@sleep2agi/commhub-server 0.9.0-preview.135 → 0.9.0-preview.136

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.135",
-  "description": "CommHub Server \u2014 AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
+  "version": "0.9.0-preview.136",
+  "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",
   "bin": {

package/src/auth-password-change-cli-tokens-http.test.ts

@@ -6,7 +6,7 @@
 //   · 默认(旧 app、dashboard 代理不带字段):撤销全部不绑网络的令牌 —— 客户端自报的 cli 也活不下来;
 //   · keep_cli_tokens=true(anet passwd 默认带):只撤其他 kind='login' 会话,保留的 cli 令牌列在响应里、不含令牌值;
 //   · 当前会话(换发后的新令牌)永远可用,而且沿用当前令牌的种类;
-//   · 节点 / 网络令牌永远不动;
+//   · 节点令牌不动;具名网络令牌默认保留,可显式revoke_network_tokens;
 //   · 启动迁移按 client_label / scope 回填存量令牌的 kind(夹具库,跑两遍幂等)。
 // SQLite 由 test798 自动收进;PostgreSQL 由 tests/test2123-hub-postgres-ladder 的 run_pg_tests_rc 跑同一个文件。
 
@@ -15,7 +15,7 @@ import { mkdtempSync, rmSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
 import { spawnSync } from "child_process";
-import { register, createNetworkTokenForNode, createToken, changePassword } from "./auth.js";
+import { register, createNetworkTokenForNode, createToken, createNetwork, changePassword } from "./auth.js";
 import { db, hashToken } from "./db.js";
 
