@yeaft/webchat-agent 1.0.188 → 1.0.189

package/local-runtime/server/auth/providers/github.js

@@ -0,0 +1,82 @@
+/**
+ * GitHub OAuth2 provider — server-side code flow.
+ * Endpoint: https://github.com/login/oauth/authorize and /access_token
+ * Profile API: https://api.github.com/user (requires User-Agent header)
+ */
+import { CONFIG } from '../../config.js';
+
+export const name = 'github';
+
+export function isEnabled() {
+  const c = CONFIG.sso?.github;
+  return !!(c?.enabled && c.clientId && c.clientSecret && c.callbackUrl);
+}
+
+export function getAuthorizeUrl(state /* , intent */) {
+  const c = CONFIG.sso.github;
+  const url = new URL('https://github.com/login/oauth/authorize');
+  url.searchParams.set('client_id', c.clientId);
+  url.searchParams.set('redirect_uri', c.callbackUrl);
+  url.searchParams.set('scope', 'read:user user:email');
+  url.searchParams.set('state', state);
+  url.searchParams.set('allow_signup', 'true');
+  return url.toString();
+}
+
+export async function exchangeCode(code /* , state */) {
+  const c = CONFIG.sso.github;
+  // Step 1: code -> access_token
+  const tokRes = await fetch('https://github.com/login/oauth/access_token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
+    body: JSON.stringify({
+      client_id: c.clientId,
+      client_secret: c.clientSecret,
+      code,
+      redirect_uri: c.callbackUrl
+    })
+  });
+  if (!tokRes.ok) throw new Error(`GitHub token exchange failed: ${tokRes.status}`);
+  const tok = await tokRes.json();
+  if (!tok.access_token) throw new Error(`GitHub token response missing access_token: ${tok.error || ''}`);
+
+  // Step 2: access_token -> profile
+  const userRes = await fetch('https://api.github.com/user', {
+    headers: {
+      'Authorization': `Bearer ${tok.access_token}`,
+      'Accept': 'application/vnd.github+json',
+      'User-Agent': 'yeaft-webchat'
+    }
+  });
+  if (!userRes.ok) throw new Error(`GitHub /user failed: ${userRes.status}`);
+  const profile = await userRes.json();
+  if (!profile.id) throw new Error('GitHub /user missing id');
+
+  let email = profile.email;
+  if (!email) {
+    // Email may be private — fetch /user/emails to find primary verified.
+    try {
+      const emailRes = await fetch('https://api.github.com/user/emails', {
+        headers: {
+          'Authorization': `Bearer ${tok.access_token}`,
+          'Accept': 'application/vnd.github+json',
+          'User-Agent': 'yeaft-webchat'
+        }
+      });
+      if (emailRes.ok) {
+        const emails = await emailRes.json();
+        const primary = Array.isArray(emails) ? emails.find(e => e.primary && e.verified) : null;
+        if (primary) email = primary.email;
+      }
+    } catch { /* ignore */ }
+  }
+
+  return {
+    subject: String(profile.id),
+    email: email || null,
+    displayName: profile.name || profile.login || null,
+    raw: profile
+  };
+}
+
+export default { name, isEnabled, getAuthorizeUrl, exchangeCode };

package/local-runtime/server/auth/providers/google.js

@@ -0,0 +1,60 @@
+/**
+ * Google OIDC provider — server-side code flow.
+ * Endpoint: https://accounts.google.com/o/oauth2/v2/auth
+ * Token endpoint: https://oauth2.googleapis.com/token
+ * The id_token contains a stable `sub` (Google account id).
+ */
+import { CONFIG } from '../../config.js';
+
+export const name = 'google';
+
+export function isEnabled() {
+  const c = CONFIG.sso?.google;
+  return !!(c?.enabled && c.clientId && c.clientSecret && c.callbackUrl);
+}
+
+export function getAuthorizeUrl(state /* , intent */) {
+  const c = CONFIG.sso.google;
+  const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
+  url.searchParams.set('client_id', c.clientId);
+  url.searchParams.set('redirect_uri', c.callbackUrl);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('scope', 'openid email profile');
+  url.searchParams.set('state', state);
+  url.searchParams.set('access_type', 'online');
+  url.searchParams.set('prompt', 'select_account');
+  return url.toString();
+}
+
+export async function exchangeCode(code /* , state */) {
+  const c = CONFIG.sso.google;
+  const body = new URLSearchParams({
+    code,
+    client_id: c.clientId,
+    client_secret: c.clientSecret,
+    redirect_uri: c.callbackUrl,
+    grant_type: 'authorization_code'
+  });
+  const tokRes = await fetch('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body
+  });
+  if (!tokRes.ok) throw new Error(`Google token exchange failed: ${tokRes.status}`);
+  const tok = await tokRes.json();
+  if (!tok.id_token) throw new Error('Google token response missing id_token');
+
+  // Decode id_token payload (TLS to googleapis.com guarantees authenticity for
+  // this confidential-client server-side code flow).
+  const payload = JSON.parse(Buffer.from(tok.id_token.split('.')[1], 'base64url').toString());
+  if (!payload.sub) throw new Error('Google id_token missing sub');
+
+  return {
+    subject: payload.sub,
+    email: payload.email || null,
+    displayName: payload.name || payload.email || null,
+    raw: payload
+  };
+}
+
+export default { name, isEnabled, getAuthorizeUrl, exchangeCode };

