npm - @xfe-repo/cli-plugin-oauth - Versions diffs - 2.0.8 - Mend

@xfe-repo/cli-plugin-oauth 2.0.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/CHANGELOG.md +9 -0
package/dist/callback-runner.d.ts +8 -0
package/dist/callback-runner.js +26 -0
package/dist/callback-server.d.ts +11 -0
package/dist/callback-server.js +74 -0
package/dist/index.d.ts +22 -0
package/dist/index.js +427 -0
package/dist/types.d.ts +51 -0
package/dist/types.js +12 -0
package/package.json +33 -0

package/CHANGELOG.md ADDED Viewed

@@ -0,0 +1,9 @@
+# @xfe-repo/cli-plugin-oauth
+## 2.0.8
+### Patch Changes
+- 新增deploy自动部署支持
+- Updated dependencies
+  - @xfe-repo/cli-core@2.1.0

package/dist/callback-runner.d.ts ADDED Viewed

@@ -0,0 +1,8 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - OAuth 回调子进程
+ *
+ * 在独立 Node 进程中等待本地 OAuth 回调，让 CLI session 的 Ctrl+C
+ * 可以通过 ctx.exec 终止等待中的回调服务。
+ */
+export {};
+//# sourceMappingURL=callback-runner.d.ts.map

package/dist/callback-runner.js ADDED Viewed

@@ -0,0 +1,26 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - OAuth 回调子进程
+ *
+ * 在独立 Node 进程中等待本地 OAuth 回调，让 CLI session 的 Ctrl+C
+ * 可以通过 ctx.exec 终止等待中的回调服务。
+ */
+import { OAUTH_CALLBACK_URL_PREFIX, startOAuthCallbackServer } from './callback-server.js';
+async function main() {
+    const redirectUri = process.argv[2];
+    if (!redirectUri)
+        throw new Error('缺少 OAuth redirectUri 参数');
+    const callbackServer = await startOAuthCallbackServer(redirectUri);
+    try {
+        const callbackUrl = await callbackServer.waitForCallback();
+        process.stdout.write(`${OAUTH_CALLBACK_URL_PREFIX}${callbackUrl.href}\n`);
+    }
+    finally {
+        await callbackServer.close();
+    }
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`${message}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=callback-runner.js.map

package/dist/callback-server.d.ts ADDED Viewed

@@ -0,0 +1,11 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - OAuth 回调服务
+ *
+ * 基于 Hono 启动临时本地 HTTP 服务，等待 OAuth 授权服务器回跳 redirectUri。
+ */
+export interface OAuthCallbackServer {
+    waitForCallback(): Promise<URL>;
+    close(): Promise<void>;
+}
+export declare function startOAuthCallbackServer(redirectUri: string): Promise<OAuthCallbackServer>;
+//# sourceMappingURL=callback-server.d.ts.map

