@downcity/plugins 1.0.4

package/bin/auth/Plugin.js

@@ -0,0 +1,190 @@
+/**
+ * Auth Plugin。
+ *
+ * 关键点（中文）
+ * - auth 是内建且必需的 plugin，不走可选启停语义。
+ * - 静态授权配置与动态观测态都收敛在项目 `.downcity/chat/authorization/`。
+ * - auth plugin 只负责统一暴露扩展点 / action 边界，不再依赖宿主平台读写授权配置。
+ */
+import { BasePlugin } from "@downcity/agent/internal/plugin/core/BasePlugin.js";
+import { CHAT_PLUGIN_POINTS } from "../chat/runtime/PluginPoints.js";
+import { AUTH_ACTIONS, } from "../auth/types/AuthPlugin.js";
+import { readChatAuthorizationConfig, setChatAuthorizationUserRole, writeChatAuthorizationConfig, } from "../auth/runtime/AuthorizationConfig.js";
+import { evaluateIncomingChatAuthorization, resolveAuthorizedUserRole, } from "../auth/runtime/AuthorizationPolicy.js";
+import { readAuthorizationSnapshot, recordObservedAuthorizationPrincipal, } from "../auth/runtime/AuthorizationStore.js";
+function toChannel(value) {
+    const text = String(value || "").trim().toLowerCase();
+    if (text === "telegram" || text === "feishu" || text === "qq")
+        return text;
+    return null;
+}
+function toRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    return value;
+}
+function toEvaluateInput(payload) {
+    const channel = toChannel(payload.channel);
+    if (!channel) {
+        throw new Error("auth.authorize_incoming requires a valid channel");
+    }
+    return {
+        channel,
+        chatId: String(payload.chatId || "").trim(),
+        ...(typeof payload.chatType === "string" ? { chatType: payload.chatType.trim() } : {}),
+        ...(typeof payload.userId === "string" ? { userId: payload.userId.trim() } : {}),
+        ...(typeof payload.username === "string" ? { username: payload.username.trim() } : {}),
+        ...(typeof payload.chatTitle === "string" ? { chatTitle: payload.chatTitle.trim() } : {}),
+    };
+}
+function toSnapshotData(snapshot) {
+    return {
+        config: snapshot.config,
+        users: snapshot.users,
+        chats: snapshot.chats,
+    };
+}
+function createAuthPluginDefinition() {
+    return {
+        name: "auth",
+        title: "User Authorization System",
+        description: "Controls who can talk to the agent in chat channels, records observed users and chats, and resolves each user's effective role for downstream service decisions.",
+        availability() {
+            return {
+                enabled: true,
+                available: true,
+                reasons: [],
+            };
+        },
+        hooks: {
+            guard: {
+                [CHAT_PLUGIN_POINTS.authorizeIncoming]: [
+                    async ({ context, value }) => {
+                        const input = value && typeof value === "object" && !Array.isArray(value)
+                            ? value
+                            : {};
+                        const evaluateInput = toEvaluateInput(input);
+                        const authorizationConfig = readChatAuthorizationConfig(context);
+                        const result = evaluateIncomingChatAuthorization({
+                            config: context.config,
+                            channel: evaluateInput.channel,
+                            input: evaluateInput,
+                            authorizationConfig,
+                        });
+                        if (result.decision !== "allow") {
+                            throw new Error(result.reason || "chat authorization blocked");
+                        }
+                    },
+                ],
+            },
+            effect: {
+                [CHAT_PLUGIN_POINTS.observePrincipal]: [
+                    async ({ context, value }) => {
+                        const input = toRecord(value);
+                        const channel = toChannel(input.channel);
+                        if (!channel) {
+                            throw new Error("chat.observePrincipal requires a valid channel");
+                        }
+                        await recordObservedAuthorizationPrincipal({
+                            context,
+                            channel,
+                            chatId: String(input.chatId || "").trim(),
+                            ...(typeof input.chatType === "string" ? { chatType: input.chatType.trim() } : {}),
+                            ...(typeof input.chatTitle === "string" ? { chatTitle: input.chatTitle.trim() } : {}),
+                            ...(typeof input.userId === "string" ? { userId: input.userId.trim() } : {}),
