create-windy 0.6.9 → 0.6.10

package/template/apps/server/src/license/pairing-routes.test.ts

@@ -0,0 +1,282 @@
+import { describe, expect, test } from "bun:test";
+import { Elysia } from "elysia";
+import type { StaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import { registerLicensePairingRoutes } from "./pairing-routes.js";
+import type { LicensePairingService } from "./pairing-service.js";
+import type { PlatformLicenseRuntime } from "./runtime-service.js";
+
+describe("License 配对 HTTP 边界", () => {
+  test("创建会话要求认证且必须通过 Manifest authorizer", async () => {
+    const paths: string[] = [];
+    const service = mockService();
+    const app = createApp(service, {
+      authorize: async (_context, _method, path) => {
+        paths.push(path);
+        return Response.json({ error: "FORBIDDEN" }, { status: 403 });
+      },
+    });
+
+    const anonymous = await app.handle(
+      request("/api/license/runtime/pairing/sessions", "POST"),
+    );
+    expect(anonymous.status).toBe(401);
+    expect(anonymous.headers.get("cache-control")).toBe("no-store");
+    expect(paths).toEqual([]);
+
+    const denied = await app.handle(
+      request("/api/license/runtime/pairing/sessions", "POST", true),
+    );
+    expect(denied.status).toBe(403);
+    expect(denied.headers.get("cache-control")).toBe("no-store");
+    expect(paths).toEqual(["/api/license/runtime/pairing/sessions"]);
+    expect(service.createCalls).toBe(0);
+  });
+
+  test("创建会话只接受与请求 Origin 一致的 callbackOrigin", async () => {
+    const service = mockService();
+    const app = createApp(service, allowAuthorizer);
+    const mismatch = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions",
+        "POST",
+        true,
+        { callbackOrigin: "https://windy.internal" },
+        {
+          origin: "https://other.internal",
+          "content-type": "application/json",
+        },
+      ),
+    );
+    expect(mismatch.status).toBe(403);
+    expect(service.createCalls).toBe(0);
+
+    const accepted = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions",
+        "POST",
+        true,
+        { callbackOrigin: "https://windy.internal" },
+        {
+          origin: "https://windy.internal",
+          "content-type": "application/json",
+        },
+      ),
+    );
+    expect(accepted.status).toBe(201);
+    expect(service.callbackUrl).toBe(
+      "https://windy.internal/api/license/runtime/pairing/sessions/session_1/deliver",
+    );
+    await expect(accepted.json()).resolves.toMatchObject({
+      id: "session_1",
+      token: "delivery-token",
+      nonce: "pairing-nonce",
+      status: "waiting",
+    });
+
+    const confirmed = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/confirm",
+        "POST",
+        true,
+        { pairingCode: "GTM8FFTX" },
+        { "content-type": "application/json" },
+      ),
+    );
+    expect(confirmed.status).toBe(200);
+    expect(service.confirmCalls).toEqual([["session_1", "GTM8FFTX"]]);
+  });
+
+  test("允许来源可用 text/plain 自动投递，响应固定 no-store 和精确 CORS", async () => {
+    const service = mockService();
+    const bindings: string[] = [];
+    const app = createApp(service, {
+      authorize: async (_context, method, path) => {
+        bindings.push(`${method} ${path}`);
+        return undefined;
+      },
+    });
+    const response = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/deliver",
+        "POST",
+        false,
+        { token: "delivery-token", license: "canonical-license" },
+        {
+          origin: "https://phone.example",
+          "content-type": "text/plain;charset=UTF-8",
+        },
+      ),
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBe(
+      "https://phone.example",
+    );
+    expect(response.headers.get("access-control-allow-private-network")).toBe(
+      "true",
+    );
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(response.headers.get("vary")).toContain("Origin");
+    expect(service.deliverCalls).toEqual([
+      ["session_1", "delivery-token", "canonical-license"],
+    ]);
+    expect(bindings).toEqual([
