@yeaft/webchat-agent 1.0.188 → 1.0.190

package/local-runtime/server/auth/login.js

@@ -0,0 +1,156 @@
+import bcrypt from 'bcrypt';
+import jwt from 'jsonwebtoken';
+import { CONFIG, getUserByUsername, isEmailConfigured, isTotpEnabled } from '../config.js';
+import { issueSessionToken } from './token.js';
+import { sendVerificationCode } from '../email.js';
+import { generateSessionKey, encodeKey } from '../encryption.js';
+import { generateTotpSecret, generateTotpQRCode } from '../totp.js';
+import { pendingVerifications, pendingTotpVerifications, pendingTotpSetup, activeSessions } from './session-store.js';
+import { generateVerificationCode, maskEmail } from './utils.js';
+
+/**
+ * Helper: complete login and return token + sessionKey + role
+ */
+export function completeLogin(username, sessionKey, role) {
+  const token = issueSessionToken(username);
+  activeSessions.set(token, { username, sessionKey });
+  return {
+    success: true,
+    token,
+    sessionKey: encodeKey(sessionKey),
+    role: role === 'admin' ? 'admin' : 'pro',
+    needTotpCode: false,
+    needTotpSetup: false,
+    needEmailCode: false
+  };
+}
+
+/**
+ * Authenticate user with username and password (Step 1)
+ */
+export async function loginStep1(username, password) {
+  const user = getUserByUsername(username);
+
+  if (!user) {
+    await bcrypt.compare(password, '$2b$10$invalidhashfortiminginvalidhash');
+    return { success: false, error: 'Invalid username or password' };
+  }
+
+  if (!user.passwordHash) {
+    await bcrypt.compare(password, '$2b$10$invalidhashfortiminginvalidhash');
+    return { success: false, error: 'Invalid username or password' };
+  }
+
+  const passwordValid = await bcrypt.compare(password, user.passwordHash);
+  if (!passwordValid) {
+    return { success: false, error: 'Invalid username or password' };
+  }
+
+  const sessionKey = generateSessionKey();
+  const role = user.role === 'admin' ? 'admin' : 'pro';
+
+  // Check if TOTP is enabled for this user
+  if (user.totpEnabled && user.totpSecret) {
+    const tempToken = jwt.sign({ username, type: 'totp' }, CONFIG.jwtSecret, { expiresIn: CONFIG.tempTokenExpiresIn });
+
+    pendingTotpVerifications.set(tempToken, {
+      username,
+      sessionKey,
+      role,
+      expiresAt: Date.now() + CONFIG.emailCodeExpiresIn
+    });
+
+    return {
+      success: true,
+      tempToken,
+      needTotpCode: true,
+      needTotpSetup: false,
+      needEmailCode: false
+    };
+  }
+
+  // Check if TOTP setup is required
+  if (isTotpEnabled() && !user.totpSecret) {
+    const tempSecret = generateTotpSecret();
+    const setupToken = jwt.sign({ username, type: 'totp-setup' }, CONFIG.jwtSecret, { expiresIn: '15m' });
+
+    pendingTotpSetup.set(setupToken, {
+      username,
+      secret: tempSecret,
+      sessionKey,
+      role,
+      expiresAt: Date.now() + 15 * 60 * 1000
+    });
+
+    const qrCode = await generateTotpQRCode(username, tempSecret);
+
+    return {
+      success: true,
+      setupToken,
+      needTotpSetup: true,
+      totpSecret: tempSecret,
+      qrCode,
+      needTotpCode: false,
+      needEmailCode: false
+    };
+  }
+
+  // No TOTP - proceed to email verification or complete login
+  if (!isEmailConfigured()) {
+    return completeLogin(username, sessionKey, role);
+  }
+
+  // Need email verification
+  const code = generateVerificationCode();
+  const tempToken = jwt.sign({ username, type: 'temp' }, CONFIG.jwtSecret, { expiresIn: CONFIG.tempTokenExpiresIn });
+
