npm - openlearn-next - Versions diffs - 0.3.14 → 0.3.16 - Mend

openlearn-next 0.3.14 → 0.3.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/dist/index.html CHANGED Viewed

@@ -15,7 +15,7 @@
       }
     }
     </script>
-    <script type="module" crossorigin src="/assets/index-CWmuWSYa.js"></script>
+    <script type="module" crossorigin src="/assets/index-D7ZJLlkd.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-D7PQWdtD.css">
   </head>
   <body>

package/dist/server.cjs CHANGED Viewed

@@ -351,7 +351,7 @@ var init_token = __esm({
 });
 // packages/core/di/interfaces.ts
-var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken;
+var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, IAuthSessionBridgeToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken;
 var init_interfaces = __esm({
   "packages/core/di/interfaces.ts"() {
     init_token();
@@ -400,6 +400,10 @@ var init_interfaces = __esm({
     ICapabilityRegistryToken = new Token(
       "@openlearn/core:ICapabilityRegistry"
     );
+    IAuthSessionBridgeToken = new Token(
+      "@openlearn/core:IAuthSessionBridgeService",
+      "1.0.0"
+    );
     ISemesterGradeServiceToken = new Token(
       "@openlearn/core:ISemesterGradeService"
     );
@@ -8402,6 +8406,78 @@ var PointsLedgerService = class {
   }
 };
+// packages/core/di/auth-session-bridge-service.ts
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var AuthSessionBridgeService = class {
+  constructor(db2) {
+    this.db = db2;
+  }
+  async createSession(user) {
+    if (!user || !user.userId || !user.role) {
+      throw new Error("Invalid user payload: userId and role are required");
+    }
+    const now = Date.now();
+    const maxAgeSeconds = 7 * 24 * 60 * 60;
+    const expiresAt = now + maxAgeSeconds * 1e3;
+    const sessionToken = "token_" + import_node_crypto.default.randomBytes(16).toString("hex");
+    if (user.role === "student") {
+      const existingStudent = this.db.prepare("SELECT id FROM students WHERE id = ?").get(user.userId);
+      if (!existingStudent) {
+        const studentNumber = user.username || `sso_${user.userId}`;
+        const studentNumberCheck = this.db.prepare("SELECT id FROM students WHERE student_number = ?").get(studentNumber);
+        const finalStudentNumber = studentNumberCheck ? `sso_${user.userId}_${Date.now()}` : studentNumber;
+        this.db.prepare(`
+          INSERT INTO students (id, student_number, name, email, created_at)
+          VALUES (?, ?, ?, ?, ?)
+        `).run(
+          user.userId,
+          finalStudentNumber,
+          user.name || user.username || user.userId,
+          user.email || null,
+          now
+        );
+      }
+    } else if (user.role === "teacher" || user.role === "administrator") {
+      const existingUser = this.db.prepare("SELECT id FROM users WHERE id = ?").get(user.userId);
+      if (!existingUser) {
+        const username = user.username || `sso_${user.userId}`;
+        const usernameCheck = this.db.prepare("SELECT id FROM users WHERE username = ?").get(username);
+        const finalUsername = usernameCheck ? `sso_${user.userId}_${Date.now()}` : username;
+        this.db.prepare(`
+          INSERT INTO users (id, username, password_hash, role, name, created_at, status)
+          VALUES (?, ?, ?, ?, ?, ?, 'active')
+        `).run(
+          user.userId,
+          finalUsername,
+          "",
+          // SSO 用户无本地明文/哈希密码
+          user.role,
+          user.name || user.username || user.userId,
+          now
+        );
+      }
+    }
+    const sessionData = {
+      userId: user.userId,
+      username: user.username || user.userId,
+      role: user.role,
+      subRole: user.role,
+      name: user.name || user.username || user.userId,
+      email: user.email || null,
+      avatar: user.avatar ?? null,
+      classId: user.classId ?? null
+    };
+    this.db.prepare(`
+      INSERT INTO client_sessions (id, session_data, updated_at, expires_at)
+      VALUES (?, ?, ?, ?)
