1080 lines
37 KiB
Go
1080 lines
37 KiB
Go
// Copyright 2026 Alibaba Group
|
||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||
// you may not use this file except in compliance with the License.
|
||
// You may obtain a copy of the License at
|
||
//
|
||
// http://www.apache.org/licenses/LICENSE-2.0
|
||
//
|
||
// Unless required by applicable law or agreed to in writing, software
|
||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
// See the License for the specific language governing permissions and
|
||
// limitations under the License.
|
||
|
||
package app
|
||
|
||
import (
|
||
"bytes"
|
||
"context"
|
||
"encoding/base64"
|
||
"encoding/json"
|
||
"fmt"
|
||
"io"
|
||
"os"
|
||
"path/filepath"
|
||
"runtime"
|
||
"strings"
|
||
"time"
|
||
|
||
authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
|
||
apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
|
||
"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/helpers"
|
||
"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
|
||
"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pat"
|
||
"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
|
||
"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
|
||
"github.com/charmbracelet/huh"
|
||
"github.com/charmbracelet/lipgloss"
|
||
"github.com/spf13/cobra"
|
||
)
|
||
|
||
type authLoginConfig struct {
|
||
Token string
|
||
Force bool
|
||
Device bool
|
||
Recommend bool
|
||
Yes bool
|
||
}
|
||
|
||
type authLoginGuideAction string
|
||
|
||
const (
|
||
authLoginGuideDirectCLI authLoginGuideAction = "direct_cli"
|
||
authLoginGuideConfigureAgentApp authLoginGuideAction = "configure_agent_app"
|
||
authLoginGuideManualCredentials authLoginGuideAction = "manual_credentials"
|
||
)
|
||
|
||
var (
|
||
authLoginBrandBlue = lipgloss.AdaptiveColor{Light: "#1677FF", Dark: "#69B1FF"}
|
||
authLoginInk = lipgloss.AdaptiveColor{Light: "#1F2937", Dark: "#EAF2FF"}
|
||
authLoginMuted = lipgloss.AdaptiveColor{Light: "#667085", Dark: "#8A96A8"}
|
||
authLoginLine = lipgloss.AdaptiveColor{Light: "#D6E4FF", Dark: "#2F3B52"}
|
||
authLoginDanger = lipgloss.AdaptiveColor{Light: "#D92D20", Dark: "#FF6B6B"}
|
||
)
|
||
|
||
func buildAuthCommand(patCaller edition.ToolCaller) *cobra.Command {
|
||
cmd := &cobra.Command{
|
||
Use: "auth",
|
||
Short: "认证管理",
|
||
Long: "管理钉钉 CLI 的认证凭证。支持 OAuth 扫码登录和 Device Flow。",
|
||
Args: cobra.NoArgs,
|
||
TraverseChildren: true,
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
return cmd.Help()
|
||
},
|
||
}
|
||
|
||
if !edition.Get().HideAuthLogin {
|
||
cmd.AddCommand(newAuthLoginCommand(patCaller))
|
||
}
|
||
cmd.AddCommand(
|
||
newAuthLogoutCommand(),
|
||
newAuthStatusCommand(),
|
||
newAuthExportCommand(),
|
||
newAuthImportCommand(),
|
||
newAuthExchangeCommand(),
|
||
newAuthResetCommand(),
|
||
)
|
||
return cmd
|
||
}
|
||
|
||
func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
|
||
cmd := &cobra.Command{
|
||
Use: "login",
|
||
Short: "登录钉钉（自动刷新 token，必要时扫码）",
|
||
Long: `登录钉钉并获取认证凭证。
|
||
|
||
支持的登录方式:
|
||
- OAuth Loopback 流 (默认): 本机自动起 127.0.0.1 监听接收回调，浏览器授权后自动完成
|
||
- OAuth 设备流 (--device): 显示 user_code + 短 URL，适合 SSH 远程 / 容器 / 无头环境
|
||
- 直接提供 Token (--token): 跳过授权，使用已有 token
|
||
|
||
不支持的登录方式:
|
||
- 邮箱/密码登录
|
||
- 手机号/验证码登录
|
||
- 应用凭证 (AppKey/AppSecret) 直接登录
|
||
|
||
注意: SSH 远程或无头环境（无本地浏览器可访问远端的 127.0.0.1）请使用 --device，
