@finebi/finebi-cli 1.2.1 → 1.4.0

package/skills/finebi-cli-agent/scripts/finebi-cli/src/browser-auth.js

@@ -0,0 +1,331 @@
+import {spawn} from "node:child_process";
+import {platform} from "node:process";
+
+import {selfRevokeAccessKey} from "./access-key.js";
+import {cliError} from "./errors.js";
+import {failure, success} from "./output.js";
+
+const BROWSER_AUTH_BASE_PATH = "/api/bi-cli/browser-auth";
+
+export async function authorizeWithBrowser(options) {
+  if (options.signal?.aborted) {
+    return abortedAuthorization();
+  }
+  const base = validateBaseUrl(options.baseUrl);
+  if (!base.ok) {
+    return base;
+  }
+  const started = await postJson({
+    ...options,
+    command: "auth.login",
+    endpoint: `${BROWSER_AUTH_BASE_PATH}/start`,
+    body: {description: options.description},
+  });
+  if (!started.ok) {
+    return started;
+  }
+  const session = started.data;
+  if (!isStartResponse(session)) {
+    return failure("auth.login", cliError("BROWSER_AUTH_START_INVALID", {
+      path: "data",
+      message: "Browser authorization start response is incomplete.",
+      nextActions: ["finebi-cli auth login --browser"],
+    }));
+  }
+  const verificationUrl = verificationUrlFor(base.data, session.verificationPath);
+  if (!verificationUrl) {
+    return failure("auth.login", cliError("BROWSER_AUTH_START_INVALID", {
+      path: "data.verificationPath",
+      message: "Browser authorization response returned an unsafe verification path.",
+      nextActions: ["finebi-cli auth login --browser"],
+    }));
+  }
+  report(options, `Open this URL after signing in to FineBI:\n${verificationUrl}\nConfirmation code: ${session.userCode}`);
+  if (options.interactive) {
+    try {
+      await (options.openBrowser || openBrowser)(verificationUrl);
+    } catch (_error) {
+      report(options, "Could not open a browser automatically. Copy the URL above into a browser.");
+    }
+  }
+  const deadline = clock(options) + session.expiresIn * 1000;
+  let delayMs = session.interval * 1000;
+  while (clock(options) < deadline) {
+    if (options.signal?.aborted) {
+      return abortedAuthorization();
+    }
+    const polled = await postJson({
+      ...options,
+      command: "auth.login",
+      endpoint: `${BROWSER_AUTH_BASE_PATH}/poll`,
+      body: {deviceCode: session.deviceCode},
+      allowRateLimit: true,
+    });
+    if (!polled.ok) {
+      if (polled.meta?.status === 429) {
+        delayMs = retryDelay(polled.meta.retryAfter, delayMs);
+        if (await waitForPoll(options, delayMs)) {
+          return abortedAuthorization();
+        }
+        continue;
+      }
+      if (polled.errors?.[0]?.code === "NETWORK_ERROR") {
+        delayMs = retryDelay(null, delayMs);
+        if (await waitForPoll(options, delayMs)) {
+          return abortedAuthorization();
+        }
+        continue;
+      }
+      return polled;
+    }
+    const result = polled.data;
+    if (!result || typeof result.status !== "string") {
+      return failure("auth.login", cliError("BROWSER_AUTH_POLL_INVALID", {
+        path: "data.status",
+        message: "Browser authorization poll response did not contain a status.",
+        nextActions: ["finebi-cli auth login --browser"],
+      }));
+    }
+    if (result.status === "pending") {
+      if (await waitForPoll(options, delayMs)) {
+        return abortedAuthorization();
+      }
+      continue;
+    }
+    if (result.status === "approved") {
+      if (!result.token || !result.id) {
+        return failure("auth.login", cliError("BROWSER_AUTH_POLL_INVALID", {
+          path: "data.token",
+          message: "Approved browser authorization did not return an Access Key.",
+          nextActions: ["finebi-cli auth login --browser"],
+        }));
+      }
+      try {
+        await options.onApproved(result);
+      } catch (error) {
+        const revoked = await selfRevokeAccessKey({
+          baseUrl: base.data,
+          accessKey: result.token,
+          timeoutMs: options.timeoutMs,
+          fetchImpl: options.fetchImpl,
+        });
+        return failure("auth.login", cliError("BROWSER_AUTH_SAVE_FAILED", {
+          path: "auth.accessKey",
+          message: "Browser authorization succeeded but the new Access Key could not be saved locally.",
+          hint: revoked.ok
+            ? "The newly issued Access Key was revoked. Check local configuration permissions and try again."
