@downcity/city 0.2.205 → 0.2.211

package/bin/federation/auth/bureau-token-schema.d.ts

@@ -0,0 +1,274 @@
+/**
+ * Federation Bureau Token 数据库表。
+ *
+ * 只保存 Token hash 和权限元数据，不持久化 Bureau Token 明文。
+ */
+/** Federation SQLite Bureau Token 表。 */
+export declare const sqlite_bureau_tokens: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "federation_bureau_tokens";
+    schema: undefined;
+    columns: {
+        token_id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "token_id";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        city_id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "city_id";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        token_hash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "token_hash";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        capabilities: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "capabilities";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "status";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        created_at: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        updated_at: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "updated_at";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** Federation Postgres Bureau Token 表。 */
+export declare const pg_bureau_tokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "federation_bureau_tokens";
+    schema: undefined;
+    columns: {
+        token_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_id";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        city_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "city_id";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        capabilities: import("drizzle-orm/pg-core").PgColumn<{
+            name: "capabilities";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updated_at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "federation_bureau_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=bureau-token-schema.d.ts.map

package/bin/federation/auth/bureau-token-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bureau-token-schema.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/bureau-token-schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,wCAAwC;AACxC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe/B,CAAC;AAEH,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe3B,CAAC"}

package/bin/federation/auth/bureau-token-schema.js

@@ -0,0 +1,43 @@
+/**
+ * Federation Bureau Token 数据库表。
+ *
+ * 只保存 Token hash 和权限元数据，不持久化 Bureau Token 明文。
+ */
+import { pgTable, text as pgText } from "drizzle-orm/pg-core";
+import { sqliteTable, text as sqliteText } from "drizzle-orm/sqlite-core";
+const BUREAU_TOKEN_TABLE = "federation_bureau_tokens";
+/** Federation SQLite Bureau Token 表。 */
+export const sqlite_bureau_tokens = sqliteTable(BUREAU_TOKEN_TABLE, {
+    /** Bureau Token 查找 ID。 */
+    token_id: sqliteText("token_id").primaryKey(),
+    /** Token 绑定的 City。 */
+    city_id: sqliteText("city_id").notNull(),
+    /** Token SHA-256 Base64URL hash。 */
+    token_hash: sqliteText("token_hash").notNull(),
+    /** JSON capability 列表。 */
+    capabilities: sqliteText("capabilities").notNull(),
+    /** active 或 revoked。 */
+    status: sqliteText("status").notNull(),
+    /** 创建时间。 */
+    created_at: sqliteText("created_at").notNull(),
+    /** 更新时间。 */
+    updated_at: sqliteText("updated_at").notNull(),
+});
+/** Federation Postgres Bureau Token 表。 */
+export const pg_bureau_tokens = pgTable(BUREAU_TOKEN_TABLE, {
+    /** Bureau Token 查找 ID。 */
+    token_id: pgText("token_id").primaryKey(),
+    /** Token 绑定的 City。 */
+    city_id: pgText("city_id").notNull(),
+    /** Token SHA-256 Base64URL hash。 */
+    token_hash: pgText("token_hash").notNull(),
+    /** JSON capability 列表。 */
+    capabilities: pgText("capabilities").notNull(),
+    /** active 或 revoked。 */
+    status: pgText("status").notNull(),
+    /** 创建时间。 */
+    created_at: pgText("created_at").notNull(),
+    /** 更新时间。 */
+    updated_at: pgText("updated_at").notNull(),
+});
+//# sourceMappingURL=bureau-token-schema.js.map

package/bin/federation/auth/bureau-token-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bureau-token-schema.js","sourceRoot":"","sources":["../../../src/federation/auth/bureau-token-schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD,wCAAwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC,kBAAkB,EAAE;IAClE,0BAA0B;IAC1B,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE;IAC7C,sBAAsB;IACtB,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACxC,oCAAoC;IACpC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC9C,0BAA0B;IAC1B,YAAY,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAClD,wBAAwB;IACxB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IACtC,YAAY;IACZ,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC9C,YAAY;IACZ,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC/C,CAAC,CAAC;AAEH,0CAA0C;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAC1D,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE;IACzC,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACpC,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC9C,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAClC,YAAY;IACZ,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,YAAY;IACZ,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC3C,CAAC,CAAC"}