package/dist/callback-server.js ADDED Viewed

@@ -0,0 +1,74 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - OAuth 回调服务
+ *
+ * 基于 Hono 启动临时本地 HTTP 服务，等待 OAuth 授权服务器回跳 redirectUri。
+ */
+import { serve } from '@hono/node-server';
+import { Hono } from 'hono';
+// ─── Constants ─────────────────────────────────────────────
+const CALLBACK_TIMEOUT_MS = 300000;
+const HTTP_OK = 200;
+const HTTP_BAD_REQUEST = 400;
+const HTTP_NOT_FOUND = 404;
+const SUCCESS_HTML = '<!doctype html><html lang="zh"><body>OAuth 登录完成，可以关闭此窗口。</body></html>';
+const FAILURE_HTML = '<!doctype html><html lang="zh"><body>OAuth 登录失败，请回到终端查看错误。</body></html>';
+// ─── Public API ────────────────────────────────────────────
+export async function startOAuthCallbackServer(redirectUri) {
+    const redirectUrl = new URL(redirectUri);
+    const port = Number.parseInt(redirectUrl.port, 10);
+    if (redirectUrl.protocol !== 'http:') {
+        throw new Error('oauth.redirectUri 仅支持本地 http 回调地址');
+    }
+    if (redirectUrl.hostname !== '127.0.0.1' && redirectUrl.hostname !== 'localhost') {
+        throw new Error('oauth.redirectUri 必须使用 127.0.0.1 或 localhost');
+    }
+    if (!redirectUrl.port || Number.isNaN(port)) {
+        throw new Error('oauth.redirectUri 必须包含有效端口号');
+    }
+    let resolveCallback = () => { };
+    let rejectCallback = () => { };
+    let hasClosed = false;
+    const callbackPromise = new Promise((resolve, reject) => {
+        resolveCallback = resolve;
+        rejectCallback = reject;
+    });
+    const app = new Hono();
+    app.get(redirectUrl.pathname, (ctx) => {
+        const currentUrl = new URL(ctx.req.url);
+        const error = currentUrl.searchParams.get('error');
+        if (error) {
+            const description = currentUrl.searchParams.get('error_description');
+            rejectCallback(new Error(description ? `${error}: ${description}` : error));
+            return ctx.html(FAILURE_HTML, HTTP_BAD_REQUEST);
+        }
+        resolveCallback(currentUrl);
+        return ctx.html(SUCCESS_HTML, HTTP_OK);
+    });
+    app.notFound((ctx) => ctx.html(FAILURE_HTML, HTTP_NOT_FOUND));
+    const httpServer = serve({
+        fetch: app.fetch,
+        hostname: redirectUrl.hostname,
+        port,
+    });
+    const timeout = setTimeout(() => {
+        rejectCallback(new Error('OAuth 登录超时，请重新执行 oauth:login'));
+    }, CALLBACK_TIMEOUT_MS);
+    return {
+        waitForCallback: () => callbackPromise,
+        close: async () => {
+            if (hasClosed)
+                return;
+            hasClosed = true;
+            clearTimeout(timeout);
+            rejectCallback(new Error('OAuth 回调服务已关闭'));
+            const closableServer = httpServer;
+            await new Promise((resolve) => {
+                httpServer.close(() => {
+                    resolve();
+                });
+                closableServer.closeAllConnections?.();
+            });
+        },
+    };
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - OAuth 登录插件
+ *
+ * 通过 openid-client 对接 OIDC/OAuth 登录，保存本地 token 状态，
+ * 并向其他插件提供 auth/login/getToken/logout 能力。
+ */
+import type { XfePlugin } from '@xfe-repo/cli-core';
+import { type OAuthCapability, type OAuthConfig, type OAuthStoreState, type OAuthTokenState, type OAuthUserState } from './types.js';
+export type { OAuthCapability, OAuthConfig, OAuthLoginOptions, OAuthSessionState, OAuthStoreState, OAuthTokenState, OAuthUserState, } from './types.js';
+export { OAuthClientAuthMethod } from './types.js';
+export declare const oauthStoreInitial: OAuthStoreState;
+declare module '@xfe-repo/cli-core' {
+    interface XfePluginRegistry {
+        oauth: XfePlugin<typeof oauthStoreInitial, OAuthCapability>;
+    }
+}
+export declare function oauthPlugin(): XfePlugin<typeof oauthStoreInitial, OAuthCapability>;
+export default oauthPlugin;
+export declare function resolveOAuthStateForConfig(config: OAuthConfig, state?: Partial<OAuthStoreState>): OAuthTokenState;
+export declare function resolveOAuthConfigKey(config: OAuthConfig): string;
+export declare function normalizeOAuthUserInfo(input: unknown): OAuthUserState;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js ADDED Viewed

