@huaqiu/dsh-auth 0.3.9 → 0.3.11

package/lib/index.d.mts

@@ -27,6 +27,8 @@ interface HuaqiuAuthConfig {
   hqEdgeBaseUrl?: string;
   /** Path on the host; default "/api/v1/auth/token". */
   hostAuthPath?: string;
+  /** Host endpoint that triggers the EDA login dialog; default "/api/v1/auth/login". */
+  hostLoginPath?: string;
   /** Seconds a host session is reused before re-fetching. Default 300. */
   hostSessionTtlSeconds?: number;
   /** Seconds remote token-validation results are cached. Default 60. */
@@ -132,12 +134,20 @@ declare class InMemoryHuaqiuAuthService implements HuaqiuAuthService {
   private listeners;
   private readonly host;
   private readonly validator;
+  private readonly doFetch;
+  private readonly hostLoginPath;
+  /** Bound on the host login RPC (user must complete the EDA dialog). */
+  private readonly loginWaitMs;
   /**
    * True once the current credential has been rejected (API 401) or explicitly
    * invalidated. Keeps the credential for recovery but makes `isAuthenticated()`
    * short-circuit to false and forces a fresh remote validation next time.
    */
   private stale;
+  /** Last host credential version seen; see `observeHostVersion`. */
+  private lastHostVersion;
+  private _log;
+  private get log();
   constructor(config?: Partial<HuaqiuAuthConfig> | null, opts?: {
     fetchImpl?: typeof fetch;
   });
@@ -153,11 +163,45 @@ declare class InMemoryHuaqiuAuthService implements HuaqiuAuthService {
    * standalone (auth.eda.cn) login. Otherwise a stale `~/.dsh/auth/session.json`
    * would let the DSH plugins keep calling the backend while hq-edge itself has
    * no auth info. The standalone fallbacks only apply when no host is configured.
+   *
+   * A host credential the host itself reports as `authenticated: false` counts
+   * as "no credential" — otherwise `/session` would hand the browser half a user
+   * object its own `authenticated` flag contradicts, and the browser half (which
+   * adopts the session only when `authenticated` is true) would silently drop
+   * it. That mismatch is exactly how "the token reached HQ Edge but never
+   * reached the plugin" presents.
    */
   private resolve;
-  /** Spec §7: resolve → local expiry → remote validation → update state. */
+  /**
+   * Track the host's credential version so a replaced credential re-arms the
+   * session after a 401.
+   *
+   * `invalidate()` (called when a backend answers 401) must keep the session
+   * down — but only for *that* credential. HQ Edge bumps `version` whenever EDA
+   * replaces or clears its credential, so a new version means the operator has
+   * a new token and the previous rejection no longer applies.
+   */
+  private observeHostVersion;
+  /**
+   * Spec §7: resolve → local expiry → remote validation → update state.
+   *
+   * In HOST mode there is no remote validation: the host is the authority. It
+   * received the credential from EDA and publishes its own `authenticated`
+   * verdict, so probing `www.eda.cn/api/token/validate` here is not just
+   * redundant — it is wrong. That endpoint does not know the credential class
+   * EDA hands to HQ Edge (it answers `result: false`) and is unreachable in
+   * offline deployments, so gating on it made every host-mode session read as
+   * unauthenticated even while hq-edge reported `authenticated: true`.
+   */
   private validateInternal;
-  /** Validation-scoped invalidation: keep the credential, drop cached validity. */
+  /** Validation-scoped invalidation: keep the credential, drop cached validity.
+   *
+   *  In host mode the host cache *is* the cached validity — the validator only
+   *  confirmed what the host already said — so the next call must re-fetch:
+   *  otherwise a 401-driven `auth.invalidate()` would keep stale=true latched
+   *  for the full `hostSessionTtlSeconds` (default 300 s), and an HQ-Edge
+   *  credential replace in between would be invisible until the cache expired.
