fnos-cli 0.2.0 → 0.3.0

package/src/utils/client.js

@@ -1,141 +1,163 @@
 /**
- * FnosClient wrapper with authentication
+ * FnosClient wrapper with fnos 0.4 authentication.
  */
 
-const { FnosClient, ResourceMonitor, Store, SystemInfo, User, Network, File, SAC } = require('fnos');
+const sdk = require('fnos');
 const settings = require('./settings');
 const { logger } = require('./logger');
 
-/**
- * Create authenticated FnosClient
- * @param {Object} options - Options object
- * @param {Object} [options.credentials] - Direct credentials object (endpoint, username, password, etc.)
- * @param {string} [options.endpoint] - Server endpoint (legacy)
- * @param {string} [options.username] - Username (legacy)
- * @param {string} [options.password] - Password (legacy)
- * @param {number} [options.timeout] - Connection timeout in seconds
- * @param {boolean} [options.saveCredentials] - Whether to save credentials to settings (default: false)
- * @returns {Promise<FnosClient>} Authenticated client
- */
-async function createClient(options = {}) {
-  const { credentials, endpoint, username, password, timeout = 60, saveCredentials = false } = options;
-
-  // Use provided credentials object
-  if (credentials) {
-    return await createClientWithCredentials(credentials, timeout, saveCredentials);
-  }
-
-  // Legacy support: build credentials from individual parameters
-  const savedCredentials = settings.getCredentials();
-  const finalEndpoint = endpoint || savedCredentials?.endpoint;
-  const finalUsername = username || savedCredentials?.username;
-  const finalPassword = password || savedCredentials?.password;
-
-  if (!finalEndpoint || !finalUsername) {
-    throw new Error('Missing credentials. Please run "fnos login" first or provide -e, -u, -p parameters.');
+const SDK_CLASS_NAMES = [
+  'ResourceMonitor', 'Store', 'SystemInfo', 'User', 'Network', 'File', 'SAC',
+  'DockerManager', 'EventLogger', 'Share', 'Notify', 'IscsiManager',
+  'BackupManager', 'DownloadCenter', 'IPBlocker', 'LicenseManager',
+  'LiveUpdate', 'MountManager', 'NetworkServer', 'Security', 'SystemRestore'
+];
+
+class AuthenticationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'AuthenticationError';
+    this.exitCode = 3;
   }
-
-  return await createClientWithCredentials(
-    {
-      endpoint: finalEndpoint,
-      username: finalUsername,
-      password: finalPassword,
-      token: savedCredentials?.token,
-      longToken: savedCredentials?.longToken,
-      secret: savedCredentials?.secret
-    },
-    timeout,
-    saveCredentials
-  );
 }
 
-/**
- * Create authenticated client with credentials
- * @param {Object} credentials - Credentials object
- * @param {string} credentials.endpoint - Server endpoint
- * @param {string} credentials.username - Username
- * @param {string} credentials.password - Password
- * @param {number} timeout - Connection timeout in seconds
- * @param {boolean} saveToSettings - Whether to save credentials to settings
- * @returns {Promise<FnosClient>} Authenticated client
- */
-async function createClientWithCredentials(credentials, timeout, saveToSettings) {
-  const { endpoint, username, password } = credentials;
+function canUseToken(credentials) {
+  return credentials.credentialVersion === 2 &&
+    credentials.secretFormat === 'decrypted-v1' &&
+    [credentials.token, credentials.longToken, credentials.secret]
+      .every((value) => typeof value === 'string' && value.length > 0);
+}
 
-  // Create client
-  const client = new FnosClient();
-  logger.info(`Connecting to ${endpoint}...`);
+function tokenLoginSucceeded(result) {
+  return Boolean(result && (result.result === 'succ' || result.errno === 0));
+}
 