+            : "The newly issued Access Key could not be saved or revoked. Revoke it manually by id.",
+          retryable: false,
+          nextActions: ["finebi-cli auth login --browser"],
+          partialResult: {id: result.id},
+          cause: error instanceof Error ? error.message : String(error),
+        }));
+      }
+      return success("auth.login", result);
+    }
+    const terminal = {
+      denied: ["BROWSER_AUTH_DENIED", "Browser authorization was denied."],
+      expired: ["BROWSER_AUTH_EXPIRED", "Browser authorization expired before approval."],
+      consumed: ["BROWSER_AUTH_CONSUMED", "Browser authorization was already consumed. Start a new authorization."],
+    }[result.status];
+    if (terminal) {
+      return failure("auth.login", cliError(terminal[0], {
+        path: "data.status",
+        message: terminal[1],
+        nextActions: ["finebi-cli auth login --browser"],
+        ...(result.id ? {partialResult: {id: result.id}} : {}),
+      }));
+    }
+    return failure("auth.login", cliError("BROWSER_AUTH_POLL_INVALID", {
+      path: "data.status",
+      message: `Browser authorization returned an unsupported status: ${result.status}.`,
+      nextActions: ["finebi-cli auth login --browser"],
+    }));
+  }
+  return failure("auth.login", cliError("BROWSER_AUTH_TIMEOUT", {
+    path: "data.status",
+    message: "Browser authorization timed out before approval.",
+    nextActions: ["finebi-cli auth login --browser"],
+  }));
+}
+
+function abortedAuthorization() {
+  return failure("auth.login", cliError("BROWSER_AUTH_ABORTED", {
+    path: "browserAuthorization",
+    message: "Browser authorization was aborted before approval.",
+    nextActions: ["finebi-cli auth login --browser"],
+  }));
+}
+
+function validateBaseUrl(value) {
+  try {
+    const url = new URL(value);
+    const localHttp = url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]", "::1"].includes(url.hostname.toLowerCase());
+    if (url.protocol !== "https:" && !localHttp) {
+      throw new Error("Browser authorization requires HTTPS, except for localhost development.");
+    }
+    if (url.username || url.password || url.search || url.hash) {
+      throw new Error("Browser authorization base URL must not contain credentials, a query, or a fragment.");
+    }
+    return success("auth.login", url.toString().replace(/\/+$/, ""));
+  } catch (error) {
+    return failure("auth.login", cliError("BROWSER_AUTH_URL_INVALID", {
+      path: "baseUrl",
+      message: error instanceof Error ? error.message : String(error),
+      nextActions: ["finebi-cli config set base-url <https-url>"],
+    }));
+  }
+}
+
+function isStartResponse(data) {
+  return data && typeof data.deviceCode === "string" && typeof data.userCode === "string"
+      && data.deviceCode.length > 0 && data.userCode.length > 0 && typeof data.verificationPath === "string"
+      && Number.isFinite(data.expiresIn) && data.expiresIn > 0 && data.expiresIn <= 600
+      && Number.isFinite(data.interval) && data.interval > 0 && data.interval <= 60;
+}
+
+function verificationUrlFor(baseUrl, verificationPath) {
+  if (!verificationPath.startsWith("/") || verificationPath.startsWith("//") || verificationPath.includes("\\")) {
+    return null;
+  }
+  const base = new URL(baseUrl);
+  const candidate = new URL(verificationPath, "https://browser-auth.invalid");
+  const decisionPath = base.pathname.replace(/\/+$/, "");
+  const expectedPath = `${BROWSER_AUTH_BASE_PATH}/authorize`;
+  if (candidate.origin !== "https://browser-auth.invalid" || candidate.username || candidate.password || candidate.hash
+      || candidate.pathname !== expectedPath) {
+    return null;
+  }
+  return new URL(`${decisionPath}${candidate.pathname}${candidate.search}`, base.origin).toString();
+}
+
+async function postJson(options) {
+  const controller = new AbortController();
