@huaqiu/dsh-auth 0.1.1

package/src/index.ts

@@ -0,0 +1,42 @@
+/**
+ * `@huaqiu/dsh-auth` — node plugin entry.
+ *
+ * Provides the `huaqiuAuth` service (capability, not token transport) and
+ * mounts the browser→node credential routes on `ctx.webServer`.
+ */
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-host-webserver'
+import { InMemoryHuaqiuAuthService, type HuaqiuAuthService } from './service.js'
+import { AUTH_ROUTE_PREFIX, createAuthHandler } from './routes.js'
+import type { HuaqiuAuthConfig } from './host.js'
+
+export type { HuaqiuAuthApi, HuaqiuAuthService, HuaqiuUserInfo } from './service.js'
+export type { HuaqiuAuthConfig } from './host.js'
+
+export const name = '@huaqiu/dsh-auth'
+export const inject = ['webServer'] as const
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    huaqiuAuth: HuaqiuAuthService
+  }
+}
+
+/**
+ * @param ctx cordis context
+ * @param config overlay `config` (hq-edge supervisor injects `hqEdgeBaseUrl`
+ *   here). When present with a base URL, the plugin runs in HQ Edge host mode:
+ *   the node half fetches the credential from HQ Edge instead of waiting for a
+ *   browser login. Env (`HQ_EDGE_BASE_URL` …) is the fallback for installs
+ *   without a supervisor (spec §6.4).
+ */
+export function apply(ctx: Context, config?: Partial<HuaqiuAuthConfig>): void {
+  const service = new InMemoryHuaqiuAuthService(config)
+  ctx.effect(() => ctx.provide('huaqiuAuth', service))
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'prefix',
+    path: AUTH_ROUTE_PREFIX,
+    handler: createAuthHandler(service),
+  }))
+}

package/src/routes.ts

@@ -0,0 +1,84 @@
+/**
+ * HTTP adapter: receives the browser-pushed credentials and serves the node
+ * auth state (probe / boot restore). Same-origin through `ctx.webServer`:
+ *
+ *   POST /api/v1/huaqiu/auth/session   body { token, userInfo? }  → cache set
+ *   POST /api/v1/huaqiu/auth/logout                                → cache cleared
+ *   GET  /api/v1/huaqiu/auth/session   → { authenticated, user }
+ *
+ * These routes are the browser→node transport for Phase 0A (start-p0.md §4:
+ * smallest supported extension point — `apiProxy`'s dispatch table is closed,
+ * so a plugin-owned `webServer` route is the documented channel).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { HuaqiuAuthService, HuaqiuUserInfo } from './service.js'
+
+export const AUTH_ROUTE_PREFIX = '/api/v1/huaqiu/auth'
+
+export type AuthHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void> | void
+
+function sendJson(res: ServerResponse, status: number, body: unknown): void {
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' })
+  res.end(JSON.stringify(body))
+}
+
+function readBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = []
+    req.on('data', (c: Buffer) => chunks.push(c))
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')))
+    req.on('error', reject)
+  })
+}
+
+function normalizeUserInfo(data: Record<string, unknown>): HuaqiuUserInfo | null {
+  const token = typeof data.token === 'string' && data.token.length > 0 ? data.token : null
+  const id = typeof data.userId === 'string' && data.userId.length > 0
+    ? data.userId
+    : typeof data.userId === 'number' && Number.isFinite(data.userId) ? String(data.userId)
+    : typeof data.id === 'string' && data.id.length > 0 ? data.id
+    : typeof data.id === 'number' && Number.isFinite(data.id) ? String(data.id)
+    : null
+  if (!token || !id) return null
+  const nickname = typeof data.nickname === 'string' && data.nickname.length > 0 ? data.nickname : undefined
+  return { id, token, ...(nickname ? { nickname } : {}) }
+}
+
+export function createAuthHandler(service: HuaqiuAuthService): AuthHandler {
+  return async (req, res) => {
+    try {
+      const url = req.url ?? ''
+      const q = url.indexOf('?')
+      const pathname = (q >= 0 ? url.slice(0, q) : url).replace(/\/+$/, '')
+
+      if (req.method === 'POST' && pathname === `${AUTH_ROUTE_PREFIX}/session`) {
+        const body = JSON.parse(await readBody(req) || '{}') as Record<string, unknown>
+        const info = normalizeUserInfo(body)
+        if (!info) {
+          sendJson(res, 400, { error: 'token and userId are required' })
+          return
+        }
+        service.setCredentials(info)
+        sendJson(res, 200, { ok: true })
+        return
+      }
+
+      if (req.method === 'POST' && pathname === `${AUTH_ROUTE_PREFIX}/logout`) {
+        service.invalidate()
+        sendJson(res, 200, { ok: true })
+        return
+      }
+
+      if (req.method === 'GET' && pathname === `${AUTH_ROUTE_PREFIX}/session`) {
+        const user = await service.auth.getUserInfo()
+        const authenticated = service.auth.isAuthenticated()
+        sendJson(res, 200, { authenticated, user })
+        return
+      }
+
+      sendJson(res, 404, { error: 'not found' })
+    } catch (err) {
+      sendJson(res, 500, { error: 'internal error', detail: String(err) })
+    }
+  }
+}

