@h-ai/iam 0.1.0-alpha.18 → 0.1.0-alpha.19

package/README.md

@@ -86,6 +86,8 @@ const hasPermission = await iam.authz.checkPermission(
 await iam.close()
 ```
 
+`iam.config` 返回的是**脱敏后的配置快照**：LDAP `url` / `bindPassword` 等敏感配置会自动隐藏，便于状态检查但不能代替原始配置源。
+
 ## 设计说明
 
 ### 架构概览

package/dist/index.d.ts

@@ -1364,7 +1364,7 @@ interface IamFunctions {
      * 关闭后访问 `iam.auth` 等属性将返回未初始化错误。
      */
     close: () => Promise<void>;
-    /** 当前配置（未初始化时为 null） */
+    /** 当前脱敏后的配置快照（未初始化时为 null） */
     readonly config: IamConfig | null;
     /** 是否已初始化 */
     readonly isInitialized: boolean;

package/dist/index.js

@@ -663,18 +663,18 @@ var API_KEY_FIELDS = [
   }
 ];
 var apiKeyRepoInstance = null;
-var apiKeyRepoDbConfig = null;
+var apiKeyRepoSqlOps = null;
 function resetApiKeyRepoSingleton() {
   apiKeyRepoInstance = null;
-  apiKeyRepoDbConfig = null;
+  apiKeyRepoSqlOps = null;
 }
 async function createDbApiKeyRepository() {
-  if (apiKeyRepoInstance && apiKeyRepoDbConfig === reldb.config)
+  if (apiKeyRepoInstance && apiKeyRepoSqlOps === reldb.sql)
     return apiKeyRepoInstance;
   const repo = new DbApiKeyRepository();
   await repo.count();
   apiKeyRepoInstance = repo;
-  apiKeyRepoDbConfig = reldb.config;
+  apiKeyRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbApiKeyRepository = class extends BaseReldbCrudRepository {
@@ -893,18 +893,18 @@ var USER_FIELDS = [
   }
 ];
 var userRepoInstance = null;
-var userRepoDbConfig = null;
+var userRepoSqlOps = null;
 function resetUserRepoSingleton() {
   userRepoInstance = null;
-  userRepoDbConfig = null;
+  userRepoSqlOps = null;
 }
 async function createDbUserRepository() {
-  if (userRepoInstance && userRepoDbConfig === reldb.config)
+  if (userRepoInstance && userRepoSqlOps === reldb.sql)
     return userRepoInstance;
   const repo = new DbUserRepository();
   await repo.count();
   userRepoInstance = repo;
-  userRepoDbConfig = reldb.config;
+  userRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbUserRepository = class extends BaseReldbCrudRepository {
@@ -2103,18 +2103,18 @@ var PERMISSION_FIELDS = [
   }
 ];
 var permRepoInstance = null;
-var permRepoDbConfig = null;
+var permRepoSqlOps = null;
 function resetPermissionRepoSingleton() {
   permRepoInstance = null;
-  permRepoDbConfig = null;
+  permRepoSqlOps = null;
 }
 async function createDbPermissionRepository() {
-  if (permRepoInstance && permRepoDbConfig === reldb.config)
+  if (permRepoInstance && permRepoSqlOps === reldb.sql)
     return permRepoInstance;
   const repo = new DbPermissionRepository();
   await repo.count();
   permRepoInstance = repo;
-  permRepoDbConfig = reldb.config;
+  permRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbPermissionRepository = class extends BaseReldbCrudRepository {
@@ -2619,18 +2619,18 @@ var ROLE_FIELDS = [
   }
 ];
 var roleRepoInstance = null;
-var roleRepoDbConfig = null;
+var roleRepoSqlOps = null;
 function resetRoleRepoSingleton() {
   roleRepoInstance = null;
-  roleRepoDbConfig = null;
+  roleRepoSqlOps = null;
 }
 async function createDbRoleRepository() {
-  if (roleRepoInstance && roleRepoDbConfig === reldb.config)
+  if (roleRepoInstance && roleRepoSqlOps === reldb.sql)
     return roleRepoInstance;
   const repo = new DbRoleRepository();
   await repo.count();
   roleRepoInstance = repo;
-  roleRepoDbConfig = reldb.config;
+  roleRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbRoleRepository = class extends BaseReldbCrudRepository {
@@ -3561,6 +3561,13 @@ function restoreSessionDates(session) {
     expiresAt: session.expiresAt instanceof Date ? session.expiresAt : new Date(session.expiresAt)
   };
 }
+function buildRepositoryError(messageKey, message, cause) {
+  return err(
+    HaiIamError.REPOSITORY_ERROR,
+    iamM(messageKey, { params: { message } }),
+    cause
+  );
+}
 function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
   const repo = {
     async save(session, tokenPair) {
@@ -3639,31 +3646,82 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
       return ok(void 0);
     },
     async removeByAccessToken(accessToken) {
-      const sessionResult = await cache.kv.get(buildTokenKey(accessToken));
-      if (sessionResult.success && sessionResult.data) {
+      const tokenKey = buildTokenKey(accessToken);
+      const sessionResult = await cache.kv.get(tokenKey);
