@undefineds.co/xpod 0.4.20 → 0.4.27

package/dist/api/handlers/NetworkSettingsHandler.js

@@ -12,6 +12,8 @@ exports.createCertificateCapability = createCertificateCapability;
 exports.redactSecretText = redactSecretText;
 const node_os_1 = require("node:os");
 const global_logger_factory_1 = require("global-logger-factory");
+const EndpointReachabilityProbe_1 = require("../network/EndpointReachabilityProbe");
+const TunnelClientManager_1 = require("../../tunnel/TunnelClientManager");
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
 const AdminHandler_1 = require("./AdminHandler");
 const TunnelProviderCatalog_1 = require("../../tunnel/TunnelProviderCatalog");
@@ -66,6 +68,46 @@ function registerNetworkSettingsRoutes(server, options) {
             sendJson(response, 500, { error: 'Failed to run network diagnostics' });
         }
     }, { optionalAuth: true });
+    // The tunnel-client plugin actions live next to the tunnel configuration they serve: one
+    // "check" that says where each client comes from, one "download" that installs it (N16).
+    server.get('/api/network/settings/tunnel-clients', async (request, response) => {
+        if (!await requireNetworkPermission(request, response, authorizer, 'read', options.internalAdminAuthSecret)) {
+            return;
+        }
+        try {
+            const manager = options.tunnelClients ?? new TunnelClientManager_1.TunnelClientManager();
+            sendJson(response, 200, { clients: await manager.inspectAll() });
+        }
+        catch (error) {
+            logger.error(`Failed to inspect tunnel clients: ${redactSecretText(error)}`);
+            sendJson(response, 500, { error: 'Failed to inspect tunnel clients' });
+        }
+    }, { optionalAuth: true });
+    server.post('/api/network/settings/tunnel-clients/:provider/install', async (request, response, params) => {
+        const provider = String(params?.provider ?? '');
+        const known = ['ngrok', 'cloudflare', 'sakura_frp', 'frp'].includes(provider);
+        if (!known) {
+            sendJson(response, 404, { error: `Unknown tunnel provider: ${provider}` });
+            return;
+        }
+        if (!await requireNetworkPermission(request, response, authorizer, 'write', options.internalAdminAuthSecret)) {
+            return;
+        }
+        try {
+            const manager = options.tunnelClients ?? new TunnelClientManager_1.TunnelClientManager();
+            const installed = await manager.install(provider);
+            sendJson(response, 200, {
+                installed,
+                clients: await manager.inspectAll(),
+            });
+        }
+        catch (error) {
+            // A refused download is a normal answer (no pinned asset), not a server fault.
+            const message = redactSecretText(error);
+            logger.warn(`Tunnel client install refused for ${provider}: ${message}`);
+            sendJson(response, 400, { error: message });
+        }
+    }, { optionalAuth: true });
     if (options.certificateRenewer) {
         server.post('/api/network/settings/certificate/renew', async (request, response) => {
             if (!await requireNetworkPermission(request, response, authorizer, 'write', options.internalAdminAuthSecret)) {
@@ -344,6 +386,28 @@ function buildDefaultDiagnostics(options, logger) {
                     : { status: 'unsupported', detail: 'endpoint_unavailable' };
             },
         },
+        {
+            // Only runs because the operator asked for a diagnose pass; it never polls. The verdict
+            // is deliberately "from this node": a node reaching its own public entry says nothing
+            // about a remote user's path (NAT hairpin), so the wording keeps that distinction.
+            id: 'endpoint-reachability',
+            label: 'Endpoint reachability from this node',
+            run: async () => {
+                const endpoint = normalizeEndpoint(resolveValue(options.endpoint));
+                if (!endpoint) {
+                    return { status: 'unsupported', detail: 'endpoint_unavailable' };
+                }
+                const probe = options.endpointReachabilityProbe ?? EndpointReachabilityProbe_1.probeEndpointReachability;
+                const result = await probe(endpoint);
+                if (result.verdict === 'reachable-from-this-node') {
+                    return { status: 'ok', detail: result.detail };
+                }
+                if (result.verdict === 'blocked') {
+                    return { status: 'unsupported', detail: result.detail };
+                }
+                return { status: 'warning', detail: result.detail };
+            },
+        },
         {
             id: 'tls',
             label: 'TLS',
@@ -363,7 +427,7 @@ function buildDefaultDiagnostics(options, logger) {
 }
 async function runDiagnostic(check, logger) {
     const startedAt = Date.now();
-    const evidence = () => ({ durationMs: Math.max(0, Date.now() - startedAt), checkedAt: new Date().toISOString() });
+    const evidence = () => ({ checkDurationMs: Math.max(0, Date.now() - startedAt), checkedAt: new Date().toISOString() });
     try {
         const result = await check.run();
         if (typeof result === 'string') {
@@ -382,14 +446,23 @@ async function runDiagnostic(check, logger) {
         return { id: check.id, label: check.label, status: 'error', detail: redactSecretText(error), ...evidence() };
     }
 }
+/**
+ * Maps a provider capability onto a diagnostic level.
+ *
+ * Only statuses that positively mean "verified" become `ok`, and known-bad ones become `error`
+ * (an invalid or expired certificate is a failure, not something to warn about). Anything else
+ * stays a warning: a status we cannot place must never be rendered as a pass (audit N12).
+ */
+const VERIFIED_CAPABILITY_STATUSES = new Set(['active', 'valid', 'synced', 'direct', 'ready']);
+const FAILED_CAPABILITY_STATUSES = new Set(['error', 'invalid', 'failed', 'expired', 'untrusted', 'mismatch']);
 function capabilityToDiagnostic(capability) {
     if (!capability.supported) {
         return { status: 'unsupported', detail: capability.status };
     }
-    if (capability.status === 'active' || capability.status === 'valid' || capability.status === 'synced' || capability.status === 'direct') {
+    if (VERIFIED_CAPABILITY_STATUSES.has(capability.status)) {
         return { status: 'ok', detail: capability.status };
     }
-    if (capability.status === 'error') {
+    if (FAILED_CAPABILITY_STATUSES.has(capability.status)) {
         return { status: 'error', detail: capability.status };
     }
     return { status: 'warning', detail: capability.status };

