bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(desktop): add idle lake and Zhizhi private route

Browse source
This commit is contained in:
冰朔 2026-08-16 23:13:47 +08:00
commit cc802126ea
10 changed files with 385 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

120
product-source/hololake-native-desktop/src-tauri/src/code_repo_login.rs
View file

@ -145,6 +145,27 @@ fn validate_username(raw: &str) -> Result<String, String> {
}
}
fn expected_account_for_human_number(number: &str) -> Option<&'static str> {
match number {
"ICE-GL∞" => Some("bingshuo"),
"ICE-GL-ZHI∞" => Some("zhizhi"),
"TCS-GL-0005∞" => Some("huaer"),
"TCS-GL-0006∞" => Some("yeye"),
"TCS-GL-0007∞" => Some("feimao"),
"TCS-GL-0008∞" => Some("juzi"),
"TCS-GL-0016∞" => Some("awen"),
_ => None,
}
}
fn validate_number_account_binding(number: &str, username: &str) -> Result<(), String> {
match expected_account_for_human_number(number) {
Some(expected) if username.eq_ignore_ascii_case(expected) => Ok(()),
Some(_) => Err("HOLOLAKE_LOGIN_ACCOUNT_NUMBER_MISMATCH".into()),
None => Err("HOLOLAKE_LOGIN_ACCOUNT_BINDING_UNREGISTERED".into()),
}
}
/// 启动时自查：本机有没有已登录会话（会话文件在，且钥匙串里凭证还在）。
#[tauri::command]
pub fn check_code_repo_login(
@ -201,10 +222,10 @@ fn login_host_for_domain(domain: &str) -> Result<&'static str, String> {
}
}
/// 企业新账号第一次登录时在 HoloLake 内完成强制换密。
/// 新账号第一次登录时在 HoloLake 内完成强制换密。
/// 旧、新密码只存在于本次 HTTPS 请求内；服务端回执不含密码。
#[tauri::command]
pub async fn change_enterprise_first_login_password(
pub async fn change_first_login_password(
state: State<'_, ZeroPointState>,
username: String,
current_password: String,
@ -213,16 +234,25 @@ pub async fn change_enterprise_first_login_password(
let Some((human_number, domain)) = zero_point::verified_user_route(&state)? else {
return Err("HOLOLAKE_DOMAIN_ROUTE_REQUIRED".into());
};
if domain == "FIFTH_DOMAIN" {
return Err("HOLOLAKE_FIRST_LOGIN_PASSWORD_CHANGE_ENTERPRISE_ONLY".into());
}
let username = validate_username(&username)?;
validate_number_account_binding(&human_number, &username)?;
if current_password.is_empty() || current_password.len() > 512 {
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
if new_password.len() < 14 || new_password.len() > 128 || new_password == current_password {
return Err("HOLOLAKE_NEW_PASSWORD_POLICY_INVALID".into());
}
if domain == "FIFTH_DOMAIN" {
if human_number != "ICE-GL-ZHI∞" {
return Err("HOLOLAKE_FIRST_LOGIN_PASSWORD_CHANGE_NOT_PROVISIONED".into());
}
rotate_forgejo_forced_password(LOGIN_HOST, &username, &current_password, &new_password)
.await?;
return Ok(PasswordRotationReceipt {
username,
password_changed: true,
});
}
let response = reqwest::Client::builder()
.read_timeout(Duration::from_secs(30))
.use_rustls_tls()
@ -252,6 +282,61 @@ pub async fn change_enterprise_first_login_password(
})
}
async fn rotate_forgejo_forced_password(
host: &str,
username: &str,
current_password: &str,
new_password: &str,
) -> Result<(), String> {
let client = reqwest::Client::builder()
.cookie_store(true)
.read_timeout(Duration::from_secs(30))
