superun-ai-cli 0.1.65 → 0.1.66
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/INSTALL.md +2 -0
- package/README.en.md +1 -1
- package/README.md +1 -1
- package/dist/auth/pat-store.js +14 -3
- package/dist/auth/pat-store.js.map +1 -1
- package/dist/auth/windows-credential-acl.d.ts +2 -0
- package/dist/auth/windows-credential-acl.js +68 -0
- package/dist/auth/windows-credential-acl.js.map +1 -0
- package/package.json +1 -1
package/INSTALL.md
CHANGED
|
@@ -106,6 +106,8 @@ superun-ai auth login
|
|
|
106
106
|
|
|
107
107
|
CLI 会打开 superun 登录页面，完成后领取 PAT 并保存到本地。浏览器未自动打开时，把 CLI 打印的登录地址提供给用户。保持登录命令运行，等它返回成功；不要另起重复登录流程。等待期间告诉用户需要完成网页登录，超时或取消时如实说明。
|
|
108
108
|
|
|
109
|
+
Windows 从 0.1.66 起使用系统 ACL 校验凭据，不要求 POSIX `0600`。保存前先收紧并核对临时文件 ACL；读取时仅允许当前用户、SYSTEM 和本机管理员访问。系统 PowerShell 不可用或 ACL 不安全时停止并保留错误，不关闭权限保护。自动化环境可复用用户已安全配置的 `SUPERUN_PAT`，不得要求用户将秘密发到聊天、写入命令参数或日志。
|
|
110
|
+
|
|
109
111
|
如果用户明确要导入已有 PAT，请让用户在自己的交互式终端执行：
|
|
110
112
|
|
|
111
113
|
```bash
|
package/README.en.md
CHANGED
|
@@ -322,7 +322,7 @@ For unattended automation, configure `SUPERUN_PAT` ahead of time or import a PAT
|
|
|
322
322
|
printf '%s\n' "$SUPERUN_PAT" | superun-ai auth login --stdin
|
|
323
323
|
```
|
|
324
324
|
|
|
325
|
-
The CLI prefers `SUPERUN_PAT`, then `~/.config/superun-ai-cli/credentials.json`.
|
|
325
|
+
The CLI prefers `SUPERUN_PAT`, then `~/.config/superun-ai-cli/credentials.json`. macOS/Linux enforce `0600` file permissions. Windows checks the system ACL through PowerShell: the current user must own the file, and only that user, SYSTEM, and local administrators may have access. Before saving on Windows, the CLI restricts the empty temporary file to the current user and verifies the ACL before writing the PAT. Failed permission checks stop the operation without falling back to unprotected storage. Logging out removes the local credential without revoking the server-side PAT. Never put a PAT in command-line arguments, source control, or logs.
|
|
326
326
|
|
|
327
327
|
`auth status` checks local configuration by default; `CONFIGURED` does not prove that the credential is valid. Add `--online` for read-only verification, returning `authenticated=true` and `checkedOnline=true` on success without opening a browser, requesting a PAT, displaying projects, or selecting a project. Project permission and stage checks still apply to each operation.
|
|
328
328
|
|
package/README.md
CHANGED
|
@@ -335,7 +335,7 @@ superun-ai auth login --pat
|
|
|
335
335
|
printf '%s\n' "$SUPERUN_PAT" | superun-ai auth login --stdin
|
|
336
336
|
```
|
|
337
337
|
|
|
338
|
-
凭据优先级为 `SUPERUN_PAT` 环境变量，其次是 `~/.config/superun-ai-cli/credentials.json
|
|
338
|
+
凭据优先级为 `SUPERUN_PAT` 环境变量，其次是 `~/.config/superun-ai-cli/credentials.json`。macOS/Linux 校验文件权限为 `0600`；Windows 使用系统 PowerShell 校验 ACL，文件须归当前用户所有，允许访问的主体仅为当前用户、SYSTEM 和本机管理员，不用 POSIX mode 判断 Windows 权限。Windows 保存时先将空临时文件的 ACL 收紧为当前用户独占并读回校验，再写入 PAT；权限设置或校验失败时停止，不回退为无保护存储。退出登录只清除本地保存的凭据，不撤销服务端 PAT。请勿将 PAT 写进命令行参数、仓库或日志。
|
|
339
339
|
|
|
340
340
|
`auth status` 默认只查看本地配置，`CONFIGURED` 不代表凭据仍有效。加 `--online` 会只读验证现有 PAT，成功时返回 `authenticated=true`、`checkedOnline=true`，不会打开浏览器、申请 PAT、输出作品列表或选择项目。在线登录有效也不代表有权操作任意作品，具体操作仍需实时检查权限与阶段。
|
|
341
341
|
|
package/dist/auth/pat-store.js
CHANGED
|
@@ -6,6 +6,7 @@ import { randomUUID } from 'node:crypto';
|
|
|
6
6
|
import { PACKAGE_NAME, PAT_PREFIX } from '../config/constants.js';
|
|
7
7
|
import { CliError } from '../output/exit-codes.js';
|
|
8
8
|
import { object, text } from '../contracts/value.js';
|
|
9
|
+
import { protectWindowsCredential, verifyWindowsCredential } from './windows-credential-acl.js';
|
|
9
10
|
export const CREDENTIAL_DIRECTORY = join(homedir(), '.config', PACKAGE_NAME);
|
|
10
11
|
export function validatePat(value) {
|
|
11
12
|
const pat = value.trim();
|
|
@@ -31,7 +32,12 @@ export class PatStore {
|
|
|
31
32
|
const path = join(this.directory, 'credentials.json');