+                            ...(typeof input.username === "string" ? { username: input.username.trim() } : {}),
+                        });
+                    },
+                ],
+            },
+        },
+        resolves: {
+            [CHAT_PLUGIN_POINTS.resolveUserRole]: async ({ context, value }) => {
+                const input = value && typeof value === "object" && !Array.isArray(value)
+                    ? value
+                    : {};
+                const channel = toChannel(input.channel);
+                if (!channel) {
+                    throw new Error("chat.resolveUserRole requires a valid channel");
+                }
+                const role = resolveAuthorizedUserRole({
+                    channel,
+                    userId: String(input.userId || "").trim(),
+                    rootPath: context.rootPath,
+                });
+                return (role || null);
+            },
+        },
+        actions: {
+            [AUTH_ACTIONS.snapshot]: {
+                execute: async ({ context }) => {
+                    const snapshot = await readAuthorizationSnapshot({
+                        context,
+                    });
+                    return {
+                        success: true,
+                        data: toSnapshotData(snapshot),
+                    };
+                },
+            },
+            [AUTH_ACTIONS.readConfig]: {
+                execute: async ({ context }) => {
+                    return {
+                        success: true,
+                        data: readChatAuthorizationConfig(context),
+                    };
+                },
+            },
+            [AUTH_ACTIONS.writeConfig]: {
+                execute: async ({ context, payload }) => {
+                    const body = toRecord(payload);
+                    const nextConfig = body.config && typeof body.config === "object" && !Array.isArray(body.config)
+                        ? body.config
+                        : {};
+                    await writeChatAuthorizationConfig({
+                        context,
+                        nextConfig,
+                    });
+                    return {
+                        success: true,
+                        data: readChatAuthorizationConfig(context),
+                    };
+                },
+            },
+            [AUTH_ACTIONS.setUserRole]: {
+                execute: async ({ context, payload }) => {
+                    const body = toRecord(payload);
+                    const channel = toChannel(body.channel);
+                    if (!channel) {
+                        return {
+                            success: false,
+                            error: "set-user-role requires a valid channel",
+                            message: "set-user-role requires a valid channel",
+                        };
+                    }
+                    await setChatAuthorizationUserRole({
+                        context,
+                        channel,
+                        userId: String(body.userId || "").trim(),
+                        roleId: String(body.roleId || "").trim(),
+                    });
+                    return {
+                        success: true,
+                        data: readChatAuthorizationConfig(context),
+                    };
+                },
+            },
+        },
+    };
+}
+/**
+ * AuthPlugin：统一承载授权能力。
+ */
+export class AuthPlugin extends BasePlugin {
+    name = "auth";
+    constructor(agent = null) {
+        super(agent);
+        Object.assign(this, createAuthPluginDefinition());
+    }
+}
+//# sourceMappingURL=Plugin.js.map

package/bin/auth/Plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Plugin.js","sourceRoot":"","sources":["../../src/auth/Plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,oDAAoD,CAAC;AAGhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EACL,YAAY,GAOb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,oCAAoC,GACrC,MAAM,sCAAsC,CAAC;AAG9C,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3C,GAAG,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAmC;IACzD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAA8B;QAC/C,KAAK,EAAE,QAAQ,CAAC,KAA6B;QAC7C,KAAK,EAAE,QAAQ,CAAC,KAA6B;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO;QACL,IAAI,EAAE,MAAM;QACd,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,kKAAkK;QACpK,YAAY;YACV,