luckytri 1.0.0 → 1.0.2

package/scripts/start-server.js

@@ -1,41 +1,41 @@
-import { spawn } from "node:child_process";
-import { join } from "node:path";
-import { prepareRuntime } from "./runtime.js";
-import {
-  resolveProxyEnvironment,
-  supportsNodeEnvironmentProxy,
-} from "./proxy-config.js";
-
-const paths = prepareRuntime();
-const proxy = await resolveProxyEnvironment(process.env);
-if (proxy.enabled && !supportsNodeEnvironmentProxy())
-  throw new Error(
-    "系统代理转发需要 Node.js 24.5 或更高版本。请升级 Node.js 后重启 LuckyTri。",
-  );
-
-const args = [
-  ...(proxy.enabled ? ["--use-env-proxy"] : []),
-  join(paths.package, "server", "index.js"),
-];
-const env = { ...process.env, ...proxy.env };
-if (proxy.enabled) console.log("已启用系统代理，外部 API 请求将经代理转发。");
-else if (proxy.source === "windows-pac-unsupported")
-  console.log(
-    "检测到 PAC 自动代理；LuckyTri 暂不解析 PAC，请改用本机 HTTP 代理或配置 HTTPS_PROXY。",
-  );
-else console.log("未检测到系统代理，外部 API 请求将直连。");
-
-const child = spawn(process.execPath, args, {
-  cwd: paths.home,
-  env,
-  stdio: "inherit",
-});
-for (const signal of ["SIGINT", "SIGTERM"])
-  process.on(signal, () => child.kill(signal));
-child.once("error", (error) => {
-  console.error(`LuckyTri 启动失败：${error.message}`);
-  process.exitCode = 1;
-});
-child.once("exit", (code, signal) => {
-  process.exitCode = signal ? 1 : (code ?? 1);
-});
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { prepareRuntime } from "./runtime.js";
+import {
+  resolveProxyEnvironment,
+  supportsNodeEnvironmentProxy,
+} from "./proxy-config.js";
+
+const paths = prepareRuntime();
+const proxy = await resolveProxyEnvironment(process.env);
+if (proxy.enabled && !supportsNodeEnvironmentProxy())
+  throw new Error(
+    "系统代理转发需要 Node.js 24.5 或更高版本。请升级 Node.js 后重启 LuckyTri。",
+  );
+
+const args = [
+  ...(proxy.enabled ? ["--use-env-proxy"] : []),
+  join(paths.package, "server", "index.js"),
+];
+const env = { ...process.env, ...proxy.env };
+if (proxy.enabled) console.log("已启用系统代理，外部 API 请求将经代理转发。");
+else if (proxy.source === "windows-pac-unsupported")
+  console.log(
+    "检测到 PAC 自动代理；LuckyTri 暂不解析 PAC，请改用本机 HTTP 代理或配置 HTTPS_PROXY。",
+  );
+else console.log("未检测到系统代理，外部 API 请求将直连。");
+
+const child = spawn(process.execPath, args, {
+  cwd: paths.home,
+  env,
+  stdio: "inherit",
+});
+for (const signal of ["SIGINT", "SIGTERM"])
+  process.on(signal, () => child.kill(signal));
+child.once("error", (error) => {
+  console.error(`LuckyTri 启动失败：${error.message}`);
+  process.exitCode = 1;
+});
+child.once("exit", (code, signal) => {
+  process.exitCode = signal ? 1 : (code ?? 1);
+});

package/scripts/stop.js

@@ -1,36 +1,36 @@
-import { prepareRuntime } from "./runtime.js";
-import { running, serviceHeaders, serviceUrl } from "./service.js";
-import { starting } from "../server/startup-lock.js";
-try {
-  prepareRuntime({ initialize: false });
-  const base = serviceUrl();
-  if (!(await running({ base }))) {
-    console.log("LuckyTri 已经停止 / LuckyTri is already stopped");
-  } else {
-    const stopped = await fetch(base + "/api/service/stop", {
-      method: "POST",
-      headers: serviceHeaders(),
-      body: "{}",
-      signal: AbortSignal.timeout(5000),
-    });
-    if (!stopped.ok) throw new Error("服务拒绝停止请求");
-    let stoppedConfirmed = false;
-    for (let attempt = 0; attempt < 40; attempt++) {
-      await new Promise((resolve) => setTimeout(resolve, 150));
-      if (!(await running({ base, lenient: true })) && !starting()) {
-        stoppedConfirmed = true;
-        break;
-      }
-    }
-    if (!stoppedConfirmed)
-      throw Error("服务仍在停止中，请稍后再检查 / Service is still stopping");
-    console.log("LuckyTri 已停止 / LuckyTri stopped");
-  }
-} catch (error) {
