redskillhub-upload 1.0.0-alpha.5 → 1.0.0-alpha.6

package/README.md

@@ -16,7 +16,7 @@ Publish input can be a local Skill directory or a `.zip` file. User-provided zip
 
 ## API Endpoints
 
-All paths and hosts are centralized in `cli/config.mjs` (`PATHS` + `DEFAULT_API_BASE` / `DEFAULT_OAS_BASE`).
+All paths and hosts are centralized in `cli/config.mjs` (`PATHS` + `DEFAULT_API_BASE` / `BETA_API_BASE`).
 
 | Path Key | Path | Host | Description |
 |----------|------|------|-------------|
@@ -24,16 +24,15 @@ All paths and hosts are centralized in `cli/config.mjs` (`PATHS` + `DEFAULT_API_
 | `SUBMIT_SKILL_VERSION` | `/api/sns/v1/openapi/skillhub/submit_skill_version` | `DEFAULT_API_BASE` | 提交 skill 版本 |
 | `CREATE_CLI_OAUTH_DEVICE_CODE` | `/api/sns/v1/creator/red_skill/create_cli_oauth_device_code` | `DEFAULT_API_BASE` | 创建 CLI OAuth 设备码 |
 | `POLL_CLI_OAUTH_DEVICE_TOKEN` | `/api/sns/v1/creator/red_skill/poll_cli_oauth_device_token` | `DEFAULT_API_BASE` | 轮询 CLI OAuth 授权状态 |
-| `OAS_ACCESS_TOKEN` | `/api/sns/v1/oauth2/access_token` | `DEFAULT_OAS_BASE` | 用授权码换取 access_token |
-| `OAS_REFRESH_TOKEN` | `/api/sns/v1/oauth2/refresh_token` | `DEFAULT_OAS_BASE` | 用 refresh_token 续期 access_token |
+| `EXCHANGE_CLI_OAUTH_TOKEN` | `/api/sns/v1/creator/red_skill/exchange_cli_oauth_token` | `DEFAULT_API_BASE` / `BETA_API_BASE` | 通过 SkillHub 服务端换取 access_token |
+| `REFRESH_CLI_OAUTH_TOKEN` | `/api/sns/v1/creator/red_skill/refresh_cli_oauth_token` | `DEFAULT_API_BASE` / `BETA_API_BASE` | 通过 SkillHub 服务端续期 access_token |
 
 - `DEFAULT_API_BASE` = `https://edith.xiaohongshu.com` — 生产业务接口
 - `BETA_API_BASE` = `https://edith.beta.xiaohongshu.com` — beta 业务接口
-- `DEFAULT_OAS_BASE` = `https://openaccount.xiaohongshu.com` — OAuth2 开放平台接口
 - 所有命令都支持 `--env prod|beta`，默认 `prod`；`--env beta` 时业务接口使用 `BETA_API_BASE`
 - prod 沿用 `~/.skillhub-upload`，beta 使用 `~/.skillhub-upload/beta`，凭证、待授权、二维码、标签缓存和临时包相互隔离
 - 业务接口 host 可通过 `--api-base` 参数或 `SKILLHUB_UPLOAD_API_BASE` 环境变量覆盖
-- OAS 换 token 默认使用内置应用凭证；可通过 `SKILLHUB_UPLOAD_APP_SECRET` 覆盖
+- OAuth token 换取与刷新统一走 SkillHub 服务端 broker，CLI 不保存 appSecret
 
 ## Auth Flow
 

package/cli/auth.mjs

@@ -3,9 +3,6 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import {
   DEFAULT_API_BASE,
-  DEFAULT_APP_ID,
-  DEFAULT_APP_SECRET,
-  DEFAULT_OAS_BASE,
   DEFAULT_SCOPE,
   DEFAULT_SCOPES,
   PATHS,
@@ -108,34 +105,17 @@ function unwrapResponseBody(body) {
   return body?.data && typeof body.data === 'object' ? body.data : body;
 }
 
-function resolveAppSecret(flags = {}, env = process.env) {
-  return flags.appSecret
-    || flags['app-secret']
-    || env.SKILLHUB_UPLOAD_APP_SECRET
-    || DEFAULT_APP_SECRET;
-}
-
 function buildTokenRequestBody(fields = {}) {
-  const body = {
-    app_id: fields.appId,
-    code: fields.authorizationCode,
+  return {
+    authorization_code: fields.authorizationCode,
     code_verifier: fields.codeVerifier
   };
-  if (fields.appSecret) {
-    body.app_secret = fields.appSecret;
-  }
-  return body;
 }
 
 function buildRefreshRequestBody(fields = {}) {
-  const body = {
-    app_id: fields.appId,
+  return {
     refresh_token: fields.refreshToken
   };
-  if (fields.appSecret) {
-    body.app_secret = fields.appSecret;
-  }
-  return body;
 }
 
 function getRejectMessage(body, fallback) {
@@ -231,14 +211,12 @@ export async function pollDeviceToken({ apiBase, deviceCode, fetchImpl = compati
 }
 
 export async function exchangeToken({
-  tokenUrl = `${DEFAULT_OAS_BASE}${PATHS.OAS_ACCESS_TOKEN}`,
-  appId = DEFAULT_APP_ID,
-  appSecret = '',
+  tokenUrl = `${DEFAULT_API_BASE}${PATHS.EXCHANGE_CLI_OAUTH_TOKEN}`,
   authorizationCode,
   codeVerifier,
   fetchImpl = compatibleFetch
 }) {
-  const body = buildTokenRequestBody({ appId, appSecret, authorizationCode, codeVerifier });
+  const body = buildTokenRequestBody({ authorizationCode, codeVerifier });
   const response = await fetchImpl(tokenUrl, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
@@ -257,13 +235,11 @@ export async function exchangeToken({
 }
 
