rainskills 0.1.19 → 0.1.21

package/rainbond-platform-installer/scripts/runtime-context-resolver.js

@@ -1,189 +0,0 @@
-"use strict";
-
-const { createHash, randomUUID: nodeRandomUUID } = require("node:crypto");
-
-const MAX_OPTIONS = 256;
-
-function clone(value) {
-  return JSON.parse(JSON.stringify(value));
-}
-
-function boundedString(value) {
-  return typeof value === "string"
-    && value.length > 0
-    && value.length <= 128
-    && !/[\u0000-\u001f\u007f-\u009f]/u.test(value)
-    ? value
-    : null;
-}
-
-function optionUuid(teamId, regionName) {
-  const digest = createHash("sha256").update(`${teamId}\0${regionName}`, "utf8").digest("hex");
-  return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-4${digest.slice(13, 16)}-8${digest.slice(17, 20)}-${digest.slice(20, 32)}`;
-}
-
-function normalizeWorkspaceOptions(payload) {
-  if (!payload || typeof payload !== "object" || !Array.isArray(payload.items)) {
-    throw new Error("Rainbond 工作空间查询结果无效");
-  }
-  const options = [];
-  for (const item of payload.items) {
-    if (!item || typeof item !== "object") continue;
-    const teamId = boundedString(item.team_id || item.tenant_id);
-    const teamName = boundedString(item.team_name || item.tenant_name);
-    const teamAlias = boundedString(item.team_alias || item.tenant_alias);
-    if (!teamId || !teamName || !Array.isArray(item.region_list)) continue;
-    for (const region of item.region_list) {
-      const regionName = boundedString(region?.region_name);
-      if (!regionName) continue;
-      const regionLabel = boundedString(region.region_alias) || regionName;
-      const workspaceLabel = teamAlias && teamAlias !== teamName
-        ? `${teamAlias}（${teamName}）`
-        : teamName;
-      options.push({
-        id: optionUuid(teamId, regionName),
-        label: `${workspaceLabel} / ${regionLabel}`,
-        team_id: teamId,
-        team_name: teamName,
-        team_alias: teamAlias,
-        region_name: regionName,
-      });
-      if (options.length > MAX_OPTIONS) throw new Error("candidate-set-too-large");
-    }
-  }
-  return options.sort((left, right) => (
-    left.team_id.localeCompare(right.team_id) || left.region_name.localeCompare(right.region_name)
-  ));
-}
-
-function createRuntimeContextResolver({
-  operationStore,
-  queryTool,
-  randomUUID = nodeRandomUUID,
-} = {}) {
-  if (!operationStore || typeof operationStore.read !== "function"
-    || typeof operationStore.updateContext !== "function") {
-    throw new Error("runtime context resolver 缺少 operation store");
-  }
-  if (typeof queryTool !== "function") throw new Error("runtime context resolver 缺少只读查询 transport");
-
-  async function resolve({ operationId, required = [] } = {}) {
-    if (!Array.isArray(required) || required.some((item) => !["enterprise", "workspace"].includes(item))) {
-      throw new Error("runtime context required dimensions 无效");
-    }
-    let operation = operationStore.read(operationId);
-    if (!operation) throw new Error("runtime operation 不存在");
-    if (operation.pending_selection) {
-      return {
-        schema: "rainskills.context-result.v1",
-        state: "needs-selection",
-        selection_id: operation.pending_selection.selection_id,
-        dimension: operation.pending_selection.dimension,
-        options: operation.pending_selection.options.map(({ id, label }) => ({ id, label })),
-      };
-    }
-
-    if (required.includes("enterprise") && !operation.context.enterprise_id) {
-      const identity = await queryTool("rainbond_get_current_user", {});
-      const enterpriseId = boundedString(identity?.enterprise_id);
-      if (!enterpriseId) {
-        return {
-          schema: "rainskills.context-result.v1",
-          state: "blocked",
-          reason: "no-current-enterprise",
-          message_id: "context.no-current-enterprise",
-        };
-      }
-      operation = operationStore.updateContext(operationId, {
-        expectedRevision: operation.context_revision,
-        values: { enterprise_id: enterpriseId },
-      });
-    }
-
-    const workspaceResolved = operation.context.team_id && operation.context.region_name;
-    if (required.includes("workspace") && !workspaceResolved) {