package/src/service.ts

@@ -0,0 +1,172 @@
+/**
+ * Node-side `huaqiuAuth` service.
+ *
+ * Holds the credential used by the tools (`getAccessToken()` → `x-user-token`,
+ * `getUserInfo()` → `x-user-id`). Two sources feed it:
+ *
+ *  - **pushed** — the browser half owns the login flow (auth.eda.cn iframe +
+ *    postMessage) and pushes credentials over a plugin-owned `webServer` route
+ *    (`setCredentials`).
+ *  - **host** — when HQ Edge is the host, the node half fetches the operator
+ *    token directly from HQ Edge's loopback route (host mode, `src/host.ts`).
+ *
+ * `huaqiuAuth.auth` is a capability (`isAuthenticated`/`getAccessToken`/
+ * `getUserInfo`), NOT a promise that the browser and node tokens are the same
+ * value (migration plan review #7).
+ *
+ * Resolution order inside `getUserInfo()` (spec §6.2):
+ *   1. host session   — HQ Edge configured → fetch + cache (TTL)
+ *   2. pushed session — what the browser half sent
+ *   3. persisted file — `~/.dsh/auth/session.json`, written on every set
+ *   4. null           → tools return needs_auth
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { dshHomePath } from '@deepseek-ai/dsh-home-paths'
+import {
+  HostSessionResolver,
+  resolveHostConfig,
+  type HuaqiuAuthConfig,
+  type ResolvedHostUser,
+} from './host.js'
+
+export interface HuaqiuUserInfo {
+  id: string
+  token: string
+  nickname?: string
+}
+
+export interface HuaqiuAuthApi {
+  isAuthenticated(): boolean
+  getAccessToken(): Promise<string | null>
+  getUserInfo(): Promise<HuaqiuUserInfo | null>
+  /** Node-side no-op: login always happens in the browser. */
+  login(): Promise<void>
+  logout(): Promise<void>
+  onAuthStateChanged(listener: (info: HuaqiuUserInfo | null) => void): () => void
+}
+
+export interface HuaqiuAuthService {
+  auth: HuaqiuAuthApi
+  /** Node-only setters used by the webServer route handlers. */
+  setCredentials(info: HuaqiuUserInfo): void
+  invalidate(): void
+}
+
+const PERSIST_FILE = 'session.json'
+const PERSIST_DIR = () => dshHomePath('auth')
+
+/**
+ * Returns the persisted session, or null if absent/unreadable. Best-effort: a
+ * corrupt or unreadable file is treated as "no session" rather than thrown.
+ */
+function readPersisted(): HuaqiuUserInfo | null {
+  try {
+    const file = join(PERSIST_DIR(), PERSIST_FILE)
+    if (!existsSync(file)) return null
+    const raw = JSON.parse(readFileSync(file, 'utf8')) as Record<string, unknown>
+    const id = typeof raw.id === 'string' && raw.id.length > 0 ? raw.id : null
+    const token = typeof raw.token === 'string' && raw.token.length > 0 ? raw.token : null
+    if (!id || !token) return null
+    const nickname = typeof raw.nickname === 'string' && raw.nickname.length > 0
+      ? raw.nickname
+      : undefined
+    return { id, token, ...(nickname ? { nickname } : {}) }
+  } catch {
+    return null
