@finebi/finebi-cli 1.2.1 → 1.4.0

package/skills/finebi-cli-agent/scripts/finebi-cli/src/config.js

@@ -0,0 +1,189 @@
+import {existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync} from "node:fs";
+import {randomUUID} from "node:crypto";
+import {homedir} from "node:os";
+import {basename, dirname, join, win32} from "node:path";
+
+import {createConfigPermissionController} from "./config-permissions.js";
+import {CLI_CONFIG_DIRECTORY} from "./branding.js";
+import {maskSecret} from "./output.js";
+
+export const DEFAULT_TIMEOUT_MS = 30000;
+export const DEFAULT_CAPABILITY_TTL_MS = 600000;
+
+export function defaultConfigPath(env = process.env) {
+  const home = env.USERPROFILE || env.HOME || homedir();
+    if (isWindowsPath(home)) {
+        return win32.join(home, CLI_CONFIG_DIRECTORY, "config.json");
+    }
+    return join(home, CLI_CONFIG_DIRECTORY, "config.json");
+}
+
+export function readConfig(path = defaultConfigPath()) {
+  if (!existsSync(path)) {
+    return defaultConfig();
+  }
+  return normalizeConfig(JSON.parse(readFileSync(path, "utf8")));
+}
+
+export function writeConfig(path, config, permissionOptions = {}) {
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const permissions = createConfigPermissionController(permissionOptions);
+  permissions.restrictDirectory(directory);
+  // 先创建不含敏感内容的空文件并收紧权限，避免 JWT/Access Key 在 chmod/icacls 前短暂暴露。
+  writeFileSync(path, "", { encoding: "utf8", mode: 0o600, flag: "a" });
+  permissions.restrictFile(path);
+  writeFileSync(path, `${JSON.stringify(sanitizeConfig(normalizeConfig(config)), null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+}
+
+/** Write a complete protected staging file beside config.json, then atomically replace it. */
+export function writeConfigAtomically(path, config, options = {}) {
+  const {rename = renameSync, remove = rmSync, ...permissionOptions} = options;
+  const staging = join(dirname(path), `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    writeConfig(staging, config, permissionOptions);
+    rename(staging, path);
+  } catch (error) {
+    try {
+      remove(staging, {force: true});
+    } catch (_cleanupError) {
+      // Preserve the original write error; the staging file only contains the new local configuration.
+    }
+    throw error;
+  }
+}
+
+export function resolveConfig(flags = {}, env = process.env, fileConfig = readConfig()) {
+  const baseUrl = firstNonEmpty(flags.baseUrl, env.FINEBI_BASE_URL, fileConfig.baseUrl);
+  const sameServer = sameBaseUrl(baseUrl, fileConfig.baseUrl);
+  const explicitToken = firstNonEmpty(flags.token, env.FINEBI_AUTH_TOKEN);
+  const savedAuth = sameServer ? fileConfig.auth : undefined;
+  const token = firstNonEmpty(explicitToken, savedAuth?.token, sameServer ? fileConfig.token : undefined);
+  return normalizeConfig({
+    ...fileConfig,
+    baseUrl,
+    timeoutMs: parsePositiveInt(firstNonEmpty(flags.timeoutMs, env.FINEBI_TIMEOUT_MS), fileConfig.timeoutMs),
+    capabilityTtlMs: parsePositiveInt(
+      firstNonEmpty(flags.capabilityTtlMs, env.FINEBI_CAPABILITY_TTL_MS),
+      fileConfig.capabilityTtlMs,
+    ),
+    auth: {
+      ...(explicitToken ? {} : savedAuth),
+      token,
+    },
+  });
+}
+
+export function updateConfigValue(config, key, value, now = () => new Date().toISOString()) {
+  const next = normalizeConfig(config);
+  switch (key) {
+    case "base-url":
+      if (next.baseUrl !== value) {
+        next.capabilityCacheInvalidatedAt = now();
+        delete next.auth;
+        delete next.token;
+      }
+      next.baseUrl = value;
+      return next;
+    case "timeout-ms":
+      next.timeoutMs = parsePositiveInt(value, DEFAULT_TIMEOUT_MS);
+      return next;
+    case "capability-ttl-ms":
+      next.capabilityTtlMs = parsePositiveInt(value, DEFAULT_CAPABILITY_TTL_MS);
+      return next;
+    default:
+      throw new Error(`Unsupported config key: ${key}`);
+  }
+}
+
+export function maskConfig(config) {
+  const normalized = normalizeConfig(config);
+  return {
+    ...normalized,
+    token: maskSecret(normalized.token),
+    auth: normalized.auth
+      ? {
+          ...normalized.auth,
+          token: maskSecret(normalized.auth.token),
+          ...(normalized.auth.accessKey
+            ? {
+                accessKey: {
+                  ...normalized.auth.accessKey,
+                  value: maskSecret(normalized.auth.accessKey.value),
+                },
