@qingflow-tech/qingflow-cli 1.1.41 → 1.1.43

package/src/qingflow_mcp/cloud_auth.py

@@ -25,6 +25,8 @@ from .json_types import JSONObject
 AUTH_CONTEXT_KEY_PREFIX = "mcp:auth:context"
 AUTH_CONTEXT_LOCK_KEY_PREFIX = "mcp:auth:context:lock"
 AUTH_CONTEXT_NEGATIVE_KEY_PREFIX = "mcp:auth:context:negative"
+ACCESS_PLATFORM_KEY_PREFIX = "oauth2:access-platform:"
+ACCESS_CONTEXT_KEY_PREFIX = "auth:access-context:"
 
 
 @dataclass(slots=True)
@@ -103,6 +105,35 @@ class CloudAuthBroker:
     def invalidate(self, credential_hash: str) -> None:
         self.cache.delete(self._auth_key(credential_hash))
 
+    def resolve_call_platform(self, access_token: str) -> str:
+        normalized_token = self._normalize_text(access_token)
+        if normalized_token is None:
+            return ""
+        access_context = self.resolve_access_context(normalized_token)
+        if access_context is not None:
+            source_code = self._normalize_text(access_context.get("source_code"))
+            if source_code is not None:
+                return source_code
+        try:
+            value = self.cache.get_text(f"{ACCESS_PLATFORM_KEY_PREFIX}{normalized_token}")
+        except QingflowApiError:
+            return ""
+        return self._normalize_text(value) or ""
+
+    def resolve_access_context(self, access_token: str) -> JSONObject | None:
+        normalized_token = self._normalize_text(access_token)
+        if normalized_token is None:
+            return None
+        try:
+            value = self.cache.get_json(
+                f"{ACCESS_CONTEXT_KEY_PREFIX}{sha256(normalized_token.encode('utf-8')).hexdigest()}"
+            )
+        except QingflowApiError:
+            return None
+        if not isinstance(value, dict):
+            return None
+        return value
+
     @staticmethod
     def credential_hash(credential: str) -> str:
         return sha256(credential.encode("utf-8")).hexdigest()

package/src/qingflow_mcp/cloud_context.py

@@ -68,3 +68,8 @@ current_cloud_context: ContextVar[CloudMcpContext | None] = ContextVar(
     "qingflow_mcp_current_cloud_context",
     default=None,
 )
+
+current_call_platform: ContextVar[str] = ContextVar(
+    "qingflow_mcp_current_call_platform",
+    default="",
+)