package/local-runtime/server/auth/providers/microsoft.js

@@ -0,0 +1,71 @@
+/**
+ * Microsoft (Azure AD / Entra ID) provider — server-side OIDC code flow.
+ *
+ * Note: the existing `loginWithAad()` route (POST /api/auth/aad) using MSAL.js
+ * client-side popup is preserved for backwards compatibility. This file exposes
+ * the same provider under the new unified provider abstraction so binding +
+ * server-driven start/callback can reuse one code path.
+ */
+import { CONFIG, isAadEnabled } from '../../config.js';
+
+export const name = 'microsoft';
+
+export function isEnabled() {
+  return isAadEnabled();
+}
+
+function authority() {
+  return `https://login.microsoftonline.com/${CONFIG.aad.tenantId}`;
+}
+
+function callbackUrl() {
+  return process.env.SSO_MICROSOFT_CALLBACK_URL || `${CONFIG.aad.redirectBase || ''}/api/auth/sso/microsoft/callback`;
+}
+
+export function getAuthorizeUrl(state /* , intent */) {
+  const url = new URL(`${authority()}/oauth2/v2.0/authorize`);
+  url.searchParams.set('client_id', CONFIG.aad.clientId);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('redirect_uri', callbackUrl());
+  url.searchParams.set('response_mode', 'query');
+  url.searchParams.set('scope', 'openid profile email');
+  url.searchParams.set('state', state);
+  return url.toString();
+}
+
+export async function exchangeCode(code /* , state */) {
+  const tokenUrl = `${authority()}/oauth2/v2.0/token`;
+  const body = new URLSearchParams({
+    client_id: CONFIG.aad.clientId,
+    client_secret: process.env.AAD_CLIENT_SECRET || '',
+    code,
+    redirect_uri: callbackUrl(),
+    grant_type: 'authorization_code'
+  });
+  const tokRes = await fetch(tokenUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body
+  });
+  if (!tokRes.ok) {
+    throw new Error(`Microsoft token exchange failed: ${tokRes.status}`);
+  }
+  const tok = await tokRes.json();
+  if (!tok.id_token) throw new Error('Microsoft token response missing id_token');
+
+  // Decode payload (without verification — verification happens in aad.js for the
+  // legacy MSAL.js flow; for server-driven code flow we trust the token from the
+  // authority endpoint we just contacted over HTTPS).
+  const payload = JSON.parse(Buffer.from(tok.id_token.split('.')[1], 'base64url').toString());
+  const subject = payload.oid || payload.sub;
+  if (!subject) throw new Error('Microsoft id_token missing oid/sub');
+
+  return {
+    subject,
+    email: payload.preferred_username || payload.email || payload.upn || null,
+    displayName: payload.name || null,
+    raw: payload
+  };
+}
+
+export default { name, isEnabled, getAuthorizeUrl, exchangeCode };

