@skillbuilder/minitool-cli-auth 0.0.0-beta-20261027053041051 → 0.0.0-stage

package/README.md

@@ -1,36 +1,3 @@
-# @skillbuilder/minitool-cli-auth
+# Temporary Holding Version
 
-`redminitool` 的凭据与登录生命周期包。默认 `DeviceAuthService` 复用 `skill-cli/feat-pipline-auth` 的设备码扫码策略：
-申请设备码、S256 PKCE、授权轮询、Token 交换和刷新。`HttpDeviceAuthApi` 由宿主注入网关与请求函数，协议路径集中定义；
-公开提示仅含扫码链接、备用链接、用户码和到期时间，设备码/verifier 不进入 UI DTO。
-`ConfigFiles` 安全保存有时效的等待状态，支持重启恢复、信号中断与跨进程取消；成功或终止后清理。
-Token 按所属 API origin 校验，临近过期时进行进程内合并续期；并发 logout 或账号切换后，旧续期结果不能写回。
-确定失效的刷新凭据清理并要求重新扫码，临时网络失败保留凭据。`getAuthState` 不发网络请求，access token 过期但 refresh 仍有效时
-表示可续期的 authenticated 状态，业务实际使用前由 `getAccessToken` 续期。prod/beta 由宿主使用独立 `ConfigFiles` 目录隔离。
-
-原有 `SecretAuthService` 使用 Secret ID / Secret Key、随机 nonce 和分钟
-时间生成 MD5 登录证明，请求平台 `cli_auth` 接口；Secret Key 不出网、不落盘。真实接口成功后返回的
-`data.cli_token` 当前就是服务端确认后的该证明，按 7200 秒短期可重放凭据管理；响应不含 `secret_id`，
-持久化时使用本次已验证的请求值补齐。若未来响应包含 `secret_id`，则必须与请求身份一致。
-登录会校验 token、服务端 `create_at` 和 TTL 可安全表示后再执行持久化。
-真实认证接口由宿主传入完整 HTTPS URL；本包不内置旧云开发接口路径。
-`ManagedCredentialStore` 支持文件与系统 Keyring，默认文件，显式切换时写入并回读目标、提交存储模式，
-最后清理旧位置；任一步失败都会保持或恢复原模式，不会从残留明文文件静默恢复 Keyring 凭据。
-Keyring 通过可选且固定版本的 `@napi-rs/keyring@2.0.0` 原生模块按配置路径隔离条目，在 macOS 映射
-Keychain、Windows 映射 Credential Manager、Linux 映射 Secret Service / Keyutils。原生模块仅在使用或
-探测 Keyring 时延迟加载；读取、写入和删除错误会转换为不含凭据的稳定错误，正常读写失败时不会静默
-写回 `auth.json`。`inspect()` 只返回后端、可用性和失败类别，不返回条目名或凭据。宿主显式执行
-`auth storage --check` 时只做只读探测；无论原生包/平台二进制不可加载，还是 Keyring 被锁定或访问失败，
-都只报错并提示开发者自行执行 `auth storage --set file`，不会修改配置或凭据。显式切换时若原 Keyring
-无法读取，则仅将配置切为文件模式，不删除无法访问的旧条目，也不会伪造或恢复登录态，开发者需重新登录。
-Keyring → 文件切换若旧条目删除失败，会回滚新文件并保持原模式；配置内容损坏时 logout 仍尝试同时
-清理文件和 Keyring，并将配置重置为无凭据的文件模式；路径安全错误及无法保证清理完成的 Keyring
-错误仍会显式失败。
-
-本包统一定义 `AuthState`、`CreatorIdentity`、认证方式（device / secret）与凭据来源；`getAuthState()` 只返回脱敏的
-`authenticated / anonymous / unavailable` 三态，并区分未登录、过期与凭据存储故障。对业务层只暴露
-`AccessTokenProvider#getAccessToken()` 窄接口。`AuthService` 负责登录、登出、脱敏登录态与当前创作者身份，
-由 CLI bootstrap 组装。业务 core 不读取 `auth.json`，也不感知 Keyring、Secret 或登录接口。
-
-本包不包含 CLI 输出、创作者小工具业务规则或资源权限判定。过期的当前 Secret 会话会删除并要求重新登录；
-设备码 OAuth 则使用参考分支已有的 refresh 协议续期。
+This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.