+              }
+            : {}),
+        }
+      : undefined,
+  };
+}
+
+function defaultConfig() {
+  return {
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+    capabilityTtlMs: DEFAULT_CAPABILITY_TTL_MS,
+  };
+}
+
+export function normalizeConfig(config) {
+  return {
+    ...config,
+    timeoutMs: parsePositiveInt(config.timeoutMs, DEFAULT_TIMEOUT_MS),
+    capabilityTtlMs: parsePositiveInt(config.capabilityTtlMs, DEFAULT_CAPABILITY_TTL_MS),
+  };
+}
+
+function sanitizeConfig(config) {
+  if (config.schemaVersion === 2) {
+    return {
+      schemaVersion: 2,
+      currentProfile: config.currentProfile,
+      profiles: Object.fromEntries(Object.entries(config.profiles).map(([name, profile]) => [name, sanitizeConfig(normalizeConfig(profile))])),
+    };
+  }
+  const { token: _legacyToken, ...rest } = config;
+  const auth = config.auth
+    ? {
+        username: config.auth.username,
+        token: config.auth.token,
+        expiresAt: config.auth.expiresAt,
+        loginAt: config.auth.loginAt,
+        source: config.auth.source,
+        accessKey: config.auth.accessKey
+          ? {
+              id: config.auth.accessKey.id,
+              value: config.auth.accessKey.value,
+              description: config.auth.accessKey.description,
+              createdAt: config.auth.accessKey.createdAt,
+            }
+          : undefined,
+      }
+    : undefined;
+  return {
+    ...rest,
+    auth,
+  };
+}
+
+export function sameBaseUrl(left, right) {
+  return (left || "").replace(/\/+$/, "") === (right || "").replace(/\/+$/, "");
+}
+
+function firstNonEmpty(...values) {
+  return values.find((value) => typeof value === "string" && value.trim().length > 0)?.trim();
+}
+
+function parsePositiveInt(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return parsed;
+}
+
+function isWindowsPath(value) {
+    return /^[a-zA-Z]:[\\/]/.test(value) || value.includes("\\");
+}

package/skills/finebi-cli-agent/scripts/finebi-cli/src/dynamic-command.js

@@ -0,0 +1,324 @@
+import {randomBytes} from "node:crypto";
+import {createReadStream} from "node:fs";
+import {basename, extname} from "node:path";
+import {Readable} from "node:stream";
+
+import {authenticationFailure} from "./auth-failure.js";
+import {buildAuthHeaders} from "./auth-headers.js";
+import {commandLine} from "./branding.js";
+import {cliError} from "./errors.js";
+import {failure} from "./output.js";
+import {buildRequestBody} from "./schema-options.js";
+
+export async function executeDynamicCommand(manifest, resourceName, commandName, args, options) {
+  const command = findCommand(manifest, resourceName, commandName);
+  if (!command) {
+      return failure(`${resourceName}.${commandName}`, cliError("CAPABILITY_NOT_FOUND", {
+      path: `${resourceName}.${commandName}`,
+      message: `Capability not found: ${resourceName}.${commandName}.`,
+      hint: "Run finebi-cli capability refresh and check finebi-cli --help.",
+      retryable: true,
+      nextActions: ["finebi-cli capability refresh", "finebi-cli --help"],
+      }));
+  }
+  const displayArgs = parseDisplayArgs(args, command);
+  if (!displayArgs.ok) {
+    return failure(command.command, withCommandHelp(displayArgs.error, resourceName, commandName));
+  }
+  const requestBody = buildRequestBody(command.requestSchema || { properties: {}, required: [] }, displayArgs.args);
+  if (!requestBody.ok) {
+    return failure(command.command, withCommandHelp(requestBody.error, resourceName, commandName));
+  }
+  const envelope = await sendDynamicRequest(command, requestBody.body, options);
+  return withDisplayResolved(withResolvedLinks(envelope, options.baseUrl), displayArgs.display);
+}
+
+function findCommand(manifest, resourceName, commandName) {
+  const resource = (manifest.resources || []).find((item) => item.name === resourceName);
+  return resource?.commands?.find((item) => item.name === commandName);
+}
+
+async function sendDynamicRequest(command, body, options) {
+  const baseUrl = options.baseUrl.replace(/\/+$/, "");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs || 30000);
+  try {
+    const request = multipartRequest(command, body, options)
+        || jsonRequest(command, body, options);
+    const response = await (options.fetchImpl || fetch)(`${baseUrl}${command.path}${request.query}`, {
+      method: command.method || "POST",
+      headers: request.headers,
+      body: request.body,
