ChatComment 0.1.1__tar.gz → 0.2.0__tar.gz

{chatcomment-0.1.1 → chatcomment-0.2.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.0
+
+- 平台中立的 `AccessContext` / `SiteAccess` API，复用 ChatLogin 主体并显式检查每站 read/comment/manage/owner；管理 grant 按 session 和站点区分。
+- 独立服务签名网关模式，验证短时 method/path/query/body 绑定上下文；所有非 health 路由要求签名，不接受旧全局 token 作为替代。
+- 邮箱齿轮提示、管理列表、再认证和前端 CSRF 端点按站点及平台配置；不向前端暴露期望邮箱或服务器密钥。
+- 迁移所需的 `site allow-origin` 只更新允许来源，保留字段设置和全部留言；`--require-existing-db` 防止缺少持久卷时创建空库。
+
 ## 0.1.1
 
 - 留言区仅显示一个齿轮入口；本人填写管理员邮箱后由服务器确认显示，不按昵称判断、不下发管理员邮箱。

{chatcomment-0.1.1 → chatcomment-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.1.1
+Version: 0.2.0
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -15,6 +15,7 @@ Provides-Extra: dev
 Requires-Dist: build; extra == "dev"
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: twine; extra == "dev"
+Requires-Dist: chatlogin<0.3.0,>=0.2.1; extra == "dev"
 Dynamic: license-file
 
 # ChatComment
@@ -43,6 +44,8 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
+多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
+
 独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.1.1 → chatcomment-0.2.0}/README.md

@@ -24,6 +24,8 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
+多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
+
 独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.1.1 → chatcomment-0.2.0}/docs/api.md

@@ -1,9 +1,11 @@
 # Commands and APIs
 
-`chatcomment --help`, `--version`, `--tree`, `--tree-brief` describe the installed CLI. Commands: `serve`, `site register`, `site list`, `backup`. Python API: `Store.register`, `site`, `sites`, `configure`, `create`, `comments`, `moderate`, `backup`; `server.make_handler` and `server.serve` expose the same HTTP service.
+`chatcomment --help`, `--version`, `--tree`, `--tree-brief` describe the installed CLI. Commands: `serve`, `site register`, `site list`, `site allow-origin`, `backup`. Python API: `Store.register`, `site`, `sites`, `configure`, `allow_origin`, `create`, `comments`, `moderate`, `backup`; `server.make_handler` and `server.serve` expose the same HTTP service. Platform APIs `AccessContext`, `SiteAccess`, `sign_context`, `verify_context` are described in [platform.md](platform.md).
 
 All request bodies are JSON (maximum 32 KiB). Site IDs are explicit, origins are exact and page paths must be pre-registered; query strings and hashes do not create new comment streams.
 
+Platform deployments use `serve --gateway-key-env NAME`, optionally `--session-endpoint`, `--reauth-endpoint`, `--return-path`, and `--require-existing-db`. Every non-health request needs a valid platform context, including direct backend assets; each site operation independently checks its scope. The bearer-token descriptions below refer to the retained legacy single-gateway mode, not platform authorization.
+
 | Method | Path | Behavior |
 | --- | --- | --- |
 | GET | `/health` | Version and service name |

chatcomment-0.2.0/docs/platform.md

@@ -0,0 +1,113 @@
+# Platform service integration
+
+ChatComment can run as an independent Coolify application. The platform owns
+ChatLogin accounts/sessions, project ACLs, CSRF, password reauthentication and
+native resource/deployment IDs. ChatComment owns comments, field settings,
+moderation and its persistent SQLite data. It does not schedule containers or
+duplicate account tables.
+
+## Start a scoped backend
+
+```sh
+chatcomment --db /data/comments.sqlite3 serve --host 0.0.0.0 --port 8000 \
+  --gateway-key-env CHATCOMMENT_GATEWAY_KEY \
+  --session-endpoint /__platform/session \
+  --reauth-endpoint /__platform/reauth --return-path /
+```
+
+Use a server-only randomly generated key of at least 32 characters, stored in
+the platform's secret configuration. All non-health routes, including assets
+on the direct native application domain, require a signed context. `/health`
+is the only unsigned route. This mode explicitly rejects legacy token mode;
+browser `Role`, nickname, email and Bearer headers do not grant access.
+
+The legacy `--token-file` mode remains for existing deployments during staged
+migration. It must not be used as a multi-user platform authorization shortcut.
+
+## Reusable Python contract
+
+```python
+from chatcomment import AccessContext, SiteAccess, sign_context
+
+# Obtain a current Session from ChatLogin ManagedUsers.sessions.resolve().
+# Read current project grants; do not derive these from Principal.role.
+context = AccessContext.from_chatlogin(
+    session,
+    session_id=stable_session_digest,
+    email=current_verified_account_email,
+    sites={site_id: SiteAccess(
+        read=may_read, comment=may_comment, manage=may_manage,
+        owner=is_site_owner, management_until=site_bound_reauth_expiry,
+    )},
+    csrf_verified=actual_request_csrf_was_verified,
+)
+headers = sign_context(
+    context, key=server_key, method=method,
+    path=backend_path_with_raw_query, body=raw_request_body,
+    ttl=30, audience='chatcomment',
+)
+```
+
+The gateway strips all incoming `X-ChatComment-*` identity headers, checks the
+current app session and site/project permission on every request, verifies
+Origin and CSRF for writes, signs the **downstream** method/path/query/raw body,
+and forwards only its generated context headers to the controlled internal
+upstream. The backend calls `verify_context` and again checks the selected site's
+permission. A context cannot be reused for a different body, verb, path or site.
+TTL is at most 60 seconds. Signed claims are server-to-server, never sent to JS
+or logged. Keep the backend path canonical and preserve raw body bytes.
+
+`AccessContext` contains `subject`, a session identifier/digest, current email,
+`sites`, `csrf_verified`, and `authenticated`. `SiteAccess` contains explicit
+`read`, `comment`, `manage`, `owner`, and absolute `management_until` time.
+Guest contexts must explicitly use `authenticated=False`; they cannot have
+management eligibility and never read private sites, even if mis-scoped.
+
+For a native in-process adapter, `make_handler(..., context_resolver=callable)`
+accepts the same validated context. The callable receives headers, method,
+downstream path and body bytes. Do not combine it with a gateway key or legacy
+global token. The independent-service CLI uses the signed transport.
+
+## Management and browser contract
+
+`/api/sites/{id}/config` returns field settings, owner hint eligibility and public
+same-origin auth endpoint paths. It never returns expected administrator email
+or a signing key. The widget sends `{site,email}` to `/api/admin/entry` only for
+an eligible owner. A matching email only reveals its single settings gear.
+
+The gear opens `/login?site={id}`. The included form posts `{site,email,password}`
+to the configured **platform** reauthentication endpoint with native session
+CSRF. The platform verifies the existing password and current owner eligibility,
+then records a 900-second grant bound to subject, reader session, project and
+site. Subsequent contexts may include that site's `management_until`.
+An email hint, global admin role, another site's grant or expired grant never
+authorizes management. `GET /api/admin/sites` lists only currently authorized,
+reauthenticated sites; site paths independently enforce the scope.
+
+Session responses supply `csrf_token`. The platform owns logout, reader session
+audiences, account disable/revision checks and current ACL revocation. A raw
+backend without platform context rejects requests. Central and reader cookies
+must not be shared across wildcard application domains.
+
+## Persistent migration
+
+Keep the existing `site_id` and `page_key` explicit when frontend domains or URI
+change. Mount the existing local data directory at `/data` using its real UID
+and restrictive permissions. SQLite WAL permits a staged period with the old
+service using the same authoritative file; do not create diverging copies.
+Coolify's native storage/resource configuration owns this mount and lifecycle.
+
+Before deployment, take an online SQLite backup and generate per-row hashes of
+all columns in `sites` and `comments`, including private email and soft-deleted
+states. Compare the original IDs/rows after migration and permit only recorded
+new rows. If the new app origin differs, add it explicitly:
+
+```sh
+chatcomment --db /data/comments.sqlite3 site allow-origin personal-ai https://new-app.example
+```
+
+This changes only the registered origin list. Field/anonymous/moderation settings
+and every comment row remain unchanged. Record that intentional site metadata
+change separately. Preserve the old service/route until the new same-page
+browser flow, independent readback, permissions and native restart/redeploy
+persistence pass. Retiring legacy routing is a separate coordinated last step.

