@eduwork/dsh-oidc 0.1.0 → 0.2.0

package/lib/desktop-oidc.js

@@ -0,0 +1,205 @@
+import { createServer } from 'node:http'
+import { randomBytes } from 'node:crypto'
+import { WebOidcBackend, OIDC_CALLBACK_PATH, sessionRef } from './oidc.js'
+import { callbackLanguage, callbackPage } from './callback-page.js'
+
+const MAX_FLOWS = 32
+const MAX_HISTORY = 128
+const error = (code, message) => Object.assign(new Error(message), { code })
+const safeCodes = new Set(['oidc_callback_invalid', 'oidc_authorization_rejected', 'oidc_token_invalid', 'oidc_id_token_invalid', 'oidc_userinfo_invalid'])
+
+function reply(response, status, profile, outcome, language) {
+  const page = callbackPage(profile, outcome, language)
+  response.writeHead(status, page.headers)
+  response.end(page.html)
+}
+
+/** Same identity/resource implementation as Web; only the callback transport differs. */
+export class DesktopOidcBackend extends WebOidcBackend {
+  constructor(ctx, profiles, config = {}, options = {}) {
+    super(ctx, profiles, config, { ...options, transport: 'desktop' })
+    if (Object.keys(config).some(key => !['callbackPort', 'flowTimeoutMs'].includes(key))) throw new Error('unsupported desktop OIDC callback setting')
+    this.port = config.callbackPort ?? 0
+    this.ttl = config.flowTimeoutMs ?? 600_000
+    if (!Number.isInteger(this.port) || this.port < 0 || this.port > 65535) throw new Error('desktop callbackPort must be an integer from 0 to 65535')
+    if (!Number.isInteger(this.ttl) || this.ttl < 1000 || this.ttl > 600_000) throw new Error('desktop flowTimeoutMs must be between 1000 and 600000')
+    this.openExternal = options.openExternal
+    this.attempts = new Map()
+    this.starting = new Set()
+    this.disposed = false
+    ctx.effect(() => () => this.dispose(), 'dsh-oidc: temporary desktop callbacks')
+  }
+
+  async begin(profileID) {
+    const profile = this.profile(profileID)
+    if (this.disposed) throw error('oidc_host_unavailable', 'OIDC host has stopped')
+    if (typeof this.openExternal !== 'function') throw error('oidc_browser_unavailable', 'The desktop browser service is unavailable')
+    if (this.starting.has(profileID)) throw error('oidc_login_pending', 'Organization sign-in is already starting')
+    this.starting.add(profileID)
+    let attempt
+    try {
+      for (const previous of this.attempts.values()) if (previous.profileID === profileID && previous.state === 'pending') await this.cancelLogin(previous.loginID)
+      const discovery = await this.discover(profile)
+      if (this.disposed) throw error('oidc_host_unavailable', 'OIDC host has stopped')
+      if ([...this.attempts.values()].filter(value => value.state === 'pending').length >= MAX_FLOWS) throw error('oidc_flow_limit', 'Too many pending organization sign-ins')
+      const loginID = randomBytes(24).toString('base64url')
+      attempt = { loginID, profileID, state: 'pending', expiresAt: new Date(this.now() + this.ttl).toISOString(), consumed: false }
+      const server = createServer((request, response) => { void this.callbackFor(attempt, request, response) })
+      server.requestTimeout = 10_000
+      server.headersTimeout = 10_000
+      server.maxHeadersCount = 32
+      attempt.server = server
+      this.attempts.set(loginID, attempt)
+      await new Promise((resolve, reject) => {
+        server.once('error', reject)
+        server.listen({ host: '127.0.0.1', port: this.port, exclusive: true }, resolve)
+      }).catch(() => { throw error('oidc_callback_unavailable', 'The local sign-in callback could not start; check whether its configured port is in use') })
+      server.unref()
+      if (this.disposed || attempt.state !== 'pending') {
+        await new Promise(resolve => { server.close(resolve); server.closeAllConnections() })
+        throw error('oidc_host_unavailable', 'OIDC host has stopped')
+      }
+      attempt.origin = `http://127.0.0.1:${server.address().port}`
+      const authorization = this.createAuthorization(profile, discovery, `${attempt.origin}${OIDC_CALLBACK_PATH}`)
+      Object.assign(attempt, { oauthState: authorization.state, flow: authorization.flow })
+      attempt.timer = setTimeout(() => { void this.cancelLogin(loginID, 'expired').catch(() => {}) }, this.ttl)
+      attempt.timer.unref()
+      // This Host-only method receives a URL derived from reviewed discovery, never an RPC URL.
