@xiaoyuanhao/yunzhi-cli 2.1.1 → 2.1.2

package/lib/auth-context.cjs

@@ -0,0 +1,135 @@
+// Conversation authorization state is local to the command working directory.
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const { root, loadConfig } = require('./storage.cjs');
+const { gatewayURL } = require('./gateway.cjs');
+const { Failure, invalid } = require('./result.cjs');
+const hash = value => createHash('sha256').update(value).digest('hex');
+const operation = args => hash(JSON.stringify(args));
+function stopped(message) { return new Failure(3, 'authentication', 'authorization_stopped', message); }
+async function withState(action, create = false) {
+  const directory = path.join(root(), 'authorization');
+  if (!create) {
+    try { await fs.access(path.join(directory, hash(process.cwd()) + '.json')); }
+    catch (error) { if (error.code === 'ENOENT') return action(null, async () => {}); throw error; }
+  }
+  await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+  const info = await fs.lstat(directory);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw stopped('授权上下文目录无效。');
+  const file = path.join(directory, hash(process.cwd()) + '.json');
+  let lock;
+  try { lock = await fs.open(file + '.lock', 'wx', 0o600); }
+  catch (error) { if (error.code === 'EEXIST') throw stopped('本工作目录的授权操作正在进行或上次被中断，请先检查该操作。'); throw error; }
+  try {
+    let state = null;
+    try {
+      const stat = await fs.lstat(file);
+      if (!stat.isFile() || stat.isSymbolicLink()) throw stopped('授权上下文文件无效。');
+      state = JSON.parse(await fs.readFile(file, 'utf8'));
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const save = async value => {
+      await fs.writeFile(file + '.tmp', JSON.stringify(value), { mode: 0o600, flag: 'wx' });
+      await fs.rename(file + '.tmp', file);
+    };
+    return await action(state, save);
+  } finally { await lock.close(); await fs.unlink(file + '.lock'); }
+}
+async function binding() {
+  const config = await loadConfig();
+  return { gateway: gatewayURL(config), profile: config.current_profile?.credential_ref || null };
+}
+const sameBinding = (s, b) => s.gateway === b.gateway && s.profile === b.profile;
+async function remember(args, result) {
+  const error = result.value?.error;
+  if (!error || !['auth_required', 'missing_scope'].includes(error.subtype)
+      || !['authentication', 'authorization'].includes(error.type)
+      || error.operation_completed || error.cleanup_failed) return;
+  const scopes = error.required_scopes;
+  if (!Array.isArray(scopes) || !scopes.length || scopes.some(s => typeof s !== 'string' || !s.trim())) return;
+  const bound = await binding();
+  await withState(async (state, save) => {
+    const id = operation(args);
+    if (state && sameBinding(state, bound) && state.operation === id && state.phase !== 'required') {
+      error.hint = '本次业务的授权恢复已停止，请报告当前错误；不要重新创建授权或重复办理。';
+      return;
+    }
+    if (state && sameBinding(state, bound) && ['creating', 'pending', 'exchanging'].includes(state.phase)) {
+      error.hint = '本工作目录已有另一项待完成的授权，请先完成或明确取消它。';
+      return;
+    }
+    await save({ ...bound, operation: id, scopes, phase: 'required' });
+    error.hint = 'CLI 已保存本次所需权限。执行 auth login 获取授权链接；等待用户确认后执行 auth login --continue。';
+  }, true);
+}
+async function beforeBusiness(args) {
+  const bound = await binding();
+  return withState(async (state, save) => {
+    if (!state || !sameBinding(state, bound) || state.operation !== operation(args)) return;