{chatcomment-0.1.1 → chatcomment-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ChatComment"
-version = "0.1.1"
+version = "0.2.0"
 description = "Embeddable comments with a Python server, SQLite storage and a small JavaScript widget."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -19,7 +19,7 @@ Repository = "https://github.com/ChatArch/ChatComment"
 chatcomment = "chatcomment.cli:main"
 
 [project.optional-dependencies]
-dev = ["build", "pytest>=8", "twine"]
+dev = ["build", "pytest>=8", "twine", "chatlogin>=0.2.1,<0.3.0"]
 
 [tool.setuptools.packages.find]
 where = ["src"]

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/ChatComment.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.1.1
+Version: 0.2.0
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -15,6 +15,7 @@ Provides-Extra: dev
 Requires-Dist: build; extra == "dev"
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: twine; extra == "dev"
+Requires-Dist: chatlogin<0.3.0,>=0.2.1; extra == "dev"
 Dynamic: license-file
 
 # ChatComment
@@ -43,6 +44,8 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
+多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
+
 独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/ChatComment.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ README.md
 pyproject.toml
 docs/api.md
 docs/deployment.md
+docs/platform.md
 src/ChatComment.egg-info/PKG-INFO
 src/ChatComment.egg-info/SOURCES.txt
 src/ChatComment.egg-info/dependency_links.txt
@@ -13,6 +14,7 @@ src/ChatComment.egg-info/entry_points.txt
 src/ChatComment.egg-info/requires.txt
 src/ChatComment.egg-info/top_level.txt
 src/chatcomment/__init__.py
+src/chatcomment/access.py
 src/chatcomment/cli.py
 src/chatcomment/server.py
 src/chatcomment/store.py
@@ -22,4 +24,7 @@ src/chatcomment/static/login.html
 src/chatcomment/static/widget.css
 src/chatcomment/static/widget.js
 tests/cli-tests/test_cli.py
-tests/code-tests/test_comments.py
+tests/code-tests/test_access.py
+tests/code-tests/test_chatlogin_adapter.py
+tests/code-tests/test_comments.py
+tests/code-tests/test_platform_http.py

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/ChatComment.egg-info/requires.txt

@@ -6,3 +6,4 @@ chatenv<0.3.0,>=0.2.11
 build
 pytest>=8
 twine
+chatlogin<0.3.0,>=0.2.1

chatcomment-0.2.0/src/chatcomment/__init__.py

@@ -0,0 +1,7 @@
+"""Reusable comments storage and HTTP service."""
+__version__ = "0.2.0"
+
+from .store import Store
+from .access import AccessContext,SiteAccess,sign_context,verify_context
+
+__all__ = ["Store", "AccessContext", "SiteAccess", "sign_context", "verify_context", "__version__"]

chatcomment-0.2.0/src/chatcomment/access.py

@@ -0,0 +1,150 @@
+"""Platform-neutral, per-site permissions and a signed gateway transport.
+
+The platform resolves the real ChatLogin session on EVERY request, evaluates its
+site ACL and CSRF, then signs this context. No global account role implies site
+access. Browser-supplied identity headers are not trusted by this module.
+"""
+from __future__ import annotations
+
+import base64
+from dataclasses import asdict, dataclass, field
+import hashlib
+import hmac
+import json
+import math
+import secrets
+import time
+from typing import Mapping
+from types import MappingProxyType
+
+
+@dataclass(frozen=True)
+class SiteAccess:
+    read: bool = False
+    comment: bool = False
+    manage: bool = False
+    owner: bool = False
+    management_until: float = 0
+
+    def __post_init__(self):
+        if any(type(getattr(self,k)) is not bool for k in ['read','comment','manage','owner']):
+            raise ValueError('Site permissions must be booleans')
+        if (self.comment or self.manage or self.owner) and not self.read:
+            raise ValueError('Site operations require explicit site read permission')
+        if self.owner and not self.manage:
+            raise ValueError('Site owner must have explicit management eligibility')
+        if type(self.management_until) not in (int,float) or not math.isfinite(self.management_until):
+            raise ValueError('Invalid management grant expiry')
+
+
+@dataclass(frozen=True)
+class AccessContext:
+    subject: str
+    session: str  # A stable session digest/identifier, never the raw cookie.
+    email: str = field(default='',repr=False)
+    sites: Mapping[str, SiteAccess] = field(default_factory=dict)
+    csrf_verified: bool = False
+    authenticated: bool = True
+
+    def __post_init__(self):
+        for name in ['subject','session']:
+            value=getattr(self,name)
+            if not isinstance(value,str) or not 1<=len(value)<=256:
+                raise ValueError('Authenticated subject and session identifier required')
+        if not isinstance(self.email,str) or len(self.email)>500 or type(self.csrf_verified) is not bool or type(self.authenticated) is not bool:
+            raise ValueError('Invalid identity or CSRF context')
+        if not isinstance(self.sites,Mapping) or len(self.sites)>100:
+            raise ValueError('Bounded per-site permissions required')
+        for site,scope in self.sites.items():
+            if not isinstance(site,str) or not 1<=len(site)<=64 or not isinstance(scope,SiteAccess):
+                raise ValueError('Invalid site permission')
+            if not self.authenticated and (scope.manage or scope.owner):
+                raise ValueError('Anonymous context cannot have management eligibility')
+        object.__setattr__(self,'sites',MappingProxyType(dict(self.sites)))
+
+    def scope(self,site_id):
+        return self.sites.get(site_id,SiteAccess())
+
+    def permits(self,site_id,action,*,now=None):
+        scope=self.scope(site_id)
+        if action=='read':return scope.read
+        if action=='comment':return scope.read and scope.comment
+        if action=='hint':return self.authenticated and scope.read and scope.owner
+        if action=='manage':
+            return self.authenticated and scope.read and scope.manage and scope.management_until>(time.time() if now is None else now)
+        return False
+
+    def require(self,site_id,action,*,write=False,now=None):
+        if not self.permits(site_id,action,now=now):
+            raise PermissionError('此账号未获该站点权限或需要重新验证密码')
+        if write and not self.csrf_verified:
+            raise PermissionError('平台未验证此请求的 CSRF')
+
+    @classmethod
+    def from_chatlogin(cls,session,*,session_id,email,sites,csrf_verified=False):
+        """Adapt an already-resolved ChatLogin Session, never infer ACL from Role."""
+        principal=session.principal
+        if not principal.authenticated:
+            raise PermissionError('需要已验证的 ChatLogin 主体')
+        return cls(principal.user_id,session_id,email,sites,csrf_verified)
+
+
+def _key(value):
+    if isinstance(value,str):value=value.encode()
+    if not isinstance(value,bytes) or len(value)<32:
+        raise ValueError('Gateway signing key must be at least 32 bytes')
+    return value
+
+
+def _binding(method,path,body):
+    if not isinstance(body,bytes) or not isinstance(path,str) or not path.startswith('/'):
+        raise ValueError('Canonical request path and raw body bytes required')
+    return {'method':method.upper(),'path':path,'body_sha256':hashlib.sha256(body).hexdigest()}
+
+
+def sign_context(context:AccessContext,*,key,method,path,body=b'',now=None,ttl=30,audience='chatcomment'):
+    """Return server-to-server headers bound to a single HTTP request.
+
+    Gateway MUST strip incoming X-ChatComment-* headers first. Password checks,
+    current account/session revocation, site ACL and CSRF happen in the platform.
+    """
+    if not isinstance(context,AccessContext):raise TypeError('Verified AccessContext required')
+    if type(ttl) is not int or not 1<=ttl<=60:raise ValueError('Context TTL must be 1..60 seconds')
+    stamp=time.time() if now is None else now
+    if type(stamp) not in (int,float) or not math.isfinite(stamp):raise ValueError('Invalid signing clock')
+    value={'v':1,'aud':audience,'iat':stamp,'exp':stamp+ttl,'nonce':secrets.token_urlsafe(16),
+           'subject':context.subject,'session':context.session,'email':context.email,
+           'sites':{site:asdict(scope) for site,scope in context.sites.items()},
+           'csrf_verified':context.csrf_verified,'authenticated':context.authenticated,**_binding(method,path,body)}
+    raw=json.dumps(value,ensure_ascii=False,separators=(',',':'),sort_keys=True).encode()
+    encoded=base64.urlsafe_b64encode(raw).decode().rstrip('=')
+    if len(encoded)>16000:raise ValueError('Gateway context is too large; scope it to this request')
+    signature=hmac.new(_key(key),encoded.encode(),hashlib.sha256).hexdigest()
+    return {'X-ChatComment-Context':encoded,'X-ChatComment-Signature':signature}
+
+
+def verify_context(headers,*,key,method,path,body=b'',now=None,audience='chatcomment'):
+    """Validate context before using any identity or site permission claim."""
+    encoded=headers.get('X-ChatComment-Context')
+    signature=headers.get('X-ChatComment-Signature')
+    if encoded is None and signature is None:return None
+    if not isinstance(encoded,str) or not 1<=len(encoded)<=16000 or not isinstance(signature,str) or len(signature)!=64 or not signature.isascii():
+        raise PermissionError('无效的平台认证上下文')
+    try:encoded_bytes=encoded.encode('ascii','strict')
+    except UnicodeError as exc:raise PermissionError('无效的平台认证上下文') from exc
+    expected=hmac.new(_key(key),encoded_bytes,hashlib.sha256).hexdigest()
+    if not hmac.compare_digest(expected,signature):raise PermissionError('平台认证签名不正确')
+    try:
+        raw=base64.b64decode(encoded+'='*((-len(encoded))%4),altchars=b'-_',validate=True)
+        data=json.loads(raw)
+        stamp=time.time() if now is None else now
+        if data['v']!=1 or data['aud']!=audience:raise ValueError('Wrong audience')
+        issued,expires=data['iat'],data['exp']
+        if any(type(v) not in (int,float) or not math.isfinite(v) for v in [issued,expires,stamp]):raise ValueError('Invalid timestamp')
+        if not issued-5<=stamp<expires or not 0<expires-issued<=60:raise ValueError('Expired context')
+        for name,value in _binding(method,path,body).items():
+            if data[name]!=value:raise ValueError('Request binding mismatch')
+        scopes={site:SiteAccess(**scope) for site,scope in data['sites'].items()}
+        return AccessContext(data['subject'],data['session'],data['email'],scopes,data['csrf_verified'],data['authenticated'])
+    except (ValueError,TypeError,KeyError,AttributeError) as exc:
+        raise PermissionError('平台认证上下文无效、过期或请求不匹配') from exc

