EACT,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,WAAW,IAAI,SAAS;iBAC9E;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAA4C;IAE5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS;QACrD,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,KAA4C;IAE5C,MAAM,GAAG,GACP,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAGC;QACJ,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IAC5E,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QAC3E,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,MAAM,GAAG,GACP,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAAiE;QACpE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA8E,EAAE,CAAC;IAC/F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAA0C;IAE1C,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,uCAAuC,CAAC,MAGhD;IACC,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,qBAAqB;QAAE,OAAO,4BAA4B,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,sCAAsC,CAAC,WAAmB;IACjE,MAAM,qBAAqB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,qBAAqB;QAAE,OAAO,4BAA4B,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,KAAK,CACb,gEAAgE,qBAAqB,EAAE,CACxF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,MAOjD;IACC,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvE,MAAM,MAAM,CAAC,WAAW,CACtB,qBAAqB,EACrB,4BAA4B,CAAC,MAAM,CAAC,UAAU,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA+B,EAC/B,OAAiC;IAEjC,MAAM,CAAC,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAmC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,WAAmB;IACjE,OAAO,sCAAsC,CAAC,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,oBAA0E;IAE1E,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,sCAAsC,CAAC,oBAAoB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,uCAAuC,CAAC;QAC7C,WAAW,EAAE,oBAAoB,CAAC,QAAQ;QAC1C,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAC1B,oBAAoB,CAAC,QAAQ,CAAC,2BAA2B,CAAC,WAAW,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAGlD;IACC,MAAM,kCAAkC,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACpC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,WAAW,EAAE,UAAU,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAE1C;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAKlD;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,wBAAwB,CAC5C,uCAAuC,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACpC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,WAAW,CAAC;KACnE,CAAC,CACH,CAAC;IACF,aAAa,CAAC,KAAK,GAAG,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACjF,aAAa,CAAC,SAAS,KAAK,EAAE,CAAC;IAC/B,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,kCAAkC,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACpC,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,WAAW,EAAE,UAAU,CAAC;KAChF,CAAC,CAAC;AACL,CAAC"}

package/bin/plugin/builtins/auth/runtime/AuthorizationPolicy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Auth 授权判定逻辑。
+ *
+ * 关键点（中文）
+ * - 角色模型替代旧的 allowlist/pairing 模型。
+ * - 判定统一走“用户角色 + 权限集合”，群聊只看发言用户自身权限。
+ */
+import type { DowncityConfig } from "../../../../config/types/DowncityConfig.js";
+import type { AgentPlatformRuntime } from "../../../../host/types/AgentHost.js";
+import type { ChatAuthorizationConfig, ChatAuthorizationChannel, ChatAuthorizationEvaluateInput, ChatAuthorizationEvaluateResult, ChatAuthorizationRole } from "../../../../plugin/builtins/auth/types/AuthPlugin.js";
+/**
+ * 解析用户授权角色。
+ */
+export declare function resolveAuthorizedUserRole(params: {
+    channel: ChatAuthorizationChannel;
+    userId?: string;
+    authorizationConfig?: ChatAuthorizationConfig;
+    rootPath?: string;
+    platform?: Pick<AgentPlatformRuntime, "readChatAuthorizationConfig">;
+}): ChatAuthorizationRole | undefined;
+/**
+ * 执行入站授权判定。
+ */
+export declare function evaluateIncomingChatAuthorization(params: {
+    config: DowncityConfig;
+    channel: ChatAuthorizationChannel;
+    input: ChatAuthorizationEvaluateInput;
+    authorizationConfig?: ChatAuthorizationConfig;
+}): ChatAuthorizationEvaluateResult;
+//# sourceMappingURL=AuthorizationPolicy.d.ts.map

package/bin/plugin/builtins/auth/runtime/AuthorizationPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationPolicy.d.ts","sourceRoot":"","sources":["../../../../../src/plugin/builtins/auth/runtime/AuthorizationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAE/B,qBAAqB,EAEtB,MAAM,4CAA4C,CAAC;AAoEpD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,6BAA6B,CAAC,CAAC;CACtE,GAAG,qBAAqB,GAAG,SAAS,CAepC;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,wBAAwB,CAAC;IAClC,KAAK,EAAE,8BAA8B,CAAC;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C,GAAG,+BAA+B,CA+ClC"}

