@musnows/scriverse 0.8.7 → 0.9.0

package/dist/user-auth.js

@@ -25,8 +25,10 @@ export function relationshipAnalysisReadModules(scope) {
     }
     return [...modules];
 }
-const sessionCookieName = "scriverse_session";
-const sessionLifetimeMs = 30 * 24 * 60 * 60_000;
+export const SESSION_COOKIE_NAME = "scriverse_session";
+export const SESSION_LIFETIME_MS = 30 * 24 * 60 * 60_000;
+export const DESKTOP_SESSION_TOKEN_PREFIX = "scrvd_";
+export const DESKTOP_SESSION_LIFETIME_MS = 30 * 24 * 60 * 60_000;
 const apiKeyPrefix = "scrv_";
 function membershipAccessRole(row) {
     const role = String(row?.role ?? "");
@@ -72,30 +74,41 @@ function parseCookies(header) {
     }
     return result;
 }
+function bearerCredential(request) {
+    const authorization = request.get("authorization");
+    if (!authorization?.startsWith("Bearer "))
+        return null;
+    const token = authorization.slice(7).trim();
+    return token.length > 0 && token.length <= 200 ? token : null;
+}
 function apiKeyCredential(request) {
     const direct = request.get("x-scriverse-api-key")?.trim();
     if (direct)
         return direct;
-    const authorization = request.get("authorization");
-    if (!authorization?.startsWith("Bearer "))
-        return null;
-    return authorization.slice(7).trim();
+    const bearer = bearerCredential(request);
+    return bearer?.startsWith(apiKeyPrefix) ? bearer : null;
+}
+function desktopSessionCredential(request) {
+    const bearer = bearerCredential(request);
+    return bearer?.startsWith(DESKTOP_SESSION_TOKEN_PREFIX) ? bearer : null;
 }
 function mapUser(row) {
     const avatarSha256 = row.avatar_sha256 === null || row.avatar_sha256 === undefined
         ? null
         : String(row.avatar_sha256);
+    const isSystemAdmin = String(row.role) === "admin";
     return {
         userId: String(row.id),
         username: String(row.username),
         displayName: String(row.display_name),
-        role: String(row.role) === "admin" ? "admin" : "user",
+        role: isSystemAdmin ? "admin" : "user",
         status: String(row.status) === "disabled" ? "disabled" : "active",
         createdAt: String(row.created_at),
         avatarUrl: avatarSha256
             ? `/api/user-avatars/${encodeURIComponent(String(row.id))}?v=${encodeURIComponent(avatarSha256)}`
             : null,
-        onboardingCompleted: row.onboarding_completed_at !== null && row.onboarding_completed_at !== undefined
+        onboardingCompleted: row.onboarding_completed_at !== null && row.onboarding_completed_at !== undefined,
+        isSystemAdmin
     };
 }
 function passwordDigest(password, salt) {
@@ -116,6 +129,8 @@ function workIdFromPath(database, pathname) {
         return null;
     if (resource === "works" && decoded[3] && decoded[3].toLocaleLowerCase("en-US") !== "import")
         return decoded[3];
+    if (resource === "sync" && decoded[3]?.toLocaleLowerCase("en-US") === "works" && decoded[4])
+        return decoded[4];
     const tableByResource = {
         volumes: "volumes",
         chapters: "chapters",
@@ -173,10 +188,20 @@ function workIdFromPath(database, pathname) {
     }
     return null;
 }
+function apiKeyCiphertext(row) {
+    const encrypted = String(row?.key_encrypted ?? "");
+    const iv = String(row?.key_iv ?? "");
+    const tag = String(row?.key_tag ?? "");
+    if (!encrypted || !iv || !tag)
+        return null;
+    return { encrypted, iv, tag };
+}
 export class UserAuthService {
     database;
-    constructor(database) {
+    vault;
+    constructor(database, vault) {
         this.database = database;
+        this.vault = vault;
         const revokedAt = new Date().toISOString();
         const result = this.database.run("UPDATE user_sessions SET revoked_at = ? WHERE revoked_at IS NULL", revokedAt);
         if (result.changes > 0) {
@@ -204,10 +229,33 @@ export class UserAuthService {
         const sessionId = randomUUID();
         const timestamp = new Date();
         this.database.run(`INSERT INTO user_sessions (id, user_id, token_hash, csrf_token, created_at, expires_at, last_seen_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`, sessionId, userId, sha256(token), csrfToken, timestamp.toISOString(), new Date(timestamp.getTime() + sessionLifetimeMs).toISOString(), timestamp.toISOString());
+       VALUES (?, ?, ?, ?, ?, ?, ?)`, sessionId, userId, sha256(token), csrfToken, timestamp.toISOString(), new Date(timestamp.getTime() + SESSION_LIFETIME_MS).toISOString(), timestamp.toISOString());
         const user = this.getUser(userId);
         return { token, session: { id: sessionId, user, csrfToken } };
     }
+    createDesktopSession(userId, input) {
+        const token = `${DESKTOP_SESSION_TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
+        const sessionId = randomUUID();
+        const timestamp = new Date();
+        const createdAt = timestamp.toISOString();
+        const expiresAt = new Date(timestamp.getTime() + DESKTOP_SESSION_LIFETIME_MS).toISOString();
+        this.database.run(`UPDATE user_desktop_sessions SET revoked_at = ?
