openyida 2026.7.19 → 2026.7.21

package/lib/core/utils.js

@@ -3,10 +3,14 @@
  *
  * 导出函数：
  *   findProjectRoot()         - 查找项目根目录（兼容悟空环境）
- *   loadAuthData()            - 读取 token 登录态缓存
+ *   extractInfoFromCookies()  - 从 Cookie 列表中提取 csrf_token / corp_id / user_id
+ *   loadCookieData()          - 已废弃：默认登录态不再读取 Cookie 缓存
+ *   getAuthStatus()           - 读取当前鉴权模式的安全状态摘要
  *   triggerLogin()            - 触发登录
- *   resolveBaseUrl()          - 从 authData 中解析 base_url
+ *   refreshCsrfToken()        - 刷新 csrf_token
+ *   resolveBaseUrl()          - 从 cookieData 中解析 base_url
  *   isLoginExpired()          - 检测响应体是否表示登录过期
+ *   isCsrfTokenExpired()      - 检测响应体是否表示 csrf_token 过期
  */
 
 'use strict';
@@ -150,9 +154,6 @@ function detectActiveTool() {
 }
 
 function hasDesktopEnvironment(env = process.env, platform = process.platform) {
-  if (env.OPENYIDA_FORCE_TERMINAL_QR === '1') {
-    return false;
-  }
   if (env.OPENYIDA_ASSUME_DESKTOP === '1') {
     return true;
   }
@@ -256,15 +257,16 @@ function getNodeExecutable() {
   return 'node';
 }
 
-function isInjectedAuthMode() {
-  return false;
+function isInjectedAuthMode(env = process.env) {
+  const authEnabled = String(env.YIDA_AUTH_ENABLED || '').trim().toLowerCase();
+  return ['1', 'true', 'yes', 'on'].includes(authEnabled);
 }
 
-function isEnvAuthMode() {
-  return false;
+function isEnvAuthMode(env = process.env) {
+  return isInjectedAuthMode(env);
 }
 
-function isTokenAuthMode() {
+function isTokenAuthMode(_env = process.env) {
   return true;
 }
 
@@ -329,9 +331,6 @@ function resolveTokenBaseUrl(root, fallbackBaseUrl, session) {
 }
 
 function loadTokenAuthData(projectRoot, defaultBaseUrl) {
-  if (!isTokenAuthMode()) {
-    return null;
-  }
   try {
     const { loadTokenSession } = require('../auth/token-store');
     const session = loadTokenSession({ projectRoot });
@@ -342,7 +341,7 @@ function loadTokenAuthData(projectRoot, defaultBaseUrl) {
       corp_id: session.corp_id,
       user_id: session.user_id,
       base_url: resolveTokenBaseUrl(projectRoot, defaultBaseUrl, session),
-      auth_source: 'token',
+      auth_source: session.auth_source === 'env' ? 'env' : 'token',
       auth_mode: 'token',
     };
   } catch {
@@ -364,10 +363,115 @@ async function resolveBearerAuthHeaders(options = {}) {
   };
 }
 
