@undefineds.co/xpod 0.4.9 → 0.4.11

package/dist/api/auth/ClientCredentialsAuthenticator.d.ts

@@ -42,5 +42,4 @@ export declare class ClientCredentialsAuthenticator implements Authenticator {
     canAuthenticate(request: IncomingMessage): boolean;
     authenticate(request: IncomingMessage): Promise<AuthResult>;
     private exchangeForToken;
-    private isJwt;
 }

package/dist/api/auth/ClientCredentialsAuthenticator.js

@@ -173,9 +173,6 @@ class ClientCredentialsAuthenticator {
             return { success: false, error: 'Token exchange failed' };
         }
     }
-    isJwt(token) {
-        return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
-    }
 }
 exports.ClientCredentialsAuthenticator = ClientCredentialsAuthenticator;
 function tokenEndpointRoutingHeaders(tokenEndpoint, publicBaseUrl) {

package/dist/api/auth/index.d.ts

@@ -3,4 +3,5 @@ export * from './AuthContext';
 export * from './SolidTokenAuthenticator';
 export * from './ClientCredentialsAuthenticator';
 export * from './ServiceTokenAuthenticator';
+export * from './NodeTokenAuthenticator';
 export * from './MultiAuthenticator';

package/dist/api/auth/index.js

@@ -19,6 +19,6 @@ __exportStar(require("./AuthContext"), exports);
 __exportStar(require("./SolidTokenAuthenticator"), exports);
 __exportStar(require("./ClientCredentialsAuthenticator"), exports);
 __exportStar(require("./ServiceTokenAuthenticator"), exports);
-// export * from './NodeTokenAuthenticator';  // TODO: Fix later
+__exportStar(require("./NodeTokenAuthenticator"), exports);
 __exportStar(require("./MultiAuthenticator"), exports);
 //# sourceMappingURL=index.js.map

package/dist/identity/drizzle/AccountRoleRepository.d.ts

@@ -4,16 +4,44 @@ export interface AccountRoleContext {
     webId?: string;
     roles: string[];
 }
+export interface AccountRoleRepositoryOptions {
+    /**
+     * CSS 文件存储时代的账户目录（`.internal/accounts/data`）。
+     * 仅在迁移期兜底读取；默认按进程 CWD 惰性解析，桌面/集群部署应显式注入。
+     */
+    legacyAccountDataDir?: string;
+}
 export declare class AccountRoleRepository {
     private readonly db;
     private readonly logger;
-    constructor(db: IdentityDatabase);
+    private readonly legacyAccountDataDir?;
+    constructor(db: IdentityDatabase, options?: AccountRoleRepositoryOptions);
     findByAccountId(accountId: string): Promise<AccountRoleContext | undefined>;
     findByWebId(webId: string): Promise<AccountRoleContext | undefined>;
     findByWebIdLoose(webId: string): Promise<AccountRoleContext | undefined>;
     listAccounts(): Promise<AccountRoleContext[]>;
     addRoles(accountId: string, roles: string[]): Promise<void>;
-    private getAccountById;
+    /**
+     * 按主键直查 identity_store 中的 account 行；表不存在时返回 undefined（由调用方走兜底）。
+     */
+    private getIdentityStoreAccount;
+    /**
+     * 按 CSS 行契约（webIdLink.accountId、pod.accountId、owner.podId）下推查询账户的 WebID。
+     */
+    private findWebIdsForAccount;
+    /**
+     * WebID → accountId 的下推解析：webIdLink 优先，其次 account 行内嵌 webId 字段，
+     * 最后 owner→pod 链路。全部 miss 返回 undefined（调用方再走全量兜底）。
+     */
+    private findAccountIdByWebId;
+    /**
+     * owner→pod 链路里把 owner 行的 podId 与 pod 行的 id 对齐。
+     */
+    private ownerPodJoin;
+    /**
+     * legacy 来源：internal_kv 与文件账户（迁移期兜底），不含 identity_store。
+     */
+    private loadLegacyAccounts;
     private loadAllAccounts;
     private loadIdentityStoreAccounts;
     private loadInternalKvAccounts;

