bdip-office-assistant-cli 0.0.0-stage → 1.0.0

package/dist/auth.js

@@ -0,0 +1,290 @@
+import fs from 'node:fs';
+import readline from 'node:readline';
+import { endpointFor, profileNameFromBaseUrl, updateConfigCookie } from './config.js';
+import { passwordLogin, assertPasswordLoginTransport } from './password-login.js';
+import { promptCaptcha } from './captcha-display.js';
+import { PASSWORD_RISK_NOTICE, assertNoCredentialArguments, readPasswordCredentials } from './password-input.js';
+import { AuthTokenSession, ensurePlaywright, canReach } from './auth-token.js';
+import { probeCookieSession, sessionOptions, refreshCookie, assertSessionNotForcedOffline, latchForcedOffline } from './session.js';
+import { parseDuration, keepaliveStatus, stopKeepalive, startBackgroundKeepalive, runForegroundKeepalive } from './keepalive.js';
+/** 登录前隐私确认（硬门槛）：未持久化同意且未带 --consent 时拒绝执行登录/鉴权。
+ *  由 SKILL.md 行为规范保证：AI 必须先向用户展示选择框确认「信息会经过大模型处理」，
+ *  用户明确同意后才带 --consent 调用本命令；本函数作为 CLI 兜底，防 AI 跳过询问直接登录。 */
+function ensureLlmConsent(cfg, args) {
+    const persisted = cfg.llmConsent === true || String(cfg.llmConsent).toLowerCase() === 'true';
+    if (persisted)
+        return;
+    if (args?.flags?.consent)
+        return;
+    console.error('⚠ 隐私确认：你发送或获取的信息（待办/台账/邮件/日报等）会经过大模型处理。是否同意？');
+    console.error('  同意本次登录：在命令后加 --consent 重试；');
+    console.error('  或一次性同意（写入配置，后续登录不再询问）：bdip config set llmConsent true');
+    console.error('  不同意则中止登录，不执行任何鉴权操作。');
+    process.exit(1);
+}
+/**
+ * 申请/续期当前环境的 aiAgentToken（单一端点）。
+ * 带 preflight：① baseUrl 可达（避免错地址白耗浏览器）；② playwright 就位（缺则联网自动装模块+内核）；
+ * ③ 开浏览器登录拿 token（开不出窗口由 loginForCookie 抛清晰错并引导 cookie-login）。
+ * 登录前需隐私确认：--consent 或 config llmConsent=true，见 ensureLlmConsent。
+ */
+function loginError(code, message) { const error = new Error(message); error.code = code; return error; }
+export function browserEnvironmentUnavailable(platform = process.platform, env = process.env) {
+    return platform === 'linux' && !env.DISPLAY && !env.WAYLAND_DISPLAY;
+}
+/** Test seams are explicit function dependencies, never user-controlled command flags. */
+export async function cmdTokenLogin(cfg, args, dependencies = {}) {
+    assertNoCredentialArguments(args);
+    ensureLlmConsent(cfg, args);
+    const deps = { probe: probeCookieSession, reachable: canReach, ensureBrowser: ensurePlaywright,
+        browserUnavailable: browserEnvironmentUnavailable, getTokenSession: () => AuthTokenSession.fromProfile(cfg),
+        readCredentials: readPasswordCredentials, promptCaptcha, passwordLogin, ...dependencies };
+    const flags = args?.flags ?? {};
+    if (flags['allow-insecure-password-input'] !== undefined && flags['allow-insecure-password-input'] !== true
+        || flags['credentials-stdin'] !== undefined && flags['credentials-stdin'] !== true) {
+        throw loginError('PASSWORD_INPUT_INVALID', '密码兼容选项必须是布尔开关，不得附带任何凭据值。');
