bdip-office-assistant-cli 0.0.0-stage → 1.0.0

package/dist/browser-links.js

@@ -0,0 +1,223 @@
+import { refreshCookie, mergeResponseCookies, authFailureCode, latchForcedOffline, assertSessionNotForcedOffline } from './session.js';
+
+// Browser authentication belongs at the final output boundary. Business URL builders
+// remain pure; this module never calls business APIs or acquires native SSO tokens.
+const ISSUE_PATH = '/api/bdip/assistant/browser-links';
+const OPEN_PATH = '/api/bdip/assistant/open';
+const BATCH_SIZE = 50;
+const CONCURRENCY = 3;
+const MAX_TTL_MS = 60 * 60 * 1000;
+const warnedConfigs = new WeakSet();
+let warnedInvalidConfig = false;
+const PAGE_PATHS = new Set([
+    '/wui/index.html', '/spa/workflow/static4form/index.html', '/spa/workflow/static4mobileform/index.html', '/spa/cube/index.html',
+    '/spa/email/static/index.html', '/spa/workplan/static/index.html', '/spa/hrm/index_mobx.html',
+]);
+
+function plain(targetUrl, status, reason = null) {
+    return { targetUrl: targetUrl ?? null, url: targetUrl || null,
+        browserLinkStatus: status, expiresAt: null, browserLinkReason: reason };
+}
+
+function configuration(cfg) {
+    const raw = String(cfg?.baseUrl ?? '').replace(/\/+$/, '');
+    if (!/^https?:\/\//i.test(raw) || /[\s\\]/.test(raw)) throw Error('invalid-base');
+    const base = new URL(raw);
+    if (base.username || base.password || base.search || base.hash
+        || base.pathname !== (raw.match(/^https?:\/\/[^/?#]+([^?#]*)/i)?.[1] || '/')) throw Error('invalid-base');
+    const pagePaths = new Set(PAGE_PATHS);
+    // Exact paths relative to the OA context: for baseUrl=https://oa/e9 use
+    // /custom/page.jsp, not /e9/custom/page.jsp. CLI extras ADD to defaults;
+    // server allowedTargetPaths REPLACES its defaults and must include them.
+    // Invalid entries and wildcards never widen access.
+    const extras = cfg?.browserLinks?.allowedPaths;
+    for (const path of Array.isArray(extras) ? extras : typeof extras === 'string' ? extras.split(',').map(p => p.trim()) : []) {
+        if (typeof path !== 'string' || !/^\/(?!\/)/.test(path)
+            || /[\u0000-\u0020\u007f\\%*?#]/.test(path)
+            || /(?:^|\/)(?:api|ssologin|login|logout|download|upload|print|pdf)(?:[/.]|$)/i.test(path)
+            || /\.(?:pdf|zip|xlsx?|docx?|png|jpe?g|gif)$/i.test(path)) continue;
+        if (new URL(path, 'https://path.invalid').pathname === path) pagePaths.add(path);
+    }
+    return { base, context: base.pathname.replace(/\/+$/, ''), endpoint: raw + ISSUE_PATH, pagePaths };
+}
+
+function targetPolicy(target, { base, context, pagePaths }) {
+    if (typeof target !== 'string' || !target) return 'unavailable';
+    if (!/^https?:\/\//i.test(target) || /[\u0000-\u0020\u007f\\]/.test(target)) return 'excluded';
+    let parsed;
+    try { parsed = new URL(target); } catch { return 'excluded'; }
+    if (parsed.origin !== base.origin || parsed.username || parsed.password
+        || parsed.pathname !== (target.match(/^https?:\/\/[^/?#]+([^?#]*)/i)?.[1] || '/')) return 'excluded';
+    if (context && !parsed.pathname.startsWith(context + '/')) return 'excluded';
+    const path = parsed.pathname.slice(context.length);
+    // Only browser pages are eligible. File/API/print/PDF requests never enter the issuer.
+    if (!pagePaths.has(path)) return 'excluded';
+    const decoded = (() => { try { return decodeURIComponent(parsed.search + parsed.hash); } catch { return ''; } })();
+    if (/(?:[?&#]|^)(?:ssoToken|ticket|token|aiAgentToken|redirect|redirectUrl|url|target|download|upload|print|pdf)=/i.test(decoded)
+        || /(?:\/|[?&#])(?:print|pdf|download|upload)(?:[/?&#=]|$)/i.test(decoded)) return 'excluded';
+    return 'eligible';
+}
+
+function bridgeUrl(value, conf) {
+    if (typeof value !== 'string' || !/^https?:\/\//i.test(value) || /[\u0000-\u0020\u007f\\]/.test(value)) return false;
+    let url;
+    try { url = new URL(value); } catch { return false; }
+    if (url.origin !== conf.base.origin || url.username || url.password || url.hash
+        || url.pathname !== conf.context + OPEN_PATH
+        || url.pathname !== value.match(/^https?:\/\/[^/?#]+([^?#]*)/i)?.[1]) return false;
+    const keys = [...url.searchParams.keys()];
+    return keys.length === 1 && keys[0] === 'ticket' && /^[A-Za-z0-9_-]{16,256}$/.test(url.searchParams.get('ticket'));
+}
+
+function expiryMillis(value) {
+    if (typeof value === 'number') return value;
+    if (typeof value !== 'string' || !value) return NaN;
+    return /^\d+$/.test(value) ? Number(value) : Date.parse(value);
+}
+
+function warnOnce(cfg, options) {
+    if (cfg && typeof cfg === 'object') {
+        if (warnedConfigs.has(cfg)) return;
+        warnedConfigs.add(cfg);
+    }
+    else {
+        if (warnedInvalidConfig) return;
+        warnedInvalidConfig = true;
+    }
+    const diagnostic = options.diagnostic ?? ((message) => console.error(message));
+    diagnostic('[browser-links] 浏览器免登录链接暂不可用（扩展未部署、Cookie 失效或响应无效）；业务结果已保留，链接回退原页面，可能需要登录。');
+}
+
+/**
+ * Resolve a batch of final clickable OA page URLs using the current Cookie only.
