kld-sdd 2.6.21 → 2.7.3

package/lib/device-auth.js

@@ -1,345 +0,0 @@
-// kld-T03 — Device Flow 授权客户端
-// 职责：code/poll、浏览器打开降级、过期/拒绝/Ctrl+C 状态、原子写入用户配置。
-// 与 kb-sdd 跨仓契约对齐；Node 14 兼容；不依赖全局 fetch。
-'use strict';
-
-const { spawn } = require('node:child_process');
-const fs = require('node:fs');
-const path = require('node:path');
-
-const {
-  normalizeServerUrl,
-  parseDeviceCodeResponse,
-  classifyDevicePollResponse,
-  postJson,
-  unwrapApiResponse,
-} = require('../skywalk-sdd/lib/usage-contract.cjs');
-const {
-  readUserConfig,
-  writeUserConfig,
-  USER_CONFIG_VERSION,
-} = require('../skywalk-sdd/lib/user-config.cjs');
-
-const DEFAULT_TIMEOUT_MS = 15000;
-const DEFAULT_POLL_INTERVAL_MS = 2000;
-const DEFAULT_EXPIRES_IN_MS = 600 * 1000;
-// 交互输入平台地址时的默认值（回车即采用）
-const DEFAULT_SERVER_URL = 'http://10.29.213.80:8080/';
-
-/**
- * 解析 server URL：已有用户绑定 → 项目现有 KB server（kb-state.json.api）→ env KLD_SDD_SERVER → null。
- * @param {{homeDir?:string, env?:object, projectRoot?:string}} [options]
- * @returns {string|null} 规范化后的 server URL；未找到返回 null
- */
-function resolveServer(options = {}) {
-  const homeDir = options.homeDir;
-  const env = options.env || process.env;
-  const projectRoot = options.projectRoot || process.cwd();
-  // 1. 已有用户绑定
-  const existing = readUserConfig(homeDir);
-  if (existing && typeof existing.server === 'string') {
-    const normalized = normalizeServerUrl(existing.server);
-    if (normalized) return normalized;
-  }
-  // 2. 项目现有 KB server（kld-fixback YELLOW#3）
-  try {
-    const kbStatePath = path.join(projectRoot, 'kb-state.json');
-    if (fs.existsSync(kbStatePath)) {
-      const kbState = JSON.parse(fs.readFileSync(kbStatePath, 'utf8'));
-      if (kbState && typeof kbState.api === 'string') {
-        const normalized = normalizeServerUrl(kbState.api);
-        if (normalized) return normalized;
-      }
-    }
-  } catch {
-    // kb-state 读取失败时静默，继续下一级
-  }
-  // 3. env KLD_SDD_SERVER
-  if (env && typeof env.KLD_SDD_SERVER === 'string') {
-    const normalized = normalizeServerUrl(env.KLD_SDD_SERVER);
-    if (normalized) return normalized;
-  }
-  return null;
-}
-
-/**
- * 请求 Device Flow code。
- * @param {string} server — 已规范化的 server URL
- * @param {{clientName?:string,clientVersion?:string,timeoutMs?:number}} [options]
- * @returns {Promise<{deviceCode,userCode,verificationUri,verificationUriComplete,expiresIn,interval}>}
- * @throws {Error} 网络失败 / 响应非法
- */
-async function requestDeviceCode(server, options = {}) {
-  const normalized = normalizeServerUrl(server);
-  if (!normalized) throw new Error('server must be http/https URL');
-  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
-    ? options.timeoutMs
-    : DEFAULT_TIMEOUT_MS;
-  const payload = {
-    clientName: typeof options.clientName === 'string' && options.clientName
-      ? options.clientName
-      : 'kld-sdd',
-    clientVersion: typeof options.clientVersion === 'string' && options.clientVersion
-      ? options.clientVersion
-      : 'unknown',
-  };
-  const result = await postJson(`${normalized}/api/v1/auth/device/code`, payload, { timeoutMs });
-  if (result.statusCode == null) {
-    throw new Error(`device code request failed: ${result.error ? result.error.message : 'network error'}`);
-  }
-  if (result.statusCode < 200 || result.statusCode >= 300) {
-    throw new Error(`device code request HTTP ${result.statusCode}`);
-  }
-  // 兼容两种格式：直接 data 或 ApiResponse 信封
-  let data = result.body;
