onebots 1.0.6 → 1.1.0

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-export * from './app.js';
-export * from './config-schema.js';
-export * from '@onebots/core';
+export { App, createOnebots, defineConfig } from './app.js';
+export { getAppConfigSchema } from './config-schema.js';
+export { AdapterRegistry, ProtocolRegistry, Adapter, Account, Protocol, BaseApp, SqliteDB, Router, CommonEvent, CommonTypes, AccountStatus, type Schema, type RouterContext, type Next, type Dict, type WsServer, ConnectionManager, RetryPresets, yaml, configure, readLine, dateLikeToEventMs, toUnixSeconds, unixSecondsToEventMs, unixMillisToEventMs, buildProxyUrl, maskProxyUrl, createProxyAgent, createHttpsProxyAgent, createSocksProxyAgent, createManagedTokenValidator, initTokenManager, ConfigValidator, } from '@onebots/core';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.js

@@ -1,4 +1,21 @@
-export * from './app.js';
-export * from './config-schema.js';
-export * from '@onebots/core';
+// App exports
+export { App, createOnebots, defineConfig } from './app.js';
+export { getAppConfigSchema } from './config-schema.js';
+// Re-export core symbols that adapters and protocols depend on
+// (avoids requiring consumers to add @onebots/core as a direct dependency)
+export { 
+// Registry
+AdapterRegistry, ProtocolRegistry, 
+// Base classes
+Adapter, Account, Protocol, BaseApp, SqliteDB, Router, AccountStatus, 
+// Infrastructure
+ConnectionManager, RetryPresets, 
+// Utilities
+yaml, configure, readLine, dateLikeToEventMs, toUnixSeconds, unixSecondsToEventMs, unixMillisToEventMs, 
+// Proxy
+buildProxyUrl, maskProxyUrl, createProxyAgent, createHttpsProxyAgent, createSocksProxyAgent, 
+// Auth
+createManagedTokenValidator, initTokenManager, 
+// Config
+ConfigValidator, } from '@onebots/core';
 //# sourceMappingURL=index.js.map

package/lib/routes/adapter-api.d.ts

@@ -0,0 +1,17 @@
+import type { Router } from "@onebots/core";
+import type { App } from "../app.js";
+/**
+ * Register adapter / account management and message-sending routes.
+ *
+ * Routes in this group:
+ *  GET  /api/adapters       — list all adapter infos
+ *  GET  /api/list           — list all account infos
+ *  POST /api/add            — add an account
+ *  POST /api/edit           — update an account
+ *  GET  /api/remove         — remove an account
+ *  POST /api/bots/start     — set a bot online
+ *  POST /api/bots/stop      — set a bot offline
+ *  POST /api/send           — send a message through a running gateway
+ */
+export declare function registerAdapterRoutes(app: App, router: Router): void;
+//# sourceMappingURL=adapter-api.d.ts.map

