@fuxi-ailabs/dsh-provider-auth 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,133 @@
-# Temporary Holding Version
+# @fuxi-ailabs/dsh-provider-auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DSH 插件共享的 **provider/auth resolver**。它不直接调用模型，也不保存密钥；只把
+“某个消费者应该用哪一组 `baseUrl / apiKey / model`”按统一优先级解析出来。
+
+## 为什么单独拆插件
+
+`dsh-insight` 的评分能力已经有一份 `显式配置 → 环境变量 → DSH credentials` 的解析逻辑。`dsh-audit`
+需要同样一套规则，但协议和默认值不同：
+
+- `dsh-insight` 评分：OpenAI-compatible，默认 `https://api.deepseek.com`
+- `dsh-audit`：Anthropic Messages，默认 `https://api.deepseek.com/anthropic`
+
+共享 resolver 只负责“从哪拿”，协议映射和探活仍留在各自插件。
+
+## 服务
+
+插件向宿主提供：
+
+```ts
+ctx.provide('providerAuth', service)
+```
+
+消费方软取：
+
+```ts
+const auth = ctx.get('providerAuth')
+```
+
+### `resolve(request)`
+
+```ts
+const resolved = await auth.resolve({
+  id: 'sift',
+  protocol: 'anthropic-messages',
+  explicit: { baseUrl, apiKey, model },
+  env: {
+    baseUrl: ['DSH_SIFT_BASE_URL', 'ANTHROPIC_BASE_URL'],
+    apiKey: ['DSH_SIFT_AUTH_TOKEN', 'ANTHROPIC_AUTH_TOKEN'],
+    model: ['DSH_SIFT_MODEL', 'ANTHROPIC_MODEL'],
+  },
+  dsh: {
+    apiKeyRef: 'DEEPSEEK_API_KEY',
+    baseUrl: 'https://api.deepseek.com/anthropic',
+    model: 'deepseek-chat',
+  },
+})
+```
+
+优先级：
+
+```text
+显式配置
+  > 环境变量
+  > DSH credentials
+```
+
+### `describe(request)`
+
+返回不包含密钥的状态：
+
+```ts
+{
+  configured: true,
+  source: 'dsh-credentials',
+  sourceDetail: 'DSH credentials DEEPSEEK_API_KEY (file)',
+  maskedKey: 'sk-d…6789',
+  note: '来源:DSH credentials DEEPSEEK_API_KEY (file)',
+  skipped: []
+}
+```
+
+供 `/score --probe-provider` 和后续独立的环境检查插件使用。
+
+### `mask(secret)`
+
+默认保留前 4 位和后 4 位；短 key 直接返回 `****`。
+
+## 配置
+
+```yaml
+- id: dsh-provider-auth
+  name: '@fuxi-ailabs/dsh-provider-auth'
+  config:
+    allowDshCredentials: true
+    maskHead: 4
+    maskTail: 4
+    providers:
+      anthropic-messages:
+        baseUrl: https://api.deepseek.com/anthropic
+        model: deepseek-chat
+        apiKeyRef: DEEPSEEK_API_KEY
+      openai-chat:
+        baseUrl: https://api.deepseek.com
+        model: deepseek-chat
+        apiKeyRef: DEEPSEEK_API_KEY
+```
+
+消费插件可以只传协议，不再重复写 endpoint/model/key 引用：
+
+```ts
+providerAuth.resolve({
+  id: 'sift',
+  protocol: 'anthropic-messages',
+})
+```
+
+解析优先级：
+
+```text
+显式请求配置
+  > 环境变量
+  > providerAuth providers[protocol]
+  > 消费方传入的 DSH 兼容模板
+```
+
+## 边界
+
+- 不保存密钥；密钥来自配置、环境变量或 DSH `credentials` 服务
+- 不缓存密钥；每次 `resolve()` 现取现用
+- 不做协议转换
+- 不负责模型探活
+- 不向 client 暴露 secret
+- 不是 `dsh-insight` 评分能力 / `dsh-audit` 的硬依赖；两个消费方应在服务缺席时保留自己的 fallback
+
+## 开发
+
+```bash
+npm install
+npm test
+npm run typecheck
+npm run pack
+```

package/dist/index.js

@@ -0,0 +1,273 @@
+// src/config.ts
+var DEFAULT_PROVIDERS = {
+  "anthropic-messages": {
+    baseUrl: "https://api.deepseek.com/anthropic",
+    model: "deepseek-chat",
+    apiKeyRef: "DEEPSEEK_API_KEY"
+  },
+  "openai-chat": {
+    baseUrl: "https://api.deepseek.com",
+    model: "deepseek-chat",
+    apiKeyRef: "DEEPSEEK_API_KEY"
+  }
+};
+var defaultConfig = {
+  allowDshCredentials: true,
+  maskHead: 4,
+  maskTail: 4,
+  providers: DEFAULT_PROVIDERS
+};
+function nonNegativeInt(value, fallback) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : fallback;
+}
+function normalizeProfiles(input) {
+  const given = input ?? {};
+  const out = {};
+  const protocols = ["anthropic-messages", "openai-chat"];
+  for (const protocol of protocols) {