+       WHERE desktop_id = ? AND profile_id = ? AND revoked_at IS NULL`, createdAt, input.desktopId, input.profileId);
+        this.database.run(`INSERT INTO user_desktop_sessions (
+         id, user_id, token_hash, desktop_id, profile_id, client_version, created_at, expires_at, last_seen_at
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, sessionId, userId, sha256(token), input.desktopId, input.profileId, input.clientVersion, createdAt, expiresAt, createdAt);
+        return {
+            token,
+            session: {
+                id: sessionId,
+                user: this.getUser(userId),
+                desktopId: input.desktopId,
+                profileId: input.profileId,
+                clientVersion: input.clientVersion,
+                expiresAt
+            }
+        };
+    }
     register(input) {
         const normalizedUsername = normalizeUsername(input.username);
         const timestamp = new Date().toISOString();
@@ -229,9 +277,8 @@ export class UserAuthService {
             return this.createSession(userId);
         });
     }
-    login(username, password) {
+    validateLoginCredentials(username, password) {
         const normalizedUsername = normalizeUsername(username);
-        const timestamp = new Date();
         const row = this.database.get("SELECT * FROM users WHERE normalized_username = ?", normalizedUsername);
         const fallbackSalt = "invalid-login-salt";
         const calculated = passwordDigest(password, String(row?.password_salt ?? fallbackSalt));
@@ -245,15 +292,26 @@ export class UserAuthService {
             logger.warn("auth.login.failed", { reason: "account_disabled", actorRef: accountReference(user.userId) });
             throw new AppError(403, "ACCOUNT_DISABLED", "该账户已被停用");
         }
+        return { user, normalizedUsername, loginAt: new Date().toISOString() };
+    }
+    login(username, password) {
+        const validated = this.validateLoginCredentials(username, password);
         return this.database.transaction(() => {
-            const loginAt = timestamp.toISOString();
-            this.database.run("DELETE FROM login_attempts WHERE normalized_username = ?", normalizedUsername);
-            this.database.run("UPDATE users SET last_login_at = ?, updated_at = ? WHERE id = ?", loginAt, loginAt, user.userId);
-            return this.createSession(user.userId);
+            this.database.run("DELETE FROM login_attempts WHERE normalized_username = ?", validated.normalizedUsername);
+            this.database.run("UPDATE users SET last_login_at = ?, updated_at = ? WHERE id = ?", validated.loginAt, validated.loginAt, validated.user.userId);
+            return this.createSession(validated.user.userId);
+        });
+    }
+    loginDesktop(username, password, input) {
+        const validated = this.validateLoginCredentials(username, password);
+        return this.database.transaction(() => {
+            this.database.run("DELETE FROM login_attempts WHERE normalized_username = ?", validated.normalizedUsername);
+            this.database.run("UPDATE users SET last_login_at = ?, updated_at = ? WHERE id = ?", validated.loginAt, validated.loginAt, validated.user.userId);
+            return this.createDesktopSession(validated.user.userId, input);
         });
     }
     authenticate(request) {
-        const token = parseCookies(request.get("cookie")).get(sessionCookieName);
+        const token = parseCookies(request.get("cookie")).get(SESSION_COOKIE_NAME);
         if (!token)
             return null;
         const row = this.database.get(`SELECT session.id AS session_id, session.csrf_token, session.expires_at, session.revoked_at,
@@ -266,6 +324,30 @@ export class UserAuthService {
         this.database.run("UPDATE user_sessions SET last_seen_at = ? WHERE id = ?", new Date().toISOString(), String(row.session_id));
         return { id: String(row.session_id), csrfToken: String(row.csrf_token), user };
     }
+    authenticateDesktop(request) {
+        const token = desktopSessionCredential(request);
+        if (!token || token.length !== DESKTOP_SESSION_TOKEN_PREFIX.length + 43)
+            return null;
+        const row = this.database.get(`SELECT session.id AS session_id, session.desktop_id, session.profile_id, session.client_version,
+              session.expires_at, session.revoked_at, user.*
+       FROM user_desktop_sessions session
+       JOIN users user ON user.id = session.user_id