package/lib/routes/adapter-api.js

@@ -0,0 +1,127 @@
+/**
+ * Register adapter / account management and message-sending routes.
+ *
+ * Routes in this group:
+ *  GET  /api/adapters       — list all adapter infos
+ *  GET  /api/list           — list all account infos
+ *  POST /api/add            — add an account
+ *  POST /api/edit           — update an account
+ *  GET  /api/remove         — remove an account
+ *  POST /api/bots/start     — set a bot online
+ *  POST /api/bots/stop      — set a bot offline
+ *  POST /api/send           — send a message through a running gateway
+ */
+export function registerAdapterRoutes(app, router) {
+    router.get("/api/adapters", (ctx) => {
+        ctx.body = [...app.adapters.values()].map(adapter => adapter.info);
+    });
+    router.get("/api/list", (ctx) => {
+        ctx.body = app.accounts.map(bot => bot.info);
+    });
+    router.post("/api/add", (ctx) => {
+        const config = ctx.request.body;
+        try {
+            app.addAccount(config);
+            ctx.body = { success: true, message: '添加成功' };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    router.post("/api/edit", async (ctx) => {
+        const config = ctx.request.body;
+        try {
+            await app.updateAccount(config);
+            ctx.body = { success: true, message: '修改成功' };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    router.get("/api/remove", async (ctx) => {
+        const { uin, platform, force } = ctx.request.query;
+        try {
+            await app.removeAccount(String(platform), String(uin), Boolean(force));
+            ctx.body = { success: true, message: '移除成功' };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    router.post("/api/bots/start", async (ctx) => {
+        const { platform, uin } = ctx.request.body;
+        try {
+            const adapter = app.adapters.get(platform);
+            await adapter?.setOnline(uin);
+            ctx.body = { success: true, data: adapter?.getAccount(uin)?.info };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    router.post("/api/bots/stop", async (ctx) => {
+        const { platform, uin } = ctx.request.body;
+        try {
+            const adapter = app.adapters.get(platform);
+            await adapter?.setOffline(uin);
+            ctx.body = { success: true, data: adapter?.getAccount(uin)?.info };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    // CLI send：通过已运行网关发信
+    router.post("/api/send", async (ctx) => {
+        try {
+            const body = ctx.request.body || {};
+            const channel = String(body.channel ?? "");
+            const target_id = String(body.target_id ?? "");
+            const target_type = String(body.target_type ?? "private");
+            const message = String(body.message ?? "");
+            if (!channel || !target_id) {
+                ctx.status = 400;
+                ctx.body = { success: false, message: "缺少 channel 或 target_id" };
+                return;
+            }
+            const parts = channel.split(".");
+            const platform = parts[0];
+            const account_id = parts.slice(1).join(".") || parts[1];
+            if (!platform || !account_id) {
+                ctx.status = 400;
+                ctx.body = { success: false, message: "channel 格式应为 platform.account_id" };
+                return;
+            }
+            const adapter = app.adapters.get(platform);
+            if (!adapter) {
+                ctx.status = 404;
+                ctx.body = { success: false, message: `适配器 ${platform} 不存在` };
+                return;
+            }
+            const account = adapter.getAccount(account_id);
+            if (!account) {
+                ctx.status = 404;
+                ctx.body = { success: false, message: `账号 ${channel} 不存在` };
+                return;
+            }
+            const segments = [{ type: "text", data: { text: message } }];
+            const scene_id = adapter.createId(target_id);
+            const result = await adapter.sendMessage(account_id, {
+                scene_type: target_type,
+                scene_id,
+                message: segments,
+            });
+            ctx.body = { success: true, message_id: result?.message_id ?? null };
+        }
+        catch (e) {
+            const err = e;
+            ctx.status = 500;
+            ctx.body = { success: false, message: err?.message ?? "发送失败" };
+        }
+    });
+}
+//# sourceMappingURL=adapter-api.js.map

package/lib/routes/auth.d.ts

@@ -0,0 +1,15 @@
+import type { App } from "../app.js";
+import type { Router } from "@onebots/core";
+/**
+ * Register authentication-related routes.
+ *
+ * Computes auth state from app.config rather than relying on start() closure variables.
+ * The middleware registered here protects all /api/* routes except login and refresh.
+ *
+ * A note on the access token: it can come from config.access_token or the environment
+ * variable ONEBOTS_ACCESS_TOKEN.  The access token path skips the per-session token
+ * manager and is validated by direct comparison.  The username/password path generates
+ * managed tokens via app.tokenManager.
+ */
+export declare function registerAuthRoutes(app: App, router: Router): void;
+//# sourceMappingURL=auth.d.ts.map

