@downcity/city 1.1.32 → 1.1.47

package/src/terminal/auth/mode-select.ts

@@ -0,0 +1,38 @@
+/**
+ * 身份选择模块。
+ *
+ * 始终显示菜单，围绕当前 active server 进入身份或 server 管理。
+ */
+
+import { readActiveServer, readConfig, readUserSession } from "../core/session.js";
+import { select, isCancel } from "@clack/prompts";
+
+export type Identity = "admin" | "user" | "servers" | "update" | "quit";
+
+/**
+ * 选择身份。始终显示菜单，已有 session 的身份标注 ★。
+ */
+export async function selectIdentity(): Promise<Identity> {
+  const config = readConfig();
+  const activeServer = readActiveServer();
+
+  const hasAdmin = !!String(activeServer?.admin_secret_key ?? "").trim();
+  const hasUser = activeServer ? !!readUserSession(activeServer.base_url) : false;
+  const title = activeServer
+    ? `Identity [${activeServer.name}]`
+    : "Identity [No servers configured]";
+
+  const selected = await select({
+    message: title,
+    options: [
+      { label: hasAdmin ? "★ Admin" : "   Admin", value: "admin", hint: hasAdmin ? activeServer?.base_url ?? "" : "Admin management" },
+      { label: hasUser ? "★ User" : "   User", value: "user", hint: hasUser ? "session active" : "Login or register" },
+      { label: "Manage Servers", value: "servers", hint: `${config.servers.length} configured` },
+      { label: "Update CLI", value: "update", hint: "Refresh global downcity command" },
+      { label: "Quit", value: "quit" },
+    ],
+  });
+
+  if (!selected || isCancel(selected)) return "quit";
+  return selected as Identity;
+}

package/src/terminal/auth/server-switch.ts

@@ -0,0 +1,275 @@
+/**
+ * Server 管理模块。
+ *
+ * 关键说明（中文）
+ * - 不再提供“切换当前 server”的临时入口
+ * - 所有 server 操作都统一收口到 Manage Servers
+ * - 没有 server 时，CLI 会先强制进入添加流程
+ */
+
+import { AdminClient } from "@downcity/conduit";
+import { isCancel, password, select, text } from "@clack/prompts";
+import {
+  addServer,
+  readActiveServer,
+  readConfig,
+  readServer,
+  removeServer,
+  setActiveServer,
+  type ServerProfile,
+  updateServer,
+} from "../core/session.js";
+import { show, showError, showSuccess } from "../core/ui.js";
+
+/**
+ * 确保至少存在一个 server。
+ */
+export async function ensureServerConfigured(): Promise<boolean> {
+  if (readConfig().servers.length > 0) {
+    return true;
+  }
+
+  show("No servers configured. Add a server before continuing.");
+  const created = await promptAddServer();
+  if (!created) {
+    showError("No server configured. Exiting.");
+    return false;
+  }
+  return true;
+}
+
+/**
+ * 顶层 server 管理菜单。
+ */
+export async function manageServersMenu(): Promise<void> {
+  while (true) {
+    const config = readConfig();
+    const active = readActiveServer();
+
+    const selected = await select({
+      message: active
+        ? `Manage Servers [current: ${active.name}]`
+        : "Manage Servers [no active server]",
+      options: [
+        { label: "List Servers", value: "list", hint: `${config.servers.length} configured` },
+        { label: "Add Server", value: "add", hint: "Create a new Infra server profile" },
+        { label: "Select Active Server", value: "select", hint: active ? active.base_url : "Choose current server" },
+        { label: "Edit Server", value: "edit", hint: "Update name, server URL, or admin key" },
+        { label: "Remove Server", value: "remove", hint: "Delete a server profile" },
+        { label: "Back", value: "back", hint: "Return to main menu" },
+      ],
+    });
+
+    if (!selected || isCancel(selected) || selected === "back") {
+      return;
+    }
+
+    if (selected === "list") {
+      printServers(config.servers, active?.base_url);
+      continue;
+    }
+
+    if (selected === "add") {
+      await promptAddServer();
+      continue;
+    }
+
+    if (selected === "select") {
+      await promptSelectActiveServer();
+      continue;
+    }
+
+    if (selected === "edit") {
+      await promptEditServer();
+      continue;
+    }
+
+    if (selected === "remove") {
+      await promptRemoveServer();
+    }
+  }
+}
+
+/**
+ * 添加 server。
+ */
+export async function promptAddServer(): Promise<ServerProfile | undefined> {
+  const baseUrl = await text({
+    message: "Server URL",
+    placeholder: "https://downcity.wangenius.workers.dev",
+  });
+  if (!baseUrl || isCancel(baseUrl) || !String(baseUrl).trim()) {
