From a9f244d7819cd3faa46f6c631fecf5f412990c63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Mon, 10 Aug 2026 03:37:50 +0800
Subject: [PATCH] Wire desktop domain access to trusted orchestrator

---
 .../hololake-desktop/electron/main.ts         | 56 +++++++++++++------
 1 file changed, 38 insertions(+), 18 deletions(-)

diff --git a/product-source/hololake-desktop/electron/main.ts b/product-source/hololake-desktop/electron/main.ts
index 8f13c41..67a31d2 100644
--- a/product-source/hololake-desktop/electron/main.ts
+++ b/product-source/hololake-desktop/electron/main.ts
@@ -18,7 +18,8 @@ import path from 'path';
 import { spawn, ChildProcess } from 'child_process';
 import fs from 'fs';
 import { importKnowledgeFolder } from './folder-import.js';
-import { evaluateDomainAccess } from '../../guanghu-knowledge-base/server/domain-access.js';
+import { DomainAccessOrchestrator } from '../../guanghu-knowledge-base/server/domain-access-orchestrator.js';
+import { TrustedSignerSnapshotLoader } from '../../guanghu-knowledge-base/server/trusted-signer-snapshot.js';
 
 // ─── 配置 ───
 
@@ -312,6 +313,41 @@ async function forgejoRequest(
   return { response, data };
 }
 
+const trustedSignerSnapshots = new TrustedSignerSnapshotLoader({
+  async fetchJson(url: string): Promise<unknown> {
+    const response = await fetch(url, {
+      headers: { Accept: 'application/json' },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok) throw new Error(`trusted_signer_source_http_${response.status}`);
+    return response.json();
+  },
+});
+
+const domainAccessOrchestrator = new DomainAccessOrchestrator(
+  trustedSignerSnapshots,
+  {
+    async read() {
+      const stored = applyStoredServerAuth();
+      if (!stored) {
+        return { accountVerified: false, nodeId: defaultPersonalServerId() || '' };
+      }
+      try {
+        const { response } = await forgejoRequest(stored.nodeId, '/api/v1/user', {}, { token: stored.token });
+        return { accountVerified: response.ok, nodeId: stored.nodeId };
+      } catch {
+        return { accountVerified: false, nodeId: stored.nodeId };
+      }
+    },
+  },
+  {
+    async read() {
+      // 当前灯塔尚未发布签名运行体交接端点。保持关闭，不从账号身份推导运行体权限。
+      return null;
+    },
+  },
+);
+
 function startServer(): Promise<void> {
   return new Promise((resolve, reject) => {
     if (isDev) {
@@ -567,23 +603,7 @@ ipcMain.handle('server:session', async (_event, requestedNodeId?: string) => {
   }
 });
 ipcMain.handle('server:domain-access', async (_event, domainId = 'DOM-FIFTH-0001') => {
-  const stored = applyStoredServerAuth();
-  let accountVerified = false;
-  if (stored) {
-    try {
-      const { response } = await forgejoRequest(stored.nodeId, '/api/v1/user', {}, { token: stored.token });
-      accountVerified = response.ok;
-    } catch {
-      accountVerified = false;
-    }
-  }
-  // Forgejo identity is only the first proof. A signed manifest, scoped capability and
-  // matching online receipt must arrive from the lighthouse/domain before runtime entry.
-  return evaluateDomainAccess({
-    accountVerified,
-    domainId: String(domainId),
-    nodeId: stored?.nodeId || defaultPersonalServerId() || '',
-  });
+  return domainAccessOrchestrator.domainAccess(String(domainId));
 });
 ipcMain.handle('server:login', async (_event, input: { nodeId: string; username: string; password: string }) => {
   const username = String(input.username || '').trim();