+  pendingVerifications.set(tempToken, {
+    username,
+    code,
+    email: user.email,
+    sessionKey,
+    role,
+    expiresAt: Date.now() + CONFIG.emailCodeExpiresIn
+  });
+
+  try {
+    await sendVerificationCode(user.email, code, username);
+  } catch (err) {
+    console.error('Failed to send verification email:', err.message);
+    pendingVerifications.delete(tempToken);
+    return { success: false, error: 'Failed to send verification email' };
+  }
+
+  return {
+    success: true,
+    tempToken,
+    needTotpCode: false,
+    needTotpSetup: false,
+    needEmailCode: true,
+    emailHint: maskEmail(user.email)
+  };
+}
+
+/**
+ * Verify email code (Step 2)
+ */
+export function loginStep2(tempToken, code) {
+  const pending = pendingVerifications.get(tempToken);
+
+  if (!pending) {
+    return { success: false, error: 'Invalid or expired verification token' };
+  }
+
+  if (Date.now() > pending.expiresAt) {
+    pendingVerifications.delete(tempToken);
+    return { success: false, error: 'Verification code has expired' };
+  }
+
+  if (pending.code !== code) {
+    return { success: false, error: 'Invalid verification code' };
+  }
+
+  pendingVerifications.delete(tempToken);
+
+  return completeLogin(pending.username, pending.sessionKey, pending.role);
+}

package/local-runtime/server/auth/oauth-flow.js

@@ -0,0 +1,277 @@
+/**
+ * Shared OAuth start/callback flow used by all providers.
+ *
+ * Responsibilities:
+ *   - Generate a CSRF-safe `state` token, remember `intent` (login | bind) and
+ *     the binding user (if intent='bind') for the callback to consume.
+ *   - On callback, exchange code → identity, then either log the user in or
+ *     attach a new user_identities row, enforcing the conflict policy.
+ *
+ * The state store is in-memory and short-lived (10 minute TTL). It does not
+ * survive a server restart — that's fine: a stale OAuth attempt would just
+ * fail validation and the user would retry.
+ */
+import { randomBytes } from 'crypto';
+import { CONFIG } from '../config.js';
+import { userDb, identityDb } from '../database.js';
+import { generateSessionKey } from '../encryption.js';
+import { completeLogin } from './login.js';
+import { getProvider } from './providers/types.js';
+
+const STATE_TTL_MS = 10 * 60 * 1000;
+const _stateStore = new Map(); // state → { provider, intent, userId, createdAt, mode }
+
+// QR-mode pending-result store. When a QR-flow callback completes, we don't
+// redirect the (mobile) browser into the SPA — instead we park the result
+// here keyed by `state`, and the PC frontend polls /api/auth/sso/poll/:state
+// to retrieve it. Entries are auto-GC'd after the same TTL.
+const _pendingResults = new Map(); // state → { kind, ...result, createdAt }
+
+function _gcStates() {
+  const now = Date.now();
+  for (const [k, v] of _stateStore.entries()) {
+    if (now - v.createdAt > STATE_TTL_MS) _stateStore.delete(k);
+  }
+  for (const [k, v] of _pendingResults.entries()) {
+    if (now - v.createdAt > STATE_TTL_MS) _pendingResults.delete(k);
+  }
+}
+
+/**
+ * Allocate a state token. `intent` is either 'login' (logged-out user) or
+ * 'bind' (logged-in user attaching another identity). For 'bind', `userId`
+ * MUST be supplied so the callback knows which internal account to attach to.
+ *
+ * `mode` defaults to 'redirect' (the user's browser is the one going to the
+ * provider). Set it to 'qr' for the QR-scan flow where the callback fires on
+ * a different device (the user's phone) and the original PC frontend polls
+ * for completion.