+  const abortExternal = () => controller.abort();
+  options.signal?.addEventListener("abort", abortExternal, {once: true});
+  if (options.signal?.aborted) {
+    controller.abort();
+  }
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs || 30000);
+  try {
+    const response = await (options.fetchImpl || fetch)(`${options.baseUrl.replace(/\/+$/, "")}${options.endpoint}`, {
+      method: "POST",
+      headers: {"content-type": "application/json"},
+      body: JSON.stringify(options.body),
+      credentials: "omit",
+      redirect: "error",
+      signal: controller.signal,
+    });
+    if (options.allowRateLimit && response.status === 429) {
+      return failure(options.command, cliError("BROWSER_AUTH_RATE_LIMITED", {
+        path: options.endpoint,
+        message: "Browser authorization polling is being rate limited.",
+        retryable: true,
+        nextActions: ["Wait before polling again"],
+      }), {status: 429, retryAfter: response.headers.get("retry-after")});
+    }
+    if (!response.ok) {
+      return failure(options.command, cliError("BROWSER_AUTH_HTTP_ERROR", {
+        path: options.endpoint,
+        message: `FineBI returned HTTP ${response.status} from browser authorization.`,
+        retryable: response.status >= 500,
+        nextActions: ["finebi-cli auth login --browser"],
+      }), {status: response.status});
+    }
+    const text = await response.text();
+    let payload;
+    try {
+      payload = JSON.parse(text);
+    } catch (_error) {
+      return invalidSuccessResponse(options);
+    }
+    return success(options.command, payload?.data);
+  } catch (error) {
+    if (options.signal?.aborted) {
+      return abortedAuthorization();
+    }
+    return failure(options.command, cliError("NETWORK_ERROR", {
+      path: options.endpoint,
+      message: error instanceof Error ? error.message : String(error),
+      retryable: true,
+      nextActions: ["finebi-cli auth login --browser"],
+    }));
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abortExternal);
+  }
+}
+
+function retryDelay(retryAfter, currentDelay) {
+  const seconds = Number.parseInt(retryAfter, 10);
+  return Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : Math.min(currentDelay * 2, 60000);
+}
+
+function wait(options, delayMs) {
+  return options.sleep ? options.sleep(delayMs) : new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+
+async function waitForPoll(options, delayMs) {
+  if (!options.sleep && options.signal) {
+    if (options.signal.aborted) {
+      return true;
+    }
+    return new Promise((resolve) => {
+      const timer = setTimeout(done, delayMs, false);
+      const abort = () => done(true);
+      options.signal.addEventListener("abort", abort, {once: true});
+      function done(aborted) {
+        clearTimeout(timer);
+        options.signal.removeEventListener("abort", abort);
+        resolve(aborted);
+      }
+    });
+  }
+  if (!options.signal) {
+    await wait(options, delayMs);
+    return false;
+  }
+  if (options.signal.aborted) {
+    return true;
+  }
+  let abort;
+  const aborted = new Promise((resolve) => {
+    abort = () => resolve(true);
+    options.signal.addEventListener("abort", abort, {once: true});
+  });
+  try {
+    return await Promise.race([Promise.resolve(wait(options, delayMs)).then(() => false), aborted]);
+  } finally {
+    options.signal.removeEventListener("abort", abort);
+  }
+}
+
+function invalidSuccessResponse(options) {
+  const code = options.endpoint.endsWith("/start") ? "BROWSER_AUTH_START_INVALID" : "BROWSER_AUTH_POLL_INVALID";
+  return failure(options.command, cliError(code, {
+    path: "data",
+    message: "Browser authorization returned malformed JSON.",
+    nextActions: ["finebi-cli auth login --browser"],
+  }));
+}
+
+function clock(options) {
+  return options.nowMs ? options.nowMs() : Date.now();
