@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/identity/drizzle/schema.sqlite.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiClientCredentials = exports.edgeNodePods = exports.edgeNodes = exports.ddnsRecords = exports.ddnsDomains = exports.webidProfiles = exports.podUsage = exports.accountUsage = void 0;
+const sqlite_core_1 = require("drizzle-orm/sqlite-core");
+exports.accountUsage = (0, sqlite_core_1.sqliteTable)('identity_account_usage', {
+    accountId: (0, sqlite_core_1.text)('account_id').primaryKey(),
+    storageBytes: (0, sqlite_core_1.integer)('storage_bytes').notNull().default(0),
+    ingressBytes: (0, sqlite_core_1.integer)('ingress_bytes').notNull().default(0),
+    egressBytes: (0, sqlite_core_1.integer)('egress_bytes').notNull().default(0),
+    storageLimitBytes: (0, sqlite_core_1.integer)('storage_limit_bytes'),
+    bandwidthLimitBps: (0, sqlite_core_1.integer)('bandwidth_limit_bps'),
+    updatedAt: (0, sqlite_core_1.integer)('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+exports.podUsage = (0, sqlite_core_1.sqliteTable)('identity_pod_usage', {
+    podId: (0, sqlite_core_1.text)('pod_id').primaryKey(),
+    accountId: (0, sqlite_core_1.text)('account_id').notNull(),
+    storageBytes: (0, sqlite_core_1.integer)('storage_bytes').notNull().default(0),
+    ingressBytes: (0, sqlite_core_1.integer)('ingress_bytes').notNull().default(0),
+    egressBytes: (0, sqlite_core_1.integer)('egress_bytes').notNull().default(0),
+    storageLimitBytes: (0, sqlite_core_1.integer)('storage_limit_bytes'),
+    bandwidthLimitBps: (0, sqlite_core_1.integer)('bandwidth_limit_bps'),
+    updatedAt: (0, sqlite_core_1.integer)('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+/**
+ * WebID Profile 托管表
+ * 用于身份与存储分离架构，Cloud 托管用户的 WebID Profile
+ */
+exports.webidProfiles = (0, sqlite_core_1.sqliteTable)('identity_webid_profile', {
+    username: (0, sqlite_core_1.text)('username').primaryKey(),
+    webidUrl: (0, sqlite_core_1.text)('webid_url').notNull(), // https://id.undefineds.co/alice/profile/card#me
+    storageUrl: (0, sqlite_core_1.text)('storage_url'), // https://alice.undefineds.xyz/ 或 https://pods.undefineds.co/alice/
+    storageMode: (0, sqlite_core_1.text)('storage_mode').default('cloud'), // 'cloud' | 'local' | 'custom'
+    oidcIssuer: (0, sqlite_core_1.text)('oidc_issuer'), // https://id.undefineds.co/
+    profileData: (0, sqlite_core_1.text)('profile_data', { mode: 'json' }), // WebID Profile 的 JSON-LD 表示
+    accountId: (0, sqlite_core_1.text)('account_id'), // 关联的 CSS 账户 ID
+    createdAt: (0, sqlite_core_1.integer)('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+    updatedAt: (0, sqlite_core_1.integer)('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+/**
+ * DDNS 域名池表
+ * 管理可用的 DDNS 域名
+ */
+exports.ddnsDomains = (0, sqlite_core_1.sqliteTable)('identity_ddns_domain', {
+    domain: (0, sqlite_core_1.text)('domain').primaryKey(), // undefineds.xyz
+    status: (0, sqlite_core_1.text)('status').default('active'), // 'active' | 'suspended'
+    provider: (0, sqlite_core_1.text)('provider'), // 'cloudflare' | 'tencent'
+    zoneId: (0, sqlite_core_1.text)('zone_id'), // DNS Zone ID
+    createdAt: (0, sqlite_core_1.integer)('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+/**
+ * DDNS 记录表
+ * 已分配的子域名记录
+ */
+exports.ddnsRecords = (0, sqlite_core_1.sqliteTable)('identity_ddns_record', {
+    subdomain: (0, sqlite_core_1.text)('subdomain').primaryKey(), // alice
+    domain: (0, sqlite_core_1.text)('domain').notNull(), // undefineds.xyz
+    ipAddress: (0, sqlite_core_1.text)('ip_address'),
+    ipv6Address: (0, sqlite_core_1.text)('ipv6_address'),
+    recordType: (0, sqlite_core_1.text)('record_type').default('A'), // 'A' | 'AAAA'
+    nodeId: (0, sqlite_core_1.text)('node_id'), // 关联的节点 ID
+    username: (0, sqlite_core_1.text)('username'), // 关联的用户名
+    status: (0, sqlite_core_1.text)('status').default('active'), // 'active' | 'banned'
+    bannedReason: (0, sqlite_core_1.text)('banned_reason'),
+    ttl: (0, sqlite_core_1.integer)('ttl').default(60),
+    createdAt: (0, sqlite_core_1.integer)('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+    updatedAt: (0, sqlite_core_1.integer)('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+exports.edgeNodes = (0, sqlite_core_1.sqliteTable)('identity_edge_node', {
+    id: (0, sqlite_core_1.text)('id').primaryKey(),
+    ownerAccountId: (0, sqlite_core_1.text)('owner_account_id'), // Owner of the node
+    displayName: (0, sqlite_core_1.text)('display_name'),
+    tokenHash: (0, sqlite_core_1.text)('token_hash').notNull(),
+    nodeType: (0, sqlite_core_1.text)('node_type').default('edge'), // 'center' | 'edge'