package/dist/api/handlers/PodAccessFailureResponse.d.ts

@@ -1,4 +1,5 @@
 import type { ServerResponse } from 'node:http';
+import type { RouteHandler } from '../ApiServer';
 /** The wire code callers already report when Xpod cannot open the Pod for them. */
 export declare const SERVICE_ACCESS_MISSING = "service_access_missing";
 export interface PodAccessFailureResponse {
@@ -20,4 +21,4 @@ export declare function sendPodAccessFailure(response: ServerResponse, error: un
  *
  * Anything else keeps propagating, so unrelated bugs are not reported as missing Pod access.
  */
-export declare function guardPodAccessRoute<T extends (...args: any[]) => Promise<unknown>>(handler: T): T;
+export declare function guardPodAccessRoute(handler: RouteHandler): RouteHandler;

package/dist/api/handlers/PodAccessFailureResponse.js

@@ -45,16 +45,15 @@ function sendPodAccessFailure(response, error) {
  * Anything else keeps propagating, so unrelated bugs are not reported as missing Pod access.
  */
 function guardPodAccessRoute(handler) {
-    return (async (...args) => {
+    return async (request, response, params) => {
         try {
-            await handler(...args);
+            await handler(request, response, params);
         }
         catch (error) {
-            const response = args[1];
-            if (!response || !sendPodAccessFailure(response, error)) {
+            if (!sendPodAccessFailure(response, error)) {
                 throw error;
             }
         }
-    });
+    };
 }
 //# sourceMappingURL=PodAccessFailureResponse.js.map

