@yeaft/webchat-agent 1.0.186 → 1.0.189

package/local-runtime/server/routes/upload-routes.js

@@ -0,0 +1,109 @@
+import { randomUUID } from 'crypto';
+import multer from 'multer';
+import { CONFIG } from '../config.js';
+import { userDb } from '../database.js';
+import { pendingFiles, previewFiles } from '../context.js';
+import { yeaftAssetStore } from '../yeaft-asset-store.js';
+
+// 文件上传配置 (存储在内存中)
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: CONFIG.maxFileSize }
+});
+
+export function extensionForMimeType(mimeType) {
+  const type = String(mimeType || '').toLowerCase();
+  if (type === 'image/png') return '.png';
+  if (type === 'image/jpeg') return '.jpg';
+  if (type === 'image/gif') return '.gif';
+  if (type === 'image/webp') return '.webp';
+  if (type === 'image/svg+xml') return '.svg';
+  if (type === 'text/plain') return '.txt';
+  if (type === 'application/json') return '.json';
+  return '';
+}
+
+export function fallbackUploadName(file, index) {
+  const original = typeof file?.originalname === 'string' ? file.originalname.trim() : '';
+  if (original) return original;
+  const isImage = String(file?.mimetype || '').startsWith('image/');
+  const prefix = isImage ? 'pasted-image' : 'uploaded-file';
+  return `${prefix}-${Date.now()}-${index + 1}${extensionForMimeType(file?.mimetype)}`;
+}
+
+// 定期清理超过 10 分钟的文件
+setInterval(() => {
+  const now = Date.now();
+  for (const [fileId, file] of pendingFiles) {
+    if (now - file.uploadedAt > CONFIG.fileCleanupInterval) {
+      pendingFiles.delete(fileId);
+    }
+  }
+}, 60 * 1000);
+
+// Cleanup expired preview files every 60s (10 min TTL)
+setInterval(() => {
+  const cutoff = Date.now() - 10 * 60 * 1000;
+  for (const [id, f] of previewFiles) {
+    if (f.createdAt < cutoff) previewFiles.delete(id);
+  }
+}, 60 * 1000);
+
+/**
+ * Register file upload and preview routes.
+ */
+export function registerUploadRoutes(app, { requireAuth }) {
+  app.post('/api/upload', requireAuth, upload.array('files', 10), (req, res) => {
+    if (!req.files || req.files.length === 0) {
+      return res.status(400).json({ error: 'No files uploaded' });
+    }
+
+    const user = userDb.getOrCreate(req.user.username);
+    const userId = user?.id;
+
+    const uploaded = req.files.map((file, index) => {
+      const fileId = randomUUID();
+      const name = fallbackUploadName(file, index);
+      pendingFiles.set(fileId, {
+        name,
+        mimeType: file.mimetype,
+        buffer: file.buffer,
+        uploadedAt: Date.now(),
+        userId
+      });
+      return {
+        fileId,
+        name,
+        mimeType: file.mimetype,
+        size: file.size
+      };
+    });
+
+    res.json({ files: uploaded });
+  });
+
+  app.get('/api/preview/:fileId', (req, res) => {
+    const file = previewFiles.get(req.params.fileId);
+    if (!file) return res.status(404).send('File not found or expired');
+    if (file.token && req.query.token !== file.token) {
+      return res.status(403).send('Forbidden');
+    }
+    res.setHeader('Content-Type', file.mimeType);
+    res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(file.filename)}"`);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Cache-Control', 'no-store');
+    res.send(file.buffer);
+  });
+
+  app.get('/api/yeaft/assets/:scopeId/:assetId', (req, res) => {
+    const asset = yeaftAssetStore.read(req.params.scopeId, req.params.assetId, req.query.token);
+    if (!asset) return res.status(404).send('Image asset not found');
+    res.setHeader('Content-Type', asset.metadata.mimeType);
+    res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(asset.metadata.filename)}"`);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Cache-Control', 'private, max-age=3600');
+    res.setHeader('ETag', `"${asset.metadata.assetId}"`);
+    res.send(asset.buffer);
+  });
+}