-      const teams = await queryTool("rainbond_query_teams", {
-        enterprise_id: operation.context.enterprise_id,
-      });
-      const options = normalizeWorkspaceOptions(teams);
-      if (options.length === 0) {
-        return {
-          schema: "rainskills.context-result.v1",
-          state: "blocked",
-          reason: "no-accessible-workspace",
-          message_id: "context.no-accessible-workspace",
-        };
-      }
-      if (options.length === 1) {
-        const [option] = options;
-        operation = operationStore.updateContext(operationId, {
-          expectedRevision: operation.context_revision,
-          values: {
-            team_id: option.team_id,
-            team_name: option.team_name,
-            region_name: option.region_name,
-          },
-          pendingSelection: null,
-        });
-      } else {
-        const pendingSelection = {
-          selection_id: randomUUID(),
-          dimension: "workspace-region",
-          options,
-          context_revision: operation.context_revision + 1,
-        };
-        operationStore.updateContext(operationId, {
-          expectedRevision: operation.context_revision,
-          pendingSelection,
-        });
-        return {
-          schema: "rainskills.context-result.v1",
-          state: "needs-selection",
-          selection_id: pendingSelection.selection_id,
-          dimension: pendingSelection.dimension,
-          options: options.map(({ id, label }) => ({ id, label })),
-        };
-      }
-    }
-
-    return {
-      schema: "rainskills.context-result.v1",
-      state: "resolved",
-      context: clone(operation.context),
-      context_revision: operation.context_revision,
-    };
-  }
-
-  async function select({ operationId, selectionId, optionId } = {}) {
-    const operation = operationStore.read(operationId);
-    const pending = operation?.pending_selection;
-    if (!pending || pending.selection_id !== selectionId
-      || pending.context_revision !== operation.context_revision) {
-      throw new Error("runtime context selection 已失效");
-    }
-    const option = pending.options.find((candidate) => candidate.id === optionId);
-    if (!option) throw new Error("runtime context option 无效");
-    const updated = operationStore.updateContext(operationId, {
-      expectedRevision: operation.context_revision,
-      values: {
-        team_id: option.team_id,
-        team_name: option.team_name,
-        region_name: option.region_name,
-      },
-      pendingSelection: null,
-    });
-    return {
-      schema: "rainskills.context-result.v1",
-      state: "resolved",
-      context: clone(updated.context),
-      context_revision: updated.context_revision,
-    };
-  }
-
-  return { resolve, select };
-}
-
-module.exports = {
-  createRuntimeContextResolver,
-  normalizeWorkspaceOptions,
-};

package/rainbond-platform-installer/scripts/runtime-credentials.js

@@ -1,163 +0,0 @@
-"use strict";
-
-const crypto = require("node:crypto");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
-
-const { normalizeConsoleOrigin } = require("./console-origin.js");
-const { createSecureStateStore } = require("./secure-state.js");
-const { looksLikeJwt } = require("./windows-auth.js");
-
-const MAX_CREDENTIAL_FILE_BYTES = 16384;
-
-function assertProtectedPosixDirectory(directory) {
-  const info = fs.lstatSync(directory);
-  if (info.isSymbolicLink() || !info.isDirectory()) {
-    throw new Error("Rainbond 凭据目录必须是受保护的普通目录");
-  }
-  if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
-    throw new Error("Rainbond 凭据目录 owner 不匹配");
-  }
-  if ((info.mode & 0o777) !== 0o700) {
-    throw new Error("Rainbond 凭据目录权限必须为 0700");
-  }
-}
-
-function validateCredentialPayload(payload, expectedOrigin) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    throw new Error("Rainbond 运行凭据无效");
-  }
-  if (Object.keys(payload).sort().join(",") !== "origin,token") {
-    throw new Error("Rainbond 运行凭据字段无效");
-  }
-  if (!looksLikeJwt(payload.token)) throw new Error("Rainbond 运行凭据格式无效");
-  const origin = normalizeConsoleOrigin(payload.origin);
-  if (origin !== normalizeConsoleOrigin(expectedOrigin)) {
-    throw new Error("Rainbond 运行凭据 origin 与 onboarding 不匹配");
