@eduwork/dsh-oidc 0.1.0-alpha.11 → 0.2.0

package/lib/oidc.js

@@ -1,4 +1,6 @@
 import { createHash, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify as verifySignature } from 'node:crypto'
+import { emptyResources, normalizeResourceModels } from './resources.js'
+import { DEFAULT_CREDENTIAL_REF, legacyCredentialRefs } from './profile.js'
 
 const FLOW_TTL_MS = 10 * 60 * 1000
 const MAX_PENDING_FLOWS = 32
@@ -72,6 +74,22 @@ function sessionRef(profile) {
   return `DSH_OIDC_${profile.id.toUpperCase().replace(/-/g, '_')}_SESSION`
 }
 
+function resourceBinding(profile) {
+  return profile.keyBinding ? {
+    managementBaseURL: profile.keyBinding.baseURL, runtimeBaseURL: profile.provider.baseURL,
+    providerID: profile.provider.id, credentialRef: profile.keyBinding.credentialRef,
+  } : null
+}
+
+function credentialHash(value) {
+  return typeof value === 'string' && value ? createHash('sha256').update(value).digest('hex') : ''
+}
+
+function sameResourceBinding(left, right, ignoreRef = false) {
+  return Boolean(left && right && ['managementBaseURL', 'runtimeBaseURL', 'providerID', ...(ignoreRef ? [] : ['credentialRef'])]
+    .every(key => left[key] === right[key]))
+}
+
 function nowSeconds(now) {
   return Math.floor(now() / 1000)
 }
@@ -85,11 +103,11 @@ function account(profile, session, credentialReady, credentialState = '') {
     profileID: profile.id,
     displayName: profile.displayName,
     organization: profile.organization,
-    state: session ? (credentialReady ? 'connected' : 'authenticated') : 'signed_out',
+    state: session ? (credentialReady || !profile.keyBinding ? 'connected' : 'authenticated') : 'signed_out',
     ...(session?.identity?.name ? { userName: session.identity.name } : {}),
     ...(session?.identity?.affiliation ? { affiliation: session.identity.affiliation } : {}),
     ...(session?.expiresAt ? { accessExpiresAt: new Date(session.expiresAt * 1000).toISOString() } : {}),
-    credentialRef: profile.keyBinding.credentialRef,
+    credentialRef: profile.keyBinding?.credentialRef ?? '',
     credentialReady,
     ...(credentialState ? { credentialState } : {}),
     capabilities: Array.isArray(session?.capabilities) ? session.capabilities : [],
@@ -105,6 +123,8 @@ function runtimeModel(model) {
     ...(model?.maxTokens ? { maxTokens: model.maxTokens } : {}),
     ...(Array.isArray(model?.input) ? { input: [...model.input] } : {}),
     ...(typeof model?.reasoning === 'boolean' ? { reasoning: model.reasoning } : {}),
+    ...(model?.defaultReasoningEffort ? { defaultReasoningEffort: String(model.defaultReasoningEffort) } : {}),
+    ...(model?.reasoningEfforts === false ? { reasoningEfforts: false } : {}),
     ...(model?.reasoningEfforts && typeof model.reasoningEfforts === 'object' ? { reasoningEfforts: { ...model.reasoningEfforts } } : {}),
     ...(model?.compat && typeof model.compat === 'object' ? { compat: { ...model.compat } } : {}),
   }
@@ -125,9 +145,9 @@ function runtimeProjection(runtime = {}, fallback = {}) {
 function profileManagement(profiles) {
   const rows = [...profiles.values()].map(profile => ({
     id: profile.id, displayName: profile.displayName, organization: profile.organization,
-    baseURL: profile.provider.baseURL, builtIn: true, configured: true, enabled: true,
-    providerID: profile.provider.id,
-    runtime: runtimeProjection({ ...profile.provider, modelSource: 'profile' }, profile.provider),
+    baseURL: profile.provider?.baseURL ?? profile.oidc.issuer, builtIn: true, configured: true, enabled: true,
+    providerID: profile.provider?.id ?? '',
+    runtime: runtimeProjection({ ...profile.provider, modelSource: profile.provider?.modelSource ?? 'none' }, profile.provider),
   }))
   return {
     schemaVersion: 'dsh-oidc/management/v1alpha1', mode: 'profile',
@@ -193,9 +213,24 @@ export class WebOidcBackend {
     this.profiles = profiles
     this.config = config
     this.fetch = options.fetch ?? fetch
+    this.updateProvider = options.updateProvider ?? (() => {})
+    this.accountChanged = options.accountChanged ?? (() => {})
+    if (options.authorizedOrigins !== undefined && (!Array.isArray(options.authorizedOrigins) || options.authorizedOrigins.length > 64)) throw new Error('authorizedOrigins must be a bounded origin array')
+    this.authorizedOrigins = (options.authorizedOrigins ?? []).map(value => {
+      const url = new URL(value)
+      if (url.origin !== value || url.protocol !== 'https:') throw new Error('authorizedOrigins must contain exact HTTPS origins')
+      return value
+    })
+    this.resourceStates = new Map()
+    this.resourceFlights = new Map()
+    this.refreshFlights = new Map()
+    this.accountEpochs = new Map()
+    this.credentialWrites = new Map()
+    this.reviewedProfiles = new Map(profiles)
     this.now = options.now ?? Date.now
     this.flows = new Map()
     this.discovery = new Map()
+    if (options.transport === 'desktop') return
     this.callbackBaseURL = loopbackBaseURL(config, ctx.webServer)
     this.returnPath = normalizeReturnPath(config.returnPath, this.callbackBaseURL)
     this.callbackPath = OIDC_CALLBACK_PATH
@@ -249,18 +284,24 @@ export class WebOidcBackend {
     const discovery = await this.discover(profile)
     this.pruneFlows()
     if (this.flows.size >= MAX_PENDING_FLOWS) throw publicError('oidc_flow_limit', 'too many pending OIDC login attempts')
+    const { authorizationURL } = this.createAuthorization(profile, discovery, this.redirectURI)
+    return { mode: 'redirect', authorizationURL }
+  }
+
+  createAuthorization(profile, discovery, redirectURI) {
     const state = base64url(randomBytes(32))
     const nonce = base64url(randomBytes(32))
     const verifier = base64url(randomBytes(48))
     const challenge = base64url(createHash('sha256').update(verifier).digest())
-    this.flows.set(state, { profileID, nonce, verifier, createdAt: this.now() })
+    const flow = { profileID: profile.id, nonce, verifier, redirectURI, createdAt: this.now(), epoch: this.accountEpoch(profile) }
+    this.flows.set(state, flow)
     const target = new URL(discovery.authorizationEndpoint)
     for (const [key, value] of Object.entries({
-      response_type: 'code', client_id: profile.oidc.clientId, redirect_uri: this.redirectURI,
+      response_type: 'code', client_id: profile.oidc.clientId, redirect_uri: redirectURI,
       scope: profile.oidc.scopes.join(' '), state, nonce, code_challenge: challenge,
       code_challenge_method: 'S256',
     })) target.searchParams.set(key, value)
-    return { mode: 'redirect', authorizationURL: target.toString() }
+    return { state, flow, authorizationURL: target.toString() }
   }
 
