create-windy 0.6.9 → 0.6.11

package/template/apps/server/src/license/pairing-http.ts

@@ -0,0 +1,138 @@
+import { boundedJsonBodyErrorResponse } from "@southwind-ai/license";
+import { LicensePairingError } from "./pairing-service.js";
+
+export function createPairingCorsPolicy(
+  env: Record<string, string | undefined>,
+) {
+  const configured = env.WINDY_LICENSE_PAIRING_ORIGINS;
+  const candidates =
+    configured === undefined
+      ? env.NODE_ENV === "production"
+        ? []
+        : ["http://localhost:9843"]
+      : configured.split(",").map((value) => value.trim());
+  const origins = new Set(candidates.filter(isExactHttpOrigin));
+  return {
+    enabled: origins.size > 0,
+    accept: (request: Request) => {
+      const origin = request.headers.get("origin") || "";
+      return origins.has(origin) ? origin : undefined;
+    },
+    headers: (origin: string) => ({
+      "access-control-allow-origin": origin,
+      "access-control-allow-methods": "POST, OPTIONS",
+      "access-control-allow-headers": "Content-Type",
+      "access-control-allow-private-network": "true",
+      vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network",
+    }),
+  };
+}
+
+export function allowedPreflightHeaders(value: string | null): boolean {
+  if (!value) return true;
+  return value
+    .split(",")
+    .map((header) => header.trim().toLowerCase())
+    .every((header) => header === "content-type");
+}
+
+export function requireCallbackOrigin(
+  value: unknown,
+  request: Request,
+): string {
+  const callbackOrigin = requiredText(value, "callbackOrigin");
+  if (!isExactHttpOrigin(callbackOrigin)) {
+    throw new LicensePairingError(
+      "PAIRING_CALLBACK_ORIGIN_INVALID",
+      400,
+      "callbackOrigin 必须是精确的 HTTP(S) Origin",
+    );
+  }
+  if (request.headers.get("origin") !== callbackOrigin) {
+    throw new LicensePairingError(
+      "PAIRING_CALLBACK_ORIGIN_MISMATCH",
+      403,
+      "请求 Origin 与 callbackOrigin 不一致",
+    );
+  }
+  return callbackOrigin;
+}
+
+export function requireDeliveryContentType(request: Request): void {
+  const value = request.headers.get("content-type")?.toLowerCase() || "";
+  if (value.startsWith("application/json") || value.startsWith("text/plain")) {
+    return;
+  }
+  throw new LicensePairingError(
+    "PAIRING_CONTENT_TYPE_INVALID",
+    415,
+    "投递只接受 application/json 或 text/plain JSON",
+  );
+}
+
+export function requiredText(value: unknown, name: string): string {
+  if (typeof value === "string" && value.trim()) return value;
+  throw new LicensePairingError(
+    "PAIRING_REQUEST_INVALID",
+    400,
+    `${name} 必须为非空字符串`,
+  );
+}
+
+export function pairingErrorResponse(
+  error: unknown,
+  headers: Record<string, string> = {},
+): Response {
+  const bodyError = boundedJsonBodyErrorResponse(error);
+  if (bodyError) return noStore(bodyError, headers);
+  if (error instanceof LicensePairingError) {
+    return json(
+      { error: error.code, reason: error.message, ...error.details },
+      error.status,
+      headers,
+    );
+  }
+  throw error;
+}
+
+export function corsRejected(): Response {
+  return json({ error: "PAIRING_CORS_REJECTED" }, 403, { vary: "Origin" });
+}
+
+export function json(
+  body: unknown,
+  status = 200,
+  headers: Record<string, string> = {},
+): Response {
+  return Response.json(body, { status, headers: responseHeaders(headers) });
+}
+
+export function noStore(
+  response: Response,
+  headers: Record<string, string> = {},
+) {
+  const nextHeaders = new Headers(response.headers);
+  for (const [key, value] of Object.entries(responseHeaders(headers))) {
+    nextHeaders.set(key, value);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    headers: nextHeaders,
+  });
+}
+
+export function responseHeaders(headers: Record<string, string>) {
+  return { ...headers, "cache-control": "no-store" };
+}
+
+function isExactHttpOrigin(value: string): boolean {
+  try {
+    const url = new URL(value);
+    return (
+      (url.protocol === "http:" || url.protocol === "https:") &&
+      url.origin === value
+    );
+  } catch {
+    return false;
+  }
+}

