weaver-work-cli 0.1.0 → 0.1.1

package/dist/internal/e10/auth/commands.js

@@ -1,6 +1,7 @@
 import { execFile } from 'node:child_process';
 import { createServer } from 'node:http';
 import { CliError, ExitCode } from '../../../core/errors.js';
+import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
 import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
 const DEFAULT_AGENT_TYPE = 'weaver-work-cli';
@@ -83,6 +84,15 @@ function formatLoginResult(result) {
         'authFile: ' + result.authFile,
     ].join('\n');
 }
+async function clearInvoiceTokenCache(profile, authData) {
+    if (!authData.baseUrl || !authData.userId)
+        return;
+    await clearInvoiceTokenForSession({
+        baseUrl: normalizeUrl(authData.baseUrl),
+        profile,
+        userId: authData.userId,
+    }).catch(() => false);
+}
 function shellQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -201,6 +211,7 @@ async function oidcExchange(code, redirectUri, baseUrl, tenantKeyFallback, agent
     };
     const profile = profileHint || profileNameFromUrl(base);
     setActiveProfile(profile);
+    await clearInvoiceTokenCache(profile, authData);
     const authFile = saveAuthFile(authData, profile);
     saveProfileConfig(base, base, profile, tenantKey);
     return {
@@ -455,6 +466,7 @@ export function registerE10AuthCommands(parent, action) {
             passportUrl,
             cookieSavedAt: Date.now(),
         };
+        await clearInvoiceTokenCache(profile, authData);
         const authFile = saveAuthFile(authData, profile);
         saveProfileConfig(baseUrl, passportUrl, profile, tenantKey);
         const result = {
@@ -475,9 +487,18 @@ export function registerE10AuthCommands(parent, action) {
     auth.command('logout')
         .alias('clear')
         .description('Clear saved E10 auth for the current or selected profile')
-        .action(action((ctx) => {
+        .action(action(async (ctx) => {
         const opts = ctx.getGlobalOptions();
-        const result = clearProfileAuthFile(opts.profile || getActiveProfile());
+        const profile = opts.profile || getActiveProfile();
+        const authFile = getProfileAuthPath(profile);
+        const session = E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl);
+        if (session) {
+            await clearInvoiceTokenCache(profile, {
+                baseUrl: session.getBaseUrl(),
+                userId: session.userId,
+            });
+        }
+        const result = clearProfileAuthFile(profile);
         const text = result.cleared
             ? 'Cleared E10 auth.\nprofile: ' + result.profile + '\nauthFile: ' + result.authFile
             : 'No E10 auth to clear.\nprofile: ' + result.profile + '\nauthFile: ' + result.authFile;