|
|
32
33
|
try {
|
|
33
34
|
const stat = await lstat(path);
|
|
34
|
-
if (!stat.isFile() || stat.isSymbolicLink()
|
|
35
|
+
if (!stat.isFile() || stat.isSymbolicLink()) {
|
|
36
|
+
throw new CliError('AUTH_REQUIRED', '本地凭据必须为普通文件，不能使用符号链接');
|
|
37
|
+
}
|
|
38
|
+
if (process.platform === 'win32')
|
|
39
|
+
await verifyWindowsCredential(path);
|
|
40
|
+
else if ((stat.mode & 0o077) !== 0) {
|
|
35
41
|
throw new CliError('AUTH_REQUIRED', '本地凭据必须为权限 0600 的普通文件，请重新执行 auth login');
|
|
36
42
|
}
|
|
37
43
|
const value = JSON.parse(await readFile(path, 'utf8'));
|
|
@@ -46,12 +52,17 @@ export class PatStore {
|
|
|
46
52
|
}
|
|
47
53
|
}
|
|
48
54
|
async save(pat) {
|
|
55
|
+
const validPat = validatePat(pat);
|
|
49
56
|
await mkdir(this.directory, { recursive: true, mode: 0o700 });
|
|
50
|
-
|
|
57
|
+
if (process.platform !== 'win32')
|
|
58
|
+
await chmod(this.directory, 0o700);
|
|
51
59
|
const temporary = join(this.directory, `.credentials-${randomUUID()}.tmp`);
|
|
52
60
|
const handle = await open(temporary, 'wx', 0o600);
|
|
53
61
|
try {
|
|
54
|
-
|
|
62
|
+
// Windows 先收紧空临时文件的 ACL 并读回校验，成功后才写入秘密。
|
|
63
|
+
if (process.platform === 'win32')
|
|
64
|
+
await protectWindowsCredential(temporary);
|
|
65
|
+
await handle.writeFile(JSON.stringify({ pat: validPat, createdAt: new Date().toISOString() }));
|
|
55
66
|
await handle.sync();
|
|
56
67
|
await handle.close();
|
|
57
68
|
await rename(temporary, join(this.directory, 'credentials.json'));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pat-store.js","sourceRoot":"","sources":["../../src/auth/pat-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"pat-store.js","sourceRoot":"","sources":["../../src/auth/pat-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEhG,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAG7E,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,YAAY,oBAAoB;QAAhC,cAAS,GAAT,SAAS,CAAuB;IAAG,CAAC;IAEjE,KAAK,CAAC,IAAI;QACR,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;QAC7F,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS;YACvC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5C,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;iBACjE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAChE,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACtD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,UAAU,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,wCAAwC;YACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC5E,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/F,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAe;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;IAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACnC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,KAAgB,EAAE,EAAE;YAClC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACpB,CAAC;gBACJ,IAAI,CAAC;oBACH,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;YAChC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,CAAC,IAAI,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC7C,MAAM,EAAE,CAAC;oBACT,OAAO;gBACT,CAAC;gBACD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;oBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;;oBACxE,KAAK,IAAI,SAAS,CAAC;gBACxB,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC;oBACrD,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
/** Windows 凭据使用系统 ACL，不把 POSIX mode 当作权限依据。@author xiuyu.yi */
|
|
2
|
+
import { execFile } from 'node:child_process';
|
|
3
|
+
import { win32 } from 'node:path';
|
|
4
|
+
import { promisify } from 'node:util';
|
|
5
|
+
import { CliError } from '../output/exit-codes.js';
|
|
6
|
+
const execute = promisify(execFile);
|
|
7
|
+
// 只传文件路径，不向 PowerShell 传递 PAT、用户配置或业务环境变量。
|
|
8
|
+
async function credentialAcl(path, protect) {
|
|
9
|
+
const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
|
|
10
|
+
if (!systemRoot || !win32.isAbsolute(systemRoot))