+    subdomain: (0, sqlite_core_1.text)('subdomain').unique(),
+    accessMode: (0, sqlite_core_1.text)('access_mode'),
+    publicIp: (0, sqlite_core_1.text)('public_ip'),
+    publicPort: (0, sqlite_core_1.integer)('public_port'),
+    internalIp: (0, sqlite_core_1.text)('internal_ip'), // Internal network IP for center nodes
+    internalPort: (0, sqlite_core_1.integer)('internal_port'),
+    capabilities: (0, sqlite_core_1.text)('capabilities', { mode: 'json' }),
+    metadata: (0, sqlite_core_1.text)('metadata', { mode: 'json' }),
+    connectivityStatus: (0, sqlite_core_1.text)('connectivity_status').default('unknown'),
+    lastConnectivityCheck: (0, sqlite_core_1.integer)('last_connectivity_check', { mode: 'timestamp' }),
+    createdAt: (0, sqlite_core_1.integer)('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+    updatedAt: (0, sqlite_core_1.integer)('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+    lastSeen: (0, sqlite_core_1.integer)('last_seen', { mode: 'timestamp' }),
+});
+exports.edgeNodePods = (0, sqlite_core_1.sqliteTable)('identity_edge_node_pod', {
+    nodeId: (0, sqlite_core_1.text)('node_id').notNull().references(() => exports.edgeNodes.id, { onDelete: 'cascade' }),
+    baseUrl: (0, sqlite_core_1.text)('base_url').notNull(),
+});
+exports.apiClientCredentials = (0, sqlite_core_1.sqliteTable)('identity_api_client_credentials', {
+    clientId: (0, sqlite_core_1.text)('client_id').primaryKey(),
+    clientSecretEncrypted: (0, sqlite_core_1.text)('client_secret_encrypted').notNull(),
+    webId: (0, sqlite_core_1.text)('web_id').notNull(),
+    accountId: (0, sqlite_core_1.text)('account_id').notNull(),
+    displayName: (0, sqlite_core_1.text)('display_name'),
+    createdAt: (0, sqlite_core_1.integer)('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),
+});
+//# sourceMappingURL=schema.sqlite.js.map

package/dist/identity/drizzle/schema.sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.sqlite.js","sourceRoot":"","sources":["../../../src/identity/drizzle/schema.sqlite.ts"],"names":[],"mappings":";;;AAAA,yDAAqE;AAExD,QAAA,YAAY,GAAG,IAAA,yBAAW,EAAC,wBAAwB,EAAE;IAChE,SAAS,EAAE,IAAA,kBAAI,EAAC,YAAY,CAAC,CAAC,UAAU,EAAE;IAC1C,YAAY,EAAE,IAAA,qBAAO,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,YAAY,EAAE,IAAA,qBAAO,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,WAAW,EAAE,IAAA,qBAAO,EAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,iBAAiB,EAAE,IAAA,qBAAO,EAAC,qBAAqB,CAAC;IACjD,iBAAiB,EAAE,IAAA,qBAAO,EAAC,qBAAqB,CAAC;IACjD,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEU,QAAA,QAAQ,GAAG,IAAA,yBAAW,EAAC,oBAAoB,EAAE;IACxD,KAAK,EAAE,IAAA,kBAAI,EAAC,QAAQ,CAAC,CAAC,UAAU,EAAE;IAClC,SAAS,EAAE,IAAA,kBAAI,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,YAAY,EAAE,IAAA,qBAAO,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,YAAY,EAAE,IAAA,qBAAO,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,WAAW,EAAE,IAAA,qBAAO,EAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,iBAAiB,EAAE,IAAA,qBAAO,EAAC,qBAAqB,CAAC;IACjD,iBAAiB,EAAE,IAAA,qBAAO,EAAC,qBAAqB,CAAC;IACjD,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,aAAa,GAAG,IAAA,yBAAW,EAAC,wBAAwB,EAAE;IACjE,QAAQ,EAAE,IAAA,kBAAI,EAAC,UAAU,CAAC,CAAC,UAAU,EAAE;IACvC,QAAQ,EAAE,IAAA,kBAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAe,iDAAiD;IACrG,UAAU,EAAE,IAAA,kBAAI,EAAC,aAAa,CAAC,EAAqB,oEAAoE;IACxH,WAAW,EAAE,IAAA,kBAAI,EAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,+BAA+B;IACnF,UAAU,EAAE,IAAA,kBAAI,EAAC,aAAa,CAAC,EAAqB,4BAA4B;IAChF,WAAW,EAAE,IAAA,kBAAI,EAAC,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,6BAA6B;IAClF,SAAS,EAAE,IAAA,kBAAI,EAAC,YAAY,CAAC,EAAuB,gBAAgB;IACpE,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9F,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,WAAW,GAAG,IAAA,yBAAW,EAAC,sBAAsB,EAAE;IAC7D,MAAM,EAAE,IAAA,kBAAI,EAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAiB,iBAAiB;IACrE,MAAM,EAAE,IAAA,kBAAI,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAY,yBAAyB;IAC7E,QAAQ,EAAE,IAAA,kBAAI,EAAC,UAAU,CAAC,EAA0B,2BAA2B;IAC/E,MAAM,EAAE,IAAA,kBAAI,EAAC,SAAS,CAAC,EAA6B,cAAc;IAClE,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,WAAW,GAAG,IAAA,yBAAW,EAAC,sBAAsB,EAAE;IAC7D,SAAS,EAAE,IAAA,kBAAI,EAAC,WAAW,CAAC,CAAC,UAAU,EAAE,EAAW,QAAQ;IAC5D,MAAM,EAAE,IAAA,kBAAI,EAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAoB,iBAAiB;IACrE,SAAS,EAAE,IAAA,kBAAI,EAAC,YAAY,CAAC;IAC7B,WAAW,EAAE,IAAA,kBAAI,EAAC,cAAc,CAAC;IACjC,UAAU,EAAE,IAAA,kBAAI,EAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAQ,eAAe;IACnE,MAAM,EAAE,IAAA,kBAAI,EAAC,SAAS,CAAC,EAA6B,WAAW;IAC/D,QAAQ,EAAE,IAAA,kBAAI,EAAC,UAAU,CAAC,EAA0B,SAAS;IAC7D,MAAM,EAAE,IAAA,kBAAI,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAY,sBAAsB;IAC1E,YAAY,EAAE,IAAA,kBAAI,EAAC,eAAe,CAAC;IACnC,GAAG,EAAE,IAAA,qBAAO,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/B,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9F,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEU,QAAA,SAAS,GAAG,IAAA,yBAAW,EAAC,oBAAoB,EAAE;IACzD,EAAE,EAAE,IAAA,kBAAI,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,cAAc,EAAE,IAAA,kBAAI,EAAC,kBAAkB,CAAC,EAAM,oBAAoB;IAClE,WAAW,EAAE,IAAA,kBAAI,EAAC,cAAc,CAAC;IACjC,SAAS,EAAE,IAAA,kBAAI,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAA,kBAAI,EAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAG,oBAAoB;IAClE,SAAS,EAAE,IAAA,kBAAI,EAAC,WAAW,CAAC,CAAC,MAAM,EAAE;IACrC,UAAU,EAAE,IAAA,kBAAI,EAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,IAAA,kBAAI,EAAC,WAAW,CAAC;IAC3B,UAAU,EAAE,IAAA,qBAAO,EAAC,aAAa,CAAC;IAClC,UAAU,EAAE,IAAA,kBAAI,EAAC,aAAa,CAAC,EAAe,uCAAuC;IACrF,YAAY,EAAE,IAAA,qBAAO,EAAC,eAAe,CAAC;IACtC,YAAY,EAAE,IAAA,kBAAI,EAAC,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,QAAQ,EAAE,IAAA,kBAAI,EAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5C,kBAAkB,EAAE,IAAA,kBAAI,EAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAClE,qBAAqB,EAAE,IAAA,qBAAO,EAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAChF,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9F,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9F,QAAQ,EAAE,IAAA,qBAAO,EAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;CACtD,CAAC,CAAC;AAEU,QAAA,YAAY,GAAG,IAAA,yBAAW,EAAC,wBAAwB,EAAE;IAChE,MAAM,EAAE,IAAA,kBAAI,EAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACzF,OAAO,EAAE,IAAA,kBAAI,EAAC,UAAU,CAAC,CAAC,OAAO,EAAE;CACpC,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,IAAA,yBAAW,EAAC,iCAAiC,EAAE;IACjF,QAAQ,EAAE,IAAA,kBAAI,EAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,qBAAqB,EAAE,IAAA,kBAAI,EAAC,yBAAyB,CAAC,CAAC,OAAO,EAAE;IAChE,KAAK,EAAE,IAAA,kBAAI,EAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,IAAA,kBAAI,EAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,WAAW,EAAE,IAAA,kBAAI,EAAC,cAAc,CAAC;IACjC,SAAS,EAAE,IAAA,qBAAO,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CAC/F,CAAC,CAAC","sourcesContent":["import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';\n\nexport const accountUsage = sqliteTable('identity_account_usage', {\n  accountId: text('account_id').primaryKey(),\n  storageBytes: integer('storage_bytes').notNull().default(0),\n  ingressBytes: integer('ingress_bytes').notNull().default(0),\n  egressBytes: integer('egress_bytes').notNull().default(0),\n  storageLimitBytes: integer('storage_limit_bytes'),\n  bandwidthLimitBps: integer('bandwidth_limit_bps'),\n  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n});\n\nexport const podUsage = sqliteTable('identity_pod_usage', {\n  podId: text('pod_id').primaryKey(),\n  accountId: text('account_id').notNull(),\n  storageBytes: integer('storage_bytes').notNull().default(0),\n  ingressBytes: integer('ingress_bytes').notNull().default(0),\n  egressBytes: integer('egress_bytes').notNull().default(0),\n  storageLimitBytes: integer('storage_limit_bytes'),\n  bandwidthLimitBps: integer('bandwidth_limit_bps'),\n  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n});\n\n/**\n * WebID Profile 托管表\n * 用于身份与存储分离架构，Cloud 托管用户的 WebID Profile\n */\nexport const webidProfiles = sqliteTable('identity_webid_profile', {\n  username: text('username').primaryKey(),\n  webidUrl: text('webid_url').notNull(),              // https://id.undefineds.co/alice/profile/card#me\n  storageUrl: text('storage_url'),                    // https://alice.undefineds.xyz/ 或 https://pods.undefineds.co/alice/\n  storageMode: text('storage_mode').default('cloud'), // 'cloud' | 'local' | 'custom'\n  oidcIssuer: text('oidc_issuer'),                    // https://id.undefineds.co/\n  profileData: text('profile_data', { mode: 'json' }), // WebID Profile 的 JSON-LD 表示\n  accountId: text('account_id'),                      // 关联的 CSS 账户 ID\n  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n});\n\n/**\n * DDNS 域名池表\n * 管理可用的 DDNS 域名\n */\nexport const ddnsDomains = sqliteTable('identity_ddns_domain', {\n  domain: text('domain').primaryKey(),                // undefineds.xyz\n  status: text('status').default('active'),           // 'active' | 'suspended'\n  provider: text('provider'),                         // 'cloudflare' | 'tencent'\n  zoneId: text('zone_id'),                            // DNS Zone ID\n  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n});\n\n/**\n * DDNS 记录表\n * 已分配的子域名记录\n */\nexport const ddnsRecords = sqliteTable('identity_ddns_record', {\n  subdomain: text('subdomain').primaryKey(),          // alice\n  domain: text('domain').notNull(),                   // undefineds.xyz\n  ipAddress: text('ip_address'),\n  ipv6Address: text('ipv6_address'),\n  recordType: text('record_type').default('A'),       // 'A' | 'AAAA'\n  nodeId: text('node_id'),                            // 关联的节点 ID\n  username: text('username'),                         // 关联的用户名\n  status: text('status').default('active'),           // 'active' | 'banned'\n  bannedReason: text('banned_reason'),\n  ttl: integer('ttl').default(60),\n  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n});\n\nexport const edgeNodes = sqliteTable('identity_edge_node', {\n  id: text('id').primaryKey(),\n  ownerAccountId: text('owner_account_id'),     // Owner of the node\n  displayName: text('display_name'),\n  tokenHash: text('token_hash').notNull(),\n  nodeType: text('node_type').default('edge'),  // 'center' | 'edge'\n  subdomain: text('subdomain').unique(),\n  accessMode: text('access_mode'),\n  publicIp: text('public_ip'),\n  publicPort: integer('public_port'),\n  internalIp: text('internal_ip'),              // Internal network IP for center nodes\n  internalPort: integer('internal_port'),\n  capabilities: text('capabilities', { mode: 'json' }),\n  metadata: text('metadata', { mode: 'json' }),\n  connectivityStatus: text('connectivity_status').default('unknown'),\n  lastConnectivityCheck: integer('last_connectivity_check', { mode: 'timestamp' }),\n  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n  updatedAt: integer('updated_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n  lastSeen: integer('last_seen', { mode: 'timestamp' }),\n});\n\nexport const edgeNodePods = sqliteTable('identity_edge_node_pod', {\n  nodeId: text('node_id').notNull().references(() => edgeNodes.id, { onDelete: 'cascade' }),\n  baseUrl: text('base_url').notNull(),\n});\n\nexport const apiClientCredentials = sqliteTable('identity_api_client_credentials', {\n  clientId: text('client_id').primaryKey(),\n  clientSecretEncrypted: text('client_secret_encrypted').notNull(),\n  webId: text('web_id').notNull(),\n  accountId: text('account_id').notNull(),\n  displayName: text('display_name'),\n  createdAt: integer('created_at', { mode: 'timestamp' }).notNull().$defaultFn(() => new Date()),\n});\n"]}

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.d.ts

@@ -0,0 +1,43 @@
+import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
+export interface AutoDetectIdentityProviderHandlerOptions {
+    /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */
+    idpUrl?: string;
+    /** 禁用时的消息 */
+    message?: string;
+    /** CSS 默认的 IdentityProviderHandler，标准模式下委托给它 */
+    source?: HttpHandler;
+}
+/**
+ * Auto-detect Identity Provider Handler
+ *
+ * 自动检测运行模式：
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理
+ * - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler
+ */
+export declare class AutoDetectIdentityProviderHandler extends HttpHandler {
+    private readonly logger;
+    private readonly idpUrl?;
+    private readonly message;
+    private readonly source?;
+    constructor(options?: AutoDetectIdentityProviderHandlerOptions);
+    /**
+     * 判断是否处理请求
+     * - SP 模式：拒绝所有 IdP 请求
+     * - 标准模式：委托给 source Handler
+     */
+    canHandle(input: HttpHandlerInput): Promise<void>;
+    /**
+     * 处理请求
+     * - SP 模式：不应该到达这里
+     * - 标准模式：委托给 source Handler
+     */
+    handle(input: HttpHandlerInput): Promise<void>;
+    /**
+     * 检查是否是 IdP 路径
+     */
+    private isIdpPath;
+    /**
+     * 从 URL 提取 pathname
+     */
+    private getPathname;
+}

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutoDetectIdentityProviderHandler = void 0;
+const global_logger_factory_1 = require("global-logger-factory");
+const community_server_1 = require("@solid/community-server");
+/**
+ * Auto-detect Identity Provider Handler
+ *
+ * 自动检测运行模式：
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理
+ * - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler
+ */
+class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
+    constructor(options = {}) {
+        super();
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.idpUrl = options.idpUrl;
+        this.message = options.message ?? 'Account management handled by external IdP';
+        this.source = options.source;
+        if (this.idpUrl) {
+            this.logger.info(`SP mode enabled: ${this.message}, external IdP: ${this.idpUrl}`);
+        }
+        else {
+            this.logger.info('Standard mode enabled, delegating to source IdentityProviderHandler');
+        }
+    }
+    /**
+     * 判断是否处理请求
+     * - SP 模式：拒绝所有 IdP 请求
+     * - 标准模式：委托给 source Handler
+     */
+    async canHandle(input) {
+        const url = input.request.url ?? '';
+        // 检查是否是 IdP 路径
+        if (!this.isIdpPath(url)) {
+            throw new community_server_1.NotImplementedHttpError('Not an IdP request');