+       WHERE session.token_hash = ?`, sha256(token));
+        if (!row || row.revoked_at || String(row.expires_at) <= new Date().toISOString())
+            return null;
+        const user = mapUser(row);
+        if (user.status !== "active")
+            return null;
+        this.database.run("UPDATE user_desktop_sessions SET last_seen_at = ? WHERE id = ?", new Date().toISOString(), String(row.session_id));
+        return {
+            id: String(row.session_id),
+            user,
+            desktopId: String(row.desktop_id),
+            profileId: String(row.profile_id),
+            clientVersion: String(row.client_version),
+            expiresAt: String(row.expires_at)
+        };
+    }
     authenticateApiKey(request) {
         const key = apiKeyCredential(request);
         if (!key || !key.startsWith(apiKeyPrefix) || key.length > 200)
@@ -283,18 +365,22 @@ export class UserAuthService {
     hasApiKeyCredential(request) {
         return apiKeyCredential(request) !== null;
     }
+    hasDesktopSessionCredential(request) {
+        return desktopSessionCredential(request) !== null;
+    }
     getApiKeyStatus(userId) {
         this.getUser(userId);
         const row = this.database.get("SELECT * FROM user_api_keys WHERE user_id = ?", userId);
         if (!row) {
-            return { configured: false, prefix: null, createdAt: null, rotatedAt: null, lastUsedAt: null };
+            return { configured: false, prefix: null, createdAt: null, rotatedAt: null, lastUsedAt: null, copyable: false };
         }
         return {
             configured: true,
             prefix: String(row.key_prefix),
             createdAt: String(row.created_at),
             rotatedAt: String(row.rotated_at),
-            lastUsedAt: row.last_used_at === null ? null : String(row.last_used_at)
+            lastUsedAt: row.last_used_at === null ? null : String(row.last_used_at),
+            copyable: apiKeyCiphertext(row) !== null
         };
     }
     resetApiKey(userId) {
@@ -302,18 +388,40 @@ export class UserAuthService {
         const apiKey = `${apiKeyPrefix}${randomBytes(32).toString("base64url")}`;
         const prefix = apiKey.slice(0, 13);
         const timestamp = new Date().toISOString();
-        this.database.run(`INSERT INTO user_api_keys (user_id, key_hash, key_prefix, created_at, rotated_at, last_used_at)
-       VALUES (?, ?, ?, ?, ?, NULL)
+        const encrypted = this.vault.encrypt(apiKey);
+        this.database.run(`INSERT INTO user_api_keys (user_id, key_hash, key_prefix, created_at, rotated_at, last_used_at, key_encrypted, key_iv, key_tag)
+       VALUES (?, ?, ?, ?, ?, NULL, ?, ?, ?)
        ON CONFLICT(user_id) DO UPDATE SET
          key_hash = excluded.key_hash,
          key_prefix = excluded.key_prefix,
          rotated_at = excluded.rotated_at,
-         last_used_at = NULL`, userId, sha256(apiKey), prefix, timestamp, timestamp);
+         last_used_at = NULL,
+         key_encrypted = excluded.key_encrypted,
+         key_iv = excluded.key_iv,
+         key_tag = excluded.key_tag`, userId, sha256(apiKey), prefix, timestamp, timestamp, encrypted.encrypted, encrypted.iv, encrypted.tag);
         return { ...this.getApiKeyStatus(userId), apiKey };
     }
+    revealApiKey(userId) {
+        this.getUser(userId);
+        const row = this.database.get("SELECT * FROM user_api_keys WHERE user_id = ?", userId);
+        if (!row)
+            throw new AppError(404, "API_KEY_NOT_CONFIGURED", "尚未生成 API Key");
+        const ciphertext = apiKeyCiphertext(row);
+        if (!ciphertext)
+            throw new AppError(409, "API_KEY_NOT_RECOVERABLE", "当前 API Key 无法复制，请重置后再试");
+        try {
+            return { apiKey: this.vault.decrypt(ciphertext), prefix: String(row.key_prefix) };
+        }
+        catch {
+            throw new AppError(409, "API_KEY_NOT_RECOVERABLE", "当前 API Key 无法复制，请重置后再试");
+        }
+    }
     revoke(sessionId) {
         this.database.run("UPDATE user_sessions SET revoked_at = ? WHERE id = ?", new Date().toISOString(), sessionId);
     }
+    revokeDesktop(sessionId) {
+        this.database.run("UPDATE user_desktop_sessions SET revoked_at = ? WHERE id = ?", new Date().toISOString(), sessionId);
+    }
     getUser(userId) {
         const row = this.database.get("SELECT * FROM users WHERE id = ?", userId);
         if (!row)
@@ -365,7 +473,9 @@ export class UserAuthService {
