koishi-plugin-new-auth 0.1.0

package/lib/index.js

@@ -0,0 +1,637 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NewAuthService = exports.Config = exports.inject = exports.name = void 0;
+exports.apply = apply;
+const koishi_1 = require("koishi");
+exports.name = 'new-auth';
+exports.inject = ['database'];
+const BUILTIN_ROLES = [
+    {
+        id: 'bot-admin',
+        name: 'Bot 管理员',
+        type: 'builtin',
+        scopeType: 'global',
+    },
+    {
+        id: 'guild-owner',
+        name: '群主',
+        type: 'builtin',
+        scopeType: 'guild',
+    },
+    {
+        id: 'guild-admin',
+        name: '群管理员',
+        type: 'builtin',
+        scopeType: 'guild',
+    },
+    {
+        id: 'guild-member',
+        name: '群成员',
+        type: 'builtin',
+        scopeType: 'guild',
+    },
+    {
+        id: 'guest',
+        name: '访客',
+        type: 'builtin',
+        scopeType: 'global',
+    },
+];
+exports.Config = koishi_1.Schema.object({
+    botAdmins: koishi_1.Schema.array(String)
+        .role('table')
+        .description('显式 Bot 管理员 UID，格式为 platform:userId。')
+        .default([]),
+    trustLegacyAuthorityAsAdmin: koishi_1.Schema.boolean()
+        .description('兼容旧实例：是否把 authority 达到阈值的用户视为 Bot 管理员。')
+        .default(true),
+    legacyAdminAuthority: koishi_1.Schema.number()
+        .min(0)
+        .max(10)
+        .description('旧 authority 管理员阈值。')
+        .default(4),
+    ownerRoleNames: koishi_1.Schema.array(String)
+        .description('平台角色名/ID 命中这些值时识别为群主。')
+        .default(['owner', 'guild-owner', 'administrator']),
+    adminRoleNames: koishi_1.Schema.array(String)
+        .description('平台角色名/ID 命中这些值时识别为群管理员。')
+        .default(['admin', 'administrator', 'guild-admin', 'moderator']),
+    allowGuildOverrideAuthorityMax: koishi_1.Schema.number()
+        .min(0)
+        .max(10)
+        .description('旧 authority 建议值不高于该值时，默认认为允许群内自治。')
+        .default(3),
+    deniedMessage: koishi_1.Schema.string()
+        .description('权限不足时返回的提示。')
+        .default('你没有权限使用该指令。'),
+    grantRuntimeCommandPermission: koishi_1.Schema.boolean()
+        .description('新权限系统放行后，临时授予本次 Koishi command 权限，绕过旧 command authority 校验。')
+        .default(true),
+    raiseLegacyAuthority: koishi_1.Schema.boolean()
+        .description('新权限系统放行后，临时提升 session.user.authority 以兼容插件内部硬编码判断。可能影响依赖旧 authority 的插件行为。')
+        .default(false),
+});
+function apply(ctx, config) {
+    ctx.model.extend('new_auth_command', {
+        id: 'string(255)',
+        name: 'string(255)',
+        commandPath: 'string(255)',
+        aliases: 'list',
+        plugin: 'string(255)',
+        description: 'text',
+        legacyAuthority: 'unsigned(4)',
+        status: 'string(32)',
+        allowGuildOverride: 'boolean',
+        createdAt: 'timestamp',
+        updatedAt: 'timestamp',
+    }, {
+        primary: 'id',
+    });
+    ctx.model.extend('new_auth_role', {
+        id: 'string(255)',
+        name: 'string(255)',
+        type: 'string(32)',
+        scopeType: 'string(32)',
+        builtin: 'boolean',
+        createdAt: 'timestamp',
+        updatedAt: 'timestamp',
+    }, {
+        primary: 'id',
+    });
+    ctx.model.extend('new_auth_role_member', {
+        roleId: 'string(255)',
+        platform: 'string(255)',
+        userId: 'string(255)',
+        scope: 'string(255)',
+        createdAt: 'timestamp',
+    }, {
+        primary: ['roleId', 'platform', 'userId', 'scope'],
+    });
+    ctx.model.extend('new_auth_policy', {
+        scope: 'string(255)',
+        roleId: 'string(255)',
+        commandId: 'string(255)',
+        state: 'string(32)',
+        updatedAt: 'timestamp',
+    }, {
+        primary: ['scope', 'roleId', 'commandId'],
+    });
+    const service = new NewAuthService(ctx, config);
+    ctx.provide('newauth', service);
+    ctx.on('ready', () => service.start());
+    ctx.on('command-added', command => service.registerCommand(command));
+    ctx.on('command-updated', command => service.registerCommand(command));
+    ctx.before('command/execute', async (argv) => {
+        return service.intercept(argv);
+    });