+    }
+    refreshCookie(cfg);
+    assertSessionNotForcedOffline(cfg);
+    const ep = endpointFor(cfg);
+    if (!ep.baseUrl || ep.baseUrl.replace(/\/+$/, '') === 'http://localhost:8080') {
+        console.error('✗ baseUrl 未配置，先跑 bdip config set baseUrl <你的E9地址>');
+        process.exit(1);
+    }
+    if (cfg.cookie) {
+        let checkedCookie = cfg.cookie;
+        const existing = await deps.probe(cfg, { onCredential: cookie => { checkedCookie = cookie; } });
+        if (existing.code === 'FORCED_OFFLINE') {
+            latchForcedOffline(cfg, existing, checkedCookie);
+            throw loginError('FORCED_OFFLINE', '当前会话被强制下线；已停止，未自动重新登录。');
+        }
+        if (existing.authenticated) {
+            console.log(`✔ 当前 Cookie 登录有效，已复用当前用户 ${existing.userId}；未启动浏览器或请求密码。`);
+            return { mode: 'existing-cookie', userId: existing.userId };
+        }
+        if (!['SESSION_EXPIRED', 'NO_COOKIE', 'IDENTITY_UNVERIFIED'].includes(existing.code)) {
+            throw loginError(existing.code ?? 'SESSION_CHECK_FAILED', '无法确认现有会话状态；请检查网络和平台服务，未请求密码。');
+        }
+    }
+    const expectedCookie = cfg.cookie ?? '';
+    const fallback = async () => {
+        if (flags['allow-insecure-password-input'] !== true) {
+            console.error(PASSWORD_RISK_NOTICE);
+            throw loginError('MOBILE_PASSWORD_CONSENT_REQUIRED', '浏览器环境不可用。用户单独确认上述密码风险后，重试同命令并加 --allow-insecure-password-input --credentials-stdin；不要将密码写入命令或文件。');
+        }
+        if (flags['credentials-stdin'] !== true) {
+            throw loginError('PASSWORD_INPUT_UNAVAILABLE', '需要独立进程 stdin 输入；工具不支持时请停止，不得把密码拼入命令、脚本或临时文件。');
+        }
+        let credentials;
+        let verified;
+        try {
+            assertPasswordLoginTransport(cfg);
+            console.error('[AUTH] 已确认兼容方式；等待独立 stdin 的单行凭据 JSON，不会回显或保存密码。');
+            credentials = await deps.readCredentials();
+            verified = await deps.passwordLogin(cfg, { ...credentials, onCaptcha: (challenge, context) => deps.promptCaptcha(challenge, context) });
+        } catch (error) {
+            // Never propagate remote body, passwords, input lines or arbitrary transport errors.
+            const allowed = /^(?:PASSWORD_[A-Z_]+|LOGIN_[A-Z_]+|IDENTITY_UNVERIFIED|FORCED_OFFLINE|RSA_[A-Z_]+|HTTP_[A-Z_]+|SESSION_EXPIRED|AUTH_[A-Z_]+)$/;
+            const code = allowed.test(String(error?.code ?? '')) ? error.code : 'PASSWORD_LOGIN_FAILED';
+            if (code === 'FORCED_OFFLINE') latchForcedOffline(cfg, { code }, expectedCookie);
+            const guidance = {
+                PASSWORD_CHALLENGE_UNSUPPORTED: '账号要求动态口令、设备或未知验证，当前兼容方式不能处理；请勿跳过平台要求。',
+                PASSWORD_CAPTCHA_REQUIRED: '平台要求图片验证码，需要工具展示图片并保持同一进程 stdin 等待人工填写。',
+                PASSWORD_CAPTCHA_REJECTED: '平台拒绝了本次验证码；没有自动重试密码，请重新发起登录获取新图片。',