package/package.json

@@ -1,28 +1,6 @@
 {
   "name": "@skillbuilder/minitool-cli-auth",
-  "version": "0.0.0-beta-20261027053041051",
-  "description": "redminitool credential storage and Secret login lifecycle",
-  "main": "lib/index.js",
-  "types": "types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./types/index.d.ts",
-      "require": "./lib/index.js",
-      "default": "./lib/index.js"
-    }
-  },
-  "files": [
-    "lib",
-    "types"
-  ],
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "dependencies": {
-    "@skillbuilder/minitool-cli-config": "0.0.0-beta-20261027053041051"
-  },
-  "optionalDependencies": {
-    "@napi-rs/keyring": "2.0.0"
-  },
-  "license": "ISC"
-}
+  "version": "0.0.0-stage",
+  "stub": true,
+  "description": "Temporary package placeholder for staged publishing"
+}

package/lib/auth-state.js

@@ -1,36 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreatorIdentityUnavailableError = exports.AuthenticationRequiredError = exports.CredentialStoreUnavailableError = void 0;
-exports.requireAuthenticatedAuthState = requireAuthenticatedAuthState;
-class CredentialStoreUnavailableError extends Error {
-    code = "CREDENTIAL_STORE_UNAVAILABLE";
-    constructor(message = "无法读取本地凭据存储，请检查系统凭据库或配置文件。") {
-        super(message);
-        this.name = "CredentialStoreUnavailableError";
-    }
-}
-exports.CredentialStoreUnavailableError = CredentialStoreUnavailableError;
-class AuthenticationRequiredError extends Error {
-    code = "AUTHENTICATION_REQUIRED";
-    constructor(message = "未登录，请先完成小红书小工具认证。") {
-        super(message);
-        this.name = "AuthenticationRequiredError";
-    }
-}
-exports.AuthenticationRequiredError = AuthenticationRequiredError;
-class CreatorIdentityUnavailableError extends Error {
-    code = "CREATOR_IDENTITY_UNAVAILABLE";
-    constructor(message = "登录态有效，但未能获取创作者身份。") {
-        super(message);
-        this.name = "CreatorIdentityUnavailableError";
-    }
-}
-exports.CreatorIdentityUnavailableError = CreatorIdentityUnavailableError;
-function requireAuthenticatedAuthState(state) {
-    if (state.status === "unavailable")
-        throw new CredentialStoreUnavailableError();
-    if (state.status === "anonymous") {
-        throw new AuthenticationRequiredError(state.reason === "expired" ? "登录态已过期，请重新登录。" : undefined);
-    }
-    return state;
-}

package/lib/credential-store.js

@@ -1,20 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileCredentialStore = void 0;
-class FileCredentialStore {
-    files;
-    constructor(files) {
-        this.files = files;
-    }
-    get() {
-        return this.files.readAuth();
-    }
-    update(config) {
-        this.files.writeGlobal(this.files.readGlobal());
-        this.files.writeAuth(config);
-    }
-    delete() {
-        this.files.clearAuth();
-    }
-}
-exports.FileCredentialStore = FileCredentialStore;