+      if (!sessionResult.success) {
+        return buildRepositoryError(
+          "iam_querySessionMappingCacheFailed",
+          sessionResult.error.message,
+          sessionResult.error
+        );
+      }
+      if (sessionResult.data) {
         const session = sessionResult.data;
-        await cache.set_.srem(buildUserTokensKey(session.userId), accessToken);
+        const removeUserTokenResult = await cache.set_.srem(buildUserTokensKey(session.userId), accessToken);
+        if (!removeUserTokenResult.success) {
+          return buildRepositoryError(
+            "iam_deleteUserSessionCacheFailed",
+            removeUserTokenResult.error.message,
+            removeUserTokenResult.error
+          );
+        }
         const tokenPair = session.data?._tokenPair;
         if (tokenPair?.refreshToken) {
-          await cache.kv.del(buildRefreshKey(tokenPair.refreshToken));
+          const removeRefreshTokenResult = await cache.kv.del(buildRefreshKey(tokenPair.refreshToken));
+          if (!removeRefreshTokenResult.success) {
+            return buildRepositoryError(
+              "iam_deleteSessionMappingCacheFailed",
+              removeRefreshTokenResult.error.message,
+              removeRefreshTokenResult.error
+            );
+          }
         }
       }
-      await cache.kv.del(buildTokenKey(accessToken));
+      const removeSessionResult = await cache.kv.del(tokenKey);
+      if (!removeSessionResult.success) {
+        return buildRepositoryError(
+          "iam_deleteSessionMappingCacheFailed",
+          removeSessionResult.error.message,
+          removeSessionResult.error
+        );
+      }
       return ok(void 0);
     },
     async removeByUserId(userId) {
       const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
+      if (!tokensResult.success) {
+        return buildRepositoryError(
+          "iam_queryUserSessionCacheFailed",
+          tokensResult.error.message,
+          tokensResult.error
+        );
+      }
       let removed = 0;
-      if (tokensResult.success && tokensResult.data.length > 0) {
+      if (tokensResult.data.length > 0) {
         const results = await Promise.allSettled(
           tokensResult.data.map((token) => repo.removeByAccessToken(token))
         );
         for (const r of results) {
-          if (r.status === "fulfilled" && r.value.success)
-            removed += 1;
+          if (r.status === "rejected") {
+            return buildRepositoryError(
+              "iam_deleteSessionFailed",
+              String(r.reason),
+              r.reason
+            );
+          }
+          if (!r.value.success)
+            return r.value;
+          removed += 1;
         }
       }
-      await cache.kv.del(buildUserTokensKey(userId));
+      const removeUserTokensKeyResult = await cache.kv.del(buildUserTokensKey(userId));
+      if (!removeUserTokensKeyResult.success) {
+        return buildRepositoryError(
+          "iam_deleteUserSessionCacheFailed",
+          removeUserTokensKeyResult.error.message,
+          removeUserTokensKeyResult.error
+        );
+      }
       return ok(removed);
     },
     async getByRefreshToken(refreshToken) {
@@ -3714,8 +3772,13 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
       const staleTokens = [];
       const writeOps = [];
       for (const entry of readResults) {
-        if (entry.status === "rejected")
-          continue;
+        if (entry.status === "rejected") {
+          return buildRepositoryError(
+            "iam_queryUserSessionCacheFailed",
+            String(entry.reason),
+            entry.reason
+          );
+        }
         const { token, sessionKey, sessionResult, ttlResult } = entry.value;
         if (!sessionResult.success || !sessionResult.data || !ttlResult.success || ttlResult.data <= 0) {
           staleTokens.push(token);
@@ -3725,16 +3788,31 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
         writeOps.push(cache.kv.set(sessionKey, updated, { ex: ttlResult.data }));
       }
       const writeResults = await Promise.allSettled(writeOps);
-      const failedWrite = writeResults.find((r) => r.status === "fulfilled" && !r.value.success);
-      if (failedWrite) {
-        const failedResult = failedWrite.value;
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveUserSessionCacheFailed", { params: { message: failedResult.error.message } })