+    return undefined;
+  }
+
+  const adminSecretKey = await password({ message: "admin_secret_key" });
+  if (!adminSecretKey || isCancel(adminSecretKey) || !String(adminSecretKey).trim()) {
+    return undefined;
+  }
+
+  const server = addServer({
+    base_url: String(baseUrl).trim(),
+    admin_secret_key: String(adminSecretKey).trim(),
+  });
+
+  const verified = await verifyServerAdminAccess(server);
+  if (verified) {
+    showSuccess(`Server added and activated: ${server.name}`);
+  } else {
+    showError(`Server saved, but admin verification failed: ${server.name}`);
+  }
+
+  return server;
+}
+
+async function promptSelectActiveServer(): Promise<void> {
+  const config = readConfig();
+  if (config.servers.length === 0) {
+    showError("No servers configured.");
+    return;
+  }
+
+  const selected = await select({
+    message: "Select active server",
+    options: config.servers.map((server) => ({
+      label: server.base_url === config.active_server_url ? `★ ${server.name}` : `   ${server.name}`,
+      value: server.base_url,
+      hint: server.base_url,
+    })),
+  });
+
+  if (!selected || isCancel(selected)) {
+    return;
+  }
+
+  setActiveServer(String(selected));
+  showSuccess(`Active server: ${String(selected)}`);
+}
+
+async function promptEditServer(): Promise<void> {
+  const config = readConfig();
+  if (config.servers.length === 0) {
+    showError("No servers configured.");
+    return;
+  }
+
+  const targetBaseUrl = await select({
+    message: "Edit server",
+    options: config.servers.map((server) => ({
+      label: server.base_url === config.active_server_url ? `★ ${server.name}` : `   ${server.name}`,
+      value: server.base_url,
+      hint: server.base_url,
+    })),
+  });
+  if (!targetBaseUrl || isCancel(targetBaseUrl)) {
+    return;
+  }
+
+  const current = readServer(String(targetBaseUrl));
+  if (!current) {
+    showError("Selected server no longer exists.");
+    return;
+  }
+
+  const field = await select({
+    message: `Edit ${current.name}`,
+    options: [
+      { label: "Name", value: "name", hint: current.name },
+      { label: "Server URL", value: "base_url", hint: current.base_url },
+      { label: "Admin secret key", value: "admin_secret_key", hint: maskSecret(current.admin_secret_key) },
+      { label: "Cancel", value: "cancel", hint: "Return without changes" },
+    ],
+  });
+  if (!field || isCancel(field) || field === "cancel") {
+    return;
+  }
+
+  const next = { ...current };
+
+  if (field === "name") {
+    const name = await text({ message: "Display name", initialValue: current.name });
+    if (!name || isCancel(name)) return;
+    next.name = String(name).trim() || current.name;
+  } else if (field === "base_url") {
+    const baseUrl = await text({ message: "Server URL", initialValue: current.base_url });
+    if (!baseUrl || isCancel(baseUrl)) return;
+    next.base_url = String(baseUrl).trim() || current.base_url;
+  } else if (field === "admin_secret_key") {
+    const adminSecretKey = await password({ message: "admin_secret_key" });
+    if (!adminSecretKey || isCancel(adminSecretKey)) return;
+    next.admin_secret_key = String(adminSecretKey).trim();
+  }
+
+  const updated = updateServer(current.base_url, next);
+  const verified = await verifyServerAdminAccess(updated);
+  if (verified) {
+    showSuccess(`Server updated: ${updated.name}`);
+  } else {
+    showError(`Server updated, but admin verification failed: ${updated.name}`);
+  }
+}
+
+async function promptRemoveServer(): Promise<void> {
+  const config = readConfig();
+  if (config.servers.length === 0) {
+    showError("No servers configured.");
+    return;
+  }
+
+  const selected = await select({
+    message: "Remove server",
+    options: [
+      ...config.servers.map((server) => ({
+        label: `${server.base_url === config.active_server_url ? "★ " : ""}${server.name}`,
+        value: server.base_url,
+        hint: server.base_url,
+      })),
+      { label: "Cancel", value: "cancel", hint: "Return without changes" },
+    ],
+  });
+  if (!selected || isCancel(selected) || selected === "cancel") {
+    return;
+  }
+
+  removeServer(String(selected));
+  const nextActive = readActiveServer();