package/dist/identity/drizzle/AccountRoleRepository.js

@@ -9,7 +9,6 @@ const node_path_1 = __importDefault(require("node:path"));
 const drizzle_orm_1 = require("drizzle-orm");
 const global_logger_factory_1 = require("global-logger-factory");
 const db_1 = require("./db");
-const ACCOUNT_DATA_DIR = node_path_1.default.resolve('.internal', 'accounts', 'data');
 const IDENTITY_STORE_TABLE = 'identity_store';
 const INTERNAL_KV_TABLE = 'internal_kv';
 function isWebIdString(value) {
@@ -103,22 +102,39 @@ function parsePayload(value) {
     return typeof value === 'object' ? value : undefined;
 }
 class AccountRoleRepository {
-    constructor(db) {
+    constructor(db, options = {}) {
         this.db = db;
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.legacyAccountDataDir = options.legacyAccountDataDir;
     }
     async findByAccountId(accountId) {
-        const record = await this.getAccountById(accountId);
-        if (!record) {
+        // 快路径：按主键直查 account 行，再按 accountId 反查链接表，避免全表扫描。
+        const record = await this.getIdentityStoreAccount(accountId);
+        if (record) {
+            const linked = await this.findWebIdsForAccount(accountId);
+            const webId = linked[0] ?? resolveWebIds(record.payload)[0];
+            return { accountId, webId, roles: resolveRoles(record.payload) };
+        }
+        const legacy = await this.loadLegacyAccounts();
+        const fallback = legacy.get(accountId);
+        if (!fallback) {
             return undefined;
         }
-        const [webId] = resolveWebIds(record.payload);
-        return { accountId, webId, roles: resolveRoles(record.payload) };
+        return { accountId, webId: resolveWebIds(fallback.payload)[0], roles: resolveRoles(fallback.payload) };
     }
     async findByWebId(webId) {
         if (!isWebIdString(webId)) {
             return undefined;
         }
+        // 快路径：webIdLink / owner→pod 链路的字段下推查询。
+        const accountId = await this.findAccountIdByWebId(webId);
+        if (accountId) {
+            const context = await this.findByAccountId(accountId);
+            if (context) {
+                return { ...context, webId };
+            }
+        }
+        // 兜底：legacy kv/文件来源及历史 payload 形状，保持原有全扫描行为。
         const accounts = await this.loadAllAccounts();
         for (const { id, payload } of accounts.values()) {
             const knownWebIds = resolveWebIds(payload);
@@ -148,7 +164,10 @@ class AccountRoleRepository {
         if (unique.length === 0) {
             return;
         }
-        const record = await this.getAccountById(accountId);
+        let record = await this.getIdentityStoreAccount(accountId);
+        if (!record) {
+            record = (await this.loadLegacyAccounts()).get(accountId);
+        }
         if (!record) {
             this.logger.warn(`Cannot add roles for unknown account ${accountId}`);
             return;
@@ -156,13 +175,130 @@ class AccountRoleRepository {
         const nextRoles = Array.from(new Set([...resolveRoles(record.payload), ...unique]));
         await this.updateAccountRecord(record, { ...record.payload, roles: nextRoles });
     }
-    async getAccountById(accountId) {
-        const accounts = await this.loadAllAccounts();
-        return accounts.get(accountId);
+    /**
+     * 按主键直查 identity_store 中的 account 行；表不存在时返回 undefined（由调用方走兜底）。
+     */
+    async getIdentityStoreAccount(accountId) {