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/cli.py

@@ -1,6 +1,7 @@
 """Thin CLI around the Python API."""
 from pathlib import Path
 import json
+import os
 
 import click
 from chatstyle import add_tree_option
@@ -22,15 +23,27 @@ def main(ctx, db):
 @main.command()
 @click.option('--host', default='127.0.0.1', show_default=True)
 @click.option('--port', default=10196, type=click.IntRange(1,65535), show_default=True)
-@click.option('--token-file', required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
+@click.option('--token-file', type=click.Path(exists=True, dir_okay=False, path_type=Path), help='Legacy single-gateway token mode.')
+@click.option('--gateway-key-file', type=click.Path(exists=True,dir_okay=False,path_type=Path), help='Server-only signing key; enables per-site platform authorization.')
+@click.option('--gateway-key-env', help='Name of environment variable holding the server-only signing key.')
+@click.option('--session-endpoint', default='/api/session',show_default=True)
+@click.option('--reauth-endpoint', default=None,help='Platform same-origin management reauthentication endpoint.')
+@click.option('--return-path', default='/',show_default=True)
+@click.option('--require-existing-db',is_flag=True,help='Fail closed if the persistent database mount is missing.')
 @click.pass_context
-def serve(ctx, host, port, token_file):
+def serve(ctx, host, port, token_file,gateway_key_file,gateway_key_env,session_endpoint,reauth_endpoint,return_path,require_existing_db):
     """Serve API, widget assets and the gateway-protected admin page."""
     from .server import serve as run
-    token = token_file.read_text().strip()
-    if len(token) < 32:
-        raise click.ClickException('Token file must contain at least 32 characters.')
-    run(Store(ctx.obj['db']), token=token, host=host, port=port)
+    if sum(bool(v) for v in [token_file,gateway_key_file,gateway_key_env])!=1:
+        raise click.UsageError('Choose exactly one of --token-file, --gateway-key-file or --gateway-key-env.')
+    token=token_file.read_text().strip() if token_file else None
+    key=gateway_key_file.read_text().strip() if gateway_key_file else os.environ.get(gateway_key_env,'') if gateway_key_env else None
+    if len(token if token is not None else key or '')<32:
+        raise click.ClickException('Server credential must contain at least 32 characters.')
+    if require_existing_db and not ctx.obj['db'].expanduser().is_file():
+        raise click.ClickException('Persistent database mount is missing; refusing to create an empty database.')
+    run(Store(ctx.obj['db']), token=token,gateway_key=key, host=host, port=port,
+        session_endpoint=session_endpoint,reauth_endpoint=reauth_endpoint,return_path=return_path)
 
 
 @main.group()
@@ -61,6 +74,19 @@ def list_sites(ctx):
     click.echo(json.dumps(Store(ctx.obj['db']).sites(),ensure_ascii=False,indent=2))
 
 
+@site.command(name='allow-origin')
+@click.argument('site_id')
+@click.argument('origin')
+@click.pass_context
+def allow_origin(ctx,site_id,origin):
+    """Add an approved platform origin, preserving comments and field settings."""
+    try:
+        result=Store(ctx.obj['db']).allow_origin(site_id,origin)
+    except (ValueError,KeyError) as exc:
+        raise click.ClickException(str(exc)) from exc
+    click.echo(json.dumps(result,ensure_ascii=False,indent=2))
+
+
 @main.command()
 @click.argument('destination', type=click.Path(path_type=Path))
 @click.pass_context

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/server.py

@@ -12,11 +12,28 @@ from urllib.parse import parse_qs, urlsplit
 
 from . import __version__
 from .store import Invalid, Store, origin, text
+from .access import AccessContext, verify_context
 