package/dist/api/handlers/PodDeletionGrantHandler.d.ts

@@ -0,0 +1,9 @@
+import type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';
+import type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';
+import type { ApiServer } from '../ApiServer';
+import type { NodeTokenAuthenticator } from '../auth/NodeTokenAuthenticator';
+import type { PodDeletionOperationRepository } from '../../identity/drizzle/PodDeletionOperationRepository';
+export declare function registerPodDeletionGrantRoutes(server: ApiServer, operations: PodDeletionOperationRepository, authenticator: NodeTokenAuthenticator, authorization?: {
+    pods: PodLookupRepository;
+    nodes: EdgeNodeRepository;
+}): void;

package/dist/api/handlers/PodDeletionGrantHandler.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPodDeletionGrantRoutes = registerPodDeletionGrantRoutes;
+function registerPodDeletionGrantRoutes(server, operations, authenticator, authorization) {
+    for (const action of ['claim', 'complete']) {
+        server.post(`/api/pod-deletions/:operationId/${action}`, async (request, response, params) => {
+            const send = (status, body) => {
+                response.statusCode = status;
+                response.setHeader('content-type', 'application/json');
+                response.end(JSON.stringify(body));
+            };
+            if (!authenticator.canAuthenticate(request)) {
+                send(401, { error: 'POD_DELETE_NODE_AUTH_REQUIRED' });
+                return;
+            }
+            const auth = await authenticator.authenticate(request);
+            if (!auth.success || auth.context?.type !== 'node' || !auth.context.nodeId) {
+                send(401, { error: 'POD_DELETE_NODE_AUTH_REQUIRED' });
+                return;
+            }
+            let body;
+            try {
+                let data = '';
+                for await (const chunk of request) {
+                    data += chunk.toString();
+                    if (data.length > 4096) {
+                        throw new Error('Request too large');
+                    }
+                }
+                body = JSON.parse(data);
+            }
+            catch {
+                send(400, { error: 'POD_DELETE_INVALID_COMMAND' });
+                return;
+            }
+            if (typeof body.grant !== 'string' || typeof body.storageUrl !== 'string') {
+                send(400, { error: 'POD_DELETE_INVALID_COMMAND' });
+                return;
+            }
+            const original = await operations.get(params.operationId);
+            if (!original || original.storageUrl !== body.storageUrl || original.nodeId !== auth.context.nodeId) {
+                send(403, { error: 'POD_DELETE_INVALID_GRANT' });
+                return;
+            }
+            if (action === 'claim') {
+                const operation = await operations.claim(params.operationId, auth.context.nodeId, body.grant);
+                if (!operation) {
+                    send(403, { error: 'POD_DELETE_INVALID_GRANT' });
+                    return;
+                }
+                send(200, { operation });
+            }
+            else {
+                const accepted = await operations.acknowledge(params.operationId, auth.context.nodeId, body.grant, body.storageUrl);
+                send(accepted ? 200 : 403, accepted ? { success: true } : { error: 'POD_DELETE_INVALID_GRANT' });
+            }
+        }, { public: true });
+    }
+    if (authorization) {
+        for (const action of ['authorize-details', 'authorize']) {
+            const register = action === 'authorize-details' ? server.get.bind(server) : server.post.bind(server);
+            register(`/api/pod-deletions/:operationId/${action}`, async (request, response, params) => {
+                const send = (status, body) => {
+                    response.statusCode = status;
+                    response.setHeader('content-type', 'application/json');
+                    response.end(JSON.stringify(body));
+                };
+                if (!authenticator.canAuthenticate(request)) {
+                    send(401, { error: 'POD_DELETE_NODE_AUTH_REQUIRED' });
+                    return;
+                }
+                const auth = await authenticator.authenticate(request);
+                const nodeId = auth.success && auth.context?.type === 'node' ? auth.context.nodeId : undefined;
+                if (!nodeId) {
+                    send(401, { error: 'POD_DELETE_NODE_AUTH_REQUIRED' });
+                    return;
+                }
+                const challenge = request.headers['x-xpod-pod-authorization'];
+                if (typeof challenge !== 'string' || challenge.split('.')[0] !== params.operationId) {
+                    send(403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+                    return;
+                }
+                const details = await operations.authorizationDetails(challenge, nodeId);
+                if (!details) {
+                    send(403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+                    return;
+                }
+                const pod = await authorization.pods.findById(details.podId);
+                const node = await authorization.nodes.findSpNodeByStorageUrl(details.storageUrl);
+                if (!pod || pod.accountId !== details.accountId || pod.baseUrl !== details.storageUrl || node?.nodeId !== nodeId) {
+                    send(403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+                    return;
+                }
+                if (await operations.find(details.accountId, details.podId) || await operations.remoteGeneration(details.podId, nodeId, details.storageUrl)) {
+                    send(409, { error: 'POD_DELETE_AUTHORIZATION_CONFLICT' });
+                    return;
+                }
+                if (action === 'authorize-details') {
+                    send(200, { authorization: details });
+                    return;
+                }
+                let body;
+                try {
+                    let data = '';
+                    for await (const chunk of request) {
+                        data += chunk.toString();
+                        if (data.length > 8192) {
+                            throw new Error('Body too large');
+                        }
+                    }
+                    body = JSON.parse(data);
+                }
+                catch {
+                    send(400, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+                    return;
+                }
+                const owners = [pod.webId, ...(pod.webIds ?? [])].filter(Boolean);
+                if (body.storageUrl !== details.storageUrl || typeof body.remotePodId !== 'string' || !body.remotePodId ||
+                    !Array.isArray(body.ownerWebIds) || !body.ownerWebIds.some((owner) => typeof owner === 'string' && owners.includes(owner))) {
+                    send(403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+                    return;
+                }
+                const accepted = await operations.authorizeGeneration(challenge, nodeId, body.remotePodId);
+                send(accepted ? 200 : 409, accepted ? { success: true, returnUrl: details.returnUrl } : { error: 'POD_DELETE_AUTHORIZATION_CONFLICT' });
+            }, { public: true });
+        }
+    }
+}
+//# sourceMappingURL=PodDeletionGrantHandler.js.map

