@yeaft/webchat-agent 1.0.219 → 1.0.220

package/local-runtime/server/api.js

@@ -2,7 +2,8 @@ import { readFileSync } from 'fs';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { CONFIG } from './config.js';
-import { verifyToken, maybeRenewToken } from './auth.js';
+import { maybeRenewToken } from './auth.js';
+import { authenticateRequest, setSessionCookie } from './auth/request-auth.js';
 import { registerAuthRoutes } from './routes/auth-routes.js';
 import { registerInvitationRoutes } from './routes/invitation-routes.js';
 import { registerUserRoutes } from './routes/user-routes.js';
@@ -44,27 +45,29 @@ function requireAuth(req, res, next) {
     return next();
   }
 
-  const authHeader = req.headers.authorization;
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return res.status(401).json({ error: 'Authentication required' });
-  }
-
-  const token = authHeader.replace('Bearer ', '');
-  const result = verifyToken(token);
-
-  if (!result.valid) {
-    return res.status(401).json({ error: 'Invalid or expired token' });
+  const result = authenticateRequest({
+    authorizationHeader: req.headers.authorization,
+    cookieHeader: req.headers.cookie,
+  });
+  if (!result) {
+    const hasCredential = !!req.headers.authorization || !!req.headers.cookie;
+    return res.status(401).json({
+      error: hasCredential ? 'Invalid or expired token' : 'Authentication required',
+    });
   }
 
   // Sliding renewal: if the token is in the last `jwtRenewThresholdMs` of its
-  // life, mint a fresh one and surface it to the client via X-New-Token. The
-  // browser fetch wrapper picks this up and swaps localStorage transparently.
+  // life, mint a fresh one and update both browser auth channels.
   // Skip renewal for non-session tokens (temp/totp/totp-setup) — those have
   // their own short-lived semantics and must not be promoted to full sessions.
   if (!result.type) {
-    const fresh = maybeRenewToken(token, result.exp, result.username);
+    const fresh = maybeRenewToken(result.token, result.exp, result.username);
     if (fresh) {
-      res.setHeader('X-New-Token', fresh);
+      setSessionCookie(req, res, fresh);
+      if (result.source !== 'cookie') res.setHeader('X-New-Token', fresh);
+    } else if (result.source !== 'cookie') {
+      // Repair the cookie for existing bearer-only sessions after deployment.
+      setSessionCookie(req, res, result.token);
     }
   }
 

package/local-runtime/server/auth/request-auth.js

@@ -0,0 +1,82 @@
+import jwt from 'jsonwebtoken';
+import { verifyToken } from './token.js';
+
+export const SESSION_COOKIE_NAME = 'yeaft_session';
+
+function readBearerToken(authorizationHeader) {
+  if (typeof authorizationHeader !== 'string' || !authorizationHeader.startsWith('Bearer ')) return null;
+  const token = authorizationHeader.slice('Bearer '.length).trim();
+  return token || null;
+}
+
+function readCookieToken(cookieHeader) {
+  if (typeof cookieHeader !== 'string' || !cookieHeader) return null;
+  for (const part of cookieHeader.split(';')) {
+    const separator = part.indexOf('=');
+    if (separator < 0) continue;
+    const name = part.slice(0, separator).trim();
+    if (name !== SESSION_COOKIE_NAME) continue;
+    const value = part.slice(separator + 1).trim();
+    if (!value) return null;
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve one authenticated browser session for HTTP and WebSocket requests.
+ * Explicit bearer/query tokens remain the compatibility path; a valid
+ * HttpOnly cookie is the browser fallback when that token is absent or stale.
+ */
+export function authenticateRequest({ authorizationHeader, cookieHeader, queryToken } = {}) {
+  const candidates = [
+    ['bearer', readBearerToken(authorizationHeader)],
+    ['query', typeof queryToken === 'string' && queryToken ? queryToken : null],
+    ['cookie', readCookieToken(cookieHeader)],
+  ];
+  const seen = new Set();
+  for (const [source, token] of candidates) {
+    if (!token || seen.has(token)) continue;
+    seen.add(token);
+    const result = verifyToken(token);
+    if (result.valid) return { ...result, token, source };
+  }
+  return null;
+}
+
+function requestIsSecure(req) {
+  if (req?.secure) return true;
+  const forwardedProto = req?.headers?.['x-forwarded-proto'];
+  return typeof forwardedProto === 'string' && forwardedProto.split(',')[0].trim() === 'https';
+}
+
+function sessionCookieOptions(req, token) {
+  const decoded = token ? jwt.decode(token) : null;
+  const remainingMs = decoded?.exp ? Math.max(0, decoded.exp * 1000 - Date.now()) : undefined;
+  return {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: requestIsSecure(req),
+    path: '/',
+    ...(remainingMs !== undefined && { maxAge: remainingMs }),
+  };
+}
+
+export function setSessionCookie(req, res, token) {
+  if (!token || typeof res?.cookie !== 'function') return;
+  res.cookie(SESSION_COOKIE_NAME, token, sessionCookieOptions(req, token));
+}
+
+export function clearSessionCookie(req, res) {
+  if (typeof res?.clearCookie !== 'function') return;
+  res.clearCookie(SESSION_COOKIE_NAME, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: requestIsSecure(req),
+    path: '/',
+  });
+}