+      "POST /api/license/runtime/pairing/sessions/:sessionId/deliver",
+    ]);
+  });
+
+  test("未知 Origin 在读取 token 前拒绝，严格预检只允许 POST Content-Type", async () => {
+    const service = mockService();
+    const app = createApp(service, allowAuthorizer);
+    const rejected = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/deliver",
+        "POST",
+        false,
+        { token: "secret-token", license: "secret-license" },
+        { origin: "https://attacker.example", "content-type": "text/plain" },
+      ),
+    );
+    expect(rejected.status).toBe(403);
+    expect(rejected.headers.get("access-control-allow-origin")).toBeNull();
+    expect(service.deliverCalls).toEqual([]);
+
+    const preflight = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/deliver",
+        "OPTIONS",
+        false,
+        undefined,
+        {
+          origin: "https://phone.example",
+          "access-control-request-method": "POST",
+          "access-control-request-headers": "content-type",
+          "access-control-request-private-network": "true",
+        },
+      ),
+    );
+    expect(preflight.status).toBe(204);
+    expect(preflight.headers.get("access-control-allow-methods")).toBe(
+      "POST, OPTIONS",
+    );
+    expect(preflight.headers.get("access-control-allow-headers")).toBe(
+      "Content-Type",
+    );
+    expect(preflight.headers.get("access-control-allow-private-network")).toBe(
+      "true",
+    );
+  });
+
+  test("生产未配置来源时关闭创建入口", async () => {
+    const service = mockService();
+    const app = createApp(service, allowAuthorizer, { NODE_ENV: "production" });
+    const response = await app.handle(
+      request("/api/license/runtime/pairing/sessions", "POST", true),
+    );
+    expect(response.status).toBe(503);
+    await expect(response.json()).resolves.toMatchObject({
+      error: "PAIRING_DISABLED",
+    });
+    expect(service.createCalls).toBe(0);
+  });
+});
+
+function createApp(
+  service: ReturnType<typeof mockService>,
+  authorizer: StaticRouteAuthorizer,
+  env: Record<string, string | undefined> = {
+    NODE_ENV: "production",
+    WINDY_LICENSE_PAIRING_ORIGINS: "https://phone.example",
+  },
+) {
+  const app = new Elysia({ prefix: "/api" }).derive(({ request: current }) => ({
+    guardContext: {
+      actor: current.headers.has("authorization")
+        ? {
+            id: "user_1",
+            type: "user" as const,
+            name: "管理员",
+            roleCodes: ["admin"],
+            permissionKeys: ["system.license.manage"],
+          }
+        : { type: "anonymous" as const, roleCodes: [], permissionKeys: [] },
+      requestId: "request_pairing",
+    },
+  }));
+  registerLicensePairingRoutes(
+    app,
+    {
+      presentSnapshot: (snapshot: unknown) => snapshot,
+    } as unknown as PlatformLicenseRuntime,
+    authorizer,
+    {
+      env,
+      service: service as unknown as LicensePairingService,
+    },
+  );
+  return app;
+}
+
+function mockService() {
+  return {
+    createCalls: 0,
+    callbackUrl: "",
+    deliverCalls: [] as string[][],
+    confirmCalls: [] as string[][],
+    create(callback: string | ((id: string) => string)) {
+      this.createCalls += 1;
+      this.callbackUrl =
+        typeof callback === "function" ? callback("session_1") : callback;
+      return {
+        request: {
+          sessionId: "session_1",
+          token: "delivery-token",
+          nonce: "pairing-nonce",
+          productCode: "windy-platform",
+          machineCode: "machine_1",
+          expiresAt: "2030-08-01T00:00:00.000Z",
+          callbackUrl: this.callbackUrl,
+        },
+        qrPayload: "qr",
+        status: "waiting",
+      };
+    },
+    status: () => ({ status: "waiting" }),
+    async deliver(id: string, token: string, license: string) {
+      this.deliverCalls.push([id, token, license]);
+      return { id, status: "delivered" };
+    },
+    async confirm(id: string, pairingCode: string) {
+      this.confirmCalls.push([id, pairingCode]);
+      return {
+        result: { status: "installed", failures: [] },
+        snapshot: {
+          status: "valid",