package/dist/api/handlers/PodManagementHandler.d.ts

@@ -3,6 +3,7 @@ import type { PodLookupRepository } from '../../identity/drizzle/PodLookupReposi
 export interface PodManagementHandlerOptions {
     /** Pod 存储根目录 */
     rootDir: string;
+    internalAdminAuthSecret?: string;
     /** 验证 IdP service token */
     verifyServiceToken: (token: string) => Promise<boolean>;
     /** 可选：限制允许的 pod 名称正则 */
@@ -12,6 +13,7 @@ export interface PodManagementHandlerOptions {
         createPod(input: CreatePodRequest): Promise<{
             podUrl: string;
             webId?: string;
+            podId?: string;
         }>;
     };
     /** SP-local Pod lookup used by Cloud consent to scope account WebIDs. */

package/dist/api/handlers/PodManagementHandler.js

@@ -25,6 +25,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerPodManagementRoutes = registerPodManagementRoutes;
 const global_logger_factory_1 = require("global-logger-factory");
+const AdminHandler_1 = require("./AdminHandler");
+const LocalProvisionState_1 = require("../../provision/LocalProvisionState");
 const ProvisionReceiptCodec_1 = require("../../provision/ProvisionReceiptCodec");
 /**
  * Pod Management Handler
@@ -45,6 +47,88 @@ function registerPodManagementRoutes(server, options) {
     const logger = (0, global_logger_factory_1.getLoggerFor)('PodManagementHandler');
     const { rootDir, verifyServiceToken, podNameRegex = /^[a-zA-Z0-9_-]+$/, provisioningService, podLookupRepository, receiptSigningSecret, } = options;
     const storageProviderRoot = normalizeStorageRoot(options.storageProviderBaseUrl);
+    const setupPath = (0, LocalProvisionState_1.resolveLocalSetupPath)(process.env.XPOD_LOCAL_SETUP_PATH, rootDir);
+    const providerId = (0, LocalProvisionState_1.resolveLocalSetupProviderId)(process.env.XPOD_PROVIDER_ID);
+    async function deletionAuthorization(request, response, body) {
+        if (!(0, AdminHandler_1.isAdminMutationAllowed)(request, { internalAdminAuthSecret: options.internalAdminAuthSecret, allowLoopback: !request.headers.authorization && !request.headers['x-xpod-admin-token'] })) {
+            sendJson(response, 403, { error: 'POD_DELETE_OPERATOR_REQUIRED' });
+            return;
+        }
+        const origin = request.headers.origin;
+        let sameOrigin = false;
+        try {
+            const parsed = new URL(typeof origin === 'string' ? origin : '');
+            const canonical = storageProviderRoot && new URL(storageProviderRoot).origin;
+            const localAlias = parsed.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname) && parsed.host === request.headers.host;
+            sameOrigin = ['http:', 'https:'].includes(parsed.protocol) && parsed.origin === origin && parsed.host === request.headers.host && (parsed.origin === canonical || localAlias);
+        }
+        catch { /* An absent/opaque Origin never grants browser operator authority. */ }
+        if (!sameOrigin) {
+            sendJson(response, 403, { error: 'POD_DELETE_ORIGIN_REQUIRED' });
+            return;
+        }
+        const { challenge, podName, expectedLocalPodId } = body;
+        if (typeof challenge !== 'string' || !/^[a-f0-9-]{36}\.[a-zA-Z0-9_-]{43}$/u.test(challenge) || typeof podName !== 'string' || !validatePodName(podName) || !storageProviderRoot) {
+            sendJson(response, 403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+            return;
+        }
+        const state = (0, LocalProvisionState_1.readLocalProvisionState)(setupPath, providerId);
+        if (!state?.nodeId || !state.nodeToken || !state.cloudApiUrl) {
+            sendJson(response, 403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+            return;
+        }
+        const storageUrl = new URL(`${podName}/`, storageProviderRoot).href;
+        const callback = async (action, payload) => {
+            const callbackRoot = new URL(state.cloudApiUrl);