+// ── Cookie 解析 ───────────────────────────────────────
+
+const CSRF_COOKIE_NAMES = new Set([
+  'tianshu_csrf_token',
+  'china_csrf_token',
+  'csrf_token',
+  '_csrf_token',
+]);
+
+/**
+ * 从 Cookie 列表中提取 csrf_token、corp_id、user_id。
+ *
+ * 国内宜搭（aliwork.com）：corpId/userId 合并写在 `tianshu_corp_user` 里，
+ * 形如 `${corpId}_${userId}`，按最后一个下划线切分。
+ *
+ * 海外 YiDA（yidaapps.com）：不写 `tianshu_corp_user`，而是单独写 `corp_id` cookie
+ * 存放 corpId 明文；userId 加密在 `pub_uid` 里客户端无法解密，留 null 接受。
+ *
+ * @param {Array} cookies
+ * @returns {{ csrfToken: string|null, corpId: string|null, userId: string|null }}
+ */
+function extractInfoFromCookies(cookies) {
+  let csrfToken = null;
+  let corpId = null;
+  let userId = null;
+  const cookieList = Array.isArray(cookies) ? cookies : [];
+
+  for (const cookie of cookieList) {
+    if (cookie && CSRF_COOKIE_NAMES.has(cookie.name) && cookie.value && !csrfToken) {
+      csrfToken = cookie.value;
+    } else if (cookie && cookie.name === 'tianshu_corp_user') {
+      const lastUnderscore = cookie.value.lastIndexOf('_');
+      if (lastUnderscore > 0) {
+        corpId = cookie.value.slice(0, lastUnderscore);
+        userId = cookie.value.slice(lastUnderscore + 1);
+      }
+    }
+  }
+
+  if (!corpId) {
+    const corpCookie = cookieList.find((c) => c && ['corp_id', 'corpId'].includes(c.name) && c.value);
+    if (corpCookie) {
+      corpId = corpCookie.value;
+    }
+  }
+
+  if (!userId) {
+    const userCookie = cookieList.find((c) => c && ['user_id', 'userId', 'staffId'].includes(c.name) && c.value);
+    if (userCookie) {
+      userId = userCookie.value;
+    }
+  }
+
+  return { csrfToken, corpId, userId };
+}
+
+function parseCookieHeader(rawCookieHeader, options = {}) {
+  const raw = String(rawCookieHeader || '').trim();
+  if (!raw) {
+    return [];
+  }
+  let domain = '';
+  if (options.baseUrl) {
+    try {
+      domain = new URL(options.baseUrl).hostname;
+    } catch {
+      domain = '';
+    }
+  }
+  return raw
+    .split(';')
+    .map((part) => {
+      const trimmed = part.trim();
+      const equalsIndex = trimmed.indexOf('=');
+      if (equalsIndex <= 0) {
+        return null;
+      }
+      const name = trimmed.slice(0, equalsIndex).trim();
+      const value = trimmed.slice(equalsIndex + 1).trim();
+      if (!name) {
+        return null;
+      }
+      const cookie = { name, value };
+      if (domain) {
+        cookie.domain = domain;
+      }
+      return cookie;
+    })
+    .filter(Boolean);
+}
+
 // ── 登录态缓存读取 ────────────────────────────────────
 
 /**
- * 读取 token 登录态缓存。
+ * 已废弃：默认登录态不再读取 Cookie。
+ * 保留函数名用于旧测试/显式 mock 兼容；实际登录态只从 token session 读取。
+ * @param {string} [projectRoot]
+ * @param {string} [defaultBaseUrl]
+ * @returns {object|null}
+ */
+function loadCookieData(projectRoot, defaultBaseUrl) {
+  void projectRoot;
+  void defaultBaseUrl;
+  return null;
+}
+
+/**
+ * 读取当前默认登录态。
+ * 默认使用 OAuth token session；YIDA_AUTH_ENABLED=true 时仅使用宿主注入 token。
  * @param {string} [projectRoot]
  * @param {string} [defaultBaseUrl]
  * @returns {object|null}
@@ -378,15 +482,41 @@ function loadAuthData(projectRoot, defaultBaseUrl) {
   return loadTokenAuthData(root, fallbackBaseUrl);
 }
 
+function getAuthStatus(options = {}) {
+  const { tokenStatus } = require('../auth/token-auth');
+  return tokenStatus(options);
+}
+
 // ── 登录触发 ──────────────────────────────────────────
 
 /**
- * 触发登录。
+ * 校验默认登录态；host mode 下不会触发 OAuth，本地模式提示用户执行 openyida login。
  * @param {object} [options]
  * @param {boolean} [options.force=false] - 是否跳过本地缓存，强制重新登录
  * @returns {object} loginResult
  */
 function triggerLogin(options = {}) {
+  if (isEnvAuthMode()) {
+    const status = getAuthStatus({ projectRoot: options.projectRoot || findProjectRoot() });
+    if (status && status.ok) {
+      return loadTokenAuthData(options.projectRoot || findProjectRoot(), status.base_url || 'https://www.aliwork.com');
+    }
+    const reason = status && status.failure_reason
+      ? status.failure_reason
+      : 'env_token_missing';
+    const { CliError } = require('./cli-error');
+    throw new CliError(
+      `not_logged_in: host-injected token is unavailable (${reason}). Ask the host to inject an OpenYida token.`,
+      {
+        code: 'INJECTED_AUTH_REQUIRED',
+        details: {
+          authMode: 'token',
+          failure_reason: reason,
+        },
+      }
+    );
+  }
+
   const tokenAuthData = loadTokenAuthData(options.projectRoot || findProjectRoot(), 'https://www.aliwork.com');
   if (tokenAuthData) {
     return tokenAuthData;
@@ -403,6 +533,15 @@ function triggerLogin(options = {}) {
   );
 }
 
