@pippit-dev/cli 1.0.17 → 1.0.20

package/internal/auth/store.go

@@ -0,0 +1,303 @@
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/zalando/go-keyring"
+)
+
+const (
+	defaultKeyringAccount = "browser-login"
+	credentialFileName    = "browser-credential.json"
+	maxCredentialBytes    = 64 << 10
+)
+
+type keyringBackend interface {
+	Get(service, user string) (string, error)
+	Set(service, user, password string) error
+	Delete(service, user string) error
+}
+
+type systemKeyring struct{}
+
+func (systemKeyring) Get(service, user string) (string, error) {
+	return keyring.Get(service, user)
+}
+
+func (systemKeyring) Set(service, user, password string) error {
+	return keyring.Set(service, user, password)
+}
+
+func (systemKeyring) Delete(service, user string) error {
+	return keyring.Delete(service, user)
+}
+
+type keyringCredentialStore struct {
+	backend keyringBackend
+	service string
+	account string
+}
+
+func (s *keyringCredentialStore) Load(ctx context.Context) (*Credential, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	value, err := s.backend.Get(s.service, s.account)
+	if errors.Is(err, keyring.ErrNotFound) {
+		return nil, ErrCredentialNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("读取系统钥匙串失败: %w", ErrSecureStore)
+	}
+	credential, err := decodeCredential([]byte(value))
+	if err != nil {
+		return nil, err
+	}
+	return credential, nil
+}
+
+func (s *keyringCredentialStore) Save(ctx context.Context, credential *Credential) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	payload, err := encodeCredential(credential)
+	if err != nil {
+		return err
+	}
+	if err := s.backend.Set(s.service, s.account, string(payload)); err != nil {
+		return fmt.Errorf("写入系统钥匙串失败: %w", ErrSecureStore)
+	}
+	return nil
+}
+
+func (s *keyringCredentialStore) Delete(ctx context.Context) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	err := s.backend.Delete(s.service, s.account)
+	if errors.Is(err, keyring.ErrNotFound) {
+		return ErrCredentialNotFound
+	}
+	if err != nil {
+		return fmt.Errorf("删除系统钥匙串凭证失败: %w", ErrSecureStore)
+	}
+	return nil
+}
+
+type resilientCredentialStore struct {
+	primary  CredentialStore
+	fallback CredentialStore
+}
+
+type storedCredential struct {
+	Version         int    `json:"version"`
+	DeviceID        string `json:"device_id"`
+	CredentialScope string `json:"credential_scope"`
+	// LegacyTokenName is decoded only for compatibility with credentials written
+	// by the first browser-auth beta. New records intentionally omit it.
+	LegacyTokenName string `json:"token_name,omitempty"`
+	AccessKey       string `json:"access_key,omitempty"`
+	TokenID         string `json:"token_id,omitempty"`
+	UID             string `json:"uid,omitempty"`
+	ExpiredAt       int64  `json:"expired_at,omitempty"`
+}
+
+// NewDefaultCredentialStore prefers the operating system keyring. Unix uses
+// a private no-follow file as a fallback; Windows deliberately has no file
+// fallback because an equivalent ACL guarantee is not provided here.
+func NewDefaultCredentialStore(serviceName string) CredentialStore {
+	serviceName = strings.TrimSpace(serviceName)
+	if serviceName == "" {
+		serviceName = "pippit-cli"
+	}
+	primary := &keyringCredentialStore{
+		backend: systemKeyring{},
+		service: serviceName,
+		account: defaultKeyringAccount,
+	}
+	return &resilientCredentialStore{
+		primary:  primary,
+		fallback: newPlatformFallbackStore(),
+	}
+}
+
+func (s *resilientCredentialStore) Load(ctx context.Context) (*Credential, error) {
+	credential, primaryErr := s.primary.Load(ctx)
+	if primaryErr == nil {
+		return credential, nil
+	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	if !errors.Is(primaryErr, ErrCredentialNotFound) && !errors.Is(primaryErr, ErrSecureStore) {
+		// A decodable-but-invalid primary record may indicate corruption or
+		// tampering. Never mask it with an older fallback credential.
+		return nil, primaryErr
+	}
+	if s.fallback == nil {
+		if errors.Is(primaryErr, ErrCredentialNotFound) {
+			return nil, ErrCredentialNotFound
+		}
+		return nil, primaryErr
+	}
+	credential, fallbackErr := s.fallback.Load(ctx)
+	if fallbackErr == nil {
+		return credential, nil
+	}
+	if errors.Is(fallbackErr, ErrCredentialNotFound) {
+		// An available, empty fallback is the active store when the primary
+		// keyring is unavailable. Report a fresh login state so Manager can
+		// create the device identity and Save can persist it to that fallback.