package/dist/shortcuts/invoice/host.js

@@ -5,6 +5,7 @@ import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { InvoiceCliError, invoiceAuthError, invoiceNetworkError, invoiceValidationError, } from './errors.js';
 const MAX_DOWNLOAD_BYTES = 50 * 1024 * 1024;
 const TOKEN_SERVICE = 'cn.weaver.weaver-work-cli.invoice-token';
+const INVOICE_SESSION_EXPIRED_CODE = '-2';
 function assertPath(requestPath) {
     if (typeof requestPath !== 'string' || !requestPath.startsWith('/') || requestPath.startsWith('//')) {
         throw invoiceValidationError('path_invalid', '请求路径必须是相对绝对路径');
@@ -63,6 +64,10 @@ function responseCode(value) {
     const root = responseRoot(value);
     return root?.ret ?? root?.code;
 }
+function isInvoiceSessionExpired(value) {
+    const code = responseCode(value);
+    return code !== undefined && String(code) === INVOICE_SESSION_EXPIRED_CODE;
+}
 function tokenAccount(session) {
     return createHash('sha256')
         .update(`${session.profile}\n${session.baseUrl}\n${session.userId}`)
@@ -109,6 +114,9 @@ function createInvoiceTokenStore(session) {
         },
     };
 }
+export async function clearInvoiceTokenForSession(session) {
+    return createInvoiceTokenStore(session).clear();
+}
 function inferProfile(ctx) {
     const options = ctx.getGlobalOptions();
     return options.profile || getActiveProfile();
@@ -125,14 +133,16 @@ function requestHeaders(session, invoiceToken) {
         headers.token = invoiceToken;
     return headers;
 }
-export function createInvoiceHost(ctx) {
+export function createInvoiceHost(ctx, dependencies = {}) {
     let e10Session = null;
     let sessionContext = null;
     let invoiceToken = null;
     let tokenStore = null;
+    const requireSession = dependencies.requireSession || requireE10Session;
+    const tokenStoreFactory = dependencies.tokenStoreFactory || createInvoiceTokenStore;
     async function ensureSession() {
         if (!e10Session) {
-            e10Session = await requireE10Session(ctx);
+            e10Session = await requireSession(ctx);
             sessionContext = {
                 baseUrl: e10Session.getBaseUrl(),
                 profile: inferProfile(ctx),
@@ -148,7 +158,7 @@ export function createInvoiceHost(ctx) {
     async function ensureInvoiceToken(timeoutMs = 30_000) {
         await ensureSession();
         const context = await getSession();
-        tokenStore ||= createInvoiceTokenStore(context);
+        tokenStore ||= tokenStoreFactory(context);
         if (invoiceToken)
             return invoiceToken;
         invoiceToken = await tokenStore.load();
@@ -182,7 +192,31 @@ export function createInvoiceHost(ctx) {
         }
         return ensureInvoiceToken(timeoutMs);
     }
-    async function invoiceRequest(request) {
+    async function clearCachedInvoiceToken() {
+        invoiceToken = null;
+        await tokenStore?.clear().catch(() => false);
+    }
+    function businessError(value) {
+        const code = responseCode(value);
+        return new InvoiceCliError('api', 'business_error', responseMessage(value), {
+            code: String(code),
+            details: { ret: code },
+            exitCode: 1,
+        });
+    }
+    async function handleBusinessResponse(value, retry, canRetry) {
+        const code = responseCode(value);
+        if (code === undefined || code === 0 || code === 200)
+            return value;
+        if (isInvoiceSessionExpired(value)) {
+            await clearCachedInvoiceToken();
+            if (canRetry)
+                return retry();
+            throw invoiceAuthError('invoice_session_expired', '发票业务登录态已失效，已清理本地发票 Token；请重新运行 weaver-work-cli auth login --base-url <域名> 后再试', { ret: code });
+        }
+        throw businessError(value);
+    }
+    async function invoiceRequest(request, canRetryExpiredToken = true) {
         const { method = 'POST', path, query, body, needsInvoiceToken = true, timeoutMs = 30_000, } = request;
         assertPath(path);
         const token = await ensureContext(needsInvoiceToken, timeoutMs, path);
@@ -220,118 +254,110 @@ export function createInvoiceHost(ctx) {
                 exitCode: 1,
             });
         }
-        const code = responseCode(value);
-        if (code !== undefined && code !== 0 && code !== 200) {
-            throw new InvoiceCliError('api', 'business_error', responseMessage(value), {
-                code: String(code),
-                details: { ret: code },
+        return handleBusinessResponse(value, () => invoiceRequest(request, false), canRetryExpiredToken && Boolean(token));
+    }
+    async function invoiceMultipartRequest(request, canRetryExpiredToken = true) {
+        const { method = 'POST', path, query, fields = {}, file, needsInvoiceToken = true, timeoutMs = 30_000, } = request;
+        if (!file && !fields.url) {
+            throw invoiceValidationError('input_invalid', 'multipart 请求需要文件或 URL');
+        }
+        assertPath(path);
+        const token = await ensureContext(needsInvoiceToken, timeoutMs, path);
+        const session = await ensureSession();
+        const form = new FormData();
+        for (const [key, value] of Object.entries(fields)) {
+            if (value === undefined || value === null)
+                continue;
+            form.append(key, typeof value === 'string' ? value : JSON.stringify(value));
+        }
+        if (file) {
+            const content = await readFile(file.path);
+            form.append('file', new Blob([content], { type: file.mimeType || 'application/octet-stream' }), file.name);
+        }
+        const response = await fetchWithTimeout(withQuery(session.getBaseUrl(), path, query), {
+            method,
+            headers: requestHeaders(session, token),
+            body: form,
+            redirect: 'manual',
+        }, timeoutMs);
+        const text = await response.text();
+        if (response.status === 401 || response.status === 302) {
+            throw invoiceAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+        }
+        let value = {};
+        try {
+            value = text ? JSON.parse(text) : {};
+        }
+        catch {
+            throw invoiceNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new InvoiceCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
+                code: response.status,
+                details: { status: response.status, message: responseMessage(value) },
                 exitCode: 1,
             });
         }
-        return value;
+        return handleBusinessResponse(value, () => invoiceMultipartRequest(request, false), canRetryExpiredToken && Boolean(token));
     }
-    return {
-        invoiceRequest,
-        async invoiceMultipartRequest(request) {
-            const { method = 'POST', path, query, fields = {}, file, needsInvoiceToken = true, timeoutMs = 30_000, } = request;
-            if (!file && !fields.url) {
-                throw invoiceValidationError('input_invalid', 'multipart 请求需要文件或 URL');
-            }
-            assertPath(path);
-            const token = await ensureContext(needsInvoiceToken, timeoutMs, path);
-            const session = await ensureSession();
-            const form = new FormData();
-            for (const [key, value] of Object.entries(fields)) {
-                if (value === undefined || value === null)