+/**
+ * 已废弃：默认 token 登录态不再刷新 CSRF。
+ * @returns {object} loginResult
+ */
+function refreshCsrfToken() {
+  warn(t('login.csrf_refresh'));
+  return null;
+}
+
 // ── 响应检测 ──────────────────────────────────────────
 
 /**
@@ -412,7 +551,7 @@ function triggerLogin(options = {}) {
  */
 function isLoginExpired(responseJson) {
   if (!responseJson) {return false;}
-  const content = responseJson && typeof responseJson.content === 'object' && !Array.isArray(responseJson.content)
+  const content = responseJson && responseJson.content && typeof responseJson.content === 'object' && !Array.isArray(responseJson.content)
     ? responseJson.content
     : {};
   const status = String(responseJson.status || content.status || '').toLowerCase();
@@ -446,6 +585,19 @@ function isLoginExpired(responseJson) {
   );
 }
 
+/**
+ * 检测响应体是否表示 csrf_token 过期。
+ * @param {object} responseJson
+ * @returns {boolean}
+ */
+function isCsrfTokenExpired(responseJson) {
+  return (
+    responseJson &&
+    responseJson.success === false &&
+    responseJson.errorCode === 'TIANSHU_000030'
+  );
+}
+
 function isHttpRedirectStatus(statusCode) {
   return [301, 302, 303, 307, 308].includes(Number(statusCode));
 }
@@ -457,23 +609,23 @@ function isHttpAuthStatus(statusCode) {
 // ── base_url 解析 ─────────────────────────────────────
 
 /**
- * 从 authData 中解析 base_url，支持多环境配置优先级。
+ * 从 cookieData 中解析 base_url，支持多环境配置优先级。
  *
  * 优先级（高 → 低）：
  *   1. OPENYIDA_ENDPOINT 环境变量
- *   2. authData.base_url（登录后实际跳转域名）
+ *   2. cookieData.base_url（登录后实际跳转域名）
  *   3. 当前激活的私有化环境配置
  *   4. 当前激活的环境配置（公有云默认）
  *   5. defaultBaseUrl 参数 / 公有云兜底
  *
- * @param {object} authData
+ * @param {object} cookieData
  * @param {string} [defaultBaseUrl]
  * @returns {string}
  */
-function resolveBaseUrl(authData, defaultBaseUrl) {
+function resolveBaseUrl(cookieData, defaultBaseUrl) {
   const { resolveEndpoint } = require('./env-manager');
-  const resolved = resolveEndpoint(authData, undefined);
-  if (defaultBaseUrl && resolved === 'https://www.aliwork.com' && (!authData || !authData.base_url)) {
+  const resolved = resolveEndpoint(cookieData, undefined);
+  if (defaultBaseUrl && resolved === 'https://www.aliwork.com' && (!cookieData || !cookieData.base_url)) {
     return defaultBaseUrl.replace(/\/+$/, '');
   }
   return resolved;
@@ -491,19 +643,79 @@ function collectResponseText(res, onEnd) {
   });
 }
 