package/bin/plugin/builtins/auth/runtime/AuthorizationPolicy.js

@@ -0,0 +1,123 @@
+/**
+ * Auth 授权判定逻辑。
+ *
+ * 关键点（中文）
+ * - 角色模型替代旧的 allowlist/pairing 模型。
+ * - 判定统一走“用户角色 + 权限集合”，群聊只看发言用户自身权限。
+ */
+import { createDefaultChatAuthorizationRoles } from "../../../../plugin/builtins/auth/types/AuthPlugin.js";
+function normalizeText(value) {
+    const text = String(value || "").trim();
+    return text ? text : undefined;
+}
+function isDirectMessage(channel, chatType) {
+    const type = String(chatType || "").trim().toLowerCase();
+    if (!type)
+        return true;
+    if (channel === "telegram")
+        return type === "private";
+    if (channel === "feishu")
+        return type === "p2p";
+    if (channel === "qq")
+        return type === "private" || type === "c2c";
+    return false;
+}
+function resolveAuthorizationRoles(authorizationConfig) {
+    const raw = authorizationConfig?.roles;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return createDefaultChatAuthorizationRoles();
+    }
+    return Object.keys(raw).length > 0 ? raw : createDefaultChatAuthorizationRoles();
+}
+function resolveChannelAuthorizationConfig(channel, authorizationConfig) {
+    const raw = authorizationConfig?.channels?.[channel];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {
+            defaultUserRoleId: "default",
+            userRoles: {},
+        };
+    }
+    return raw;
+}
+function resolveRole(roleId, roles) {
+    if (roleId && roles?.[roleId])
+        return roles[roleId];
+    if (roles?.default)
+        return roles.default;
+    return { roleId: "default", name: "Default", permissions: [] };
+}
+function hasPermission(role, permission) {
+    return role.permissions.includes(permission);
+}
+function resolveUserRole(params) {
+    const userId = normalizeText(params.userId);
+    const defaultRoleId = normalizeText(params.channelConfig.defaultUserRoleId) || "default";
+    const boundRoleId = userId ? normalizeText(params.channelConfig.userRoles?.[userId]) : undefined;
+    return resolveRole(boundRoleId || defaultRoleId, params.roles);
+}
+/**
+ * 解析用户授权角色。
+ */
+export function resolveAuthorizedUserRole(params) {
+    const userId = normalizeText(params.userId);
+    if (!userId)
+        return undefined;
+    const authorizationConfig = params.authorizationConfig ||
+        (params.rootPath && params.platform
+            ? params.platform.readChatAuthorizationConfig(params.rootPath)
+            : undefined);
+    const roles = resolveAuthorizationRoles(authorizationConfig);
+    const channelConfig = resolveChannelAuthorizationConfig(params.channel, authorizationConfig);
+    return resolveUserRole({
+        roles,
+        channelConfig,
+        userId,
+    });
+}
+/**
+ * 执行入站授权判定。
+ */
+export function evaluateIncomingChatAuthorization(params) {
+    const channelConfig = resolveChannelAuthorizationConfig(params.channel, params.authorizationConfig);
+    const roles = resolveAuthorizationRoles(params.authorizationConfig);
+    const direct = isDirectMessage(params.channel, params.input.chatType);
+    const userRole = resolveUserRole({
+        roles,
+        channelConfig,
+        userId: params.input.userId,
+    });
+    const isOwner = hasPermission(userRole, "agent.manage");
+    if (direct) {
+        return hasPermission(userRole, "chat.dm.use")
+            ? {
+                decision: "allow",
+                isOwner,
+                userRoleId: userRole.roleId,
+                userPermissions: [...userRole.permissions],
+                reason: "dm_role_allowed",
+            }
+            : {
+                decision: "block",
+                isOwner,
+                userRoleId: userRole.roleId,
+                userPermissions: [...userRole.permissions],
+                reason: "dm_role_blocked",
+            };
+    }
+    return hasPermission(userRole, "chat.group.use")
+        ? {
+            decision: "allow",
+            isOwner,
+            userRoleId: userRole.roleId,
+            userPermissions: [...userRole.permissions],
+            reason: "group_user_role_allowed",
+        }
+        : {
+            decision: "block",
+            isOwner,
+            userRoleId: userRole.roleId,
+            userPermissions: [...userRole.permissions],
+            reason: "user_group_permission_blocked",
+        };
+}
+//# sourceMappingURL=AuthorizationPolicy.js.map