   pruneFlows() {
@@ -280,18 +321,13 @@ export class WebOidcBackend {
       if (!flow || flow.createdAt < this.now() - FLOW_TTL_MS) throw publicError('oidc_callback_invalid', 'OIDC login state is missing or expired')
       profileID = flow.profileID
       const profile = this.profile(flow.profileID)
-      const oauthError = singleQueryParameter(requested, 'error')
-      if (oauthError) throw publicError('oidc_authorization_rejected', `OIDC authorization returned ${oauthError}`)
-      const code = singleQueryParameter(requested, 'code', true)
-      const responseIssuer = singleQueryParameter(requested, 'iss')
-      if (responseIssuer && !equalText(responseIssuer, profile.oidc.issuer)) throw publicError('oidc_callback_invalid', 'OIDC authorization response issuer is invalid')
-      const discovery = await this.discover(profile)
-      const session = await this.exchangeCode(profile, discovery, code, flow.verifier, flow.nonce)
-      await this.saveSession(profile, session)
+      const session = await this.exchangeAuthorization(requested, flow)
+      await this.saveSession(profile, session, flow.epoch)
       const status = await this.reconcile(profile.id, { allowProvision: false })
-      outcome = status.credentialReady ? 'connected' : 'credential-required'
+      this.accountChanged(status)
+      outcome = status.state === 'connected' ? 'connected' : 'credential-required'
     } catch (cause) {
-      this.ctx.logger.warn(cause instanceof Error ? cause : new Error(String(cause)))
+      this.ctx.logger.warn('OIDC callback failed', { code: cause?.code ?? 'oidc_callback_failed' })
       outcome = cause?.code ?? 'oidc_callback_failed'
     }
     const target = new URL(this.returnPath, this.callbackBaseURL)
@@ -301,10 +337,19 @@ export class WebOidcBackend {
     response.end()
   }
 
