nolo-cli 0.1.23 → 0.1.29

package/auth/server/tokenUsageBilling.ts

@@ -0,0 +1,312 @@
+import { DB_PREFIX, createTransactionKey } from "../../database/keys";
+import serverDb from "../../database/server/db";
+
+import { balanceLockManager } from "./locks";
+import {
+  getBillingLedgerRuntime,
+  prepareLedgerTransactionAppend,
+  userAvailableCreditsAccountId,
+  type BillingLedgerRuntime,
+} from "./ledger";
+import {
+  buildTokenRevenueShareProjectionOps,
+  type TokenRevenueShareRecord,
+} from "./revenueShareLedger";
+import { withRetry } from "./utils";
+
+export type TokenUsageBillingStore = {
+  get: (key: string) => Promise<unknown>;
+  batch: (
+    ops: Array<{ type: "put"; key: string; value: unknown }>
+  ) => Promise<void>;
+};
+
+export type TokenUsageChargeResult =
+  | {
+      success: true;
+      status: "charged" | "duplicate";
+      userId: string;
+      tokenKey: string;
+      txId: string;
+      balance?: number;
+      amountCredits: number;
+    }
+  | {
+      success: false;
+      status:
+        | "invalid_amount"
+        | "user_mismatch"
+        | "user_not_found"
+        | "invalid_user_balance"
+        | "invalid_split_projection"
+        | "insufficient_funds"
+        | "ledger_rejected"
+        | "failed";
+      userId: string;
+      tokenKey: string;
+      txId: string;
+      error: string;
+      balance?: number;
+    };
+
+const getMaybe = async <T>(
+  store: TokenUsageBillingStore,
+  key: string
+): Promise<T | null> => {
+  try {
+    return ((await store.get(key)) ?? null) as T | null;
+  } catch {
+    return null;
+  }
+};
+
+const isPositiveFinite = (value: unknown): value is number =>
+  typeof value === "number" && Number.isFinite(value) && value > 0;
+
+export async function chargeTokenUsageWithLedger({
+  store = serverDb,
+  runtime = getBillingLedgerRuntime(),
+  userId,
+  tokenKey,
+  tokenRecord,
+  reason = "token_usage",
+  txId = `token-${tokenKey}`,
+  nowMs = Date.now(),
+}: {
+  store?: TokenUsageBillingStore;
+  runtime?: BillingLedgerRuntime;
+  userId: string;
+  tokenKey: string;
+  tokenRecord: TokenRevenueShareRecord;
+  reason?: string;
+  txId?: string;
+  nowMs?: number;
+}): Promise<TokenUsageChargeResult> {
+  const lock = balanceLockManager.getLock(`token-usage:${userId}:${tokenKey}`);
+
+  return lock.runExclusive(async () => {
+    try {
+      if (!isPositiveFinite(tokenRecord.cost)) {
+        return {
+          success: false,
+          status: "invalid_amount",
+          userId,
+          tokenKey,
+          txId,
+          error: "Invalid token usage amount",
+        };
+      }
+
+      if (tokenRecord.userId && tokenRecord.userId !== userId) {
+        return {
+          success: false,
+          status: "user_mismatch",
+          userId,
+          tokenKey,
+          txId,
+          error: "Token usage user does not match billed user",
+        };
+      }
+
+      const userKey = `${DB_PREFIX.USER}${userId}`;
+      const userData = await getMaybe<any>(store, userKey);
+      if (!userData) {
+        return {
+          success: false,
+          status: "user_not_found",
+          userId,
+          tokenKey,
+          txId,
+          error: "User not found",
+        };
+      }
+      if (typeof userData.balance !== "number") {
+        return {
+          success: false,
+          status: "invalid_user_balance",
+          userId,
+          tokenKey,
+          txId,
+          error: "User balance invalid",
+        };
+      }
+
+      const projection = buildTokenRevenueShareProjectionOps({
+        runtime,
+        tokenKey,
+        tokenRecord: {
+          ...tokenRecord,
+          userId,
+        },
+        billingTxId: txId,
+        nowMs,
+      });
+      if (projection.status !== "projected") {
+        return {
+          success: false,
+          status: "invalid_split_projection",
+          userId,
+          tokenKey,
+          txId,
+          error: projection.reason,
+          balance: userData.balance,
+        };
+      }
+
+      const event = projection.event;
+      const ledgerAppend = await prepareLedgerTransactionAppend({
+        store,
+        runtime,
+        type: "usage_charge",
+        reason,
+        idempotencyKey: `token:${tokenKey}`,
+        txId,
+        entries: [
+          {
+            accountId: userAvailableCreditsAccountId(userId),