+                PASSWORD_INVALID_URL: '本地 baseUrl 格式无效；尚未提交密码，请用 bdip config 核对。',
+                PASSWORD_TLS_REQUIRED: '密码登录仅支持 HTTP/HTTPS；尚未提交密码，请核对 baseUrl 协议。',
+                PASSWORD_HTTP_CONSENT_REQUIRED: '尚未读取或提交密码。保留 HTTP 时，先按用户授权执行 bdip config set httpPasswordLoginOrigin <当前HTTP站点根地址>；该设置仅对同协议、主机及端口生效。',
+                PASSWORD_INVALID_USERNAME: '本地账号输入格式无效；尚未提交密码。',
+                PASSWORD_INVALID_PASSWORD: '本地密码输入格式无效；尚未提交密码。',
+                PASSWORD_INVALID_OPTIONS: '登录选项格式无效；尚未提交密码。',
+                PASSWORD_CHANGE_REQUIRED: '平台要求修改密码，请先按平台规定完成改密后再登录。',
+                PASSWORD_POLICY_UNSUPPORTED: '平台启用了弱密码限制，本期兼容方式无法安全完成策略检查。',
+                PASSWORD_POLICY_UNKNOWN: '无法安全确认平台密码策略，已停止；需要核对原生接口兼容性。',
+                PASSWORD_LOGIN_REJECTED: '账号密码认证未通过；请核实账号或平台要求，不要反复试错。',
+                PASSWORD_INPUT_UNAVAILABLE: '工具没有可用的独立 stdin 输入通道；不要把密码拼入命令或临时文件。',
+            };
+            throw loginError(code, `临时 HTTP 登录未完成；原登录配置未被新凭据覆盖，未自动重试。${guidance[code] ?? '请按错误代码处理认证要求。'}`);
+        } finally {
+            if (credentials) { credentials.password = ''; credentials.username = ''; }
+        }
+        if (!verified || typeof verified.cookie !== 'string' || !verified.cookie || !/^[1-9]\d*$/.test(String(verified.userId))) {
+            throw loginError('IDENTITY_UNVERIFIED', '未取得经验证的当前用户，未保存登录态。');
+        }
+        assertSessionNotForcedOffline(cfg);
+        const session = deps.getTokenSession();
+        if (!updateConfigCookie(cfg, verified.cookie, expectedCookie)) {
+            throw loginError('PROFILE_CHANGED', '登录期间本地平台或账号配置已更新；未覆盖新配置，请重新检查登录状态。');
+        }
+        session.data = { token: '', expireTime: '', expireSeconds: 0, cookieSavedAt: Date.now(), noToken: true,
+            userId: String(verified.userId) };
+        session.save();
+        console.log(`✔ 原生 HTTP 登录成功，已核验当前用户 ${verified.userId}；仅保存 Cookie，未保存密码或注册 token。`);
+        console.log('  长任务可使用 bdip auth keepalive --duration 8h --background；强制下线后不会自动重新登录。');
+        return { mode: 'password-http', userId: String(verified.userId) };
+    };
+    const profileName = profileNameFromBaseUrl(ep.baseUrl);
+    // ── preflight ①：baseUrl 可达 ──
+    console.log(`\n[1/3] 探测 baseUrl 可达：${ep.baseUrl}`);
+    const reachable = await deps.reachable(ep.baseUrl, 8000);
+    if (!reachable) {
+        throw loginError('LOGIN_NETWORK_ERROR', '平台地址不可达；请检查地址与网络，未启用密码兼容方式。');
+    }
+    console.log('✔ 地址可达');
+    if (deps.browserUnavailable()) return fallback();
+    // ── preflight ②：playwright 就位（缺则联网自动装模块+内核；装不上会清晰报错并引导 cookie-login）──
+    console.log('[2/3] 检查 playwright ...');
+    try {
+        await deps.ensureBrowser();
+    }
+    catch (e) {
+        if (e.code === 'BROWSER_ENV_UNAVAILABLE' || e.code === 'ERR_MODULE_NOT_FOUND') return fallback();
+        // Dependency download/network failures do not prove browser login is impossible.
