npm - @undefineds.co/xpod - Versions diffs - 0.3.57 → 0.3.61 - Mend

@undefineds.co/xpod 0.3.57 → 0.3.61

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (779) hide show

package/dist/provision/ProvisionPodCreator.d.ts CHANGED Viewed

@@ -7,7 +7,7 @@
  * - 有 → 解码 JWT，回调远端 SP 的 /provision/pods 创建 Pod
  * - 没有 → 委托给原始 BasePodCreator（标准本地创建）
  */
-import { BasePodCreator, type PodCreatorInput, type PodCreatorOutput, type BasePodCreatorArgs } from '@solid/community-server';
+import { BasePodCreator, type PodCreatorInput, type PodCreatorOutput, type BasePodCreatorArgs, type ResourceStore } from '@solid/community-server';
 export interface ProvisionPodCreatorArgs extends BasePodCreatorArgs {
     /** 与 ProvisionHandler 使用相同的 baseUrl 派生签名密钥 */
     provisionBaseUrl?: string;
@@ -15,16 +15,30 @@ export interface ProvisionPodCreatorArgs extends BasePodCreatorArgs {
     nodeId?: string;
     /** Kept in the component signature for config compatibility; Pod storage facts live in CSS account data. */
     identityDbUrl?: string;
+    /**
+     * Server-internal resource store. Used to reconcile the solid:storage binding in an existing
+     * WebID profile card after the Pod moves to another storage provider.
+     */
+    resourceStore?: ResourceStore;
 }
 export declare class ProvisionPodCreator extends BasePodCreator {
     private readonly provisionLogger;
     private readonly codec;
     private readonly oidcIssuer?;
     private readonly currentNodeId?;
+    private readonly resourceStore?;
     constructor(args: ProvisionPodCreatorArgs);
     handle(input: PodCreatorInput): Promise<PodCreatorOutput>;
     private targetsCurrentStorageProvider;
     private handleStandardPodCreate;
     private prepareWebIdLink;
     private findExistingWebIdLink;
+    /**
+     * Best-effort reconcile of the solid:storage binding in a WebID profile card hosted on this server.
+     * Fresh pods get the correct binding from the pod resource templates, so this only rewrites
+     * the card when an existing WebID's Pod moved to a different storage URL.
+     * Never throws: the Pod itself is already created and a stale card is recoverable on retry.
+     */
+    private trySyncProfileStorageBinding;
+    private syncProfileStorageBinding;
 }

package/dist/provision/ProvisionPodCreator.js CHANGED Viewed

@@ -11,6 +11,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProvisionPodCreator = void 0;
 const global_logger_factory_1 = require("global-logger-factory");
+const node_stream_1 = require("node:stream");
+const n3_1 = require("n3");
 const community_server_1 = require("@solid/community-server");
 const ProvisionCodeCodec_1 = require("./ProvisionCodeCodec");
 function joinUrlPath(baseUrl, relativePath) {
@@ -49,6 +51,14 @@ function isSameUrlRoot(left, right) {
 function isSameNodeId(left, right) {
     return Boolean(left && right && left.trim() === right.trim());
 }
+function isSameUrlOrigin(left, right) {
+    try {
+        return new URL(left).origin === new URL(right).origin;
+    }
+    catch {
+        return false;
+    }
+}
 function buildDefaultWebId(issuer, podName, relativeWebIdPath) {
     const normalizedRelativePath = relativeWebIdPath.replace(/^\/+/u, '');
     return joinUrlPath(issuer, `${encodeURIComponent(podName)}/${normalizedRelativePath}`);
@@ -98,6 +108,7 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         this.provisionLogger = (0, global_logger_factory_1.getLoggerFor)(this);
         this.oidcIssuer = normalizeOptionalUrl(args.provisionBaseUrl);
         this.currentNodeId = normalizeOptionalString(args.nodeId);
+        this.resourceStore = args.resourceStore;
         this.codec = new ProvisionCodeCodec_1.ProvisionCodeCodec(this.oidcIssuer ?? args.baseUrl);
     }
     async handle(input) {
@@ -131,12 +142,16 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         }
         this.provisionLogger.info(`Provisioning pod on remote SP: ${payload.spUrl}`);
         // 2. 回调 SP 创建 Pod
+        const callbackToken = payload.serviceAccessToken ?? payload.serviceToken;
+        if (!callbackToken) {
+            throw new Error('Invalid or expired provisionCode');
+        }
         const callbackUrl = `${payload.spUrl.replace(/\/$/, '')}/provision/pods`;
         const spResponse = await fetch(callbackUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                'Authorization': `Bearer ${payload.serviceToken}`,
+                'Authorization': `Bearer ${callbackToken}`,
             },
             body: JSON.stringify({ podName, webId }),
         });
@@ -168,6 +183,7 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         const webIdLink = await this.prepareWebIdLink(!input.webId, webId, input.accountId, podSettings);
         podSettings.oidcIssuer = tokenOidcIssuer;
         const podId = await this.createPod(input.accountId, podSettings, !input.name, webIdLink.cleanupWebIdLink);
+        await this.trySyncProfileStorageBinding(webId, canonicalStorageUrl);
         this.provisionLogger.info(`Provisioned pod ${podName} on SP ${payload.spUrl}, podUrl: ${podUrl}`);
         return {
             podUrl,
@@ -217,6 +233,7 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         }
         const podElapsed = Date.now() - podStarted;
         const totalElapsed = Date.now() - totalStarted;
+        await this.trySyncProfileStorageBinding(webId, storageUrl);
         this.provisionLogger.info(`[timing] ProvisionPodCreator.standard account=${input.accountId} pod=${baseIdentifier.path} handleWebId=${webIdElapsed}ms createPod=${podElapsed}ms total=${totalElapsed}ms`);
         return {
             podUrl: baseIdentifier.path,
@@ -245,6 +262,56 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         const links = await this.webIdStore.findLinks(accountId);
         return links.find((link) => (normalizeUrlRoot(link.webId) ?? link.webId) === normalizedTarget);
     }
+    /**
+     * Best-effort reconcile of the solid:storage binding in a WebID profile card hosted on this server.
+     * Fresh pods get the correct binding from the pod resource templates, so this only rewrites
+     * the card when an existing WebID's Pod moved to a different storage URL.
+     * Never throws: the Pod itself is already created and a stale card is recoverable on retry.
+     */
+    async trySyncProfileStorageBinding(webId, storageUrl) {
+        try {
+            await this.syncProfileStorageBinding(webId, storageUrl);
+        }
+        catch (error) {
+            this.provisionLogger.error(`Failed to sync solid:storage in profile card for ${webId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    async syncProfileStorageBinding(webId, storageUrl) {
+        if (!this.resourceStore) {
+            return;
+        }
+        const cardUrl = webId.split('#')[0];
+        if (!cardUrl || !isSameUrlOrigin(cardUrl, this.baseUrl)) {
+            return;
+        }
+        const identifier = { path: cardUrl };
+        const representation = await this.resourceStore.getRepresentation(identifier, {
+            type: { 'text/turtle': 1 },
+        });
+        const turtle = await (0, community_server_1.readableToString)(representation.data);
+        const webIdNode = n3_1.DataFactory.namedNode(webId);
+        const storagePredicate = n3_1.DataFactory.namedNode('http://www.w3.org/ns/solid/terms#storage');
+        const quads = new n3_1.Parser().parse(turtle);
+        const storageQuads = quads.filter((quad) => quad.subject.equals(webIdNode) && quad.predicate.equals(storagePredicate));
+        if (storageQuads.length === 1 && storageQuads[0].object.value === storageUrl) {
+            return;
+        }
+        const keptQuads = quads.filter((quad) => !(quad.subject.equals(webIdNode) && quad.predicate.equals(storagePredicate)));
+        keptQuads.push(n3_1.DataFactory.quad(webIdNode, storagePredicate, n3_1.DataFactory.namedNode(storageUrl)));
+        const writer = new n3_1.Writer({
+            prefixes: {
+                foaf: 'http://xmlns.com/foaf/0.1/',
+                solid: 'http://www.w3.org/ns/solid/terms#',
+                rdf: 'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
+            },
+        });
+        writer.addQuads(keptQuads);
+        const updatedTurtle = await new Promise((resolve, reject) => {
+            writer.end((error, result) => error ? reject(error) : resolve(result));
+        });
+        await this.resourceStore.setRepresentation(identifier, new community_server_1.BasicRepresentation((0, community_server_1.guardStream)(node_stream_1.Readable.from(updatedTurtle)), identifier, 'text/turtle'));
+        this.provisionLogger.info(`Updated solid:storage in profile card ${cardUrl} to ${storageUrl}`);
+    }
 }
 exports.ProvisionPodCreator = ProvisionPodCreator;
 //# sourceMappingURL=ProvisionPodCreator.js.map

