dsh-multimodal-node 0.0.0-stage → 0.3.1

package/lib/apikeys.js

@@ -0,0 +1,250 @@
+/**
+ * API 接入凭据（apikey）。
+ *
+ * 与服务节点绑定的第二条凭据线，和网页账号完全分开：
+ *
+ *   网页账号  = 用户名 + 密码 + 6 位配对码 → 人，浏览器，Cookie 会话。
+ *   apikey    = 一个 Bearer 串                 → 程序，脚本，别的 DSH。
+ *
+ * 为什么分开：把 apikey 存进 remote.accounts 那一套里，任何一次「给脚本发个 key」都会
+ * 顺手生成一个能登进网页的密码；反过来，一次网页改密码会静默打断所有正在跑的脚本。
+ *
+ * 存储形态：**只存 sha256，不存明文**。创建时返回一次完整 key，之后列表里只剩前缀。
+ * 这不是洁癖——settings.json 落在用户目录、会被同步盘带走、会被截图贴进群里。
+ *
+ * 分级（tier）：SFW / NSFW 是**上限**，与网页账号同一套语义。
+ *   SFW 的 key 能提交 SFW 工作流、看 SFW 模板与产物；
+ *   NSFW 的 key 两者都能。
+ * 判定复用 lib/tiers.js，所以「什么算成人内容」只有一份定义。
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { normalizeTier } from './tiers.js';
+
+const KEY_PREFIX = 'mmn_';
+const PREFIX_SHOWN = 10;
+const NAME_PATTERN = /^[a-z0-9_.-]{2,32}$/;
+
+export function hashKey(key) {
+    return createHash('sha256').update(String(key)).digest('hex');
+}
+
+/** 生成一个新 key：`mmn_` + 32 字节 base64url。 */
+export function generateKey() {
+    return `${KEY_PREFIX}${randomBytes(32).toString('base64url')}`;
+}
+
+function publicRecord(entry) {
+    return {
+        id: entry.id,
+        name: entry.name,
+        tier: normalizeTier(entry.tier),
+        enabled: entry.enabled !== false,
+        prefix: entry.prefix ?? '',
+        note: entry.note ?? '',
+        createdAt: entry.createdAt ?? null,
+        lastUsedAt: entry.lastUsedAt ?? null,
+    };
+}
+
+export class ApiKeyStore {
+    constructor(store) {
+        this.store = store;
+        /**
+         * 写盘串行链。
+         *
+         * 一个 key 上每次请求都会调 touch()，而来回是同一份 settings.json：
+         * 两个 touch 在同一个 tick 里 rename 到同一个目标，Windows 上直接
+         * EPERM operation not permitted（Linux 上则是抢临时文件名）。
+         * 这不是理论问题——第一版就是这样把测试打挂的。
+         */
+        this.writing = Promise.resolve();
+    }
+
+    /**
+     * 排进写链。
+     *
+     * 两条要求同时成立：
+     *   1. 一次失败不能卡住后面的写入 —— 所以链本身吃掉错误；
+     *   2. 失败的调用方必须能看到自己的失败 —— 所以返回的是**另一个** promise。
+     *
+     * 第一版只做了第 1 条（直接把吃掉错误的链返回），于是「重名」这种校验错误变成
+     * undefined，调用方接着读它的字段才炸，报错位置离真原因十万八千里。
+     */
+    enqueue(work) {
+        const attempt = this.writing.then(work);
+        this.writing = attempt.catch(() => {});
+        return attempt;
+    }
+
+    get block() {
+        return this.store.get().service ?? {};
+    }
+
+    records() {
+        return Array.isArray(this.block.apiKeys) ? this.block.apiKeys : [];
+    }
+
+    /** 面板用：永不含 hash，也永不含明文。 */
+    list() {
+        return this.records().map(publicRecord);
+    }
+
+    requireKey() {
+        return this.block.requireKey === true;
+    }
+
+    async setRequireKey(on) {
+        await this.enqueue(async () => {
+            await this.store.patch({ service: { requireKey: on === true } });
+        });
+        return { ok: true, requireKey: this.block.requireKey === true };
+    }
+
+    /**
+     * 建一个 key。返回的 `key` 只在这一刻存在，之后再也拿不到——
+     * 面板必须当场显示并提示复制，这是唯一一次。
+     */
+    async create(input = {}) {
+        const name = String(input.name ?? '').trim().toLowerCase();
+        if (!NAME_PATTERN.test(name)) throw new Error('名称需为 2–32 位字母、数字、下划线、点或减号');
+        const key = generateKey();
+        /**
+         * 读-改-写整个在队列里做。
+         *
+         * 之前的写法是「先读 records、算好新数组、再入队写」。两次并发 create 会读到
+         * 同一份 records，各自的数组都只含自己的新 key，后写的那次把前一次整个覆盖——
+         * 面板上表现为「刚生成的那把 key 消失了」，而且没有任何日志。
+         * 队列只保证写盘不撞车，保证不了「算的时候看到的是最新的」。
+         */
+        const record = await this.enqueue(async () => {
