botrun-horse 2.29.2 → 2.30.0

package/botrun-c/api/admin-tools/check-whitelist.mjs.migration-bak

@@ -0,0 +1,74 @@
+/**
+ * Check Firestore whitelist
+ * 檢查 Firestore 白名單設定
+ */
+
+import admin from 'firebase-admin';
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, resolve } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+// Initialize Firebase Admin
+const serviceAccountPath = resolve(__dirname, '../../keys/agentic-botrun-gcs-service-account-key.json');
+const serviceAccount = JSON.parse(readFileSync(serviceAccountPath, 'utf8'));
+
+if (!admin.apps.length) {
+  admin.initializeApp({
+    credential: admin.credential.cert(serviceAccount)
+  });
+}
+
+const db = admin.firestore();
+
+async function checkWhitelist() {
+  try {
+    console.log('🔍 Checking Firestore whitelist...\n');
+
+    // Check system/allowedUsers document
+    const systemDoc = await db.collection('system').doc('allowedUsers').get();
+
+    if (!systemDoc.exists) {
+      console.log('❌ system/allowedUsers document not found!');
+      return;
+    }
+
+    const systemData = systemDoc.data();
+    console.log('📋 Allowed Emails:', systemData.emails || []);
+    console.log('');
+
+    // Check individual user documents
+    const usersSnapshot = await db.collection('users').get();
+
+    if (usersSnapshot.empty) {
+      console.log('❌ No users found in users collection!');
+      return;
+    }
+
+    console.log('👥 User Documents:\n');
+    usersSnapshot.forEach(doc => {
+      const data = doc.data();
+      console.log(`📧 ${doc.id}`);
+      console.log(`   allowedService: ${data.allowedService || 'N/A'}`);
+      console.log(`   role: ${data.role || 'N/A'}`);
+      console.log(`   createdAt: ${data.createdAt || 'N/A'}`);
+      console.log('');
+    });
+
+  } catch (error) {
+    console.error('❌ Error checking whitelist:', error);
+    throw error;
+  }
+}
+
+checkWhitelist()
+  .then(() => {
+    console.log('✅ Whitelist check complete');
+    process.exit(0);
+  })
+  .catch((error) => {
+    console.error('❌ Check failed:', error);
+    process.exit(1);
+  });

package/botrun-c/api/admin-tools/create-user.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * 管理者建立 Firebase Auth 使用者帳號
+ * 不需要使用者先登入
+ */
+
+import admin from 'firebase-admin';
+
+console.log('🚀 Creating Firebase Auth users...');
+
+// 初始化 Firebase Admin
+if (!admin.apps || admin.apps.length === 0) {
+  admin.initializeApp({
+    projectId: 'confidential-botrun',
+  });
+}
+
+async function createUser(email, displayName) {
+  try {
+    console.log(`\n📝 Creating user: ${email}`);
+
+    // 檢查使用者是否已存在
+    try {
+      const existingUser = await admin.auth().getUserByEmail(email);
+      console.log(`✅ User already exists: ${existingUser.uid}`);
+      return existingUser;
+    } catch (error) {
+      if (error.code !== 'auth/user-not-found') {
+        throw error;
+      }
+      // 使用者不存在，繼續建立
+    }
+
+    // 建立新使用者
+    const userRecord = await admin.auth().createUser({
+      email: email,
+      emailVerified: false, // 使用者首次登入後會驗證
+      displayName: displayName,
+      disabled: false,
+    });
+
+    console.log(`✅ User created successfully:`);
+    console.log(`   UID: ${userRecord.uid}`);
+    console.log(`   Email: ${userRecord.email}`);
+    console.log(`   Display Name: ${userRecord.displayName}`);
+
+    return userRecord;
+  } catch (error) {
+    console.error(`❌ Error creating user ${email}:`, error.message);
+    throw error;
+  }
+}
+
+// CLI 使用
+const args = process.argv.slice(2);
+
+if (args.length === 0) {
+  // 批次建立預設的兩個使用者
+  const users = [
+    { email: 'bohachu@gmail.com', displayName: 'Bo-Ha Chu' },
+    { email: 'cbh@cameo.tw', displayName: 'CBH' },
+  ];
+
+  console.log(`\n📦 Creating ${users.length} users...\n`);
+
+  for (const user of users) {
+    try {
+      await createUser(user.email, user.displayName);
+      console.log(`\n${'─'.repeat(60)}\n`);
+    } catch (error) {
+      console.error(`Failed for ${user.email}, continuing...`);
+    }
+  }
+
+  console.log('\n✅ User creation complete!');
+  console.log('\n🔧 Next step: Set Custom Claims');
+  console.log('   npx tsx api/src/setup-custom-claims.ts --batch');
+} else {
+  // 單一使用者建立
+  const email = args[0];
+  const displayName = args[1] || email;
+
+  try {
+    await createUser(email, displayName);
+    console.log('\n✅ User created successfully!');
+  } catch (error) {
+    console.error('\n❌ Failed to create user');
+    process.exit(1);
+  }
+}
+
+process.exit(0);

