nolo-cli 0.1.26 → 0.1.29

package/server/handleRPCRequest.ts

@@ -0,0 +1,117 @@
+// server/handleRPCRequest.ts
+
+import { pino } from "pino";
+import { createResponse } from "./createResponse";
+import { apiMethods } from "./api/methods";
+import type { MethodName } from "./api/methods";
+import type { ApiError } from "./api/types";
+import { authenticateToken } from "./authenticateToken";
+import { userActor } from "../auth/actor";
+
+const logger = pino({ name: "server:rpc" });
+const res = createResponse();
+
+async function invoke<T = unknown>(
+  method: MethodName,
+  params?: unknown,
+  token?: string
+): Promise<T> {
+  const apiMethod = apiMethods[method];
+  if (!apiMethod) {
+    throw {
+      code: "not_found",
+      message: `Method "${method}" not found`,
+    } as ApiError;
+  }
+
+  if (apiMethod.auth && !token) {
+    throw {
+      code: "unauthorized",
+      message: "Authentication required",
+    } as ApiError;
+  }
+
+  try {
+    const auth = apiMethod.auth ? await authenticateToken(token) : null;
+    const result = await apiMethod.handler(params, {
+      token,
+      userId: auth?.userId,
+      actor: userActor(auth?.userId),
+      authPayload: auth?.payload,
+    });
+    return result as T;
+  } catch (err: any) {
+    if (!err.code) {
+      err = {
+        code: "internal",
+        message: err.message || "Internal server error",
+      } as ApiError;
+    }
+    throw err as ApiError;
+  }
+}
+
+export async function handleRPCRequest(request: Request) {
+  const url = new URL(request.url);
+
+  try {
+    const methodName = url.pathname.split("/")[2] as MethodName;
+    if (!methodName) {
+      return res.status(400).json({
+        code: "invalid_input",
+        message: "Missing method name",
+      });
+    }
+
+    const params = await parseRequestBody(request);
+
+    // 统一处理 Authorization 头，去掉 Bearer 前缀
+    const authHeader = request.headers.get("authorization") || undefined;
+    let token: string | undefined;
+    if (authHeader) {
+      token = authHeader.startsWith("Bearer ")
+        ? authHeader.slice("Bearer ".length)
+        : authHeader;
+    }
+
+    const result = await invoke(methodName, params, token);
+    return res.status(200).json(result);
+  } catch (error: any) {
+    logger.error({ error, path: url.pathname }, "RPC call failed");
+    const status =
+      error.code === "unauthorized"
+        ? 401
+        : error.code === "forbidden"
+          ? 403
+          : error.code === "not_found"
+            ? 404
+            : error.code === "invalid_input"
+              ? 400
+              : 500;
+    return res.status(status).json(error);
+  }
+}
+
+async function parseRequestBody(request: Request) {
+  const contentType = request.headers.get("content-type") || "";
+
+  if (contentType.includes("multipart/form-data")) {
+    try {
+      return await request.formData();
+    } catch (error) {
+      logger.warn({ error }, "Failed to parse form data");
+      return {};
+    }
+  }
+
+  if (contentType.includes("application/json") && request.body) {
+    try {
+      return (await request.json()) || {};
+    } catch (error) {
+      logger.warn({ error }, "Failed to parse JSON body");
+      return {};
+    }
+  }
+
+  return Object.fromEntries(new URL(request.url).searchParams);
+}

package/server/handlers/activityStatsHandler.ts

@@ -0,0 +1,74 @@
+// packages/server/handlers/activityStatsHandler.ts
+// 全局用户活跃时段分析：扫描 token 记录，输出 UTC 小时维度分布
+// 用途：找到全球用户最低活跃时段，作为最佳发布窗口参考
+//
+// GET /api/admin/activity-stats?days=30
+
+import serverDb from "../../database/server/db";
+
+const CORS = {
+    "Access-Control-Allow-Origin": "*",