 
-def make_handler(store: Store, admin_token: str):
-    if len(admin_token) < 32:
+def make_handler(store: Store, admin_token: str | None = None, *, gateway_key=None,
+                 context_resolver=None, session_endpoint='/api/session',
+                 reauth_endpoint=None, return_path='/'):
+    scoped = gateway_key is not None or context_resolver is not None
+    if gateway_key is not None and context_resolver is not None:
+        raise ValueError('Choose a gateway key or a native context resolver')
+    if context_resolver is not None and not callable(context_resolver):
+        raise ValueError('Native context resolver must be callable')
+    if gateway_key is not None and (not isinstance(gateway_key,(str,bytes)) or len(gateway_key)<32):
+        raise ValueError('Gateway signing key must be at least 32 characters')
+    if not scoped and (not isinstance(admin_token,str) or len(admin_token) < 32):
         raise ValueError('管理 token 至少需要 32 个字符')
+    if scoped and admin_token is not None:
+        raise ValueError('Scoped platform mode must not accept the legacy global token')
+    for value in [session_endpoint,reauth_endpoint,return_path]:
+        if value is not None and (not isinstance(value,str) or not value.startswith('/') or value.startswith('//') or any(ord(c)<33 for c in value) or '\\' in value):
+            raise ValueError('Authentication endpoints must be same-origin absolute paths')
+    auth_config={'session_endpoint':session_endpoint,'reauth_endpoint':reauth_endpoint,
+                 'return_path':return_path,'scoped':scoped}
     attempts = defaultdict(deque)
     lock = threading.Lock()
 
@@ -50,59 +67,125 @@ def make_handler(store: Store, admin_token: str):
             if self.headers.get('Transfer-Encoding') or self.headers.get_content_type() != 'application/json':
                 raise Invalid('仅接受 JSON 请求')
             try:
-                size = int(self.headers.get('Content-Length', 0))
-            except ValueError as exc:
-                raise Invalid('无效的请求长度') from exc
-            if not 0 < size <= 32768:
-                raise Invalid('请求内容需为 1–32768 字节')
-            try:
-                result = json.loads(self.rfile.read(size))
+                result = json.loads(self.raw_body())
             except (ValueError, UnicodeDecodeError) as exc:
                 raise Invalid('JSON 格式不正确') from exc
             if not isinstance(result, dict):
                 raise Invalid('JSON 必须是对象')
             return result
 
+        def raw_body(self):
+            if hasattr(self,'_body'):
+                return self._body
+            if self.headers.get('Transfer-Encoding'):
+                raise Invalid('不接受分块请求')
+            try:
+                size = int(self.headers.get('Content-Length', 0))
+            except ValueError as exc:
+                raise Invalid('无效的请求长度') from exc
+            if not 0 < size <= 32768:
+                raise Invalid('请求内容需为 1–32768 字节')
+            self._body = self.rfile.read(size)
+            if len(self._body)!=size:
+                raise Invalid('请求正文不完整')
+            return self._body
+
+        def asset(self,name,mime,**extra):
+            data=files('chatcomment').joinpath('static',name).read_text()
+            config=json.dumps({**auth_config,**extra},ensure_ascii=False).replace('<','\\u003c')
+            return self.send(200,data.replace('__CHATCOMMENT_AUTH__',config),mime)
+
+        def target_site(self,query,context):
+            selected=query.get('site',[None])[0]
+            if selected:
+                return selected
+            ids=list(context.sites) if context else [s['id'] for s in store.sites()]
+            if not scoped and ids:
+                return ids[0]
+            if len(ids)!=1:
+                raise Invalid('请指定站点 site')
+            return ids[0]
+
         def dispatch(self):
             self.cors = None
             p = urlsplit(self.path)
             q = parse_qs(p.query)
             token = self.headers.get('Authorization', '').removeprefix('Bearer ')
-            trusted = secrets.compare_digest(token, admin_token)
-            manager = trusted and self.headers.get('X-ChatComment-Role', 'admin') == 'admin'
+            trusted = not scoped and secrets.compare_digest(token, admin_token)
+            context=None
+            if scoped:
+                body=self.raw_body() if self.command=='POST' else b''
+                context=(context_resolver(self.headers,self.command,self.path,body) if context_resolver else
+                         verify_context(self.headers,key=gateway_key,method=self.command,path=self.path,body=body))
+                if context is not None and not isinstance(context,AccessContext):
+                    raise PermissionError('平台未提供已验证的主体')
+                trusted=context is not None
+            manager = not scoped and trusted and self.headers.get('X-ChatComment-Role', 'admin') == 'admin'
             parts = p.path.strip('/').split('/')
             if p.path == '/health' and self.command in {'GET','HEAD'}:
                 return self.send(200, {'service':'chatcomment','version':__version__})
+            if scoped and context is None:
+                raise PermissionError('此独立服务需要平台签名上下文')
             assets = {'/widget.js':('widget.js','application/javascript; charset=utf-8'), '/widget.css':('widget.css','text/css; charset=utf-8')}
             if p.path in assets and self.command in {'GET','HEAD'}:
                 name, mime = assets[p.path]
                 return self.send(200, files('chatcomment').joinpath('static', name).read_bytes(), mime)
             if p.path == '/board' and self.command in {'GET','HEAD'}:
-                return self.send(200, files('chatcomment').joinpath('static/board.html').read_bytes(), 'text/html; charset=utf-8')
+                selected=self.target_site(q,context)
+                if scoped:context.require(selected,'read')
+                site=store.site(selected)
+                if site['private'] and scoped:
+                    if context is None or not context.authenticated:raise PermissionError('此站点需要平台登录')
+                    context.require(selected,'read')
+                return self.asset('board.html','text/html; charset=utf-8',site=selected,page=q.get('page',site['pages'])[0])
             if p.path == '/admin' and self.command in {'GET','HEAD'}:
-                if not manager:
+                if scoped:
+                    if context is None:raise PermissionError('需要平台登录和站点管理权限')
+                    selected=q.get('site',[None])[0]
+                    if selected:context.require(selected,'manage')
+                    elif not any(context.permits(s,'manage') for s in context.sites):raise PermissionError('需要站点管理再认证')
+                elif not manager:
                     raise PermissionError('请通过已登录管理网关访问')
-                return self.send(200, files('chatcomment').joinpath('static/admin.html').read_bytes(), 'text/html; charset=utf-8')
+                return self.asset('admin.html','text/html; charset=utf-8')
             if p.path == '/login' and self.command in {'GET','HEAD'}:
-                if not manager:
+                selected=self.target_site(q,context)
+                if scoped:
+                    if context is None:raise PermissionError('需要平台登录')
+                    context.require(selected,'hint')
+                elif not manager:
                     raise PermissionError('请通过已登录管理网关访问')
-                return self.send(200, files('chatcomment').joinpath('static/login.html').read_bytes(), 'text/html; charset=utf-8')
+                return self.asset('login.html','text/html; charset=utf-8',site=selected)
             if p.path == '/api/admin/entry' and self.command == 'POST':
-                if not manager:
+                payload=self.payload()
+                if scoped:
+                    selected=payload.get('site')
+                    if context is None:raise PermissionError('需要平台登录')
+                    context.require(selected,'hint',write=True)
+                    expected=context.email
+                elif not manager:
                     raise PermissionError('需要本人账号')
-                entered = text(self.payload().get('email',''),'邮箱',500)
-                expected = self.headers.get('X-ChatComment-Admin-Email','')
+                else:
+                    expected = self.headers.get('X-ChatComment-Admin-Email','')
+                entered = text(payload.get('email',''),'邮箱',500)
                 return self.send(200, {'show_settings':bool(expected) and secrets.compare_digest(entered.casefold().encode(),expected.strip().casefold().encode())})
             if p.path == '/api/admin/sites':
-                if not manager:
+                if scoped and context is None:
+                    raise PermissionError('需要平台站点管理权限')
+                if not scoped and not manager:
                     raise PermissionError('需要管理权限')
                 if self.command == 'GET':
-                    return self.send(200, {'sites':store.sites()})
+                    sites=store.sites()
+                    if scoped:
+                        sites=[s for s in sites if context.permits(s['id'],'manage')]
+                        if not sites:raise PermissionError('需要站点管理再认证')
+                    return self.send(200, {'sites':sites})
                 if self.command == 'POST':
                     v = self.payload()
+                    if scoped:context.require(v.get('id'),'manage',write=True)
                     return self.send(201, store.register(v.get('id'),title=v.get('title'),origins=v.get('origins'),pages=v.get('pages'),private=v.get('private',True)))
             if len(parts) >= 4 and parts[:2] == ['api','sites']:
                 site_id, action = parts[2:4]
+                if scoped:context.require(site_id,'read')
                 site = store.site(site_id)
                 request_origin = self.headers.get('Origin')
                 if request_origin:
@@ -110,16 +193,24 @@ def make_handler(store: Store, admin_token: str):
                     if request_origin not in site['origins']:
                         raise PermissionError('来源未获此站点允许')
                     self.cors = request_origin
-                if site['private'] and not trusted:
-                    raise PermissionError('此站点需要登录网关')
+                if site['private']:
+                    if not trusted:raise PermissionError('此站点需要登录网关')
+                    if scoped:
+                        if not context.authenticated:raise PermissionError('私人站点需要平台账号')
+                        context.require(site_id,'read')
                 if self.command == 'OPTIONS':
                     if not self.cors:
                         raise PermissionError('缺少来源')
                     return self.send(204, b'')
-                if action in {'settings','admin','export','moderate'} and not manager:
-                    raise PermissionError('需要管理权限')
+                if action in {'settings','admin','export','moderate'}:
+                    if scoped:
+                        if context is None:raise PermissionError('需要平台站点管理权限')
+                        context.require(site_id,'manage',write=self.command=='POST')
+                    elif not manager:raise PermissionError('需要管理权限')
                 if action == 'config' and self.command == 'GET':
-                    return self.send(200, {'id':site_id,'title':site['title'],'settings':site['settings'],'can_manage':manager})
+                    return self.send(200, {'id':site_id,'title':site['title'],'settings':site['settings'],
+                                          'can_manage':context.permits(site_id,'hint') if scoped and context else manager,
+                                          'auth':auth_config})
                 if action == 'settings' and self.command == 'POST':
                     return self.send(200, store.configure(site_id, self.payload()))
                 if action == 'moderate' and self.command == 'POST':
@@ -128,6 +219,8 @@ def make_handler(store: Store, admin_token: str):
                 if action in {'comments','admin','export'} and self.command == 'GET':
                     return self.send(200, store.comments(site_id,q.get('page',[''])[0],admin=action!='comments',before=q.get('before',[None])[0],limit=q.get('limit',[50])[0]))
                 if action == 'comments' and self.command == 'POST':
+                    if scoped and context:
+                        context.require(site_id,'comment',write=True)
                     if not trusted and (not request_origin or self.headers.get('X-ChatComment-Request') != '1'):
                         raise PermissionError('留言需通过允许来源的组件提交')
                     # A process-local bound keeps public submissions within 10/minute/IP.
@@ -145,7 +238,7 @@ def make_handler(store: Store, admin_token: str):
                             if len(bucket) >= 10:
                                 return self.send(429, {'error':'留言太频繁，请稍后再试'})
                             bucket.append(now)
-                    authenticated = trusted and bool(self.headers.get('X-ChatComment-Identity'))
+                    authenticated = bool(context and context.authenticated) if scoped else trusted and bool(self.headers.get('X-ChatComment-Identity'))
                     return self.send(201, store.create(site_id,self.payload(),authenticated=authenticated))
             return self.send(404, {'error':'接口不存在'})
 