package/botrun-c/api/admin-tools/create-user.mjs.migration-bak

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * 管理者建立 Firebase Auth 使用者帳號
+ * 不需要使用者先登入
+ */
+
+import admin from 'firebase-admin';
+
+console.log('🚀 Creating Firebase Auth users...');
+
+// 初始化 Firebase Admin
+if (!admin.apps || admin.apps.length === 0) {
+  admin.initializeApp({
+    projectId: 'scoop-386004',
+  });
+}
+
+async function createUser(email, displayName) {
+  try {
+    console.log(`\n📝 Creating user: ${email}`);
+
+    // 檢查使用者是否已存在
+    try {
+      const existingUser = await admin.auth().getUserByEmail(email);
+      console.log(`✅ User already exists: ${existingUser.uid}`);
+      return existingUser;
+    } catch (error) {
+      if (error.code !== 'auth/user-not-found') {
+        throw error;
+      }
+      // 使用者不存在，繼續建立
+    }
+
+    // 建立新使用者
+    const userRecord = await admin.auth().createUser({
+      email: email,
+      emailVerified: false, // 使用者首次登入後會驗證
+      displayName: displayName,
+      disabled: false,
+    });
+
+    console.log(`✅ User created successfully:`);
+    console.log(`   UID: ${userRecord.uid}`);
+    console.log(`   Email: ${userRecord.email}`);
+    console.log(`   Display Name: ${userRecord.displayName}`);
+
+    return userRecord;
+  } catch (error) {
+    console.error(`❌ Error creating user ${email}:`, error.message);
+    throw error;
+  }
+}
+
+// CLI 使用
+const args = process.argv.slice(2);
+
+if (args.length === 0) {
+  // 批次建立預設的兩個使用者
+  const users = [
+    { email: 'bohachu@gmail.com', displayName: 'Bo-Ha Chu' },
+    { email: 'cbh@cameo.tw', displayName: 'CBH' },
+  ];
+
+  console.log(`\n📦 Creating ${users.length} users...\n`);
+
+  for (const user of users) {
+    try {
+      await createUser(user.email, user.displayName);
+      console.log(`\n${'─'.repeat(60)}\n`);
+    } catch (error) {
+      console.error(`Failed for ${user.email}, continuing...`);
+    }
+  }
+
+  console.log('\n✅ User creation complete!');
+  console.log('\n🔧 Next step: Set Custom Claims');
+  console.log('   npx tsx api/src/setup-custom-claims.ts --batch');
+} else {
+  // 單一使用者建立
+  const email = args[0];
+  const displayName = args[1] || email;
+
+  try {
+    await createUser(email, displayName);
+    console.log('\n✅ User created successfully!');
+  } catch (error) {
+    console.error('\n❌ Failed to create user');
+    process.exit(1);
+  }
+}
+
+process.exit(0);