package/template/apps/server/src/license/pairing-routes.test.ts

@@ -0,0 +1,282 @@
+import { describe, expect, test } from "bun:test";
+import { Elysia } from "elysia";
+import type { StaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import { registerLicensePairingRoutes } from "./pairing-routes.js";
+import type { LicensePairingService } from "./pairing-service.js";
+import type { PlatformLicenseRuntime } from "./runtime-service.js";
+
+describe("License 配对 HTTP 边界", () => {
+  test("创建会话要求认证且必须通过 Manifest authorizer", async () => {
+    const paths: string[] = [];
+    const service = mockService();
+    const app = createApp(service, {
+      authorize: async (_context, _method, path) => {
+        paths.push(path);
+        return Response.json({ error: "FORBIDDEN" }, { status: 403 });
+      },
+    });
+
+    const anonymous = await app.handle(
+      request("/api/license/runtime/pairing/sessions", "POST"),
+    );
+    expect(anonymous.status).toBe(401);
+    expect(anonymous.headers.get("cache-control")).toBe("no-store");
+    expect(paths).toEqual([]);
+
+    const denied = await app.handle(
+      request("/api/license/runtime/pairing/sessions", "POST", true),
+    );
+    expect(denied.status).toBe(403);
+    expect(denied.headers.get("cache-control")).toBe("no-store");
+    expect(paths).toEqual(["/api/license/runtime/pairing/sessions"]);
+    expect(service.createCalls).toBe(0);
+  });
+
+  test("创建会话只接受与请求 Origin 一致的 callbackOrigin", async () => {
+    const service = mockService();
+    const app = createApp(service, allowAuthorizer);
+    const mismatch = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions",
+        "POST",
+        true,
+        { callbackOrigin: "https://windy.internal" },
+        {
+          origin: "https://other.internal",
+          "content-type": "application/json",
+        },
+      ),
+    );
+    expect(mismatch.status).toBe(403);
+    expect(service.createCalls).toBe(0);
+
+    const accepted = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions",
+        "POST",
+        true,
+        { callbackOrigin: "https://windy.internal" },
+        {
+          origin: "https://windy.internal",
+          "content-type": "application/json",
+        },
+      ),
+    );
+    expect(accepted.status).toBe(201);
+    expect(service.callbackUrl).toBe(
+      "https://windy.internal/api/license/runtime/pairing/sessions/session_1/deliver",
+    );
+    await expect(accepted.json()).resolves.toMatchObject({
+      id: "session_1",
+      token: "delivery-token",
+      nonce: "pairing-nonce",
+      status: "waiting",
+    });
+
+    const confirmed = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/confirm",
+        "POST",
+        true,
+        { pairingCode: "GTM8FFTX" },
+        { "content-type": "application/json" },
+      ),
+    );
+    expect(confirmed.status).toBe(200);
+    expect(service.confirmCalls).toEqual([["session_1", "GTM8FFTX"]]);
+  });
+
+  test("允许来源可用 text/plain 自动投递，响应固定 no-store 和精确 CORS", async () => {
+    const service = mockService();
+    const bindings: string[] = [];
+    const app = createApp(service, {
+      authorize: async (_context, method, path) => {
+        bindings.push(`${method} ${path}`);
+        return undefined;
+      },
+    });
+    const response = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/deliver",
+        "POST",
+        false,
+        { token: "delivery-token", license: "canonical-license" },
+        {
+          origin: "https://phone.example",
+          "content-type": "text/plain;charset=UTF-8",
+        },
+      ),
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBe(
+      "https://phone.example",
+    );
+    expect(response.headers.get("access-control-allow-private-network")).toBe(
+      "true",
+    );
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(response.headers.get("vary")).toContain("Origin");
+    expect(service.deliverCalls).toEqual([
+      ["session_1", "delivery-token", "canonical-license"],
+    ]);
+    expect(bindings).toEqual([
+      "POST /api/license/runtime/pairing/sessions/:sessionId/deliver",