+    registerManagementCommands(ctx, config, service);
+}
+class NewAuthService {
+    constructor(ctx, config) {
+        this.ctx = ctx;
+        this.config = config;
+        this.commandCache = new Map();
+        this.adminSet = new Set(config.botAdmins.map(normalizeKey));
+        this.ownerRoleNames = new Set(config.ownerRoleNames.map(normalizeKey));
+        this.adminRoleNames = new Set(config.adminRoleNames.map(normalizeKey));
+    }
+    async start() {
+        await this.ensureBuiltinRoles();
+        for (const command of this.getCommandList()) {
+            await this.registerCommand(command);
+        }
+    }
+    async registerCommand(command) {
+        if (!command?.name)
+            return;
+        const now = new Date();
+        const record = this.createCommandRecord(command, now);
+        const [existing] = await this.ctx.database.get('new_auth_command', { id: record.id });
+        if (existing) {
+            const next = {
+                name: record.name,
+                commandPath: record.commandPath,
+                aliases: record.aliases,
+                plugin: record.plugin,
+                description: record.description,
+                legacyAuthority: record.legacyAuthority,
+                updatedAt: now,
+            };
+            await this.ctx.database.set('new_auth_command', record.id, next);
+            this.commandCache.set(record.id, { ...existing, ...next });
+            return record.id;
+        }
+        await this.ctx.database.create('new_auth_command', record);
+        this.commandCache.set(record.id, record);
+        if (this.isSelfCommand(command)) {
+            await this.setPolicy('global', 'bot-admin', record.id, 'allow');
+        }
+        return record.id;
+    }
+    async intercept(argv) {
+        const { command, session, options } = argv;
+        if (!command || !session)
+            return;
+        const commandId = await this.registerCommand(command);
+        if (!commandId)
+            return;
+        const result = await this.canExecute(session, commandId);
+        if (!result.allowed) {
+            return command.config.showWarning ? this.config.deniedMessage : '';
+        }
+        if (this.config.grantRuntimeCommandPermission) {
+            this.grantRuntimeCommandPermission(session, command, options || {});
+        }
+        if (this.config.raiseLegacyAuthority && session.user) {
+            const user = session.user;
+            const legacyAuthority = result.command?.legacyAuthority ?? command.config.authority ?? 0;
+            if ((user.authority ?? 0) < legacyAuthority) {
+                user.authority = legacyAuthority;
+            }
+        }
+    }
+    async canExecute(session, commandId) {
+        const command = await this.getCommand(commandId);
+        if (!command) {
+            return { allowed: await this.isBotAdmin(session), reason: 'command_missing' };
+        }
+        if (command.status === 'disabled') {
+            return { allowed: false, reason: 'command_disabled', command };
+        }
+        const roles = await this.resolveRoles(session);
+        if (roles.includes('bot-admin')) {
+            return { allowed: true, reason: 'bot_admin', command, roles };
+        }
+        if (command.status === 'pending') {
+            return { allowed: false, reason: 'command_pending', command, roles };
+        }
+        const scope = getScope(session);
+        for (const roleId of roles) {
+            const state = await this.getEffectivePolicy(scope, roleId, commandId);
+            if (state === 'allow') {
+                return { allowed: true, reason: 'role_policy', command, roles, matchedRole: roleId, matchedScope: scope };
+            }
+        }
+        return { allowed: false, reason: 'no_policy', command, roles };
+    }
+    async resolveRoles(session) {
+        const roles = new Set();
+        const scope = getScope(session);
+        if (await this.isBotAdmin(session)) {
+            roles.add('bot-admin');
+        }
+        if (!session.userId) {
+            roles.add('guest');
+        }
+        else if (!session.guildId || session.isDirect) {
+            roles.add('guest');
