@qingflow-tech/qingflow-cli 1.1.43-beta.5 → 1.1.44-beta.1

package/src/qingflow_mcp/tools/auth_tools.py

@@ -6,6 +6,7 @@ from typing import Any
 
 from mcp.server.fastmcp import FastMCP
 
+from ..auth_provider import CliSessionFacade
 from ..backend_client import BackendRequestContext, BackendResponse
 from ..cloud_context import current_cloud_context
 from ..config import (
@@ -16,6 +17,7 @@ from ..config import (
     normalize_base_url,
 )
 from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
+from ..oauth_token_store import OAuthTokenBundle
 from ..session_store import SessionStore
 from .base import ToolBase
 
@@ -29,7 +31,7 @@ class AuthTools(ToolBase):
     3. 退出并清理当前 profile 会话。
     """
 
-    def __init__(self, sessions: SessionStore, backend) -> None:
+    def __init__(self, sessions: SessionStore | CliSessionFacade, backend) -> None:
         """执行内部辅助逻辑。"""
         super().__init__(sessions, backend)
         self.sessions.set_profile_refresher(self._refresh_profile_via_credential)
@@ -307,6 +309,130 @@ class AuthTools(ToolBase):
             ),
         }
 
+    def auth_use_oauth_token(
+        self,
+        *,
+        profile: str,
+        base_url: str,
+        qf_version: str | None,
+        issuer: str,
+        resource: str,
+        bundle: OAuthTokenBundle,
+    ) -> dict[str, Any]:
+        """使用 OAuth Token Bundle 建立 CLI 专用会话。"""
+        if not isinstance(self.sessions, CliSessionFacade):
+            raise_tool_error(QingflowApiError.config_error("OAuth login is only available in the Qingflow CLI."))
+        normalized_base_url = self._normalize_base_url(base_url)
+        normalized_qf_version, qf_version_source = self._resolve_qf_version_input(qf_version)
+        resolved_user_info, response_qf_version = self._fetch_user_info(
+            normalized_base_url,
+            bundle.access_token,
+            None,
+            qf_version=normalized_qf_version,
+            qf_version_source=qf_version_source,
+        )
+
+        last_workspace = resolved_user_info.get("lastWsInfo")
+        selected_ws_id = self._coerce_positive_int(
+            last_workspace.get("wsId") if isinstance(last_workspace, dict) else None
+        )
+        selected_ws_name = self._normalize_text(
+            (last_workspace.get("wsName") if isinstance(last_workspace, dict) else None)
+            or (last_workspace.get("workspaceName") if isinstance(last_workspace, dict) else None)
+            or (last_workspace.get("remark") if isinstance(last_workspace, dict) else None)
+        )
+        workspace_qf_version = (
+            self._workspace_system_version(last_workspace) if isinstance(last_workspace, dict) else None
+        )
+        if selected_ws_id is None:
+            fallback_workspace, fallback_qf_version = self._fetch_first_workspace(
+                normalized_base_url,
+                bundle.access_token,
+                qf_version=normalized_qf_version,
+                qf_version_source=qf_version_source,
+            )
+            if isinstance(fallback_workspace, dict):
+                selected_ws_id = self._coerce_positive_int(fallback_workspace.get("wsId"))
+                selected_ws_name = self._normalize_text(
+                    fallback_workspace.get("workspaceName")
+                    or fallback_workspace.get("wsName")
+                    or fallback_workspace.get("remark")
+                ) or selected_ws_name
+                workspace_qf_version = self._workspace_system_version(fallback_workspace) or fallback_qf_version
+        elif selected_ws_name is None or workspace_qf_version is None:
+            workspace = self._fetch_workspace_with_name_fallback(
+                normalized_base_url,
+                bundle.access_token,
+                selected_ws_id,
+                qf_version=normalized_qf_version,
+                qf_version_source=qf_version_source,
+            )
+            if isinstance(workspace, dict):
+                selected_ws_name = self._normalize_text(
+                    workspace.get("workspaceName")
+                    or workspace.get("wsName")
+                    or workspace.get("remark")
+                ) or selected_ws_name
+                workspace_qf_version = self._workspace_system_version(workspace) or workspace_qf_version
+
+        if workspace_qf_version is not None:
+            resolved_qf_version, resolved_qf_version_source = workspace_qf_version, "workspace_system_version"
+        else:
+            resolved_qf_version, resolved_qf_version_source = self._resolve_backend_qf_version(
+                response_qf_version,
+                fallback_qf_version=normalized_qf_version,
+                fallback_source=qf_version_source,
+            )
+        uid = self._coerce_positive_int(resolved_user_info.get("uid"))
+        if uid is None:
+            raise_tool_error(QingflowApiError(category="auth", message="Token validation did not return valid user info"))
+
+        state = self.sessions.activate_oauth(
+            profile=profile,
+            base_url=normalized_base_url,
+            qf_version=resolved_qf_version,
+            qf_version_source=resolved_qf_version_source,
+            uid=uid,
+            email=self._normalize_text(resolved_user_info.get("email")),
+            nick_name=self._normalize_text(
+                resolved_user_info.get("nickName")
+                or resolved_user_info.get("displayName")
+                or resolved_user_info.get("name")
+            ),
+            selected_ws_id=selected_ws_id,
+            selected_ws_name=selected_ws_name,
+            issuer=issuer,
+            resource=resource,
+            bundle=bundle,
+        )
+        return {
+            "profile": state.profile,
+            "base_url": state.base_url,
+            "qf_version": state.qf_version,
+            "qf_version_source": state.qf_version_source,
+            "uid": state.uid,
+            "email": state.email,
+            "nick_name": state.nick_name,
+            "selected_ws_id": state.selected_ws_id,
+            "selected_ws_name": state.selected_ws_name,
+            "suggested_ws_id": state.selected_ws_id,
+            "suggested_ws_name": state.selected_ws_name,
+            "persisted": True,
+            "active_auth_type": "oauth",
+            "auth_source": "oauth_pkce",
+            "source_code": state.source_code,
+            "access_expires_at": state.access_expires_at,
+            "request_route": self._request_route_payload(
+                BackendRequestContext(
+                    base_url=state.base_url or normalized_base_url,
+                    token=bundle.access_token,
+                    ws_id=state.selected_ws_id,
+                    qf_version=state.qf_version,
+                    qf_version_source=state.qf_version_source,
+                )
+            ),
+        }
+
     def _resolve_auth_inputs(
         self,
         *,
@@ -380,6 +506,14 @@ class AuthTools(ToolBase):
 