+    const base = DEFAULT_PROVIDERS[protocol] ?? {};
+    const override = given[protocol] ?? {};
+    out[protocol] = { ...base, ...override };
+  }
+  return out;
+}
+function normalizeConfig(input) {
+  const given = input ?? {};
+  return {
+    allowDshCredentials: given.allowDshCredentials ?? defaultConfig.allowDshCredentials,
+    maskHead: nonNegativeInt(given.maskHead, defaultConfig.maskHead),
+    maskTail: nonNegativeInt(given.maskTail, defaultConfig.maskTail),
+    providers: normalizeProfiles(given.providers)
+  };
+}
+function maskSecret(secret, config = defaultConfig) {
+  const head = nonNegativeInt(config.maskHead, defaultConfig.maskHead);
+  const tail = nonNegativeInt(config.maskTail, defaultConfig.maskTail);
+  if (head === 0 && tail === 0) return "****";
+  if (secret.length <= head + tail + 1) return "****";
+  return `${head > 0 ? secret.slice(0, head) : ""}\u2026${tail > 0 ? secret.slice(-tail) : ""}`;
+}
+
+// src/core/resolve.ts
+var VALUE_KEYS = ["baseUrl", "apiKey", "model"];
+function trim(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function pickEnv(env, names) {
+  for (const name2 of names ?? []) {
+    const value = trim(env[name2]);
+    if (value.length > 0) return { value, key: name2 };
+  }
+  return { value: "", key: "" };
+}
+function missing(values) {
+  return VALUE_KEYS.filter((key) => values[key].length === 0);
+}
+function hasAny(values) {
+  return VALUE_KEYS.some((key) => values[key].length > 0);
+}
+function result(request, values, source, sourceDetail) {
+  return {
+    id: request.id,
+    protocol: request.protocol,
+    baseUrl: values.baseUrl,
+    apiKey: values.apiKey,
+    model: values.model,
+    source,
+    sourceDetail,
+    note: `\u6765\u6E90:${sourceDetail}`
+  };
+}
+async function resolveProviderAuth(request, options) {
+  if (request.id.trim().length === 0) throw new Error("providerAuth: request.id must be non-empty");
+  if (request.protocol !== "openai-chat" && request.protocol !== "anthropic-messages") {
+    throw new Error(`providerAuth: unsupported protocol ${String(request.protocol)}`);
+  }
+  const skipped = [];
+  const explicit = {
+    baseUrl: trim(request.explicit?.baseUrl),
+    apiKey: trim(request.explicit?.apiKey),
+    model: trim(request.explicit?.model)
+  };
+  if (hasAny(explicit)) {
+    const miss = missing(explicit);
+    if (miss.length === 0) return { result: result(request, explicit, "config", `\u63D2\u4EF6\u663E\u5F0F\u914D\u7F6E(${request.id})`), skipped };
+    skipped.push(`\u663E\u5F0F\u914D\u7F6E\u4E0D\u5B8C\u6574,\u7F3A ${miss.join("/")}`);
+  }
+  const envSource = request.env ?? {};
+  const envPicks = {
+    baseUrl: pickEnv(options.env ?? process.env, envSource.baseUrl),
+    apiKey: pickEnv(options.env ?? process.env, envSource.apiKey),
+    model: pickEnv(options.env ?? process.env, envSource.model)
+  };
+  const envValues = {
+    baseUrl: envPicks.baseUrl.value,
+    apiKey: envPicks.apiKey.value,
+    model: envPicks.model.value
+  };
+  if (hasAny(envValues)) {
+    const miss = missing(envValues);
+    if (miss.length === 0) {
+      const keys = `${envPicks.baseUrl.key} / ${envPicks.apiKey.key} / ${envPicks.model.key}`;
+      return { result: result(request, envValues, "env", `\u73AF\u5883\u53D8\u91CF ${keys}`), skipped };
+    }
+    skipped.push(`\u73AF\u5883\u53D8\u91CF\u4E0D\u5B8C\u6574,\u7F3A ${miss.join("/")}`);
+  }
+  if (!options.allowDshCredentials) {