+ * Order/duplicates and hashes are preserved; eligible targets are serialized with
+ * URL.href before submission so Unicode matches the server's ASCII URI binding.
+ * Failed links retain their original URL. Batches are deduplicated and bounded;
+ * nothing is cached across calls or account changes.
+ * Failure is data, never a reason to retry a successful business operation.
+ */
+export async function resolveBrowserLinks(cfg, targetUrls, options = {}) {
+    const targets = Array.from(targetUrls ?? []);
+    let conf;
+    try { conf = configuration(cfg); } catch {
+        if (targets.length) warnOnce(cfg, options);
+        return targets.map((target) => plain(target, 'fallback', 'invalid-configuration'));
+    }
+    // Refresh only local credentials; direct link output must never start a
+    // heartbeat or token login. Forced-offline/profile changes remain fallback data.
+    let sessionFailure = null;
+    try { refreshCookie(cfg); assertSessionNotForcedOffline(cfg); }
+    catch (error) {
+        sessionFailure = error.code === 'FORCED_OFFLINE' ? 'forced-offline'
+            : error.code === 'PROFILE_CHANGED' ? 'profile-changed' : 'session-unavailable';
+    }
+    const resolved = new Map();
+    const pending = [];
+    const originals = new Map();
+    const store = (target, result) => {
+        for (const original of originals.get(target)) {
+            resolved.set(original, result.browserLinkStatus === 'sso'
+                ? result : plain(original, result.browserLinkStatus, result.browserLinkReason));
+        }
+    };
+    for (const target of targets) {
+        if (resolved.has(target)) continue;
+        const policy = targetPolicy(target, conf);
+        if (policy !== 'eligible') resolved.set(target, plain(target, policy, policy === 'excluded' ? 'not-an-oa-browser-page' : 'missing-target'));
+        else if (cfg.browserLinks?.enabled === false) resolved.set(target, plain(target, 'disabled', 'disabled-by-configuration'));
+        else if (sessionFailure) resolved.set(target, plain(target, 'fallback', sessionFailure));
+        else if (!String(cfg.cookie ?? '').trim()) resolved.set(target, plain(target, 'fallback', 'missing-cookie'));
+        else {
+            // Validate the raw path before URL serialization: canonicalization must
+            // never turn forbidden dot segments into an allowed browser page.
+            const canonical = new URL(target).href;
+            resolved.set(target, null);
+            if (!originals.has(canonical)) { originals.set(canonical, []); pending.push(canonical); }
+            originals.get(canonical).push(target);
+        }
+    }
+    const batches = [];
+    for (let i = 0; i < pending.length; i += BATCH_SIZE) batches.push(pending.slice(i, i + BATCH_SIZE));
+    let cursor = 0;
+    // Capture credentials for this resolution, with no shared ticket cache. A later
+    // invocation after identityShift always asks the server for the current identity.
+    const cookie = String(cfg.cookie ?? '');
+    const credential = { ...cfg, cookie };
+    const worker = async () => {
+        while (cursor < batches.length) {
+            const batch = batches[cursor++];
+            let reason = 'issuer-unavailable';
+            try {
+                // A concurrent batch may already have observed 003/004 for this Cookie.
+                assertSessionNotForcedOffline(credential);
+                const response = await fetch(conf.endpoint, {
+                    method: 'POST', redirect: 'error', cache: 'no-store',
+                    headers: { Cookie: cookie, Accept: 'application/json',
+                        'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8' },
+                    body: new URLSearchParams({ targets: JSON.stringify(batch) }),
+                    signal: AbortSignal.timeout(10000),
+                });
+                const json = await response.json().catch(() => null);
+                const authFailure = authFailureCode(response.status, json);
+                if (authFailure === 'FORCED_OFFLINE') {
+                    // Bind the latch to the Cookie actually sent, and never accept
+                    // replacement cookies supplied by a forced-offline response.
