gaoding-cli 1.0.0-alpha.10

package/dist/src/features/auth/credential-store.js

@@ -0,0 +1,62 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createLocalJsonFile, LocalFileError } from "../../platform/local-json-file.js";
+import { AuthStateInvalidError, parseStoredAuthState } from "./state.js";
+export function createLocalCredentialStore(options = {}) {
+    const file = options.file ?? createLocalJsonFile({
+        directory: join(options.homeDirectory ?? homedir(), ".gd"),
+        filename: "credentials.json"
+    });
+    return {
+        async read() {
+            try {
+                const text = await file.readText();
+                if (text === null)
+                    return null;
+                let raw;
+                try {
+                    raw = JSON.parse(text);
+                }
+                catch (cause) {
+                    throw new AuthStateInvalidError({ cause });
+                }
+                const parsed = parseStoredAuthState(raw);
+                if (parsed.migrated)
+                    await file.writeTextAtomically(serialize(parsed.state));
+                return parsed.state;
+            }
+            catch (cause) {
+                if (cause instanceof AuthStateInvalidError)
+                    throw cause;
+                throw invalidState(cause);
+            }
+        },
+        async write(state) {
+            try {
+                const validated = parseStoredAuthState(state).state;
+                await file.writeTextAtomically(serialize(validated));
+            }
+            catch (cause) {
+                if (cause instanceof AuthStateInvalidError)
+                    throw cause;
+                throw invalidState(cause);
+            }
+        },
+        async remove() {
+            try {
+                await file.remove();
+            }
+            catch (cause) {
+                throw invalidState(cause);
+            }
+        }
+    };
+}
+function serialize(state) {
+    return `${JSON.stringify(state, null, 2)}\n`;
+}
+function invalidState(cause) {
+    return new AuthStateInvalidError({
+        cause: cause instanceof LocalFileError ? cause.cause : cause
+    });
+}

package/dist/src/features/auth/sso-service.js

@@ -0,0 +1,179 @@
+import { normalizeScope } from "./state.js";
+import { signBindOrganization } from "../../platform/signature.js";
+export class SsoRequestError extends Error {
+    status;
+    constructor(status) {
+        super(status === undefined ? "无法连接稿定登录服务。" : `稿定登录服务请求失败（HTTP ${status}）。`);
+        this.name = "SsoRequestError";
+        this.status = status;
+    }
+}
+export function classifyBindOutcome(input) {
+    const code = input.code === undefined ? "" : String(input.code).trim().toUpperCase();
+    const details = input.message ? { message: input.message } : {};
+    if (!code || code === "0" || code === "200" || code === "OK" || code === "SUCCESS") {
+        return input.bindExpiresAt
+            ? { status: "success", bindExpiresAt: input.bindExpiresAt }
+            : { status: "success" };
+    }
+    return code === "ORG_INVALID"
+        ? { status: "invalid", ...details }
+        : { status: "failed", ...details };
+}
+export function createSsoService(options) {
+    const baseUrl = new URL(options.ssoApi);
+    if (!baseUrl.pathname.endsWith("/"))
+        baseUrl.pathname += "/";
+    async function request(relativeUrl, signal) {
+        signal.throwIfAborted();
+        try {
+            return await options.fetch(new URL(relativeUrl, baseUrl), {
+                method: "POST",
+                headers: { Accept: "application/json" },
+                signal: AbortSignal.any([
+                    signal,
+                    AbortSignal.timeout(options.timeoutMs ?? 30_000)
+                ])
+            });
+        }
+        catch {
+            if (signal.aborted)
+                throw signal.reason;
+            throw new SsoRequestError();
+        }
+    }
+    return {
+        async startDeviceAuthorization(signal) {
+            const response = await request("oauth/device-authorization?clientId=gdhub-cli", signal);
+            if (!response.ok)
+                throw new SsoRequestError(response.status);
+            const body = await responseRecord(response);