+    ]);
+  });
+
+  test("未知 Origin 在读取 token 前拒绝，严格预检只允许 POST Content-Type", async () => {
+    const service = mockService();
+    const app = createApp(service, allowAuthorizer);
+    const rejected = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/deliver",
+        "POST",
+        false,
+        { token: "secret-token", license: "secret-license" },
+        { origin: "https://attacker.example", "content-type": "text/plain" },
+      ),
+    );
+    expect(rejected.status).toBe(403);
+    expect(rejected.headers.get("access-control-allow-origin")).toBeNull();
+    expect(service.deliverCalls).toEqual([]);
+
+    const preflight = await app.handle(
+      request(
+        "/api/license/runtime/pairing/sessions/session_1/deliver",
+        "OPTIONS",
+        false,
+        undefined,
+        {
+          origin: "https://phone.example",
+          "access-control-request-method": "POST",
+          "access-control-request-headers": "content-type",
+          "access-control-request-private-network": "true",
+        },
+      ),
+    );
+    expect(preflight.status).toBe(204);
+    expect(preflight.headers.get("access-control-allow-methods")).toBe(
+      "POST, OPTIONS",
+    );
+    expect(preflight.headers.get("access-control-allow-headers")).toBe(
+      "Content-Type",
+    );
+    expect(preflight.headers.get("access-control-allow-private-network")).toBe(
+      "true",
+    );
+  });
+
+  test("生产未配置来源时关闭创建入口", async () => {
+    const service = mockService();
+    const app = createApp(service, allowAuthorizer, { NODE_ENV: "production" });
+    const response = await app.handle(
+      request("/api/license/runtime/pairing/sessions", "POST", true),
+    );
+    expect(response.status).toBe(503);
+    await expect(response.json()).resolves.toMatchObject({
+      error: "PAIRING_DISABLED",
+    });
+    expect(service.createCalls).toBe(0);
+  });
+});
+
+function createApp(
+  service: ReturnType<typeof mockService>,
+  authorizer: StaticRouteAuthorizer,
+  env: Record<string, string | undefined> = {
+    NODE_ENV: "production",
+    WINDY_LICENSE_PAIRING_ORIGINS: "https://phone.example",
+  },
+) {
+  const app = new Elysia({ prefix: "/api" }).derive(({ request: current }) => ({
+    guardContext: {
+      actor: current.headers.has("authorization")
+        ? {
+            id: "user_1",
+            type: "user" as const,
+            name: "管理员",
+            roleCodes: ["admin"],
+            permissionKeys: ["system.license.manage"],
+          }
+        : { type: "anonymous" as const, roleCodes: [], permissionKeys: [] },
+      requestId: "request_pairing",
+    },
+  }));
+  registerLicensePairingRoutes(
+    app,
+    {
+      presentSnapshot: (snapshot: unknown) => snapshot,
+    } as unknown as PlatformLicenseRuntime,
+    authorizer,
+    {
+      env,
+      service: service as unknown as LicensePairingService,
+    },
+  );
+  return app;
+}
+
+function mockService() {
+  return {
+    createCalls: 0,
+    callbackUrl: "",
+    deliverCalls: [] as string[][],
+    confirmCalls: [] as string[][],
+    create(callback: string | ((id: string) => string)) {
+      this.createCalls += 1;
+      this.callbackUrl =
+        typeof callback === "function" ? callback("session_1") : callback;
+      return {
+        request: {
+          sessionId: "session_1",
+          token: "delivery-token",
+          nonce: "pairing-nonce",
+          productCode: "windy-platform",
+          machineCode: "machine_1",
+          expiresAt: "2030-08-01T00:00:00.000Z",
+          callbackUrl: this.callbackUrl,
+        },
+        qrPayload: "qr",
+        status: "waiting",
+      };
+    },
+    status: () => ({ status: "waiting" }),
+    async deliver(id: string, token: string, license: string) {
+      this.deliverCalls.push([id, token, license]);
+      return { id, status: "delivered" };
+    },
+    async confirm(id: string, pairingCode: string) {
+      this.confirmCalls.push([id, pairingCode]);
+      return {
+        result: { status: "installed", failures: [] },
+        snapshot: {
+          status: "valid",
+          restricted: false,
