openyida 2026.7.13 → 2026.7.14-2

package/lib/auth/token-auth.js

@@ -0,0 +1,346 @@
+'use strict';
+
+const http = require('http');
+const https = require('https');
+
+const {
+  DINGTALK_OAUTH_CLIENT_ID,
+  DINGTALK_LOGIN_ORIGIN,
+  DINGTALK_INTL_LOGIN_ORIGIN,
+  getCurrentEnvConfig,
+  normalizeBaseUrl,
+} = require('../core/env-manager');
+const { runDingtalkLoopback } = require('./oauth-loopback');
+const {
+  clearTokenSession,
+  isAccessTokenUsable,
+  loadTokenSession,
+  maskToken,
+  saveTokenSession,
+} = require('./token-store');
+
+const DEFAULT_AUTH_PATH_PREFIX = '/openapi/cli/v1/auth';
+
+function stripTrailingSlash(value) {
+  return String(value || '').replace(/\/+$/, '');
+}
+
+function appendPath(baseUrl, path) {
+  return `${stripTrailingSlash(baseUrl)}${path.startsWith('/') ? path : `/${path}`}`;
+}
+
+function getArgEndpoint(options = {}) {
+  return options.endpoint ||
+    null;
+}
+
+function resolveTokenBaseUrl(options = {}) {
+  const explicitEndpoint = getArgEndpoint(options);
+  if (explicitEndpoint) {
+    const baseUrl = normalizeBaseUrl(explicitEndpoint, null);
+    if (!baseUrl) {
+      throw new Error('invalid base_url: pass a valid --endpoint value');
+    }
+    return baseUrl;
+  }
+
+  const { config } = getCurrentEnvConfig(options.projectRoot);
+  const baseUrl = normalizeBaseUrl(process.env.OPENYIDA_ENDPOINT || config.baseUrl, null);
+  if (!baseUrl) {
+    throw new Error('missing base_url: pass --endpoint or set OPENYIDA_ENDPOINT');
+  }
+  return baseUrl;
+}
+
+function resolveDingtalkLoginOrigin(options = {}) {
+  if (options.loginOrigin) {
+    return options.loginOrigin;
+  }
+  try {
+    const { config } = getCurrentEnvConfig(options.projectRoot);
+    const baseUrl = normalizeBaseUrl(config.baseUrl, '');
+    if (baseUrl && baseUrl.includes('yidaapps.com')) {
+      return DINGTALK_INTL_LOGIN_ORIGIN;
+    }
+  } catch {
+    // Fall back to domestic DingTalk login.
+  }
+  return DINGTALK_LOGIN_ORIGIN;
+}
+
+function requestJson(method, url, body, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new URL(url);
+    const data = body === undefined || body === null ? null : Buffer.from(JSON.stringify(body));
+    const transport = parsedUrl.protocol === 'https:' ? https : http;
+    const request = transport.request({
+      method,
+      protocol: parsedUrl.protocol,
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port,
+      path: `${parsedUrl.pathname}${parsedUrl.search}`,
+      headers: {
+        accept: 'application/json',
+        ...headers,
+        ...(data ? {
+          'content-type': 'application/json',
+          'content-length': data.length,
+        } : {}),
+      },
+    }, (response) => {
+      const chunks = [];
+      response.on('data', (chunk) => chunks.push(chunk));
+      response.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let payload = null;
+        if (text) {
+          try {
+            payload = JSON.parse(text);
+          } catch {
+            payload = { raw: text };
+          }
+        }
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+          const location = response.headers && response.headers.location;
+          const message = payload && payload.message
+            ? payload.message
+            : `http_${response.statusCode}${location ? `: ${location}` : ''}`;
+          const error = new Error(message);
+          error.statusCode = response.statusCode;
+          error.payload = payload;
+          error.headers = response.headers;
+          error.location = location;
+          reject(error);
+          return;
+        }
+        resolve(payload || {});
+      });
+    });
+
+    request.on('error', reject);
+    if (data) {