-  // Connect
-  await client.connect(endpoint, timeout * 1000);
-  logger.info('Connected successfully');
+// fnos 0.4.0 treats every response containing data.hostName as the connection
+// handshake, so a later SystemInfo.getHostName response never reaches its waiter.
+function installHostNameResponseCompatibility(client) {
+  if (typeof client.processMessage !== 'function' || !(client.pendingRequests instanceof Map)) return;
+  const processMessage = client.processMessage.bind(client);
+  client.processMessage = (message) => {
+    let response;
+    try {
+      response = JSON.parse(message);
+    } catch (error) {
+      return processMessage(message);
+    }
+    const hasHostName = response && response.data &&
+      typeof response.data === 'object' && 'hostName' in response.data;
+    const pending = hasHostName && typeof response.reqid === 'string'
+      ? client.pendingRequests.get(response.reqid)
+      : null;
+    if (pending) {
+      if (pending.timeoutTimer) clearTimeout(pending.timeoutTimer);
+      client.pendingRequests.delete(response.reqid);
+      pending.future.resolve(response);
+      return;
+    }
+    return processMessage(message);
+  };
+}
 
-  // Login with password
-  if (!password) {
-    throw new Error('Password required. Please run "fnos login" first or provide -p parameter.');
+async function passwordLogin(client, credentials, options) {
+  if (!credentials.password) throw new AuthenticationError('Password is required.');
+  let result;
+  try {
+    result = await client.login(credentials.username, credentials.password, 10000);
+  } catch (error) {
+    if (client.loginResponse?.result === 'fail') {
+      throw new AuthenticationError(error.message || 'Login failed.');
+    }
+    throw error;
   }
-
-  logger.info('Logging in...');
-  const loginResult = await client.login(username, password);
-  logger.info('Logged in successfully');
-
-  // Save credentials only if explicitly requested (e.g., from login command)
-  if (saveToSettings) {
-    settings.saveCredentials({
-      endpoint,
-      username,
-      password,
-      token: loginResult.token,
-      longToken: loginResult.longToken,
-      secret: loginResult.secret
-    });
-    logger.info('Credentials saved');
+  if (!result) throw new AuthenticationError('Login failed.');
+  if (result.twofaSetupRequired) {
+    throw new AuthenticationError('This account must bind two-factor authentication in the fnOS web interface first.');
   }
-
-  return client;
+  if (result.twofaRequired) {
+    if (!/^\d{6}$/.test(options.twofaCode || '')) {
+      throw new AuthenticationError('A six-digit --twofa-code is required for this account.');
+    }
+    result = await client.submitTwofaCode(options.twofaCode, options.trustDevice === true, 10000);
+  }
+  if (!result || result.result !== 'succ' || !result.token || !result.secret) {
+    throw new AuthenticationError(result?.msg || result?.errmsg || 'Login failed.');
+  }
+  return result;
 }
 
-/**
- * Execute a command with auto-retry
- * @param {FnosClient} client - FnosClient instance
- * @param {Function} commandFn - Command function to execute
- * @returns {Promise<*>} Command result
- */
-async function executeCommand(client, commandFn) {
+async function createClientWithCredentials(credentials, options = {}, dependencies = {}) {
+  const sdkModule = dependencies.sdk || sdk;
+  const settingsStore = dependencies.settings || settings;
+  const activeLogger = dependencies.logger || logger;
+  const Client = sdkModule.FnosClient;
+  const client = new Client();
+  const timeout = options.timeout ?? 60;
+
   try {
-    return await commandFn();
-  } catch (error) {
-    if (error.message.includes('token') || error.message.includes('auth')) {
-      logger.warn('Authentication failed, trying to re-login...');
-      // Re-login logic could be added here
+    activeLogger.info(`Connecting to ${credentials.endpoint}...`);
+    await client.connect(credentials.endpoint, timeout * 1000, false, options.verifySsl === true ? false : true);
+    installHostNameResponseCompatibility(client);
+    let result;
+    let usedToken = false;
+
+    if (canUseToken(credentials)) {
+      result = await client.loginViaToken(credentials.token, credentials.longToken, credentials.secret, 10000);
+      usedToken = tokenLoginSucceeded(result);
+      if (!usedToken) activeLogger.debug('Saved token was rejected; falling back to password login.');
     }
+
+    if (!usedToken) {
+      result = await passwordLogin(client, credentials, options);
+      if (options.saveCredentials || credentials.source === 'settings_file') {
+        const decryptedSecret = client.getDecryptedSecret();
+        if (typeof decryptedSecret !== 'string' || decryptedSecret.length === 0) {
+          throw new AuthenticationError('Login secret decryption failed.');
+        }
+        settingsStore.saveCredentials({
+          endpoint: credentials.endpoint,
+          username: credentials.username,
+          password: credentials.password,
+          credentialVersion: 2,
+          token: result.token || null,
+          longToken: result.longToken || null,
+          secret: decryptedSecret,
+          secretFormat: 'decrypted-v1'
+        });
+      }
+    }
+
+    return client;
+  } catch (error) {
+    client.close();
     throw error;
   }
 }
 
