trustbase-seller-backend 0.1.5

package/core/security.js

@@ -0,0 +1,390 @@
+"use strict";
+/**
+ * TrustChain Security Boundary Manager
+ *
+ * 安全边界管理器 - 确保各层之间的安全边界清晰
+ * 目标：解决安全边界模糊问题
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityBoundaryManager = exports.SecurityRateLimiter = exports.AuthorizationManager = exports.AuthenticationManager = exports.SecurityLevel = void 0;
+const events_1 = require("events");
+const crypto_1 = __importDefault(require("crypto"));
+// ===================== Security Types =====================
+var SecurityLevel;
+(function (SecurityLevel) {
+    SecurityLevel["PUBLIC"] = "public";
+    SecurityLevel["AUTHENTICATED"] = "authenticated";
+    SecurityLevel["AUTHORIZED"] = "authorized";
+    SecurityLevel["ADMIN"] = "admin";
+})(SecurityLevel || (exports.SecurityLevel = SecurityLevel = {}));
+// ===================== Authentication Manager =====================
+/**
+ * 认证管理器
+ */
+class AuthenticationManager extends events_1.EventEmitter {
+    tokens = new Map();
+    tokenExpiry = 3600000; // 1小时过期
+    /**
+     * 生成认证令牌
+     */
+    generateToken(userId, address, role) {
+        const token = crypto_1.default.randomBytes(32).toString('hex');
+        const now = Date.now();
+        const context = {
+            userId,
+            address,
+            role,
+            permissions: this.getPermissionsForRole(role),
+            authenticatedAt: now,
+            expiresAt: now + this.tokenExpiry,
+        };
+        this.tokens.set(token, context);
+        console.log(`[Auth] Token generated for ${userId}`);
+        this.emit('token-generated', token, context);
+        return token;
+    }
+    /**
+     * 验证令牌
+     */
+    verifyToken(token) {
+        const context = this.tokens.get(token);
+        if (!context) {
+            console.warn(`[Auth] Invalid token: ${token}`);
+            return null;
+        }
+        if (context.expiresAt && Date.now() > context.expiresAt) {
+            this.tokens.delete(token);
+            console.warn(`[Auth] Token expired: ${token}`);
+            this.emit('token-expired', token);
+            return null;
+        }
+        return context;
+    }
+    /**
+     * 刷新令牌
+     */
+    refreshToken(token) {
+        const context = this.tokens.get(token);
+        if (!context)
+            return null;
+        // 生成新令牌
+        const newToken = crypto_1.default.randomBytes(32).toString('hex');
+        context.expiresAt = Date.now() + this.tokenExpiry;
+        this.tokens.delete(token);
+        this.tokens.set(newToken, context);
+        console.log(`[Auth] Token refreshed`);
+        this.emit('token-refreshed', newToken, context);
+        return newToken;
+    }
+    /**
+     * 撤销令牌
+     */
+    revokeToken(token) {
+        this.tokens.delete(token);
+        console.log(`[Auth] Token revoked: ${token}`);
+        this.emit('token-revoked', token);
+    }
+    /**
+     * 根据角色获取权限
+     */
+    getPermissionsForRole(role) {
+        const rolePermissions = {
+            'buyer': ['search', 'query', 'create_order', 'confirm_order', 'cancel_order', 'submit_review'],
+            'seller': ['search', 'query', 'list_product', 'ship_order', 'update_product', 'delist_product'],
+            'admin': ['search', 'query', 'create_order', 'confirm_order', 'cancel_order', 'submit_review',
+                'list_product', 'ship_order', 'update_product', 'delist_product',
+                'manage_users', 'manage_orders', 'manage_products', 'view_stats'],
+        };
+        return rolePermissions[role] || [];
+    }
+    /**
+     * 获取认证统计
+     */
+    getAuthStats() {
+        return {
+            activeTokens: this.tokens.size,
+            expiry: this.tokenExpiry,
+        };
+    }
+}
+exports.AuthenticationManager = AuthenticationManager;
+// ===================== Authorization Manager =====================
+/**
+ * 授权管理器
+ */
+class AuthorizationManager extends events_1.EventEmitter {
+    policies = new Map();