package/src/qingflow_mcp/cloud_oauth_proxy.py

@@ -0,0 +1,454 @@
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import Any
+from urllib.parse import urlsplit, urlunsplit
+
+import httpx
+
+from .backend_client import BackendClient, BackendRequestContext
+from .cloud_context import CloudMcpContext
+from .config import (
+    get_cloud_oauth_resource_url,
+    get_cloud_oauth_service_base_url,
+    get_default_base_url,
+    get_default_qf_version,
+    get_timeout_seconds,
+    normalize_base_url,
+)
+from .errors import QingflowApiError, is_auth_like_error
+from .json_types import JSONObject
+
+
+PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource"
+AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server"
+OAUTH_ENDPOINT_PATHS = {
+    "authorization_endpoint": "/oauth/authorize",
+    "token_endpoint": "/oauth/token",
+    "revocation_endpoint": "/oauth/revoke",
+    "registration_endpoint": "/oauth/register",
+}
+FORWARDED_REQUEST_HEADERS = {"accept", "content-type"}
+HOP_BY_HOP_RESPONSE_HEADERS = {
+    "connection",
+    # httpx decodes compressed response bodies before exposing response.content.
+    "content-encoding",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "date",
+    "server",
+}
+
+
+@dataclass(frozen=True, slots=True)
+class CloudOAuthProxyConfig:
+    service_base_url: str
+    resource_url: str
+
+    @classmethod
+    def from_config(cls) -> "CloudOAuthProxyConfig | None":
+        resource_url = get_cloud_oauth_resource_url()
+        if resource_url is None:
+            return None
+        service_base_url = get_cloud_oauth_service_base_url()
+        if service_base_url is None:
+            raise QingflowApiError.config_error(
+                "cloud.oauth.service_base_url or default_base_url is required when OAuth is enabled"
+            )
+        return cls(
+            service_base_url=service_base_url,
+            resource_url=_validate_resource_url(resource_url),
+        )
+
+    @property
+    def resource_metadata_url(self) -> str:
+        return f"{self.metadata_issuer_url}{PROTECTED_RESOURCE_METADATA_PATH}"
+
+    @property
+    def metadata_issuer_url(self) -> str:
+        parsed = urlsplit(self.resource_url)
+        return urlunsplit((parsed.scheme, parsed.netloc, "", "", ""))
+
+    def backend_metadata_path(self, request_path: str) -> str | None:
+        if request_path == PROTECTED_RESOURCE_METADATA_PATH or request_path.startswith(
+            f"{PROTECTED_RESOURCE_METADATA_PATH}/"
+        ):
+            return PROTECTED_RESOURCE_METADATA_PATH
+        if request_path == AUTHORIZATION_SERVER_METADATA_PATH or request_path.startswith(
+            f"{AUTHORIZATION_SERVER_METADATA_PATH}/"
+        ):
+            return AUTHORIZATION_SERVER_METADATA_PATH
+        return None
+
+    def backend_oauth_endpoint_path(self, request_path: str) -> str | None:
+        if request_path in OAUTH_ENDPOINT_PATHS.values():
+            return request_path
+        return None
+
+
+@dataclass(frozen=True, slots=True)
+class OAuthProxyResponse:
+    status_code: int
+    headers: tuple[tuple[bytes, bytes], ...]
+    body: bytes
+
+
+class OAuthServiceProxy:
+    def __init__(
+        self,
+        config: CloudOAuthProxyConfig,
+        *,
+        client: httpx.Client | None = None,
+    ) -> None:
+        self.config = config
+        self._owns_client = client is None
+        self._client = client or httpx.Client(
+            timeout=get_timeout_seconds(),
+            follow_redirects=False,
+            trust_env=False,
+        )
+
+    def close(self) -> None:
+        if self._owns_client:
+            self._client.close()
+
+    def request_metadata(
+        self,
+        method: str,
+        backend_path: str,
+        query_string: bytes = b"",
+    ) -> OAuthProxyResponse:
+        url = f"{self.config.service_base_url}/{backend_path.lstrip('/')}"
+        if query_string:
+            url = f"{url}?{query_string.decode('latin1')}"
+        try:
+            response = self._client.request(
+                method.upper(),
+                url,
+                headers={"Accept": "application/json"},
+            )
+        except httpx.RequestError as error:
+            raise QingflowApiError(
+                category="network",
+                message=f"OAuth service request failed: {error}",
+            ) from error
+
+        headers = tuple(
+            (name.encode("latin1"), value.encode("latin1"))
+            for name, value in response.headers.multi_items()
+            if name.lower() not in HOP_BY_HOP_RESPONSE_HEADERS
+            and name.lower() != "content-length"
+        )
+        return OAuthProxyResponse(
+            status_code=response.status_code,
+            headers=headers,
+            body=self._rewrite_metadata_body(backend_path, response),
+        )
+
+    def request_oauth_endpoint(
+        self,
+        method: str,
+        backend_path: str,
+        query_string: bytes = b"",
+        body: bytes = b"",
+        headers: tuple[tuple[bytes, bytes], ...] = (),
+    ) -> OAuthProxyResponse:
+        url = f"{self.config.service_base_url}/{backend_path.lstrip('/')}"
+        if query_string:
+            url = f"{url}?{query_string.decode('latin1')}"
+        forwarded_headers = {
+            name.decode("latin1"): value.decode("latin1")
+            for name, value in headers
+            if name.decode("latin1").lower() in FORWARDED_REQUEST_HEADERS