+   */
   private markStale;
   setCredentials(info: HuaqiuUserInfo): void;
   invalidate(): void;

package/lib/index.mjs

@@ -1,6 +1,34 @@
+import { getLogger } from "@huaqiu/dsh-plugin-log";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
+//#region src/host.ts
+/**
+* HQ Edge host mode for `dsh-auth`.
+*
+* In standalone DSH, credentials arrive only when the user logs in through the
+* browser (auth.eda.cn iframe → postMessage → `webServer` route →
+* `setCredentials`). That means the node half is empty until a browser tab
+* focuses the card, and every tool returns `needs_auth` in the gap — including
+* across a process restart (the in-memory cache is gone).
+*
+* Host mode removes that gap. When HQ Edge is the host, it already holds the
+* operator-supplied token + user id, and exposes them on a loopback route. The
+* node half fetches them on boot and is authoritative immediately, without
+* waiting for a browser. The browser half is untouched — host mode is *mode*,
+* not API (spec §5/§14).
+*
+* Resolution order inside `getUserInfo()` (spec §6.2):
+*   1. host session   — HQ Edge configured → fetch + cache (TTL)
+*   2. pushed session — what the browser half sent (today's behaviour)
+*   3. persisted file — node-side `~/.dsh/auth/session.json`, written on every set
+*   4. null           → tools return needs_auth
+*/
+let _log = null;
+function log$1() {
+	if (_log === null) _log = getLogger("dsh-auth");
+	return _log;
+}
 /**
 * Resolve the effective config: overlay `config` (highest) > env (safety net
 * for non-supervisor installs) > defaults. Centralised here so only `dsh-auth`
@@ -9,6 +37,7 @@ import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 function resolveHostConfig(config, env = process.env) {
 	const baseUrl = config?.hqEdgeBaseUrl ?? env.HQ_EDGE_BASE_URL ?? "";
 	const hostAuthPath = config?.hostAuthPath ?? env.HQ_EDGE_AUTH_PATH ?? "/api/v1/auth/token";
+	const hostLoginPath = config?.hostLoginPath ?? env.HQ_EDGE_LOGIN_PATH ?? "/api/v1/auth/login";
 	const ttlRaw = config?.hostSessionTtlSeconds ?? env.HQ_EDGE_HOST_TTL_SECONDS;
 	let ttl = 300;
 	if (typeof ttlRaw === "number" && Number.isFinite(ttlRaw) && ttlRaw > 0) ttl = ttlRaw;
@@ -26,13 +55,21 @@ function resolveHostConfig(config, env = process.env) {
 	return {
 		hqEdgeBaseUrl: baseUrl,
 		hostAuthPath,
+		hostLoginPath,
 		hostSessionTtlSeconds: ttl,
 		validationTtlSeconds
 	};
 }
 /**
-* Fetches and caches the host (HQ Edge) session. The cache is memory-only with a
-* TTL; the loopback GET is cheap and the token is static, so we never persist it.
+* Fetches and caches the host (HQ Edge) session. The cache is memory-only with
+* a TTL; the loopback GET is cheap, so we never persist the credential.
+*
+* Caching rule — **only a usable session is cached**. A host that is up but has
+* no credential yet (EDA not logged in, or the login dialog still open) must
+* NOT be cached: the operator may complete the login a second later, and a
+* cached negative would pin every tool to `needs_auth` for the whole TTL. The
+* old code cached whatever it got, so a DSH that booted before EDA
+* authenticated stayed "logged out" for up to `hostSessionTtlSeconds` (300s).