+    constructor() {
+        super();
+        // 初始化默认安全策略
+        this.initializeDefaultPolicies();
+    }
+    /**
+     * 初始化默认安全策略
+     */
+    initializeDefaultPolicies() {
+        // MCP工具安全策略
+        this.addPolicy({
+            resource: 'search_products',
+            action: 'read',
+            level: SecurityLevel.PUBLIC,
+            rateLimit: 100,
+        });
+        this.addPolicy({
+            resource: 'create_order',
+            action: 'write',
+            level: SecurityLevel.AUTHENTICATED,
+            requiredPermissions: ['create_order'],
+            rateLimit: 10,
+        });
+        this.addPolicy({
+            resource: 'confirm_order',
+            action: 'write',
+            level: SecurityLevel.AUTHENTICATED,
+            requiredPermissions: ['confirm_order'],
+            rateLimit: 10,
+        });
+        this.addPolicy({
+            resource: 'list_product',
+            action: 'write',
+            level: SecurityLevel.AUTHENTICATED,
+            requiredPermissions: ['list_product'],
+            rateLimit: 20,
+        });
+        this.addPolicy({
+            resource: 'manage_users',
+            action: 'admin',
+            level: SecurityLevel.ADMIN,
+            requiredPermissions: ['manage_users'],
+            rateLimit: 5,
+        });
+        // 支付网关安全策略
+        this.addPolicy({
+            resource: 'payment_callback',
+            action: 'write',
+            level: SecurityLevel.AUTHORIZED,
+            requiredPermissions: ['payment_callback'],
+            rateLimit: 100,
+        });
+        // P2P节点安全策略
+        this.addPolicy({
+            resource: 'p2p_query',
+            action: 'read',
+            level: SecurityLevel.PUBLIC,
+            rateLimit: 50,
+        });
+        this.addPolicy({
+            resource: 'p2p_verify',
+            action: 'read',
+            level: SecurityLevel.AUTHENTICATED,
+            requiredPermissions: ['p2p_verify'],
+            rateLimit: 20,
+        });
+        console.log('[AuthZ] Default policies initialized');
+    }
+    /**
+     * 添加安全策略
+     */
+    addPolicy(policy) {
+        const key = `${policy.resource}:${policy.action}`;
+        this.policies.set(key, policy);
+        console.log(`[AuthZ] Policy added: ${key}`);
+    }
+    /**
+     * 检查权限
+     */
+    checkPermission(resource, action, context) {
+        const key = `${resource}:${action}`;
+        const policy = this.policies.get(key);
+        if (!policy) {
+            console.warn(`[AuthZ] No policy found for ${key}`);
+            return false;
+        }
+        // 公开访问
+        if (policy.level === SecurityLevel.PUBLIC) {
+            return true;
+        }
+        // 需要认证
+        if (!context) {
+            console.warn(`[AuthZ] Authentication required for ${key}`);
+            return false;
+        }
+        // 检查权限
+        if (policy.requiredPermissions) {
+            const hasPermission = policy.requiredPermissions.every(perm => context.permissions?.includes(perm));
+            if (!hasPermission) {
+                console.warn(`[AuthZ] Missing permissions for ${key}`);
+                return false;
+            }
+        }
+        // 管理员权限
+        if (policy.level === SecurityLevel.ADMIN && context.role !== 'admin') {
+            console.warn(`[AuthZ] Admin required for ${key}`);
+            return false;
+        }
+        return true;
+    }
+    /**
+     * 获取安全策略
+     */
+    getPolicy(resource, action) {
+        return this.policies.get(`${resource}:${action}`);
+    }
+    /**
+     * 获取所有策略
+     */
+    getAllPolicies() {
+        return Array.from(this.policies.values());
+    }
+}
+exports.AuthorizationManager = AuthorizationManager;
+// ===================== Rate Limiter =====================
+/**
+ * 速率限制器
+ */
+class SecurityRateLimiter extends events_1.EventEmitter {
+    requests = new Map();
+    maxRequests = 100;
+    windowMs = 60000; // 1分钟窗口