+      try { await this.openExternal(authorization.authorizationURL) }
+      catch { throw error('oidc_browser_unavailable', 'The sign-in browser could not be opened') }
+      return { mode: 'external', loginID, expiresAt: attempt.expiresAt }
+    } catch (cause) {
+      if (attempt) await this.cancelLogin(attempt.loginID, 'failed')
+      throw cause
+    } finally {
+      this.starting.delete(profileID)
+      this.pruneAttempts()
+    }
+  }
+
+  pruneAttempts() {
+    for (const [id, attempt] of this.attempts) {
+      if (attempt.state !== 'pending' && (this.attempts.size > MAX_HISTORY || Date.parse(attempt.expiresAt) + this.ttl < this.now())) this.attempts.delete(id)
+    }
+  }
+
+  async closeCallback(attempt, force = false) {
+    clearTimeout(attempt.timer)
+    this.flows.delete(attempt.oauthState)
+    if (!attempt.server) return
+    const server = attempt.server
+    attempt.server = undefined
+    const closed = new Promise(resolve => server.close(resolve))
+    if (force) server.closeAllConnections()
+    else server.closeIdleConnections()
+    await closed
+  }
+
+  loginStatus(loginID) {
+    const attempt = this.attempts.get(loginID)
+    if (!attempt) throw error('oidc_login_unknown', 'This sign-in attempt is no longer available')
+    return { loginID, profileID: attempt.profileID, state: attempt.state, expiresAt: attempt.expiresAt,
+      ...(attempt.status ? { status: attempt.status } : {}), ...(attempt.errorCode ? { errorCode: attempt.errorCode } : {}) }
+  }
+
+  async cancelLogin(loginID, state = 'cancelled') {
+    const attempt = this.attempts.get(loginID)
+    if (!attempt) throw error('oidc_login_unknown', 'This sign-in attempt is no longer available')
+    if (attempt.state === 'pending') {
+      attempt.state = state
+      await this.closeCallback(attempt, true)
+    }
+    await attempt.processing
+    return this.loginStatus(loginID)
+  }
+
+  async callbackFor(attempt, request, response) {
+    const profile = this.profile(attempt.profileID), language = callbackLanguage(request.headers['accept-language'])
+    let requested
+    try {
+      requested = new URL(request.url, attempt.origin)
+      if (request.method !== 'GET' || request.headers.host !== new URL(attempt.origin).host
+        || (request.headers.origin && request.headers.origin !== attempt.origin)
+        || requested.origin !== attempt.origin || requested.username || requested.password || requested.hash || requested.pathname !== OIDC_CALLBACK_PATH
+        || requested.searchParams.getAll('state').length !== 1 || requested.searchParams.get('state') !== attempt.oauthState
+        || attempt.state !== 'pending' || attempt.consumed) {
+        reply(response, 400, profile, 'failed', language); return
+      }
+      if (Date.parse(attempt.expiresAt) <= this.now()) {
+        reply(response, 410, profile, 'expired', language); await this.cancelLogin(attempt.loginID, 'expired'); return
+      }
+    } catch { reply(response, 400, profile, 'failed', language); return }
+    attempt.consumed = true
+    this.flows.delete(attempt.oauthState)