package/local-runtime/server/auth/providers/types.js

@@ -0,0 +1,57 @@
+/**
+ * Provider abstraction shape (multi-provider SSO).
+ *
+ * Every provider implementation must export an object with this shape:
+ *
+ *   {
+ *     name: 'github',                      // unique identifier
+ *     isEnabled() => boolean,              // gate routes + UI
+ *     getAuthorizeUrl(state, intent) => string,
+ *     exchangeCode(code, state) => Promise<{ subject, email, displayName, raw }>
+ *   }
+ *
+ * `subject` MUST be a stable provider-side user id (oid/sub/unionid/user_id).
+ * `state` is opaque to the provider — generated/validated by oauth-flow.js.
+ */
+
+import * as microsoft from './microsoft.js';
+import * as github from './github.js';
+import * as google from './google.js';
+import * as wechat from './wechat.js';
+import * as alipay from './alipay.js';
+
+const REGISTRY = {
+  microsoft: microsoft.default || microsoft,
+  github: github.default || github,
+  google: google.default || google,
+  wechat: wechat.default || wechat,
+  alipay: alipay.default || alipay
+};
+
+/**
+ * Look up a provider implementation by name.
+ * Returns null if the name is unknown.
+ */
+export function getProvider(name) {
+  return REGISTRY[name] || null;
+}
+
+/**
+ * List all known provider names (whether enabled or not).
+ */
+export function listProviderNames() {
+  return Object.keys(REGISTRY);
+}
+
+/**
+ * List the names of all currently-enabled providers.
+ */
+export function listEnabledProviders() {
+  return Object.entries(REGISTRY)
+    .filter(([, p]) => {
+      try { return p.isEnabled && p.isEnabled(); } catch { return false; }
+    })
+    .map(([name]) => name);
+}
+
+export default REGISTRY;

package/local-runtime/server/auth/providers/wechat.js

@@ -0,0 +1,68 @@
+/**
+ * WeChat Open Platform — PC web 扫码 (qrconnect) flow.
+ *
+ * Authorize URL: https://open.weixin.qq.com/connect/qrconnect
+ * Token URL:     https://api.weixin.qq.com/sns/oauth2/access_token
+ * UserInfo URL:  https://api.weixin.qq.com/sns/userinfo
+ *
+ * `subject` is `unionid` if available (stable across an open-platform account
+ * suite), otherwise `openid`. Note: WeChat's `state` round-trips back as a
+ * regular query param, same as standard OAuth2.
+ */
+import { CONFIG } from '../../config.js';
+
+export const name = 'wechat';
+
+export function isEnabled() {
+  const c = CONFIG.sso?.wechat;
+  return !!(c?.enabled && c.appId && c.appSecret && c.callbackUrl);
+}
+
+export function getAuthorizeUrl(state /* , intent */) {
+  const c = CONFIG.sso.wechat;
+  const url = new URL('https://open.weixin.qq.com/connect/qrconnect');
+  url.searchParams.set('appid', c.appId);
+  url.searchParams.set('redirect_uri', c.callbackUrl);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('scope', 'snsapi_login');
+  url.searchParams.set('state', state);
+  // WeChat requires the fragment '#wechat_redirect' literally appended.
+  return `${url.toString()}#wechat_redirect`;
+}
+
+export async function exchangeCode(code /* , state */) {
+  const c = CONFIG.sso.wechat;
+  const tokenUrl = new URL('https://api.weixin.qq.com/sns/oauth2/access_token');
+  tokenUrl.searchParams.set('appid', c.appId);
+  tokenUrl.searchParams.set('secret', c.appSecret);
+  tokenUrl.searchParams.set('code', code);
+  tokenUrl.searchParams.set('grant_type', 'authorization_code');
+
+  const tokRes = await fetch(tokenUrl.toString());
+  if (!tokRes.ok) throw new Error(`WeChat token exchange failed: ${tokRes.status}`);
+  const tok = await tokRes.json();
+  if (tok.errcode) throw new Error(`WeChat token error ${tok.errcode}: ${tok.errmsg || ''}`);
+  if (!tok.access_token || !tok.openid) throw new Error('WeChat token response missing access_token/openid');
+
+  // Step 2: pull profile (returns nickname, headimgurl, unionid if linked)
+  const userUrl = new URL('https://api.weixin.qq.com/sns/userinfo');
+  userUrl.searchParams.set('access_token', tok.access_token);
+  userUrl.searchParams.set('openid', tok.openid);
+  userUrl.searchParams.set('lang', 'zh_CN');
+  const userRes = await fetch(userUrl.toString());
+  if (!userRes.ok) throw new Error(`WeChat /userinfo failed: ${userRes.status}`);
+  const profile = await userRes.json();
+  if (profile.errcode) throw new Error(`WeChat /userinfo error ${profile.errcode}: ${profile.errmsg || ''}`);
+
+  const subject = profile.unionid || profile.openid || tok.unionid || tok.openid;
+  if (!subject) throw new Error('WeChat profile missing unionid/openid');
+
+  return {
+    subject,
+    email: null, // WeChat does not provide email
+    displayName: profile.nickname || null,
+    raw: profile
+  };
+}
+
+export default { name, isEnabled, getAuthorizeUrl, exchangeCode };