 const DIR = mkdtempSync(join(tmpdir(), "anet-pwchange-kind-"));
@@ -292,3 +292,132 @@ describe("startup migration backfills api_tokens.kind on a fixture DB", () => {
     expect(Number(db.get<any>("SELECT COUNT(*) AS n FROM api_tokens WHERE token_id = ?1", id("node")).n)).toBe(1);
   }, 120_000);
 });
+
+
+describe("network password opt-in", () => {
+  const id = (token: string) => db.get<any>("SELECT token_id FROM api_tokens WHERE token_hash=?1", hashToken(token)).token_id;
+
+  test("default lists only the caller's active named network tokens across networks, without credentials", async () => {
+    const f = await fleet();
+    const second = createNetwork(f.userId, `pwk-second-${seq}`);
+    expect(second.ok).toBe(true);
+    const extra = createToken(f.userId, "second-network-script", second.network_id);
+    const other = await fleet();
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2 });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_network).toBe(0);
+    expect(r.body.revoked).toBe(5);
+    expect(r.body.kept_network_tokens.map((x: any) => x.token_id).sort()).toEqual([id(f.netToken), id(extra.token!)].sort());
+    for (const row of r.body.kept_network_tokens) {
+      expect(Object.keys(row).sort()).toEqual(["created_at", "last_used_at", "name", "network_id", "token_id"]);
+    }
+    const body = JSON.stringify(r.body);
+    expect(body.includes("token_hash")).toBe(false);
+    for (const t of [f.netToken, extra.token!, f.nodeToken, other.netToken]) expect(body.includes(t)).toBe(false);
+    expect(await works(f.netToken)).toBe(true);
+    expect(await works(extra.token!)).toBe(true);
+    expect(await works(other.netToken)).toBe(true);
+    expect(await works(r.body.token)).toBe(true);
+  });
+
+  test("explicit boolean opt-in revokes only own named network tokens, independently of keep_cli_tokens", async () => {
+    const f = await fleet();
+    const other = await fleet();
+    const second = createNetwork(f.userId, `pwk-revoke-second-${seq}`);
+    const extra = createToken(f.userId, "second-network-script", second.network_id);
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, keep_cli_tokens: true, revoke_network_tokens: true });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_network).toBe(2);
+    expect(r.body.revoked_login).toBe(2);
+    expect(r.body.revoked_cli).toBe(0);
+    expect(r.body.revoked).toBe(4);
+    expect(r.body.kept_network_tokens).toEqual([]);
+    expect(await works(f.netToken)).toBe(false);
+    expect(await works(extra.token!)).toBe(false);
+    expect(await works(other.netToken)).toBe(true);
+    expect(await works(other.app)).toBe(true);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(f.apiToken)).toBe(true);
+    expect(await works(r.body.token)).toBe(true);
+    expect(await works(f.app)).toBe(false);
+  });
+
+  for (const value of [false, "true", 1, null, {}]) {
+    test(`non-true option ${JSON.stringify(value)} cannot revoke network tokens`, async () => {
+      const f = await fleet();
+      const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, revoke_network_tokens: value });
+      expect(r.status).toBe(200);
+      expect(r.body.revoked_network).toBe(0);
+      expect(r.body.kept_network_tokens).toHaveLength(1);
+      expect(await works(f.netToken)).toBe(true);
+    });
+  }
+
+  test("scope and binding protect node credentials; inactive rows are neither listed nor counted", async () => {
+    const f = await fleet();
+    const legacy = createNetworkTokenForNode(f.userId, f.net, `legacy-pwk-${seq}`);
+    expect(legacy.ok).toBe(true);
+    const bound = createToken(f.userId, "mislabelled-bound-node", f.net);
+    db.run("UPDATE api_tokens SET bound_node_id=?1 WHERE token_id=?2", ["n-protected717", bound.token_id]);
+    const expired = createToken(f.userId, "expired-script", f.net);
+    db.run("UPDATE api_tokens SET expires_at=datetime('now','-1 day') WHERE token_id=?1", [expired.token_id]);
+    const revoked = createToken(f.userId, "revoked-script", f.net);
+    db.run("UPDATE api_tokens SET revoked_at=datetime('now') WHERE token_id=?1", [revoked.token_id]);
+    const r = await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, revoke_network_tokens: true });
+    expect(r.status).toBe(200);
+    expect(r.body.revoked_network).toBe(1);
+    expect(await works(f.nodeToken)).toBe(true);
+    expect(await works(bound.token!)).toBe(true);
+    for (const t of [bound, expired, revoked, legacy]) expect(db.get("SELECT token_id FROM api_tokens WHERE token_id=?1", t.token_id)).not.toBeNull();
+  });
+
+  test("bad old password or weak new password has no token side effects", async () => {
+    for (const body of [{ old_password: "wrong", new_password: PW2 }, { old_password: PW, new_password: "123" }]) {
+      const f = await fleet();
+      const r = await call(f.app, "POST", "/api/auth/password", { ...body, revoke_network_tokens: true });
+      expect(r.status).toBe(400);
+      for (const t of [f.app, f.netToken, f.apiToken, f.nodeToken]) expect(await works(t)).toBe(true);
+      expect((await call("", "POST", "/api/auth/login", { username: f.user, password: PW })).status).toBe(200);
+    }
+  });
+
+  test("network-scoped and unauthenticated credentials cannot invoke password change", async () => {
+    const f = await fleet();
+    for (const t of [f.netToken, f.nodeToken, ""]) {
+      expect((await call(t, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, revoke_network_tokens: true })).status).toBe(t ? 403 : 401);
+    }
+    expect(await works(f.netToken)).toBe(true);
+    expect(await works(f.app)).toBe(true);
+  });
+
+  test("a failed network revoke rolls back the password and earlier session deletions", async () => {
+    const f = await fleet();
+    const victim = id(f.netToken);
+    const fn = `pw717_failure_${seq}`;
+    const trigger = `pw717_trigger_${seq}`;
+    if (db.dialect === "postgres") db.exec(`CREATE FUNCTION ${fn}() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN IF OLD.token_id='${victim}' THEN RAISE EXCEPTION 'fixture717_delete_failure'; END IF; RETURN OLD; END; $$; CREATE TRIGGER ${trigger} BEFORE DELETE ON api_tokens FOR EACH ROW EXECUTE FUNCTION ${fn}()`);
+    else db.exec(`CREATE TRIGGER ${trigger} BEFORE DELETE ON api_tokens WHEN OLD.token_id='${victim}' BEGIN SELECT RAISE(ABORT,'fixture717_delete_failure'); END`);
+    try {
+      expect((await call(f.app, "POST", "/api/auth/password", { old_password: PW, new_password: PW2, revoke_network_tokens: true })).status).toBe(400);
+      for (const t of [f.app, f.appB, f.apiToken, f.netToken, f.nodeToken]) expect(await works(t)).toBe(true);
+      expect((await call("", "POST", "/api/auth/login", { username: f.user, password: PW })).status).toBe(200);
+      expect((await call("", "POST", "/api/auth/login", { username: f.user, password: PW2 })).status).toBe(401);
+    } finally {
+      db.exec(db.dialect === "postgres" ? `DROP TRIGGER ${trigger} ON api_tokens; DROP FUNCTION ${fn}()` : `DROP TRIGGER ${trigger}`);
+    }
+  });
+
+  test("direct changePassword keeps its current row and defaults to listing network tokens", async () => {
+    const f = await fleet();
+    const cur = id(f.app);
+    const r = changePassword(f.userId, PW, PW2, cur);
+    expect(r.ok).toBe(true);
+    expect(r.kept_network_tokens).toHaveLength(1);
+    expect(await works(f.app)).toBe(true);
+    const r2 = changePassword(f.userId, PW2, PW, cur, { revokeNetworkTokens: true, keepCliTokens: true });
+    expect(r2.ok).toBe(true);
+    expect(r2.revoked_network).toBe(1);
+    expect(await works(f.app)).toBe(true);
+    expect(await works(f.nodeToken)).toBe(true);
+  });
+});