+  showSuccess(
+    nextActive
+      ? `Server removed. Current server: ${nextActive.name}`
+      : "Server removed. No servers configured.",
+  );
+}
+
+async function verifyServerAdminAccess(server: ServerProfile): Promise<boolean> {
+  try {
+    const admin = new AdminClient({
+      base_url: server.base_url,
+      admin_secret_key: server.admin_secret_key,
+    });
+    await admin.listServices();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function printServers(servers: ServerProfile[], activeBaseUrl: string | undefined): void {
+  if (servers.length === 0) {
+    show("No servers configured.");
+    return;
+  }
+
+  console.log(`\n${servers.length} servers:\n`);
+  for (const server of servers) {
+    const marker = server.base_url === activeBaseUrl ? "★" : " ";
+    console.log(` ${marker} ${server.name.padEnd(24)} ${server.base_url}  admin=${maskSecret(server.admin_secret_key)}`);
+  }
+  console.log("");
+}
+
+function maskSecret(value: string): string {
+  const normalized = String(value ?? "").trim();
+  if (!normalized) return "(missing)";
+  if (normalized.length <= 8) return `${normalized.slice(0, 2)}***`;
+  return `${normalized.slice(0, 4)}***${normalized.slice(-2)}`;
+}

package/src/terminal/auth/user.ts

@@ -0,0 +1,351 @@
+/**
+ * User 鉴权模块。
+ *
+ * 登录方式不在 CLI 里写死，而是先读取 InfraRuntime 返回的 providers：
+ *   1. Email Login      — 邮箱 + 密码直接登录
+ *   2. Email Register   — 邮箱 + 密码注册 → 验证码 → 完成
+ *   3. 任意 OAuth Provider — 浏览器授权（完全以服务端 providers 返回为准）
+ *
+ * 已有有效 session 直接返回，不重复鉴权。
+ */
+
+import { UserClient } from "@downcity/conduit";
+import { select, isCancel } from "@clack/prompts";
+import { normalizeBaseUrl } from "../core/env.js";
+import { openBrowser } from "../core/browser.js";
+import { readUserSession, writeUserSession, readConfig, type UserSession } from "../core/session.js";
+import { askText, askSecret, showError, showSuccess, show } from "../core/ui.js";
+
+export interface UserContext {
+  session: UserSession;
+  config: { model: string };
+}
+
+type AuthMethod = "login" | "register" | `oauth:${string}`;
+
+/**
+ * 服务端返回的单个登录方式描述。
+ */
+interface AccountsProviderItem {
+  /**
+   * 登录方式标识。
+   */
+  id?: string;
+
+  /**
+   * 登录方式类别。
+   */
+  type?: string;
+
+  /**
+   * 当前 InfraRuntime 是否真的启用了该登录方式。
+   */
+  enabled?: boolean;
+
+  /**
+   * 邮箱登录是否开放。
+   */
+  login_enabled?: boolean;
+
+  /**
+   * 邮箱注册是否开放。
+   */
+  register_enabled?: boolean;
+
+  /**
+   * 当登录方式不可用时的原因码。
+   */
+  reason?: string;
+}
+
+/**
+ * 登录菜单项。
+ */
+interface AuthOption {
+  /**
+   * 菜单展示文案。
+   */
+  label: string;
+
+  /**
+   * 选择后进入的鉴权方式。
+   */
+  value: AuthMethod;
+
+  /**
+   * 菜单辅助提示。
+   */
+  hint: string;
+}
+
+// ===========================================================================
+// 入口
+// ===========================================================================
+
+export async function userAuth(baseUrl: string): Promise<UserContext | undefined> {
+  const existing = readUserSession(normalizeBaseUrl(baseUrl));
+  if (existing) return { session: existing, config: readConfig() };
+
+  while (true) {
+    const method = await selectAuthMethod(baseUrl);
+    if (!method) return undefined;
+
+    const ctx = await doAuth(baseUrl, method);
+    if (ctx) return ctx;
+  }
+}
+
+async function selectAuthMethod(baseUrl: string): Promise<AuthMethod | undefined> {
+  const options = await loadAuthOptions(baseUrl);
+  if (options.length === 0) {
+    showError("No sign-in methods enabled on server.");
+    return undefined;
+  }
+
+  const selected = await select({
+    message: "Sign in",
+    options,
+  });
+  if (!selected || isCancel(selected)) return undefined;
+  return selected as AuthMethod;
+}
+
+async function loadAuthOptions(baseUrl: string): Promise<AuthOption[]> {
+  const client = new UserClient({ base_url: normalizeBaseUrl(baseUrl) });
+  const accounts = client.service("accounts");
+
+  try {
+    const result = await accounts.get<{ items?: AccountsProviderItem[] }>("providers");
+    return mapProvidersToOptions(result.items ?? []);
+  } catch (e) {
+    showError(`Failed to load sign-in methods: ${e instanceof Error ? e.message : String(e)}`);
+    return [];
+  }
+}
+
+function mapProvidersToOptions(items: AccountsProviderItem[]): AuthOption[] {