+                    latchForcedOffline(cfg, { mode: 'cookie' }, cookie);
+                    reason = 'forced-offline';
+                }
+                else if (authFailure === 'SESSION_EXPIRED' || response.status === 403) reason = 'cookie-expired';
+                else if (!response.ok) reason = 'issuer-unavailable';
+                else {
+                    const data = json?.data;
+                    const identity = data && String(data.userId ?? '').trim() && String(data.loginId ?? '').trim();
+                    if (json?.success === true && identity && Array.isArray(data.links)) {
+                        assertSessionNotForcedOffline(credential);
+                        mergeResponseCookies(cfg, response.headers, cookie);
+                        const rows = new Map();
+                        const duplicates = new Set();
+                        for (const row of data.links) {
+                            if (!batch.includes(row?.targetUrl)) continue;
+                            if (rows.has(row.targetUrl)) duplicates.add(row.targetUrl);
+                            rows.set(row.targetUrl, row);
+                        }
+                        const now = Date.now();
+                        for (const target of batch) {
+                            const row = rows.get(target);
+                            const expires = expiryMillis(row?.expiresAt);
+                            if (!duplicates.has(target) && bridgeUrl(row?.url, conf)
+                                && Number.isFinite(expires) && expires > now && expires <= now + MAX_TTL_MS) {
+                                store(target, { targetUrl: target, url: row.url, browserLinkStatus: 'sso',
+                                    expiresAt: new Date(expires).toISOString(), browserLinkReason: null,
+                                    userId: String(data.userId), loginId: String(data.loginId) });
+                            }
+                            else store(target, plain(target, 'fallback', 'invalid-link-response'));
+                        }
+                        continue;
+                    }
+                    reason = 'invalid-issuer-response';
+                }
+            }
+            catch (error) {
+                // Never echo remote errors, cookies, or native tokens.
+                if (error.code === 'FORCED_OFFLINE') reason = 'forced-offline';
+            }
+            for (const target of batch) store(target, plain(target, 'fallback', reason));
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(CONCURRENCY, batches.length) }, worker));
+    const results = targets.map((target) => ({ ...resolved.get(target) }));
+    if (results.some((result) => result.browserLinkStatus === 'fallback')) warnOnce(cfg, options);
+    return results;
+}
+
+export async function resolveBrowserLink(cfg, targetUrl, options = {}) {
+    return (await resolveBrowserLinks(cfg, [targetUrl], options))[0];
+}
+
+/** Common Markdown status suffix, using exactly the resolution returned in JSON. */
+export function browserLinkNote(link) {
+    if (link?.browserLinkStatus === 'sso') return `（免登录链接有效至 ${link.expiresAt}）`;
+    if (link?.browserLinkStatus === 'fallback') return '（免登录链接不可用，可能需要登录）';
+    if (link?.browserLinkStatus === 'disabled') return '（普通页面，可能需要登录）';
+    return '';
+}

package/dist/captcha-display.js

@@ -0,0 +1,30 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readCaptchaAnswer } from './password-input.js';
+function invalid() { const e = new Error('验证码图片格式或大小无效；未保存挑战。'); e.code = 'PASSWORD_CAPTCHA_INVALID'; return e; }
+/** Only an ephemeral image is written, never credentials, challenge keys or cookies. */
+export async function promptCaptcha(challenge, { input = process.stdin, readAnswer = readCaptchaAnswer, signal, notify = value => console.error('BDIP_CAPTCHA_REQUIRED ' + JSON.stringify(value)) } = {}) {
+    const { image, contentType } = challenge ?? {};
+    const mime = String(contentType ?? '').split(';')[0].trim().toLowerCase();
+    const png = Buffer.isBuffer(image) && image.subarray(0, 8).equals(Buffer.from([137,80,78,71,13,10,26,10]));
+    const jpg = Buffer.isBuffer(image) && image[0] === 255 && image[1] === 216 && image[2] === 255;
+    const gif = Buffer.isBuffer(image) && /^GIF8[79]a$/.test(image.subarray(0,6).toString('ascii'));
+    const extension = mime === 'image/png' && png ? 'png' : mime === 'image/jpeg' && jpg ? 'jpg' : mime === 'image/gif' && gif ? 'gif' : null;
+    if (!extension || !image.length || image.length > 1024 * 1024) throw invalid();
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'bdip-captcha-'));
+    fs.chmodSync(directory, 0o700);
+    const file = path.join(directory, 'captcha.' + extension);
+    try {
+        fs.writeFileSync(file, image, { mode: 0o600, flag: 'wx' });
+        notify({ imagePath: file, contentType: mime, expiresAt: Date.now() + 300000,
+            instruction: '展示图片给用户人工填写；保持此进程和 stdin 打开，下一行输入仅含 captcha 的 JSON，不要另开登录进程。' });
+        return await readAnswer(input, { timeoutMs: 300000, signal });
+    } finally {
+        // Only remove the fixed leaf and exact mkdtemp directory created above.
+        if (path.basename(directory).startsWith('bdip-captcha-') && path.dirname(file) === directory) {
+            try { fs.unlinkSync(file); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+            fs.rmdirSync(directory);
+        }
+    }
+}