@huaqiu/dsh-auth 0.1.1

package/src/client/lib.ts

@@ -0,0 +1,234 @@
+/**
+ * Pure browser message parsing for auth.eda.cn postMessage envelopes.
+ *
+ * auth.eda.cn posts `JSON.stringify({ category: 1, data: { type, data } })`
+ * to the parent window with `targetOrigin: '*'`.
+ *
+ * SECURITY NOTE (offline deployment): the DSH harness runs fully offline /
+ * local (127.0.0.1), so there is no public attack surface of a malicious
+ * website posting a forged token at us. The origin gate is therefore dropped
+ * by design — webviews may even report an opaque origin ("null") for the
+ * embedded auth.eda.cn iframe, which would otherwise reject legitimate login
+ * messages. What remains is the ENVELOPE validation in `parseAuthMessage`
+ * (category 1 + well-formed token/userId), which keeps unrelated window
+ * messages from ever corrupting the credential cache.
+ *
+ * Envelope types (see `/Users/admin/code/eda-cn-login/lib/kicadTools.ts`):
+ *   { category: 1, data: { type: 'update_access_token', data: { userId, token, expires_at, ... } } }
+ *   { category: 1, data: { type: 'logout', data: null } }
+ *   { category: 1, data: { type: 'close_dialog', data: null } }
+ */
+
+export const AUTH_ORIGIN = 'https://auth.eda.cn'
+
+/**「Go to profile」destination: the eda.cn account page. */
+export const PROFILE_URL = 'https://www.eda.cn/account/profile'
+
+/**
+ * Build the「Go to profile」URL: the eda.cn account page WITH the access token
+ * in the query, mirroring `hq-eda-ai`'s `UserMenu`
+ * (`/account/profile?token=…&phone=…`).
+ *
+ * The token is always attached: eda.cn consumes it to establish the session
+ * and strips it from the address bar / history itself, so there is nothing to
+ * leak beyond the target site. `encodeURIComponent` is required (not cosmetic):
+ * tokens are base64-ish and may contain `+`, `/` or `=`, and a raw `+` in a
+ * query string decodes to a space, which would corrupt the credential.
+ */
+export function buildProfileUrl(options: { token: string; phone?: string | number }): string {
+  const phone = options.phone === undefined || options.phone === null ? '' : String(options.phone)
+  return `${PROFILE_URL}?token=${encodeURIComponent(options.token)}&phone=${encodeURIComponent(phone)}`
+}
+
+/**
+ * Contract version of the auth.eda.cn embed, shared with the web app
+ * (`hq-eda-ai` LoginDialog) so both send the same cache-busting `v=`.
+ */
+export const AUTH_IFRAME_VERSION = '20260409'
+
+/** UI language of the auth.eda.cn embed. */
+export type AuthLocale = 'zh' | 'en'
+
+/** Color scheme of the auth.eda.cn embed (its own vocabulary: light | dark). */
+export type AuthTheme = 'light' | 'dark'
+
+/**
+ * auth.eda.cn's own language ids, keyed by our locale id.
+ *
+ * The embed reads `?locale=`, NOT `lang`: `eda-cn-login/app/layout.tsx` reads
+ * `urlParams.get('locale')` and `components/ui/LanguageContext.tsx`
+ * (`getLangFromUrl`) only accepts the ids in `locales/index.ts` — `cn` and
+ * `en` (`zh` / `zh_CN` are aliased to `cn` there, but we send the canonical
+ * id outright).
+ *
+ * NOTE: `hq-eda-ai`'s `LoginDialog.tsx` sends `lang=zh`, which the embed
+ * IGNORES, so its login card always falls back to whatever the browser asks
+ * for. We send `locale` (what is actually read) and keep `lang` alongside it
+ * for parity with the web app and forward compatibility.
+ */
+export const AUTH_LOCALE_ID: Record<AuthLocale, string> = { zh: 'cn', en: 'en' }
+
+/**
+ * Options for the auth.eda.cn overlay iframe opened by `auth.login()`.