|
||
否则 OAuth 回调会跳到本机不可达的 127.0.0.1 链接，授权完成后无法回写 token。
|
||
|
||
示例:
|
||
dws auth login # 本机登录后选择推荐/全部权限与授权业务域
|
||
dws auth login --recommend # 无交互批量授权服务端推荐权限
|
||
dws auth login --device # SSH 远程 / 无头环境登录 (设备流)
|
||
dws auth login --force # 强制重新登录 (忽略缓存 token)
|
||
dws auth login --token xxx # 使用指定 token`,
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
cfg, err := resolveAuthLoginConfig(cmd)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
configDir := defaultConfigDir()
|
||
var tokenData *authpkg.TokenData
|
||
format, _ := cmd.Root().PersistentFlags().GetString("format")
|
||
postLoginTUIMode := !cfg.Yes && authLoginShouldUsePostLoginTUIMode(cmd, format, cfg.Recommend)
|
||
recommendAuthMode := cfg.Recommend || postLoginTUIMode
|
||
humanAuthMode := !cfg.Yes && authLoginShouldUseHumanAuthorizationMode(cmd, format, recommendAuthMode)
|
||
|
||
switch {
|
||
case strings.TrimSpace(cfg.Token) != "":
|
||
tokenData = &authpkg.TokenData{
|
||
AccessToken: cfg.Token,
|
||
ExpiresAt: time.Now().Add(config.ManualTokenExpiry),
|
||
}
|
||
if err := authpkg.SaveTokenData(configDir, tokenData); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to persist auth token: %v", err))
|
||
}
|
||
case cfg.Device:
|
||
loginCtx, cancel := context.WithTimeout(cmd.Context(), config.DeviceFlowTimeout)
|
||
defer cancel()
|
||
|
||
provider := authpkg.NewDeviceFlowProvider(configDir, nil)
|
||
provider.Output = cmd.ErrOrStderr()
|
||
provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
|
||
tokenData, err = provider.Login(loginCtx)
|
||
if err != nil {
|
||
return apperrors.NewAuth(fmt.Sprintf("device authorization failed: %v", err))
|
||
}
|
||
default:
|
||
loginCtx, cancel := context.WithTimeout(cmd.Context(), config.OAuthFlowTimeout)
|
||
defer cancel()
|
||
|
||
provider := authpkg.NewOAuthProvider(configDir, nil)
|
||
provider.Output = cmd.ErrOrStderr()
|
||
provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
|
||
configureOAuthProviderCompatibility(provider, configDir)
|
||
tokenData, err = provider.Login(loginCtx, cfg.Force)
|
||
if err != nil {
|
||
return apperrors.NewAuth(fmt.Sprintf("dingtalk login failed: %v", err))
|
||
}
|
||
}
|
||
|
||
ResetRuntimeTokenCache()
|
||
clearCompatCache()
|
||
|
||
w := cmd.OutOrStdout()
|
||
runPostLoginAuthorization := func() error {
|
||
if !recommendAuthMode {
|
||
return nil
|
||
}
|
||
recommendScopeMode := pat.LoginRecommendScopeRecommended
|
||
var initialPlan *pat.LoginRecommendPlan
|
||
if postLoginTUIMode {
|
||
var planErr error
|
||
initialPlan, planErr = pat.PlanLoginRecommendAuthorization(cmd.Context(), patCaller)
|
||
if planErr != nil {
|
||
return planErr
|
||
}
|
||
if authLoginRecommendPlanSkipsInteractiveAuthorization(initialPlan) {
|
||
fmt.Fprintln(cmd.ErrOrStderr(), "推荐权限已全部授权或没有可授权项")
|
||
return nil
|
||
}
|
||
var err error
|
||
recommendScopeMode, err = loginRecommendScopeModeSelector()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
}
|
||
opts := pat.LoginRecommendOptions{Confirmed: cfg.Yes, ScopeMode: recommendScopeMode, InitialPlan: initialPlan}
|
||
if postLoginTUIMode {
|
||
opts.ProductSelector = func(products []pat.LoginRecommendProduct) ([]string, error) {
|
||
return loginRecommendProductSelector(products)
|
||
}
|
||
}
|
||
retryFormat := format
|
||
if humanAuthMode {
|
||