package/bin/federation/auth/bureau-token-store.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Federation Bureau Token Store。
+ *
+ * Token 使用 `fb_<token_id>.<secret>` 格式。数据库只保存完整 token 的 SHA-256 hash，
+ * 通过 token_id 定位记录后再比较 hash，从而支持注册表状态校验和撤销。
+ */
+import type { CityTableApi } from "../../store/table-api.js";
+import type { BureauTokenRecord, BureauTokenSummary, RegisterBureauTokenInput, RuntimeBureau } from "../../types/Bureau.js";
+/** Bureau Token 持久化与验证入口。 */
+export declare class BureauTokenStore {
+    private readonly table;
+    constructor(table: CityTableApi<BureauTokenRecord>);
+    /** 登记 CLI 生成的 Bureau Token hash，不接触 Token 明文。 */
+    register(input: RegisterBureauTokenInput): Promise<BureauTokenSummary>;
+    /** 验证 Bureau Token 并返回绑定身份。 */
+    resolve(bureau_token: string): Promise<RuntimeBureau | undefined>;
+    /** 列出 Bureau Token 元数据，不返回 token hash。 */
+    list(): Promise<BureauTokenSummary[]>;
+    /** 立即撤销 Bureau Token。 */
+    revoke(token_id: string): Promise<void>;
+}
+//# sourceMappingURL=bureau-token-store.d.ts.map

package/bin/federation/auth/bureau-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bureau-token-store.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/bureau-token-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAEV,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAI/B,6BAA6B;AAC7B,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,YAAY,CAAC,iBAAiB,CAAC;IAEnE,iDAAiD;IAC3C,QAAQ,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4B5E,+BAA+B;IACzB,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAavE,0CAA0C;IACpC,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW3C,yBAAyB;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU9C"}

package/bin/federation/auth/bureau-token-store.js

@@ -0,0 +1,122 @@
+/**
+ * Federation Bureau Token Store。
+ *
+ * Token 使用 `fb_<token_id>.<secret>` 格式。数据库只保存完整 token 的 SHA-256 hash，
+ * 通过 token_id 定位记录后再比较 hash，从而支持注册表状态校验和撤销。
+ */
+import { base64UrlEncodeBytes } from "../../utils/helpers.js";
+const DEFAULT_CAPABILITIES = ["accounts:read"];
+/** Bureau Token 持久化与验证入口。 */
+export class BureauTokenStore {
+    table;
+    constructor(table) {
+        this.table = table;
+    }
+    /** 登记 CLI 生成的 Bureau Token hash，不接触 Token 明文。 */
+    async register(input) {
+        const token_id = read_token_id_value(input.token_id);
+        const token_hash = read_token_hash(input.token_hash);
+        const city_id = read_required_string(input.city_id, "city_id");
+        const capabilities = normalize_capabilities(input.capabilities);
+        if ((await this.table.select({ token_id }))[0]) {
+            throw new TypeError(`Bureau token already registered: ${token_id}`);
+        }
+        const now = new Date().toISOString();
+        await this.table.insert({
+            token_id,
+            city_id,
+            token_hash,
+            capabilities: JSON.stringify(capabilities),
+            status: "active",
+            created_at: now,
+            updated_at: now,
+        });
+        return {
+            token_id,
+            city_id,
+            capabilities,
+            status: "active",
+            created_at: now,
+            updated_at: now,
+        };
+    }
+    /** 验证 Bureau Token 并返回绑定身份。 */
+    async resolve(bureau_token) {
+        const token_id = read_token_id(bureau_token);
+        if (!token_id)
+            return undefined;
+        const record = (await this.table.select({ token_id }))[0];
+        if (!record || record.status !== "active")
+            return undefined;
+        if (record.token_hash !== await hash_token(bureau_token))
+            return undefined;
+        return {
+            token_id: record.token_id,
+            city_id: record.city_id,
+            capabilities: normalize_capabilities(JSON.parse(record.capabilities)),
+        };
+    }
+    /** 列出 Bureau Token 元数据，不返回 token hash。 */
+    async list() {
+        return (await this.table.select()).map((record) => ({
+            token_id: record.token_id,
+            city_id: record.city_id,
+            capabilities: normalize_capabilities(JSON.parse(record.capabilities)),
+            status: record.status,
+            created_at: record.created_at,
+            updated_at: record.updated_at,
+        }));
+    }
+    /** 立即撤销 Bureau Token。 */
+    async revoke(token_id) {
+        const id = read_required_string(token_id, "token_id");
+        if (!(await this.table.select({ token_id: id }))[0]) {
+            throw new TypeError(`Unknown Bureau token: ${id}`);
+        }
+        await this.table.update({
+            where: { token_id: id },
+            values: { status: "revoked", updated_at: new Date().toISOString() },
+        });
+    }
+}
+function read_token_id_value(value) {
+    const token_id = read_required_string(value, "token_id");
+    if (!/^br_[A-Za-z0-9_-]{16,}$/u.test(token_id)) {
+        throw new TypeError("token_id must use the br_<random> format");
+    }
+    return token_id;
+}
+function read_token_hash(value) {
+    const token_hash = read_required_string(value, "token_hash");
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(token_hash)) {
+        throw new TypeError("token_hash must be a SHA-256 Base64URL value");
+    }
+    return token_hash;
+}
+function read_token_id(token) {
+    const match = String(token ?? "").trim().match(/^fb_(br_[A-Za-z0-9_-]+)\.[A-Za-z0-9_-]+$/u);
+    return match?.[1];
+}
+async function hash_token(token) {
+    const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+    return base64UrlEncodeBytes(new Uint8Array(hash));
+}
+function normalize_capabilities(input) {
+    const values = input ?? DEFAULT_CAPABILITIES;
+    const allowed = new Set(["accounts:read"]);
+    const result = [...new Set(values)];
+    if (result.length === 0)
+        throw new TypeError("Bureau Token requires at least one capability");
+    for (const capability of result) {
+        if (!allowed.has(capability))
+            throw new TypeError(`Unknown Bureau capability: ${capability}`);
+    }
+    return result;
+}
+function read_required_string(value, name) {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new TypeError(`${name} must be a non-empty string`);
+    }
+    return value.trim();
+}
+//# sourceMappingURL=bureau-token-store.js.map