+ */
+export function createState({ provider, intent = 'login', userId = null, mode = 'redirect' }) {
+  _gcStates();
+  const state = randomBytes(24).toString('hex');
+  _stateStore.set(state, { provider, intent, userId, mode, createdAt: Date.now() });
+  return state;
+}
+
+/**
+ * Consume a state token, returning the stored metadata or null if invalid.
+ * One-shot: a valid state is removed once consumed.
+ */
+export function consumeState(state, expectedProvider) {
+  if (!state) return null;
+  const entry = _stateStore.get(state);
+  if (!entry) return null;
+  _stateStore.delete(state);
+  if (Date.now() - entry.createdAt > STATE_TTL_MS) return null;
+  if (entry.provider !== expectedProvider) return null;
+  return entry;
+}
+
+/**
+ * Build the provider's authorize redirect URL.
+ * Throws if the provider is unknown or disabled.
+ */
+export function buildAuthorizeUrl({ provider, intent = 'login', userId = null, mode = 'redirect' }) {
+  const impl = getProvider(provider);
+  if (!impl) throw new Error(`Unknown provider: ${provider}`);
+  if (!impl.isEnabled()) throw new Error(`Provider not enabled: ${provider}`);
+  const state = createState({ provider, intent, userId, mode });
+  const url = impl.getAuthorizeUrl(state, intent);
+  return { url, state };
+}
+
+/**
+ * Park a completed QR-flow result so the PC frontend can poll for it.
+ */
+export function storePendingResult(state, result) {
+  _pendingResults.set(state, { ...result, createdAt: Date.now() });
+}
+
+/**
+ * Read (and delete on success) a parked QR-flow result.
+ * Returns null if not found / expired.
+ */
+export function consumePendingResult(state) {
+  _gcStates();
+  const r = _pendingResults.get(state);
+  if (!r) return null;
+  // Only one-shot for terminal kinds; pending shouldn't reach here.
+  _pendingResults.delete(state);
+  return r;
+}
+
+/**
+ * Inspect whether a state was issued in QR mode without consuming it.
+ * Used by the callback handler to decide whether to redirect or park-and-stop.
+ */
+export function peekStateMode(state) {
+  const e = _stateStore.get(state);
+  return e ? e.mode : null;
+}
+
+/**
+ * Sanitize an arbitrary string into a username candidate.
+ *
+ * We allow Unicode letters/numbers (so a Chinese nickname like "张三" comes
+ * through intact instead of being collapsed to "__"), plus underscore and
+ * hyphen. Anything else (whitespace, emoji, punctuation) is replaced with
+ * underscore. Falls back to 'sso_user' if nothing usable remains.
+ */
+function sanitizeUsername(raw) {
+  const cleaned = String(raw || '').replace(/[^\p{L}\p{N}_-]/gu, '_').slice(0, 32);
+  // Strip leading/trailing underscores so we don't end up with "_张三_".
+  const trimmed = cleaned.replace(/^_+|_+$/g, '');
+  return trimmed || 'sso_user';
+}
+
+/**
+ * Pick a unique username close to `base`, appending _1, _2, ... if needed.
+ */
+function uniqueUsername(base) {
+  let candidate = base;
+  let suffix = 1;
+  while (userDb.getByUsername(candidate)) {
+    candidate = `${base}_${suffix++}`;
+    if (suffix > 1000) throw new Error('Could not allocate username');
+  }
+  return candidate;
+}
+
+/**
+ * Pick the per-provider config for autoCreateUser/defaultRole. Microsoft
+ * reuses CONFIG.aad; the rest live under CONFIG.sso[provider].