+        throw loginError('BROWSER_SETUP_FAILED', '浏览器依赖准备失败；请检查依赖与网络，未要求密码输入。');
+    }
+    console.log('✔ playwright 就位');
+    // ── 第3步：开浏览器登录拿 token ──
+    console.log(`[3/3] 为环境 "${profileName}" (${cfg.username || '?'}@${ep.baseUrl}) 开浏览器登录拿 aiAgentToken ...`);
+    if (!cfg.username || !cfg.encPassword) {
+        console.log('⚠ 未配置 username/encPassword，将启动有头浏览器手动登录（输账密并点「确认授权」）');
+        console.log('  （在 .bdip/config.json 配置后可 autoFill 自动填）');
+    }
+    const session = deps.getTokenSession();
+    let token;
+    try { token = await session.acquireToken('first'); }
+    catch (error) {
+        if (error.code === 'BROWSER_ENV_UNAVAILABLE') return fallback();
+        throw error;
+    }
+    if (token)
+        console.log('✔ aiAgentToken 申请成功');
+    else
+        console.log('⚠ 未拿到 token（已切 cookie 鉴权，见上方诊断）。跑 `bdip todo list` 验证，或 `bdip auth cookie-login` 手动导入。');
+}
+/**
+ * 手动导入 cookie 走 cookie 鉴权（无需浏览器，给无桌面/无 playwright 机器的后路）。
+ * 接受 --cookie <串> / --file <路径>，缺省交互式提示粘贴。
+ */
+export async function cmdCookieLogin(cfg, args) {
+    ensureLlmConsent(cfg, args);
+    const ep = endpointFor(cfg);
+    if (!ep.baseUrl || ep.baseUrl.replace(/\/+$/, '') === 'http://localhost:8080') {
+        console.error('✗ baseUrl 未配置，先跑 bdip config set baseUrl <你的E9地址>');
+        process.exit(1);
+    }
+    let cookie = '';
+    if (args?.flags && typeof args.flags.cookie === 'string' && args.flags.cookie)
+        cookie = args.flags.cookie;
+    else if (args?.flags?.file) {
+        try {
+            cookie = fs.readFileSync(args.flags.file, 'utf8').trim();
+        }
+        catch (e) {
+            console.error(`✗ 读文件失败：${e.message}`);
+            process.exit(1);
+        }
+    }
+    if (!cookie) {
+        console.log('请粘贴整条 Cookie（含 loginidweaver=...），回车结束：');
+        console.log('  获取：浏览器登录 OA → F12 → Network → 任一请求 → Request Headers → Cookie 整行复制');
+        cookie = await readCookieLine();
+    }
+    cookie = cookie.trim();
+    if (!/loginidweaver=/.test(cookie)) {
+        console.error('✗ cookie 中未找到 loginidweaver=，请确认复制的是登录后的整条 Cookie（未登录态没有它）。');
+        process.exit(1);
+    }
+    if (/[\r\n]/.test(cookie)) throw new Error('Cookie 应为单行请求头');
+    const candidate = { ...cfg, cookie, _configPath: undefined };
+    const verified = await probeCookieSession(candidate, { refresh: false });
+    if (!verified.authenticated) throw new Error(`Cookie 未导入：${verified.message}；请从已登录浏览器重新获取。`);
+    cookie = candidate.cookie;
+    const session = AuthTokenSession.fromProfile(cfg);
+    session.saveCookieToProfile(cookie); // 只更新 Cookie，保留其他最新配置
+    session.data = { token: '', expireTime: '', expireSeconds: 0, cookieSavedAt: Date.now(), noToken: true };
+    session.save(); // 标 noToken：运行时走 cookie，不弹浏览器
+    console.log(`✔ 已导入 cookie 鉴权（${cookie.length} 字符），写入 ${cfg._configPath ?? '~/.bdip/config.json'}`);
+    console.log(`  已验证当前用户：${verified.userId}${verified.loginId ? ` (${verified.loginId})` : ''}；${verified.mode === 'extension' ? `空闲超时 ${verified.idleTimeoutSeconds} 秒` : verified.message}`);
+    console.log('  业务命令运行期间会自动心跳；跨多次命令的长任务请运行 `bdip auth keepalive --duration 8h --background`。');
+}
+/** 读 stdin 第一条非空行（交互式粘贴 cookie）。5 分钟兜底超时。 */
+function readCookieLine() {
+    return new Promise((resolve) => {
+        let got = '';
+        let settled = false;
+        let timer;
+        const done = (v) => { if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            try {
+                rl.close();
+            }
+            catch { /* ignore */ }
+            resolve(v);
+        } };
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.on('line', (line) => { const t = line.trim(); if (t)
+            done(t); });
+        rl.on('close', () => done(got));
+        timer = setTimeout(() => done(got), 300000);
