@huaqiu/dsh-auth 0.1.1 → 0.2.0

package/lib/index.d.mts

@@ -28,28 +28,103 @@ interface HuaqiuAuthConfig {
   hostAuthPath?: string;
   /** Seconds a host session is reused before re-fetching. Default 300. */
   hostSessionTtlSeconds?: number;
+  /** Seconds remote token-validation results are cached. Default 60. */
+  validationTtlSeconds?: number;
 }
 //#endregion
+//#region src/validation.d.ts
+/**
+ * Token validation for `@huaqiu/dsh-auth`.
+ *
+ * Single authoritative validation path shared by standalone (auth.eda.cn) and
+ * HQ Edge host credentials. Uses the existing Huaqiu endpoint
+ *
+ *   GET https://www.eda.cn/api/token/validate?token=<token>
+ *   → { code, message, result: boolean }
+ *
+ * (the same endpoint consumed by `NextChat/app/auth/is_token_valid.ts`; probe:
+ *   `curl "https://www.eda.cn/api/token/validate?token=__dummy__"` → 200
+ *   `{"code":200000,"message":"success","result":false}`).
+ *
+ * Local expiry is a cheap pre-check only (never authoritative). Remote
+ * validation is authoritative, short-lived in-memory cached, and never
+ * persisted. Network / 5xx failures are reported as `unavailable` — they are
+ * NOT converted into "token invalid", so a transient network blip never forces
+ * the user to log in again.
+ */
+/**
+ * Outcome of an authoritative token validation.
+ *
+ * - `valid`       — the Huaqiu API accepted the token.
+ * - `invalid`     — the token is definitively rejected/expired.
+ * - `unavailable` — validation could not be performed (network/5xx); the token
+ *                   is NOT declared invalid (spec §17/§18).
+ */
+type AuthValidationResult = {
+  status: 'valid';
+  userId?: string;
+  expiresAt?: number;
+} | {
+  status: 'invalid';
+  reason: 'expired' | 'unauthorized' | 'forbidden' | 'invalid';
+} | {
+  status: 'unavailable';
+  error: Error;
+};
+//#endregion
 //#region src/service.d.ts
 interface HuaqiuUserInfo {
   id: string;
   token: string;
   nickname?: string;
+  /** Unix seconds; known for browser-pushed sessions (auth.eda.cn window). */
+  expiresAt?: number;
 }
 interface HuaqiuAuthApi {
-  isAuthenticated(): boolean;
+  /**
+   * Authoritative async check: a credential exists AND is known to be valid
+   * (local expiry + cached remote validation). Never a mere token-presence
+   * check — a host token supplied by hq-edge is not assumed valid just because
+   * it exists (spec §10). Short-circuits to `false` after `invalidate()` until
+   * re-validated or a fresh credential arrives.
+   */
+  isAuthenticated(): Promise<boolean>;
   getAccessToken(): Promise<string | null>;
   getUserInfo(): Promise<HuaqiuUserInfo | null>;
   /** Node-side no-op: login always happens in the browser. */
   login(): Promise<void>;
   logout(): Promise<void>;
+  /**
+   * Single authoritative validation path (spec §7). Works identically for
+   * standalone and host credentials; never depends on hq-edge.
+   */
+  validate(): Promise<AuthValidationResult>;
+  /**
+   * Mark the current credential's validation state stale without deleting the
+   * credential (kept for recovery). Next validation cannot reuse a previous
+   * "valid" result (spec §9/§11). Call this when an API request returns 401.
+   */
+  invalidate(): void;
   onAuthStateChanged(listener: (info: HuaqiuUserInfo | null) => void): () => void;
 }
 interface HuaqiuAuthService {
   auth: HuaqiuAuthApi;
-  /** Node-only setters used by the webServer route handlers. */
+  /**
+   * Node-only setters used by the webServer route handlers.
+   * NOTE: `service.invalidate()` is the FULL reset (logout: drops the pushed
+   * credential, persisted file and host cache). The capability-level
+   * `auth.invalidate()` is validation-scoped and keeps the credential.
+   */
   setCredentials(info: HuaqiuUserInfo): void;
   invalidate(): void;
+  /**
+   * True when running in HQ Edge host mode (a host base URL was configured —
+   * overlay `config.hqEdgeBaseUrl` or `HQ_EDGE_BASE_URL`). The browser half
+   * reads this over the webServer config route to decide whether the sidebar
+   * login entrypoint is needed: in host mode EDA hands the credential to
+   * hq-edge, so the auth plugin's own login UI is suppressed.
+   */
+  readonly hostMode: boolean;
 }
 //#endregion
 //#region src/index.d.ts

