@lobehub/lobehub 2.0.0-next.225 → 2.0.0-next.226

package/src/app/[variants]/(main)/chat/profile/features/Header/AgentPublishButton/useMarketPublish.ts

@@ -3,32 +3,45 @@ import { useCallback, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import { message } from '@/components/AntdStaticMethods';
-import { checkOwnership } from '@/hooks/useAgentOwnershipCheck';
 import { useTokenCount } from '@/hooks/useTokenCount';
 import { useMarketAuth } from '@/layout/AuthProvider/MarketAuth';
-import { marketApiService } from '@/services/marketApi';
+import { lambdaClient } from '@/libs/trpc/client';
 import { useAgentStore } from '@/store/agent';
 import { agentChatConfigSelectors, agentSelectors } from '@/store/agent/selectors';
 import { useGlobalStore } from '@/store/global';
 import { globalGeneralSelectors } from '@/store/global/selectors';
-import { useServerConfigStore } from '@/store/serverConfig';
-import { serverConfigSelectors } from '@/store/serverConfig/selectors';
 
 import type { MarketPublishAction } from './types';
-import { generateDefaultChangelog, generateMarketIdentifier } from './utils';
+import { generateDefaultChangelog } from './utils';
+
+export interface OriginalAgentInfo {
+  author?: {
+    avatar?: string;
+    name?: string;
+    userName?: string;
+  };
+  avatar?: string;
+  identifier: string;
+  name: string;
+}
 
 interface UseMarketPublishOptions {
   action: MarketPublishAction;
   onSuccess?: (identifier: string) => void;
 }
 
+export interface CheckOwnershipResult {
+  needsForkConfirm: boolean;
+  originalAgent: OriginalAgentInfo | null;
+}
+
 export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions) => {
   const { t } = useTranslation('setting');
   const [isPublishing, setIsPublishing] = useState(false);
+  const [isCheckingOwnership, setIsCheckingOwnership] = useState(false);
   // 使用 ref 来同步跟踪发布状态，避免闭包导致的竞态问题
   const isPublishingRef = useRef(false);
-  const { isAuthenticated, session, getCurrentUserInfo } = useMarketAuth();
-  const enableMarketTrustedClient = useServerConfigStore(serverConfigSelectors.enableMarketTrustedClient);
+  const { isAuthenticated } = useMarketAuth();
 
   // Agent data from store
   const meta = useAgentStore(agentSelectors.currentAgentMeta, isEqual);
@@ -46,15 +59,49 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
 
   const isSubmit = action === 'submit';
 
+  /**
+   * Check ownership before publishing
+   * Returns whether fork confirmation is needed and original agent info
+   */
+  const checkOwnership = useCallback(async (): Promise<CheckOwnershipResult> => {
+    const identifier = meta?.marketIdentifier;
+
+    // No identifier means new agent, no need to check
+    if (!identifier) {
+      return { needsForkConfirm: false, originalAgent: null };
+    }
+
+    try {
+      setIsCheckingOwnership(true);
+      const result = await lambdaClient.market.agent.checkOwnership.query({ identifier });
+
+      // If agent doesn't exist or user is owner, no confirmation needed
+      if (!result.exists || result.isOwner) {
+        return { needsForkConfirm: false, originalAgent: null };
+      }
+
+      // User is not owner, need fork confirmation
+      return {
+        needsForkConfirm: true,
+        originalAgent: result.originalAgent as OriginalAgentInfo,
+      };
+    } catch (error) {
+      console.error('[useMarketPublish] Failed to check ownership:', error);
+      // On error, proceed without confirmation
+      return { needsForkConfirm: false, originalAgent: null };
+    } finally {
+      setIsCheckingOwnership(false);
+    }
+  }, [meta?.marketIdentifier]);
+
   const publish = useCallback(async () => {
     // 防止重复发布：使用 ref 同步检查，避免闭包导致的竞态问题
     if (isPublishingRef.current) {
       return { success: false };
     }
 