+    "Content-Type": "application/json",
+};
+
+export async function handleActivityStats(req: Request): Promise<Response> {
+    if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: CORS });
+
+    const url = new URL(req.url);
+    const days = Math.min(Number(url.searchParams.get("days") ?? 30), 365);
+    const cutoff = Date.now() - days * 86_400_000;
+
+    // UTC 小时分布（0-23）
+    const hourCounts = new Array(24).fill(0);
+    // 星期 × 小时分布（0=周日，1=周一...6=周六）
+    const weekdayCounts: number[][] = Array.from({ length: 7 }, () => new Array(24).fill(0));
+
+    let totalRecords = 0;
+    let skipped = 0;
+
+    try {
+        // 扫描所有以 "token-" 开头但不是 "token-stats-" 的记录
+        const iter = serverDb.iterator({
+            gte: "token-",
+            lte: "token-\uffff",
+        });
+
+        for await (const [key, value] of iter) {
+            // 跳过统计汇总记录（token-stats-...）
+            if (key.startsWith("token-stats-")) { skipped++; continue; }
+
+            const ts: number | undefined = value?.timestamp ?? value?.createdAt;
+            if (!ts || typeof ts !== "number" || ts < cutoff) continue;
+
+            const date = new Date(ts);
+            const hour = date.getUTCHours();
+            const weekday = date.getUTCDay();
+
+            hourCounts[hour]++;
+            weekdayCounts[weekday][hour]++;
+            totalRecords++;
+        }
+    } catch (err: any) {
+        return new Response(
+            JSON.stringify({ error: "DB scan failed", detail: err?.message }),
+            { status: 500, headers: CORS }
+        );
+    }
+
+    // 找最低活跃的 3 个小时（推荐发布窗口）
+    const sorted = hourCounts
+        .map((count, hour) => ({ hour, count }))
+        .sort((a, b) => a.count - b.count);
+    const recommendedHours = sorted.slice(0, 3).map(x => x.hour);
+
+    return new Response(
+        JSON.stringify({
+            days,
+            totalRecords,
+            hourCounts,        // 长度 24，hourCounts[h] = UTC 第 h 小时的请求数
+            weekdayCounts,     // 7×24，weekdayCounts[weekday][hour]
+            recommendedHours,  // 推荐发布窗口（UTC 小时）
+        }),
+        { status: 200, headers: CORS }
+    );
+}

package/server/handlers/agentEmailRegistrationE2EHandler.ts

@@ -0,0 +1,406 @@
+import { randomInt, randomUUID } from "node:crypto";
+import { authenticateRequest } from "../../auth/utils";
+import serverDb from "../../database/server/db";
+import { getEmailProvider } from "../email/providerRegistry";
+import { mirrorEmailToControlledInboxes } from "../../database/server/emailRepository";
+import {
+  AGENT_EMAIL_REGISTRATION_E2E_PAGE_PATH,
+  AGENT_EMAIL_REGISTRATION_E2E_START_PATH,
+  AGENT_EMAIL_REGISTRATION_E2E_VERIFY_PATH,
+} from "./agentEmailRegistrationE2ERoutes";
+
+export {
+  AGENT_EMAIL_REGISTRATION_E2E_PAGE_PATH,
+  AGENT_EMAIL_REGISTRATION_E2E_START_PATH,
+  AGENT_EMAIL_REGISTRATION_E2E_VERIFY_PATH,
+};
+
+const JSON_HEADERS = {
+  "Content-Type": "application/json",
+};
+
+const HTML_HEADERS = {
+  "Content-Type": "text/html; charset=utf-8",
+};
+
+const REGISTRATION_TTL_MS = 15 * 60 * 1000;
+const KEY_PREFIX = "agent-email-registration-e2e-";
+
+type RegistrationRecord = {
+  dbKey: string;
+  registrationId: string;
+  email: string;
+  username: string;
+  code: string;
+  status: "pending" | "verified";
+  createdAt: string;
+  updatedAt: string;
+  expiresAt: string;
+  verifiedAt?: string;
+};
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), {
+    status,
+    headers: JSON_HEADERS,
+  });
+
+const stripCorsHeaders = (response: Response): Response => {
+  const headers = new Headers(response.headers);