package/lib/index.mjs

@@ -16,10 +16,18 @@ function resolveHostConfig(config, env = process.env) {
 		const parsed = Number.parseInt(ttlRaw, 10);
 		if (Number.isFinite(parsed) && parsed > 0) ttl = parsed;
 	}
+	const vTtlRaw = config?.validationTtlSeconds ?? env.HQ_EDGE_VALIDATION_TTL_SECONDS;
+	let validationTtlSeconds = 60;
+	if (typeof vTtlRaw === "number" && Number.isFinite(vTtlRaw) && vTtlRaw > 0) validationTtlSeconds = vTtlRaw;
+	else if (typeof vTtlRaw === "string" && vTtlRaw.trim().length > 0) {
+		const parsed = Number.parseInt(vTtlRaw, 10);
+		if (Number.isFinite(parsed) && parsed > 0) validationTtlSeconds = parsed;
+	}
 	return {
 		hqEdgeBaseUrl: baseUrl,
 		hostAuthPath,
-		hostSessionTtlSeconds: ttl
+		hostSessionTtlSeconds: ttl,
+		validationTtlSeconds
 	};
 }
 /**
@@ -85,6 +93,135 @@ function normalizeHostUser(data) {
 		...nickname ? { nickname } : {}
 	};
 }
+/**
+* Classifies the HTTP status of the validation request.
+*
+* 401 → unauthorized; 403 → forbidden; any other non-ok status (incl. 5xx) →
+* unavailable. A 2xx body of `{ result: false }` → unauthorized (the endpoint
+* does not distinguish expired vs revoked, so we use the generic
+* `unauthorized` reason; local expiry is the only source of `expired`).
+*/
+function classifyStatus(status) {
+	if (status === 401) return {
+		status: "invalid",
+		reason: "unauthorized"
+	};
+	if (status === 403) return {
+		status: "invalid",
+		reason: "forbidden"
+	};
+	return {
+		status: "unavailable",
+		error: /* @__PURE__ */ new Error(`token validation HTTP ${status}`)
+	};
+}
+var TokenValidator = class {
+	ttlMs;
+	validateUrl;
+	fetchImpl;
+	now;
+	/** token → { result, at }; in-memory only, never persisted (spec §8). */
+	cache = /* @__PURE__ */ new Map();
+	/** token → in-flight promise; coalesces concurrent validate() calls (§16). */
+	inFlight = /* @__PURE__ */ new Map();
+	constructor(options = {}) {
+		this.ttlMs = options.ttlMs ?? 6e4;
+		this.validateUrl = options.validateUrl ?? "https://www.eda.cn/api/token/validate";
+		this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
+		this.now = options.now ?? (() => Date.now());
+	}
+	/**
+	* Cheap local expiry check — an optimization, not authoritative validation.
+	* Unknown expiry ⇒ not assumed invalid (spec §6).
+	*/
+	isLocallyExpired(expiresAt) {
+		if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return false;
+		return expiresAt * 1e3 <= this.now();
+	}
+	/**
+	* Validate a token. Cached within TTL; a single in-flight request is shared
+	* by concurrent callers. Never treats a network failure as "invalid".
+	*/
+	async validate(token, session) {
+		if (!token) return {
+			status: "invalid",
+			reason: "invalid"
+		};
+		if (this.isLocallyExpired(session?.expiresAt)) {
+			this.cache.delete(token);
+			return {
+				status: "invalid",
+				reason: "expired"
+			};
+		}
+		const cached = this.cache.get(token);
+		if (cached && this.now() - cached.at < this.ttlMs) return cached.result;
+		const inFlight = this.inFlight.get(token);
+		if (inFlight) return inFlight;
+		const promise = this.validateRemotely(token);
+		this.inFlight.set(token, promise);
+		try {
+			const result = await promise;
+			this.cache.set(token, {
+				result,
+				at: this.now()
+			});
+			return result;
+		} finally {
+			this.inFlight.delete(token);
+		}
+	}
+	/** Drop cached/in-flight validation for a token (or all when omitted). */
+	invalidate(token) {
+		if (token === void 0) {
+			this.cache.clear();
+			this.inFlight.clear();
+			return;
+		}
+		this.cache.delete(token);
+		this.inFlight.delete(token);
+	}
+	/** Resolve a currently-cached result (no remote call), or null. */
+	peek(token) {
+		const cached = this.cache.get(token);
+		if (!cached) return null;
+		if (this.now() - cached.at >= this.ttlMs) {
+			this.cache.delete(token);
+			return null;
+		}
+		return cached.result;
+	}
+	async validateRemotely(token) {
+		const url = `${this.validateUrl}?token=${encodeURIComponent(token)}`;
+		let res;
+		try {
+			res = await this.fetchImpl(url, {
+				method: "GET",
+				headers: { accept: "application/json" }
+			});
+		} catch (err) {
+			return {
+				status: "unavailable",
+				error: err
+			};
+		}
+		if (!res.ok) return classifyStatus(res.status);
+		let body;
+		try {
+			body = await res.json();
+		} catch (err) {
+			return {
+				status: "unavailable",
+				error: /* @__PURE__ */ new Error(`token validation: unparseable response (${String(err)})`)
+			};
+		}
+		if ((typeof body === "object" && body !== null ? body.result : void 0) === true) return { status: "valid" };
+		return {
+			status: "invalid",
+			reason: "unauthorized"
+		};
+	}
+};
 //#endregion
 //#region src/service.ts
 /**
@@ -124,10 +261,12 @@ function readPersisted() {
 		const token = typeof raw.token === "string" && raw.token.length > 0 ? raw.token : null;
 		if (!id || !token) return null;
 		const nickname = typeof raw.nickname === "string" && raw.nickname.length > 0 ? raw.nickname : void 0;
+		const expiresAt = typeof raw.expiresAt === "number" && Number.isFinite(raw.expiresAt) ? raw.expiresAt : void 0;
 		return {
 			id,
