@pippit-dev/cli 1.0.17 → 1.0.18

package/internal/auth/browser_darwin.go

@@ -0,0 +1,14 @@
+//go:build darwin
+
+package auth
+
+import (
+	"os"
+	"os/exec"
+)
+
+func OpenBrowser(rawURL string) error {
+	command := exec.Command("open", rawURL)
+	command.Env = SanitizedBrowserEnv(os.Environ())
+	return command.Start()
+}

package/internal/auth/browser_env.go

@@ -0,0 +1,35 @@
+package auth
+
+import "strings"
+
+// SanitizedBrowserEnv removes Pippit/XYQ credential variables before spawning
+// a browser helper. The login URL carries its own one-time binding and does not
+// need any CLI credential from the child process environment.
+func SanitizedBrowserEnv(environment []string) []string {
+	result := make([]string, 0, len(environment))
+	for _, entry := range environment {
+		name, _, found := strings.Cut(entry, "=")
+		if !found || isCredentialEnvName(name) {
+			continue
+		}
+		result = append(result, entry)
+	}
+	return result
+}
+
+func isCredentialEnvName(name string) bool {
+	upper := strings.ToUpper(strings.TrimSpace(name))
+	if !strings.HasPrefix(upper, "PIPPIT_") && !strings.HasPrefix(upper, "XYQ_") {
+		return false
+	}
+	if strings.Contains(upper, "ACCESS_KEY") || strings.Contains(upper, "TOKEN") || strings.Contains(upper, "SECRET") {
+		return true
+	}
+	parts := strings.Split(upper, "_")
+	for _, part := range parts {
+		if part == "AK" {
+			return true
+		}
+	}
+	return false
+}

package/internal/auth/browser_linux.go

@@ -0,0 +1,14 @@
+//go:build linux
+
+package auth
+
+import (
+	"os"
+	"os/exec"
+)
+
+func OpenBrowser(rawURL string) error {
+	command := exec.Command("xdg-open", rawURL)
+	command.Env = SanitizedBrowserEnv(os.Environ())
+	return command.Start()
+}

package/internal/auth/browser_windows.go

@@ -0,0 +1,14 @@
+//go:build windows
+
+package auth
+
+import (
+	"os"
+	"os/exec"
+)
+
+func OpenBrowser(rawURL string) error {
+	command := exec.Command("rundll32", "url.dll,FileProtocolHandler", rawURL)
+	command.Env = SanitizedBrowserEnv(os.Environ())
+	return command.Start()
+}

package/internal/auth/identity.go

@@ -0,0 +1,89 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"io"
+	"strings"
+)
+
+func randomEncoded(reader io.Reader, size int) (string, error) {
+	if reader == nil {
+		reader = rand.Reader
+	}
+	value := make([]byte, size)
+	if _, err := io.ReadFull(reader, value); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(value), nil
+}
+
+func randomTempName() (string, error) {
+	value, err := randomEncoded(rand.Reader, 18)
+	if err != nil {
+		return "", err
+	}
+	return ".credential-" + value + ".tmp", nil
+}
+
+func validDeviceID(deviceID string) bool {
+	decoded, err := base64.RawURLEncoding.DecodeString(deviceID)
+	return err == nil && len(decoded) == deviceIDBytes &&
+		constantTimeEqual(deviceID, base64.RawURLEncoding.EncodeToString(decoded))
+}
+
+func credentialScope(uid, deviceID string) string {
+	return "pippit-tool-cli:user:" + accountBinding(uid) + ":device:" + deviceID
+}
+
+func accountBinding(uid string) string {
+	digest := sha256.Sum256([]byte(strings.TrimSpace(uid)))
+	return base64.RawURLEncoding.EncodeToString(digest[:16])
+}
+
+func accountBindingFromCredentialScope(scope, deviceID string) (string, bool) {
+	prefix := "pippit-tool-cli:user:"
+	suffix := ":device:" + deviceID
+	if !strings.HasPrefix(scope, prefix) || !strings.HasSuffix(scope, suffix) {
+		return "", false
+	}
+	binding := strings.TrimSuffix(strings.TrimPrefix(scope, prefix), suffix)
+	return binding, validAccountBinding(binding)
+}
+
+func legacyCredentialScope(deviceID string) string {
+	return "pippit-tool-cli:device:" + deviceID
+}
+
+func constantTimeEqual(left, right string) bool {
+	leftHash := sha256.Sum256([]byte(left))
+	rightHash := sha256.Sum256([]byte(right))
+	return subtle.ConstantTimeCompare(leftHash[:], rightHash[:]) == 1
+}
+
+func newIdentity(reader io.Reader) (*Credential, error) {
+	deviceID, err := randomEncoded(reader, deviceIDBytes)
+	if err != nil {
+		return nil, errors.New("生成本机登录设备标识失败")
+	}
+	return &Credential{
+		Version:  credentialVersion,
+		DeviceID: deviceID,
+	}, nil
+}
+
+func identityOnly(credential *Credential) *Credential {
+	if credential == nil {
+		return nil
+	}
+	return &Credential{
+		Version:  credential.Version,
+		DeviceID: credential.DeviceID,
+		// TokenID is a non-secret exact selector used by the Web page to reuse the
+		// same remote token after logout instead of consuming another AK slot.
+		TokenID: credential.TokenID,
+	}
+}