-        );
+      for (const writeResult of writeResults) {
+        if (writeResult.status === "rejected") {
+          return buildRepositoryError(
+            "iam_saveUserSessionCacheFailed",
+            String(writeResult.reason),
+            writeResult.reason
+          );
+        }
+        if (!writeResult.value.success) {
+          return buildRepositoryError(
+            "iam_saveUserSessionCacheFailed",
+            writeResult.value.error.message,
+            writeResult.value.error
+          );
+        }
       }
       if (staleTokens.length > 0) {
-        await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
+        const staleCleanupResult = await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
+        if (!staleCleanupResult.success) {
+          return buildRepositoryError(
+            "iam_deleteUserSessionCacheFailed",
+            staleCleanupResult.error.message,
+            staleCleanupResult.error
+          );
+        }
       }
       return ok(void 0);
     }
@@ -3825,15 +3903,21 @@ function buildSessionFunctions(config) {
         return ok(null);
       }
       if (/* @__PURE__ */ new Date() > session.expiresAt) {
-        await repo.removeByAccessToken(accessToken);
+        const removeResult = await repo.removeByAccessToken(accessToken);
+        if (!removeResult.success) {
+          return removeResult;
+        }
         return ok(null);
       }
       if (sliding) {
         const now = /* @__PURE__ */ new Date();
-        await repo.updateByAccessToken(accessToken, {
+        const updateResult = await repo.updateByAccessToken(accessToken, {
           lastActiveAt: now,
           expiresAt: new Date(now.getTime() + maxAge * 1e3)
         });
+        if (!updateResult.success) {
+          return updateResult;
+        }
       }
       return ok(stripInternalSessionFields(session));
     },
@@ -3877,7 +3961,10 @@ function buildSessionFunctions(config) {
             iamM("iam_refreshTokenExpired")
           );
         }
-        await repo.removeByAccessToken(oldSession.accessToken);
+        const removeOldSessionResult = await repo.removeByAccessToken(oldSession.accessToken);
+        if (!removeOldSessionResult.success) {
+          return removeOldSessionResult;
+        }
         const newSessionResult = await this.create({
           userId: oldSession.userId,
           username: oldSession.username,
@@ -3929,12 +4016,23 @@ function hashResetToken(token) {
 }
 var RESET_TOKEN_KEY_PREFIX = "hai:iam:reset:";
 var RESET_ATTEMPTS_KEY_PREFIX = "hai:iam:reset:attempts:";
+var RESET_USER_TOKEN_KEY_PREFIX = "hai:iam:reset:user:";
 function buildResetTokenKey(hashedToken) {
   return `${RESET_TOKEN_KEY_PREFIX}${hashedToken}`;
 }
 function buildAttemptsKey(userId) {
   return `${RESET_ATTEMPTS_KEY_PREFIX}${userId}`;
 }
+function buildUserTokenKey(userId) {
+  return `${RESET_USER_TOKEN_KEY_PREFIX}${userId}`;
+}
+function buildResetTokenRepositoryError(messageKey, message, cause) {
+  return err(
+    HaiIamError.REPOSITORY_ERROR,
+    iamM(messageKey, { params: { message } }),
+    cause
+  );
+}
 var resetTokenRepoInstance = null;
 function resetResetTokenRepoSingleton() {
   resetTokenRepoInstance = null;
@@ -3942,6 +4040,22 @@ function resetResetTokenRepoSingleton() {
 function createCacheResetTokenRepository() {
   if (resetTokenRepoInstance)
     return resetTokenRepoInstance;
+  async function clearTokenState(hashedToken, userId) {
+    const cleanupResults = await Promise.all([
+      cache.kv.del(buildResetTokenKey(hashedToken)),
+      cache.kv.del(buildAttemptsKey(userId)),
+      cache.kv.del(buildUserTokenKey(userId))
+    ]);
+    const failedCleanup = cleanupResults.find((result) => !result.success);
+    if (failedCleanup && !failedCleanup.success) {
+      return buildResetTokenRepositoryError(
+        "iam_saveResetTokenFailed",
+        failedCleanup.error.message,
+        failedCleanup.error
+      );
+    }
+    return ok(void 0);
+  }
   const repo = {
     async saveToken(token, userId, expiresAt) {
       const hashResult = hashResetToken(token);
@@ -3950,6 +4064,25 @@ function createCacheResetTokenRepository() {
       }
       const hashedToken = hashResult.data;
       const ttlSeconds = Math.max(1, Math.ceil((expiresAt.getTime() - Date.now()) / 1e3));