+      request.write(data);
+    }
+    request.end();
+  });
+}
+
+function sanitizeRawTokenResponse(response) {
+  if (!response || typeof response !== 'object') {
+    return response;
+  }
+  const clone = Array.isArray(response) ? [...response] : { ...response };
+  delete clone.ai_app_user_auth_token;
+  delete clone.aiAppUserAuthToken;
+  delete clone.tianshu_csrf_token;
+  delete clone.tianshuCsrfToken;
+  delete clone.csrf_token;
+  delete clone.csrfToken;
+  delete clone.access_token;
+  delete clone.accessToken;
+  delete clone.refresh_token;
+  delete clone.refreshToken;
+  if (clone.data && typeof clone.data === 'object') {
+    clone.data = sanitizeRawTokenResponse(clone.data);
+  }
+  if (clone.content && typeof clone.content === 'object') {
+    clone.content = sanitizeRawTokenResponse(clone.content);
+  }
+  return clone;
+}
+
+function getTokenPayload(response) {
+  if (!response || typeof response !== 'object') {
+    return response || {};
+  }
+  return response.data || response.content || response;
+}
+
+function normalizeTokenResponse(response, baseUrl, clientId) {
+  const data = getTokenPayload(response);
+  return {
+    auth_mode: 'token',
+    status: data.status || 'ok',
+    can_auto_use: true,
+    message: data.message || data.errorMsg || response.errorMsg,
+    token_type: data.token_type || data.tokenType || 'Bearer',
+    access_token: data.access_token || data.accessToken,
+    refresh_token: data.refresh_token || data.refreshToken,
+    expires_in: data.expires_in || data.expiresIn,
+    expires_at: data.expires_at || data.expiresAt,
+    base_url: baseUrl,
+    client_id: data.client_id || data.clientId || clientId,
+    corp_id: data.corp_id || data.corpId,
+    user_id: data.user_id || data.userId,
+    user_name: data.user_name || data.userName,
+    open_user_id: data.open_user_id || data.openUserId,
+    scope: data.scope,
+    raw: sanitizeRawTokenResponse(response),
+  };
+}
+
+function requireOkResponse(response) {
+  const data = getTokenPayload(response);
+  const status = data.status || data.code || response.status || response.code;
+  if (typeof status === 'string' && status.startsWith('need_')) {
+    return;
+  }
+  if (status && status !== 'ok' && status !== 'success' && status !== true && status !== 200) {
+    const error = new Error(data.message || data.error || response.message || response.error || String(status));
+    error.payload = response;
+    throw error;
+  }
+  if (response && response.success === false) {
+    const error = new Error(response.errorMsg || response.message || 'request_failed');
+    error.payload = response;
+    throw error;
+  }
+}
+
+async function tokenLogin(options = {}) {
+  const baseUrl = resolveTokenBaseUrl(options);
+  const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
+  const clientId = options.clientId || process.env.OPENYIDA_DINGTALK_CLIENT_ID || DINGTALK_OAUTH_CLIENT_ID;
+  const callback = await runDingtalkLoopback({
+    clientId,
+    loginOrigin: resolveDingtalkLoginOrigin(options),
+    scope: options.scope || process.env.OPENYIDA_DINGTALK_SCOPE || 'openid corpid',
+    prompt: options.prompt,
+    port: options.port,
+    quiet: options.quiet,
+    timeoutMs: options.timeoutMs,
+  });
+
+  const response = await requestJson('POST', appendPath(authBaseUrl, '/dingtalk/token'), {
+    code: callback.code,
+    authCode: callback.authCode,
+    redirectUri: callback.redirectUri,
+    state: callback.state,
+    clientId,
+  });
+  requireOkResponse(response);
+
+  const normalized = normalizeTokenResponse(response, baseUrl, clientId);
+  if (!normalized.access_token) {
+    return {
+      ...normalized,
+      ok: false,