package/bin/plugin/builtins/auth/runtime/AuthorizationPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationPolicy.js","sourceRoot":"","sources":["../../../../../src/plugin/builtins/auth/runtime/AuthorizationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,OAAO,EAAE,mCAAmC,EAAE,MAAM,4CAA4C,CAAC;AAEjG,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,OAAiC,EAAE,QAAiB;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,KAAK,SAAS,CAAC;IACtD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,KAAK,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAChC,mBAA6C;IAE7C,MAAM,GAAG,GAAG,mBAAmB,EAAE,KAAK,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,mCAAmC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAiC,EACjC,mBAA6C;IAE7C,MAAM,GAAG,GAAG,mBAAmB,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,iBAAiB,EAAE,SAAS;YAC5B,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAClB,MAA0B,EAC1B,KAAwD;IAExD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,EAAE,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CACpB,IAA2B,EAC3B,UAAuC;IAEvC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,MAIxB;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IACzF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,OAAO,WAAW,CAAC,WAAW,IAAI,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAMzC;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,mBAAmB,GACvB,MAAM,CAAC,mBAAmB;QAC1B,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,iCAAiC,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7F,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,aAAa;QACb,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAKjD;IACC,MAAM,aAAa,GAAG,iCAAiC,CACrD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,mBAAmB,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,KAAK;QACL,aAAa;QACb,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;KAC5B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAExD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;YAC3C,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO;gBACP,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,iBAAiB;aAC1B;YACH,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO;gBACP,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,iBAAiB;aAC1B,CAAC;IACR,CAAC;IAED,OAAO,aAAa,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC9C,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,yBAAyB;SAClC;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,+BAA+B;SACxC,CAAC;AACR,CAAC"}

package/bin/plugin/builtins/auth/runtime/AuthorizationStore.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Auth 授权运行时状态存储。
+ *
+ * 关键点（中文）
+ * - 所有动态状态（观测用户 / 会话）统一落盘到 `.downcity/chat/authorization/state.json`。
+ * - 静态授权配置保存在 console `downcity.db`，不和运行时观测数据混写。
+ */
+import type { ChatAuthorizationSnapshot } from "../../../../plugin/builtins/auth/types/AuthPlugin.js";
+import type { AgentContext } from "../../../../agent/AgentContextTypes.js";
+import type { ChatDispatchChannel } from "../../../../service/builtins/chat/types/ChatDispatcher.js";
+/**
+ * 记录观测到的用户 / 会话。
+ */
+export declare function recordObservedAuthorizationPrincipal(params: {
+    context: Pick<AgentContext, "rootPath">;
+    channel: ChatDispatchChannel;
+    chatId: string;
+    chatType?: string;
+    chatTitle?: string;
+    userId?: string;
+    username?: string;
+}): Promise<void>;
+/**
+ * 读取授权快照（配置 + 动态状态）。
+ */
+export declare function readAuthorizationSnapshot(params: {
+    context: Pick<AgentContext, "rootPath" | "platform">;
+}): Promise<ChatAuthorizationSnapshot>;
+//# sourceMappingURL=AuthorizationStore.d.ts.map

package/bin/plugin/builtins/auth/runtime/AuthorizationStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationStore.d.ts","sourceRoot":"","sources":["../../../../../src/plugin/builtins/auth/runtime/AuthorizationStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAGV,yBAAyB,EAE1B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAuI3F;;GAEG;AACH,wBAAsB,oCAAoC,CAAC,MAAM,EAAE;IACjE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC;CACtD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAOrC"}