botrun-horse 2.29.2 → 2.30.0

package/botrun-c/scripts/github-collaborator-manager.ts

@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+/**
+ * GitHub Collaborator 管理工具 (TypeScript 版本)
+ *
+ * 使用方式:
+ *   export GITHUB_TOKEN="ghp_your_token_here"
+ *   npx tsx github-collaborator-manager.ts <command> [args...]
+ *
+ * 或整合到 Node.js 程式:
+ *   import { GitHubCollaboratorManager } from './github-collaborator-manager';
+ *   const manager = new GitHubCollaboratorManager('ghp_token', 'bohachu');
+ *   await manager.addCollaborator('my-repo', 'alice', 'push');
+ */
+
+// ==================== 型別定義 ====================
+interface Collaborator {
+  login: string;
+  permissions: {
+    pull: boolean;
+    push: boolean;
+    admin: boolean;
+  };
+}
+
+interface Repository {
+  name: string;
+  private: boolean;
+  html_url: string;
+}
+
+type Permission = 'pull' | 'push' | 'admin';
+
+// ==================== GitHubCollaboratorManager 類別 ====================
+class GitHubCollaboratorManager {
+  private token: string;
+  private owner: string;
+  private apiBase = 'https://api.github.com';
+
+  constructor(token: string, owner: string) {
+    this.token = token;
+    this.owner = owner;
+  }
+
+  // ========== API 呼叫基礎函數 ==========
+  private async apiCall<T>(
+    method: string,
+    endpoint: string,
+    data?: any
+  ): Promise<T> {
+    const url = `${this.apiBase}${endpoint}`;
+    const headers: HeadersInit = {
+      'Authorization': `token ${this.token}`,
+      'Accept': 'application/vnd.github.v3+json',
+      'Content-Type': 'application/json',
+    };
+
+    const options: RequestInit = {
+      method,
+      headers,
+    };
+
+    if (data) {
+      options.body = JSON.stringify(data);
+    }
+
+    const response = await fetch(url, options);
+
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new Error(
+        `GitHub API 錯誤 (${response.status}): ${error.message || response.statusText}`
+      );
+    }
+
+    // DELETE 請求可能沒有 body
+    if (method === 'DELETE') {
+      return {} as T;
+    }
+
+    return response.json();
+  }
+
+  // ========== 驗證 Token ==========
+  async verifyToken(): Promise<{ valid: boolean; login?: string }> {
+    try {
+      const user: any = await this.apiCall('GET', '/user');
+      return { valid: true, login: user.login };
+    } catch (error) {
+      return { valid: false };
+    }
+  }
+
+  // ========== 列出所有 Repo ==========
+  async listRepositories(): Promise<Repository[]> {
+    return this.apiCall<Repository[]>(
+      'GET',
+      `/users/${this.owner}/repos?per_page=100`
+    );
+  }
+
+  // ========== 列出 Collaborators ==========
+  async listCollaborators(repo: string): Promise<Collaborator[]> {
+    return this.apiCall<Collaborator[]>(
+      'GET',
+      `/repos/${this.owner}/${repo}/collaborators`
+    );
+  }
+
+  // ========== 新增 Collaborator ==========
+  async addCollaborator(
+    repo: string,
+    username: string,
+    permission: Permission = 'push'
+  ): Promise<void> {
+    await this.apiCall(
+      'PUT',
+      `/repos/${this.owner}/${repo}/collaborators/${username}`,
+      { permission }
+    );
+  }
+
+  // ========== 移除 Collaborator ==========
+  async removeCollaborator(repo: string, username: string): Promise<void> {
+    await this.apiCall(
+      'DELETE',
+      `/repos/${this.owner}/${repo}/collaborators/${username}`
+    );
+  }
+
+  // ========== 批次新增 Collaborator ==========
+  async batchAddCollaborator(
+    username: string,
+    permission: Permission = 'push',
+    repoFilter?: (repo: Repository) => boolean
+  ): Promise<{ success: string[]; failed: string[] }> {
+    const repos = await this.listRepositories();
+    const targetRepos = repoFilter ? repos.filter(repoFilter) : repos;
+
+    const success: string[] = [];
+    const failed: string[] = [];
+
+    for (const repo of targetRepos) {
+      try {
+        await this.addCollaborator(repo.name, username, permission);
+        success.push(repo.name);
+      } catch (error) {
+        failed.push(repo.name);
+      }
+    }
+
+    return { success, failed };
+  }
+
+  // ========== 生成報告 ==========
+  async generateReport(): Promise<string> {
+    const repos = await this.listRepositories();
+    let report = '='.repeat(50) + '\n';