+    attempt.processing = this.finishAuthorization(attempt, requested).catch(() => {
+      attempt.state = 'failed'
+      attempt.errorCode = 'oidc_credentials_unavailable'
+      this.ctx.logger.warn('Desktop OIDC host credentials are unavailable')
+    })
+    await attempt.processing
+    if (!response.destroyed) reply(response, attempt.state === 'completed' ? 200 : 400, profile,
+      attempt.state === 'completed' ? (attempt.status?.state === 'authenticated' ? 'credential-required' : 'completed') : 'failed', language)
+    await this.closeCallback(attempt)
+  }
+
+  async finishAuthorization(attempt, requested) {
+    const profile = this.profile(attempt.profileID)
+    const previous = new Map()
+    let wrote = false
+    try {
+      const session = await this.exchangeAuthorization(requested, attempt.flow)
+      if (attempt.state !== 'pending') return
+      const refs = [sessionRef(profile), ...(profile.keyBinding ? [profile.keyBinding.credentialRef] : [])]
+      for (const ref of refs) previous.set(ref, await this.ctx.credentials.resolve(ref))
+      if (attempt.state !== 'pending') return
+      wrote = true
+      await this.saveSession(profile, session, attempt.flow.epoch)
+      if (attempt.state !== 'pending') return
+      // A resource outage must not turn a successful identity login into a failed login.
+      let status
+      try { status = await this.reconcile(profile.id, { allowProvision: false }) }
+      catch { status = await this.status(profile.id) }
+      if (attempt.state !== 'pending') return
+      attempt.status = status
+      attempt.state = 'completed'
+      this.accountChanged(status)
+    } catch (cause) {
+      if (attempt.state === 'pending') {
+        attempt.state = 'failed'
+        attempt.errorCode = safeCodes.has(cause?.code) ? cause.code : 'oidc_login_failed'
+      }
+      this.ctx.logger.warn('Desktop OIDC sign-in did not complete', { code: attempt.errorCode ?? 'oidc_login_cancelled' })
+    } finally {
+      // Cancellation/disposal while the host vault writes must not resurrect a login.
+      if (wrote && attempt.state !== 'completed') {
+        await this.writeCredentials(profile, attempt.flow.epoch, async () => {
+          const currentRecord = await this.ctx.credentials.resolve(sessionRef(profile))
+          let currentSession
+          try { currentSession = JSON.parse(currentRecord?.value) } catch { /* No proven runtime-key ownership. */ }
+          const ownsCurrentKey = await this.boundCredential(profile, currentSession)
+          for (const [ref, record] of previous) {
+            // A different profile may have rebound the shared key during login.
+            if (ref !== sessionRef(profile) && !ownsCurrentKey) continue
+            if (record?.value !== undefined) await this.ctx.credentials.set(ref, record.value)
+            else await this.ctx.credentials.unset(ref)
+          }
+        })
+        this.resourceStates.delete(profile.id)
+      }
+      // Retain only the safe public result once the authorization is consumed.
