@undefineds.co/xpod 0.3.52 → 0.3.54

package/config/cli.json

@@ -282,6 +282,78 @@
             "hidden": true
           }
         },
+        {
+          "@type": "YargsParameter",
+          "name": "edgeNodeAgentEnabled",
+          "options": {
+            "type": "boolean",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "signalEndpoint",
+          "options": {
+            "type": "string",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "nodeToken",
+          "options": {
+            "type": "string",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "p2pEnabled",
+          "options": {
+            "type": "boolean",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "p2pTargetBaseUrl",
+          "options": {
+            "type": "string",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "p2pLabel",
+          "options": {
+            "type": "string",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "p2pAcceptIntervalMs",
+          "options": {
+            "type": "number",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "p2pConnectTimeoutMs",
+          "options": {
+            "type": "number",
+            "hidden": true
+          }
+        },
+        {
+          "@type": "YargsParameter",
+          "name": "p2pWinnerSelectionWindowMs",
+          "options": {
+            "type": "number",
+            "hidden": true
+          }
+        },
         {
           "comment": "=== Hidden: Multi-Node Center Deployment ===",
           "@type": "YargsParameter",

package/config/components-ignore.json

@@ -0,0 +1,21 @@
+[
+  "Error",
+  "BaseQuintStore",
+  "ClaudeAuthenticationError",
+  "CliCommandError",
+  "CodeBuddyAuthError",
+  "DisabledSparqlFeatureError",
+  "InvalidRelaySessionRequestError",
+  "InvalidTunnelTokenError",
+  "NodeRouteSourceNotFoundError",
+  "P2PSessionExpiredError",
+  "P2PSessionNotFoundError",
+  "P2PSignalingRequestError",
+  "SearchApiError",
+  "SolidFsConflictError",
+  "SolidFsNotFoundError",
+  "SubdomainClientError",
+  "UnsupportedSparqlQueryError",
+  "VectorApiError",
+  "WaitingRunnerError"
+]

package/config/extensions.local.initializer.json

@@ -4,19 +4,88 @@
     "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld"
   ],
   "@graph": [
+    {
+      "comment": "Local edge node heartbeat and optional P2P answer-loop agent. Disabled unless edgeNodeAgentEnabled is true.",
+      "@id": "urn:undefineds:xpod:EdgeNodeAgentInitializer",
+      "@type": "EdgeNodeAgentInitializer",
+      "enabled": {
+        "@id": "urn:solid-server:default:variable:edgeNodeAgentEnabled",
+        "@type": "Variable"
+      },
+      "signalEndpoint": {
+        "@id": "urn:solid-server:default:variable:signalEndpoint",
+        "@type": "Variable"
+      },
+      "nodeId": {
+        "@id": "urn:solid-server:default:variable:nodeId",
+        "@type": "Variable"
+      },
+      "nodeToken": {
+        "@id": "urn:solid-server:default:variable:nodeToken",
+        "@type": "Variable"
+      },
+      "baseUrl": {
+        "@id": "urn:solid-server:default:variable:baseUrl",
+        "@type": "Variable"
+      },
+      "intervalMs": {
+        "@id": "urn:solid-server:default:variable:nodeHeartbeatInterval",
+        "@type": "Variable"
+      },
+      "p2pEnabled": {
+        "@id": "urn:solid-server:default:variable:p2pEnabled",
+        "@type": "Variable"
+      },
+      "p2pTargetBaseUrl": {
+        "@id": "urn:solid-server:default:variable:p2pTargetBaseUrl",
+        "@type": "Variable"
+      },
+      "p2pLabel": {
+        "@id": "urn:solid-server:default:variable:p2pLabel",
+        "@type": "Variable"
+      },
+      "p2pAcceptIntervalMs": {
+        "@id": "urn:solid-server:default:variable:p2pAcceptIntervalMs",
+        "@type": "Variable"
+      },
+      "p2pConnectTimeoutMs": {
+        "@id": "urn:solid-server:default:variable:p2pConnectTimeoutMs",
+        "@type": "Variable"
+      },
+      "p2pWinnerSelectionWindowMs": {
+        "@id": "urn:solid-server:default:variable:p2pWinnerSelectionWindowMs",
+        "@type": "Variable"
+      }
+    },
     {
       "comment": "Redefine PrimarySequenceInitializer to include EdgeNodeAgentInitializer",
       "@id": "urn:solid-server:default:PrimarySequenceInitializer",
       "@type": "SequenceHandler",
       "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/SequenceHandler.jsonld#SequenceHandler_handlers": [
-        { "@id": "urn:solid-server:default:CleanupInitializer" },
-        { "@id": "urn:solid-server:default:MigrationInitializer" },
-        { "@id": "urn:solid-server:default:BaseUrlVerifier" },
-        { "@id": "urn:solid-server:default:PrimaryParallelInitializer" },
-        { "@id": "urn:solid-server:default:ModuleVersionVerifier" },
-        { "@id": "urn:solid-server:default:WorkerManager" },
-        { "@id": "urn:solid-server:default:SeededAccountInitializer" },
-        { "@id": "urn:undefineds:xpod:EdgeNodeAgentInitializer" }
+        {
+          "@id": "urn:solid-server:default:CleanupInitializer"
+        },
+        {
+          "@id": "urn:solid-server:default:MigrationInitializer"
+        },
+        {
+          "@id": "urn:solid-server:default:BaseUrlVerifier"
+        },
+        {
+          "@id": "urn:solid-server:default:PrimaryParallelInitializer"
+        },
+        {
+          "@id": "urn:solid-server:default:ModuleVersionVerifier"
+        },
+        {
+          "@id": "urn:solid-server:default:WorkerManager"
+        },
+        {
+          "@id": "urn:solid-server:default:SeededAccountInitializer"
+        },
+        {
+          "@id": "urn:undefineds:xpod:EdgeNodeAgentInitializer"
+        }
       ]
     }
   ]