+    /**
+     * 检查速率限制
+     */
+    checkRateLimit(identifier, limit) {
+        const maxRequests = limit || this.maxRequests;
+        const now = Date.now();
+        const windowStart = now - this.windowMs;
+        // 获取请求历史
+        let history = this.requests.get(identifier) || [];
+        // 清理过期请求
+        history = history.filter(time => time > windowStart);
+        // 检查是否超限
+        if (history.length >= maxRequests) {
+            console.warn(`[RateLimit] Rate limit exceeded for ${identifier}`);
+            this.emit('rate-limit-exceeded', identifier, history.length);
+            return false;
+        }
+        // 记录请求
+        history.push(now);
+        this.requests.set(identifier, history);
+        return true;
+    }
+    /**
+     * 获取剩余配额
+     */
+    getRemainingQuota(identifier, limit) {
+        const maxRequests = limit || this.maxRequests;
+        const history = this.requests.get(identifier) || [];
+        const now = Date.now();
+        const windowStart = now - this.windowMs;
+        const recentRequests = history.filter(time => time > windowStart);
+        return Math.max(0, maxRequests - recentRequests.length);
+    }
+    /**
+     * 清理过期记录
+     */
+    cleanupExpiredRecords() {
+        const now = Date.now();
+        const windowStart = now - this.windowMs;
+        for (const [identifier, history] of this.requests) {
+            const cleaned = history.filter(time => time > windowStart);
+            if (cleaned.length === 0) {
+                this.requests.delete(identifier);
+            }
+            else {
+                this.requests.set(identifier, cleaned);
+            }
+        }
+    }
+    /**
+     * 获取速率限制统计
+     */
+    getRateLimitStats() {
+        return {
+            activeIdentifiers: this.requests.size,
+            maxRequests: this.maxRequests,
+            windowMs: this.windowMs,
+        };
+    }
+}
+exports.SecurityRateLimiter = SecurityRateLimiter;
+// ===================== Security Boundary Manager =====================
+/**
+ * 安全边界管理器（统一入口）
+ */
+class SecurityBoundaryManager extends events_1.EventEmitter {
+    authManager;
+    authzManager;
+    rateLimiter;
+    constructor() {
+        super();
+        this.authManager = new AuthenticationManager();
+        this.authzManager = new AuthorizationManager();
+        this.rateLimiter = new SecurityRateLimiter();
+        // 定期清理
+        setInterval(() => {
+            this.rateLimiter.cleanupExpiredRecords();
+        }, 60000);
+    }
+    /**
+     * 认证用户
+     */
+    authenticate(userId, address, role) {
+        return this.authManager.generateToken(userId, address, role);
+    }
+    /**
+     * 验证请求
+     */
+    validateRequest(resource, action, token, identifier) {
+        // 检查速率限制
+        if (identifier) {
+            const policy = this.authzManager.getPolicy(resource, action);
+            if (policy && policy.rateLimit) {
+                if (!this.rateLimiter.checkRateLimit(identifier, policy.rateLimit)) {
+                    return { valid: false, error: 'Rate limit exceeded' };
+                }
+            }
+        }
+        // 验证令牌
+        let context = null;
+        if (token) {
+            context = this.authManager.verifyToken(token);
+            if (!context) {
+                return { valid: false, error: 'Invalid or expired token' };
+            }
+        }
+        // 检查权限
+        if (!this.authzManager.checkPermission(resource, action, context || undefined)) {
+            return { valid: false, error: 'Permission denied' };
+        }
+        return { valid: true, context: context || undefined };
+    }
+    /**
+     * 刷新令牌
+     */
+    refreshToken(token) {
+        return this.authManager.refreshToken(token);
+    }
+    /**
+     * 撤销令牌
+     */
+    revokeToken(token) {
+        this.authManager.revokeToken(token);
+    }
+    /**
+     * 获取安全统计
+     */
+    getSecurityStats() {
+        return {