+      attempt.flow = undefined
+      attempt.oauthState = undefined
+    }
+  }
+
+  async logout(profileID) {
+    for (const attempt of this.attempts.values()) if (attempt.profileID === profileID && attempt.state === 'pending') await this.cancelLogin(attempt.loginID)
+    return super.logout(profileID)
+  }
+
+  async dispose() {
+    this.disposed = true
+    await Promise.all([...this.attempts.values()].filter(value => value.state === 'pending').map(value => this.cancelLogin(value.loginID)))
+    await Promise.all([...this.attempts.values()].map(value => value.processing))
+  }
+}

package/lib/index.js

@@ -1,13 +1,14 @@
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
 import { apply as applyEnterpriseProvider } from './provider/index.js'
 import { NativeOidcBackend, WebOidcBackend } from './oidc.js'
+import { DesktopOidcBackend } from './desktop-oidc.js'
 import { enterpriseProviderConfig, loadEnterpriseProfiles, publicProfile } from './profile.js'
 
 export const name = 'dsh-oidc'
 const remoteInitializers = []
 
 export class OidcAccountService extends TypertRemoteService {
-  static inject = ['credentials', 'llm', 'webServer']
+  static inject = ['credentials', 'llm']
 
   constructor(ctx, config = {}) {
     super(ctx, 'oidcAccounts')
@@ -15,36 +16,164 @@ export class OidcAccountService extends TypertRemoteService {
     this.profiles = loadEnterpriseProfiles(config)
     if (this.profiles.size === 0 && config.allowEmptyProfiles !== true) throw new Error('dsh-oidc requires at least one Enterprise Profile')
     this.uiMode = ['external', 'models-only'].includes(config.uiMode) ? config.uiMode : 'standard'
-    applyEnterpriseProvider(ctx, enterpriseProviderConfig(this.profiles))
-    this.backend = config.backend === 'native'
-      ? new NativeOidcBackend(ctx, this.profiles)
-      : new WebOidcBackend(ctx, this.profiles, config.web ?? {})
+    this.manageProductBrand = config.manageProductBrand !== false
+    if (config.configFile !== undefined) {
+      const source = config.configFile
+      if (!source || typeof source.path !== 'string' || !source.path || typeof source.examplesPath !== 'string' || !source.examplesPath) throw new Error('Invalid enterprise configuration file location')
+      this.configFile = { path: source.path, examplesPath: source.examplesPath }
+      ctx.inject(['desktopServices'], inner => {
+        if (typeof inner.desktopServices.openConfiguration !== 'function') return
+        const open = target => inner.desktopServices.openConfiguration(target)
+        this.openConfigTarget = open
+        inner.effect(() => () => {
+          if (this.openConfigTarget === open) this.openConfigTarget = undefined
+        }, 'dsh-oidc: configuration file service')
+      })
+    }
+    this.accountStates = new Map()
+    const provider = applyEnterpriseProvider(ctx, {
+      ...enterpriseProviderConfig(this.profiles),
+      resolveCredential: async providerID => {
+        const profile = [...this.profiles.values()].find(value => value.provider?.id === providerID)
+        if (!profile) return undefined
+        if (this.backend instanceof NativeOidcBackend) return ctx.credentials.resolve(profile.keyBinding.credentialRef)
+        if (this.backend instanceof WebOidcBackend) return this.backend.resolveBoundCredential(profile.id, {
+          credentialRef: profile.keyBinding.credentialRef, runtimeBaseURL: profile.provider.baseURL,
+        })
+      },
+    })
+    const backendOptions = {
+          authorizedOrigins: config.authorizedOrigins,
+          accountChanged: status => this.notifyAccount(status),
+          updateProvider: profile => {
+            const profiles = new Map(this.profiles)
+            profiles.set(profile.id, profile)
+            provider.replaceConfig(enterpriseProviderConfig(profiles))
+          },
+        }
+    if (config.backend === 'native') this.backend = new NativeOidcBackend(ctx, this.profiles)
+    else if (config.backend === 'desktop') {