+        }
+        try:
+            response = self._client.request(
+                method.upper(),
+                url,
+                content=body,
+                headers=forwarded_headers,
+            )
+        except httpx.RequestError as error:
+            raise QingflowApiError(
+                category="network",
+                message=f"OAuth service request failed: {error}",
+            ) from error
+
+        response_headers = tuple(
+            (name.encode("latin1"), value.encode("latin1"))
+            for name, value in response.headers.multi_items()
+            if name.lower() not in HOP_BY_HOP_RESPONSE_HEADERS
+            and name.lower() != "content-length"
+        )
+        return OAuthProxyResponse(
+            status_code=response.status_code,
+            headers=response_headers,
+            body=response.content,
+        )
+
+    def _rewrite_metadata_body(
+        self,
+        backend_path: str,
+        response: httpx.Response,
+    ) -> bytes:
+        if not 200 <= response.status_code < 300 or not response.content:
+            return response.content
+        try:
+            payload = json.loads(response.content)
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return response.content
+        if not isinstance(payload, dict):
+            return response.content
+
+        changed = False
+        issuer = self.config.metadata_issuer_url
+        if backend_path == PROTECTED_RESOURCE_METADATA_PATH:
+            for field_name in ("authorization_servers", "authorizationServers"):
+                if field_name in payload:
+                    payload[field_name] = [issuer]
+                    changed = True
+        elif backend_path == AUTHORIZATION_SERVER_METADATA_PATH:
+            if "issuer" in payload:
+                payload["issuer"] = issuer
+                changed = True
+            for field_name, endpoint_path in OAUTH_ENDPOINT_PATHS.items():
+                if field_name in payload:
+                    payload[field_name] = f"{issuer}{endpoint_path}"
+                    changed = True
+
+        if not changed:
+            return response.content
+        return json.dumps(payload, ensure_ascii=False, separators=(",", ":")).encode(
+            "utf-8"
+        )
+
+
+@dataclass(slots=True)
+class OAuthAccessTokenResolver:
+    backend: BackendClient
+    base_url: str
+    qf_version: str | None = None
+
+    @classmethod
+    def from_config(cls, backend: BackendClient) -> "OAuthAccessTokenResolver":
+        base_url = get_default_base_url()
+        if base_url is None:
+            raise QingflowApiError.config_error(
+                "default_base_url is required for OAuth access token requests"
+            )
+        return cls(
+            backend=backend,
+            base_url=base_url,
+            qf_version=get_default_qf_version(),
+        )
+
+    def resolve(self, access_token: str) -> CloudMcpContext:
+        normalized_token = str(access_token or "").strip()
+        if not normalized_token:
+            raise QingflowApiError(category="auth", message="OAuth access token is required")
+
+        user_info, workspace, response_qf_version = self._load_backend_context(
+            normalized_token
+        )
+        uid = self._coerce_positive_int(user_info.get("uid"))
+        ws_id = self._coerce_positive_int(workspace.get("wsId"))
+        if uid is None or ws_id is None:
+            raise QingflowApiError(
+                category="auth",
+                message="OAuth access token did not resolve a valid user and workspace",
+            )
+
+        workspace_qf_version, workspace_qf_version_source = (
+            self._resolve_workspace_qf_version(workspace)
+        )
+        qf_version = workspace_qf_version or response_qf_version or self.qf_version
+        qf_version_source = (
+            workspace_qf_version_source
+            if workspace_qf_version
+            else "backend_response"
+            if response_qf_version
+            else "default_config"
+            if self.qf_version
+            else None
+        )
+        return CloudMcpContext(
+            credential_hash="",
+            credential="",
+            token=normalized_token,
+            uid=uid,
+            ws_id=ws_id,
+            base_url=self.base_url,
+            qf_version=qf_version,
+            qf_version_source=qf_version_source,
+            email=self._normalize_text(user_info.get("email")),
+            nick_name=self._normalize_text(
+                user_info.get("nickName")
+                or user_info.get("displayName")
+                or user_info.get("name")
+            ),
+            ws_name=self._normalize_text(
+                workspace.get("workspaceName")
+                or workspace.get("wsName")
+                or workspace.get("remark")
+            ),
+        )
+
+    def _load_backend_context(
+        self, access_token: str
+    ) -> tuple[JSONObject, JSONObject, str | None]:
+        first_workspace: JSONObject | None = None
+        response_qf_version: str | None = None
+        try:
+            user_response = self.backend.request_with_meta(
+                "GET",
+                self._request_context(access_token, None),
+                "/user",
+            )
+        except QingflowApiError as original_error:
+            first_workspace, response_qf_version = self._fetch_first_workspace(
+                access_token
