cyymall-cli 0.1.5 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyymall-cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "CyyMall / 菜洋洋商城 API CLI (per app-api-cli-spec)",
   "bin": {
     "cyy": "bin/cyy.js"

package/src/commands/auth.js

@@ -1,4 +1,4 @@
-"use strict";
+"use strict";
 
 const crypto = require("crypto");
 const readline = require("readline/promises");
@@ -9,15 +9,15 @@ const biz = require("../biz");
 const encrypt = require("../encrypt");
 
 /**
- * `/app/auth/ua/*` responses (e.g. sendCodeV2, registerMember/v2): raw wire -> decryptResponse ->
- * JSON.parse -> optional parsedJsonAfterHybridEnvelopeDecrypt, same order as App.
+ * `/app/auth/ua/sendCodeV2` responses may still be returned as a hybrid envelope.
+ * Decrypt the raw wire body first, then parse JSON, matching the App pipeline.
  *
  * @param {string} [rawWireText]
  * @param {unknown} jsonAfterParse
- * @param {string} clientPkForDecrypt
  * @returns {unknown}
  */
-function plainBizJsonFromSendCodeWire(rawWireText, jsonAfterParse, clientPkForDecrypt) {
+function plainBizJsonFromSendCodeWire(rawWireText, jsonAfterParse) {
+  const { clientPrivateKey } = encrypt.resolveEncryptKeys();
   let wire =
     typeof rawWireText === "string" && rawWireText.trim()
       ? rawWireText.trim()
@@ -44,26 +44,26 @@ function plainBizJsonFromSendCodeWire(rawWireText, jsonAfterParse, clientPkForDe
     }
   }
 
-  if (wire) {
-    const decryptedText = encrypt.decryptResponse(wire, clientPkForDecrypt);
+  if (wire && clientPrivateKey) {
+    const decryptedText = encrypt.decryptResponse(wire, clientPrivateKey);
     try {
       const obj = decryptedText ? JSON.parse(decryptedText) : null;
       if (obj != null && typeof obj === "object" && !Array.isArray(obj)) {
         const out = encrypt.looksLikeHybridEnvelope(obj)
-          ? encrypt.parsedJsonAfterHybridEnvelopeDecrypt(obj, clientPkForDecrypt)
+          ? encrypt.parsedJsonAfterHybridEnvelopeDecrypt(obj, clientPrivateKey)
           : obj;
         if (!encrypt.looksLikeHybridEnvelope(out)) {
           return out;
         }
       }
     } catch {
-      // fall through to parsed-json fallback
+      // fall through to parsed fallback
     }
   }
 
   if (jsonAfterParse != null && typeof jsonAfterParse === "object" && !Array.isArray(jsonAfterParse)) {
-    return encrypt.looksLikeHybridEnvelope(jsonAfterParse)
-      ? encrypt.parsedJsonAfterHybridEnvelopeDecrypt(jsonAfterParse, clientPkForDecrypt)
+    return clientPrivateKey && encrypt.looksLikeHybridEnvelope(jsonAfterParse)
+      ? encrypt.parsedJsonAfterHybridEnvelopeDecrypt(jsonAfterParse, clientPrivateKey)
       : jsonAfterParse;
   }
 
@@ -91,31 +91,24 @@ function extractBizMessage(json, fallback) {
     : fallback;
 }
 
-function buildHybridAuthBody(plainBody, headers) {
+function buildEncryptedSendCodeBody(phone) {
+  const headers = /** @type {Record<string,string>} */ (http.buildDefaultHeaders());
+  const plainBody = JSON.stringify({ phone, objectCode: "3" });
   if (!encrypt.encryptEnvConfigured()) {
-    return plainBody;
+    return { headers, body: plainBody };
   }
   headers.encrypte = "true";
   const { serverPublicKey } = encrypt.resolveEncryptKeys();
   const hy = encrypt.hybridEncrypt(plainBody, serverPublicKey);
-  return encrypt.hybridEncryptResultToJson(hy);
-}
-
-function decryptAuthBizJson(rawWireText, jsonAfterParse) {
-  const { clientPrivateKey } = encrypt.resolveEncryptKeys();
-  if (!clientPrivateKey) return jsonAfterParse;
-  return plainBizJsonFromSendCodeWire(
-    typeof rawWireText === "string" ? rawWireText : "",
-    jsonAfterParse,
-    clientPrivateKey,
-  );
+  return {
+    headers,
+    body: encrypt.hybridEncryptResultToJson(hy),
+  };
 }
 
