@zhin.js/host-http 1.0.10 → 1.0.11

package/src/console-rpc.ts

@@ -81,6 +81,16 @@ export type RuntimeConsoleRpcContext = {
    * Returns whether a process restart is required (always true without ConfigFeature).
    */
   setConfigKey?(pluginName: string, data: unknown): Promise<{ restartRequired: boolean }>;
+  /** Atomic, revision-checked runtime Workroom Catalog read/write. */
+  readWorkroomCatalog?(): Promise<Readonly<{
+    agents: Readonly<Record<string, unknown>>;
+    workrooms: Readonly<Record<string, unknown>>;
+    revision: string;
+  }>>;
+  setWorkroomCatalog?(
+    workrooms: unknown,
+    expectedRevision: string,
+  ): Promise<Readonly<{ revision: string; restartRequired: boolean }>>;
   /** Project file manager (allowlisted paths under project root). */
   listProjectFiles?(): Promise<readonly unknown[]>;
   readProjectFile?(filePath: string): Promise<{ content: string; size: number }>;
@@ -240,6 +250,39 @@ export async function dispatchRuntimeConsoleRpc(
       }
       return payloads;
     }
+    case 'workrooms:get': {
+      try {
+        if (!ctx.readWorkroomCatalog) {
+          emit({ requestId, error: 'Workroom Catalog read is not configured' });
+          return payloads;
+        }
+        emit({ requestId, data: await ctx.readWorkroomCatalog() });
+      } catch (error) {
+        emit({ requestId, error: error instanceof Error ? error.message : String(error) });
+      }
+      return payloads;
+    }
+    case 'workrooms:set': {
+      try {
+        if (!ctx.setWorkroomCatalog) {
+          emit({ requestId, error: 'Workroom Catalog write is not configured' });
+          return payloads;
+        }
+        const expectedRevision = typeof message.expectedRevision === 'string'
+          ? message.expectedRevision
+          : '';
+        if (!/^[a-f0-9]{64}$/u.test(expectedRevision)) {
+          emit({ requestId, error: 'expectedRevision is required' });
+          return payloads;
+        }
+        const result = await ctx.setWorkroomCatalog(message.data, expectedRevision);
+        ctx.publishEvent?.('workrooms:updated', { revision: result.revision });
+        emit({ requestId, data: { success: true, ...result } });
+      } catch (error) {
+        emit({ requestId, error: error instanceof Error ? error.message : String(error) });
+      }
+      return payloads;
+    }
     case 'config:save-yaml': {
       try {
         const yaml = message.yaml;

package/src/http-host.ts

@@ -17,6 +17,7 @@ import {
   TokenRegistry,
   extractBearerToken,
   isDemoWebSocketPath,
+  type AuthenticatedTokenPrincipal,
   type AuthScope,
   type ScopedTokenConfig,
   type TokenRegistryConfig,
@@ -73,6 +74,7 @@ export type HttpHandler = (
   response: ServerResponse,
   url: URL,
   authScope: AuthScope,
+  authenticatedPrincipal?: AuthenticatedTokenPrincipal,
 ) => void | Promise<void>;
 
 export interface HttpRouteRegistration {
@@ -323,7 +325,7 @@ export function createHttpHost(options: HttpHostOptions = {}): ProcessHttpHost {
         return;
       }
       if (!release) {
-        await route.handler(request, response, url, auth.scope);
+        await route.handler(request, response, url, auth.scope, auth.principal);
         return;
       }
       let released = false;
@@ -336,7 +338,7 @@ export function createHttpHost(options: HttpHostOptions = {}): ProcessHttpHost {
       };
       response.once('finish', releaseResponse);
       response.once('close', releaseResponse);
-      await route.handler(request, response, url, auth.scope);
+      await route.handler(request, response, url, auth.scope, auth.principal);
       if (response.writableFinished || response.destroyed) releaseResponse();
     } catch (err) {
       // 统一把请求体错误（400/413）映射回对应状态码，
@@ -363,7 +365,7 @@ export function createHttpHost(options: HttpHostOptions = {}): ProcessHttpHost {
     request: IncomingMessage,
     url: URL,
     pathname: string,
-  ): { ok: true; scope: AuthScope } | { ok: false } {
+  ): { ok: true; scope: AuthScope; principal?: AuthenticatedTokenPrincipal } | { ok: false } {
     if (!requiresHttpAuth(pathname, apiBase, authExempt)) {
       return { ok: true, scope: 'full' };
     }
@@ -380,7 +382,8 @@ export function createHttpHost(options: HttpHostOptions = {}): ProcessHttpHost {
       const method = (request.method ?? 'GET').toUpperCase();
       if (!isDemoHttpAllowed(method, pathname, apiBase)) return { ok: false };
     }
-    return { ok: true, scope };
+    const principal = tokenRegistry.resolvePrincipal(token);
+    return { ok: true, scope, ...(principal ? { principal } : {}) };
   }
 
