@h-ai/iam 0.1.0-alpha.18 → 0.1.0-alpha.20

package/README.md

@@ -86,6 +86,8 @@ const hasPermission = await iam.authz.checkPermission(
 await iam.close()
 ```
 
+`iam.config` 返回的是**脱敏后的配置快照**：LDAP `url` / `bindPassword` 等敏感配置会自动隐藏，便于状态检查但不能代替原始配置源。
+
 ## 设计说明
 
 ### 架构概览

package/dist/index.d.ts

@@ -1364,7 +1364,7 @@ interface IamFunctions {
      * 关闭后访问 `iam.auth` 等属性将返回未初始化错误。
      */
     close: () => Promise<void>;
-    /** 当前配置（未初始化时为 null） */
+    /** 当前脱敏后的配置快照（未初始化时为 null） */
     readonly config: IamConfig | null;
     /** 是否已初始化 */
     readonly isInitialized: boolean;

package/dist/index.js

@@ -663,18 +663,18 @@ var API_KEY_FIELDS = [
   }
 ];
 var apiKeyRepoInstance = null;
-var apiKeyRepoDbConfig = null;
+var apiKeyRepoSqlOps = null;
 function resetApiKeyRepoSingleton() {
   apiKeyRepoInstance = null;
-  apiKeyRepoDbConfig = null;
+  apiKeyRepoSqlOps = null;
 }
 async function createDbApiKeyRepository() {
-  if (apiKeyRepoInstance && apiKeyRepoDbConfig === reldb.config)
+  if (apiKeyRepoInstance && apiKeyRepoSqlOps === reldb.sql)
     return apiKeyRepoInstance;
   const repo = new DbApiKeyRepository();
   await repo.count();
   apiKeyRepoInstance = repo;
-  apiKeyRepoDbConfig = reldb.config;
+  apiKeyRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbApiKeyRepository = class extends BaseReldbCrudRepository {
@@ -753,6 +753,20 @@ var DbApiKeyRepository = class extends BaseReldbCrudRepository {
     );
   }
 };
+
+// src/iam-agreement.ts
+function buildAgreementDisplay(config, enabled) {
+  if (!enabled)
+    return void 0;
+  if (!config.userAgreementUrl && !config.privacyPolicyUrl)
+    return void 0;
+  return {
+    userAgreementUrl: config.userAgreementUrl,
+    privacyPolicyUrl: config.privacyPolicyUrl,
+    showOnRegister: config.showOnRegister,
+    showOnLogin: config.showOnLogin
+  };
+}
 var TABLE_NAME2 = "hai_iam_users";
 var USER_FIELDS = [
   {
@@ -893,18 +907,18 @@ var USER_FIELDS = [
   }
 ];
 var userRepoInstance = null;
-var userRepoDbConfig = null;
+var userRepoSqlOps = null;
 function resetUserRepoSingleton() {
   userRepoInstance = null;
-  userRepoDbConfig = null;
+  userRepoSqlOps = null;
 }
 async function createDbUserRepository() {
-  if (userRepoInstance && userRepoDbConfig === reldb.config)
+  if (userRepoInstance && userRepoSqlOps === reldb.sql)
     return userRepoInstance;
   const repo = new DbUserRepository();
   await repo.count();
   userRepoInstance = repo;
-  userRepoDbConfig = reldb.config;
+  userRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbUserRepository = class extends BaseReldbCrudRepository {
@@ -1503,9 +1517,6 @@ function createOtpStrategy(config) {
   const registerConfig = config.registerConfig;
   const allowAutoRegister = registerConfig?.enabled ?? config.autoRegister ?? false;
   const defaultEnabled = registerConfig?.defaultEnabled ?? true;
-  function buildChallengeResult(expiresAt) {
-    return { expiresAt };
-  }
   const strategy = {
     type: "otp",
     name: "otp-strategy",
@@ -1633,7 +1644,7 @@ function createOtpStrategy(config) {
         iamM("iam_identifierTypeNotSupported")
       );
     }
-    const result = buildChallengeResult(expiresAt);
+    const result = { expiresAt };
     logger3.debug("OTP challenge sent", { identifier, expiresAt });
     return ok(result);
   }
@@ -1870,20 +1881,6 @@ function buildAuthnOperations(deps) {
   } = deps;
   const loginConfig = LoginConfigSchema.parse(config.login ?? {});
   const agreementConfig = AgreementConfigSchema.parse(config.agreements ?? {});
-  function buildAgreementDisplay() {
-    if (!agreementConfig.showOnLogin) {
-      return void 0;
-    }
-    if (!agreementConfig.userAgreementUrl && !agreementConfig.privacyPolicyUrl) {
-      return void 0;
-    }
-    return {
-      userAgreementUrl: agreementConfig.userAgreementUrl,
-      privacyPolicyUrl: agreementConfig.privacyPolicyUrl,
-      showOnRegister: agreementConfig.showOnRegister,
-      showOnLogin: agreementConfig.showOnLogin
-    };
-  }
   function loginDisabled(type) {
     if (!loginConfig[type]) {
       return err(
@@ -1960,7 +1957,7 @@ function buildAuthnOperations(deps) {