+            const authorizeCode = nonEmptyString(body.authorize_code);
+            const deviceCode = nonEmptyString(body.device_code);
+            const expiresInSeconds = positiveNumber(body.expires_in);
+            const intervalSeconds = positiveNumber(body.interval);
+            if (!authorizeCode || !deviceCode || !expiresInSeconds || !intervalSeconds) {
+                throw new SsoRequestError(response.status);
+            }
+            return { authorizeCode, deviceCode, expiresInSeconds, intervalSeconds };
+        },
+        async pollDeviceToken(deviceCode, signal) {
+            const query = new URLSearchParams({
+                grantType: "device_code",
+                deviceCode
+            });
+            const response = await request(`oauth/device/token?${query}`, signal);
+            const body = await responseRecord(response);
+            const error = nonEmptyString(body.error)?.toLowerCase();
+            if (error === "authorization_pending")
+                return { status: "pending" };
+            if (error === "slow_down")
+                return { status: "slow_down" };
+            if (!response.ok)
+                throw new SsoRequestError(response.status);
+            const accessKey = nonEmptyString(body.ak);
+            const secretKey = nonEmptyString(body.sk);
+            const expiresAt = dateString(body.expires_at);
+            if (!accessKey || !secretKey || !expiresAt)
+                throw new SsoRequestError(response.status);
+            let scope;
+            try {
+                scope = normalizeScope(body.scope);
+            }
+            catch {
+                throw new SsoRequestError(response.status);
+            }
+            const result = {
+                status: "authorized",
+                credential: { accessKey, secretKey, expiresAt, scope }
+            };
+            if (isRecord(body.user)) {
+                const id = identifier(body.user.id);
+                const name = nonEmptyString(body.user.name);
+                if (id && name)
+                    result.account = { id, name };
+            }
+            const organizationId = identifier(body.orgId ?? body.org_id ?? body.orgID);
+            if (organizationId)
+                result.organizationId = organizationId;
+            return result;
+        },
+        async bindOrganization(input, signal) {
+            const timestamp = Math.floor(options.now().getTime() / 1000);
+            const query = new URLSearchParams({
+                ak: input.credential.accessKey,
+                orgId: input.organizationId,
+                signature: signBindOrganization({
+                    accessKey: input.credential.accessKey,
+                    secretKey: input.credential.secretKey,
+                    organizationId: input.organizationId,
+                    timestamp
+                }),
+                timestamp: String(timestamp)
+            });
+            const response = await request(`oauth/device/bind-org?${query}`, signal);
+            if (!response.ok)
+                throw new SsoRequestError(response.status);
+            const text = await response.text();
+            if (!text.trim())
+                return {};
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                return { message: text.trim() };
+            }
+            if (!isRecord(parsed))
+                throw new SsoRequestError(response.status);
+            const result = {};
+            if (typeof parsed.code === "string" || typeof parsed.code === "number") {
+                result.code = parsed.code;
+            }
+            const message = nonEmptyString(parsed.message);
+            if (message)
+                result.message = message;
+            if (parsed.bind_expires_at !== undefined) {
+                const bindExpiresAt = dateString(parsed.bind_expires_at);
+                if (!bindExpiresAt)
+                    throw new SsoRequestError(response.status);
+                result.bindExpiresAt = bindExpiresAt;
+            }
+            return result;
+        }
+    };
+}
+async function responseRecord(response) {
+    try {
+        const value = await response.json();
+        if (isRecord(value))
+            return value;
+    }
+    catch {
+        // Handled as one safe protocol failure below.