+  headers.delete("Access-Control-Allow-Origin");
+  headers.delete("Access-Control-Allow-Methods");
+  headers.delete("Access-Control-Allow-Headers");
+  headers.delete("Access-Control-Max-Age");
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+};
+
+const requireAuthenticatedOperator = async (req: Request) => {
+  const auth = await authenticateRequest(req);
+  return auth instanceof Response ? stripCorsHeaders(auth) : auth;
+};
+
+const normalizeEmail = (value: unknown): string =>
+  typeof value === "string" ? value.trim().toLowerCase() : "";
+
+const normalizeText = (value: unknown): string =>
+  typeof value === "string" ? value.trim() : "";
+
+const assertEmail = (email: string) => {
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    throw new Error("email must be a valid address");
+  }
+};
+
+const assertUsername = (username: string) => {
+  if (!/^[a-zA-Z0-9._-]{2,64}$/.test(username)) {
+    throw new Error("username must be 2-64 chars and contain only letters, numbers, dot, underscore, or hyphen");
+  }
+};
+
+const assertPassword = (password: string) => {
+  if (password.length < 8 || password.length > 256) {
+    throw new Error("password must be 8-256 chars");
+  }
+};
+
+const parseJsonBody = async (req: Request): Promise<Record<string, unknown>> => {
+  try {
+    const payload = await req.json();
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      throw new Error("JSON body must be an object");
+    }
+    return payload as Record<string, unknown>;
+  } catch (error: any) {
+    throw new Error(error?.message || "Invalid JSON body");
+  }
+};
+
+const isInvalidStartInputError = (message: string) =>
+  message === "Invalid JSON body" ||
+  message === "JSON body must be an object" ||
+  message === "email must be a valid address" ||
+  message ===
+    "username must be 2-64 chars and contain only letters, numbers, dot, underscore, or hyphen" ||
+  message === "password must be 8-256 chars" ||
+  /Unexpected (?:end|token)/i.test(message) ||
+  message.includes("JSON");
+
+const buildDbKey = (registrationId: string) => `${KEY_PREFIX}${registrationId}`;
+
+const isNotFoundError = (error: any): boolean => {
+  const code = error?.code;
+  return (
+    error?.notFound === true ||
+    error?.name === "NotFoundError" ||
+    error?.message === "NotFound" ||
+    code === "LEVEL_NOT_FOUND" ||
+    code === "LEVEL_NOT_FOUND_ERROR"
+  );
+};
+
+const createCode = () => String(randomInt(0, 1_000_000)).padStart(6, "0");
+
+const getSender = () => {
+  const email = normalizeEmail(
+    process.env.AGENT_EMAIL_E2E_FROM ||
+      process.env.CLOUDFLARE_EMAIL_FROM ||
+      process.env.EMAIL_FROM ||
+      process.env.RESEND_FROM_EMAIL
+  );
+  if (!email) {
+    throw new Error("AGENT_EMAIL_E2E_FROM, CLOUDFLARE_EMAIL_FROM, EMAIL_FROM, or RESEND_FROM_EMAIL is required");
+  }
+  return { email, name: "Nolo E2E" };
+};
+
+const getAppOrigin = (req: Request) =>
+  process.env.AGENT_EMAIL_E2E_APP_URL?.replace(/\/+$/, "") ||
+  process.env.EMAIL_APP_URL?.replace(/\/+$/, "") ||
+  new URL(req.url).origin;
+
+const loadRegistration = async (registrationId: string): Promise<RegistrationRecord> => {
+  const id = normalizeText(registrationId);
+  if (!id) throw new Error("registrationId is required");
+  try {
+    const record = await serverDb.get(buildDbKey(id));
+    if (!record) throw new Error("registration not found");
+    return record as RegistrationRecord;
+  } catch (error: any) {
+    if (isNotFoundError(error)) {
+      throw new Error("registration not found");
+    }
+    throw error;
+  }
+};
+
+const isExpired = (record: RegistrationRecord) =>
+  Date.now() > new Date(record.expiresAt).getTime();