       tokens: tokenPair,
       roles: roleCodesResult.data,
       permissions: permCodesResult.data,
-      agreements: buildAgreementDisplay()
+      agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnLogin)
     });
   }
   async function loginWithStrategy(type, credentials, strategy) {
@@ -2103,18 +2100,18 @@ var PERMISSION_FIELDS = [
   }
 ];
 var permRepoInstance = null;
-var permRepoDbConfig = null;
+var permRepoSqlOps = null;
 function resetPermissionRepoSingleton() {
   permRepoInstance = null;
-  permRepoDbConfig = null;
+  permRepoSqlOps = null;
 }
 async function createDbPermissionRepository() {
-  if (permRepoInstance && permRepoDbConfig === reldb.config)
+  if (permRepoInstance && permRepoSqlOps === reldb.sql)
     return permRepoInstance;
   const repo = new DbPermissionRepository();
   await repo.count();
   permRepoInstance = repo;
-  permRepoDbConfig = reldb.config;
+  permRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbPermissionRepository = class extends BaseReldbCrudRepository {
@@ -2619,18 +2616,18 @@ var ROLE_FIELDS = [
   }
 ];
 var roleRepoInstance = null;
-var roleRepoDbConfig = null;
+var roleRepoSqlOps = null;
 function resetRoleRepoSingleton() {
   roleRepoInstance = null;
-  roleRepoDbConfig = null;
+  roleRepoSqlOps = null;
 }
 async function createDbRoleRepository() {
-  if (roleRepoInstance && roleRepoDbConfig === reldb.config)
+  if (roleRepoInstance && roleRepoSqlOps === reldb.sql)
     return roleRepoInstance;
   const repo = new DbRoleRepository();
   await repo.count();
   roleRepoInstance = repo;
-  roleRepoDbConfig = reldb.config;
+  roleRepoSqlOps = reldb.sql;
   return repo;
 }
 var DbRoleRepository = class extends BaseReldbCrudRepository {
@@ -3561,6 +3558,13 @@ function restoreSessionDates(session) {
     expiresAt: session.expiresAt instanceof Date ? session.expiresAt : new Date(session.expiresAt)
   };
 }
+function buildRepositoryError(messageKey, message, cause) {
+  return err(
+    HaiIamError.REPOSITORY_ERROR,
+    iamM(messageKey, { params: { message } }),
+    cause
+  );
+}
 function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
   const repo = {
     async save(session, tokenPair) {
@@ -3639,31 +3643,82 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
       return ok(void 0);
     },
     async removeByAccessToken(accessToken) {
-      const sessionResult = await cache.kv.get(buildTokenKey(accessToken));
-      if (sessionResult.success && sessionResult.data) {
+      const tokenKey = buildTokenKey(accessToken);
+      const sessionResult = await cache.kv.get(tokenKey);
+      if (!sessionResult.success) {
+        return buildRepositoryError(
+          "iam_querySessionMappingCacheFailed",
+          sessionResult.error.message,
+          sessionResult.error
+        );
+      }
+      if (sessionResult.data) {
         const session = sessionResult.data;
-        await cache.set_.srem(buildUserTokensKey(session.userId), accessToken);
+        const removeUserTokenResult = await cache.set_.srem(buildUserTokensKey(session.userId), accessToken);
+        if (!removeUserTokenResult.success) {
+          return buildRepositoryError(
+            "iam_deleteUserSessionCacheFailed",
+            removeUserTokenResult.error.message,
+            removeUserTokenResult.error
+          );
+        }
         const tokenPair = session.data?._tokenPair;
         if (tokenPair?.refreshToken) {
-          await cache.kv.del(buildRefreshKey(tokenPair.refreshToken));
+          const removeRefreshTokenResult = await cache.kv.del(buildRefreshKey(tokenPair.refreshToken));
+          if (!removeRefreshTokenResult.success) {
+            return buildRepositoryError(
+              "iam_deleteSessionMappingCacheFailed",
+              removeRefreshTokenResult.error.message,
+              removeRefreshTokenResult.error
+            );
+          }
         }
       }
-      await cache.kv.del(buildTokenKey(accessToken));
+      const removeSessionResult = await cache.kv.del(tokenKey);
+      if (!removeSessionResult.success) {
+        return buildRepositoryError(
