@oj-module/cli 0.2.2 → 0.2.6

package/src/lifecycle/__tests__/trust.test.ts

@@ -0,0 +1,177 @@
+import process from "node:process";
+// BDD：ojm trust 瘦客户端（P2-2，C2-38/39）——纯转发（uninstall.test.ts 同范式）：
+// 登录 → GET/POST/DELETE /api/_platform/market/trust* → 打印人话；fetch 全 stub 不真发网络。
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { formatFingerprint, trustCommand } from "../../trust";
+
+function fetchStub(handlers: Record<string, (url: string, init?: RequestInit) => unknown>): {
+	fetchFn: typeof fetch
+	calls: { url: string, init?: RequestInit }[]
+} {
+	const calls: { url: string, init?: RequestInit }[] = [];
+	const fetchFn = (async (url: string | URL, init?: RequestInit) => {
+		const u = String(url);
+		calls.push({ url: u, init });
+		for (const [prefix, handler] of Object.entries(handlers)) {
+			if (u.includes(prefix))
+				return handler(u, init);
+		}
+		throw new Error(`fetchStub 未覆盖：${u}`);
+	}) as typeof fetch;
+	return { fetchFn, calls };
+}
+
+const ok = (data: unknown) => ({ ok: true, status: 200, text: async () => JSON.stringify({ code: 0, data }) });
+
+const KEY_A = { key_id: "ojm.test", public_key: "a".repeat(64), added_at: 1730000000000 };
+
+let logs: string[];
+
+beforeEach(() => {
+	logs = [];
+	vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => {
+		logs.push(args.map(String).join(" "));
+	});
+});
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+const SITE = { url: "http://x", user: "u", pass: "p" };
+
+describe("trustCommand · ls（P2-2）", () => {
+	it("登录后 GET /market/trust → 逐行打印 key_id + 分组指纹", async () => {
+		const { fetchFn, calls } = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/trust": () => ok({ keys: [KEY_A], note: null }),
+		});
+		await trustCommand("ls", [], { ...SITE, fetchFn });
+		expect(calls[1]?.url).toContain("/api/_platform/market/trust");
+		expect(calls[1]?.init?.method).toBe("GET");
+		expect((calls[1]?.init?.headers as Record<string, string>).authorization).toBe("Bearer tok");
+		const out = logs.join("\n");
+		expect(out).toContain("ojm.test");
+		expect(out).toMatch(/fp=([0-9a-f]{8} ){7}[0-9a-f]{8}/); // 64hex 分 8 组
+	});
+
+	it("空库 → 可读空态；note 在场（.bak 回落）→ 先打注意行", async () => {
+		const { fetchFn } = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/trust": () => ok({ keys: [], note: "x 损坏，已自动回落 x.bak" }),
+		});
+		await trustCommand("ls", [], { ...SITE, fetchFn });
+		expect(logs.join("\n")).toContain("已自动回落");
+	});
+});
+
+describe("trustCommand · add / revoke（P2-2）", () => {
+	it("add：POST {key_id, public_key}；added / exists_same 两种回显", async () => {
+		const added = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/trust/key": () => ok({ result: "added" }),
+		});
+		await trustCommand("add", ["ojm.test", "a".repeat(64)], { ...SITE, fetchFn: added.fetchFn });
+		const call = added.calls[1]!;
+		expect(call.init?.method).toBe("POST");
+		expect(JSON.parse(String(call.init?.body))).toEqual({ key_id: "ojm.test", public_key: "a".repeat(64) });