+            )
+            if first_workspace is None:
+                raise original_error
+            first_ws_id = self._coerce_positive_int(first_workspace.get("wsId"))
+            if first_ws_id is None:
+                raise original_error
+            user_response = self.backend.request_with_meta(
+                "GET",
+                self._request_context(
+                    access_token, first_ws_id, response_qf_version
+                ),
+                "/user",
+            )
+
+        user_info = self._as_object(user_response.data)
+        if user_info is None:
+            raise QingflowApiError(
+                category="auth", message="OAuth access token did not resolve user info"
+            )
+        response_qf_version = user_response.qf_response_version or response_qf_version
+
+        workspace = self._as_object(user_info.get("lastWsInfo")) or first_workspace
+        if workspace is None:
+            workspace, workspace_response_version = self._fetch_first_workspace(
+                access_token
+            )
+            response_qf_version = workspace_response_version or response_qf_version
+        if workspace is None:
+            raise QingflowApiError(
+                category="auth",
+                message="OAuth access token user has no accessible workspace",
+            )
+
+        ws_id = self._coerce_positive_int(workspace.get("wsId"))
+        if ws_id is None:
+            raise QingflowApiError(
+                category="auth",
+                message="OAuth access token user has no valid workspace",
+            )
+        if self._resolve_workspace_qf_version(workspace)[0] is None:
+            try:
+                workspace_response = self.backend.request_with_meta(
+                    "GET",
+                    self._request_context(access_token, ws_id, response_qf_version),
+                    f"/user/workspace/{ws_id}",
+                )
+                workspace = self._as_object(workspace_response.data) or workspace
+                response_qf_version = (
+                    workspace_response.qf_response_version or response_qf_version
+                )
+            except QingflowApiError as error:
+                if is_auth_like_error(error):
+                    raise
+        return user_info, workspace, response_qf_version
+
+    def _fetch_first_workspace(
+        self, access_token: str
+    ) -> tuple[JSONObject | None, str | None]:
+        response = self.backend.request_with_meta(
+            "POST",
+            self._request_context(access_token, None),
+            "/user/workspaceList/pageQuery",
+            json_body={"pageNum": 1, "pageSize": 1},
+        )
+        page = self._as_object(response.data)
+        workspaces = page.get("list") if page else None
+        first = workspaces[0] if isinstance(workspaces, list) and workspaces else None
+        return self._as_object(first), response.qf_response_version
+
+    def _request_context(
+        self,
+        access_token: str,
+        ws_id: int | None,
+        qf_version: str | None = None,
+    ) -> BackendRequestContext:
+        return BackendRequestContext(
+            base_url=self.base_url,
+            token=access_token,
+            ws_id=ws_id,
+            qf_version=qf_version or self.qf_version,
+            qf_version_source=(
+                "backend_response"
+                if qf_version
+                else "default_config"
+                if self.qf_version
+                else None
+            ),
+        )
+
+    @staticmethod
+    def _as_object(value: Any) -> JSONObject | None:
+        return value if isinstance(value, dict) else None
+
+    @classmethod
+    def _resolve_workspace_qf_version(
+        cls, workspace: JSONObject
+    ) -> tuple[str | None, str | None]:
+        qf_version = cls._normalize_text(workspace.get("qfVersion"))
+        if qf_version is not None:
+            return qf_version, "workspace_qf_version"
+        system_version = cls._normalize_text(workspace.get("systemVersion"))
+        if system_version is not None:
+            return system_version, "workspace_system_version"
+        return None, None
+
+    @staticmethod
+    def _normalize_text(value: Any) -> str | None:
+        if value is None:
+            return None
+        text = str(value).strip()
+        return text or None
+
+    @staticmethod
+    def _coerce_positive_int(value: Any) -> int | None:
+        if isinstance(value, bool) or value is None:
+            return None
+        try:
+            parsed = int(value)
+        except (TypeError, ValueError):
+            return None
+        return parsed if parsed > 0 else None
+
+
+def _validate_resource_url(value: str) -> str:
+    parsed = urlsplit(value)
+    is_loopback_http = parsed.scheme == "http" and parsed.hostname in {
+        "localhost",
+        "127.0.0.1",
+        "::1",
+    }
+    if not parsed.netloc or (parsed.scheme != "https" and not is_loopback_http):
+        raise QingflowApiError.config_error(
+            "cloud.oauth.resource_url must use HTTPS (HTTP is allowed for loopback)"
+        )
+    if parsed.query or parsed.fragment or parsed.username or parsed.password:
+        raise QingflowApiError.config_error(
+            "cloud.oauth.resource_url must not contain user info, query parameters, or a fragment"
+        )
+    return normalize_base_url(value) or value.rstrip("/")