@@ -164,8 +257,8 @@ def make_handler(store: Store, admin_token: str):
     return Handler
 
 
-def serve(store, *, token, host='127.0.0.1', port=10196):
-    server = ThreadingHTTPServer((host, port), make_handler(store, token))
+def serve(store, *, token=None, host='127.0.0.1', port=10196, **options):
+    server = ThreadingHTTPServer((host, port), make_handler(store, token,**options))
     server.daemon_threads = True
     try:
         server.serve_forever()

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/static/admin.html

@@ -4,14 +4,17 @@
 <section><label>站点 <select id="site"></select></label><p id="site-info" class="muted"></p><form id="settings"><div class="grid"><label><input name="anonymous" type="checkbox"> 允许匿名留言</label><label><input name="moderation" type="checkbox"> 新留言先审核</label></div><div class="grid" id="fields"></div><button>保存站点设置</button></form><p class="muted">页面访问范围由登录网关控制；允许匿名仅决定留言者是否需要已验证身份。邮箱只对管理员显示。</p></section>
 <section><div class="grid"><label>页面 <select id="page"></select></label><label>显示 <select id="filter"><option value="all">全部状态</option><option value="pending">待审核</option><option value="approved">已显示</option><option value="deleted">已删除</option></select></label></div><button id="refresh">刷新</button><button id="export" class="secondary">导出此页全部留言 JSON</button><div id="comments"></div><button id="more" hidden>加载更早留言</button></section>
 <section><details><summary>注册另一个站点</summary><form id="register"><label>站点 ID<input name="id" type="text" required pattern="[a-z0-9][a-z0-9_-]{0,63}"></label><label>站点名称<input name="title" type="text" required maxlength="120"></label><label>允许来源（每行一个完整 origin）<textarea name="origins" required placeholder="https://blog.example.com"></textarea></label><label>允许页面路径（每行一个）<textarea name="pages" required placeholder="/article/one/"></textarea></label><label><input type="checkbox" name="public"> 此站点允许公开读取与匿名提交（默认私有）</label><button>注册站点</button></form></details></section></main>
+<script type="application/json" id="chatcomment-auth">__CHATCOMMENT_AUTH__</script>
 <script>
 (() => {'use strict';
 const base=location.pathname.replace(/\/admin\/?$/,'');
+const config=JSON.parse(document.getElementById('chatcomment-auth').textContent);
 const $=s=>document.querySelector(s), notice=$('#notice');
 const labels={nickname:'昵称',email:'邮箱',website:'网址'};let sites=[],cursor=null;
-$('#back').href=base.replace(/\/comments$/,'/') || '/';
+$('#back').href=config.return_path;
+if(config.scoped)$('#register').parentElement.hidden=true;
 for(const [name,label] of Object.entries(labels)){const el=document.createElement('label');el.textContent=label+' ';const select=document.createElement('select');select.name=name;for(const [v,t] of [['optional','可选'],['required','必填'],['hidden','隐藏']]){const o=document.createElement('option');o.value=v;o.textContent=t;select.append(o);}el.append(select);$('#fields').append(el);}
-async function api(path,payload){const headers={};if(payload){headers['Content-Type']='application/json';const session=await fetch('/api/session',{credentials:'same-origin'});if(session.ok)headers['X-CSRF-Token']=(await session.json()).csrf_token;}const r=await fetch(base+path,{method:payload?'POST':'GET',credentials:'same-origin',headers,body:payload?JSON.stringify(payload):undefined});const v=await r.json().catch(()=>({}));if(!r.ok)throw new Error(v.error||'操作失败，请确认登录状态');return v;}
+async function api(path,payload){const headers={};if(payload){headers['Content-Type']='application/json';const session=await fetch(config.session_endpoint,{credentials:'same-origin'});if(session.ok)headers['X-CSRF-Token']=(await session.json()).csrf_token;}const r=await fetch(base+path,{method:payload?'POST':'GET',credentials:'same-origin',headers,body:payload?JSON.stringify(payload):undefined});const v=await r.json().catch(()=>({}));if(!r.ok)throw new Error(v.error||'操作失败，请确认登录状态');return v;}
 function site(){return sites.find(s=>s.id===$('#site').value);}
 function sitePath(action){return '/api/sites/'+encodeURIComponent(site().id)+'/'+action;}
 async function loadSites(selected){sites=(await api('/api/admin/sites')).sites;$('#site').replaceChildren();for(const s of sites){const o=document.createElement('option');o.value=s.id;o.textContent=s.title+' · '+s.id;$('#site').append(o);}if(selected)$('#site').value=selected;if(sites.length)await selectSite();}
@@ -22,6 +25,6 @@ $('#site').onchange=()=>run(selectSite);$('#page').onchange=$('#filter').onchang
 $('#settings').onsubmit=e=>{e.preventDefault();run(async()=>{const f=e.target.elements;const fields=Object.fromEntries(Object.keys(labels).map(n=>[n,f[n].value]));const result=await api(sitePath('settings'),{allow_anonymous:f.anonymous.checked,moderation:f.moderation.checked,fields});sites[sites.findIndex(s=>s.id===result.id)]=result;notice.textContent='设置已保存，留言组件刷新后使用新设置。';});};
 $('#register').onsubmit=e=>{e.preventDefault();run(async()=>{const f=e.target.elements;const result=await api('/api/admin/sites',{id:f.id.value,title:f.title.value,origins:f.origins.value.split('\n').map(v=>v.trim()).filter(Boolean),pages:f.pages.value.split('\n').map(v=>v.trim()).filter(Boolean),private:!f.public.checked});await loadSites(result.id);e.target.reset();notice.textContent='站点已注册。';});};
 $('#export').onclick=()=>run(async()=>{let all=[],before=null;do{const d=await api(sitePath('export')+'?limit=100&page='+encodeURIComponent($('#page').value)+(before?'&before='+encodeURIComponent(before):''));all.push(...d.comments);before=d.next_cursor;}while(before);const blob=new Blob([JSON.stringify({site:site().id,page:$('#page').value,comments:all},null,2)],{type:'application/json'}),url=URL.createObjectURL(blob),a=document.createElement('a');a.href=url;a.download='chatcomment-'+site().id+'.json';a.click();URL.revokeObjectURL(url);});
-run(()=>loadSites());
+run(()=>loadSites(new URLSearchParams(location.search).get('site')));
 })();
 </script></html>