+      status: 'token_not_issued',
+      can_auto_use: false,
+      message: 'auth service did not return access_token',
+    };
+  }
+  return saveTokenSession(normalized, options);
+}
+
+function tokenStatus(options = {}) {
+  const session = loadTokenSession(options);
+  if (!session || !session.access_token) {
+    return {
+      ok: false,
+      auth_mode: 'token',
+      status: 'not_logged_in',
+      can_auto_use: false,
+      token_file: require('./token-store').getTokenFilePath(options),
+    };
+  }
+  const usable = isAccessTokenUsable(session);
+  return {
+    ok: usable,
+    auth_mode: 'token',
+    status: usable ? 'ok' : 'expired',
+    can_auto_use: usable,
+    token_type: session.token_type,
+    access_token: maskToken(session.access_token),
+    refresh_token: maskToken(session.refresh_token),
+    expires_at: session.expires_at ? new Date(session.expires_at).toISOString() : undefined,
+    base_url: session.base_url,
+    corp_id: session.corp_id,
+    user_id: session.user_id,
+    user_name: session.user_name,
+  };
+}
+
+async function tokenRefresh(options = {}) {
+  const session = loadTokenSession(options);
+  if (!session || !session.refresh_token) {
+    return {
+      ok: false,
+      auth_mode: 'token',
+      status: 'missing_refresh_token',
+      can_auto_use: false,
+    };
+  }
+
+  const baseUrl = normalizeBaseUrl(options.endpoint || options.baseUrl || session.base_url, null) ||
+    resolveTokenBaseUrl(options);
+  const authBaseUrl = appendPath(baseUrl, DEFAULT_AUTH_PATH_PREFIX);
+  const clientId = options.clientId || session.client_id || DINGTALK_OAUTH_CLIENT_ID;
+  const response = await requestJson('POST', appendPath(authBaseUrl, '/refresh'), {
+    refreshToken: session.refresh_token,
+    clientId,
+  });
+  requireOkResponse(response);
+  const data = getTokenPayload(response);
+  const normalized = normalizeTokenResponse({
+    ...data,
+    corp_id: data.corp_id || data.corpId || session.corp_id,
+    user_id: data.user_id || data.userId || session.user_id,
+    user_name: data.user_name || data.userName || session.user_name,
+    refresh_token: data.refresh_token || data.refreshToken || session.refresh_token,
+  }, baseUrl, clientId);
+  if (!normalized.access_token) {
+    return {
+      ...normalized,
+      ok: false,
+      status: 'token_not_issued',
+      can_auto_use: false,
+      message: normalized.message || 'auth service did not return access_token',
+    };
+  }
+  return saveTokenSession(normalized, options);
+}
+
+async function tokenLogout(options = {}) {
+  const session = loadTokenSession(options);
+  if (session && session.refresh_token && session.base_url) {
+    try {
+      await requestJson('POST', appendPath(appendPath(session.base_url, DEFAULT_AUTH_PATH_PREFIX), '/logout'), {
+        refreshToken: session.refresh_token,
+      }, session.access_token ? {
+        authorization: `${session.token_type || 'Bearer'} ${session.access_token}`,
+      } : {});
+    } catch {
+      // Local logout should still clear the credential cache.
+    }
+  }
+  clearTokenSession(options);
+  return {
+    ok: true,
+    auth_mode: 'token',
+    status: 'logged_out',
+    can_auto_use: false,
+  };
+}
+
+async function getAccessToken(options = {}) {
+  let session = loadTokenSession(options);
+  if (isAccessTokenUsable(session, options.skewMs)) {
+    return session.access_token;
+  }
+  if (session && session.refresh_token) {
+    session = await tokenRefresh(options);
+    return session.access_token;
+  }
+  throw new Error('not_logged_in');
+}
+
+module.exports = {
+  tokenLogin,
+  tokenStatus,
+  tokenRefresh,
+  tokenLogout,
+  getAccessToken,
+  requestJson,
+  resolveTokenBaseUrl,
+};