+    `).run(sessionToken, JSON.stringify(sessionData), now, expiresAt);
+    return {
+      token: sessionToken,
+      maxAge: maxAgeSeconds
+    };
+  }
+};
 // packages/core/plugin-host/index.ts
 var import_uuid13 = require("uuid");
 var import_fs5 = __toESM(require("fs"), 1);
@@ -8988,7 +9064,7 @@ var HotReloadActivationError = class extends HotReloadError {
 init_interfaces();
 // packages/core/version.ts
-var PLATFORM_VERSION = "0.3.14";
+var PLATFORM_VERSION = "0.3.16";
 var OPENLEARN_VERSION = PLATFORM_VERSION;
 // packages/core/plugin-host/plugin-runtime-composition.ts
@@ -17975,6 +18051,7 @@ var Kernel = class {
     this.serviceRegistry.register(ICapabilityRuntimeServiceToken, { getRuntimeKernel: async () => this.capabilityFrameworkRuntime });
     this.serviceRegistry.register(ICapabilityGovernanceServiceToken, { getGovernanceKernel: async () => this.capabilityGovernance });
     this.serviceRegistry.register(IPlatformServiceRegistryToken, { getServiceRegistryKernel: async () => this.platformServiceRegistryKernel });
+    this.serviceRegistry.register(IAuthSessionBridgeToken, new AuthSessionBridgeService(this.db));
     this.commandBus.setInterceptor(async (command) => {
       const action = this.actionRegistry.getActionByCommandType(command.type);
       if (action) {
@@ -25069,6 +25146,12 @@ data: ${JSON.stringify({ error: msg })}
       5e3
     );
     const status = typeof response.status === "number" && response.status >= 100 && response.status <= 599 ? response.status : 200;
+    if (response.sessionToken && typeof response.sessionToken === "string" && response.sessionToken.startsWith("token_")) {
+      const isSecure = req.secure || req.headers["x-forwarded-proto"] === "https" || process.env.NODE_ENV === "production" && process.env.ENABLE_HTTPS === "true";
+      const secureFlag = isSecure ? "; Secure" : "";
+      const sameSite = isSecure ? "SameSite=None" : "SameSite=Lax";
+      res.setHeader("Set-Cookie", `edu_os_token=${response.sessionToken}; Path=/; HttpOnly; ${sameSite}; Max-Age=604800${secureFlag}`);
+    }
     if (response.headers && typeof response.headers === "object") {
       for (const [k, v] of Object.entries(response.headers)) {
         const lowerKey = k.toLowerCase();
@@ -25077,10 +25160,10 @@ data: ${JSON.stringify({ error: msg })}
         }
       }
     }
-    if (res.getHeader("content-type") === void 0) {
+    if (res.getHeader("content-type") === void 0 && response.body !== void 0 && response.body !== null) {
       res.setHeader("content-type", "application/json; charset=utf-8");
     }
-    res.status(status).send(response.body);
+    res.status(status).send(response.body !== void 0 ? response.body : "");
   } catch (err) {
     if (err.name === "GatewayTimeoutError" || err.message?.includes("timed out")) {
       res.status(504).json({ success: false, error: "Gateway Timeout: Plugin did not respond in time" });
@@ -25752,8 +25835,11 @@ async function startServer() {
   kernelContainer.pluginHost.setExpressApp(app);
   const PORT = parseInt(process.env.PORT || "9000", 10);
   app.set("trust proxy", 1);
-  const frameAllowedOrigins = process.env.ALLOWED_FRAME_ORIGINS ? process.env.ALLOWED_FRAME_ORIGINS.split(",").map((s) => s.trim()) : ["http://localhost:*", "http://127.0.0.1:*"];
+  const frameAllowedOrigins = process.env.ALLOWED_FRAME_ORIGINS ? process.env.ALLOWED_FRAME_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : ["http://localhost:*", "http://127.0.0.1:*"];
+  const ltiAllowedOrigins = process.env.LTI_ALLOWED_LMS_ORIGINS ? process.env.LTI_ALLOWED_LMS_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
   app.use((0, import_helmet.default)({
+    // SEC-LTI: 若配置了允许嵌入的 LMS 平台域名，禁用全局 X-Frame-Options，由 CSP frame-ancestors 严格精细化管控
+    xFrameOptions: ltiAllowedOrigins.length > 0 ? false : { action: "sameorigin" },
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
@@ -25765,6 +25851,7 @@ async function startServer() {
         fontSrc: ["'self'", "data:", "https://fonts.gstatic.com"],
         // 移除通配 http: 和 https:，限制 iframe 仅能加载本地、沙箱或受信任课件源
         frameSrc: ["'self'", "blob:", "data:", ...frameAllowedOrigins],
+        frameAncestors: ltiAllowedOrigins.length > 0 ? ["'self'", ...ltiAllowedOrigins] : ["'self'"],
         objectSrc: ["'none'"],
         baseUri: ["'self'"]
       }
@@ -25772,10 +25859,10 @@ async function startServer() {
     crossOriginOpenerPolicy: false,
     crossOriginEmbedderPolicy: false,
     crossOriginResourcePolicy: { policy: "cross-origin" },
-    // 允许沙箱 iframe（opaque origin）加载静态资?