retryFormat = "table"
|
||
}
|
||
run := func(ctx context.Context) error {
|
||
return pat.RunLoginRecommendAuthorizationWithOptions(ctx, patCaller, cmd.ErrOrStderr(), opts)
|
||
}
|
||
err := run(cmd.Context())
|
||
if patErr := apperrors.AsPatAuthCheckError(err); patErr != nil {
|
||
return runDirectPATAuthCheckWaitOnly(
|
||
cmd.Context(),
|
||
&GlobalFlags{Format: retryFormat},
|
||
patErr,
|
||
cmd.ErrOrStderr(),
|
||
)
|
||
}
|
||
return err
|
||
}
|
||
|
||
// Check if JSON output is requested
|
||
if strings.EqualFold(strings.TrimSpace(format), "json") && !humanAuthMode {
|
||
if err := runPostLoginAuthorization(); err != nil {
|
||
return err
|
||
}
|
||
return writeAuthLoginJSON(w, tokenData, cfg.Force)
|
||
}
|
||
|
||
// Default table output
|
||
if err := runPostLoginAuthorization(); err != nil {
|
||
return err
|
||
}
|
||
fmt.Fprintln(w)
|
||
if !cfg.Device && tokenData != nil && tokenData.IsAccessTokenValid() && !cfg.Force {
|
||
fmt.Fprintln(w, authLoginStatusLine("Token 有效，无需重新登录"))
|
||
} else {
|
||
fmt.Fprintln(w, authLoginStatusLine("登录成功！"))
|
||
}
|
||
if tokenData != nil {
|
||
if tokenData.CorpName != "" {
|
||
fmt.Fprintln(w, authLoginInfoLine("企业", tokenData.CorpName))
|
||
}
|
||
if tokenData.CorpID != "" {
|
||
fmt.Fprintln(w, authLoginInfoLine("企业 ID", tokenData.CorpID))
|
||
}
|
||
if tokenData.UserName != "" {
|
||
fmt.Fprintln(w, authLoginInfoLine("用户", tokenData.UserName))
|
||
}
|
||
if expiry := authLoginDisplayExpiry(tokenData); expiry != "" {
|
||
fmt.Fprintln(w, authLoginInfoLine("有效期", expiry))
|
||
}
|
||
}
|
||
fmt.Fprintln(w, authLoginMutedStyle().Render("Token 将自动刷新，无需重复登录"))
|
||
return nil
|
||
},
|
||
}
|
||
cmd.Flags().String("token", "", "Access token")
|
||
cmd.Flags().Bool("device", false, "Use device authorization flow")
|
||
cmd.Flags().Bool("force", false, "Force interactive login (ignore cached token)")
|
||
cmd.Flags().Bool("recommend", false, "登录成功后无交互批量授权服务端推荐权限")
|
||
// Hidden compatibility flags
|
||
cmd.Flags().String("redirect-url", "", "Loopback redirect URL")
|
||
cmd.Flags().String("scopes", "", "Space-separated DingTalk OAuth scopes")
|
||
cmd.Flags().String("authorize-url", "", "Override DingTalk authorization URL")
|
||
cmd.Flags().String("token-url", "", "Override DingTalk token exchange URL")
|
||
cmd.Flags().String("refresh-url", "", "Override DingTalk refresh token URL")
|
||
cmd.Flags().Int("login-timeout", 0, "Login timeout seconds")
|
||
cmd.Flags().Bool("no-browser", false, "Suppress browser launch")
|
||
_ = cmd.Flags().MarkHidden("redirect-url")
|
||
_ = cmd.Flags().MarkHidden("scopes")
|
||
_ = cmd.Flags().MarkHidden("authorize-url")
|
||
_ = cmd.Flags().MarkHidden("token-url")
|
||
_ = cmd.Flags().MarkHidden("refresh-url")
|
||
_ = cmd.Flags().MarkHidden("login-timeout")
|
||
return cmd
|
||
}
|
||
|
||
var (
|
||
authLoginGuideActionSelector = selectAuthLoginGuideAction
|
||
authLoginGuideActionApplier = applyAuthLoginGuideAction
|
||
loginRecommendScopeModeSelector = selectLoginRecommendScopeMode
|
||
loginRecommendProductSelector = selectLoginRecommendProducts
|
||
authLoginInteractiveTerminal = isInteractiveTerminal
|
||
)
|
||
|
||
func selectAuthLoginGuideAction() (authLoginGuideAction, error) {
|
||
choice := authLoginGuideDirectCLI
|
||
form := huh.NewForm(
|
||
huh.NewGroup(
|
||
huh.NewSelect[authLoginGuideAction]().