+    report += `GitHub Collaborator 報告\n`;
+    report += `Owner: ${this.owner}\n`;
+    report += `時間: ${new Date().toLocaleString('zh-TW')}\n`;
+    report += '='.repeat(50) + '\n\n';
+
+    for (const repo of repos) {
+      report += `🔹 ${repo.name} (${repo.private ? 'private' : 'public'})\n`;
+      try {
+        const collaborators = await this.listCollaborators(repo.name);
+        for (const collab of collaborators) {
+          const perms = Object.entries(collab.permissions)
+            .filter(([_, v]) => v)
+            .map(([k, _]) => k)
+            .join(', ');
+          report += `    - ${collab.login} (${perms})\n`;
+        }
+      } catch (error) {
+        report += `    ⚠️  無法存取\n`;
+      }
+      report += '\n';
+    }
+
+    return report;
+  }
+}
+
+// ==================== CLI 介面 ====================
+async function main() {
+  const token = process.env.GITHUB_TOKEN;
+  if (!token) {
+    console.error('❌ 請設定 GITHUB_TOKEN 環境變數');
+    console.error('範例: export GITHUB_TOKEN="ghp_your_token_here"');
+    process.exit(1);
+  }
+
+  const owner = process.env.GITHUB_OWNER || 'bohachu';  // ⚠️ 修改預設值
+  const manager = new GitHubCollaboratorManager(token, owner);
+
+  const [, , command, ...args] = process.argv;
+
+  try {
+    switch (command) {
+      case 'verify': {
+        const result = await manager.verifyToken();
+        if (result.valid) {
+          console.log(`✅ Token 有效！目前登入為: ${result.login}`);
+        } else {
+          console.error('❌ Token 無效或已過期');
+          process.exit(1);
+        }
+        break;
+      }
+
+      case 'list-repos': {
+        const repos = await manager.listRepositories();
+        console.log(`📚 ${owner} 的所有 repo (${repos.length} 個):\n`);
+        repos.forEach(repo => {
+          console.log(`  - ${repo.name} (${repo.private ? 'private' : 'public'})`);
+        });
+        break;
+      }
+
+      case 'list': {
+        const [repo] = args;
+        if (!repo) {
+          console.error('❌ 請指定 repo 名稱');
+          process.exit(1);
+        }
+        const collaborators = await manager.listCollaborators(repo);
+        console.log(`📋 ${owner}/${repo} 的 collaborators:\n`);
+        collaborators.forEach(collab => {
+          const perms = Object.entries(collab.permissions)
+            .filter(([_, v]) => v)
+            .map(([k, _]) => k)
+            .join(', ');
+          console.log(`  - ${collab.login} (${perms})`);
+        });
+        break;
+      }
+
+      case 'add': {
+        const [repo, username, permission = 'push'] = args;
+        if (!repo || !username) {
+          console.error('❌ 使用方式: add <repo> <username> [permission]');
+          process.exit(1);
+        }
+        await manager.addCollaborator(repo, username, permission as Permission);
+        console.log(`✅ 成功邀請 ${username} 到 ${repo} (權限: ${permission})`);
+        break;
+      }
+
+      case 'remove': {
+        const [repo, username] = args;
+        if (!repo || !username) {
+          console.error('❌ 使用方式: remove <repo> <username>');
+          process.exit(1);
+        }
+        await manager.removeCollaborator(repo, username);
+        console.log(`✅ 成功移除 ${username} 從 ${repo}`);
+        break;
+      }
+
+      case 'batch-add': {
+        const [username, permission = 'push'] = args;
+        if (!username) {
+          console.error('❌ 使用方式: batch-add <username> [permission]');
+          process.exit(1);
+        }
+        console.log(`⏳ 批次新增 ${username} 到所有 repo...`);
+        const result = await manager.batchAddCollaborator(
+          username,
+          permission as Permission
+        );
+        console.log(`\n✅ 成功: ${result.success.length} 個`);
+        if (result.failed.length > 0) {
+          console.log(`❌ 失敗: ${result.failed.length} 個`);
+          console.log(`失敗的 repo: ${result.failed.join(', ')}`);
+        }
+        break;
+      }
+
+      case 'report': {
+        console.log('⏳ 生成報告中...\n');
+        const report = await manager.generateReport();
+        console.log(report);
+        break;
+      }
+
+      default: {
+        console.log(`
+📚 GitHub Collaborator 管理工具 (TypeScript 版本)
+
+使用方式:
+  export GITHUB_TOKEN="ghp_your_token_here"
+  npx tsx github-collaborator-manager.ts <command> [args...]