+ *
+ * The embed has TWO rendering modes, and which one is right depends on the
+ * surface that hosts the iframe:
+ *
+ * - **Transparent card mode** (default, no `fill`): the embedded page sets
+ *   `html[data-iframe-mode="true"]` and the root paints
+ *   `background: transparent` (see `eda-cn-login/app/page.tsx` — the wrapper
+ *   only gets the `bg-transparent` class when `fill !== 'full'`). The host
+ *   then paints a card around the iframe (e.g. the login dialog's backdrop
+ *   + centered card) so Blink's white `BaseBackgroundColor()` canvas never
+ *   shows. This is the right mode when the iframe sits inside a host-painted
+ *   card with its own visual edge — e.g. the sidebar-triggered login dialog.
+ *
+ * - **Fill mode** (`fill: 'full'`): the embed's `DialogContent` becomes
+ *   `w-full h-full max-w-none max-h-none left-0 top-0 rounded-none border-none`
+ *   (see `eda-cn-login/components/LoginDialog.tsx` — `fillFull` branch at
+ *   line 61) and the wrapper drops `bg-transparent` so the page paints its
+ *   own `bg-background` edge-to-edge. This is the right mode when the iframe
+ *   fills its host container (e.g. the toolview card) and there is no
+ *   surrounding card to mask the embed's rounded corners or transparent
+ *   20px grid strips.
+ *
+ * The `lang` and `theme` params follow the host UI in both modes.
+ */
+export interface LoginOptions {
+  /** Ask auth.eda.cn to self-close on an outside click (default `true`). */
+  closeOnOutsideClick?: boolean
+  /** Embed UI language (default `zh`). */
+  lang?: AuthLocale
+  /** Embed color scheme (default `light`). */
+  theme?: AuthTheme
+  /**
+   * Set to `'full'` to make the embed fill its iframe viewport edge-to-edge
+   * (no rounded corners, no transparent grid strips, embed paints its own
+   * `bg-background`). Omit for the transparent card mode described above.
+   * `true` is accepted as a shorthand for `'full'`.
+   */
+  fill?: 'full' | 'transparent' | true
+}
+
+export interface AuthTokenPayload {
+  id: string
+  token: string
+  nickname?: string
+  /** User avatar URL (`headimage` in the auth.eda.cn payload). */
+  avatar?: string
+  /** Bound mobile number; forwarded to the eda.cn profile page as `phone=`. */
+  phone?: string
+  /** unix seconds; undefined = no expiry */
+  expiresAt?: number
+}
+
+/**
+ * Build the auth.eda.cn embed URL.
+ *
+ * The URL switches between two rendering modes based on `options.fill`:
+ *  - `fill: 'full'` (or `true`) → `fill=full` is sent; the embed's
+ *    `DialogContent` becomes `w-full h-full … rounded-none` and the wrapper
+ *    drops `bg-transparent`, so the embed fills the iframe viewport with
+ *    its own `bg-background`. Use this when the iframe is the surface (e.g.
+ *    the toolview card).
+ *  - any other value (including unset) → no `fill` is sent; the embed stays
+ *    in transparent card mode. The host is responsible for painting a card
+ *    around the iframe so Blink's white base canvas never reaches the user.
+ */
+export function buildLoginUrl(options: LoginOptions & { baseUrl?: string } = {}): string {
+  const url = new URL(options.baseUrl ?? `${AUTH_ORIGIN}/`)
+  url.searchParams.set('v', AUTH_IFRAME_VERSION)
+  if (options.closeOnOutsideClick !== false) url.searchParams.set('clickOutsideToClose', 'true')
+  if (options.fill === 'full' || options.fill === true) url.searchParams.set('fill', 'full')
+  url.searchParams.set('transparent', 'true')
+  const lang = options.lang ?? 'zh'
+  // `locale` is the param auth.eda.cn reads; `lang` keeps parity with
+  // hq-eda-ai's LoginDialog (see AUTH_LOCALE_ID).