+    // 允许沙箱 iframe（opaque origin）加载静态资源
     originAgentCluster: false,
     strictTransportSecurity: false
-    // �? HTTP 部署，禁�? HSTS（否则浏览器缓存后强�? HTTPS，导�? ERR_CONNECTION_REFUSED�?
+    // 针对 HTTP 部署，禁用 HSTS（否则浏览器缓存后强制 HTTPS，导致 ERR_CONNECTION_REFUSED）
   }));
   const loginLimiter = (0, import_express_rate_limit.default)({
     windowMs: 60 * 1e3,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "openlearn-next",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "private": false,
   "description": "A plugin-driven Educational OS / LMS platform with AI agent teaching assistant",
   "keywords": [
@@ -43,22 +43,8 @@
     "node": ">=20.0.0",
     "pnpm": ">=9.0.0"
   },
-  "scripts": {
-    "dev": "npx tsx --no-cache server.ts",
-    "build": "vite build && node scripts/build-plugins.mjs && esbuild server.ts --bundle --platform=node --format=cjs --packages=external --sourcemap --outfile=dist/server.cjs",
-    "start": "node dist/server.cjs",
-    "preview": "vite preview",
-    "clean": "rm -rf dist server.js",
-    "lint": "tsc --noEmit",
-    "lint:eslint": "eslint . --ext .ts,.tsx --ignore-pattern dist --ignore-pattern node_modules",
-    "format": "prettier --write .",
-    "test": "vitest run",
-    "db:backup": "npx tsx scripts/backup-db.ts",
-    "db:reset": "rm -f packages/core/db/educational_os.db* && echo \"✓ Database deleted. Run pnpm dev to regenerate.\""
-  },
   "dependencies": {
     "@google/genai": "^2.4.0",
-    "@openlearn/plugin-sdk": "3.6.0",
     "@types/reveal.js": "^5.2.2",
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^12.11.1",
@@ -91,7 +77,8 @@
     "xlsx": "^0.18.5",
     "xss": "^1.0.15",
     "zod": "^4.4.3",
-    "zustand": "^5.0.14"
+    "zustand": "^5.0.14",
+    "@openlearn/plugin-sdk": "3.6.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
@@ -121,5 +108,18 @@
     "tsx": "^4.21.0",
     "typescript": "~5.8.2",
     "vitest": "^4.1.9"
+  },
+  "scripts": {
+    "dev": "npx tsx --no-cache server.ts",
+    "build": "vite build && node scripts/build-plugins.mjs && esbuild server.ts --bundle --platform=node --format=cjs --packages=external --sourcemap --outfile=dist/server.cjs",
+    "start": "node dist/server.cjs",
+    "preview": "vite preview",
+    "clean": "rm -rf dist server.js",
+    "lint": "tsc --noEmit",
+    "lint:eslint": "eslint . --ext .ts,.tsx --ignore-pattern dist --ignore-pattern node_modules",
+    "format": "prettier --write .",
+    "test": "vitest run",
+    "db:backup": "npx tsx scripts/backup-db.ts",
+    "db:reset": "rm -f packages/core/db/educational_os.db* && echo \"✓ Database deleted. Run pnpm dev to regenerate.\""
   }
-}
+}