+        }
+        else if (this.hasPlatformRole(session, this.ownerRoleNames)) {
+            roles.add('guild-owner');
+        }
+        else if (this.hasPlatformRole(session, this.adminRoleNames)) {
+            roles.add('guild-admin');
+        }
+        else {
+            roles.add('guild-member');
+        }
+        if (session.platform && session.userId) {
+            const globalMembers = await this.ctx.database.get('new_auth_role_member', {
+                platform: session.platform,
+                userId: session.userId,
+                scope: 'global',
+            });
+            const scopedMembers = scope === 'global' ? [] : await this.ctx.database.get('new_auth_role_member', {
+                platform: session.platform,
+                userId: session.userId,
+                scope,
+            });
+            for (const member of [...globalMembers, ...scopedMembers]) {
+                roles.add(member.roleId);
+            }
+        }
+        return [...roles];
+    }
+    async isBotAdmin(session) {
+        if (!session.platform || !session.userId)
+            return false;
+        const uid = getUid(session.platform, session.userId);
+        if (this.adminSet.has(uid))
+            return true;
+        const [member] = await this.ctx.database.get('new_auth_role_member', {
+            roleId: 'bot-admin',
+            platform: session.platform,
+            userId: session.userId,
+            scope: 'global',
+        });
+        if (member)
+            return true;
+        const user = session.user;
+        return !!(this.config.trustLegacyAuthorityAsAdmin
+            && user
+            && user.authority >= this.config.legacyAdminAuthority);
+    }
+    async listCommands(options = {}) {
+        const records = await this.ctx.database.get('new_auth_command', {});
+        return records
+            .filter(record => options.all || !options.pending || record.status === 'pending')
+            .filter(record => {
+            if (!options.query)
+                return true;
+            const query = normalizeKey(options.query);
+            return normalizeKey(record.id).includes(query)
+                || normalizeKey(record.commandPath).includes(query)
+                || normalizeKey(record.name).includes(query)
+                || normalizeKey(record.plugin).includes(query);
+        })
+            .sort((a, b) => a.commandPath.localeCompare(b.commandPath));
+    }
+    async listRoles() {
+        const records = await this.ctx.database.get('new_auth_role', {});
+        return records.sort((a, b) => Number(a.builtin) - Number(b.builtin) || a.id.localeCompare(b.id));
+    }
+    async addBotAdmin(uid) {
+        const parsed = parseUid(uid);
+        await this.ensureRoleMember('bot-admin', parsed.platform, parsed.userId, 'global');
+    }
+    async removeBotAdmin(uid) {
+        const parsed = parseUid(uid);
+        await this.ctx.database.remove('new_auth_role_member', {
+            roleId: 'bot-admin',
+            platform: parsed.platform,
+            userId: parsed.userId,
+            scope: 'global',
+        });
+    }
+    async createCustomRole(id, name, scopeType = 'guild') {
+        if (BUILTIN_ROLES.some(role => role.id === id)) {
+            throw new Error(`cannot overwrite builtin role: ${id}`);
+        }
+        const now = new Date();
+        const [existing] = await this.ctx.database.get('new_auth_role', { id });
+        const record = {
+            id,
+            name,
+            type: 'custom',
+            scopeType,
+            builtin: false,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+        };
+        if (existing) {
+            await this.ctx.database.set('new_auth_role', id, record);
+        }
+        else {
+            await this.ctx.database.create('new_auth_role', record);
+        }
+    }
+    async addRoleMember(roleId, uid, scope = 'global') {
+        const parsed = parseUid(uid);
+        await this.ensureRoleMember(roleId, parsed.platform, parsed.userId, scope);
+    }
+    async removeRoleMember(roleId, uid, scope = 'global') {
+        const parsed = parseUid(uid);