+            authentication: this.authManager.getAuthStats(),
+            authorization: {
+                policies: this.authzManager.getAllPolicies().length,
+            },
+            rateLimit: this.rateLimiter.getRateLimitStats(),
+        };
+    }
+}
+exports.SecurityBoundaryManager = SecurityBoundaryManager;
+//# sourceMappingURL=security.js.map

package/core/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/core/security.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,mCAAsC;AACtC,oDAA4B;AAE5B,6DAA6D;AAE7D,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,gDAA+B,CAAA;IAC/B,0CAAyB,CAAA;IACzB,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,6BAAb,aAAa,QAKxB;AAmBD,qEAAqE;AAErE;;GAEG;AACH,MAAa,qBAAsB,SAAQ,qBAAY;IAC7C,MAAM,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC7C,WAAW,GAAW,OAAO,CAAC,CAAC,QAAQ;IAE/C;;OAEG;IACH,aAAa,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY;QACzD,MAAM,KAAK,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAgB;YAC3B,MAAM;YACN,OAAO;YACP,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAC7C,eAAe,EAAE,GAAG;YACpB,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,WAAW;SAClC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEhC,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,QAAQ;QACR,MAAM,QAAQ,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEnC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,IAAY;QACxC,MAAM,eAAe,GAA6B;YAChD,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,CAAC;YAC9F,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;YAC/F,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe;gBACnF,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;gBAChE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC;SAC5E,CAAC;QAEF,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC9B,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC;IACJ,CAAC;CACF;AAtGD,sDAsGC;AAED,oEAAoE;AAEpE;;GAEG;AACH,MAAa,oBAAqB,SAAQ,qBAAY;IAC5C,QAAQ,GAAgC,IAAI,GAAG,EAAE,CAAC;IAE1D;QACE,KAAK,EAAE,CAAC;QACR,YAAY;QACZ,IAAI,CAAC,yBAAyB,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,yBAAyB;QAC/B,YAAY;QACZ,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,aAAa,CAAC,MAAM;YAC3B,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa,CAAC,aAAa;YAClC,mBAAmB,EAAE,CAAC,cAAc,CAAC;YACrC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa,CAAC,aAAa;YAClC,mBAAmB,EAAE,CAAC,eAAe,CAAC;YACtC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa,CAAC,aAAa;YAClC,mBAAmB,EAAE,CAAC,cAAc,CAAC;YACrC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,mBAAmB,EAAE,CAAC,cAAc,CAAC;YACrC,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QAEH,WAAW;QACX,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,aAAa,CAAC,UAAU;YAC/B,mBAAmB,EAAE,CAAC,kBAAkB,CAAC;YACzC,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,YAAY;QACZ,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,aAAa,CAAC,MAAM;YAC3B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC;YACb,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,aAAa,CAAC,aAAa;YAClC,mBAAmB,EAAE,CAAC,YAAY,CAAC;YACnC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAsB;QAC9B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,eAAe,CACb,QAAgB,EAChB,MAAc,EACd,OAAqB;QAErB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO;QACP,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;QACP,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO;QACP,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CACpD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAC5C,CAAC;YAEF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,QAAQ;QACR,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,MAAc;QACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;CACF;AAvJD,oDAuJC;AAED,2DAA2D;AAE3D;;GAEG;AACH,MAAa,mBAAoB,SAAQ,qBAAY;IAC3C,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAC;IAC5C,WAAW,GAAW,GAAG,CAAC;IAC1B,QAAQ,GAAW,KAAK,CAAC,CAAC,QAAQ;IAE1C;;OAEG;IACH,cAAc,CAAC,UAAkB,EAAE,KAAc;QAC/C,MAAM,WAAW,