package/src/qingflow_mcp/cloud_redis.py

@@ -20,6 +20,9 @@ class CloudAuthCache(Protocol):
     def get_json(self, key: str) -> JSONObject | None:
         ...
 
+    def get_text(self, key: str) -> str | None:
+        ...
+
     def set_json(self, key: str, value: JSONObject, ttl_seconds: int) -> None:
         ...
 
@@ -72,6 +75,28 @@ class RedisCloudAuthCache:
             raise QingflowApiError(category="cache", message=f"invalid Redis JSON for key '{key}': {exc}") from exc
         return value if isinstance(value, dict) else None
 
+    def get_text(self, key: str) -> str | None:
+        try:
+            raw_value = self._client.get(key)
+        except Exception as exc:
+            raise QingflowApiError(
+                category="cache",
+                message="failed to read text value from Redis",
+            ) from exc
+        if raw_value is None:
+            return None
+        if isinstance(raw_value, bytes):
+            try:
+                raw_value = raw_value.decode("utf-8")
+            except UnicodeDecodeError:
+                return None
+        text = str(raw_value)
+        try:
+            value = json.loads(text)
+        except json.JSONDecodeError:
+            value = text
+        return value if isinstance(value, str) else None
+
     def set_json(self, key: str, value: JSONObject, ttl_seconds: int) -> None:
         self._client.set(key, json.dumps(value, ensure_ascii=False), ex=max(1, int(ttl_seconds)))
 

package/src/qingflow_mcp/config.py

@@ -12,6 +12,7 @@ DEFAULT_USER_AGENT = "qingflow-mcp/1.0"
 DEFAULT_RECORD_LIST_TYPE = 8
 ATTACHMENT_QUESTION_TYPE = 13
 DEFAULT_BASE_URL = "https://qingflow.com/api"
+DEFAULT_CLI_OAUTH_RESOURCE_URL = "https://mcp.qingflow.com/mcp"
 DEFAULT_FEEDBACK_APP_KEY = "e0d017kju002"
 DEFAULT_FEEDBACK_QSOURCE_TOKEN = "mcp-feedback-7755d14748fc"
 DEFAULT_REPOSITORY_GIT_REMOTE_TEMPLATE = "git@hackers.oalite.com:{group}/{repo}.git"
@@ -165,6 +166,17 @@ def get_default_qf_version() -> str | None:
     return normalized or None
 
 
+def get_cli_oauth_resource_url() -> str:
+    """获取 CLI OAuth 受保护资源地址。"""
+    value = get_config_value(
+        "cli.oauth.resource_url",
+        env_var="QINGFLOW_MCP_OAUTH_RESOURCE_URL",
+        default=DEFAULT_CLI_OAUTH_RESOURCE_URL,
+    )
+    normalized = normalize_base_url(str(value or "").strip())
+    return normalized or DEFAULT_CLI_OAUTH_RESOURCE_URL
+
+
 def get_feedback_qsource_token() -> str | None:
     """获取反馈 q-source 被动入口 token"""
     value = get_config_value(
@@ -301,6 +313,50 @@ def get_cloud_auth_context_lock_wait_seconds() -> float:
     return parsed if parsed > 0 else DEFAULT_CLOUD_AUTH_CONTEXT_LOCK_WAIT_SECONDS
 
 
+def get_cloud_oauth_service_base_url() -> str | None:
+    value = get_config_value(
+        "cloud.oauth.service_base_url",
+        env_var="QINGFLOW_MCP_OAUTH_SERVICE_BASE_URL",
+        default=None,
+    )
+    normalized = normalize_base_url(str(value).strip()) if value is not None else None
+    if normalized:
+        return normalized
+    _, service_base_url = _derive_cloud_oauth_urls()
+    return service_base_url
+
+
+def get_cloud_oauth_resource_url() -> str | None:
+    value = get_config_value(
+        "cloud.oauth.resource_url",
+        env_var="QINGFLOW_MCP_OAUTH_RESOURCE_URL",
+        default=None,
+    )
+    normalized = str(value or "").strip().rstrip("/")
+    if normalized:
+        return normalized
+    resource_url, _ = _derive_cloud_oauth_urls()
+    return resource_url
+
+
+def _derive_cloud_oauth_urls() -> tuple[str | None, str | None]:
+    default_base_url = get_default_base_url()
+    if default_base_url is None:
+        return None, None
+
+    parsed = urlsplit(default_base_url)
+    path = parsed.path.rstrip("/")
+    if path.endswith("/api"):
+        resource_path = path[:-4]
+    else:
+        resource_path = path
+
+    resource_url = urlunsplit(
+        (parsed.scheme, parsed.netloc, resource_path, parsed.query, parsed.fragment)
+    )
+    return resource_url or None, default_base_url
+
+
 def get_cloud_http_host() -> str:
     value = get_config_value(
         "cloud.http.host",