+          "iam_deleteSessionMappingCacheFailed",
+          removeSessionResult.error.message,
+          removeSessionResult.error
+        );
+      }
       return ok(void 0);
     },
     async removeByUserId(userId) {
       const tokensResult = await cache.set_.smembers(buildUserTokensKey(userId));
+      if (!tokensResult.success) {
+        return buildRepositoryError(
+          "iam_queryUserSessionCacheFailed",
+          tokensResult.error.message,
+          tokensResult.error
+        );
+      }
       let removed = 0;
-      if (tokensResult.success && tokensResult.data.length > 0) {
+      if (tokensResult.data.length > 0) {
         const results = await Promise.allSettled(
           tokensResult.data.map((token) => repo.removeByAccessToken(token))
         );
         for (const r of results) {
-          if (r.status === "fulfilled" && r.value.success)
-            removed += 1;
+          if (r.status === "rejected") {
+            return buildRepositoryError(
+              "iam_deleteSessionFailed",
+              String(r.reason),
+              r.reason
+            );
+          }
+          if (!r.value.success)
+            return r.value;
+          removed += 1;
         }
       }
-      await cache.kv.del(buildUserTokensKey(userId));
+      const removeUserTokensKeyResult = await cache.kv.del(buildUserTokensKey(userId));
+      if (!removeUserTokensKeyResult.success) {
+        return buildRepositoryError(
+          "iam_deleteUserSessionCacheFailed",
+          removeUserTokensKeyResult.error.message,
+          removeUserTokensKeyResult.error
+        );
+      }
       return ok(removed);
     },
     async getByRefreshToken(refreshToken) {
@@ -3714,8 +3769,13 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
       const staleTokens = [];
       const writeOps = [];
       for (const entry of readResults) {
-        if (entry.status === "rejected")
-          continue;
+        if (entry.status === "rejected") {
+          return buildRepositoryError(
+            "iam_queryUserSessionCacheFailed",
+            String(entry.reason),
+            entry.reason
+          );
+        }
         const { token, sessionKey, sessionResult, ttlResult } = entry.value;
         if (!sessionResult.success || !sessionResult.data || !ttlResult.success || ttlResult.data <= 0) {
           staleTokens.push(token);
@@ -3725,16 +3785,31 @@ function createCacheSessionRepository(sessionMaxAge, refreshTokenMaxAge) {
         writeOps.push(cache.kv.set(sessionKey, updated, { ex: ttlResult.data }));
       }
       const writeResults = await Promise.allSettled(writeOps);
-      const failedWrite = writeResults.find((r) => r.status === "fulfilled" && !r.value.success);
-      if (failedWrite) {
-        const failedResult = failedWrite.value;
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveUserSessionCacheFailed", { params: { message: failedResult.error.message } })
-        );
+      for (const writeResult of writeResults) {
+        if (writeResult.status === "rejected") {
+          return buildRepositoryError(
+            "iam_saveUserSessionCacheFailed",
+            String(writeResult.reason),
+            writeResult.reason
+          );
+        }
+        if (!writeResult.value.success) {
+          return buildRepositoryError(
+            "iam_saveUserSessionCacheFailed",
+            writeResult.value.error.message,
+            writeResult.value.error
+          );
+        }
       }
       if (staleTokens.length > 0) {
-        await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
+        const staleCleanupResult = await cache.set_.srem(buildUserTokensKey(userId), ...staleTokens);
+        if (!staleCleanupResult.success) {
+          return buildRepositoryError(
+            "iam_deleteUserSessionCacheFailed",
+            staleCleanupResult.error.message,
+            staleCleanupResult.error
+          );
+        }
       }
       return ok(void 0);
     }
@@ -3825,15 +3900,21 @@ function buildSessionFunctions(config) {
         return ok(null);
       }
       if (/* @__PURE__ */ new Date() > session.expiresAt) {
