@inventec/dsh-copilot-auth 1.2.7 → 1.2.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@inventec/dsh-copilot-auth",
-  "version": "1.2.7",
-  "description": "为内置 Copilot 提供方补设备码登录/注销设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。适配 DSH 0.1.7+（settings API 重塑后；≤0.1.5 请用 1.1.x）。",
+  "version": "1.2.8",
+  "description": "为内置 Copilot 提供方补设备码登录设置页，预置开箱路由；凭据入内置凭据库，模型目录兜底不覆盖定制。v1.2.8：请求撤回/禁用不安全退出、补充模型/重建模型列表双入口（协议 v2）。适配 DSH 0.1.7+（≤0.1.5 请用 1.1.x）。",
   "type": "module",
   "license": "MIT",
   "author": "iasi",
@@ -29,6 +29,13 @@
     "src/atomic-json.mjs",
     "src/state.mjs",
     "src/refresh-flow.mjs",
+    "src/client-http.mjs",
+    "src/runtime-scope.mjs",
+    "src/auth-host.mjs",
+    "src/auth-flow.mjs",
+    "src/model-update.mjs",
+    "src/refresh-service.mjs",
+    "src/refresh-transaction.mjs",
     "src/catalog-overlay.json"
   ],
   "scripts": {

package/src/auth-flow.mjs

@@ -0,0 +1,190 @@
+// auth-flow.mjs — 浏览器授权状态机（T5）：串行请求、代次保护、轮询退避、卸载停止。
+// 契约：createAuthFlow({fetchImpl, clock, onState}) -> {init, start, cancel, refresh, dispose}
+//  - 单一 init 聚合 /status；start 202 → 轮询；409 → attempt.shared 并转入对现有 attempt 的轮询
+//  - 请求代次（generation）保护：慢响应不得覆盖新操作；dispose 仅停止本页请求
+//  - 轮询 1 秒；连续读取失败退避 1/2/4/8/15 秒封顶；累计失败 60 秒转手动（connectivity=manual）
+//  - 写操作（start/cancel）绝不自动重发
+import { requestJson } from "./client-http.mjs";
+
+const POLL_INTERVAL_MS = 1000;
+const BACKOFF_STEPS_S = [1, 2, 4, 8, 15];
+const AUTO_RETRY_LIMIT_MS = 60_000;
+const LIVE_STATUSES = ["starting", "waiting", "finishing"];
+
+const defaultClock = () => ({
+  now: () => Date.now(),
+  setTimeout: (fn, ms) => setTimeout(fn, ms),
+  clearTimeout: (id) => clearTimeout(id),
+});
+
+export function createAuthFlow({ fetchImpl, clock = defaultClock(), onState = () => {} } = {}) {
+  let generation = 0;
+  let timer = null;
+  let failures = 0;
+  let backoffIdx = 0;
+  let failureWindowStart = null;
+  let last = { phase: "loading", connectivity: "online", shared: false };
+
+  const emit = (patch) => {
+    last = { ...last, ...patch };
+    onState({ ...last });
+  };
+  const stale = (gen) => gen !== generation;
+  const clearTimer = () => {
+    if (timer !== null) {
+      clock.clearTimeout(timer);
+      timer = null;
+    }
+  };
+  const schedule = (gen, delayMs) => {
+    if (stale(gen)) return;
+    clearTimer();
+    timer = clock.setTimeout(() => {
+      timer = null;
+      void pollTick(gen);
+    }, delayMs);
+  };
+
+  function applySnapshot(gen, s) {
+    if (stale(gen)) return;
+    emit({ attempt: s, riskLatch: s?.riskLatch ?? null });
+    if (LIVE_STATUSES.includes(s?.status)) {
+      emit({ phase: "waiting" });
+      schedule(gen, POLL_INTERVAL_MS);
+      return;
+    }
+    if (s?.status === "authorized") {
+      emit({ phase: "authorized", error: undefined });
+      return;
+    }
+    if (s?.status === "failed") {
+      emit({ phase: "failed", error: s?.error ?? "authorization-failed" });
+      return;
+    }
+    if (s?.status === "withdrawal-pending-unverified" || s?.status === "timed-out-unverified") {
+      emit({ phase: "risk", riskKind: s.status });
+      return;
+    }
+    emit({ phase: "idle" });
+  }
+
+  async function pollTick(gen) {
+    const r = await requestJson(fetchImpl, "/copilot-auth/state", { method: "GET" });
+    if (stale(gen)) return;