package/bin/federation/auth/bureau-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bureau-token-store.js","sourceRoot":"","sources":["../../../src/federation/auth/bureau-token-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAU9D,MAAM,oBAAoB,GAAuB,CAAC,eAAe,CAAC,CAAC;AAEnE,6BAA6B;AAC7B,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,KAAsC;QAAtC,UAAK,GAAL,KAAK,CAAiC;IAAG,CAAC;IAEvE,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,KAA+B;QAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,SAAS,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,QAAQ;YACR,OAAO;YACP,UAAU;YACV,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAC1C,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ;YACR,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5D,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3E,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAC;SAC5F,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAuB,CAAC;YAC3F,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,EAAE,GAAG,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YACvB,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5F,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa;IACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,OAAO,oBAAoB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAA0B;IACxD,MAAM,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IAC9F,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAY;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/bin/federation/auth/federation-key-store.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Federation Ed25519 Key Ring 存储模块。
+ *
+ * 该模块负责生成、持久化和读取 Federation 用户 token 签名密钥。
+ * 私钥只通过 get_active_signing_key() 返回给内部签发路径，JWKS 始终剥离私钥字段。
+ */
+import type { CityTableApi } from "../../store/table-api.js";
+import type { FederationAuthKeyRecord, FederationJwks } from "./types.js";
+/** 当前用户 token 使用的 JOSE 算法。 */
+export declare const USER_TOKEN_ALGORITHM: "EdDSA";
+/** Federation Key Ring 数据访问入口。 */
+export declare class FederationKeyStore {
+    private readonly table;
+    constructor(table: CityTableApi<FederationAuthKeyRecord>);
+    /** 确保 Federation 至少存在一把 active signing key。 */
+    ensure_active_key(): Promise<FederationAuthKeyRecord>;
+    /** 读取当前唯一 active signing key。 */
+    get_active_key(): Promise<FederationAuthKeyRecord | undefined>;
+    /** 按 kid 读取可用于验签的密钥。 */
+    get_verification_key(key_id: string): Promise<FederationAuthKeyRecord | undefined>;
+    /** 返回只包含公开字段的 JWKS。 */
+    get_public_jwks(): Promise<FederationJwks>;
+    /** 生成并保存新的 active Ed25519 signing key。 */
+    private create_active_key;
+}
+//# sourceMappingURL=federation-key-store.d.ts.map

package/bin/federation/auth/federation-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-key-store.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/federation-key-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EACV,uBAAuB,EACvB,cAAc,EAEf,MAAM,YAAY,CAAC;AAEpB,8BAA8B;AAC9B,eAAO,MAAM,oBAAoB,EAAG,OAAgB,CAAC;AAErD,kCAAkC;AAClC,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,YAAY,CAAC,uBAAuB,CAAC;IAEzE,+CAA+C;IACzC,iBAAiB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAK3D,iCAAiC;IAC3B,cAAc,IAAI,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAQpE,wBAAwB;IAClB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAOxF,uBAAuB;IACjB,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC;IAQhD,0CAA0C;YAC5B,iBAAiB;CAiChC"}