package/dist/provision/ProvisionPodCreator.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ProvisionPodCreator.js","sourceRoot":"","sources":["../../src/provision/ProvisionPodCreator.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,iEAAqD;AACrD,8DAQiC;AACjC,6DAA0D;AAE1D,SAAS,WAAW,CAAC,OAAe,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,sBAAsB,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,GAAG,iBAAiB,IAAI,sBAAsB,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAuB;IACnD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAC9D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAwB,EAAE,KAAyB;IACxE,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,cAAc,IAAI,eAAe,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB,EAAE,KAAyB;IACvE,OAAO,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,OAAe,EAAE,iBAAyB;IACnF,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA6C;IACrE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,OAAe;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAqC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,QAAmC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,QAAkB;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2C,CAAC;QACxE,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AA0BD,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,oCAAiB,CAAC,aAAa,OAAO,6CAA6C,EAAE;YAC7F,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,CAAC;AACd,CAAC;AAED,MAAa,mBAAoB,SAAQ,iCAAc;IAMrD,YAAmB,IAA6B;QAC9C,KAAK,CAAC,IAAI,CAAC,CAAC;QANG,oBAAe,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAOpD,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,uCAAkB,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,EAAE,aAAmC,CAAC;QAE1E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,iCAAiC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,gBAAgB;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjH,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,WAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC;QAE7G,IAAI,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CACvB,qCAAqC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,qCAAqC,CAC9I,CAAC;YACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE;gBACzC,cAAc,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBAC7C,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK;gBACvB,UAAU,EAAE,eAAe;gBAC3B,UAAU,EAAE,mBAAmB;gBAC/B,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7E,kBAAkB;QAClB,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC;QACzE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;aAClD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;YAC/D,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,uBAAuB,UAAU,CAAC,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACxF,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/F,MAAM,IAAI,oCAAiB,CAAC,OAAO,IAAI,aAAa,OAAO,6CAA6C,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,OAAO;gBACrB,CAAC,CAAC,+BAA+B,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE;gBAChE,CAAC,CAAC,+BAA+B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,EAAyB,CAAC;QAEhE,uCAAuC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAEtD,oCAAoC;QACpC,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,IAAI,EAAE,SAAS;YACf,KAAK;YACL,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,mBAAmB;SAC7B,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjG,WAAW,CAAC,UAAU,GAAG,eAAe,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE1G,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,OAAO,UAAU,OAAO,CAAC,KAAK,aAAa,MAAM,EAAE,CAAC,CAAC;QAElG,OAAO;YACL,MAAM;YACN,KAAK;YACL,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,eAAe;SACrC,CAAC;IACJ,CAAC;IAEO,6BAA6B,CAAC,OAA2C,EAAE,iBAAyB;QAC1G,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC;YACrD,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;YAC1C,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,KAAsB,EACtB,UAAoC,EAAE;QAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,aAAa,EAAE,UAAU,KAAK,QAAQ;YACrF,CAAC,CAAC,aAAa,CAAC,UAAU;YAC1B,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;YACvD,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC;YACnE,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC;QAC7D,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,IAAI,EAAE,cAAc;YACpB,KAAK;YACL,UAAU;YACV,OAAO,EAAE,UAAU;SACpB,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAEpD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9F,WAAW,CAAC,UAAU,GAAG,UAAU,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE/C,IAAI,CAAC,eAAe,CAAC,IAAI,CACvB,iDAAiD,KAAK,CAAC,SAAS,QAAQ,cAAc,CAAC,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,YAAY,IAAI,CAC9K,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,cAAc,CAAC,IAAI;YAC3B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,eAAe;SACrC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,SAAkB,EAClB,KAAa,EACb,SAAiB,EACjB,QAAqB;QAErB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7E,OAAO;YACL,eAAe,EAAE,WAAW;YAC5B,gBAAgB,EAAE,WAAW;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,KAAa,EACb,SAAiB;QAEjB,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACjG,CAAC;CACF;AAnMD,kDAmMC","sourcesContent":["/*\n ProvisionPodCreator\n \n 等位替换 CSS 的 BasePodCreator。\n \n 检查 settings 里有没有 provisionCode：\n * - 有 → 解码 JWT，回调远端 SP 的 /provision/pods 创建 Pod\n * - 没有 → 委托给原始 BasePodCreator（标准本地创建）\n /\n\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n BasePodCreator,\n type PodCreatorInput,\n type PodCreatorOutput,\n type BasePodCreatorArgs,\n type ResourceIdentifier,\n type PodSettings,\n ConflictHttpError,\n} from '@solid/community-server';\nimport { ProvisionCodeCodec } from './ProvisionCodeCodec';\n\nfunction joinUrlPath(baseUrl: string, relativePath: string): string {\n const normalizedBaseUrl = baseUrl.replace(/\\/+$/u, '');\n const normalizedRelativePath = relativePath.replace(/^\\/+/u, '');\n return `${normalizedBaseUrl}/${normalizedRelativePath}`;\n}\n\nfunction normalizeOptionalUrl(url: string \| undefined): string \| undefined {\n const trimmed = url?.trim();\n return trimmed ? trimmed : undefined;\n}\n\nfunction normalizeOptionalString(value: string \| undefined): string \| undefined {\n const trimmed = value?.trim();\n return trimmed ? trimmed : undefined;\n}\n\nfunction normalizeUrlRoot(url: string \| undefined): string \| undefined {\n if (!url) {\n return undefined;\n }\n\n try {\n const parsed = new URL(url);\n parsed.pathname = parsed.pathname.replace(/\\/+$/u, '') \|\| '/';\n parsed.search = '';\n parsed.hash = '';\n return parsed.toString();\n } catch {\n return undefined;\n }\n}\n\nfunction isSameUrlRoot(left: string \| undefined, right: string \| undefined): boolean {\n const normalizedLeft = normalizeUrlRoot(left);\n const normalizedRight = normalizeUrlRoot(right);\n return Boolean(normalizedLeft && normalizedRight && normalizedLeft === normalizedRight);\n}\n\nfunction isSameNodeId(left: string \| undefined, right: string \| undefined): boolean {\n return Boolean(left && right && left.trim() === right.trim());\n}\n\nfunction buildDefaultWebId(issuer: string, podName: string, relativeWebIdPath: string): string {\n const normalizedRelativePath = relativeWebIdPath.replace(/^\\/+/u, '');\n return joinUrlPath(issuer, `${encodeURIComponent(podName)}/${normalizedRelativePath}`);\n}\n\nfunction buildStorageRoot(payload: { spDomain?: string; spUrl: string }): string {\n return payload.spDomain ? `https://${payload.spDomain}` : payload.spUrl;\n}\n\nfunction buildPodUrl(storageRoot: string, podName: string): string {\n return joinUrlPath(storageRoot, `${encodeURIComponent(podName)}/`);\n}\n\nfunction stripProvisionCode(settings: PodCreatorInput['settings']): Record<string, unknown> \| undefined {\n if (!settings) {\n return undefined;\n }\n\n const { provisionCode: _provisionCode, ...rest } = settings as Record<string, unknown>;\n return rest;\n}\n\nasync function readProvisionResponseMessage(response: Response): Promise<string \| undefined> {\n const text = await response.text().catch(() => '');\n if (!text) {\n return undefined;\n }\n\n try {\n const body = JSON.parse(text) as { message?: unknown; error?: unknown };\n return typeof body.message === 'string'\n ? body.message\n : typeof body.error === 'string'\n ? body.error\n : text;\n } catch {\n return text;\n }\n}\n\nexport interface ProvisionPodCreatorArgs extends BasePodCreatorArgs {\n /* 与 ProvisionHandler 使用相同的 baseUrl 派生签名密钥 /\n provisionBaseUrl?: string;\n /* Current SP node id; used to recognize this SP even when URLs differ by localhost/managed domain. /\n nodeId?: string;\n /* Kept in the component signature for config compatibility; Pod storage facts live in CSS account data. /\n identityDbUrl?: string;\n}\n\ninterface StandardPodCreateOptions {\n baseIdentifier?: ResourceIdentifier;\n linkWebId?: boolean;\n oidcIssuer?: string;\n storageUrl?: string;\n webId?: string;\n}\n\ninterface PreparedWebIdLink {\n /* Link id to expose in the create-pod response. May be an existing link. /\n outputWebIdLink?: string;\n /* Link id CSS may delete if Pod creation fails. Only newly-created links are safe here. */\n cleanupWebIdLink?: string;\n}\n\nfunction remapPodConflict(error: unknown, podName: string): never {\n const message = error instanceof Error ? error.message : String(error);\n if (/There already is a resource at/i.test(message)) {\n throw new ConflictHttpError(`Pod name \"${podName}\" is already taken for this storage target.