+		expect(logs.join("\n")).toContain("已信任发布方：ojm.test");
+
+		const idem = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/trust/key": () => ok({ result: "exists_same" }),
+		});
+		await trustCommand("add", ["ojm.test", "a".repeat(64)], { ...SITE, fetchFn: idem.fetchFn });
+		expect(logs.join("\n")).toContain("无需重复添加");
+	});
+
+	it("add 缺参 → 人话用法报错（不发网络）", async () => {
+		const { fetchFn, calls } = fetchStub({});
+		await expect(trustCommand("add", ["ojm.test"], { ...SITE, fetchFn })).rejects.toThrow(/用法/);
+		expect(calls).toHaveLength(0);
+	});
+
+	it("revoke：DELETE ?key_id=（URI 编码）；revoked=false 置 exitCode 1", async () => {
+		const exitBackup = process.exitCode;
+		process.exitCode = 0;
+		try {
+			const yes = fetchStub({
+				"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+				"/api/_platform/market/trust/key": () => ok({ revoked: true }),
+			});
+			await trustCommand("revoke", ["ojm.test"], { ...SITE, fetchFn: yes.fetchFn });
+			const call = yes.calls[1]!;
+			expect(call.init?.method).toBe("DELETE");
+			expect(call.url).toContain("/api/_platform/market/trust/key?key_id=ojm.test");
+			expect(process.exitCode).toBe(0);
+
+			process.exitCode = 0;
+			const no = fetchStub({
+				"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+				"/api/_platform/market/trust/key": () => ok({ revoked: false }),
+			});
+			await trustCommand("revoke", ["nope.key"], { ...SITE, fetchFn: no.fetchFn });
+			expect(process.exitCode).toBe(1);
+			expect(logs.join("\n")).toContain("无此 key_id");
+		}
+		finally {
+			process.exitCode = exitBackup;
+		}
+	});
+
+	it("未知子命令 → 人话报错（列可用子命令）", async () => {
+		const { fetchFn } = fetchStub({});
+		await expect(trustCommand("frobnicate", [], { ...SITE, fetchFn })).rejects.toThrow(/可用：ls/);
+	});
+});
+
+describe("trustCommand · confirm（P2-3 TOFU 确认链）", () => {
+	const needsTrustTask = {
+		id: "install-1-abc",
+		name: "demo-solution",
+		version: "0.1.0",
+		status: "needs_trust",
+		stage: "verifying",
+		trust: { key_id: "stranger.pub", public_key: "b".repeat(64), fingerprint: "f".repeat(64) },
+	};
+
+	it("先展示指纹再调端点：GET task → 打印 key_id + 分组指纹 → POST /market/trust {task_id}", async () => {
+		const { fetchFn, calls } = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/task": () => ok(needsTrustTask),
+			"/api/_platform/market/trust": () => ok({ result: "added", key_id: "stranger.pub" }),
+		});
+		await trustCommand("confirm", [], { ...SITE, task: "install-1-abc", fetchFn });
+		// 调用序：登录 → GET task → POST trust
+		expect(calls[1]?.url).toContain("/api/_platform/market/task?id=install-1-abc");
+		expect(calls[2]?.init?.method).toBe("POST");
+		expect(calls[2]?.url).toContain("/api/_platform/market/trust");
+		expect(JSON.parse(String(calls[2]?.init?.body))).toEqual({ task_id: "install-1-abc" });
+		const out = logs.join("\n");
+		expect(out).toContain("stranger.pub");
+		expect(out).toMatch(/ffffffff ffffffff ffffffff ffffffff/); // 指纹分组先于人看到
+		expect(out).toContain("已信任发布方：stranger.pub");