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QACD,KAAK,EAAE;YACL,KAAK,EAAE;gBACL,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE;oBACtC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;wBAC3B,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;4BACzD,CAAC,CAAE,KAAiC;4BACpC,CAAC,CAAC,EAAE,CAAC;wBACT,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;wBAC7C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;wBACjE,MAAM,MAAM,GAAG,iCAAiC,CAAC;4BAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,OAAO,EAAE,aAAa,CAAC,OAAO;4BAC9B,KAAK,EAAE,aAAa;4BACpB,mBAAmB;yBACpB,CAAC,CAAC;wBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;4BAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAC;wBACjE,CAAC;oBACH,CAAC;iBACF;aACF;YACD,MAAM,EAAE;gBACN,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE;oBACrC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;wBAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAA2C,CAAC;wBACxE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;wBACpE,CAAC;wBACD,MAAM,oCAAoC,CAAC;4BACzC,OAAO;4BACP,OAAO;4BACP,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;4BACzC,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAClF,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACrF,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC5E,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnF,CAAC,CAAC;oBACL,CAAC;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjE,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBACzD,CAAC,CAAE,KAAiC;oBACpC,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,IAAI,GAAG,yBAAyB,CAAC;oBACrC,OAAO;oBACP,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;gBACH,OAAQ,CAAC,IAAI,IAAI,IAAI,CAA0B,CAAC;YAClD,CAAC;SACF;QACD,OAAO,EAAE;YACP,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;gBACvB,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;oBAC7B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;wBAC/C,OAAO;qBACR,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE;gBACzB,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;oBAC7B,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAyB;qBACnE,CAAC;gBACJ,CAAC;aACF;YACD,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE;gBAC1B,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;oBACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAsC,CAAC;oBACpE,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC3E,CAAC,CAAE,IAAI,CAAC,MAAkC;wBAC1C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,4BAA4B,CAAC;wBACjC,OAAO;wBACP,UAAU;qBACX,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAyB;qBACnE,CAAC;gBACJ,CAAC;aACF;YACD,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE;gBAC1B,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;oBACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAsC,CAAC;oBACpE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACxC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,wCAAwC;4BAC/C,OAAO,EAAE,wCAAwC;yBAClD,CAAC;oBACJ,CAAC;oBACD,MAAM,4BAA4B,CAAC;wBACjC,OAAO;wBACP,OAAO;wBACP,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;wBACxC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;qBACzC,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAyB;qBACnE,CAAC;gBACJ,CAAC;aACF;SACF;KACA,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,UAAU;IAC/B,IAAI,GAAG,MAAM,CAAC;IAEvB,YAAY,QAA6B,IAAI;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACpD,CAAC;CACF"}

package/bin/auth/runtime/AuthorizationConfig.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Auth 授权配置读写工具。
+ *
+ * 关键点（中文）
+ * - 静态授权规则直接存放在项目 `.downcity/chat/authorization/config.json`。
+ * - 授权核心模型为 role / permission / binding。
+ */
+import type { AgentContext } from "@downcity/agent/internal/types/runtime/agent/AgentContext.js";
+import type { ChatAuthorizationConfig, ChatAuthorizationChannel, ChatAuthorizationPermission, ChatAuthorizationRole } from "../../auth/types/AuthPlugin.js";
+export declare const DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS: ChatAuthorizationPermission[];
+/**
+ * 同步读取当前 agent 的授权配置。
+ */
+export declare function readChatAuthorizationConfigSync(projectRoot: string): ChatAuthorizationConfig;
+/**
+ * 读取当前 agent 的授权配置。
+ */
+export declare function readChatAuthorizationConfig(contextOrProjectRoot: Pick<AgentContext, "rootPath"> | string): ChatAuthorizationConfig;
+/**
+ * 覆盖写入整份授权配置。
+ */
+export declare function writeChatAuthorizationConfig(params: {
+    context: Pick<AgentContext, "rootPath">;
+    nextConfig: ChatAuthorizationConfig;