`, {\n cause: error instanceof Error ? error : undefined,\n });\n }\n\n throw error;\n}\n\nexport class ProvisionPodCreator extends BasePodCreator {\n private readonly provisionLogger = getLoggerFor(this);\n private readonly codec: ProvisionCodeCodec;\n private readonly oidcIssuer?: string;\n private readonly currentNodeId?: string;\n\n public constructor(args: ProvisionPodCreatorArgs) {\n super(args);\n this.oidcIssuer = normalizeOptionalUrl(args.provisionBaseUrl);\n this.currentNodeId = normalizeOptionalString(args.nodeId);\n this.codec = new ProvisionCodeCodec(this.oidcIssuer ?? args.baseUrl);\n }\n\n public override async handle(input: PodCreatorInput): Promise<PodCreatorOutput> {\n const provisionCode = input.settings?.provisionCode as string \| undefined;\n\n if (!provisionCode) {\n return this.handleStandardPodCreate(input);\n }\n\n // SP 模式：解码 provisionCode，回调远端 SP\n const payload = this.codec.decode(provisionCode);\n if (!payload) {\n throw new Error('Invalid or expired provisionCode');\n }\n\n // 1. 确定 podName\n const podName = input.name;\n if (!podName) {\n throw new Error('Pod name is required for remote provisioning');\n }\n const webId = input.webId ?? buildDefaultWebId(this.oidcIssuer ?? this.baseUrl, podName, this.relativeWebIdPath);\n const targetStorageRoot = buildStorageRoot(payload);\n const canonicalStorageUrl = buildPodUrl(targetStorageRoot, podName);\n const tokenOidcIssuer = normalizeUrlRoot(this.oidcIssuer ?? this.baseUrl) ?? this.oidcIssuer ?? this.baseUrl;\n\n if (this.targetsCurrentStorageProvider(payload, targetStorageRoot)) {\n this.provisionLogger.info(\n `Provision code targets current SP ${this.baseUrl}${this.currentNodeId ? ` (${this.currentNodeId})` : ''}; creating Pod directly through CSS`,\n );\n return this.handleStandardPodCreate(input, {\n baseIdentifier: { path: canonicalStorageUrl },\n linkWebId: !input.webId,\n oidcIssuer: tokenOidcIssuer,\n storageUrl: canonicalStorageUrl,\n webId,\n });\n }\n\n this.provisionLogger.info(`Provisioning pod on remote SP: ${payload.spUrl}`);\n\n // 2. 回调 SP 创建 Pod\n const callbackUrl = `${payload.spUrl.replace(/\\/$/, '')}/provision/pods`;\n const spResponse = await fetch(callbackUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'Authorization': `Bearer ${payload.serviceToken}`,\n },\n body: JSON.stringify({ podName, webId }),\n });\n\n if (!spResponse.ok) {\n const message = await readProvisionResponseMessage(spResponse);\n this.provisionLogger.error(`SP callback failed: ${spResponse.status} ${message ?? ''}`);\n if (spResponse.status === 409 \|\| /already exists\|already taken\|conflict/iu.test(message ?? '')) {\n throw new ConflictHttpError(message \|\| `Pod name \"${podName}\" is already taken for this storage target.`);\n }\n throw new Error(message\n ? `Failed to create pod on SP: ${spResponse.status}: ${message}`\n : `Failed to create pod on SP: ${spResponse.status}`);\n }\n\n const spResult = await spResponse.json() as { podUrl?: string };\n\n // storage URL 优先用 Cloud 分配的子域名，回调用实际地址\n const podUrl = spResult.podUrl \|\| canonicalStorageUrl;\n\n // 3. 链接 WebID 到账户 + 在本地 PodStore 记录\n // base.path 必须在 Cloud 的 identifier space 内（CSS PodStore 会检查），\n // 所以用 Cloud 本地路径；真实的 SP storage URL 通过 podUrl 返回。\n const localBase = this.identifierGenerator.generate(podName);\n const inputSettings = stripProvisionCode(input.settings);\n const podSettings = {\n ...inputSettings,\n base: localBase,\n webId,\n oidcIssuer: tokenOidcIssuer,\n storage: canonicalStorageUrl,\n };\n\n const webIdLink = await this.prepareWebIdLink(!input.webId, webId, input.accountId, podSettings);\n podSettings.oidcIssuer = tokenOidcIssuer;\n const podId = await this.createPod(input.accountId, podSettings, !input.name, webIdLink.cleanupWebIdLink);\n\n this.provisionLogger.info(`Provisioned pod ${podName} on SP ${payload.spUrl}, podUrl: ${podUrl}`);\n\n return {\n podUrl,\n webId,\n podId,\n webIdLink: webIdLink.outputWebIdLink,\n };\n }\n\n private targetsCurrentStorageProvider(payload: { nodeId?: string; spUrl: string }, targetStorageRoot: string): boolean {\n return isSameNodeId(payload.nodeId, this.currentNodeId) \|\|\n isSameUrlRoot(payload.spUrl, this.baseUrl) \|\|\n isSameUrlRoot(targetStorageRoot, this.baseUrl);\n }\n\n private async handleStandardPodCreate(\n input: PodCreatorInput,\n options: StandardPodCreateOptions = {},\n ): Promise<PodCreatorOutput> {\n const totalStarted = Date.now();\n const baseIdentifier = options.baseIdentifier ?? this.generateBaseIdentifier(input.name);\n const inputSettings = stripProvisionCode(input.settings);\n const oidcIssuer = options.oidcIssuer ?? (typeof inputSettings?.oidcIssuer === 'string'\n ? inputSettings.oidcIssuer\n : this.oidcIssuer ?? this.baseUrl);\n const webId = options.webId ?? input.webId ?? (input.name\n ? buildDefaultWebId(oidcIssuer, input.name, this.relativeWebIdPath)\n : joinUrlPath(baseIdentifier.path, this.relativeWebIdPath));\n const storageUrl = options.storageUrl ?? baseIdentifier.path;\n const podSettings = {\n ...inputSettings,\n base: baseIdentifier,\n webId,\n oidcIssuer,\n storage: storageUrl,\n };\n const linkWebId = options.linkWebId ?? !input.webId;\n\n const webIdStarted = Date.now();\n const webIdLink = await this.prepareWebIdLink(linkWebId, webId, input.accountId, podSettings);\n podSettings.oidcIssuer = oidcIssuer;\n const webIdElapsed = Date.now() - webIdStarted;\n\n const podStarted = Date.now();\n let podId: string;\n try {\n podId = await this.createPod(input.accountId, podSettings, !input.name, webIdLink.cleanupWebIdLink);\n } catch (error) {\n if (input.name) {\n remapPodConflict(error, input.name);\n }\n throw error;\n }\n const podElapsed = Date.now() - podStarted;\n const totalElapsed = Date.now() - totalStarted;\n\n this.provisionLogger.info(\n `[timing] ProvisionPodCreator.standard account=${input.accountId} pod=${baseIdentifier.path} handleWebId=${webIdElapsed}ms createPod=${podElapsed}ms total=${totalElapsed}ms`,\n );\n\n return {\n podUrl: baseIdentifier.path,\n webId,\n podId,\n webIdLink: webIdLink.outputWebIdLink,\n };\n }\n\n private async prepareWebIdLink(\n linkWebId: boolean,\n webId: string,\n accountId: string,\n settings: PodSettings,\n ): Promise<PreparedWebIdLink> {\n if (!linkWebId) {\n return {};\n }\n\n const existingLink = await this.findExistingWebIdLink(webId, accountId);\n if (existingLink) {\n this.provisionLogger.info(`Reusing existing WebID link ${existingLink.id} for ${webId}`);\n return { outputWebIdLink: existingLink.id };\n }\n\n const createdLink = await this.handleWebId(true, webId, accountId, settings);\n return {\n outputWebIdLink: createdLink,\n cleanupWebIdLink: createdLink,\n };\n }\n\n private async findExistingWebIdLink(\n webId: string,\n accountId: string,\n ): Promise<{ id: string; webId: string } \| undefined> {\n const normalizedTarget = normalizeUrlRoot(webId) ?? webId;\n const links = await this.webIdStore.findLinks(accountId);\n return links.find((link) => (normalizeUrlRoot(link.webId) ?? link.webId) === normalizedTarget);\n }\n}\n"]}
1	+ {"version":3,"file":"ProvisionPodCreator.js","sourceRoot":"","sources":["../../src/provision/ProvisionPodCreator.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,iEAAqD;AACrD,6CAAuC;AACvC,2BAAiD;AACjD,8DAYiC;AACjC,6DAA0D;AAE1D,SAAS,WAAW,CAAC,OAAe,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,sBAAsB,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,GAAG,iBAAiB,IAAI,sBAAsB,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAuB;IACnD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAC9D,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAwB,EAAE,KAAyB;IACxE,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,eAAe,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,cAAc,IAAI,eAAe,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB,EAAE,KAAyB;IACvE,OAAO,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,OAAe,EAAE,iBAAyB;IACnF,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,WAAW,CAAC,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA6C;IACrE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,OAAe;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAqC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,QAAmC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,QAAkB;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2C,CAAC;QACxE,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;gBACZ,CAAC,CAAC,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AA+BD,SAAS,gBAAgB,CAAC,KAAc,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,oCAAiB,CAAC,aAAa,OAAO,6CAA6C,EAAE;YAC7F,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,CAAC;AACd,CAAC;AAED,MAAa,mBAAoB,SAAQ,iCAAc;IAOrD,YAAmB,IAA6B;QAC9C,KAAK,CAAC,IAAI,CAAC,CAAC;QAPG,oBAAe,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAQpD,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,uCAAkB,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,EAAE,aAAmC,CAAC;QAE1E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,iCAAiC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,gBAAgB;QAChB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjH,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAG,WAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC;QAE7G,IAAI,IAAI,CAAC,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,eAAe,CAAC,IAAI,CACvB,qCAAqC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,qCAAqC,CAC9I,CAAC;YACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE;gBACzC,cAAc,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBAC7C,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK;gBACvB,UAAU,EAAE,eAAe;gBAC3B,UAAU,EAAE,mBAAmB;gBAC/B,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAE7E,kBAAkB;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC;QACzE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC;QACzE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,aAAa,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;YAC/D,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,uBAAuB,UAAU,CAAC,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YACxF,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/F,MAAM,IAAI,oCAAiB,CAAC,OAAO,IAAI,aAAa,OAAO,6CAA6C,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,OAAO;gBACrB,CAAC,CAAC,+BAA+B,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE;gBAChE,CAAC,CAAC,+BAA+B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,EAAyB,CAAC;QAEhE,uCAAuC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAEtD,oCAAoC;QACpC,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,IAAI,EAAE,SAAS;YACf,KAAK;YACL,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,mBAAmB;SAC7B,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjG,WAAW,CAAC,UAAU,GAAG,eAAe,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE1G,MAAM,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAEpE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,OAAO,UAAU,OAAO,CAAC,KAAK,aAAa,MAAM,EAAE,CAAC,CAAC;QAElG,OAAO;YACL,MAAM;YACN,KAAK;YACL,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,eAAe;SACrC,CAAC;IACJ,CAAC;IAEO,6BAA6B,CAAC,OAA2C,EAAE,iBAAyB;QAC1G,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC;YACrD,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;YAC1C,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,KAAsB,EACtB,UAAoC,EAAE;QAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,aAAa,EAAE,UAAU,KAAK,QAAQ;YACrF,CAAC,CAAC,aAAa,CAAC,UAAU;YAC1B,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;YACvD,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC;YACnE,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC;QAC7D,MAAM,WAAW,GAAG;YAClB,GAAG,aAAa;YAChB,IAAI,EAAE,cAAc;YACpB,KAAK;YACL,UAAU;YACV,OAAO,EAAE,UAAU;SACpB,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAEpD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9F,WAAW,CAAC,UAAU,GAAG,UAAU,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE/C,MAAM,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE3D,IAAI,CAAC,eAAe,CAAC,IAAI,CACvB,iDAAiD,KAAK,CAAC,SAAS,QAAQ,cAAc,CAAC,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,YAAY,IAAI,CAC9K,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,cAAc,CAAC,IAAI;YAC3B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,eAAe;SACrC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,SAAkB,EAClB,KAAa,EACb,SAAiB,EACjB,QAAqB;QAErB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7E,OAAO;YACL,eAAe,EAAE,WAAW;YAC5B,gBAAgB,EAAE,WAAW;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,KAAa,EACb,SAAiB;QAEjB,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,4BAA4B,CAAC,KAAa,EAAE,UAAkB;QAC1E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,eAAe,CAAC,KAAK,CACxB,oDAAoD,KAAK,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,KAAa,EAAE,UAAkB;QACvE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,UAAU,EAAE;YAC5E,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,EAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,gBAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,gBAAgB,GAAG,gBAAW,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,WAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE7E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,CAAC,gBAAW,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,gBAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAG,IAAI,WAAM,CAAC;YACxB,QAAQ,EAAE;gBACR,IAAI,EAAE,4BAA4B;gBAClC,KAAK,EAAE,mCAAmC;gBAC1C,GAAG,EAAE,6CAA6C;aACnD;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,aAAa,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACxC,UAAU,EACV,IAAI,sCAAmB,CAAC,IAAA,8BAAW,EAAC,sBAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,CAAC,CAC9F,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,yCAAyC,OAAO,OAAO,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;CACF;AA9QD,kDA8QC","sourcesContent":["/*\n ProvisionPodCreator\n \n 等位替换 CSS 的 BasePodCreator。\n \n 检查 settings 里有没有 provisionCode：\n * - 有 → 解码 JWT，回调远端 SP 的 /provision/pods 创建 Pod\n * - 没有 → 委托给原始 BasePodCreator（标准本地创建）\n /\n\nimport { getLoggerFor } from 'global-logger-factory';\nimport { Readable } from 'node:stream';\nimport { DataFactory, Parser, Writer } from 'n3';\nimport {\n BasePodCreator,\n BasicRepresentation,\n guardStream,\n readableToString,\n type PodCreatorInput,\n type PodCreatorOutput,\n type BasePodCreatorArgs,\n type ResourceIdentifier,\n type ResourceStore,\n type PodSettings,\n ConflictHttpError,\n} from '@solid/community-server';\nimport { ProvisionCodeCodec } from './ProvisionCodeCodec';\n\nfunction joinUrlPath(baseUrl: string, relativePath: string): string {\n const normalizedBaseUrl = baseUrl.replace(/\\/+$/u, '');\n const normalizedRelativePath = relativePath.replace(/^\\/+/u, '');\n return `${normalizedBaseUrl}/${normalizedRelativePath}`;\n}\n\nfunction normalizeOptionalUrl(url: string \| undefined): string \| undefined {\n const trimmed = url?.trim();\n return trimmed ? trimmed : undefined;\n}\n\nfunction normalizeOptionalString(value: string \| undefined): string \| undefined {\n const trimmed = value?.trim();\n return trimmed ? trimmed : undefined;\n}\n\nfunction normalizeUrlRoot(url: string \| undefined): string \| undefined {\n if (!url) {\n return undefined;\n }\n\n try {\n const parsed = new URL(url);\n parsed.pathname = parsed.pathname.replace(/\\/+$/u, '') \|\| '/';\n parsed.search = '';\n parsed.hash = '';\n return parsed.toString();\n } catch {\n return undefined;\n }\n}\n\nfunction isSameUrlRoot(left: string \| undefined, right: string \| undefined): boolean {\n const normalizedLeft = normalizeUrlRoot(left);\n const normalizedRight = normalizeUrlRoot(right);\n return Boolean(normalizedLeft && normalizedRight && normalizedLeft === normalizedRight);\n}\n\nfunction isSameNodeId(left: string \| undefined, right: string \| undefined): boolean {\n return Boolean(left && right && left.trim() === right.trim());\n}\n\nfunction isSameUrlOrigin(left: string, right: string): boolean {\n try {\n return new URL(left).origin === new URL(right).origin;\n } catch {\n return false;\n }\n}\n\nfunction buildDefaultWebId(issuer: string, podName: string, relativeWebIdPath: string): string {\n const normalizedRelativePath = relativeWebIdPath.replace(/^\\/+/u, '');\n return joinUrlPath(issuer, `${encodeURIComponent(podName)}/${normalizedRelativePath}`);\n}\n\nfunction buildStorageRoot(payload: { spDomain?: string; spUrl: string }): string {\n return payload.spDomain ? `https://${payload.spDomain}` : payload.spUrl;\n}\n\nfunction buildPodUrl(storageRoot: string, podName: string): string {\n return joinUrlPath(storageRoot, `${encodeURIComponent(podName)}/`);\n}\n\nfunction stripProvisionCode(settings: PodCreatorInput['settings']): Record<string, unknown> \| undefined {\n if (!settings) {\n return undefined;\n }\n\n const { provisionCode: _provisionCode, ...rest } = settings as Record<string, unknown>;\n return rest;\n}\n\nasync function readProvisionResponseMessage(response: Response): Promise<string \| undefined> {\n const text = await response.text().catch(() => '');\n if (!text) {\n return undefined;\n }\n\n try {\n const body = JSON.parse(text) as { message?: unknown; error?: unknown };\n return typeof body.message === 'string'\n ? body.message\n : typeof body.error === 'string'\n ? body.error\n : text;\n } catch {\n return text;\n }\n}\n\nexport interface ProvisionPodCreatorArgs extends BasePodCreatorArgs {\n /* 与 ProvisionHandler 使用相同的 baseUrl 派生签名密钥 /\n provisionBaseUrl?: string;\n /* Current SP node id; used to recognize this SP even when URLs differ by localhost/managed domain. /\n nodeId?: string;\n /* Kept in the component signature for config compatibility; Pod storage facts live in CSS account data. /\n identityDbUrl?: string;\n /\n Server-internal resource store. Used to reconcile the solid:storage binding in an existing\n * WebID profile card after the Pod moves to another storage provider.\n /\n resourceStore?: ResourceStore;\n}\n\ninterface StandardPodCreateOptions {\n baseIdentifier?: ResourceIdentifier;\n linkWebId?: boolean;\n oidcIssuer?: string;\n storageUrl?: string;\n webId?: string;\n}\n\ninterface PreparedWebIdLink {\n /* Link id to expose in the create-pod response. May be an existing link. /\n outputWebIdLink?: string;\n /* Link id CSS may delete if Pod creation fails. Only newly-created links are safe here. /\n cleanupWebIdLink?: string;\n}\n\nfunction remapPodConflict(error: unknown, podName: string): never {\n const message = error instanceof Error ? error.message : String(error);\n if (/There already is a resource at/i.test(message)) {\n throw new ConflictHttpError(`Pod name \"${podName}\" is already taken for this storage target.