+            if (this.records().some((entry) => entry.name === name)) throw new Error(`apikey ${name} 已存在`);
+            const entry = {
+                id: randomBytes(6).toString('hex'),
+                name,
+                tier: normalizeTier(input.tier),
+                enabled: true,
+                keyHash: hashKey(key),
+                prefix: key.slice(0, PREFIX_SHOWN),
+                note: String(input.note ?? '').slice(0, 200),
+                createdAt: new Date().toISOString(),
+                lastUsedAt: null,
+            };
+            await this.store.patch({ service: { apiKeys: [...this.records(), entry] } });
+            return entry;
+        });
+        return { ok: true, key, record: publicRecord(record), apiKeys: this.list() };
+    }
+
+    async update(name, patch = {}) {
+        const target = String(name ?? '').toLowerCase();
+        // 读-改-写全在队列里（理由同 create）：在队列外读，两次并发改不同字段会互相覆盖。
+        const next = await this.enqueue(async () => {
+            const records = this.records();
+            const index = records.findIndex((entry) => entry.name === target || entry.id === target);
+            if (index < 0) throw new Error(`没有 apikey ${name}`);
+            const rows = records.slice();
+            rows[index] = {
+                ...rows[index],
+                ...(patch.tier !== undefined ? { tier: normalizeTier(patch.tier) } : {}),
+                ...(patch.enabled !== undefined ? { enabled: patch.enabled === true } : {}),
+                ...(patch.note !== undefined ? { note: String(patch.note).slice(0, 200) } : {}),
+            };
+            await this.store.patch({ service: { apiKeys: rows } });
+            return rows;
+        });
+        return { ok: true, apiKeys: next.map(publicRecord) };
+    }
+
+    async remove(name) {
+        const target = String(name ?? '').toLowerCase();
+        const next = await this.enqueue(async () => {
+            const records = this.records();
+            const rows = records.filter((entry) => entry.name !== target && entry.id !== target);
+            if (rows.length === records.length) throw new Error(`没有 apikey ${name}`);
+            await this.store.patch({ service: { apiKeys: rows } });
+            return rows;
+        });
+        return { ok: true, apiKeys: next.map(publicRecord) };
+    }
+
+    /** 轮换：同一个名字换一把新 key，旧 key 立刻失效。 */
+    async rotate(name) {
+        const target = String(name ?? '').toLowerCase();
+        const key = generateKey();
+        const entry = await this.enqueue(async () => {
+            const records = this.records();
+            const index = records.findIndex((row) => row.name === target || row.id === target);
+            if (index < 0) throw new Error(`没有 apikey ${name}`);
+            const rows = records.slice();
+            rows[index] = { ...rows[index], keyHash: hashKey(key), prefix: key.slice(0, PREFIX_SHOWN), createdAt: new Date().toISOString() };
+            await this.store.patch({ service: { apiKeys: rows } });
+            return rows[index];
+        });
+        return { ok: true, key, record: publicRecord(entry), apiKeys: this.list() };
+    }
+
+    /**
+     * 校验一次调用。
+     *
+     * 返回值里 `checked: false` 表示「这个端口没有在管凭据」——调用方据此决定放行，
+     * 而不是把「没开校验」误当成「校验通过」。两者在日志和审计里必须能分开。
+     */
+    verify(raw) {
+        if (this.requireKey() !== true) {
+            return { ok: true, checked: false, key: null, tier: 'nsfw' };
+        }
+        const text = String(raw ?? '').trim();