-  console.error(
-    error instanceof TypeError
-      ? "未连接到 LuckyTri，可能已经停止"
-      : error.message,
-  );
-  process.exitCode = 1;
-}
+import { prepareRuntime } from "./runtime.js";
+import { running, serviceHeaders, serviceUrl } from "./service.js";
+import { starting } from "../server/startup-lock.js";
+try {
+  prepareRuntime({ initialize: false });
+  const base = serviceUrl();
+  if (!(await running({ base }))) {
+    console.log("LuckyTri 已经停止 / LuckyTri is already stopped");
+  } else {
+    const stopped = await fetch(base + "/api/service/stop", {
+      method: "POST",
+      headers: serviceHeaders(),
+      body: "{}",
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!stopped.ok) throw new Error("服务拒绝停止请求");
+    let stoppedConfirmed = false;
+    for (let attempt = 0; attempt < 40; attempt++) {
+      await new Promise((resolve) => setTimeout(resolve, 150));
+      if (!(await running({ base, lenient: true })) && !starting()) {
+        stoppedConfirmed = true;
+        break;
+      }
+    }
+    if (!stoppedConfirmed)
+      throw Error("服务仍在停止中，请稍后再检查 / Service is still stopping");
+    console.log("LuckyTri 已停止 / LuckyTri stopped");
+  }
+} catch (error) {
+  console.error(
+    error instanceof TypeError
+      ? "未连接到 LuckyTri，可能已经停止"
+      : error.message,
+  );
+  process.exitCode = 1;
+}

package/server/app.js

@@ -1,96 +1,112 @@
-import express from "express";
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import { tokenEqual } from "./http.js";
-import { localizeApi } from "./i18n/index.js";
-import { mountStudio } from "./studio/settings.js";
-import { mountManagement } from "./studio/management.js";
-import { mountCore } from "./core/api.js";
-import { mountKnowledge } from "./knowledge/api.js";
-import { mountEvents } from "./core/events.js";
-import { mountMind } from "./mind/api.js";
-import { mountPlugins } from "./plugins/api.js";
-import { Life } from "./mind/life/index.js";
-import { runtimePaths } from "./paths.js";
-
-export function createApp({ store, chatSystem, runtime, life, plugins }) {
-  const app = express();
-  app.use("/api", localizeApi);
-  app.use("/api", (req, res, next) => {
-    res.setHeader("Cache-Control", "no-store");
-    if (
-      req.headers.origin &&
-      req.headers.origin !== `${req.protocol}://${req.headers.host}`
-    )
-      return res.status(403).json({ error: "不允许跨站访问" });
-    if (
-      process.env.ADMIN_TOKEN &&
-      !tokenEqual(
-        req.headers.authorization,
-        `Bearer ${process.env.ADMIN_TOKEN}`,
-      )
-    )
-      return res.status(401).json({ error: "请输入管理令牌" });
-    next();
-  });
-  if (plugins) {
-    app.post(
-      "/api/plugins/import/upload",
-      express.raw({ type: "*/*", limit: "21mb" }),
-      (req, res) => {
-        try {
-          res.json(plugins.install.stageUpload(req.body));
-        } catch (error) {
-          res.status(400).json({ error: error.message });
-        }
-      },
-    );
-  }
-  app.use(express.json({ limit: "4mb" }));
-  app.use("/api", (req, res, next) => {
-    if (
-      ["POST", "PATCH", "PUT"].includes(req.method) &&
-      (!req.body || typeof req.body !== "object" || Array.isArray(req.body))
-    )
-      return res.status(400).json({ error: "请提交 JSON 对象" });
-    next();
-  });
-  mountStudio(app, store, runtime, chatSystem);
-  mountManagement(app, store, chatSystem);
-  mountCore(app, chatSystem);
-  mountMind(app, chatSystem, life || new Life(chatSystem));
-  mountKnowledge(app, chatSystem);
-  mountEvents(app, chatSystem);
-  mountPlugins(app, plugins);
-  // Built assets carry a content hash; the page that names them must not be
-  // cached, or an upgrade leaves the browser asking for files that are gone.