package/config/resolver.json

@@ -42,7 +42,6 @@
             "defaultValue": "false"
           }
         },
-
         {
           "comment": "=== Data Layer ===",
           "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:identityDbUrl",
@@ -153,7 +152,6 @@
             "key": "emailConfigAuthPass"
           }
         },
-
         {
           "comment": "=== Business Features ===",
           "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:clusterIngressDomain",
@@ -259,7 +257,6 @@
             "defaultValue": "tcp"
           }
         },
-
         {
           "comment": "=== Multi-Node Cluster Parameters ===",
           "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:nodeId",
@@ -277,6 +274,78 @@
             "defaultValue": "30000"
           }
         },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:edgeNodeAgentEnabled",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "edgeNodeAgentEnabled",
+            "defaultValue": "false"
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:signalEndpoint",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "signalEndpoint",
+            "defaultValue": ""
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:nodeToken",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "nodeToken",
+            "defaultValue": ""
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:p2pEnabled",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "p2pEnabled",
+            "defaultValue": "false"
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:p2pTargetBaseUrl",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "p2pTargetBaseUrl",
+            "defaultValue": ""
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:p2pLabel",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "p2pLabel",
+            "defaultValue": ""
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:p2pAcceptIntervalMs",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "p2pAcceptIntervalMs",
+            "defaultValue": ""
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:p2pConnectTimeoutMs",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "p2pConnectTimeoutMs",
+            "defaultValue": ""
+          }
+        },
+        {
+          "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:p2pWinnerSelectionWindowMs",
+          "CombinedShorthandResolver:_resolvers_value": {
+            "@type": "KeyExtractor",
+            "key": "p2pWinnerSelectionWindowMs",
+            "defaultValue": ""
+          }
+        },
         {
           "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:podRoutingEnabled",
           "CombinedShorthandResolver:_resolvers_value": {
@@ -285,7 +354,6 @@
             "defaultValue": "false"
           }
         },
-
         {
           "comment": "=== IdP/SP Separation Parameters ===",
           "CombinedShorthandResolver:_resolvers_key": "urn:solid-server:default:variable:baseStorageDomain",

package/dist/api/ApiServer.d.ts

@@ -1,4 +1,5 @@
 import { type Server, type ServerResponse } from 'node:http';
+import type { AddressInfo } from 'node:net';
 import type { AuthMiddleware, AuthenticatedRequest } from './middleware/AuthMiddleware';
 import type { RuntimeHost, RuntimeListenEndpoint } from '../runtime/host/types';
 /**
@@ -15,6 +16,8 @@ export interface Route {
     handler: RouteHandler;
     /** If true, skip authentication */
     public?: boolean;
+    /** If true, authenticate when credentials are present, otherwise continue unauthenticated */
+    optionalAuth?: boolean;
     /** If true, match all methods instead of one method. */
     allMethods?: boolean;
 }
@@ -45,6 +48,8 @@ export declare class ApiServer {
     route(method: string, path: string, handler: RouteHandler, options?: {
         /** If true, skip authentication for this route */
         public?: boolean;
+        /** If true, authenticate when credentials are present, otherwise continue unauthenticated */
+        optionalAuth?: boolean;
         /** If true, match all methods instead of one method */
         allMethods?: boolean;
     }): void;
@@ -53,21 +58,27 @@ export declare class ApiServer {
      */
     get(path: string, handler: RouteHandler, options?: {
         public?: boolean;
+        optionalAuth?: boolean;
     }): void;
     post(path: string, handler: RouteHandler, options?: {
         public?: boolean;
+        optionalAuth?: boolean;
     }): void;
     put(path: string, handler: RouteHandler, options?: {
         public?: boolean;
+        optionalAuth?: boolean;
     }): void;
     delete(path: string, handler: RouteHandler, options?: {
         public?: boolean;
+        optionalAuth?: boolean;
     }): void;
     patch(path: string, handler: RouteHandler, options?: {
         public?: boolean;
+        optionalAuth?: boolean;
     }): void;
     all(path: string, handler: RouteHandler, options?: {
         public?: boolean;
+        optionalAuth?: boolean;
     }): void;
     /**
      * Start the server
@@ -81,6 +92,7 @@ export declare class ApiServer {
      * Get the underlying HTTP server (for WebSocket upgrade)
      */
     getHttpServer(): Server | undefined;
+    address(): AddressInfo | string | null;
     private handleRequest;
     private findRoute;
     private pathToRegex;

package/dist/api/ApiServer.js

@@ -31,9 +31,10 @@ class ApiServer {
             paramNames,
             handler,
             public: options?.public,
+            optionalAuth: options?.optionalAuth,
             allMethods: options?.allMethods,
         });
-        this.logger.debug(`Registered route: ${method.toUpperCase()} ${path}${options?.public ? ' (public)' : ''}`);
+        this.logger.debug(`Registered route: ${method.toUpperCase()} ${path}${options?.public ? ' (public)' : ''}${options?.optionalAuth ? ' (optional auth)' : ''}`);
     }
     /**
      * Convenience methods for common HTTP methods
@@ -98,6 +99,9 @@ class ApiServer {
     getHttpServer() {
         return this.server;
     }
+    address() {
+        return this.server?.address() ?? null;
+    }
     async handleRequest(request, response) {
         const method = request.method?.toUpperCase() ?? 'GET';
         const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
@@ -121,8 +125,15 @@ class ApiServer {
         }
         const { route, params } = match;
         const authRequest = request;
-        // Run auth middleware unless route is public
-        if (!route.public) {
+        // Run auth middleware unless route is public. Optional-auth routes accept
+        // anonymous callers but still hydrate request.auth when credentials exist.
+        if (route.optionalAuth && request.headers.authorization) {
+            const authOk = await this.authMiddleware.process(authRequest, response);
+            if (!authOk) {
+                return;
+            }
+        }
+        else if (!route.public && !route.optionalAuth) {
             const authOk = await this.authMiddleware.process(authRequest, response);
             if (!authOk) {
                 return;

