@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/api/auth/ClientCredentialsAuthenticator.d.ts

@@ -0,0 +1,56 @@
+import type { IncomingMessage } from 'node:http';
+import type { Authenticator, AuthResult } from './Authenticator';
+/**
+ * Interface for token cache
+ */
+export interface TokenCache {
+    get(clientId: string): Promise<{
+        token: string;
+        webId: string;
+        expiresAt: Date;
+    } | undefined>;
+    set(clientId: string, token: string, webId: string, expiresAt: Date): Promise<void>;
+}
+export interface ClientCredentialsAuthenticatorOptions {
+    tokenCache?: TokenCache;
+    /**
+     * CSS token endpoint URL
+     */
+    tokenEndpoint: string;
+}
+/**
+ * Authenticator for API Keys in sk-xxx format.
+ *
+ * Format: sk-base64(client_id:client_secret)
+ *
+ * This authenticator:
+ * 1. Decodes the API Key to get client_id and client_secret
+ * 2. Exchanges them for a Solid Token via CSS token endpoint
+ * 3. Extracts webId from the token response
+ * 4. Returns a SolidAuthContext
+ */
+export declare class ClientCredentialsAuthenticator implements Authenticator {
+    private readonly logger;
+    private readonly tokenCache?;
+    private readonly tokenEndpoint;
+    constructor(options: ClientCredentialsAuthenticatorOptions);
+    canAuthenticate(request: IncomingMessage): boolean;
+    authenticate(request: IncomingMessage): Promise<AuthResult>;
+    private exchangeForToken;
+    /**
+     * Extract webId from JWT access token
+     */
+    private extractWebIdFromJwt;
+    private isJwt;
+}
+export interface ClientCredentialsRecord {
+    clientId: string;
+    clientSecret: string;
+    webId: string;
+    accountId: string;
+    displayName?: string;
+    createdAt: Date;
+}
+export interface ClientCredentialsStore {
+    findByClientId(clientId: string): Promise<ClientCredentialsRecord | undefined>;
+}

package/dist/api/auth/ClientCredentialsAuthenticator.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentialsAuthenticator = void 0;
+const global_logger_factory_1 = require("global-logger-factory");
+/**
+ * Authenticator for API Keys in sk-xxx format.
+ *
+ * Format: sk-base64(client_id:client_secret)
+ *
+ * This authenticator:
+ * 1. Decodes the API Key to get client_id and client_secret
+ * 2. Exchanges them for a Solid Token via CSS token endpoint
+ * 3. Extracts webId from the token response
+ * 4. Returns a SolidAuthContext
+ */
+class ClientCredentialsAuthenticator {
+    constructor(options) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.tokenCache = options.tokenCache;
+        this.tokenEndpoint = options.tokenEndpoint;
+    }
+    canAuthenticate(request) {
+        const auth = request.headers.authorization;
+        if (!auth?.startsWith('Bearer ')) {
+            return false;
+        }
+        // If there's a DPoP header, it's a Solid Token, not an API Key
+        if (request.headers.dpop) {
+            return false;
+        }
+        const token = auth.slice(7).trim();
+        if (!token) {
+            return false;
+        }
+        // Only handle sk-xxx format or non-JWT tokens
+        return token.startsWith('sk-') || !this.isJwt(token);
+    }
+    async authenticate(request) {
+        const authorization = request.headers.authorization;
+        if (!authorization?.startsWith('Bearer ')) {
+            return { success: false, error: 'Missing Bearer token' };
+        }
+        const token = authorization.slice(7).trim();
+        if (!token) {
+            return { success: false, error: 'Empty API Key' };
+        }
+        try {
+            let clientId;
+            let clientSecret;
+            // Parse sk-xxx format (base64 encoded client_id:client_secret)
+            if (token.startsWith('sk-')) {
+                const base64 = token.slice(3);
+                try {
+                    const decoded = Buffer.from(base64, 'base64').toString('utf-8');
+                    const colonIndex = decoded.indexOf(':');
+                    if (colonIndex === -1) {
+                        return { success: false, error: 'Invalid API Key format: missing colon separator' };
+                    }
+                    clientId = decoded.slice(0, colonIndex);
+                    clientSecret = decoded.slice(colonIndex + 1);
+                    if (!clientId || !clientSecret) {
+                        return { success: false, error: 'Invalid API Key format: empty client_id or client_secret' };
+                    }
+                }
+                catch {
