@sleep2agi/commhub-server 0.9.0-preview.111 → 0.9.0-preview.113

package/src/create-node.ts

@@ -232,47 +232,91 @@ export type DaemonResolveResult =
   | { ok: true; daemonNodeId: string; daemonAlias: string; networkId: string }
   | { ok: false; error: string };
 
-export function resolveCallerDaemonTokenBound(opts: {
-  callerTokenIsNetwork: boolean;
-  callerTokenId: string | null | undefined;
-  enforceNetworkId: string | null | undefined;
-}): DaemonResolveResult {
-  if (!opts.callerTokenIsNetwork || !opts.callerTokenId) {
-    return { ok: false, error: "caller_not_a_daemon" };
-  }
-  if (!opts.enforceNetworkId) {
-    return { ok: false, error: "caller_not_a_daemon" };
-  }
+export type NodeCallerResolution =
+  | { ok: true; kind: "node"; nodeId: string; alias: string; networkId: string }
+  | { ok: true; kind: "unregistered"; alias: string; networkId: string }
+  | { ok: false; reason: "not_a_node_token" | "bound_node_missing" | "ambiguous" | "not_owner" };
+
+type NodeCallerRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
+
+// nodes has no unique (network, alias). An unbound token that hits several
+// rows is not rejected outright: the row owned by the token's issuer wins;
+// if that is still not unique, the node_id on the latest session for the
+// alias wins. Still not unique, then refuse.
+function disambiguateUnboundAlias(
+  rows: NodeCallerRow[],
+  userId: string | null,
+  alias: string,
+  networkId: string,
+): NodeCallerRow | undefined {
+  const owned = userId ? rows.filter((row) => row.owner_user_id === userId) : [];
+  if (owned.length === 1) return owned[0]; // board679-unbound-dup
+  const pool = owned.length > 1 ? owned : rows;
+  const recent = db.get<{ node_id: string | null }>(
+    `SELECT node_id FROM sessions WHERE alias = ?1 AND network_id = ?2 AND node_id IS NOT NULL ORDER BY updated_at DESC LIMIT 1`,
+    alias,
+    networkId,
+  );
+  const hit = recent?.node_id ? pool.filter((row) => row.node_id === recent.node_id) : [];
+  return hit.length === 1 ? hit[0] : undefined;
+}
+
+// One lookup for every caller-identity entry. The token name is a hint.
+// bound_node_id is the row: if that row is gone, refuse — do not look up by name.
+// An unbound token with no row in its network stays the token name. First
+// registration (report_status) still depends on that; sending and subscribing
+// do not get a second exception.
+export function resolveNodeCaller(tokenId: string | null | undefined): NodeCallerResolution {
+  if (!tokenId) return { ok: false, reason: "not_a_node_token" };
   const tokRow = db.get<{ name: string; network_id: string | null; user_id: string | null; bound_node_id: string | null; node_identity_epoch: number }>(
     `SELECT name, network_id, user_id, bound_node_id, node_identity_epoch FROM api_tokens WHERE token_id = ?1 AND revoked_at IS NULL`,
-    opts.callerTokenId,
+    tokenId,
   );
-  if (!tokRow || !tokRow.name || !tokRow.name.startsWith("node:")) {
-    return { ok: false, error: "caller_not_a_daemon" };
-  }
-  if (tokRow.network_id !== opts.enforceNetworkId) {