-  async exchangeCode(profile, discovery, code, verifier, nonce) {
+  async exchangeAuthorization(requested, flow) {
+    const profile = this.profile(flow.profileID)
+    if (singleQueryParameter(requested, 'error')) throw publicError('oidc_authorization_rejected', 'OIDC authorization was rejected')
+    const code = singleQueryParameter(requested, 'code', true)
+    const issuer = singleQueryParameter(requested, 'iss')
+    if (issuer && !equalText(issuer, profile.oidc.issuer)) throw publicError('oidc_callback_invalid', 'OIDC authorization response issuer is invalid')
+    return this.exchangeCode(profile, await this.discover(profile), code, flow.verifier, flow.nonce, flow.redirectURI)
+  }
+
+  async exchangeCode(profile, discovery, code, verifier, nonce, redirectURI = this.redirectURI) {
     const body = new URLSearchParams({
       grant_type: 'authorization_code', client_id: profile.oidc.clientId,
-      code, redirect_uri: this.redirectURI, code_verifier: verifier,
+      code, redirect_uri: redirectURI, code_verifier: verifier,
     })
     const response = await this.fetch(discovery.tokenEndpoint, {
       method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
@@ -382,25 +427,138 @@ export class WebOidcBackend {
   }
 
   async loadSession(profile) {
-    const record = await this.ctx.credentials.resolve(sessionRef(profile))
-    if (typeof record?.value !== 'string') return undefined
-    try {
-      const session = JSON.parse(record.value)
-      if (session.issuer !== profile.oidc.issuer || session.clientId !== profile.oidc.clientId
-        || typeof session.accessToken !== 'string' || !Number.isFinite(session.expiresAt)
-        || typeof session.identity?.sub !== 'string') throw new Error('session binding mismatch')
+    const epoch = this.accountEpoch(profile)
+    return this.writeCredentials(profile, epoch, async () => {
+      const record = await this.ctx.credentials.resolve(sessionRef(profile))
+      if (typeof record?.value !== 'string') return undefined
+      let session
+      try { session = JSON.parse(record.value) } catch { await this.ctx.credentials.unset(sessionRef(profile)); return undefined }
+      if (session?.issuer !== profile.oidc.issuer || session?.clientId !== profile.oidc.clientId
+        || typeof session?.accessToken !== 'string' || !Number.isFinite(session?.expiresAt)
+        || typeof session?.identity?.sub !== 'string') {
+        await this.clearOwnedCredential(profile, session)
+        await this.ctx.credentials.unset(sessionRef(profile))
+        return undefined
+      }
+      const binding = resourceBinding(profile)
+      if (binding) {
+        const current = await this.ctx.credentials.resolve(binding.credentialRef)
+        if (!sameResourceBinding(session.resourceBinding, binding)) {
+          const oldRef = session.resourceBinding?.credentialRef
+          const renameOnly = binding.credentialRef === DEFAULT_CREDENTIAL_REF
+            && legacyCredentialRefs(profile).includes(oldRef)
+            && sameResourceBinding(session.resourceBinding, binding, true)
+          const old = renameOnly ? await this.ctx.credentials.resolve(oldRef) : undefined
+          if (renameOnly && !current?.value && old?.value
+            && ![...this.profiles.values()].some(value => value.id !== profile.id && value.keyBinding?.credentialRef === oldRef)
+            && (session.runtimeCredentialHash === undefined || session.runtimeCredentialHash === credentialHash(old.value))) {
+            await this.ctx.credentials.set(binding.credentialRef, old.value)
+            session.runtimeCredentialHash = credentialHash(old.value)
+            await this.ctx.credentials.unset(oldRef)
+          } else {
+            // A rename never adopts or overwrites an already populated target.
+            // Changed endpoints retain identity but require a fresh binding.
+            if (!renameOnly) await this.clearOwnedCredential(profile, session)
+            session.runtimeCredentialHash = ''
+          }
+          session.resourceBinding = binding
+        } else if (session.runtimeCredentialHash === undefined) {
+          // Only unambiguous pre-fingerprint sessions may adopt their old key.
+          // New logins always save an explicit empty hash until binding succeeds.
+          session.runtimeCredentialHash = this.uniqueCredentialRef(profile) ? credentialHash(current?.value) : ''
+        }
+      }
+      const encoded = JSON.stringify(session)
+      if (encoded !== record.value) await this.ctx.credentials.set(sessionRef(profile), encoded)
       return session
-    } catch {
+    })
+  }
+
+  uniqueCredentialRef(profile) {
+    return [...this.profiles.values()].filter(value => value.keyBinding?.credentialRef === profile.keyBinding?.credentialRef).length === 1
+  }
+
+  async boundCredential(profile, session) {
+    if (!session?.runtimeCredentialHash || !sameResourceBinding(session.resourceBinding, resourceBinding(profile))) return undefined
+    const credential = await this.ctx.credentials.resolve(profile.keyBinding.credentialRef)
+    return credentialHash(credential?.value) === session.runtimeCredentialHash ? credential : undefined
+  }
+
+  async resolveBoundCredential(profileID, expected) {
+    const profile = this.profiles.get(profileID)
+    if (!profile?.keyBinding || !expected || expected.credentialRef !== profile.keyBinding.credentialRef
+      || expected.runtimeBaseURL !== profile.provider.baseURL) return undefined
+    const epoch = this.accountEpoch(profile)
+    const credential = await this.boundCredential(profile, await this.loadSession(profile))
+    return epoch === this.accountEpoch(profile) ? credential : undefined
+  }
+
+  async clearOwnedCredential(profile, session) {
+    if (!profile.keyBinding || session?.resourceBinding?.credentialRef !== profile.keyBinding.credentialRef) return
+    const credential = await this.ctx.credentials.resolve(profile.keyBinding.credentialRef)
+    const proven = session.runtimeCredentialHash ? credentialHash(credential?.value) === session.runtimeCredentialHash
+      : session.runtimeCredentialHash === undefined && this.uniqueCredentialRef(profile)
+    if (proven) await this.ctx.credentials.unset(profile.keyBinding.credentialRef)
+  }
+
+  setRuntimeCredential(profile, session, value, epoch = this.accountEpoch(profile)) {
+    return this.writeCredentials(profile, epoch, async () => {
+      const record = await this.ctx.credentials.resolve(sessionRef(profile))
+      const saved = record?.value ? JSON.parse(record.value) : undefined
+      if (!saved || saved.issuer !== session.issuer || saved.clientId !== session.clientId
+        || saved.identity?.sub !== session.identity?.sub || !sameResourceBinding(saved.resourceBinding, resourceBinding(profile))) {
+        throw publicError('oidc_login_cancelled', '账户状态已改变，请重新登录。')
+      }
+      if (value) await this.ctx.credentials.set(profile.keyBinding.credentialRef, value)
+      else await this.clearOwnedCredential(profile, saved)
+      saved.runtimeCredentialHash = credentialHash(value)
+      await this.ctx.credentials.set(sessionRef(profile), JSON.stringify(saved))
+    })
+  }
+
+  accountEpoch(profile) { return this.accountEpochs.get(profile.id) ?? 0 }
+
+  writeCredentials(profile, epoch, operation) {
+    // Serialize vault writes so logout clears even a write already in progress.
+    // Network requests do not hold this queue; late replies cannot restore keys.
+    const queue = profile.keyBinding?.credentialRef ?? sessionRef(profile)
+    const write = (this.credentialWrites.get(queue) ?? Promise.resolve()).catch(() => {}).then(() => {
+      if (epoch !== this.accountEpoch(profile)) throw publicError('oidc_login_cancelled', '账户状态已改变，请重新登录。')
+      return operation()
+    })
+    this.credentialWrites.set(queue, write)
+    void write.finally(() => { if (this.credentialWrites.get(queue) === write) this.credentialWrites.delete(queue) }).catch(() => {})
+    return write
+  }
+
+  clearCredentials(profile, epoch) {
+    return this.writeCredentials(profile, epoch, async () => {
+      const record = await this.ctx.credentials.resolve(sessionRef(profile))
+      let saved
+      try { saved = JSON.parse(record?.value) } catch { /* Malformed records cannot prove key ownership. */ }
+      await this.clearOwnedCredential(profile, saved)
       await this.ctx.credentials.unset(sessionRef(profile))
-      return undefined
-    }
+    })
+  }
+
+  saveSession(profile, session, epoch = this.accountEpoch(profile)) {
+    return this.writeCredentials(profile, epoch, () => this.ctx.credentials.set(sessionRef(profile), JSON.stringify({ ...session,
+      runtimeCredentialHash: session.runtimeCredentialHash ?? '', resourceBinding: resourceBinding(profile) })))
   }
 
