@fonlan/dsh-task-kanban 0.1.0

package/src/server/rpc.ts

@@ -0,0 +1,167 @@
+/**
+ * Fenced JSON API under /plugins/@fonlan/dsh-task-kanban/api/<method>. Same
+ * browser-trust fence as the /api gateway and /sidebar routes: loopback
+ * Host-header or configured trustedHosts, same-origin browser markers.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-host-webserver'
+import type { Lane } from '../shared/card.js'
+import type { KanbanRunner } from './runner.js'
+import type { KanbanSettingsFace } from './settings.js'
+import { listModels } from './models.js'
+
+const API_PREFIX = '/plugins/@fonlan/dsh-task-kanban/api'
+
+// ── browser-trust fence (mirrors dsh-client-connection's api-request-trust) ──
+
+function header(headers: IncomingMessage['headers'], name: string): string | undefined {
+  const value = headers[name]
+  return typeof value === 'string' ? value : undefined
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  const parts = hostname.split('.')
+  return parts.length === 4 && parts[0] === '127' && parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255)
+}
+
+function isTrustedApiRequest(req: IncomingMessage, trustedHosts: readonly string[]): boolean {
+  const host = header(req.headers, 'host')
+  if (host === undefined) return false
+  let hostUrl: URL
+  try {
+    hostUrl = new URL(`http://${host}`)
+  } catch {
+    return false
+  }
+  if (!isLoopbackHostname(hostUrl.hostname) && !trustedHosts.includes(hostUrl.host) && !trustedHosts.includes(hostUrl.hostname)) {
+    if (!trustedHosts.some((entry) => entry === hostUrl.hostname || entry === hostUrl.host)) return false
+  }
+  if (header(req.headers, 'sec-fetch-site') === 'cross-site') return false
+  const origin = header(req.headers, 'origin')
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === hostUrl.host
+  } catch {
+    return false
+  }
+}
+
+function trustedHostsOf(ctx: Context): string[] {
+  for (const entry of ctx.get('loader')?.entries?.() ?? []) {
+    if (entry.options?.name === 'connection') {
+      const config = entry.options.config as { trustedHosts?: string[] } | undefined
+      return config?.trustedHosts ?? []
+    }
+  }
+  return []
+}
+
+// ── wire helpers ────────────────────────────────────────────────────────────
+
+function writeJson(res: ServerResponse, body: unknown): void {
+  res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+  res.end(JSON.stringify(body))
+}
+
+function writeError(res: ServerResponse, code: string, message: string, status = 400): void {
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+  res.end(JSON.stringify({ ok: false, error: { code, message } }))
+}
+
+function requireString(value: unknown, name: string): string {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new Error(`${name} 不能为空`)
+  }
+  return value
+}
+
+async function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown>> {
+  const chunks: Buffer[] = []
+  for await (const chunk of req) chunks.push(chunk as Buffer)
+  const raw = Buffer.concat(chunks).toString('utf8')
+  if (raw.trim() === '') return {}
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : {}
+  } catch {
+    return {}
+  }
+}
+
+// ── routes ──────────────────────────────────────────────────────────────────
+
+export function registerApiRoutes(
+  ctx: Context,
+  runner: KanbanRunner,
+  settings: KanbanSettingsFace,
+): () => void {
+  const fence = (req: IncomingMessage): boolean => isTrustedApiRequest(req, trustedHostsOf(ctx))
+  const disposers: Array<() => void> = []
+
+  const route = (name: string, handler: (payload: Record<string, unknown>) => Promise<unknown>): void => {
+    disposers.push(ctx.webServer.register({
+      kind: 'prefix',
+      path: `${API_PREFIX}/${name}`,
+      handler: async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+        if (!fence(req)) {
+          writeError(res, 'forbidden', 'forbidden', 403)
+          return
+        }
+        if (req.method !== 'POST' && req.method !== 'GET') {
+          writeError(res, 'method', 'method not allowed', 405)
+          return
+        }
+        const payload = await readJsonBody(req)
+        try {
+          const value = await handler(payload)
+          writeJson(res, { ok: true, value })
+        } catch (error) {
+          writeError(res, 'error', error instanceof Error ? error.message : String(error))
+        }
+      },
+    }))
+  }
+
+  route('list', async (p) => runner.listCards(requireString(p.workspacePath, 'workspacePath')))
+
+  route('create', async (p) => {
+    const workspacePath = requireString(p.workspacePath, 'workspacePath')
+    const requirement = requireString(p.requirement, 'requirement')
+    const model = typeof p.model === 'string' ? p.model : ''
+    const provider = typeof p.provider === 'string' ? p.provider : undefined
+    return runner.createTask({ workspacePath, requirement, model, provider })
+  })
+
+  route('move', async (p) => {
+    const cardId = requireString(p.cardId, 'cardId')
+    const toLane = p.toLane as Lane
+    if (!['demand', 'queue', 'running', 'completed', 'merged'].includes(toLane)) {
+      throw new Error('无效的目标泳道')
+    }
+    return runner.moveTask(cardId, toLane)
+  })
+
+  route('stop', async (p) => runner.stopTask(requireString(p.cardId, 'cardId')))
+
+  route('retry', async (p) => runner.retryTask(requireString(p.cardId, 'cardId')))
+
+  route('remove', async (p) => runner.deleteTask(requireString(p.cardId, 'cardId')))
+
+  route('settings.get', async () => settings.get())
+
+  route('settings.set', async (p) => {
+    const patch: { maxParallelWorkers?: number; defaultModel?: string } = {}
+    if (typeof p.maxParallelWorkers === 'number') patch.maxParallelWorkers = p.maxParallelWorkers
+    if (typeof p.defaultModel === 'string') patch.defaultModel = p.defaultModel
+    await settings.update(patch)
+    return settings.get()
+  })
+
+  route('models.list', async () => listModels(ctx))
+
+  return () => {
+    for (const d of disposers) d()
+  }
+}