package/local-runtime/server/index.js

@@ -172,7 +172,7 @@ wss.on('connection', (ws, req) => {
   if (clientType === 'agent') {
     handleAgentConnection(ws, url);
   } else if (clientType === 'web') {
-    handleWebConnection(ws, url);
+    handleWebConnection(ws, url, req);
   } else {
     ws.close(1008, 'Invalid client type');
   }

package/local-runtime/server/routes/auth-routes.js

@@ -1,10 +1,23 @@
 import { CONFIG, isEmailConfigured, isTotpEnabled, isAadEnabled, getEnabledSsoProviders, getUserByUsername } from '../config.js';
 import { loginStep1, loginStep2, logout, verifyTotpStep, completeTotpSetup, register, loginWithAad } from '../auth.js';
 import { buildAuthorizeUrl, handleCallback, peekStateMode, storePendingResult, consumePendingResult } from '../auth/oauth-flow.js';
-import { verifyToken } from '../auth/token.js';
+import { authenticateRequest, clearSessionCookie, setSessionCookie } from '../auth/request-auth.js';
 import { requestPasswordReset, verifyPasswordReset } from '../auth/password-reset.js';
 import { identityDb, userDb } from '../database.js';
 
+function sendLoginResult(req, res, result) {
+  if (result?.success && result.token) setSessionCookie(req, res, result.token);
+  return res.json(result);
+}
+
+function authenticateBrowserRequest(req, queryToken = undefined) {
+  return authenticateRequest({
+    authorizationHeader: req.headers.authorization,
+    cookieHeader: req.headers.cookie,
+    queryToken,
+  });
+}
+
 /**
  * Register authentication-related API routes.
  */
@@ -39,7 +52,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     }
     try {
       const result = await loginStep1(username, password);
-      res.json(result);
+      sendLoginResult(req, res, result);
     } catch (err) {
       console.error('Login error:', err);
       res.status(500).json({ success: false, error: 'Internal server error' });
@@ -55,14 +68,15 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
       return res.status(400).json({ success: false, error: 'Token and code are required' });
     }
     const result = loginStep2(tempToken, code);
-    res.json(result);
+    sendLoginResult(req, res, result);
   });
 
   app.post('/api/auth/logout', (req, res) => {
-    const token = req.headers.authorization?.replace('Bearer ', '');
-    if (token) {
-      logout(token);
-    }
+    const bearerSession = authenticateRequest({ authorizationHeader: req.headers.authorization });
+    const cookieSession = authenticateRequest({ cookieHeader: req.headers.cookie });
+    const tokens = new Set([bearerSession?.token, cookieSession?.token].filter(Boolean));
+    for (const token of tokens) logout(token);
+    clearSessionCookie(req, res);
     res.json({ success: true });
   });
 