 			token,
-			...nickname ? { nickname } : {}
+			...nickname ? { nickname } : {},
+			...expiresAt !== void 0 ? { expiresAt } : {}
 		};
 	} catch {
 		return null;
@@ -153,19 +292,42 @@ var InMemoryHuaqiuAuthService = class {
 	current = null;
 	listeners = /* @__PURE__ */ new Set();
 	host;
+	validator;
+	/**
+	* True once the current credential has been rejected (API 401) or explicitly
+	* invalidated. Keeps the credential for recovery but makes `isAuthenticated()`
+	* short-circuit to false and forces a fresh remote validation next time.
+	*/
+	stale = false;
 	constructor(config, opts) {
 		const resolved = resolveHostConfig(config);
 		this.host = new HostSessionResolver(resolved.hqEdgeBaseUrl ?? "", resolved.hostAuthPath ?? "/api/v1/auth/token", (resolved.hostSessionTtlSeconds ?? 300) * 1e3, opts?.fetchImpl);
+		this.validator = new TokenValidator({
+			ttlMs: (resolved.validationTtlSeconds ?? 60) * 1e3,
+			fetchImpl: opts?.fetchImpl
+		});
+		this.hostMode = this.host.enabled;
 	}
+	/** Host mode is active iff a host base URL was configured (see HostSessionResolver.enabled). */
+	hostMode;
 	auth = {
-		isAuthenticated: () => this.host.enabled || this.current !== null || readPersisted() !== null,
+		isAuthenticated: async () => {
+			if (this.stale) return false;
+			return (await this.validateInternal()).status === "valid";
+		},
 		getAccessToken: async () => (await this.resolve())?.token ?? null,
 		getUserInfo: async () => this.resolve(),
 		login: async () => {},
 		logout: async () => this.invalidate(),
+		validate: () => this.validateInternal(),
+		invalidate: () => this.markStale(),
 		onAuthStateChanged: (listener) => this.on(listener)
 	};
-	/** Spec §6.2 resolution order: host → pushed → persisted → null. */
+	/**
+	* Spec §6.2 resolution order: host → pushed → persisted → null.
+	* Returns the credential regardless of validation state (recovery keeps the
+	* value; `validate()`/`isAuthenticated()` decide whether it is usable).
+	*/
 	async resolve() {
 		if (this.host.enabled) {
 			const host = await this.host.resolve();
@@ -174,8 +336,38 @@ var InMemoryHuaqiuAuthService = class {
 		if (this.current) return this.current;
 		return readPersisted();
 	}
+	/** Spec §7: resolve → local expiry → remote validation → update state. */
+	async validateInternal() {
+		const info = await this.resolve();
+		if (!info) {
+			this.stale = true;
+			return {
+				status: "invalid",
+				reason: "invalid"
+			};
+		}
+		if (this.validator.isLocallyExpired(info.expiresAt)) {
+			this.validator.invalidate(info.token);
+			this.stale = true;
+			return {
+				status: "invalid",
+				reason: "expired"
+			};
+		}
+		const result = await this.validator.validate(info.token, { expiresAt: info.expiresAt });
+		if (result.status === "valid") this.stale = false;
+		else if (result.status === "invalid") this.stale = true;
+		return result;
+	}
+	/** Validation-scoped invalidation: keep the credential, drop cached validity. */
+	markStale() {
+		this.stale = true;
+		this.validator.invalidate();
+	}
 	setCredentials(info) {
 		this.current = info;
+		this.stale = false;
+		this.validator.invalidate();
 		writePersisted(info);
 		this.emit();
 	}
@@ -183,6 +375,8 @@ var InMemoryHuaqiuAuthService = class {
 		const was = this.host.enabled || this.current !== null || readPersisted() !== null;
 		this.current = null;
 		this.host.clear();
+		this.stale = true;
+		this.validator.invalidate();
 		deletePersisted();
 		if (was) this.emit();
 	}
@@ -222,10 +416,12 @@ function normalizeUserInfo(data) {
 	const id = typeof data.userId === "string" && data.userId.length > 0 ? data.userId : typeof data.userId === "number" && Number.isFinite(data.userId) ? String(data.userId) : typeof data.id === "string" && data.id.length > 0 ? data.id : typeof data.id === "number" && Number.isFinite(data.id) ? String(data.id) : null;
 	if (!token || !id) return null;
 	const nickname = typeof data.nickname === "string" && data.nickname.length > 0 ? data.nickname : void 0;
+	const expiresAt = typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt) ? data.expiresAt : void 0;
 	return {
 		id,
 		token,
-		...nickname ? { nickname } : {}
+		...nickname ? { nickname } : {},
+		...expiresAt !== void 0 ? { expiresAt } : {}
 	};
 }
 function createAuthHandler(service) {
@@ -252,11 +448,15 @@ function createAuthHandler(service) {
 			if (req.method === "GET" && pathname === `/api/v1/huaqiu/auth/session`) {
 				const user = await service.auth.getUserInfo();
 				sendJson(res, 200, {
-					authenticated: service.auth.isAuthenticated(),
+					authenticated: await service.auth.isAuthenticated(),
 					user
 				});
 				return;
 			}
+			if (req.method === "GET" && pathname === `/api/v1/huaqiu/auth/config`) {
+				sendJson(res, 200, { hostMode: service.hostMode });
+				return;
+			}
 			sendJson(res, 404, { error: "not found" });
 		} catch (err) {
 			sendJson(res, 500, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huaqiu/dsh-auth",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "type": "module",
   "main": "./lib/index.mjs",
   "types": "./lib/index.d.mts",