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAExC,SAAS;QACT,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAElD,SAAS;QACT,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;QAErD,SAAS;QACT,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO;QACP,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAkB,EAAE,KAAc;QAClD,MAAM,WAAW,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAExC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAExC,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;YAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF;AAzED,kDAyEC;AAED,wEAAwE;AAExE;;GAEG;AACH,MAAa,uBAAwB,SAAQ,qBAAY;IAC/C,WAAW,CAAwB;IACnC,YAAY,CAAuB;IACnC,WAAW,CAAsB;IAEzC;QACE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAE7C,OAAO;QACP,WAAW,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;QAC3C,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,eAAe,CACb,QAAgB,EAChB,MAAc,EACd,KAAc,EACd,UAAmB;QAEnB,SAAS;QACT,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;QACP,IAAI,OAAO,GAAuB,IAAI,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO;QACP,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,IAAI,SAAS,CAAC,EAAE,CAAC;YAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACtD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;YAC/C,aAAa,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM;aACpD;YACD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE;SAChD,CAAC;IACJ,CAAC;CACF;AAtFD,0DAsFC"}

package/core/seller-identity.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * seller-identity.js — 卖家真实身份生成/读取
+ *
+ * BIP39 24 词助记词 → HD 派生 m/44'/118'/0'/0/0 → secp256k1 压缩公钥
+ * → RIPEMD160(SHA256(pubkey)) → bech32(tct) 地址 (cosmos 标准)。
+ *
+ * 密钥只落盘在运行目录 tb-keyring/ 下 (mnemonic.txt + address.txt),
+ * 不写日志, 不传任何远程接口。
+ */
+const fs = require("fs");
+const path = require("path");
+
+const HD_PATH = "m/44'/118'/0'/0/0";
+const ADDR_PREFIX = "tct";
+
+/** 助记词 → tct1 地址 (派生正确性由 test-seller-identity.js 的测试向量保证) */
+async function mnemonicToAddress(mnemonic) {
+    const { Bip39, EnglishMnemonic, Slip10, Slip10Curve, Secp256k1, stringToPath } = require("@cosmjs/crypto");
+    const { rawSecp256k1PubkeyToRawAddress } = require("@cosmjs/amino");
+    const { toBech32 } = require("@cosmjs/encoding");
+    // 注意: Bip39.mnemonicToSeed 在 @cosmjs/crypto 0.38 是 async, 必须 await
+    const seed = await Bip39.mnemonicToSeed(new EnglishMnemonic(mnemonic));
+    const { privkey } = Slip10.derivePath(Slip10Curve.Secp256k1, seed, stringToPath(HD_PATH));
+    const keypair = await Secp256k1.makeKeypair(privkey);
+    const pubkey = Secp256k1.compressPubkey(keypair.pubkey);
+    return toBech32(ADDR_PREFIX, rawSecp256k1PubkeyToRawAddress(pubkey));
+}
+
+async function generateMnemonic() {
+    const { Bip39, Random } = require("@cosmjs/crypto");
+    return (await Bip39.encode(await Random.getBytes(32))).toString(); // 256-bit 熵 → 24 词
+}
+
+function identityPaths(baseDir) {
+    const keyringDir = path.join(baseDir, "tb-keyring");
+    return {
+        keyringDir,
+        mnemonicFile: path.join(keyringDir, "mnemonic.txt"),
+        addressFile: path.join(keyringDir, "address.txt"),
+    };
+}
+
+/** 读取已有身份 (不生成); 没有助记词返回 null; 有助记词缺地址则现算并补写 */
+async function readSellerIdentity(baseDir) {
+    const p = identityPaths(baseDir);
+    if (!fs.existsSync(p.mnemonicFile)) return null;
+    const mnemonic = fs.readFileSync(p.mnemonicFile, "utf8").trim();
+    if (!mnemonic) return null;
+    let address = null;
+    if (fs.existsSync(p.addressFile)) address = fs.readFileSync(p.addressFile, "utf8").trim() || null;
+    if (!address || !address.startsWith(ADDR_PREFIX + "1")) {
+        address = await mnemonicToAddress(mnemonic);
+        fs.writeFileSync(p.addressFile, address + "\n", "utf8");
+    }
+    return { mnemonic, address };
+}
+
+/**
+ * 幂等获取卖家身份: 已有则读取, 没有则生成并落盘 (Unix 下 chmod 600)。
+ * 返回 { mnemonic, address, created }
+ */
+async function ensureSellerIdentity(baseDir) {
+    const existing = await readSellerIdentity(baseDir);
