orbit-codex-bridge 0.1.6 → 0.1.8

package/relay-store.mjs

@@ -1,368 +0,0 @@
-import { DatabaseSync } from 'node:sqlite';
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { promisify } from 'node:util';
-
-const scrypt = promisify(crypto.scrypt);
-
-function safeCount(value, { min = 1, max = 100 } = {}) {
-  const number = Number(value);
-  if (!Number.isSafeInteger(number) || number < min || number > max) throw new Error('数量超出允许范围。');
-  return number;
-}
-
-function safeString(value, label, max = 120) {
-  if (typeof value !== 'string') throw new Error(`${label}格式无效。`);
-  const result = value.trim();
-  if (!result || result.length > max || /[\u0000-\u001f\u007f]/.test(result)) throw new Error(`${label}格式无效。`);
-  return result;
-}
-
-function validPassword(value) {
-  if(typeof value!=='string'||value.length<6||value.length>256||/[\u0000-\u001f\u007f]/.test(value))throw new Error('密码需要 6–256 个字符，不能包含控制字符。');
-  return value;
-}
-
-export class RelayStore {
-  constructor(filePath = process.env.ORBIT_RELAY_DB || path.join(os.homedir(), '.orbit', 'relay.sqlite')) {
-    this.filePath = path.resolve(filePath);
-    fs.mkdirSync(path.dirname(this.filePath), { recursive:true });
-    this.db = new DatabaseSync(this.filePath);
-    this.db.exec(`
-      PRAGMA journal_mode=WAL;
-      PRAGMA foreign_keys=ON;
-      PRAGMA busy_timeout=5000;
-      CREATE TABLE IF NOT EXISTS users (
-        id TEXT PRIMARY KEY,
-        username TEXT NOT NULL UNIQUE,
-        display_name TEXT NOT NULL,
-        password_salt TEXT NOT NULL,
-        password_hash TEXT NOT NULL,
-        status TEXT NOT NULL CHECK(status IN ('active','suspended')),
-        plan TEXT NOT NULL,
-        max_devices INTEGER NOT NULL,
-        expires_at INTEGER,
-        created_at INTEGER NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS devices (
-        id TEXT PRIMARY KEY,
-        user_id TEXT NOT NULL REFERENCES users(id),
-        name TEXT NOT NULL,
-        token_hash TEXT NOT NULL UNIQUE,
-        status TEXT NOT NULL CHECK(status IN ('active','revoked')),
-        created_at INTEGER NOT NULL,
-        last_seen INTEGER
-      );
-      CREATE INDEX IF NOT EXISTS devices_by_user ON devices(user_id, created_at);
-      CREATE TABLE IF NOT EXISTS sessions (
-        token_hash TEXT PRIMARY KEY,
-        user_id TEXT REFERENCES users(id),
-        role TEXT NOT NULL CHECK(role IN ('user','admin')),
-        expires_at INTEGER NOT NULL,
-        created_at INTEGER NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS sessions_by_user ON sessions(user_id, expires_at);
-      CREATE TABLE IF NOT EXISTS audit_log (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        actor TEXT NOT NULL,
-        action TEXT NOT NULL,
-        target_id TEXT,
-        details_json TEXT NOT NULL,
-        created_at INTEGER NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS relay_meta (
-        key TEXT PRIMARY KEY,
-        value TEXT NOT NULL
-      );
-    `);
-    this.secureDatabaseFiles();
-  }
-
-  close() { this.db.close(); }
-  tokenHash(token) { return crypto.createHash('sha256').update(token).digest('hex'); }
-
-  secureDatabaseFiles() {
-    if(process.platform==='win32')return;
-    for(const suffix of ['', '-wal', '-shm'])try{fs.chmodSync(`${this.filePath}${suffix}`,0o600)}catch{}
-  }
-
-  syncAdminToken(token) {
-    const current=this.tokenHash(token);
-    const previous=this.db.prepare("SELECT value FROM relay_meta WHERE key='admin_token_hash'").get()?.value;
-    if(previous!==current)this.db.prepare("DELETE FROM sessions WHERE role='admin'").run();