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/static/board.html

@@ -1,19 +1,21 @@
 <!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>ChatComment · 留言板</title>
 <style>body{margin:0;background:#edf2ee;color:#243c32;font:16px/1.7 system-ui,sans-serif}main{max-width:900px;padding:36px 20px;margin:auto}a{color:#2d6953}.intro{font-size:14px;color:#607367}h1{font-size:32px;margin:12px 0 6px}.brand{font-size:12px;letter-spacing:.1em}</style>
 <main><a id="back">← 返回页面</a><p class="brand">ChatComment</p><h1>想法，留在这里。</h1><p class="intro">这里与页面底部共用同一个留言流。页面访问权限由网站管理，匿名只是留言的署名方式。</p><div id="comments"></div></main>
+<script type="application/json" id="chatcomment-auth">__CHATCOMMENT_AUTH__</script>
 <script>
 (async () => {
   const base=location.pathname.replace(/\/board\/?$/,'');
   const query=new URLSearchParams(location.search);
+  const config=JSON.parse(document.getElementById('chatcomment-auth').textContent);
   const script=document.createElement('script');
   script.src=base+'/widget.js';script.defer=true;script.dataset.chatcomment='';
   script.dataset.target='#comments';script.dataset.api=base;
-  script.dataset.site=query.get('site')||'personal-ai';script.dataset.page=query.get('page')||'/personal-ai/';
+  script.dataset.site=config.site;script.dataset.page=config.page;
   try {
-    const session=await fetch('/api/session',{credentials:'same-origin'});
-    if(session.ok && (await session.json()).csrf_token)script.dataset.csrfEndpoint='/api/session';
+    const session=await fetch(config.session_endpoint,{credentials:'same-origin'});
+    if(session.ok && (await session.json()).csrf_token)script.dataset.csrfEndpoint=config.session_endpoint;
   } catch (_) { /* Public standalone servers have no native login contract. */ }
-  document.getElementById('back').href=base.replace(/\/comments$/,'/')||'/';
+  document.getElementById('back').href=config.return_path;
   document.body.append(script);
 })();
 </script></html>

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/static/login.html

@@ -1,16 +1,19 @@
 <!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>ChatComment · 验证管理身份</title>
 <style>body{margin:0;background:#f0f4f0;font:16px/1.6 system-ui,sans-serif;color:#243d30}main{max-width:420px;margin:10vh auto;padding:28px;background:white;border:1px solid #d7e0d9;border-radius:14px}label{display:block;margin:18px 0}input{display:block;box-sizing:border-box;width:100%;font:inherit;padding:10px;border:1px solid #c7d4ca;border-radius:7px}button{font:inherit;background:#2c6550;color:white;border:0;border-radius:7px;padding:10px 18px;cursor:pointer}a{color:#2d6953}p{font-size:14px;color:#617366}</style>
 <main><a id="back">← 返回页面</a><h1>验证管理身份</h1><p>使用既有站点账号的邮箱和密码。只有本人账号可管理此留言区。</p><form><label>邮箱<input name="email" type="email" autocomplete="username" required></label><label>密码<input name="password" type="password" autocomplete="current-password" required></label><button>验证并进入设置</button><p role="status" aria-live="polite"></p></form></main>
+<script type="application/json" id="chatcomment-auth">__CHATCOMMENT_AUTH__</script>
 <script>
 (() => {
  const base=location.pathname.replace(/\/login\/?$/,'');
- document.getElementById('back').href=base.replace(/\/comments$/,'/')||'/';
+ const config=JSON.parse(document.getElementById('chatcomment-auth').textContent);
+ document.getElementById('back').href=config.return_path;
  const form=document.querySelector('form'),status=document.querySelector('[role=status]');
  form.addEventListener('submit',async e=>{e.preventDefault();const button=form.querySelector('button');button.disabled=true;status.textContent='正在验证…';
-  try{const session=await fetch('/api/session',{credentials:'same-origin'});if(!session.ok)throw new Error('请先登录站点');const csrf=(await session.json()).csrf_token;
-   const response=await fetch(base+'/api/admin/reauth',{method:'POST',credentials:'same-origin',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},body:JSON.stringify(Object.fromEntries(new FormData(form)))});
+  try{const session=await fetch(config.session_endpoint,{credentials:'same-origin'});if(!session.ok)throw new Error('请先登录站点');const csrf=(await session.json()).csrf_token;
+   const payload=Object.fromEntries(new FormData(form));if(config.scoped)payload.site=config.site;
+   const response=await fetch(config.reauth_endpoint||base+'/api/admin/reauth',{method:'POST',credentials:'same-origin',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},body:JSON.stringify(payload)});
    const result=await response.json();if(!response.ok)throw new Error(result.error||'邮箱或密码不正确');
-   form.elements.password.value='';location.assign(base+'/admin');
+   form.elements.password.value='';location.assign(base+'/admin?site='+encodeURIComponent(config.site));
   }catch(error){status.textContent=error.message;form.elements.password.value='';button.disabled=false;}
  });
 })();