package/lib/credential-store.test.js

@@ -1,204 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const strict_1 = __importDefault(require("node:assert/strict"));
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-const node_test_1 = __importDefault(require("node:test"));
-const minitool_cli_config_1 = require("@skillbuilder/minitool-cli-config");
-const credential_store_1 = require("./credential-store");
-const keyring_credential_store_1 = require("./keyring-credential-store");
-const managed_credential_store_1 = require("./managed-credential-store");
-const credential = {
-    schemaVersion: 1,
-    method: "secret",
-    secretId: "creator-id",
-    sessionToken: "server-session-token",
-    issuedAt: "2026-09-01T00:00:00.000Z",
-    expiresAt: "2030-09-01T00:00:00.000Z",
-};
-function fixture(t, behavior = {}) {
-    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), "redminitool-keyring-test-"));
-    t.after(() => fs.rmSync(homeDir, { recursive: true, force: true }));
-    const state = { password: null };
-    const entryFactory = () => {
-        if (behavior.packageUnavailable)
-            throw new keyring_credential_store_1.KeyringUnavailableError();
-        if (behavior.unavailable)
-            throw new Error("keyring unavailable");
-        return {
-            getPassword: () => state.password,
-            setPassword: (value) => {
-                state.password = behavior.transformWrite?.(value) ?? value;
-            },
-            deleteCredential: () => {
-                if (behavior.failDelete)
-                    throw new Error("keyring delete failed");
-                const existed = state.password !== null;
-                state.password = null;
-                return existed;
-            },
-        };
-    };
-    const files = new minitool_cli_config_1.ConfigFiles(homeDir);
-    const file = new credential_store_1.FileCredentialStore(files);
-    const keyring = new keyring_credential_store_1.KeyringCredentialStore(files.paths.auth, entryFactory);
-    const store = new managed_credential_store_1.ManagedCredentialStore(files, file, keyring);
-    return { files, file, keyring, state, store };
-}
-(0, node_test_1.default)("文件与 Keyring 双向切换只保留目标副本", (t) => {
-    const { files, state, store } = fixture(t);
-    store.update(credential);
-    store.use("keychain");
-    strict_1.default.equal(store.getMode(), "keychain");
-    strict_1.default.notEqual(state.password, null);
-    strict_1.default.equal(fs.existsSync(files.paths.auth), false);
-    store.use("file");
-    strict_1.default.equal(store.getMode(), "file");
-    strict_1.default.equal(state.password, null);
-    strict_1.default.deepEqual(store.get(), credential);
-});
-(0, node_test_1.default)("Keyring 不可用时不切换或降级凭据", (t) => {
-    const { store } = fixture(t, { unavailable: true });
-    store.update(credential);
-    strict_1.default.throws(() => store.use("keychain"), /系统凭据库写入失败/);
-    strict_1.default.equal(store.getMode(), "file");
-    strict_1.default.deepEqual(store.get(), credential);
-});
-(0, node_test_1.default)("显式检查只报告故障，人工切换文件模式时保留不可读的 Keyring 条目", (t) => {
-    const behavior = {};
-    const { files, state, store } = fixture(t, behavior);
-    store.use("keychain");
-    store.update(credential);
-    behavior.packageUnavailable = true;
-    strict_1.default.deepEqual(store.inspect(true), {
-        configuredMode: "keychain",
-        provider: (0, keyring_credential_store_1.getSystemCredentialStoreName)(),
-        protection: "os_protected_store",
-        keyringAvailable: false,
-        keyringIssue: "package_unavailable",
-    });
-    strict_1.default.equal(store.getMode(), "keychain");
-    strict_1.default.deepEqual(store.use("file"), {