@@ -0,0 +1,427 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - OAuth 登录插件
+ *
+ * 通过 openid-client 对接 OIDC/OAuth 登录，保存本地 token 状态，
+ * 并向其他插件提供 auth/login/getToken/logout 能力。
+ */
+import { createHash } from 'node:crypto';
+import * as oauthClient from 'openid-client';
+import open from 'open';
+import { z } from 'zod';
+import { OAuthClientAuthMethod, } from './types.js';
+import { startOAuthCallbackServer } from './callback-server.js';
+export { OAuthClientAuthMethod } from './types.js';
+// ─── Constants ─────────────────────────────────────────────
+const OAUTH_PLUGIN_NAME = 'oauth';
+const DEFAULT_OAUTH_NAME = 'OAuth';
+const DEFAULT_SCOPE = 'openid profile email';
+const DEFAULT_REDIRECT_URI = 'http://127.0.0.1:38080/oauth/callback';
+const DEFAULT_TOKEN_TYPE = 'Bearer';
+const TOKEN_EXPIRY_SKEW_SECONDS = 60;
+const RESPONSE_TYPE_CODE = 'code';
+const MILLISECONDS_PER_SECOND = 1000;
+const OAUTH_CONFIG_KEY_PREFIX = 'oauth';
+const OAUTH_CONFIG_KEY_VERSION = 'v1';
+const OAUTH_CONFIG_KEY_SEPARATOR = '\n';
+const OAUTH_CONFIG_HASH_ALGORITHM = 'sha256';
+const OAUTH_CONFIG_HASH_ENCODING = 'hex';
+export const oauthStoreInitial = {};
+const oauthConfigSchema = z
+    .object({
+    name: z.string().trim().min(1).default(DEFAULT_OAUTH_NAME),
+    discoveryUrl: z.string().trim().url().optional(),
+    authorizeUrl: z.string().trim().url().optional(),
+    tokenUrl: z.string().trim().url().optional(),
+    userInfoUrl: z.string().trim().url().optional(),
+    clientId: z.string().trim().min(1),
+    clientSecret: z.string().trim().min(1),
+    scope: z.string().trim().min(1).default(DEFAULT_SCOPE),
+    redirectUri: z.string().trim().url().default(DEFAULT_REDIRECT_URI),
+    clientAuthMethod: z.enum([OAuthClientAuthMethod.ClientSecretPost, OAuthClientAuthMethod.ClientSecretBasic]).default(OAuthClientAuthMethod.ClientSecretBasic),
+})
+    .refine((config) => config.discoveryUrl || (config.authorizeUrl && config.tokenUrl), {
+    message: '需要配置 discoveryUrl，或配置 authorizeUrl + tokenUrl',
+    path: ['discoveryUrl'],
+});
+// ─── Plugin ────────────────────────────────────────────────
+export function oauthPlugin() {
+    return {
+        name: OAUTH_PLUGIN_NAME,
+        setup(_ctx, hooks) {
+            const runtime = {
+                callbackServers: new Set(),
+                isCleaningUp: false,
+            };
+            hooks.registerStore(oauthStoreInitial, { scope: 'global' });
+            hooks.registerView({
+                name: 'oauth-status',
+                label: 'OAuth',
+                slot: ['footer'],
+                value: (state) => {
+                    const currentSession = resolveOptionalOAuthState(state.xfe, state.oauth);
+                    return currentSession ? `Oauth ${currentSession.isAuthenticated ? '已登录' : '未登录'}` : undefined;
+                },
+                color: (state) => {
+                    const currentSession = resolveOptionalOAuthState(state.xfe, state.oauth);
+                    return currentSession?.isAuthenticated ? 'cyan' : 'yellow';
+                },
+            });
+            hooks.onProjectInit.tap(OAUTH_PLUGIN_NAME, async (ctx) => {
+                const config = parseOptionalOAuthConfig(ctx.store.getState().xfe);
+                if (!config)
+                    return;
+                replaceOAuthStoreState(ctx, createOAuthStoreState(ctx.store.getState().oauth));
+            });
+            hooks.registerCommand({
+                name: 'oauth:login',
+                simpleDescription: '登录 OAuth 平台',
+                description: '通过 xfe.json 中的 oauth 配置打开浏览器登录，并将 token 保存到本地状态，供其他插件复用。',
+                execute: async (ctx) => {
+                    await login(ctx, { force: true }, runtime);
+                },
+            });
+            hooks.registerCommand({
+                name: 'oauth:logout',
+                simpleDescription: '退出 OAuth 平台',
+                description: '清除本地保存的 OAuth token 状态，不修改 xfe.json 中的 OAuth 配置。',
+                execute: async (ctx) => {
+                    await logout(ctx);
+                },
+            });
+            hooks.provide('oauth', {
+                auth: (ctx, options) => login(ctx, options, runtime),
+                login: (ctx, options) => login(ctx, options, runtime),
+                getToken: (ctx) => getToken(ctx, runtime),
+                getUser: (ctx) => getUser(ctx, runtime),
+                logout,
+            });
+            hooks.onCleanup.tap(OAUTH_PLUGIN_NAME, async () => {
+                runtime.isCleaningUp = true;
+                const callbackServers = [...runtime.callbackServers];