+		return nil, ErrCredentialNotFound
+	}
+	if !errors.Is(fallbackErr, ErrCredentialNotFound) {
+		return nil, fallbackErr
+	}
+	return nil, primaryErr
+}
+
+func (s *resilientCredentialStore) Save(ctx context.Context, credential *Credential) error {
+	primaryErr := s.primary.Save(ctx, credential)
+	if primaryErr == nil {
+		if s.fallback != nil {
+			if err := ignoreNotFound(s.fallback.Delete(ctx)); err != nil {
+				return fmt.Errorf("系统钥匙串已更新，但清理旧的备用凭证失败: %w", err)
+			}
+		}
+		return nil
+	}
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if !errors.Is(primaryErr, ErrCredentialNotFound) && !errors.Is(primaryErr, ErrSecureStore) {
+		return primaryErr
+	}
+	if s.fallback == nil {
+		return primaryErr
+	}
+	if err := s.fallback.Save(ctx, credential); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (s *resilientCredentialStore) Delete(ctx context.Context) error {
+	primaryErr := ignoreNotFound(s.primary.Delete(ctx))
+	var fallbackErr error
+	if s.fallback != nil {
+		fallbackErr = ignoreNotFound(s.fallback.Delete(ctx))
+	}
+	if primaryErr != nil {
+		return primaryErr
+	}
+	return fallbackErr
+}
+
+func ignoreNotFound(err error) error {
+	if errors.Is(err, ErrCredentialNotFound) {
+		return nil
+	}
+	return err
+}
+
+func encodeCredential(credential *Credential) ([]byte, error) {
+	if err := validateCredential(credential); err != nil {
+		return nil, err
+	}
+	payload, err := json.Marshal(storedCredential{
+		Version:         credential.Version,
+		DeviceID:        credential.DeviceID,
+		CredentialScope: credential.CredentialScope,
+		AccessKey:       credential.AccessKey,
+		TokenID:         credential.TokenID,
+		UID:             credential.UID,
+		ExpiredAt:       credential.ExpiredAt,
+	})
+	if err != nil {
+		return nil, errors.New("编码本机登录凭证失败")
+	}
+	return payload, nil
+}
+
+func decodeCredential(payload []byte) (*Credential, error) {
+	if len(payload) == 0 || len(payload) > maxCredentialBytes {
+		return nil, errors.New("本机登录凭证格式无效")
+	}
+	record := &storedCredential{}
+	if err := json.Unmarshal(payload, record); err != nil {
+		return nil, errors.New("本机登录凭证格式无效")
+	}
+	credential := &Credential{
+		Version:         record.Version,
+		DeviceID:        record.DeviceID,
+		CredentialScope: record.CredentialScope,
+		AccessKey:       record.AccessKey,
+		TokenID:         record.TokenID,
+		UID:             record.UID,
+		ExpiredAt:       record.ExpiredAt,
+	}
+	if err := validateCredential(credential); err != nil {
+		return nil, err
+	}
+	return credential, nil
+}
+
+func defaultCredentialPath() string {
+	dir, err := os.UserConfigDir()
+	if err != nil || strings.TrimSpace(dir) == "" {
+		return ""
+	}
+	return filepath.Join(dir, "pippit-cli", credentialFileName)
+}
+
+type unavailableCredentialStore struct{}
+
+func (unavailableCredentialStore) Load(context.Context) (*Credential, error) {
+	return nil, ErrSecureStore
+}
+
+func (unavailableCredentialStore) Save(context.Context, *Credential) error {
+	return ErrSecureStore
+}
+
+func (unavailableCredentialStore) Delete(context.Context) error {
+	return ErrSecureStore
+}
+
+func validateCredential(credential *Credential) error {
+	if credential == nil {
+		return errors.New("本机登录凭证不能为空")
+	}
+	if credential.Version != credentialVersion {
+		return errors.New("本机登录凭证版本不受支持")
+	}
+	if !validDeviceID(credential.DeviceID) {
+		return errors.New("本机登录设备标识无效")
+	}
+	if credential.AccessKey == "" {
+		// TokenID is non-secret. Keeping it lets an explicit force login select
+		// exactly this device token without guessing by display name.
+		if (credential.TokenID != "" && !validTokenID(credential.TokenID)) || credential.UID != "" ||
+			credential.ExpiredAt != 0 || credential.CredentialScope != "" {
+			return errors.New("本机登录凭证不完整")
+		}
+		return nil
+	}
+	if strings.TrimSpace(credential.AccessKey) != credential.AccessKey || len(credential.AccessKey) > 4096 ||
+		!validTokenID(credential.TokenID) ||
+		credential.UID == "" || len(credential.UID) > 256 || strings.TrimSpace(credential.UID) != credential.UID || credential.ExpiredAt <= 0 {
+		return errors.New("本机登录凭证不完整")
+	}
+	expectedScope := credentialScope(credential.UID, credential.DeviceID)
+	if !constantTimeEqual(credential.CredentialScope, expectedScope) &&
+		!constantTimeEqual(credential.CredentialScope, legacyCredentialScope(credential.DeviceID)) {
+		return errors.New("本机登录凭证作用域无效")
+	}
+	return nil
+}