package/lib/auth/token-store.js

@@ -0,0 +1,174 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const TOKEN_FILE_PREFIX = 'auth-token';
+
+function sanitizeEnvName(envName) {
+  return String(envName || 'public').replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+
+function resolveProjectRoot(options = {}) {
+  if (options.projectRoot) {
+    return options.projectRoot;
+  }
+  const { findProjectRoot } = require('../core/utils');
+  return findProjectRoot();
+}
+
+function resolveEnvName(options = {}) {
+  if (options.envName) {
+    return sanitizeEnvName(options.envName);
+  }
+  try {
+    const { getCurrentEnvConfig, resolveEnvNameAlias } = require('../core/env-manager');
+    const { name } = getCurrentEnvConfig(resolveProjectRoot(options));
+    return sanitizeEnvName(resolveEnvNameAlias(name || process.env.OPENYIDA_ENV || 'public'));
+  } catch {
+    return sanitizeEnvName(process.env.OPENYIDA_ENV || 'public');
+  }
+}
+
+function getTokenFilePath(options = {}) {
+  const root = resolveProjectRoot(options);
+  const envName = resolveEnvName(options);
+  return path.join(root, '.cache', `${TOKEN_FILE_PREFIX}-${envName}.json`);
+}
+
+function normalizeBaseUrl(value) {
+  if (!value) {
+    return undefined;
+  }
+  try {
+    return new URL(String(value)).origin.replace(/\/+$/, '');
+  } catch {
+    return undefined;
+  }
+}
+
+function normalizeExpiresAt(session) {
+  if (!session) {
+    return undefined;
+  }
+  if (session.expires_at) {
+    const value = typeof session.expires_at === 'number'
+      ? session.expires_at
+      : Date.parse(session.expires_at);
+    return Number.isFinite(value) ? value : undefined;
+  }
+  if (session.expiresAt) {
+    const value = typeof session.expiresAt === 'number'
+      ? session.expiresAt
+      : Date.parse(session.expiresAt);
+    return Number.isFinite(value) ? value : undefined;
+  }
+  if (session.expires_in || session.expiresIn) {
+    const seconds = Number(session.expires_in || session.expiresIn);
+    if (Number.isFinite(seconds) && seconds > 0) {
+      return Date.now() + seconds * 1000;
+    }
+  }
+  return undefined;
+}
+
+function normalizeTokenSession(session = {}) {
+  const expiresAt = normalizeExpiresAt(session);
+  const baseUrl = normalizeBaseUrl(
+    session.base_url ||
+    session.baseUrl ||
+    session.token_endpoint ||
+    session.tokenEndpoint
+  );
+  const normalized = {
+    auth_mode: 'token',
+    token_type: session.token_type || session.tokenType || 'Bearer',
+    access_token: session.access_token || session.accessToken,
+    refresh_token: session.refresh_token || session.refreshToken,
+    expires_at: expiresAt,
+    issued_at: session.issued_at || session.issuedAt || new Date().toISOString(),
+    base_url: baseUrl,
+    client_id: session.client_id || session.clientId,
+    corp_id: session.corp_id || session.corpId,
+    user_id: session.user_id || session.userId,
+    user_name: session.user_name || session.userName,
+    open_user_id: session.open_user_id || session.openUserId,
+    scope: session.scope,
+    raw: session.raw,
+  };
+
+  Object.keys(normalized).forEach((key) => {
+    if (normalized[key] === undefined || normalized[key] === null || normalized[key] === '') {
+      delete normalized[key];
+    }
+  });
+  return normalized;
+}
+
+function saveTokenSession(session, options = {}) {
+  const tokenFile = getTokenFilePath(options);
+  const normalized = normalizeTokenSession(session);
+  fs.mkdirSync(path.dirname(tokenFile), { recursive: true });
+  fs.writeFileSync(tokenFile, JSON.stringify(normalized, null, 2), { mode: 0o600 });
+  try {
+    fs.chmodSync(tokenFile, 0o600);
+  } catch {
+    // chmod is best-effort on non-POSIX filesystems.
+  }
+  return normalized;
+}
+
+function loadTokenSession(options = {}) {
+  const tokenFile = getTokenFilePath(options);
+  if (!fs.existsSync(tokenFile)) {
+    return null;
+  }
+  try {
+    return normalizeTokenSession(JSON.parse(fs.readFileSync(tokenFile, 'utf8')));
+  } catch {
+    return null;
+  }
+}
+
+function clearTokenSession(options = {}) {
+  const tokenFile = getTokenFilePath(options);
+  try {
+    if (fs.existsSync(tokenFile)) {
+      fs.unlinkSync(tokenFile);
+    }
+  } catch {
+    // Logout should remain idempotent.
+  }
+}
+
+function isAccessTokenUsable(session, skewMs = 60 * 1000) {
+  if (!session || !session.access_token) {
+    return false;
+  }
+  if (!session.expires_at) {
+    return true;
+  }
+  return Number(session.expires_at) > Date.now() + skewMs;
+}
+
+function maskToken(token) {
+  if (!token) {
+    return undefined;
+  }
+  const value = String(token);
+  if (value.length <= 16) {
+    return `${value.slice(0, 4)}...`;
+  }
+  return `${value.slice(0, 8)}...${value.slice(-6)}`;
+}
+
+module.exports = {
+  getTokenFilePath,
+  loadTokenSession,
+  saveTokenSession,
+  clearTokenSession,
+  normalizeTokenSession,
+  isAccessTokenUsable,
+  maskToken,
+  resolveEnvName,
+};

