@qcplay/cli 1.0.6 → 1.0.7

package/README.md

@@ -7,6 +7,8 @@
 - 认证默认请求线上接口：`https://cli.qcg.ink`
 - 发布默认请求线上接口：`https://cli.qcg.ink`
 - 登录默认打开线上页面：`https://cli.qcg.ink/auth.html`
+- 登录凭证保存在当前用户本机的 `~/.qcplay/auth.json`，不同客户端之间不共享账号
+- 状态、权限和发布请求通过 Bearer Token 识别当前账号
 - `qcplay-cli update` 会更新 npm 全局包，并同步 `~/.agents/skills`
 - 本地调试时可直接使用 `--local`
 - `--local` 默认指向 `http://127.0.0.1:8787`

package/bin/qcplay.js

@@ -91,6 +91,7 @@ const BOOLEAN_TEXT_MAP = {
 const QCPLAY_DIR = path.join(os.homedir(), ".qcplay");
 const AGENTS_DIR = path.join(os.homedir(), ".agents");
 const CONFIG_FILE = path.join(QCPLAY_DIR, "config.json");
+const AUTH_FILE = path.join(QCPLAY_DIR, "auth.json");
 const SKILLS_DIR = path.join(AGENTS_DIR, "skills");
 
 function readPackageMetadata() {
@@ -234,6 +235,7 @@ async function writeJson(filePath, value) {
     encoding: "utf8",
     mode: 0o600
   });
+  await fs.promises.chmod(filePath, 0o600);
 }
 
 async function readJson(filePath) {
@@ -491,7 +493,7 @@ function parsePublishOptions(args) {
   };
 }
 
-function requestJson(method, baseUrl, pathname, payload) {
+function requestJson(method, baseUrl, pathname, payload, headers = {}) {
   return new Promise((resolve, reject) => {
     const url = new URL(pathname, baseUrl);
     const client = url.protocol === "https:" ? https : http;
@@ -505,6 +507,7 @@ function requestJson(method, baseUrl, pathname, payload) {
           Accept: "application/json",
           "Content-Type": "application/json",
           "User-Agent": `qcplay-cli/${PACKAGE_VERSION}`,
+          ...headers,
           ...(body ? { "Content-Length": Buffer.byteLength(body) } : {})
         }
       },
@@ -523,7 +526,9 @@ function requestJson(method, baseUrl, pathname, payload) {
           }
 
           if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300) {
-            reject(new Error(json.message || `接口请求失败 (${res.statusCode})`));
+            const error = new Error(json.message || `接口请求失败 (${res.statusCode})`);
+            error.statusCode = res.statusCode || 0;
+            reject(error);
             return;
           }
 
@@ -661,9 +666,18 @@ function resolvePublishBackendUrl(options, config = {}) {
   return ensureAbsoluteUrl(backendUrl, "--backend");
 }
 
-async function fetchLoginSuccessSequence(baseUrl) {
-  const response = await requestJson("GET", baseUrl, "/api/auth/login-success");
-  return Number(response.data?.sequence || 0);
+async function createLoginRequest(baseUrl) {
+  const response = await requestJson("POST", baseUrl, "/api/auth/login-request", {});
+  const requestId = normalizeText(response.data?.request_id);
+  const pollToken = normalizeText(response.data?.poll_token);
+  if (!requestId || !pollToken) {
+    throw new Error("认证后端没有返回有效的登录请求凭证");
+  }
+  return {
+    requestId,
+    pollToken,
+    expiresIn: Number(response.data?.expires_in || 600)
+  };
 }
 
 function isNonJsonResponseError(error) {
@@ -673,22 +687,30 @@ function isNonJsonResponseError(error) {
 function buildAuthBackendError(baseUrl, error) {
   if (isNonJsonResponseError(error)) {
     return new Error(
-      `认证接口 ${baseUrl} 返回了 HTML 页面，不是 JSON。请确认 ${baseUrl}/api/auth/login、${baseUrl}/api/auth/login-success、${baseUrl}/api/auth/status 已正确部署，而不是被站点首页或登录页接管。`
+      `认证接口 ${baseUrl} 返回了 HTML 页面，不是 JSON。请确认 ${baseUrl}/api/auth/login-request、${baseUrl}/api/auth/login、${baseUrl}/api/auth/login-success、${baseUrl}/api/auth/status 已正确部署，而不是被站点首页或登录页接管。`
     );
   }
 
   return error;
 }
 
-async function waitForLoginSuccessSequence(baseUrl, previousSequence, intervalMs = 1000, timeoutMs = 60000) {
+async function waitForLoginResult(baseUrl, loginRequest, intervalMs = 1000) {
   const startedAt = Date.now();
+  const timeoutMs = Math.max(1, loginRequest.expiresIn) * 1000;
   let lastError;
+  const query = new URLSearchParams({ request_id: loginRequest.requestId });
 