+
+const pageHtml = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Agent Email Registration E2E</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 720px; margin: 40px auto; padding: 0 16px; }
+    label { display: grid; gap: 4px; margin: 12px 0; }
+    input, button { font: inherit; padding: 8px 10px; }
+    pre { background: #111827; color: #e5e7eb; padding: 12px; overflow: auto; }
+  </style>
+</head>
+<body>
+  <h1>Agent Email Registration E2E</h1>
+  <form id="start-form">
+    <label>Email <input name="email" type="email" autocomplete="email" required /></label>
+    <label>Username <input name="username" autocomplete="username" required /></label>
+    <label>Password <input name="password" type="password" autocomplete="new-password" required /></label>
+    <button type="submit">Create test account</button>
+  </form>
+  <form id="verify-form" hidden>
+    <input name="registrationId" type="hidden" />
+    <label>Verification code <input name="code" inputmode="numeric" autocomplete="one-time-code" required /></label>
+    <button type="submit">Verify test account</button>
+  </form>
+  <pre id="result">Ready</pre>
+  <script>
+    const result = document.querySelector("#result");
+    const startForm = document.querySelector("#start-form");
+    const verifyForm = document.querySelector("#verify-form");
+    const initialRegistrationId = new URLSearchParams(window.location.search).get("registrationId");
+    if (initialRegistrationId) {
+      verifyForm.hidden = false;
+      verifyForm.registrationId.value = initialRegistrationId;
+      result.textContent = JSON.stringify({ registrationId: initialRegistrationId, readyToVerify: true }, null, 2);
+    }
+    startForm.addEventListener("submit", async (event) => {
+      event.preventDefault();
+      const body = Object.fromEntries(new FormData(startForm).entries());
+      const response = await fetch("${AGENT_EMAIL_REGISTRATION_E2E_START_PATH}", {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+      const payload = await response.json();
+      result.textContent = JSON.stringify(payload, null, 2);
+      if (payload.registrationId) {
+        verifyForm.hidden = false;
+        verifyForm.registrationId.value = payload.registrationId;
+      }
+    });
+    verifyForm.addEventListener("submit", async (event) => {
+      event.preventDefault();
+      const body = Object.fromEntries(new FormData(verifyForm).entries());
+      const response = await fetch("${AGENT_EMAIL_REGISTRATION_E2E_VERIFY_PATH}", {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+      const payload = await response.json();
+      result.textContent = JSON.stringify(payload, null, 2);
+      if (payload.success) document.body.dataset.registrationStatus = "verified";
+    });
+  </script>
+</body>
+</html>`;
+
+export const handleAgentEmailRegistrationE2EPage = async (req: Request) => {
+  const auth = await requireAuthenticatedOperator(req);
+  if (auth instanceof Response) return auth;
+
+  return new Response(pageHtml, { headers: HTML_HEADERS });
+};
+
+export const handleAgentEmailRegistrationE2EStart = async (req: Request) => {
+  try {
+    const auth = await requireAuthenticatedOperator(req);
+    if (auth instanceof Response) return auth;
+
+    const body = await parseJsonBody(req);
+    const email = normalizeEmail(body.email);
+    const username = normalizeText(body.username);
+    const password = normalizeText(body.password);
+    assertEmail(email);
+    assertUsername(username);
+    assertPassword(password);
+
+    const registrationId = randomUUID();
+    const code = createCode();