-        await repo.removeByAccessToken(accessToken);
+        const removeResult = await repo.removeByAccessToken(accessToken);
+        if (!removeResult.success) {
+          return removeResult;
+        }
         return ok(null);
       }
       if (sliding) {
         const now = /* @__PURE__ */ new Date();
-        await repo.updateByAccessToken(accessToken, {
+        const updateResult = await repo.updateByAccessToken(accessToken, {
           lastActiveAt: now,
           expiresAt: new Date(now.getTime() + maxAge * 1e3)
         });
+        if (!updateResult.success) {
+          return updateResult;
+        }
       }
       return ok(stripInternalSessionFields(session));
     },
@@ -3877,7 +3958,10 @@ function buildSessionFunctions(config) {
             iamM("iam_refreshTokenExpired")
           );
         }
-        await repo.removeByAccessToken(oldSession.accessToken);
+        const removeOldSessionResult = await repo.removeByAccessToken(oldSession.accessToken);
+        if (!removeOldSessionResult.success) {
+          return removeOldSessionResult;
+        }
         const newSessionResult = await this.create({
           userId: oldSession.userId,
           username: oldSession.username,
@@ -3929,12 +4013,23 @@ function hashResetToken(token) {
 }
 var RESET_TOKEN_KEY_PREFIX = "hai:iam:reset:";
 var RESET_ATTEMPTS_KEY_PREFIX = "hai:iam:reset:attempts:";
+var RESET_USER_TOKEN_KEY_PREFIX = "hai:iam:reset:user:";
 function buildResetTokenKey(hashedToken) {
   return `${RESET_TOKEN_KEY_PREFIX}${hashedToken}`;
 }
 function buildAttemptsKey(userId) {
   return `${RESET_ATTEMPTS_KEY_PREFIX}${userId}`;
 }
+function buildUserTokenKey(userId) {
+  return `${RESET_USER_TOKEN_KEY_PREFIX}${userId}`;
+}
+function buildResetTokenRepositoryError(messageKey, message, cause) {
+  return err(
+    HaiIamError.REPOSITORY_ERROR,
+    iamM(messageKey, { params: { message } }),
+    cause
+  );
+}
 var resetTokenRepoInstance = null;
 function resetResetTokenRepoSingleton() {
   resetTokenRepoInstance = null;
@@ -3942,6 +4037,22 @@ function resetResetTokenRepoSingleton() {
 function createCacheResetTokenRepository() {
   if (resetTokenRepoInstance)
     return resetTokenRepoInstance;
+  async function clearTokenState(hashedToken, userId) {
+    const cleanupResults = await Promise.all([
+      cache.kv.del(buildResetTokenKey(hashedToken)),
+      cache.kv.del(buildAttemptsKey(userId)),
+      cache.kv.del(buildUserTokenKey(userId))
+    ]);
+    const failedCleanup = cleanupResults.find((result) => !result.success);
+    if (failedCleanup && !failedCleanup.success) {
+      return buildResetTokenRepositoryError(
+        "iam_saveResetTokenFailed",
+        failedCleanup.error.message,
+        failedCleanup.error
+      );
+    }
+    return ok(void 0);
+  }
   const repo = {
     async saveToken(token, userId, expiresAt) {
       const hashResult = hashResetToken(token);
@@ -3950,6 +4061,25 @@ function createCacheResetTokenRepository() {
       }
       const hashedToken = hashResult.data;
       const ttlSeconds = Math.max(1, Math.ceil((expiresAt.getTime() - Date.now()) / 1e3));
+      const userTokenKey = buildUserTokenKey(userId);
+      const existingTokenResult = await cache.kv.get(userTokenKey);
+      if (!existingTokenResult.success) {
+        return buildResetTokenRepositoryError(
+          "iam_queryResetTokenFailed",
+          existingTokenResult.error.message,
+          existingTokenResult.error
+        );
+      }
+      if (existingTokenResult.data && existingTokenResult.data !== hashedToken) {
+        const removeExistingTokenResult = await cache.kv.del(buildResetTokenKey(existingTokenResult.data));
+        if (!removeExistingTokenResult.success) {
+          return buildResetTokenRepositoryError(
+            "iam_saveResetTokenFailed",
+            removeExistingTokenResult.error.message,
+            removeExistingTokenResult.error
+          );
+        }
+      }
       const setResult = await cache.kv.set(buildResetTokenKey(hashedToken), userId, { ex: ttlSeconds });
       if (!setResult.success) {
         return err(