+    skipped.push("DSH \u51ED\u636E\u501F\u7528\u5DF2\u5173\u95ED");
+    return { result: null, skipped };
+  }
+  if (!options.credentials || typeof options.credentials.resolve !== "function") {
+    skipped.push("\u5BBF\u4E3B\u672A\u6302\u8F7D credentials \u670D\u52A1");
+    return { result: null, skipped };
+  }
+  const profile = options.providers?.[request.protocol];
+  if (profile) {
+    const profileBaseUrl = trim(profile.baseUrl);
+    const profileModel = trim(profile.model);
+    const profileRef = trim(profile.apiKeyRef);
+    const profileMiss = [];
+    if (profileBaseUrl.length === 0) profileMiss.push("baseUrl");
+    if (profileModel.length === 0) profileMiss.push("model");
+    if (profileRef.length === 0) profileMiss.push("apiKeyRef");
+    if (profileMiss.length === 0) {
+      try {
+        const hit = await options.credentials.resolve(profileRef);
+        const key = trim(hit?.value);
+        if (key.length > 0) {
+          const values = { baseUrl: profileBaseUrl, apiKey: key, model: profileModel };
+          return {
+            result: result(
+              request,
+              values,
+              "dsh-credentials",
+              `provider profile ${request.protocol} \u2192 DSH credentials ${profileRef}${hit?.source ? ` (${hit.source})` : ""}`
+            ),
+            skipped
+          };
+        }
+        skipped.push(`provider profile \u672A\u8BFB\u5230 DSH \u51ED\u636E ${profileRef}`);
+      } catch (error) {
+        skipped.push(`\u8BFB\u53D6 provider profile \u51ED\u636E\u5931\u8D25: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    } else {
+      skipped.push(`provider profile ${request.protocol} \u4E0D\u5B8C\u6574,\u7F3A ${profileMiss.join("/")}`);
+    }
+  } else {
+    skipped.push(`\u672A\u914D\u7F6E provider profile ${request.protocol}`);
+  }
+  if (!request.dsh) {
+    skipped.push("\u672A\u63D0\u4F9B DSH \u51ED\u636E\u6A21\u677F");
+    return { result: null, skipped };
+  }
+  const dshBaseUrl = trim(request.dsh.baseUrl);
+  const dshModel = trim(request.dsh.model);
+  const ref = trim(request.dsh.apiKeyRef);
+  const dshMiss = [];
+  if (dshBaseUrl.length === 0) dshMiss.push("baseUrl");
+  if (dshModel.length === 0) dshMiss.push("model");
+  if (ref.length === 0) dshMiss.push("apiKeyRef");
+  if (dshMiss.length > 0) {
+    skipped.push(`DSH \u51ED\u636E\u6A21\u677F\u4E0D\u5B8C\u6574,\u7F3A ${dshMiss.join("/")}`);
+    return { result: null, skipped };
+  }
+  const dshValues = {
+    baseUrl: dshBaseUrl,
+    apiKey: "",
+    model: dshModel
+  };
+  try {
+    const hit = await options.credentials.resolve(ref);
+    const key = trim(hit?.value);
+    if (key.length === 0) {
+      skipped.push(`\u672A\u8BFB\u5230 DSH \u51ED\u636E ${ref}`);
+      return { result: null, skipped };
+    }
+    dshValues.apiKey = key;
+    return {
+      result: result(request, dshValues, "dsh-credentials", `DSH credentials ${ref}${hit?.source ? ` (${hit.source})` : ""}`),
+      skipped
+    };
+  } catch (error) {
+    skipped.push(`\u8BFB\u53D6 DSH \u51ED\u636E\u5931\u8D25: ${error instanceof Error ? error.message : String(error)}`);
+    return { result: null, skipped };
+  }
+}
+
+// src/service.ts
+var PROVIDER_AUTH_SERVICE_NAME = "providerAuth";
+function credentialsOf(ctx) {
+  const value = ctx.get("credentials");
+  return value && typeof value.resolve === "function" ? value : void 0;
+}
+function createProviderAuthService(ctx, config, env = process.env) {