package/lib/basic-info/basic-info.js

@@ -1,10 +1,9 @@
 'use strict';
 
 const {
-  loadCookieData,
+  loadAuthData,
   triggerLogin,
   resolveBaseUrl,
-  extractInfoFromCookies,
 } = require('../core/utils');
 const { createYidaClient } = require('../core/yida-client');
 
@@ -128,24 +127,24 @@ async function requestPost(authRef, path, params = {}, actionName = path) {
 }
 
 async function loadAuth() {
-  let cookieData = loadCookieData();
-  if (!cookieData) {
-    cookieData = await triggerLogin();
+  let authData = loadAuthData();
+  if (!authData) {
+    authData = await triggerLogin();
   }
 
-  const cookieInfo = extractInfoFromCookies(cookieData.cookies || []);
-  const csrfToken = cookieData.csrf_token || cookieInfo.csrfToken;
+  const csrfToken = authData.csrf_token;
   if (!csrfToken) {
     throw new Error('Missing csrf token. Please run openyida login again.');
   }
 
   return {
-    cookieData,
-    cookies: cookieData.cookies || [],
+    authData,
     csrfToken,
-    corpId: cookieInfo.corpId,
-    userId: cookieInfo.userId,
-    baseUrl: resolveBaseUrl(cookieData),
+    corpId: authData.corp_id || '',
+    userId: authData.user_id || '',
+    baseUrl: resolveBaseUrl(authData),
+    authMode: authData.auth_mode || '',
+    authSource: authData.auth_source || '',
   };
 }
 

package/lib/bridge/bridge.js

@@ -23,16 +23,18 @@ const SAFE_DIAGNOSTIC_KEYS = [
   'currentEnv',
   'projectRootExists',
   'hasConfig',
-  'cookieFileFound',
-  'usedLegacyCookieFile',
   'cache_readable',
-  'cookies_array_found',
-  'csrf_token_found',
+  'cacheReadable',
+  'tokenFileFound',
+  'tokenFound',
   'corp_id_found',
+  'corpIdFound',
   'user_id_found',
+  'userIdFound',
   'base_url_found',
+  'baseUrlFound',
   'failure_reason',
-  'cookies_count',
+  'failureReason',
 ];
 