+
+命令:
+  verify                              驗證 Token 是否有效
+  list-repos                          列出所有 repo
+  list <repo>                         列出某個 repo 的 collaborator
+  add <repo> <username> [permission]  新增 collaborator
+  remove <repo> <username>            移除 collaborator
+  batch-add <username> [permission]   批次新增到所有 repo
+  report                              生成完整報告
+
+範例:
+  npx tsx github-collaborator-manager.ts verify
+  npx tsx github-collaborator-manager.ts list my-repo
+  npx tsx github-collaborator-manager.ts add my-repo alice push
+  npx tsx github-collaborator-manager.ts remove my-repo bob
+  npx tsx github-collaborator-manager.ts batch-add charlie admin
+  npx tsx github-collaborator-manager.ts report
+        `);
+        break;
+      }
+    }
+  } catch (error) {
+    console.error(`❌ 錯誤: ${(error as Error).message}`);
+    process.exit(1);
+  }
+}
+
+// ==================== 執行 CLI 或匯出類別 ====================
+if (require.main === module) {
+  main();
+}
+
+export { GitHubCollaboratorManager, Collaborator, Repository, Permission };

package/botrun-c/scripts/manage-collaborators.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+# GitHub Collaborator 管理工具
+# 使用方式: ./manage-collaborators.sh <action> <repo> <username>
+
+set -e
+
+GITHUB_TOKEN="${GITHUB_TOKEN:-}"
+OWNER="bohachu"  # 修改為你的 GitHub 帳號
+
+if [ -z "$GITHUB_TOKEN" ]; then
+  echo "❌ 錯誤: 請設定 GITHUB_TOKEN 環境變數"
+  echo "範例: export GITHUB_TOKEN='ghp_your_token_here'"
+  exit 1
+fi
+
+show_usage() {
+  cat << EOF
+📚 使用方式:
+  ./manage-collaborators.sh list <repo>
+  ./manage-collaborators.sh add <repo> <username> [permission]
+  ./manage-collaborators.sh remove <repo> <username>
+  ./manage-collaborators.sh list-all
+
+參數:
+  permission: pull (唯讀), push (讀寫), admin (管理員)，預設 push
+
+範例:
+  ./manage-collaborators.sh list botrun-claude-agent-jp-doctor-日本醫生mcp
+  ./manage-collaborators.sh add my-repo alice push
+  ./manage-collaborators.sh remove my-repo bob
+  ./manage-collaborators.sh list-all
+EOF
+}
+
+cmd_list() {
+  local repo="$1"
+  echo "📋 Collaborators in $OWNER/$repo:"
+  gh api "/repos/$OWNER/$repo/collaborators" --jq '.[] | "  - \(.login) (\(.permissions | to_entries[] | select(.value == true) | .key | gsub("push"; "write")))"'
+}
+
+cmd_add() {
+  local repo="$1"
+  local username="$2"
+  local permission="${3:-push}"
+
+  echo "➕ 新增 $username 到 $OWNER/$repo (權限: $permission)..."
+  gh api -X PUT "/repos/$OWNER/$repo/collaborators/$username" \
+    -f permission="$permission"
+  echo "✅ 成功！"
+}
+
+cmd_remove() {
+  local repo="$1"
+  local username="$2"
+
+  echo "➖ 移除 $username 從 $OWNER/$repo..."
+  gh api -X DELETE "/repos/$OWNER/$repo/collaborators/$username"
+  echo "✅ 成功！"
+}
+
+cmd_list_all() {
+  echo "📚 列出所有 repo 的 collaborators..."