+  const options: AuthOption[] = [];
+
+  for (const item of items) {
+    if (!item.enabled) continue;
+
+    if (item.id === "email" && item.type === "password") {
+      if (item.login_enabled !== false) {
+        options.push({ label: "Email Login", value: "login", hint: "Sign in with email + password" });
+      }
+      if (item.register_enabled !== false) {
+        options.push({ label: "Email Register", value: "register", hint: "Create a new account" });
+      }
+      continue;
+    }
+
+    if (item.type === "oauth" && typeof item.id === "string" && item.id.trim()) {
+      const provider = item.id.trim();
+      options.push({
+        label: formatOAuthProviderLabel(provider),
+        value: `oauth:${provider}`,
+        hint: `Sign in with ${formatOAuthProviderLabel(provider)} OAuth`,
+      });
+    }
+  }
+
+  return options;
+}
+
+// ===========================================================================
+// 鉴权分发
+// ===========================================================================
+
+async function doAuth(baseUrl: string, method: AuthMethod): Promise<UserContext | undefined> {
+  if (method.startsWith("oauth:")) {
+    return oauthAuth(baseUrl, method.slice("oauth:".length));
+  }
+
+  switch (method) {
+    case "login":    return emailLogin(baseUrl);
+    case "register": return emailRegister(baseUrl);
+  }
+}
+
+// ===========================================================================
+// 邮箱登录
+// ===========================================================================
+
+interface LoginResult {
+  user_token?: string;
+  user_id?: string;
+  email?: string;
+  error?: string;
+}
+
+async function emailLogin(baseUrl: string): Promise<UserContext | undefined> {
+  const email = await askText("email");
+  if (!email || !email.includes("@")) { showError("invalid email"); return undefined; }
+
+  const password = await askSecret("password");
+  if (!password) return undefined;
+
+  const client = new UserClient({ base_url: normalizeBaseUrl(baseUrl) });
+  const accounts = client.service("accounts");
+
+  try {
+    const result = await accounts.action("login").invoke<LoginResult>({ email, password });
+    if (result.error) { showError(result.error); return undefined; }
+    if (!result.user_token) { showError("login failed: no token"); return undefined; }
+
+    return saveSession(baseUrl, email, result as { user_token: string; user_id?: string });
+  } catch (e) {
+    showError(e instanceof Error ? e.message : String(e));
+    return undefined;
+  }
+}
+
+// ===========================================================================
+// 邮箱注册 + 验证
+// ===========================================================================
+
+interface RegisterResult {
+  success?: boolean;
+  message?: string;
+  verification_token?: string;
+  user_id?: string;
+  error?: string;
+}
+
+interface VerifyResult {
+  user_token?: string;
+  user_id?: string;
+  error?: string;
+}
+
+async function emailRegister(baseUrl: string): Promise<UserContext | undefined> {
+  const email = await askText("email");
+  if (!email || !email.includes("@")) { showError("invalid email"); return undefined; }
+
+  const password = await askSecret("password (min 8 characters)");
+  if (!password || password.length < 8) { showError("password must be at least 8 characters"); return undefined; }
+
+  const client = new UserClient({ base_url: normalizeBaseUrl(baseUrl) });
+  const accounts = client.service("accounts");
+
+  let reg: RegisterResult;
+  try {
+    reg = await accounts.action("register").invoke<RegisterResult>({ email, password });
+  } catch (e) {
+    showError(e instanceof Error ? e.message : String(e));
+    return undefined;
+  }
+
+  if (reg.error) { showError(reg.error); return undefined; }
+  if (!reg.success) { showError("registration failed"); return undefined; }
+
+  showSuccess("Verification code sent to your email");
+  show("If email delivery is unavailable, check server logs for the verification code.");
+
+  const token = await askText("verification token");
+  if (!token) return undefined;
+
+  try {
+    const verify = await accounts.action("verify-email").invoke<VerifyResult>({ token: token.trim() });