+function splitRequestAuthArgs(cookiesOrOptions, maybeOptions) {
+  if (Array.isArray(cookiesOrOptions)) {
+    return {
+      cookies: cookiesOrOptions,
+      options: maybeOptions || {},
+    };
+  }
+  return {
+    cookies: [],
+    options: cookiesOrOptions || {},
+  };
+}
+
+function resolveCookieAuthCookies(cookies) {
+  if (Array.isArray(cookies) && cookies.length > 0) {
+    return cookies;
+  }
+  return [];
+}
+
+function buildCookieAuthHeaders(baseUrl, cookies, optionsOverride = {}) {
+  const parsedUrl = new URL(baseUrl);
+  const requestHost = parsedUrl.hostname;
+  const cookieList = resolveCookieAuthCookies(cookies);
+  const filteredCookies = cookieList.filter(c => {
+    const cookieDomain = (c.domain || '').replace(/^\./, '');
+    return !cookieDomain || requestHost === cookieDomain || requestHost.endsWith('.' + cookieDomain);
+  });
+  const effectiveCookies = filteredCookies.length > 0 ? filteredCookies : cookieList;
+  const cookieHeader = effectiveCookies.map((c) => `${c.name}=${c.value}`).join('; ');
+  const { csrfToken } = extractInfoFromCookies(effectiveCookies);
+  const headers = {};
+  if (cookieHeader) {
+    headers.Cookie = cookieHeader;
+  }
+  if (optionsOverride.csrfToken || csrfToken) {
+    headers.global_csrf_token = optionsOverride.csrfToken || csrfToken;
+  }
+  return headers;
+}
+
+async function resolveRequestAuthHeaders(baseUrl, cookies, optionsOverride = {}) {
+  if (Array.isArray(cookies) && cookies.length > 0) {
+    return buildCookieAuthHeaders(baseUrl, cookies, optionsOverride);
+  }
+  const auth = await resolveBearerAuthHeaders(optionsOverride);
+  return auth.headers;
+}
+
+function createNonJsonResponseResult(statusCode, data) {
+  const responseText = data === null || data === undefined ? '' : String(data);
+  return {
+    success: false,
+    errorMsg: `HTTP ${statusCode}: ` + t('common.response_not_json'),
+    __httpStatus: statusCode,
+    __nonJsonResponse: true,
+    __emptyBody: responseText.trim().length === 0,
+  };
+}
+
 /**
  * 发送 HTTP POST 请求（application/x-www-form-urlencoded）
  * @param {string} baseUrl
  * @param {string} requestPath
  * @param {string} postData - querystring 格式
- * @param {object} [optionsOverride]
+ * @param {Array} cookies
  * @returns {Promise<object>}
  */
-async function httpPost(baseUrl, requestPath, postData, optionsOverride = {}) {
+async function httpPost(baseUrl, requestPath, postData, cookiesOrOptions, maybeOptions) {
   const https = require('https');
   const http = require('http');
-
-  const auth = await resolveBearerAuthHeaders(optionsOverride);
+  const { cookies, options: optionsOverride } = splitRequestAuthArgs(cookiesOrOptions, maybeOptions);
+  const authHeaders = await resolveRequestAuthHeaders(baseUrl, cookies, optionsOverride);
   const bodyData = postData === null || postData === undefined ? '' : String(postData);
 
   return new Promise((resolve, reject) => {
@@ -523,9 +735,9 @@ async function httpPost(baseUrl, requestPath, postData, optionsOverride = {}) {
         Origin: baseUrl,
         Referer: optionsOverride.referer || baseUrl + '/',
         'x-requested-with': 'XMLHttpRequest',
-        ...auth.headers,
+        ...authHeaders,
       },
-      timeout: 30000,
+      timeout: optionsOverride.timeout || 30000,
     };
 
     const req = requestModule.request(options, (res) => {
@@ -547,10 +759,16 @@ async function httpPost(baseUrl, requestPath, postData, optionsOverride = {}) {
             resolve({ __needLogin: true });
             return;
           }
+          if (isCsrfTokenExpired(parsed)) {
+            resolve({ __csrfExpired: true });
+            return;
+          }
           resolve(parsed);
         } catch {
-          warn(t('common.http_response', data.substring(0, 500)));
-          resolve({ success: false, errorMsg: `HTTP ${res.statusCode}: ` + t('common.response_not_json') });
+          if (!optionsOverride.silentStatus) {
+            warn(t('common.http_response', data.substring(0, 500)));
+          }
+          resolve(createNonJsonResponseResult(res.statusCode, data));
         }
       });
     });
@@ -568,11 +786,11 @@ async function httpPost(baseUrl, requestPath, postData, optionsOverride = {}) {
   });
 }
 