+      signal: controller.signal,
+      ...(request.duplex ? {duplex: request.duplex} : {}),
+    });
+    return parseResponse(response, command.command);
+  } catch (error) {
+      return failure(command.command, cliError("NETWORK_ERROR", {
+      path: command.path,
+      message: error instanceof Error ? error.message : String(error),
+      hint: "Check FineBI base-url and network connection.",
+      retryable: true,
+      nextActions: ["finebi-cli auth info", "finebi-cli capability refresh"],
+      }));
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function jsonRequest(command, body, options) {
+  return {
+    query: "",
+    headers: buildAuthHeaders({
+      token: options.token,
+      accessKey: options.accessKey,
+      contentType: "application/json",
+    }),
+    body: JSON.stringify(body),
+  };
+}
+
+function multipartRequest(command, body, options) {
+  if (String(command.requestEncoding || "").toLowerCase() !== "multipart/form-data") {
+    return null;
+  }
+  const properties = command.requestSchema?.properties || {};
+  const entry = Object.entries(properties).find(([, property]) =>
+    property.file && String(property.fileContentType || "").toUpperCase() === "BINARY");
+  if (!entry) {
+    throw new Error(`Capability ${command.command} does not declare a BINARY file field.`);
+  }
+  const [fieldName] = entry;
+  const filePath = body[fieldName];
+  const fileName = basename(filePath);
+  const boundary = `finebi-cli-${randomBytes(16).toString("hex")}`;
+  return {
+    query: `?${encodeURIComponent(fieldName)}=${encodeURIComponent(fileName)}`,
+    headers: buildAuthHeaders({
+      token: options.token,
+      accessKey: options.accessKey,
+      contentType: `multipart/form-data; boundary=${boundary}`,
+    }),
+    body: createMultipartBody(boundary, fieldName, fileName, filePath),
+    duplex: "half",
+  };
+}
+
+function createMultipartBody(boundary, fieldName, fileName, filePath) {
+  const dispositionName = multipartHeaderValue(fieldName);
+  const dispositionFileName = multipartHeaderValue(fileName);
+  const opening = Buffer.from(
+      `--${boundary}\r\n`
+      + `Content-Disposition: form-data; name="${dispositionName}"; filename="${dispositionFileName}"\r\n`
+      + `Content-Type: ${uploadContentType(fileName)}\r\n\r\n`,
+  );
+  const closing = Buffer.from(`\r\n--${boundary}--\r\n`);
+  return Readable.from((async function* () {
+    yield opening;
+    for await (const chunk of createReadStream(filePath)) {
+      yield chunk;
+    }
+    yield closing;
+  })());
+}
+
+function uploadContentType(fileName) {
+  switch (extname(fileName).toLowerCase()) {
+    case ".xlsx":
+      return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+    case ".xls":
+      return "application/vnd.ms-excel";
+    case ".csv":
+      return "text/csv";
+    case ".png":
+      return "image/png";
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".gif":
+      return "image/gif";
+    case ".bmp":
+      return "image/bmp";
+    default:
+      return "application/octet-stream";
+  }
+}
+
+function multipartHeaderValue(value) {
+  return String(value).replace(/[\r\n"]/g, "_");
+}
+
+async function parseResponse(response, commandName) {
+  const text = await response.text();
+  const contentType = response.headers.get("content-type") || "";
+  if (!contentType.includes("json") || text.trim().startsWith("<")) {
+    if (isAuthStatusResponse(response)) {
+        return failure(commandName, cliError("AUTH_REDIRECT_OR_HTML_RESPONSE", {
+        path: "",
+        message: "FineBI returned an HTML login or redirect page instead of JSON.",
+        hint: "Run finebi-cli auth login and retry the command.",
+        retryable: true,
+        nextActions: ["finebi-cli auth login"],
+        }), {status: response.status});
+    }
+    if (isAuthHtmlResponse(text)) {
+        return failure(commandName, cliError("AUTH_REDIRECT_OR_HTML_RESPONSE", {
+        path: "",
+        message: "FineBI returned an HTML login or redirect page instead of JSON.",
+        hint: "Run finebi-cli auth login and retry the command.",
+        retryable: true,
+        nextActions: ["finebi-cli auth login"],
+        }), {status: response.status});
+    }
+      return failure(commandName, cliError("HTTP_HTML_RESPONSE", {
+      path: "",
+      message: `FineBI returned HTTP ${response.status} with an HTML page instead of JSON: ${text.replace(/\s+/g, " ").slice(0, 200)}`,