+    if (existing) return { ...existing, created: false };
+    const p = identityPaths(baseDir);
+    fs.mkdirSync(p.keyringDir, { recursive: true });
+    const mnemonic = await generateMnemonic();
+    const address = await mnemonicToAddress(mnemonic);
+    fs.writeFileSync(p.mnemonicFile, mnemonic + "\n", { encoding: "utf8", mode: 0o600 });
+    fs.writeFileSync(p.addressFile, address + "\n", { encoding: "utf8", mode: 0o600 });
+    if (process.platform !== "win32") {
+        try { fs.chmodSync(p.mnemonicFile, 0o600); fs.chmodSync(p.addressFile, 0o600); } catch (_) { /* ignore */ }
+    }
+    return { mnemonic, address, created: true };
+}
+
+module.exports = { ensureSellerIdentity, readSellerIdentity, mnemonicToAddress, generateMnemonic, HD_PATH, ADDR_PREFIX };

package/core/session-manager.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Authorization Session Manager - 授权会话管理
+ *
+ * 功能：
+ * - 授权记录查询
+ * - 授权撤销
+ * - APP 权限管理
+ * - 会话续期
+ */
+interface AuthSession {
+    sessionId: string;
+    walletAddress: string;
+    appId: string;
+    apiKey: string;
+    permissions: string[];
+    createdAt: number;
+    lastUsedAt: number;
+    expiresAt: number;
+    idleTimeout: number;
+    revoked: boolean;
+    revokedAt?: number;
+    revokedReason?: string;
+    deviceInfo?: {
+        userAgent?: string;
+        ip?: string;
+        deviceName?: string;
+    };
+}
+/**
+ * 创建会话
+ */
+export declare function createSession(walletAddress: string, appId: string, permissions: string[], deviceInfo?: AuthSession['deviceInfo']): AuthSession;
+/**
+ * 获取用户的所有授权
+ */
+export declare function getUserAuthorizations(walletAddress: string): AuthSession[];
+/**
+ * 获取应用的所有用户
+ */
+export declare function getAppUsers(appId: string): AuthSession[];
+/**
+ * 验证会话（银行标准：15分钟空闲超时 + 8小时绝对超时）
+ */
+export declare function validateSession(sessionId: string): {
+    valid: boolean;
+    session?: AuthSession;
+    error?: string;
+};
+/**
+ * 撤销会话
+ */
+export declare function revokeSession(sessionId: string, walletAddress: string, reason?: string): {
+    success: boolean;
+    error?: string;
+};
+/**
+ * 批量撤销应用授权
+ */
+export declare function revokeAppAuthorizations(walletAddress: string, appId: string, reason?: string): number;
+/**
+ * 续期会话
+ */
+export declare function renewSession(sessionId: string, walletAddress: string): {
+    success: boolean;
+    session?: AuthSession;
+    error?: string;
+};
+/**
+ * 清理过期会话
+ */
+export declare function cleanupExpiredSessions(): number;
+/**
+ * 获取会话统计
+ */
+export declare function getSessionStats(walletAddress?: string): {
+    total: number;
+    active: number;
+    revoked: number;
+    expired: number;
+};
+/**
+ * 检查会话是否有指定权限
+ */
+export declare function hasPermission(sessionId: string, permission: string): boolean;
+/**
+ * 更新会话权限（仅限管理员）
+ */
+export declare function updateSessionPermissions(sessionId: string, permissions: string[]): {
+    success: boolean;
+    error?: string;
+};
+export {};
+//# sourceMappingURL=session-manager.d.ts.map

package/core/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/core/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AA0BD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EAAE,EACrB,UAAU,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GACrC,WAAW,CA+Bb;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,EAAE,CAG1E;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAGxD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAwC5G;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBtC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAoBR;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAiClI;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAgB/C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAeA;AAID;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS5E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EAAE,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBtC"}