-async function httpPostJson(baseUrl, requestPath, payload, optionsOverride = {}) {
+async function httpPostJson(baseUrl, requestPath, payload, cookiesOrOptions, maybeOptions) {
   const https = require('https');
   const http = require('http');
-
-  const auth = await resolveBearerAuthHeaders(optionsOverride);
+  const { cookies, options: optionsOverride } = splitRequestAuthArgs(cookiesOrOptions, maybeOptions);
+  const authHeaders = await resolveRequestAuthHeaders(baseUrl, cookies, optionsOverride);
 
   return new Promise((resolve, reject) => {
     const parsedUrl = new URL(baseUrl);
@@ -592,7 +810,7 @@ async function httpPostJson(baseUrl, requestPath, payload, optionsOverride = {})
         Origin: baseUrl,
         Referer: optionsOverride.referer || baseUrl + '/',
         'x-requested-with': 'XMLHttpRequest',
-        ...auth.headers,
+        ...authHeaders,
       },
       timeout: optionsOverride.timeout || 30000,
     };
@@ -616,10 +834,16 @@ async function httpPostJson(baseUrl, requestPath, payload, optionsOverride = {})
             resolve({ __needLogin: true });
             return;
           }
+          if (isCsrfTokenExpired(parsed)) {
+            resolve({ __csrfExpired: true });
+            return;
+          }
           resolve(parsed);
         } catch {
-          warn(t('common.http_response', data.substring(0, 500)));
-          resolve({ success: false, errorMsg: `HTTP ${res.statusCode}: ` + t('common.response_not_json') });
+          if (!optionsOverride.silentStatus) {
+            warn(t('common.http_response', data.substring(0, 500)));
+          }
+          resolve(createNonJsonResponseResult(res.statusCode, data));
         }
       });
     });
@@ -641,15 +865,15 @@ async function httpPostJson(baseUrl, requestPath, payload, optionsOverride = {})
  * @param {string} baseUrl
  * @param {string} requestPath
  * @param {object} queryParams
- * @param {object} [optionsOverride]
+ * @param {Array} cookies
  * @returns {Promise<object>}
  */
-async function httpGet(baseUrl, requestPath, queryParams, optionsOverride = {}) {
+async function httpGet(baseUrl, requestPath, queryParams, cookiesOrOptions, maybeOptions) {
   const https = require('https');
   const http = require('http');
   const querystring = require('querystring');
-
-  const auth = await resolveBearerAuthHeaders(optionsOverride);
+  const { cookies, options: optionsOverride } = splitRequestAuthArgs(cookiesOrOptions, maybeOptions);
+  const authHeaders = await resolveRequestAuthHeaders(baseUrl, cookies, optionsOverride);
 
   return new Promise((resolve, reject) => {
     const parsedUrl = new URL(baseUrl);
@@ -667,9 +891,9 @@ async function httpGet(baseUrl, requestPath, queryParams, optionsOverride = {})
         Origin: baseUrl,
         Referer: baseUrl + '/',
         'x-requested-with': 'XMLHttpRequest',
-        ...auth.headers,
+        ...authHeaders,
       },
-      timeout: 30000,
+      timeout: optionsOverride.timeout || 30000,
     };
 
     const req = requestModule.request(options, (res) => {
@@ -691,10 +915,16 @@ async function httpGet(baseUrl, requestPath, queryParams, optionsOverride = {})
             resolve({ __needLogin: true });
             return;
           }
+          if (isCsrfTokenExpired(parsed)) {
+            resolve({ __csrfExpired: true });
+            return;
+          }
           resolve(parsed);
         } catch {
-          warn(t('common.http_response', data.substring(0, 500)));
-          resolve({ success: false, errorMsg: `HTTP ${res.statusCode}: ` + t('common.response_not_json') });
+          if (!optionsOverride.silentStatus) {
+            warn(t('common.http_response', data.substring(0, 500)));
+          }
+          resolve(createNonJsonResponseResult(res.statusCode, data));
         }
       });
     });
@@ -714,31 +944,16 @@ async function httpGet(baseUrl, requestPath, queryParams, optionsOverride = {})
 /**
  * 带自动重登录的请求封装。
  * @param {Function} requestFn - 接受 authRef 返回 Promise 的工厂函数
- * @param {object} authRef - { baseUrl, authData }
+ * @param {object} authRef - { csrfToken, cookies, baseUrl, cookieData }
  * @returns {Promise<object>}
  */
-function tokenAuthRequiredResult() {
-  return {
-    success: false,
-    __needLogin: true,
-    errorCode: 'TOKEN_AUTH_REQUIRED',
-    errorMsg: 'not_logged_in: token auth is unavailable. Run openyida login first.',
-  };
-}
-
-function tokenRefreshFailedResult(error) {
-  return {
-    success: false,
-    errorCode: 'TOKEN_REFRESH_FAILED',
-    errorMsg: error && error.message
-      ? error.message
-      : 'token_refresh_failed: failed to refresh access token. Please retry later.',
-  };
-}
-
 async function requestWithAutoLogin(requestFn, authRef) {
   const result = await requestFn(authRef);
 