package/internal/auth/store_file_unix.go

@@ -0,0 +1,176 @@
+//go:build !windows
+
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+type fileCredentialStore struct {
+	path string
+}
+
+func NewFileCredentialStore(path string) CredentialStore {
+	return &fileCredentialStore{path: filepath.Clean(path)}
+}
+
+func newPlatformFallbackStore() CredentialStore {
+	path := defaultCredentialPath()
+	if path == "" {
+		return nil
+	}
+	return NewFileCredentialStore(path)
+}
+
+func (s *fileCredentialStore) Load(ctx context.Context) (*Credential, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	dirFD, name, err := s.openPrivateDirectory(false)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, ErrCredentialNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer unix.Close(dirFD)
+
+	fd, err := unix.Openat(dirFD, name, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
+	if errors.Is(err, unix.ENOENT) {
+		return nil, ErrCredentialNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("安全打开本机登录凭证失败: %w", ErrSecureStore)
+	}
+	file := os.NewFile(uintptr(fd), name)
+	defer file.Close()
+	if err := verifyPrivateRegularFile(fd); err != nil {
+		return nil, err
+	}
+	payload, err := io.ReadAll(io.LimitReader(file, maxCredentialBytes+1))
+	if err != nil {
+		return nil, fmt.Errorf("读取本机登录凭证失败: %w", ErrSecureStore)
+	}
+	return decodeCredential(payload)
+}
+
+func (s *fileCredentialStore) Save(ctx context.Context, credential *Credential) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	payload, err := encodeCredential(credential)
+	if err != nil {
+		return err
+	}
+	dirFD, name, err := s.openPrivateDirectory(true)
+	if err != nil {
+		return err
+	}
+	defer unix.Close(dirFD)
+
+	tempName, err := randomTempName()
+	if err != nil {
+		return errors.New("创建本机登录凭证临时文件失败")
+	}
+	fd, err := unix.Openat(dirFD, tempName, unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
+	if err != nil {
+		return fmt.Errorf("创建本机登录凭证临时文件失败: %w", ErrSecureStore)
+	}
+	cleanup := true
+	defer func() {
+		if cleanup {
+			_ = unix.Unlinkat(dirFD, tempName, 0)
+		}
+	}()
+	file := os.NewFile(uintptr(fd), tempName)
+	if _, err := file.Write(payload); err != nil {
+		_ = file.Close()
+		return fmt.Errorf("写入本机登录凭证失败: %w", ErrSecureStore)
+	}
+	if err := file.Sync(); err != nil {
+		_ = file.Close()
+		return fmt.Errorf("同步本机登录凭证失败: %w", ErrSecureStore)
+	}
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("关闭本机登录凭证失败: %w", ErrSecureStore)
+	}
+	if err := unix.Renameat(dirFD, tempName, dirFD, name); err != nil {
+		return fmt.Errorf("原子保存本机登录凭证失败: %w", ErrSecureStore)
+	}
+	cleanup = false
+	if err := unix.Fsync(dirFD); err != nil {
+		return fmt.Errorf("同步本机凭证目录失败: %w", ErrSecureStore)
+	}
+	return nil
+}
+
+func (s *fileCredentialStore) Delete(ctx context.Context) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	dirFD, name, err := s.openPrivateDirectory(false)
+	if errors.Is(err, os.ErrNotExist) {
+		return ErrCredentialNotFound
+	}
+	if err != nil {
+		return err
+	}
+	defer unix.Close(dirFD)
+	if err := unix.Unlinkat(dirFD, name, 0); errors.Is(err, unix.ENOENT) {
+		return ErrCredentialNotFound
+	} else if err != nil {
+		return fmt.Errorf("删除本机登录凭证失败: %w", ErrSecureStore)
+	}
+	if err := unix.Fsync(dirFD); err != nil {
+		return fmt.Errorf("同步本机凭证目录失败: %w", ErrSecureStore)
+	}
+	return nil
+}
+
+func (s *fileCredentialStore) openPrivateDirectory(create bool) (int, string, error) {
+	if s == nil || strings.TrimSpace(s.path) == "" || filepath.Base(s.path) == "." {
+		return -1, "", ErrSecureStore
+	}
+	dir := filepath.Dir(s.path)
+	if create {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			return -1, "", fmt.Errorf("创建本机凭证目录失败: %w", ErrSecureStore)
+		}
+	}
+	info, err := os.Lstat(dir)
+	if err != nil {
+		return -1, "", err
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() || info.Mode().Perm()&0o077 != 0 {
+		return -1, "", fmt.Errorf("本机凭证目录必须是权限 0700 的真实目录: %w", ErrSecureStore)
+	}
+	dirFD, err := unix.Open(dir, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_DIRECTORY|unix.O_NOFOLLOW, 0)
+	if err != nil {
+		return -1, "", fmt.Errorf("安全打开本机凭证目录失败: %w", ErrSecureStore)
+	}
+	var stat unix.Stat_t
+	if err := unix.Fstat(dirFD, &stat); err != nil || stat.Uid != uint32(os.Geteuid()) {
+		unix.Close(dirFD)
+		return -1, "", fmt.Errorf("本机凭证目录所有者无效: %w", ErrSecureStore)
+	}
+	return dirFD, filepath.Base(s.path), nil
+}
+
+func verifyPrivateRegularFile(fd int) error {
+	var stat unix.Stat_t
+	if err := unix.Fstat(fd, &stat); err != nil {
+		return fmt.Errorf("检查本机登录凭证失败: %w", ErrSecureStore)
+	}
+	if stat.Uid != uint32(os.Geteuid()) || stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Mode&0o077 != 0 {
+		return fmt.Errorf("本机登录凭证必须是当前用户拥有的权限 0600 文件: %w", ErrSecureStore)
+	}
+	return nil
+}