package/lib/routes/auth.js

@@ -0,0 +1,136 @@
+import { createManagedTokenValidator, BaseApp } from "@onebots/core";
+/**
+ * Register authentication-related routes.
+ *
+ * Computes auth state from app.config rather than relying on start() closure variables.
+ * The middleware registered here protects all /api/* routes except login and refresh.
+ *
+ * A note on the access token: it can come from config.access_token or the environment
+ * variable ONEBOTS_ACCESS_TOKEN.  The access token path skips the per-session token
+ * manager and is validated by direct comparison.  The username/password path generates
+ * managed tokens via app.tokenManager.
+ */
+export function registerAuthRoutes(app, router) {
+    /* ── auth state derived from app.config ───────────────────── */
+    const expectedUsername = app.config.username ?? BaseApp.defaultConfig.username;
+    const expectedPassword = app.config.password ?? BaseApp.defaultConfig.password;
+    const expectedAccessToken = (app.config.access_token?.trim()
+        || process.env.ONEBOTS_ACCESS_TOKEN?.trim()
+        || undefined);
+    /** Extract a Bearer token or ?access_token from an http.IncomingMessage (used by WebSocket auth). */
+    const getTokenFromRequest = (request) => {
+        const authHeader = request.headers.authorization;
+        if (authHeader && typeof authHeader === 'string') {
+            const match = authHeader.match(/^Bearer\s+(.+)$/i);
+            return match ? match[1] : authHeader;
+        }
+        try {
+            const url = new URL(request.url || '/', 'http://localhost');
+            return url.searchParams.get('access_token') || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    /** Extract a Bearer token or ?access_token from a Koa / RouterContext. */
+    const getTokenFromKoa = (ctx) => {
+        const authHeader = ctx.request.headers.authorization;
+        if (authHeader && typeof authHeader === 'string') {
+            const match = authHeader.match(/^Bearer\s+(.+)$/i);
+            return match ? match[1] : authHeader;
+        }
+        return ctx.request.query?.access_token || undefined;
+    };
+    const authValidator = createManagedTokenValidator(app.tokenManager, {
+        tokenName: 'access_token',
+        errorMessage: 'Unauthorized',
+    });
+    /* ── routes ────────────────────────────────────────────────── */
+    router.post("/api/auth/login", (ctx) => {
+        const body = ctx.request.body;
+        // 鉴权码登录
+        if (body.access_token != null && body.access_token !== '') {
+            if (expectedAccessToken && body.access_token === expectedAccessToken) {
+                ctx.body = {
+                    success: true,
+                    token: body.access_token,
+                    expiresAt: null,
+                    refreshToken: null,
+                    isDefaultCredentials: false,
+                };
+                return;
+            }
+            ctx.status = 401;
+            ctx.body = { success: false, message: "鉴权码错误" };
+            return;
+        }
+        if (!body.username || !body.password || body.username !== expectedUsername || body.password !== expectedPassword) {
+            ctx.status = 401;
+            ctx.body = { success: false, message: "用户名或密码错误" };
+            return;
+        }
+        const tokenInfo = app.tokenManager.generateToken({ username: body.username });
+        ctx.body = {
+            success: true,
+            token: tokenInfo.token,
+            expiresAt: tokenInfo.expiresAt,
+            refreshToken: tokenInfo.refreshToken,
+            isDefaultCredentials: app.credentialsWereAutoGenerated,
+        };
+    });
+    router.post("/api/auth/refresh", (ctx) => {
+        const { refreshToken } = ctx.request.body;
+        if (!refreshToken) {
+            ctx.status = 400;
+            ctx.body = { success: false, message: "缺少 refreshToken" };
+            return;
+        }
+        const tokenInfo = app.tokenManager.refreshToken(refreshToken);
+        if (!tokenInfo) {
+            ctx.status = 401;
+            ctx.body = { success: false, message: "refreshToken 无效或已过期" };
+            return;
+        }
+        ctx.body = {
+            success: true,
+            token: tokenInfo.token,
+            expiresAt: tokenInfo.expiresAt,
+            refreshToken: tokenInfo.refreshToken,
+        };
+    });
+    /**
+     * API auth middleware — protects all /api/* paths EXCEPT login & refresh.
+     * Access-token paths (config.access_token / env ONEBOTS_ACCESS_TOKEN) short-circuit
+     * the per-session token-manager check.  All other paths go through authValidator
+     * which validates the Bearer token issued by the login endpoint.
+     */
+    router.use('/api', async (ctx, next) => {
+        if (ctx.path === '/api/auth/login' || ctx.path === '/api/auth/refresh')
+            return next();
+        const token = getTokenFromKoa(ctx);
+        if (expectedAccessToken && token === expectedAccessToken) {
+            ctx.state.token = token;
+            ctx.state.tokenInfo = { metadata: { username: 'token' }, expiresAt: null };
+            return next();
+        }
+        return authValidator(ctx, next);
+    });
+    router.post("/api/auth/logout", (ctx) => {
+        const token = ctx.state.token;
+        if (token && token !== expectedAccessToken)
+            app.tokenManager.revokeToken(token);
+        ctx.body = { success: true };
+    });
+    router.get("/api/auth/me", (ctx) => {
+        const tokenInfo = ctx.state.tokenInfo;
+        ctx.body = {
+            success: true,
+            data: {
+                username: tokenInfo?.metadata?.username ?? expectedUsername,
+                expiresAt: tokenInfo?.expiresAt ?? null,
+                isDefaultCredentials: app.credentialsWereAutoGenerated,
+            },
+        };
+    });
+}
+//# sourceMappingURL=auth.js.map

package/lib/routes/config.d.ts

@@ -0,0 +1,13 @@
+import type { Router } from "@onebots/core";
+import type { App } from "../app.js";
+/**
+ * Register configuration and system management routes.
+ *
+ * - GET/POST /api/config — read / write the config YAML file
+ * - GET  /api/config/schema — JSON schema for the config
+ * - GET  /api/system — app info
+ * - POST /api/system/restart — graceful shutdown
+ * - POST /api/system/backup-to-hf — push config + data dir to Hugging Face
+ */
+export declare function registerConfigRoutes(app: App, router: Router): void;
+//# sourceMappingURL=config.d.ts.map