   while (true) {
     try {
-      const nextSequence = await fetchLoginSuccessSequence(baseUrl);
-      if (nextSequence > previousSequence) {
-        return nextSequence;
+      const response = await requestJson("GET", baseUrl, `/api/auth/login-success?${query}`, undefined, {
+        "X-QCPlay-Poll-Token": loginRequest.pollToken
+      });
+      if (response.data?.complete) {
+        const result = response.data?.result;
+        if (!result?.access_token || !result?.refresh_token) {
+          throw new Error("认证后端返回的登录结果不完整");
+        }
+        return result;
       }
     } catch (error) {
       lastError = error;
@@ -706,13 +728,15 @@ async function waitForLoginSuccessSequence(baseUrl, previousSequence, intervalMs
   }
 }
 
-function buildAuthPageUrl(backendUrl, authPageUrl = "") {
+function buildAuthPageUrl(backendUrl, authPageUrl = "", requestId = "") {
   const targetUrl = authPageUrl ? new URL(authPageUrl) : pathToFileURL(AUTH_PAGE);
 
   if (shouldAttachBackendQuery(targetUrl, backendUrl)) {
     targetUrl.searchParams.set("backend", backendUrl);
   }
 
+  targetUrl.searchParams.set("request_id", requestId);
+
   return targetUrl.toString();
 }
 
@@ -729,6 +753,117 @@ function shouldAttachBackendQuery(targetUrl, backendUrl) {
   return normalizedBackendUrl.origin !== targetUrl.origin;
 }
 
+function normalizeTimestamp(value) {
+  const timestamp = Number(value || 0);
+  return timestamp > 0 && timestamp < 1_000_000_000_000 ? timestamp * 1000 : timestamp;
+}
+
+function tokenIsValid(token, expiresAt) {
+  return Boolean(normalizeText(token)) && Date.now() < normalizeTimestamp(expiresAt);
+}
+
+function authRequiredError(message) {
+  const error = new Error(message);
+  error.code = "AUTH_REQUIRED";
+  return error;
+}
+
+async function loadAuthState() {
+  const state = await readJson(AUTH_FILE);
+  return normalizeText(state.access_token) ? state : {};
+}
+
+async function saveAuthState(result, backendUrl) {
+  if (!normalizeText(result?.access_token) || !normalizeText(result?.refresh_token)) {
+    throw new Error("认证后端返回的登录结果不完整");
+  }
+
+  await writeJson(AUTH_FILE, {
+    backend_url: backendUrl,
+    api_base: result.api_base || "",
+    access_token: result.access_token,
+    refresh_token: result.refresh_token,
+    token_type: result.token_type || "Bearer",
+    expires_at: Number(result.expires_at || 0),
+    refresh_expires_at: Number(result.refresh_expires_at || 0),
+    created_at: Number(result.created_at || Date.now()),
+    id: Number(result.id || 0),
+    account: result.account || "",
+    name: result.name || "",
+    status: result.status || "",
+    type: result.type || ""
+  });
+}
+
+async function removeAuthState() {
+  try {
+    await fs.promises.unlink(AUTH_FILE);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+}
+
+async function refreshAuthState(state, fallbackBackendUrl) {
+  if (!tokenIsValid(state.refresh_token, state.refresh_expires_at)) {
+    throw authRequiredError("登录状态已过期，请重新登录");
+  }
+
+  const authBackendUrl = normalizeOptionalUrl(state.backend_url) || fallbackBackendUrl;
+  const response = await requestJson("POST", authBackendUrl, "/api/auth/login", {
+    refresh_token: state.refresh_token
+  });
+  const result = response.data?.result;
+  await saveAuthState(result, authBackendUrl);
+  return loadAuthState();
+}
+
+async function requireAuthState(backendUrl) {
+  let state = await loadAuthState();
+  if (!normalizeText(state.access_token)) {
+    throw authRequiredError("未检测到登录状态，请先执行 qcplay-cli auth");
+  }
+
+  if (!tokenIsValid(state.access_token, state.expires_at)) {
+    try {
+      state = await refreshAuthState(state, backendUrl);
+    } catch (error) {
+      if (error.code === "AUTH_REQUIRED" || error.statusCode === 401) {
+        await removeAuthState();
+      }
+      throw error;
+    }
+  }
+  return state;
+}
+
+async function authenticatedRequest(method, baseUrl, pathname, payload) {
+  let state = await requireAuthState(baseUrl);
+  try {
+    return await requestJson(method, baseUrl, pathname, payload, {
+      Authorization: `Bearer ${state.access_token}`
+    });
+  } catch (error) {
+    if (error.statusCode !== 401) {
+      throw error;
+    }
+  }
+
+  try {
+    state = await refreshAuthState(state, baseUrl);
+  } catch (error) {
+    if (error.code === "AUTH_REQUIRED" || error.statusCode === 401) {
+      await removeAuthState();
+    }
+    throw error;
+  }
+
+  return requestJson(method, baseUrl, pathname, payload, {
+    Authorization: `Bearer ${state.access_token}`
+  });
+}
+
 function flattenPermissionTree(items, bucket = []) {
   for (const item of items) {
     bucket.push(item);
@@ -782,10 +917,15 @@ function printPermissionTree(items) {
 function formatAccountSummary(data = {}) {
   const id = Number(data.id || 0);
   const name = normalizeText(data.name) || "未知账号";
+  const account = normalizeText(data.account);
   const type = normalizeText(data.type);
   const status = normalizeText(data.status);
   const parts = [name];
 