+        const tableId = drizzle_orm_1.sql.identifier(IDENTITY_STORE_TABLE);
+        try {
+            const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+        SELECT payload
+        FROM ${tableId}
+        WHERE container = 'account' AND id = ${accountId}
+        LIMIT 1
+      `);
+            const payload = parsePayload(result.rows[0]?.payload);
+            return payload ? { id: accountId, payload, source: 'identity-store' } : undefined;
+        }
+        catch (error) {
+            if (!this.isTableMissing(error)) {
+                throw error;
+            }
+            return undefined;
+        }
     }
-    async loadAllAccounts() {
+    /**
+     * 按 CSS 行契约（webIdLink.accountId、pod.accountId、owner.podId）下推查询账户的 WebID。
+     */
+    async findWebIdsForAccount(accountId) {
+        const tableId = drizzle_orm_1.sql.identifier(IDENTITY_STORE_TABLE);
+        const webIds = new Set();
+        try {
+            const links = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+        SELECT payload FROM ${tableId}
+        WHERE container = 'webIdLink' AND ${(0, db_1.jsonFieldEquals)(this.db, 'accountId', accountId)}
+      `);
+            for (const row of links.rows) {
+                const webId = parsePayload(row.payload)?.webId;
+                if (isWebIdString(webId)) {
+                    webIds.add(webId);
+                }
+            }
+            const owners = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+        SELECT o.payload FROM ${tableId} o
+        WHERE o.container = 'owner' AND EXISTS (
+          SELECT 1 FROM ${tableId} p
+          WHERE p.container = 'pod'
+            AND ${(0, db_1.jsonFieldEquals)(this.db, 'accountId', accountId, 'p')}
+            AND ${this.ownerPodJoin()}
+        )
+      `);
+            for (const row of owners.rows) {
+                const webId = parsePayload(row.payload)?.webId;
+                if (isWebIdString(webId)) {
+                    webIds.add(webId);
+                }
+            }
+        }
+        catch (error) {
+            if (!this.isTableMissing(error)) {
+                throw error;
+            }
+        }
+        return Array.from(webIds);
+    }
+    /**
+     * WebID → accountId 的下推解析：webIdLink 优先，其次 account 行内嵌 webId 字段，
+     * 最后 owner→pod 链路。全部 miss 返回 undefined（调用方再走全量兜底）。
+     */
+    async findAccountIdByWebId(webId) {
+        const tableId = drizzle_orm_1.sql.identifier(IDENTITY_STORE_TABLE);
+        try {
+            const links = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+        SELECT payload FROM ${tableId}
+        WHERE container = 'webIdLink' AND ${(0, db_1.jsonFieldEquals)(this.db, 'webId', webId)}
+        LIMIT 1
+      `);
+            const linkedAccount = parsePayload(links.rows[0]?.payload)?.accountId;
+            if (typeof linkedAccount === 'string' && linkedAccount.length > 0) {
+                return linkedAccount;
+            }
+            for (const field of ['webId', 'webid', 'primaryWebId', 'primary_webid']) {
+                const accounts = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+          SELECT id FROM ${tableId}
+          WHERE container = 'account' AND ${(0, db_1.jsonFieldEquals)(this.db, field, webId)}
+          LIMIT 1
+        `);
+                if (accounts.rows[0]?.id) {
+                    return accounts.rows[0].id;
+                }
+            }