+                runtime.callbackServers.clear();
+                await Promise.allSettled(callbackServers.map((callbackServer) => callbackServer.close()));
+            });
+        },
+    };
+}
+export default oauthPlugin;
+// ─── Capability Handlers ───────────────────────────────────
+async function login(ctx, options, runtime) {
+    const config = parseOAuthConfig(ctx.store.getState().xfe);
+    const current = activateOAuthState(ctx, config);
+    const now = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+    if (!options?.force &&
+        current.isAuthenticated &&
+        current.accessToken &&
+        (!current.expiresAt || current.expiresAt - TOKEN_EXPIRY_SKEW_SECONDS > now)) {
+        return current;
+    }
+    const spinner = ctx.spinner.create(`正在登录 ${config.name}...`);
+    spinner.start();
+    try {
+        const clientConfig = await discoverOAuthConfig(config);
+        const callbackServer = await startOAuthCallbackServer(config.redirectUri);
+        if (runtime.isCleaningUp) {
+            await callbackServer.close();
+            throw new Error('OAuth 插件正在退出，已取消登录');
+        }
+        const codeVerifier = oauthClient.randomPKCECodeVerifier();
+        const codeChallenge = await oauthClient.calculatePKCECodeChallenge(codeVerifier);
+        const state = oauthClient.randomState();
+        const authorizationUrl = oauthClient.buildAuthorizationUrl(clientConfig, {
+            redirect_uri: config.redirectUri,
+            scope: config.scope,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            state,
+        });
+        let tokenResponse;
+        runtime.callbackServers.add(callbackServer);
+        try {
+            await open(authorizationUrl.href);
+            const callbackUrl = await callbackServer.waitForCallback();
+            tokenResponse = await oauthClient.authorizationCodeGrant(clientConfig, callbackUrl, {
+                pkceCodeVerifier: codeVerifier,
+                expectedState: state,
+            });
+        }
+        finally {
+            runtime.callbackServers.delete(callbackServer);
+            await callbackServer.close();
+        }
+        if (!tokenResponse.access_token)
+            throw new Error('OAuth token 响应缺少 access_token');
+        const expiresIn = tokenResponse.expiresIn();
+        const tokenState = {
+            name: config.name,
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token || '',
+            idToken: tokenResponse.id_token || '',
+            tokenType: tokenResponse.token_type || DEFAULT_TOKEN_TYPE,
+            scope: tokenResponse.scope || '',
+            expiresAt: expiresIn ? now + expiresIn : 0,
+            isAuthenticated: true,
+            userId: 0,
+            userName: '',
+        };
+        saveOAuthSession(ctx, config, tokenState);
+        spinner.succeed(`${config.name} 登录成功`);
+        return resolveOAuthStateForConfig(config, ctx.store.getState().oauth);
+    }
+    catch (error) {
+        spinner.fail(`${config.name} 登录失败`);
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`OAuth 登录失败: ${message}`);
+    }
+}
+async function getToken(ctx, runtime) {
+    const config = parseOAuthConfig(ctx.store.getState().xfe);
+    const current = activateOAuthState(ctx, config);
+    const now = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+    if (current.isAuthenticated && current.accessToken && (!current.expiresAt || current.expiresAt - TOKEN_EXPIRY_SKEW_SECONDS > now)) {
+        return current.accessToken;
+    }
+    if (current.refreshToken) {
+        try {
+            const clientConfig = await discoverOAuthConfig(config);
+            const tokenResponse = await oauthClient.refreshTokenGrant(clientConfig, current.refreshToken);
+            if (!tokenResponse.access_token)
+                throw new Error('OAuth token 响应缺少 access_token');
+            const expiresIn = tokenResponse.expiresIn();
+            const tokenState = {
+                name: config.name,
+                accessToken: tokenResponse.access_token,
+                refreshToken: tokenResponse.refresh_token || current.refreshToken,
+                idToken: tokenResponse.id_token || '',
+                tokenType: tokenResponse.token_type || DEFAULT_TOKEN_TYPE,
+                scope: tokenResponse.scope || '',
+                expiresAt: expiresIn ? now + expiresIn : 0,
+                isAuthenticated: true,
+                userId: 0,
+                userName: '',
+            };
+            saveOAuthSession(ctx, config, tokenState);
