openlearn-next 0.3.13 → 0.3.15

package/dist/server.cjs

@@ -351,7 +351,7 @@ var init_token = __esm({
 });
 
 // packages/core/di/interfaces.ts
-var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken;
+var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, IAuthSessionBridgeToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken;
 var init_interfaces = __esm({
   "packages/core/di/interfaces.ts"() {
     init_token();
@@ -400,6 +400,10 @@ var init_interfaces = __esm({
     ICapabilityRegistryToken = new Token(
       "@openlearn/core:ICapabilityRegistry"
     );
+    IAuthSessionBridgeToken = new Token(
+      "@openlearn/core:IAuthSessionBridgeService",
+      "1.0.0"
+    );
     ISemesterGradeServiceToken = new Token(
       "@openlearn/core:ISemesterGradeService"
     );
@@ -8402,6 +8406,78 @@ var PointsLedgerService = class {
   }
 };
 
+// packages/core/di/auth-session-bridge-service.ts
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var AuthSessionBridgeService = class {
+  constructor(db2) {
+    this.db = db2;
+  }
+  async createSession(user) {
+    if (!user || !user.userId || !user.role) {
+      throw new Error("Invalid user payload: userId and role are required");
+    }
+    const now = Date.now();
+    const maxAgeSeconds = 7 * 24 * 60 * 60;
+    const expiresAt = now + maxAgeSeconds * 1e3;
+    const sessionToken = "token_" + import_node_crypto.default.randomBytes(16).toString("hex");
+    if (user.role === "student") {
+      const existingStudent = this.db.prepare("SELECT id FROM students WHERE id = ?").get(user.userId);
+      if (!existingStudent) {
+        const studentNumber = user.username || `sso_${user.userId}`;
+        const studentNumberCheck = this.db.prepare("SELECT id FROM students WHERE student_number = ?").get(studentNumber);
+        const finalStudentNumber = studentNumberCheck ? `sso_${user.userId}_${Date.now()}` : studentNumber;
+        this.db.prepare(`
+          INSERT INTO students (id, student_number, name, email, created_at)
+          VALUES (?, ?, ?, ?, ?)
+        `).run(
+          user.userId,
+          finalStudentNumber,
+          user.name || user.username || user.userId,
+          user.email || null,
+          now
+        );
+      }
+    } else if (user.role === "teacher" || user.role === "administrator") {
+      const existingUser = this.db.prepare("SELECT id FROM users WHERE id = ?").get(user.userId);
+      if (!existingUser) {
+        const username = user.username || `sso_${user.userId}`;
+        const usernameCheck = this.db.prepare("SELECT id FROM users WHERE username = ?").get(username);
+        const finalUsername = usernameCheck ? `sso_${user.userId}_${Date.now()}` : username;
+        this.db.prepare(`
+          INSERT INTO users (id, username, password_hash, role, name, created_at, status)
+          VALUES (?, ?, ?, ?, ?, ?, 'active')
+        `).run(
+          user.userId,
+          finalUsername,
+          "",
+          // SSO 用户无本地明文/哈希密码
+          user.role,
+          user.name || user.username || user.userId,
+          now
+        );
+      }
+    }
+    const sessionData = {
+      userId: user.userId,
+      username: user.username || user.userId,
+      role: user.role,
+      subRole: user.role,
+      name: user.name || user.username || user.userId,
+      email: user.email || null,
+      avatar: user.avatar ?? null,
+      classId: user.classId ?? null
+    };
+    this.db.prepare(`
+      INSERT INTO client_sessions (id, session_data, updated_at, expires_at)
+      VALUES (?, ?, ?, ?)
+    `).run(sessionToken, JSON.stringify(sessionData), now, expiresAt);
+    return {
+      token: sessionToken,
+      maxAge: maxAgeSeconds
+    };
+  }
+};
+
 // packages/core/plugin-host/index.ts
 var import_uuid13 = require("uuid");
 var import_fs5 = __toESM(require("fs"), 1);
@@ -8988,7 +9064,7 @@ var HotReloadActivationError = class extends HotReloadError {
 init_interfaces();
 
 // packages/core/version.ts
-var PLATFORM_VERSION = "0.3.13";
+var PLATFORM_VERSION = "0.3.15";
 var OPENLEARN_VERSION = PLATFORM_VERSION;
 