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + REGISTRATION_TTL_MS);
+    const dbKey = buildDbKey(registrationId);
+    const record: RegistrationRecord = {
+      dbKey,
+      registrationId,
+      email,
+      username,
+      code,
+      status: "pending",
+      createdAt: now.toISOString(),
+      updatedAt: now.toISOString(),
+      expiresAt: expiresAt.toISOString(),
+    };
+    await serverDb.put(dbKey, record);
+
+    const origin = getAppOrigin(req);
+    const verifyUrl = `${origin}${AGENT_EMAIL_REGISTRATION_E2E_PAGE_PATH}?registrationId=${encodeURIComponent(registrationId)}`;
+    const provider = getEmailProvider();
+    const result = await provider.sendEmail({
+      from: getSender(),
+      to: [{ email }],
+      subject: "Nolo Agent Email Registration E2E Code",
+      text: [
+        `Your Nolo Agent Email Registration E2E verification code is ${code}.`,
+        `Registration ID: ${registrationId}`,
+        `Verification page: ${verifyUrl}`,
+        "This message was sent for an explicitly requested self-hosted registration test.",
+      ].join("\n"),
+    });
+
+    if (result.status === "failed") {
+      return json(
+        {
+          success: false,
+          code: "email_send_failed",
+          message: result.error || "Failed to send verification email",
+        },
+        502
+      );
+    }
+
+    await mirrorEmailToControlledInboxes({
+      from: getSender(),
+      to: [{ email }],
+      subject: "Nolo Agent Email Registration E2E Code",
+      text: [
+        `Your Nolo Agent Email Registration E2E verification code is ${code}.`,
+        `Registration ID: ${registrationId}`,
+        `Verification page: ${verifyUrl}`,
+        "This message was sent for an explicitly requested self-hosted registration test.",
+      ].join("\n"),
+      providerName: provider.name,
+      providerMessageId: result.providerMessageId,
+      meta: {
+        source: "agent-email-registration-e2e",
+        registrationId,
+      },
+    });
+
+    return json({
+      success: true,
+      registrationId,
+      email,
+      username,
+      expiresAt: record.expiresAt,
+      verificationSent: true,
+    });
+  } catch (error: any) {
+    const message = error?.message || String(error);
+    if (isInvalidStartInputError(message)) {
+      return json(
+        {
+          success: false,
+          code: "invalid_input",
+          message,
+        },
+        400
+      );
+    }
+    return json(
+      {
+        success: false,
+        code: "internal_error",
+        message,
+      },
+      500
+    );
+  }
+};
+
+export const handleAgentEmailRegistrationE2EVerify = async (req: Request) => {
+  try {
+    const auth = await requireAuthenticatedOperator(req);
+    if (auth instanceof Response) return auth;
+
+    const body = await parseJsonBody(req);
+    const registrationId = normalizeText(body.registrationId);
+    const code = normalizeText(body.code);
+    if (!code) throw new Error("code is required");
+
+    const record = await loadRegistration(registrationId);
+    if (record.status === "verified") {
+      return json({
+        success: true,
+        status: "verified",
+        email: record.email,
+        username: record.username,
+      });
+    }
+    if (isExpired(record)) {
+      return json({ success: false, code: "expired", message: "registration expired" }, 410);
+    }
+    if (record.code !== code) {
+      return json({ success: false, code: "invalid_code", message: "verification code does not match" }, 400);
+    }
+
+    const now = new Date().toISOString();
+    const updated: RegistrationRecord = {