package/internal/auth/loopback.go

@@ -0,0 +1,324 @@
+package auth
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+)
+
+const maxCallbackBodyBytes = 64 << 10
+
+const maxInjectedCallbackQueryValueBytes = 4 << 10
+
+type accessKeyPayload struct {
+	Type            string `json:"type"`
+	AccessKey       string `json:"access_key"`
+	UID             string `json:"uid"`
+	TokenID         string `json:"token_id"`
+	ExpiredAt       int64  `json:"expired_at"`
+	RandomSecretKey string `json:"random_secret_key"`
+	Source          string `json:"source"`
+	CallbackURL     string `json:"callback_url"`
+}
+
+type browserFlow struct {
+	loginURL     string
+	callbackURL  string
+	secret       string
+	state        string
+	source       string
+	origin       string
+	listener     net.Listener
+	server       *http.Server
+	payload      chan accessKeyPayload
+	serveErr     chan error
+	callbackOnce sync.Once
+	closeOnce    sync.Once
+}
+
+func startBrowserFlow(authBaseURL *url.URL, randomReader io.Reader, deviceID, tokenID, expectedAccount string, forceRefresh bool) (*browserFlow, error) {
+	if !validDeviceID(deviceID) {
+		return nil, errors.New("本机登录设备标识无效")
+	}
+	if tokenID != "" && !validTokenID(tokenID) {
+		return nil, errors.New("本机 CLI 凭证编号无效")
+	}
+	if forceRefresh && tokenID == "" {
+		return nil, errors.New("无法确认需要轮换的本机 CLI 凭证编号")
+	}
+	if expectedAccount != "" && !validAccountBinding(expectedAccount) {
+		return nil, errors.New("本机登录账号绑定无效")
+	}
+	if forceRefresh && expectedAccount == "" {
+		return nil, errors.New("无法确认需要轮换的本机 CLI 登录账号")
+	}
+	secret, err := randomEncoded(randomReader, randomBindingBytes)
+	if err != nil {
+		return nil, errors.New("生成网页授权绑定信息失败")
+	}
+	state, err := randomEncoded(randomReader, randomBindingBytes)
+	if err != nil {
+		return nil, errors.New("生成网页授权状态失败")
+	}
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		return nil, errors.New("启动本机网页授权回调失败")
+	}
+
+	callback := &url.URL{
+		Scheme: "http",
+		Host:   listener.Addr().String(),
+		Path:   callbackPath,
+	}
+	callbackQuery := callback.Query()
+	callbackQuery.Set("state", state)
+	callback.RawQuery = callbackQuery.Encode()
+
+	loginURL := *authBaseURL
+	loginURL.Path = loginPagePath
+	loginURL.RawPath = ""
+	loginURL.RawQuery = ""
+	loginURL.Fragment = ""
+	query := loginURL.Query()
+	query.Set("callback", callback.String())
+	query.Set("random_secret_key", secret)
+	query.Set("source", loginSource)
+	query.Set("device_id", deviceID)
+	if tokenID != "" {
+		query.Set("token_id", tokenID)
+	}
+	if expectedAccount != "" {
+		query.Set("expected_account", expectedAccount)
+	}
+	if forceRefresh {
+		query.Set("force", "1")
+	}
+	loginURL.RawQuery = query.Encode()
+
+	flow := &browserFlow{
+		loginURL:    loginURL.String(),
+		callbackURL: callback.String(),
+		secret:      secret,
+		state:       state,
+		source:      loginSource,
+		origin:      originOf(authBaseURL),
+		listener:    listener,
+		payload:     make(chan accessKeyPayload, 1),
+		serveErr:    make(chan error, 1),
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc(callbackPath, flow.handleCallback)
+	flow.server = &http.Server{
+		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       10 * time.Second,