package/dist/api/ApiServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiServer.js","sourceRoot":"","sources":["../../src/api/ApiServer.ts"],"names":[],"mappings":";;;AAAA,yCAAiG;AACjG,iEAAqD;AAErD,0EAAuE;AAoCvE;;GAEG;AACH,MAAa,SAAS;IASpB,YAAmB,OAAyB;QAR3B,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK5B,WAAM,GAAY,EAAE,CAAC;QAIpC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iCAAe,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC;YACpF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,KAAK,CACV,MAAc,EACd,IAAY,EACZ,OAAqB,EACrB,OAKC;QAED,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5B,OAAO;YACP,UAAU;YACV,OAAO;YACP,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,UAAU,EAAE,OAAO,EAAE,UAAU;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED;;OAEG;IACI,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAA8B;QAC5E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEM,IAAI,CAAC,IAAY,EAAE,OAAqB,EAAE,OAA8B;QAC7E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAEM,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAA8B;QAC5E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEM,MAAM,CAAC,IAAY,EAAE,OAAqB,EAAE,OAA8B;QAC/E,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,IAAY,EAAE,OAAqB,EAAE,OAA8B;QAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAEM,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAA8B;QAC5E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK;QAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACtC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;wBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC1G,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,IAAI;QACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACvC,OAAO,EAAE,CAAC;YACd,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAwB,EAAE,QAAwB;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,wBAAwB;QACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEnC,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAChC,MAAM,WAAW,GAAG,OAA+B,CAAC;QAEpD,6CAA6C;QAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,IAAY;QAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,IAAI;YACjB,8BAA8B;aAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;YACF,yBAAyB;aACxB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACxC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;aACD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC;YACpC,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,OAAwB,EAAE,QAAwB;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAEtC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAC1D,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;QAC7F,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACxD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AA7ND,8BA6NC","sourcesContent":["import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { AuthMiddleware, AuthenticatedRequest } from './middleware/AuthMiddleware';\nimport { nodeRuntimeHost } from '../runtime/host/node/NodeRuntimeHost';\nimport type { RuntimeHost, RuntimeListenEndpoint } from '../runtime/host/types';\n\n/**\n * Route handler function\n */\nexport type RouteHandler = (\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n  params: Record<string, string>,\n) => Promise<void>;\n\n/**\n * Route definition\n */\nexport interface Route {\n  method: string;\n  pattern: RegExp;\n  paramNames: string[];\n  handler: RouteHandler;\n  /** If true, skip authentication */\n  public?: boolean;\n  /** If true, match all methods instead of one method. */\n  allMethods?: boolean;\n}\n\nexport interface ApiServerOptions {\n  port?: number;\n  host?: string;\n  socketPath?: string;\n  listenEndpoint?: RuntimeListenEndpoint;\n  runtimeHost?: RuntimeHost;\n  authMiddleware: AuthMiddleware;\n  corsOrigins?: string[];\n}\n\n/**\n * Standalone API Server\n */\nexport class ApiServer {\n  private readonly logger = getLoggerFor(this);\n  private readonly runtimeHost: RuntimeHost;\n  private readonly listenEndpoint: RuntimeListenEndpoint;\n  private readonly authMiddleware: AuthMiddleware;\n  private readonly corsOrigins: string[];\n  private readonly routes: Route[] = [];\n  private server?: Server;\n\n  public constructor(options: ApiServerOptions) {\n    this.runtimeHost = options.runtimeHost ?? nodeRuntimeHost;\n    this.listenEndpoint = options.listenEndpoint ?? this.runtimeHost.createListenEndpoint({\n      port: options.port,\n      host: options.host,\n      socketPath: options.socketPath,\n    });\n    this.authMiddleware = options.authMiddleware;\n    this.corsOrigins = options.corsOrigins ?? ['*'];\n  }\n\n  /**\n   * Register a route\n   */\n  public route(\n    method: string,\n    path: string,\n    handler: RouteHandler,\n    options?: {\n      /** If true, skip authentication for this route */\n      public?: boolean;\n      /** If true, match all methods instead of one method */\n      allMethods?: boolean;\n    },\n  ): void {\n    const { pattern, paramNames } = this.pathToRegex(path);\n    this.routes.push({\n      method: method.toUpperCase(),\n      pattern,\n      paramNames,\n      handler,\n      public: options?.public,\n      allMethods: options?.allMethods,\n    });\n    this.logger.debug(`Registered route: ${method.toUpperCase()} ${path}${options?.public ? ' (public)' : ''}`);\n  }\n\n  /**\n   * Convenience methods for common HTTP methods\n   */\n  public get(path: string, handler: RouteHandler, options?: { public?: boolean }): void {\n    this.route('GET', path, handler, options);\n  }\n\n  public post(path: string, handler: RouteHandler, options?: { public?: boolean }): void {\n    this.route('POST', path, handler, options);\n  }\n\n  public put(path: string, handler: RouteHandler, options?: { public?: boolean }): void {\n    this.route('PUT', path, handler, options);\n  }\n\n  public delete(path: string, handler: RouteHandler, options?: { public?: boolean }): void {\n    this.route('DELETE', path, handler, options);\n  }\n\n  public patch(path: string, handler: RouteHandler, options?: { public?: boolean }): void {\n    this.route('PATCH', path, handler, options);\n  }\n\n  public all(path: string, handler: RouteHandler, options?: { public?: boolean }): void {\n    this.route('ALL', path, handler, { ...options, allMethods: true });\n  }\n\n  /**\n   * Start the server\n   */\n  public async start(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.server = createServer((req, res) => {\n        this.handleRequest(req, res).catch((error) => {\n          this.logger.error(`Unhandled error: ${error}`);\n          if (!res.headersSent) {\n            res.statusCode = 500;\n            res.setHeader('Content-Type', 'application/json');\n            res.end(JSON.stringify({ error: 'Internal Server Error' }));\n          }\n        });\n      });\n\n      this.runtimeHost.listen(this.server, this.listenEndpoint).then(() => {\n        this.logger.info(`API Server listening on ${this.runtimeHost.formatListenEndpoint(this.listenEndpoint)}`);\n        resolve();\n      }, reject);\n    });\n  }\n\n  /**\n   * Stop the server\n   */\n  public async stop(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      if (!this.server) {\n        resolve();\n        return;\n      }\n\n      this.runtimeHost.close(this.server, this.listenEndpoint).then(() => {\n          this.logger.info('API Server stopped');\n          resolve();\n      }, reject);\n    });\n  }\n\n  /**\n   * Get the underlying HTTP server (for WebSocket upgrade)\n   */\n  public getHttpServer(): Server | undefined {\n    return this.server;\n  }\n\n  private async handleRequest(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    const method = request.method?.toUpperCase() ?? 'GET';\n    const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n    const path = url.pathname;\n\n    // Handle CORS preflight\n    if (method === 'OPTIONS') {\n      this.handleCors(request, response);\n      response.statusCode = 204;\n      response.end();\n      return;\n    }\n\n    // Add CORS headers\n    this.handleCors(request, response);\n\n    // Find matching route\n    const match = this.findRoute(method, path);\n    if (!match) {\n      response.statusCode = 404;\n      response.setHeader('Content-Type', 'application/json');\n      response.end(JSON.stringify({ error: 'Not Found' }));\n      return;\n    }\n\n    const { route, params } = match;\n    const authRequest = request as AuthenticatedRequest;\n\n    // Run auth middleware unless route is public\n    if (!route.public) {\n      const authOk = await this.authMiddleware.process(authRequest, response);\n      if (!authOk) {\n        return;\n      }\n    }\n\n    // Execute handler\n    try {\n      await route.handler(authRequest, response, params);\n    } catch (error) {\n      this.logger.error(`Route handler error: ${error}`);\n      if (!response.headersSent) {\n        response.statusCode = 500;\n        response.setHeader('Content-Type', 'application/json');\n        response.end(JSON.stringify({ error: 'Internal Server Error' }));\n      }\n    }\n  }\n\n  private findRoute(method: string, path: string): { route: Route; params: Record<string, string> } | undefined {\n    for (const route of this.routes) {\n      if (!route.allMethods && route.method !== method) {\n        continue;\n      }\n\n      const match = route.pattern.exec(path);\n      if (match) {\n        const params: Record<string, string> = {};\n        route.paramNames.forEach((name, index) => {\n          params[name] = match[index + 1];\n        });\n        return { route, params };\n      }\n    }\n    return undefined;\n  }\n\n  private pathToRegex(path: string): { pattern: RegExp; paramNames: string[] } {\n    const paramNames: string[] = [];\n    let regexStr = path\n      // 先处理通配符 *path 或 * (匹配剩余所有路径)\n      .replace(/\\*([a-zA-Z0-9_]*)/g, (_, name) => {\n        paramNames.push(name || 'wildcard');\n        return '(.*)';\n      })\n      // 再处理普通参数 :param (只匹配单段)\n      .replace(/:([a-zA-Z0-9_]+)/g, (_, name) => {\n        paramNames.push(name);\n        return '([^/]+)';\n      })\n      .replace(/\\//g, '\\\\/');\n    return {\n      pattern: new RegExp(`^${regexStr}$`),\n      paramNames,\n    };\n  }\n\n  private handleCors(request: IncomingMessage, response: ServerResponse): void {\n    const origin = request.headers.origin;\n\n    if (this.corsOrigins.includes('*')) {\n      response.setHeader('Access-Control-Allow-Origin', '*');\n    } else if (origin && this.corsOrigins.includes(origin)) {\n      response.setHeader('Access-Control-Allow-Origin', origin);\n      response.setHeader('Vary', 'Origin');\n    }\n\n    response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');\n    response.setHeader('Access-Control-Allow-Headers', '*');\n    response.setHeader('Access-Control-Max-Age', '86400');\n  }\n}\n"]}