package/lib/routes/config.js

@@ -0,0 +1,73 @@
+import { BaseApp } from "@onebots/core";
+import { readFileSync, writeFileSync } from "fs";
+import { getAppConfigSchema } from "../config-schema.js";
+/**
+ * Register configuration and system management routes.
+ *
+ * - GET/POST /api/config — read / write the config YAML file
+ * - GET  /api/config/schema — JSON schema for the config
+ * - GET  /api/system — app info
+ * - POST /api/system/restart — graceful shutdown
+ * - POST /api/system/backup-to-hf — push config + data dir to Hugging Face
+ */
+export function registerConfigRoutes(app, router) {
+    router.get("/api/config", (ctx) => {
+        ctx.body = readFileSync(BaseApp.configPath, "utf8");
+    });
+    router.get("/api/config/schema", (ctx) => {
+        ctx.body = getAppConfigSchema();
+    });
+    router.post("/api/config", async (ctx) => {
+        try {
+            const configContent = ctx.request.body;
+            writeFileSync(BaseApp.configPath, configContent, "utf8");
+            app.credentialsWereAutoGenerated = false;
+            const backupResult = await app.backupDataToHf(configContent);
+            if (!backupResult.success && backupResult.message) {
+                app.logger?.warn?.(backupResult.message);
+            }
+            ctx.body = { success: true, message: "配置已保存" };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    router.get("/api/system", (ctx) => {
+        ctx.body = {
+            ...app.info,
+            isDefaultCredentials: app.credentialsWereAutoGenerated,
+            configDir: BaseApp.configDir,
+            configPath: BaseApp.configPath,
+            dataDir: BaseApp.dataDir,
+        };
+    });
+    /** 手动将 data 与配置备份到 HF 仓库（与保存配置时的备份逻辑一致） */
+    router.post("/api/system/backup-to-hf", async (ctx) => {
+        try {
+            const configContent = readFileSync(BaseApp.configPath, "utf8");
+            const result = await app.backupDataToHf(configContent);
+            if (result.success) {
+                ctx.body = { success: true, message: "已备份到仓库" };
+            }
+            else {
+                ctx.status = 400;
+                ctx.body = { success: false, message: result.message ?? "备份失败" };
+            }
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    /** 重启服务：进程退出后由 Docker 的 restart 策略自动拉起容器；非 Docker 需手动重新启动 */
+    router.post("/api/system/restart", (ctx) => {
+        ctx.body = { success: true, message: "服务即将重启" };
+        setImmediate(() => {
+            setTimeout(() => {
+                process.exit(0);
+            }, 1500);
+        });
+    });
+}
+//# sourceMappingURL=config.js.map

package/lib/routes/public-static.d.ts

@@ -0,0 +1,12 @@
+import type { Router } from "@onebots/core";
+import type { App } from "../app.js";
+/**
+ * Register public-static file management routes.
+ *
+ * Routes:
+ *  GET    /api/public-static/files     — list files in public_static_dir
+ *  POST   /api/public-static/upload    — upload a file
+ *  DELETE /api/public-static/:filename — delete a file
+ */
+export declare function registerPublicStaticRoutes(app: App, router: Router): void;
+//# sourceMappingURL=public-static.d.ts.map