+		expect(out).toContain("重试安装命令即可继续");
+	});
+
+	it("任务非 needs_trust → 本地可读报错（不发确认请求）", async () => {
+		const { fetchFn, calls } = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/task": () => ok({ ...needsTrustTask, status: "done", trust: undefined }),
+		});
+		await expect(trustCommand("confirm", [], { ...SITE, task: "install-1-abc", fetchFn })).rejects.toThrow(/不在待信任确认状态/);
+		expect(calls).toHaveLength(2); // 登录 + GET task，无 POST
+	});
+
+	it("缺 --task → 用法报错（不发网络）", async () => {
+		const { fetchFn, calls } = fetchStub({});
+		await expect(trustCommand("confirm", [], { ...SITE, fetchFn })).rejects.toThrow(/--task/);
+		expect(calls).toHaveLength(0);
+	});
+});
+
+describe("formatFingerprint（契约 §2.11 展示口径）", () => {
+	it("64hex → 8 组 × 8 字符空格分隔", () => {
+		expect(formatFingerprint("0".repeat(64))).toBe("00000000 ".repeat(8).trim());
+	});
+});

package/src/lifecycle/__tests__/uninstall.test.ts

@@ -0,0 +1,87 @@
+import process from "node:process";
+// BDD：ojm uninstall 瘦客户端（P1-15a 缺口 B，D6/D8 同款）——纯转发：
+// 登录 → POST /api/_platform/market/uninstall {name} → 打印服务端人话 message；
+// ok:false（未装/空锁拒启）置 exitCode 1。fetch 全 stub 不真发网络（install.test.ts 同范式）。
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { uninstallCommand } from "../../uninstall";
+
+/** fetch stub：按 URL 前缀分发，记录全部调用（url + init） */
+function fetchStub(handlers: Record<string, (url: string, init?: RequestInit) => unknown>): {
+	fetchFn: typeof fetch
+	calls: { url: string, init?: RequestInit }[]
+} {
+	const calls: { url: string, init?: RequestInit }[] = [];
+	const fetchFn = (async (url: string | URL, init?: RequestInit) => {
+		const u = String(url);
+		calls.push({ url: u, init });
+		for (const [prefix, handler] of Object.entries(handlers)) {
+			if (u.includes(prefix))
+				return handler(u, init);
+		}
+		throw new Error(`fetchStub 未覆盖：${u}`);
+	}) as typeof fetch;
+	return { fetchFn, calls };
+}
+
+const ok = (data: unknown) => ({ ok: true, status: 200, text: async () => JSON.stringify({ code: 0, data }) });
+
+let logs: string[];
+
+beforeEach(() => {
+	logs = [];
+	vi.spyOn(console, "log").mockImplementation((...args: unknown[]) => {
+		logs.push(args.map(String).join(" "));
+	});
+});
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+describe("uninstallCommand · 卸载瘦客户端（P1-15a 缺口 B）", () => {
+	it("登录后 POST uninstall {name}（Bearer 注入）→ 打印服务端 message", async () => {
+		const { fetchFn, calls } = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/uninstall": () => ok({ ok: true, message: "卸载完成：四处同删（demo-solution@0.1.0）" }),
+		});
+		await uninstallCommand("demo-solution", { url: "http://x", user: "u", pass: "p", fetchFn });
+		// 登录体 + uninstall JSON 体 + Bearer
+		expect(JSON.parse(String(calls[0]?.init?.body))).toEqual({ username: "u", password: "p" });
+		const call = calls[1]!;
+		expect(call.url).toContain("/api/_platform/market/uninstall");
+		expect(call.init?.method).toBe("POST");
+		expect((call.init?.headers as Record<string, string>).authorization).toBe("Bearer tok");