-  if (result.body && typeof result.body === 'object' && typeof result.body.code === 'number') {
-    data = unwrapApiResponse(result.body);
-  }
-  const parsed = parseDeviceCodeResponse(data);
-  if (!parsed) throw new Error('device code response missing required fields (deviceCode/userCode/verificationUri)');
-  return parsed;
-}
-
-/**
- * 轮询 Device Flow token，直到 authorized / expired / denied / aborted / error。
- *
- * @param {string} server — 已规范化 server URL
- * @param {string} deviceCode
- * @param {{intervalMs?:number,expiresInMs?:number,timeoutMs?:number,signal?:AbortSignal,onPending?:Function}} [options]
- * @returns {Promise<{kind:'authorized',token:string,user:*}|{kind:'expired'}|{kind:'denied'}|{kind:'aborted'}|{kind:'error',message?:string}>}
- */
-async function pollDeviceToken(server, deviceCode, options = {}) {
-  const normalized = normalizeServerUrl(server);
-  if (!normalized) return { kind: 'error', message: 'invalid server' };
-  const intervalMs = Number.isFinite(options.intervalMs) && options.intervalMs > 0
-    ? options.intervalMs
-    : DEFAULT_POLL_INTERVAL_MS;
-  const expiresInMs = Number.isFinite(options.expiresInMs) && options.expiresInMs > 0
-    ? options.expiresInMs
-    : DEFAULT_EXPIRES_IN_MS;
-  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
-    ? options.timeoutMs
-    : DEFAULT_TIMEOUT_MS;
-  const signal = options.signal;
-  const onPending = typeof options.onPending === 'function' ? options.onPending : null;
-
-  const startedAt = Date.now();
-  const deadline = startedAt + expiresInMs;
-  let currentInterval = intervalMs;
-  let consecutiveNetworkErrors = 0;
-  const MAX_CONSECUTIVE_NETWORK_ERRORS = 5;
-
-  // 主循环
-  // eslint-disable-next-line no-constant-condition
-  while (true) {
-    if (signal && signal.aborted) return { kind: 'aborted' };
-    if (Date.now() >= deadline) return { kind: 'expired' };
-
-    const result = await postJson(
-      `${normalized}/api/v1/auth/device/poll`,
-      { deviceCode },
-      { timeoutMs: Math.min(timeoutMs, Math.max(1, deadline - Date.now())) },
-    );
-    if (signal && signal.aborted) return { kind: 'aborted' };
-
-    if (result.statusCode == null) {
-      consecutiveNetworkErrors += 1;
-      if (consecutiveNetworkErrors >= MAX_CONSECUTIVE_NETWORK_ERRORS) {
-        return { kind: 'error', message: result.error ? result.error.message : 'network error' };
-      }
-    } else {
-      consecutiveNetworkErrors = 0;
-    }
-
-    // 平台可能返回成功信封（{code:0,message,data}）：先解包再分类，
-    // 与 requestDeviceCode 的信封处理对齐；非 0 code 或裸契约响应保持原样，
-    // 交给分类器走 RFC 8628 error 字段等防御路径（向后兼容）。
-    let pollBody = result.body;
-    if (pollBody && typeof pollBody === 'object' && pollBody.code === 0) {
-      try {
-        pollBody = unwrapApiResponse(pollBody);
-      } catch {
-        pollBody = result.body;
-      }
-    }
-    const classified = classifyDevicePollResponse(result.statusCode, pollBody);
-    if (classified.kind === 'authorized') {
-      return { kind: 'authorized', token: classified.token, user: classified.user };
-    }
-    if (classified.kind === 'expired') return { kind: 'expired' };
-    if (classified.kind === 'denied') return { kind: 'denied' };
-    if (classified.kind === 'slow_down') {
-      currentInterval = Math.min(currentInterval + 1000, 10000);
-    }
-    if (classified.kind === 'error' && result.statusCode != null && result.statusCode >= 500) {
-      // 5xx 当网络错误处理，继续
-    } else if (classified.kind === 'error') {
-      return { kind: 'error', message: classified.message };