package/local-runtime/server/auth/register.js

@@ -0,0 +1,91 @@
+import bcrypt from 'bcrypt';
+import { CONFIG } from '../config.js';
+import { generateSessionKey } from '../encryption.js';
+import { userDb, invitationDb } from '../database.js';
+
+/**
+ * Verify agent connection using per-user agent_secret or global fallback
+ */
+export function verifyAgent(secret) {
+  // 1. Try per-user agent secret
+  const user = userDb.getUserByAgentSecret(secret);
+  if (user) {
+    const sessionKey = generateSessionKey();
+    return {
+      valid: true,
+      sessionKey,
+      userId: user.id,
+      username: user.username
+    };
+  }
+
+  // 2. Fallback: global AGENT_SECRET (backward compat)
+  if (CONFIG.agentSecret && secret === CONFIG.agentSecret) {
+    const sessionKey = generateSessionKey();
+    return { valid: true, sessionKey, userId: null, username: null };
+  }
+
+  return { valid: false };
+}
+
+/**
+ * Register a new user via invitation code
+ */
+export async function register(username, password, email, invitationCode) {
+  if (CONFIG.skipAuth) {
+    return { success: false, error: 'Registration disabled in development mode' };
+  }
+
+  if (!username || username.length < 2 || username.length > 32) {
+    return { success: false, error: 'Username must be 2-32 characters' };
+  }
+  if (!/^[a-zA-Z0-9_-]+$/.test(username)) {
+    return { success: false, error: 'Username can only contain letters, numbers, hyphens and underscores' };
+  }
+  if (!password || password.length < 6) {
+    return { success: false, error: 'Password must be at least 6 characters' };
+  }
+  // TODO: restore invitation code requirement — currently disabled for open registration
+  let invitation = null;
+  if (invitationCode) {
+    invitation = invitationDb.get(invitationCode);
+    if (!invitation) {
+      return { success: false, error: 'Invalid invitation code' };
+    }
+    if (invitation.used_by) {
+      return { success: false, error: 'Invitation code already used' };
+    }
+    if (invitation.expires_at < Date.now()) {
+      return { success: false, error: 'Invitation code has expired' };
+    }
+  }
+
+  const existing = userDb.getByUsername(username);
+  if (existing && existing.password_hash) {
+    return { success: false, error: 'Username already exists' };
+  }
+
+  const passwordHash = await bcrypt.hash(password, 10);
+  // TODO: restore invitation-based role assignment — currently defaults to 'pro'
+  const role = invitation ? (invitation.role === 'admin' ? 'admin' : 'pro') : 'pro';
+
+  let user;
+  if (existing && !existing.password_hash) {
+    userDb.updatePassword(existing.id, passwordHash);
+    if (email) userDb.updateEmail(existing.id, email);
+    userDb.updateRole(existing.id, role);
+    if (!existing.agent_secret) {
+      userDb.resetAgentSecret(existing.id);
+    }
+    user = existing;
+  } else {
+    user = userDb.createFull(username, passwordHash, email || null, role);
+  }
+
+  // TODO: restore invitation code consumption — only consume if code was provided
+  if (invitationCode && invitation) {
+    invitationDb.use(invitationCode, user.id);
+  }
+
+  return { success: true, message: 'Registration successful' };
+}