package/src/auth.ts

@@ -2,7 +2,7 @@
  * V3 Auth module — user registration, login, token management
  */
 import { db, generateId, hashPassword, verifyPassword, hashToken, generateToken, generateUserToken, generateNetworkToken, uuidv4 } from "./db.js"; import { deleteDepartmentsForNetwork, groupTx, removeMemberFromChatGroups } from "./departments.js"; // #419: also ensures network_members.department_id exists (same line on purpose: docs pin auth.ts line numbers)
-import { WEAK_PASSWORDS } from "./password-dict.js";
+import { WEAK_PASSWORDS } from "./password-dict.js"; import { passwordNetworkTokens, type KeptNetworkToken } from "./password-network-tokens.js";
 import { checkNodeTokenClaim, legacyNodeHolder } from "./node-token-ownership.js";
 import { NETWORK_REST_COLUMNS, NETWORK_REST_SELECT, sqlColumns } from "./rest-projections.js";
 import { deleteAgentGrants, isAgentRestricted } from "./agent-access.js"; import { deleteTaskGrantsForMember, newMemberTaskAccess, type TaskAccessMode } from "./task-access.js"; // 一行两个 import:文档钉着 auth.ts 的行号
@@ -330,7 +330,7 @@ export type SessionClientInfo = { label?: unknown; userAgent?: unknown; kind?: u
 // 种类由客户端自报(client_kind / client_label),**只用于展示和「显式保留」那条路**:
 // 改密码默认仍撤销全部不绑网络的令牌(当前这条除外),调用方显式 keep_cli_tokens=true 才保留 'cli'。
 // 所以一个自称 cli 的令牌永远不能靠自报在默认改密码里活下来。
-// 节点 / 网络令牌(network_id 非空)不分类,改密码永远不碰。
+// 节点 / 网络令牌(network_id 非空)不按cli分类;具名网络令牌另有显式撤销选项。
 export type UserTokenKind = "login" | "cli";
 
 /** 登录 / 注册请求签发的令牌算哪一类:客户端显式报 kind='cli',或 client_label 是 anet 自报的「anet <版本> · …」。 */
@@ -642,14 +642,14 @@ export function revokeOtherSessions(userId: string, currentTokenId: string): num
   return db.run(`DELETE FROM api_tokens WHERE user_id = ?1 AND ${SESSION_TOKEN_SQL} AND token_id != ?2`, [userId, currentTokenId]).changes;
 }
 
-export type ChangePasswordResult = { ok: boolean; error?: string; revoked?: number; revoked_login?: number; revoked_cli?: number; kept_cli_tokens?: KeptCliToken[] };
+export type ChangePasswordResult = { ok: boolean; error?: string; revoked?: number; revoked_login?: number; revoked_cli?: number; kept_cli_tokens?: KeptCliToken[]; revoked_network?: number; kept_network_tokens?: KeptNetworkToken[] };
 