+		WriteTimeout:      10 * time.Second,
+		IdleTimeout:       15 * time.Second,
+	}
+	go func() {
+		err := flow.server.Serve(listener)
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			flow.serveErr <- err
+		}
+		close(flow.serveErr)
+	}()
+	return flow, nil
+}
+
+func (f *browserFlow) wait(ctx context.Context) (accessKeyPayload, error) {
+	select {
+	case payload := <-f.payload:
+		return payload, nil
+	case err, open := <-f.serveErr:
+		if open && err != nil {
+			return accessKeyPayload{}, errors.New("本机网页授权回调异常退出")
+		}
+		return accessKeyPayload{}, errors.New("本机网页授权回调已关闭")
+	case <-ctx.Done():
+		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+			return accessKeyPayload{}, errors.New("等待网页授权超时，请重新登录")
+		}
+		return accessKeyPayload{}, ctx.Err()
+	}
+}
+
+func (f *browserFlow) close() {
+	f.closeOnce.Do(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_ = f.server.Shutdown(ctx)
+		_ = f.listener.Close()
+	})
+}
+
+func (f *browserFlow) handleCallback(writer http.ResponseWriter, request *http.Request) {
+	if !f.validRequestTarget(request) {
+		http.Error(writer, "invalid callback target", http.StatusBadRequest)
+		return
+	}
+	if !constantTimeEqual(request.Header.Get("Origin"), f.origin) {
+		http.Error(writer, "origin not allowed", http.StatusForbidden)
+		return
+	}
+	f.setCORSHeaders(writer.Header())
+
+	if request.Method == http.MethodOptions {
+		if !strings.EqualFold(strings.TrimSpace(request.Header.Get("Access-Control-Request-Method")), http.MethodPost) ||
+			!allowsContentTypeHeader(request.Header.Get("Access-Control-Request-Headers")) {
+			http.Error(writer, "invalid preflight", http.StatusBadRequest)
+			return
+		}
+		writer.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if request.Method != http.MethodPost {
+		writer.Header().Set("Allow", "OPTIONS, POST")
+		http.Error(writer, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	mediaType, _, err := mime.ParseMediaType(request.Header.Get("Content-Type"))
+	if err != nil || !strings.EqualFold(mediaType, "application/json") {
+		http.Error(writer, "content type must be application/json", http.StatusUnsupportedMediaType)
+		return
+	}
+
+	reader := http.MaxBytesReader(writer, request.Body, maxCallbackBodyBytes)
+	decoder := json.NewDecoder(reader)
+	decoder.DisallowUnknownFields()
+	payload := accessKeyPayload{}
+	if err := decoder.Decode(&payload); err != nil {
+		http.Error(writer, "invalid callback payload", http.StatusBadRequest)
+		return
+	}
+	if err := ensureJSONEOF(decoder); err != nil {
+		http.Error(writer, "invalid callback payload", http.StatusBadRequest)
+		return
+	}
+	if payload.Type != "access_key" || !validCallbackValue(payload.AccessKey, 4096) ||
+		!validCallbackValue(payload.UID, 256) || !validTokenID(payload.TokenID) || payload.ExpiredAt <= 0 ||
+		!constantTimeEqual(payload.RandomSecretKey, f.secret) ||
+		!constantTimeEqual(payload.Source, f.source) ||
+		!constantTimeEqual(payload.CallbackURL, f.callbackURL) {
+		http.Error(writer, "callback binding mismatch", http.StatusBadRequest)
+		return
+	}
+	accepted := false
+	f.callbackOnce.Do(func() {
+		f.payload <- payload
+		accepted = true
+	})
+	if accepted {