-    // 如果启用了 trustedClient，只需要检查 isAuthenticated
-    // 因为后端会自动注入 trustedClientToken
-    if (!isAuthenticated || (!enableMarketTrustedClient && !session?.accessToken)) {
+    // 检查认证状态 - tRPC 会自动处理 trustedClient
+    if (!isAuthenticated) {
       return { success: false };
     }
 
@@ -63,8 +110,6 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
       ? t('marketPublish.modal.loading.submit')
       : t('marketPublish.modal.loading.upload');
 
-    let identifier = meta?.marketIdentifier;
-
     const changelog = generateDefaultChangelog();
 
     try {
@@ -72,61 +117,9 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
       isPublishingRef.current = true;
       setIsPublishing(true);
       message.loading({ content: loadingMessage, key: messageKey });
-      // 只有在非 trustedClient 模式下才需要设置 accessToken
-      if (session?.accessToken) {
-        marketApiService.setAccessToken(session.accessToken);
-      }
-
-      // 判断是否需要创建新 agent
-      let needsCreateAgent = false;
-
-      if (!identifier) {
-        // 没有 marketIdentifier，需要创建新 agent
-        needsCreateAgent = true;
-      } else if (isSubmit) {
-        // 有 marketIdentifier 且是 submit 操作，需要检查是否是自己的 agent
-        const userInfo = getCurrentUserInfo?.() ?? session?.userInfo;
-        const accountId = userInfo?.accountId;
-
-        if (accountId) {
-          const isOwner = await checkOwnership({
-            accessToken: session?.accessToken,
-            accountId,
-            enableMarketTrustedClient,
-            marketIdentifier: identifier,
-          });
-
-          if (!isOwner) {
-            // 不是自己的 agent，需要创建新的
-            needsCreateAgent = true;
-          }
-        } else {
-          // 无法获取用户 ID，为安全起见创建新 agent
-          needsCreateAgent = true;
-        }
-      }
 
-      if (needsCreateAgent) {
-        identifier = generateMarketIdentifier();
-
-        try {
-          await marketApiService.getAgentDetail(identifier);
-        } catch {
-          const createPayload: Record<string, unknown> = {
-            identifier,
-            name: meta?.title || '',
-          };
-          await marketApiService.createAgent(createPayload as any);
-        }
-      } else if (!identifier) {
-        message.error({
-          content: t('marketPublish.modal.messages.missingIdentifier'),
-          key: messageKey,
-        });
-        return { success: false };
-      }
-
-      const versionPayload = {
+      // 使用 tRPC publishOrCreate - 后端会自动处理 ownership 检查
+      const result = await lambdaClient.market.agent.publishOrCreate.mutate({
         avatar: meta?.avatar,
         changelog,
         config: {
@@ -157,31 +150,16 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
         },
         description: meta?.description || '',
         editorData: editorData,
-        identifier: identifier,
+        // 传递现有的 identifier，后端会检查 ownership
+        identifier: meta?.marketIdentifier,
         name: meta?.title || '',
         tags: meta?.tags,
         tokenUsage: tokenUsage,
-      };
-
-      try {
-        await marketApiService.createAgentVersion(versionPayload);
-      } catch (versionError) {
-        const errorMessage =
-          versionError instanceof Error
-            ? versionError.message
-            : t('unknownError', { ns: 'common' });
-        message.error({
-          content: t('marketPublish.modal.messages.createVersionFailed', {
-            message: errorMessage,
-          }),
-          key: messageKey,
-        });
-        return { success: false };
-      }
+      });
 
-      // 只有在首次创建 agent 时才需要更新 meta
-      if (needsCreateAgent) {
-        updateAgentMeta({ marketIdentifier: identifier });
+      // 如果是新创建的 agent，需要更新 meta
+      if (result.isNewAgent) {
+        updateAgentMeta({ marketIdentifier: result.identifier });
       }
 
       message.success({
@@ -189,8 +167,8 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
         key: messageKey,
       });
 