+            const owners = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+        SELECT payload FROM ${tableId}
+        WHERE container = 'owner' AND ${(0, db_1.jsonFieldEquals)(this.db, 'webId', webId)}
+        LIMIT 1
+      `);
+            const podId = parsePayload(owners.rows[0]?.payload)?.podId;
+            if (typeof podId === 'string' && podId.length > 0) {
+                const pods = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+          SELECT payload FROM ${tableId}
+          WHERE container = 'pod' AND id = ${podId}
+          LIMIT 1
+        `);
+                const ownerAccount = parsePayload(pods.rows[0]?.payload)?.accountId;
+                if (typeof ownerAccount === 'string' && ownerAccount.length > 0) {
+                    return ownerAccount;
+                }
+            }
+        }
+        catch (error) {
+            if (!this.isTableMissing(error)) {
+                throw error;
+            }
+        }
+        return undefined;
+    }
+    /**
+     * owner→pod 链路里把 owner 行的 podId 与 pod 行的 id 对齐。
+     */
+    ownerPodJoin() {
+        return (0, drizzle_orm_1.sql) `${(0, db_1.jsonFieldExtract)(this.db, 'podId', 'o')} = p.id`;
+    }
+    /**
+     * legacy 来源：internal_kv 与文件账户（迁移期兜底），不含 identity_store。
+     */
+    async loadLegacyAccounts() {
         const accounts = new Map();
-        await this.loadIdentityStoreAccounts(accounts);
         await this.loadInternalKvAccounts(accounts);
         for (const [id, payload] of await this.loadFileAccountMap()) {
             if (!accounts.has(id)) {
@@ -171,6 +307,16 @@ class AccountRoleRepository {
         }
         return accounts;
     }
+    async loadAllAccounts() {
+        const accounts = new Map();
+        await this.loadIdentityStoreAccounts(accounts);
+        for (const [id, record] of await this.loadLegacyAccounts()) {
+            if (!accounts.has(id)) {
+                accounts.set(id, record);
+            }
+        }
+        return accounts;
+    }
     async loadIdentityStoreAccounts(accounts) {
         const tableId = drizzle_orm_1.sql.identifier(IDENTITY_STORE_TABLE);
         let rows = [];
@@ -271,14 +417,16 @@ class AccountRoleRepository {
         }
     }
     async loadFileAccountMap() {
+        // 目录在使用时才解析（而不是模块加载时）：桌面/测试进程的 CWD 与模块加载时机无关。
+        const accountDataDir = this.legacyAccountDataDir ?? node_path_1.default.resolve('.internal', 'accounts', 'data');
         const map = new Map();
         try {
-            const files = await node_fs_1.promises.readdir(ACCOUNT_DATA_DIR);
+            const files = await node_fs_1.promises.readdir(accountDataDir);
             for (const file of files) {
                 if (!file.endsWith('.json')) {
                     continue;
                 }
-                const fullPath = node_path_1.default.join(ACCOUNT_DATA_DIR, file);
+                const fullPath = node_path_1.default.join(accountDataDir, file);
                 try {
                     const raw = await node_fs_1.promises.readFile(fullPath, 'utf8');
                     const parsed = JSON.parse(raw);
@@ -297,7 +445,7 @@ class AccountRoleRepository {
             }
         }
         catch (error) {
-            this.logger.debug(`Account data directory unavailable (${ACCOUNT_DATA_DIR}): ${error.message}`);
+            this.logger.debug(`Account data directory unavailable (${accountDataDir}): ${error.message}`);
         }
         return map;
     }