 */
 var HostSessionResolver = class {
 	baseUrl;
@@ -54,22 +91,45 @@ var HostSessionResolver = class {
 		if (!this.enabled) return null;
 		const now = Date.now();
 		if (this.cache !== null && now - this.cache.fetchedAt < this.ttlMs) return this.cache.info;
+		const url = `${this.baseUrl}${this.path}`;
+		let info = null;
+		let status = null;
 		try {
-			const res = await this.doFetch(`${this.baseUrl}${this.path}`, {
+			const res = await this.doFetch(url, {
 				method: "GET",
 				headers: { accept: "application/json" }
 			});
-			if (!res.ok) return this.cache?.info ?? null;
-			const info = normalizeHostUser(await res.json());
-			if (!info) return this.cache?.info ?? null;
+			status = res.status;
+			if (res.ok) info = normalizeHostUser(await res.json());
+		} catch (err) {
+			log$1().warn("host session fetch failed", {
+				url,
+				error: String(err)
+			});
+			info = null;
+		}
+		if (info !== null && info.authenticated) {
 			this.cache = {
 				info,
 				fetchedAt: now
 			};
+			log$1().debug("host session resolved", {
+				url,
+				status,
+				userId: info.id,
+				version: info.version ?? null,
+				authenticated: info.authenticated
+			});
 			return info;
-		} catch {
-			return this.cache?.info ?? null;
 		}
+		this.cache = null;
+		log$1().info("no usable host session", {
+			url,
+			status,
+			parsed: info !== null,
+			hostAuthenticated: info?.authenticated ?? null
+		});
+		return null;
 	}
 	/** Drop the cached value so the next `resolve()` re-fetches (reactive invalidation). */
 	clear() {
@@ -81,16 +141,30 @@ function asId(raw) {
 	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
 	return null;
 }
-/** Parse the host route payload into a credential, tolerating key-name drift. */
+/**
+* Parse the host route payload into a credential, tolerating key-name drift.
+*
+* HQ Edge answers `GET /api/v1/auth/token` with
+* `{ authenticated, token, userId, version }`. The `authenticated` flag is the
+* host's own verdict and is carried through verbatim; hosts that predate it
+* (or a minimal `{ token, userId }` stub) omit the key, in which case the
+* presence of a usable token+id is taken as the old contract was: authenticated.
+*/
 function normalizeHostUser(data) {
 	const token = typeof data.token === "string" && data.token.length > 0 ? data.token : null;
 	const id = asId(data.userId) ?? asId(data.id) ?? asId(data.user_id);
 	if (!token || !id) return null;
 	const nickname = typeof data.nickname === "string" && data.nickname.length > 0 ? data.nickname : void 0;
+	const authenticated = data.authenticated === void 0 ? true : data.authenticated === true;
+	const version = typeof data.version === "number" && Number.isFinite(data.version) ? data.version : void 0;
+	const expiresAt = typeof data.expiresAt === "number" && Number.isFinite(data.expiresAt) ? data.expiresAt : void 0;
 	return {
 		id,
 		token,
-		...nickname ? { nickname } : {}
+		authenticated,
+		...nickname ? { nickname } : {},
+		...version !== void 0 ? { version } : {},
+		...expiresAt !== void 0 ? { expiresAt } : {}
 	};
 }
 /**
@@ -293,31 +367,63 @@ var InMemoryHuaqiuAuthService = class {
 	listeners = /* @__PURE__ */ new Set();
 	host;
 	validator;
+	doFetch;
+	hostLoginPath;
+	/** Bound on the host login RPC (user must complete the EDA dialog). */
+	loginWaitMs;
 	/**
 	* True once the current credential has been rejected (API 401) or explicitly
 	* invalidated. Keeps the credential for recovery but makes `isAuthenticated()`
 	* short-circuit to false and forces a fresh remote validation next time.