+}): Promise<void>;
+/**
+ * 读取角色列表。
+ */
+export declare function listChatAuthorizationRoles(params: {
+    config: ChatAuthorizationConfig;
+}): ChatAuthorizationRole[];
+/**
+ * 设置用户角色。
+ */
+export declare function setChatAuthorizationUserRole(params: {
+    context: Pick<AgentContext, "rootPath">;
+    channel: ChatAuthorizationChannel;
+    userId: string;
+    roleId: string;
+}): Promise<void>;
+//# sourceMappingURL=AuthorizationConfig.d.ts.map

package/bin/auth/runtime/AuthorizationConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationConfig.d.ts","sourceRoot":"","sources":["../../../src/auth/runtime/AuthorizationConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EAEtB,MAAM,4BAA4B,CAAC;AASpC,eAAO,MAAM,sCAAsC,EAAE,2BAA2B,EAE/E,CAAC;AAwJF;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAE5F;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,GAC5D,uBAAuB,CAKzB;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACxC,UAAU,EAAE,uBAAuB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,MAAM,EAAE,uBAAuB,CAAC;CACjC,GAAG,qBAAqB,EAAE,CAG1B;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB"}

package/bin/auth/runtime/AuthorizationConfig.js

@@ -0,0 +1,185 @@
+/**
+ * Auth 授权配置读写工具。
+ *
+ * 关键点（中文）
+ * - 静态授权规则直接存放在项目 `.downcity/chat/authorization/config.json`。
+ * - 授权核心模型为 role / permission / binding。
+ */
+import fs from "fs-extra";
+import path from "node:path";
+import { CHAT_AUTHORIZATION_CHANNELS, CHAT_AUTHORIZATION_PERMISSIONS, createDefaultChatAuthorizationRoles, } from "../../auth/types/AuthPlugin.js";
+const CHANNELS = [...CHAT_AUTHORIZATION_CHANNELS];
+export const DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS = [
+    ...CHAT_AUTHORIZATION_PERMISSIONS,
+];
+function normalizeText(value) {
+    const text = String(value || "").trim();
+    return text ? text : undefined;
+}
+function normalizePermissionList(values) {
+    const allowed = new Set(DEFAULT_CHAT_AUTHORIZATION_PERMISSIONS);
+    if (!Array.isArray(values))
+        return [];
+    return [
+        ...new Set(values
+            .map((value) => normalizeText(value))
+            .filter((value) => Boolean(value && allowed.has(value)))),
+    ];
+}
+function buildDefaultRole(roleId) {
+    return createDefaultChatAuthorizationRoles()[roleId];
+}
+function normalizeRoleMap(input) {
+    const defaultRoles = createDefaultChatAuthorizationRoles();
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return defaultRoles;
+    const roles = {};
+    for (const [rawRoleId, rawRole] of Object.entries(input)) {
+        const roleId = normalizeText(rawRoleId);
+        if (!roleId)
+            continue;
+        const roleObj = rawRole && typeof rawRole === "object" && !Array.isArray(rawRole)
+            ? rawRole
+            : null;
+        if (!roleObj)
+            continue;
+        const builtinRole = defaultRoles[roleId];
+        roles[roleId] = {
+            roleId,
+            name: normalizeText(roleObj.name) || builtinRole?.name || roleId,
+            ...(normalizeText(roleObj.description) || builtinRole?.description
+                ? {
+                    description: normalizeText(roleObj.description) || builtinRole?.description || undefined,
+                }
+                : {}),
+            permissions: normalizePermissionList(roleObj.permissions),
+        };
+    }
+    if (Object.keys(roles).length === 0)
+        return defaultRoles;
+    if (!roles.default)
+        roles.default = buildDefaultRole("default");
+    return roles;
+}
+function normalizeBindingMap(input, roles) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return {};
+    const out = {};
+    for (const [rawId, rawRoleId] of Object.entries(input)) {
+        const entityId = normalizeText(rawId);
+        const roleId = normalizeText(rawRoleId);
+        if (!entityId || !roleId || !roles[roleId])
+            continue;
+        out[entityId] = roleId;
+    }
+    return out;
+}
+function normalizeChannelConfig(input, roles) {
+    const raw = input && typeof input === "object" && !Array.isArray(input)
+        ? input
+        : {};
+    const defaultUserRoleId = normalizeText(raw.defaultUserRoleId) || "default";
+    return {
+        defaultUserRoleId: roles[defaultUserRoleId] ? defaultUserRoleId : "default",
+        userRoles: normalizeBindingMap(raw.userRoles, roles),
+    };
+}
+function normalizeAuthorizationConfig(input) {
+    const raw = input && typeof input === "object" && !Array.isArray(input)