+{"version":3,"file":"ApiServer.js","sourceRoot":"","sources":["../../src/api/ApiServer.ts"],"names":[],"mappings":";;;AAAA,yCAAiG;AAEjG,iEAAqD;AAErD,0EAAuE;AAsCvE;;GAEG;AACH,MAAa,SAAS;IASpB,YAAmB,OAAyB;QAR3B,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK5B,WAAM,GAAY,EAAE,CAAC;QAIpC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iCAAe,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC;YACpF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,KAAK,CACV,MAAc,EACd,IAAY,EACZ,OAAqB,EACrB,OAOC;QAED,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5B,OAAO;YACP,UAAU;YACV,OAAO;YACP,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,UAAU,EAAE,OAAO,EAAE,UAAU;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChK,CAAC;IAED;;OAEG;IACI,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsD;QACpG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEM,IAAI,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsD;QACrG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAEM,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsD;QACpG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEM,MAAM,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsD;QACvG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsD;QACtG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAEM,GAAG,CAAC,IAAY,EAAE,OAAqB,EAAE,OAAsD;QACpG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK;QAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,IAAA,wBAAY,EAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACtC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;oBAC/C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;wBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;wBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC1G,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,IAAI;QACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACvC,OAAO,EAAE,CAAC;YACd,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEM,OAAO;QACZ,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAwB,EAAE,QAAwB;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE1B,wBAAwB;QACxB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEnC,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAChC,MAAM,WAAW,GAAG,OAA+B,CAAC;QAEpD,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,IAAY;QAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,IAAI;YACjB,8BAA8B;aAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;YACF,yBAAyB;aACxB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACxC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;aACD,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC;YACpC,UAAU;SACX,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,OAAwB,EAAE,QAAwB;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAEtC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAC1D,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAC;QAC7F,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACxD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AA1OD,8BA0OC","sourcesContent":["import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { AuthMiddleware, AuthenticatedRequest } from './middleware/AuthMiddleware';\nimport { nodeRuntimeHost } from '../runtime/host/node/NodeRuntimeHost';\nimport type { RuntimeHost, RuntimeListenEndpoint } from '../runtime/host/types';\n\n/**\n * Route handler function\n */\nexport type RouteHandler = (\n  request: AuthenticatedRequest,\n  response: ServerResponse,\n  params: Record<string, string>,\n) => Promise<void>;\n\n/**\n * Route definition\n */\nexport interface Route {\n  method: string;\n  pattern: RegExp;\n  paramNames: string[];\n  handler: RouteHandler;\n  /** If true, skip authentication */\n  public?: boolean;\n  /** If true, authenticate when credentials are present, otherwise continue unauthenticated */\n  optionalAuth?: boolean;\n  /** If true, match all methods instead of one method. */\n  allMethods?: boolean;\n}\n\nexport interface ApiServerOptions {\n  port?: number;\n  host?: string;\n  socketPath?: string;\n  listenEndpoint?: RuntimeListenEndpoint;\n  runtimeHost?: RuntimeHost;\n  authMiddleware: AuthMiddleware;\n  corsOrigins?: string[];\n}\n\n/**\n * Standalone API Server\n */\nexport class ApiServer {\n  private readonly logger = getLoggerFor(this);\n  private readonly runtimeHost: RuntimeHost;\n  private readonly listenEndpoint: RuntimeListenEndpoint;\n  private readonly authMiddleware: AuthMiddleware;\n  private readonly corsOrigins: string[];\n  private readonly routes: Route[] = [];\n  private server?: Server;\n\n  public constructor(options: ApiServerOptions) {\n    this.runtimeHost = options.runtimeHost ?? nodeRuntimeHost;\n    this.listenEndpoint = options.listenEndpoint ?? this.runtimeHost.createListenEndpoint({\n      port: options.port,\n      host: options.host,\n      socketPath: options.socketPath,\n    });\n    this.authMiddleware = options.authMiddleware;\n    this.corsOrigins = options.corsOrigins ?? ['*'];\n  }\n\n  /**\n   * Register a route\n   */\n  public route(\n    method: string,\n    path: string,\n    handler: RouteHandler,\n    options?: {\n      /** If true, skip authentication for this route */\n      public?: boolean;\n      /** If true, authenticate when credentials are present, otherwise continue unauthenticated */\n      optionalAuth?: boolean;\n      /** If true, match all methods instead of one method */\n      allMethods?: boolean;\n    },\n  ): void {\n    const { pattern, paramNames } = this.pathToRegex(path);\n    this.routes.push({\n      method: method.toUpperCase(),\n      pattern,\n      paramNames,\n      handler,\n      public: options?.public,\n      optionalAuth: options?.optionalAuth,\n      allMethods: options?.allMethods,\n    });\n    this.logger.debug(`Registered route: ${method.toUpperCase()} ${path}${options?.public ? ' (public)' : ''}${options?.optionalAuth ? ' (optional auth)' : ''}`);\n  }\n\n  /**\n   * Convenience methods for common HTTP methods\n   */\n  public get(path: string, handler: RouteHandler, options?: { public?: boolean; optionalAuth?: boolean }): void {\n    this.route('GET', path, handler, options);\n  }\n\n  public post(path: string, handler: RouteHandler, options?: { public?: boolean; optionalAuth?: boolean }): void {\n    this.route('POST', path, handler, options);\n  }\n\n  