-    return { ok: false, error: "caller_not_a_daemon" };
+  if (!tokRow || !tokRow.name || !tokRow.name.startsWith("node:") || !tokRow.network_id) {
+    return { ok: false, reason: "not_a_node_token" };
   }
   const tokenAlias = tokRow.name.slice(5);
   type DaemonRow = { node_id: string; alias: string; network_id: string; owner_user_id: string | null };
   const rows = tokRow.bound_node_id
     ? db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE node_id = ?1 AND network_id = ?2`, tokRow.bound_node_id, tokRow.network_id)
     : db.all<DaemonRow>(`SELECT node_id, alias, network_id, owner_user_id FROM nodes WHERE alias = ?1 AND network_id = ?2`, tokenAlias, tokRow.network_id);
-  const nodeRow = rows.length === 1 ? rows[0] : undefined;
-  if (!nodeRow) {
-    return { ok: false, error: "caller_not_a_daemon" };
+  const nodeRow = rows.length === 1
+    ? rows[0]
+    : (!tokRow.bound_node_id && rows.length > 1
+      ? disambiguateUnboundAlias(rows, tokRow.user_id, tokenAlias, tokRow.network_id)
+      : undefined);
+  // board679-bound-row-missing: a bound token with no row is refused. Do not look up by name.
+  if (tokRow.bound_node_id && !nodeRow) return { ok: false, reason: "bound_node_missing" };
+  if (!nodeRow && rows.length === 0) {
+    return { ok: true, kind: "unregistered", alias: tokenAlias, networkId: tokRow.network_id };
   }
-  // Legacy daemon tokens have no bound_node_id: retain their owner's authority.
-  // A token name is a lookup hint, never proof of authority over that node.
+  if (!nodeRow) return { ok: false, reason: "ambiguous" };
+  // Legacy unbound tokens keep their owner's authority. A token name is only a hint.
   const ownsNode = !!tokRow.user_id && tokRow.user_id === nodeRow.owner_user_id;
   const boundToNode = tokRow.bound_node_id === nodeRow.node_id;
   const legacyOwnerless = nodeRow.owner_user_id === null && tokRow.node_identity_epoch === 0;
-  if (!ownsNode && !boundToNode && !legacyOwnerless) return { ok: false, error: "caller_not_a_daemon" };
+  if (!ownsNode && !boundToNode && !legacyOwnerless) return { ok: false, reason: "not_owner" };
+  return { ok: true, kind: "node", nodeId: nodeRow.node_id, alias: nodeRow.alias, networkId: nodeRow.network_id };
+}
+
+export function resolveCallerDaemonTokenBound(opts: {
+  callerTokenIsNetwork: boolean;
+  callerTokenId: string | null | undefined;
+  enforceNetworkId: string | null | undefined;
+}): DaemonResolveResult {
+  if (!opts.callerTokenIsNetwork || !opts.callerTokenId || !opts.enforceNetworkId) {
+    return { ok: false, error: "caller_not_a_daemon" };
+  }
+  const resolved = resolveNodeCaller(opts.callerTokenId);
+  // No row yet is not a daemon. First registration stays on report_status.
+  if (!resolved.ok || resolved.kind !== "node" || resolved.networkId !== opts.enforceNetworkId) {
+    return { ok: false, error: "caller_not_a_daemon" };
+  }
   return {
     ok: true,
-    daemonNodeId: nodeRow.node_id,
-    daemonAlias: nodeRow.alias,
-    networkId: nodeRow.network_id,
+    daemonNodeId: resolved.nodeId,
+    daemonAlias: resolved.alias,
+    networkId: resolved.networkId,
   };
 }
 