`, {\n cause: error instanceof Error ? error : undefined,\n });\n }\n\n throw error;\n}\n\nexport class ProvisionPodCreator extends BasePodCreator {\n private readonly provisionLogger = getLoggerFor(this);\n private readonly codec: ProvisionCodeCodec;\n private readonly oidcIssuer?: string;\n private readonly currentNodeId?: string;\n private readonly resourceStore?: ResourceStore;\n\n public constructor(args: ProvisionPodCreatorArgs) {\n super(args);\n this.oidcIssuer = normalizeOptionalUrl(args.provisionBaseUrl);\n this.currentNodeId = normalizeOptionalString(args.nodeId);\n this.resourceStore = args.resourceStore;\n this.codec = new ProvisionCodeCodec(this.oidcIssuer ?? args.baseUrl);\n }\n\n public override async handle(input: PodCreatorInput): Promise<PodCreatorOutput> {\n const provisionCode = input.settings?.provisionCode as string \| undefined;\n\n if (!provisionCode) {\n return this.handleStandardPodCreate(input);\n }\n\n // SP 模式：解码 provisionCode，回调远端 SP\n const payload = this.codec.decode(provisionCode);\n if (!payload) {\n throw new Error('Invalid or expired provisionCode');\n }\n\n // 1. 确定 podName\n const podName = input.name;\n if (!podName) {\n throw new Error('Pod name is required for remote provisioning');\n }\n const webId = input.webId ?? buildDefaultWebId(this.oidcIssuer ?? this.baseUrl, podName, this.relativeWebIdPath);\n const targetStorageRoot = buildStorageRoot(payload);\n const canonicalStorageUrl = buildPodUrl(targetStorageRoot, podName);\n const tokenOidcIssuer = normalizeUrlRoot(this.oidcIssuer ?? this.baseUrl) ?? this.oidcIssuer ?? this.baseUrl;\n\n if (this.targetsCurrentStorageProvider(payload, targetStorageRoot)) {\n this.provisionLogger.info(\n `Provision code targets current SP ${this.baseUrl}${this.currentNodeId ? ` (${this.currentNodeId})` : ''}; creating Pod directly through CSS`,\n );\n return this.handleStandardPodCreate(input, {\n baseIdentifier: { path: canonicalStorageUrl },\n linkWebId: !input.webId,\n oidcIssuer: tokenOidcIssuer,\n storageUrl: canonicalStorageUrl,\n webId,\n });\n }\n\n this.provisionLogger.info(`Provisioning pod on remote SP: ${payload.spUrl}`);\n\n // 2. 回调 SP 创建 Pod\n const callbackToken = payload.serviceAccessToken ?? payload.serviceToken;\n if (!callbackToken) {\n throw new Error('Invalid or expired provisionCode');\n }\n const callbackUrl = `${payload.spUrl.replace(/\\/$/, '')}/provision/pods`;\n const spResponse = await fetch(callbackUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'Authorization': `Bearer ${callbackToken}`,\n },\n body: JSON.stringify({ podName, webId }),\n });\n\n if (!spResponse.ok) {\n const message = await readProvisionResponseMessage(spResponse);\n this.provisionLogger.error(`SP callback failed: ${spResponse.status} ${message ?? ''}`);\n if (spResponse.status === 409 \|\| /already exists\|already taken\|conflict/iu.test(message ?? '')) {\n throw new ConflictHttpError(message \|\| `Pod name \"${podName}\" is already taken for this storage target.`);\n }\n throw new Error(message\n ? `Failed to create pod on SP: ${spResponse.status}: ${message}`\n : `Failed to create pod on SP: ${spResponse.status}`);\n }\n\n const spResult = await spResponse.json() as { podUrl?: string };\n\n // storage URL 优先用 Cloud 分配的子域名，回调用实际地址\n const podUrl = spResult.podUrl \|\| canonicalStorageUrl;\n\n // 3. 链接 WebID 到账户 + 在本地 PodStore 记录\n // base.path 必须在 Cloud 的 identifier space 内（CSS PodStore 会检查），\n // 所以用 Cloud 本地路径；真实的 SP storage URL 通过 podUrl 返回。\n const localBase = this.identifierGenerator.generate(podName);\n const inputSettings = stripProvisionCode(input.settings);\n const podSettings = {\n ...inputSettings,\n base: localBase,\n webId,\n oidcIssuer: tokenOidcIssuer,\n storage: canonicalStorageUrl,\n };\n\n const webIdLink = await this.prepareWebIdLink(!input.webId, webId, input.accountId, podSettings);\n podSettings.oidcIssuer = tokenOidcIssuer;\n const podId = await this.createPod(input.accountId, podSettings, !input.name, webIdLink.cleanupWebIdLink);\n\n await this.trySyncProfileStorageBinding(webId, canonicalStorageUrl);\n\n this.provisionLogger.info(`Provisioned pod ${podName} on SP ${payload.spUrl}, podUrl: ${podUrl}`);\n\n return {\n podUrl,\n webId,\n podId,\n webIdLink: webIdLink.outputWebIdLink,\n };\n }\n\n private targetsCurrentStorageProvider(payload: { nodeId?: string; spUrl: string }, targetStorageRoot: string): boolean {\n return isSameNodeId(payload.nodeId, this.currentNodeId) \|\|\n isSameUrlRoot(payload.spUrl, this.baseUrl) \|\|\n isSameUrlRoot(targetStorageRoot, this.baseUrl);\n }\n\n private async handleStandardPodCreate(\n input: PodCreatorInput,\n options: StandardPodCreateOptions = {},\n ): Promise<PodCreatorOutput> {\n const totalStarted = Date.now();\n const baseIdentifier = options.baseIdentifier ?? this.generateBaseIdentifier(input.name);\n const inputSettings = stripProvisionCode(input.settings);\n const oidcIssuer = options.oidcIssuer ?? (typeof inputSettings?.oidcIssuer === 'string'\n ? inputSettings.oidcIssuer\n : this.oidcIssuer ?? this.baseUrl);\n const webId = options.webId ?? input.webId ?? (input.name\n ? buildDefaultWebId(oidcIssuer, input.name, this.relativeWebIdPath)\n : joinUrlPath(baseIdentifier.path, this.relativeWebIdPath));\n const storageUrl = options.storageUrl ?? baseIdentifier.path;\n const podSettings = {\n ...inputSettings,\n base: baseIdentifier,\n webId,\n oidcIssuer,\n storage: storageUrl,\n };\n const linkWebId = options.linkWebId ?? !input.webId;\n\n const webIdStarted = Date.now();\n const webIdLink = await this.prepareWebIdLink(linkWebId, webId, input.accountId, podSettings);\n podSettings.oidcIssuer = oidcIssuer;\n const webIdElapsed = Date.now() - webIdStarted;\n\n const podStarted = Date.now();\n let podId: string;\n try {\n podId = await this.createPod(input.accountId, podSettings, !input.name, webIdLink.cleanupWebIdLink);\n } catch (error) {\n if (input.name) {\n remapPodConflict(error, input.name);\n }\n throw error;\n }\n const podElapsed = Date.now() - podStarted;\n const totalElapsed = Date.now() - totalStarted;\n\n await this.trySyncProfileStorageBinding(webId, storageUrl);\n\n this.provisionLogger.info(\n `[timing] ProvisionPodCreator.standard account=${input.accountId} pod=${baseIdentifier.path} handleWebId=${webIdElapsed}ms createPod=${podElapsed}ms total=${totalElapsed}ms`,\n );\n\n return {\n podUrl: baseIdentifier.path,\n webId,\n podId,\n webIdLink: webIdLink.outputWebIdLink,\n };\n }\n\n private async prepareWebIdLink(\n linkWebId: boolean,\n webId: string,\n accountId: string,\n settings: PodSettings,\n ): Promise<PreparedWebIdLink> {\n if (!linkWebId) {\n return {};\n }\n\n const existingLink = await this.findExistingWebIdLink(webId, accountId);\n if (existingLink) {\n this.provisionLogger.info(`Reusing existing WebID link ${existingLink.id} for ${webId}`);\n return { outputWebIdLink: existingLink.id };\n }\n\n const createdLink = await this.handleWebId(true, webId, accountId, settings);\n return {\n outputWebIdLink: createdLink,\n cleanupWebIdLink: createdLink,\n };\n }\n\n private async findExistingWebIdLink(\n webId: string,\n accountId: string,\n ): Promise<{ id: string; webId: string } \| undefined> {\n const normalizedTarget = normalizeUrlRoot(webId) ?? webId;\n const links = await this.webIdStore.findLinks(accountId);\n return links.find((link) => (normalizeUrlRoot(link.webId) ?? link.webId) === normalizedTarget);\n }\n\n /\n Best-effort reconcile of the solid:storage binding in a WebID profile card hosted on this server.\n * Fresh pods get the correct binding from the pod resource templates, so this only rewrites\n * the card when an existing WebID's Pod moved to a different storage URL.\n * Never throws: the Pod itself is already created and a stale card is recoverable on retry.\n */\n private async trySyncProfileStorageBinding(webId: string, storageUrl: string): Promise<void> {\n try {\n await this.syncProfileStorageBinding(webId, storageUrl);\n } catch (error: unknown) {\n this.provisionLogger.error(\n `Failed to sync solid:storage in profile card for ${webId}: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n }\n\n private async syncProfileStorageBinding(webId: string, storageUrl: string): Promise<void> {\n if (!this.resourceStore) {\n return;\n }\n\n const cardUrl = webId.split('#')[0];\n if (!cardUrl \|\| !isSameUrlOrigin(cardUrl, this.baseUrl)) {\n return;\n }\n\n const identifier = { path: cardUrl };\n const representation = await this.resourceStore.getRepresentation(identifier, {\n type: { 'text/turtle': 1 },\n });\n const turtle = await readableToString(representation.data);\n\n const webIdNode = DataFactory.namedNode(webId);\n const storagePredicate = DataFactory.namedNode('http://www.w3.org/ns/solid/terms#storage');\n const quads = new Parser().parse(turtle);\n const storageQuads = quads.filter((quad) =>\n quad.subject.equals(webIdNode) && quad.predicate.equals(storagePredicate));\n\n if (storageQuads.length === 1 && storageQuads[0].object.value === storageUrl) {\n return;\n }\n\n const keptQuads = quads.filter((quad) =>\n !(quad.subject.equals(webIdNode) && quad.predicate.equals(storagePredicate)));\n keptQuads.push(DataFactory.quad(webIdNode, storagePredicate, DataFactory.namedNode(storageUrl)));\n\n const writer = new Writer({\n prefixes: {\n foaf: 'http://xmlns.com/foaf/0.1/',\n solid: 'http://www.w3.org/ns/solid/terms#',\n rdf: 'http://www.w3.org/1999/02/22-rdf-syntax-ns#',\n },\n });\n writer.addQuads(keptQuads);\n const updatedTurtle = await new Promise<string>((resolve, reject) => {\n writer.end((error, result) => error ? reject(error) : resolve(result));\n });\n\n await this.resourceStore.setRepresentation(\n identifier,\n new BasicRepresentation(guardStream(Readable.from(updatedTurtle)), identifier, 'text/turtle'),\n );\n this.provisionLogger.info(`Updated solid:storage in profile card ${cardUrl} to ${storageUrl}`);\n }\n}\n"]}