-      onSuccess?.(identifier!);
-      return { identifier, success: true };
+      onSuccess?.(result.identifier);
+      return { identifier: result.identifier, success: true };
     } catch (error) {
       const errorMessage =
         error instanceof Error ? error.message : t('unknownError', { ns: 'common' });
@@ -211,8 +189,6 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
     chatConfig?.historyCount,
     chatConfig?.searchMode,
     editorData,
-    enableMarketTrustedClient,
-    getCurrentUserInfo,
     isAuthenticated,
     isSubmit,
     language,
@@ -225,8 +201,6 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
     onSuccess,
     plugins,
     provider,
-    session?.accessToken,
-    session?.userInfo,
     systemRole,
     tokenUsage,
     t,
@@ -234,6 +208,8 @@ export const useMarketPublish = ({ action, onSuccess }: UseMarketPublishOptions)
   ]);
 
   return {
+    checkOwnership,
+    isCheckingOwnership,
     isPublishing,
     publish,
   };

package/src/layout/AuthProvider/MarketAuth/MarketAuthProvider.tsx

@@ -5,7 +5,8 @@ import { type ReactNode, createContext, useCallback, useContext, useEffect, useS
 import { useTranslation } from 'react-i18next';
 import { mutate as globalMutate } from 'swr';
 
-import { MARKET_ENDPOINTS, MARKET_OIDC_ENDPOINTS } from '@/services/_url';
+import { lambdaClient } from '@/libs/trpc/client';
+import { MARKET_OIDC_ENDPOINTS } from '@/services/_url';
 import { useServerConfigStore } from '@/store/serverConfig';
 import { serverConfigSelectors } from '@/store/serverConfig/selectors';
 import { useUserStore } from '@/store/user';
@@ -32,31 +33,16 @@ interface MarketAuthProviderProps {
 }
 
 /**
- * 获取用户信息（从 OIDC userinfo endpoint）
+ * 获取用户信息（通过 tRPC OIDC endpoint）
  * @param accessToken - 可选的 access token，如果不传则后端会尝试使用 trustedClientToken
  */
 const fetchUserInfo = async (accessToken?: string): Promise<MarketUserInfo | null> => {
   try {
-    const response = await fetch(MARKET_OIDC_ENDPOINTS.userinfo, {
-      body: JSON.stringify({ token: accessToken }),
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      method: 'POST',
+    const userInfo = await lambdaClient.market.oidc.getUserInfo.mutate({
+      token: accessToken,
     });
 
-    if (!response.ok) {
-      console.error(
-        '[MarketAuth] Failed to fetch user info:',
-        response.status,
-        response.statusText,
-      );
-      return null;
-    }
-
-    const userInfo = (await response.json()) as MarketUserInfo;
-
-    return userInfo;
+    return userInfo as MarketUserInfo;
   } catch (error) {
     console.error('[MarketAuth] Error fetching user info:', error);
     return null;
@@ -136,16 +122,11 @@ const refreshToken = async (): Promise<boolean> => {
  */
 const checkNeedsProfileSetup = async (username: string): Promise<boolean> => {
   try {
-    const response = await fetch(MARKET_ENDPOINTS.getUserProfile(username));
-    if (!response.ok) {
-      // User profile not found, needs setup
-      return true;
-    }
-    const profile = (await response.json()) as MarketUserProfile;
+    const profile = await lambdaClient.market.user.getUserByUsername.query({ username });
     // If userName is not set, user needs to complete profile setup
     return !profile.userName;
   } catch {
-    // Error fetching profile, assume needs setup
+    // Error fetching profile (e.g., NOT_FOUND), assume needs setup
     return true;
   }
 };
@@ -177,7 +158,9 @@ export const MarketAuthProvider = ({ children, isDesktop }: MarketAuthProviderPr
   const isUserStateInit = useUserStore((s) => s.isUserStateInit);
 
   // 检查是否启用了 Market Trusted Client 认证
-  const enableMarketTrustedClient = useServerConfigStore(serverConfigSelectors.enableMarketTrustedClient);
+  const enableMarketTrustedClient = useServerConfigStore(
+    serverConfigSelectors.enableMarketTrustedClient,
+  );
 