+            if (!['http:', 'https:'].includes(callbackRoot.protocol) || callbackRoot.username || callbackRoot.password || callbackRoot.search || callbackRoot.hash) {
+                throw new Error('Invalid registered callback');
+            }
+            const result = await fetch(new URL(`api/pod-deletions/${challenge.split('.')[0]}/${action}`, callbackRoot.href.replace(/\/?$/u, '/')), {
+                method: payload ? 'POST' : 'GET', redirect: 'error', signal: AbortSignal.timeout(15_000),
+                headers: { authorization: `XpodNode ${state.nodeId}:${state.nodeToken}`, 'x-xpod-pod-authorization': challenge, ...(payload ? { 'content-type': 'application/json' } : {}) },
+                ...(payload ? { body: JSON.stringify(payload) } : {}),
+            });
+            return { status: result.status, body: await result.json() };
+        };
+        try {
+            const result = await callback('authorize-details');
+            if (result.status !== 200) {
+                sendAuthorizationFailure(response, result.status);
+                return;
+            }
+            const details = result.body.authorization;
+            if (!details || details.storageUrl !== storageUrl || details.nodeId !== state.nodeId || details.challengeId !== challenge.split('.')[0]) {
+                sendJson(response, 403, { error: 'POD_DELETE_AUTHORIZATION_INVALID' });
+                return;
+            }
+            const pod = await podLookupRepository?.findByResourceIdentifier?.(storageUrl);
+            if (!pod || pod.baseUrl !== storageUrl || !pod.podId) {
+                sendJson(response, 404, { error: 'POD_DELETE_NOT_FOUND' });
+                return;
+            }
+            const ownerWebIds = [...new Set([pod.webId, ...(pod.webIds ?? [])].filter((value) => Boolean(value)))];
+            if (body.action === 'inspectDeletionAuthorization') {
+                sendJson(response, 200, { deletionAuthorization: { challenge, podName, expiresAt: details.expiresAt,
+                        cloudAccountId: details.accountId, cloudPodId: details.podId, nodeId: details.nodeId, storageUrl,
+                        currentLocalPodId: pod.podId, ownerWebIds, returnUrl: details.returnUrl } });
+                return;
+            }
+            if (expectedLocalPodId !== pod.podId) {
+                sendJson(response, 409, { error: 'POD_DELETE_GENERATION_CHANGED' });
+                return;
+            }
+            const accepted = await callback('authorize', { storageUrl, remotePodId: pod.podId, ownerWebIds });
+            if (accepted.status !== 200) {
+                sendAuthorizationFailure(response, accepted.status);
+                return;
+            }
+            sendJson(response, 200, { success: true, returnUrl: details.returnUrl });
+        }
+        catch (error) {
+            logger.warn('Pod deletion authorization callback failed');
+            sendJson(response, 502, { error: 'POD_DELETE_NODE_UNAVAILABLE' });
+        }
+    }
     /**
      * 验证 service token
      */
@@ -82,18 +166,34 @@ function registerPodManagementRoutes(server, options) {
      *   409: { error: "Pod already exists" }
      */
     server.post('/provision/pods', async (request, response) => {
-        // 1. 认证
-        if (!await authenticate(request)) {
-            sendJson(response, 401, { error: 'Unauthorized', message: 'Invalid or missing service token' });
+        const serviceAuthorized = Boolean(await authenticate(request));
+        if (!serviceAuthorized && !(0, AdminHandler_1.isAdminMutationAllowed)(request, { internalAdminAuthSecret: options.internalAdminAuthSecret, allowLoopback: !request.headers.authorization && !request.headers['x-xpod-admin-token'] })) {
+            sendJson(response, 401, { error: 'Unauthorized' });
             return;
         }
-        // 2. 解析请求体
         let body;
         try {
             body = await readJsonBody(request);
         }
         catch (error) {