+                    return { success: false, error: 'Invalid API Key encoding' };
+                }
+            }
+            else {
+                // Non sk- format not supported without database lookup
+                return { success: false, error: 'Invalid API Key format: must start with sk-' };
+            }
+            // Check cache first
+            if (this.tokenCache) {
+                const cached = await this.tokenCache.get(clientId);
+                if (cached && cached.expiresAt > new Date()) {
+                    this.logger.debug(`Using cached token for ${clientId.slice(0, 8)}...`);
+                    return {
+                        success: true,
+                        context: {
+                            type: 'solid',
+                            webId: cached.webId,
+                            accountId: cached.webId,
+                            clientId,
+                            clientSecret,
+                            viaApiKey: true,
+                        },
+                    };
+                }
+            }
+            // Exchange for token at CSS endpoint
+            console.log(`[ClientCredentialsAuthenticator] Exchanging credentials at ${this.tokenEndpoint}`);
+            const tokenResult = await this.exchangeForToken(clientId, clientSecret);
+            console.log(`[ClientCredentialsAuthenticator] Token exchange result: success=${tokenResult.success}, webId=${tokenResult.webId}, error=${tokenResult.error}`);
+            if (!tokenResult.success || !tokenResult.webId) {
+                return { success: false, error: tokenResult.error || 'Token exchange failed' };
+            }
+            // Cache the token
+            if (this.tokenCache && tokenResult.expiresAt) {
+                await this.tokenCache.set(clientId, tokenResult.token, tokenResult.webId, tokenResult.expiresAt);
+            }
+            const context = {
+                type: 'solid',
+                webId: tokenResult.webId,
+                accountId: tokenResult.webId,
+                clientId,
+                clientSecret,
+                viaApiKey: true,
+            };
+            this.logger.debug(`Authenticated API Key for webId: ${tokenResult.webId}`);
+            return { success: true, context };
+        }
+        catch (error) {
+            console.error(`[ClientCredentialsAuthenticator] API Key authentication error:`, error);
+            this.logger.error(`API Key authentication error: ${error}`);
+            return { success: false, error: 'Authentication failed' };
+        }
+    }
+    async exchangeForToken(clientId, clientSecret) {
+        // 开发模式：跳过 CSS token exchange
+        if (process.env.NODE_ENV === 'development') {
+            this.logger.warn(`[DEV] Skipping token exchange for ${clientId.slice(0, 8)}...`);
+            return {
+                success: true,
+                token: `dev-token-${clientId}`,
+                expiresAt: new Date(Date.now() + 3600000),
+            };
+        }
+        try {
+            const response = await fetch(this.tokenEndpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    grant_type: 'client_credentials',
+                    client_id: clientId,
+                    client_secret: clientSecret,
+                }),
+            });
+            if (!response.ok) {
+                const error = await response.text();
+                this.logger.warn(`Token exchange failed: ${response.status} ${error}`);
+                return { success: false, error: `Token exchange failed: ${response.status}` };
+            }
+            const data = await response.json();
+            // Extract webId from token response or decode from JWT
+            let webId = data.webid;
+            if (!webId && data.access_token) {
+                webId = this.extractWebIdFromJwt(data.access_token);
+            }
+            if (!webId) {
+                return { success: false, error: 'Could not determine webId from token response' };
+            }
+            const expiresAt = data.expires_in
+                ? new Date(Date.now() + data.expires_in * 1000 - 60000) // 1 min buffer
+                : new Date(Date.now() + 3600000); // Default 1 hour
+            return {
+                success: true,
+                token: data.access_token,
+                webId,
+                expiresAt,
+            };
+        }
+        catch (error) {
+            this.logger.error(`Token exchange error: ${error}`);
+            return { success: false, error: 'Token exchange failed' };
