@easyai-canvas/canvas-plugin-sdk 0.1.0 → 0.1.1

package/README.md

@@ -20,3 +20,5 @@ npm start
 托管节点暂不支持文件和画布宿主能力。管理员导入 ZIP 后默认停用，审核插件代码、声明能力和版本摘要后启用。版本切换不会改变已提交任务使用的包摘要。
 
 公开导入路径：`@easyai-canvas/canvas-plugin-sdk`、`@easyai-canvas/canvas-plugin-sdk/protocol`、`@easyai-canvas/canvas-plugin-sdk/ui`。客户项目不需访问 EasyAI 画布源码。
+
+后台节点从 `request.parameters` 读取用户在画布上设置的参数，从 `request.inputsByPort` 读取上游数据，从 `request.context.runtime` 读取平台生成的默认上下文。查询处理器的第三个参数也是默认上下文，其中 `user.ssoId` 仅在用户已绑定 SSO 时提供。默认上下文不包含用户登录 Token；插件不得把参数或查询输入中的身份字段当作平台身份。

package/dist/protocol/index.d.ts

@@ -50,6 +50,7 @@ export type PluginMenuContribution = {
     order?: number;
     icon?: string;
 };
+/** Platform-derived identity and location, shared by backend node handlers and queries. Never accepts a login token. */
 export type PluginRuntimeContext = {
     user: {
         id: string;
@@ -182,6 +183,7 @@ export type ExecutionRequest = {
     executionId: string;
     pluginId: string;
     nodeType: string;
+    /** User-edited node settings. Neither these nor inputsByPort can override context.runtime. */
     parameters: Record<string, unknown>;
     inputsByPort: Record<string, DataPacket[]>;
     document?: {

package/dist/protocol/index.js

@@ -325,12 +325,21 @@ export function validateExecution(value, node) {
     if (request.nodeType !== node.type)
         throw new ContractError('节点类型不匹配');
     object(request.parameters, 'parameters');
-    const context = object(request.context, 'context');
+    const context = keys(request.context, ['nodeId', 'taskId', 'userId', 'projectId', 'runtime'], 'execution.context');
     identifier(context.nodeId, 'nodeId');
     if (typeof context.userId !== 'string' || !context.userId)
         throw new ContractError('调用身份缺失');
-    if (context.runtime !== undefined)
-        validatePluginRuntimeContext(context.runtime);
+    optionalString(context.taskId, 'context.taskId');
+    optionalString(context.projectId, 'context.projectId');
+    if (context.runtime !== undefined) {
+        const runtime = validatePluginRuntimeContext(context.runtime);
+        if (runtime.user.id !== context.userId)
+            throw new ContractError('运行上下文身份不匹配');
+        if (runtime.projectId !== undefined && runtime.projectId !== context.projectId)
+            throw new ContractError('运行上下文项目不匹配');
+        if (runtime.nodeId !== undefined && runtime.nodeId !== context.nodeId)
+            throw new ContractError('运行上下文节点不匹配');
+    }
     if (request.host !== undefined) {
         const host = keys(request.host, ['files'], 'execution.host');
         if (host.files !== undefined) {

package/dist/runtime/package-runtime.js

@@ -4,7 +4,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, writeFile, rename, rm, lstat, } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { fork } from 'node:child_process';
-import { ContractError, validateManifest, validateExecution, object, } from '../protocol/index.js';
+import { ContractError, validateManifest, validateExecution, validatePluginRuntimeContext, object, } from '../protocol/index.js';
 export const PLUGIN_PACKAGE_MAX_BYTES = 16 * 1024 * 1024;
 const MAX_EXPANDED_BYTES = 64 * 1024 * 1024;
 const MAX_FILES = 128;
@@ -278,6 +278,10 @@ export async function invokePluginPackage(pkg, call, options = {}) {
             throw new ContractError('插件节点处理器与安装包声明不匹配', 400, 'INVALID_PACKAGE');
         call = { ...call, request: validateExecution(request, node) };
     }
+    if (call.operation === 'query' && call.context !== undefined) {
+        // Platform queries always carry a context; keep direct legacy package calls compatible.
+        call = { ...call, context: validatePluginRuntimeContext(call.context) };
+    }
     if (Number(process.versions.node.split('.')[0]) !==
         pkg.descriptor.runtime.nodeMajor)
         throw new ContractError('平台 Node 运行版本不兼容', 400, 'INVALID_PACKAGE');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easyai-canvas/canvas-plugin-sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "EasyAI 画布插件开发工具与运行时",
   "type": "module",
   "engines": {