+        if (text === '') return { ok: false, checked: true, key: null, error: '缺少 apikey' };
+        const digest = Buffer.from(hashKey(text), 'hex');
+        for (const entry of this.records()) {
+            if (entry.enabled === false) continue;
+            if (typeof entry.keyHash !== 'string' || entry.keyHash.length !== 64) continue;
+            const expected = Buffer.from(entry.keyHash, 'hex');
+            if (expected.length !== digest.length) continue;
+            if (!timingSafeEqual(digest, expected)) continue;
+            void this.touch(entry.id);
+            return {
+                ok: true,
+                checked: true,
+                key: publicRecord(entry),
+                tier: normalizeTier(entry.tier),
+                name: entry.name,
+            };
+        }
+        return { ok: false, checked: true, key: null, error: 'apikey 无效或已停用' };
+    }
+
+    /**
+     * 记一次使用时间。
+     *
+     * 进串行链之后再判断节流：判断写在入队之前是错的，因为同一毫秒里进来的
+     * 十个请求会全部看到"上次使用在一分钟前"，然后一起排进去写十次。
+     */
+    touch(id) {
+        return this.enqueue(async () => {
+            const now = new Date().toISOString();
+            // 入队后重读，不能信入队前的快照
+            const records = this.records();
+            const index = records.findIndex((entry) => entry.id === id);
+            if (index < 0) return;
+            const last = records[index].lastUsedAt;
+            if (typeof last === 'string' && Date.now() - Date.parse(last) < 60_000) return;
+            const next = records.slice();
+            next[index] = { ...records[index], lastUsedAt: now };
+            await this.store.patch({ service: { apiKeys: next } });
+        });
+    }
+
+    /** 从 Authorization / X-API-Key / 查询串里取 key，三种写法都认。 */
+    static extract(headers, url) {
+        const auth = headers?.authorization;
+        if (typeof auth === 'string' && /^bearer\s+/i.test(auth)) return auth.replace(/^bearer\s+/i, '').trim();
+        const direct = headers?.['x-api-key'];
+        if (typeof direct === 'string' && direct !== '') return direct.trim();
+        const query = url?.searchParams?.get('apikey');
+        if (typeof query === 'string' && query !== '') return query.trim();
+        return '';
+    }
+}
+
+export { KEY_PREFIX, PREFIX_SHOWN };

package/lib/assets.js

@@ -0,0 +1,234 @@
+/**
+ * The asset library: every image an account has produced, indexed for browsing.
+ *
+ * The run index answers "what did I submit"; this answers "show me my pictures"
+ * — one entry per file, with the pixel size the console prints under the
+ * thumbnail, and enough of the prompt to recognise what produced it. Sizes are
+ * filled in lazily by whatever route has a connection to the owning instance,
+ * because only the instance holds the bytes.
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const MAX_PER_ACCOUNT = 1200;
+
+export class AssetLibrary {
+    constructor(dataDir) {
+        this.file = join(dataDir, 'assets.json');
+        /** @type {Map<string, object[]>} owner -> assets, newest first */
+        this.byOwner = new Map();
+        /**
+         * Deletions, kept as tombstones rather than just removing a row.
+         *
+         * The library is rebuilt from `runs.json` by a periodic sweep, so "the row is gone
+         * from the array" is not enough: the next pass finds a finished run, notices its
+         * file list does not match, and puts the picture straight back. That is exactly the
+         * reported "删除记录还会出来". A tombstone says "this file was deliberately
+         * removed", which the sweep can honour.