+        }
+    }
+    /**
+     * Extract webId from JWT access token
+     */
+    extractWebIdFromJwt(jwt) {
+        try {
+            const parts = jwt.split('.');
+            if (parts.length !== 3) {
+                return undefined;
+            }
+            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));
+            return payload.webid || payload.webId || payload.sub;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    isJwt(token) {
+        return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
+    }
+}
+exports.ClientCredentialsAuthenticator = ClientCredentialsAuthenticator;
+//# sourceMappingURL=ClientCredentialsAuthenticator.js.map

package/dist/api/auth/ClientCredentialsAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientCredentialsAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/ClientCredentialsAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AAoBrD;;;;;;;;;;GAUG;AACH,MAAa,8BAA8B;IAKzC,YAAmB,OAA8C;QAJhD,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,+DAA+D;QAC/D,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,8CAA8C;QAC9C,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,IAAI,CAAC;YACH,IAAI,QAAgB,CAAC;YACrB,IAAI,YAAoB,CAAC;YAEzB,+DAA+D;YAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;wBACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;oBACtF,CAAC;oBACD,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;oBACxC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;oBAC/F,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,uDAAuD;gBACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAClF,CAAC;YAED,oBAAoB;YACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBACvE,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,SAAS,EAAE,MAAM,CAAC,KAAK;4BACvB,QAAQ;4BACR,YAAY;4BACZ,SAAS,EAAE,IAAI;yBAChB;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,OAAO,CAAC,GAAG,CAAC,8DAA8D,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAChG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CAAC,mEAAmE,WAAW,CAAC,OAAO,WAAW,WAAW,CAAC,KAAK,WAAW,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAE9J,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,uBAAuB,EAAE,CAAC;YACjF,CAAC;YAED,kBAAkB;YAClB,IAAI,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAM,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YACpG,CAAC;YAED,MAAM,OAAO,GAAqB;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,SAAS,EAAE,WAAW,CAAC,KAAK;gBAC5B,QAAQ;gBACR,YAAY;gBACZ,SAAS,EAAE,IAAI;aAChB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,YAAoB;QAOnE,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACjF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,aAAa,QAAQ,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;YAEF,uDAAuD;YACvD,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;gBAC/B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe;gBACvE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB;YAErD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,KAAK;gBACL,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,GAAW;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;CACF;AA5MD,wEA4MC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { SolidAuthContext } from './AuthContext';\n\n/**\n * Interface for token cache\n */\nexport interface TokenCache {\n  get(clientId: string): Promise<{ token: string; webId: string; expiresAt: Date } | undefined>;\n  set(clientId: string, token: string, webId: string, expiresAt: Date): Promise<void>;\n}\n\nexport interface ClientCredentialsAuthenticatorOptions {\n  tokenCache?: TokenCache;\n  /**\n   * CSS token endpoint URL\n   */\n  tokenEndpoint: string;\n}\n\n/**\n * Authenticator for API Keys in sk-xxx format.\n * \n * Format: sk-base64(client_id:client_secret)\n * \n * This authenticator:\n * 1. Decodes the API Key to get client_id and client_secret\n * 2. Exchanges them for a Solid Token via CSS token endpoint\n * 3. Extracts webId from the token response\n * 4. Returns a SolidAuthContext\n */\nexport class ClientCredentialsAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly tokenCache?: TokenCache;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: ClientCredentialsAuthenticatorOptions) {\n    this.tokenCache = options.tokenCache;\n    this.tokenEndpoint = options.tokenEndpoint;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    if (!auth?.startsWith('Bearer ')) {\n      return false;\n    }\n    // If there's a DPoP header, it's a Solid Token, not an API Key\n    if (request.headers.dpop) {\n      return false;\n    }\n    const