package/dist/provision/ProvisionPodCreator.jsonld CHANGED Viewed

@@ -52,6 +52,19 @@
           },
           "comment": "Kept in the component signature for config compatibility; Pod storage facts live in CSS account data."
         },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_resourceStore",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "css:dist/storage/ResourceStore.jsonld#ResourceStore",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Server-internal resource store. Used to reconcile the solid:storage binding in an existing WebID profile card after the Pod moves to another storage provider."
+        },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_baseUrl",
           "range": "xsd:string",
@@ -95,6 +108,10 @@
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_currentNodeId",
           "memberFieldName": "currentNodeId"
         },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_resourceStore",
+          "memberFieldName": "resourceStore"
+        },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_constructor",
           "memberFieldName": "constructor"
@@ -118,6 +135,14 @@
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_findExistingWebIdLink",
           "memberFieldName": "findExistingWebIdLink"
+        },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_trySyncProfileStorageBinding",
+          "memberFieldName": "trySyncProfileStorageBinding"
+        },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_syncProfileStorageBinding",
+          "memberFieldName": "syncProfileStorageBinding"
         }
       ],
       "constructorArguments": [
@@ -142,6 +167,12 @@
                 "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_identityDbUrl"
               }
             },
+            {
+              "keyRaw": "resourceStore",
+              "value": {
+                "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_resourceStore"
+              }
+            },
             {
               "keyRaw": "baseUrl",
               "value": {