+         *
+         * @type {Map<string, object[]>} owner -> [{promptId, filename}]
+         */
+        this.deleted = new Map();
+        this.writing = Promise.resolve();
+        this.counter = 0;
+    }
+
+    async init() {
+        await mkdir(join(this.file, '..'), { recursive: true });
+        try {
+            const parsed = JSON.parse(await readFile(this.file, 'utf8'));
+            for (const [owner, rows] of Object.entries(parsed?.byOwner ?? {})) {
+                if (Array.isArray(rows)) this.byOwner.set(owner, rows);
+            }
+            for (const [owner, rows] of Object.entries(parsed?.deleted ?? {})) {
+                if (Array.isArray(rows)) this.deleted.set(owner, rows);
+            }
+        } catch {
+            await this.save();
+        }
+    }
+
+    save() {
+        this.writing = this.writing
+            .catch(() => {})
+            .then(async () => {
+                this.counter += 1;
+                const temp = `${this.file}.${this.counter}.tmp`;
+                const body = {
+                    byOwner: Object.fromEntries(this.byOwner),
+                    deleted: Object.fromEntries(this.deleted),
+                };
+                await writeFile(temp, `${JSON.stringify(body, null, 2)}\n`, 'utf8');
+                await rename(temp, this.file);
+            })
+            .catch(() => {});
+        return this.writing;
+    }
+
+    /**
+     * Record every file one finished run produced.
+     *
+     * Idempotent per (owner, promptId, filename): the sweeper re-reads finished
+     * runs, so a second pass must not duplicate a picture.
+     */
+    async recordRun(owner, record, files) {
+        const existing = this.byOwner.get(owner) ?? [];
+        const kept = existing.filter((asset) => asset.promptId !== record.promptId);
+        /**
+         * A file the operator deleted stays deleted.
+         *
+         * Filtered here rather than in the sweep, because every path that rebuilds a run's
+         * rows goes through this function. Without it the tombstone would be advisory and
+         * the picture would reappear the next time anything re-read the run.
+         */
+        const wanted = files.filter((file) => !this.isDeleted(owner, record.promptId, file.filename));
+        const fresh = wanted.map((file) => ({
+            owner,
+            promptId: record.promptId,
+            name: record.name ?? '',
+            filename: file.filename,
+            subfolder: file.subfolder ?? '',
+            type: file.type ?? 'output',
+            endpointId: record.endpointId ?? null,
+            submittedAt: record.submittedAt ?? Date.now(),
+            /**
+             * The sampling seed this picture came from, when the run recorded one.
+             *
+             * Carried onto the asset row for the same reason it is stored on the run: it is
+             * the only way to reproduce that exact image later. null means "this run had no
+             * seed to record" (a pure upscale, or a sampler without one), which the console
+             * prints as a dash — not as 0, which is a real seed.
+             */
+            seed: typeof record.seed === 'number' && Number.isSafeInteger(record.seed) ? record.seed : null,
+            /**
+             * Which half of the library this picture belongs to.
+             *
+             * Recorded at run time from the run's own classification, because that is the
+             * only moment the answer is cheap: the workflow name, the declared tier and the
+             * prompt are all in hand. After the fact it would mean re-reading runs.json for
+             * every browse. The admin eye filters on this column.
+             */
+            tier: record.tier === 'nsfw' ? 'nsfw' : 'sfw',
+            // Filled on first browse; null means "not measured yet", which is
+            // different from "measured and unreadable".
+            width: null,
+            height: null,
+        }));
+        // Preserve sizes already learned for files that survive this pass, and the seed when
+        // a later pass arrives without one (a run recorded before seeds were stored).
+        const sizes = new Map(existing.map((asset) => [`${asset.promptId}|${asset.filename}`, asset]));
+        for (const asset of fresh) {
+            const known = sizes.get(`${asset.promptId}|${asset.filename}`);
+            if (known !== undefined) {
+                asset.width = known.width ?? null;
+                asset.height = known.height ?? null;
+                if (asset.seed === null && typeof known.seed === 'number') asset.seed = known.seed;
+                if (known.tier !== undefined) asset.tier = known.tier;
+            }
+        }
+        const next = [...fresh, ...kept].slice(0, MAX_PER_ACCOUNT);
+        this.byOwner.set(owner, next);
+        await this.save();
+        return fresh.length;
+    }
+
+    /** Record a size once it is known. */
+    async setSize(owner, promptId, filename, size) {
+        const rows = this.byOwner.get(owner);
+        if (rows === undefined) return;
+        let changed = false;
+        for (const asset of rows) {
+            if (asset.promptId !== promptId || asset.filename !== filename) continue;
+            if (asset.width === size.width && asset.height === size.height) continue;
+            asset.width = size.width;
+            asset.height = size.height;
+            changed = true;
+        }
+        if (changed) await this.save();
+    }
+
+    list(owner, limit = 80) {
+        return (this.byOwner.get(owner) ?? []).slice(0, limit);
+    }
+
+    get(owner, promptId, filename) {
+        return (this.byOwner.get(owner) ?? []).find((asset) => asset.promptId === promptId && asset.filename === filename);
+    }
+
+    owns(owner, promptId, filename) {
+        return this.get(owner, promptId, filename) !== undefined;
+    }
+
+    /**
+     * Does this run already have exactly this many asset rows?