+    }
+    throw new SsoRequestError(response.status);
+}
+function positiveNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0
+        ? value
+        : undefined;
+}
+function dateString(value) {
+    const text = nonEmptyString(value);
+    return text && !Number.isNaN(Date.parse(text)) ? text : undefined;
+}
+function identifier(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return nonEmptyString(value);
+}
+function nonEmptyString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const text = value.trim();
+    return text || undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/src/features/auth/state.js

@@ -0,0 +1,129 @@
+export class AuthStateInvalidError extends Error {
+    constructor(options) {
+        super("本地登录状态无效。", options);
+        this.name = "AuthStateInvalidError";
+    }
+}
+export function parseStoredAuthState(value) {
+    try {
+        if (!isRecord(value))
+            throw new Error("invalid root");
+        if (value.version === 1)
+            return { state: parseVersionOne(value), migrated: false };
+        if (value.version === 2)
+            return { state: migrateVersionTwo(value), migrated: true };
+        throw new Error("unsupported version");
+    }
+    catch (cause) {
+        if (cause instanceof AuthStateInvalidError)
+            throw cause;
+        throw new AuthStateInvalidError({ cause });
+    }
+}
+function parseVersionOne(value) {
+    if (!isRecord(value.credential))
+        throw new Error("missing credential");
+    const credential = value.credential;
+    const result = {
+        version: 1,
+        credential: {
+            accessKey: requiredString(credential.accessKey),
+            secretKey: requiredString(credential.secretKey),
+            expiresAt: requiredDate(credential.expiresAt),
+            scope: requiredScope(credential.scope)
+        }
+    };
+    if (value.account !== undefined) {
+        if (!isRecord(value.account))
+            throw new Error("invalid account");
+        result.account = {
+            id: requiredString(value.account.id),
+            name: requiredString(value.account.name)
+        };
+    }
+    if (value.organization !== undefined) {
+        if (!isRecord(value.organization))
+            throw new Error("invalid organization");
+        result.organization = organization(value.organization.id, value.organization.name, value.organization.bindExpiresAt);
+    }
+    return result;
+}
+function migrateVersionTwo(value) {
+    const result = {
+        version: 1,
+        credential: {
+            accessKey: requiredString(value.ak),
+            secretKey: requiredString(value.sk),
+            expiresAt: requiredDate(value.expires_at),
+            scope: normalizeScope(value.scope)
+        }
+    };
+    const account = completeLegacyPair(value.user);
+    if (account)
+        result.account = account;
+    if (isRecord(value.current_org)) {
+        const id = legacyString(value.current_org.id);
+        const name = optionalString(value.current_org.name);
+        if (id && name) {
+            result.organization = organization(id, name, value.current_org.bind_expires_at);
+        }
+    }
+    return result;
+}
+function organization(id, name, expiresAt) {
+    const result = {
+        id: requiredString(id),
+        name: requiredString(name)
+    };
+    if (expiresAt !== undefined)
+        result.bindExpiresAt = requiredDate(expiresAt);
+    return result;
+}
+function completeLegacyPair(value) {
+    if (!isRecord(value))
+        return undefined;
+    const id = legacyString(value.id);
+    const name = optionalString(value.name);
+    return id && name ? { id, name } : undefined;
+}
+function requiredScope(value) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new Error("invalid scope");
+    }
+    return normalizeScope(value);
+}
+export function normalizeScope(value) {
+    if (value === undefined || value === null)
+        return [];
+    const entries = typeof value === "string" ? value.split(",") : value;
+    if (!Array.isArray(entries) || entries.some((item) => typeof item !== "string")) {
+        throw new Error("invalid scope");
+    }
+    return entries.map((item) => item.trim()).filter(Boolean);
+}
+function requiredDate(value) {
+    const text = requiredString(value);
+    if (Number.isNaN(Date.parse(text)))
+        throw new Error("invalid date");
+    return text;
+}
+function requiredString(value) {
+    const text = optionalString(value);
+    if (!text)
+        throw new Error("missing string");
+    return text;
+}
+function optionalString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const text = value.trim();
+    return text || undefined;
+}
+function legacyString(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return optionalString(value);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/src/features/auth/use-cases.js

@@ -0,0 +1,106 @@