public put(path: string, handler: RouteHandler, options?: { public?: boolean; optionalAuth?: boolean }): void {\n    this.route('PUT', path, handler, options);\n  }\n\n  public delete(path: string, handler: RouteHandler, options?: { public?: boolean; optionalAuth?: boolean }): void {\n    this.route('DELETE', path, handler, options);\n  }\n\n  public patch(path: string, handler: RouteHandler, options?: { public?: boolean; optionalAuth?: boolean }): void {\n    this.route('PATCH', path, handler, options);\n  }\n\n  public all(path: string, handler: RouteHandler, options?: { public?: boolean; optionalAuth?: boolean }): void {\n    this.route('ALL', path, handler, { ...options, allMethods: true });\n  }\n\n  /**\n   * Start the server\n   */\n  public async start(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      this.server = createServer((req, res) => {\n        this.handleRequest(req, res).catch((error) => {\n          this.logger.error(`Unhandled error: ${error}`);\n          if (!res.headersSent) {\n            res.statusCode = 500;\n            res.setHeader('Content-Type', 'application/json');\n            res.end(JSON.stringify({ error: 'Internal Server Error' }));\n          }\n        });\n      });\n\n      this.runtimeHost.listen(this.server, this.listenEndpoint).then(() => {\n        this.logger.info(`API Server listening on ${this.runtimeHost.formatListenEndpoint(this.listenEndpoint)}`);\n        resolve();\n      }, reject);\n    });\n  }\n\n  /**\n   * Stop the server\n   */\n  public async stop(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      if (!this.server) {\n        resolve();\n        return;\n      }\n\n      this.runtimeHost.close(this.server, this.listenEndpoint).then(() => {\n          this.logger.info('API Server stopped');\n          resolve();\n      }, reject);\n    });\n  }\n\n  /**\n   * Get the underlying HTTP server (for WebSocket upgrade)\n   */\n  public getHttpServer(): Server | undefined {\n    return this.server;\n  }\n\n  public address(): AddressInfo | string | null {\n    return this.server?.address() ?? null;\n  }\n\n  private async handleRequest(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    const method = request.method?.toUpperCase() ?? 'GET';\n    const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n    const path = url.pathname;\n\n    // Handle CORS preflight\n    if (method === 'OPTIONS') {\n      this.handleCors(request, response);\n      response.statusCode = 204;\n      response.end();\n      return;\n    }\n\n    // Add CORS headers\n    this.handleCors(request, response);\n\n    // Find matching route\n    const match = this.findRoute(method, path);\n    if (!match) {\n      response.statusCode = 404;\n      response.setHeader('Content-Type', 'application/json');\n      response.end(JSON.stringify({ error: 'Not Found' }));\n      return;\n    }\n\n    const { route, params } = match;\n    const authRequest = request as AuthenticatedRequest;\n\n    // Run auth middleware unless route is public. Optional-auth routes accept\n    // anonymous callers but still hydrate request.auth when credentials exist.\n    if (route.optionalAuth && request.headers.authorization) {\n      const authOk = await this.authMiddleware.process(authRequest, response);\n      if (!authOk) {\n        return;\n      }\n    } else if (!route.public && !route.optionalAuth) {\n      const authOk = await this.authMiddleware.process(authRequest, response);\n      if (!authOk) {\n        return;\n      }\n    }\n\n    // Execute handler\n    try {\n      await route.handler(authRequest, response, params);\n    } catch (error) {\n      this.logger.error(`Route handler error: ${error}`);\n      if (!response.headersSent) {\n        response.statusCode = 500;\n        response.setHeader('Content-Type', 'application/json');\n        response.end(JSON.stringify({ error: 'Internal Server Error' }));\n      }\n    }\n  }\n\n  private findRoute(method: string, path: string): { route: Route; params: Record<string, string> } | undefined {\n    for (const route of this.routes) {\n      if (!route.allMethods && route.method !== method) {\n        continue;\n      }\n\n      const match = route.pattern.exec(path);\n      if (match) {\n        const params: Record<string, string> = {};\n        route.paramNames.forEach((name, index) => {\n          params[name] = match[index + 1];\n        });\n        return { route, params };\n      }\n    }\n    return undefined;\n  }\n\n  private pathToRegex(path: string): { pattern: RegExp; paramNames: string[] } {\n    const paramNames: string[] = [];\n    let regexStr = path\n      // 先处理通配符 *path 或 * (匹配剩余所有路径)\n      .replace(/\\*([a-zA-Z0-9_]*)/g, (_, name) => {\n        paramNames.push(name || 'wildcard');\n        return '(.*)';\n      })\n      // 再处理普通参数 :param (只匹配单段)\n      .replace(/:([a-zA-Z0-9_]+)/g, (_, name) => {\n        paramNames.push(name);\n        return '([^/]+)';\n      })\n      .replace(/\\//g, '\\\\/');\n    return {\n      pattern: new RegExp(`^${regexStr}$`),\n      paramNames,\n    };\n  }\n\n  private handleCors(request: IncomingMessage, response: ServerResponse): void {\n    const origin = request.headers.origin;\n\n    if (this.corsOrigins.includes('*')) {\n      response.setHeader('Access-Control-Allow-Origin', '*');\n    } else if (origin && this.corsOrigins.includes(origin)) {\n      response.setHeader('Access-Control-Allow-Origin', origin);\n      response.setHeader('Vary', 'Origin');\n    }\n\n    response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, PATCH, OPTIONS');\n    response.setHeader('Access-Control-Allow-Headers', '*');\n    response.setHeader('Access-Control-Max-Age', '86400');\n  }\n}\n"]}