+        ? input
+        : {};
+    const roles = normalizeRoleMap(raw.roles);
+    const channels = {};
+    for (const channel of CHANNELS) {
+        channels[channel] = normalizeChannelConfig(raw.channels?.[channel], roles);
+    }
+    return { roles, channels };
+}
+function cloneAuthorizationConfig(input) {
+    return normalizeAuthorizationConfig(input ? JSON.parse(JSON.stringify(input)) : {});
+}
+function getChatAuthorizationConfigPath(projectRoot) {
+    return path.join(projectRoot, ".downcity", "chat", "authorization", "config.json");
+}
+function readAuthorizationConfigFromProjectRoot(projectRoot) {
+    const normalizedProjectRoot = normalizeText(projectRoot);
+    if (!normalizedProjectRoot)
+        return normalizeAuthorizationConfig({});
+    const file = getChatAuthorizationConfigPath(normalizedProjectRoot);
+    if (!fs.existsSync(file))
+        return normalizeAuthorizationConfig({});
+    try {
+        return normalizeAuthorizationConfig(fs.readJsonSync(file));
+    }
+    catch {
+        return normalizeAuthorizationConfig({});
+    }
+}
+async function writeAuthorizationConfigToPlatform(params) {
+    const normalizedProjectRoot = normalizeText(params.projectRoot);
+    if (!normalizedProjectRoot)
+        throw new Error("projectRoot is required");
+    const file = getChatAuthorizationConfigPath(normalizedProjectRoot);
+    await fs.ensureDir(path.dirname(file));
+    await fs.writeJson(file, normalizeAuthorizationConfig(params.nextConfig), {
+        spaces: 2,
+    });
+}
+function ensureChannelConfig(config, channel) {
+    config.roles = normalizeRoleMap(config.roles);
+    config.channels ??= {};
+    config.channels[channel] = normalizeChannelConfig(config.channels[channel], config.roles);
+    return config.channels[channel];
+}
+/**
+ * 同步读取当前 agent 的授权配置。
+ */
+export function readChatAuthorizationConfigSync(projectRoot) {
+    return readAuthorizationConfigFromProjectRoot(projectRoot);
+}
+/**
+ * 读取当前 agent 的授权配置。
+ */
+export function readChatAuthorizationConfig(contextOrProjectRoot) {
+    if (typeof contextOrProjectRoot === "string") {
+        return readAuthorizationConfigFromProjectRoot(contextOrProjectRoot);
+    }
+    return readAuthorizationConfigFromProjectRoot(contextOrProjectRoot.rootPath);
+}
+/**
+ * 覆盖写入整份授权配置。
+ */
+export async function writeChatAuthorizationConfig(params) {
+    await writeAuthorizationConfigToPlatform({
+        projectRoot: params.context.rootPath,
+        nextConfig: params.nextConfig,
+    });
+}
+/**
+ * 读取角色列表。
+ */
+export function listChatAuthorizationRoles(params) {
+    const config = normalizeAuthorizationConfig(params.config);
+    return Object.values(config.roles || {}).sort((a, b) => a.roleId.localeCompare(b.roleId));
+}
+/**
+ * 设置用户角色。
+ */
+export async function setChatAuthorizationUserRole(params) {
+    const userId = normalizeText(params.userId);
+    const roleId = normalizeText(params.roleId);
+    if (!userId || !roleId)
+        throw new Error("userId and roleId are required");
+    const authorization = cloneAuthorizationConfig(readAuthorizationConfigFromProjectRoot(params.context.rootPath));
+    authorization.roles = normalizeRoleMap(authorization.roles);
+    const channelConfig = ensureChannelConfig(authorization, params.channel);
+    if (!authorization.roles?.[roleId])
+        throw new Error(`Unknown roleId: ${roleId}`);
+    channelConfig.userRoles ??= {};
+    channelConfig.userRoles[userId] = roleId;
+    await writeAuthorizationConfigToPlatform({
+        projectRoot: params.context.rootPath,
+        nextConfig: authorization,
+    });
+}
+//# sourceMappingURL=AuthorizationConfig.js.map

package/bin/auth/runtime/AuthorizationConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationConfig.js","sourceRoot":"","sources":["../../../src/auth/runtime/AuthorizationConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AAEpC,MAAM,QAAQ,GAA+B,CAAC,GAAG,2BAA2B,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,sCAAsC,GAAkC;IACnF,GAAG,8BAA8B;CAClC,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA6B;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,sCAAsC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,MAAM;aACH,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpC,MAAM,CACL,CAAC,KAAK,EAAwC,EAAE,CAC9C,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACvC,CACJ;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsC;IAC9D,OAAO,mCAAmC,EAAE