package/local-runtime/server/routes/user-routes.js

@@ -0,0 +1,241 @@
+import { CONFIG } from '../config.js';
+import { hashPassword } from '../auth.js';
+import { userDb, sessionDb } from '../database.js';
+import { activeSessions, revokedTokens } from '../auth/session-store.js';
+
+// 过滤用户敏感字段
+function sanitizeUser(user) {
+  return {
+    id: user.id,
+    username: user.username,
+    display_name: user.display_name,
+    email: user.email,
+    role: user.role,
+    created_at: user.created_at,
+    last_login_at: user.last_login_at
+  };
+}
+
+// 转换数据库会话记录为前端期望的格式
+function transformSession(session) {
+  return {
+    id: session.id,
+    agentId: session.agent_id,
+    agentName: session.agent_name,
+    claudeSessionId: session.claude_session_id,
+    workDir: session.work_dir,
+    title: session.title,
+    createdAt: session.created_at,
+    updatedAt: session.updated_at,
+    isActive: !!session.is_active,
+    userId: session.user_id
+  };
+}
+
+function loadCurrentUser(req) {
+  let user = userDb.getByUsername(req.user.username);
+  if (!user && CONFIG.skipAuth) {
+    user = userDb.getOrCreate(req.user.username, req.user.username);
+  }
+  return user;
+}
+
+function ensureAgentSecret(user) {
+  if (user?.agent_secret) return user.agent_secret;
+  return userDb.resetAgentSecret(user.id);
+}
+
+/**
+ * Register user profile, agent secret, and admin user management routes.
+ */
+export function registerUserRoutes(app, { requireAuth, requireAdmin }) {
+  // Get my profile
+  app.get('/api/user/profile', requireAuth, (req, res) => {
+    try {
+      const user = loadCurrentUser(req);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+      res.json({
+        username: user.username,
+        displayName: user.display_name,
+        email: user.email,
+        role: user.role === 'admin' ? 'admin' : 'pro',
+        createdAt: user.created_at,
+        // hasPassword lets the UI distinguish "change password" (current pwd
+        // required) from "set password for the first time" (SSO-only users).
+        hasPassword: !!user.password_hash
+      });
+    } catch (err) {
+      console.error('Get profile error:', err);
+      res.status(500).json({ error: 'Failed to get profile' });
+    }
+  });
+
+  // Update my profile (password and/or email)
+  app.put('/api/user/profile', requireAuth, async (req, res) => {
+    try {
+      const user = userDb.getByUsername(req.user.username);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+
+      const { currentPassword, newPassword, email } = req.body;
+
+      // Two cases:
+      //   (a) User already has a password → must verify currentPassword.
+      //   (b) User has no password (e.g. SSO-only) and is setting one for the
+      //       first time → currentPassword is not required, but they must
+      //       supply newPassword. This unblocks logout-then-username-login
+      //       for SSO users.
+      const isSettingFirstPassword = !user.password_hash && !!newPassword;
+
+      if (!isSettingFirstPassword) {
+        if (!currentPassword) {
+          return res.status(400).json({ error: 'Current password is required' });
+        }
+        if (!user.password_hash) {
+          // No password yet, and no newPassword in this request → nothing valid to do.
+          return res.status(400).json({ error: 'No password is set; supply newPassword to set one.' });
+        }
+        const bcryptModule = await import('bcrypt');
+        const passwordValid = await bcryptModule.default.compare(currentPassword, user.password_hash);
+        if (!passwordValid) {
+          return res.status(403).json({ error: 'Current password is incorrect' });
+        }
+      }
+
+      if (newPassword) {
+        if (newPassword.length < 6) {
+          return res.status(400).json({ error: 'New password must be at least 6 characters' });
+        }
+        const newHash = await hashPassword(newPassword);
+        userDb.updatePassword(user.id, newHash);
+      }
+
+      if (email !== undefined) {
+        userDb.updateEmail(user.id, email || null);
+      }
+
+      res.json({ success: true });
+    } catch (err) {
+      console.error('Update profile error:', err);
