nolo-cli 0.1.39 → 0.1.41

package/auth/routes.ts

@@ -0,0 +1,178 @@
+// auth/routes.ts
+import { API_VERSION } from "../database/config";
+
+export interface RouteParams {
+  userId?: string;
+}
+
+export const authRoutes = {
+  login: {
+    path: `${API_VERSION}/users/login`,
+    method: "POST" as const,
+    createPath: () => `${API_VERSION}/users/login`,
+  },
+  signup: {
+    path: `${API_VERSION}/users/signup`,
+    method: "POST" as const,
+    createPath: () => `${API_VERSION}/users/signup`,
+  },
+  users: {
+    cliLoginStart: {
+      path: `${API_VERSION}/users/cli-login/start`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/cli-login/start`,
+    },
+    cliLoginAuthorize: {
+      path: `${API_VERSION}/users/cli-login/authorize`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/cli-login/authorize`,
+    },
+    cliLoginPoll: {
+      path: `${API_VERSION}/users/cli-login/poll`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/cli-login/poll`,
+    },
+    list: {
+      path: `${API_VERSION}/users`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users`,
+    },
+    usageReport: {
+      path: `${API_VERSION}/users/usage-report`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/usage-report`,
+    },
+    providerBillingHealth: {
+      path: `${API_VERSION}/users/provider-billing-health`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/provider-billing-health`,
+    },
+    providerBillingDrilldown: {
+      path: `${API_VERSION}/users/provider-billing-drilldown`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/provider-billing-drilldown`,
+    },
+    providerCredentials: {
+      path: `${API_VERSION}/users/provider-credentials`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/provider-credentials`,
+    },
+    providerCredentialLifecycle: {
+      path: `${API_VERSION}/users/provider-credentials/lifecycle`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/provider-credentials/lifecycle`,
+    },
+    billingAnomalyLifecycle: {
+      path: `${API_VERSION}/users/billing-anomalies/lifecycle`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/billing-anomalies/lifecycle`,
+    },
+    billingAnomalyDrilldown: {
+      path: `${API_VERSION}/users/billing-anomalies/drilldown`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/billing-anomalies/drilldown`,
+    },
+    billingAnomalyAudit: {
+      path: `${API_VERSION}/users/billing-anomalies/audit`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/billing-anomalies/audit`,
+    },
+    detail: {
+      path: `${API_VERSION}/users/:userId`,
+      method: "GET" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}`,
+    },
+    sessionRevoke: {
+      path: `${API_VERSION}/users/session-revoke`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/session-revoke`,
+    },
+    transfer: {
+      path: `${API_VERSION}/users/:userId/transfer`,
+      method: "POST" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}/transfer`,
+    },
+    delete: {
+      path: `${API_VERSION}/users/:userId`,
+      method: "DELETE" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}`,
+    },
+    disable: {
+      path: `${API_VERSION}/users/:userId/disable`,
+      method: "POST" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}/disable`,
+    },
+    enable: {
+      path: `${API_VERSION}/users/:userId/enable`,
+      method: "POST" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}/enable`,
+    },
+    adminPermissions: {
+      path: `${API_VERSION}/users/:userId/admin-permissions`,
+      method: "POST" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}/admin-permissions`,
+    },
+    sendEmail: {
+      path: `${API_VERSION}/users/send-email`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/send-email`,
+    },
+    emailPreferencesGet: {
+      path: `${API_VERSION}/users/email-preferences`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/email-preferences`,
+    },
+    emailPreferencesUpdate: {
+      path: `${API_VERSION}/users/email-preferences`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/email-preferences`,
+    },
+    emailReport: {
+      path: `${API_VERSION}/users/email-report`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/email-report`,
+    },
+    emailRetryRun: {
+      path: `${API_VERSION}/users/email-retry/run`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/email-retry/run`,
+    },
+    emailReplayFailures: {
+      path: `${API_VERSION}/users/email-replay-failures`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/email-replay-failures`,
+    },
+    emailConfigGet: {
+      path: `${API_VERSION}/users/email-config`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/email-config`,
+    },
+    emailConfigUpdate: {
+      path: `${API_VERSION}/users/email-config`,
+      method: "POST" as const,
+      createPath: () => `${API_VERSION}/users/email-config`,
+    },
+    emailUnsubscribe: {
+      path: `${API_VERSION}/users/email-unsubscribe`,
+      method: "GET" as const,
+      createPath: () => `${API_VERSION}/users/email-unsubscribe`,
+    },
+    rechargeHistory: {
+      path: `${API_VERSION}/users/:userId/recharge-history`,
+      method: "POST" as const,
+      createPath: (params: RouteParams) =>
+        `${API_VERSION}/users/${params.userId}/recharge-history`,
+    },
+  },
+} as const;
+
+// 简单的路径匹配器，只处理基本的参数提取
+export function createPathMatcher(routePath: string) {
+  return new RegExp(`^${routePath.replace(/:(\w+)/g, "([^/]+)")}$`);
+}