+    if (r.ok) {
+      failures = 0;
+      backoffIdx = 0;
+      failureWindowStart = null;
+      emit({ connectivity: "online" });
+      applySnapshot(gen, r.body);
+      return;
+    }
+    failures += 1;
+    if (failureWindowStart === null) failureWindowStart = clock.now();
+    const cumulative = clock.now() - failureWindowStart;
+    if (cumulative >= AUTO_RETRY_LIMIT_MS) {
+      // 60 秒上限：转手动重试，保留最后确认的状态（连接异常文案由 UI 呈现）
+      emit({ connectivity: "manual" });
+      return;
+    }
+    emit({ connectivity: "retrying" });
+    const delayS = BACKOFF_STEPS_S[Math.min(backoffIdx, BACKOFF_STEPS_S.length - 1)];
+    backoffIdx += 1;
+    schedule(gen, delayS * 1000);
+  }
+
+  function beginPolling(gen) {
+    void pollTick(gen);
+  }
+
+  async function init() {
+    const gen = ++generation;
+    clearTimer();
+    const status = await requestJson(fetchImpl, "/copilot-auth/status", { method: "GET" });
+    if (stale(gen)) return;
+    if (!status.ok) {
+      emit({ phase: "idle", error: status.error?.messageKey });
+      return;
+    }
+    const body = status.body ?? {};
+    if (body.refresh?.scopeAvailable === false) {
+      emit({ phase: "unavailable" });
+      return;
+    }
+    emit({ status: body });
+    if (body.authorization?.riskLatch) {
+      emit({ riskLatch: body.authorization.riskLatch });
+    }
+    if (body.configured === true) {
+      emit({ phase: "authorized" });
+      return;
+    }
+    // 未配置时回查最近一次 attempt：恢复轮询或如实呈现终态
+    const r = await requestJson(fetchImpl, "/copilot-auth/state", { method: "GET" });
+    if (stale(gen)) return;
+    if (!r.ok) {
+      emit({ phase: "idle" });
+      return;
+    }
+    applySnapshot(gen, r.body);
+  }
+
+  async function start() {
+    const gen = ++generation;
+    clearTimer();
+    failures = 0;
+    backoffIdx = 0;
+    failureWindowStart = null;
+    emit({ phase: "waiting", shared: false, error: undefined, connectivity: "online" });
+    const r = await requestJson(fetchImpl, "/copilot-auth/start", { method: "POST" });
+    if (stale(gen)) return;
+    if (r.ok) {
+      beginPolling(gen);
+      return;
+    }
+    const errorCode = r.error?.details?.errorCode;
+    if (r.httpStatus === 409) {
+      // 共同尝试：不是失败——展示 shared 并转入对现有 attempt 的轮询
+      emit({ shared: true });
+      beginPolling(gen);
+      return;
+    }
+    if (errorCode === "auth-unsafe") {
+      emit({ phase: "risk", riskKind: "auth-unsafe" });
+      return;
+    }
+    if (errorCode === "scope-unavailable" || r.httpStatus === 503) {
+      emit({ phase: "unavailable" });
+      return;
+    }
+    emit({ phase: "failed", error: errorCode ?? r.error?.messageKey });
+  }
+
+  async function cancel() {
+    // 写操作：单次调用，绝不自动重发
+    const r = await requestJson(fetchImpl, "/copilot-auth/cancel", { method: "POST" });
+    if (r.ok) {
+      emit({ withdrawalDelivery: r.body?.withdrawalDelivery ?? "unavailable" });
+      return;
+    }
+    emit({ withdrawalDelivery: "failed", error: r.error?.details?.errorCode ?? r.error?.messageKey });
+  }
+
+  function refresh() {
+    // 手动重试（60 秒上限后）：恢复自动轮询并重置失败窗口
+    const gen = ++generation;
+    clearTimer();
+    failures = 0;
+    backoffIdx = 0;
+    failureWindowStart = null;
+    emit({ connectivity: "online" });
+    void pollTick(gen);
+  }
+
+  function dispose() {