+    if (verify.error) { showError(verify.error); return undefined; }
+    if (!verify.user_token) { showError("verification failed: no token"); return undefined; }
+
+    return saveSession(baseUrl, email, verify as { user_token: string; user_id?: string });
+  } catch (e) {
+    showError(e instanceof Error ? e.message : String(e));
+    return undefined;
+  }
+}
+
+// ===========================================================================
+// OAuth 登录 (GitHub / Google)
+// ===========================================================================
+
+interface OAuthStartResult {
+  url?: string;
+  state?: string;
+  error?: string;
+}
+
+interface OAuthPollResult {
+  status?: string;
+  user_token?: string;
+  error?: string;
+}
+
+async function oauthAuth(baseUrl: string, provider: string): Promise<UserContext | undefined> {
+  const client = new UserClient({ base_url: normalizeBaseUrl(baseUrl) });
+  const accounts = client.service("accounts");
+
+  let start: OAuthStartResult;
+  try {
+    start = await accounts.action("oauth/start").invoke<OAuthStartResult>({ provider });
+  } catch (e) {
+    showError(e instanceof Error ? e.message : String(e));
+    return undefined;
+  }
+
+  if (start.error) { showError(start.error); return undefined; }
+  if (!start.url || !start.state) { showError("failed to start OAuth"); return undefined; }
+
+  show(`Opening browser for ${provider} authorization...`);
+  const opened = openBrowser(start.url);
+  if (!opened) showError(`Could not open browser. Please visit:\n  ${start.url}`);
+
+  show("Waiting for authorization...");
+  const result = await pollOAuth(client, start.state);
+
+  if (!result || result.error) { showError(result?.error ?? "OAuth failed"); return undefined; }
+  if (!result.user_token) { showError("OAuth failed: no token"); return undefined; }
+
+  showSuccess(`${provider} login successful`);
+  return saveSession(baseUrl, `${provider}:`, result as { user_token: string; user_id?: string });
+}
+
+/** 轮询 OAuth 结果（最多 3 分钟） */
+async function pollOAuth(client: UserClient, state: string): Promise<OAuthPollResult | undefined> {
+  const accounts = client.service("accounts");
+  for (let i = 0; i < 180; i++) {
+    try {
+      const result = await accounts.get<OAuthPollResult>("oauth/result", { state });
+      if (result.error) return result;
+      if (result.status === "done") return result;
+    } catch { /* continue polling */ }
+    await sleep(1000);
+  }
+  return { error: "OAuth timed out" };
+}
+
+// ===========================================================================
+// 工具函数
+// ===========================================================================
+
+function saveSession(baseUrl: string, email: string, result: { user_token: string; user_id?: string }): UserContext {
+  const session: UserSession = {
+    base_url: normalizeBaseUrl(baseUrl),
+    email,
+    user_id: result.user_id ?? "",
+    product_id: "prod_downcity",
+    user_token: result.user_token,
+  };
+  writeUserSession(session);
+  showSuccess(`signed in: ${email}`);
+  return { session, config: readConfig() };
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function formatOAuthProviderLabel(provider: string): string {
+  const normalized = provider.trim().toLowerCase();
+  if (!normalized) return "OAuth";
+  if (normalized === "github") return "GitHub";
+  if (normalized === "google") return "Google";
+  if (normalized === "wechat") return "WeChat";
+  return normalized
+    .split(/[_-]+/)
+    .filter(Boolean)
+    .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1))
+    .join(" ");
+}

package/src/terminal/core/browser.ts

@@ -0,0 +1,31 @@
+/**
+ * 浏览器工具模块。
+ *
+ * 关键说明（中文）
+ * - 统一封装跨平台打开默认浏览器
+ * - Stripe Checkout、OAuth 登录都复用这里，避免重复实现
+ */
+
+import { execFileSync } from "node:child_process";
+
+/**
+ * 打开系统默认浏览器。
+ */
+export function openBrowser(url: string): boolean {
+  try {
+    if (process.platform === "darwin") {
+      execFileSync("open", [url], { stdio: "ignore" });
+      return true;
+    }
+
+    if (process.platform === "win32") {
+      execFileSync("cmd", ["/c", "start", "", url], { stdio: "ignore" });
+      return true;
+    }
+
+    execFileSync("xdg-open", [url], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}