package/dist/identity/drizzle/PodLookupRepository.d.ts

@@ -14,6 +14,12 @@ export interface PodLookupResult {
  *
  * Reads Pod facts from the canonical identity_store table and from CSS
  * WrappedIndexedStorage rows when that storage backend is active.
+ *
+ * 点查（findById / findAllByWebId / findByWebIds / listByAccountId）走字段下推
+ * 快路径，避免每请求全扫 identity_store；KV 历史账户记录独立读取，
+ * 同 ID 的 canonical 记录整条优先，包括无法解析的记录，不能恢复旧身份。
+ * findByResourceIdentifier / listAllPods 本质上需要
+ * 候选全集，仍保留全量读取（identity_store 侧用反向前缀 LIKE 下推预筛）。
  */
 export declare class PodLookupRepository {
     private readonly db;
@@ -22,22 +28,27 @@ export declare class PodLookupRepository {
     constructor(db: IdentityDatabase, kvTableName?: string);
     /**
      * Find Pod by resource path (matches longest canonical storage/base URL prefix).
+     *
+     * kv 账户行无法按 URL 下推，保持全量解析（cloud 部署 kv 为空，local 规模有限）。
      */
     findByResourceIdentifier(resourcePath: string): Promise<PodLookupResult | undefined>;
     /**
      * Get Pod by ID.
+     *
+     * 快路径按主键直查 identity_store 的 pod 行并补齐 owner/node 关联；
+     * 独立读取 KV 历史记录，并按原始 ID 检查 canonical 遮蔽。
      */
     findById(podId: string): Promise<PodLookupResult | undefined>;
     /**
-     * Find Pod by a linked WebID URL.
+     * Find Pod by an explicit owner or pod.webId URL.
      *
-     * CSS account data stores WebID links separately from Pod base URLs. This is
+     * Pod ownership stores WebIDs separately from Pod base URLs. This is
      * the precise lookup for IdP/SP split deployments where the WebID path does
      * not have to match the storage base URL.
      */
     findByWebId(webId: string): Promise<PodLookupResult | undefined>;
     /**
-     * Find all Pods linked to a WebID.
+     * Find all Pods explicitly owned by a WebID.
      *
      * A Cloud WebID can legitimately back both a Cloud Pod and a Local SP Pod.
      * Callers that are scoped to a storage provider must inspect all candidates
@@ -45,11 +56,14 @@ export declare class PodLookupRepository {
      */
     findAllByWebId(webId: string): Promise<PodLookupResult[]>;
     /**
-     * Find Pods by linked WebID URLs in one scan.
+     * Find Pods by explicit WebID bindings with batched canonical queries.
      */
     findByWebIds(webIds: string[]): Promise<PodLookupResult[]>;
     /**
      * List Pods for a specific account.
+     *
+     * 定向查询与全扫描等价：kv 按账户键直取，identity_store 按 accountId 下推，
+     * canonical 整条优先与 getAllPods 一致，KV 扫描补齐 .json 等历史键。
      */
     listByAccountId(accountId: string): Promise<PodLookupResult[]>;
     /**
@@ -60,21 +74,50 @@ export declare class PodLookupRepository {
      * Extract all pods from the configured CSS identity storage.
      */
     private getAllPods;
+    private getLegacyPods;
+    private extractKvPods;
     private getAccountRowsFromKv;
     private getNodeAssignments;
+    private mergeCanonicalPods;
+    private extractPodsFromAccountData;
     /**
-     * Fast path for CSS WrappedIndexedStorage. WebID indexes point to the root
-     * account id, so a single indexed key plus account data row can resolve the
-     * profile without scanning all account records.
+     * 与全扫描一致的 WebID 匹配过滤：按 Pod 解析后的 WebID 列表按原字符串比较，
+     * 命中时附加该 Pod 自身存储的 WebID。
      */
-    private findByWebIdIndex;
-    private readAccountData;
-    private readStringArrayFromKv;
-    private readKvValue;
-    private extractPodsFromAccountData;
+    private filterPodsByWebIds;
     /**
      * DrizzleIndexedStorage stores CSS identity facts as typed rows in
      * identity_store; this is the canonical clustered identity source.
      */
     private getPodsFromIndexedStore;
+    /**
+     * 按主键直查 identity_store pod 行并补齐关联。
+     */
+    private getIndexedStorePodsByIds;
+    /**
+     * 按 payload.accountId 下推查询 identity_store pod 行并补齐关联。
+     */
+    private getIndexedStorePodsByAccountId;
+    /**
+     * 反向前缀 LIKE 预筛候选 pod 行（baseUrl/storageUrl/storage 任一前缀），
+     * JS 侧 startsWith 复核由调用方（findByResourceIdentifier）执行。
+     */
+    private findIndexedStorePodsByResource;
+    /**
+     * WebID → Pod 的下推解析：owner 按 webId 命中拿 podId，pod.webId
+     * 直查；Account webIdLink 不建立 Pod ownership。
+     * webIdForms 只携带完整原字符串；URL 等价不代表相同身份。
+     */
+    private findIndexedStorePodsByWebIds;
+    /**
+     * 为候选 pod 行补齐 owner 关联与 nodeAssignments，组装最终结果。
+     * 与全扫描共用 buildIndexedStorePods，保证返回形状一致。
+     */
+    private enrichIndexedStorePods;
+    private queryIndexedStoreRows;
+    /**
+     * 组装 identity_store Pod 视图：pod 行为主体，owner 行补充 WebID，
+     * nodeAssignments 兜底 nodeId。全扫描与下推快路径共用，保证返回形状一致。
+     */
+    private buildIndexedStorePods;
 }