+        }
+        // SP 模式：拒绝所有 IdP 请求
+        if (this.idpUrl) {
+            throw new community_server_1.NotImplementedHttpError(`External IdP mode: ${this.message}. Please use the external identity provider.`);
+        }
+        // 标准模式：委托给 source Handler
+        if (this.source) {
+            await this.source.canHandle(input);
+        }
+        else {
+            throw new community_server_1.NotImplementedHttpError('No source IdentityProviderHandler configured');
+        }
+    }
+    /**
+     * 处理请求
+     * - SP 模式：不应该到达这里
+     * - 标准模式：委托给 source Handler
+     */
+    async handle(input) {
+        if (this.idpUrl) {
+            // SP 模式下不应该到达这里
+            throw new community_server_1.NotImplementedHttpError(`External IdP mode: ${this.message}. Please use the external identity provider.`);
+        }
+        // 标准模式：委托给 source Handler
+        if (this.source) {
+            await this.source.handle(input);
+        }
+        else {
+            throw new community_server_1.NotImplementedHttpError('No source IdentityProviderHandler configured');
+        }
+    }
+    /**
+     * 检查是否是 IdP 路径
+     */
+    isIdpPath(url) {
+        const pathname = this.getPathname(url);
+        return (pathname.startsWith('/idp/') ||
+            pathname.startsWith('/.account/') ||
+            pathname === '/register' ||
+            pathname === '/login' ||
+            pathname === '/logout');
+    }
+    /**
+     * 从 URL 提取 pathname
+     */
+    getPathname(url) {
+        try {
+            return new URL(url, 'http://localhost').pathname;
+        }
+        catch {
+            return url.split('?')[0];
+        }
+    }
+}
+exports.AutoDetectIdentityProviderHandler = AutoDetectIdentityProviderHandler;
+//# sourceMappingURL=AutoDetectIdentityProviderHandler.js.map

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutoDetectIdentityProviderHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectIdentityProviderHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;GAMG;AACH,MAAa,iCAAkC,SAAQ,8BAAW;IAMhE,YAAY,UAAoD,EAAE;QAChE,KAAK,EAAE,CAAC;QANO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAO3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4CAA4C,CAAC;QAC/E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,KAAuB;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAEpC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,0CAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,oBAAoB;QACpB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,8CAA8C,CACjF,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,8CAA8C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,gBAAgB;YAChB,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,8CAA8C,CACjF,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,8CAA8C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,SAAS,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA5FD,8EA4FC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectIdentityProviderHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  idpUrl?: string;\n  /** 禁用时的消息 */\n  message?: string;\n  /** CSS 默认的 IdentityProviderHandler，标准模式下委托给它 */\n  source?: HttpHandler;\n}\n\n/**\n * Auto-detect Identity Provider Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理\n * - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler\n */\nexport class AutoDetectIdentityProviderHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly idpUrl?: string;\n  private readonly message: string;\n  private readonly source?: HttpHandler;\n\n  constructor(options: AutoDetectIdentityProviderHandlerOptions = {}) {\n    super();\n    this.idpUrl = options.idpUrl;\n    this.message = options.message ?? 'Account management handled by external IdP';\n    this.source = options.source;\n\n    if (this.idpUrl) {\n      this.logger.info(`SP mode enabled: ${this.message}, external IdP: ${this.idpUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, delegating to source IdentityProviderHandler');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：拒绝所有 IdP 请求\n   * - 标准模式：委托给 source Handler\n   */\n  public override async canHandle(input: HttpHandlerInput): Promise<void> {\n    const url = input.request.url ?? '';\n\n    // 检查是否是 IdP 路径\n    if (!this.isIdpPath(url)) {\n      throw new NotImplementedHttpError('Not an IdP request');\n    }\n\n    // SP 模式：拒绝所有 IdP 请求\n    if (this.idpUrl) {\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Please use the external identity provider.