|
||
Title("选择操作").
|
||
Options(
|
||
huh.NewOption("直接使用CLI", authLoginGuideDirectCLI),
|
||
huh.NewOption("一键配置智能体应用", authLoginGuideConfigureAgentApp),
|
||
huh.NewOption("手动输入应用凭证", authLoginGuideManualCredentials),
|
||
).
|
||
Value(&choice),
|
||
),
|
||
).WithTheme(authLoginHuhTheme())
|
||
if err := form.Run(); err != nil {
|
||
return "", fmt.Errorf("使用引导选择中止: %w", err)
|
||
}
|
||
return choice, nil
|
||
}
|
||
|
||
func applyAuthLoginGuideAction(cmd *cobra.Command, configDir string, action authLoginGuideAction) error {
|
||
switch action {
|
||
case authLoginGuideDirectCLI:
|
||
return nil
|
||
case authLoginGuideConfigureAgentApp:
|
||
fmt.Fprintln(cmd.ErrOrStderr(), "一键配置智能体应用暂未开放，已继续使用 CLI 登录")
|
||
return nil
|
||
case authLoginGuideManualCredentials:
|
||
clientID, clientSecret, err := promptAuthLoginManualCredentials()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
authpkg.SetClientID(clientID)
|
||
authpkg.SetClientSecret(clientSecret)
|
||
if err := authpkg.SaveAppConfig(configDir, &authpkg.AppConfig{
|
||
ClientID: clientID,
|
||
ClientSecret: authpkg.PlainSecret(clientSecret),
|
||
}); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to persist app credentials: %v", err))
|
||
}
|
||
return nil
|
||
default:
|
||
return fmt.Errorf("未知操作: %s", action)
|
||
}
|
||
}
|
||
|
||
func promptAuthLoginManualCredentials() (string, string, error) {
|
||
var clientID, clientSecret string
|
||
nonEmpty := func(label string) func(string) error {
|
||
return func(value string) error {
|
||
if strings.TrimSpace(value) == "" {
|
||
return fmt.Errorf("%s 不能为空", label)
|
||
}
|
||
return nil
|
||
}
|
||
}
|
||
form := huh.NewForm(
|
||
huh.NewGroup(
|
||
huh.NewInput().
|
||
Title("输入 AppKey").
|
||
Value(&clientID).
|
||
Validate(nonEmpty("AppKey")),
|
||
huh.NewInput().
|
||
Title("输入 AppSecret").
|
||
EchoMode(huh.EchoModePassword).
|
||
Value(&clientSecret).
|
||
Validate(nonEmpty("AppSecret")),
|
||
),
|
||
).WithTheme(authLoginHuhTheme())
|
||
if err := form.Run(); err != nil {
|
||
return "", "", fmt.Errorf("应用凭证输入中止: %w", err)
|
||
}
|
||
return strings.TrimSpace(clientID), strings.TrimSpace(clientSecret), nil
|
||
}
|
||
|
||
func selectLoginRecommendScopeMode() (pat.LoginRecommendScopeMode, error) {
|
||
choice := pat.LoginRecommendScopeRecommended
|
||
form := huh.NewForm(
|
||
huh.NewGroup(
|
||
huh.NewSelect[pat.LoginRecommendScopeMode]().
|
||
Title("选择授权范围").
|
||
Description("空格选择 回车确认").
|
||
Options(
|
||
huh.NewOption("推荐授权", pat.LoginRecommendScopeRecommended),
|
||
huh.NewOption("全部授权", pat.LoginRecommendScopeAll),
|
||
).