-  saveSession(profile, session) {
-    return this.ctx.credentials.set(sessionRef(profile), JSON.stringify(session))
+  refresh(profile, session) {
+    if (!this.refreshFlights.has(profile.id)) {
+      const flight = this.performRefresh(profile, session).finally(() => { if (this.refreshFlights.get(profile.id) === flight) this.refreshFlights.delete(profile.id) })
+      this.refreshFlights.set(profile.id, flight)
+    }
+    return this.refreshFlights.get(profile.id)
   }
 
-  async refresh(profile, session) {
+  async performRefresh(profile, session) {
+    const epoch = this.accountEpoch(profile)
+    const saved = await this.loadSession(profile)
+    if (!saved) throw publicError('oidc_login_required', 'OIDC session is no longer available')
+    if (saved && saved.accessToken !== session.accessToken && saved.expiresAt > nowSeconds(this.now) + ACCESS_REFRESH_SECONDS) return saved
     if (!session.refreshToken) throw publicError('oidc_login_required', 'OIDC session cannot be refreshed')
     const discovery = await this.discover(profile)
     const response = await this.fetch(discovery.tokenEndpoint, {
@@ -412,10 +570,8 @@ export class WebOidcBackend {
     try { token = await responseJSON(response, 'oidc_refresh_failed') }
     catch (cause) {
       if (cause.oauthError === 'invalid_grant') {
-        await Promise.all([
-          this.ctx.credentials.unset(sessionRef(profile)),
-          this.ctx.credentials.unset(profile.keyBinding.credentialRef),
-        ])
+        await this.clearCredentials(profile, epoch)
+        this.accountChanged(account(profile, undefined, false))
         throw publicError('oidc_login_required', 'OIDC refresh token is no longer valid', cause)
       }
       throw cause
@@ -431,19 +587,18 @@ export class WebOidcBackend {
       refreshToken: typeof token.refresh_token === 'string' ? token.refresh_token : session.refreshToken,
       expiresAt: nowSeconds(this.now) + Math.max(60, expiresIn),
     }
-    await this.saveSession(profile, next)
+    await this.saveSession(profile, next, epoch)
     return next
   }
 
   async activeSession(profile) {
+    const epoch = this.accountEpoch(profile)
     let session = await this.loadSession(profile)
     if (!session) return undefined
     if (session.expiresAt <= nowSeconds(this.now) + ACCESS_REFRESH_SECONDS) {
       if (!session.refreshToken) {
-        await Promise.all([
-          this.ctx.credentials.unset(sessionRef(profile)),
-          this.ctx.credentials.unset(profile.keyBinding.credentialRef),
-        ])
+        await this.clearCredentials(profile, epoch)
+        this.accountChanged(account(profile, undefined, false))
         return undefined
       }
       session = await this.refresh(profile, session)
@@ -453,16 +608,21 @@ export class WebOidcBackend {
 