+ */
+function providerPolicy(provider) {
+  if (provider === 'microsoft') {
+    return {
+      autoCreateUser: CONFIG.aad?.autoCreateUser !== false,
+      defaultRole: CONFIG.aad?.defaultRole || 'pro'
+    };
+  }
+  const c = CONFIG.sso?.[provider] || {};
+  return {
+    autoCreateUser: c.autoCreateUser !== false,
+    defaultRole: c.defaultRole || 'pro'
+  };
+}
+
+/**
+ * Process a callback: validate state, exchange code, then either log in or
+ * bind. Returns one of:
+ *
+ *   { kind: 'login',  token, sessionKey, role }      — issue session JWT
+ *   { kind: 'bind',   provider }                     — binding succeeded for current user
+ *   { kind: 'error',  status, error }                — surface to the user
+ */
+export async function handleCallback({ provider, code, state }) {
+  const impl = getProvider(provider);
+  if (!impl) return { kind: 'error', status: 400, error: 'Unknown provider' };
+  if (!impl.isEnabled()) return { kind: 'error', status: 400, error: 'Provider not enabled' };
+
+  const stateEntry = consumeState(state, provider);
+  if (!stateEntry) return { kind: 'error', status: 400, error: 'Invalid or expired state' };
+
+  let identity;
+  try {
+    identity = await impl.exchangeCode(code, state);
+  } catch (err) {
+    console.error(`[SSO ${provider}] exchangeCode failed:`, err.message);
+    return { kind: 'error', status: 400, error: 'Failed to verify provider response' };
+  }
+  if (!identity || !identity.subject) {
+    return { kind: 'error', status: 400, error: 'Provider response missing subject' };
+  }
+
+  const existing = identityDb.findBySubject(provider, identity.subject);
+
+  if (stateEntry.intent === 'bind') {
+    // Logged-in user binding a new identity.
+    if (!stateEntry.userId) {
+      return { kind: 'error', status: 401, error: 'Bind requires authenticated user' };
+    }
+    if (existing && existing.user_id !== stateEntry.userId) {
+      // Already linked to someone else → reject (per agreed conflict policy).
+      return { kind: 'error', status: 409, error: 'This account is already linked to another user' };
+    }
+    if (!existing) {
+      const created = identityDb.create({
+        userId: stateEntry.userId,
+        provider,
+        subject: identity.subject,
+        email: identity.email,
+        displayName: identity.displayName
+      });
+      if (!created) {
+        return { kind: 'error', status: 409, error: 'This account is already linked to another user' };
+      }
+    } else {
+      identityDb.touchLogin(existing.id);
+    }
+    return { kind: 'bind', provider };
+  }
+
+  // intent='login' (or anything else — default to login).
+  if (existing) {
+    const user = userDb.get(existing.user_id);
+    if (!user) {
+      return { kind: 'error', status: 500, error: 'Bound user no longer exists' };
+    }
+    // Backfill display_name on subsequent logins if it was never set away
+    // from the auto-generated username (e.g. early logins before this code
+    // existed). Don't clobber a name the user has manually changed.
+    if (identity.displayName && user.display_name === user.username) {
+      userDb.updateDisplayName(user.id, identity.displayName);
+    }
+    identityDb.touchLogin(existing.id);
+    if (user.id) userDb.updateLogin(user.id);
+    const sessionKey = generateSessionKey();
+    const role = user.role === 'admin' ? 'admin' : 'pro';
+    const result = completeLogin(user.username, sessionKey, role);
+    return { kind: 'login', ...result };
+  }
+
+  // No identity row yet — auto-create user (if policy allows) and link.
+  const policy = providerPolicy(provider);
+  if (!policy.autoCreateUser) {
+    return { kind: 'error', status: 403, error: 'No matching account. Contact your admin.' };
+  }
+
+  const base = sanitizeUsername(
+    identity.email ? identity.email.split('@')[0] : (identity.displayName || provider + '_user')
+  );
+  const username = uniqueUsername(base);
+  const newUser = userDb.createFromAad(
+    username,
+    identity.email,
+    /* aadOid */ null,
+    policy.defaultRole,
+    identity.displayName || null
+  );
+
+  // Link the identity. createFromAad reuses null aad_oid for non-microsoft, and
+  // we always insert into user_identities for the unified model.