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/static/widget.js

@@ -18,7 +18,7 @@
       <div class="cc-actions"><button type="submit">提交留言</button><button type="button" class="cc-refresh">刷新留言</button><span class="cc-status" role="status" aria-live="polite"></span></div></form>
       <div class="cc-list" aria-live="polite"></div><button type="button" class="cc-more" hidden>更早的留言</button>`;
     // The API base comes from the deployer's script attribute; never from comments.
-    box.querySelector('.cc-admin').href = `${api}/login`;
+    box.querySelector('.cc-admin').href = `${api}/login?site=${site}`;
     const status = box.querySelector('.cc-status');
     const list = box.querySelector('.cc-list');
     const form = box.querySelector('form');
@@ -43,6 +43,7 @@
     }
     async function config() {
       const data = await request(`/api/sites/${site}/config`);
+      if (data.auth?.scoped) options.csrfEndpoint=data.auth.session_endpoint;
       const gear = box.querySelector('.cc-admin'); gear.hidden = true;
       const fields = box.querySelector('.cc-fields'); fields.replaceChildren();
       const labels = {nickname:'昵称',email:'邮箱',website:'网址'};
@@ -63,7 +64,7 @@
             if (!value || !input.validity.valid) return;
             timer = setTimeout(async () => {
               try {
-                const hint = await request('/api/admin/entry', {email:value});
+                const hint = await request('/api/admin/entry', {site:options.site,email:value});
                 gear.hidden = input.value.trim() !== value || hint.show_settings !== true;
               } catch (_) { gear.hidden = true; }
             }, 250);

{chatcomment-0.1.1 → chatcomment-0.2.0}/src/chatcomment/store.py

@@ -142,6 +142,19 @@ class Store:
             db.execute('UPDATE sites SET settings=? WHERE id=?', (json.dumps(config), site_id))
         return self.site(site_id)
 
+    def allow_origin(self,site_id,value):
+        """Add an approved platform origin without touching fields or comments."""
+        approved=origin(value)
+        with self.connect() as db:
+            row=db.execute('SELECT origins FROM sites WHERE id=?',(site_id,)).fetchone()
+            if row is None:raise KeyError('站点不存在')
+            origins=json.loads(row[0])
+            if approved not in origins:
+                if len(origins)>=30:raise Invalid('站点来源数量已达上限')
+                origins.append(approved)
+                db.execute('UPDATE sites SET origins=? WHERE id=?',(json.dumps(sorted(origins)),site_id))
+        return self.site(site_id)
+
     def check_page(self, site_id, page_key):
         site = self.site(site_id)
         page_key = page(page_key)

{chatcomment-0.1.1 → chatcomment-0.2.0}/tests/cli-tests/test_cli.py

@@ -14,3 +14,10 @@ def test_installed_surface_and_registration(tmp_path):
     assert r.invoke(main,args+['site','list']).exit_code==0
     result=r.invoke(main,args+['backup',str(tmp_path/'backup.sqlite3')])
     assert result.exit_code==0,result.output
+
+
+def test_scoped_missing_database_fails_before_creating_file(tmp_path):
+    path=tmp_path/'missing'/'db.sqlite3'
+    result=CliRunner().invoke(main,['--db',str(path),'serve','--gateway-key-env','TEST_GATEWAY_KEY','--require-existing-db'],env={'TEST_GATEWAY_KEY':'x'*48})
+    assert result.exit_code!=0 and 'mount is missing' in result.output
+    assert not path.exists()

chatcomment-0.2.0/tests/code-tests/test_access.py

@@ -0,0 +1,46 @@
+import json
+import base64
+import hmac
+import hashlib
+from types import SimpleNamespace
+
+import pytest
+
+from chatcomment.access import AccessContext,SiteAccess,sign_context,verify_context
+
+KEY=b'test-key-with-at-least-thirty-two-bytes'
+
+
+def context():
+    return AccessContext('user-a','session-digest','a@example.invalid',{
+        'owned':SiteAccess(True,True,True,True,200),
+        'viewed':SiteAccess(read=True),
+        'other-managed':SiteAccess(True,True,True,False,200)},True)
+
+
+def test_explicit_site_roles_and_reauth():
+    c=context()
+    assert c.permits('owned','manage',now=100)
+    assert not c.permits('owned','manage',now=200)
+    assert c.permits('viewed','read') and not c.permits('viewed','comment')
+    assert c.permits('other-managed','manage',now=100) and not c.permits('other-managed','hint')
+    assert not c.permits('ungranted','read')
+    with pytest.raises(PermissionError):c.require('viewed','manage',now=100)
+    with pytest.raises(PermissionError):AccessContext('u','s',sites={'owned':SiteAccess(True,True)},csrf_verified=False).require('owned','comment',write=True)
+
+
+def test_chatlogin_global_admin_does_not_grant_sites():
+    principal=SimpleNamespace(user_id='global-admin',authenticated=True,role='admin')
+    c=AccessContext.from_chatlogin(SimpleNamespace(principal=principal),session_id='digest',email='admin@example.invalid',sites={})
+    assert not c.permits('any-site','manage',now=100)
+
+
+def test_signed_body_method_path_and_ttl():
+    headers=sign_context(context(),key=KEY,method='POST',path='/api/sites/owned/settings',body=b'{"a":1}',now=100)
+    c=verify_context(headers,key=KEY,method='POST',path='/api/sites/owned/settings',body=b'{"a":1}',now=110)
+    assert c.subject=='user-a' and c.permits('owned','manage',now=110)
+    for changes in [{'method':'GET'},{'path':'/api/sites/ungranted/settings'},{'body':b'{"a":2}'},{'now':131},{'key':b'wrong-key-that-is-at-least-32-bytes'}]:
+        args={'key':KEY,'method':'POST','path':'/api/sites/owned/settings','body':b'{"a":1}','now':110};args.update(changes)
+        with pytest.raises(PermissionError):verify_context(headers,**args)
+    assert verify_context({},key=KEY,method='GET',path='/health') is None
+    with pytest.raises(PermissionError):verify_context({'X-ChatComment-Role':'admin','X-ChatComment-Signature':'f'*64},key=KEY,method='GET',path='/health')

chatcomment-0.2.0/tests/code-tests/test_chatlogin_adapter.py

@@ -0,0 +1,24 @@
+from chatlogin.managed import ManagedUsers
+
+from chatcomment import AccessContext,SiteAccess
+
+
+def test_real_managed_sessions_preserve_site_scope_and_subject():
+    users=ManagedUsers.in_memory('comment-platform')
+    try:
+        users.bootstrap_owner('alice@example.invalid','test-password-alice-123!')
+        alice=users.authenticate('alice@example.invalid','test-password-alice-123!')
+        users.create_user(alice,'bob@example.invalid','test-password-bob-123!')
+        bob=users.authenticate('bob@example.invalid','test-password-bob-123!')
+        issued=users.sessions.issue(bob)
+        session=users.sessions.resolve(issued.token)
+        assert session is not None
+        context=AccessContext.from_chatlogin(session,session_id=users.sessions.digest(issued.token),
+            email='bob@example.invalid',sites={'bob-project':SiteAccess(True,True,True,True)},csrf_verified=True)
+        assert context.subject==bob.user_id and context.permits('bob-project','hint')
+        assert not context.permits('alice-project','read')
+        assert not context.permits('bob-project','manage')  # Password grant still required.
+        users.sessions.revoke(issued.token)
+        assert users.sessions.resolve(issued.token) is None
+    finally:
+        users.close()

{chatcomment-0.1.1 → chatcomment-0.2.0}/tests/code-tests/test_comments.py

@@ -32,6 +32,16 @@ def test_isolation_privacy_persistence_backup(store,tmp_path):
     with pytest.raises(Invalid): store.backup(backup)
 