package/src/client/client.ts

@@ -39,6 +39,8 @@ export interface AuthClient {
   restore(): Promise<void>
   /** Re-push persisted credentials on demand (heals a reset/absent node half). */
   syncNow(): Promise<void>
+  /** Browser→node transport (used to read host mode before UI registration). */
+  transport: AuthTransport
   dispose(): void
 }
 
@@ -144,6 +146,12 @@ export function createAuthClient(deps: AuthClientDeps): AuthClient {
     auth,
     handleMessageEvent,
     restore,
+    /**
+     * Browser→node transport. Exposed so the client entry can read host mode
+     * (whether an HQ Edge host supplies the credential and the login UI should
+     * be suppressed) before registering the sidebar entrypoint.
+     */
+    transport,
     /**
      * Re-push the persisted credential to the node half. Healing path: the
      * node keeps auth in memory, so a `dsh web` restart (or a failed first

package/src/client/index.tsx

@@ -65,6 +65,7 @@ export function apply(ctx: ClientContext): () => void {
   })
 
   const disposers: Array<() => void> = []
+  let disposed = false
   const disposeProvide = ctx.provide?.('huaqiuAuth', { auth: client.auth })
   registerAuth(client.auth)
   registerAuthSync(() => { void client.syncNow() })
@@ -85,15 +86,32 @@ export function apply(ctx: ClientContext): () => void {
     document.removeEventListener('visibilitychange', sync)
   })
 