-    }
-    // pending / slow_down / 5xx 都继续轮询
-    if (onPending) {
-      try { onPending({ kind: classified.kind, intervalMs: currentInterval }); } catch { /* ignore */ }
-    }
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) return { kind: 'expired' };
-    const sleepMs = Math.min(currentInterval, remaining);
-    await sleep(sleepMs, signal);
-    if (signal && signal.aborted) return { kind: 'aborted' };
-  }
-}
-
-function sleep(ms, signal) {
-  return new Promise((resolve) => {
-    const timer = setTimeout(done, ms);
-    function done() {
-      if (signal) signal.removeEventListener('abort', done);
-      clearTimeout(timer);
-      resolve();
-    }
-    if (signal) {
-      if (signal.aborted) return done();
-      signal.addEventListener('abort', done, { once: true });
-    }
-  });
-}
-
-/**
- * 构造各平台打开浏览器的命令（纯函数，便于测试）。
- * win32 用 PowerShell Start-Process（ShellExecute 打开默认浏览器）：
- * - cmd /c start：部分机器静默失败，退出码 0 但浏览器未开（探测服务器无请求）；
- * - explorer.exe <url>：URL 含 ? query 时解析失败，退而弹出文件夹窗口（真机复现）；
- * - Start-Process 经探测验证可完整传递带 query 的 URL。
- * 用 -EncodedCommand（UTF-16LE base64）传参，Node→CreateProcess→PowerShell 全程无引号转义问题。
- * @param {'win32'|'darwin'|string} platform
- * @param {string} url
- * @returns {{cmd:string,args:string[]}}
- */
-function buildOpenCommand(platform, url) {
-  const target = String(url);
-  if (platform === 'win32') {
-    // 单引号在 PowerShell 单引号字符串中用 '' 转义；URL 正常不含单引号，防御处理
-    const ps = `Start-Process '${target.replace(/'/g, "''")}'`;
-    const encoded = Buffer.from(ps, 'utf16le').toString('base64');
-    return { cmd: 'powershell.exe', args: ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded] };
-  }
-  if (platform === 'darwin') return { cmd: 'open', args: [target] };
-  return { cmd: 'xdg-open', args: [target] };
-}
-
-/**
- * 打开浏览器（best-effort）。任何失败均不抛错，返回 false 让调用方走打印降级。
- * @param {string} url
- * @returns {Promise<boolean>}
- */
-async function openSystemBrowser(url) {
-  if (typeof url !== 'string' || !url) return false;
-  const platform = process.platform;
-  const { cmd, args } = buildOpenCommand(platform, url);
-  return new Promise((resolve) => {
-    let child;
-    try {
-      // win32 不能 detached：DETACHED_PROCESS（无控制台）下 PowerShell Start-Process
-      // 会静默失败——退出码 0 但浏览器未开（真机矩阵验证）。子进程秒退 + unref，
-      // 不依赖 detached 也能让父进程正常退出。
-      child = spawn(cmd, args, { detached: platform !== 'win32', stdio: 'ignore' });
-    } catch {
-      resolve(false);
-      return;
-    }
-    let settled = false;
-    const finish = (ok) => {
-      if (settled) return;
-      settled = true;
-      resolve(ok);
-    };
-    child.on('error', () => finish(false));
-    child.on('close', (code) => finish(code === 0));
-    child.unref();
-    // 浏览器启动命令通常立刻返回；超过 3s 未返回视为已脱手
-    setTimeout(() => finish(true), 3000).unref();
-  });
-}
-
-/**
- * 完整 Device Flow 编排。
- *
- * @param {object} options
- * @param {string} options.server — 已规范化 server URL（必需）
- * @param {string} [options.clientName]
- * @param {string} [options.clientVersion]
- * @param {string} [options.homeDir] — 注入 home（测试用）
- * @param {Function} [options.openUrl] — 自定义浏览器打开；返回 Promise<boolean>
- * @param {Function} [options.onPrint] — 输出提示（默认 console.log）
- * @param {number} [options.intervalMs]
- * @param {number} [options.expiresInMs]
- * @param {AbortSignal} [options.signal]
- * @returns {Promise<{status:'bound'|'expired'|'denied'|'aborted'|'error',reason?:string,config?:object}>}
- */
-async function runDeviceFlow(options = {}) {