+    if (['creating', 'pending', 'exchanging', 'stopped', 'retried'].includes(state.phase))
+      throw stopped('本次业务已有授权恢复记录，尚未完成授权或恢复次数已用完；本次未执行业务。');
+    if (state.phase === 'complete') await save({ ...state, phase: 'retried' });
+  });
+}
+async function afterBusiness(args, result) {
+  if (!result.value?.ok) return;
+  await withState(async (state, save) => {
+    if (state?.operation === operation(args) && state.phase === 'retried') await save(null);
+  });
+}
+async function login(args) {
+  if (args.length && !(args.length === 1 && args[0] === '--continue')) throw invalid('用法：auth login 或 auth login --continue。');
+  const continuing = args.length === 1;
+  const auth = require('./auth.cjs');
+  const bound = await binding();
+  return withState(async (state, save) => {
+    if (!state || !sameBinding(state, bound)) throw stopped('没有与当前账号及服务地址匹配的待授权业务，请先执行需要办理的业务。');
+    if (!continuing) {
+      if (state.phase === 'pending' && Date.parse(state.expires_at) > Date.now()) return receipt(state);
+      if (state.phase !== 'required') throw stopped('本次授权已结束或状态不确定，不再自动创建新会话。');
+      await save({ ...state, phase: 'creating' });
+      try {
+        const explicit = state.scopes.flatMap(s => ['--scope', s]);
+        let result;
+        try { result = await auth.login(explicit); }
+        catch (error) {
+          if (error.result?.value.error.subtype !== 'stale_session_requires_logout') throw error;
+          await auth.logout([]);
+          state = { ...state, ...await binding() };
+          result = await auth.login(explicit);
+        }
+        const data = result.value.data;
+        state = { ...state, phase: 'pending', device_code: data.device_code,
+          authorization_url: data.authorization_url, expires_at: data.expires_at, attempts: 0 };
+        await save(state);
+        return receipt(state);
+      } catch (error) { await save({ ...state, phase: 'stopped' }); throw error; }
+    }
+    if (state.phase !== 'pending' || Date.parse(state.expires_at) <= Date.now()) {
+      await save({ ...state, device_code: undefined, phase: 'stopped' });
+      throw stopped('授权已过期或本次流程已停止。');
+    }
+    state.attempts++;
+    await save({ ...state, phase: 'exchanging' });
+    try {
+      const result = await auth.login(['--device-code', state.device_code]);
+      await save({ ...state, ...await binding(), device_code: undefined, phase: 'complete' });
+      result.value.data.message = '授权完成。可以继续原业务一次。';
+      return result;
+    } catch (error) {
+      const pending = error.result?.value.error.subtype === 'authorization_pending' && state.attempts === 1;
+      await save({ ...state, device_code: pending ? state.device_code : undefined, phase: pending ? 'pending' : 'stopped' });
+      if (error.result) error.result.value.error.hint = pending
+        ? '网页授权尚未完成。请等待用户再次明确确认，然后执行 auth login --continue；不要轮询。'
+        : '本次授权恢复已停止。请报告错误，不再兑换或自动重新创建授权。';
+      throw error;
+    }
+  });
+}
+function receipt(state) {
+  return { code: 0, value: { ok: true, data: { event: 'authorization_pending', authorization_url: state.authorization_url,
+    expires_at: state.expires_at, requested_scopes: state.scopes,
+    message: '请用业务名称说明所需权限，展示可点击的完整授权链接。等待用户明确确认网页授权完成后执行 auth login --continue；不要轮询。' } } };
+}
+async function clear() { await withState(async (_, save) => save(null)); }
+module.exports = { login, remember, beforeBusiness, afterBusiness, clear };