+        await this.ctx.database.remove('new_auth_role_member', {
+            roleId,
+            platform: parsed.platform,
+            userId: parsed.userId,
+            scope,
+        });
+    }
+    async setCommandStatus(input, status) {
+        const command = await this.resolveCommandInput(input);
+        await this.ctx.database.set('new_auth_command', command.id, {
+            status,
+            updatedAt: new Date(),
+        });
+        this.commandCache.delete(command.id);
+        return command;
+    }
+    async setCommandPolicy(scope, roleId, input, state) {
+        const command = await this.resolveCommandInput(input);
+        await this.setPolicy(scope, roleId, command.id, state);
+        if (state !== 'inherit' && command.status === 'pending') {
+            await this.setCommandStatus(command.id, 'configured');
+        }
+        return command;
+    }
+    async getCommand(input) {
+        const cached = this.commandCache.get(input);
+        if (cached)
+            return cached;
+        const [command] = await this.ctx.database.get('new_auth_command', { id: input });
+        if (command)
+            this.commandCache.set(input, command);
+        return command;
+    }
+    async ensureBuiltinRoles() {
+        for (const role of BUILTIN_ROLES) {
+            const now = new Date();
+            const [existing] = await this.ctx.database.get('new_auth_role', { id: role.id });
+            const record = {
+                ...role,
+                builtin: true,
+                createdAt: existing?.createdAt ?? now,
+                updatedAt: now,
+            };
+            if (existing) {
+                await this.ctx.database.set('new_auth_role', role.id, record);
+            }
+            else {
+                await this.ctx.database.create('new_auth_role', record);
+            }
+        }
+    }
+    createCommandRecord(command, now) {
+        const plugin = inferPlugin(command);
+        const legacyAuthority = inferLegacyAuthority(command);
+        const commandPath = command.name;
+        const aliases = Object.keys(command._aliases || {});
+        const id = makeCommandId(plugin, commandPath);
+        return {
+            id,
+            name: command.displayName || commandPath,
+            commandPath,
+            aliases,
+            plugin,
+            description: this.getDescription(command),
+            legacyAuthority,
+            status: this.isSelfCommand(command) ? 'configured' : 'pending',
+            allowGuildOverride: legacyAuthority <= this.config.allowGuildOverrideAuthorityMax,
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    getDescription(command) {
+        const key = `commands.${command.name}.description`;
+        const value = this.ctx.i18n.get(key);
+        return Array.isArray(value) ? value[0] ?? '' : value ?? '';
+    }
+    async resolveCommandInput(input) {
+        const normalized = input.trim();
+        const [byId] = await this.ctx.database.get('new_auth_command', { id: normalized });
+        if (byId)
+            return byId;
+        const records = await this.ctx.database.get('new_auth_command', {});
+        const match = records.find(record => record.commandPath === normalized
+            || record.name === normalized
+            || record.aliases.includes(normalized));
+        if (!match)
+            throw new Error(`command not found: ${input}`);
+        return match;
+    }
+    async setPolicy(scope, roleId, commandId, state) {
+        const now = new Date();
+        const query = { scope, roleId, commandId };
+        const [existing] = await this.ctx.database.get('new_auth_policy', query);
+        if (existing) {
+            await this.ctx.database.set('new_auth_policy', query, { state, updatedAt: now });
+        }
+        else {
+            await this.ctx.database.create('new_auth_policy', { ...query, state, updatedAt: now });
+        }
+    }
+    async getEffectivePolicy(scope, roleId, commandId) {
+        if (scope !== 'global') {
+            const [scoped] = await this.ctx.database.get('new_auth_policy', { scope, roleId, commandId });