   async status(profileID) {
     const profile = this.profile(profileID)
-    const [session, credential] = await Promise.all([
-      this.loadSession(profile), this.ctx.credentials.resolve(profile.keyBinding.credentialRef),
-    ])
+    const epoch = this.accountEpoch(profile)
+    const session = await this.loadSession(profile)
+    const credential = profile.keyBinding ? await this.boundCredential(profile, session) : undefined
+    if (session && credential?.value && profile.provider?.modelSource === 'discovery' && !this.resourceStates.has(profileID)) {
+      await this.resources(profileID)
+    }
+    if (epoch !== this.accountEpoch(profile)) return account(profile, undefined, false)
     return account(profile, session, typeof credential?.value === 'string' && credential.value !== '')
   }
 
   async authorized(profile, session, endpoint, init = {}) {
     const request = current => this.fetch(endpoint, {
       ...init,
-      headers: { ...(init.headers ?? {}), authorization: `Bearer ${current.accessToken}`, accept: 'application/json' },
+      headers: { ...Object.fromEntries(new Headers(init.headers).entries()), authorization: `Bearer ${current.accessToken}`, accept: 'application/json' },
+      redirect: 'error',
       signal: init.signal ?? AbortSignal.timeout(20_000),
     })
     let current = session
@@ -474,27 +634,75 @@ export class WebOidcBackend {
     return { response, session: current }
   }
 