 
+def test_allow_origin_preserves_all_other_site_fields_and_rows(store):
+    item=store.create('first',{'page':'/one/','content':'preserve migration row','email':'private@example.invalid'})
+    before=store.site('first');rows=store.comments('first','/one/',admin=True)
+    after=store.allow_origin('first','https://new-platform.example/')
+    assert after['origins']==['https://first.example','https://new-platform.example']
+    assert {k:v for k,v in before.items() if k!='origins'}=={k:v for k,v in after.items() if k!='origins'}
+    assert store.comments('first','/one/',admin=True)==rows
+    assert store.allow_origin('first','https://new-platform.example')==after
+
+
 def test_fields_and_anonymous_enforced(store):
     config=store.site('first')['settings']
     config['fields']['email']='required'

chatcomment-0.2.0/tests/code-tests/test_platform_http.py

@@ -0,0 +1,103 @@
+from http.server import ThreadingHTTPServer
+import json
+import threading
+import time
+import urllib.error
+import urllib.request
+
+import pytest
+
+from chatcomment import Store
+from chatcomment.access import AccessContext,SiteAccess,sign_context
+from chatcomment.server import make_handler
+
+KEY='test-platform-signing-key-with-more-than-32-characters'
+
+
+@pytest.fixture
+def platform(tmp_path):
+    store=Store(tmp_path/'comments.sqlite3')
+    for site in ['alice-site','bob-site']:
+        store.register(site,title=site,origins=['https://platform.example'],pages=['/kept/page/'],private=True)
+    store.create('bob-site',{'page':'/kept/page/','content':'Bob private row','email':'bob-private@example.invalid'})
+    server=ThreadingHTTPServer(('127.0.0.1',0),make_handler(store,gateway_key=KEY,
+        session_endpoint='/auth/api/session',reauth_endpoint='/extensions/comments/reauth',return_path='/sites/alice-site/'))
+    thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
+    def request(path,*,context=None,body=None,signature_path=None,legacy=False):
+        raw=json.dumps(body).encode() if body is not None else b''
+        method='POST' if body is not None else 'GET'
+        headers={'Origin':'https://platform.example'}
+        if body is not None:headers['Content-Type']='application/json'
+        if context is not None:headers.update(sign_context(context,key=KEY,method=method,path=signature_path or path,body=raw))
+        if legacy:headers.update({'Authorization':'Bearer '+KEY,'X-ChatComment-Role':'admin','X-ChatComment-Identity':'alice'})
+        req=urllib.request.Request(f'http://127.0.0.1:{server.server_port}'+path,data=raw if body is not None else None,headers=headers)
+        try:r=urllib.request.urlopen(req,timeout=5)
+        except urllib.error.HTTPError as e:r=e
+        with r:
+            data=r.read()
+            return r.status,json.loads(data) if r.headers.get_content_type()=='application/json' else data.decode()
+    yield store,request
+    server.shutdown();server.server_close();thread.join()
+
+
+def owner(*,verified=False,csrf=True):
+    return AccessContext('alice','current-session-hash','alice@example.invalid',{
+        'alice-site':SiteAccess(True,True,True,True,time.time()+900 if verified else 0)},csrf)
+
+
+def test_private_read_and_cross_site_management(platform):
+    store,http=platform
+    assert http('/api/sites/alice-site/config')[0]==403
+    assert http('/widget.js')[0]==403
+    assert http('/widget.css')[0]==403
+    assert http('/health')[0]==200
+    assert http('/api/sites/alice-site/config',legacy=True)[0]==403
+    assert http('/api/sites/alice-site/config',context=owner())[0]==200
+    assert http('/api/sites/bob-site/comments?page=/kept/page/',context=owner(verified=True))[0]==403
+    assert http('/api/sites/bob-site/admin?page=/kept/page/',context=owner(verified=True))[0]==403
+    assert http('/api/sites/bob-site/config',context=owner(),signature_path='/api/sites/alice-site/config')[0]==403
+    assert http('/api/sites/unknown-site/config',context=owner())[0]==403
+    code,data=http('/api/admin/sites',context=owner(verified=True))
+    assert code==200 and [s['id'] for s in data['sites']]==['alice-site']
+    assert 'bob-private@example.invalid' not in json.dumps(data)
+    assert http('/admin?site=bob-site',context=owner(verified=True))[0]==403
+
+
+def test_email_hint_is_site_scoped_and_never_grants_management(platform):
+    _,http=platform
+    assert http('/api/admin/entry',context=owner(),body={'site':'alice-site','email':'alice@example.invalid'})==(200,{'show_settings':True})
+    assert http('/api/admin/entry',context=owner(),body={'site':'alice-site','email':'nickname-rexwzh@example.invalid'})==(200,{'show_settings':False})
+    assert http('/api/admin/entry',context=owner(),body={'site':'bob-site','email':'alice@example.invalid'})[0]==403
+    assert http('/api/admin/entry',context=owner(csrf=False),body={'site':'alice-site','email':'alice@example.invalid'})[0]==403
+    assert http('/api/sites/alice-site/admin?page=/kept/page/',context=owner())[0]==403
+    assert http('/api/admin/sites',context=owner())[0]==403
+    assert http('/api/sites/alice-site/admin?page=/kept/page/',context=owner(verified=True))[0]==200
+    _,config=http('/api/sites/alice-site/config',context=owner())
+    assert config['auth']['session_endpoint']=='/auth/api/session'
+    assert 'alice@example.invalid' not in json.dumps(config)
+
+
+def test_viewer_no_writes_csrf_and_registered_page(platform):
+    store,http=platform
+    viewer=AccessContext('viewer','session','viewer@example.invalid',{'alice-site':SiteAccess(read=True)},True)
+    guest=AccessContext('guest','guest-session',sites={'alice-site':SiteAccess(read=True)},authenticated=False)
+    assert http('/api/sites/alice-site/config',context=guest)[0]==403
+    assert http('/api/sites/alice-site/config',context=viewer)[1]['can_manage'] is False
+    body={'page':'/kept/page/','content':'A real scoped comment'}
+    assert http('/api/sites/alice-site/comments',context=viewer,body=body)[0]==403
+    assert http('/api/sites/alice-site/comments',context=owner(csrf=False),body=body)[0]==403
+    assert http('/api/sites/alice-site/comments',context=owner(),body={**body,'page':'/unregistered/'})[0]==404
+    code,data=http('/api/sites/alice-site/comments',context=owner(),body=body)
+    assert code==201
+    assert http('/api/sites/alice-site/comments?page=/kept/page/',context=viewer)[1]['comments'][0]['id']==data['id']
+    assert store.comments('bob-site','/kept/page/')['comments'][0]['content']=='Bob private row'
+
+
+def test_scoped_login_configuration_and_registration_denial(platform):
+    store,http=platform
+    code,html=http('/login?site=alice-site',context=owner())
+    assert code==200 and '/auth/api/session' in html and '/extensions/comments/reauth' in html
+    assert 'alice@example.invalid' not in html and '__CHATCOMMENT_AUTH__' not in html
+    assert http('/login?site=bob-site',context=owner())[0]==403
+    assert http('/api/admin/sites',context=owner(verified=True),body={'id':'bob-site','title':'overwrite','origins':['https://platform.example'],'pages':['/kept/page/']})[0]==403
+    with pytest.raises(ValueError):make_handler(store,KEY,gateway_key=KEY)

chatcomment-0.1.1/src/chatcomment/__init__.py

@@ -1,6 +0,0 @@
-"""Reusable comments storage and HTTP service."""
-__version__ = "0.1.1"
-
-from .store import Store
-
-__all__ = ["Store", "__version__"]