   // 初始化 OIDC 客户端（仅在客户端）
   useEffect(() => {

package/src/layout/AuthProvider/MarketAuth/ProfileSetupModal.tsx

@@ -9,7 +9,7 @@ import { memo, useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import EmojiPicker from '@/components/EmojiPicker';
-import { MARKET_ENDPOINTS } from '@/services/_url';
+import { lambdaClient } from '@/libs/trpc/client';
 import { useFileStore } from '@/store/file';
 import { useGlobalStore } from '@/store/global';
 import { globalGeneralSelectors } from '@/store/global/selectors';
@@ -211,37 +211,42 @@ const ProfileSetupModal = memo<ProfileSetupModalProps>(
         if (bannerUrl) meta.bannerUrl = bannerUrl;
         if (Object.keys(socialLinks).length > 0) meta.socialLinks = socialLinks;
 
-        const response = await fetch(MARKET_ENDPOINTS.updateUserProfile, {
-          body: JSON.stringify({
-            avatarUrl: avatarUrl || undefined,
-            displayName: values.displayName,
-            meta: Object.keys(meta).length > 0 ? meta : undefined,
-            userName: values.userName,
-          }),
-          headers: {
-            'Authorization': `Bearer ${accessToken}`,
-            'Content-Type': 'application/json',
-          },
-          method: 'PUT',
+        const result = await lambdaClient.market.user.updateUserProfile.mutate({
+          avatarUrl: avatarUrl || undefined,
+          displayName: values.displayName,
+          meta: Object.keys(meta).length > 0 ? meta : undefined,
+          userName: values.userName,
         });
 
-        if (!response.ok) {
-          const errorData = await response.json();
-          if (errorData.error === 'username_taken') {
-            message.error(t('profileSetup.errors.usernameTaken'));
-            return;
-          }
-          throw new Error(errorData.message || 'Update failed');
-        }
-
-        const data = await response.json();
         message.success(t('profileSetup.success'));
-        onSuccess?.(data.user);
+        // Cast result.user to MarketUserProfile with required fields
+        const userProfile: MarketUserProfile = {
+          avatarUrl: result.user?.avatarUrl || avatarUrl || null,
+          bannerUrl: bannerUrl || null,
+          createdAt: result.user?.createdAt || new Date().toISOString(),
+          description: values.description || null,
+          displayName: values.displayName || null,
+          id: result.user?.id || 0,
+          namespace: result.user?.namespace || '',
+          socialLinks: Object.keys(socialLinks).length > 0 ? socialLinks : null,
+          type: result.user?.type || null,
+          userName: values.userName || null,
+        };
+        onSuccess?.(userProfile);
         onClose();
       } catch (error) {
         console.error('[ProfileSetupModal] Update failed:', error);
         if (error instanceof Error && error.message !== 'Validation failed') {
-          message.error(t('profileSetup.errors.updateFailed'));
+          // Check for username taken error (tRPC CONFLICT code)
+          const errorMessage = error.message || '';
+          if (
+            errorMessage.toLowerCase().includes('already taken') ||
+            errorMessage.includes('CONFLICT')
+          ) {
+            message.error(t('profileSetup.errors.usernameTaken'));
+          } else {
+            message.error(t('profileSetup.errors.updateFailed'));
+          }
         }
       } finally {
         setLoading(false);

package/src/layout/AuthProvider/MarketAuth/useMarketUserProfile.ts

@@ -1,20 +1,15 @@
 import useSWR from 'swr';
 
-import { MARKET_ENDPOINTS } from '@/services/_url';
+import { lambdaClient } from '@/libs/trpc/client';
 
 import { type MarketUserProfile } from './types';
 