|
||
Value(&choice),
|
||
),
|
||
).WithTheme(authLoginHuhTheme())
|
||
if err := form.Run(); err != nil {
|
||
return "", fmt.Errorf("授权范围选择中止: %w", err)
|
||
}
|
||
return choice, nil
|
||
}
|
||
|
||
func newAuthLogoutCommand() *cobra.Command {
|
||
return &cobra.Command{
|
||
Use: "logout",
|
||
Short: "清除认证信息",
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
configDir := defaultConfigDir()
|
||
revokeCtx, cancel := context.WithTimeout(cmd.Context(), 15*time.Second)
|
||
defer cancel()
|
||
_ = authpkg.RevokeTokenRemote(revokeCtx)
|
||
|
||
// Load token data to get associated clientId before deletion
|
||
var storedClientID string
|
||
if tokenData, err := authpkg.LoadTokenData(configDir); err == nil && tokenData != nil {
|
||
storedClientID = tokenData.ClientID
|
||
}
|
||
|
||
if err := authpkg.DeleteTokenData(configDir); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to clear token data: %v", err))
|
||
}
|
||
// Clean up associated client secret and app token from keychain
|
||
if storedClientID != "" {
|
||
_ = authpkg.DeleteClientSecret(storedClientID)
|
||
_ = authpkg.DeleteAppTokenData(storedClientID)
|
||
}
|
||
// Also try cleaning app token using appKey from app config
|
||
if appKey, _ := authpkg.ResolveAppCredentials(configDir); appKey != "" && appKey != storedClientID {
|
||
_ = authpkg.DeleteAppTokenData(appKey)
|
||
}
|
||
// Clean up app credentials (app.json + keychain secret)
|
||
_ = authpkg.DeleteAppConfig(configDir)
|
||
_ = os.Remove(filepath.Join(configDir, "mcp_url"))
|
||
_ = os.Remove(filepath.Join(configDir, "token"))
|
||
_ = os.Remove(filepath.Join(configDir, "token.json"))
|
||
ResetRuntimeTokenCache()
|
||
clearCompatCache()
|
||
w := cmd.OutOrStdout()
|
||
fmt.Fprintln(w, "[OK] 已清除所有认证信息")
|
||
if !edition.Get().IsEmbedded {
|
||
fmt.Fprintln(w, "请运行 dws auth login --recommend 重新登录")
|
||
}
|
||
return nil
|
||
},
|
||
}
|
||
}
|
||
|
||
func newAuthStatusCommand() *cobra.Command {
|
||
return &cobra.Command{
|
||
Use: "status",
|
||
Short: "查看认证状态",
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
configDir := defaultConfigDir()
|
||
|
||
authenticated := false
|
||
refreshed := false
|
||
var tokenData *authpkg.TokenData
|
||
provider := authpkg.NewOAuthProvider(configDir, nil)
|
||
configureOAuthProviderCompatibility(provider, configDir)
|
||
if data, err := provider.Status(); err == nil {
|
||
tokenData = data
|
||
if !data.IsAccessTokenValid() && data.IsRefreshTokenValid() {
|
||
refreshCtx, cancel := context.WithTimeout(cmd.Context(), 15*time.Second)
|
||
_, refreshErr := provider.GetAccessToken(refreshCtx)
|
||
cancel()
|
||
if refreshErr == nil {
|
||
if updatedData, statusErr := provider.Status(); statusErr == nil {
|
||
tokenData = updatedData
|
||
refreshed = true
|
||
}
|
||
} else if edition.Get().AutoPurgeToken {
|
||
_ = authpkg.DeleteTokenData(configDir)
|
||
}
|
||
}
|
||
if authStatusAuthenticated(tokenData) {
|
||
authenticated = true
|
||
}
|
||
}
|
||
|
||
// Check if JSON output is requested
|
||
format, _ := cmd.Root().PersistentFlags().GetString("format")
|
||
if strings.EqualFold(strings.TrimSpace(format), "json") {
|
||
return writeAuthStatusJSON(cmd.OutOrStdout(), authenticated, refreshed, tokenData)