`\n      );\n    }\n\n    // 标准模式：委托给 source Handler\n    if (this.source) {\n      await this.source.canHandle(input);\n    } else {\n      throw new NotImplementedHttpError('No source IdentityProviderHandler configured');\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：不应该到达这里\n   * - 标准模式：委托给 source Handler\n   */\n  public override async handle(input: HttpHandlerInput): Promise<void> {\n    if (this.idpUrl) {\n      // SP 模式下不应该到达这里\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Please use the external identity provider.`\n      );\n    }\n\n    // 标准模式：委托给 source Handler\n    if (this.source) {\n      await this.source.handle(input);\n    } else {\n      throw new NotImplementedHttpError('No source IdentityProviderHandler configured');\n    }\n  }\n\n  /**\n   * 检查是否是 IdP 路径\n   */\n  private isIdpPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/idp/') ||\n      pathname.startsWith('/.account/') ||\n      pathname === '/register' ||\n      pathname === '/login' ||\n      pathname === '/logout'\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld

@@ -0,0 +1,122 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler",
+      "@type": "Class",
+      "requireElement": "AutoDetectIdentityProviderHandler",
+      "extends": [
+        "css:dist/server/HttpHandler.jsonld#HttpHandler"
+      ],
+      "comment": "Auto-detect Identity Provider Handler  自动检测运行模式： - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理 - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_idpUrl",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "外部 IdP 的基础 URL，如果提供则启用 SP 模式"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_message",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "禁用时的消息"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_source",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "css:dist/server/HttpHandler.jsonld#HttpHandler",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "CSS 默认的 IdentityProviderHandler，标准模式下委托给它"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_logger",
+          "memberFieldName": "logger"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_idpUrl",
+          "memberFieldName": "idpUrl"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_message",
+          "memberFieldName": "message"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_source",
+          "memberFieldName": "source"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_canHandle",
+          "memberFieldName": "canHandle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_handle",
+          "memberFieldName": "handle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_isIdpPath",
+          "memberFieldName": "isIdpPath"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_getPathname",
+          "memberFieldName": "getPathname"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "idpUrl",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_idpUrl"
+              }
+            },
+            {
+              "keyRaw": "message",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_message"
+              }
+            },
+            {
+              "keyRaw": "source",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_source"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/identity/oidc/AutoDetectOidcHandler.d.ts

@@ -0,0 +1,55 @@
+import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
+export interface AutoDetectOidcHandlerOptions {
+    /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */
+    idpUrl?: string;
+    /** 禁用原因说明 */
+    message?: string;
+    /** JWKS 缓存时间 (ms) */
+    cacheMs?: number;
+}
+/**
+ * Auto-detect OIDC Handler
+ *
+ * 自动检测运行模式：
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
+ * - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
+ *
+ * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
+ */
+export declare class AutoDetectOidcHandler extends HttpHandler {
+    private readonly logger;
+    private readonly idpUrl?;
+    private readonly jwksUrl?;
+    private readonly message;
+    private readonly cacheMs;
+    private jwksCache?;
+    constructor(options?: AutoDetectOidcHandlerOptions);
+    /**
+     * 判断是否处理请求
+     * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501
+     * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）
+     */
+    canHandle({ request }: HttpHandlerInput): Promise<void>;
+    /**
+     * 处理请求
+     * - SP 模式：代理 JWKS
+     * - 标准模式：不应该到达这里
+     */
+    handle({ response }: HttpHandlerInput): Promise<void>;
+    /**
+     * 获取并缓存 JWKS
+     */
+    private fetchJwks;
+    /**
+     * 检查是否是 OIDC 路径
+     */
+    private isOidcPath;
+    /**
+     * 检查是否是 JWKS 路径
+     */
+    private isJwksPath;
+    /**
+     * 从 URL 提取 pathname
+     */
+    private getPathname;
+}

package/dist/identity/oidc/AutoDetectOidcHandler.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutoDetectOidcHandler = void 0;
+const node_url_1 = require("node:url");