+          restricted: false,
+          reminder: { level: "none" },
+          canViewDetails: true,
+        },
+      };
+    },
+  };
+}
+
+const allowAuthorizer: StaticRouteAuthorizer = {
+  authorize: async () => undefined,
+};
+
+function request(
+  path: string,
+  method: string,
+  authenticated = false,
+  body?: unknown,
+  headers: Record<string, string> = {},
+) {
+  const nextHeaders = new Headers(headers);
+  if (authenticated) nextHeaders.set("authorization", "Bearer user-token");
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: nextHeaders,
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+}

package/template/apps/server/src/license/pairing-routes.ts

@@ -0,0 +1,257 @@
+import { readBoundedJsonObject } from "@southwind-ai/license";
+import type { RequestGuardContext } from "../guards.js";
+import type { StaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import type { RouteApp } from "../system/routes.js";
+import {
+  allowedPreflightHeaders,
+  corsRejected,
+  createPairingCorsPolicy,
+  json,
+  noStore,
+  pairingErrorResponse,
+  requireCallbackOrigin,
+  requireDeliveryContentType,
+  requiredText,
+  responseHeaders,
+} from "./pairing-http.js";
+import { LicensePairingService } from "./pairing-service.js";
+import type { PlatformLicenseRuntime } from "./runtime-service.js";
+
+interface PairingRouteContext {
+  guardContext: RequestGuardContext;
+  request: Request;
+  params: { sessionId: string };
+}
+
+type PairingRouteApp = Pick<RouteApp, "get" | "post"> & {
+  options(path: string, handler: (context: unknown) => unknown): unknown;
+};
+
+export interface PairingRouteOptions {
+  env?: Record<string, string | undefined>;
+  service?: LicensePairingService;
+}
+
+export function registerLicensePairingRoutes(
+  app: PairingRouteApp,
+  runtime: PlatformLicenseRuntime,
+  authorizer: StaticRouteAuthorizer,
+  options: PairingRouteOptions = {},
+) {
+  const env = options.env || process.env;
+  const service = options.service || new LicensePairingService(runtime);
+  const cors = createPairingCorsPolicy(env);
+
+  app.post(
+    "/license/runtime/pairing/sessions",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeUser(
+        context,
+        authorizer,
+        "POST",
+        "/api/license/runtime/pairing/sessions",
+      );
+      if (denied) return denied;
+      if (!cors.enabled) {
+        return json(
+          { error: "PAIRING_DISABLED", reason: "未配置手机 Web 允许来源" },
+          503,
+        );
+      }
+      try {
+        const body = await readBoundedJsonObject(context.request);
+        const callbackOrigin = requireCallbackOrigin(
+          body.callbackOrigin,
+          context.request,
+        );
+        const created = service.create(
+          (sessionId) =>
+            `${callbackOrigin}/api/license/runtime/pairing/sessions/${sessionId}/deliver`,
+        );
+        return json(
+          {
+            id: created.request.sessionId,
+            token: created.request.token,
+            nonce: created.request.nonce,
+            productCode: created.request.productCode,
+            machineCode: created.request.machineCode,
+            expiresAt: created.request.expiresAt,
+            qrPayload: created.qrPayload,
+            status: created.status,
+          },
+          201,
+        );
+      } catch (error) {
+        return pairingErrorResponse(error);
+      }
+    },
+    { parse: "none" },
+  );
+
+  app.get(
+    "/license/runtime/pairing/sessions/:sessionId",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeUser(
+        context,
+        authorizer,
+        "GET",
+        "/api/license/runtime/pairing/sessions/:sessionId",
+      );
+      if (denied) return denied;
+      try {
+        return json(service.status(context.params.sessionId));
+      } catch (error) {
+        return pairingErrorResponse(error);
+      }
+    },
+  );
+
+  app.options(
+    "/license/runtime/pairing/sessions/:sessionId/deliver",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeCallbackBinding(
+        context,
+        authorizer,
+        "OPTIONS",