 export async function refreshToken({
-  tokenUrl = `${DEFAULT_OAS_BASE}${PATHS.OAS_REFRESH_TOKEN}`,
-  appId = DEFAULT_APP_ID,
-  appSecret = '',
+  tokenUrl = `${DEFAULT_API_BASE}${PATHS.REFRESH_CLI_OAUTH_TOKEN}`,
   refreshToken: rt,
   fetchImpl = compatibleFetch
 }) {
-  const body = buildRefreshRequestBody({ appId, appSecret, refreshToken: rt });
+  const body = buildRefreshRequestBody({ refreshToken: rt });
   const response = await fetchImpl(tokenUrl, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
@@ -283,7 +259,6 @@ export async function refreshToken({
 
 function buildCredentialsFromToken(token, nowMs, errorCode) {
   const credentials = {
-    appId: token.app_id || token.appId || DEFAULT_APP_ID,
     accessToken: token.access_token || token.accessToken || '',
     refreshToken: token.refresh_token || token.refreshToken || '',
     expireTimeMs: String(token.expire_time_ms || token.expireTimeMs || nowMs + Number(token.expires_in || 7200) * 1000),
@@ -349,6 +324,7 @@ export async function login({
   now = () => Date.now(),
   promptStream = process.stdout
 } = {}) {
+  const apiBase = resolveApiBase(flags, env);
   const cachedCredentials = await readCredentials(env, flags);
   if (isValidCredentials(cachedCredentials, now())) {
     return maskCredentials(cachedCredentials);
@@ -357,12 +333,9 @@ export async function login({
   // access_token 过期但 refresh_token 仍有效，静默续期
   if (canRefreshCredentials(cachedCredentials, now())) {
     try {
-      const appSecret = resolveAppSecret(flags, env);
       const token = await refreshToken({
-        appId: cachedCredentials.appId || DEFAULT_APP_ID,
-        appSecret,
         refreshToken: cachedCredentials.refreshToken,
-        tokenUrl: flags.tokenUrl || `${DEFAULT_OAS_BASE}${PATHS.OAS_REFRESH_TOKEN}`,
+        tokenUrl: `${apiBase}${PATHS.REFRESH_CLI_OAUTH_TOKEN}`,
         fetchImpl
       });
       await writeCredentials(buildCredentialsFromToken(token, now(), 'OAS_TOKEN_REFRESH_INVALID_RESPONSE'), env, flags);
@@ -376,8 +349,6 @@ export async function login({
     }
   }
 
-  const apiBase = resolveApiBase(flags, env);
-
   // 从磁盘恢复未完成的授权状态，避免进程重启后要求用户重新授权
   let pending = await readPendingAuth(env, flags, now);
   let codeVerifier;
@@ -457,11 +428,9 @@ export async function login({
   }
 
   const token = await exchangeToken({
-    appId: DEFAULT_APP_ID,
-    appSecret: resolveAppSecret(flags, env),
     authorizationCode,
     codeVerifier,
-    tokenUrl: flags.tokenUrl || `${DEFAULT_OAS_BASE}${PATHS.OAS_ACCESS_TOKEN}`,
+    tokenUrl: `${apiBase}${PATHS.EXCHANGE_CLI_OAUTH_TOKEN}`,
     fetchImpl
   });
   await writeCredentials(buildCredentialsFromToken(token, now(), 'OAS_TOKEN_EXCHANGE_INVALID_RESPONSE'), env, flags);

package/cli/config.mjs

@@ -3,9 +3,6 @@ import path from 'node:path';
 
 export const DEFAULT_API_BASE = 'https://edith.xiaohongshu.com';
 export const BETA_API_BASE = 'https://edith-redskill.sl.beta.xiaohongshu.com';
-export const DEFAULT_OAS_BASE = 'https://openaccount.xiaohongshu.com';
-export const DEFAULT_APP_ID = 'xhsyfHfmZQAQ24o';
-export const DEFAULT_APP_SECRET = 'skHlFZ8BTk2bVmsSt1aYjv1NxcJjuOwhSev4oraniDa6eyn8L9oqBWvCtsEBnmCmWG';
 export const DEFAULT_SCOPES = ['base_info', 'skill_publish'];
 export const DEFAULT_SCOPE = DEFAULT_SCOPES.join(',');
  
@@ -14,8 +11,8 @@ export const PATHS = {
   SUBMIT_SKILL_VERSION: '/api/sns/v1/creator/red_skill/cli_submit_skill_version',
   CREATE_CLI_OAUTH_DEVICE_CODE: '/api/sns/v1/creator/red_skill/create_cli_oauth_device_code',
   POLL_CLI_OAUTH_DEVICE_TOKEN: '/api/sns/v1/creator/red_skill/poll_cli_oauth_device_token',
-  OAS_ACCESS_TOKEN: '/api/sns/v1/oauth2/access_token',
-  OAS_REFRESH_TOKEN: '/api/sns/v1/oauth2/refresh_token',
+  EXCHANGE_CLI_OAUTH_TOKEN: '/api/sns/v1/creator/red_skill/exchange_cli_oauth_token',
+  REFRESH_CLI_OAUTH_TOKEN: '/api/sns/v1/creator/red_skill/refresh_cli_oauth_token',
   QUERY_CONTENT_TAG_CONFIG: '/api/sns/v1/activity_platform/config/query_config'
 };
 export const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "redskillhub-upload",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.6",
   "type": "module",
   "publishConfig": {
     "access": "public",