+  url.searchParams.set('locale', AUTH_LOCALE_ID[lang])
+  url.searchParams.set('lang', lang)
+  url.searchParams.set('theme', options.theme ?? 'light')
+  return url.toString()
+}
+
+export type ParsedAuthMessage =
+  | { kind: 'token'; info: AuthTokenPayload }
+  | { kind: 'logout' }
+  | { kind: 'close' }
+
+/** Structural event (origin + data) so tests don't need a real MessageEvent. */
+export interface AuthMessageEventLike {
+  origin: string
+  data: unknown
+  /** The posting window; retained for completeness (origin is not gated). */
+  source?: unknown
+}
+
+interface RawEnvelope {
+  category?: unknown
+  data?: { type?: unknown; data?: unknown }
+}
+
+/** Coerce an id field (string or number, as auth.eda.cn sends) to a string. */
+function stringifyId(value: unknown): string | null {
+  if (typeof value === 'string' && value.length > 0) return value
+  if (typeof value === 'number' && Number.isFinite(value)) return String(value)
+  return null
+}
+
+export function parseAuthMessage(raw: unknown): ParsedAuthMessage | null {
+  let envelope: RawEnvelope | null = null
+  if (typeof raw === 'string') {
+    try {
+      envelope = JSON.parse(raw) as RawEnvelope
+    } catch {
+      return null
+    }
+  } else if (raw !== null && typeof raw === 'object') {
+    envelope = raw as RawEnvelope
+  }
+  if (!envelope || envelope.category !== 1) return null
+  const data = envelope.data
+  if (!data || typeof data !== 'object') return null
+
+  switch (data.type) {
+    case 'update_access_token': {
+      const d = data.data
+      if (!d || typeof d !== 'object') return null
+      const record = d as Record<string, unknown>
+      const token = typeof record.token === 'string' && record.token.length > 0 ? record.token : null
+      // auth.eda.cn sends userId/id as NUMBERS (e.g. 6215935) — coerce to string.
+      const id = stringifyId(record.userId) ?? stringifyId(record.id)
+      if (!token || !id) return null
+      const nickname = typeof record.nickname === 'string' && record.nickname.length > 0 ? record.nickname : undefined
+      // auth.eda.cn sends the avatar as `headimage`; `avatar` accepted as alias.
+      const avatar = typeof record.headimage === 'string' && record.headimage.length > 0
+        ? record.headimage
+        : typeof record.avatar === 'string' && record.avatar.length > 0 ? record.avatar : undefined
+      // Phone may arrive as a string or a number (mirrors `stringifyId`).
+      const phone = stringifyId(record.phone) ?? undefined
+      const expiresAt = typeof record.expires_at === 'number' ? record.expires_at : undefined
+      return {
+        kind: 'token',
+        info: {
+          id,
+          token,
+          ...(nickname !== undefined ? { nickname } : {}),
+          ...(avatar !== undefined ? { avatar } : {}),
+          ...(phone !== undefined ? { phone } : {}),
+          ...(expiresAt !== undefined ? { expiresAt } : {}),
+        },
+      }
+    }
+    case 'logout':
+      return { kind: 'logout' }
+    case 'close_dialog':
+      return { kind: 'close' }
+    default:
+      return null
+  }
+}
+
+/** Origin-agnostic envelope parsing. The ONLY entry point for window message events. */
+export function handleAuthMessage(event: AuthMessageEventLike): ParsedAuthMessage | null {
+  return parseAuthMessage(event.data)
+}

package/src/client/storage.ts

@@ -0,0 +1,43 @@
+/**
+ * localStorage-backed credential cache (client side). Survives reload, which
+ * is what makes the fingerprint silent-login restore (acceptance group D) work.
+ */
+import type { AuthTokenPayload } from './lib.js'
+
+export const DEFAULT_STORAGE_KEY = 'huaqiu.dsh.auth'
+
+export interface AuthStorage {
+  get(): AuthTokenPayload | null
+  set(info: AuthTokenPayload): void
+  clear(): void
+}
+
+export function createAuthStorage(
+  storage: Pick<Storage, 'getItem' | 'setItem' | 'removeItem'>,
+  key: string = DEFAULT_STORAGE_KEY,
+): AuthStorage {
+  return {
+    get() {
+      const raw = storage.getItem(key)
+      if (!raw) return null
+      try {
+        const parsed = JSON.parse(raw) as AuthTokenPayload
+        if (!parsed || typeof parsed.token !== 'string' || typeof parsed.id !== 'string') return null
+        // Parity with auth.eda.cn's 5-day token window.