+    generation += 1;
+    clearTimer();
+  }
+
+  return { init, start, cancel, refresh, dispose };
+}

package/src/auth-host.mjs

@@ -0,0 +1,182 @@
+// auth-host.mjs — 授权控制器（T3）：单实例尝试、软撤回＋风险锁存、禁用退出/重授权、
+// intentVersion 与首次填充 handoff。
+// 契约见 docs/plans/2026-10-04-copilot-auth-models-unified-implementation-plan.md：
+//  - start：先 intentIO.bump() 持久 intentVersion+1（失败不发 begin），再 begin；202 先行语义保留
+//  - cancel：先 bump，再调用宿主撤销（invoked/unavailable/failed），设进程内 riskLatch
+//  - logout/reauthorize：一律拒绝 logout-safety-unavailable，绝不 deleteRecord
+//  - onAuthorized(handoff) 仅在 outcome=authorized 且 originIntentVersion 仍当前且无撤回/超时标记时触发
+//  - riskLatch 进程级：重挂/dispose 不清；15 分钟等待超时由 snapshot 以注入 clock 惰性判定
+import { randomUUID } from "node:crypto";
+import { CREDENTIAL_KEY } from "./shared.mjs";
+
+export const WAIT_LIMIT_MS = 15 * 60 * 1000;
+const LIVE_STATUSES = ["starting", "waiting", "finishing"];
+
+// 授权错误脱敏：仅保留安全字符集（字母/数字/空格/点/冒号/逗号/连字符），
+// 阻断上游异常文本或疑似 token（含 = ; / + _ 等的串）进入状态面。
+const SAFE_AUTH_ERROR = /^[A-Za-z0-9 .,:-]{1,140}$/;
+
+export function sanitizeAuthError(err) {
+  const msg = String(err?.message ?? err);
+  return SAFE_AUTH_ERROR.test(msg) ? msg : "authorization-failed";
+}
+
+function authError(code, message, extra = {}) {
+  const err = new Error(message);
+  err.code = code;
+  Object.assign(err, extra);
+  return err;
+}
+
+export function createAuthorizationController(ctx, { scope, intentIO, clock = { now: () => Date.now() }, onAuthorized } = {}) {
+  let attempt = null;
+  let riskLatch = null; // { reason, at } — 进程级风险锁存，本进程生命周期内不解除
+
+  const setRiskLatch = (reason) => {
+    if (!riskLatch) riskLatch = { reason, at: clock.now() };
+  };
+
+  const requireScope = () => {
+    if (!scope?.known) throw authError("SCOPE_UNAVAILABLE", "scope-unavailable");
+  };
+
+  function start() {
+    requireScope();
+    if (riskLatch) throw authError("AUTH_UNSAFE", "auth-unsafe", { riskLatch });
+    if (attempt && LIVE_STATUSES.includes(attempt.status)) {
+      throw authError("ATTEMPT_RUNNING", "already running", { attemptId: attempt.attemptId });
+    }
+    // 先持久意图版本，失败不发 begin（安全门拒绝动作不产生副作用）
+    const originIntentVersion = intentIO.bump();
+    const a = {
+      attemptId: randomUUID(),
+      status: "starting",
+      startedAt: clock.now(),
+      notices: [],
+      originIntentVersion,
+      withdrawalRequested: false,
+      timedOut: false,
+      withdrawalDelivery: undefined,
+      error: undefined,
+      staleIntent: false,
+    };
+    attempt = a;
+    const interaction = {
+      notify: (notice) => {
+        if (attempt !== a) return;
+        a.notices.push(notice);
+        if (notice && typeof notice === "object") {
+          if (a.status === "starting") a.status = "waiting";
+          if (typeof notice.code === "string") a.code = notice.code;
+          if (typeof notice.url === "string") a.url = notice.url;
+          if (typeof notice.expiresAt === "string") a.expiresAt = notice.expiresAt;
+        }
+      },
+      // 企业域名提问答空串（github.com 组织账号）；其余 prompt 都是未预期的
+      prompt: (p) => {
+        if (p && typeof p.message === "string" && p.message.includes("Enterprise")) {
+          return Promise.resolve("");
+        }
+        return Promise.reject(new Error("unexpected prompt: " + (p?.message ?? String(p))));
+      },
+    };