package/dist/api/auth/NodeTokenAuthenticator.d.ts

@@ -10,12 +10,4 @@ export declare class NodeTokenAuthenticator implements Authenticator {
     constructor(options: NodeTokenAuthenticatorOptions);
     canAuthenticate(request: IncomingMessage): boolean;
     authenticate(request: IncomingMessage): Promise<AuthResult>;
-    /**
-     * 解析 Node Token (username:secret 或 base64)
-     */
-    private parseNodeToken;
-    /**
-     * 检查是否是 base64 编码的 Node Token
-     */
-    private isBase64NodeToken;
 }

package/dist/api/auth/NodeTokenAuthenticator.js

@@ -9,10 +9,9 @@ class NodeTokenAuthenticator {
     }
     canAuthenticate(request) {
         const auth = request.headers.authorization;
-        // 支持两种格式:
+        // 支持两种明确格式:
         // 1. XpodNode nodeId:token
         // 2. Bearer <raw-node-token> (带 X-Node-Id 头)
-        // 3. Bearer username:secret / base64(username:secret) (兼容旧格式，带 X-Node-Id 头)
         if (auth?.startsWith('XpodNode ')) {
             return true;
         }
@@ -37,14 +36,11 @@ class NodeTokenAuthenticator {
         }
         else {
             // 格式: Bearer <raw-node-token> (带 X-Node-Id 头)
-            // 兼容旧的 username:secret / base64(username:secret) 形式。
             nodeId = request.headers['x-node-id'];
-            const bearerToken = auth.slice(7).trim();
-            if (!bearerToken) {
+            token = auth.slice(7).trim();
+            if (!token) {
                 return { success: false, error: 'Empty node token' };
             }
-            const parsed = this.parseNodeToken(bearerToken);
-            token = parsed?.token ?? bearerToken;
         }
         try {
             const secret = await this.repo.getNodeSecret(nodeId);
@@ -78,45 +74,6 @@ class NodeTokenAuthenticator {
             return { success: false, error: 'Internal authentication error' };
         }
     }
-    /**
-     * 解析 Node Token (username:secret 或 base64)
-     */
-    parseNodeToken(token) {
-        if (token.includes(':')) {
-            const [username, ...secretParts] = token.split(':');
-            const secret = secretParts.join(':');
-            if (username && secret) {
-                return { username, token: secret };
-            }
-        }
-        // 尝试 base64 解码
-        try {
-            const decoded = Buffer.from(token, 'base64').toString('utf8');
-            if (decoded.includes(':')) {
-                const [username, ...secretParts] = decoded.split(':');
-                const secret = secretParts.join(':');
-                if (username && secret) {
-                    return { username, token: secret };
-                }
-            }
-        }
-        catch {
-            // ignore
-        }
-        return undefined;
-    }
-    /**
-     * 检查是否是 base64 编码的 Node Token
-     */
-    isBase64NodeToken(token) {
-        try {
-            const decoded = Buffer.from(token, 'base64').toString('utf8');
-            return decoded.includes(':');
-        }
-        catch {
-            return false;
-        }
-    }
 }
 exports.NodeTokenAuthenticator = NodeTokenAuthenticator;
 //# sourceMappingURL=NodeTokenAuthenticator.js.map