token = auth.slice(7).trim();\n    if (!token) {\n      return false;\n    }\n    // Only handle sk-xxx format or non-JWT tokens\n    return token.startsWith('sk-') || !this.isJwt(token);\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const authorization = request.headers.authorization;\n    if (!authorization?.startsWith('Bearer ')) {\n      return { success: false, error: 'Missing Bearer token' };\n    }\n\n    const token = authorization.slice(7).trim();\n    if (!token) {\n      return { success: false, error: 'Empty API Key' };\n    }\n\n    try {\n      let clientId: string;\n      let clientSecret: string;\n\n      // Parse sk-xxx format (base64 encoded client_id:client_secret)\n      if (token.startsWith('sk-')) {\n        const base64 = token.slice(3);\n        try {\n          const decoded = Buffer.from(base64, 'base64').toString('utf-8');\n          const colonIndex = decoded.indexOf(':');\n          if (colonIndex === -1) {\n            return { success: false, error: 'Invalid API Key format: missing colon separator' };\n          }\n          clientId = decoded.slice(0, colonIndex);\n          clientSecret = decoded.slice(colonIndex + 1);\n          \n          if (!clientId || !clientSecret) {\n            return { success: false, error: 'Invalid API Key format: empty client_id or client_secret' };\n          }\n        } catch {\n          return { success: false, error: 'Invalid API Key encoding' };\n        }\n      } else {\n        // Non sk- format not supported without database lookup\n        return { success: false, error: 'Invalid API Key format: must start with sk-' };\n      }\n\n      // Check cache first\n      if (this.tokenCache) {\n        const cached = await this.tokenCache.get(clientId);\n        if (cached && cached.expiresAt > new Date()) {\n          this.logger.debug(`Using cached token for ${clientId.slice(0, 8)}...`);\n          return {\n            success: true,\n            context: {\n              type: 'solid',\n              webId: cached.webId,\n              accountId: cached.webId,\n              clientId,\n              clientSecret,\n              viaApiKey: true,\n            },\n          };\n        }\n      }\n\n      // Exchange for token at CSS endpoint\n      console.log(`[ClientCredentialsAuthenticator] Exchanging credentials at ${this.tokenEndpoint}`);\n      const tokenResult = await this.exchangeForToken(clientId, clientSecret);\n      console.log(`[ClientCredentialsAuthenticator] Token exchange result: success=${tokenResult.success}, webId=${tokenResult.webId}, error=${tokenResult.error}`);\n      \n      if (!tokenResult.success || !tokenResult.webId) {\n        return { success: false, error: tokenResult.error || 'Token exchange failed' };\n      }\n\n      // Cache the token\n      if (this.tokenCache && tokenResult.expiresAt) {\n        await this.tokenCache.set(clientId, tokenResult.token!, tokenResult.webId, tokenResult.expiresAt);\n      }\n\n      const context: SolidAuthContext = {\n        type: 'solid',\n        webId: tokenResult.webId,\n        accountId: tokenResult.webId,\n        clientId,\n        clientSecret,\n        viaApiKey: true,\n      };\n\n      this.logger.debug(`Authenticated API Key for webId: ${tokenResult.webId}`);\n      return { success: true, context };\n    } catch (error) {\n      console.error(`[ClientCredentialsAuthenticator] API Key authentication error:`, error);\n      this.logger.error(`API Key authentication error: ${error}`);\n      return { success: false, error: 'Authentication failed' };\n    }\n  }\n\n  private async exchangeForToken(clientId: string, clientSecret: string): Promise<{\n    success: boolean;\n    token?: string;\n    webId?: string;\n    expiresAt?: Date;\n    error?: string;\n  }> {\n    // 开发模式：跳过 CSS token exchange\n    if (process.env.NODE_ENV === 'development') {\n      this.logger.warn(`[DEV] Skipping token exchange for ${clientId.slice(0, 8)}...