+  if (isExplicitCookieAuthRef(authRef)) {
+    return result;
+  }
+
   if (result && result.__needLogin) {
     const { tokenRefresh, isRefreshAuthRequired } = require('../auth/token-auth');
     try {
@@ -755,8 +970,13 @@ async function requestWithAutoLogin(requestFn, authRef) {
         }
         return tokenRefreshFailedResult(new Error('token_refresh_failed'));
       }
-      const refreshedTokenData = loadTokenAuthData(authRef && authRef.projectRoot, currentBaseUrl);
+      const refreshedTokenData = refreshResult.access_token
+        ? normalizeRefreshedTokenAuthData(refreshResult, currentBaseUrl)
+        : loadTokenAuthData(authRef && authRef.projectRoot, currentBaseUrl);
       if (refreshedTokenData) {
+        if (!authRef) {
+          authRef = {};
+        }
         authRef.authData = refreshedTokenData;
         authRef.baseUrl = resolveBaseUrl(refreshedTokenData);
         authRef.authMode = refreshedTokenData.auth_mode || refreshedTokenData.authMode || '';
@@ -777,14 +997,62 @@ async function requestWithAutoLogin(requestFn, authRef) {
   return result;
 }
 
+function isExplicitCookieAuthRef(authRef) {
+  if (!authRef || !Array.isArray(authRef.cookies) || authRef.cookies.length === 0) {
+    return false;
+  }
+  const authData = authRef.authData || authRef.cookieData || {};
+  const authMode = authRef.authMode || authRef.auth_mode || authData.auth_mode || authData.authMode;
+  const authSource = authRef.authSource || authRef.auth_source || authData.auth_source || authData.authSource;
+  return authMode !== 'token' && authSource !== 'token';
+}
+
+function normalizeRefreshedTokenAuthData(refreshResult, fallbackBaseUrl) {
+  if (!refreshResult || !refreshResult.access_token) {
+    return null;
+  }
+  return {
+    corp_id: refreshResult.corp_id,
+    user_id: refreshResult.user_id,
+    base_url: resolveBaseUrl(refreshResult, fallbackBaseUrl),
+    auth_source: refreshResult.auth_source === 'env' ? 'env' : 'token',
+    auth_mode: 'token',
+  };
+}
+
+function tokenAuthRequiredResult() {
+  return {
+    success: false,
+    __needLogin: true,
+    errorCode: 'TOKEN_AUTH_REQUIRED',
+    errorMsg: 'not_logged_in: token auth is unavailable. Run openyida login first.',
+  };
+}
+
+function tokenRefreshFailedResult(error) {
+  return {
+    success: false,
+    errorCode: 'TOKEN_REFRESH_FAILED',
+    errorMsg: error && error.message
+      ? error.message
+      : 'token_refresh_failed: failed to refresh access token. Please retry later.',
+  };
+}
+
 module.exports = {
   detectActiveTool,
   hasDesktopEnvironment,
   findProjectRoot,
+  extractInfoFromCookies,
+  parseCookieHeader,
+  getAuthStatus,
   loadAuthData,
+  loadCookieData,
   triggerLogin,
+  refreshCsrfToken,
   resolveBaseUrl,
   isLoginExpired,
+  isCsrfTokenExpired,
   httpPost,
   httpPostJson,
   httpGet,