-/**
- * Get SDK class instance
- * @param {FnosClient} client - FnosClient instance
- * @param {string} className - Name of the SDK class
- * @returns {*} SDK class instance
- */
-function getSDKInstance(client, className) {
-  const instances = {
-    ResourceMonitor: new ResourceMonitor(client),
-    Store: new Store(client),
-    SystemInfo: new SystemInfo(client),
-    User: new User(client),
-    Network: new Network(client),
-    File: new File(client),
-    SAC: new SAC(client)
+async function createClient(options = {}, dependencies = {}) {
+  const credentials = options.credentials || {
+    endpoint: options.endpoint,
+    username: options.username,
+    password: options.password,
+    source: 'command_line'
   };
+  if (!credentials.endpoint || !credentials.username) {
+    throw new AuthenticationError('Missing credentials. Run "fnos login" or provide -e/-u/-p.');
+  }
+  return createClientWithCredentials(credentials, options, dependencies);
+}
 
-  const instance = instances[className];
-  if (!instance) {
+function getSDKInstance(client, className, sdkModule = sdk) {
+  if (!SDK_CLASS_NAMES.includes(className) || typeof sdkModule[className] !== 'function') {
     throw new Error(`Unknown SDK class: ${className}`);
   }
-
-  return instance;
+  return new sdkModule[className](client);
 }
 
-module.exports = { createClient, executeCommand, getSDKInstance };
+module.exports = {
+  AuthenticationError,
+  SDK_CLASS_NAMES,
+  createClient,
+  createClientWithCredentials,
+  getSDKInstance
+};

package/src/utils/errors.js

@@ -0,0 +1,11 @@
+const { HTTPSRequiredError } = require('fnos');
+const { redactSensitive } = require('./logger');
+
+function errorMessage(error) {
+  const message = error instanceof HTTPSRequiredError
+    ? `fnOS requires HTTPS: ${error.requestedUri} was redirected to ${error.redirectUri}. Use the corresponding wss:// endpoint.`
+    : error?.message || String(error);
+  return redactSensitive(message);
+}
+
+module.exports = { errorMessage };

package/src/utils/logger.js

@@ -19,6 +19,26 @@ if (!fs.existsSync(logsDir)) {
 const randomNum = crypto.randomBytes(4).toString('hex');
 const logFilename = `fnos-${new Date().toISOString().split('T')[0]}-${randomNum}.log`;
 
+const SENSITIVE_VALUE = /((?:"?(?:longToken|long_token|accessToken|access_token|twofaCode|twofa_code|password|secret|token|code|hmac)"?)\s*[:=]\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\[REDACTED\]|[^\s,}\]]+)/gi;
+const SIGNED_MESSAGE = /^(Calculated iz-result:|Sending msg to channel:|已发送请求:)\s*.*$/i;
+
+function redactSensitive(value) {
+  const message = String(value);
+  if (SIGNED_MESSAGE.test(message)) return message.replace(SIGNED_MESSAGE, '$1 [REDACTED]');
+  return message
+    .replace(SENSITIVE_VALUE, (match, prefix, rawValue) => {
+      const quote = rawValue[0] === '"' || rawValue[0] === "'" ? rawValue[0] : '';
+      const value = quote ? rawValue.slice(1, -1) : rawValue;
+      return value === '[REDACTED]' ? match : `${prefix}${quote}[REDACTED]${quote}`;
+    })
+    .replace(/(服务器返回的secret:\s*)\S+/gi, '$1[REDACTED]');
+}
+
+const redactFormat = winston.format((info) => {
+  info.message = redactSensitive(info.message);
+  return info;
+});
+
 // Log format
 const logFormat = winston.format.printf(({ timestamp, level, message }) => {
   return `${timestamp} - ${level.toUpperCase()} - ${message}`;
@@ -52,6 +72,7 @@ class StderrTransport extends winston.Transport {
 const logger = winston.createLogger({
   level: 'silly', // Capture all levels for file output
   format: winston.format.combine(
+    redactFormat(),
     winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
     logFormat
   ),
@@ -60,6 +81,7 @@ const logger = winston.createLogger({
     new StderrTransport({
       level: 'error', // Default: only show errors
       format: winston.format.combine(
+        redactFormat(),
         winston.format.colorize(),
         logFormat
       )
@@ -102,10 +124,12 @@ function setLogLevel(verbose) {
       if (sdkConsoleTransport) {
         fnosLogger.default.remove(sdkConsoleTransport);
       }
+      fnosLogger.default.level = consoleTransport.level;
       // Add our custom stderr transport
       const sdkStderrTransport = new StderrTransport({
         level: consoleTransport.level,
         format: winston.format.combine(
+          redactFormat(),
           winston.format.colorize(),
           logFormat
         )
@@ -117,4 +141,4 @@ function setLogLevel(verbose) {
   }
 }
 