+            if (scoped && scoped.state !== 'inherit')
+                return scoped.state;
+        }
+        const [global] = await this.ctx.database.get('new_auth_policy', {
+            scope: 'global',
+            roleId,
+            commandId,
+        });
+        return global?.state ?? 'inherit';
+    }
+    async ensureRoleMember(roleId, platform, userId, scope) {
+        const [role] = await this.ctx.database.get('new_auth_role', { id: roleId });
+        if (!role)
+            throw new Error(`role not found: ${roleId}`);
+        const query = { roleId, platform, userId, scope };
+        const [existing] = await this.ctx.database.get('new_auth_role_member', query);
+        if (!existing) {
+            await this.ctx.database.create('new_auth_role_member', { ...query, createdAt: new Date() });
+        }
+    }
+    hasPlatformRole(session, roleNames) {
+        const values = new Set();
+        const author = session.author;
+        const member = session.event?.member;
+        addRoleValue(values, author?.role);
+        addRoleValue(values, author?.roles);
+        addRoleValue(values, member?.role);
+        addRoleValue(values, member?.roles);
+        return [...values].some(value => roleNames.has(normalizeKey(value)));
+    }
+    grantRuntimeCommandPermission(session, command, options) {
+        session.permissions || (session.permissions = []);
+        const permissions = [`command:${command.name}`];
+        for (const option of Object.values(command._options || {})) {
+            if (option.name in options) {
+                permissions.push(`command:${command.name}:option:${option.name}`);
+            }
+        }
+        for (const permission of permissions) {
+            if (!session.permissions.includes(permission)) {
+                session.permissions.push(permission);
+            }
+        }
+    }
+    getCommandList() {
+        return [...(this.ctx.$commander?._commandList || [])];
+    }
+    isSelfCommand(command) {
+        return command.name === 'newauth' || command.name.startsWith('newauth/');
+    }
+}
+exports.NewAuthService = NewAuthService;
+function registerManagementCommands(ctx, config, service) {
+    const authority = config.legacyAdminAuthority;
+    ctx.command('newauth', '管理新权限系统', { authority })
+        .action(async ({ session }) => {
+        const commands = await service.listCommands({ all: true });
+        const pending = commands.filter(command => command.status === 'pending').length;
+        const roles = await service.listRoles();
+        return [
+            `已登记指令：${commands.length}`,
+            `待配置指令：${pending}`,
+            `角色数量：${roles.length}`,
+        ].join('\n');
+    });
+    ctx.command('newauth.commands [query:text]', '列出已登记指令', { authority })
+        .option('pending', '-p 只显示待配置指令')
+        .option('all', '-a 显示全部指令')
+        .action(async ({ options = {} }, query) => {
+        const commands = await service.listCommands({
+            pending: !!options.pending,
+            all: !!options.all,
+            query,
+        });
+        if (!commands.length)
+            return '没有匹配的指令。';
+        return commands.map(command => {
+            return `${command.status.padEnd(10)} ${command.commandPath} (${command.id}) legacy=${command.legacyAuthority}`;
+        }).join('\n');
+    });
+    ctx.command('newauth.roles', '列出角色', { authority })
+        .action(async () => {
+        const roles = await service.listRoles();
+        return roles.map(role => {
+            const type = role.builtin ? 'builtin' : 'custom';
+            return `${role.id} ${role.name} ${type}/${role.scopeType}`;
+        }).join('\n');
+    });
+    ctx.command('newauth.allow <roleId> <command> [scope]', '允许角色使用指令', { authority })
+        .action(async (_, roleId, command, scope = 'global') => {
+        const record = await service.setCommandPolicy(scope, roleId, command, 'allow');
+        return `已允许：${scope} ${roleId} -> ${record.commandPath}`;
+    });
+    ctx.command('newauth.deny <roleId> <command> [scope]', '关闭角色使用指令', { authority })
+        .action(async (_, roleId, command, scope = 'global') => {