+      this.backend = new DesktopOidcBackend(ctx, this.profiles, config.desktop ?? {}, backendOptions)
+      ctx.inject(['desktopServices'], inner => {
+        this.backend.openExternal = url => inner.desktopServices.openExternal(url)
+        inner.effect(() => () => {
+          this.backend.openExternal = undefined
+          return Promise.all([...this.backend.attempts.values()].filter(value => value.state === 'pending').map(value => this.backend.cancelLogin(value.loginID)))
+        }, 'dsh-oidc: external browser service')
+      })
+    } else {
+      this.backendReady = new Promise(resolve => {
+        ctx.inject(['webServer'], inner => {
+          const backend = new WebOidcBackend(inner, this.profiles, config.web ?? {}, backendOptions)
+          this.backend = backend
+          resolve()
+          inner.effect(() => () => { if (this.backend === backend) this.backend = undefined }, 'dsh-oidc: web backend')
+        })
+      })
+    }
+  }
+
+  async callBackend(method, ...args) {
+    if (this.configFile && ['activate', 'configure', 'addCustom', 'updateCustom', 'removeProfile', 'configureModels'].includes(method)) throw new Error('Organization services are managed in the configuration file; edit it and restart the application')
+    await this.backendReady
+    if (typeof this.backend?.[method] !== 'function') throw new Error('This OIDC operation is unavailable in the configured host')
+    return this.backend[method](...args)
   }
 
   configuration() {
     return Promise.resolve({
       schemaVersion: 'dsh-oidc/v1alpha1',
       uiMode: this.uiMode,
+      manageProductBrand: this.manageProductBrand,
+      ...(this.configFile ? { configFile: { ...this.configFile, canOpen: typeof this.openConfigTarget === 'function' } } : {}),
       profiles: [...this.profiles.values()].map(publicProfile),
     })
   }
 
-  status(profileID) { return this.backend.status(profileID) }
-  begin(profileID) { return this.backend.begin(profileID) }
-  reconcile(profileID, options) { return this.backend.reconcile(profileID, options) }
-  logout(profileID) { return this.backend.logout(profileID) }
-  management() { return this.backend.management() }
-  activate(profileID) { return this.backend.activate(profileID) }
-  configure(profileID) { return this.backend.configure(profileID) }
-  addCustom(baseURL) { return this.backend.addCustom(baseURL) }
-  updateCustom(profileID, baseURL) { return this.backend.updateCustom(profileID, baseURL) }
-  removeProfile(profileID) { return this.backend.removeProfile(profileID) }
-  configureModels(profileID, modelMode, models) { return this.backend.configureModels(profileID, modelMode, models) }
-  restart() { return this.backend.restart() }
+  async openConfiguration(target) {
+    if (!['config', 'examples'].includes(target)) throw new Error('只能打开应用配置文件或示例目录。')
+    if (!this.configFile || typeof this.openConfigTarget !== 'function') throw new Error('当前宿主不支持直接打开配置文件，请按配置路径手动打开。')
+    try { await this.openConfigTarget(target) }
+    catch { throw new Error('未能打开配置文件或示例目录，请重试或检查系统文件关联。') }
+    return { opened: true }
+  }
+
+  notifyAccount(status) {
+    if (this.accountStates.get(status.profileID) !== status.state) {
+      this.accountStates.set(status.profileID, status.state)
+      this.ctx.emit('oidc/accounts-changed', { profileID: status.profileID, state: status.state })
+    }
+    return status
+  }
+  async status(profileID) { return this.notifyAccount(await this.callBackend('status', profileID)) }
+  resources(profileID) { return this.callBackend('resources', profileID) }
+  // Host-only capability: deliberately absent from Remote markers and Typert.
+  authorizedFetch(profileID, endpoint, init) {
+    return this.callBackend('authorizedFetch', profileID, endpoint, init)
+  }
+  modelResourceFetch(profileID, relativePath, options) {
+    return this.callBackend('modelResourceFetch', profileID, relativePath, options)
+  }
+  // Host-only credential snapshot for optional adapters; never exposed via RPC.