+  const resolve = async (request) => {
+    const outcome = await resolveProviderAuth(request, {
+      allowDshCredentials: config.allowDshCredentials,
+      credentials: credentialsOf(ctx),
+      env,
+      providers: config.providers
+    });
+    return outcome.result;
+  };
+  const mask = (secret) => maskSecret(secret, config);
+  return {
+    resolve,
+    async describe(request) {
+      const outcome = await resolveProviderAuth(request, {
+        allowDshCredentials: config.allowDshCredentials,
+        credentials: credentialsOf(ctx),
+        env,
+        providers: config.providers
+      });
+      const hit = outcome.result;
+      if (hit) {
+        return {
+          id: request.id,
+          protocol: request.protocol,
+          configured: true,
+          source: hit.source,
+          sourceDetail: hit.sourceDetail,
+          maskedKey: mask(hit.apiKey),
+          note: hit.note,
+          skipped: outcome.skipped
+        };
+      }
+      return {
+        id: request.id,
+        protocol: request.protocol,
+        configured: false,
+        note: outcome.skipped.length > 0 ? `\u672A\u89E3\u6790\u5230\u5B8C\u6574 provider auth: ${outcome.skipped.join("; ")}` : "\u672A\u914D\u7F6E provider auth",
+        skipped: outcome.skipped
+      };
+    },
+    mask
+  };
+}
+
+// src/index.ts
+var name = "dsh-provider-auth";
+var inject = [];
+function apply(ctx, config) {
+  if (typeof ctx.provide !== "function") {
+    throw new Error("dsh-provider-auth: \u5BBF\u4E3B ctx \u7F3A\u5C11 provide(),\u65E0\u6CD5\u6CE8\u518C providerAuth \u670D\u52A1");
+  }
+  const resolved = normalizeConfig(config);
+  const service = createProviderAuthService(ctx, resolved);
+  const register = () => ctx.provide(PROVIDER_AUTH_SERVICE_NAME, service);
+  if (typeof ctx.effect === "function") ctx.effect(register, "dsh-provider-auth: service");
+  else register();
+  process.stderr.write(`[dsh-provider-auth] ready \u2014 service=${PROVIDER_AUTH_SERVICE_NAME} borrowDsh=${resolved.allowDshCredentials}
+`);
+}
+export {
+  PROVIDER_AUTH_SERVICE_NAME,
+  apply,
+  createProviderAuthService,
+  defaultConfig,
+  inject,
+  maskSecret,
+  name,
+  normalizeConfig,
+  resolveProviderAuth
+};

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@fuxi-ailabs/dsh-provider-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "private": false,
+  "type": "module",
+  "description": "Shared provider/auth resolver for DSH plugins: explicit config, environment variables, and DSH credentials",
+  "main": "dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "dsh": {
+    "manifestVersion": 1
+  },
+  "scripts": {
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node tests/smoke.mjs",
+    "pack": "npm run build && npm pack",
+    "prepack": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.43",
+    "esbuild": "^0.25.12",
+    "typescript": "^5.9.3"
+  },
+  "license": "UNLICENSED",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "author": "Fuxi AI Labs",
+  "homepage": "https://fuxi-ailabs.github.io/dsh-plugin-market/plugins/insight/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/guixu-labs/dsh-plugin.git",
+    "directory": "packages/dsh-provider-auth"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "provider-auth",
+    "credentials"
+  ],
+  "engines": {
+    "dsh": "^0.2.1-rc.2",
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5"
+  }
+}