-  }
-  return { token: payload.token, origin };
-}
-
-function readPosixRuntimeCredential({
-  home = os.homedir(),
-  expectedOrigin,
-  stateStore = createSecureStateStore({ platform: process.platform, home }),
-} = {}) {
-  const directory = path.join(home, ".rainbond");
-  const credentialPath = path.join(directory, "mcp.env");
-  assertProtectedPosixDirectory(directory);
-  stateStore.assertProtectedRegularFile(credentialPath);
-  const flags = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0);
-  const fd = fs.openSync(credentialPath, flags);
-  let content;
-  try {
-    const info = fs.fstatSync(fd);
-    if (!info.isFile()) throw new Error("Rainbond 凭据路径不是普通文件");
-    if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
-      throw new Error("Rainbond 凭据文件 owner 不匹配");
-    }
-    if ((info.mode & 0o777) !== 0o600) throw new Error("Rainbond 凭据文件权限必须为 0600");
-    if (info.size > MAX_CREDENTIAL_FILE_BYTES) throw new Error("Rainbond 凭据文件过大");
-    content = fs.readFileSync(fd, "utf8");
-  } finally {
-    fs.closeSync(fd);
-  }
-  const match = content.match(
-    /^export RAINBOND_JWT='([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)'\nexport RAINBOND_URL='([^'\r\n]+)'\n?$/
-  );
-  if (!match) throw new Error("Rainbond 凭据文件语法无效");
-  return validateCredentialPayload({ token: match[1], origin: match[2] }, expectedOrigin);
-}
-
-function windowsReaderEnvironment(outputPath, source = process.env) {
-  const environment = { RAINSKILLS_CREDENTIAL_OUTPUT_PATH: outputPath };
-  for (const key of [
-    "SystemRoot", "WINDIR", "PATH", "COMSPEC", "TEMP", "TMP", "USERPROFILE",
-  ]) {
-    if (typeof source[key] === "string") environment[key] = source[key];
-  }
-  return environment;
-}
-
-function readWindowsRuntimeCredential({
-  home = process.env.USERPROFILE || os.homedir(),
-  expectedOrigin,
-  stateStore,
-  spawnImpl = spawnSync,
-  helperPath = path.join(__dirname, "windows-read-user-environment.ps1"),
-  randomUUID = crypto.randomUUID,
-} = {}) {
-  const store = stateStore || require("./windows-platform.js")
-    .createWindowsSecureStateStore({ home });
-  const directory = store.ensurePrivateDirectory(path.join(home, ".rainbond", "rainskills"));
-  const outputPath = store.assertInsideHome(
-    path.join(directory, `.credential-read-${randomUUID()}.json`),
-    "凭据读取文件"
-  );
-  let fd;
-  try {
-    fd = fs.openSync(outputPath, "wx", 0o600);
-    fs.closeSync(fd);
-    fd = undefined;
-    store.protectRegularFile(outputPath);
-    const result = spawnImpl("powershell.exe", [
-      "-NoProfile",
-      "-NonInteractive",
-      "-File",
-      helperPath,
-    ], {
-      env: windowsReaderEnvironment(outputPath),
-      stdio: ["ignore", "ignore", "ignore"],
-      windowsHide: true,
-    });
-    if (result?.error || result?.signal || result?.status !== 0) {
-      throw new Error("无法安全读取 Windows 用户级 Rainbond 凭据");
-    }
-    store.assertProtectedRegularFile(outputPath);
-    const info = fs.lstatSync(outputPath);
-    if (info.size > MAX_CREDENTIAL_FILE_BYTES) throw new Error("Rainbond 凭据文件过大");
-    let payload;
-    try {
-      payload = JSON.parse(fs.readFileSync(outputPath, "utf8"));
-    } catch {
-      throw new Error("Windows 用户级 Rainbond 凭据无效");
-    }
-    return validateCredentialPayload(payload, expectedOrigin);
-  } finally {
-    if (fd !== undefined) fs.closeSync(fd);
-    try {
-      fs.unlinkSync(outputPath);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-  }
-}
-
-function readRuntimeCredential({
-  platform = process.platform,
-  environmentId,
-  environmentCredentialStore,
-  ...options
-} = {}) {
-  if (environmentId !== undefined) {
-    const store = environmentCredentialStore || require("./environment-credentials.js")
-      .createEnvironmentCredentialStore({ platform, ...options });
-    return store.read({
-      environmentId,
-      expectedOrigin: options.expectedOrigin,
-    });
-  }
-  return platform === "win32"
-    ? readWindowsRuntimeCredential(options)
-    : readPosixRuntimeCredential(options);
-}
-
-module.exports = {
-  readPosixRuntimeCredential,
-  readRuntimeCredential,
-  readWindowsRuntimeCredential,
-  validateCredentialPayload,
-  windowsReaderEnvironment,
-};