+          reminder: { level: "none" },
+          canViewDetails: true,
+        },
+      };
+    },
+  };
+}
+
+const allowAuthorizer: StaticRouteAuthorizer = {
+  authorize: async () => undefined,
+};
+
+function request(
+  path: string,
+  method: string,
+  authenticated = false,
+  body?: unknown,
+  headers: Record<string, string> = {},
+) {
+  const nextHeaders = new Headers(headers);
+  if (authenticated) nextHeaders.set("authorization", "Bearer user-token");
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: nextHeaders,
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+}

package/template/apps/server/src/license/pairing-routes.ts

@@ -0,0 +1,257 @@
+import { readBoundedJsonObject } from "@southwind-ai/license";
+import type { RequestGuardContext } from "../guards.js";
+import type { StaticRouteAuthorizer } from "../module-host/static-route-authorization.js";
+import type { RouteApp } from "../system/routes.js";
+import {
+  allowedPreflightHeaders,
+  corsRejected,
+  createPairingCorsPolicy,
+  json,
+  noStore,
+  pairingErrorResponse,
+  requireCallbackOrigin,
+  requireDeliveryContentType,
+  requiredText,
+  responseHeaders,
+} from "./pairing-http.js";
+import { LicensePairingService } from "./pairing-service.js";
+import type { PlatformLicenseRuntime } from "./runtime-service.js";
+
+interface PairingRouteContext {
+  guardContext: RequestGuardContext;
+  request: Request;
+  params: { sessionId: string };
+}
+
+type PairingRouteApp = Pick<RouteApp, "get" | "post"> & {
+  options(path: string, handler: (context: unknown) => unknown): unknown;
+};
+
+export interface PairingRouteOptions {
+  env?: Record<string, string | undefined>;
+  service?: LicensePairingService;
+}
+
+export function registerLicensePairingRoutes(
+  app: PairingRouteApp,
+  runtime: PlatformLicenseRuntime,
+  authorizer: StaticRouteAuthorizer,
+  options: PairingRouteOptions = {},
+) {
+  const env = options.env || process.env;
+  const service = options.service || new LicensePairingService(runtime);
+  const cors = createPairingCorsPolicy(env);
+
+  app.post(
+    "/license/runtime/pairing/sessions",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeUser(
+        context,
+        authorizer,
+        "POST",
+        "/api/license/runtime/pairing/sessions",
+      );
+      if (denied) return denied;
+      if (!cors.enabled) {
+        return json(
+          { error: "PAIRING_DISABLED", reason: "未配置手机 Web 允许来源" },
+          503,
+        );
+      }
+      try {
+        const body = await readBoundedJsonObject(context.request);
+        const callbackOrigin = requireCallbackOrigin(
+          body.callbackOrigin,
+          context.request,
+        );
+        const created = service.create(
+          (sessionId) =>
+            `${callbackOrigin}/api/license/runtime/pairing/sessions/${sessionId}/deliver`,
+        );
+        return json(
+          {
+            id: created.request.sessionId,
+            token: created.request.token,
+            nonce: created.request.nonce,
+            productCode: created.request.productCode,
+            machineCode: created.request.machineCode,
+            expiresAt: created.request.expiresAt,
+            qrPayload: created.qrPayload,
+            status: created.status,
+          },
+          201,
+        );
+      } catch (error) {
+        return pairingErrorResponse(error);
+      }
+    },
+    { parse: "none" },
+  );
+
+  app.get(
+    "/license/runtime/pairing/sessions/:sessionId",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeUser(
+        context,
+        authorizer,
+        "GET",
+        "/api/license/runtime/pairing/sessions/:sessionId",
+      );
+      if (denied) return denied;
+      try {
+        return json(service.status(context.params.sessionId));
+      } catch (error) {
+        return pairingErrorResponse(error);
+      }
+    },
+  );
+
+  app.options(
+    "/license/runtime/pairing/sessions/:sessionId/deliver",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeCallbackBinding(
+        context,
+        authorizer,
+        "OPTIONS",
+        "/api/license/runtime/pairing/sessions/:sessionId/deliver",
