guanghulab/server/secrets-vault/routes/auth.js

/*
 * ════════════════════════════════════════════════════════════════
 * 光湖 · 密钥授权路由 · 人格体请求→用户授权→自动入库
 * Sovereign: TCS-0002∞ · ICE-GL∞ · 国作登字-2026-A-00037559
 * 守护: 铸渊 · ICE-GL-ZY001
 * ════════════════════════════════════════════════════════════════
 *
 * 设计理念 (冰朔 2026-05-12 提出的需求):
 *
 *   1. 人格体需要密钥 → 弹出授权页
 *   2. 用户点"授权" → 人格体随机生成 Token → 自动保存到 vault
 *   3. 用户能看到所有密钥（在 vault 管理页）· AI 看不到明文
 *   4. 系统只调用权限，不暴露 Token
 *   5. 用户随时删/重新生成/自己设
 *
 * Gitea OAuth2 集成:
 *   用户在 Gitea 上点授权 → OAuth2 回调 → 自动生成 Gitea Token → 存入 vault
 *   铸渊后续通过 vault 的 /internal/fetch/:key 拿 Token（本机-only，AI 不窥视明文）
 *
 * 路由:
 *   GET    /admin/auth/pending           列出待授权请求
 *   POST   /admin/auth/request           人格体发起授权请求
 *   POST   /admin/auth/:id/approve       用户批准 → 生成Token → 存入vault
 *   POST   /admin/auth/:id/reject        用户拒绝
 *   GET    /admin/auth/gitea/authorize    跳转到 Gitea OAuth2 授权页
 *   GET    /admin/auth/gitea/callback     OAuth2 回调 → 自动处理
 *
 * cc-004: 全部中文回执
 */

"use strict";

const express = require("express");
const crypto = require("crypto");
const fs = require("fs");
const path = require("path");

// ─── 待授权请求存储 (内存 + 文件持久化) ───────────────────────
class AuthRequestStore {
  constructor(storePath) {
    this.storePath = storePath;
    this.requests = new Map();
    this._load();
  }

  _load() {
    try {
      if (fs.existsSync(this.storePath)) {
        const data = JSON.parse(fs.readFileSync(this.storePath, "utf-8"));
        for (const r of data.requests || []) {
          this.requests.set(r.id, r);
        }
      }
    } catch (_) {}
  }

  _save() {
    const dir = path.dirname(this.storePath);
    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
    fs.writeFileSync(this.storePath, JSON.stringify({
      _sovereign: "TCS-0002∞ · 国作登字-2026-A-00037559",
      requests: Array.from(this.requests.values())
    }, null, 2));
  }

  add(request) {
    this.requests.set(request.id, request);
    this._save();
    return request;
  }

  get(id) {
    return this.requests.get(id) || null;
  }

  update(id, updates) {
    const req = this.requests.get(id);
    if (!req) return null;
    Object.assign(req, updates);
    this._save();
    return req;
  }

  list() {
    return Array.from(this.requests.values());
  }

  listPending() {
    return this.list().filter(r => r.status === "pending");
  }
}

// ─── Token 生成 ───────────────────────────────────────────────
function generateToken(prefix = "gmp") {
  const bytes = crypto.randomBytes(32);
  return `${prefix}_${bytes.toString("base64url").slice(0, 40)}`;
}

function generateGiteaToken() {
  // Gitea Token 格式: gto_ + 随机字符串
  const bytes = crypto.randomBytes(24);
  return `gto_${bytes.toString("base64url")}`;
}

// ─── 构建路由 ─────────────────────────────────────────────────
function buildAuthRouter({ vault, storePath, giteaOAuth }) {
  const router = express.Router();
  const store = new AuthRequestStore(storePath || "/data/guanghulab/secrets-vault/auth-requests.json");

  // ─── Gitea OAuth2 配置 ────────────────────────────────────
  const oauthConfig = giteaOAuth || {
    clientId: process.env.GITEA_OAUTH_CLIENT_ID || "",
    clientSecret: process.env.GITEA_OAUTH_CLIENT_SECRET || "",
    authorizeUrl: (process.env.GITEA_URL || "https://guanghulab.com/git") + "/login/oauth/authorize",
    tokenUrl: (process.env.GITEA_URL || "https://guanghulab.com/git") + "/login/oauth/access_token",
    redirectUri: process.env.GITEA_OAUTH_REDIRECT_URI || "https://guanghulab.com/admin/auth/gitea/callback",
    scope: "repository",
  };