package/dist/provision/ServiceAccessTokenCodec.d.ts ADDED Viewed

@@ -0,0 +1,45 @@
+/**
+ * ServiceAccessTokenCodec
+ *
+ * Long-lived serviceToken is a local/root setup credential. Cloud should not
+ * embed it into provisionCode. Instead Cloud signs a short-lived access token
+ * with serviceToken, and Local verifies it statelessly before accepting
+ * provision callbacks.
+ *
+ * 格式: "sat-" + base64url(JSON payload) + "." + base64url(HMAC-SHA256 signature)
+ */
+export interface ServiceAccessTokenPayload {
+    typ: 'xpod-service-access';
+    sub?: string;
+    scopes: string[];
+    exp: number;
+}
+export interface CreateServiceAccessTokenOptions {
+    /** Long-lived local serviceToken used only as signing secret. */
+    serviceToken: string;
+    /** Node/app/service subject, normally nodeId. */
+    subject?: string;
+    scopes: string[];
+    /** Relative lifetime in seconds. Ignored when expiresAt is set. */
+    ttlSeconds?: number;
+    /** Absolute expiration as Unix timestamp seconds. */
+    expiresAt?: number;
+    /** Test hook. Returns milliseconds. */
+    now?: () => number;
+}
+export interface VerifyServiceAccessTokenOptions {
+    /** Long-lived local serviceToken used only as verification secret. */
+    serviceToken: string;
+    requiredScope?: string;
+    /** Test hook. Returns milliseconds. */
+    now?: () => number;
+}
+export type VerifyServiceAccessTokenResult = {
+    valid: true;
+    payload: ServiceAccessTokenPayload;
+} | {
+    valid: false;
+    reason: 'malformed' | 'signature' | 'expired' | 'scope';
+};
+export declare function createServiceAccessToken(options: CreateServiceAccessTokenOptions): string;
+export declare function verifyServiceAccessToken(token: string | undefined | null, options: VerifyServiceAccessTokenOptions): VerifyServiceAccessTokenResult;

package/dist/provision/ServiceAccessTokenCodec.js ADDED Viewed

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * ServiceAccessTokenCodec
+ *
+ * Long-lived serviceToken is a local/root setup credential. Cloud should not
+ * embed it into provisionCode. Instead Cloud signs a short-lived access token
+ * with serviceToken, and Local verifies it statelessly before accepting
+ * provision callbacks.
+ *
+ * 格式: "sat-" + base64url(JSON payload) + "." + base64url(HMAC-SHA256 signature)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServiceAccessToken = createServiceAccessToken;
+exports.verifyServiceAccessToken = verifyServiceAccessToken;
+const node_crypto_1 = require("node:crypto");
+const TOKEN_PREFIX = 'sat-';
+function createServiceAccessToken(options) {
+    const nowSeconds = Math.floor((options.now?.() ?? Date.now()) / 1000);
+    const exp = options.expiresAt ?? (options.ttlSeconds && options.ttlSeconds > 0
+        ? nowSeconds + options.ttlSeconds
+        : undefined);
+    if (!exp || !Number.isFinite(exp)) {
+        throw new Error('service access token expiration is required');
+    }
+    const payload = {
+        typ: 'xpod-service-access',
+        sub: options.subject,
+        scopes: dedupeScopes(options.scopes),
+        exp,
+    };
+    const data = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
+    return `${TOKEN_PREFIX}${data}.${sign(data, options.serviceToken)}`;
+}
+function verifyServiceAccessToken(token, options) {
+    if (typeof token !== 'string' || !token.startsWith(TOKEN_PREFIX)) {
+        return { valid: false, reason: 'malformed' };
+    }
+    const body = token.slice(TOKEN_PREFIX.length);
+    const dotIndex = body.indexOf('.');
+    if (dotIndex <= 0) {
+        return { valid: false, reason: 'malformed' };
+    }
+    const data = body.slice(0, dotIndex);
+    const signature = body.slice(dotIndex + 1);
+    if (!safeEqual(signature, sign(data, options.serviceToken))) {
+        return { valid: false, reason: 'signature' };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(data, 'base64url').toString('utf8'));
+    }
+    catch {
+        return { valid: false, reason: 'malformed' };
+    }
+    if (!isValidPayload(payload)) {
+        return { valid: false, reason: 'malformed' };
+    }
+    const nowSeconds = Math.floor((options.now?.() ?? Date.now()) / 1000);
+    if (payload.exp <= nowSeconds) {
+        return { valid: false, reason: 'expired' };
+    }
+    if (options.requiredScope && !payload.scopes.includes(options.requiredScope)) {
+        return { valid: false, reason: 'scope' };
+    }
+    return { valid: true, payload };
+}
+function sign(data, serviceToken) {
+    return (0, node_crypto_1.createHmac)('sha256', serviceToken).update(data).digest('base64url');
+}
+function safeEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && (0, node_crypto_1.timingSafeEqual)(leftBuffer, rightBuffer);
+}
+function dedupeScopes(scopes) {
+    return [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))];
+}
+function isValidPayload(payload) {
+    return Boolean(payload
+        && payload.typ === 'xpod-service-access'
+        && Array.isArray(payload.scopes)
+        && payload.scopes.every((scope) => typeof scope === 'string' && scope.length > 0)
+        && typeof payload.exp === 'number'
+        && Number.isFinite(payload.exp));
+}
+//# sourceMappingURL=ServiceAccessTokenCodec.js.map

package/dist/provision/ServiceAccessTokenCodec.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ServiceAccessTokenCodec.js","sourceRoot":"","sources":["../../src/provision/ServiceAccessTokenCodec.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAuCH,4DAoBC;AAED,4DAyCC;AApGD,6CAA0D;AAmC1D,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,SAAgB,wBAAwB,CAAC,OAAwC;IAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,CAC/B,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC;QAC1C,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU;QACjC,CAAC,CAAC,SAAS,CACd,CAAC;IAEF,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAA8B;QACzC,GAAG,EAAE,qBAAqB;QAC1B,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,GAAG;KACJ,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,YAAY,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAgC,EAChC,OAAwC;IAExC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8B,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,YAAoB;IAC9C,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB;IACpC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,cAAc,CAAC,OAAkC;IACxD,OAAO,OAAO,CACZ,OAAO;WACJ,OAAO,CAAC,GAAG,KAAK,qBAAqB;WACrC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;WAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;WAC9E,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;WAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAChC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * ServiceAccessTokenCodec\n *\n * Long-lived serviceToken is a local/root setup credential. Cloud should not\n * embed it into provisionCode. Instead Cloud signs a short-lived access token\n * with serviceToken, and Local verifies it statelessly before accepting\n * provision callbacks.\n *\n * 格式: \"sat-\" + base64url(JSON payload) + \".\" + base64url(HMAC-SHA256 signature)\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\nexport interface ServiceAccessTokenPayload {\n typ: 'xpod-service-access';\n sub?: string;\n scopes: string[];\n exp: number;\n}\n\nexport interface CreateServiceAccessTokenOptions {\n /** Long-lived local serviceToken used only as signing secret. */\n serviceToken: string;\n /** Node/app/service subject, normally nodeId. */\n subject?: string;\n scopes: string[];\n /** Relative lifetime in seconds. Ignored when expiresAt is set. */\n ttlSeconds?: number;\n /** Absolute expiration as Unix timestamp seconds. */\n expiresAt?: number;\n /** Test hook. Returns milliseconds. */\n now?: () => number;\n}\n\nexport interface VerifyServiceAccessTokenOptions {\n /** Long-lived local serviceToken used only as verification secret. */\n serviceToken: string;\n requiredScope?: string;\n /** Test hook. Returns milliseconds. */\n now?: () => number;\n}\n\nexport type VerifyServiceAccessTokenResult =\n | { valid: true; payload: ServiceAccessTokenPayload }\n | { valid: false; reason: 'malformed' | 'signature' | 'expired' | 'scope' };\n\nconst TOKEN_PREFIX = 'sat-';\n\nexport function createServiceAccessToken(options: CreateServiceAccessTokenOptions): string {\n const nowSeconds = Math.floor((options.now?.() ?? Date.now()) / 1000);\n const exp = options.expiresAt ?? (\n options.ttlSeconds && options.ttlSeconds > 0\n ? nowSeconds + options.ttlSeconds\n : undefined\n );\n\n if (!exp || !Number.isFinite(exp)) {\n throw new Error('service access token expiration is required');\n }\n\n const payload: ServiceAccessTokenPayload = {\n typ: 'xpod-service-access',\n sub: options.subject,\n scopes: dedupeScopes(options.scopes),\n exp,\n };\n const data = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');\n return `${TOKEN_PREFIX}${data}.${sign(data, options.serviceToken)}`;\n}\n\nexport function verifyServiceAccessToken(\n token: string | undefined | null,\n options: VerifyServiceAccessTokenOptions,\n): VerifyServiceAccessTokenResult {\n if (typeof token !== 'string' || !token.startsWith(TOKEN_PREFIX)) {\n return { valid: false, reason: 'malformed' };\n }\n\n const body = token.slice(TOKEN_PREFIX.length);\n const dotIndex = body.indexOf('.');\n if (dotIndex <= 0) {\n return { valid: false, reason: 'malformed' };\n }\n\n const data = body.slice(0, dotIndex);\n const signature = body.slice(dotIndex + 1);\n if (!safeEqual(signature, sign(data, options.serviceToken))) {\n return { valid: false, reason: 'signature' };\n }\n\n let payload: ServiceAccessTokenPayload;\n try {\n payload = JSON.parse(Buffer.from(data, 'base64url').toString('utf8')) as ServiceAccessTokenPayload;\n } catch {\n return { valid: false, reason: 'malformed' };\n }\n\n if (!isValidPayload(payload)) {\n return { valid: false, reason: 'malformed' };\n }\n\n const nowSeconds = Math.floor((options.now?.() ?? Date.now()) / 1000);\n if (payload.exp <= nowSeconds) {\n return { valid: false, reason: 'expired' };\n }\n\n if (options.requiredScope && !payload.scopes.includes(options.requiredScope)) {\n return { valid: false, reason: 'scope' };\n }\n\n return { valid: true, payload };\n}\n\nfunction sign(data: string, serviceToken: string): string {\n return createHmac('sha256', serviceToken).update(data).digest('base64url');\n}\n\nfunction safeEqual(left: string, right: string): boolean {\n const leftBuffer = Buffer.from(left);\n const rightBuffer = Buffer.from(right);\n return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);\n}\n\nfunction dedupeScopes(scopes: string[]): string[] {\n return [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))];\n}\n\nfunction isValidPayload(payload: ServiceAccessTokenPayload): boolean {\n return Boolean(\n payload\n && payload.typ === 'xpod-service-access'\n && Array.isArray(payload.scopes)\n && payload.scopes.every((scope) => typeof scope === 'string' && scope.length > 0)\n && typeof payload.exp === 'number'\n && Number.isFinite(payload.exp),\n );\n}\n"]}

