@siming-org/server 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -2,11 +2,48 @@ import { Hono } from 'hono';
 import { SimingClient, SimingConfig } from '@siming-org/core';
 import { ServerType } from '@hono/node-server';
 
+/**
+ * 认证中间件（T202608310001 F3）——鉴权三层模型的第一层。
+ * 职责：① 预鉴权可达端点直通（whoami 除外——做尝试性凭证解析，失败落 none 不 401）
+ * ② open 模式直通 ③ Bearer Token / 会话 Cookie 认证 ④ admin-only 端点集中拦截。
+ * 错误通道：core AppError 子类（UnauthorizedError 401 / ForbiddenError 403），onError 单源响应。
+ * 资源级归属校验（assertProjectScope/resolveProjectFilter）由各路由 handler 经 routes/auth-guard.ts 承担。
+ */
+/** 请求认证上下文（app Variables 注入，handler 经 c.get('auth') 消费） */
+type AuthContext = {
+    kind: 'open';
+} | {
+    kind: 'admin';
+} | {
+    kind: 'project';
+    projectId: string;
+} | {
+    kind: 'none';
+};
+/**
+ * admin-only 路由表（D8：按 routes/ 真实路由表机械枚举——project 上下文命中即 403）。
+ * ⚠ 新增/变更端点必须同步本表（E2E 403 矩阵从同一路由清单遍历生成，防手写漏项）。
+ * skill/agent 的作用域相关写（scope=global 创建/copy）路径级无法判定 → 由 handler 级
+ * requireAdminLike 承担（见 routes/auth-guard.ts）。不含：auth/password（会话/admin token 均可用）。
+ */
+declare const ADMIN_ONLY_ROUTES: readonly {
+    method: string;
+    pattern: RegExp;
+}[];
+
 interface CreateAppOptions {
     /** Web UI 根目录注入（测试用）；null = 显式禁用静态服务。默认走解析链 resolveWebDistRoot() */
     webRoot?: string | null;
+    /** 鉴权开关（T202608310001 F1）：默认 false = 现状全权（存量行为零破坏） */
+    authEnabled?: boolean;
+}
+/** Hono Variables：认证上下文（中间件注入，守卫/路由消费） */
+interface AuthEnv {
+    Variables: {
+        auth: AuthContext;
+    };
 }
-declare function createApp(client: SimingClient, opts?: CreateAppOptions): Hono;
+declare function createApp(client: SimingClient, opts?: CreateAppOptions): Hono<AuthEnv>;
 
 /**
  * startServer（N018 §2/D2 拆分）：main.ts 薄壳化后由两处消费——
@@ -44,4 +81,4 @@ declare function resolveWebDistRoot(): string | null;
  */
 declare function createStaticRoutes(webRoot: string | null): Hono;
 
-export { type CreateAppOptions, MONGO_PROBE_TIMEOUT_MS, type RunningServer, createApp, createStaticRoutes, resolveWebDistRoot, startServer };
+export { ADMIN_ONLY_ROUTES, type AuthContext, type CreateAppOptions, MONGO_PROBE_TIMEOUT_MS, type RunningServer, createApp, createStaticRoutes, resolveWebDistRoot, startServer };

package/dist/index.js

@@ -1,11 +1,13 @@
 import {
+  ADMIN_ONLY_ROUTES,
   MONGO_PROBE_TIMEOUT_MS,
   createApp,
   createStaticRoutes,
   resolveWebDistRoot,
   startServer
-} from "./chunk-T7QAGG73.js";
+} from "./chunk-XZWVPHDG.js";
 export {
+  ADMIN_ONLY_ROUTES,
   MONGO_PROBE_TIMEOUT_MS,
   createApp,
   createStaticRoutes,

package/dist/main.js

@@ -1,14 +1,25 @@
 import {
   startServer
-} from "./chunk-T7QAGG73.js";
+} from "./chunk-XZWVPHDG.js";
 
 // src/config/env.ts
-import { SIMING_CONFIG_ENV_KEYS, SIMING_CONFIG_KEYS, SimingConfigSchema } from "@siming-org/core";
+import { SIMING_CONFIG_ENV_KEYS, SIMING_CONFIG_KEYS, SimingConfigSchema, parseAuthEnabledEnvValue } from "@siming-org/core";
 function parseEnv(processEnv = process.env) {
   const input = {};
   for (const key of SIMING_CONFIG_KEYS) {
     const value = processEnv[SIMING_CONFIG_ENV_KEYS[key]];
-    if (value !== void 0) input[key] = value;
+    if (value === void 0) continue;
+    if (key === "auth") {
+      try {
+        input[key] = { enabled: parseAuthEnabledEnvValue(value) };
+      } catch (e) {
+        console.error(`Invalid environment configuration:
+  ${SIMING_CONFIG_ENV_KEYS[key]}: ${e instanceof Error ? e.message : String(e)}`);
+        process.exit(1);
+      }
+      continue;
+    }
+    input[key] = value;
   }
   const result = SimingConfigSchema.safeParse(input);
   if (!result.success) {
@@ -21,7 +32,36 @@ function parseEnv(processEnv = process.env) {
   return result.data;
 }
 
+// src/config/workspace-guard.ts
+import { existsSync } from "fs";
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { SIMING_CONFIG_ENV_KEYS as SIMING_CONFIG_ENV_KEYS2 } from "@siming-org/core";
+function findDevJsonDir(startDirs, exists = existsSync) {
+  for (const startDir of startDirs) {
+    let current = startDir;
+    for (; ; ) {
+      if (exists(`${current}/.siming/dev.json`)) return current;
+      const parent = dirname(current);
+      if (parent === current) break;
+      current = parent;
+    }
+  }
+  return null;
+}
+function assertDirectStartAllowed(processEnv = process.env, startDirs = [dirname(fileURLToPath(import.meta.url)), process.cwd()], exists = existsSync) {
+  const hasPort = processEnv[SIMING_CONFIG_ENV_KEYS2.port] !== void 0;
+  const hasMongoUri = processEnv[SIMING_CONFIG_ENV_KEYS2.mongoUri] !== void 0;
+  if (hasPort && hasMongoUri) return;
+  if (findDevJsonDir(startDirs, exists) === null) return;
+  console.error("[siming] \u68C0\u6D4B\u5230\u5E76\u884C\u5F00\u53D1\u5DE5\u4F5C\u533A\uFF08.siming/dev.json\uFF09\uFF0C\u4F46 server \u76F4\u542F\u7F3A\u5C11\u9694\u79BB\u914D\u7F6E\uFF0C\u62D2\u7EDD\u542F\u52A8\uFF1A");
+  console.error("  \u6B63\u786E\u5165\u53E3\uFF1Apnpm dev \u6216 bash scripts/dev-server.sh");
+  console.error(`  \u6216\u663E\u5F0F\u4F20\u5165 ${SIMING_CONFIG_ENV_KEYS2.port} \u4E0E ${SIMING_CONFIG_ENV_KEYS2.mongoUri} \u540E\u76F4\u542F`);
+  process.exit(1);
+}
+
 // src/main.ts
+assertDirectStartAllowed();
 var env = parseEnv();
 async function bootstrap() {
   const running = await startServer(env);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@siming-org/server",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "license": "MIT",
   "author": "Wuchao",
   "engines": {
@@ -21,7 +21,7 @@
     "@hono/zod-validator": "^0.4.2",
     "hono": "^4.6.0",
     "zod": "^4.4.3",
-    "@siming-org/core": "0.3.0"
+    "@siming-org/core": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",