`);\n      return {\n        success: true,\n        token: `dev-token-${clientId}`,\n        expiresAt: new Date(Date.now() + 3600000),\n      };\n    }\n\n    try {\n      const response = await fetch(this.tokenEndpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'client_credentials',\n          client_id: clientId,\n          client_secret: clientSecret,\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.text();\n        this.logger.warn(`Token exchange failed: ${response.status} ${error}`);\n        return { success: false, error: `Token exchange failed: ${response.status}` };\n      }\n\n      const data = await response.json() as {\n        access_token: string;\n        expires_in?: number;\n        token_type: string;\n        webid?: string;  // CSS returns webid in response\n      };\n\n      // Extract webId from token response or decode from JWT\n      let webId = data.webid;\n      if (!webId && data.access_token) {\n        webId = this.extractWebIdFromJwt(data.access_token);\n      }\n\n      if (!webId) {\n        return { success: false, error: 'Could not determine webId from token response' };\n      }\n\n      const expiresAt = data.expires_in\n        ? new Date(Date.now() + data.expires_in * 1000 - 60000) // 1 min buffer\n        : new Date(Date.now() + 3600000); // Default 1 hour\n\n      return {\n        success: true,\n        token: data.access_token,\n        webId,\n        expiresAt,\n      };\n    } catch (error) {\n      this.logger.error(`Token exchange error: ${error}`);\n      return { success: false, error: 'Token exchange failed' };\n    }\n  }\n\n  /**\n   * Extract webId from JWT access token\n   */\n  private extractWebIdFromJwt(jwt: string): string | undefined {\n    try {\n      const parts = jwt.split('.');\n      if (parts.length !== 3) {\n        return undefined;\n      }\n      const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));\n      return payload.webid || payload.webId || payload.sub;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private isJwt(token: string): boolean {\n    return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token);\n  }\n}\n\n// Re-export for backwards compatibility (these are no longer needed but keep for other code)\nexport interface ClientCredentialsRecord {\n  clientId: string;\n  clientSecret: string;\n  webId: string;\n  accountId: string;\n  displayName?: string;\n  createdAt: Date;\n}\n\nexport interface ClientCredentialsStore {\n  findByClientId(clientId: string): Promise<ClientCredentialsRecord | undefined>;\n}\n"]}

package/dist/api/auth/MultiAuthenticator.d.ts

@@ -0,0 +1,15 @@
+import type { IncomingMessage } from 'node:http';
+import type { Authenticator, AuthResult } from './Authenticator';
+export interface MultiAuthenticatorOptions {
+    authenticators: Authenticator[];
+}
+/**
+ * Combines multiple authenticators, trying each in order
+ */
+export declare class MultiAuthenticator implements Authenticator {
+    private readonly logger;
+    private readonly authenticators;
+    constructor(options: MultiAuthenticatorOptions);
+    canAuthenticate(request: IncomingMessage): boolean;
+    authenticate(request: IncomingMessage): Promise<AuthResult>;
+}

package/dist/api/auth/MultiAuthenticator.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MultiAuthenticator = void 0;
+const global_logger_factory_1 = require("global-logger-factory");
+/**
+ * Combines multiple authenticators, trying each in order
+ */
+class MultiAuthenticator {
+    constructor(options) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.authenticators = options.authenticators;
+    }
+    canAuthenticate(request) {
+        return this.authenticators.some((auth) => auth.canAuthenticate(request));
+    }
+    async authenticate(request) {
+        console.log(`[MultiAuthenticator] Starting authentication with ${this.authenticators.length} authenticators`);
+        for (const authenticator of this.authenticators) {
+            const canAuth = authenticator.canAuthenticate(request);
+            console.log(`[MultiAuthenticator] ${authenticator.constructor.name}.canAuthenticate: ${canAuth}`);
+            if (canAuth) {
+                const result = await authenticator.authenticate(request);
+                if (result.success) {
+                    return result;
+                }
+                // If this authenticator claimed it could handle but failed,
+                // don't try others - return the error
+                this.logger.debug(`Authenticator failed: ${result.error}`);
+                return result;
+            }
+        }
+        return { success: false, error: 'No valid authentication provided' };
+    }
+}
+exports.MultiAuthenticator = MultiAuthenticator;
+//# sourceMappingURL=MultiAuthenticator.js.map