+  identityDb.create({
+    userId: newUser.id,
+    provider,
+    subject: identity.subject,
+    email: identity.email,
+    displayName: identity.displayName
+  });
+
+  if (provider === 'microsoft' && identity.subject) {
+    // Keep legacy users.aad_oid in sync for backwards compat.
+    userDb.updateAadOid(newUser.id, identity.subject);
+  }
+
+  userDb.updateLogin(newUser.id);
+  const sessionKey = generateSessionKey();
+  const role = newUser.role === 'admin' ? 'admin' : 'pro';
+  const result = completeLogin(newUser.username, sessionKey, role);
+  return { kind: 'login', ...result };
+}
+
+// Test-only: clear the in-memory state store between cases.
+export function _resetStateStore() {
+  _stateStore.clear();
+}

package/local-runtime/server/auth/password-reset.js

@@ -0,0 +1,134 @@
+/**
+ * Email-based password reset.
+ *
+ * Two-step flow:
+ *   1) POST /api/auth/password-reset/request  { email }
+ *      → server looks up user by email; if found, mints a 6-digit code,
+ *        stashes it in memory keyed by a random opaque resetToken, and emails
+ *        the code. Always responds 200 even if email isn't on file (prevents
+ *        account enumeration). 15-minute TTL.
+ *   2) POST /api/auth/password-reset/verify   { resetToken, code, newPassword }
+ *      → validates code, replaces password_hash, returns success.
+ *
+ * Uses the same SMTP infra as login email verification.
+ */
+import { randomBytes, randomInt, timingSafeEqual } from 'crypto';
+import { CONFIG, isEmailConfigured } from '../config.js';
+import { userDb } from '../database.js';
+import { sendVerificationCode } from '../email.js';
+import { hashPassword } from './utils.js';
+
+const RESET_TTL_MS = 15 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+const _pending = new Map(); // resetToken -> { userId, code, expiresAt, attempts }
+
+function _gc() {
+  const now = Date.now();
+  for (const [t, e] of _pending.entries()) if (e.expiresAt < now) _pending.delete(t);
+}
+
+function _generateCode() {
+  // CSPRNG. Math.random() is unsuitable for security tokens — predictable
+  // across attackers who can sample the server's PRNG state.
+  return String(randomInt(0, 1_000_000)).padStart(6, '0');
+}
+
+function _constantTimeCodeEqual(a, b) {
+  const ab = Buffer.from(String(a));
+  const bb = Buffer.from(String(b));
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+
+/**
+ * Step 1: request a reset code.
+ * Always returns { success: true } regardless of whether the email exists,
+ * so an attacker can't enumerate accounts. Returns the resetToken on success
+ * (or always — same shape — for the user who actually owns the email).
+ */
+export async function requestPasswordReset(email) {
+  _gc();
+  if (!isEmailConfigured()) {
+    return { success: false, error: 'Email is not configured on this server' };
+  }
+  if (!email || typeof email !== 'string') {
+    return { success: false, error: 'Email is required' };
+  }
+  const normalized = email.trim().toLowerCase();
+
+  // Look up user by email. We scan getAll() because there's no index — this is
+  // an admin-rare action so the cost is acceptable.
+  const all = userDb.getAll();
+  const user = all.find(u => (u.email || '').toLowerCase() === normalized);
+
+  if (!user) {
+    // Pretend success to prevent enumeration. No code sent, no token issued.
+    // The client gets a fake-looking token so the UI can still proceed to
+    // the "enter code" step — verification will simply fail.
+    //
+    // Sleep a small randomized window so the response time roughly matches
+    // the existing-email path (which awaits an SMTP round-trip). Without
+    // this, request latency is itself an enumeration oracle.