+            return tokenState.accessToken;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            ctx.logger.warn(`OAuth token 刷新失败，将重新登录: ${message}`);
+        }
+    }
+    const tokenState = await login(ctx, undefined, runtime);
+    return tokenState.accessToken;
+}
+async function getUser(ctx, runtime) {
+    const config = parseOAuthConfig(ctx.store.getState().xfe);
+    const current = activateOAuthState(ctx, config);
+    if (current.userId > 0 && current.userName)
+        return { userId: current.userId, userName: current.userName };
+    if (!config.userInfoUrl)
+        throw new Error('xfe.json oauth 配置缺少 userInfoUrl，无法获取用户信息');
+    const accessToken = await getToken(ctx, runtime);
+    const latestBeforeUserInfo = resolveOAuthStateForConfig(config, ctx.store.getState().oauth);
+    const tokenType = latestBeforeUserInfo.tokenType || DEFAULT_TOKEN_TYPE;
+    const response = await fetch(config.userInfoUrl, {
+        headers: {
+            Authorization: `${tokenType} ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`OAuth 用户信息获取失败: HTTP ${response.status}`);
+    }
+    const user = normalizeOAuthUserInfo(await response.json());
+    const latest = resolveOAuthStateForConfig(config, ctx.store.getState().oauth);
+    saveOAuthSession(ctx, config, { ...toOAuthSessionState(latest, config.name), ...user });
+    return user;
+}
+async function logout(ctx) {
+    const config = parseOptionalOAuthConfig(ctx.store.getState().xfe);
+    const current = config ? resolveOAuthStateForConfig(config, ctx.store.getState().oauth) : undefined;
+    const name = config?.name || current?.name || DEFAULT_OAUTH_NAME;
+    const storeState = createOAuthStoreState(ctx.store.getState().oauth);
+    if (config)
+        delete storeState[resolveOAuthConfigKey(config)];
+    replaceOAuthStoreState(ctx, storeState);
+    ctx.logger.success(`${name} 已退出登录`);
+}
+// ─── Config And State ──────────────────────────────────────
+export function resolveOAuthStateForConfig(config, state) {
+    const configKey = resolveOAuthConfigKey(config);
+    const session = state?.[configKey];
+    return session ? toOAuthSessionState(session, config.name) : createEmptyOAuthSession(config.name);
+}
+function parseOAuthConfig(xfeConfig) {
+    const config = parseOptionalOAuthConfig(xfeConfig);
+    if (!config)
+        throw new Error('xfe.json 中缺少 oauth 配置');
+    return config;
+}
+function parseOptionalOAuthConfig(xfeConfig) {
+    const rawConfig = xfeConfig?.oauth;
+    if (!rawConfig)
+        return undefined;
+    const result = oauthConfigSchema.safeParse(rawConfig);
+    if (!result.success) {
+        const message = result.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ');
+        throw new Error(`xfe.json oauth 配置无效: ${message}`);
+    }
+    return result.data;
+}
+function activateOAuthState(ctx, config) {
+    const storeState = createOAuthStoreState(ctx.store.getState().oauth);
+    replaceOAuthStoreState(ctx, storeState);
+    return resolveOAuthStateForConfig(config, storeState);
+}
+function saveOAuthSession(ctx, config, session) {
+    const configKey = resolveOAuthConfigKey(config);
+    const storeState = createOAuthStoreState(ctx.store.getState().oauth);
+    storeState[configKey] = toOAuthSessionState(session, config.name);
+    replaceOAuthStoreState(ctx, storeState);
+}
+function replaceOAuthStoreState(ctx, state) {
+    ctx.store.setState({ oauth: state });
+}
+function resolveOptionalOAuthState(xfeConfig, state) {
+    const config = parseOptionalOAuthConfig(xfeConfig);
+    if (!config)
+        return undefined;
+    return resolveOAuthStateForConfig(config, state);
+}
+function createOAuthStoreState(state) {
+    return cloneOAuthState(state);
+}
+export function resolveOAuthConfigKey(config) {
+    const payload = [
+        OAUTH_CONFIG_KEY_VERSION,
+        config.discoveryUrl ?? '',
+        config.authorizeUrl ?? '',
+        config.tokenUrl ?? '',
+        config.userInfoUrl ?? '',
+        config.clientId,
+        config.scope,
+        config.redirectUri,
+        config.clientAuthMethod,
+    ].join(OAUTH_CONFIG_KEY_SEPARATOR);
+    const digest = createHash(OAUTH_CONFIG_HASH_ALGORITHM).update(payload).digest(OAUTH_CONFIG_HASH_ENCODING);
+    return `${OAUTH_CONFIG_KEY_PREFIX}:${digest}`;
+}
+function cloneOAuthState(stateMap) {
+    if (!stateMap)
+        return {};
+    return Object.fromEntries(Object.entries(stateMap)
+        .filter((entry) => isOAuthSessionState(entry[1]))
+        .map(([configKey, session]) => [configKey, toOAuthSessionState(session, session.name)]));
+}
+function isOAuthSessionState(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    return typeof record.name === 'string';