-  app.use(
-    "/app",
-    express.static(join(runtimePaths().public, "app"), {
-      setHeaders(res, path) {
-        res.setHeader(
-          "Cache-Control",
-          path.endsWith(".html")
-            ? "no-cache"
-            : "public, max-age=31536000, immutable",
-        );
-      },
-    }),
-  );
-  const studioIndex = join(runtimePaths().public, "app", "index.html");
-  app.get(["/", "/index.html", "/app", "/app/"], (req, res, next) => {
-    if (!existsSync(studioIndex)) return next();
-    res.setHeader("Cache-Control", "no-cache");
-    res.sendFile(studioIndex);
-  });
-  app.use(express.static(runtimePaths().public));
-  app.use((err, req, res, next) => {
-    console.error(err.message);
-    if (err.type === "entity.too.large")
-      return res.status(413).json({ error: "请求内容过大" });
-    if (err.type === "entity.parse.failed")
-      return res.status(400).json({ error: "JSON 格式无效" });
-    res.status(500).json({ error: "请求失败，请检查输入或服务日志" });
-  });
-  return app;
-}
+import express from "express";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { createManagementAuth } from "./auth.js";
+import { localizeApi } from "./i18n/index.js";
+import { mountStudio } from "./studio/settings.js";
+import { mountManagement } from "./studio/management.js";
+import { mountCore } from "./core/api.js";
+import { mountKnowledge } from "./knowledge/api.js";
+import { mountEvents } from "./core/events.js";
+import { mountMind } from "./mind/api.js";
+import { mountPlugins } from "./plugins/api.js";
+import { Life } from "./mind/life/index.js";
+import { runtimePaths } from "./paths.js";
+import { mountDataTransfer } from "./storage/data-transfer-api.js";
+
+export function createApp({
+  store,
+  chatSystem,
+  runtime,
+  life,
+  plugins,
+  auth = createManagementAuth(store),
+}) {
+  const app = express();
+  app.use("/api", localizeApi);
+  app.use("/api", (req, res, next) => {
+    res.setHeader("Cache-Control", "no-store");
+    if (
+      req.headers.origin &&
+      req.headers.origin !== `${req.protocol}://${req.headers.host}`
+    )
+      return res.status(403).json({ error: "不允许跨站访问" });
+    if (req.headers["sec-fetch-site"] === "cross-site")
+      return res.status(403).json({ error: "不允许跨站访问" });
+    next();
+  });
+  app.use(express.json({ limit: "4mb" }));
+  const objectBody = (req, res, next) => {
+    if (
+      ["POST", "PATCH", "PUT"].includes(req.method) &&
+      (!req.body || typeof req.body !== "object" || Array.isArray(req.body)) &&
+      !["/plugins/import/upload", "/storage/transfer/upload"].includes(req.path)
+    )
+      return res.status(400).json({ error: "请提交 JSON 对象" });
+    next();
+  };
+  app.use("/api/auth", objectBody);
+  auth.mount(app);
+  app.use("/api", (req, res, next) => {
+    if (
+      auth.authorized(req) ||
+      (["/service/status", "/service/stop"].includes(req.path) &&
+        auth.service(req))
+    )
+      return next();
+    res.status(401).json({ error: "请先登录管理台" });
+  });
+  app.use("/api", objectBody);
+  mountDataTransfer(app, runtime.transfer);
+  if (plugins) {
+    app.post(
+      "/api/plugins/import/upload",
+      express.raw({ type: "*/*", limit: "21mb" }),
+      (req, res) => {
+        try {
+          res.json(plugins.install.stageUpload(req.body));
+        } catch (error) {
+          res.status(400).json({ error: error.message });
+        }
+      },
+    );
+  }
+  mountStudio(app, store, runtime, chatSystem);
+  mountManagement(app, store, chatSystem);
+  mountCore(app, chatSystem);
+  mountMind(app, chatSystem, life || new Life(chatSystem));
+  mountKnowledge(app, chatSystem);
+  mountEvents(app, chatSystem, auth.authorized);
+  mountPlugins(app, plugins);
+  // Built assets carry a content hash; the page that names them must not be
+  // cached, or an upgrade leaves the browser asking for files that are gone.