|
||
}
|
||
|
||
// Default table output
|
||
w := cmd.OutOrStdout()
|
||
if authenticated {
|
||
if refreshed {
|
||
fmt.Fprintf(w, "%-16s%s\n", "状态:", "已登录 ✅")
|
||
fmt.Fprintln(w, "Token 已自动刷新")
|
||
} else {
|
||
fmt.Fprintf(w, "%-16s%s\n", "状态:", "已登录 ✅")
|
||
}
|
||
if tokenData != nil {
|
||
if tokenData.IsRefreshTokenValid() {
|
||
fmt.Fprintf(w, "%-16s%s\n", "Refresh Token:", "有效 ✅")
|
||
} else {
|
||
fmt.Fprintf(w, "%-16s%s\n", "Refresh Token:", "缺失或已过期 ⚠️")
|
||
}
|
||
}
|
||
if updatedAt := authStatusUpdatedAt(tokenData); updatedAt != "" {
|
||
fmt.Fprintf(w, "%-16s%s\n", "有效期:", updatedAt)
|
||
}
|
||
} else {
|
||
fmt.Fprintf(w, "%-16s%s\n", "状态:", "未登录")
|
||
if !edition.Get().IsEmbedded {
|
||
fmt.Fprintln(w, "运行 dws auth login --recommend 进行登录")
|
||
}
|
||
}
|
||
return nil
|
||
},
|
||
}
|
||
}
|
||
|
||
func newAuthExportCommand() *cobra.Command {
|
||
cmd := &cobra.Command{
|
||
Use: "export",
|
||
Short: "导出可迁移认证包",
|
||
Long: `导出包含 refresh token 与解密材料的认证包，便于在另一台 Linux 沙箱中导入。
|
||
|
||
包内包含 ~/.local/share/dws-cli 加密 keychain 与 ~/.dws 必要配置，不含 token 明文。
|
||
|
||
示例:
|
||
dws auth export -o dws-auth.tar.gz
|
||
dws auth export --base64 > dws-auth.b64`,
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
output, err := cmd.Flags().GetString("output")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --output")
|
||
}
|
||
asBase64, err := cmd.Flags().GetBool("base64")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --base64")
|
||
}
|
||
output = strings.TrimSpace(output)
|
||
if !asBase64 && output == "" {
|
||
return apperrors.NewValidation("--output is required unless --base64 is used")
|
||
}
|
||
if !authpkg.PortableExportSupported() {
|
||
return apperrors.NewValidation(fmt.Sprintf(
|
||
"macOS 默认将 DEK 存在系统 Keychain，导出的包无法在其它机器解密；请设置 %s=1 后重新登录再导出",
|
||
keychain.DisableKeychainEnv,
|
||
))
|
||
}
|
||
if !authpkg.PortableAuthSourceReady() {
|
||
return apperrors.NewValidation("尚未登录，请先运行 dws auth login --recommend")
|
||
}
|
||
|
||
var bundle bytes.Buffer
|
||
if err := authpkg.ExportPortableAuthBundle(defaultConfigDir(), &bundle); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to export auth bundle: %v", err))
|
||
}
|
||
|
||
if asBase64 {
|
||
payload := []byte(base64.StdEncoding.EncodeToString(bundle.Bytes()) + "\n")
|
||
if output == "" {
|
||
_, err := cmd.OutOrStdout().Write(payload)
|
||
return err
|
||
}
|
||
if err := helpers.AtomicWrite(output, payload, config.FilePerm); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to write auth bundle: %v", err))
|
||
}
|
||
fmt.Fprintf(cmd.OutOrStdout(), "[OK] 已导出认证包: %s\n", output)
|
||
fmt.Fprintf(cmd.ErrOrStderr(), "认证包含敏感凭据，用完请删除: rm -P %s\n", output)
|
||
return nil
|
||
}
|
||
|
||
if err := helpers.AtomicWrite(output, bundle.Bytes(), config.FilePerm); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to write auth bundle: %v", err))
|
||
}
|
||
fmt.Fprintf(cmd.OutOrStdout(), "[OK] 已导出认证包: %s\n", output)
|
||
fmt.Fprintf(cmd.ErrOrStderr(), "认证包含敏感凭据，用完请删除: rm -P %s\n", output)
|
||
return nil
|
||
},
|
||
}
|
||
cmd.Flags().StringP("output", "o", "", "认证包输出路径")
|
||
cmd.Flags().Bool("base64", false, "将认证包编码为 base64，便于复制粘贴")
|
||
return cmd
|
||
}
|
||
|
||