+  async resolveBoundCredential(profileID, expected) {
+    await this.backendReady
+    return this.backend instanceof WebOidcBackend ? this.backend.resolveBoundCredential(profileID, expected) : undefined
+  }
+  async begin(profileID) {
+    const result = await this.callBackend('begin', profileID)
+    if (result.mode === 'completed') this.notifyAccount(result.status)
+    return result
+  }
+  loginStatus(loginID) { return this.callBackend('loginStatus', loginID) }
+  cancelLogin(loginID) { return this.callBackend('cancelLogin', loginID) }
+  async reconcile(profileID, options) { return this.notifyAccount(await this.callBackend('reconcile', profileID, options)) }
+  async selectEnterpriseModel(profileID, options = {}) {
+    const status = await this.callBackend('status', profileID)
+    const profile = this.profiles.get(profileID)
+    if (!profile?.provider || status.state !== 'connected' || !status.credentialReady) throw new Error('请先完成企业登录和模型凭据连接，再选择企业模型。')
+    const defaults = this.ctx.get('agentDefaultModel')
+    if (typeof defaults?.saveSelection !== 'function') throw new Error('已连接企业模型；当前宿主不支持自动选择，请从模型菜单中选择。')
+    const original = defaults.currentSelection()
+    if (options.onlyIfMissing === true) {
+      const current = original
+      if (current?.provider && current?.model) {
+        try { await this.ctx.llm.resolveCallConfig(current); return { changed: false } }
+        catch { /* The old edition's provider may no longer be assembled. */ }
+      }
+    }
+    const models = await this.ctx.llm.listModels(profile.provider.id)
+    for (const model of models) {
+      let resolved
+      try { resolved = await this.ctx.llm.resolveCallConfig({ provider: profile.provider.id, model: model.id }) }
+      catch { continue }
+      const selection = { provider: resolved.provider, model: resolved.model,
+        ...(resolved.reasoningEffort === undefined ? {} : { reasoningEffort: String(resolved.reasoningEffort) }) }
+      // A slow discovery must not overwrite a newer personal choice or finish
+      // activation after the account has been signed out elsewhere.
+      if (options.onlyIfMissing === true && JSON.stringify(defaults.currentSelection()) !== JSON.stringify(original)) return { changed: false }
+      const latest = await this.callBackend('status', profileID)
+      if (latest.state !== 'connected' || !latest.credentialReady) throw new Error('企业连接状态已变化，请重新检查连接后选择模型。')
+      await defaults.saveSelection(selection)
+      return { selection, changed: true }
+    }
+    throw new Error('企业登录已完成，但尚未找到可用模型。请刷新模型目录或联系服务管理员。')
+  }
+  async logout(profileID) { return this.notifyAccount(await this.callBackend('logout', profileID)) }
+  async management() {
+    const result = await this.callBackend('management')
+    return this.configFile ? { ...result, capabilities: { ...result.capabilities, manageProfiles: false, manageModels: false } } : result
+  }
+  activate(profileID) { return this.callBackend('activate', profileID) }
+  configure(profileID) { return this.callBackend('configure', profileID) }
+  addCustom(baseURL) { return this.callBackend('addCustom', baseURL) }
+  updateCustom(profileID, baseURL) { return this.callBackend('updateCustom', profileID, baseURL) }
+  removeProfile(profileID) { return this.callBackend('removeProfile', profileID) }
+  configureModels(profileID, modelMode, models) { return this.callBackend('configureModels', profileID, modelMode, models) }
+  restart() { return this.callBackend('restart') }
 }
 
 for (const method of [
-  'configuration', 'status', 'begin', 'reconcile', 'logout', 'management',
+  'configuration', 'openConfiguration', 'status', 'resources', 'begin', 'loginStatus', 'cancelLogin', 'reconcile', 'selectEnterpriseModel', 'logout', 'management',
   'activate', 'configure', 'addCustom', 'updateCustom', 'removeProfile', 'configureModels', 'restart',
 ]) {
   Remote(method)(OidcAccountService.prototype[method], {
@@ -56,4 +185,5 @@ for (const method of [
 export default OidcAccountService
 export { enterpriseProviderConfig, loadEnterpriseProfiles, normalizeEnterpriseProfile, publicProfile } from './profile.js'
 export { NativeOidcBackend, WebOidcBackend } from './oidc.js'
+export { DesktopOidcBackend } from './desktop-oidc.js'
 export { EnterpriseModelTransforms } from './provider/transforms.js'