-    this.db.prepare("INSERT INTO relay_meta(key,value) VALUES('admin_token_hash',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(current);
-  }
-
-  async createUser({ username, displayName, password, plan = 'standard', maxDevices = 2, expiresAt = null }, { actor = 'admin', action = 'user.created' } = {}) {
-    username = safeString(username, '用户名', 64).toLowerCase();
-    if (!/^[a-z0-9][a-z0-9._-]{2,63}$/.test(username)) throw new Error('用户名须为 3–64 位，仅可用字母、数字、点、连字符和下划线。');
-    displayName = safeString(displayName || username, '显示名称', 120);
-    password = validPassword(password);
-    plan = safeString(plan, '套餐', 40);
-    maxDevices = safeCount(maxDevices, { min:1, max:50 });
-    if(expiresAt!==null&&(!Number.isSafeInteger(expiresAt)||expiresAt<Date.now()))throw new Error('账号到期时间必须是未来时间。');
-    const salt = crypto.randomBytes(16);
-    const passwordHash = await scrypt(password, salt, 64);
-    const id = crypto.randomUUID();
-    const createdAt = Date.now();
-    try {
-      this.db.prepare(`
-        INSERT INTO users(id,username,display_name,password_salt,password_hash,status,plan,max_devices,expires_at,created_at)
-        VALUES(?,?,?,?,?,'active',?,?,?,?)
-      `).run(id,username,displayName,salt.toString('hex'),passwordHash.toString('hex'),plan,maxDevices,expiresAt,createdAt);
-    } catch (error) {
-      if (error.errcode === 2067) throw Object.assign(new Error('此用户名已被使用，请换一个。'), { status:409 });
-      throw error;
-    }
-    this.audit(actor, action, id, { username, plan, maxDevices });
-    return this.getUser(id);
-  }
-
-  registerUser({ username, displayName, password }) {
-    return this.createUser(
-      { username, displayName, password, plan:'free', maxDevices:1, expiresAt:null },
-      { actor:'registration', action:'user.registered' }
-    );
-  }
-
-  getUser(id) {
-    const row = this.db.prepare('SELECT id,username,display_name AS displayName,status,plan,max_devices AS maxDevices,expires_at AS expiresAt,created_at AS createdAt FROM users WHERE id=?').get(id);
-    return row || null;
-  }
-
-  listUsers({ search = '', status = 'all', page = 1, pageSize = 25 } = {}) {
-    const filters = [];
-    const values = [];
-    const normalizedSearch = String(search).trim();
-    if (normalizedSearch) {
-      const escaped = normalizedSearch.replace(/[\\%_]/g, '\\$&');
-      filters.push("(u.username LIKE ? ESCAPE '\\' OR u.display_name LIKE ? ESCAPE '\\')");
-      values.push(`%${escaped}%`, `%${escaped}%`);
-    }
-    if (status === 'active') {
-      filters.push("u.status='active' AND (u.expires_at IS NULL OR u.expires_at>?)");
-      values.push(Date.now());
-    } else if (status === 'suspended') {
-      filters.push("u.status='suspended'");
-    } else if (status === 'expired') {
-      filters.push("u.status='active' AND u.expires_at IS NOT NULL AND u.expires_at<=?");
-      values.push(Date.now());
-    }
-    const where = filters.length ? `WHERE ${filters.join(' AND ')}` : '';
-    const total = this.db.prepare(`SELECT COUNT(*) AS count FROM users u ${where}`).get(...values).count;
-    const lastPage = Math.max(1, Math.ceil(total / pageSize));
-    const currentPage = Math.min(page, lastPage);
-    const users = this.db.prepare(`
-      SELECT u.id,u.username,u.display_name AS displayName,u.status,u.plan,
-        u.max_devices AS maxDevices,u.expires_at AS expiresAt,u.created_at AS createdAt,
-        COUNT(d.id) AS deviceCount
-      FROM users u LEFT JOIN devices d ON d.user_id=u.id AND d.status='active'
-      ${where}
-      GROUP BY u.id ORDER BY u.created_at DESC LIMIT ? OFFSET ?