+  async authorizedFetch(profileID, endpoint, init = {}) {
+    const profile = this.profile(profileID)
+    const target = new URL(endpoint)
+    const allowed = new Set([
+      new URL(profile.oidc.issuer).origin,
+      ...(profile.keyBinding ? [new URL(profile.keyBinding.baseURL).origin] : []),
+      ...this.authorizedOrigins,
+    ])
+    if (!allowed.has(target.origin) || target.username || target.password || target.hash) {
+      throw publicError('oidc_authorized_origin_denied', 'authorized request must use a configured organization origin')
+    }
+    const session = await this.activeSession(profile)
+    if (!session) throw publicError('oidc_login_required', 'organization sign-in is required')
+    return (await this.authorized(profile, session, target.toString(), init)).response
+  }
+
+  /** Host-only read transport for optional account extensions. No business paths. */
+  async modelResourceFetch(profileID, relativePath, options = {}) {
+    const profile = this.profile(profileID), epoch = this.accountEpoch(profile)
+    if (!profile.provider || !profile.keyBinding) throw publicError('oidc_resource_not_configured', 'Organization model resources are not configured')
+    if (typeof relativePath !== 'string' || !/^\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/.test(relativePath)
+      || Object.keys(options).some(key => key !== 'signal')) throw publicError('oidc_resource_path_denied', 'A fixed model-resource path and read-only options are required')
+    const session = await this.activeSession(profile)
+    const credential = await this.boundCredential(profile, session)
+    if (!session || !credential?.value || epoch !== this.accountEpoch(profile)) throw publicError('oidc_login_required', 'Organization model sign-in is required')
+    const response = await this.fetch(`${profile.provider.baseURL}${relativePath}`, {
+      method: 'GET', headers: { authorization: `Bearer ${credential.value}`, accept: 'application/json' },
+      redirect: 'error', signal: AbortSignal.any([AbortSignal.timeout(20_000), ...(options.signal ? [options.signal] : [])]),
+    })
+    // Complete the bounded body while the request signal is active. An extension
+    // never receives a response belonging to a signed-out or replaced account.
+    if (Number(response.headers.get('content-length')) > 1024 * 1024) { await response.body?.cancel(); throw publicError('oidc_resource_invalid', 'Model resource response is too large') }
+    const chunks = [], reader = response.body?.getReader()
+    let size = 0
+    if (reader) {
+      try { for (;;) { const { done, value } = await reader.read(); if (done) break; size += value.length; if (size > 1024 * 1024) throw new Error('size'); chunks.push(value) } }
+      catch { await reader.cancel().catch(() => {}); throw publicError('oidc_resource_invalid', 'Model resource response could not be read') }
+    }
+    const currentCredential = await this.ctx.credentials.resolve(profile.keyBinding.credentialRef)
+    if (epoch !== this.accountEpoch(profile) || currentCredential?.value !== credential.value) throw publicError('oidc_login_cancelled', 'Organization account changed during resource request')
+    return new Response([204, 205, 304].includes(response.status) ? null : Buffer.concat(chunks), { status: response.status, headers: response.headers })
+  }
+
   async reconcile(profileID, options = {}) {
     const profile = this.profile(profileID)
+    const epoch = this.accountEpoch(profile)
     let session = await this.activeSession(profile)
     if (!session) return account(profile, undefined, false)
+    if (!profile.keyBinding) return account(profile, session, false, 'not_required')
     const bootstrapCall = await this.authorized(profile, session, `${profile.keyBinding.baseURL}/bootstrap`)
     session = bootstrapCall.session
     const bootstrap = await responseJSON(bootstrapCall.response, 'oidc_binding_bootstrap_failed')
+    if (bootstrap.protocol_version !== undefined && !['worker.user-center.v1', 'worker-user-center/v1', 'eduwork-resources/v1'].includes(bootstrap.protocol_version)) {
+      throw publicError('oidc_binding_invalid', '身份登录已完成，但模型资源服务的协议版本不受支持。请联系服务管理员检查接口版本。')
+    }
     if (bootstrap.provider?.id !== profile.keyBinding.providerId) {
-      throw publicError('oidc_binding_invalid', 'key binding provider does not match the Enterprise Profile')
+      throw publicError('oidc_binding_invalid', '身份登录已完成，但模型资源服务与配置中的 Provider ID 不一致。请检查企业配置文件。')
     }
     session = {