+        "/api/license/runtime/pairing/sessions/:sessionId/deliver",
+      );
+      if (denied) return denied;
+      const origin = cors.accept(context.request);
+      if (!origin) return corsRejected();
+      if (
+        context.request.headers.get("access-control-request-method") !==
+          "POST" ||
+        !allowedPreflightHeaders(
+          context.request.headers.get("access-control-request-headers"),
+        )
+      ) {
+        return json(
+          { error: "PAIRING_CORS_REJECTED" },
+          403,
+          cors.headers(origin),
+        );
+      }
+      return new Response(null, {
+        status: 204,
+        headers: responseHeaders(cors.headers(origin)),
+      });
+    },
+  );
+
+  app.post(
+    "/license/runtime/pairing/sessions/:sessionId/deliver",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeCallbackBinding(
+        context,
+        authorizer,
+        "POST",
+        "/api/license/runtime/pairing/sessions/:sessionId/deliver",
+      );
+      if (denied) return denied;
+      const origin = cors.accept(context.request);
+      if (!origin) return corsRejected();
+      const headers = cors.headers(origin);
+      try {
+        requireDeliveryContentType(context.request);
+        const body = await readBoundedJsonObject(context.request);
+        const token = requiredText(body.token, "token");
+        const license = requiredText(body.license, "license");
+        return json(
+          await service.deliver(context.params.sessionId, token, license),
+          200,
+          headers,
+        );
+      } catch (error) {
+        return pairingErrorResponse(error, headers);
+      }
+    },
+    { parse: "none" },
+  );
+
+  app.post(
+    "/license/runtime/pairing/sessions/:sessionId/confirm",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeUser(
+        context,
+        authorizer,
+        "POST",
+        "/api/license/runtime/pairing/sessions/:sessionId/confirm",
+      );
+      if (denied) return denied;
+      try {
+        const body = await readBoundedJsonObject(context.request);
+        const installed = await service.confirm(
+          context.params.sessionId,
+          requiredText(body.pairingCode, "pairingCode"),
+          {
+            actor: context.guardContext.actor,
+            requestId: context.guardContext.requestId,
+            clientIp: context.guardContext.clientIp,
+            userAgent: context.guardContext.userAgent,
+          },
+        );
+        if (installed.result.status === "rejected") {
+          return json(
+            {
+              error: "LICENSE_INSTALL_REJECTED",
+              reasons: installed.result.failures,
+              snapshot: runtime.presentSnapshot(
+                installed.snapshot,
+                context.guardContext.actor,
+              ),
+            },
+            400,
+          );
+        }
+        return json({
+          installStatus: installed.result.status,
+          snapshot: runtime.presentSnapshot(
+            installed.snapshot,
+            context.guardContext.actor,
+          ),
+        });
+      } catch (error) {
+        return pairingErrorResponse(error);
+      }
+    },
+    { parse: "none" },
+  );
+}
+
+async function authorizeCallbackBinding(
+  context: PairingRouteContext,
+  authorizer: StaticRouteAuthorizer,
+  method: string,
+  path: string,
+): Promise<Response | undefined> {
+  const denied = await authorizer.authorize(
+    context.guardContext,
+    method,
+    path,
+    { restrictedModeAccess: "admin-admission" },
+  );
+  return denied ? noStore(denied) : undefined;
+}
+
+async function authorizeUser(
+  context: PairingRouteContext,
+  authorizer: StaticRouteAuthorizer,
+  method: string,
+  path: string,
+): Promise<Response | undefined> {
+  if (context.guardContext.actor.type !== "user") {
+    return json({ error: "UNAUTHORIZED" }, 401);
+  }
+  const denied = await authorizer.authorize(
+    context.guardContext,
+    method,
+    path,
+    { restrictedModeAccess: "admin-admission" },
+  );
+  return denied ? noStore(denied) : undefined;
+}