+    const fakeDelay = 200 + Math.floor(Math.random() * 400);
+    await new Promise(r => setTimeout(r, fakeDelay));
+    return { success: true, resetToken: 'fake_' + randomBytes(16).toString('hex') };
+  }
+
+  const code = _generateCode();
+  const resetToken = 'rst_' + randomBytes(24).toString('hex');
+  _pending.set(resetToken, {
+    userId: user.id,
+    code,
+    expiresAt: Date.now() + RESET_TTL_MS,
+    attempts: 0
+  });
+  try {
+    await sendVerificationCode(user.email, code, user.username);
+  } catch (err) {
+    console.error('[password-reset] sendVerificationCode failed:', err.message);
+    _pending.delete(resetToken);
+    return { success: false, error: 'Failed to send reset email' };
+  }
+  return { success: true, resetToken };
+}
+
+/**
+ * Step 2: verify code and set new password.
+ *
+ * Per-token attempt counter caps brute-force at MAX_ATTEMPTS regardless of
+ * IP rotation — the IP rate-limit alone is bypassable via residential
+ * proxies.
+ */
+export async function verifyPasswordReset(resetToken, code, newPassword) {
+  _gc();
+  const entry = _pending.get(resetToken);
+  if (!entry) return { success: false, error: 'Invalid or expired reset token' };
+  if (Date.now() > entry.expiresAt) {
+    _pending.delete(resetToken);
+    return { success: false, error: 'Reset code has expired' };
+  }
+  if (entry.attempts >= MAX_ATTEMPTS) {
+    _pending.delete(resetToken);
+    return { success: false, error: 'Too many attempts; request a new reset code' };
+  }
+  if (!_constantTimeCodeEqual(entry.code, code || '')) {
+    entry.attempts += 1;
+    if (entry.attempts >= MAX_ATTEMPTS) _pending.delete(resetToken);
+    return { success: false, error: 'Invalid reset code' };
+  }
+  if (!newPassword || typeof newPassword !== 'string' || newPassword.length < 6) {
+    return { success: false, error: 'New password must be at least 6 characters' };
+  }
+  const user = userDb.get(entry.userId);
+  if (!user) {
+    _pending.delete(resetToken);
+    return { success: false, error: 'User no longer exists' };
+  }
+  const hash = await hashPassword(newPassword);
+  userDb.updatePassword(user.id, hash);
+  _pending.delete(resetToken);
+  return { success: true };
+}
+
+// Test-only
+export function _resetPasswordResetStore() { _pending.clear(); }

package/local-runtime/server/auth/providers/alipay.js

@@ -0,0 +1,125 @@
+/**
+ * Alipay 网页授权 — RSA2-signed OAuth-like flow.
+ *
+ * Authorize URL: https://openauth.alipay.com/oauth2/publicAppAuthorize.htm
+ * Gateway:       https://openapi.alipay.com/gateway.do (alipay.system.oauth.token, alipay.user.info.share)
+ *
+ * Subject = `user_id` returned by alipay.user.info.share.
+ *
+ * Alipay's "OAuth" is non-standard — every API call is signed with the merchant
+ * RSA private key per Alipay's signing rules. Node's built-in `crypto` module
+ * covers RSA2 (SHA256withRSA), so no extra dependency is needed.
+ */
+import { createSign } from 'crypto';
+import { readFileSync } from 'fs';
+import { CONFIG } from '../../config.js';
+
+export const name = 'alipay';
+
+const GATEWAY = 'https://openapi.alipay.com/gateway.do';
+
+/**
+ * Resolve the configured Alipay private key. Accepts either a PEM string
+ * (containing "BEGIN") or a filesystem path (starts with "/" or "file://").
+ * File mode keeps the secret out of env vars and process listings.
+ */
+function resolvePrivateKey() {
+  const raw = CONFIG.sso.alipay.privateKey || '';
+  if (raw.includes('BEGIN')) return raw;
+  if (raw.startsWith('file://')) return readFileSync(raw.slice(7), 'utf8');
+  if (raw.startsWith('/')) return readFileSync(raw, 'utf8');
+  // Bare base64 — wrap as PKCS#1 (legacy fallback for compactness in env vars).