+            ownerUserId: userId,
+            delta: -event.grossCredits,
+            startingBalance: userData.balance,
+            metadata: {
+              role: "buyer_debit",
+              tokenKey,
+              productKind: event.product.kind,
+              productId: event.product.id,
+            },
+          },
+          ...event.shares.map((share) => ({
+            accountId: share.accountId,
+            ...(share.userId ? { ownerUserId: share.userId } : {}),
+            delta: share.amountCredits,
+            metadata: {
+              role: share.role,
+              tokenKey,
+              productKind: event.product.kind,
+              productId: event.product.id,
+            },
+          })),
+        ],
+        metadata: {
+          tokenKey,
+          buyerId: userId,
+          productKind: event.product.kind,
+          productId: event.product.id,
+          ...(event.product.model ? { model: event.product.model } : {}),
+          ...(event.product.provider ? { provider: event.product.provider } : {}),
+          grossCredits: event.grossCredits,
+          platformCostCredits: event.platformCostCredits,
+          creatorShareCredits: event.creatorShareCredits,
+          platformNetCredits: event.platformNetCredits,
+          ...(event.splitPolicy ? { splitPolicy: event.splitPolicy } : {}),
+        },
+        now: nowMs,
+      });
+
+      const buyerAccountId = userAvailableCreditsAccountId(userId);
+      if (ledgerAppend.status === "duplicate") {
+        const balance = ledgerAppend.transaction.entries.find(
+          (entry) => entry.accountId === buyerAccountId
+        )?.balanceAfter;
+        return {
+          success: true,
+          status: "duplicate",
+          userId,
+          tokenKey,
+          txId,
+          balance,
+          amountCredits: event.grossCredits,
+        };
+      }
+      if (
+        ledgerAppend.status === "insufficient_funds" ||
+        userData.balance < event.grossCredits
+      ) {
+        return {
+          success: false,
+          status: "insufficient_funds",
+          userId,
+          tokenKey,
+          txId,
+          error: "Insufficient balance",
+          balance: userData.balance,
+        };
+      }
+      if (ledgerAppend.status !== "prepared") {
+        return {
+          success: false,
+          status: "ledger_rejected",
+          userId,
+          tokenKey,
+          txId,
+          error: `Ledger append rejected: ${ledgerAppend.status}`,
+          balance: userData.balance,
+        };
+      }
+
+      const balanceAfter =
+        ledgerAppend.transaction.entries.find(
+          (entry) => entry.accountId === buyerAccountId
+        )?.balanceAfter ?? userData.balance - event.grossCredits;
+
+      const txIndexKey = createTransactionKey.index(txId);
+      await withRetry(
+        async () => {
+          await store.batch([
+            ...ledgerAppend.operations,
+            ...projection.operations,
+            {
+              type: "put",
+              key: createTransactionKey.record(userId, txId),
+              value: {
+                txId,
+                userId,
+                type: "deduct",
+                amount: event.grossCredits,
+                reason,
+                timestamp: nowMs,
+                status: "completed",
+              },
+            },
+            {
+              type: "put",
+              key: txIndexKey,
+              value: {
+                userId,
+                timestamp: nowMs,
+              },
+            },
+            {
+              type: "put",
+              key: userKey,
+              value: {
+                ...userData,
+                balance: balanceAfter,
+                lastDeductAt: nowMs,
+              },
+            },
+          ]);
+        },
+        { maxAttempts: 3, delayMs: 1000, backoff: true }
+      );
+
+      return {
+        success: true,
+        status: "charged",
+        userId,
+        tokenKey,
+        txId,
+        balance: balanceAfter,
+        amountCredits: event.grossCredits,
+      };
+    } catch (error) {
+      return {
+        success: false,
+        status: "failed",
+        userId,
+        tokenKey,
+        txId,
+        error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  });
+}