 	*/
 	stale = false;
+	/** Last host credential version seen; see `observeHostVersion`. */
+	lastHostVersion = null;
+	_log = null;
+	get log() {
+		if (this._log === null) this._log = getLogger("dsh-auth");
+		return this._log;
+	}
 	constructor(config, opts) {
 		const resolved = resolveHostConfig(config);
-		this.host = new HostSessionResolver(resolved.hqEdgeBaseUrl ?? "", resolved.hostAuthPath ?? "/api/v1/auth/token", (resolved.hostSessionTtlSeconds ?? 300) * 1e3, opts?.fetchImpl);
+		this.doFetch = opts?.fetchImpl ?? globalThis.fetch.bind(globalThis);
+		this.host = new HostSessionResolver(resolved.hqEdgeBaseUrl ?? "", resolved.hostAuthPath ?? "/api/v1/auth/token", (resolved.hostSessionTtlSeconds ?? 300) * 1e3, this.doFetch);
+		this.hostLoginPath = resolved.hostLoginPath ?? "/api/v1/auth/login";
+		this.loginWaitMs = 3e5;
 		this.validator = new TokenValidator({
 			ttlMs: (resolved.validationTtlSeconds ?? 60) * 1e3,
-			fetchImpl: opts?.fetchImpl
+			fetchImpl: this.doFetch
 		});
 		this.hostMode = this.host.enabled;
+		this.log.info("auth service started", {
+			hostMode: this.hostMode,
+			hostAuthPath: resolved.hostAuthPath,
+			hostSessionTtlSeconds: resolved.hostSessionTtlSeconds
+		});
 	}
 	/** Host mode is active iff a host base URL was configured (see HostSessionResolver.enabled). */
 	hostMode;
 	auth = {
 		isAuthenticated: async () => {
+			if (await this.resolve() === null) return false;
 			if (this.stale) return false;
 			return (await this.validateInternal()).status === "valid";
 		},
 		getAccessToken: async () => (await this.resolve())?.token ?? null,
 		getUserInfo: async () => this.resolve(),
-		login: async () => {},
+		login: async () => {
+			if (!this.host.enabled) return;
+			const res = await this.doFetch(`${this.host.baseUrl}${this.hostLoginPath}`, {
+				method: "POST",
+				headers: { accept: "application/json" },
+				signal: AbortSignal.timeout(this.loginWaitMs)
+			});
+			if (!res.ok) throw new Error(`host login not completed: HTTP ${res.status}`);
+			this.host.clear();
+			this.stale = false;
+			this.validator.invalidate();
+			this.emit();
+		},
 		logout: async () => this.invalidate(),
 		validate: () => this.validateInternal(),
 		invalidate: () => this.markStale(),
@@ -332,26 +438,83 @@ var InMemoryHuaqiuAuthService = class {
 	* standalone (auth.eda.cn) login. Otherwise a stale `~/.dsh/auth/session.json`
 	* would let the DSH plugins keep calling the backend while hq-edge itself has
 	* no auth info. The standalone fallbacks only apply when no host is configured.
+	*
+	* A host credential the host itself reports as `authenticated: false` counts
+	* as "no credential" — otherwise `/session` would hand the browser half a user
+	* object its own `authenticated` flag contradicts, and the browser half (which
+	* adopts the session only when `authenticated` is true) would silently drop
+	* it. That mismatch is exactly how "the token reached HQ Edge but never
+	* reached the plugin" presents.
 	*/
 	async resolve() {
 		if (this.host.enabled) {
 			const host = await this.host.resolve();
-			if (host) return toUserInfo(host);
-			return null;
+			if (!host || !host.authenticated) {
+				this.log.debug("host session unusable", {
+					hostReachable: host !== null,
+					hostAuthenticated: host?.authenticated ?? null
+				});
+				return null;
+			}
+			this.observeHostVersion(host.version);
+			return toUserInfo(host);
 		}
 		if (this.current) return this.current;
 		return readPersisted();
 	}
-	/** Spec §7: resolve → local expiry → remote validation → update state. */
+	/**
+	* Track the host's credential version so a replaced credential re-arms the
+	* session after a 401.
+	*
+	* `invalidate()` (called when a backend answers 401) must keep the session
+	* down — but only for *that* credential. HQ Edge bumps `version` whenever EDA
+	* replaces or clears its credential, so a new version means the operator has
+	* a new token and the previous rejection no longer applies.