+  /**
+   * In HQ Edge host mode (config.hqEdgeBaseUrl set on the node half), EDA
+   * launches hq-edge WITH the operator credential, so hq-edge — not this
+   * plugin — owns authentication for the session. The auth plugin's own login
+   * UI (the `sidebar.footer.action` entrypoint and the login toolviews) is
+   * therefore suppressed: it would be redundant and confusing next to the
+   * host-provided session. In standalone DSH (official integration) the
+   * sidebar entrypoint stays — it is the only login surface there.
+   *
+   * The mode is read from the node half over the plugin-owned webServer route
+   * (async), so registration is deferred until it answers; the returned
+   * disposer still drains anything registered later.
+   */
   const slots = ctx.slots
-  if (slots && typeof slots.inject === 'function' && typeof slots.register === 'function') {
-    for (const toolName of AUTH_TOOL_NAMES) {
-      disposers.push(slots.inject('tool.call.toolview', () => slots.register({ name: 'tool.call.toolview', key: toolName }, HuaqiuToolView) as () => void))
+  void client.transport.fetchHostMode().then((hostMode) => {
+    if (disposed || hostMode) return
+    if (slots && typeof slots.inject === 'function' && typeof slots.register === 'function') {
+      for (const toolName of AUTH_TOOL_NAMES) {
+        disposers.push(slots.inject('tool.call.toolview', () => slots.register({ name: 'tool.call.toolview', key: toolName }, HuaqiuToolView) as () => void))
+      }
+      disposers.push(slots.inject('sidebar.footer.action', () => slots.register({ name: 'sidebar.footer.action', id: 'huaqiu-auth' }, HuaqiuAuthSidebarAction) as () => void))
     }
-    disposers.push(slots.inject('sidebar.footer.action', () => slots.register({ name: 'sidebar.footer.action', id: 'huaqiu-auth' }, HuaqiuAuthSidebarAction) as () => void))
-  }
+  })
 
   return () => {
+    disposed = true
     for (const dispose of disposers) {
       try {
         dispose()

package/src/client/transport.ts

@@ -9,6 +9,12 @@ import type { AuthTokenPayload } from './lib.js'
 export interface AuthTransport {
   pushSession(info: AuthTokenPayload): Promise<void>
   pushLogout(): Promise<void>
+  /**
+   * Whether the plugin runs under an HQ Edge host. In host mode hq-edge already
+   * holds the operator credential (EDA hands it over on launch), so the
+   * browser half's own login UI (sidebar entrypoint) is suppressed.
+   */
+  fetchHostMode(): Promise<boolean>
 }
 
 export function createWebServerAuthTransport(
@@ -24,6 +30,7 @@ export function createWebServerAuthTransport(
           token: info.token,
           userId: info.id,
           ...(info.nickname !== undefined ? { nickname: info.nickname } : {}),
+          ...(info.expiresAt !== undefined ? { expiresAt: info.expiresAt } : {}),
         }),
       })
       if (!res.ok) throw new Error(`auth push failed: HTTP ${res.status}`)
@@ -32,5 +39,21 @@ export function createWebServerAuthTransport(
       const res = await doFetch(`${base}/logout`, { method: 'POST' })
       if (!res.ok) throw new Error(`auth logout push failed: HTTP ${res.status}`)
     },
+    async fetchHostMode() {
+      try {
+        const res = await doFetch(`${base}/config`, {
+          method: 'GET',
+          headers: { accept: 'application/json' },
+        })
+        if (!res.ok) return false
+        const body = await res.json() as { hostMode?: unknown }
+        return body.hostMode === true
+      } catch {
+        // Offline/same-origin failure: fall back to standalone (show the login
+        // entrypoint) rather than hiding it — a login UI is never a security
+        // regression, but a missing one in standalone would lock the user out.
+        return false
+      }
+    },
   }
 }

package/src/host.ts

@@ -27,10 +27,13 @@ export interface HuaqiuAuthConfig {
   hostAuthPath?: string
   /** Seconds a host session is reused before re-fetching. Default 300. */
   hostSessionTtlSeconds?: number
+  /** Seconds remote token-validation results are cached. Default 60. */
+  validationTtlSeconds?: number
 }
 
 export const DEFAULT_HOST_AUTH_PATH = '/api/v1/auth/token'
 export const DEFAULT_HOST_TTL_SECONDS = 300
+export const DEFAULT_VALIDATION_TTL_SECONDS = 60
 