-module.exports = { logger, setLogLevel };
+module.exports = { logger, redactSensitive, setLogLevel };

package/src/utils/settings.js

@@ -2,122 +2,83 @@
  * Settings manager for fnos
  */
 
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 
 class Settings {
-  constructor() {
-    this.settingsDir = path.join(os.homedir(), '.fnos');
+  constructor(homeDir = os.homedir()) {
+    this.settingsDir = path.join(homeDir, '.fnos');
     this.settingsPath = path.join(this.settingsDir, 'settings.json');
   }
 
-  /**
-   * Ensure settings directory exists
-   */
   _ensureDir() {
-    if (!fs.existsSync(this.settingsDir)) {
-      fs.mkdirSync(this.settingsDir, { recursive: true });
-    }
+    fs.mkdirSync(this.settingsDir, { recursive: true, mode: 0o700 });
   }
 
-  /**
-   * Load settings from file
-   * @returns {Object|null} Settings object or null if not exists
-   */
   load() {
-    if (!fs.existsSync(this.settingsPath)) {
-      return null;
-    }
+    if (!fs.existsSync(this.settingsPath)) return null;
     try {
-      const data = fs.readFileSync(this.settingsPath, 'utf8');
-      return JSON.parse(data);
+      return JSON.parse(fs.readFileSync(this.settingsPath, 'utf8'));
     } catch (error) {
-      console.error('Failed to load settings:', error.message);
+      console.error(error instanceof SyntaxError
+        ? 'Failed to load settings: invalid JSON.'
+        : 'Failed to load settings.');
       return null;
     }
   }
 
-  /**
-   * Save settings to file
-   * @param {Object} data - Settings data to save
-   */
   save(data) {
     this._ensureDir();
     try {
-      fs.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2), {
-        mode: 0o600 // Read/write for owner only
-      });
+      fs.writeFileSync(this.settingsPath, JSON.stringify(data, null, 2), { mode: 0o600 });
+      fs.chmodSync(this.settingsPath, 0o600);
     } catch (error) {
-      console.error('Failed to save settings:', error.message);
+      console.error('Failed to save settings.');
       throw error;
     }
   }
 
-  /**
-   * Clear settings file
-   */
   clear() {
-    if (fs.existsSync(this.settingsPath)) {
-      fs.unlinkSync(this.settingsPath);
-    }
+    if (fs.existsSync(this.settingsPath)) fs.unlinkSync(this.settingsPath);
   }
 
-  /**
-   * Clear only authentication credentials, preserving other settings
-   */
   clearCredentials() {
     const existingSettings = this.load();
-    if (!existingSettings) {
-      return;
-    }
-
-    // Remove only auth-related fields, keep other settings
-    const authFields = ['endpoint', 'username', 'password', 'token', 'longToken', 'secret'];
-    authFields.forEach(field => delete existingSettings[field]);
-
-    // Always save the file (even if empty), to preserve the settings.json file
+    if (!existingSettings) return;
+    const authFields = [
+      'endpoint', 'username', 'password', 'token', 'longToken', 'secret',
+      'credentialVersion', 'secretFormat'
+    ];
+    authFields.forEach((field) => delete existingSettings[field]);
     this.save(existingSettings);
   }
 
-  /**
-   * Check if settings file exists
-   * @returns {boolean} True if settings file exists
-   */
   exists() {
     return fs.existsSync(this.settingsPath);
   }
 