+	*/
+	observeHostVersion(version) {
+		if (typeof version !== "number" || !Number.isFinite(version)) return;
+		if (this.lastHostVersion !== null && version !== this.lastHostVersion) {
+			this.stale = false;
+			this.validator.invalidate();
+			this.log.info("host credential replaced — re-arming session", { version });
+		}
+		this.lastHostVersion = version;
+	}
+	/**
+	* Spec §7: resolve → local expiry → remote validation → update state.
+	*
+	* In HOST mode there is no remote validation: the host is the authority. It
+	* received the credential from EDA and publishes its own `authenticated`
+	* verdict, so probing `www.eda.cn/api/token/validate` here is not just
+	* redundant — it is wrong. That endpoint does not know the credential class
+	* EDA hands to HQ Edge (it answers `result: false`) and is unreachable in
+	* offline deployments, so gating on it made every host-mode session read as
+	* unauthenticated even while hq-edge reported `authenticated: true`.
+	*/
 	async validateInternal() {
 		const info = await this.resolve();
 		if (!info) {
-			this.stale = true;
+			if (!this.host.enabled) this.stale = true;
 			return {
 				status: "invalid",
 				reason: "invalid"
 			};
 		}
+		if (this.host.enabled) {
+			if (this.validator.isLocallyExpired(info.expiresAt)) {
+				this.validator.invalidate(info.token);
+				this.stale = true;
+				return {
+					status: "invalid",
+					reason: "expired"
+				};
+			}
+			return {
+				status: "valid",
+				userId: info.id,
+				...info.expiresAt !== void 0 ? { expiresAt: info.expiresAt } : {}
+			};
+		}
 		if (this.validator.isLocallyExpired(info.expiresAt)) {
 			this.validator.invalidate(info.token);
 			this.stale = true;
@@ -365,10 +528,18 @@ var InMemoryHuaqiuAuthService = class {
 		else if (result.status === "invalid") this.stale = true;
 		return result;
 	}
-	/** Validation-scoped invalidation: keep the credential, drop cached validity. */
+	/** Validation-scoped invalidation: keep the credential, drop cached validity.
+	*
+	*  In host mode the host cache *is* the cached validity — the validator only
+	*  confirmed what the host already said — so the next call must re-fetch:
+	*  otherwise a 401-driven `auth.invalidate()` would keep stale=true latched
+	*  for the full `hostSessionTtlSeconds` (default 300 s), and an HQ-Edge
+	*  credential replace in between would be invisible until the cache expired.
+	*/
 	markStale() {
 		this.stale = true;
 		this.validator.invalidate();
+		if (this.host.enabled) this.host.clear();
 	}
 	setCredentials(info) {
 		this.current = info;
@@ -399,7 +570,8 @@ function toUserInfo(host) {
 	return {
 		id: host.id,
 		token: host.token,
-		...host.nickname !== void 0 ? { nickname: host.nickname } : {}
+		...host.nickname !== void 0 ? { nickname: host.nickname } : {},
+		...host.expiresAt !== void 0 ? { expiresAt: host.expiresAt } : {}
 	};
 }
 //#endregion
@@ -463,6 +635,16 @@ function createAuthHandler(service) {
 				sendJson(res, 200, { hostMode: service.hostMode });
 				return;
 			}
+			if (req.method === "POST" && pathname === `/api/v1/huaqiu/auth/login`) {
+				await service.auth.login();
+				const user = await service.auth.getUserInfo();
+				sendJson(res, 200, {
+					ok: true,
+					authenticated: user !== null,
+					user
+				});
+				return;
+			}
 			sendJson(res, 404, { error: "not found" });
 		} catch (err) {
 			sendJson(res, 500, {
@@ -474,6 +656,7 @@ function createAuthHandler(service) {
 }
 //#endregion
 //#region src/index.ts
+const log = getLogger("dsh-auth");
 const name = "@huaqiu/dsh-auth";
 const inject = ["webServer"];
 /**
@@ -485,6 +668,11 @@ const inject = ["webServer"];
 *   without a supervisor (spec §6.4).