-                    continue;
-                form.append(key, typeof value === 'string' ? value : JSON.stringify(value));
-            }
-            if (file) {
-                const content = await readFile(file.path);
-                form.append('file', new Blob([content], { type: file.mimeType || 'application/octet-stream' }), file.name);
-            }
-            const response = await fetchWithTimeout(withQuery(session.getBaseUrl(), path, query), {
-                method,
-                headers: requestHeaders(session, token),
-                body: form,
-                redirect: 'manual',
-            }, timeoutMs);
-            const text = await response.text();
-            if (response.status === 401 || response.status === 302) {
-                throw invoiceAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
-            }
+    async function invoiceDownload({ id, fid, needLog = false, timeoutMs = 30_000 }, canRetryExpiredToken = true) {
+        const token = await ensureContext(true, timeoutMs, '/api/inc/file/download');
+        const session = await ensureSession();
+        const url = withQuery(session.getBaseUrl(), '/api/inc/file/download', { id, fid, needLog });
+        const response = await fetchWithTimeout(url, {
+            method: 'GET',
+            headers: {
+                ...requestHeaders(session, token),
+                Accept: 'application/octet-stream, application/pdf, */*',
+            },
+            redirect: 'manual',
+        }, timeoutMs);
+        if (response.status === 401 || response.status === 302) {
+            throw invoiceAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+        }
+        const contentType = response.headers.get('content-type') || 'application/octet-stream';
+        const declaredLength = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declaredLength) && declaredLength > MAX_DOWNLOAD_BYTES) {
+            throw invoiceNetworkError('response_too_large', `下载文件超过 ${MAX_DOWNLOAD_BYTES} 字节限制`, { retryable: false });
+        }
+        const content = Buffer.from(await response.arrayBuffer());
+        const looksLikeJson = /^[\s\r\n]*[\[{]/u.test(content.subarray(0, 64).toString('utf8'));
+        if (response.status < 200 || response.status >= 300 || contentType.includes('json') || looksLikeJson) {
             let value = {};
             try {
-                value = text ? JSON.parse(text) : {};
+                value = JSON.parse(content.toString('utf8'));
             }
             catch {
-                throw invoiceNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
-            }
-            if (response.status < 200 || response.status >= 300) {
-                throw new InvoiceCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
-                    code: response.status,
-                    details: { status: response.status, message: responseMessage(value) },
-                    exitCode: 1,
-                });
-            }
-            const code = responseCode(value);
-            if (code !== undefined && code !== 0 && code !== 200) {
-                throw new InvoiceCliError('api', 'business_error', responseMessage(value), {
-                    code: String(code),
-                    details: { ret: code },
-                    exitCode: 1,
-                });
-            }
-            return value;
-        },
-        async invoiceDownload({ id, fid, needLog = false, timeoutMs = 30_000 }) {
-            const token = await ensureContext(true, timeoutMs, '/api/inc/file/download');
-            const session = await ensureSession();
-            const url = withQuery(session.getBaseUrl(), '/api/inc/file/download', { id, fid, needLog });
-            const response = await fetchWithTimeout(url, {
-                method: 'GET',
-                headers: {
-                    ...requestHeaders(session, token),
-                    Accept: 'application/octet-stream, application/pdf, */*',
-                },
-                redirect: 'manual',
-            }, timeoutMs);
-            if (response.status === 401 || response.status === 302) {
-                throw invoiceAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+                value = {};
             }
-            const contentType = response.headers.get('content-type') || 'application/octet-stream';
-            const declaredLength = Number(response.headers.get('content-length'));
-            if (Number.isFinite(declaredLength) && declaredLength > MAX_DOWNLOAD_BYTES) {
-                throw invoiceNetworkError('response_too_large', `下载文件超过 ${MAX_DOWNLOAD_BYTES} 字节限制`, { retryable: false });
+            if (isInvoiceSessionExpired(value)) {
+                await clearCachedInvoiceToken();
+                if (canRetryExpiredToken && token)
+                    return invoiceDownload({ id, fid, needLog, timeoutMs }, false);
+                throw invoiceAuthError('invoice_session_expired', '发票业务登录态已失效，已清理本地发票 Token；请重新运行 weaver-work-cli auth login --base-url <域名> 后再试', { ret: responseCode(value), status: response.status });
             }
-            const content = Buffer.from(await response.arrayBuffer());
-            const looksLikeJson = /^[\s\r\n]*[\[{]/u.test(content.subarray(0, 64).toString('utf8'));
-            if (response.status < 200 || response.status >= 300 || contentType.includes('json') || looksLikeJson) {
-                let value = {};
-                try {
-                    value = JSON.parse(content.toString('utf8'));
-                }
-                catch {
-                    value = {};
-                }
-                throw new InvoiceCliError('api', 'download_failed', responseMessage(value) || `下载失败（HTTP ${response.status}）`, {
-                    code: response.status,
-                    details: { status: response.status, ret: responseCode(value) },
-                    exitCode: 1,
-                });
-            }
-            if (!content.length) {
-                throw invoiceNetworkError('protocol', '下载接口返回空文件', { retryable: false });
-            }
-            if (content.length > MAX_DOWNLOAD_BYTES) {
-                throw invoiceNetworkError('response_too_large', `下载文件超过 ${MAX_DOWNLOAD_BYTES} 字节限制`, { retryable: false });
-            }
-            return { content, contentType };
-        },
+            throw new InvoiceCliError('api', 'download_failed', responseMessage(value) || `下载失败（HTTP ${response.status}）`, {
+                code: response.status,
+                details: { status: response.status, ret: responseCode(value) },
+                exitCode: 1,
+            });
+        }
+        if (!content.length) {
+            throw invoiceNetworkError('protocol', '下载接口返回空文件', { retryable: false });
+        }
+        if (content.length > MAX_DOWNLOAD_BYTES) {
+            throw invoiceNetworkError('response_too_large', `下载文件超过 ${MAX_DOWNLOAD_BYTES} 字节限制`, { retryable: false });
+        }
+        return { content, contentType };
+    }
+    return {
+        invoiceRequest,
+        invoiceMultipartRequest,
+        invoiceDownload,
         getSession,
         invalidateToken() {
             invoiceToken = null;
-            void tokenStore?.clear();
+            void clearCachedInvoiceToken();
         },
     };
 }