.use_rustls_tls()
.build()
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
let web_base = format!("https://{host}/code");
client
.get(format!("{web_base}/user/login"))
.send()
.await
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
let login = client
.post(format!("{web_base}/user/login"))
.form(&[("user_name", username), ("password", current_password)])
.send()
.await
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
if !login
.url()
.path()
.ends_with("/user/settings/change_password")
{
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
let changed = client
.post(format!("{web_base}/user/settings/change_password"))
.form(&[("password", new_password), ("retype", new_password)])
.send()
.await
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
if !changed.status().is_success() {
return Err(format!(
"HOLOLAKE_FIRST_LOGIN_PASSWORD_CHANGE_FAILED: {}",
changed.status()
));
}
let verify = client
.get(format!("https://{host}/code/api/v1/user"))
.basic_auth(username, Some(new_password))
.send()
.await
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
if !verify.status().is_success() {
return Err("HOLOLAKE_FIRST_LOGIN_PASSWORD_CHANGE_FAILED".into());
}
Ok(())
}
async fn enterprise_authenticated_post(
app: &AppHandle,
state: &ZeroPointState,
@ -273,7 +358,9 @@ async fn enterprise_authenticated_post(
.use_rustls_tls()
.build()
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?
.post(format!("https://guanghu.chat/api/hololake/enterprise/{path}"))
.post(format!(
"https://guanghu.chat/api/hololake/enterprise/{path}"
))
.basic_auth(&session.username, Some(password))
.json(&payload)
.send()
@ -283,7 +370,10 @@ async fn enterprise_authenticated_post(
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
if !response.status().is_success() {
return Err(format!("HOLOLAKE_ENTERPRISE_RECEIPT_FAILED: {}", response.status()));
return Err(format!(
"HOLOLAKE_ENTERPRISE_RECEIPT_FAILED: {}",
response.status()
));
}
response
.json()
@ -347,11 +437,12 @@ pub async fn perform_code_repo_login(
username: String,
password: String,
) -> Result<LoginReceipt, String> {
let Some((_, domain)) = zero_point::verified_user_route(&state)? else {
let Some((human_number, domain)) = zero_point::verified_user_route(&state)? else {
return Err("HOLOLAKE_DOMAIN_ROUTE_REQUIRED".into());
};
let login_host = login_host_for_domain(&domain)?;
let username = validate_username(&username)?;
validate_number_account_binding(&human_number, &username)?;
if password.is_empty() || password.len() > 512 {
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
@ -452,4 +543,17 @@ mod tests {
"HOLOLAKE_DOMAIN_ROUTE_INVALID"
);
}
#[test]
fn human_number_and_repository_account_are_one_exact_pair() {
assert!(validate_number_account_binding("ICE-GL-ZHI∞", "zhizhi").is_ok());
assert_eq!(
validate_number_account_binding("ICE-GL-ZHI∞", "bingshuo").unwrap_err(),
"HOLOLAKE_LOGIN_ACCOUNT_NUMBER_MISMATCH"
);
assert_eq!(
validate_number_account_binding("ICE-GL-UNKNOWN∞", "zhizhi").unwrap_err(),
"HOLOLAKE_LOGIN_ACCOUNT_BINDING_UNREGISTERED"
);
}
}