 /**
- * Fetcher function for user profile
+ * Fetcher function for user profile using tRPC
  */
 const fetchUserProfile = async (username: string): Promise<MarketUserProfile | null> => {
-  const response = await fetch(MARKET_ENDPOINTS.getUserProfile(username));
-
-  if (!response.ok) {
-    throw new Error(`Failed to fetch user profile: ${response.status}`);
-  }
-
-  return response.json();
+  const result = await lambdaClient.market.user.getUserByUsername.query({ username });
+  return result as MarketUserProfile;
 };
 
 /**

package/src/libs/trpc/lambda/middleware/index.ts

@@ -1,4 +1,5 @@
 export * from './keyVaults';
+export * from './marketSDK';
 export * from './marketUserInfo';
 export * from './serverDatabase';
 export * from './telemetry';

package/src/libs/trpc/lambda/middleware/marketSDK.ts

@@ -0,0 +1,68 @@
+import { MarketSDK } from '@lobehub/market-sdk';
+
+import { generateTrustedClientToken, type TrustedClientUserInfo } from '@/libs/trusted-client';
+
+import { trpc } from '../init';
+
+interface ContextWithMarketUserInfo {
+  marketAccessToken?: string;
+  marketUserInfo?: TrustedClientUserInfo;
+}
+
+/**
+ * Middleware that initializes MarketSDK with proper authentication.
+ * This requires marketUserInfo middleware to be applied first.
+ *
+ * Provides:
+ * - ctx.marketSDK: Initialized MarketSDK instance with trustedClientToken and optional accessToken
+ * - ctx.trustedClientToken: The generated trusted client token (if available)
+ */
+export const marketSDK = trpc.middleware(async (opts) => {
+  const ctx = opts.ctx as ContextWithMarketUserInfo;
+
+  // Generate trusted client token if user info is available
+  const trustedClientToken = ctx.marketUserInfo
+    ? generateTrustedClientToken(ctx.marketUserInfo)
+    : undefined;
+
+  // Initialize MarketSDK with both authentication methods
+  const market = new MarketSDK({
+    accessToken: ctx.marketAccessToken,
+    baseURL: process.env.NEXT_PUBLIC_MARKET_BASE_URL,
+    trustedClientToken,
+  });
+
+  return opts.next({
+    ctx: {
+      marketSDK: market,
+      trustedClientToken,
+    },
+  });
+});
+
+/**
+ * Middleware that requires authentication for Market API access.
+ * This middleware ensures that either accessToken or trustedClientToken is available.
+ * It should be used after marketUserInfo and marketSDK middlewares.
+ *
+ * Throws UNAUTHORIZED error if neither authentication method is available.
+ */
+export const requireMarketAuth = trpc.middleware(async (opts) => {
+  const ctx = opts.ctx as ContextWithMarketUserInfo & {
+    trustedClientToken?: string;
+  };
+
+  // Check if any authentication is available
+  const hasAccessToken = !!ctx.marketAccessToken;
+  const hasTrustedToken = !!ctx.trustedClientToken;
+
+  if (!hasAccessToken && !hasTrustedToken) {
+    const { TRPCError } = await import('@trpc/server');
+    throw new TRPCError({
+      code: 'UNAUTHORIZED',
+      message: 'Authentication required. Please sign in.',
+    });
+  }
+
+  return opts.next();
+});

package/src/locales/default/setting.ts

@@ -140,6 +140,11 @@ export default {
   'llm.proxyUrl.title': 'API proxy URL',
   'llm.waitingForMore': 'More models are <1>planned to be added</1>, stay tuned',
   'llm.waitingForMoreLinkAriaLabel': 'Open the Provider request form',
+  'marketPublish.forkConfirm.by': 'by {{author}}',
+  'marketPublish.forkConfirm.confirm': 'Confirm Publish',
+  'marketPublish.forkConfirm.description':
+    'You are about to publish a derivative version based on an existing agent from the community. Your new agent will be created as a separate entry in the marketplace.',
+  'marketPublish.forkConfirm.title': 'Publish Derivative Agent',
   'marketPublish.modal.changelog.extra':
     'Describe the key changes and improvements in this version',
   'marketPublish.modal.changelog.label': 'Changelog',