+    // 响应先行：begin 以后台任务执行，start 返回路径不得 await begin
+    void Promise.resolve()
+      .then(() => ctx.authorization.begin({ key: CREDENTIAL_KEY, method: "oauth", interaction }))
+      .then((outcome) => {
+        if (attempt !== a) return;
+        if (outcome && outcome.status === "authorized") {
+          const versionStillCurrent = a.originIntentVersion === intentIO.read();
+          const intact = versionStillCurrent && !a.withdrawalRequested && !a.timedOut;
+          a.status = "authorized";
+          a.staleIntent = !intact;
+          if (intact && typeof onAuthorized === "function") {
+            // 释放意图：handoff 只携带来源标识，晚到事实不生成新意图（T4 消费前再核）
+            onAuthorized({
+              attemptId: a.attemptId,
+              originIntentVersion: a.originIntentVersion,
+              authorizedAt: new Date(clock.now()).toISOString(),
+            });
+          }
+        } else {
+          // 宿主 cancelled 只是源结果：晚写不可排除，转待核实并锁存风险（D-01 软撤回）
+          a.status = "withdrawal-pending-unverified";
+          setRiskLatch("withdrawal-unverified");
+        }
+      })
+      .catch((err) => {
+        if (attempt !== a) return;
+        a.status = "failed";
+        a.error = sanitizeAuthError(err);
+      });
+    return { attemptId: a.attemptId };
+  }
+
+  async function cancel() {
+    requireScope();
+    // 先持久失效本地旧意图，再发撤回调用
+    intentIO.bump();
+    let withdrawalDelivery = "unavailable";
+    if (attempt) {
+      attempt.withdrawalRequested = true;
+      if (LIVE_STATUSES.includes(attempt.status)) attempt.status = "withdrawal-pending-unverified";
+    }
+    const cancelFn = ctx.authorization?.cancel;
+    if (typeof cancelFn === "function") {
+      try {
+        await cancelFn(CREDENTIAL_KEY);
+        withdrawalDelivery = "invoked";
+      } catch {
+        withdrawalDelivery = "failed";
+      }
+    }
+    // delivery 写入 attempt：刷新页面后 /state 恢复仍如实展示「已请求撤回」事实
+    if (attempt) attempt.withdrawalDelivery = withdrawalDelivery;
+    // 任何响应都不承诺晚写停止：风险锁存待核实
+    setRiskLatch("withdrawal-requested");
+    return { withdrawalDelivery };
+  }
+
+  function logout() {
+    // 当前宿主无法证明安全退出（D-01）：统一拒绝，不调用 deleteRecord
+    throw authError("LOGOUT_UNAVAILABLE", "logout-safety-unavailable");
+  }
+
+  function snapshot() {
+    // 15 分钟本地等待上限：惰性判定（无后台定时器），不伪造设备码倒计时
+    if (attempt && LIVE_STATUSES.includes(attempt.status) && clock.now() > attempt.startedAt + WAIT_LIMIT_MS) {
+      attempt.status = "timed-out-unverified";
+      attempt.timedOut = true;
+      setRiskLatch("wait-timeout");
+    }
+    if (!attempt) {
+      return { attemptId: null, status: "idle", startedAt: null, waitDeadline: null, riskLatch };
+    }
+    return {
+      attemptId: attempt.attemptId,
+      status: attempt.status,
+      startedAt: attempt.startedAt,
+      code: attempt.code,
+      url: attempt.url,
+      expiresAt: attempt.expiresAt,
+      waitDeadline: attempt.startedAt + WAIT_LIMIT_MS,
+      withdrawalDelivery: attempt.withdrawalDelivery,
+      riskLatch,
+      staleIntent: attempt.staleIntent,
+      notices: [...attempt.notices],
+      error: attempt.error,
+    };
+  }
+
+  // T4 消费：handoff 是否仍完好（同 attempt、版本仍当前、无撤回/超时标记）
+  function handoffIntact(handoff) {
+    if (!attempt || !handoff) return false;
+    return attempt.attemptId === handoff.attemptId