+const global_logger_factory_1 = require("global-logger-factory");
+const community_server_1 = require("@solid/community-server");
+/**
+ * Auto-detect OIDC Handler
+ *
+ * 自动检测运行模式：
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
+ * - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
+ *
+ * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
+ */
+class AutoDetectOidcHandler extends community_server_1.HttpHandler {
+    constructor(options = {}) {
+        super();
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.idpUrl = options.idpUrl;
+        this.jwksUrl = this.idpUrl ? `${this.idpUrl.replace(/\/$/, '')}/.oidc/jwks` : undefined;
+        this.message = options.message ?? 'OIDC disabled in storage provider mode';
+        this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟
+        if (this.idpUrl) {
+            this.logger.info(`SP mode enabled, external IdP: ${this.idpUrl}, JWKS: ${this.jwksUrl}`);
+        }
+        else {
+            this.logger.info('Standard mode enabled, OIDC requests will pass through');
+        }
+    }
+    /**
+     * 判断是否处理请求
+     * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501
+     * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）
+     */
+    async canHandle({ request }) {
+        const url = request.url ?? '';
+        // 检查是否是 OIDC 路径
+        if (!this.isOidcPath(url)) {
+            throw new community_server_1.NotImplementedHttpError('Not an OIDC request');
+        }
+        // 标准模式：不处理，透传给 CSS 默认 Handler
+        if (!this.jwksUrl) {
+            throw new community_server_1.NotImplementedHttpError('Pass through to default OIDC handler');
+        }
+        // SP 模式：只有 JWKS 请求可以处理
+        if (!this.isJwksPath(url)) {
+            throw new community_server_1.NotImplementedHttpError(`External IdP mode: ${this.message}. Authentication handled by external IdP.`);
+        }
+    }
+    /**
+     * 处理请求
+     * - SP 模式：代理 JWKS
+     * - 标准模式：不应该到达这里
+     */
+    async handle({ response }) {
+        // 标准模式：不应该到达这里
+        if (!this.jwksUrl) {
+            throw new community_server_1.InternalServerError('AutoDetectOidcHandler should not handle requests in standard mode');
+        }
+        try {
+            const jwks = await this.fetchJwks();
+            response.statusCode = 200;
+            response.setHeader('Content-Type', 'application/json');
+            response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);
+            response.end(JSON.stringify(jwks));
+            this.logger.debug('JWKS proxy successful');
+        }
+        catch (error) {
+            this.logger.error(`JWKS proxy failed: ${error.message}`);
+            throw new community_server_1.InternalServerError('Failed to proxy JWKS request', { cause: error });
+        }
+    }
+    /**
+     * 获取并缓存 JWKS
+     */
+    async fetchJwks() {
+        // 检查缓存
+        if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {
+            this.logger.debug('Returning cached JWKS');
+            return { keys: this.jwksCache.keys };
+        }
+        if (!this.jwksUrl) {
+            throw new Error('External JWKS URL not configured');
+        }
+        this.logger.debug(`Fetching JWKS from ${this.jwksUrl}`);
+        const res = await fetch(this.jwksUrl, {
+            headers: { Accept: 'application/json' },
+        });
+        if (!res.ok) {
+            throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);
+        }
+        const jwks = await res.json();
+        // 验证 JWKS 格式
+        if (!Array.isArray(jwks.keys)) {
+            throw new Error('Invalid JWKS format: missing keys array');
+        }
+        // 更新缓存
+        this.jwksCache = {
+            keys: jwks.keys,
+            expiresAt: Date.now() + this.cacheMs,
+        };
+        this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);
+        return jwks;
+    }
+    /**
+     * 检查是否是 OIDC 路径
+     */
+    isOidcPath(url) {
+        const pathname = this.getPathname(url);
+        return (pathname.startsWith('/.oidc/') ||
+            pathname === '/.well-known/openid-configuration' ||
+            pathname === '/.well-known/oauth-authorization-server' ||
+            pathname.startsWith('/idp/'));
+    }
+    /**
+     * 检查是否是 JWKS 路径
+     */
+    isJwksPath(url) {
+        const pathname = this.getPathname(url);
+        return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';
+    }
+    /**
+     * 从 URL 提取 pathname
+     */
+    getPathname(url) {
+        try {
+            return new node_url_1.URL(url, 'http://localhost').pathname;
+        }
+        catch {
+            // 如果解析失败，直接返回 url（可能是相对路径）
+            return url.split('?')[0];
+        }
+    }
+}