+      ...record,
+      status: "verified",
+      verifiedAt: now,
+      updatedAt: now,
+    };
+    await serverDb.put(record.dbKey, updated);
+
+    return json({
+      success: true,
+      status: "verified",
+      email: updated.email,
+      username: updated.username,
+      verifiedAt: updated.verifiedAt,
+    });
+  } catch (error: any) {
+    const message = error?.message || String(error);
+    if (message === "registration not found") {
+      return json({ success: false, code: "not_found", message }, 404);
+    }
+    if (message === "registrationId is required" || message === "Invalid JSON body" || message === "code is required") {
+      return json({ success: false, code: "invalid_input", message }, 400);
+    }
+    return json(
+      {
+        success: false,
+        code: "internal_error",
+        message,
+      },
+      500
+    );
+  }
+};

package/server/handlers/agentEmailRegistrationE2ERoutes.ts

@@ -0,0 +1,6 @@
+export const AGENT_EMAIL_REGISTRATION_E2E_PAGE_PATH =
+  "/alpha-test/agent-email-registration-e2e";
+export const AGENT_EMAIL_REGISTRATION_E2E_START_PATH =
+  "/api/alpha-test/agent-email-registration-e2e/start";
+export const AGENT_EMAIL_REGISTRATION_E2E_VERIFY_PATH =
+  "/api/alpha-test/agent-email-registration-e2e/verify";

package/server/handlers/agentRun/agentLookup.ts

@@ -0,0 +1,77 @@
+import {
+  BUILTIN_ECOMMERCE_AGENT_KEY,
+  BUILTIN_NOLO_AGENT_KEY,
+  fetchBuiltinPlatformAgentRecord,
+  normalizeBuiltinPlatformAgentModelConfig,
+  resolveBuiltinAgentConfig,
+} from "./builtinAgents";
+
+export type AgentRecordGetter = (agentKey: string) => Promise<unknown>;
+
+export type AgentRunAgentLookupResult =
+  | { ok: true; agentConfig: any }
+  | { ok: false; status: number; message: string };
+
+export async function resolveAgentRunAgentConfig(options: {
+  agentKey: string;
+  getAgentRecord: AgentRecordGetter;
+  resolveBuiltinAgentConfig?: typeof resolveBuiltinAgentConfig;
+  fetchBuiltinPlatformAgentRecord?: typeof fetchBuiltinPlatformAgentRecord;
+  normalizeBuiltinPlatformAgentModelConfig?: typeof normalizeBuiltinPlatformAgentModelConfig;
+}): Promise<AgentRunAgentLookupResult> {
+  const {
+    agentKey,
+    getAgentRecord,
+    resolveBuiltinAgentConfig: resolveBuiltin =
+      resolveBuiltinAgentConfig,
+    fetchBuiltinPlatformAgentRecord: fetchBuiltinPlatform =
+      fetchBuiltinPlatformAgentRecord,
+    normalizeBuiltinPlatformAgentModelConfig: normalizeBuiltinPlatform =
+      normalizeBuiltinPlatformAgentModelConfig,
+  } = options;
+
+  let agentConfig: any;
+  if (
+    agentKey === BUILTIN_NOLO_AGENT_KEY ||
+    agentKey === BUILTIN_ECOMMERCE_AGENT_KEY
+  ) {
+    agentConfig = resolveBuiltin(agentKey);
+  } else {
+    try {
+      agentConfig = await getAgentRecord(agentKey);
+    } catch (error: any) {
+      if (error?.code === "LEVEL_NOT_FOUND") {
+        agentConfig = resolveBuiltin(agentKey);
+      } else {
+        return {
+          ok: false,
+          status: 500,
+          message: String(error?.message ?? error ?? "Agent lookup failed"),
+        };
+      }
+    }
+  }
+
+  if (!agentConfig || typeof agentConfig !== "object") {
+    agentConfig =
+      resolveBuiltin(agentKey) ??
+      await fetchBuiltinPlatform(agentKey);
+    if (!agentConfig || typeof agentConfig !== "object") {
+      return {
+        ok: false,
+        status: 404,
+        message: `Agent not found: ${agentKey}`,
+      };
+    }
+  }
+
+  agentConfig = {
+    ...agentConfig,
+    dbKey: (agentConfig as any).dbKey ?? agentKey,
+  };
+
+  return {
+    ok: true,
+    agentConfig: normalizeBuiltinPlatform(agentConfig),
+  };
+}