+  }
+}
+
+function writePersisted(info: HuaqiuUserInfo): void {
+  try {
+    const dir = PERSIST_DIR()
+    mkdirSync(dir, { recursive: true })
+    const file = join(dir, PERSIST_FILE)
+    const tmp = `${file}.${process.pid}.tmp`
+    writeFileSync(tmp, JSON.stringify(info), 'utf8')
+    renameSync(tmp, file)
+  } catch {
+    /* persistence is best-effort; never break the auth flow over a disk error */
+  }
+}
+
+function deletePersisted(): void {
+  try {
+    const file = join(PERSIST_DIR(), PERSIST_FILE)
+    if (existsSync(file)) rmSync(file, { force: true })
+  } catch {
+    /* best-effort */
+  }
+}
+
+export class InMemoryHuaqiuAuthService implements HuaqiuAuthService {
+  private current: HuaqiuUserInfo | null = null
+  private listeners = new Set<(info: HuaqiuUserInfo | null) => void>()
+  private readonly host: HostSessionResolver
+
+  constructor(
+    config?: Partial<HuaqiuAuthConfig> | null,
+    opts?: { fetchImpl?: typeof fetch },
+  ) {
+    const resolved = resolveHostConfig(config)
+    this.host = new HostSessionResolver(
+      resolved.hqEdgeBaseUrl ?? '',
+      resolved.hostAuthPath ?? '/api/v1/auth/token',
+      (resolved.hostSessionTtlSeconds ?? 300) * 1000,
+      opts?.fetchImpl,
+    )
+  }
+
+  readonly auth: HuaqiuAuthApi = {
+    isAuthenticated: () => this.host.enabled || this.current !== null || readPersisted() !== null,
+    getAccessToken: async () => (await this.resolve())?.token ?? null,
+    getUserInfo: async () => this.resolve(),
+    login: async () => {
+      /* login is a browser action */
+    },
+    logout: async () => this.invalidate(),
+    onAuthStateChanged: (listener) => this.on(listener),
+  }
+
+  /** Spec §6.2 resolution order: host → pushed → persisted → null. */
+  private async resolve(): Promise<HuaqiuUserInfo | null> {
+    if (this.host.enabled) {
+      const host = await this.host.resolve()
+      if (host) return toUserInfo(host)
+    }
+    if (this.current) return this.current
+    return readPersisted()
+  }
+
+  setCredentials(info: HuaqiuUserInfo): void {
+    this.current = info
+    void writePersisted(info)
+    this.emit()
+  }
+
+  invalidate(): void {
+    const was = this.host.enabled || this.current !== null || readPersisted() !== null
+    this.current = null
+    this.host.clear()
+    deletePersisted()
+    if (was) this.emit()
+  }
+
+  private on(listener: (info: HuaqiuUserInfo | null) => void): () => void {
+    this.listeners.add(listener)
+    return () => this.listeners.delete(listener)
+  }
+
+  private emit(): void {
+    const snapshot = this.current
+    for (const listener of this.listeners) listener(snapshot)
+  }
+}
+
+function toUserInfo(host: ResolvedHostUser): HuaqiuUserInfo {
+  return {
+    id: host.id,
+    token: host.token,
+    ...(host.nickname !== undefined ? { nickname: host.nickname } : {}),
+  }
+}