-        changed: true,
-        migrated: false,
-        sourceRetained: true,
-    });
-    strict_1.default.equal(store.getMode(), "file");
-    strict_1.default.equal(files.readAuth(), null);
-    strict_1.default.notEqual(state.password, null);
-    const accessBehavior = {};
-    const access = fixture(t, accessBehavior);
-    access.store.use("keychain");
-    access.store.update(credential);
-    accessBehavior.unavailable = true;
-    strict_1.default.equal(access.store.inspect(true).keyringIssue, "access_error");
-    strict_1.default.deepEqual(access.store.use("file"), {
-        changed: true,
-        migrated: false,
-        sourceRetained: true,
-    });
-});
-(0, node_test_1.default)("Keyring 模式清理残留文件且不从中恢复凭据", (t) => {
-    const { files, state, store } = fixture(t);
-    store.update(credential);
-    store.use("keychain");
-    files.writeAuth(credential);
-    strict_1.default.deepEqual(store.get(), credential);
-    strict_1.default.equal(fs.existsSync(files.paths.auth), false);
-    state.password = null;
-    files.writeAuth(credential);
-    strict_1.default.equal(store.get(), null);
-    strict_1.default.equal(fs.existsSync(files.paths.auth), false);
-});
-(0, node_test_1.default)("存储状态探测不暴露凭据", (t) => {
-    const { store } = fixture(t);
-    store.update(credential);
-    store.use("keychain");
-    const status = store.inspect();
-    strict_1.default.equal(status.configuredMode, "keychain");
-    strict_1.default.equal(status.protection, "os_protected_store");
-    strict_1.default.equal(status.keyringAvailable, true);
-    strict_1.default.equal(JSON.stringify(status).includes(credential.sessionToken), false);
-});
-(0, node_test_1.default)("损坏的 Keyring 内容只返回稳定错误", () => {
-    const store = new keyring_credential_store_1.KeyringCredentialStore("/tmp/redminitool-test-auth.json", () => ({
-        getPassword: () => '{"sessionToken":"sensitive-fragment"',
-        setPassword: () => undefined,
-        deleteCredential: () => true,
-    }));
-    strict_1.default.throws(() => store.get(), (error) => {
-        strict_1.default.equal(String(error), "KeyringAccessError: 系统凭据库读取失败；未执行明文文件降级");
-        strict_1.default.equal(String(error).includes("sensitive-fragment"), false);
-        return true;
-    });
-});
-(0, node_test_1.default)("回读校验比较完整凭据并清理无效目标", (t) => {
-    const { state, store } = fixture(t, {
-        transformWrite(value) {
-            return JSON.stringify({ ...JSON.parse(value), secretId: "tampered-id" });
-        },
-    });
-    store.update(credential);
-    strict_1.default.throws(() => store.use("keychain"), /凭据存储切换校验失败/);
-    strict_1.default.equal(store.getMode(), "file");
-    strict_1.default.equal(state.password, null);
-    strict_1.default.deepEqual(store.get(), credential);
-});
-(0, node_test_1.default)("切换后清理来源失败时回滚模式和目标副本", (t) => {
-    const behavior = {};
-    const { files, state, store } = fixture(t, behavior);
-    store.use("keychain");
-    store.update(credential);
-    behavior.failDelete = true;
-    strict_1.default.throws(() => store.use("file"), /系统凭据库删除失败/);
-    strict_1.default.equal(store.getMode(), "keychain");
-    strict_1.default.equal(fs.existsSync(files.paths.auth), false);
-    strict_1.default.notEqual(state.password, null);
-});
-(0, node_test_1.default)("配置损坏时登出仍清理文件与 Keyring", (t) => {
-    const { files, file, keyring, state, store } = fixture(t);
-    file.update(credential);
-    keyring.update(credential);
-    fs.writeFileSync(files.paths.config, "{broken-config");
-    store.delete();
-    strict_1.default.equal(files.readAuth(), null);
-    strict_1.default.equal(state.password, null);
-    strict_1.default.deepEqual(files.readGlobal(), { schemaVersion: 1, credentialStore: "file" });
-});