 /**
  * 改密码。默认撤销该用户全部不绑网络的令牌(改密码前的行为,旧 app 依赖它)。#711:opts.keepCliTokens=true
  * 时保留 kind='cli' 的(anet 命令行登录、具名脚本令牌),并在 kept_cli_tokens 里列出。当前会话和节点令牌永远保留。
- * revoked = 两类合计(旧字段,兼容旧客户端)。
+ * revokeNetworkTokens=true显式撤销具名网络令牌;默认列出保留清单。revoked含三类合计。
  */
-export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null, opts: { keepCliTokens?: boolean } = {}): ChangePasswordResult {
+export function changePassword(userId: string, oldPassword: string, newPassword: string, currentTokenId?: string | null, opts: { keepCliTokens?: boolean; revokeNetworkTokens?: boolean } = {}): ChangePasswordResult {
   const passwordError = validatePasswordStrength(newPassword, "new password");
   if (passwordError) return { ok: false, error: passwordError };
   const user = db.get<any>("SELECT password_hash FROM users WHERE user_id = ?1", userId);
@@ -663,10 +663,14 @@ export function changePassword(userId: string, oldPassword: string, newPassword:
   // password change. If the user changes via `anet passwd`, the bootstrap
   // nudge goes away on next login. SET to 0 explicitly (rather than skip)
   // so a future flag flip can't drift the state.
-  db.run("UPDATE users SET password_hash = ?1, must_change_password = 0, updated_at = datetime('now') WHERE user_id = ?2", [hashPassword(newPassword), userId]);
-  const keep = opts.keepCliTokens === true;
-  const r = revokeTokensAfterPasswordChange(userId, currentTokenId, keep);
-  return { ok: true, revoked: r.login + r.cli, revoked_login: r.login, revoked_cli: r.cli, ...(keep ? { kept_cli_tokens: r.kept } : {}) };
+  const nextHash = hashPassword(newPassword);
+  return db.transaction(() => {
+    db.run("UPDATE users SET password_hash = ?1, must_change_password = 0, updated_at = datetime('now') WHERE user_id = ?2", [nextHash, userId]);
+    const keep = opts.keepCliTokens === true;
+    const r = revokeTokensAfterPasswordChange(userId, currentTokenId, keep);
+    const network = passwordNetworkTokens(userId, currentTokenId, opts.revokeNetworkTokens === true);
+    return { ok: true, revoked: r.login + r.cli + network.revoked, revoked_login: r.login, revoked_cli: r.cli, ...(keep ? { kept_cli_tokens: r.kept } : {}), revoked_network: network.revoked, kept_network_tokens: network.kept };
+  });
 }
 
 /**

package/src/password-network-tokens.ts

@@ -0,0 +1,25 @@
+import { db } from "./db.js";
+
+export type KeptNetworkToken = {
+  token_id: string;
+  name: string;
+  network_id: string;
+  created_at: string;
+  last_used_at: string | null;
+};
+
+/** Only user-created named network tokens. Node credentials have a different scope or binding. */
+export function passwordNetworkTokens(userId: string, currentTokenId: string | null | undefined, revoke: boolean) {
+  const where = `user_id = ?1 AND network_id IS NOT NULL AND scope = 'full'
+    AND bound_node_id IS NULL AND revoked_at IS NULL
+    AND (expires_at IS NULL OR expires_at > datetime('now'))${currentTokenId ? " AND token_id != ?2" : ""}`;
+  const params = currentTokenId ? [userId, currentTokenId] : [userId];
+  if (revoke) {
+    return { revoked: db.run(`DELETE FROM api_tokens WHERE ${where}`, params).changes, kept: [] as KeptNetworkToken[] };
+  }
+  const kept = db.all<KeptNetworkToken>(
+    `SELECT token_id, name, network_id, created_at, last_used_at FROM api_tokens WHERE ${where} ORDER BY created_at DESC, token_id`,
+    ...params,
+  );
+  return { revoked: 0, kept };
+}

package/src/server.ts

@@ -1520,7 +1520,7 @@ return Bun.serve({
         // #711 不带 keep_cli_tokens 的请求(旧 app、dashboard 代理)= 改密码前的行为:撤销全部不绑网络的令牌。
         // keep_cli_tokens 必须是布尔 true 才保留命令行 / 脚本令牌。
         const meta = resolved.tokenId ? getUserTokenMeta(resolved.user.user_id, resolved.tokenId) : null;
-        const result = changePassword(resolved.user.user_id, body.old_password, body.new_password, resolved.tokenId, { keepCliTokens: body.keep_cli_tokens === true });
+        const result = changePassword(resolved.user.user_id, body.old_password, body.new_password, resolved.tokenId, { keepCliTokens: body.keep_cli_tokens === true, revokeNetworkTokens: body.revoke_network_tokens === true });
         if (result.ok) {
           // 换发的新令牌沿用当前这条的种类和设备标识:anet passwd 换完仍是命令行令牌。
           const issued = issueUserToken(resolved.user.user_id, "password-change", { kind: meta?.kind, clientLabel: meta?.client_label, userAgent: meta?.user_agent });