package/auth/server/transfer.ts

@@ -0,0 +1,40 @@
+import {
+  logger,
+  createErrorResponse,
+  createSuccessResponse,
+  checkAdminPermission,
+  handleOptionsRequest,
+} from "./shared";
+import { rechargeUserBalance } from "./recharge";
+// HTTP 处理层
+export async function handleTransferUser(req: Request, userId: string) {
+  if (req.method === "OPTIONS") {
+    return handleOptionsRequest();
+  }
+  const { userId: actionUserId } = req.user;
+
+  const permissionError = checkAdminPermission(actionUserId);
+  if (permissionError) return permissionError;
+
+  try {
+    const { amount, reason } = req.body;
+    const result = await rechargeUserBalance(userId, amount, reason);
+
+    if (!result.success) {
+      return createErrorResponse(result.error || "Recharge failed", 400);
+    }
+
+    return createSuccessResponse({
+      success: true,
+      balance: result.balance,
+      txId: result.txId,
+    });
+  } catch (error) {
+    logger.error({
+      event: "http_recharge_failed",
+      userId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return createErrorResponse("Internal server error");
+  }
+}

package/auth/server/utils.ts

@@ -0,0 +1,200 @@
+// auth/server/utils.ts
+import { logger } from "./shared";
+
+interface RetryOptions {
+  maxAttempts: number;
+  delayMs: number;
+  backoff?: boolean;
+  onRetry?: (attempt: number, error: Error) => void;
+}
+
+interface RetryError extends Error {
+  attempts?: number;
+  lastError?: Error;
+}
+
+const DEFAULT_RETRY_OPTIONS: RetryOptions = {
+  maxAttempts: 3,
+  delayMs: 1000,
+  backoff: true,
+  onRetry: (attempt, error) => {
+    logger.warn({
+      event: "operation_retry",
+      attempt,
+      error: error.message,
+    });
+  },
+};
+
+/**
+ * 通用重试函数
+ * @param operation 需要重试的异步操作
+ * @param options 重试配置选项
+ * @returns 操作结果
+ */
+export async function withRetry<T>(
+  operation: () => Promise<T>,
+  options: Partial<RetryOptions> = {}
+): Promise<T> {
+  const finalOptions = { ...DEFAULT_RETRY_OPTIONS, ...options };
+  let lastError: Error | null = null;
+
+  for (let attempt = 1; attempt <= finalOptions.maxAttempts; attempt++) {
+    try {
+      return await operation();
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+
+      if (attempt === finalOptions.maxAttempts) {
+        break;
+      }
+
+      const delay = finalOptions.backoff
+        ? finalOptions.delayMs * Math.pow(2, attempt - 1)
+        : finalOptions.delayMs;
+
+      if (finalOptions.onRetry) {
+        finalOptions.onRetry(attempt, lastError);
+      }
+
+      await sleep(delay);
+    }
+  }
+
+  const error: RetryError = new Error(
+    `Operation failed after ${finalOptions.maxAttempts} attempts`
+  );
+  error.attempts = finalOptions.maxAttempts;
+  error.lastError = lastError || undefined;
+  throw error;
+}
+
+/**
+ * 带超时的重试函数
+ */
+export async function withRetryAndTimeout<T>(
+  operation: () => Promise<T>,
+  timeoutMs: number,
+  options?: Partial<RetryOptions>
+): Promise<T> {
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    setTimeout(() => {
+      reject(new Error(`Operation timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+
+  return Promise.race([withRetry(operation, options), timeoutPromise]);
+}
+
+/**
+ * 休眠函数
+ */
+export function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * 带重试的批量操作
+ */
+export async function withBatchRetry<T>(
+  operations: (() => Promise<T>)[],
+  options?: Partial<RetryOptions>
+): Promise<T[]> {
+  return Promise.all(
+    operations.map((operation) => withRetry(operation, options))
+  );
+}
+
+/**
+ * 用法示例:
+ */
+/* 
+// 基本用法
+try {
+  const result = await withRetry(
+    async () => {
+      // 异步操作
+      return await someAsyncOperation();
+    },
+    {
+      maxAttempts: 3,
+      delayMs: 1000,
+      backoff: true,
+    }
+  );
+} catch (error) {
+  // 处理最终失败
+}
+
+// 带超时的用法
+try {
+  const result = await withRetryAndTimeout(
+    async () => {
+      return await someAsyncOperation();
+    },
+    5000, // 5秒超时
+    {
+      maxAttempts: 3,
+      delayMs: 1000,
+    }
+  );
+} catch (error) {
+  // 处理超时或重试失败
+}
+
+// 自定义重试回调
+const result = await withRetry(
+  async () => {
+    return await someAsyncOperation();
+  },
+  {
+    onRetry: (attempt, error) => {
+      logger.warn({
+        event: "custom_retry",
+        attempt,
+        error: error.message,
+        customData: "some context",
+      });
+    },
+  }
+);
+*/
+
+/**
+ * 测试用例
+ */
+/* 
+describe("withRetry", () => {
+  it("should retry failed operations", async () => {
+    let attempts = 0;
+    const operation = async () => {
+      attempts++;
+      if (attempts < 3) {
+        throw new Error("Temporary failure");
+      }
+      return "success";
+    };
+
+    const result = await withRetry(operation, {
+      maxAttempts: 3,
+      delayMs: 100,
+    });
+
+    expect(result).toBe("success");
+    expect(attempts).toBe(3);
+  });
+
+  it("should fail after max attempts", async () => {
+    const operation = async () => {
+      throw new Error("Persistent failure");
+    };
+
+    await expect(
+      withRetry(operation, {
+        maxAttempts: 3,
+        delayMs: 100,
+      })
+    ).rejects.toThrow("Operation failed after 3 attempts");
+  });
+});
+*/