+  for repo in $(gh repo list "$OWNER" --limit 1000 --json name -q '.[].name'); do
+    echo ""
+    echo "🔹 $repo"
+    cmd_list "$repo" || echo "  ⚠️  無法存取"
+  done
+}
+
+# Main
+case "${1:-}" in
+  list)
+    [ -z "$2" ] && { show_usage; exit 1; }
+    cmd_list "$2"
+    ;;
+  add)
+    [ -z "$2" ] || [ -z "$3" ] && { show_usage; exit 1; }
+    cmd_add "$2" "$3" "${4:-push}"
+    ;;
+  remove)
+    [ -z "$2" ] || [ -z "$3" ] && { show_usage; exit 1; }
+    cmd_remove "$2" "$3"
+    ;;
+  list-all)
+    cmd_list_all
+    ;;
+  *)
+    show_usage
+    exit 1
+    ;;
+esac

package/botrun-c/scripts/setup-secrets.sh

@@ -0,0 +1,202 @@
+#!/bin/bash
+# ==============================================================================
+# Google Secret Manager 設定腳本
+# 用途：將所有敏感環境變數遷移到 Google Secret Manager
+# ==============================================================================
+
+set -e  # 遇到錯誤立即停止
+
+# 顏色定義
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+echo -e "${GREEN}======================================${NC}"
+echo -e "${GREEN}Google Secret Manager 設定${NC}"
+echo -e "${GREEN}======================================${NC}"
+echo ""
+
+# ==============================================================================
+# 1. 檢查必要工具
+# ==============================================================================
+echo -e "${YELLOW}[1/6] 檢查必要工具...${NC}"
+
+if ! command -v gcloud &> /dev/null; then
+    echo -e "${RED}錯誤: 找不到 gcloud CLI${NC}"
+    echo "請安裝 Google Cloud SDK: https://cloud.google.com/sdk/docs/install"
+    exit 1
+fi
+
+if ! command -v jq &> /dev/null; then
+    echo -e "${RED}錯誤: 找不到 jq${NC}"
+    echo "請安裝 jq: brew install jq"
+    exit 1
+fi
+
+echo -e "${GREEN}✓ 工具檢查完成${NC}"
+echo ""
+
+# ==============================================================================
+# 2. 設定 GCP 專案
+# ==============================================================================
+echo -e "${YELLOW}[2/6] 設定 GCP 專案...${NC}"
+
+# 從 .env 讀取專案 ID
+if [ -f .env ]; then
+    export $(grep -v '^#' .env | grep GOOGLE_CLOUD_PROJECT | xargs)
+fi
+
+# 如果沒有設定，詢問使用者
+if [ -z "$GOOGLE_CLOUD_PROJECT" ]; then
+    echo -e "${YELLOW}請輸入 GCP 專案 ID:${NC}"
+    read -r GOOGLE_CLOUD_PROJECT
+fi
+
+echo "使用專案: $GOOGLE_CLOUD_PROJECT"
+gcloud config set project "$GOOGLE_CLOUD_PROJECT"
+
+echo -e "${GREEN}✓ 專案設定完成${NC}"
+echo ""
+
+# ==============================================================================
+# 3. 啟用 Secret Manager API
+# ==============================================================================
+echo -e "${YELLOW}[3/6] 啟用 Secret Manager API...${NC}"
+
+gcloud services enable secretmanager.googleapis.com
+
+echo -e "${GREEN}✓ API 已啟用${NC}"
+echo ""
+
+# ==============================================================================
+# 4. 建立 secrets（從 .env 讀取）
+# ==============================================================================
+echo -e "${YELLOW}[4/6] 遷移敏感環境變數到 Secret Manager...${NC}"
+
+# 定義需要遷移的 secrets（極高敏感度）
+CRITICAL_SECRETS=(
+    "ANTHROPIC_API_KEY"
+)
+
+# 定義需要遷移的 service account JSON 檔案
+SERVICE_ACCOUNT_FILES=(
+    "keys/agentic-botrun-gcs-service-account-key.json:GCS_SERVICE_ACCOUNT_JSON"
+    "keys/firebase-admin-key.json:FIREBASE_SERVICE_ACCOUNT_JSON"
+)
+
+# 從 .env 讀取環境變數
+if [ -f .env ]; then
+    export $(grep -v '^#' .env | xargs)
+fi
+
+# 遷移環境變數
+for SECRET_NAME in "${CRITICAL_SECRETS[@]}"; do
+    echo -e "${YELLOW}處理: $SECRET_NAME${NC}"
+
+    # 取得環境變數的值
+    SECRET_VALUE="${!SECRET_NAME}"
+
+    if [ -z "$SECRET_VALUE" ]; then
+        echo -e "${RED}警告: $SECRET_NAME 未設定，跳過${NC}"
+        continue
+    fi
+
+    # 檢查 secret 是否已存在
+    if gcloud secrets describe "$SECRET_NAME" &> /dev/null; then
+        echo "Secret $SECRET_NAME 已存在，新增新版本..."