,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,MAAM,YAAY,GAAG,mCAAmC,EAAE,CAAC;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACrF,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,OAAO,GACX,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,OAKC;YACJ,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM;YACN,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,IAAI,IAAI,MAAM;YAChE,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,WAAW;gBAChE,CAAC,CAAC;oBACE,WAAW,EACT,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,WAAW,IAAI,SAAS;iBAC9E;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAc,EACd,KAA4C;IAE5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS;QACrD,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,KAA4C;IAE5C,MAAM,GAAG,GACP,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAGC;QACJ,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IAC5E,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QAC3E,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,MAAM,GAAG,GACP,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAAiE;QACpE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAA8E,EAAE,CAAC;IAC/F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAA0C;IAE1C,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,8BAA8B,CAAC,WAAmB;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,sCAAsC,CAAC,WAAmB;IACjE,MAAM,qBAAqB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,qBAAqB;QAAE,OAAO,4BAA4B,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,8BAA8B,CAAC,qBAAqB,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,MAGjD;IACC,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,qBAAqB;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,8BAA8B,CAAC,qBAAqB,CAAC,CAAC;IACnE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,4BAA4B,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QACxE,MAAM,EAAE,CAAC;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA+B,EAC/B,OAAiC;IAEjC,MAAM,CAAC,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;IACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAmC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,WAAmB;IACjE,OAAO,sCAAsC,CAAC,WAAW,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,oBAA6D;IAE7D,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,sCAAsC,CAAC,oBAAoB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,sCAAsC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAGlD;IACC,MAAM,kCAAkC,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACpC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAE1C;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAKlD;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,wBAAwB,CAC5C,sCAAsC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAChE,CAAC;IACF,aAAa,CAAC,KAAK,GAAG,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACjF,aAAa,CAAC,SAAS,KAAK,EAAE,CAAC;IAC/B,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,kCAAkC,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACpC,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/bin/auth/runtime/AuthorizationPolicy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Auth 授权判定逻辑。
+ *
+ * 关键点（中文）
+ * - 角色模型替代旧的 allowlist/pairing 模型。
+ * - 判定统一走“用户角色 + 权限集合”，群聊只看发言用户自身权限。
+ */
+import type { DowncityConfig } from "@downcity/agent/internal/types/config/DowncityConfig.js";
+import type { ChatAuthorizationConfig, ChatAuthorizationChannel, ChatAuthorizationEvaluateInput, ChatAuthorizationEvaluateResult, ChatAuthorizationRole } from "../../auth/types/AuthPlugin.js";
+/**
+ * 解析用户授权角色。
+ */
+export declare function resolveAuthorizedUserRole(params: {
+    channel: ChatAuthorizationChannel;
+    userId?: string;
+    authorizationConfig?: ChatAuthorizationConfig;
+    rootPath?: string;
+}): ChatAuthorizationRole | undefined;
+/**
+ * 执行入站授权判定。
+ */
+export declare function evaluateIncomingChatAuthorization(params: {
+    config: DowncityConfig;
+    channel: ChatAuthorizationChannel;
+    input: ChatAuthorizationEvaluateInput;
+    authorizationConfig?: ChatAuthorizationConfig;
+}): ChatAuthorizationEvaluateResult;
+//# sourceMappingURL=AuthorizationPolicy.d.ts.map

package/bin/auth/runtime/AuthorizationPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationPolicy.d.ts","sourceRoot":"","sources":["../../../src/auth/runtime/AuthorizationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAC9F,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAE/B,qBAAqB,EAEtB,MAAM,4BAA4B,CAAC;AAqEpC;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,qBAAqB,GAAG,SAAS,CAepC;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACxD,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,wBAAwB,CAAC;IAClC,KAAK,EAAE,8BAA8B,CAAC;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C,GAAG,+BAA+B,CA+ClC"}