         return this.database.transaction(() => {
             this.database.run("UPDATE users SET role = ?, status = ?, updated_at = ? WHERE id = ?", nextRole, nextStatus, new Date().toISOString(), userId);
             if (nextStatus === "disabled") {
-                this.database.run("UPDATE user_sessions SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL", new Date().toISOString(), userId);
+                const revokedAt = new Date().toISOString();
+                this.database.run("UPDATE user_sessions SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL", revokedAt, userId);
+                this.database.run("UPDATE user_desktop_sessions SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL", revokedAt, userId);
             }
             return this.getUser(userId);
         });
@@ -417,7 +527,7 @@ export class UserAuthService {
         });
         return this.getUser(userId);
     }
-    changePassword(userId, sessionId, currentPassword, newPassword) {
+    changePassword(userId, sessionId, currentPassword, newPassword, sessionKind = "browser") {
         const row = this.database.get("SELECT * FROM users WHERE id = ?", userId);
         if (!row)
             throw notFound("用户");
@@ -428,7 +538,10 @@ export class UserAuthService {
         const timestamp = new Date().toISOString();
         this.database.transaction(() => {
             this.database.run("UPDATE users SET password_hash = ?, password_salt = ?, updated_at = ? WHERE id = ?", passwordDigest(newPassword, salt), salt, timestamp, userId);
-            this.database.run("UPDATE user_sessions SET revoked_at = ? WHERE user_id = ? AND id <> ? AND revoked_at IS NULL", timestamp, userId, sessionId);
+            this.database.run(`UPDATE user_sessions SET revoked_at = ?
+         WHERE user_id = ? AND (? <> 'browser' OR id <> ?) AND revoked_at IS NULL`, timestamp, userId, sessionKind, sessionId);
+            this.database.run(`UPDATE user_desktop_sessions SET revoked_at = ?
+         WHERE user_id = ? AND (? <> 'desktop' OR id <> ?) AND revoked_at IS NULL`, timestamp, userId, sessionKind, sessionId);
             this.database.run("DELETE FROM login_attempts WHERE normalized_username = ?", String(row.normalized_username));
         });
     }
@@ -580,16 +693,16 @@ export class UserAuthService {
     }
 }
 export function setSessionCookie(response, token, secure) {
-    response.cookie(sessionCookieName, token, {
+    response.cookie(SESSION_COOKIE_NAME, token, {
         httpOnly: true,
         sameSite: "lax",
         secure,
         path: "/",
-        maxAge: sessionLifetimeMs
+        maxAge: SESSION_LIFETIME_MS
     });
 }
 export function clearSessionCookie(response, secure) {
-    response.clearCookie(sessionCookieName, { httpOnly: true, sameSite: "lax", secure, path: "/" });
+    response.clearCookie(SESSION_COOKIE_NAME, { httpOnly: true, sameSite: "lax", secure, path: "/" });
 }
 export function createUserSessionMiddleware(auth, disabledOrOptions = false) {
     const options = typeof disabledOrOptions === "boolean"
@@ -605,18 +718,36 @@ export function createUserSessionMiddleware(auth, disabledOrOptions = false) {
             }
             return runWithRequestActor(null, next);
         }
-        const apiKey = auth.authenticateApiKey(request);
-        if (auth.hasApiKeyCredential(request) && !apiKey) {
+        const apiKeyProvided = auth.hasApiKeyCredential(request);
+        const desktopSessionProvided = auth.hasDesktopSessionCredential(request);
+        if (apiKeyProvided && desktopSessionProvided) {
+            logger.warn("auth.request.rejected", { reason: "conflicting_credentials", method: request.method, path: sanitizeRequestPath(request.path) });
+            response.status(400).json({ error: { code: "AUTH_CREDENTIAL_CONFLICT", message: "请求包含相互冲突的身份凭据" } });
+            return;
+        }
+        const apiKey = apiKeyProvided ? auth.authenticateApiKey(request) : null;
+        if (apiKeyProvided && !apiKey) {
             logger.warn("auth.request.rejected", { reason: "invalid_api_key", method: request.method, path: sanitizeRequestPath(request.path) });
             response.status(401).json({ error: { code: "API_KEY_INVALID", message: "API Key 无效或已失效" } });
             return;
         }
-        const session = apiKey ? null : auth.authenticate(request);
+        const desktopSession = desktopSessionProvided ? auth.authenticateDesktop(request) : null;