-            sendJson(response, 400, { error: 'Bad Request', message: 'Invalid JSON body' });
+            if (error instanceof Error && error.message === 'Request body too large') {
+                sendJson(response, 413, { error: 'Request body too large' });
+                return;
+            }
+            sendJson(response, serviceAuthorized ? 400 : 401, { error: 'Invalid request' });
+            return;
+        }
+        if (!body || typeof body !== 'object' || Array.isArray(body)) {
+            sendJson(response, 400, { error: 'Invalid request' });
+            return;
+        }
+        const action = body.action;
+        if (action === 'inspectDeletionAuthorization' || action === 'authorizeDeletion') {
+            await deletionAuthorization(request, response, body);
+            return;
+        }
+        if (!serviceAuthorized) {
+            sendJson(response, 401, { error: 'Unauthorized', message: 'Invalid or missing service token' });
             return;
         }
         const { podName, initialResources } = body;
@@ -117,6 +217,7 @@ function registerPodManagementRoutes(server, options) {
                         success: true,
                         podUrl: existing.storageUrl,
                         webId: existing.webId,
+                        // A network access token may retry provisioning but cannot acquire deletion authority over an existing Pod.
                         provisionReceipt: createReceipt({ secret: receiptSigningSecret, podName, podUrl: existing.storageUrl, webId: existing.webId }),
                         message: `Pod ${podName} already exists for this WebID`,
                     });
@@ -148,7 +249,7 @@ function registerPodManagementRoutes(server, options) {
                 podUrl,
                 ...(webId ? {
                     webId,
-                    provisionReceipt: createReceipt({ secret: receiptSigningSecret, podName, podUrl, webId }),
+                    provisionReceipt: createReceipt({ secret: receiptSigningSecret, podName, podUrl, webId, podId: result?.podId }),
                 } : {}),
                 message: `Pod ${podName} created successfully`
             });
@@ -236,7 +337,8 @@ function registerPodManagementRoutes(server, options) {
         }
     }, { public: true });
     async function findExistingProvisionedPod(body, podName) {
-        if (!podLookupRepository || !storageProviderRoot) {
+        if (!podLookupRepository || !storageProviderRoot || typeof body.webId !== 'string' ||
+            !body.webId || body.webId !== body.webId.trim() || /[\r\n\t]/u.test(body.webId)) {
             return undefined;
         }
         try {
@@ -250,70 +352,20 @@ function registerPodManagementRoutes(server, options) {
                         storageUrlBelongsToRoot(storageUrl, storageProviderRoot) &&
                         Boolean(resolveMatchedWebId(pod.webId, pod.webIds, [requestedWebId]));
                 });
-                return match ? { storageUrl: expectedPodUrl, webId: requestedWebId } : undefined;
+                return match ? { storageUrl: expectedPodUrl, webId: requestedWebId, podId: match.podId } : undefined;
             }
-            const pod = await podLookupRepository.findByResourceIdentifier?.(expectedPodUrl);
-            const storageUrl = canonicalizeStorageProviderUrl(pod?.storageUrl ?? pod?.baseUrl, storageProviderRoot);
-            const webId = getFirstWebId(pod);
-            return storageUrl === expectedPodUrl && webId ? { storageUrl: expectedPodUrl, webId } : undefined;
+            return undefined;
         }
         catch (error) {
             logger.warn(`Failed to verify existing pod ownership for ${podName}: ${error.message}`);
             return undefined;
         }
     }
-    /**
-     * DELETE /provision/pods/:podName
-     *
-     * 删除 Pod 目录
-     *
-     * Request:
-     *   Authorization: Bearer {service_token}
-     *
-     * Response:
-     *   200: { success: true }
-     *   401: { error: "Unauthorized" }
-     *   404: { error: "Pod not found" }
-     */
-    server.delete('/provision/pods/:podName', async (request, response, params) => {
-        // 1. 认证
-        if (!await authenticate(request)) {
-            sendJson(response, 401, { error: 'Unauthorized', message: 'Invalid or missing service token' });
-            return;
-        }
-        const podName = decodeURIComponent(params.podName);
-        // 2. 验证 pod 名称
-        if (!validatePodName(podName)) {
-            sendJson(response, 400, { error: 'Bad Request', message: `Invalid pod name: ${podName}` });
-            return;
-        }
-        // 3. 检查是否存在
-        const podPath = `${rootDir}/${podName}`;
-        try {
-            const exists = await fileExists(podPath);
-            if (!exists) {
-                sendJson(response, 404, { error: 'Not Found', message: `Pod ${podName} not found` });
-                return;
-            }
-        }
-        catch (error) {
-            logger.error(`Error checking pod existence: ${error.message}`);
-            sendJson(response, 500, { error: 'Internal Server Error', message: 'Failed to check pod existence' });
-            return;
-        }
-        // 4. 删除 Pod 目录
-        try {
-            await deletePodDirectory(podPath);
-            logger.info(`Deleted pod: ${podName}`);
-            sendJson(response, 200, {
-                success: true,
-                message: `Pod ${podName} deleted successfully`
-            });
-        }
-        catch (error) {
-            logger.error(`Failed to delete pod: ${error.message}`);
-            sendJson(response, 500, { error: 'Internal Server Error', message: 'Failed to delete pod' });
-        }
+    // Pod deletion runs in CSS with its actual data accessor, indexes and AccountStorage.
+    // Direct API callers fail closed instead of removing only a filesystem directory.
+    server.delete('/provision/pods/:podName', async (_request, response) => {
+        response.setHeader('Allow', 'GET');
+        sendJson(response, 405, { error: 'POD_DELETE_USE_GATEWAY', message: 'Pod deletion must use the Gateway lifecycle endpoint' });
     }, { public: true });
     /**
      * GET /provision/pods/:podName
@@ -359,19 +411,40 @@ function createReceipt(input) {
         podName: input.podName,
         webId: input.webId,
         podUrl: input.podUrl,
+        podId: input.podId,
     });
 }
+function sendAuthorizationFailure(response, status) {
+    if (status >= 500) {
+        sendJson(response, 502, { error: 'POD_DELETE_NODE_UNAVAILABLE' });
+        return;
+    }
+    sendJson(response, status === 409 ? 409 : 403, { error: status === 409 ? 'POD_DELETE_AUTHORIZATION_CONFLICT' : 'POD_DELETE_AUTHORIZATION_INVALID' });
+}
 /**
  * 读取 JSON 请求体
  */
 async function readJsonBody(request) {
     return new Promise((resolve, reject) => {
         let data = '';
+        let tooLarge = false;
         request.setEncoding('utf8');
         request.on('data', (chunk) => {
+            if (tooLarge) {
+                return;
+            }
+            if (Buffer.byteLength(data) + Buffer.byteLength(chunk) > 1_048_576) {
+                tooLarge = true;
+                data = '';
+                reject(new Error('Request body too large'));
+                return;
+            }
             data += chunk;
         });
         request.on('end', () => {
+            if (tooLarge) {
+                return;
+            }
             if (!data) {
                 resolve({});
                 return;
@@ -512,11 +585,4 @@ async function createPodDirectory(podPath, initialResources) {
         }
     }
 }
-/**
- * 删除 Pod 目录
- */
-async function deletePodDirectory(podPath) {
-    const { rm } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
-    await rm(podPath, { recursive: true, force: true });
-}
 //# sourceMappingURL=PodManagementHandler.js.map