+}
+
+function report(options, message) {
+  (options.writeStderr || ((text) => process.stderr.write(text)))(`${message}\n`);
+}
+
+function openBrowser(url) {
+  const command = platform === "win32" ? "rundll32.exe" : platform === "darwin" ? "open" : "xdg-open";
+  const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {detached: true, stdio: "ignore", windowsHide: true});
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}

package/skills/finebi-cli-agent/scripts/finebi-cli/src/capability.js

@@ -0,0 +1,122 @@
+import {existsSync, mkdirSync, readFileSync, writeFileSync} from "node:fs";
+import {dirname, join, win32} from "node:path";
+
+import {authenticationFailure} from "./auth-failure.js";
+import {buildAuthHeaders} from "./auth-headers.js";
+import {brandCommandText, brandCommandValue, CLI_API_BASE_PATH} from "./branding.js";
+import {defaultConfigPath} from "./config.js";
+import {cliError} from "./errors.js";
+import {failure, success} from "./output.js";
+
+export async function fetchCapabilities(options) {
+    const endpoint = `${CLI_API_BASE_PATH}/capabilities`;
+  const baseUrl = options.baseUrl.replace(/\/+$/, "");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs || 30000);
+  try {
+    const response = await (options.fetchImpl || fetch)(`${baseUrl}${endpoint}`, {
+      method: "GET",
+      headers: buildAuthHeaders({ token: options.token, accessKey: options.accessKey }),
+      signal: controller.signal,
+    });
+    return await parseCapabilityResponse(response);
+  } catch (error) {
+      return failure("capability.refresh", cliError("CAPABILITY_REFRESH_FAILED", {
+      path: endpoint,
+      message: error instanceof Error ? error.message : String(error),
+      hint: "Check FineBI base-url and authentication.",
+      retryable: true,
+      nextActions: ["finebi-cli auth login", "finebi-cli capability refresh"],
+      }));
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export function capabilityCachePath(env = process.env) {
+    const configPath = defaultConfigPath(env);
+    if (isWindowsPath(configPath)) {
+        return win32.join(win32.dirname(configPath), "capabilities.json");
+    }
+    return join(dirname(configPath), "capabilities.json");
+}
+
+export function cacheCapability(path, manifest, options) {
+  const fetchedAt = options.fetchedAt;
+  const expiresAt = new Date(Date.parse(fetchedAt) + options.ttlMs).toISOString();
+  const record = {
+    baseUrl: options.baseUrl,
+    username: options.username,
+    fetchedAt,
+    expiresAt,
+    ttlMs: options.ttlMs,
+    manifest,
+  };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, "utf8");
+  return record;
+}
+
+export function readCapabilityCache(path, now = new Date().toISOString()) {
+  if (!existsSync(path)) {
+    return { hit: false, stale: false };
+  }
+  const record = JSON.parse(readFileSync(path, "utf8"));
+  const stale = Date.parse(record.expiresAt) <= Date.parse(now);
+  return {
+    hit: !stale,
+    stale,
+    manifest: record.manifest,
+    record,
+  };
+}
+
+export function resolveCapability(cache, purpose) {
+  if (cache.hit || (purpose === "help" && cache.stale && cache.manifest)) {
+    return { manifest: cache.manifest };
+  }
+  return {
+      error: cliError("CAPABILITY_CACHE_EXPIRED", {
+      path: "capabilityCache",
+      message: "Capability cache is missing or expired.",
+          hint: brandCommandText("Run finebi-cli capability refresh."),
+      retryable: true,
+          nextActions: brandCommandValue(["finebi-cli capability refresh"]),
+      }),
+  };
+}
+
+async function parseCapabilityResponse(response) {
+  const text = await response.text();
+  const contentType = response.headers.get("content-type") || "";
+  if (!contentType.includes("json") || text.trim().startsWith("<")) {
+      return failure("capability.refresh", cliError("AUTH_REDIRECT_OR_HTML_RESPONSE", {