package/lib/cli.cjs

@@ -127,7 +127,7 @@ const usage = {
   'leave remind': '--id <id>',
   'leave withdraw': '--id <id>',
   'leave list': '[--scope mine|managed] [--start-date YYYY-MM-DD --end-date YYYY-MM-DD] [--leave-type <type>] [--status draft|processing|completed|returned|rejected|withdrawn|unknown] [--reason <text>] [--page <n>] [--page-size <1-100>]',
-  'auth login': '--scope <scope> [--scope <scope>...]\n  或 auth login --device-code <device_code>',
+  'auth login': '[--continue]',
   'auth connect': '--scope <scope> [--scope <scope>...]',
   'auth status': '[--verify]', 'auth logout': '',
   'lesson-prep ls': '[path] [--limit 1..200] [--cursor <cursor>]',
@@ -302,37 +302,22 @@ const summaries = {
   'review approve': '通过上报并创建目标资源', 'review reject': '拒绝上报并记录原因',
 };
 
-const loginHelp = `登录与授权：创建授权会话，或在网页授权完成后兑换登录态。
+const loginHelp = `登录与授权：根据刚才业务保存的权限生成链接，用户确认后继续授权。
 
-1. 创建授权会话（首次登录或追加权限）
-用法：yunzhi-cli auth login --scope <scope> [--scope <scope>...]
+用法：yunzhi-cli auth login [--continue]
 参数：
-  --scope  必填，可重复，无默认值。使用原业务错误返回的 error.required_scopes，每个权限分别传入一次。
-  仅要求登录或切换账号、组织且尚未明确业务时，先询问要办理的业务，不自行选择默认权限。
+  无参数：使用本工作目录内刚才业务保存的权限创建授权链接；已有待授权链接时复用，不重复创建。
+  --continue：仅在用户明确确认网页授权完成后使用；CLI 读取保存的授权码并完成兑换。
 示例：
-  yunzhi-cli auth login --scope school-library:read
+  yunzhi-cli auth login
+  yunzhi-cli auth login --continue
 返回：
-  ok=true、data.event=authorization_pending 表示会话创建成功，尚未完成登录。
-  data.authorization_url 是完整授权地址；data.device_code 用于后续兑换。
-  data.expires_at 是会话过期时间；data.requested_scopes 是本次权限；data.message 提示下一步。
-下一步：
-  将 authorization_url 展示为可点击的 Markdown 链接：[完整 URL](完整 URL)，两处保留完整原始地址，不使用行内代码或代码块。
-  用用户的语言和业务名称说明所需权限，不直接展示权限代码。等待用户明确确认网页授权完成后再兑换，不轮询。
-
-2. 兑换登录态
-用法：yunzhi-cli auth login --device-code <device_code>
-参数：
-  --device-code  必填，使用创建会话时返回的 data.device_code，不能与 --scope 同时使用。
-示例：
-  yunzhi-cli auth login --device-code <device_code>
-返回：
-  ok=true、data.event=authorization_complete 表示登录授权完成，可以恢复原业务命令。
-  data.user、data.tenant 是当前用户和组织；data.granted_scopes 是已授权权限；data.expires_at 是登录过期时间。
-下一步：
-  成功后重试原业务命令。
-
-除 --scope 外，参数不能重复传入。
-默认输出 JSON。失败时阅读 error.message 及返回的引导字段，并按认证指南处理。
+  authorization_pending：尚未完成授权，展示 authorization_url 为可点击的完整链接，并用业务名称说明权限。
+  authorization_complete：授权完成，可以继续原业务一次。
+限制：
+  先执行业务命令获取所需权限，不需要手动传递权限或授权码。后续调用保持同一工作目录、账号和服务地址。
+  用户确认后才继续，不轮询。CLI 处理失效登录清理和恢复次数；根据返回提示等待确认或停止。
+  CLI 不自动同意授权，不自动重放业务写操作。失败原因与下一步见 error.message/error.hint。
 `;
 
 async function execute(args) {
@@ -415,6 +400,13 @@ async function execute(args) {
     if ((args[1] === 'reference' && args[0] !== 'lesson-prep') || (command === 'web' && args[0] !== 'school-library')) throw invalid('未知命令。');
     return require('./business.cjs').execute(args[0], command, args.slice(grouped ? 3 : 2));
   }
+  if (args[0] === 'auth' && args[1] === 'login' && (args.length === 2 || args.includes('--continue')))
+    return require('./auth-context.cjs').login(args.slice(2));
+  if (args[0] === 'auth' && args[1] === 'logout') {
+    const result = await require('./auth.cjs').logout(args.slice(2));
+    await require('./auth-context.cjs').clear();
+    return result;
+  }
   if (args[0] === 'auth' && ['login', 'connect', 'status', 'logout'].includes(args[1])) return require('./auth.cjs')[args[1]](args.slice(2));
   if (args[0] === 'config' && args[1] === 'set') {
     const filtered = args.slice(2);
@@ -440,7 +432,11 @@ async function run(args) {
   const command = Object.keys(usage).filter(item => item.split(' ').every((word, index) => args[index] === word))
     .sort((left, right) => right.length - left.length)[0];
   let result;
-  try { result = await execute(args); }
+  const managedBusiness = command && !['auth', 'config', 'version', 'help'].includes(args[0]) && !args.some(a => ['--help', '-h'].includes(a));
+  try {
+    if (managedBusiness) await require('./auth-context.cjs').beforeBusiness(args);
+    result = await execute(args);
+  }
   catch (error) { if (error instanceof Failure) result = error.result; else throw error; }
   if (command && result.value?.ok && !guidance.validResult(command, result.value.data)) {
     const failure = new Failure(1, 'api', 'invalid_response', guidance.resultProblem(command, result.value.data));
@@ -471,6 +467,19 @@ async function run(args) {
     }
   }
   if (command && result.value) require('./attendance-operation-result.cjs').project(command, result.value);
+  if (managedBusiness) {
+    try {
+      await require('./auth-context.cjs').remember(args, result);
+      await require('./auth-context.cjs').afterBusiness(args, result);
+    } catch (error) {
+      const problem = error instanceof Failure ? error.result.value.error : { type: 'internal', message: '无法保存授权上下文。' };
+      if (result.value?.ok) { result.value.data.authorization_cleanup_error = problem; }
+      else {
+        result.value.error.authorization_context_error = problem;
+        result.value.error.hint = '无法保存本次授权上下文，请报告错误并停止；不要继续创建授权。';
+      }
+    }
+  }
   return result;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaoyuanhao/yunzhi-cli",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "Yunzhi Campus CLI for lesson preparation and school library workflows",
   "bin": {
     "yunzhi-cli": "yunzhi-cli.cjs"