package/lib/routes/public-static.js

@@ -0,0 +1,162 @@
+import * as fs from "fs";
+import * as path from "path";
+/** 站点静态根目录下的文件名：禁止路径分隔与控制字符，仅使用 basename */
+function sanitizePublicStaticBasename(original) {
+    if (original == null || String(original).trim() === '')
+        return null;
+    let raw = String(original).trim();
+    try {
+        raw = decodeURIComponent(raw);
+    }
+    catch {
+        return null;
+    }
+    if (/[\\/]/.test(raw) || raw.includes('..'))
+        return null;
+    if (/[\x00-\x1f]/.test(raw))
+        return null;
+    const base = path.basename(raw);
+    if (!base || base !== raw || base === '.' || base === '..')
+        return null;
+    if (base.length > 255)
+        return null;
+    return base;
+}
+function pickPublicStaticUpload(files) {
+    if (!files || typeof files !== 'object')
+        return null;
+    const raw = files.file ?? files.upload;
+    if (!raw)
+        return null;
+    const file = Array.isArray(raw) ? raw[0] : raw;
+    if (!file || typeof file !== 'object')
+        return null;
+    return file;
+}
+/**
+ * Register public-static file management routes.
+ *
+ * Routes:
+ *  GET    /api/public-static/files     — list files in public_static_dir
+ *  POST   /api/public-static/upload    — upload a file
+ *  DELETE /api/public-static/:filename — delete a file
+ */
+export function registerPublicStaticRoutes(app, router) {
+    router.get("/api/public-static/files", (ctx) => {
+        const root = app.getPublicStaticRoot();
+        if (!root) {
+            ctx.status = 400;
+            ctx.body = {
+                success: false,
+                message: '请先在基础配置中设置 public_static_dir 并保存配置',
+            };
+            return;
+        }
+        try {
+            const names = fs
+                .readdirSync(root, { withFileTypes: true })
+                .filter((d) => d.isFile())
+                .map((d) => d.name)
+                .sort((a, b) => a.localeCompare(b));
+            ctx.body = { success: true, files: names, root };
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+    router.post("/api/public-static/upload", async (ctx) => {
+        const root = app.getPublicStaticRoot();
+        if (!root) {
+            ctx.status = 400;
+            ctx.body = {
+                success: false,
+                message: '请先在基础配置中设置 public_static_dir 并保存配置',
+            };
+            return;
+        }
+        const file = pickPublicStaticUpload(ctx.request.files);
+        if (!file?.filepath) {
+            ctx.status = 400;
+            ctx.body = { success: false, message: '缺少上传文件（字段名 file）' };
+            return;
+        }
+        const safeName = sanitizePublicStaticBasename(file.originalFilename ?? file.newFilename);
+        if (!safeName) {
+            try {
+                fs.unlinkSync(file.filepath);
+            }
+            catch {
+                /* 忽略临时文件清理失败 */
+            }
+            ctx.status = 400;
+            ctx.body = { success: false, message: '非法或无法识别的文件名' };
+            return;
+        }
+        const dest = path.join(root, safeName);
+        const tmpPath = file.filepath;
+        try {
+            fs.copyFileSync(tmpPath, dest);
+            ctx.body = { success: true, message: '上传成功', filename: safeName };
+            const hf = await app.backupDataDirToHfAfterStaticChange();
+            if (hf.attempted) {
+                ctx.body.hf_backup = hf;
+            }
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+        finally {
+            try {
+                fs.unlinkSync(tmpPath);
+            }
+            catch {
+                /* 忽略 */
+            }
+        }
+    });
+    router.delete("/api/public-static/:filename", async (ctx) => {
+        const root = app.getPublicStaticRoot();
+        if (!root) {
+            ctx.status = 400;
+            ctx.body = {
+                success: false,
+                message: '请先在基础配置中设置 public_static_dir 并保存配置',
+            };
+            return;
+        }
+        const safeName = sanitizePublicStaticBasename(ctx.params.filename ?? '');
+        if (!safeName) {
+            ctx.status = 400;
+            ctx.body = { success: false, message: '非法文件名' };
+            return;
+        }
+        const resolvedRoot = path.resolve(root);
+        const target = path.join(root, safeName);
+        const rel = path.relative(resolvedRoot, path.resolve(target));
+        if (rel.startsWith('..') || path.isAbsolute(rel) || rel === '') {
+            ctx.status = 400;
+            ctx.body = { success: false, message: '路径非法' };
+            return;
+        }
+        try {
+            if (!fs.existsSync(target) || !fs.statSync(target).isFile()) {
+                ctx.status = 404;
+                ctx.body = { success: false, message: '文件不存在' };
+                return;
+            }
+            fs.unlinkSync(target);
+            ctx.body = { success: true, message: '已删除' };
+            const hf = await app.backupDataDirToHfAfterStaticChange();
+            if (hf.attempted) {
+                ctx.body.hf_backup = hf;
+            }
+        }
+        catch (e) {
+            ctx.status = 500;
+            ctx.body = { success: false, message: e.message };
+        }
+    });
+}
+//# sourceMappingURL=public-static.js.map

package/lib/routes/terminal.d.ts

@@ -0,0 +1,10 @@
+import type { Router } from "@onebots/core";
+import type { App } from "../app.js";
+/**
+ * Register terminal and log-streaming endpoints.
+ *
+ *  WS  /api/terminal  — interactive PTY terminal via WebSocket
+ *  SSE /api/logs      — real-time log stream (stdout / stderr interception)
+ */
+export declare function registerTerminalRoutes(app: App, router: Router): void;
+//# sourceMappingURL=terminal.d.ts.map