package/bin/auth/runtime/AuthorizationPolicy.js

@@ -0,0 +1,124 @@
+/**
+ * Auth 授权判定逻辑。
+ *
+ * 关键点（中文）
+ * - 角色模型替代旧的 allowlist/pairing 模型。
+ * - 判定统一走“用户角色 + 权限集合”，群聊只看发言用户自身权限。
+ */
+import { createDefaultChatAuthorizationRoles } from "../../auth/types/AuthPlugin.js";
+import { readChatAuthorizationConfigSync } from "../../auth/runtime/AuthorizationConfig.js";
+function normalizeText(value) {
+    const text = String(value || "").trim();
+    return text ? text : undefined;
+}
+function isDirectMessage(channel, chatType) {
+    const type = String(chatType || "").trim().toLowerCase();
+    if (!type)
+        return true;
+    if (channel === "telegram")
+        return type === "private";
+    if (channel === "feishu")
+        return type === "p2p";
+    if (channel === "qq")
+        return type === "private" || type === "c2c";
+    return false;
+}
+function resolveAuthorizationRoles(authorizationConfig) {
+    const raw = authorizationConfig?.roles;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return createDefaultChatAuthorizationRoles();
+    }
+    return Object.keys(raw).length > 0 ? raw : createDefaultChatAuthorizationRoles();
+}
+function resolveChannelAuthorizationConfig(channel, authorizationConfig) {
+    const raw = authorizationConfig?.channels?.[channel];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {
+            defaultUserRoleId: "default",
+            userRoles: {},
+        };
+    }
+    return raw;
+}
+function resolveRole(roleId, roles) {
+    if (roleId && roles?.[roleId])
+        return roles[roleId];
+    if (roles?.default)
+        return roles.default;
+    return { roleId: "default", name: "Default", permissions: [] };
+}
+function hasPermission(role, permission) {
+    return role.permissions.includes(permission);
+}
+function resolveUserRole(params) {
+    const userId = normalizeText(params.userId);
+    const defaultRoleId = normalizeText(params.channelConfig.defaultUserRoleId) || "default";
+    const boundRoleId = userId ? normalizeText(params.channelConfig.userRoles?.[userId]) : undefined;
+    return resolveRole(boundRoleId || defaultRoleId, params.roles);
+}
+/**
+ * 解析用户授权角色。
+ */
+export function resolveAuthorizedUserRole(params) {
+    const userId = normalizeText(params.userId);
+    if (!userId)
+        return undefined;
+    const authorizationConfig = params.authorizationConfig ||
+        (params.rootPath
+            ? readChatAuthorizationConfigSync(params.rootPath)
+            : undefined);
+    const roles = resolveAuthorizationRoles(authorizationConfig);
+    const channelConfig = resolveChannelAuthorizationConfig(params.channel, authorizationConfig);
+    return resolveUserRole({
+        roles,
+        channelConfig,
+        userId,
+    });
+}
+/**
+ * 执行入站授权判定。
+ */
+export function evaluateIncomingChatAuthorization(params) {
+    const channelConfig = resolveChannelAuthorizationConfig(params.channel, params.authorizationConfig);
+    const roles = resolveAuthorizationRoles(params.authorizationConfig);
+    const direct = isDirectMessage(params.channel, params.input.chatType);
+    const userRole = resolveUserRole({
+        roles,
+        channelConfig,
+        userId: params.input.userId,
+    });
+    const isOwner = hasPermission(userRole, "agent.manage");
+    if (direct) {
+        return hasPermission(userRole, "chat.dm.use")
+            ? {
+                decision: "allow",
+                isOwner,
+                userRoleId: userRole.roleId,
+                userPermissions: [...userRole.permissions],
+                reason: "dm_role_allowed",
+            }
+            : {
+                decision: "block",
+                isOwner,
+                userRoleId: userRole.roleId,
+                userPermissions: [...userRole.permissions],
+                reason: "dm_role_blocked",
+            };
+    }
+    return hasPermission(userRole, "chat.group.use")
+        ? {
+            decision: "allow",
+            isOwner,
+            userRoleId: userRole.roleId,
+            userPermissions: [...userRole.permissions],
+            reason: "group_user_role_allowed",
+        }
+        : {