       ...session,
       capabilities: Array.isArray(bootstrap.capabilities) ? bootstrap.capabilities.filter(value => typeof value === 'string').slice(0, 256) : [],
     }
-    await this.saveSession(profile, session)
+    await this.saveSession(profile, session, epoch)
     const runtime = bootstrap.runtime_credential ?? {}
     const state = String(runtime.status ?? '').toLowerCase()
     let operation = 'resolve'
     if (state === 'missing') {
       if (options.allowProvision !== true) {
-        await this.ctx.credentials.unset(profile.keyBinding.credentialRef)
+        await this.setRuntimeCredential(profile, session, '', epoch)
         return account(profile, session, false, 'missing')
       }
       if (runtime.provisioning?.allowed === false) throw publicError('oidc_binding_denied', 'the organization does not allow credential provisioning')
@@ -502,7 +710,7 @@ export class WebOidcBackend {
     } else if (state === 'expired' || state === 'expiring') {
       operation = runtime.api_key_id ? 'renew' : 'resolve'
     } else if (state !== 'active') {
-      await this.ctx.credentials.unset(profile.keyBinding.credentialRef)
+      await this.setRuntimeCredential(profile, session, '', epoch)
       return account(profile, session, false, state || 'unavailable')
     }
     const payload = { provider_id: profile.keyBinding.providerId }
@@ -516,8 +724,50 @@ export class WebOidcBackend {
     const credential = await responseJSON(bindingCall.response, 'oidc_binding_failed')
     if (credential.provider_id !== profile.keyBinding.providerId) throw publicError('oidc_binding_invalid', 'runtime credential provider is invalid')
     if (typeof credential.api_key !== 'string' || credential.api_key === '' || credential.api_key.length > 16 * 1024) throw publicError('oidc_binding_invalid', 'runtime credential response has an invalid API key')
-    await this.ctx.credentials.set(profile.keyBinding.credentialRef, credential.api_key)
-    return account(profile, session, true, credential.status ?? 'active')
+    await this.setRuntimeCredential(profile, session, credential.api_key, epoch)
+    await this.resources(profileID)
+    if (epoch !== this.accountEpoch(profile)) throw publicError('oidc_login_cancelled', '账户状态已改变，请重新登录。')
+    const current = await this.resolveBoundCredential(profile.id, {
+      credentialRef: profile.keyBinding.credentialRef, runtimeBaseURL: profile.provider.baseURL,
+    })
+    return account(profile, session, Boolean(current?.value), current ? credential.status ?? 'active' : 'replaced')
+  }
+
+  resources(profileID) {
+    if (!this.resourceFlights.has(profileID)) {
+      const flight = this.readResources(profileID).finally(() => { if (this.resourceFlights.get(profileID) === flight) this.resourceFlights.delete(profileID) })
+      this.resourceFlights.set(profileID, flight)
+    }
+    return this.resourceFlights.get(profileID)
+  }
+
+  async readResources(profileID) {
+    const profile = this.profile(profileID)
+    const epoch = this.accountEpoch(profile)
+    const result = emptyResources(profile)
+    if (!profile.keyBinding) return result
+    const session = await this.loadSession(profile)
+    const credential = await this.boundCredential(profile, session)
+    if (!credential?.value || epoch !== this.accountEpoch(profile)) return result
+    const request = async path => responseJSON(await this.fetch(`${profile.provider.baseURL}/${path}`, {
+      headers: { authorization: `Bearer ${credential.value}`, accept: 'application/json' },
+      signal: AbortSignal.timeout(20_000), redirect: 'error',
+    }), `oidc_resource_${path}_failed`)
+    const operations = []
+    if (profile.provider.modelSource === 'discovery') operations.push((async () => {
+      try {
+        const models = normalizeResourceModels(await request('models'), this.reviewedProfiles.get(profileID))
+        if (epoch !== this.accountEpoch(profile) || (await this.ctx.credentials.resolve(profile.keyBinding.credentialRef))?.value !== credential.value) return
+        const next = Object.freeze({ ...profile, provider: Object.freeze({ ...profile.provider, models }) })
+        await this.updateProvider(next)
+        this.profiles.set(profileID, next)
+        result.models = models
+      } catch { result.issues.push('models_unavailable') }
+    })())
+    await Promise.all(operations)
+    if (epoch !== this.accountEpoch(profile)) return emptyResources(profile)
+    this.resourceStates.set(profileID, result)
+    return result
   }
 