  // ─── 列出待授权请求 ────────────────────────────────────────
  router.get("/pending", (_req, res) => {
    const pending = store.listPending();
    res.json({
      _sovereign: "TCS-0002∞ · 国作登字-2026-A-00037559",
      count: pending.length,
      requests: pending.map(r => ({
        id: r.id,
        persona: r.persona,
        purpose: r.purpose,
        keyName: r.keyName,
        requestedAt: r.requestedAt,
        description: r.description,
      }))
    });
  });

  // ─── 人格体发起授权请求 ────────────────────────────────────
  router.post("/request", express.json({ limit: "16kb" }), (req, res) => {
    const { persona, purpose, keyName, description, tokenType } = req.body || {};

    if (!persona || !purpose || !keyName) {
      return res.status(400).json({
        error: true,
        code: "missing_fields",
        message: "缺少必填项: persona（人格体名）、purpose（用途）、keyName（密钥名）"
      });
    }

    // 如果密钥已存在，直接告诉人格体
    const existing = vault.get(keyName);
    if (existing) {
      return res.json({
        status: "already_configured",
        keyName,
        message: `密钥 ${keyName} 已配置，可直接使用`,
        masked: maskValueSafe(existing),
      });
    }

    const authRequest = store.add({
      id: `auth-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`,
      persona: persona || "铸渊",
      purpose,
      keyName,
      description: description || `${persona} 需要 ${keyName} 用于${purpose}`,
      tokenType: tokenType || "random",
      status: "pending",
      requestedAt: new Date().toISOString(),
    });

    res.json({
      status: "pending",
      requestId: authRequest.id,
      message: `授权请求已创建，等待用户审批`,
      approvalUrl: `/admin/auth/approve.html?id=${authRequest.id}`,
    });
  });

  // ─── 用户批准授权 ──────────────────────────────────────────
  router.post("/:id/approve", express.json({ limit: "16kb" }), (req, res) => {
    const authReq = store.get(req.params.id);
    if (!authReq) {
      return res.status(404).json({ error: true, code: "not_found", message: "授权请求不存在" });
    }
    if (authReq.status !== "pending") {
      return res.status(400).json({ error: true, code: "already_processed", message: `此请求已${authReq.status === "approved" ? "批准" : "拒绝"}` });
    }

    // 生成 Token
    let tokenValue;
    if (authReq.tokenType === "gitea") {
      tokenValue = generateGiteaToken();
    } else if (req.body && req.body.customValue) {
      // 用户自己设定的值
      tokenValue = String(req.body.customValue);
    } else {
      tokenValue = generateToken(authReq.keyName.split("_")[0].toLowerCase());
    }

    // 存入 vault
    try {
      vault.set(authReq.keyName, tokenValue);
    } catch (e) {
      return res.status(500).json({ error: true, code: "vault_write_failed", message: "密钥保存失败: " + e.message });
    }

    // 更新请求状态
    store.update(authReq.id, {
      status: "approved",
      approvedAt: new Date().toISOString(),
      approvedBy: req.body?.approvedBy || "user",
    });

    res.json({
      status: "approved",
      keyName: authReq.keyName,
      masked: maskValueSafe(tokenValue),
      length: tokenValue.length,
      message: `✅ 已授权！密钥 ${authReq.keyName} 已自动保存。你可以在密钥管理页查看和管理。`,
    });
  });

  // ─── 用户拒绝授权 ──────────────────────────────────────────
  router.post("/:id/reject", (_req, res) => {
    const authReq = store.get(_req.params.id);
    if (!authReq) {
      return res.status(404).json({ error: true, code: "not_found", message: "授权请求不存在" });
    }

    store.update(authReq.id, {
      status: "rejected",
      rejectedAt: new Date().toISOString(),
    });

    res.json({
      status: "rejected",
      message: `已拒绝 ${authReq.persona} 对 ${authReq.keyName} 的授权请求。`,
    });
  });