+      hint: "Check FineBI server logs and retry after the backend error is fixed.",
+      retryable: false,
+      nextActions: ["Check FineBI server logs"],
+      }), {status: response.status});
+  }
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) {
+      return authenticationFailure(commandName, "", response.status);
+    }
+      return failure(commandName, cliError("HTTP_ERROR", {
+      path: "",
+      message: `FineBI returned HTTP ${response.status}: ${text.slice(0, 300)}`,
+      hint: "Check FineBI server logs and command arguments.",
+      retryable: false,
+      nextActions: ["finebi-cli capability refresh"],
+      }), {status: response.status});
+  }
+  return normalizeDynamicEnvelope(JSON.parse(text), commandName);
+}
+
+function normalizeDynamicEnvelope(envelope, commandName) {
+  return {
+    ok: Boolean(envelope.ok),
+    command: envelope.command || commandName,
+    data: envelope.data ?? null,
+    errors: Array.isArray(envelope.errors) ? envelope.errors : [],
+    warnings: Array.isArray(envelope.warnings) ? envelope.warnings : [],
+    resolved: envelope.resolved && typeof envelope.resolved === "object" ? envelope.resolved : {},
+    meta: envelope.meta && typeof envelope.meta === "object" ? envelope.meta : {},
+  };
+}
+
+function parseDisplayArgs(args, command) {
+  const nextArgs = [];
+  let format = "auto";
+  for (let index = 0; index < args.length; index += 1) {
+    const current = args[index];
+    if (current === "--json") {
+      continue;
+    }
+    if (current === "-f" || current === "--format") {
+      const value = args[index + 1];
+      if (!value || value.startsWith("-")) {
+        return invalidDisplayArgument(current, `Missing value for ${current}.`);
+      }
+      format = value;
+      index += 1;
+      continue;
+    }
+    nextArgs.push(current);
+  }
+  if (!["auto", "table", "expanded", "csv"].includes(format)) {
+    return invalidDisplayArgument(format, `Unsupported output format: ${format}.`);
+  }
+  return {
+    ok: true,
+    args: nextArgs,
+    display: {
+      ...(command.display || {}),
+      format,
+    },
+  };
+}
+
+function invalidDisplayArgument(path, message) {
+  return {
+    ok: false,
+      error: cliError("INVALID_ARGUMENT", {
+      path,
+      message,
+      hint: "Use -f auto, -f table, -f expanded, or -f csv.",
+      retryable: false,
+      nextActions: ["finebi-cli <resource> <command> --help"],
+      }),
+  };
+}
+
+function withCommandHelp(error, resourceName, commandName) {
+  return {
+    ...error,
+      nextActions: [commandLine(resourceName, commandName, "--help")],
+  };
+}
+
+function withDisplayResolved(envelope, display) {
+  const resolved = envelope.resolved || {};
+  return {
+    ...envelope,
+    resolved: {
+      ...resolved,
+      display: {
+        ...(resolved.display || {}),
+        ...display,
+      },
+    },
+  };
+}
+
+function withResolvedLinks(envelope, baseUrl) {
+  const links = envelope.data?.links;
+  if (!links || typeof links !== "object" || Array.isArray(links)) {
+    return envelope;
+  }
+  const resolvedLinks = Object.fromEntries(Object.entries(links).flatMap(([relation, link]) => {
+    const url = resolveLinkUrl(baseUrl, link?.path);
+    return url ? [[relation, {url}]] : [];
+  }));
+  if (Object.keys(resolvedLinks).length === 0) {
+    return envelope;
+  }
+  return {
+    ...envelope,
+    resolved: {
+      ...(envelope.resolved || {}),
+      links: {
+        ...(envelope.resolved?.links || {}),
+        ...resolvedLinks,
+      },
+    },
+  };
+}
+
+function resolveLinkUrl(baseUrl, path) {
+  if (typeof baseUrl !== "string" || typeof path !== "string" || !path.trim()) {
+    return null;
+  }
+  const cleanBaseUrl = baseUrl.replace(/[?#].*$/, "").replace(/\/+$/, "");
+  return `${cleanBaseUrl}${path.trim()}`;
+}
+
+function isAuthStatusResponse(response) {
+  if (response.status === 401 || response.status === 403 || response.status >= 300 && response.status < 400) {
+    return true;
+  }
+  return false;
+}
+
+function isAuthHtmlResponse(text) {
+  const lower = text.toLowerCase();
+  return lower.includes("login") && lower.includes("password");
+}
+
+function commandHelpAction(commandName) {
+  const parts = commandName.split(".");
+  if (parts.length >= 2) {
+      return commandLine(parts[0], parts[1], "--help");
+  }
+    return commandLine("<resource>", "<command>", "--help");
+}