qdmp-cli 0.1.24 → 0.1.26

package/README.md

@@ -61,3 +61,35 @@ qdmp-cli upload -e dev //上传开发环境
 qdmp-cli upload -d "新增订单查询功能" //指定版本描述
 ```
 直接运行上传命令时，会交互式提示输入选填的版本描述（200字以内）。
+
+### 生成 OpenAPI 权限申请地址
+
+Agent 在项目根目录维护 `.qdmp/openapi-usage.json`，只记录代码实际调用的 OpenAPI：
+
+```json
+{
+  "schemaVersion": 1,
+  "openapis": [
+    { "method": "GET", "path": "/spu/v1/detail" },
+    { "showCode": "tag.search" }
+  ]
+}
+```
+
+生成申请地址：
+
+```bash
+qdmp-cli openapi apply-url
+qdmp-cli openapi apply-url --env dev --json
+```
+
+命令会分页复用 `GET /qdmp-web/v1/developer/capabilities?type=openapi` 获取完整目录，将清单严格解析为
+资源 ID，并排除已开通、审核中或无需权限的接口。需要手动申请的 ID 会生成 16 位短令牌，最终地址形如：
+
+```text
+https://open.qiandao.com/apps/<appId>/capabilities?requiredApis=<16位queryKey>
+```
+
+本地联调可设置 `QDMP_API_BASE_URL=http://127.0.0.1:8082`，并通过
+`--open-platform-url http://local.qiandao.com:8081` 指向本地前端。
+CI 或隔离测试环境可通过 `QDMP_TOKEN` 临时注入登录 Token；日常交互仍优先使用 `qdmp-cli login`。

package/api.js

@@ -5,6 +5,14 @@ import { promisify } from "util";
 
 const readFile = promisify(fs.readFile);
 
+const resolveAPIBaseURL = (env) => {
+  const override = process.env.QDMP_API_BASE_URL?.trim().replace(/\/+$/, "");
+  if (override) return override;
+  return env === "prod"
+    ? "https://api.qiandao.com"
+    : "https://dev-api.qiandao.com";
+};
+
 // API 基础配置
 const API_CONFIG = {
   timeout: 10000,
@@ -28,10 +36,7 @@ export const request = async (
   needAuth = true
 ) => {
   const config = {
-    baseURL:
-      env === "prod"
-        ? "https://api.qiandao.com"
-        : "https://dev-api.qiandao.com",
+    baseURL: resolveAPIBaseURL(env),
     method: "GET",
     headers: { ...API_CONFIG.headers },
     ...options,
@@ -39,9 +44,10 @@ export const request = async (
   // 添加认证头（如果需要且如果有 token）
   if (needAuth) {
     const token = getToken();
-    if (token) {
-      config.headers["authorization"] = `Bearer ${token}`;
+    if (!token) {
+      throw new Error("未授权，执行 qdmp-cli login 完成登录");
     }
+    config.headers["authorization"] = `Bearer ${token}`;
   }
 
   try {
@@ -76,6 +82,85 @@ export const request = async (
   }
 };
 
+const assertSuccessResponse = (result, action) => {
+  const code = Number(result?.code || 0);
+  if (Number.isFinite(code) && code !== 0) {
+    throw new Error(result?.message || `${action}失败`);
+  }
+};
+
+/**
+ * 复用开发者能力列表接口，分页获取当前应用的完整 OpenAPI 目录。
+ */
+export const getAllOpenAPIResources = async (
+  appId,
+  env = "prod",
+  { pageSize = 200, maxPages = 100 } = {},
+) => {
+  const resources = [];
+  const seen = new Set();
+  let offset = 0;
+
+  for (let page = 0; page < maxPages; page += 1) {
+    const query = new URLSearchParams({
+      app_id: appId,
+      type: "openapi",
+      offset: String(offset),
+      limit: String(pageSize),
+    });
+    const result = await request(
+      `/qdmp-web/v1/developer/capabilities?${query.toString()}`,
+      {},
+      env,
+    );
+    assertSuccessResponse(result, "查询 OpenAPI 列表");
+    const pageResources = Array.isArray(result?.data?.resources)
+      ? result.data.resources
+      : [];
+    let added = 0;
+    for (const item of pageResources) {
+      const resourceId = String(item?.resource?.resourceId || "");
+      if (!resourceId || seen.has(resourceId)) continue;
+      seen.add(resourceId);
+      resources.push(item);
+      added += 1;
+    }
+
+    const total = Number(result?.data?.total || 0);
+    offset += pageResources.length;
+    if (
+      pageResources.length === 0 ||
+      pageResources.length < pageSize ||
+      (Number.isFinite(total) && total > 0 && offset >= total) ||
+      added === 0
+    ) {
+      return resources;
+    }
+  }
+
+  throw new Error(`OpenAPI 列表超过安全分页上限（${maxPages} 页）`);
+};
+
+export const createOpenAPIApplicationLink = async (
+  appId,
+  resourceIds,
+  env = "prod",
+) => {
+  const result = await request(