 /**
  * Resolve the effective config: overlay `config` (highest) > env (safety net
@@ -55,7 +58,20 @@ export function resolveHostConfig(
     const parsed = Number.parseInt(ttlRaw, 10)
     if (Number.isFinite(parsed) && parsed > 0) ttl = parsed
   }
-  return { hqEdgeBaseUrl: baseUrl, hostAuthPath, hostSessionTtlSeconds: ttl }
+  const vTtlRaw = config?.validationTtlSeconds ?? env.HQ_EDGE_VALIDATION_TTL_SECONDS
+  let validationTtlSeconds = DEFAULT_VALIDATION_TTL_SECONDS
+  if (typeof vTtlRaw === 'number' && Number.isFinite(vTtlRaw) && vTtlRaw > 0) {
+    validationTtlSeconds = vTtlRaw
+  } else if (typeof vTtlRaw === 'string' && vTtlRaw.trim().length > 0) {
+    const parsed = Number.parseInt(vTtlRaw, 10)
+    if (Number.isFinite(parsed) && parsed > 0) validationTtlSeconds = parsed
+  }
+  return {
+    hqEdgeBaseUrl: baseUrl,
+    hostAuthPath,
+    hostSessionTtlSeconds: ttl,
+    validationTtlSeconds,
+  }
 }
 
 export interface HostSession {

package/src/routes.ts

@@ -2,13 +2,17 @@
  * HTTP adapter: receives the browser-pushed credentials and serves the node
  * auth state (probe / boot restore). Same-origin through `ctx.webServer`:
  *
- *   POST /api/v1/huaqiu/auth/session   body { token, userInfo? }  → cache set
+ *   POST /api/v1/huaqiu/auth/session   body { token, userId, nickname?, expiresAt? } → cache set
  *   POST /api/v1/huaqiu/auth/logout                                → cache cleared
  *   GET  /api/v1/huaqiu/auth/session   → { authenticated, user }
+ *   GET  /api/v1/huaqiu/auth/config    → { hostMode }
  *
- * These routes are the browser→node transport for Phase 0A (start-p0.md §4:
- * smallest supported extension point — `apiProxy`'s dispatch table is closed,
- * so a plugin-owned `webServer` route is the documented channel).
+ * `config` tells the browser half whether it is running under an HQ Edge host
+ * (hq-edge passes the operator credential to hq-edge itself, so the sidebar
+ * login entrypoint is suppressed). These routes are the browser→node transport
+ * for Phase 0A (start-p0.md §4: smallest supported extension point —
+ * `apiProxy`'s dispatch table is closed, so a plugin-owned `webServer` route is
+ * the documented channel).
  */
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { HuaqiuAuthService, HuaqiuUserInfo } from './service.js'
@@ -41,7 +45,15 @@ function normalizeUserInfo(data: Record<string, unknown>): HuaqiuUserInfo | null
     : null
   if (!token || !id) return null
   const nickname = typeof data.nickname === 'string' && data.nickname.length > 0 ? data.nickname : undefined
-  return { id, token, ...(nickname ? { nickname } : {}) }
+  const expiresAt = typeof data.expiresAt === 'number' && Number.isFinite(data.expiresAt)
+    ? data.expiresAt
+    : undefined
+  return {
+    id,
+    token,
+    ...(nickname ? { nickname } : {}),
+    ...(expiresAt !== undefined ? { expiresAt } : {}),
+  }
 }
 
 export function createAuthHandler(service: HuaqiuAuthService): AuthHandler {
@@ -71,11 +83,16 @@ export function createAuthHandler(service: HuaqiuAuthService): AuthHandler {
 
       if (req.method === 'GET' && pathname === `${AUTH_ROUTE_PREFIX}/session`) {
         const user = await service.auth.getUserInfo()
-        const authenticated = service.auth.isAuthenticated()
+        const authenticated = await service.auth.isAuthenticated()
         sendJson(res, 200, { authenticated, user })
         return
       }
 
+      if (req.method === 'GET' && pathname === `${AUTH_ROUTE_PREFIX}/config`) {
+        sendJson(res, 200, { hostMode: service.hostMode })
+        return
+      }
+
       sendJson(res, 404, { error: 'not found' })
     } catch (err) {
       sendJson(res, 500, { error: 'internal error', detail: String(err) })