package/lib/device-auth-api.js

@@ -1,122 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HttpDeviceAuthApi = exports.DeviceAuthError = exports.DEVICE_AUTH_SCOPES = exports.DEVICE_AUTH_PATHS = void 0;
-exports.authRecord = authRecord;
-exports.authText = authText;
-const PREFIX = "/api/sns/v1/creator/red_skill";
-exports.DEVICE_AUTH_PATHS = Object.freeze({
-    create: `${PREFIX}/create_cli_oauth_device_code`,
-    poll: `${PREFIX}/poll_cli_oauth_device_token`,
-    exchange: `${PREFIX}/exchange_cli_oauth_token`,
-    refresh: `${PREFIX}/refresh_cli_oauth_token`,
-});
-exports.DEVICE_AUTH_SCOPES = ["base_info", "skill_publish"];
-class DeviceAuthError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-        this.name = "DeviceAuthError";
-    }
-}
-exports.DeviceAuthError = DeviceAuthError;
-function authRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function authText(value) {
-    return typeof value === "string" ? value : "";
-}
-class HttpDeviceAuthApi {
-    request;
-    apiBaseUrl;
-    constructor(baseUrl, request = fetch) {
-        this.request = request;
-        const url = new URL(baseUrl);
-        if ((url.protocol !== "https:" &&
-            !(url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname))) ||
-            url.username ||
-            url.password ||
-            url.search ||
-            url.hash ||
-            url.pathname !== "/")
-            throw new Error("扫码鉴权地址须为 HTTPS origin（本机测试服务除外）");
-        this.apiBaseUrl = url.origin;
-    }
-    async call(operation, payload, signal) {
-        const url = new URL(exports.DEVICE_AUTH_PATHS[operation], this.apiBaseUrl);
-        const poll = operation === "poll";
-        if (poll)
-            url.searchParams.set("device_code", String(payload.device_code));
-        let response;
-        try {
-            response = await this.request(url, {
-                method: poll ? "GET" : "POST",
-                headers: poll ? undefined : { "content-type": "application/json" },
-                body: poll ? undefined : JSON.stringify(payload),
-                redirect: "error",
-                signal: signal
-                    ? AbortSignal.any([signal, AbortSignal.timeout(20_000)])
-                    : AbortSignal.timeout(20_000),
-            });
-        }
-        catch {
-            if (signal?.aborted)
-                throw new DeviceAuthError("AUTH_CANCELLED", "已取消扫码登录");
-            throw new DeviceAuthError("AUTH_UNAVAILABLE", "扫码鉴权服务暂不可用，请稍后重试");
-        }
-        if ([401, 403].includes(response.status) && operation === "refresh")
-            throw new DeviceAuthError("AUTH_EXPIRED", "登录态已失效，请重新扫码登录");
-        if (!response.ok)
-            throw new DeviceAuthError("AUTH_UNAVAILABLE", `扫码鉴权请求失败（HTTP ${response.status}）`);
-        let body;
-        try {
-            body = await response.json();
-        }
-        catch {
-            throw new DeviceAuthError("AUTH_INVALID_RESPONSE", "扫码鉴权响应格式无效");
-        }
-        if (!authRecord(body))
-            throw new DeviceAuthError("AUTH_INVALID_RESPONSE", "扫码鉴权响应格式无效");
-        const data = authRecord(body.data) ? body.data : body;
-        if (body.success === false ||
-            data.success === false ||
-            (body.code !== undefined && ![0, "0", "OK"].includes(body.code)))
-            throw new DeviceAuthError(operation === "refresh" &&
-                ["invalid_grant", "invalid_token", "token_expired"].includes(String(data.error ?? body.error))
-                ? "AUTH_EXPIRED"
-                : "AUTH_REJECTED", "扫码鉴权请求被拒绝，请重新登录");
-        return data;
-    }
-    async create(codeChallenge, signal) {
-        const data = await this.call("create", { code_challenge: codeChallenge, code_challenge_method: "S256", scopes: exports.DEVICE_AUTH_SCOPES }, signal);
-        const fallback = data.authorizeUrl ?? data.authorize_url;
-        return {
-            deviceCode: authText(data.deviceCode ?? data.device_code),
-            userCode: authText(data.userCode ?? data.user_code),
-            authorizeCommonUrl: authText(data.authorizeCommonUrl ?? data.authorize_common_url ?? fallback),
-            authorizeH5Url: authText(data.authorizeH5Url ?? data.authorize_h5_url ?? fallback),
-            expiresInSeconds: Number(data.expiresInSeconds ?? data.expires_in_seconds ?? 600),
-            pollIntervalSeconds: Number(data.pollIntervalSeconds ?? data.poll_interval_seconds ?? 5),
-        };
-    }
-    async poll(deviceCode, signal) {
-        const data = await this.call("poll", { device_code: deviceCode }, signal);
-        const raw = data.authStatus ?? data.auth_status ?? data.status;
-        const status = typeof raw === "number"
-            ? ["", "pending", "approved", "denied", "expired", "cancelled"][raw]
-            : String(raw).toLowerCase();
-        if (!["pending", "approved", "denied", "expired", "cancelled", "rejected"].includes(status))
-            throw new DeviceAuthError("AUTH_INVALID_RESPONSE", "未知的扫码授权状态");
-        return {
-            status: status === "rejected" ? "denied" : status,
-            authorizationCode: authText(data.authorizationCode ?? data.authorization_code) || undefined,
-        };
-    }
-    exchange(code, verifier, signal) {
-        return this.call("exchange", { authorization_code: code, code_verifier: verifier }, signal);
-    }
-    refresh(token) {
-        return this.call("refresh", { refresh_token: token });
-    }
-}
-exports.HttpDeviceAuthApi = HttpDeviceAuthApi;