+    `/qdmp-web/v1/developer/apps/${encodeURIComponent(appId)}/openapi-application-links`,
+    {
+      method: "POST",
+      body: JSON.stringify({ resourceIds }),
+    },
+    env,
+  );
+  assertSuccessResponse(result, "生成 OpenAPI 权限申请链接");
+  if (!result?.data?.queryKey || !Array.isArray(result?.data?.resourceIds)) {
+    throw new Error("生成 OpenAPI 权限申请链接失败：返回数据不完整");
+  }
+  return result.data;
+};
+
 /**
  * 用户登录
  * @param {string} username - 用户名

package/index.js

@@ -16,6 +16,7 @@ import {
   buildAction,
 } from "./actions.js";
 import { printLogo } from "./utils/logHandler.js";
+import { openAPIApplyURLAction } from "./openapi.js";
 // import.meta.url： esm模块化中的属性,获取模块文件的绝对地址
 // __dirname： 获取模块文件所在目录的绝对路径，由nodejs在每个模块注入的特殊变量，只能在commonjs中使用
 // process.cwd()： 获取当前执行nodejs命令的当前工作目录
@@ -69,4 +70,18 @@ program
   .option("-e, --env <env>", "当前环境")
   .option("-d, --description <description>", "版本描述（选填，200字以内）")
   .action(uploadAction);
+
+const openapi = program
+  .command("openapi")
+  .description("OpenAPI 使用清单与权限申请工具");
+
+openapi
+  .command("apply-url")
+  .description("根据代码使用清单生成权限申请页面地址")
+  .option("-m, --manifest <path>", "OpenAPI 使用清单", ".qdmp/openapi-usage.json")
+  .option("-e, --env <env>", "环境：prod 或 dev", "prod")
+  .option("-a, --app-id <appId>", "应用 ID")
+  .option("--open-platform-url <url>", "开放平台前端地址（本地联调使用）")
+  .option("--json", "输出结构化 JSON")
+  .action(openAPIApplyURLAction);
 program.parse(process.argv);

package/openapi.js

@@ -0,0 +1,82 @@
+import { createOpenAPIApplicationLink, getAllOpenAPIResources } from "./api.js";
+import { resolveAppId } from "./utils/common.js";
+import {
+  classifyOpenAPIResources,
+  readOpenAPIManifest,
+  resolveOpenAPIManifest,
+} from "./utils/openapiManifest.js";
+import { error, info, success, warn } from "./utils/logHandler.js";
+
+const openPlatformBaseURL = (env, override) => {
+  const baseURL = override?.trim().replace(/\/+$/, "")
+    || (env === "prod" ? "https://open.qiandao.com" : "https://dev-open.qiandao.com");
+  return baseURL;
+};
+
+export const prepareOpenAPIApplication = async ({
+  appId,
+  env = "prod",
+  manifest = ".qdmp/openapi-usage.json",
+  openPlatformUrl,
+  cwd = process.cwd(),
+}) => {
+  const resolvedAppId = String(appId || resolveAppId(cwd, env)).trim();
+  if (!resolvedAppId) {
+    throw new Error("未找到 appId，请使用 --app-id 指定，或检查 qdmp-config.json/frontend/qdmp.json");
+  }
+  const usage = readOpenAPIManifest(manifest, cwd);
+  const catalog = await getAllOpenAPIResources(resolvedAppId, env);
+  const matched = resolveOpenAPIManifest(usage.openapis, catalog);
+  const classified = classifyOpenAPIResources(matched);
+
+  let queryKey = "";
+  let expiresAt = 0;
+  if (classified.required.length > 0) {
+    const link = await createOpenAPIApplicationLink(resolvedAppId, classified.required, env);
+    queryKey = link.queryKey;
+    expiresAt = Number(link.expiresAt || 0);
+    if (link.resourceIds.map(String).join(",") !== classified.required.join(",")) {
+      throw new Error("短链返回的 OpenAPI ID 与请求不一致，已停止生成申请地址");
+    }
+  }
+
+  const baseURL = openPlatformBaseURL(env, openPlatformUrl);
+  const url = new URL(`/apps/${encodeURIComponent(resolvedAppId)}/capabilities`, `${baseURL}/`);
+  if (queryKey) url.searchParams.set("requiredApis", queryKey);
+  return {
+    appId: resolvedAppId,
+    manifest: usage.path,
+    matchedResourceIds: matched.map((item) => String(item.resource.resourceId)),
+    requiredResourceIds: classified.required,
+    grantedResourceIds: classified.granted,
+    pendingResourceIds: classified.pending,
+    noPermissionRequiredResourceIds: classified.noPermissionRequired,
+    unavailableResourceIds: classified.unavailable,
+    queryKey,
+    expiresAt,
+    url: url.toString(),
+  };
+};
+
+export const openAPIApplyURLAction = async (option) => {
+  try {