+  app.use(
+    "/app",
+    express.static(join(runtimePaths().public, "app"), {
+      setHeaders(res, path) {
+        res.setHeader(
+          "Cache-Control",
+          path.endsWith(".html")
+            ? "no-cache"
+            : "public, max-age=31536000, immutable",
+        );
+      },
+    }),
+  );
+  const studioIndex = join(runtimePaths().public, "app", "index.html");
+  app.get(["/", "/index.html", "/app", "/app/"], (req, res, next) => {
+    if (!existsSync(studioIndex)) return next();
+    res.setHeader("Cache-Control", "no-cache");
+    res.sendFile(studioIndex);
+  });
+  app.use(express.static(runtimePaths().public));
+  app.use((err, req, res, next) => {
+    console.error(err.message);
+    if (err.type === "entity.too.large")
+      return res.status(413).json({ error: "请求内容过大" });
+    if (err.type === "entity.parse.failed")
+      return res.status(400).json({ error: "JSON 格式无效" });
+    res.status(500).json({ error: "请求失败，请检查输入或服务日志" });
+  });
+  return app;
+}

package/server/auth.js

@@ -0,0 +1,217 @@
+import { createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+import { isLoopback, localServiceKey } from "./local-access.js";
+import { tokenEqual, wrap } from "./http.js";
+
+const derive = promisify(scrypt);
+const COOKIE = "luckytri_session";
+const MONTH = 30 * 86400000;
+const sessionHash = (value) => createHash("sha256").update(value).digest("hex");
+const digest = async (password, salt) =>
+  (await derive(password, salt, 64)).toString("hex");
+function validate(password) {
+  if (
+    typeof password !== "string" ||
+    password.length < 8 ||
+    password.length > 256
+  )
+    throw Error("密码长度应为 8–256 个字符");
+}
+
+export function createManagementAuth(
+  store,
+  { key = localServiceKey(), now = Date.now } = {},
+) {
+  const db = store.db;
+  db.exec(`CREATE TABLE IF NOT EXISTS management_auth(id INTEGER PRIMARY KEY CHECK(id=1),salt TEXT NOT NULL,hash TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS management_sessions(id TEXT PRIMARY KEY,expires INTEGER NOT NULL);`);
+  const record = () =>
+    db.prepare("SELECT salt,hash FROM management_auth WHERE id=1").get();
+  const failures = new Map();
+  function throttle(req) {
+    const address = req.socket.remoteAddress || "unknown";
+    const entry = failures.get(address);
+    if (entry && now() - entry.at < 300000 && entry.count >= 8) {
+      const error = Error("尝试次数过多，请稍后再试");
+      error.status = 429;
+      throw error;
+    }
+    if (!entry || now() - entry.at >= 300000)
+      failures.set(address, { count: 0, at: now() });
+    if (failures.size > 1000) failures.delete(failures.keys().next().value);
+    return failures.get(address);
+  }
+  async function verifyPassword(password) {
+    const saved = record();
+    if (!saved || typeof password !== "string" || password.length > 256)
+      return false;
+    const result = Buffer.from(await digest(password, saved.salt), "hex");
+    const expected = Buffer.from(saved.hash, "hex");
+    return (
+      result.length === expected.length &&
+      timingSafeEqual(result, expected) &&
+      record()?.hash === saved.hash
+    );
+  }
+  function cookie(req) {
+    return (
+      String(req.headers.cookie || "")
+        .split(";")
+        .map((part) => part.trim())
+        .find((part) => part.startsWith(COOKIE + "="))
+        ?.slice(COOKIE.length + 1) || ""
+    );
+  }
+  function authorized(req) {
+    const id = cookie(req);
+    if (!/^[\w-]{43}$/.test(id)) return false;
+    return !!db
+      .prepare("SELECT 1 FROM management_sessions WHERE id=? AND expires>?")