-    `).all(...values, pageSize, (currentPage - 1) * pageSize);
-    return { users, total, page:currentPage, pageSize };
-  }
-
-  listDevicesForUsers(userIds) {
-    if (!userIds.length) return [];
-    const placeholders = userIds.map(() => '?').join(',');
-    return this.db.prepare(`
-      SELECT id,userId,name,status,createdAt,lastSeen,username,displayName
-      FROM (
-        SELECT d.id,d.user_id AS userId,d.name,d.status,d.created_at AS createdAt,d.last_seen AS lastSeen,
-          u.username,u.display_name AS displayName,
-          ROW_NUMBER() OVER(
-            PARTITION BY d.user_id
-            ORDER BY CASE WHEN d.status='active' THEN 0 ELSE 1 END,d.created_at DESC
-          ) AS rowNumber
-        FROM devices d JOIN users u ON u.id=d.user_id
-        WHERE d.user_id IN (${placeholders})
-      )
-      WHERE rowNumber<=100
-      ORDER BY createdAt DESC
-    `).all(...userIds);
-  }
-
-  async authenticateUser(username, password) {
-    const normalized = typeof username === 'string' ? username.trim().toLowerCase() : '';
-    const row = this.db.prepare('SELECT * FROM users WHERE username=?').get(normalized);
-    const salt = row ? Buffer.from(row.password_salt, 'hex') : Buffer.alloc(16);
-    const expected = row ? Buffer.from(row.password_hash, 'hex') : Buffer.alloc(64);
-    const actual = await scrypt(typeof password === 'string' && password.length<=256 ? password : '', salt, 64);
-    const valid = actual.length === expected.length && crypto.timingSafeEqual(actual, expected);
-    if (!row || !valid) return null;
-    const current=this.db.prepare('SELECT password_hash,status,expires_at FROM users WHERE id=?').get(row.id);
-    if(!current||current.password_hash!==row.password_hash||current.status!=='active'||current.expires_at&&current.expires_at<=Date.now())return null;
-    return this.getUser(row.id);
-  }
-
-  async resetPassword(userId, password) {
-    password = validPassword(password);
-    const salt = crypto.randomBytes(16);
-    const passwordHash = await scrypt(password, salt, 64);
-    const result = this.db.prepare('UPDATE users SET password_salt=?,password_hash=? WHERE id=?')
-      .run(salt.toString('hex'),passwordHash.toString('hex'),userId);
-    if (!result.changes) return false;
-    this.db.prepare('DELETE FROM sessions WHERE user_id=?').run(userId);
-    this.audit('admin', 'user.password_reset', userId, {});
-    return true;
-  }
-
-  updateUser(userId, changes) {
-    const allowed = new Set(['status','displayName','plan','maxDevices','expiresAt']);
-    if (!changes || typeof changes !== 'object' || Object.keys(changes).some(key => !allowed.has(key))) throw new Error('用户更新字段无效。');
-    const user = this.getUser(userId);
-    if (!user) return null;
-    const next = {
-      status: changes.status === undefined ? user.status : changes.status,
-      displayName: changes.displayName === undefined ? user.displayName : safeString(changes.displayName, '显示名称', 120),
-      plan: changes.plan === undefined ? user.plan : safeString(changes.plan, '套餐', 40),
-      maxDevices: changes.maxDevices === undefined ? user.maxDevices : safeCount(changes.maxDevices, { min:1, max:50 }),
-      expiresAt: changes.expiresAt === undefined ? user.expiresAt : changes.expiresAt
-    };
-    if (!['active','suspended'].includes(next.status)) throw new Error('用户状态无效。');
-    if (next.expiresAt !== null && (!Number.isSafeInteger(next.expiresAt) || next.expiresAt <= 0)) throw new Error('到期时间无效。');
-    const activeDeviceCount=this.db.prepare("SELECT COUNT(*) AS count FROM devices WHERE user_id=? AND status='active'").get(userId).count;
-    if(next.maxDevices<activeDeviceCount)throw new Error(`当前已有 ${activeDeviceCount} 台有效设备，不能把额度调得更低。`);
-    this.db.prepare('UPDATE users SET status=?,display_name=?,plan=?,max_devices=?,expires_at=? WHERE id=?')