 // packages/core/plugin-host/plugin-runtime-composition.ts
@@ -17975,6 +18051,7 @@ var Kernel = class {
     this.serviceRegistry.register(ICapabilityRuntimeServiceToken, { getRuntimeKernel: async () => this.capabilityFrameworkRuntime });
     this.serviceRegistry.register(ICapabilityGovernanceServiceToken, { getGovernanceKernel: async () => this.capabilityGovernance });
     this.serviceRegistry.register(IPlatformServiceRegistryToken, { getServiceRegistryKernel: async () => this.platformServiceRegistryKernel });
+    this.serviceRegistry.register(IAuthSessionBridgeToken, new AuthSessionBridgeService(this.db));
     this.commandBus.setInterceptor(async (command) => {
       const action = this.actionRegistry.getActionByCommandType(command.type);
       if (action) {
@@ -25069,6 +25146,12 @@ data: ${JSON.stringify({ error: msg })}
       5e3
     );
     const status = typeof response.status === "number" && response.status >= 100 && response.status <= 599 ? response.status : 200;
+    if (response.sessionToken && typeof response.sessionToken === "string" && response.sessionToken.startsWith("token_")) {
+      const isSecure = req.secure || req.headers["x-forwarded-proto"] === "https" || process.env.NODE_ENV === "production" && process.env.ENABLE_HTTPS === "true";
+      const secureFlag = isSecure ? "; Secure" : "";
+      const sameSite = isSecure ? "SameSite=None" : "SameSite=Lax";
+      res.setHeader("Set-Cookie", `edu_os_token=${response.sessionToken}; Path=/; HttpOnly; ${sameSite}; Max-Age=604800${secureFlag}`);
+    }
     if (response.headers && typeof response.headers === "object") {
       for (const [k, v] of Object.entries(response.headers)) {
         const lowerKey = k.toLowerCase();
@@ -25077,10 +25160,10 @@ data: ${JSON.stringify({ error: msg })}
         }
       }
     }
-    if (res.getHeader("content-type") === void 0) {
+    if (res.getHeader("content-type") === void 0 && response.body !== void 0 && response.body !== null) {
       res.setHeader("content-type", "application/json; charset=utf-8");
     }
-    res.status(status).send(response.body);
+    res.status(status).send(response.body !== void 0 ? response.body : "");
   } catch (err) {
     if (err.name === "GatewayTimeoutError" || err.message?.includes("timed out")) {
       res.status(504).json({ success: false, error: "Gateway Timeout: Plugin did not respond in time" });
@@ -25752,8 +25835,11 @@ async function startServer() {
   kernelContainer.pluginHost.setExpressApp(app);
   const PORT = parseInt(process.env.PORT || "9000", 10);
   app.set("trust proxy", 1);
-  const frameAllowedOrigins = process.env.ALLOWED_FRAME_ORIGINS ? process.env.ALLOWED_FRAME_ORIGINS.split(",").map((s) => s.trim()) : ["http://localhost:*", "http://127.0.0.1:*"];
+  const frameAllowedOrigins = process.env.ALLOWED_FRAME_ORIGINS ? process.env.ALLOWED_FRAME_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : ["http://localhost:*", "http://127.0.0.1:*"];
+  const ltiAllowedOrigins = process.env.LTI_ALLOWED_LMS_ORIGINS ? process.env.LTI_ALLOWED_LMS_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
   app.use((0, import_helmet.default)({
+    // SEC-LTI: 若配置了允许嵌入的 LMS 平台域名，禁用全局 X-Frame-Options，由 CSP frame-ancestors 严格精细化管控
+    xFrameOptions: ltiAllowedOrigins.length > 0 ? false : { action: "sameorigin" },
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
@@ -25765,6 +25851,7 @@ async function startServer() {
         fontSrc: ["'self'", "data:", "https://fonts.gstatic.com"],
         // 移除通配 http: 和 https:，限制 iframe 仅能加载本地、沙箱或受信任课件源
         frameSrc: ["'self'", "blob:", "data:", ...frameAllowedOrigins],
+        frameAncestors: ltiAllowedOrigins.length > 0 ? ["'self'", ...ltiAllowedOrigins] : ["'self'"],
         objectSrc: ["'none'"],
         baseUri: ["'self'"]
       }
@@ -25772,10 +25859,10 @@ async function startServer() {
     crossOriginOpenerPolicy: false,
     crossOriginEmbedderPolicy: false,
     crossOriginResourcePolicy: { policy: "cross-origin" },
-    // 允许沙箱 iframe（opaque origin）加载静态资?
+    // 允许沙箱 iframe（opaque origin）加载静态资源
     originAgentCluster: false,
     strictTransportSecurity: false
-    // �? HTTP 部署，禁�? HSTS（否则浏览器缓存后强�? HTTPS，导�? ERR_CONNECTION_REFUSED�?
+    // 针对 HTTP 部署，禁用 HSTS（否则浏览器缓存后强制 HTTPS，导致 ERR_CONNECTION_REFUSED）
   }));
   const loginLimiter = (0, import_express_rate_limit.default)({
     windowMs: 60 * 1e3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openlearn-next",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "private": false,
   "description": "A plugin-driven Educational OS / LMS platform with AI agent teaching assistant",
   "keywords": [
@@ -74,10 +74,11 @@
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
     "uuid": "^14.0.0",
+    "xlsx": "^0.18.5",
     "xss": "^1.0.15",
     "zod": "^4.4.3",
     "zustand": "^5.0.14",
-    "@openlearn/plugin-sdk": "3.6.0"
+    "@openlearn/plugin-sdk": "3.6.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -106,8 +107,7 @@
     "tailwindcss": "^4.1.14",
     "tsx": "^4.21.0",
     "typescript": "~5.8.2",
-    "vitest": "^4.1.9",
-    "xlsx": "^0.18.5"
+    "vitest": "^4.1.9"
   },
   "scripts": {
     "dev": "npx tsx --no-cache server.ts",