+        if (desktopSessionProvided && !desktopSession) {
+            logger.warn("auth.request.rejected", { reason: "invalid_desktop_session", method: request.method, path: sanitizeRequestPath(request.path) });
+            response.status(401).json({ error: { code: "DESKTOP_SESSION_INVALID", message: "Desktop 登录已失效，请重新登录" } });
+            return;
+        }
+        const session = apiKey || desktopSession ? null : auth.authenticate(request);
         if (apiKey) {
             request.authApiKey = apiKey;
             request.authUser = apiKey.user;
             request.authMethod = "api-key";
         }
+        else if (desktopSession) {
+            request.authDesktopSession = desktopSession;
+            request.authUser = desktopSession.user;
+            request.authMethod = "desktop-session";
+        }
         else if (session) {
             request.authSession = session;
             request.authUser = session.user;
@@ -627,8 +758,9 @@ export function createUserSessionMiddleware(auth, disabledOrOptions = false) {
             || path === "/api/auth/session"
             || (path === "/api/auth/register" && request.method === "POST")
             || (path === "/api/auth/login" && request.method === "POST")
+            || (path === "/api/desktop/auth/login" && request.method === "POST")
             || !path.startsWith("/api/");
-        if (!session && !apiKey && !isPublic) {
+        if (!session && !desktopSession && !apiKey && !isPublic) {
             logger.warn("auth.request.rejected", { reason: "authentication_required", method: request.method, path: sanitizeRequestPath(request.path) });
             response.status(401).json({ error: { code: "AUTH_REQUIRED", message: "请先登录" } });
             return;
@@ -641,10 +773,11 @@ export function createUserSessionMiddleware(auth, disabledOrOptions = false) {
                 return;
             }
         }
-        const user = apiKey?.user ?? session?.user ?? null;
-        return runWithRequestActor(user ? { ...user, authentication: apiKey ? "api-key" : "session" } : null, () => {
+        const user = apiKey?.user ?? desktopSession?.user ?? session?.user ?? null;
+        const authMethod = apiKey ? "api-key" : desktopSession ? "desktop-session" : "session";
+        return runWithRequestActor(user ? { ...user, authentication: authMethod } : null, () => {
             if (user)
-                logger.debug("auth.request.authenticated", { authMethod: apiKey ? "api-key" : "session" });
+                logger.debug("auth.request.authenticated", { authMethod });
             next();
         });
     };
@@ -762,11 +895,37 @@ function globalReplaceWriteModules(request) {
         return ["prose", "settings"];
     return [];
 }
+function syncPushWriteModules(request) {
+    const mutations = requestBodyRecord(request).mutations;
+    if (!Array.isArray(mutations))
+        return [];
+    const modules = new Set();
+    for (const mutation of mutations) {
+        if (!mutation || typeof mutation !== "object" || Array.isArray(mutation))
+            continue;
+        const entityType = mutation.entityType;
+        if (entityType === "chapter")
+            modules.add("prose");
+        if (entityType === "setting")
+            modules.add("settings");
+    }
+    return [...modules];
+}
 function workModuleRequirements(request, write, annotationAccess) {
     const pathname = normalizeApiPath(request.path);
     const direct = (module, extraWrite = []) => (write ? { write: [module, ...extraWrite] } : { read: [module] });
+    if (/^\/api\/sync\/works\/[^/]+\/snapshots$/u.test(pathname))
+        return { read: ["prose", "settings"] };
+    if (/^\/api\/sync\/works\/[^/]+\/changes$/u.test(pathname))
+        return { read: ["prose", "settings"] };
+    if (/^\/api\/sync\/works\/[^/]+\/push$/u.test(pathname))
+        return { write: syncPushWriteModules(request) };
+    if (/^\/api\/sync\/works\/[^/]+\/mutations\/[^/]+$/u.test(pathname))
+        return { read: ["prose", "settings"] };
     if (/^\/api\/works\/[^/]+$/u.test(pathname))
         return write ? { ownerOnly: true } : {};
+    if (/^\/api\/works\/[^/]+\/offline-access$/u.test(pathname))
+        return { ownerOnly: true };
     if (/^\/api\/works\/[^/]+\/cover$/u.test(pathname))
         return write ? { ownerOnly: true } : {};
     if (/^\/api\/works\/[^/]+\/members(?:\/[^/]+)?$/u.test(pathname))