+          path: `${CLI_API_BASE_PATH}/capabilities`,
+      message: "FineBI returned an HTML page instead of JSON.",
+      hint: "Run finebi-cli auth login and retry capability refresh.",
+      retryable: true,
+      nextActions: ["finebi-cli auth login", "finebi-cli capability refresh"],
+      }), {status: response.status});
+  }
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) {
+      return authenticationFailure("capability.refresh", `${CLI_API_BASE_PATH}/capabilities`, response.status);
+    }
+      return failure("capability.refresh", cliError("CAPABILITY_REFRESH_FAILED", {
+          path: `${CLI_API_BASE_PATH}/capabilities`,
+      message: `FineBI returned HTTP ${response.status}: ${text.slice(0, 300)}`,
+      hint: "Check FineBI server logs and plugin registration.",
+      retryable: true,
+      nextActions: ["finebi-cli capability refresh"],
+      }), {status: response.status});
+  }
+  const payload = JSON.parse(text);
+  if (payload && payload.ok === false) {
+    return payload;
+  }
+  return success("capability.refresh", payload.data || payload);
+}
+
+function isWindowsPath(value) {
+    return /^[a-zA-Z]:[\\/]/.test(value) || value.includes("\\");
+}

package/skills/finebi-cli-agent/scripts/finebi-cli/src/config-permissions.js

@@ -0,0 +1,87 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync } from "node:fs";
+
+/**
+ * 创建配置权限控制器，隐藏 POSIX mode 与 Windows ACL 的平台差异。
+ *
+ * Windows 的 mode 参数不会收紧 NTFS ACL，因此需要在写入敏感内容前显式关闭继承。
+ * 只保留当前用户、SYSTEM 与本机 Administrators 的完全控制权：当前用户可继续使用 CLI，
+ * 系统服务和管理员仍能执行备份/恢复，但普通继承主体不能读取 JWT 或 Access Key。
+ * 安全命令失败时不阻断配置写入，改为发出明确 warning，避免把登录成功误报成失败。
+ */
+export function createConfigPermissionController(options = {}) {
+  const platform = options.platform || process.platform;
+  if (platform !== "win32") {
+    return {
+      restrictDirectory: (path) => chmodSync(path, 0o700),
+      restrictFile: (path) => chmodSync(path, 0o600),
+    };
+  }
+
+  const spawn = options.spawnSyncImpl || spawnSync;
+  const warn = options.onPermissionWarning || defaultPermissionWarning;
+  const userSid = resolveWindowsUserSid(spawn);
+  if (!userSid) {
+    warn("Could not resolve the current Windows user SID; FineBI CLI config ACL was not restricted.");
+    return noOpPermissionController();
+  }
+
+  return {
+    restrictDirectory(path) {
+      const acl = [
+        "/inheritance:r",
+        "/grant:r",
+        `*${userSid}:(OI)(CI)F`,
+        "*S-1-5-18:(OI)(CI)F",
+        "*S-1-5-32-544:(OI)(CI)F",
+      ];
+      if (!runIcacls(spawn, path, acl)) {
+        warn("Could not restrict the FineBI CLI config directory ACL; verify that other users cannot read it.");
+      }
+    },
+    restrictFile(path) {
+      const acl = [
+        "/inheritance:r",
+        "/grant:r",
+        `*${userSid}:(F)`,
+        "*S-1-5-18:(F)",
+        "*S-1-5-32-544:(F)",
+      ];
+      if (!runIcacls(spawn, path, acl)) {
+        warn("Could not restrict the FineBI CLI config file ACL; verify that only the current user can read config.json.");
+      }
+    },
+  };
+}
+
+function resolveWindowsUserSid(spawn) {
+  const result = spawn("whoami.exe", ["/user", "/fo", "csv", "/nh"], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result?.error || result?.status !== 0 || typeof result?.stdout !== "string") {
+    return undefined;
+  }
+  return result.stdout.match(/"[^"]*","(S-[^"]+)"/)?.[1];
+}
+
+function runIcacls(spawn, path, aclArguments) {
+  const result = spawn("icacls.exe", [path, ...aclArguments], {
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  return !result?.error && result?.status === 0;
+}
+
+function noOpPermissionController() {
+  return {
+    restrictDirectory() {
+    },
+    restrictFile() {
+    },
+  };
+}
+
+function defaultPermissionWarning(message) {
+  process.emitWarning(message, { code: "FINEBI_CONFIG_PERMISSIONS" });
+}