   function listListedRoutes(): readonly ListedRoute[] {

package/src/index.ts

@@ -15,6 +15,7 @@ export {
   TokenRegistry,
   extractBearerToken,
   isDemoWebSocketPath,
+  type AuthenticatedTokenPrincipal,
   type AuthScope,
   type ScopedTokenConfig,
   type TokenRegistryConfig,
@@ -70,5 +71,7 @@ export {
   dispatchExtendedConsoleRpc,
   type ConsoleRpcExtendedCtx,
   type ConsoleScheduleEngine,
+  type ConsoleWorkroomProfileControlPort,
+  type ConsoleWorkroomKnowledgeControlPort,
   type ExtendedRpcResult,
 } from './console-rpc-extended.js';

package/src/token-registry.ts

@@ -6,27 +6,55 @@ export type AuthScope = 'full' | 'demo';
 export type ScopedTokenConfig = {
   readonly token: string;
   readonly scope: AuthScope;
+  /** Root-configured subject binding; never accepted from an HTTP payload. */
+  readonly principalId?: string;
 };
 
+export interface AuthenticatedTokenPrincipal {
+  readonly principalId: string;
+  readonly scope: AuthScope;
+}
+
 export type TokenRegistryConfig = {
   readonly primaryToken?: string;
   readonly scopedTokens?: readonly ScopedTokenConfig[];
 };
 
 export class TokenRegistry {
-  readonly #entries = new Map<string, AuthScope>();
+  readonly #entries = new Map<string, Readonly<{ scope: AuthScope; principalId?: string }>>();
 
   constructor(config: TokenRegistryConfig = {}) {
-    if (config.primaryToken) this.#entries.set(config.primaryToken, 'full');
-    for (const { token, scope } of config.scopedTokens ?? []) {
-      if (token) this.#entries.set(token, scope);
+    if (config.primaryToken) this.#entries.set(config.primaryToken, Object.freeze({ scope: 'full' }));
+    for (const { token, scope, principalId } of config.scopedTokens ?? []) {
+      if (!token) continue;
+      if (principalId !== undefined && (!principalId.trim() || principalId !== principalId.trim())) {
+        throw new Error('HTTP token principalId is invalid');
+      }
+      const candidate = Object.freeze({ scope, ...(principalId === undefined ? {} : { principalId }) });
+      const existing = this.#entries.get(token);
+      if (existing && (existing.scope !== candidate.scope || existing.principalId !== candidate.principalId)) {
+        throw new Error('HTTP token has conflicting authority bindings');
+      }
+      this.#entries.set(token, candidate);
     }
   }
 
   resolve(token: string): AuthScope | null {
     if (!token) return null;
-    for (const [known, scope] of this.#entries) {
-      if (timingSafeEqualString(known, token)) return scope;
+    for (const [known, binding] of this.#entries) {
+      if (timingSafeEqualString(known, token)) return binding.scope;
+    }
+    return null;
+  }
+
+  resolvePrincipal(token: string): AuthenticatedTokenPrincipal | null {
+    if (!token) return null;
+    for (const [known, binding] of this.#entries) {
+      if (timingSafeEqualString(known, token)) {
+        return binding.principalId
+          ? Object.freeze({ principalId: binding.principalId, scope: binding.scope })
+          : null;
+      }
     }
     return null;
   }
@@ -36,8 +64,8 @@ export class TokenRegistry {
   }
 
   primaryTokenPrefixForLog(): string {
-    for (const [tok, scope] of this.#entries) {
-      if (scope === 'full') return tok.slice(0, 6);
+    for (const [tok, binding] of this.#entries) {
+      if (binding.scope === 'full') return tok.slice(0, 6);
     }
     const first = this.#entries.keys().next().value;
     return first ? first.slice(0, 6) : '';