package/internal/auth/store_file_windows.go

@@ -0,0 +1,11 @@
+//go:build windows
+
+package auth
+
+func NewFileCredentialStore(string) CredentialStore {
+	return unavailableCredentialStore{}
+}
+
+func newPlatformFallbackStore() CredentialStore {
+	return nil
+}

package/internal/auth/types.go

@@ -0,0 +1,72 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"io"
+	"time"
+)
+
+const (
+	loginPagePath      = "/cli/pippit-tool-login"
+	callbackPath       = "/pippit-tool/callback"
+	loginSource        = "pippit-tool-cli"
+	credentialVersion  = 1
+	deviceIDBytes      = 32
+	randomBindingBytes = 32
+
+	DefaultLoginTimeout = 5 * time.Minute
+)
+
+var (
+	ErrCredentialNotFound        = errors.New("未找到本机小云雀 CLI 登录凭证")
+	ErrCredentialExpired         = errors.New("本机小云雀 CLI 登录凭证已过期")
+	ErrSecureStore               = errors.New("安全凭证存储不可用")
+	ErrCredentialAccountMismatch = errors.New("网页授权账号与当前任务账号不一致")
+	ErrRemoteRevokeUnsupported   = errors.New("当前版本不支持在 CLI 中安全撤销远程 Access Key")
+)
+
+// Credential is the dedicated, device-scoped Access Key managed by this CLI.
+// AccessKey is secret and must never be printed, logged, or written to journals.
+type Credential struct {
+	Version         int    `json:"version"`
+	DeviceID        string `json:"device_id"`
+	CredentialScope string `json:"credential_scope"`
+	AccessKey       string `json:"-"`
+	TokenID         string `json:"token_id,omitempty"`
+	UID             string `json:"uid,omitempty"`
+	ExpiredAt       int64  `json:"expired_at,omitempty"`
+}
+
+// CredentialStore persists a credential without exposing its serialized form.
+type CredentialStore interface {
+	Load(context.Context) (*Credential, error)
+	Save(context.Context, *Credential) error
+	Delete(context.Context) error
+}
+
+type LoginOptions struct {
+	// OpenURL should open the URL without persisting it. Login writes the
+	// one-time URL to Progress so the user can continue manually when automatic
+	// opening is unavailable. When nil, the platform's standard browser opener
+	// is used with credential-bearing env vars removed.
+	OpenURL  func(string) error
+	Progress io.Writer
+	Timeout  time.Duration
+	// ForceRefresh asks the browser page to rotate this device's rejected AK.
+	// The CLI never calls QueryAk, DeleteAk, or GenerateAk itself.
+	ForceRefresh bool
+	// ExpectedCredentialScope binds reauthentication to the UID and device that
+	// started a durable operation. A different browser account fails before the
+	// returned Access Key is saved.
+	ExpectedCredentialScope string
+}
+
+type Status struct {
+	LoggedIn        bool      `json:"logged_in"`
+	Source          string    `json:"source,omitempty"`