+     *
+     * The sync uses it as a cheap "already current" test so a periodic sweep over a healthy
+     * library does no work. Counting rows rather than checking presence matters: a run that
+     * produced three images and has one row is stale, not current.
+     *
+     * Rows the operator deleted are counted. Without that, a deleted picture made the count
+     * permanently short, the sweeper re-added it on its next pass, and "删除" looked broken —
+     * the row came back seconds later. A deletion is a decision, so it has to be part of
+     * "current".
+     */
+    hasRun(owner, promptId, expected) {
+        const rows = (this.byOwner.get(owner) ?? []).filter((asset) => asset.promptId === promptId);
+        const removed = (this.deleted?.get(owner) ?? []).filter((row) => row.promptId === promptId).length;
+        return rows.length + removed === expected;
+    }
+
+    /** Was this exact picture deleted by its owner? */
+    isDeleted(owner, promptId, filename) {
+        return (this.deleted?.get(owner) ?? []).some((row) => row.promptId === promptId && row.filename === filename);
+    }
+
+    /** Every file this owner has under one prompt id — the console's "assets of a run". */
+    ofRun(owner, promptId) {
+        return (this.byOwner.get(owner) ?? []).filter((asset) => asset.promptId === promptId);
+    }
+
+    /**
+     * Drop one picture from this owner's library.
+     *
+     * Only the index row goes away: the bytes live on the ComfyUI instance and this
+     * library never had the authority to delete them. That is the honest scope of a
+     * "delete from library" button — the picture stops appearing here, and the run it
+     * came from stays in history with its file list intact, so nothing silently
+     * disagrees with the instance.
+     *
+     * A tombstone is written as well as the row being removed. Removing the row alone made
+     * the delete undo itself: the sweep rebuilds every finished run's rows from runs.json,
+     * saw one row fewer than the run produced, and re-added the picture. The tombstone is
+     * what makes the decision stick, and it is why the answer to "删除记录还是彻底删除" is
+     * "neither — it stops being listed, and it stays unlisted".
+     *
+     * Returns whether a row actually matched, so the route can answer 404 rather than
+     * reporting success for a name that was never there.
+     */
+    async remove(owner, promptId, filename) {
+        const rows = this.byOwner.get(owner) ?? [];
+        const next = rows.filter((asset) => !(asset.promptId === promptId && asset.filename === filename));
+        if (next.length === rows.length) return false;
+        this.byOwner.set(owner, next);
+        const tombstones = this.deleted.get(owner) ?? [];
+        if (!tombstones.some((row) => row.promptId === promptId && row.filename === filename)) {
+            tombstones.push({ promptId, filename, at: Date.now() });
+            // Bounded: a library keeps at most MAX_PER_ACCOUNT rows, so the tombstone list
+            // never needs to be longer than that to stay useful.
+            this.deleted.set(owner, tombstones.slice(-MAX_PER_ACCOUNT));
+        }
+        await this.save();
+        return true;
+    }
+
+    /** How many pictures this owner has deliberately removed (for the diagnostics line). */
+    removedCount(owner) {
+        return (this.deleted.get(owner) ?? []).length;
+    }
+
+    async dropOwner(owner) {
+        this.byOwner.delete(owner);
+        this.deleted.delete(owner);
+        await this.save();
+    }
+}