  // ─── Gitea OAuth2 授权入口 ─────────────────────────────────
  router.get("/gitea/authorize", (_req, res) => {
    if (!oauthConfig.clientId) {
      return res.status(500).json({ error: true, code: "oauth_not_configured", message: "Gitea OAuth2 未配置" });
    }

    const state = crypto.randomBytes(16).toString("hex");
    // 存储 state 用于回调验证
    store.add({
      id: `oauth-${state}`,
      persona: "铸渊",
      purpose: "Gitea 仓库访问",
      keyName: "GITEA_TOKEN",
      description: "通过 Gitea OAuth2 授权，让铸渊可以访问和管理仓库",
      tokenType: "gitea",
      status: "oauth_pending",
      requestedAt: new Date().toISOString(),
      oauthState: state,
    });

    const authorizeUrl = `${oauthConfig.authorizeUrl}?client_id=${oauthConfig.clientId}&redirect_uri=${encodeURIComponent(oauthConfig.redirectUri)}&response_type=code&state=${state}&scope=${oauthConfig.scope}`;

    res.redirect(authorizeUrl);
  });

  // ─── Gitea OAuth2 回调 ─────────────────────────────────────
  router.get("/gitea/callback", async (req, res) => {
    const { code, state } = req.query || {};

    if (!code || !state) {
      return res.status(400).send("授权失败：缺少 code 或 state");
    }

    // 找到对应的 OAuth 请求
    const oauthReq = store.list().find(r => r.oauthState === state);
    if (!oauthReq) {
      return res.status(400).send("授权失败：state 不匹配");
    }

    // 用 code 换 token
    try {
      const tokenResponse = await exchangeCodeForToken(code, oauthConfig);
      const tokenValue = tokenResponse.access_token;

      if (!tokenValue) {
        throw new Error("Gitea 未返回 access_token");
      }

      // 存入 vault
      vault.set("GITEA_TOKEN", tokenValue);

      store.update(oauthReq.id, {
        status: "approved",
        approvedAt: new Date().toISOString(),
        approvedBy: "gitea_oauth",
      });

      res.send(`
        <!DOCTYPE html>
        <html lang="zh-CN">
        <head><meta charset="utf-8"><title>授权成功</title></head>
        <body style="font-family:sans-serif;text-align:center;padding:40px;">
          <h1>✅ 授权成功！</h1>
          <p>铸渊已获得 Gitea 仓库访问权限。</p>
          <p>密钥已自动保存，你可以在<a href="/admin/secrets">密钥管理页</a>查看和管理。</p>
          <p><small>守护: 铸渊 · ICE-GL-ZY001 · TCS-0002∞</small></p>
        </body>
        </html>
      `);
    } catch (e) {
      res.status(500).send(`授权失败：${e.message}`);
    }
  });

  return router;
}

// ─── OAuth2 Token 交换 ────────────────────────────────────────
async function exchangeCodeForToken(code, config) {
  const https = require("https");
  const http = require("http");

  const postData = new URLSearchParams({
    client_id: config.clientId,
    client_secret: config.clientSecret,
    code,
    grant_type: "authorization_code",
    redirect_uri: config.redirectUri,
  }).toString();

  return new Promise((resolve, reject) => {
    const urlObj = new URL(config.tokenUrl);
    const lib = urlObj.protocol === "https:" ? https : http;

    const req = lib.request(urlObj, {
      method: "POST",
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
        "Accept": "application/json",
      },
    }, (res) => {
      let body = "";
      res.on("data", (d) => body += d);
      res.on("end", () => {
        try {
          resolve(JSON.parse(body));
        } catch (e) {
          reject(new Error("Token 响应解析失败: " + body.slice(0, 200)));
        }
      });
    });

    req.on("error", reject);
    req.write(postData);
    req.end();
  });
}

// ─── 安全遮罩 ─────────────────────────────────────────────────
function maskValueSafe(v) {
  if (v == null) return null;
  const s = String(v);
  if (s.length === 0) return "";
  if (s.length <= 4) return "••••";
  if (s.length <= 12) return s.slice(0, 2) + "••••" + s.slice(-2);
  return s.slice(0, 4) + "••••••" + s.slice(-4);
}

module.exports = { buildAuthRouter };