+		expect(JSON.parse(String(call.init?.body))).toEqual({ name: "demo-solution" });
+		expect(logs.join("\n")).toContain("卸载完成：四处同删（demo-solution@0.1.0）");
+	});
+
+	it("ok:false（域逻辑拒绝）→ message 照打 + exitCode 1", async () => {
+		const { fetchFn } = fetchStub({
+			"/api/auth/login": () => ok({ access_token: "tok", refresh_token: "r", expires_in: 1 }),
+			"/api/_platform/market/uninstall": () => ok({ ok: false, message: "卸载失败：「x」未安装（锁与 sidecar 均无记录）" }),
+		});
+		const exitBackup = process.exitCode;
+		process.exitCode = 0;
+		try {
+			await uninstallCommand("x", { url: "http://x", user: "u", pass: "p", fetchFn });
+			expect(process.exitCode).toBe(1);
+		}
+		finally {
+			process.exitCode = exitBackup;
+		}
+		expect(logs.join("\n")).toContain("未安装");
+	});
+
+	it("空名 → 人话用法报错（不发网络）", async () => {
+		const { fetchFn, calls } = fetchStub({});
+		await expect(uninstallCommand("", { url: "http://x", user: "u", pass: "p", fetchFn })).rejects.toThrow(/用法/);
+		expect(calls).toHaveLength(0);
+	});
+
+	it("信封非 0：可读报错（code + msg）", async () => {
+		const { fetchFn } = fetchStub({
+			"/api/auth/login": () => ({ ok: true, status: 200, text: async () => JSON.stringify({ code: 403, msg: "forbidden" }) }),
+		});
+		await expect(uninstallCommand("x", { url: "http://x", user: "u", pass: "p", fetchFn })).rejects.toThrow(/forbidden/);
+	});
+});

package/src/lifecycle/keygen.ts

@@ -0,0 +1,40 @@
+// 密钥工具（P2-1）：Ed25519 密钥对生成与 PEM 读写。
+// 与 sign.ts 的分界（SRP）：sign.ts 管「签/验/规范串」语义，本文件管「key 生命周期」。
+// CLI 命令接线（ojm keygen 的 --out 警告/0600 落盘）属 P2-4；此处只交付纯函数面。
+// 站点既有 RSA cert 对 / X25519 secrets 对不可复用（算法不符、per-site、已暴露）——
+// bootstrap key 与本工具一律新生成 Ed25519（执行计划 §0 bootstrap key 定性）。
+import type { Buffer } from "node:buffer";
+import { generateKeyPairSync } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+export interface KeyPair {
+	/** 32B raw 公钥 hex（契约 C2-35 public_key 字段口径） */
+	publicKeyHex: string
+	/** PKCS#8 PEM 私钥（写盘 0600；永不入日志/任务记录——P2-5 redact 钉面） */
+	privateKeyPem: string
+}
+
+/** 生成 Ed25519 密钥对（Node 侧唯一入口；确定性由 Ed25519 算法本身保证同 key 同签） */
+export function generateKeyPair(): KeyPair {
+	const { privateKey, publicKey } = generateKeyPairSync("ed25519", {
+		publicKeyEncoding: { format: "der", type: "spki" },
+		privateKeyEncoding: { format: "pem", type: "pkcs8" },
+	});
+	const spki = publicKey as Buffer;
+	const raw = spki.subarray(spki.length - 32);
+	return { publicKeyHex: raw.toString("hex"), privateKeyPem: privateKey as string };
+}
+
+/** 从 PEM 文件加载私钥（不存在/形状错抛可读错误——fail-closed 不做静默回落） */
+export function readPrivateKeyPem(file: string): string {
+	let pem: string;
+	try {
+		pem = readFileSync(file, "utf8");
+	}
+	catch (e) {
+		throw new Error(`[ojm] 私钥文件读取失败：${file}（${String(e)}）`);
+	}
+	if (!pem.includes("PRIVATE KEY"))
+		throw new Error(`[ojm] 不是合法 PEM 私钥文件：${file}`);
+	return pem;
+}

package/src/lifecycle/sign.ts

@@ -0,0 +1,74 @@
+// 签名纯函数（P2-1，契约 v1.3 §2.11 / C2-34~36）。