+}
+function createEmptyOAuthSession(name) {
+    return toOAuthSessionState(undefined, name);
+}
+function toOAuthSessionState(state, name) {
+    return {
+        name: state?.name || name,
+        accessToken: state?.accessToken || '',
+        refreshToken: state?.refreshToken || '',
+        idToken: state?.idToken || '',
+        tokenType: state?.tokenType || DEFAULT_TOKEN_TYPE,
+        scope: state?.scope || '',
+        expiresAt: state?.expiresAt ?? 0,
+        isAuthenticated: state?.isAuthenticated ?? false,
+        userId: state?.userId ?? 0,
+        userName: state?.userName || '',
+    };
+}
+export function normalizeOAuthUserInfo(input) {
+    if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+        throw new Error('OAuth 用户信息响应格式无效');
+    }
+    const rootRecord = input;
+    const nestedRecord = [rootRecord.Data, rootRecord.data, rootRecord.result].find((value) => typeof value === 'object' && value !== null && !Array.isArray(value));
+    const userRecord = nestedRecord ?? rootRecord;
+    const userIdKeys = ['userId', 'user_id', 'UserId', 'id', 'uid'];
+    const userNameKeys = ['name', 'userName', 'user_name', 'UserName', 'username', 'nickName', 'nikeName', 'nickname'];
+    let userId = 0;
+    let userName = '';
+    for (const key of userIdKeys) {
+        const value = userRecord[key];
+        if (typeof value === 'number' && Number.isInteger(value)) {
+            userId = value;
+            break;
+        }
+        if (typeof value === 'string' && value.trim()) {
+            const parsed = Number.parseInt(value, 10);
+            if (!Number.isNaN(parsed)) {
+                userId = parsed;
+                break;
+            }
+        }
+    }
+    if (!userId)
+        throw new Error('OAuth 用户信息缺少 userId');
+    for (const key of userNameKeys) {
+        const value = userRecord[key];
+        if (typeof value === 'string' && value.trim()) {
+            userName = value.trim();
+            break;
+        }
+    }
+    if (!userName)
+        throw new Error('OAuth 用户信息缺少 userName');
+    return { userId, userName };
+}
+// ─── OAuth Runtime ─────────────────────────────────────────
+async function discoverOAuthConfig(config) {
+    const clientAuth = config.clientAuthMethod === OAuthClientAuthMethod.ClientSecretBasic
+        ? oauthClient.ClientSecretBasic(config.clientSecret)
+        : oauthClient.ClientSecretPost(config.clientSecret);
+    const clientMetadata = {
+        client_secret: config.clientSecret,
+        token_endpoint_auth_method: config.clientAuthMethod,
+    };
+    if (config.discoveryUrl) {
+        return withTokenTypeFallback(await oauthClient.discovery(new URL(config.discoveryUrl), config.clientId, clientMetadata, clientAuth));
+    }
+    if (!config.authorizeUrl || !config.tokenUrl) {
+        throw new Error('oauth 显式端点模式需要配置 authorizeUrl、tokenUrl');
+    }
+    const serverMetadata = {
+        issuer: new URL(config.authorizeUrl).origin,
+        authorization_endpoint: config.authorizeUrl,
+        token_endpoint: config.tokenUrl,
+        response_types_supported: [RESPONSE_TYPE_CODE],
+        token_endpoint_auth_methods_supported: [config.clientAuthMethod],
+    };
+    return withTokenTypeFallback(new oauthClient.Configuration(config.userInfoUrl ? { ...serverMetadata, userinfo_endpoint: config.userInfoUrl } : serverMetadata, config.clientId, clientMetadata, clientAuth));
+}
+function withTokenTypeFallback(clientConfig) {
+    clientConfig[oauthClient.customFetch] = async (input, init) => {
+        const response = await fetch(input, init);
+        if (!(init?.body instanceof URLSearchParams) || !init.body.has('grant_type'))
+            return response;
+        if (!response.headers.get('content-type')?.includes('application/json'))
+            return response;
+        const body = await response
+            .clone()
+            .json()
+            .catch(() => undefined);
+        if (!body || typeof body !== 'object' || Array.isArray(body))
+            return response;
+        const tokenBody = body;
+        if (typeof tokenBody.access_token !== 'string' || tokenBody.token_type !== undefined)
+            return response;
+        const headers = new Headers(response.headers);
+        headers.delete('content-length');
+        headers.set('content-type', 'application/json');
+        return new Response(JSON.stringify({ ...tokenBody, token_type: DEFAULT_TOKEN_TYPE }), {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    };
+    return clientConfig;
+}
+//# sourceMappingURL=index.js.map