package/auth/token.ts

@@ -0,0 +1,63 @@
+import { detachedSign, verifyDetachedSignature } from "../core/crypto";
+import { Base64 } from "js-base64";
+
+/**
+ * Token 格式：`base64(JSON(payload)).ed25519签名`
+ *
+ * 设计说明：
+ * - 密钥派生是确定性的：用户名 + 哈希(密码) + locale → secretKey/publicKey
+ * - token 由客户端本地签发，服务端用存储的 publicKey 验签，没有中心化密钥
+ * - 忘记密码 = 无法恢复（类似助记词钱包），注册时应明确告知用户
+ *
+ * payload 约定：
+ * - userId, username 必填
+ * - exp: Unix 秒（number），仅旧 token 使用；新的登录 token 默认不设置过期时间
+ */
+
+export const buildPersistentAuthTokenPayload = <T extends Record<string, unknown>>(
+  payload: T,
+  nowSec = Math.floor(Date.now() / 1000)
+) => ({
+  ...payload,
+  iat: nowSec,
+  nbf: nowSec,
+});
+
+export const signToken = (payload: any, secretKey: string) => {
+  const encodedPayload = Base64.encode(JSON.stringify(payload));
+  const signature = detachedSign(encodedPayload, secretKey);
+  return `${encodedPayload}.${signature}`;
+};
+
+export const verifyToken = (token: string, publicKey: string) => {
+  const [encodedPayload, signature] = token.split(".");
+
+  if (!verifyDetachedSignature(encodedPayload, signature, publicKey)) {
+    throw new Error("Invalid signature");
+  }
+
+  const payload = JSON.parse(Base64.decode(encodedPayload));
+
+  // exp 统一为 Unix 秒（number），直接与当前时间比较
+  if (payload.exp && typeof payload.exp === "number") {
+    if (Math.floor(Date.now() / 1000) > payload.exp) {
+      throw new Error("Token has expired");
+    }
+  }
+
+  return payload;
+};
+
+/**
+ * 不验证签名，只解析 payload。
+ * 用于从 token 中快速读取 userId 等字段（如初始化 auth 状态）。
+ * 注意：结果未经验签，不可用于权限判断。
+ */
+export const parseToken = (token: string) => {
+  try {
+    const [payloadBase64] = token.split(".");
+    return JSON.parse(Base64.decode(payloadBase64));
+  } catch {
+    return null;
+  }
+};

package/auth/types.ts

@@ -0,0 +1,40 @@
+// auth/types.ts
+import type { AdminPermissions } from "./adminPermissions";
+
+export interface User {
+  userId: string;
+  username?: string;
+  name?: string;
+  nickname?: string;
+  avatar?: string;
+  email?: string;
+  locale?: string;
+  publicKey?: string;
+  tokenVersion?: number;
+  balance?: number;
+  gptProAccess?: {
+    status?: string;
+    requiredRechargeAmount?: number;
+    rechargeAmount?: number;
+    source?: string;
+    sourceTxId?: string;
+    grantedAt?: number;
+    updatedAt?: number;
+  };
+  adminPermissions?: AdminPermissions;
+}
+export interface TokenManager {
+  getTokens(): Promise<string[]>;
+  storeToken(token: string): Promise<void>;
+  removeToken(token: string): Promise<void>;
+  initTokens(): Promise<string[]>;
+}
+
+export const safelyParseJSON = (jsonString: string) => {
+  try {
+    const parsed = JSON.parse(jsonString);
+    return typeof parsed === "string" ? [parsed] : parsed;
+  } catch {
+    return [jsonString];
+  }
+};