+// 与 oj isolate 侧（P2-3 steps/verify.ts + CryptoFace.verifyEd25519）三方同语义：
+// 规范串逐字、编码严格拒（不做归一）、确定性签名。isolate 面无 node:crypto，
+// 其实现由上游原语承担；本文件是 Node 侧（ojm sign/深检/夹具）唯一实现，
+// 与 isolate 面的一致性由 P2-0 夹具 + 本 spec 的夹具对拍钉住。
+import { Buffer } from "node:buffer";
+import { createHash, createPrivateKey, createPublicKey, sign as nodeSign, verify as nodeVerify } from "node:crypto";
+
+/** 规范串版本标记（契约 §2.11：canon 字段恒 "v1"） */
+export const CANON = "v1";
+/** 签名算法标识（大小写敏感，契约 §2.11 / C2-35） */
+export const SIG_ALG = "Ed25519";
+
+const HEX64 = /^[0-9a-f]{64}$/;
+/** 标准 base64（契约 C2-36：含 -/_ 即 base64url，一律拒，禁归一） */
+const STD_B64 = /^[A-Z0-9+/]+={0,2}$/i;
+/** Ed25519 SPKI DER 前缀（12B）+ 32B raw 公钥；从 PEM 导出 raw hex 用 */
+const SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+/**
+ * 规范串（C2-34，拼接式逐字）：`<name>@<version>:<sha256>`。
+ * name/version 取 bundle manifest 值，sha256 = tgz 字节 sha256（hex 小写）；
+ * 禁止自造分隔符/归一化/大小写变换——两端与夹具三方逐字一致的前提。
+ */
+export function canonicalString(name: string, version: string, sha256: string): string {
+	return `${name}@${version}:${sha256}`;
+}
+
+/** 指纹 = sha256Hex(publicKey) 全 64 hex（契约 §2.11，TOFU 展示用） */
+export function fingerprintOfPublicKey(publicKeyHex: string): string {
+	if (!HEX64.test(publicKeyHex))
+		throw new Error(`[ojm] 公钥不是 64 hex：${publicKeyHex.slice(0, 8)}…`);
+	return createHashSha256(Buffer.from(publicKeyHex, "hex"));
+}
+
+/** 用私钥 PEM 签规范串，返回标准 base64（C2-35 value 字段口径） */
+export function signCanonical(privateKeyPem: string, canonical: string): string {
+	const key = createPrivateKey(privateKeyPem);
+	return nodeSign(null, Buffer.from(canonical, "utf8"), key).toString("base64");
+}
+
+/** 从私钥 PEM 导出 32B raw 公钥 hex（C2-35 public_key 字段口径） */
+export function exportRawPublicKeyHex(privateKeyPem: string): string {
+	const spki = createPublicKey(createPrivateKey(privateKeyPem)).export({ format: "der", type: "spki" }) as Buffer;
+	if (spki.length !== SPKI_PREFIX.length + 32 || !spki.subarray(0, SPKI_PREFIX.length).equals(SPKI_PREFIX))
+		throw new Error("[ojm] 私钥不是 Ed25519（SPKI 形状不符）");
+	return spki.subarray(SPKI_PREFIX.length).toString("hex");
+}
+
+/**
+ * 验签（与上游 crypto.verifyEd25519 / Node crypto.verify 同语义）。
+ * **严格拒不做归一**：public_key 非 64hex、value 非标准 base64（含 -/_）→ false；
+ * 形状合法但验不过 → false。分码（sig_format vs tampered）由调用方结构校验序负责（P2-3）。
+ */
+export function verifyCanonical(publicKeyHex: string, canonical: string, sigB64: string): boolean {
+	if (!HEX64.test(publicKeyHex) || !STD_B64.test(sigB64))
+		return false;
+	try {
+		const key = createPublicKey({
+			key: Buffer.concat([SPKI_PREFIX, Buffer.from(publicKeyHex, "hex")]),
+			format: "der",
+			type: "spki",
+		});
+		return nodeVerify(null, Buffer.from(canonical, "utf8"), key, Buffer.from(sigB64, "base64"));
+	}
+	catch {
+		return false; // 形状逃逸检测的极端输入（如非 base64 解码残留）同样拒
+	}
+}
+
+// node:crypto 的 sha256 仅指纹一处使用——独立小封装，避免把 hash 面扩散成第二契约
+function createHashSha256(data: Buffer): string {
+	return createHash("sha256").update(data).digest("hex");
+}