package/dist/api/auth/MultiAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MultiAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/MultiAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AAOrD;;GAEG;AACH,MAAa,kBAAkB;IAI7B,YAAmB,OAAkC;QAHpC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAI3C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/C,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,OAAO,CAAC,GAAG,CAAC,qDAAqD,IAAI,CAAC,cAAc,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAC9G,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,wBAAwB,aAAa,CAAC,WAAW,CAAC,IAAI,qBAAqB,OAAO,EAAE,CAAC,CAAC;YAClG,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,4DAA4D;gBAC5D,sCAAsC;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3D,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IACvE,CAAC;CACF;AA/BD,gDA+BC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\n\nexport interface MultiAuthenticatorOptions {\n  authenticators: Authenticator[];\n}\n\n/**\n * Combines multiple authenticators, trying each in order\n */\nexport class MultiAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly authenticators: Authenticator[];\n\n  public constructor(options: MultiAuthenticatorOptions) {\n    this.authenticators = options.authenticators;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    return this.authenticators.some((auth) => auth.canAuthenticate(request));\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    console.log(`[MultiAuthenticator] Starting authentication with ${this.authenticators.length} authenticators`);\n    for (const authenticator of this.authenticators) {\n      const canAuth = authenticator.canAuthenticate(request);\n      console.log(`[MultiAuthenticator] ${authenticator.constructor.name}.canAuthenticate: ${canAuth}`);\n      if (canAuth) {\n        const result = await authenticator.authenticate(request);\n        if (result.success) {\n          return result;\n        }\n        // If this authenticator claimed it could handle but failed,\n        // don't try others - return the error\n        this.logger.debug(`Authenticator failed: ${result.error}`);\n        return result;\n      }\n    }\n\n    return { success: false, error: 'No valid authentication provided' };\n  }\n}\n"]}

package/dist/api/auth/NodeTokenAuthenticator.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage } from 'node:http';
+import type { Authenticator, AuthResult } from './Authenticator';
+import type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';
+export interface NodeTokenAuthenticatorOptions {
+    repository: EdgeNodeRepository;
+}
+export declare class NodeTokenAuthenticator implements Authenticator {
+    private readonly logger;
+    private readonly repo;
+    constructor(options: NodeTokenAuthenticatorOptions);
+    canAuthenticate(request: IncomingMessage): boolean;
+    authenticate(request: IncomingMessage): Promise<AuthResult>;
+    /**
+     * 解析 Node Token (username:secret 或 base64)
+     */
+    private parseNodeToken;
+    /**
+     * 检查是否是 base64 编码的 Node Token
+     */
+    private isBase64NodeToken;
+}

package/dist/api/auth/NodeTokenAuthenticator.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeTokenAuthenticator = void 0;
+const global_logger_factory_1 = require("global-logger-factory");
+class NodeTokenAuthenticator {
+    constructor(options) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.repo = options.repository;
+    }
+    canAuthenticate(request) {
+        const auth = request.headers.authorization;
+        // 支持两种格式:
+        // 1. XpodNode nodeId:token
+        // 2. Bearer username:secret (带 X-Node-Id 头)
+        if (auth?.startsWith('XpodNode ')) {
+            return true;
+        }
+        if (auth?.startsWith('Bearer ') && request.headers['x-node-id']) {
+            const token = auth.slice(7).trim();
+            // Node Token 包含 ':'，不是 JWT
+            return token.includes(':') || this.isBase64NodeToken(token);
+        }
+        return false;
+    }
+    async authenticate(request) {
+        const auth = request.headers.authorization;
+        let nodeId;
+        let token;
+        if (auth.startsWith('XpodNode ')) {
+            // 格式: XpodNode nodeId:token
+            const credentials = auth.slice(9).trim();
+            const colonIndex = credentials.indexOf(':');
+            if (colonIndex <= 0) {
+                return { success: false, error: 'Invalid XpodNode credentials format. Expected nodeId:token' };
+            }
+            nodeId = credentials.slice(0, colonIndex);
+            token = credentials.slice(colonIndex + 1);
+        }
+        else {
+            // 格式: Bearer username:secret (带 X-Node-Id 头)
+            nodeId = request.headers['x-node-id'];
+            token = auth.slice(7).trim();
+            // 尝试从 token 解析 username
+            const parsed = this.parseNodeToken(token);