package/auth/sessionTokenVersion.ts

@@ -0,0 +1,38 @@
+type SessionVersionCarrier = {
+  tokenVersion?: unknown;
+} | null | undefined;
+
+export const SESSION_REVOKED_ERROR = "Token has been revoked";
+
+export function normalizeSessionTokenVersion(value: unknown): number {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    return 0;
+  }
+  if (value <= 0) {
+    return 0;
+  }
+  return Math.floor(value);
+}
+
+export function getSessionTokenVersion(payload: SessionVersionCarrier): number {
+  return normalizeSessionTokenVersion(payload?.tokenVersion);
+}
+
+export function getUserSessionVersion(user: SessionVersionCarrier): number {
+  return normalizeSessionTokenVersion(user?.tokenVersion);
+}
+
+export function assertSessionTokenVersion(
+  payload: SessionVersionCarrier,
+  user: SessionVersionCarrier
+) {
+  const tokenVersion = getSessionTokenVersion(payload);
+  const currentVersion = getUserSessionVersion(user);
+  if (tokenVersion !== currentVersion) {
+    throw new Error(SESSION_REVOKED_ERROR);
+  }
+}
+
+export function getNextSessionTokenVersion(user: SessionVersionCarrier): number {
+  return getUserSessionVersion(user) + 1;
+}

package/auth/token.ts

@@ -0,0 +1,63 @@
+import { detachedSign, verifyDetachedSignature } from "../core/crypto";
+import { Base64 } from "js-base64";
+
+/**
+ * Token 格式：`base64(JSON(payload)).ed25519签名`
+ *
+ * 设计说明：
+ * - 密钥派生是确定性的：用户名 + 哈希(密码) + locale → secretKey/publicKey
+ * - token 由客户端本地签发，服务端用存储的 publicKey 验签，没有中心化密钥
+ * - 忘记密码 = 无法恢复（类似助记词钱包），注册时应明确告知用户
+ *
+ * payload 约定：
+ * - userId, username 必填
+ * - exp: Unix 秒（number），仅旧 token 使用；新的登录 token 默认不设置过期时间
+ */
+
+export const buildPersistentAuthTokenPayload = <T extends Record<string, unknown>>(
+  payload: T,
+  nowSec = Math.floor(Date.now() / 1000)
+) => ({
+  ...payload,
+  iat: nowSec,
+  nbf: nowSec,
+});
+
+export const signToken = (payload: any, secretKey: string) => {
+  const encodedPayload = Base64.encode(JSON.stringify(payload));
+  const signature = detachedSign(encodedPayload, secretKey);
+  return `${encodedPayload}.${signature}`;
+};
+
+export const verifyToken = (token: string, publicKey: string) => {
+  const [encodedPayload, signature] = token.split(".");
+
+  if (!verifyDetachedSignature(encodedPayload, signature, publicKey)) {
+    throw new Error("Invalid signature");
+  }
+
+  const payload = JSON.parse(Base64.decode(encodedPayload));
+
+  // exp 统一为 Unix 秒（number），直接与当前时间比较
+  if (payload.exp && typeof payload.exp === "number") {
+    if (Math.floor(Date.now() / 1000) > payload.exp) {
+      throw new Error("Token has expired");
+    }
+  }
+
+  return payload;
+};
+
+/**
+ * 不验证签名，只解析 payload。
+ * 用于从 token 中快速读取 userId 等字段（如初始化 auth 状态）。
+ * 注意：结果未经验签，不可用于权限判断。
+ */
+export const parseToken = (token: string) => {
+  try {
+    const [payloadBase64] = token.split(".");
+    return JSON.parse(Base64.decode(payloadBase64));
+  } catch {
+    return null;
+  }
+};

package/auth/tokenCookie.ts

@@ -0,0 +1 @@
+export const WEB_AUTH_TOKEN_COOKIE = "nolo_auth_token";

package/auth/types.ts

@@ -0,0 +1,28 @@
+// auth/types.ts
+
+export interface User {
+  userId: string;
+  username?: string;
+  name?: string;
+  nickname?: string;
+  avatar?: string;
+  email?: string;
+  locale?: string;
+  publicKey?: string;
+  tokenVersion?: number;
+}
+export interface TokenManager {
+  getTokens(): Promise<string[]>;
+  storeToken(token: string): Promise<void>;
+  removeToken(token: string): Promise<void>;
+  initTokens(): Promise<string[]>;
+}
+
+export const safelyParseJSON = (jsonString: string) => {
+  try {
+    const parsed = JSON.parse(jsonString);
+    return typeof parsed === "string" ? [parsed] : parsed;
+  } catch {
+    return [jsonString];
+  }
+};