+  if (account && account !== name) {
+    parts.push(`account=${account}`);
+  }
+
   if (id > 0) {
     parts.push(`id=${id}`);
   }
@@ -894,8 +1034,8 @@ async function authCommand(rawArgs = []) {
   const authPageUrl = resolveAuthPageUrl(options, config);
 
   if (!action || action === "login") {
-    const loginPageUrl = buildAuthPageUrl(backendUrl, authPageUrl);
-    let previousSequence = 0;
+    const loginRequest = await createLoginRequest(backendUrl);
+    const loginPageUrl = buildAuthPageUrl(backendUrl, authPageUrl, loginRequest.requestId);
 
     console.log(chalk.cyan("正在登录中"));
     try {
@@ -905,40 +1045,50 @@ async function authCommand(rawArgs = []) {
       console.log(chalk.gray(loginPageUrl));
     }
 
-    try {
-      previousSequence = await fetchLoginSuccessSequence(backendUrl);
-    } catch {}
-
-    await waitForLoginSuccessSequence(backendUrl, previousSequence);
-    const statusResponse = await requestJson("GET", backendUrl, "/api/auth/status");
-    console.log(chalk.green("登录成功"));
-    if (statusResponse.data?.logged_in) {
-      console.log(chalk.gray(`当前账号: ${formatAccountSummary(statusResponse.data)}`));
+    const result = await waitForLoginResult(backendUrl, loginRequest);
+    await saveAuthState(result, backendUrl);
+    const statusResponse = await authenticatedRequest("GET", backendUrl, "/api/auth/status");
+    if (!statusResponse.data?.logged_in) {
+      await removeAuthState();
+      throw new Error("登录结果校验失败，请重新登录");
     }
+    console.log(chalk.green("登录成功"));
+    console.log(chalk.gray(`当前账号: ${formatAccountSummary(statusResponse.data)}`));
     return;
   }
 
   if (action === "status") {
-    const response = await requestJson("GET", backendUrl, "/api/auth/status");
+    let response;
+    try {
+      response = await authenticatedRequest("GET", backendUrl, "/api/auth/status");
+    } catch (error) {
+      if (error.code === "AUTH_REQUIRED" || error.statusCode === 401 || !(await pathExists(AUTH_FILE))) {
+        await removeAuthState();
+        console.log(chalk.yellow("未登录"));
+        return;
+      }
+      throw error;
+    }
     if (response.data?.logged_in) {
       console.log(chalk.green("已登录"));
       console.log(chalk.gray(`当前账号: ${formatAccountSummary(response.data)}`));
       return;
     }
 
+    await removeAuthState();
     console.log(chalk.yellow("未登录"));
     return;
   }
 
   if (action === "logout") {
-    const response = await requestJson("POST", backendUrl, "/api/auth/logout", {});
-    console.log(chalk.green(response.message || "已退出登录"));
+    await removeAuthState();
+    console.log(chalk.green("已退出登录"));
     return;
   }
 
   if (action === "permissions") {
     const flags = parsePermissionsOptions(args.slice(1));
-    const response = await requestJson("GET", backendUrl, "/api/permissions");
+    const response = await authenticatedRequest("GET", backendUrl, "/api/permissions");
     let permissions = response.data || [];
 
     if (flags.key) {
@@ -1331,7 +1481,7 @@ async function publishArticleCommand(file, options) {
   console.log(chalk.gray(`文章文件: ${articleFile}`));
   console.log("");
 
-  const response = await requestJson("POST", backendUrl, "/api/articles/publish", payload);
+  const response = await authenticatedRequest("POST", backendUrl, "/api/articles/publish", payload);
   console.log(chalk.green(response.message || "发布成功"));
   const articleId = response.data?.id ?? response.data?.article_id ?? response.data?.articleId;
   if (articleId !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qcplay/cli",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "QCPlay CLI",
   "type": "module",
   "bin": {