+    const result = await prepareOpenAPIApplication(option);
+    if (option.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    info(`已匹配 ${result.matchedResourceIds.length} 个 OpenAPI`);
+    if (result.grantedResourceIds.length > 0) info(`${result.grantedResourceIds.length} 个已开通`);
+    if (result.pendingResourceIds.length > 0) info(`${result.pendingResourceIds.length} 个正在审核`);
+    if (result.noPermissionRequiredResourceIds.length > 0) info(`${result.noPermissionRequiredResourceIds.length} 个无需申请`);
+    if (result.unavailableResourceIds.length > 0) warn(`${result.unavailableResourceIds.length} 个当前不可申请`);
+    if (result.requiredResourceIds.length === 0) {
+      success("当前没有需要手动申请的 OpenAPI");
+      return;
+    }
+    success(`已生成权限申请地址（${result.requiredResourceIds.length} 个接口）：`);
+    console.log(result.url);
+  } catch (cause) {
+    error(cause?.message || String(cause));
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "qdmp-cli",
-    "version": "0.1.24",
+    "version": "0.1.26",
     "description": "qdmp-cli",
     "main": "index.js",
     "type": "module",
@@ -9,6 +9,7 @@
         "api.js",
         "constants.js",
         "index.js",
+        "openapi.js",
         "utils/"
     ],
     "scripts": {
@@ -40,4 +41,4 @@
     "engines": {
         "node": "^20.19.0 || >=22.12.0"
     }
-}
+}

package/utils/authorized.js

@@ -29,15 +29,16 @@ export const saveToken = (token) => {
  * @returns {string} - 认证令牌
  */
 export const getToken = () => {
+  const environmentToken = process.env.QDMP_TOKEN?.trim();
+  if (environmentToken) return environmentToken;
   const configPath = getConfigPath();
   try {
     if (fs.existsSync(configPath)) {
       const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
       return config.token || null;
-    } else {
-      error("认证令牌不存在，请重新登录");
     }
   } catch (err) {
-    error("读取认证令牌失败，请重新登录:", err.message);
+    return null;
   }
+  return null;
 };

package/utils/common.js

@@ -33,6 +33,28 @@ export function getAppId(env = "prod") {
   }
 }
 
+export function resolveAppId(cwd = process.cwd(), env = "prod") {
+  const fieldNames = env === "prod" ? ["appId"] : ["devAppId", "appId"];
+  const configPaths = [
+    path.join(cwd, "qdmp-config.json"),
+    path.join(cwd, "frontend", "qdmp.json"),
+    path.join(cwd, "qdmp.json"),
+  ];
+  for (const configPath of configPaths) {
+    if (!fs.existsSync(configPath)) continue;
+    try {
+      const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+      for (const fieldName of fieldNames) {
+        const appId = String(config?.[fieldName] || "").trim();
+        if (appId) return appId;
+      }
+    } catch {
+      // 继续检查兼容配置，最终由调用方给出统一错误。
+    }
+  }
+  return "";
+}
+
 /** 验证URL是否可访问
  * @param {*} url
  */

package/utils/openapiManifest.js

@@ -0,0 +1,128 @@
+import fs from "fs";
+import path from "path";
+
+const HTTP_METHOD_PATTERN = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/i;
+
+const normalizePath = (value) => {
+  const raw = String(value || "").trim();
+  if (!raw) return "";
+  try {
+    if (/^https?:\/\//i.test(raw)) return new URL(raw).pathname.replace(/\/+$/, "") || "/";
+  } catch {
+    return "";
+  }
+  return (raw.split(/[?#]/, 1)[0].replace(/\/+$/, "") || "/");
+};
+
+const normalizeDescriptor = (entry, index) => {
+  if (typeof entry === "string") {
+    const value = entry.trim();
+    const separator = value.indexOf(" ");
+    if (separator > 0 && HTTP_METHOD_PATTERN.test(value.slice(0, separator))) {
+      return {
+        method: value.slice(0, separator).toUpperCase(),
+        path: normalizePath(value.slice(separator + 1)),
+      };
+    }
+    if (value) return { showCode: value };
+  }
+  if (entry && typeof entry === "object") {
+    const descriptor = {
+      method: String(entry.method || "").trim().toUpperCase(),