+            if (!parsed) {
+                return { success: false, error: 'Invalid node token format' };
+            }
+            // 使用解析出的完整 token
+            token = parsed.token;
+        }
+        try {
+            const secret = await this.repo.getNodeSecret(nodeId);
+            if (!secret) {
+                // 节点不存在，可能是新节点注册
+                // 对于 DDNS 分配等操作，允许通过（由业务逻辑处理）
+                this.logger.debug(`Node not found: ${nodeId}, allowing for registration`);
+                return {
+                    success: true,
+                    context: {
+                        type: 'node',
+                        nodeId,
+                    },
+                };
+            }
+            if (!secret.tokenHash || !this.repo.matchesToken(secret.tokenHash, token)) {
+                return { success: false, error: 'Invalid node token' };
+            }
+            this.logger.debug(`Authenticated edge node: ${nodeId}`);
+            return {
+                success: true,
+                context: {
+                    type: 'node',
+                    nodeId,
+                    accountId: secret.accountId,
+                },
+            };
+        }
+        catch (error) {
+            this.logger.error(`Node authentication failed: ${error}`);
+            return { success: false, error: 'Internal authentication error' };
+        }
+    }
+    /**
+     * 解析 Node Token (username:secret 或 base64)
+     */
+    parseNodeToken(token) {
+        if (token.includes(':')) {
+            const [username, ...secretParts] = token.split(':');
+            const secret = secretParts.join(':');
+            if (username && secret) {
+                return { username, token: secret };
+            }
+        }
+        // 尝试 base64 解码
+        try {
+            const decoded = Buffer.from(token, 'base64').toString('utf8');
+            if (decoded.includes(':')) {
+                const [username, ...secretParts] = decoded.split(':');
+                const secret = secretParts.join(':');
+                if (username && secret) {
+                    return { username, token: secret };
+                }
+            }
+        }
+        catch {
+            // ignore
+        }
+        return undefined;
+    }
+    /**
+     * 检查是否是 base64 编码的 Node Token
+     */
+    isBase64NodeToken(token) {
+        try {
+            const decoded = Buffer.from(token, 'base64').toString('utf8');
+            return decoded.includes(':');
+        }
+        catch {
+            return false;
+        }
+    }
+}
+exports.NodeTokenAuthenticator = NodeTokenAuthenticator;
+//# sourceMappingURL=NodeTokenAuthenticator.js.map

package/dist/api/auth/NodeTokenAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NodeTokenAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/NodeTokenAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AAQrD,MAAa,sBAAsB;IAIjC,YAAmB,OAAsC;QAHxC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAI3C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IACjC,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,UAAU;QACV,2BAA2B;QAC3B,4CAA4C;QAC5C,IAAI,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,2BAA2B;YAC3B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC;QAE5C,IAAI,MAAc,CAAC;QACnB,IAAI,KAAa,CAAC;QAElB,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,4BAA4B;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;YACjG,CAAC;YACD,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC1C,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAW,CAAC;YAChD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE7B,wBAAwB;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAChE,CAAC;YACD,iBAAiB;YACjB,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iBAAiB;gBACjB,8BAA8B;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,6BAA6B,CAAC,CAAC;gBAC1E,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP,IAAI,EAAE,MAAM;wBACZ,MAAM;qBACP;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;YAExD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,MAAM;oBACN,SAAS,EAAG,MAAc,CAAC,SAAS;iBACrC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;oBACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAhID,wDAgIC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\n\nexport interface NodeTokenAuthenticatorOptions {\n  repository: EdgeNodeRepository;\n}\n\nexport class NodeTokenAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly repo: EdgeNodeRepository;\n\n  public constructor(options: NodeTokenAuthenticatorOptions) {\n    this.repo = options.repository;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    // 支持两种格式:\n    // 1. XpodNode nodeId:token\n    // 2. Bearer username:secret (带 X-Node-Id 头)\n    if (auth?.startsWith('XpodNode ')) {\n      return true;\n    }\n    if (auth?.startsWith('Bearer ') && request.headers['x-node-id']) {\n      const token = auth.slice(7).trim();\n      // Node Token 包含 ':'，不是 JWT\n      return token.includes(':') || this.isBase64NodeToken(token);\n    }\n    return false;\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const auth = request.headers.authorization!;\n\n    let nodeId: string;\n    let token: string;\n\n    if (auth.startsWith('XpodNode ')) {\n      // 格式: XpodNode nodeId:token\n      const credentials = auth.slice(9).trim();\n      const colonIndex = credentials.indexOf(':');\n      if (colonIndex <= 0) {\n        return { success: false, error: 'Invalid XpodNode credentials format. Expected nodeId:token' };\n      }\n      nodeId = credentials.slice(0, colonIndex);\n      token = credentials.slice(colonIndex + 1);\n    } else {\n      // 格式: Bearer username:secret (带 X-Node-Id 头)\n      nodeId = request.headers['x-node-id'] as string;\n      token = auth.slice(7).trim();\n\n      // 尝试从 token 解析 username\n      const parsed = this.parseNodeToken(token);\n      if (!parsed) {\n        return { success: false, error: 'Invalid node token format' };\n      }\n      // 使用解析出的完整 token\n      token = parsed.token;\n    }\n\n    try {\n      const secret = await this.repo.getNodeSecret(nodeId);\n      if (!secret) {\n        // 节点不存在，可能是新节点注册\n        // 对于 DDNS 分配等操作，允许通过（由业务逻辑处理）\n        this.logger.debug(`Node not found: ${nodeId}, allowing for registration`);\n        return {\n          success: true,\n          context: {\n            type: 'node',\n            nodeId,\n          },\n        };\n      }\n\n      if (!secret.tokenHash || !this.repo.matchesToken(secret.tokenHash, token)) {\n        return { success: false, error: 'Invalid node token' };\n      }\n\n      this.logger.debug(`Authenticated edge node: ${nodeId}`);\n\n      return {\n        success: true,\n        context: {\n          type: 'node',\n          nodeId,\n          accountId: (secret as any).accountId,\n        },\n      };\n    } catch (error) {\n      this.logger.error(`Node authentication failed: ${error}`);\n      return { success: false, error: 'Internal authentication error' };\n    }\n  }\n\n  /**\n   * 解析 Node Token (username:secret 或 base64)\n   */\n  private parseNodeToken(token: string): { username: string; token: string } | undefined {\n    if (token.includes(':')) {\n      const [username, ...secretParts] = token.split(':');\n      const secret = secretParts.join(':');\n      if (username && secret) {\n        return { username, token: secret };\n      }\n    }\n\n    // 尝试 base64 解码\n    try {\n      const decoded = Buffer.from(token, 'base64').toString('utf8');\n      if (decoded.includes(':')) {\n        const [username, ...secretParts] = decoded.split(':');\n        const secret = secretParts.join(':');\n        if (username && secret) {\n          return { username, token: secret };\n        }\n      }\n    } catch {\n      // ignore\n    }\n\n    return undefined;\n  }\n\n  /**\n   * 检查是否是 base64 编码的 Node Token\n   */\n  private isBase64NodeToken(token: string): boolean {\n    try {\n      const decoded = Buffer.from(token, 'base64').toString('utf8');\n      return decoded.includes(':');\n    } catch {\n      return false;\n    }\n  }\n}\n"]}

package/dist/api/auth/SolidTokenAuthenticator.d.ts

@@ -0,0 +1,27 @@
+import type { IncomingMessage } from 'node:http';
+import type { Authenticator, AuthResult } from './Authenticator';
+export interface SolidTokenAuthenticatorOptions {
+    /**
+     * Function to resolve accountId from webId (optional)
+     */
+    resolveAccountId?: (webId: string) => Promise<string | undefined>;
+}
+/**
+ * Authenticator for Solid access tokens (Bearer or DPoP).
+ */
+export declare class SolidTokenAuthenticator implements Authenticator {
+    private readonly logger;
+    private readonly verify;
+    private readonly resolveAccountId?;
+    constructor(options?: SolidTokenAuthenticatorOptions);
+    canAuthenticate(request: IncomingMessage): boolean;
+    authenticate(request: IncomingMessage): Promise<AuthResult>;
+    private buildRequestUrl;
+    private getProtocol;
+    private getHost;
+    private getForwardedPrefix;
+    private joinPaths;
+    private isJwt;
+    private extractWebId;
+    private extractString;
+}