+      && attempt.originIntentVersion === handoff.originIntentVersion
+      && attempt.originIntentVersion === intentIO.read()
+      && !attempt.withdrawalRequested
+      && !attempt.timedOut;
+  }
+
+  return { start, cancel, logout, snapshot, handoffIntact };
+}

package/src/client-http.mjs

@@ -0,0 +1,80 @@
+// client-http.mjs — 浏览器/host 双侧可用的 HTTP/JSON 解析层（T1）。
+// 契约：requestJson(fetchImpl, url, init) -> {ok, httpStatus, body, error}
+//  - 网络拒绝 → network-error（httpStatus=null）
+//  - 非 JSON（HTML 代理页/空体/坏 JSON）→ 保留 httpStatus，bad-gateway（5xx 或 HTML）/ bad-response
+//  - JSON 但失败 → http-error，errorCode 仅保留安全形状（字母开头，字母/数字/空格/连字符）
+//  - details 白名单：{httpStatus?, contentType?, errorCode?}；绝不透传原始响应体或异常文本
+//  - 写调用不自动重试
+const SAFE_ERROR_CODE = /^[A-Za-z][A-Za-z0-9 -]{0,79}$/;
+const SAFE_CONTENT_TYPE = /^[\w./+-]{0,100}$/;
+
+export function sanitizeErrorCode(value) {
+  return typeof value === "string" && SAFE_ERROR_CODE.test(value) ? value : "http-error";
+}
+
+// 错误响应的 body 深度脱敏：仅保留安全形状的字符串（字母/数字/空格/连字符，
+// 覆盖 already running、logout-safety-unavailable、uuid 等），其余字符串丢弃，
+// 防止上游异常文本或疑似 token 随 body 泄漏；ok:true 的 body 为域数据，原样返回。
+const SAFE_STRING = /^[A-Za-z0-9][A-Za-z0-9 -]{0,127}$/;
+
+function deepSanitize(value) {
+  if (typeof value === "string") return SAFE_STRING.test(value) ? value : undefined;
+  if (value === null || typeof value === "number" || typeof value === "boolean") return value;
+  if (Array.isArray(value)) return value.map(deepSanitize);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const s = deepSanitize(v);
+      if (s !== undefined) out[k] = s;
+    }
+    return out;
+  }
+  return undefined;
+}
+
+function sanitizeContentType(value) {
+  if (typeof value !== "string" || !SAFE_CONTENT_TYPE.test(value)) return undefined;
+  return value;
+}
+
+export async function requestJson(fetchImpl, url, init = {}) {
+  let res;
+  try {
+    res = await fetchImpl(url, init);
+  } catch {
+    return { ok: false, httpStatus: null, body: undefined, error: { messageKey: "network-error", details: {} } };
+  }
+  const httpStatus = res.status;
+  let text = "";
+  try {
+    text = await res.text();
+  } catch {
+    text = "";
+  }
+  if (typeof text !== "string" || text.trim() === "") {
+    return {
+      ok: false,
+      httpStatus,
+      body: undefined,
+      error: { messageKey: httpStatus >= 500 ? "bad-gateway" : "bad-response", details: { httpStatus } },
+    };
+  }
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    const contentType = sanitizeContentType(res.headers?.get?.("content-type"));
+    const looksHtml = contentType?.includes("html") || /^\s*<(?:!doctype|html)/i.test(text);
+    const messageKey = httpStatus >= 500 || looksHtml ? "bad-gateway" : "bad-response";
+    const details = { httpStatus };
+    if (contentType !== undefined) details.contentType = contentType;
+    return { ok: false, httpStatus, body: undefined, error: { messageKey, details } };
+  }
+  const ok = res.ok && body?.ok !== false;
+  if (ok) return { ok: true, httpStatus, body, error: undefined };
+  const details = {};
+  if (!res.ok) details.httpStatus = httpStatus;
+  const errorCode = sanitizeErrorCode(body?.error);
+  if (errorCode !== undefined) details.errorCode = errorCode;
+  return { ok: false, httpStatus, body: deepSanitize(body), error: { messageKey: "http-error", details } };
+}