+		writer.Header().Set("Content-Type", "application/json")
+		writer.WriteHeader(http.StatusOK)
+		_, _ = writer.Write([]byte(`{"ok":true}`))
+		return
+	}
+	http.Error(writer, "callback already received", http.StatusConflict)
+}
+
+func validCallbackValue(value string, maxLength int) bool {
+	return value != "" && len(value) <= maxLength && strings.TrimSpace(value) == value
+}
+
+func validTokenID(value string) bool {
+	if len(value) == 0 || len(value) > 128 {
+		return false
+	}
+	for index := range len(value) {
+		character := value[index]
+		if (character >= 'a' && character <= 'z') || (character >= 'A' && character <= 'Z') ||
+			(character >= '0' && character <= '9') || strings.ContainsRune(":._-", rune(character)) {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+func validAccountBinding(value string) bool {
+	decoded, err := base64.RawURLEncoding.DecodeString(value)
+	return err == nil && len(decoded) == 16 && len(value) == 22 &&
+		constantTimeEqual(value, base64.RawURLEncoding.EncodeToString(decoded))
+}
+
+func (f *browserFlow) validRequestTarget(request *http.Request) bool {
+	if request.URL.Path != callbackPath || !constantTimeEqual(request.Host, strings.TrimPrefix(f.callbackURLHost(), "//")) {
+		return false
+	}
+	query := request.URL.Query()
+	states, ok := query["state"]
+	if !ok || len(states) != 1 || !constantTimeEqual(states[0], f.state) {
+		return false
+	}
+	for key, values := range query {
+		if key == "state" {
+			continue
+		}
+		// The site's security runtime appends these transport-only query
+		// parameters to cross-origin requests. They are not part of the
+		// callback binding: state, Origin, callback_url, and the body secret
+		// remain exact and independently verified below.
+		if key != "a_bogus" && key != "msToken" || len(values) != 1 ||
+			!validInjectedCallbackQueryValue(values[0]) {
+			return false
+		}
+	}
+	return true
+}
+
+func validInjectedCallbackQueryValue(value string) bool {
+	return value != "" && len(value) <= maxInjectedCallbackQueryValueBytes && strings.TrimSpace(value) == value
+}
+
+func (f *browserFlow) callbackURLHost() string {
+	parsed, err := url.Parse(f.callbackURL)
+	if err != nil {
+		return ""
+	}
+	return parsed.Host
+}
+
+func (f *browserFlow) setCORSHeaders(header http.Header) {
+	header.Set("Access-Control-Allow-Origin", f.origin)
+	header.Set("Access-Control-Allow-Methods", "POST")
+	header.Set("Access-Control-Allow-Headers", "Content-Type")
+	header.Set("Access-Control-Allow-Private-Network", "true")
+	header.Add("Vary", "Origin")
+	header.Add("Vary", "Access-Control-Request-Method")
+	header.Add("Vary", "Access-Control-Request-Headers")
+}
+
+func allowsContentTypeHeader(value string) bool {
+	for _, part := range strings.Split(value, ",") {
+		if strings.EqualFold(strings.TrimSpace(part), "content-type") {
+			return true
+		}
+	}
+	return false
+}
+
+func ensureJSONEOF(decoder *json.Decoder) error {
+	var trailing any
+	err := decoder.Decode(&trailing)
+	if errors.Is(err, io.EOF) {
+		return nil
+	}
+	if err == nil {
+		return errors.New("unexpected trailing JSON")
+	}
+	return err
+}
+
+func originOf(value *url.URL) string {
+	return fmt.Sprintf("%s://%s", strings.ToLower(value.Scheme), value.Host)
+}