-  const normalized = normalizeServerUrl(options.server || '');
-  const onPrint = typeof options.onPrint === 'function' ? options.onPrint : () => {};
-  if (!normalized) {
-    return { status: 'error', reason: 'server must be http/https URL' };
-  }
-  const openUrl = typeof options.openUrl === 'function' ? options.openUrl : openSystemBrowser;
-
-  let code;
-  try {
-    code = await requestDeviceCode(normalized, options);
-  } catch (err) {
-    return { status: 'error', reason: String(err && err.message || err) };
-  }
-
-  // 打开浏览器；失败时打印降级
-  let opened = false;
-  try {
-    opened = await openUrl(code.verificationUriComplete || code.verificationUri);
-  } catch {
-    opened = false;
-  }
-  if (!opened) {
-    onPrint(`请访问以下链接完成授权：`);
-    onPrint(`  ${code.verificationUriComplete || code.verificationUri}`);
-    onPrint(`验证码：${code.userCode}`);
-  }
-
-  const pollResult = await pollDeviceToken(normalized, code.deviceCode, {
-    intervalMs: Number.isFinite(options.intervalMs) ? options.intervalMs : code.interval * 1000,
-    expiresInMs: Number.isFinite(options.expiresInMs) ? options.expiresInMs : code.expiresIn * 1000,
-    signal: options.signal,
-  });
-
-  if (pollResult.kind === 'aborted') return { status: 'aborted' };
-  if (pollResult.kind === 'expired') return { status: 'expired' };
-  if (pollResult.kind === 'denied') return { status: 'denied' };
-  if (pollResult.kind === 'error') return { status: 'error', reason: pollResult.message || 'poll error' };
-
-  // authorized：原子写入配置
-  const existing = readUserConfig(options.homeDir) || {};
-  const displayName = pollResult.user && typeof pollResult.user === 'object'
-    ? (pollResult.user.displayName || pollResult.user.userName || pollResult.user.userId || null)
-    : null;
-  const next = Object.assign({}, existing, {
-    version: USER_CONFIG_VERSION,
-    server: normalized,
-    token: pollResult.token,
-    userName: displayName || existing.userName || null,
-    boundAt: new Date().toISOString(),
-  });
-  try {
-    writeUserConfig(next, options.homeDir);
-  } catch (err) {
-    return { status: 'error', reason: `write config failed: ${err && err.message || err}` };
-  }
-  return { status: 'bound', config: next };
-}
-
-module.exports = {
-  resolveServer,
-  requestDeviceCode,
-  pollDeviceToken,
-  runDeviceFlow,
-  openSystemBrowser,
-  buildOpenCommand,
-  DEFAULT_SERVER_URL,
-};

package/lib/init-account-binding.js

@@ -1,108 +0,0 @@
-// kld-B1 — init 向导平台账号绑定（Device Flow）编排
-// 职责：已绑定提示更新 / 未绑定引导授权 / 跳过写仅 server 配置 / 失败不阻塞 init。
-// 依赖注入（runDeviceFlow/readUserConfig/writeUserConfig/resolveServer/ask/onPrint）便于单测 mock。
-// 提示语不出现“使用统计”字样（B1 评审要求）。
-'use strict';
-
-const deviceAuth = require('./device-auth');
-const userConfig = require('../skywalk-sdd/lib/user-config.cjs');
-
-const LATER_LOGIN_HINT = '稍后运行 npx kld-sdd auth login 绑定平台账号';
-const DEFAULT_SERVER_URL = deviceAuth.DEFAULT_SERVER_URL;
-
-function defaultPrint(line) {
-  console.log(line);
-}
-
-/**
- * 账号绑定向导。
- *
- * @param {object} options
- * @param {Function} [options.ask] — 交互提问（question）=> Promise<answer>；非交互环境可不传
- * @param {boolean} [options.skipAuth] — --skip-auth：不询问，打印稍后绑定提示
- * @param {Function} [options.isInteractive] — 是否交互终端（默认按 stdin.isTTY 判定）
- * @param {Function} [options.onPrint] — 输出（默认 console.log）
- * @param {Function} [options.readUserConfig] — 默认 skywalk-sdd/lib/user-config.cjs
- * @param {Function} [options.writeUserConfig]
- * @param {Function} [options.resolveServer] — 默认 lib/device-auth.js