+    });
+}
+/**
+ * 打印当前环境 / token 状态（单一端点）。加 --check 联网探活：baseUrl 可达 + 鉴权是否真有效。
+ * 不加 --check 行为不变（纯本地读，保护 cron）。
+ */
+export async function cmdAuthStatus(cfg, args) {
+    const ep = endpointFor(cfg);
+    const profileName = profileNameFromBaseUrl(ep.baseUrl);
+    const session = AuthTokenSession.fromProfile(cfg);
+    let tokenLine = '❌ 未申请（跑 bdip auth token-login 或 bdip auth cookie-login）';
+    let extra = '';
+    if (session.data.token) {
+        const left = Math.round(((session.data.cookieSavedAt || 0) + (session.data.expireSeconds || 0) * 1000 - Date.now()) / 60000);
+        tokenLine = session.isExpired ? '⚠ 本地已过期' : `✅ 剩余约 ${left} 分钟`;
+        extra = `\n      expireTime: ${session.data.expireTime || '?'}`;
+    }
+    else if (session.data.noToken) {
+        tokenLine = '⚠ noToken（走 cookie 鉴权：系统不支持 aiAgentToken 或已手动导入 cookie）';
+    }
+    console.log('════════════════════════════════════════════════════');
+    console.log(`  BDIP5 认证状态 · ${profileName}`);
+    console.log('─────────────────────────────────────────────────────');
+    console.log(`  配置文件   ${cfg._configPath ?? '?'}`);
+    console.log(`  baseUrl   ${cfg.baseUrl}`);
+    console.log(`  username  ${cfg.username ?? '(未配置)'}`);
+    console.log(`  encPwd    ${cfg.encPassword ? '✅ 已配置（autoFill 可用）' : '❌ 未配置（手动登录）'}`);
+    console.log(`  cookie    ${cfg.cookie ? `已配置 (${cfg.cookie.length} 字符)` : '未配置'}`);
+    console.log(`  aiAgentToken  ${tokenLine}${extra}`);
+    const opts = sessionOptions(cfg);
+    console.log(`  运行期心跳  ${opts.enabled ? `每 ${opts.intervalMs / 1000} 秒` : '已禁用'}`);
+    const lease = keepaliveStatus(cfg);
+    console.log(`  后台保活   ${lease.active ? `运行中，截止 ${new Date(lease.expiresAt).toISOString()}` : lease.status}`);
+    if (args?.flags?.check) {
+        console.log('─────────────────────────────────────────────────────');
+        // Cookie-only identity probe: no browser, no token registration, no business mutation.
+        const state = await probeCookieSession(cfg);
+        console.log(`  Cookie 验证  ${state.authenticated ? `✅ 当前用户 ${state.userId}${state.loginId ? ` (${state.loginId})` : ''}` : `⚠ ${state.message}`}`);
+        console.log(`  会话扩展    ${state.mode === 'extension' && state.authenticated ? `✅ 空闲超时 ${state.idleTimeoutSeconds} 秒` : '尚未验证可用'}`);
+        if (state.authenticated && state.mode === 'native') console.log(`  说明        ${state.message}`);
+        console.log('  token 通道   本地状态见上方；此检查不将本地 token 文件视为服务端有效证明。');
+        if (!state.authenticated) process.exitCode = 1;
+    }
+    console.log('════════════════════════════════════════════════════');
+}
+
+/** Explicit, bounded keepalive across short CLI invocations; never performs a login. */
+export async function cmdKeepAlive(cfg, args) {
+    const flags = args?.flags ?? {};
+    if (flags.stop && flags.status) throw new Error('--stop 与 --status 只能选择一个');
+    const print = value => {
+        if (flags.json) console.log(JSON.stringify(value, null, 2));
+        else console.log(`保活状态：${value.status ?? (value.authenticated ? 'running' : value.code)}${value.userId ? `；当前用户 ${value.userId}` : ''}${value.expiresAt ? `；截止 ${new Date(value.expiresAt).toISOString()}` : ''}${value.message ? `；${value.message}` : ''}`);
+    };
+    if (flags.status) { print(keepaliveStatus(cfg)); return; }
+    if (flags.stop) { print(stopKeepalive(cfg)); return; }
+    const durationMs = parseDuration(flags.duration ?? '8h');
+    if (flags.background) { print(await startBackgroundKeepalive(cfg, durationMs)); return; }
+    const expiresAt = Date.now() + durationMs;
+    await runForegroundKeepalive(cfg, durationMs, state => print({ ...state, status: state.authenticated ? 'running' : 'failed', expiresAt }));
+    if (!flags.json) console.log('本次前台保活已结束。');
+}