package/docs/e10-auth.md

@@ -8,6 +8,7 @@ E10 适配模块刻意与核心 CLI 框架隔离，避免平台逻辑污染通
 - Profile 目录：`~/.weaver-work-cli/e10/profiles/<profile>`
 - 当前激活 profile：`~/.weaver-work-cli/e10/profile`
 - Keychain service/account：`weaver-work-cli` / `auth-key`
+- 发票业务 Token Keychain service：`cn.weaver.weaver-work-cli.invoice-token`
 
 `weaver-work-cli` 默认不读取、不迁移 `e10-login` / `e10-cli` 的 `~/.e10-cli`
 登录态，避免用户安装本插件后因为历史登录状态被自动授权。确需复用外部 auth
@@ -42,9 +43,12 @@ E10 兼容的 auth 文件。
 `WEAVER_BASE_URL`、`WEAVER_ETEAMSID`、`WEAVER_COOKIE`、`WEAVER_USER_AGENT` 和
 `WEAVER_AGENT_TYPE`，可通过下面方式注入到当前 shell：
 
-`auth logout` 会清理当前 profile 的本地登录凭据；也可配合
-`--profile <name>` 清理指定 profile。该命令不删除 profile 配置和 keychain
-密钥。
+`auth login`、`auth oidc` 和 `auth set` 保存新登录态前，会清理同一
+profile/baseUrl/userId 下缓存的发票业务 Token，避免重登后继续复用旧 Token。
+
+`auth logout` 会清理当前 profile 的本地登录凭据和对应的发票业务 Token；也可配合
+`--profile <name>` 清理指定 profile。该命令不删除 profile 配置和登录加密用
+keychain 密钥。
 
 ```bash
 eval "$(weaver-work-cli auth export-weaver-env)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weaver-work-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "面向泛微工作工具链的可扩展 TypeScript CLI 基础框架（E10 业票通等能力）",
   "type": "module",
   "main": "./dist/index.js",