package/dist/api/auth/NodeTokenAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"NodeTokenAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/NodeTokenAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AAQrD,MAAa,sBAAsB;IAIjC,YAAmB,OAAsC;QAHxC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAI3C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IACjC,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,UAAU;QACV,2BAA2B;QAC3B,6CAA6C;QAC7C,4EAA4E;QAC5E,IAAI,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC;QAE5C,IAAI,MAAc,CAAC;QACnB,IAAI,KAAa,CAAC;QAElB,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,4BAA4B;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;YACjG,CAAC;YACD,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC1C,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,qDAAqD;YACrD,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAW,CAAC;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAChD,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,WAAW,CAAC;QACvC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iBAAiB;gBACjB,8BAA8B;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,6BAA6B,CAAC,CAAC;gBAC1E,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP,IAAI,EAAE,MAAM;wBACZ,MAAM;qBACP;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;YAExD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,MAAM;oBACN,SAAS,EAAG,MAAc,CAAC,SAAS;iBACrC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;oBACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AA7HD,wDA6HC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\n\nexport interface NodeTokenAuthenticatorOptions {\n  repository: EdgeNodeRepository;\n}\n\nexport class NodeTokenAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly repo: EdgeNodeRepository;\n\n  public constructor(options: NodeTokenAuthenticatorOptions) {\n    this.repo = options.repository;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    // 支持两种格式:\n    // 1. XpodNode nodeId:token\n    // 2. Bearer <raw-node-token> (带 X-Node-Id 头)\n    // 3. Bearer username:secret / base64(username:secret) (兼容旧格式，带 X-Node-Id 头)\n    if (auth?.startsWith('XpodNode ')) {\n      return true;\n    }\n    if (auth?.startsWith('Bearer ') && request.headers['x-node-id']) {\n      return true;\n    }\n    return false;\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const auth = request.headers.authorization!;\n\n    let nodeId: string;\n    let token: string;\n\n    if (auth.startsWith('XpodNode ')) {\n      // 格式: XpodNode nodeId:token\n      const credentials = auth.slice(9).trim();\n      const colonIndex = credentials.indexOf(':');\n      if (colonIndex <= 0) {\n        return { success: false, error: 'Invalid XpodNode credentials format. Expected nodeId:token' };\n      }\n      nodeId = credentials.slice(0, colonIndex);\n      token = credentials.slice(colonIndex + 1);\n    } else {\n      // 格式: Bearer <raw-node-token> (带 X-Node-Id 头)\n      // 兼容旧的 username:secret / base64(username:secret) 形式。\n      nodeId = request.headers['x-node-id'] as string;\n      const bearerToken = auth.slice(7).trim();\n      if (!bearerToken) {\n        return { success: false, error: 'Empty node token' };\n      }\n      const parsed = this.parseNodeToken(bearerToken);\n      token = parsed?.token ?? bearerToken;\n    }\n\n    try {\n      const secret = await this.repo.getNodeSecret(nodeId);\n      if (!secret) {\n        // 节点不存在，可能是新节点注册\n        // 对于 DDNS 分配等操作，允许通过（由业务逻辑处理）\n        this.logger.debug(`Node not found: ${nodeId}, allowing for registration`);\n        return {\n          success: true,\n          context: {\n            type: 'node',\n            nodeId,\n          },\n        };\n      }\n\n      if (!secret.tokenHash || !this.repo.matchesToken(secret.tokenHash, token)) {\n        return { success: false, error: 'Invalid node token' };\n      }\n\n      this.logger.debug(`Authenticated edge node: ${nodeId}`);\n\n      return {\n        success: true,\n        context: {\n          type: 'node',\n          nodeId,\n          accountId: (secret as any).accountId,\n        },\n      };\n    } catch (error) {\n      this.logger.error(`Node authentication failed: ${error}`);\n      return { success: false, error: 'Internal authentication error' };\n    }\n  }\n\n  /**\n   * 解析 Node Token (username:secret 或 base64)\n   */\n  private parseNodeToken(token: string): { username: string; token: string } | undefined {\n    if (token.includes(':')) {\n      const [username, ...secretParts] = token.split(':');\n      const secret = secretParts.join(':');\n      if (username && secret) {\n        return { username, token: secret };\n      }\n    }\n\n    // 尝试 base64 解码\n    try {\n      const decoded = Buffer.from(token, 'base64').toString('utf8');\n      if (decoded.includes(':')) {\n        const [username, ...secretParts] = decoded.split(':');\n        const secret = secretParts.join(':');\n        if (username && secret) {\n          return { username, token: secret };\n        }\n      }\n    } catch {\n      // ignore\n    }\n\n    return undefined;\n  }\n\n  /**\n   * 检查是否是 base64 编码的 Node Token\n   */\n  private isBase64NodeToken(token: string): boolean {\n    try {\n      const decoded = Buffer.from(token, 'base64').toString('utf8');\n      return decoded.includes(':');\n    } catch {\n      return false;\n    }\n  }\n}\n"]}
+{"version":3,"file":"NodeTokenAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/NodeTokenAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AAQrD,MAAa,sBAAsB;IAIjC,YAAmB,OAAsC;QAHxC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAI3C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;IACjC,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,YAAY;QACZ,2BAA2B;QAC3B,6CAA6C;QAC7C,IAAI,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAc,CAAC;QAE5C,IAAI,MAAc,CAAC;QACnB,IAAI,KAAa,CAAC;QAElB,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,4BAA4B;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;YACjG,CAAC;YACD,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC1C,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,8CAA8C;YAC9C,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAW,CAAC;YAChD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iBAAiB;gBACjB,8BAA8B;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,MAAM,6BAA6B,CAAC,CAAC;gBAC1E,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP,IAAI,EAAE,MAAM;wBACZ,MAAM;qBACP;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzD,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;YAExD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,MAAM;oBACN,SAAS,EAAG,MAAc,CAAC,SAAS;iBACrC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpE,CAAC;IACH,CAAC;CAGF;AAlFD,wDAkFC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\n\nexport interface NodeTokenAuthenticatorOptions {\n  repository: EdgeNodeRepository;\n}\n\nexport class NodeTokenAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly repo: EdgeNodeRepository;\n\n  public constructor(options: NodeTokenAuthenticatorOptions) {\n    this.repo = options.repository;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    // 支持两种明确格式:\n    // 1. XpodNode nodeId:token\n    // 2. Bearer <raw-node-token> (带 X-Node-Id 头)\n    if (auth?.startsWith('XpodNode ')) {\n      return true;\n    }\n    if (auth?.startsWith('Bearer ') && request.headers['x-node-id']) {\n      return true;\n    }\n    return false;\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const auth = request.headers.authorization!;\n\n    let nodeId: string;\n    let token: string;\n\n    if (auth.startsWith('XpodNode ')) {\n      // 格式: XpodNode nodeId:token\n      const credentials = auth.slice(9).trim();\n      const colonIndex = credentials.indexOf(':');\n      if (colonIndex <= 0) {\n        return { success: false, error: 'Invalid XpodNode credentials format. Expected nodeId:token' };\n      }\n      nodeId = credentials.slice(0, colonIndex);\n      token = credentials.slice(colonIndex + 1);\n    } else {\n      // 格式: Bearer <raw-node-token> (带 X-Node-Id 头)\n      nodeId = request.headers['x-node-id'] as string;\n      token = auth.slice(7).trim();\n      if (!token) {\n        return { success: false, error: 'Empty node token' };\n      }\n    }\n\n    try {\n      const secret = await this.repo.getNodeSecret(nodeId);\n      if (!secret) {\n        // 节点不存在，可能是新节点注册\n        // 对于 DDNS 分配等操作，允许通过（由业务逻辑处理）\n        this.logger.debug(`Node not found: ${nodeId}, allowing for registration`);\n        return {\n          success: true,\n          context: {\n            type: 'node',\n            nodeId,\n          },\n        };\n      }\n\n      if (!secret.tokenHash || !this.repo.matchesToken(secret.tokenHash, token)) {\n        return { success: false, error: 'Invalid node token' };\n      }\n\n      this.logger.debug(`Authenticated edge node: ${nodeId}`);\n\n      return {\n        success: true,\n        context: {\n          type: 'node',\n          nodeId,\n          accountId: (secret as any).accountId,\n        },\n      };\n    } catch (error) {\n      this.logger.error(`Node authentication failed: ${error}`);\n      return { success: false, error: 'Internal authentication error' };\n    }\n  }\n\n\n}\n"]}