package/dist/api/handlers/ProvisionHandler.d.ts

@@ -58,6 +58,8 @@ export interface ProvisionStatusOptions {
     serviceToken?: string;
     /** 当前 SP canonical public URL */
     publicUrl?: string;
+    /** Internal provenance: a transport fallback is not an allocated/canonical node address. */
+    publicUrlIsFallback?: boolean;
     /** SP 子域名 */
     spDomain?: string;
     /** 本地端口，供 Cloud 管理 tunnel 元数据 */

package/dist/api/handlers/ProvisionHandler.js

@@ -21,6 +21,7 @@ exports.registerProvisionStatusRoute = registerProvisionStatusRoute;
 exports.createLocalSetupProvisionStateWriter = createLocalSetupProvisionStateWriter;
 const node_crypto_1 = require("node:crypto");
 const global_logger_factory_1 = require("global-logger-factory");
+const ServiceInfoHandler_1 = require("./ServiceInfoHandler");
 const TunnelProviderCatalog_1 = require("../../tunnel/TunnelProviderCatalog");
 const ProvisionCodeCodec_1 = require("../../provision/ProvisionCodeCodec");
 const ServiceAccessTokenCodec_1 = require("../../provision/ServiceAccessTokenCodec");
@@ -468,12 +469,19 @@ function registerProvisionStatusRoute(server, options) {
         nodeToken: options.nodeToken,
         serviceToken: options.serviceToken,
         publicUrl: normalizeUrl(options.publicUrl),
+        publicUrlIsFallback: options.publicUrlIsFallback ?? false,
         spDomain: options.spDomain,
         tunnelToken: undefined,
         tunnelProvider: undefined,
         tunnelEndpoint: undefined,
     };
     let refreshPromise;
+    (0, ServiceInfoHandler_1.registerServiceInfoRoute)(server, () => ({
+        edition: 'local',
+        managed: Boolean(options.cloudUrl),
+        publicUrl: state.publicUrlIsFallback ? undefined : state.publicUrl,
+        oidcIssuer: options.cloudBaseUrl ?? options.cloudUrl,
+    }));
     server.get('/provision/status', async (_request, response) => {
         const registered = Boolean(options.nodeId && options.nodeToken && options.cloudUrl);
         const body = {
@@ -687,7 +695,11 @@ async function refreshProvisionStatus(options) {
     state.nodeToken = payload.nodeToken;
     state.serviceToken = payload.serviceToken;
     state.provisionCode = payload.provisionCode;
-    state.publicUrl = normalizeUrl(payload.publicUrl) ?? state.publicUrl;
+    const assignedPublicUrl = normalizeUrl(payload.publicUrl);
+    if (assignedPublicUrl) {
+        state.publicUrl = assignedPublicUrl;
+        state.publicUrlIsFallback = false;
+    }
     state.spDomain = typeof payload.spDomain === 'string' ? payload.spDomain : state.spDomain;
     state.tunnelToken = typeof payload.tunnelToken === 'string' ? payload.tunnelToken : state.tunnelToken;
     state.tunnelProvider = typeof payload.tunnelProvider === 'string' ? payload.tunnelProvider : state.tunnelProvider;