 function printUsage() {
@@ -511,11 +513,11 @@ function sanitizeLoginResult(result = {}) {
   return {
     status,
     canAutoUse: !!(result.can_auto_use || result.canAutoUse),
-    loggedIn: status === 'ok' || !!result.csrf_token,
+    loggedIn: status === 'ok',
+    authMode: result.auth_mode || result.authMode,
     baseUrlOrigin: originFromUrl(result.base_url || result.baseUrl),
     corpId: maskId(result.corp_id || result.corpId),
     userId: maskId(result.user_id || result.userId),
-    cookiesCount: result.cookies_count || (Array.isArray(result.cookies) ? result.cookies.length : undefined),
     diagnostics: sanitizeDiagnostics(result.diagnostics || {}),
     message: result.message ? String(result.message).slice(0, 300) : undefined,
   };
@@ -549,9 +551,6 @@ function getBridgeInfo(state) {
     capabilities: [
       'pair',
       'login.check',
-      'login.start',
-      'login.poll',
-      'login.select-corp',
       'feedback.url',
       'openyida.app-list',
       'openyida.create-app',
@@ -560,32 +559,35 @@ function getBridgeInfo(state) {
 }
 
 function defaultCheckLogin() {
-  const { checkLoginOnly } = require('../auth/login');
-  return checkLoginOnly({ includeSecrets: false });
+  const { tokenStatus } = require('../auth/token-auth');
+  return tokenStatus({ includeSecrets: false });
 }
 
 async function defaultStartLogin(body = {}) {
-  const { startCodexQrLogin } = require('../auth/qr-login');
-  return startCodexQrLogin({
-    corpId: body.corpId || body.corp_id,
-    autoOpenImage: false,
-  });
+  return {
+    status: 'token_login_required',
+    auth_mode: 'token',
+    can_auto_use: false,
+    message: 'Token-only auth does not support bridge QR login. Run openyida login first.',
+  };
 }
 
 async function defaultPollLogin(sessionFile, body = {}) {
-  const { pollCodexQrLogin } = require('../auth/qr-login');
-  return pollCodexQrLogin(sessionFile, {
-    corpId: body.corpId || body.corp_id,
-    maxAttempts: 1,
-    pollIntervalMs: 0,
-  });
+  return {
+    status: 'token_login_required',
+    auth_mode: 'token',
+    can_auto_use: false,
+    message: 'Token-only auth does not support bridge QR polling. Run openyida login first.',
+  };
 }
 
 async function defaultSelectCorp(sessionFile, body = {}) {
-  const { selectCodexQrCorp } = require('../auth/qr-login');
-  return selectCodexQrCorp(sessionFile, {
-    corpId: body.corpId || body.corp_id,
-  });
+  return {
+    status: 'token_login_required',
+    auth_mode: 'token',
+    can_auto_use: false,
+    message: 'Token-only auth does not support bridge organization selection.',
+  };
 }
 
 function defaultReadFeedbackConfig(configPath) {

package/lib/connector/api.js

@@ -13,7 +13,7 @@ const { createAuthRef, createYidaClient } = require('../core/yida-client');
 
 /**
  * 获取当前登录态，未登录则触发登录
- * @returns {{ csrfToken: string, cookies: Array, baseUrl: string, cookieData: object }}
+ * @returns {{ csrfToken: string, baseUrl: string, authData: object }}
  */
 function getAuthRef() {
   return createAuthRef();
@@ -80,15 +80,15 @@ function buildOperationsSummary(operations) {
  * 构建连接器描述（包含 openyida 元数据）
  * @param {string|null} userDesc - 用户自定义描述（可选）
  * @param {string|null} originalDesc - 原有描述（用于提取创建信息）
- * @param {object} authRef - 鉴权信息（含 cookieData）
+ * @param {object} authRef - 鉴权信息（含 authData）
  * @param {Array|null} operations - 当前所有动作列表
  * @returns {string}
  */
 function buildConnectorDesc(userDesc, originalDesc, authRef, operations) {
   const now = new Date();
   const updateTime = now.toLocaleString('zh-CN');
-  const currentUserId = authRef.cookieData && authRef.cookieData.user_id
-    ? authRef.cookieData.user_id
+  const currentUserId = authRef.userId || (authRef.authData && authRef.authData.user_id)
+    ? authRef.userId || authRef.authData.user_id
     : '';
 
   let createTime = updateTime;