@shawnstack/quickforge 1.7.7 → 1.7.9

package/server/routes/cloud.mjs

@@ -2,6 +2,7 @@ import { getQfAgentStatus } from '../cloud/qf-agent-process.mjs'
 import { isAuthenticatedAppClient } from '../access-policy.mjs'
 import { CloudClient, CloudApiError } from '../cloud/client.mjs'
 import { parseCloudBaseUrl } from '../cloud/config.mjs'
+import { armAgentAutoApproval, clearAgentAutoApproval, retryAgentAutoApproval } from '../cloud/auto-approval.mjs'
 import { createCloudCredentialStore } from '../cloud/credential-store.mjs'
 import { getCloudRuntime, invalidateCloudRuntime } from '../cloud/runtime.mjs'
 import {
@@ -22,6 +23,7 @@ const JSON_WRITE_ROUTES = new Set([
   'POST /api/cloud/device/start',
   'POST /api/cloud/device/poll',
   'POST /api/cloud/device/cancel',
+  'POST /api/cloud/remote/authorize-retry',
 ])
 
 function routeError(message, statusCode, code) {
@@ -81,6 +83,9 @@ export function createCloudRouteHandler({
   invalidateRuntime = invalidateCloudRuntime,
   cloudClientFactory = (config) => new CloudClient(config),
   qfAgentStatus = getQfAgentStatus,
+  armAutoApproval = armAgentAutoApproval,
+  clearAutoApproval = clearAgentAutoApproval,
+  retryAutoApproval = retryAgentAutoApproval,
   onServiceConfigChanged,
 } = {}) {
   async function runtimeOrError() {
@@ -108,6 +113,17 @@ export function createCloudRouteHandler({
       return
     }
 
+    // 自动批准失败后由 UI 发起的重试：仍使用服务端内存中保留的 user_code，
+    // 不要求用户打开授权页或输入码。
+    if (req.method === 'POST' && url.pathname === '/api/cloud/remote/authorize-retry') {
+      if (context.isLocalRequest !== true) {
+        throw routeError('Remote agent authorization can be retried only on this computer.', 403, 'cloud_local_only')
+      }
+      await readJsonBody(req, CLOUD_CONFIG_BODY_MAX_BYTES)
+      sendJson(res, 200, await retryAutoApproval())
+      return
+    }
+
     if (req.method === 'GET' && url.pathname === '/api/cloud/config') {
       sendJson(res, 200, publicCloudServiceConfig(await readServiceConfig({ strict: false })))
       return
@@ -138,6 +154,10 @@ export function createCloudRouteHandler({
       const currentConfig = await readServiceConfig({ strict: false })
       const nextUrl = parseCloudBaseUrl(body?.cloudUrl === undefined ? currentConfig.cloudUrl : body.cloudUrl).href
       const nextEnabled = body?.enabled === undefined ? currentConfig.enabled === true : body.enabled
+      // 仅在本机用户显式将 Cloud 服务从 disabled 切换为 enabled 时立即创建短时、一次性的
+      // agent 自动批准意图；其余场景由 qf-agent 在首次 authorizing 时依据本机 desktop 会话
+      // 自动 arm（认证远程客户端触发的变更以 'manual' 策略排除，见下方 notify）。
+      const enabledTransition = context.isLocalRequest === true && currentConfig.enabled !== true && nextEnabled === true
       const urlChanged = !sameCloudUrl(currentConfig.cloudUrl, nextUrl)
       if (body?.cloudUrl !== undefined) {
         const credentialStore = credentialStoreFactory()
@@ -152,9 +172,16 @@ export function createCloudRouteHandler({
       }
       await saveServiceConfig({ cloudUrl: nextUrl, enabled: nextEnabled })
       invalidateRuntime()
+      if (enabledTransition) armAutoApproval()
+      else if (!nextEnabled) clearAutoApproval()
       const saved = await readServiceConfig({ strict: false })
       const notify = context.onCloudServiceConfigChanged || onServiceConfigChanged
-      if (typeof notify === 'function') await notify(saved, { urlChanged })
+      // 认证远程客户端触发的配置变更以 manual 策略通知生命周期：由此启动的 agent
+      // 生命周期（含其自动重启）不自动创建批准意图；本机请求保持默认（允许自动 arm）。
+      const remoteInitiated = context.isLocalRequest !== true
+      if (typeof notify === 'function') {
+        await notify(saved, remoteInitiated ? { urlChanged, autoApprovalPolicy: 'manual' } : { urlChanged })
+      }
       sendJson(res, 200, publicCloudServiceConfig(saved))
       return
     }