     def auth_whoami(self, *, profile: str = DEFAULT_PROFILE) -> dict[str, Any]:
         """执行认证与会话相关逻辑。"""
+        if isinstance(self.sessions, CliSessionFacade) and self.sessions.oauth_state(profile) == "none":
+            return {
+                "profile": profile,
+                "active_auth_type": "none",
+                "auth_source": "none",
+                "persisted": False,
+            }
+
         def build_response(
             session_profile,  # type: ignore[no-untyped-def]
             backend_session,  # type: ignore[no-untyped-def]
@@ -439,6 +573,13 @@ class AuthTools(ToolBase):
                 "persisted": session_profile.persisted,
                 "request_route": self._request_route_payload(context),
             }
+            if isinstance(self.sessions, CliSessionFacade):
+                active_auth_type = self.sessions.active_auth_type(profile)
+                response["active_auth_type"] = active_auth_type
+                if active_auth_type == "oauth":
+                    response.update(self.sessions.oauth_details(profile))
+                else:
+                    response["auth_source"] = active_auth_type
             member_info, member_warnings = self._workspace_member_info(
                 session_profile=session_profile,
                 backend_session=backend_session,
@@ -468,8 +609,18 @@ class AuthTools(ToolBase):
                     return build_response(refreshed_profile, refreshed_backend_session, refreshed_context)
                 except QingflowApiError as refreshed_error:
                     self._handle_error(profile, refreshed_error)
+            if error.looks_like_invalid_token() and self._refresh_oauth_session(profile):
+                try:
+                    refreshed_profile, refreshed_backend_session, refreshed_context = self._require_context(
+                        profile,
+                        require_workspace=False,
+                    )
+                    return build_response(refreshed_profile, refreshed_backend_session, refreshed_context)
+                except QingflowApiError as refreshed_error:
+                    self._handle_error(profile, refreshed_error)
             if (
                 error.looks_like_invalid_token()
+                and not self._uses_oauth(profile)
                 and session_profile is not None
                 and backend_session is not None
                 and self._refresh_session_from_credential(
@@ -511,6 +662,17 @@ class AuthTools(ToolBase):
 