+	UID             string    `json:"uid,omitempty"`
+	TokenID         string    `json:"token_id,omitempty"`
+	CredentialScope string    `json:"credential_scope,omitempty"`
+	ExpiresAt       time.Time `json:"expires_at,omitempty"`
+}

package/internal/canvas/allocate.go

@@ -0,0 +1,70 @@
+package canvas
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+)
+
+const MaxAllocateCount = 5000
+
+type AllocateResult struct {
+	AssetIDs []string `json:"asset_ids"`
+	LogID    string   `json:"log_id,omitempty"`
+}
+
+type allocateRequest struct {
+	Count int            `json:"count"`
+	Base  map[string]any `json:"Base"`
+}
+
+// Allocate reserves unique IDs for assets that a later canvas apply transaction creates.
+func Allocate(ctx context.Context, count int, runner *common.Runner) (*AllocateResult, error) {
+	client, err := runnerClient(runner, "canvas allocate")
+	if err != nil {
+		return nil, err
+	}
+	if count <= 0 || count > MaxAllocateCount {
+		return nil, fmt.Errorf("canvas allocate count must be between 1 and %d", MaxAllocateCount)
+	}
+	var envelope responseEnvelope
+	if err := client.SendRequest(ctx, AllocatePath, allocateRequest{Count: count, Base: base()}, &envelope); err != nil {
+		return nil, fmt.Errorf("canvas allocate request failed: %w", err)
+	}
+	if err := envelope.validate("canvas allocate"); err != nil {
+		return nil, err
+	}
+	var data map[string]json.RawMessage
+	if err := json.Unmarshal(envelope.Data, &data); err != nil {
+		return nil, common.NewLogIDError(fmt.Sprintf("canvas allocate returned invalid data: %v", err), envelope.LogID)
+	}
+	idsRaw, ok := rawField(data, "ids", "IDs", "asset_ids")
+	if !ok {
+		return nil, common.NewLogIDError("canvas allocate response is missing data.ids", envelope.LogID)
+	}
+	var ids []string
+	if err := json.Unmarshal(idsRaw, &ids); err != nil {
+		return nil, common.NewLogIDError("canvas allocate data.ids must contain JSON strings", envelope.LogID)
+	}
+	if len(ids) != count {
+		return nil, common.NewLogIDError(
+			fmt.Sprintf("canvas allocate returned %d ids, want %d", len(ids), count),
+			envelope.LogID,
+		)
+	}
+	seen := make(map[string]struct{}, len(ids))
+	for index, id := range ids {
+		ids[index] = strings.TrimSpace(id)
+		if ids[index] == "" {
+			return nil, common.NewLogIDError(fmt.Sprintf("canvas allocate returned empty id at index %d", index), envelope.LogID)
+		}
+		if _, duplicate := seen[ids[index]]; duplicate {
+			return nil, common.NewLogIDError(fmt.Sprintf("canvas allocate returned duplicate id %q", ids[index]), envelope.LogID)
+		}
+		seen[ids[index]] = struct{}{}
+	}
+	return &AllocateResult{AssetIDs: ids, LogID: strings.TrimSpace(envelope.LogID)}, nil
+}