@@ -3958,11 +4088,24 @@ function createCacheResetTokenRepository() {
           setResult.error
         );
       }
+      const saveUserTokenResult = await cache.kv.set(userTokenKey, hashedToken, { ex: ttlSeconds });
+      if (!saveUserTokenResult.success) {
+        await cache.kv.del(buildResetTokenKey(hashedToken));
+        return buildResetTokenRepositoryError(
+          "iam_saveResetTokenFailed",
+          saveUserTokenResult.error.message,
+          saveUserTokenResult.error
+        );
+      }
       const attemptsResult = await cache.kv.set(buildAttemptsKey(userId), 0, { ex: ttlSeconds });
       if (!attemptsResult.success) {
-        return err(
-          HaiIamError.REPOSITORY_ERROR,
-          iamM("iam_saveResetTokenFailed", { params: { message: attemptsResult.error.message } }),
+        await Promise.all([
+          cache.kv.del(buildResetTokenKey(hashedToken)),
+          cache.kv.del(userTokenKey)
+        ]);
+        return buildResetTokenRepositoryError(
+          "iam_saveResetTokenFailed",
+          attemptsResult.error.message,
           attemptsResult.error
         );
       }
@@ -3992,10 +4135,19 @@ function createCacheResetTokenRepository() {
       const userId = result.data;
       const attemptsKey = buildAttemptsKey(userId);
       const incrResult = await cache.kv.incr(attemptsKey);
-      const nextAttempts = incrResult.success ? incrResult.data : 1;
+      if (!incrResult.success) {
+        return buildResetTokenRepositoryError(
+          "iam_saveResetTokenFailed",
+          incrResult.error.message,
+          incrResult.error
+        );
+      }
+      const nextAttempts = incrResult.data;
       if (nextAttempts > maxAttempts) {
-        await cache.kv.del(tokenKey);
-        await cache.kv.del(attemptsKey);
+        const clearResult = await clearTokenState(hashedToken, userId);
+        if (!clearResult.success) {
+          return clearResult;
+        }
         return err(
           HaiIamError.RESET_TOKEN_MAX_ATTEMPTS,
           iamM("iam_resetTokenMaxAttempts")
@@ -4011,11 +4163,17 @@ function createCacheResetTokenRepository() {
       const hashedToken = hashResult.data;
       const tokenKey = buildResetTokenKey(hashedToken);
       const result = await cache.kv.get(tokenKey);
-      if (result.success && result.data) {
-        await cache.kv.del(buildAttemptsKey(result.data));
+      if (!result.success) {
+        return buildResetTokenRepositoryError(
+          "iam_queryResetTokenFailed",
+          result.error.message,
+          result.error
+        );
       }
-      await cache.kv.del(tokenKey);
-      return ok(void 0);
+      if (!result.data) {
+        return ok(void 0);
+      }
+      return clearTokenState(hashedToken, result.data);
     }
   };
   resetTokenRepoInstance = repo;
@@ -4136,18 +4294,6 @@ function buildRegistrationOps(ctx) {
     }
     return ok(void 0);
   }
-  function buildAgreementDisplay() {
-    if (!agreementConfig.showOnRegister)
-      return void 0;
-    if (!agreementConfig.userAgreementUrl && !agreementConfig.privacyPolicyUrl)
-      return void 0;
-    return {
-      userAgreementUrl: agreementConfig.userAgreementUrl,
-      privacyPolicyUrl: agreementConfig.privacyPolicyUrl,
-      showOnRegister: agreementConfig.showOnRegister,
-      showOnLogin: agreementConfig.showOnLogin
-    };
-  }
   async function assignDefaultRole(userId) {
     if (!config.rbac?.defaultRole)
       return;
@@ -4202,7 +4348,7 @@ function buildRegistrationOps(ctx) {
       logger9.info("User registered", { userId: createdUser.id, username: options.username });
       return ok({
         user: toUser(createdUser),
-        agreements: buildAgreementDisplay()
+        agreements: buildAgreementDisplay(agreementConfig, agreementConfig.showOnRegister)
       });
     },
     validatePassword(password) {
@@ -4789,7 +4935,7 @@ var iam = {
     return currentApiKey ?? notInitializedApiKey;
   },
   get config() {
-    return currentConfig;
+    return currentConfig ? core.sanitize.sanitizeSensitiveFields(currentConfig) : null;
   },
   get isInitialized() {
     return currentConfig !== null;