     def auth_logout(self, *, profile: str = DEFAULT_PROFILE, forget_persisted: bool = False) -> dict[str, Any]:
         """执行认证与会话相关逻辑。"""
+        if isinstance(self.sessions, CliSessionFacade) and self.sessions.uses_oauth(profile):
+            warnings = self.sessions.oauth_logout(profile)
+            result: dict[str, Any] = {
+                "profile": profile,
+                "logged_out": True,
+                "forgot_persisted": True,
+                "active_auth_type": "none",
+            }
+            if warnings:
+                result["warnings"] = warnings
+            return result
         if not self.sessions.has_profile(profile):
             raise_tool_error(QingflowApiError.auth_required(profile))
         self.sessions.logout(profile, forget_persisted=forget_persisted)

package/src/qingflow_mcp/tools/base.py

@@ -5,6 +5,7 @@ from contextvars import ContextVar
 from typing import Any, Callable, TypeVar
 
 from ..backend_client import BackendRequestContext, BackendClient
+from ..auth_provider import CliSessionFacade
 from ..cloud_context import current_call_platform, current_cloud_context
 from ..config import (
     get_credit_meter_enabled,
@@ -21,7 +22,7 @@ _RUN_DEPTH: ContextVar[int] = ContextVar("qingflow_mcp_tool_run_depth", default=
 
 
 class ToolBase:
-    def __init__(self, sessions: SessionStore, backend: BackendClient) -> None:
+    def __init__(self, sessions: SessionStore | CliSessionFacade, backend: BackendClient) -> None:
         self.sessions = sessions
         self.backend = backend
 
@@ -30,7 +31,8 @@ class ToolBase:
         if cloud_context is not None:
             return cloud_context.as_tool_context(profile)
 
-        self._ensure_environment_credential_matches(profile)
+        if not self._uses_oauth(profile):
+            self._ensure_environment_credential_matches(profile)
         session_profile = self.sessions.get_profile(profile)
         if session_profile is None:
             raise QingflowApiError.auth_required(profile)
@@ -83,8 +85,18 @@ class ToolBase:
                     return func(refreshed_profile, refreshed_context)
                 except QingflowApiError as refreshed_error:
                     self._handle_error(profile, refreshed_error)
+            if error.looks_like_invalid_token() and self._refresh_oauth_session(profile):
+                try:
+                    refreshed_profile, _, refreshed_context = self._require_context(
+                        profile,
+                        require_workspace=require_workspace,
+                    )
+                    return func(refreshed_profile, refreshed_context)
+                except QingflowApiError as refreshed_error:
+                    self._handle_error(profile, refreshed_error)
             if (
                 error.looks_like_invalid_token()
+                and not self._uses_oauth(profile)
                 and session_profile is not None
                 and backend_session is not None
                 and self._refresh_session_from_credential(
@@ -121,6 +133,19 @@ class ToolBase:
                     http_status=error.http_status,
                 )
                 raise_tool_error(refreshed_error)
+            if self._uses_oauth(profile):
+                oauth_error = QingflowApiError(
+                    category="auth",
+                    message=(
+                        f"OAuth session for profile '{profile}' has expired and could not be refreshed. "
+                        "Run auth login --method oauth again."
+                    ),
+                    backend_code=error.backend_code,
+                    request_id=error.request_id,
+                    http_status=error.http_status,
+                    details={"reason": "oauth_relogin_required"},
+                )
+                raise_tool_error(oauth_error)
             self.sessions.invalidate(profile)
             error = QingflowApiError(
                 category="auth",
@@ -142,6 +167,20 @@ class ToolBase:
         current_cloud_context.set(refreshed_context)
         return True
 
+    def _refresh_oauth_session(self, profile: str) -> bool:
+        if not self._uses_oauth(profile):
+            return False
+        assert isinstance(self.sessions, CliSessionFacade)
+        try:
+            return self.sessions.refresh_oauth_session(profile, force=True)
+        except QingflowApiError as error:
+            if (error.details or {}).get("reason") == "oauth_relogin_required":
+                raise
+            return False
+
+    def _uses_oauth(self, profile: str) -> bool:
+        return isinstance(self.sessions, CliSessionFacade) and self.sessions.uses_oauth(profile)
+
     def _refresh_session_from_credential(
         self,
         profile: str,