package/botrun-c/api/admin-tools/firebase-auth-domains-v2.py

@@ -0,0 +1,287 @@
+#!/usr/bin/env python3
+
+"""
+Firebase Authentication Authorized Domains Manager (v2 API)
+使用 Google Identity Toolkit v2 API 完整實作列出、新增、移除授權域名
+
+使用方式：
+  # 列出所有授權域名
+  python3 firebase-auth-domains-v2.py --list
+
+  # 新增授權域名
+  python3 firebase-auth-domains-v2.py --add botrun-j-example.a.run.app
+
+  # 移除授權域名
+  python3 firebase-auth-domains-v2.py --remove botrun-j-example.a.run.app
+
+  # 批次新增 Cloud Run URLs
+  python3 firebase-auth-domains-v2.py --add-cloud-run
+
+  # 列出所有域名並顯示完整配置
+  python3 firebase-auth-domains-v2.py --list --verbose
+"""
+
+import sys
+import os
+import json
+import argparse
+from typing import List, Set, Optional
+import google.auth
+from googleapiclient.discovery import build
+from googleapiclient.errors import HttpError
+from google.auth.exceptions import DefaultCredentialsError
+
+# 顏色代碼
+GREEN = '\033[92m'
+RED = '\033[91m'
+YELLOW = '\033[93m'
+BLUE = '\033[94m'
+RESET = '\033[0m'
+BOLD = '\033[1m'
+
+PROJECT_ID = os.getenv('FIREBASE_PROJECT_ID', 'confidential-botrun')
+
+# Cloud Run URLs 需要添加的清單
+CLOUD_RUN_URLS = [
+    'botrun-j-53288a47-36186877499.asia-east1.run.app',
+    'botrun-j-aee12461-36186877499.asia-east1.run.app',
+]
+
+
+class FirebaseAuthDomainManagerV2:
+    """Firebase Authentication 授權域名管理器 - 使用 Identity Toolkit v2 API"""
+
+    def __init__(self):
+        """初始化服務客戶端"""
+        try:
+            # 使用 cloud-platform scope 以獲得完整存取權限
+            self.credentials, _ = google.auth.default(
+                scopes=['https://www.googleapis.com/auth/cloud-platform']
+            )
+
+            # 建立 Identity Toolkit v2 服務客戶端
+            self.service = build('identitytoolkit', 'v2', credentials=self.credentials)
+            self.config_name = f'projects/{PROJECT_ID}/config'
+
+            print(f"{BLUE}✅ Successfully authenticated with Identity Toolkit v2 API{RESET}\n")
+
+        except DefaultCredentialsError:
+            print(f"{RED}❌ Error: Cannot authenticate with Google Cloud{RESET}")
+            print(f"{YELLOW}Please run: gcloud auth application-default login{RESET}")
+            sys.exit(1)
+        except Exception as e:
+            print(f"{RED}❌ Error initializing service: {e}{RESET}")
+            sys.exit(1)
+
+    def get_authorized_domains(self) -> Set[str]:
+        """取得所有授權域名"""
+        try:
+            request = self.service.projects().getConfig(name=self.config_name)
+            result = request.execute()
+            domains = result.get('authorizedDomains', [])
+            return set(domains) if domains else set()
+        except HttpError as error:
+            print(f"{RED}❌ Error fetching domains: {error}{RESET}")
+            return set()
+        except Exception as e:
+            print(f"{RED}❌ Unexpected error: {e}{RESET}")
+            return set()
+
+    def add_authorized_domain(self, domain: str) -> bool:
+        """新增授權域名"""
+        try:
+            print(f"{BLUE}📝 Adding domain: {domain}{RESET}\n")
+
+            # 步驟 1: 取得目前的設定
+            print(f"  1️⃣  Reading current configuration...")
+            current_domains = self.get_authorized_domains()
+
+            if domain in current_domains:
+                print(f"{YELLOW}     ⚠️  Domain already exists: {domain}{RESET}\n")
+                return False
+
+            # 步驟 2: 修改域名清單
+            print(f"  2️⃣  Updating domain list...")
+            updated_domains = list(current_domains)
+            updated_domains.append(domain)
+
+            # 步驟 3: 發送更新請求
+            print(f"  3️⃣  Sending update request to Identity Toolkit API v2...")
+
+            update_body = {
+                'authorizedDomains': sorted(updated_domains)
+            }
+
+            # 使用 updateMask 確保只更新 authorizedDomains 欄位
+            request = self.service.projects().updateConfig(
+                name=self.config_name,
+                body=update_body,
+                updateMask='authorizedDomains'
+            )
+            result = request.execute()
+
+            print(f"\n{GREEN}✅ Domain added successfully: {domain}{RESET}\n")
+            return True
+
+        except HttpError as error:
+            print(f"\n{RED}❌ HTTP Error: {error}{RESET}\n")
+            return False
+        except Exception as e:
+            print(f"\n{RED}❌ Error adding domain: {e}{RESET}\n")
+            return False
+
+    def remove_authorized_domain(self, domain: str) -> bool:
+        """移除授權域名"""
+        try:
+            print(f"{BLUE}🗑️  Removing domain: {domain}{RESET}\n")
+
+            # 步驟 1: 取得目前的設定
+            print(f"  1️⃣  Reading current configuration...")
+            current_domains = self.get_authorized_domains()
+