+      );
+      if (denied) return denied;
+      const origin = cors.accept(context.request);
+      if (!origin) return corsRejected();
+      if (
+        context.request.headers.get("access-control-request-method") !==
+          "POST" ||
+        !allowedPreflightHeaders(
+          context.request.headers.get("access-control-request-headers"),
+        )
+      ) {
+        return json(
+          { error: "PAIRING_CORS_REJECTED" },
+          403,
+          cors.headers(origin),
+        );
+      }
+      return new Response(null, {
+        status: 204,
+        headers: responseHeaders(cors.headers(origin)),
+      });
+    },
+  );
+
+  app.post(
+    "/license/runtime/pairing/sessions/:sessionId/deliver",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeCallbackBinding(
+        context,
+        authorizer,
+        "POST",
+        "/api/license/runtime/pairing/sessions/:sessionId/deliver",
+      );
+      if (denied) return denied;
+      const origin = cors.accept(context.request);
+      if (!origin) return corsRejected();
+      const headers = cors.headers(origin);
+      try {
+        requireDeliveryContentType(context.request);
+        const body = await readBoundedJsonObject(context.request);
+        const token = requiredText(body.token, "token");
+        const license = requiredText(body.license, "license");
+        return json(
+          await service.deliver(context.params.sessionId, token, license),
+          200,
+          headers,
+        );
+      } catch (error) {
+        return pairingErrorResponse(error, headers);
+      }
+    },
+    { parse: "none" },
+  );
+
+  app.post(
+    "/license/runtime/pairing/sessions/:sessionId/confirm",
+    async (rawContext) => {
+      const context = rawContext as PairingRouteContext;
+      const denied = await authorizeUser(
+        context,
+        authorizer,
+        "POST",
+        "/api/license/runtime/pairing/sessions/:sessionId/confirm",
+      );
+      if (denied) return denied;
+      try {
+        const body = await readBoundedJsonObject(context.request);
+        const installed = await service.confirm(
+          context.params.sessionId,
+          requiredText(body.pairingCode, "pairingCode"),
+          {
+            actor: context.guardContext.actor,
+            requestId: context.guardContext.requestId,
+            clientIp: context.guardContext.clientIp,
+            userAgent: context.guardContext.userAgent,
+          },
+        );
+        if (installed.result.status === "rejected") {
+          return json(
+            {
+              error: "LICENSE_INSTALL_REJECTED",
+              reasons: installed.result.failures,
+              snapshot: runtime.presentSnapshot(
+                installed.snapshot,
+                context.guardContext.actor,
+              ),
+            },
+            400,
+          );
+        }
+        return json({
+          installStatus: installed.result.status,
+          snapshot: runtime.presentSnapshot(
+            installed.snapshot,
+            context.guardContext.actor,
+          ),
+        });
+      } catch (error) {
+        return pairingErrorResponse(error);
+      }
+    },
+    { parse: "none" },
+  );
+}
+
+async function authorizeCallbackBinding(
+  context: PairingRouteContext,
+  authorizer: StaticRouteAuthorizer,
+  method: string,
+  path: string,
+): Promise<Response | undefined> {
+  const denied = await authorizer.authorize(
+    context.guardContext,
+    method,
+    path,
+    { restrictedModeAccess: "admin-admission" },
+  );
+  return denied ? noStore(denied) : undefined;
+}
+
+async function authorizeUser(
+  context: PairingRouteContext,
+  authorizer: StaticRouteAuthorizer,
+  method: string,
+  path: string,
+): Promise<Response | undefined> {
+  if (context.guardContext.actor.type !== "user") {
+    return json({ error: "UNAUTHORIZED" }, 401);
+  }
+  const denied = await authorizer.authorize(
+    context.guardContext,
+    method,
+    path,
+    { restrictedModeAccess: "admin-admission" },
+  );
+  return denied ? noStore(denied) : undefined;
+}