+        if (parsed.expiresAt !== undefined && parsed.expiresAt * 1000 <= Date.now()) {
+          storage.removeItem(key)
+          return null
+        }
+        return parsed
+      } catch {
+        return null
+      }
+    },
+    set(info) {
+      storage.setItem(key, JSON.stringify(info))
+    },
+    clear() {
+      storage.removeItem(key)
+    },
+  }
+}

package/src/client/transport.ts

@@ -0,0 +1,36 @@
+/**
+ * Browser→node credential transport over the plugin-owned webServer routes
+ * (same-origin; no CORS, no external dependency). This is the chosen Phase 0A
+ * browser→host channel — `apiProxy`'s dispatch table is closed, so a
+ * plugin-owned `webServer` route is the smallest supported extension point.
+ */
+import type { AuthTokenPayload } from './lib.js'
+
+export interface AuthTransport {
+  pushSession(info: AuthTokenPayload): Promise<void>
+  pushLogout(): Promise<void>
+}
+
+export function createWebServerAuthTransport(
+  base: string = '/api/v1/huaqiu/auth',
+  doFetch: typeof fetch = globalThis.fetch.bind(globalThis),
+): AuthTransport {
+  return {
+    async pushSession(info) {
+      const res = await doFetch(`${base}/session`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          token: info.token,
+          userId: info.id,
+          ...(info.nickname !== undefined ? { nickname: info.nickname } : {}),
+        }),
+      })
+      if (!res.ok) throw new Error(`auth push failed: HTTP ${res.status}`)
+    },
+    async pushLogout() {
+      const res = await doFetch(`${base}/logout`, { method: 'POST' })
+      if (!res.ok) throw new Error(`auth logout push failed: HTTP ${res.status}`)
+    },
+  }
+}

package/src/client/ui/common.tsx

@@ -0,0 +1,169 @@
+/**
+ * Login-state + result rendering helpers shared by the client React cards.
+ *
+ * Every style is a FUNCTION of the active color scheme: the cards are inline
+ * styled (the client bundle ships no CSS file), so light/dark support has to
+ * be expressed in JS. Colors prefer DSH's `--dsw-alias-*` tokens and fall back
+ * to an explicit per-scheme value (see `sidebar-action.tsx`).
+ */
+import type { CSSProperties, ReactNode } from 'react'
+import type { Translate } from '../i18n.js'
+
+/** Tool result content block (subset of DSH `ContentBlock`). */
+interface ContentBlockLike {
+  type?: string
+  text?: string
+}
+
+/** Structural tool-call block subset (we only read settled text content). */
+export interface ToolBlockLike {
+  content?: readonly ContentBlockLike[]
+}
+
+/** Best-effort JSON.parse of the tool's text output blocks. */
+export function parseToolResult(block: ToolBlockLike | undefined): Record<string, unknown> | null {
+  if (!block || !Array.isArray(block.content)) return null
+  const text = block.content
+    .filter((c): c is ContentBlockLike => !!c && c.type === 'text' && typeof c.text === 'string')
+    .map((c) => c.text as string)
+    .join('')
+  if (!text) return null
+  try {
+    const parsed = JSON.parse(text) as unknown
+    return parsed && typeof parsed === 'object' ? (parsed as Record<string, unknown>) : null
+  } catch {
+    return null
+  }
+}
+
+/** True when the parsed result is the auth-gate signal. */
+export function isNeedsAuthResult(result: Record<string, unknown> | null): result is Record<string, unknown> & { status: 'needs_auth' } {
+  return !!result && result.status === 'needs_auth'
+}
+