package/src/daemon-token-owner-http.test.ts

@@ -116,7 +116,7 @@ test("legacy owner and exact bound identity remain supported", async () => {
   const denied = await fetch(`${base}/mcp`, { method: "POST", headers: { Authorization: `Bearer ${revoked}` } });
   expect(denied.status).toBe(401);
   expect(await call(legacy, "ack_adopt_request", { request_id: requestId, status: "adopted" })).toMatchObject({ ok: true, status: "active" });
-  expect((await call(legacy, "list_my_children")).children).toContainEqual({ child_node_id: child, alias: child, lifecycle_state: "active", managed: "adopted" });
+  expect((await call(legacy, "list_my_children")).children).toContainEqual({ child_node_id: child, alias: child, lifecycle_state: "active", managed: "adopted", binding_request_id: requestId });
   const stop = await call(owner.token, "stop_node", { node_id: child, network_id: owner.network_id });
   expect(stop.ok).toBe(true);
   expect((await call(legacy, "get_stop_request", { request_id: stop.request_id })).ok).toBe(true);
@@ -169,9 +169,10 @@ test("fresh ID cannot mint another node alias", async () => {
   expect((await call(legacy, "list_my_children")).ok).toBe(true);
 });
 
-test("duplicate legacy aliases use bound IDs and unbound ambiguity fails closed", async () => {
+test("duplicate legacy aliases use bound IDs and an unbound token follows its owner", async () => {
   // Historical duplicate rows: the member's row was inserted first. Neither
-  // lookup order nor alias can redirect the later owner's exact-bound token.
+  // lookup order nor alias can redirect an exact-bound token. An unbound
+  // token resolves to the row its issuer owns.
   const { hashToken, generateNetworkToken } = await import("./db.js");
   const tokens: string[] = [];
   for (const [id, user] of [["n_duplicate_first", member.user.user_id], ["n_duplicate_owner", owner.user.user_id]]) {
@@ -188,9 +189,13 @@ test("duplicate legacy aliases use bound IDs and unbound ambiguity fails closed"
     expect((await call(tokens[i], "get_adopt_request", { request_id: i === 0 ? "n_duplicate_owner" : "n_duplicate_first" })).ok).toBe(false);
   }
   db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_owner'");
-  expect(await call(tokens[1], "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  expect((await call(tokens[1], "list_my_children")).ok).toBe(true);
+  expect((await call(tokens[1], "get_adopt_request", { request_id: "n_duplicate_owner" })).ok).toBe(true);
+  expect((await call(tokens[1], "get_adopt_request", { request_id: "n_duplicate_first" })).ok).toBe(false);
   db.run("UPDATE api_tokens SET bound_node_id=NULL WHERE token_id='n_duplicate_first'");
-  expect(await call(tokens[0], "list_my_children")).toMatchObject({ ok: false, error: "caller_not_a_daemon" });
+  expect((await call(tokens[0], "list_my_children")).ok).toBe(true);
+  expect((await call(tokens[0], "get_adopt_request", { request_id: "n_duplicate_first" })).ok).toBe(true);
+  expect((await call(tokens[0], "get_adopt_request", { request_id: "n_duplicate_owner" })).ok).toBe(false);
   expect((await mint(owner.token, owner.network_id, "duplicate_fixture", "n_third_duplicate")).status).toBe(400);
 });
 

package/src/db.ts

@@ -646,12 +646,26 @@ for (const ddl of [
   // 登录会话的设备标识(GET /api/auth/sessions 显示用):客户端自报的 client_label + 登录请求的 User-Agent。
   "ALTER TABLE api_tokens ADD COLUMN client_label TEXT",
   "ALTER TABLE api_tokens ADD COLUMN user_agent TEXT",
+  // #711 不绑网络的用户令牌分两类:'login' = 浏览器 / app 的登录会话;'cli' = anet 命令行登录、
+  // POST /api/auth/tokens 建的具名脚本令牌。只用于展示和 keep_cli_tokens 那条显式保留路径;节点 / 网络令牌(network_id 非空)不填。
+  "ALTER TABLE api_tokens ADD COLUMN kind TEXT",
 ]) {
   try { db.exec(ddl); }
   catch (e: any) {
     if (!/duplicate column|already exists/i.test(e?.message || "")) throw e;
   }
 }
+// #711 回填 kind:只碰 kind 还是 NULL 的非网络令牌(幂等;回滚到旧 Hub 期间新签的行,下次启动照样补上)。
+// 能明确认出是 anet 命令行的才算 'cli':scope='full'(POST /api/auth/tokens 建的具名令牌),
+// 或 client_label 去掉首尾空格后以「anet 」开头(anet 自报的「anet <版本> · <主机> · <子命令>」)。其余一律 'login'。
+// 用 SUBSTR + = 而不是 LIKE:SQLite 的 LIKE 不分大小写、PG 分,两边结果会不一样;= 两边都区分大小写,
+// 与运行时 isAnetClientLabel(auth.ts)同一条规则。
+db.run(
+  `UPDATE api_tokens SET kind = CASE
+     WHEN scope = 'full' OR SUBSTR(TRIM(client_label), 1, 5) = 'anet ' THEN 'cli'
+     ELSE 'login' END
+   WHERE network_id IS NULL AND kind IS NULL`,
+);
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_request ON api_tokens(request_id)`); }
 catch (e: any) { /* index may already exist */ void e; }
 try { db.exec(`CREATE INDEX IF NOT EXISTS idx_tokens_bound_node ON api_tokens(bound_node_id)`); }
@@ -969,7 +983,7 @@ db.exec(`
     requirement_id TEXT PRIMARY KEY,
     network_id     TEXT NOT NULL,
     title          TEXT NOT NULL,
-    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done')),
+    column_name    TEXT NOT NULL DEFAULT 'pool' CHECK(column_name IN ('pool', 'doing', 'done', 'abandoned')),
     priority       TEXT NOT NULL DEFAULT 'normal' CHECK(priority IN ('high', 'normal', 'low', 'lowest')),
     due_on         TEXT,
     assignee       TEXT,