+      const userTokenKey = buildUserTokenKey(userId);
+      const existingTokenResult = await cache.kv.get(userTokenKey);
+      if (!existingTokenResult.success) {
+        return buildResetTokenRepositoryError(
+          "iam_queryResetTokenFailed",
+          existingTokenResult.error.message,
+          existingTokenResult.error
+        );
+      }
+      if (existingTokenResult.data && existingTokenResult.data !== hashedToken) {
+        const removeExistingTokenResult = await cache.kv.del(buildResetTokenKey(existingTokenResult.data));
+        if (!removeExistingTokenResult.success) {
+          return buildResetTokenRepositoryError(
+            "iam_saveResetTokenFailed",
+            removeExistingTokenResult.error.message,
+            removeExistingTokenResult.error
+          );
+        }
+      }
       const setResult = await cache.kv.set(buildResetTokenKey(hashedToken), userId, { ex: ttlSeconds });
       if (!setResult.success) {
         return err(
@@ -3958,11 +4091,24 @@ function createCacheResetTokenRepository() {
           setResult.error
         );
       }
+      const saveUserTokenResult = await cache.kv.set(userTokenKey, hashedToken, { ex: ttlSeconds });
+      if (!saveUserTokenResult.success) {
+        await cache.kv.del(buildResetTokenKey(hashedToken));
+        return buildResetTokenRepositoryError(
+          "iam_saveResetTokenFailed",
+          saveUserTokenResult.error.message,
+          saveUserTokenResult.error
+        );
+      }
       const attemptsResult = await cache.kv.set(buildAttemptsKey(userId), 0, { ex: ttlSeconds });
       if (!attemptsResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveResetTokenFailed", { params: { message: attemptsResult.error.message } }),
+        await Promise.all([
+          cache.kv.del(buildResetTokenKey(hashedToken)),
+          cache.kv.del(userTokenKey)
+        ]);
+        return buildResetTokenRepositoryError(
+          "iam_saveResetTokenFailed",
+          attemptsResult.error.message,
           attemptsResult.error
         );
       }
@@ -3992,10 +4138,19 @@ function createCacheResetTokenRepository() {
       const userId = result.data;
       const attemptsKey = buildAttemptsKey(userId);
       const incrResult = await cache.kv.incr(attemptsKey);
-      const nextAttempts = incrResult.success ? incrResult.data : 1;
+      if (!incrResult.success) {
+        return buildResetTokenRepositoryError(
+          "iam_saveResetTokenFailed",
+          incrResult.error.message,
+          incrResult.error
+        );
+      }
+      const nextAttempts = incrResult.data;
       if (nextAttempts > maxAttempts) {
-        await cache.kv.del(tokenKey);
-        await cache.kv.del(attemptsKey);
+        const clearResult = await clearTokenState(hashedToken, userId);
+        if (!clearResult.success) {
+          return clearResult;
+        }
         return err(
           HaiIamError.RESET_TOKEN_MAX_ATTEMPTS,
           iamM("iam_resetTokenMaxAttempts")
@@ -4011,11 +4166,17 @@ function createCacheResetTokenRepository() {
       const hashedToken = hashResult.data;
       const tokenKey = buildResetTokenKey(hashedToken);
       const result = await cache.kv.get(tokenKey);
-      if (result.success && result.data) {
-        await cache.kv.del(buildAttemptsKey(result.data));
+      if (!result.success) {
+        return buildResetTokenRepositoryError(
+          "iam_queryResetTokenFailed",
+          result.error.message,
+          result.error
+        );
       }
-      await cache.kv.del(tokenKey);
-      return ok(void 0);
+      if (!result.data) {
+        return ok(void 0);
+      }
+      return clearTokenState(hashedToken, result.data);
     }
   };
   resetTokenRepoInstance = repo;
@@ -4637,6 +4798,9 @@ function buildUserFunctions(deps) {
 
 // src/iam-main.ts
 var logger10 = core.logger.child({ module: "iam", scope: "main" });
+function sanitizeIamConfig(config) {
+  return core.sanitize.sanitizeSensitiveFields(config);
+}
 var initInProgress = false;
 var currentConfig = null;
 var currentAuth = null;
@@ -4789,7 +4953,7 @@ var iam = {
     return currentApiKey ?? notInitializedApiKey;
   },
   get config() {
-    return currentConfig;
+    return currentConfig ? sanitizeIamConfig(currentConfig) : null;
   },
   get isInitialized() {
     return currentConfig !== null;