+        echo -n "$SECRET_VALUE" | gcloud secrets versions add "$SECRET_NAME" --data-file=-
+    else
+        echo "建立新 secret: $SECRET_NAME"
+        echo -n "$SECRET_VALUE" | gcloud secrets create "$SECRET_NAME" \
+            --data-file=- \
+            --replication-policy="automatic"
+    fi
+
+    echo -e "${GREEN}✓ $SECRET_NAME 已遷移${NC}"
+    echo ""
+done
+
+# 遷移 service account JSON 檔案
+for FILE_MAPPING in "${SERVICE_ACCOUNT_FILES[@]}"; do
+    FILE_PATH="${FILE_MAPPING%%:*}"
+    SECRET_NAME="${FILE_MAPPING##*:}"
+
+    echo -e "${YELLOW}處理: $SECRET_NAME (from $FILE_PATH)${NC}"
+
+    if [ ! -f "$FILE_PATH" ]; then
+        echo -e "${RED}警告: 找不到檔案 $FILE_PATH，跳過${NC}"
+        continue
+    fi
+
+    # 檢查 secret 是否已存在
+    if gcloud secrets describe "$SECRET_NAME" &> /dev/null; then
+        echo "Secret $SECRET_NAME 已存在，新增新版本..."
+        gcloud secrets versions add "$SECRET_NAME" --data-file="$FILE_PATH"
+    else
+        echo "建立新 secret: $SECRET_NAME"
+        gcloud secrets create "$SECRET_NAME" \
+            --data-file="$FILE_PATH" \
+            --replication-policy="automatic"
+    fi
+
+    echo -e "${GREEN}✓ $SECRET_NAME 已遷移${NC}"
+    echo ""
+done
+
+echo -e "${GREEN}✓ 所有 secrets 遷移完成${NC}"
+echo ""
+
+# ==============================================================================
+# 5. 設定 Cloud Run 服務帳戶權限
+# ==============================================================================
+echo -e "${YELLOW}[5/6] 設定服務帳戶權限...${NC}"
+
+# 取得專案編號
+PROJECT_NUMBER=$(gcloud projects describe "$GOOGLE_CLOUD_PROJECT" --format="value(projectNumber)")
+
+# Cloud Run 預設服務帳戶
+SERVICE_ACCOUNT="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
+
+echo "授予 Secret Manager 存取權限給: $SERVICE_ACCOUNT"
+
+# 為每個 secret 授予存取權限
+ALL_SECRETS=("${CRITICAL_SECRETS[@]}")
+for FILE_MAPPING in "${SERVICE_ACCOUNT_FILES[@]}"; do
+    SECRET_NAME="${FILE_MAPPING##*:}"
+    ALL_SECRETS+=("$SECRET_NAME")
+done
+
+for SECRET_NAME in "${ALL_SECRETS[@]}"; do
+    echo "授權 $SECRET_NAME..."
+    gcloud secrets add-iam-policy-binding "$SECRET_NAME" \
+        --member="serviceAccount:$SERVICE_ACCOUNT" \
+        --role="roles/secretmanager.secretAccessor" \
+        &> /dev/null || true
+done
+
+echo -e "${GREEN}✓ 權限設定完成${NC}"
+echo ""
+
+# ==============================================================================
+# 6. 產生摘要報告
+# ==============================================================================
+echo -e "${YELLOW}[6/6] 產生摘要報告...${NC}"
+echo ""
+echo -e "${GREEN}======================================${NC}"
+echo -e "${GREEN}設定完成！${NC}"
+echo -e "${GREEN}======================================${NC}"
+echo ""
+echo "已建立的 Secrets:"
+gcloud secrets list --format="table(name,createTime)"
+echo ""
+echo -e "${YELLOW}下一步:${NC}"
+echo "1. 更新 Cloud Run 部署，使用 Secret Manager"
+echo "2. 從 .env 檔案移除敏感變數"
+echo "3. 測試應用程式運作正常"
+echo ""
+echo -e "${RED}重要提醒:${NC}"
+echo "- 請立即重置所有已洩露的 API 金鑰"
+echo "- 不要將 .env 檔案提交到 git"
+echo "- 定期輪換 secrets"
+echo ""