+            if domain not in current_domains:
+                print(f"{YELLOW}     ⚠️  Domain not found: {domain}{RESET}\n")
+                return False
+
+            # 步驟 2: 修改域名清單
+            print(f"  2️⃣  Updating domain list...")
+            updated_domains = [d for d in current_domains if d != domain]
+
+            # 步驟 3: 發送更新請求
+            print(f"  3️⃣  Sending update request...")
+
+            update_body = {
+                'authorizedDomains': sorted(updated_domains)
+            }
+
+            request = self.service.projects().updateConfig(
+                name=self.config_name,
+                body=update_body,
+                updateMask='authorizedDomains'
+            )
+            result = request.execute()
+
+            print(f"\n{GREEN}✅ Domain removed successfully: {domain}{RESET}\n")
+            return True
+
+        except HttpError as error:
+            print(f"\n{RED}❌ HTTP Error: {error}{RESET}\n")
+            return False
+        except Exception as e:
+            print(f"\n{RED}❌ Error removing domain: {e}{RESET}\n")
+            return False
+
+    def list_authorized_domains(self):
+        """列出所有授權域名"""
+        print(f"{BLUE}📋 Fetching authorized domains...{RESET}\n")
+
+        domains = self.get_authorized_domains()
+
+        if not domains:
+            print(f"{YELLOW}⚠️  No authorized domains configured{RESET}\n")
+            return
+
+        domains_list = sorted(list(domains))
+
+        print(f"{GREEN}✅ Authorized Domains ({len(domains)} total):{RESET}\n")
+        for i, domain in enumerate(domains_list, 1):
+            print(f"   {i}. {BOLD}{domain}{RESET}")
+        print()
+
+    def print_full_config(self):
+        """顯示完整配置"""
+        try:
+            print(f"{BLUE}📊 Full Configuration:{RESET}\n")
+            request = self.service.projects().getConfig(name=self.config_name)
+            result = request.execute()
+            print(json.dumps(result, indent=2))
+            print()
+        except HttpError as error:
+            print(f"{RED}❌ Error fetching config: {error}{RESET}\n")
+        except Exception as e:
+            print(f"{RED}❌ Error: {e}{RESET}\n")
+
+    def add_cloud_run_urls(self) -> int:
+        """批次新增所有 Cloud Run URLs"""
+        print(f"{BLUE}📦 Adding Cloud Run service domains...{RESET}\n")
+
+        added = 0
+        current_domains = self.get_authorized_domains()
+
+        for url in CLOUD_RUN_URLS:
+            if url in current_domains:
+                print(f"{YELLOW}   ⚠️  Already exists: {url}{RESET}")
+            else:
+                if self.add_authorized_domain(url):
+                    added += 1
+                    # 刷新域名清單以便下一次迭代使用
+                    current_domains = self.get_authorized_domains()
+
+        if added > 0:
+            print(f"\n{GREEN}✅ Successfully added {added} domain(s){RESET}\n")
+        else:
+            print(f"\n{YELLOW}ℹ️  All domains already exist{RESET}\n")
+
+        return added
+
+
+def main():
+    """主程式"""
+    parser = argparse.ArgumentParser(
+        description='Firebase Authentication Authorized Domains Manager (v2 API)',
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  # 列出所有授權域名
+  %(prog)s --list
+
+  # 新增單個域名
+  %(prog)s --add botrun-j-example.a.run.app
+
+  # 移除域名
+  %(prog)s --remove botrun-j-example.a.run.app
+
+  # 批次新增 Cloud Run URLs
+  %(prog)s --add-cloud-run
+
+  # 列出所有域名並顯示完整配置
+  %(prog)s --list --verbose
+        """
+    )
+
+    parser.add_argument('--list', action='store_true', help='List all authorized domains')
+    parser.add_argument('--add', metavar='DOMAIN', help='Add an authorized domain')
+    parser.add_argument('--remove', metavar='DOMAIN', help='Remove an authorized domain')
+    parser.add_argument('--add-cloud-run', action='store_true', help='Add all Cloud Run service domains')
+    parser.add_argument('--verbose', '-v', action='store_true', help='Show full configuration')
+
+    args = parser.parse_args()
+
+    # 如果沒有指定任何操作，顯示列表
+    if not any([args.list, args.add, args.remove, args.add_cloud_run, args.verbose]):
+        args.list = True
+
+    # 初始化管理器
+    print(f"\n{BLUE}🔐 Firebase Auth Domains Manager (v2 API){RESET}")
+    print(f"{BLUE}Project ID: {GREEN}{PROJECT_ID}{RESET}\n")
+
+    manager = FirebaseAuthDomainManagerV2()
+
+    # 執行操作
+    if args.add:
+        manager.add_authorized_domain(args.add)
+    elif args.remove:
+        manager.remove_authorized_domain(args.remove)
+    elif args.add_cloud_run:
+        manager.add_cloud_run_urls()
+    elif args.list or args.verbose:
+        manager.list_authorized_domains()
+
+    if args.verbose:
+        manager.print_full_config()
+
+    print(f"{GREEN}✅ Done{RESET}\n")
+
+
+if __name__ == '__main__':
+    main()