+      res.status(500).json({ error: 'Failed to update profile' });
+    }
+  });
+
+  // Permanently delete my account.
+  // Requires either currentPassword (for password users) OR confirms !hasPassword
+  // for SSO-only users (in which case the body must include `confirm: 'DELETE'`).
+  app.delete('/api/user/me', requireAuth, async (req, res) => {
+    try {
+      const user = userDb.getByUsername(req.user.username);
+      if (!user) return res.status(404).json({ error: 'User not found' });
+
+      const { currentPassword, confirm } = req.body || {};
+
+      if (user.password_hash) {
+        if (!currentPassword) {
+          return res.status(400).json({ error: 'Current password is required' });
+        }
+        const bcryptModule = await import('bcrypt');
+        const ok = await bcryptModule.default.compare(currentPassword, user.password_hash);
+        if (!ok) return res.status(403).json({ error: 'Current password is incorrect' });
+      } else {
+        // SSO-only: require explicit confirmation string to prevent accidental deletion.
+        if (confirm !== 'DELETE') {
+          return res.status(400).json({ error: 'Confirmation required (confirm: "DELETE")' });
+        }
+      }
+
+      const removed = userDb.deleteUser(user.id);
+      if (!removed) return res.status(404).json({ error: 'User not found or already deleted' });
+
+      // Best-effort: revoke every active JWT belonging to this user so any
+      // open tabs can't keep talking to the API.
+      try {
+        for (const [token, info] of activeSessions.entries()) {
+          if (info && info.username === user.username) {
+            activeSessions.delete(token);
+            revokedTokens.add(token);
+          }
+        }
+      } catch {}
+
+      res.json({ success: true });
+    } catch (err) {
+      console.error('Delete user error:', err);
+      res.status(500).json({ error: 'Failed to delete account' });
+    }
+  });
+
+  // Get my agent secret
+  app.get('/api/user/agent-secret', requireAuth, (req, res) => {
+    try {
+      const user = loadCurrentUser(req);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+      const agentSecret = ensureAgentSecret(user);
+      res.json({ agentSecret });
+    } catch (err) {
+      console.error('Get agent secret error:', err);
+      res.status(500).json({ error: 'Failed to get agent secret' });
+    }
+  });
+
+  // Reset my agent secret
+  app.post('/api/user/agent-secret/reset', requireAuth, (req, res) => {
+    try {
+      const user = loadCurrentUser(req);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+      const newSecret = userDb.resetAgentSecret(user.id);
+      res.json({ agentSecret: newSecret });
+    } catch (err) {
+      console.error('Reset agent secret error:', err);
+      res.status(500).json({ error: 'Failed to reset agent secret' });
+    }
+  });
+
+  // Admin: list all users
+  app.get('/api/users', requireAuth, requireAdmin, (req, res) => {
+    try {
+      const users = userDb.getAll().map(sanitizeUser);
+      res.json({ users });
+    } catch (e) {
+      console.error('Failed to get users:', e.message);
+      res.status(500).json({ error: 'Failed to get users' });
+    }
+  });
+
+  // Admin: get user by id
+  app.get('/api/users/:id', requireAuth, requireAdmin, (req, res) => {
+    try {
+      const user = userDb.get(req.params.id);
+      if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+      }
+      res.json({ user: sanitizeUser(user) });
+    } catch (e) {
+      console.error('Failed to get user:', e.message);
+      res.status(500).json({ error: 'Failed to get user' });
+    }
+  });
+
+  // Admin: get user's sessions
+  app.get('/api/users/:id/sessions', requireAuth, requireAdmin, (req, res) => {
+    const limit = parseInt(req.query.limit, 10) || 50;
+    const agentId = req.query.agentId;
+    try {
+      const sessions = agentId
+        ? sessionDb.getByUserAndAgent(req.params.id, agentId, limit)
+        : sessionDb.getByUser(req.params.id, limit);
+      res.json({ sessions: sessions.map(transformSession) });
+    } catch (e) {
+      console.error('Failed to get user sessions:', e.message);
+      res.status(500).json({ error: 'Failed to get user sessions' });
+    }
+  });
+}