+export const AUTH_ORIGIN = 'https://auth.eda.cn'
+
+/** Card colors for one color scheme (DSH token first, explicit fallback second). */
+export interface CardPalette {
+  surface: string
+  border: string
+  text: string
+  muted: string
+  success: string
+  danger: string
+}
+
+export const LIGHT_CARD_PALETTE: CardPalette = {
+  surface: 'var(--dsw-alias-bg-layer-1, #ffffff)',
+  border: 'var(--dsw-alias-border-l1, #e4e7ec)',
+  text: 'var(--dsw-alias-label-primary, inherit)',
+  muted: 'var(--dsw-alias-label-secondary, #5b6472)',
+  success: 'var(--dsw-alias-state-success-primary, #1677ff)',
+  danger: 'var(--dsw-alias-state-error-primary, #d4380d)',
+}
+
+export const DARK_CARD_PALETTE: CardPalette = {
+  surface: 'var(--dsw-alias-bg-layer-1, #20242c)',
+  border: 'var(--dsw-alias-border-l1, rgba(255, 255, 255, 0.14))',
+  text: 'var(--dsw-alias-label-primary, #e6eaf0)',
+  muted: 'var(--dsw-alias-label-secondary, #8b95a5)',
+  success: 'var(--dsw-alias-state-success-primary, #4cc38a)',
+  danger: 'var(--dsw-alias-state-error-primary, #ff7875)',
+}
+
+export function cardPalette(dark: boolean): CardPalette {
+  return dark ? DARK_CARD_PALETTE : LIGHT_CARD_PALETTE
+}
+
+export function cardStyle(palette: CardPalette): CSSProperties {
+  return {
+    border: `1px solid ${palette.border}`,
+    borderRadius: 10,
+    padding: '12px 14px',
+    margin: '4px 0',
+    background: palette.surface,
+    color: palette.text,
+    fontFamily: 'inherit',
+  }
+}
+
+export const TITLE_STYLE: CSSProperties = {
+  fontSize: 14,
+  fontWeight: 600,
+  margin: '0 0 6px',
+}
+
+export const STATUS_STYLE: CSSProperties = {
+  fontSize: 13,
+  margin: '0 0 10px',
+  lineHeight: 1.5,
+}
+
+/**
+ * Iframe height for both the dialog and the toolview card. Tuned to the
+ * auth.eda.cn login form's actual painted height (≈390px at 768px width,
+ * measured with a magenta iframe element background so the embedded doc's
+ * transparent top/bottom strips are obvious). The dialog and toolview both
+ * use this same number for consistency.
+ *
+ * Note: the auth.eda.cn page wrapper is `grid-rows-[20px_1fr_20px]`, so the
+ * embedded doc always leaves two 20px transparent strips above and below the
+ * form — they are NOT additional empty space we can shave off; they are
+ * always there in the embed's own layout. The 30px buffer above the 390px
+ * content (→ 440) gives the form room to grow slightly on error states
+ * without immediately overflowing.
+ */
+export const LOGIN_IFRAME_HEIGHT = 440
+
+/**
+ * The embedded login iframe: painted with the same surface as the wrapping
+ * card so the login box blends in both schemes.
+ *
+ * Why not `background: transparent`? Blink's `BaseBackgroundColor()` falls
+ * back to WHITE whenever the embedded doc's root element has a transparent
+ * background (and auth.eda.cn's `data-iframe-mode` page is exactly that).
+ * That white canvas shows through wherever the document doesn't paint, which
+ * reads as a glaring white "frame" around the login card in dark mode. Light
+ * mode hid the bug because the white canvas happened to match the light
+ * host. Painting the iframe ELEMENT with the card's surface (DSH alias
+ * `--dsw-alias-bg-layer-1` with a per-scheme fallback) puts a dark sheet in
+ * dark mode and a light sheet in light mode, so the login card sits on a
+ * surface that blends with the host in both schemes.