package/local-runtime/server/auth/session-store.js

@@ -0,0 +1,57 @@
+import jwt from 'jsonwebtoken';
+import { CONFIG } from '../config.js';
+
+// Store pending verifications (tempToken -> { username, code, expiresAt, sessionKey })
+export const pendingVerifications = new Map();
+
+// Store pending TOTP verifications (tempToken -> { username, sessionKey, expiresAt })
+export const pendingTotpVerifications = new Map();
+
+// Store pending TOTP setup (setupToken -> { username, secret, sessionKey, expiresAt })
+export const pendingTotpSetup = new Map();
+
+// Store active sessions (token -> { username, sessionKey })
+export const activeSessions = new Map();
+
+// Store revoked tokens
+export const revokedTokens = new Set();
+
+/**
+ * Clean up expired pending verifications
+ */
+function cleanupPendingVerifications() {
+  const now = Date.now();
+  for (const [token, data] of pendingVerifications.entries()) {
+    if (data.expiresAt < now) {
+      pendingVerifications.delete(token);
+    }
+  }
+  for (const [token, data] of pendingTotpVerifications.entries()) {
+    if (data.expiresAt < now) {
+      pendingTotpVerifications.delete(token);
+    }
+  }
+  for (const [token, data] of pendingTotpSetup.entries()) {
+    if (data.expiresAt < now) {
+      pendingTotpSetup.delete(token);
+    }
+  }
+  // 清理过期的 activeSessions 和 revokedTokens（JWT 已过期的）
+  for (const [token] of activeSessions.entries()) {
+    try {
+      jwt.verify(token, CONFIG.jwtSecret);
+    } catch {
+      activeSessions.delete(token);
+    }
+  }
+  for (const token of revokedTokens) {
+    try {
+      jwt.verify(token, CONFIG.jwtSecret);
+    } catch {
+      revokedTokens.delete(token);
+    }
+  }
+}
+
+// Run cleanup every minute
+setInterval(cleanupPendingVerifications, 60000);

package/local-runtime/server/auth/token.js

@@ -0,0 +1,85 @@
+import { randomUUID } from 'crypto';
+import jwt from 'jsonwebtoken';
+import { CONFIG, getUserByUsername } from '../config.js';
+import { generateSessionKey } from '../encryption.js';
+import { activeSessions, revokedTokens } from './session-store.js';
+
+/**
+ * Verify JWT token and get session data.
+ *
+ * Returns `exp` (seconds since epoch, from JWT spec) so callers can decide
+ * whether to issue a sliding-renewal token.
+ */
+export function issueSessionToken(username) {
+  return jwt.sign({ username, jti: randomUUID() }, CONFIG.jwtSecret, { expiresIn: CONFIG.jwtExpiresIn });
+}
+
+export function verifyToken(token) {
+  try {
+    const decoded = jwt.verify(token, CONFIG.jwtSecret);
+
+    if (revokedTokens.has(token)) {
+      return { valid: false };
+    }
+
+    let session = activeSessions.get(token);
+
+    // Token 有效但 session 不存在（如服务器重启后），重建 session
+    if (!session) {
+      const sessionKey = generateSessionKey();
+      session = { username: decoded.username, sessionKey };
+      activeSessions.set(token, session);
+    }
+
+    const user = getUserByUsername(decoded.username);
+
+    return {
+      valid: true,
+      username: decoded.username,
+      sessionKey: session.sessionKey,
+      role: user?.role === 'admin' ? 'admin' : 'pro',
+      exp: decoded.exp, // seconds since epoch
+      type: decoded.type // undefined for full session tokens; 'temp'/'totp'/'totp-setup' otherwise
+    };
+  } catch (err) {
+    return { valid: false };
+  }
+}
+
+/**
+ * If `currentToken`'s remaining lifetime is below CONFIG.jwtRenewThresholdMs,
+ * mint a fresh token for the same user, copy the session over, and return it.
+ * Returns `null` if the current token is still fresh enough to keep using.
+ *
+ * The old token is intentionally NOT revoked — browsers fire parallel
+ * requests with the same Authorization header, and revoking would 401 every
+ * sibling request that races the renewal. The old token expires naturally on
+ * its original timeline (< jwtRenewThresholdMs from now), so the replay
+ * window is bounded by the threshold.
+ *
+ * Designed to be idempotent: missing exp or far-future exp is a no-op.
+ */
+export function maybeRenewToken(currentToken, expSeconds, username) {
+  if (!expSeconds) return null;
+  const remainingMs = expSeconds * 1000 - Date.now();
+  if (remainingMs >= CONFIG.jwtRenewThresholdMs) return null;
+  if (remainingMs <= 0) return null; // expired tokens shouldn't reach here
+
+  const newToken = issueSessionToken(username);
+  const session = activeSessions.get(currentToken);
+  if (session) {
+    activeSessions.set(newToken, session);
+    // Keep the old session entry intact so concurrent in-flight requests
+    // bearing the old token continue to find their session. It will be
+    // garbage-collected when the old token's natural exp passes.
+  }
+  return newToken;
+}
+
+/**
+ * Invalidate a session (logout)
+ */
+export function logout(token) {
+  activeSessions.delete(token);
+  revokedTokens.add(token);
+}