package/bin/federation/auth/federation-key-store.js

@@ -0,0 +1,96 @@
+/**
+ * Federation Ed25519 Key Ring 存储模块。
+ *
+ * 该模块负责生成、持久化和读取 Federation 用户 token 签名密钥。
+ * 私钥只通过 get_active_signing_key() 返回给内部签发路径，JWKS 始终剥离私钥字段。
+ */
+import { exportJWK, generateKeyPair } from "jose";
+import { randomSecret } from "../../utils/helpers.js";
+/** 当前用户 token 使用的 JOSE 算法。 */
+export const USER_TOKEN_ALGORITHM = "EdDSA";
+/** Federation Key Ring 数据访问入口。 */
+export class FederationKeyStore {
+    table;
+    constructor(table) {
+        this.table = table;
+    }
+    /** 确保 Federation 至少存在一把 active signing key。 */
+    async ensure_active_key() {
+        const active_key = await this.get_active_key();
+        return active_key ?? this.create_active_key();
+    }
+    /** 读取当前唯一 active signing key。 */
+    async get_active_key() {
+        const rows = await this.table.select({ status: "active" });
+        if (rows.length > 1) {
+            throw new Error("Federation must have exactly one active user token signing key");
+        }
+        return rows[0];
+    }
+    /** 按 kid 读取可用于验签的密钥。 */
+    async get_verification_key(key_id) {
+        const rows = await this.table.select({ key_id });
+        const key = rows[0];
+        if (!key || key.status === "revoked")
+            return undefined;
+        return key;
+    }
+    /** 返回只包含公开字段的 JWKS。 */
+    async get_public_jwks() {
+        const rows = await this.table.select();
+        const keys = rows
+            .filter((row) => row.status !== "revoked")
+            .map((row) => parse_public_jwk(row));
+        return { keys };
+    }
+    /** 生成并保存新的 active Ed25519 signing key。 */
+    async create_active_key() {
+        const existing = await this.get_active_key();
+        if (existing)
+            return existing;
+        const key_id = `key_${randomSecret(16)}`;
+        const key_pair = await generateKeyPair(USER_TOKEN_ALGORITHM, {
+            crv: "Ed25519",
+            extractable: true,
+        });
+        const public_jwk = await exportJWK(key_pair.publicKey);
+        const private_jwk = await exportJWK(key_pair.privateKey);
+        const record = {
+            key_id,
+            algorithm: USER_TOKEN_ALGORITHM,
+            public_jwk: JSON.stringify({
+                ...public_jwk,
+                alg: USER_TOKEN_ALGORITHM,
+                use: "sig",
+                kid: key_id,
+            }),
+            private_jwk: JSON.stringify({
+                ...private_jwk,
+                alg: USER_TOKEN_ALGORITHM,
+                use: "sig",
+                kid: key_id,
+            }),
+            status: "active",
+            created_at: new Date().toISOString(),
+            retired_at: "",
+        };
+        await this.table.insert(record);
+        return record;
+    }
+}
+/** 将数据库 JSON 转成严格的公开 Ed25519 JWK。 */
+function parse_public_jwk(record) {
+    const value = JSON.parse(record.public_jwk);
+    if (value.kty !== "OKP" || value.crv !== "Ed25519" || typeof value.x !== "string" || !value.x) {
+        throw new Error(`Invalid Federation public JWK: ${record.key_id}`);
+    }
+    return {
+        kty: "OKP",
+        crv: "Ed25519",
+        alg: USER_TOKEN_ALGORITHM,
+        use: "sig",
+        kid: record.key_id,
+        x: value.x,
+    };
+}
+//# sourceMappingURL=federation-key-store.js.map

package/bin/federation/auth/federation-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-key-store.js","sourceRoot":"","sources":["../../../src/federation/auth/federation-key-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQtD,8BAA8B;AAC9B,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAgB,CAAC;AAErD,kCAAkC;AAClC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,KAA4C;QAA5C,UAAK,GAAL,KAAK,CAAuC;IAAG,CAAC;IAE7E,+CAA+C;IAC/C,KAAK,CAAC,iBAAiB;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO,UAAU,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAChD,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uBAAuB;IACvB,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI;aACd,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;aACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,0CAA0C;IAClC,KAAK,CAAC,iBAAiB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,OAAO,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,oBAAoB,EAAE;YAC3D,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,MAAM,GAA4B;YACtC,MAAM;YACN,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;gBACzB,GAAG,UAAU;gBACb,GAAG,EAAE,oBAAoB;gBACzB,GAAG,EAAE,KAAK;gBACV,GAAG,EAAE,MAAM;aACZ,CAAC;YACF,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC1B,GAAG,WAAW;gBACd,GAAG,EAAE,oBAAoB;gBACzB,GAAG,EAAE,KAAK;gBACV,GAAG,EAAE,MAAM;aACZ,CAAC;YACF,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,UAAU,EAAE,EAAE;SACf,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,qCAAqC;AACrC,SAAS,gBAAgB,CAAC,MAA+B;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAiC,CAAC;IAC5E,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,oBAAoB;QACzB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,CAAC,EAAE,KAAK,CAAC,CAAC;KACX,CAAC;AACJ,CAAC"}