-      .run(next.status,next.displayName,next.plan,next.maxDevices,next.expiresAt,userId);
-    if (next.status === 'suspended'||next.expiresAt&&next.expiresAt<=Date.now()) this.db.prepare('DELETE FROM sessions WHERE user_id=?').run(userId);
-    this.audit('admin', `user.${next.status!==user.status?next.status:'updated'}`, userId, { plan:next.plan,maxDevices:next.maxDevices,expiresAt:next.expiresAt });
-    return this.getUser(userId);
-  }
-
-  listDevices(userId = null) {
-    const where = userId === null ? '' : 'WHERE d.user_id=?';
-    return this.db.prepare(`
-      SELECT d.id,d.user_id AS userId,d.name,d.status,d.created_at AS createdAt,d.last_seen AS lastSeen,
-        u.username,u.display_name AS displayName
-      FROM devices d JOIN users u ON u.id=d.user_id ${where}
-      ORDER BY d.created_at DESC LIMIT 1000
-    `).all(...(userId === null ? [] : [userId]));
-  }
-
-  issueDevice(userId, name, actor = 'admin') {
-    const user = this.getUser(userId);
-    if (!user || user.status !== 'active'||user.expiresAt&&user.expiresAt<=Date.now()) throw new Error('找不到有效用户。');
-    const activeCount = this.db.prepare("SELECT COUNT(*) AS count FROM devices WHERE user_id=? AND status='active'").get(userId).count;
-    if (activeCount >= user.maxDevices) throw new Error('此用户已达到设备上限。');
-    const id = crypto.randomUUID();
-    const token = crypto.randomBytes(32).toString('base64url');
-    const displayName = safeString(name || `电脑 ${activeCount + 1}`, '设备名称', 120);
-    this.db.prepare('INSERT INTO devices(id,user_id,name,token_hash,status,created_at) VALUES(?,?,?,?,?,?)')
-      .run(id,userId,displayName,this.tokenHash(token),'active',Date.now());
-    this.audit(actor, 'device.issued', id, { userId, name:displayName });
-    return { device:this.listDevices(userId).find(device => device.id === id), agentToken:token };
-  }
-
-  authenticateDevice(token, deviceId = null) {
-    if (typeof token !== 'string' || token.length < 32) return null;
-    const tokenHash = this.tokenHash(token);
-    const row = this.db.prepare(`
-      SELECT d.id,d.user_id AS userId,d.name,d.status,d.token_hash AS tokenHash,
-        u.status AS userStatus,u.expires_at AS userExpiresAt
-      FROM devices d JOIN users u ON u.id=d.user_id WHERE d.token_hash=?
-    `).get(tokenHash);
-    if (!row || row.status !== 'active' || row.userStatus !== 'active'
-      || (row.userExpiresAt && row.userExpiresAt <= Date.now())
-      || (deviceId && row.id !== deviceId)) return null;
-    this.db.prepare('UPDATE devices SET last_seen=? WHERE id=?').run(Date.now(),row.id);
-    return { id:row.id,userId:row.userId,name:row.name };
-  }
-
-  setDeviceStatus(deviceId, status, name = undefined, actor = 'admin') {
-    if (!['active','revoked'].includes(status)) throw new Error('设备状态无效。');
-    const device = this.db.prepare('SELECT * FROM devices WHERE id=?').get(deviceId);
-    if (!device) return null;
-    if(device.status==='revoked'&&status==='active')throw new Error('已撤销的设备凭证不能恢复，请签发新的设备凭证。');
-    const nextName = name === undefined ? device.name : safeString(name,'设备名称',120);
-    this.db.exec('BEGIN IMMEDIATE');
-    try {
-      this.db.prepare('UPDATE devices SET status=?,name=? WHERE id=?').run(status,nextName,deviceId);
-      this.secureDatabaseFiles();
-      this.db.exec('COMMIT');
-    } catch(error) {
-      try{this.db.exec('ROLLBACK')}catch{}
-      throw error;
-    }
-    this.audit(actor,`device.${status}`,deviceId,{userId:device.user_id});
-    return this.listDevices(device.user_id).find(item=>item.id===deviceId);
-  }
-
-  setSession(rawToken, role, userId, expiresAt) {
-    const token = rawToken || crypto.randomBytes(32).toString('base64url');
-    const expires = expiresAt || Date.now() + 12 * 60 * 60 * 1000;
-    this.db.prepare('INSERT INTO sessions(token_hash,user_id,role,expires_at,created_at) VALUES(?,?,?,?,?)')