package/local-runtime/server/totp.js

@@ -0,0 +1,74 @@
+import speakeasy from 'speakeasy';
+import QRCode from 'qrcode';
+import { CONFIG } from './config.js';
+
+/**
+ * Generate a new TOTP secret for a user
+ * @returns {string} Base32-encoded secret
+ */
+export function generateTotpSecret() {
+  const secret = speakeasy.generateSecret({ length: 20 });
+  return secret.base32;
+}
+
+/**
+ * Generate otpauth URI for QR code
+ * @param {string} username - User's username
+ * @param {string} secret - Base32-encoded TOTP secret
+ * @returns {string} otpauth URI
+ */
+export function generateTotpUri(username, secret) {
+  const issuer = CONFIG.totp?.issuer || 'Claude Web Chat';
+  return speakeasy.otpauthURL({
+    secret: secret,
+    label: username,
+    issuer: issuer,
+    encoding: 'base32'
+  });
+}
+
+/**
+ * Generate QR code as data URL
+ * @param {string} username - User's username
+ * @param {string} secret - Base32-encoded TOTP secret
+ * @returns {Promise<string>} QR code as data URL
+ */
+export async function generateTotpQRCode(username, secret) {
+  const uri = generateTotpUri(username, secret);
+  return QRCode.toDataURL(uri, {
+    width: 256,
+    margin: 2,
+    color: {
+      dark: '#000000',
+      light: '#ffffff'
+    }
+  });
+}
+
+/**
+ * Verify a TOTP code
+ * @param {string} token - 6-digit TOTP code from user
+ * @param {string} secret - Base32-encoded TOTP secret
+ * @returns {boolean} Whether the code is valid
+ */
+export function verifyTotpCode(token, secret) {
+  try {
+    return speakeasy.totp.verify({
+      secret: secret,
+      encoding: 'base32',
+      token: token,
+      window: CONFIG.totp?.window || 1
+    });
+  } catch (err) {
+    console.error('TOTP verification error:', err.message);
+    return false;
+  }
+}
+
+/**
+ * Check if TOTP is globally enabled
+ * @returns {boolean}
+ */
+export function isTotpEnabled() {
+  return CONFIG.totp?.enabled !== false;
+}

package/local-runtime/server/work-item-attachment-policy.js

@@ -0,0 +1,56 @@
+import { extname } from 'node:path';
+
+export const MAX_WORK_ITEM_ATTACHMENTS = 10;
+export const MAX_WORK_ITEM_ATTACHMENT_BYTES = 50 * 1024 * 1024;
+export const MAX_WORK_ITEM_INLINE_BYTES = 10 * 1024 * 1024;
+
+const IMAGE_EXTENSIONS_BY_MIME = new Map([
+  ['image/png', new Set(['.png'])],
+  ['image/jpeg', new Set(['.jpg', '.jpeg', '.jfif'])],
+  ['image/gif', new Set(['.gif'])],
+  ['image/webp', new Set(['.webp'])],
+]);
+
+const TEXT_EXTENSIONS = new Set([
+  '.txt', '.md', '.markdown', '.json', '.jsonl', '.csv', '.xml', '.yaml', '.yml',
+  '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.css', '.html', '.htm', '.py',
+  '.sh', '.zsh', '.bash', '.sql', '.toml', '.ini', '.conf', '.log',
+]);
+
+const TEXT_MIME_TYPES = new Set([
+  'application/json',
+  'application/ld+json',
+  'application/javascript',
+  'application/x-javascript',
+  'application/xml',
+  'application/yaml',
+  'application/x-yaml',
+]);
+
+export function classifyWorkItemAttachment(name, mimeType) {
+  const normalizedMime = String(mimeType || 'application/octet-stream').trim().toLowerCase();
+  const extension = extname(String(name || '')).toLowerCase();
+  if (extension === '.pdf') return normalizedMime === 'application/pdf' ? 'pdf' : null;
+
+  const imageExtensions = IMAGE_EXTENSIONS_BY_MIME.get(normalizedMime);
+  if (imageExtensions) return imageExtensions.has(extension) ? 'image' : null;
+
+  const textMime = normalizedMime.startsWith('text/') || TEXT_MIME_TYPES.has(normalizedMime);
+  if (textMime) return !extension || TEXT_EXTENSIONS.has(extension) ? 'text' : null;
+  if (TEXT_EXTENSIONS.has(extension) && normalizedMime === 'application/octet-stream') return 'text';
+  return null;
+}
+
+export function assertSupportedWorkItemAttachment(name, mimeType) {
+  const kind = classifyWorkItemAttachment(name, mimeType);
+  if (!kind) {
+    throw new Error('Unsupported WorkItem attachment type; use an image, PDF, or text-based file');
+  }
+  return kind;
+}
+
+export function assertWorkItemAttachmentSize(size) {
+  if (!Number.isSafeInteger(size) || size < 0 || size > MAX_WORK_ITEM_INLINE_BYTES) {
+    throw new Error(`WorkItem attachment exceeds ${MAX_WORK_ITEM_INLINE_BYTES} bytes`);
+  }
+}