package/dist/runtime/GatewayAdminProxyAuth.d.ts ADDED Viewed

@@ -0,0 +1,29 @@
+import type { IncomingHttpHeaders, OutgoingHttpHeaders } from 'node:http';
+export declare const GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = "x-xpod-admin-proxy-loopback";
+export declare const GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = "x-xpod-admin-proxy-timestamp";
+export declare const GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = "x-xpod-admin-proxy-signature";
+export declare const GATEWAY_ADMIN_PROXY_HEADERS: readonly ["x-xpod-admin-proxy-loopback", "x-xpod-admin-proxy-timestamp", "x-xpod-admin-proxy-signature"];
+export declare function createGatewayAdminProxyAuthSecret(): string;
+export interface GatewayAdminProxyMarkerInput {
+    secret: string;
+    method: string | undefined;
+    url: string | undefined;
+    originalClientLoopback: boolean;
+    issuedAt?: number;
+}
+export interface GatewayAdminProxyMarkerVerification {
+    present: boolean;
+    valid: boolean;
+    originalClientLoopback: boolean;
+    reason?: string;
+}
+export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): OutgoingHttpHeaders;
+export declare function stripGatewayAdminProxyHeaders(headers: IncomingHttpHeaders): void;
+export declare function isLoopbackRemoteAddress(remoteAddress: string | undefined): boolean;
+export declare function verifyGatewayAdminProxyHeaders(input: {
+    headers: IncomingHttpHeaders;
+    secret?: string;
+    method: string | undefined;
+    url: string | undefined;
+    now?: number;
+}): GatewayAdminProxyMarkerVerification;

package/dist/runtime/GatewayAdminProxyAuth.js ADDED Viewed

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GATEWAY_ADMIN_PROXY_HEADERS = exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = void 0;
+exports.createGatewayAdminProxyAuthSecret = createGatewayAdminProxyAuthSecret;
+exports.createGatewayAdminProxyHeaders = createGatewayAdminProxyHeaders;
+exports.stripGatewayAdminProxyHeaders = stripGatewayAdminProxyHeaders;
+exports.isLoopbackRemoteAddress = isLoopbackRemoteAddress;
+exports.verifyGatewayAdminProxyHeaders = verifyGatewayAdminProxyHeaders;
+const node_crypto_1 = require("node:crypto");
+const node_net_1 = require("node:net");
+exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = 'x-xpod-admin-proxy-loopback';
+exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = 'x-xpod-admin-proxy-timestamp';
+exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = 'x-xpod-admin-proxy-signature';
+exports.GATEWAY_ADMIN_PROXY_HEADERS = [
+    exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER,
+    exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER,
+    exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER,
+];
+const MAX_CLOCK_SKEW_MS = 60_000;
+function createGatewayAdminProxyAuthSecret() {
+    return (0, node_crypto_1.randomBytes)(32).toString('base64url');
+}
+function createGatewayAdminProxyHeaders(input) {
+    const issuedAt = input.issuedAt ?? Date.now();
+    const loopback = input.originalClientLoopback ? '1' : '0';
+    return {
+        [exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER]: loopback,
+        [exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]: String(issuedAt),
+        [exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]: signGatewayAdminProxyMarker({
+            secret: input.secret,
+            method: input.method,
+            url: input.url,
+            loopback,
+            issuedAt,
+        }),
+    };
+}
+function stripGatewayAdminProxyHeaders(headers) {
+    for (const header of exports.GATEWAY_ADMIN_PROXY_HEADERS) {
+        delete headers[header];
+    }
+}
+function isLoopbackRemoteAddress(remoteAddress) {
+    if (!remoteAddress)
+        return false;
+    const normalized = remoteAddress.startsWith('::ffff:')
+        ? remoteAddress.slice('::ffff:'.length)
+        : remoteAddress;
+    if ((0, node_net_1.isIP)(normalized) === 4) {
+        return normalized.startsWith('127.');
+    }
+    return normalized === '::1';
+}
+function verifyGatewayAdminProxyHeaders(input) {
+    const loopback = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER]);
+    const timestamp = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]);
+    const signature = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]);
+    const present = loopback !== undefined || timestamp !== undefined || signature !== undefined;
+    if (!present) {
+        return { present: false, valid: false, originalClientLoopback: false };
+    }
+    if (!input.secret) {
+        return { present: true, valid: false, originalClientLoopback: false, reason: 'missing_secret' };
+    }
+    if (loopback !== '0' && loopback !== '1') {
+        return { present: true, valid: false, originalClientLoopback: false, reason: 'invalid_loopback' };
+    }
+    if (!timestamp || !signature) {
+        return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'incomplete_marker' };
+    }
+    const issuedAt = Number.parseInt(timestamp, 10);
+    if (!Number.isFinite(issuedAt)) {
+        return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'invalid_timestamp' };
+    }
+    if (Math.abs((input.now ?? Date.now()) - issuedAt) > MAX_CLOCK_SKEW_MS) {
+        return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'expired_marker' };
+    }
+    const expected = signGatewayAdminProxyMarker({
+        secret: input.secret,
+        method: input.method,
+        url: input.url,
+        loopback,
+        issuedAt,
+    });
+    if (!safeEqual(signature, expected)) {
+        return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'bad_signature' };
+    }
+    return { present: true, valid: true, originalClientLoopback: loopback === '1' };
+}
+function signGatewayAdminProxyMarker(input) {
+    const payload = [
+        'v1',
+        (input.method ?? 'GET').toUpperCase(),
+        input.url ?? '/',
+        input.loopback,
+        String(input.issuedAt),
+    ].join('\n');
+    return (0, node_crypto_1.createHmac)('sha256', input.secret).update(payload).digest('base64url');
+}
+function safeEqual(actual, expected) {
+    const actualBuffer = Buffer.from(actual);
+    const expectedBuffer = Buffer.from(expected);
+    return actualBuffer.length === expectedBuffer.length && (0, node_crypto_1.timingSafeEqual)(actualBuffer, expectedBuffer);
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+//# sourceMappingURL=GatewayAdminProxyAuth.js.map