+      .get(sessionHash(id), now());
+  }
+  function service(req) {
+    return (
+      isLoopback(req.socket.remoteAddress) &&
+      tokenEqual(req.headers.authorization, `Bearer ${key}`)
+    );
+  }
+  function session(req, res) {
+    db.prepare("DELETE FROM management_sessions WHERE expires<=?").run(now());
+    const id = randomBytes(32).toString("base64url");
+    db.prepare("INSERT INTO management_sessions(id,expires) VALUES (?,?)").run(
+      sessionHash(id),
+      now() + MONTH,
+    );
+    db.exec(
+      "DELETE FROM management_sessions WHERE id NOT IN (SELECT id FROM management_sessions ORDER BY expires DESC LIMIT 100)",
+    );
+    res.cookie(COOKIE, id, {
+      httpOnly: true,
+      sameSite: "strict",
+      secure: req.secure,
+      maxAge: MONTH,
+      path: "/",
+    });
+  }
+  function mount(app) {
+    app.post("/api/auth/reset", (req, res) => {
+      if (!service(req))
+        return res.status(401).json({ error: "请使用本机命令重置管理密码" });
+      db.exec(
+        "BEGIN IMMEDIATE; DELETE FROM management_auth; DELETE FROM management_sessions; COMMIT;",
+      );
+      res.clearCookie(COOKIE, {
+        httpOnly: true,
+        sameSite: "strict",
+        secure: req.secure,
+        path: "/",
+      });
+      res.json({ ok: true });
+    });
+    app.get("/api/auth/status", (req, res) =>
+      res.json({ configured: !!record(), authenticated: authorized(req) }),
+    );
+    app.post(
+      "/api/auth/setup",
+      wrap(async (req, res) => {
+        if (
+          !isLoopback(req.socket.remoteAddress) ||
+          !["localhost", "127.0.0.1", "[::1]"].includes(req.hostname)
+        ) {
+          const error = Error("首次设置密码请在本机打开管理台");
+          error.status = 403;
+          throw error;
+        }
+        if (record()) {
+          const error = Error("管理密码已设置，请登录");
+          error.status = 409;
+          throw error;
+        }
+        validate(req.body.password);
+        const salt = randomBytes(16).toString("hex");
+        const hash = await digest(req.body.password, salt);
+        const inserted = db
+          .prepare(
+            "INSERT OR IGNORE INTO management_auth(id,salt,hash) VALUES (1,?,?)",
+          )
+          .run(salt, hash);
+        if (!inserted.changes) {
+          const error = Error("管理密码已设置，请登录");
+          error.status = 409;
+          throw error;
+        }
+        session(req, res);
+        res.json({ ok: true });
+      }),
+    );
+    app.post(
+      "/api/auth/login",
+      wrap(async (req, res) => {
+        const entry = throttle(req);
+        entry.count++;
+        if (!(await verifyPassword(req.body.password))) {
+          const error = Error("密码不正确");
+          error.status = 401;
+          throw error;
+        }
+        entry.count = 0;
+        session(req, res);
+        res.json({ ok: true });
+      }),
+    );
+    app.post("/api/auth/logout", (req, res) => {
+      db.prepare("DELETE FROM management_sessions WHERE id=?").run(
+        sessionHash(cookie(req)),
+      );
+      res.clearCookie(COOKIE, {
+        httpOnly: true,
+        sameSite: "strict",
+        secure: req.secure,
+        path: "/",
+      });
+      res.json({ ok: true });
+    });
+    app.post(
+      "/api/auth/password",
+      wrap(async (req, res) => {
+        if (!authorized(req)) {
+          const error = Error("请先登录管理台");
+          error.status = 401;
+          throw error;
+        }
+        const entry = throttle(req);
+        entry.count++;
+        const previous = record();
+        if (!(await verifyPassword(req.body.currentPassword)))
+          throw Error("当前密码不正确");
+        validate(req.body.password);
+        const salt = randomBytes(16).toString("hex"),
+          hash = await digest(req.body.password, salt);
+        const changed = db
+          .prepare(
+            "UPDATE management_auth SET salt=?,hash=? WHERE id=1 AND hash=?",
+          )
+          .run(salt, hash, previous.hash);
+        if (!changed.changes) throw Error("密码已变化，请重新登录");
+        db.exec("DELETE FROM management_sessions");
+        entry.count = 0;
+        session(req, res);
+        res.json({ ok: true });
+      }),
+    );
+  }
+  return {
+    mount,
+    authorized,
+    service,
+    configured: () => !!record(),
+    verifyPassword,
+    async verifyConnectionPassword(password, address) {
+      const entry = throttle({ socket: { remoteAddress: address } });
+      entry.count++;
+      const valid = await verifyPassword(password);
+      if (valid) entry.count = 0;
+      return valid;
+    },
+  };
+}