-  /**
-   * Get authentication credentials
-   * @returns {Object|null} Credentials object or null
-   */
   getCredentials() {
-    const settings = this.load();
-    if (!settings) {
-      return null;
-    }
-    return {
-      endpoint: settings.endpoint,
-      username: settings.username,
-      password: settings.password,
-      token: settings.token,
-      longToken: settings.longToken,
-      secret: settings.secret
-    };
+    const data = this.load();
+    if (!data) return null;
+    const fields = [
+      'endpoint', 'username', 'password', 'token', 'longToken', 'secret',
+      'credentialVersion', 'secretFormat'
+    ];
+    return Object.fromEntries(fields.map((field) => [field, data[field]]));
   }
 
-  /**
-   * Save authentication credentials
-   * @param {Object} credentials - Credentials to save
-   */
   saveCredentials(credentials) {
     const existingSettings = this.load() || {};
     this.save({
       ...existingSettings,
+      credentialVersion: 2,
+      secretFormat: 'decrypted-v1',
       ...credentials
     });
   }
 }
 
-module.exports = new Settings();
+const settings = new Settings();
+module.exports = settings;
+module.exports.Settings = Settings;

package/src/constants.js

@@ -1,69 +0,0 @@
-/**
- * Command mapping configuration
- */
-
-const COMMAND_MAPPING = {
-  resmon: {
-    className: 'ResourceMonitor',
-    commands: {
-      cpu: { method: 'cpu', description: 'Get CPU resource monitoring information' },
-      gpu: { method: 'gpu', description: 'Get GPU resource monitoring information' },
-      mem: { method: 'memory', description: 'Get memory resource monitoring information' },
-      disk: { method: 'disk', description: 'Get disk resource monitoring information' },
-      net: { method: 'net', description: 'Get network resource monitoring information' },
-      gen: { method: 'general', description: 'Get general resource monitoring information', params: ['items'] }
-    }
-  },
-  store: {
-    className: 'Store',
-    commands: {
-      general: { method: 'general', description: 'Get storage general information' },
-      calcSpace: { method: 'calculateSpace', description: 'Calculate storage space information' },
-      listDisk: { method: 'listDisks', description: 'List disk information', params: ['noHotSpare'] },
-      diskSmart: { method: 'getDiskSmart', description: 'Get disk SMART information', params: ['disk'] },
-      state: { method: 'getState', description: 'Get storage state information', params: ['name', 'uuid'] }
-    }
-  },
-  sysinfo: {
-    className: 'SystemInfo',
-    commands: {
-      getHostName: { method: 'getHostName', description: 'Get host name information' },
-      getTrimVersion: { method: 'getTrimVersion', description: 'Get Trim version information' },
-      getMachineId: { method: 'getMachineId', description: 'Get machine ID information' },
-      getHardwareInfo: { method: 'getHardwareInfo', description: 'Get hardware information' },
-      getUptime: { method: 'getUptime', description: 'Get system uptime information' }
-    }
-  },
-  user: {
-    className: 'User',
-    commands: {
-      info: { method: 'getInfo', description: 'Get user information' },
-      listUG: { method: 'listUserGroups', description: 'List users and groups' },
-      groupUsers: { method: 'groupUsers', description: 'Get user grouping information' },
-      isAdmin: { method: 'isAdmin', description: 'Check if current user is admin' }
-    }
-  },
-  network: {
-    className: 'Network',
-    commands: {
-      list: { method: 'list', description: 'List network information', params: ['type'] },
-      detect: { method: 'detect', description: 'Detect network interface', params: ['ifName'] }
-    }
-  },
-  file: {
-    className: 'File',
-    commands: {
-      ls: { method: 'list', description: 'List files and directories', params: ['path'] },
-      mkdir: { method: 'mkdir', description: 'Create directory', params: ['path'] },
-      rm: { method: 'remove', description: 'Remove files or directories', params: ['files', 'moveToTrashbin', 'details'] }
-    }
-  },
-  sac: {
-    className: 'SAC',
-    commands: {
-      upsStatus: { method: 'upsStatus', description: 'Get UPS status information' }
-    }
-  }
-};
-
-module.exports = { COMMAND_MAPPING };