   management() { return Promise.resolve(profileManagement(this.profiles)) }
@@ -531,7 +781,14 @@ export class WebOidcBackend {
 
   async logout(profileID) {
     const profile = this.profile(profileID)
+    const epoch = this.accountEpoch(profile) + 1
+    this.accountEpochs.set(profileID, epoch)
+    this.refreshFlights.delete(profileID)
+    this.resourceFlights.delete(profileID)
     const session = await this.loadSession(profile)
+    await this.clearCredentials(profile, epoch)
+    this.resourceStates.delete(profileID)
+    for (const [state, flow] of this.flows) if (flow.profileID === profileID) this.flows.delete(state)
     if (session) {
       try {
         const discovery = await this.discover(profile)
@@ -544,10 +801,6 @@ export class WebOidcBackend {
         }
       } catch (cause) { this.ctx.logger.warn(cause instanceof Error ? cause : new Error(String(cause))) }
     }
-    await Promise.all([
-      this.ctx.credentials.unset(sessionRef(profile)),
-      this.ctx.credentials.unset(profile.keyBinding.credentialRef),
-    ])
     return account(profile, undefined, false)
   }
 }
@@ -571,7 +824,7 @@ export class NativeOidcBackend {
   }
 
   normalize(profile, status) {
-    if (status.runtimeCredentialRef !== undefined && status.runtimeCredentialRef !== profile.keyBinding.credentialRef) {
+    if (status.runtimeCredentialRef !== undefined && status.runtimeCredentialRef !== (profile.keyBinding?.credentialRef ?? '')) {
       throw publicError(
         'oidc_native_credential_ref_mismatch',
         `native OIDC adapter credential reference does not match Enterprise Profile ${profile.id}`,
@@ -585,7 +838,7 @@ export class NativeOidcBackend {
       ...(status.userName ? { userName: status.userName } : {}),
       ...(status.affiliation ? { affiliation: status.affiliation } : {}),
       ...(status.accessExpiresAt ? { accessExpiresAt: status.accessExpiresAt } : {}),
-      credentialRef: profile.keyBinding.credentialRef,
+      credentialRef: profile.keyBinding?.credentialRef ?? '',
       credentialReady: status.credentialReady === true,
       ...(status.credentialState ? { credentialState: status.credentialState } : {}),
       capabilities: Array.isArray(status.capabilities) ? status.capabilities : [],
@@ -613,6 +866,9 @@ export class NativeOidcBackend {
   }
 
   async management() { return this.normalizeManagement(await this.service().configuration()) }
+  async resources(profileID) {
+    return emptyResources(this.profile(profileID))
+  }
   async activate(profileID) { return this.normalizeManagement(await this.service().activate(profileID)) }
   async configure(profileID) { return this.normalizeManagement(await this.service().configure(profileID)) }
   async addCustom(baseURL) { return this.normalizeManagement(await this.service().addCustom(baseURL)) }