+      path: normalizePath(entry.path || entry.url),
+      showCode: String(entry.showCode || "").trim(),
+      apiCode: String(entry.apiCode || "").trim(),
+    };
+    if ((descriptor.method && descriptor.path) || descriptor.showCode || descriptor.apiCode) {
+      if (descriptor.method && !HTTP_METHOD_PATTERN.test(descriptor.method)) {
+        throw new Error(`openapis[${index}].method 不是有效 HTTP 方法`);
+      }
+      return descriptor;
+    }
+  }
+  throw new Error(`openapis[${index}] 缺少 method + path、showCode 或 apiCode`);
+};
+
+export const readOpenAPIManifest = (manifestPath, cwd = process.cwd()) => {
+  const absolutePath = path.resolve(cwd, manifestPath);
+  if (!fs.existsSync(absolutePath)) {
+    throw new Error(`未找到 OpenAPI 使用清单：${absolutePath}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(absolutePath, "utf8"));
+  } catch (error) {
+    throw new Error(`OpenAPI 使用清单不是有效 JSON：${error.message}`);
+  }
+  if (manifest?.schemaVersion !== 1 || !Array.isArray(manifest?.openapis)) {
+    throw new Error("OpenAPI 使用清单必须包含 schemaVersion: 1 和 openapis 数组");
+  }
+  if (manifest.openapis.length === 0) {
+    throw new Error("OpenAPI 使用清单中的 openapis 不能为空");
+  }
+  return {
+    path: absolutePath,
+    openapis: manifest.openapis.map(normalizeDescriptor),
+  };
+};
+
+const sameText = (left, right) => String(left || "").trim() === String(right || "").trim();
+
+const resourceMatches = (descriptor, item) => {
+  const resource = item?.resource || {};
+  if (descriptor.showCode && !sameText(descriptor.showCode, resource.showCode)) return false;
+  if (descriptor.apiCode && !sameText(descriptor.apiCode, resource.apiCode)) return false;
+  if (descriptor.method && descriptor.method !== String(resource.method || "").trim().toUpperCase()) return false;
+  if (descriptor.path && descriptor.path !== normalizePath(resource.path)) return false;
+  return true;
+};
+
+export const resolveOpenAPIManifest = (descriptors, catalog) => {
+  const resolved = [];
+  const seenResourceIDs = new Set();
+  for (const descriptor of descriptors) {
+    const matches = catalog.filter((item) => resourceMatches(descriptor, item));
+    if (matches.length === 0) {
+      throw new Error(`未找到 OpenAPI：${JSON.stringify(descriptor)}`);
+    }
+    if (matches.length > 1) {
+      throw new Error(`OpenAPI 匹配不唯一，请补充 method + path 或唯一编码：${JSON.stringify(descriptor)}`);
+    }
+    const item = matches[0];
+    const resourceId = String(item?.resource?.resourceId || "");
+    if (!resourceId) throw new Error(`OpenAPI 缺少 resourceId：${JSON.stringify(descriptor)}`);
+    if (seenResourceIDs.has(resourceId)) continue;
+    seenResourceIDs.add(resourceId);
+    resolved.push(item);
+  }
+  return resolved;
+};
+
+export const classifyOpenAPIResources = (items) => {
+  const result = {
+    required: [],
+    granted: [],
+    pending: [],
+    noPermissionRequired: [],
+    unavailable: [],
+  };
+  for (const item of items) {
+    const resource = item.resource || {};
+    const appContext = item.appContext || {};
+    const resourceId = String(resource.resourceId || "");
+    const accessStatus = String(appContext.accessStatus || "").toUpperCase();
+    const applyStatus = String(appContext.applyStatus || "").toUpperCase();
+    if (String(resource.permissionPolicy || "").toUpperCase() === "NO_NEED_PERMISSION") {
+      result.noPermissionRequired.push(resourceId);
+    } else if (String(appContext.grantStatus || "").toUpperCase() === "GRANTED" || accessStatus === "GRANTED") {
+      result.granted.push(resourceId);
+    } else if (accessStatus === "PENDING" || applyStatus.includes("PENDING")) {
+      result.pending.push(resourceId);
+    } else if (appContext.capability?.canApply === true) {
+      result.required.push(resourceId);
+    } else {
+      result.unavailable.push(resourceId);
+    }
+  }
+  return result;
+};