- * @param {Function} [options.runDeviceFlow]
- * @param {string} [options.homeDir] — 注入 home（测试用）
- * @param {AbortSignal} [options.signal] — Ctrl+C 等外部取消信号
- * @returns {Promise<{status:'bound'|'kept'|'skipped'|'failed'|'deferred',userName?:string,config?:object,reason?:string}>}
- */
-async function runAccountBinding(options = {}) {
-  const print = typeof options.onPrint === 'function' ? options.onPrint : defaultPrint;
-  const readCfg = typeof options.readUserConfig === 'function' ? options.readUserConfig : userConfig.readUserConfig;
-  const writeCfg = typeof options.writeUserConfig === 'function' ? options.writeUserConfig : userConfig.writeUserConfig;
-  const resolveSrv = typeof options.resolveServer === 'function' ? options.resolveServer : deviceAuth.resolveServer;
-  const runFlow = typeof options.runDeviceFlow === 'function' ? options.runDeviceFlow : deviceAuth.runDeviceFlow;
-  const isInteractive = typeof options.isInteractive === 'function'
-    ? options.isInteractive
-    : () => Boolean(process.stdin && process.stdin.isTTY);
-  const homeDir = options.homeDir;
-
-  // --skip-auth 或 stdin 非 TTY：不询问，打印一行稍后绑定提示
-  if (options.skipAuth || !isInteractive() || typeof options.ask !== 'function') {
-    print(`🔗 ${LATER_LOGIN_HINT}`);
-    return { status: 'deferred' };
-  }
-  const ask = options.ask;
-
-  const existing = readCfg(homeDir);
-  if (existing && existing.token) {
-    const boundDate = typeof existing.boundAt === 'string' && existing.boundAt
-      ? existing.boundAt.slice(0, 10)
-      : '未知日期';
-    const answer = String(await ask(`? 已绑定账号：${existing.userName || '未知用户'}（${boundDate} 绑定）。是否需要更新用户绑定？(y/N) `))
-      .trim().toLowerCase();
-    if (answer !== 'y' && answer !== 'yes') {
-      print(`✓ 保留现有绑定：${existing.userName || '未知用户'}`);
-      return { status: 'kept', userName: existing.userName || null, config: existing };
-    }
-  }
-
-  const bindAnswer = String(await ask('? 是否绑定平台账号？(Y/n) ')).trim().toLowerCase();
-  if (bindAnswer === 'n' || bindAnswer === 'no') {
-    // 选择不绑定/跳过：写仅含 server 的用户级 config（resolveServer 无结果则不写）
-    const server = resolveSrv({ homeDir });
-    if (server) {
-      try {
-        writeCfg({ version: userConfig.USER_CONFIG_VERSION, server }, homeDir);
-      } catch (err) {
-        print(`⚠️  写入用户配置失败（${err && err.message ? err.message : err}），已跳过`);
-      }
-    }
-    print(`🔗 ${LATER_LOGIN_HINT}`);
-    return { status: 'skipped' };
-  }
-
-  let server = resolveSrv({ homeDir });
-  if (!server) {
-    const input = String(await ask(`? 请输入平台地址（http/https，回车默认 ${DEFAULT_SERVER_URL}）：`)).trim();
-    server = input || DEFAULT_SERVER_URL;
-  }
-
-  print('请在浏览器完成授权，等待中…（按 Ctrl+C 取消）');
-  const result = await runFlow({ server, homeDir, onPrint: print, signal: options.signal });
-  if (result && result.status === 'bound') {
-    const name = result.config && result.config.userName ? result.config.userName : '未知用户';
-    print(`✓ 已绑定：${name}`);
-    return { status: 'bound', userName: name, config: result.config };
-  }
-
-  const status = result && result.status;
-  const hints = {
-    expired: '⚠️  授权已过期，未完成绑定',
-    denied: '⚠️  授权被拒绝，未完成绑定',
-    aborted: '⚠️  已取消绑定',
-  };
-  print(hints[status] || `⚠️  绑定失败${result && result.reason ? `：${result.reason}` : ''}`);
-  print(`🔗 ${LATER_LOGIN_HINT}`);
-  return { status: 'failed', reason: status || 'error' };
-}
-
-module.exports = {
-  runAccountBinding,
-  LATER_LOGIN_HINT,
-  DEFAULT_SERVER_URL,
-};