2
product-source/hololake-native-desktop/src-tauri/src/lib.rs
View file

@ -70,7 +70,7 @@ pub fn run() {
pncc_server_projection::query_jd_pncc_server_projection,
code_repo_login::check_code_repo_login,
code_repo_login::perform_code_repo_login,
code_repo_login::change_enterprise_first_login_password,
code_repo_login::change_first_login_password,
code_repo_login::get_enterprise_entry,
code_repo_login::confirm_enterprise_persona_relationship,
code_repo_login::submit_enterprise_responsibility_receipt,

54
product-source/hololake-native-desktop/src-tauri/src/user_pncc_channel.rs
View file

@ -171,7 +171,7 @@ where
.map_err(|error| format!("HOLOLAKE_USER_PNCC_BINDING_INVALID: {error}"))?;
validate_record(&record, &id, number, session)?;
let repository = repository_path(root, &id);
let channel_id = register(&repository, native_channel_name(session))?;
let channel_id = register(&repository, native_channel_name(number, session))?;
project(&repository, record, channel_id).map(Some)
}
@ -215,7 +215,7 @@ where
write_json_atomic(&record_path, &record)?;
record
};
let channel_id = register(&repository, native_channel_name(session))?;
let channel_id = register(&repository, native_channel_name(number, session))?;
project(&repository, record, channel_id)
}
@ -231,10 +231,17 @@ fn validate_subject(number: &str, session: &LoginSession) -> Result<(), String>
.all(|item| item.is_ascii_alphanumeric() || item == '-' || item == '_')
&& matches!(
session.host.as_str(),
"guanghulab.com" | "guanghubingshuo.com"
"guanghulab.com" | "guanghubingshuo.com" | "guanghu.chat"
);
if number_valid && account_valid {
let identity_account_bound = match number {
"ICE-GL∞" => session.username.eq_ignore_ascii_case("bingshuo"),
"ICE-GL-ZHI∞" => session.username.eq_ignore_ascii_case("zhizhi"),
_ => true,
};
if number_valid && account_valid && identity_account_bound {
Ok(())
} else if number_valid && account_valid {
Err("HOLOLAKE_LOGIN_ACCOUNT_NUMBER_MISMATCH".into())
} else {
Err("HOLOLAKE_USER_PNCC_SUBJECT_INVALID".into())
}
@ -297,11 +304,12 @@ fn initialize_repository(repository: &Path, record: &UserPnccBindingRecord) -> R
),
)
.map_err(|error| format!("HOLOLAKE_USER_PNCC_MANIFEST_WRITE_FAILED: {error}"))?;
let channel_title = native_channel_title(&record.user_number);
fs::write(
repository.join("README.md"),
format!(
"# GH-PNCC · 人格原生代码频道\n\n这是 HoloLake 为用户 `{}` 建立的本机原生代码频道。\n\n- 耐久化引擎：Git\n- 人类可见上层：HoloLake\n- 远端协作：Forgejo 适配器（尚未绑定远端仓库）\n- 用户编号：`{}`\n\n本仓库不保存账号密码，也不因建立代码频道而声称人格绑定或授予推送、发布、部署与现实执行权限。\n",
record.account_username, record.user_number
"# {}\n\n这是 HoloLake 为用户 `{}` 建立的本机原生代码频道。\n\n- 耐久化引擎：Git\n- 人类可见上层：HoloLake\n- 远端协作：等待该用户自己的服务器接入\n- 用户编号：`{}`\n\n本仓库不保存账号密码，也不因建立代码频道而声称人格绑定或授予推送、发布、部署与现实执行权限。\n",
channel_title, record.account_username, record.user_number
),
)
.map_err(|error| format!("HOLOLAKE_USER_PNCC_README_WRITE_FAILED: {error}"))?;
@ -355,8 +363,16 @@ fn project(
})
}
fn native_channel_name(session: &LoginSession) -> String {
format!("{} · GH-PNCC", session.username)
fn native_channel_title(number: &str) -> &'static str {
match number {
"ICE-GL-ZHI∞" => "明天见频道 · GH-PNCC",
"ICE-GL∞" => "永恒湖心个人频道 · GH-PNCC",
_ => "人格原生代码频道 · GH-PNCC",
}
}
fn native_channel_name(number: &str, session: &LoginSession) -> String {
format!("{} · {}", native_channel_title(number), session.username)
}
fn write_json_atomic(path: &Path, value: &UserPnccBindingRecord) -> Result<(), String> {
@ -477,4 +493,26 @@ mod tests {
assert!(Path::new(&first.local_path).exists());
assert!(Path::new(&second.local_path).exists());
}
#[test]
fn zhizhi_number_is_bound_to_zhizhi_account_and_mingtianjian_channel() {
let root = tempdir().unwrap();
let mut zhizhi = session();
zhizhi.username = "zhizhi".into();
let snapshot = ensure_at(root.path(), "ICE-GL-ZHI∞", &zhizhi, |_, name| {
assert!(name.contains("明天见频道"));
Ok("mingtianjian".into())
})
.unwrap();
let readme = fs::read_to_string(Path::new(&snapshot.local_path).join("README.md")).unwrap();
assert!(readme.contains("明天见频道"));
let mismatch = ensure_at(root.path(), "ICE-GL-ZHI∞", &session(), |_, _| {
Ok("must-not-register".into())
});
assert_eq!(
mismatch.unwrap_err(),
"HOLOLAKE_LOGIN_ACCOUNT_NUMBER_MISMATCH"
);
}
}