|
|
11
|
+
throw new CliError('AUTH_REQUIRED', '无法定位 Windows 系统权限工具，不能安全读写本地 PAT');
|
|
12
|
+
const script = `
|
|
13
|
+
$ErrorActionPreference = 'Stop'
|
|
14
|
+
try {
|
|
15
|
+
$path = $env:SUPERUN_CREDENTIAL_ACL_PATH
|
|
16
|
+
$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
|
|
17
|
+
$sidType = [System.Security.Principal.SecurityIdentifier]
|
|
18
|
+
${protect
|
|
19
|
+
? `
|
|
20
|
+
$acl = [System.Security.AccessControl.FileSecurity]::new()
|
|
21
|
+
$acl.SetOwner($user)
|
|
22
|
+
$acl.SetAccessRuleProtection($true, $false)
|
|
23
|
+
$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
|
|
24
|
+
$user, [System.Security.AccessControl.FileSystemRights]::FullControl,
|
|
25
|
+
[System.Security.AccessControl.AccessControlType]::Allow)
|
|
26
|
+
$acl.AddAccessRule($rule)
|
|
27
|
+
Microsoft.PowerShell.Security\\Set-Acl -LiteralPath $path -AclObject $acl
|
|
28
|
+
`
|
|
29
|
+
: ''}
|
|
30
|
+
$acl = Microsoft.PowerShell.Security\\Get-Acl -LiteralPath $path
|
|
31
|
+
if ($acl.GetOwner($sidType).Value -ne $user.Value) { exit 2 }
|
|
32
|
+
$allowed = @($user.Value, 'S-1-5-18', 'S-1-5-32-544')
|
|
33
|
+
$hasUser = $false
|
|
34
|
+
foreach ($rule in $acl.GetAccessRules($true, $true, $sidType)) {
|
|
35
|
+
if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { continue }
|
|
36
|
+
if ($allowed -notcontains $rule.IdentityReference.Value) { exit 2 }
|
|
37
|
+
if ($rule.IdentityReference.Value -eq $user.Value) { $hasUser = $true }
|
|
38
|
+
}
|
|
39
|
+
if (-not $hasUser) { exit 2 }
|
|
40
|
+
[Console]::Out.Write('SUPERUN_ACL_OK')
|
|
41
|
+
} catch { exit 1 }
|
|
42
|
+
`;
|
|
43
|
+
try {
|
|
44
|
+
const { stdout } = await execute(win32.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'), [
|
|
45
|
+
'-NoLogo',
|
|
46
|
+
'-NoProfile',
|
|
47
|
+
'-NonInteractive',
|
|
48
|
+
'-EncodedCommand',
|
|
49
|
+
Buffer.from(script, 'utf16le').toString('base64'),
|
|
50
|
+
], {
|
|
51
|
+
shell: false,
|
|
52
|
+
windowsHide: true,
|
|
53
|
+
timeout: 15_000,
|
|
54
|
+
maxBuffer: 4096,
|
|
55
|
+
env: { SystemRoot: systemRoot, WINDIR: systemRoot, SUPERUN_CREDENTIAL_ACL_PATH: path },
|
|
56
|
+
});
|
|
57
|
+
if (stdout.trim() !== 'SUPERUN_ACL_OK')
|
|
58
|
+
throw new Error('ACL_CHECK_FAILED');
|
|
59
|
+
}
|
|
60
|
+
catch {
|
|
61
|
+
throw new CliError('AUTH_REQUIRED', protect
|
|
62
|
+
? '无法安全设置 Windows 凭据 ACL，未保存 PAT；请检查当前用户的文件权限'
|
|
63
|
+
: 'Windows 凭据 ACL 校验未通过；仅允许当前用户、SYSTEM 和本机管理员访问，请核对权限或重新导入凭据', { authFailure: 'CREDENTIAL_PERMISSION_DENIED' });
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
export const protectWindowsCredential = (path) => credentialAcl(path, true);
|
|
67
|
+
export const verifyWindowsCredential = (path) => credentialAcl(path, false);
|
|
68
|
+
//# sourceMappingURL=windows-credential-acl.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"windows-credential-acl.js","sourceRoot":"","sources":["../../src/auth/windows-credential-acl.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEpC,2CAA2C;AAC3C,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAgB;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACpE,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG;;;;;;IAOb,OAAO;QACL,CAAC,CAAC;;;;;;;;;GASL;QACG,CAAC,CAAC,EACN;;;;;;;;;;;;;CAaD,CAAC;IACA,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAC9B,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,EACjF;YACE,SAAS;YACT,YAAY;YACZ,iBAAiB;YACjB,iBAAiB;YACjB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAClD,EACD;YACE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,IAAI,EAAE;SACvF,CACF,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,eAAe,EACf,OAAO;YACL,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,2DAA2D,EAC/D,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAChD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAiB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC"}
|