-      .run(this.tokenHash(token),userId,role,expires,Date.now());
-    return { token,expiresAt:expires };
-  }
-
-  getSession(rawToken, role) {
-    if (typeof rawToken !== 'string' || rawToken.length < 32) return null;
-    const tokenHash = this.tokenHash(rawToken);
-    const session = this.db.prepare('SELECT * FROM sessions WHERE token_hash=? AND role=?').get(tokenHash,role);
-    if (!session || session.expires_at <= Date.now()) {
-      if (session) this.db.prepare('DELETE FROM sessions WHERE token_hash=?').run(tokenHash);
-      return null;
-    }
-    if (role === 'user') {
-      const user = this.getUser(session.user_id);
-      if (!user || user.status !== 'active' || (user.expiresAt && user.expiresAt <= Date.now())) {
-        this.db.prepare('DELETE FROM sessions WHERE token_hash=?').run(tokenHash);
-        return null;
-      }
-      return { tokenHash,user };
-    }
-    return { tokenHash,role };
-  }
-
-  hasSession(tokenHash,userId) {
-    const row=this.db.prepare('SELECT expires_at AS expiresAt FROM sessions WHERE token_hash=? AND user_id=? AND role=\'user\'').get(tokenHash,userId);
-    if(!row)return false;
-    if(row.expiresAt<=Date.now()){this.db.prepare('DELETE FROM sessions WHERE token_hash=?').run(tokenHash);return false}
-    return true;
-  }
-
-  cleanup() {
-    this.db.prepare('DELETE FROM sessions WHERE expires_at<=?').run(Date.now());
-  }
-
-  revokeSession(rawToken) {
-    if (typeof rawToken === 'string') this.db.prepare('DELETE FROM sessions WHERE token_hash=?').run(this.tokenHash(rawToken));
-  }
-
-  devicesForUser(userId) {
-    return this.listDevices(userId).filter(device => device.status === 'active');
-  }
-
-  touchDevice(deviceId) {
-    this.db.prepare('UPDATE devices SET last_seen=? WHERE id=? AND status=\'active\'').run(Date.now(),deviceId);
-  }
-
-  audit(actor, action, targetId, details) {
-    this.db.prepare('INSERT INTO audit_log(actor,action,target_id,details_json,created_at) VALUES(?,?,?,?,?)')
-      .run(actor,action,targetId || null,JSON.stringify(details || {}),Date.now());
-  }
-
-  listAudit(limit = 100) {
-    return this.db.prepare('SELECT id,actor,action,target_id AS targetId,details_json AS details,created_at AS createdAt FROM audit_log ORDER BY id DESC LIMIT ?')
-      .all(safeCount(limit,{min:1,max:500})).map(row=>({...row,details:JSON.parse(row.details)}));
-  }
-
-  overview(onlineDeviceIds) {
-    const counts = this.db.prepare(`
-      SELECT
-        (SELECT COUNT(*) FROM users) AS users,
-        (SELECT COUNT(*) FROM users WHERE status='active' AND (expires_at IS NULL OR expires_at > unixepoch('subsec')*1000)) AS activeUsers,
-        (SELECT COUNT(*) FROM users WHERE status='suspended') AS suspendedUsers,
-        (SELECT COUNT(*) FROM users WHERE status='active' AND expires_at IS NOT NULL AND expires_at <= unixepoch('subsec')*1000) AS expiredUsers,
-        (SELECT COUNT(*) FROM devices) AS devices,
-        (SELECT COUNT(*) FROM devices d JOIN users u ON u.id=d.user_id
-          WHERE d.status='active' AND u.status='active'
-            AND (u.expires_at IS NULL OR u.expires_at > unixepoch('subsec')*1000)) AS activeDevices
-    `).get();
-    return {...counts,onlineDevices:onlineDeviceIds.length,uptimeSeconds:Math.floor(process.uptime())};
-  }
-}