+        const record = await service.setCommandPolicy(scope, roleId, command, 'deny');
+        return `已关闭：${scope} ${roleId} -> ${record.commandPath}`;
+    });
+    ctx.command('newauth.inherit <roleId> <command> [scope]', '恢复继承策略', { authority })
+        .action(async (_, roleId, command, scope = 'global') => {
+        const record = await service.setCommandPolicy(scope, roleId, command, 'inherit');
+        return `已恢复继承：${scope} ${roleId} -> ${record.commandPath}`;
+    });
+    ctx.command('newauth.disable <command>', '禁用指令', { authority })
+        .action(async (_, command) => {
+        const record = await service.setCommandStatus(command, 'disabled');
+        return `已禁用：${record.commandPath}`;
+    });
+    ctx.command('newauth.enable <command>', '启用指令', { authority })
+        .action(async (_, command) => {
+        const record = await service.setCommandStatus(command, 'configured');
+        return `已启用：${record.commandPath}`;
+    });
+    ctx.command('newauth.admin.add <uid>', '添加 Bot 管理员', { authority })
+        .action(async (_, uid) => {
+        await service.addBotAdmin(uid);
+        return `已添加 Bot 管理员：${uid}`;
+    });
+    ctx.command('newauth.admin.remove <uid>', '移除 Bot 管理员', { authority })
+        .action(async (_, uid) => {
+        await service.removeBotAdmin(uid);
+        return `已移除 Bot 管理员：${uid}`;
+    });
+    ctx.command('newauth.role.create <id> <displayName> [scopeType]', '创建自定义角色', { authority })
+        .action(async (_, id, displayName, scopeType = 'guild') => {
+        if (scopeType !== 'global' && scopeType !== 'guild') {
+            return 'scopeType 只能是 global 或 guild。';
+        }
+        await service.createCustomRole(id, displayName, scopeType);
+        return `已创建角色：${id}`;
+    });
+    ctx.command('newauth.member.add <roleId> <uid> [scope]', '添加角色成员', { authority })
+        .action(async (_, roleId, uid, scope = 'global') => {
+        await service.addRoleMember(roleId, uid, scope);
+        return `已添加成员：${roleId} ${uid} ${scope}`;
+    });
+    ctx.command('newauth.member.remove <roleId> <uid> [scope]', '移除角色成员', { authority })
+        .action(async (_, roleId, uid, scope = 'global') => {
+        await service.removeRoleMember(roleId, uid, scope);
+        return `已移除成员：${roleId} ${uid} ${scope}`;
+    });
+}
+function inferLegacyAuthority(command) {
+    if (typeof command.config.authority === 'number')
+        return command.config.authority;
+    for (const permission of command.config.permissions || []) {
+        const capture = /^authority:(\d+)$/.exec(permission);
+        if (capture)
+            return +capture[1];
+    }
+    return 1;
+}
+function inferPlugin(command) {
+    const source = command.caller?.scope || command.ctx?.scope;
+    const plugin = source?.plugin?.name || source?.uid || source?.id || 'unknown';
+    return String(plugin).replace(/^koishi-plugin-/, '') || 'unknown';
+}
+function makeCommandId(plugin, commandPath) {
+    return `command:${normalizeSegment(plugin)}:${normalizeSegment(commandPath)}`;
+}
+function normalizeSegment(value) {
+    return value.trim().toLowerCase().replace(/\s+/g, '-').replace(/[/:]+/g, '.');
+}
+function getScope(session) {
+    if (session.platform && session.guildId && !session.isDirect) {
+        return `guild:${session.platform}:${session.guildId}`;
+    }
+    return 'global';
+}
+function parseUid(uid) {
+    const index = uid.indexOf(':');
+    if (index <= 0 || index === uid.length - 1) {
+        throw new Error('uid must be platform:userId');
+    }
+    return {
+        platform: uid.slice(0, index),
+        userId: uid.slice(index + 1),
+    };
+}
+function getUid(platform, userId) {
+    return normalizeKey(`${platform}:${userId}`);
+}
+function normalizeKey(value) {
+    return String(value).trim().toLowerCase();
+}
+function addRoleValue(target, value) {
+    if (!value)
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            addRoleValue(target, item);
+        return;
+    }
+    if (typeof value === 'object') {
+        const role = value;
+        addRoleValue(target, role.id);
+        addRoleValue(target, role.name);
+        return;
+    }
+    target.add(String(value));
+}