 */
 function apply(ctx, config) {
+	log.info("applying dsh-auth node half", {
+		hasConfig: config != null,
+		configKeys: config != null ? Object.keys(config) : [],
+		hqEdgeBaseUrl: config?.hqEdgeBaseUrl ?? null
+	});
 	const service = new InMemoryHuaqiuAuthService(config);
 	ctx.effect(() => ctx.provide("huaqiuAuth", service));
 	ctx.effect(() => ctx.webServer.register({
@@ -492,6 +680,10 @@ function apply(ctx, config) {
 		path: AUTH_ROUTE_PREFIX,
 		handler: createAuthHandler(service)
 	}));
+	log.info("dsh-auth node half ready", {
+		routes: AUTH_ROUTE_PREFIX,
+		hostMode: service.hostMode
+	});
 }
 //#endregion
 export { AUTH_ROUTE_PREFIX, InMemoryHuaqiuAuthService, apply, createAuthHandler, inject, name };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huaqiu/dsh-auth",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "type": "module",
   "main": "./lib/index.mjs",
   "types": "./lib/index.d.mts",
@@ -31,7 +31,8 @@
     "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.0"
   },
   "dependencies": {
-    "@deepseek-ai/dsh-home-paths": "^0.1.0-rc.0"
+    "@deepseek-ai/dsh-home-paths": "^0.1.0-rc.0",
+    "@huaqiu/dsh-plugin-log": "0.3.11"
   },
   "files": [
     "lib",

package/src/client/client.ts

@@ -131,8 +131,18 @@ export function createAuthClient(deps: AuthClientDeps): AuthClient {
       return hostSession ?? storage.get()
     },
     login: async (options?: LoginOptions): Promise<void> => {
-      // Host mode: hq-edge owns the session — never open the auth iframe.
-      if (hostMode) return
+      // Host mode: hq-edge owns the session — ask the host (EDA) to open its
+      // own login dialog instead of the auth.eda.cn iframe. The node route
+      // blocks until the dialog completes; then re-resolve and emit (only on
+      // a real change, so a redundant trigger never re-renders every card).
+      if (hostMode) {
+        const prevToken = hostSession?.token
+        await transport.triggerLogin()
+        hostSessionLoaded = false
+        await resolveHost()
+        if (hostSession?.token !== prevToken) emit(hostSession ?? storage.get())
+        return
+      }
       openIframe(options ?? {})
     },
     logout: async (): Promise<void> => {

package/src/client/transport.ts

@@ -22,6 +22,14 @@ export interface AuthTransport {
    * credential without ever opening the auth.eda.cn iframe.
    */
   fetchSession(): Promise<{ authenticated: boolean; user: HostSessionUser | null }>
+  /**
+   * Ask the node half to trigger the EDA login dialog through the host.
+   * Standalone (no host) must NOT call this — login is the browser iframe
+   * there. In host mode the node blocks until the dialog is completed (the
+   * host route waits for AuthStateChanged), then the caller re-fetches the
+   * session to pick up the fresh credential.
+   */
+  triggerLogin(): Promise<void>
 }
 
 /** Minimal session user shape returned by the node `/session` route. */
@@ -80,5 +88,12 @@ export function createWebServerAuthTransport(
       const user = body.user && typeof body.user === 'object' ? body.user as HostSessionUser : null
       return { authenticated: body.authenticated === true, user }
     },
+    async triggerLogin() {
+      const res = await doFetch(`${base}/login`, {
+        method: 'POST',
+        headers: { accept: 'application/json' },
+      })
+      if (!res.ok) throw new Error(`auth login trigger failed: HTTP ${res.status}`)
+    },
   }
 }