+  return `-----BEGIN RSA PRIVATE KEY-----\n${raw}\n-----END RSA PRIVATE KEY-----`;
+}
+
+export function isEnabled() {
+  const c = CONFIG.sso?.alipay;
+  return !!(c?.enabled && c.appId && c.privateKey && c.callbackUrl);
+}
+
+export function getAuthorizeUrl(state /* , intent */) {
+  const c = CONFIG.sso.alipay;
+  const url = new URL('https://openauth.alipay.com/oauth2/publicAppAuthorize.htm');
+  url.searchParams.set('app_id', c.appId);
+  url.searchParams.set('scope', 'auth_user');
+  url.searchParams.set('redirect_uri', c.callbackUrl);
+  url.searchParams.set('state', state);
+  return url.toString();
+}
+
+/**
+ * Build an Alipay request payload, sign it with RSA2, and POST to the gateway.
+ */
+async function alipayCall(method, bizContent) {
+  const c = CONFIG.sso.alipay;
+  const params = {
+    app_id: c.appId,
+    method,
+    format: 'JSON',
+    charset: 'utf-8',
+    sign_type: 'RSA2',
+    timestamp: new Date().toISOString().slice(0, 19).replace('T', ' '),
+    version: '1.0',
+    ...bizContent
+  };
+
+  // Alipay signing rule: sort keys alphabetically, build k=v&k=v string, exclude
+  // `sign` itself and any empty values.
+  const signStr = Object.keys(params)
+    .filter(k => k !== 'sign' && params[k] !== undefined && params[k] !== null && params[k] !== '')
+    .sort()
+    .map(k => `${k}=${params[k]}`)
+    .join('&');
+
+  const signer = createSign('RSA-SHA256');
+  signer.update(signStr, 'utf8');
+  const sign = signer.sign(resolvePrivateKey(), 'base64');
+
+  const body = new URLSearchParams({ ...params, sign });
+  const res = await fetch(GATEWAY, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' },
+    body
+  });
+  if (!res.ok) throw new Error(`Alipay ${method} HTTP ${res.status}`);
+  return res.json();
+}
+
+export async function exchangeCode(code /* , state */) {
+  // Step 1: code -> access_token
+  const tokRes = await alipayCall('alipay.system.oauth.token', {
+    grant_type: 'authorization_code',
+    code
+  });
+  const tokInner = tokRes.alipay_system_oauth_token_response;
+  if (!tokInner) throw new Error(`Alipay token exchange unexpected response: ${JSON.stringify(tokRes)}`);
+  if (tokInner.code && tokInner.code !== '10000') {
+    throw new Error(`Alipay token error ${tokInner.code}: ${tokInner.msg || ''}`);
+  }
+  if (!tokInner.access_token) throw new Error('Alipay token response missing access_token');
+
+  // Step 2: access_token -> profile
+  const userRes = await alipayCall('alipay.user.info.share', {
+    auth_token: tokInner.access_token
+  });
+  const userInner = userRes.alipay_user_info_share_response;
+  if (!userInner) throw new Error('Alipay user info missing response wrapper');
+  if (userInner.code && userInner.code !== '10000') {
+    throw new Error(`Alipay user info error ${userInner.code}: ${userInner.msg || ''}`);
+  }
+
+  // Prefer open_id (per-app stable ID under Alipay's privacy/openid mode, on by
+  // default for apps created since 2023). Fall back to user_id for legacy apps
+  // that haven't migrated. Either is a stable per-user subject for binding.
+  const subject = userInner.open_id || tokInner.open_id || userInner.user_id || tokInner.user_id;
+  if (!subject) throw new Error('Alipay profile missing open_id/user_id');
+
+  return {
+    subject,
+    email: null, // Alipay does not return email by default
+    displayName: userInner.nick_name || userInner.user_name || null,
+    raw: userInner
+  };
+}
+
+export default { name, isEnabled, getAuthorizeUrl, exchangeCode };