package/dist/types.d.ts ADDED Viewed

@@ -0,0 +1,51 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - 类型定义
+ *
+ * 定义 OAuth 配置、token 状态和插件对外能力接口。
+ */
+import type { PluginContext } from '@xfe-repo/cli-core';
+export declare enum OAuthClientAuthMethod {
+    ClientSecretPost = "client_secret_post",
+    ClientSecretBasic = "client_secret_basic"
+}
+export interface OAuthConfig {
+    name: string;
+    discoveryUrl?: string;
+    authorizeUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+    clientId: string;
+    clientSecret: string;
+    scope: string;
+    redirectUri: string;
+    clientAuthMethod: OAuthClientAuthMethod;
+}
+export interface OAuthSessionState {
+    name: string;
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    tokenType: string;
+    scope: string;
+    expiresAt: number;
+    isAuthenticated: boolean;
+    userId: number;
+    userName: string;
+}
+export type OAuthStoreState = Record<string, OAuthSessionState>;
+export type OAuthTokenState = OAuthSessionState;
+export interface OAuthLoginOptions {
+    force?: boolean;
+}
+export interface OAuthUserState {
+    userId: number;
+    userName: string;
+}
+export interface OAuthCapability {
+    auth(ctx: PluginContext, options?: OAuthLoginOptions): Promise<OAuthTokenState>;
+    login(ctx: PluginContext, options?: OAuthLoginOptions): Promise<OAuthTokenState>;
+    getToken(ctx: PluginContext): Promise<string>;
+    getUser(ctx: PluginContext): Promise<OAuthUserState>;
+    logout(ctx: PluginContext): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.js ADDED Viewed

@@ -0,0 +1,12 @@
+/**
+ * @xfe-repo/cli-plugin-oauth - 类型定义
+ *
+ * 定义 OAuth 配置、token 状态和插件对外能力接口。
+ */
+// ─── Types ──────────────────────────────────────────────────
+export var OAuthClientAuthMethod;
+(function (OAuthClientAuthMethod) {
+    OAuthClientAuthMethod["ClientSecretPost"] = "client_secret_post";
+    OAuthClientAuthMethod["ClientSecretBasic"] = "client_secret_basic";
+})(OAuthClientAuthMethod || (OAuthClientAuthMethod = {}));
+//# sourceMappingURL=types.js.map

package/package.json ADDED Viewed

@@ -0,0 +1,33 @@
+{
+  "name": "@xfe-repo/cli-plugin-oauth",
+  "version": "2.0.8",
+  "description": "XFE OAuth plugin - login through OIDC/OAuth and expose token state",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@hono/node-server": "^1.14.0",
+    "hono": "^4.7.0",
+    "openid-client": "^6.8.1",
+    "open": "^10.2.0",
+    "zod": "^4.3.6",
+    "@xfe-repo/cli-core": "2.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.3.0",
+    "typescript": "^5.9.2",
+    "vitest": "^3.1.0"
+  },
+  "files": [
+    "dist",
+    "CHANGELOG.md",
+    "!dist/**/*.map"
+  ],
+  "license": "ISC",
+  "scripts": {
+    "dev": "tsc -p tsconfig.json -w",
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}