+ */
+export function iframeStyle(palette: CardPalette): CSSProperties {
+  return {
+    width: '100%',
+    height: LOGIN_IFRAME_HEIGHT,
+    border: `1px solid ${palette.border}`,
+    borderRadius: 8,
+    background: palette.surface,
+    display: 'block',
+  }
+}
+
+export function StatusLine({
+  authenticated,
+  nickname,
+  palette,
+  t,
+}: {
+  authenticated: boolean
+  nickname?: string
+  palette: CardPalette
+  t: Translate
+}): ReactNode {
+  if (authenticated) {
+    return (
+      <p style={{ ...STATUS_STYLE, color: palette.success }}>
+        {t('card.loggedIn', {
+          nickname: nickname ? t('card.nicknameSep', { nickname }) : '',
+        })}
+      </p>
+    )
+  }
+  return (
+    <p style={{ ...STATUS_STYLE, color: palette.danger }}>
+      {t('card.loggedOut')}
+    </p>
+  )
+}

package/src/client/ui/hq-icon.tsx

@@ -0,0 +1,50 @@
+/**
+ * The Huaqiu (华秋) mark, used as the sidebar auth trigger's DEFAULT icon
+ * (mirrors `HQ_ICON` in `hq-eda-ai/apps/web/src/components/ui/icons.tsx`).
+ *
+ * Plain inline SVG: the DSH client bundle ships as a classic script with no
+ * Tailwind, so the Next.js wrapper (div + utility classes) is dropped and the
+ * 40×40 viewBox paths are kept verbatim.
+ */
+export interface HqIconProps {
+  size?: number
+  /** Brand blue by default; the paths are monochrome so one fill covers all. */
+  color?: string
+  title?: string
+}
+
+export function HQ_ICON({ size = 24, color = '#1a81c4', title }: HqIconProps): React.JSX.Element {
+  return (
+    <svg
+      xmlns="http://www.w3.org/2000/svg"
+      viewBox="0 0 40 40"
+      width={size}
+      height={size}
+      role={title ? 'img' : undefined}
+      aria-hidden={title ? undefined : true}
+      focusable="false"
+      style={{ display: 'block', flex: '0 0 auto' }}
+    >
+      {title ? <title>{title}</title> : null}
+      <path
+        fill={color}
+        fillRule="evenodd"
+        d="M29.71,30a2.75,2.75,0,1,0,2.75,2.74A2.74,2.74,0,0,0,29.71,30Z"
+      />
+      <path
+        fill={color}
+        fillRule="evenodd"
+        d="M26.59,10.49H13.41a5.93,5.93,0,0,0-5.91,5.9V29.58a5.93,5.93,0,0,0,5.91,5.91H26.85a4,4,0,0,1-1.13-2.78,4.43,4.43,0,0,1,.1-.9H13.41a2.23,2.23,0,0,1-2.22-2.22V16.39a2.23,2.23,0,0,1,2.22-2.21H26.59a2.23,2.23,0,0,1,2.22,2.21V28.81a4.43,4.43,0,0,1,.9-.1,4,4,0,0,1,2.78,1.13,2.26,2.26,0,0,0,0-.26V16.39A5.93,5.93,0,0,0,26.59,10.49Z"
+      />
+      <path
+        fill={color}
+        fillRule="evenodd"
+        d="M26.38,27.52V18.46a1.85,1.85,0,0,0-1.85-1.85h0a1.84,1.84,0,0,0-1.84,1.85v2.68H17.31V18.46a1.84,1.84,0,0,0-1.84-1.85h0a1.85,1.85,0,0,0-1.85,1.85v9.06a1.85,1.85,0,0,0,1.85,1.85h0a1.84,1.84,0,0,0,1.84-1.85V24.83h5.38v2.69a1.84,1.84,0,0,0,1.84,1.85h0A1.85,1.85,0,0,0,26.38,27.52Z"
+      />
+      <circle fill={color} cx="20" cy="5.04" r="2.86" />
+      <rect fill={color} x="19" y="5.04" width="2" height="6.7" />
+      <path fill={color} d="M6.37,17.71a4.89,4.89,0,0,0,0,9.78Z" />
+      <path fill={color} d="M33.63,17.71a4.89,4.89,0,1,1,0,9.78Z" />
+    </svg>
+  )
+}