+export class DeviceAuthorizationExpiredError extends Error {
+    constructor() {
+        super("授权码已过期，请重新执行 gd-cli auth login。");
+        this.name = "DeviceAuthorizationExpiredError";
+    }
+}
+export function createAuthUseCases(dependencies) {
+    return {
+        async status(input) {
+            const state = await dependencies.store.read();
+            if (!state)
+                return { logged_in: false, next_steps: ["gd-cli auth login"] };
+            const valid = Date.parse(state.credential.expiresAt) > input.now.getTime();
+            return {
+                logged_in: true,
+                account: {
+                    user_id: state.account?.id ?? null,
+                    name: state.account?.name ?? null
+                },
+                organization: state.organization
+                    ? { id: state.organization.id, name: state.organization.name }
+                    : null,
+                credential: {
+                    expires_at: state.credential.expiresAt,
+                    valid,
+                    scope: [...state.credential.scope]
+                },
+                next_steps: !valid
+                    ? ["gd-cli auth logout", "gd-cli auth login"]
+                    : state.organization
+                        ? []
+                        : ["gd-cli org list", "gd-cli org switch"]
+            };
+        },
+        async logout() {
+            await dependencies.store.remove();
+        },
+        async login(input) {
+            input.signal.throwIfAborted();
+            const existing = await dependencies.store.read();
+            if (existing && Date.parse(existing.credential.expiresAt) > dependencies.now().getTime()) {
+                return {
+                    status: "already_logged_in",
+                    organizationSelected: existing.organization !== undefined
+                };
+            }
+            const authorization = await dependencies.sso.startDeviceAuthorization(input.signal);
+            const deadline = dependencies.now().getTime() + authorization.expiresInSeconds * 1000;
+            const authorizationUrl = new URL("/cli/device-authorization", dependencies.authPageOrigin);
+            authorizationUrl.searchParams.set("code", authorization.authorizeCode);
+            await input.interaction.showAuthorization(authorizationUrl);
+            if (!input.noBrowser) {
+                try {
+                    await input.interaction.openBrowser(authorizationUrl);
+                }
+                catch {
+                    input.interaction.warn("无法自动打开浏览器，请手动访问授权链接。");
+                }
+            }
+            let interval = authorization.intervalSeconds * 1000;
+            while (true) {
+                if (dependencies.now().getTime() + interval > deadline) {
+                    throw new DeviceAuthorizationExpiredError();
+                }
+                await dependencies.sleep(interval, input.signal);
+                input.signal.throwIfAborted();
+                const token = await dependencies.sso.pollDeviceToken(authorization.deviceCode, input.signal);
+                if (token.status === "pending")
+                    continue;
+                if (token.status === "slow_down") {
+                    interval += 5_000;
+                    continue;
+                }
+                const state = {
+                    version: 1,
+                    credential: token.credential,
+                    ...(token.account ? { account: token.account } : {})
+                };
+                await dependencies.store.write(state);
+                if (!token.organizationId) {
+                    input.interaction.warn("登录成功，请执行 gd-cli org switch 选择组织。");
+                    return { status: "logged_in", organizationSelected: false };
+                }
+                try {
+                    const organization = await dependencies.organizationBinder.bindAuthorizedOrganization({
+                        credential: token.credential,
+                        organizationId: token.organizationId,
+                        signal: input.signal
+                    });
+                    if (!organization) {
+                        input.interaction.warn("登录成功，但未能选择组织；请执行 gd-cli org switch。");
+                        return { status: "logged_in", organizationSelected: false };
+                    }
+                    await dependencies.store.write({ ...state, organization });
+                    return { status: "logged_in", organizationSelected: true };
+                }
+                catch {
+                    if (input.signal.aborted)
+                        throw input.signal.reason;
+                    input.interaction.warn("登录成功，但组织绑定失败；请执行 gd-cli org switch。");
+                    return { status: "logged_in", organizationSelected: false };
+                }
+            }
+        }
+    };
+}