 async function requestSmsCode(phone) {
   const url = http.moduleUrl("DEFAULT", "/app/auth/ua/sendCodeV2");
-  const headers = /** @type {Record<string,string>} */ (http.buildDefaultHeaders());
-  const plainBody = JSON.stringify({ phone, objectCode: "3" });
-  const body = buildHybridAuthBody(plainBody, headers);
+  const { headers, body } = buildEncryptedSendCodeBody(phone);
 
   const { ok, status, json: jsonAfterParse, rawWireText } = await http.request(url, {
     method: "POST",
@@ -125,7 +118,7 @@ async function requestSmsCode(phone) {
     includeRawWireText: true,
   });
 
-  const json = decryptAuthBizJson(rawWireText, jsonAfterParse);
+  const json = plainBizJsonFromSendCodeWire(rawWireText, jsonAfterParse);
 
   if (!ok) {
     const msg = extractBizMessage(json, `send login code failed (HTTP ${status})`);
@@ -134,26 +127,24 @@ async function requestSmsCode(phone) {
     process.exit(2);
   }
 
-  // User-requested behavior: once the send-code request itself succeeds over HTTP,
-  // treat SMS dispatch as successful even if the encrypted response body cannot be
-  // decrypted into upstream business JSON.
-  return { status, json, acceptedByGateway: true };
+  // Only sendCodeV2 is encrypted. Once transport succeeds, treat the SMS request as accepted.
+  return { status, json, gatewayAccepted: true };
 }
 
 async function sendCode(phone) {
-  const { status, json, acceptedByGateway } = await requestSmsCode(phone);
+  const { status, json, gatewayAccepted } = await requestSmsCode(phone);
   const traceId = buildTraceId();
   console.log(
     JSON.stringify(
       {
         success: true,
         code: "OK",
-        message: acceptedByGateway ? "code sent" : "code send accepted",
+        message: "code sent",
         data: {
           phone,
           objectCode: "3",
           httpStatus: status,
-          gatewayAccepted: acceptedByGateway,
+          gatewayAccepted,
           upstream: json,
         },
         traceId,
@@ -168,7 +159,7 @@ async function sendCode(phone) {
 async function loginWithCode(phone, code) {
   const url = http.moduleUrl("DEFAULT", "/app/auth/ua/registerMember/v2");
   const headers = /** @type {Record<string,string>} */ (http.buildDefaultHeaders());
-  const plainBody = JSON.stringify({
+  const body = JSON.stringify({
     phone,
     objectCode: "3",
     password: "",
@@ -177,18 +168,13 @@ async function loginWithCode(phone, code) {
     smsCode: code,
     wxOpenid: "",
   });
-  const body = buildHybridAuthBody(plainBody, headers);
 
-  const { ok, json: jsonAfterParse, rawWireText } = await http.request(url, {
+  const { ok, json } = await http.request(url, {
     method: "POST",
     headers,
     body,
-    decryptHybridResponse: false,
-    includeRawWireText: true,
   });
 
-  const json = decryptAuthBizJson(rawWireText, jsonAfterParse);
-
   if (!ok || !biz.isBizSuccess(json)) {
     const msg = extractBizMessage(json, "login failed");
     console.error(`cyy: ${msg}`);
@@ -202,8 +188,8 @@ async function loginWithCode(phone, code) {
 
   const loginId = String(data.loginId || "");
   const memberId = loginId.includes("_") ? loginId.split("_")[0] : loginId;
-
   const token = pickLoginToken(data);
+
   if (!token) {
     console.error(
       "cyy: login reported success but data has no token (expected token, appToken, or accessToken)",
@@ -305,4 +291,4 @@ async function whoami() {
   process.exit(success ? 0 : 2);
 }
 
-module.exports = { login, loginWithCode, sendCode, whoami };
+module.exports = { login, loginWithCode, sendCode, whoami };