+exports.AutoDetectOidcHandler = AutoDetectOidcHandler;
+//# sourceMappingURL=AutoDetectOidcHandler.js.map

package/dist/identity/oidc/AutoDetectOidcHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,uCAA+B;AAC/B,iEAAqD;AACrD,8DAKiC;AAgBjC;;;;;;;;GAQG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAQpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAS3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wCAAwC,CAAC;QAC3E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,UAAU;QAEpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,0CAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,2CAA2C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,sCAAmB,CAAC,mEAAmE,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEpC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAuB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,sCAAmB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,OAAO;QACP,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;QAErD,aAAa;QACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;QACP,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;SACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,kBAAkB,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,cAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAnJD,sDAmJC","sourcesContent":["import { URL } from 'node:url';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n  InternalServerError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  idpUrl?: string;\n  /** 禁用原因说明 */\n  message?: string;\n  /** JWKS 缓存时间 (ms) */\n  cacheMs?: number;\n}\n\ninterface JwksCache {\n  keys: unknown[];\n  expiresAt: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS\n * - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly idpUrl?: string;\n  private readonly jwksUrl?: string;\n  private readonly message: string;\n  private readonly cacheMs: number;\n  private jwksCache?: JwksCache;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.idpUrl = options.idpUrl;\n    this.jwksUrl = this.idpUrl ? `${this.idpUrl.replace(/\\/$/, '')}/.oidc/jwks` : undefined;\n    this.message = options.message ?? 'OIDC disabled in storage provider mode';\n    this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟\n\n    if (this.idpUrl) {\n      this.logger.info(`SP mode enabled, external IdP: ${this.idpUrl}, JWKS: ${this.jwksUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501\n   * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    // 标准模式：不处理，透传给 CSS 默认 Handler\n    if (!this.jwksUrl) {\n      throw new NotImplementedHttpError('Pass through to default OIDC handler');\n    }\n\n    // SP 模式：只有 JWKS 请求可以处理\n    if (!this.isJwksPath(url)) {\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Authentication handled by external IdP.`\n      );\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：代理 JWKS\n   * - 标准模式：不应该到达这里\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    // 标准模式：不应该到达这里\n    if (!this.jwksUrl) {\n      throw new InternalServerError('AutoDetectOidcHandler should not handle requests in standard mode');\n    }\n\n    try {\n      const jwks = await this.fetchJwks();\n\n      response.statusCode = 200;\n      response.setHeader('Content-Type', 'application/json');\n      response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);\n      response.end(JSON.stringify(jwks));\n\n      this.logger.debug('JWKS proxy successful');\n    } catch (error) {\n      this.logger.error(`JWKS proxy failed: ${(error as Error).message}`);\n      throw new InternalServerError('Failed to proxy JWKS request', { cause: error });\n    }\n  }\n\n  /**\n   * 获取并缓存 JWKS\n   */\n  private async fetchJwks(): Promise<{ keys: unknown[] }> {\n    // 检查缓存\n    if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {\n      this.logger.debug('Returning cached JWKS');\n      return { keys: this.jwksCache.keys };\n    }\n\n    if (!this.jwksUrl) {\n      throw new Error('External JWKS URL not configured');\n    }\n\n    this.logger.debug(`Fetching JWKS from ${this.jwksUrl}`);\n\n    const res = await fetch(this.jwksUrl, {\n      headers: { Accept: 'application/json' },\n    });\n\n    if (!res.ok) {\n      throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);\n    }\n\n    const jwks = await res.json() as { keys: unknown[] };\n\n    // 验证 JWKS 格式\n    if (!Array.isArray(jwks.keys)) {\n      throw new Error('Invalid JWKS format: missing keys array');\n    }\n\n    // 更新缓存\n    this.jwksCache = {\n      keys: jwks.keys,\n      expiresAt: Date.now() + this.cacheMs,\n    };\n\n    this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);\n    return jwks;\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 检查是否是 JWKS 路径\n   */\n  private isJwksPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}