@@ -76,7 +90,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     }
     try {
       const result = await verifyTotpStep(tempToken, totpCode);
-      res.json(result);
+      sendLoginResult(req, res, result);
     } catch (err) {
       console.error('TOTP verification error:', err);
       res.status(500).json({ success: false, error: 'Internal server error' });
@@ -90,7 +104,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     }
     try {
       const result = await completeTotpSetup(setupToken, totpCode);
-      res.json(result);
+      sendLoginResult(req, res, result);
     } catch (err) {
       console.error('TOTP setup error:', err);
       res.status(500).json({ success: false, error: 'Internal server error' });
@@ -156,7 +170,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     }
     try {
       const result = await loginWithAad(idToken);
-      res.json(result);
+      sendLoginResult(req, res, result);
     } catch (err) {
       console.error('AAD login error:', err);
       res.status(500).json({ success: false, error: 'Internal server error' });
@@ -177,9 +191,8 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
       // here directly so we read the token from the `Authorization` query
       // parameter (frontend hands it over explicitly because top-level navigation
       // can't set headers).
-      const token = String(req.query.token || '');
-      const ver = verifyToken(token);
-      if (!ver.valid) {
+      const ver = authenticateBrowserRequest(req, String(req.query.token || ''));
+      if (!ver) {
         return res.status(401).send('Authentication required to bind an identity');
       }
       const u = userDb.getByUsername(ver.username);
@@ -204,9 +217,8 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     const intent = req.query.intent === 'bind' ? 'bind' : 'login';
     let userId = null;
     if (intent === 'bind') {
-      const token = String(req.query.token || '');
-      const ver = verifyToken(token);
-      if (!ver.valid) return res.status(401).json({ success: false, error: 'auth required' });
+      const ver = authenticateBrowserRequest(req, String(req.query.token || ''));
+      if (!ver) return res.status(401).json({ success: false, error: 'auth required' });
       const u = userDb.getByUsername(ver.username);
       if (!u) return res.status(401).json({ success: false, error: 'user not found' });
       userId = u.id;
@@ -226,6 +238,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
     const r = consumePendingResult(req.params.state);
     if (!r) return res.json({ status: 'pending' });
     if (r.kind === 'login') {
+      setSessionCookie(req, res, r.token);
       return res.json({ status: 'login', token: r.token, sessionKey: r.sessionKey, role: r.role });
     }
     if (r.kind === 'bind') {
@@ -261,6 +274,7 @@ export function registerAuthRoutes(app, { requireAuth, checkRateLimit }) {
       }
 
       if (result.kind === 'login') {
+        setSessionCookie(req, res, result.token);
         const params = new URLSearchParams({
           token: result.token,
           sessionKey: result.sessionKey,

package/local-runtime/server/ws-client.js

@@ -1,7 +1,8 @@
 import { randomUUID } from 'crypto';
 import { WebSocket } from 'ws';
 import { CONFIG } from './config.js';
-import { verifyToken, generateSkipAuthSession } from './auth.js';
+import { generateSkipAuthSession } from './auth.js';
+import { authenticateRequest } from './auth/request-auth.js';
 import { encodeKey } from './encryption.js';
 import { userDb } from './database.js';
 import { agents, webClients, isHeartbeatMessageType, trackRequest } from './context.js';
@@ -15,9 +16,8 @@ import { handleClientMisc } from './handlers/client-misc.js';
 import { clearWorkCenterRequestsForClient, handleClientWorkCenter } from './handlers/client-work-center.js';
 import { recordPerfTraceEvent } from './perf-trace.js';
 
-export function handleWebConnection(ws, url) {
+export function handleWebConnection(ws, url, req = {}) {
   const clientId = randomUUID();
-  const token = url.searchParams.get('token');
 
   let authenticated = false;
   let sessionKey = null;
@@ -32,14 +32,15 @@ export function handleWebConnection(ws, url) {
     sessionKey = session.sessionKey;
     username = 'dev-user';
     role = 'admin';
-  } else if (token) {
-    const result = verifyToken(token);
-    if (result.valid) {
-      authenticated = true;
-      sessionKey = result.sessionKey;
-      username = result.username;
-      role = result.role === 'admin' ? 'admin' : 'pro';
-    }
+  } else {
+    const result = authenticateRequest({
+      cookieHeader: req.headers?.cookie,
+      queryToken: url.searchParams.get('token'),
+    });
+    authenticated = !!result;
+    sessionKey = result?.sessionKey || null;
+    username = result?.username || null;
+    role = result?.role === 'admin' ? 'admin' : (result ? 'pro' : null);
   }
 
   // 获取或创建用户

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.219"}
+{"version":"1.0.220"}