+            decision: "block",
+            isOwner,
+            userRoleId: userRole.roleId,
+            userPermissions: [...userRole.permissions],
+            reason: "user_group_permission_blocked",
+        };
+}
+//# sourceMappingURL=AuthorizationPolicy.js.map

package/bin/auth/runtime/AuthorizationPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationPolicy.js","sourceRoot":"","sources":["../../../src/auth/runtime/AuthorizationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,OAAO,EAAE,mCAAmC,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AAExF,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,OAAiC,EAAE,QAAiB;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,KAAK,SAAS,CAAC;IACtD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,KAAK,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAChC,mBAA6C;IAE7C,MAAM,GAAG,GAAG,mBAAmB,EAAE,KAAK,CAAC;IACvC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,mCAAmC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAiC,EACjC,mBAA6C;IAE7C,MAAM,GAAG,GAAG,mBAAmB,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,iBAAiB,EAAE,SAAS;YAC5B,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAClB,MAA0B,EAC1B,KAAwD;IAExD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,EAAE,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACzC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CACpB,IAA2B,EAC3B,UAAuC;IAEvC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,MAIxB;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IACzF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,OAAO,WAAW,CAAC,WAAW,IAAI,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAKzC;IACC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,mBAAmB,GACvB,MAAM,CAAC,mBAAmB;QAC1B,CAAC,MAAM,CAAC,QAAQ;YACd,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,QAAQ,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,iCAAiC,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7F,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,aAAa;QACb,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAKjD;IACC,MAAM,aAAa,GAAG,iCAAiC,CACrD,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,mBAAmB,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,KAAK;QACL,aAAa;QACb,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;KAC5B,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAExD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;YAC3C,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO;gBACP,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,iBAAiB;aAC1B;YACH,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO;gBACP,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAC1C,MAAM,EAAE,iBAAiB;aAC1B,CAAC;IACR,CAAC;IAED,OAAO,aAAa,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC9C,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,yBAAyB;SAClC;QACH,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,eAAe,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,+BAA+B;SACxC,CAAC;AACR,CAAC"}

package/bin/auth/runtime/AuthorizationStore.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Auth 授权运行时状态存储。
+ *
+ * 关键点（中文）
+ * - 所有动态状态（观测用户 / 会话）统一落盘到 `.downcity/chat/authorization/state.json`。
+ * - 静态授权配置保存在同目录下的 `config.json`，不和运行时观测数据混写。
+ */
+import type { ChatAuthorizationSnapshot } from "../../auth/types/AuthPlugin.js";
+import type { AgentContext } from "@downcity/agent/internal/types/runtime/agent/AgentContext.js";
+import type { ChatDispatchChannel } from "../../chat/types/ChatDispatcher.js";
+/**
+ * 记录观测到的用户 / 会话。
+ */
+export declare function recordObservedAuthorizationPrincipal(params: {
+    context: Pick<AgentContext, "rootPath">;
+    channel: ChatDispatchChannel;
+    chatId: string;
+    chatType?: string;
+    chatTitle?: string;
+    userId?: string;
+    username?: string;
+}): Promise<void>;
+/**
+ * 读取授权快照（配置 + 动态状态）。
+ */
+export declare function readAuthorizationSnapshot(params: {
+    context: Pick<AgentContext, "rootPath">;
+}): Promise<ChatAuthorizationSnapshot>;
+//# sourceMappingURL=AuthorizationStore.d.ts.map

package/bin/auth/runtime/AuthorizationStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationStore.d.ts","sourceRoot":"","sources":["../../../src/auth/runtime/AuthorizationStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAGV,yBAAyB,EAE1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAwI1E;;GAEG;AACH,wBAAsB,oCAAoC,CAAC,MAAM,EAAE;IACjE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAOrC"}