func newAuthImportCommand() *cobra.Command {
|
||
cmd := &cobra.Command{
|
||
Use: "import",
|
||
Short: "导入可迁移认证包",
|
||
Long: `从 dws auth export 生成的 tar.gz 或 base64 文件恢复认证。
|
||
|
||
导入后请运行 dws auth status 确认 refresh token 仍有效。
|
||
|
||
示例:
|
||
dws auth import -i dws-auth.tar.gz
|
||
dws auth import -i dws-auth.b64 --base64`,
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
input, err := cmd.Flags().GetString("input")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --input")
|
||
}
|
||
input = strings.TrimSpace(input)
|
||
if input == "" {
|
||
return apperrors.NewValidation("--input is required")
|
||
}
|
||
asBase64, err := cmd.Flags().GetBool("base64")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --base64")
|
||
}
|
||
force, err := cmd.Flags().GetBool("force")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --force")
|
||
}
|
||
|
||
configDir := defaultConfigDir()
|
||
if !force && authpkg.PortableAuthTargetPopulated(configDir) {
|
||
return apperrors.NewValidation("检测到已有登录态，请使用 --force 确认覆盖")
|
||
}
|
||
|
||
payload, err := os.ReadFile(input)
|
||
if err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to read auth bundle: %v", err))
|
||
}
|
||
if asBase64 {
|
||
payload, err = base64.StdEncoding.DecodeString(strings.TrimSpace(string(payload)))
|
||
if err != nil {
|
||
return apperrors.NewValidation(fmt.Sprintf("invalid base64 auth bundle: %v", err))
|
||
}
|
||
}
|
||
report, err := authpkg.ImportPortableAuthBundle(configDir, bytes.NewReader(payload))
|
||
if err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to import auth bundle: %v", err))
|
||
}
|
||
if report.OSMismatch {
|
||
fmt.Fprintf(cmd.ErrOrStderr(), "警告: 认证包来自 %s，当前系统为 %s，请确认解密材料兼容\n", report.BundleOS, runtime.GOOS)
|
||
}
|
||
ResetRuntimeTokenCache()
|
||
clearCompatCache()
|
||
fmt.Fprintln(cmd.OutOrStdout(), "[OK] 已导入认证包")
|
||
fmt.Fprintln(cmd.OutOrStdout(), "请运行 dws auth status 验证登录状态")
|
||
return nil
|
||
},
|
||
}
|
||
cmd.Flags().StringP("input", "i", "", "认证包输入路径")
|
||
cmd.Flags().Bool("base64", false, "输入为 base64 编码的认证包")
|
||
cmd.Flags().Bool("force", false, "覆盖已有登录态")
|
||
return cmd
|
||
}
|
||
|
||
func newAuthExchangeCommand() *cobra.Command {
|
||
cmd := &cobra.Command{
|
||
Use: "exchange",
|
||
Short: "Exchange an authorization code for credentials",
|
||
Hidden: true,
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
code, err := cmd.Flags().GetString("code")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --code")
|
||
}
|
||
code = strings.TrimSpace(code)
|
||
if code == "" {
|
||
return apperrors.NewValidation("--code is required")
|
||
}
|
||
uid, err := cmd.Flags().GetString("uid")
|
||
if err != nil {
|
||
return apperrors.NewInternal("failed to read --uid")
|
||
}
|
||
|
||
configDir := defaultConfigDir()
|
||
provider := authpkg.NewOAuthProvider(configDir, nil)
|
||
configureOAuthProviderCompatibility(provider, configDir)
|
||
exchangeCtx, cancel := context.WithTimeout(cmd.Context(), time.Minute)
|
||
defer cancel()
|
||
tokenData, err := provider.ExchangeAuthCode(exchangeCtx, code, strings.TrimSpace(uid))
|
||
if err != nil {
|
||
return apperrors.NewAuth(fmt.Sprintf("failed to exchange authorization code: %v", err))
|
||
}
|
||
ResetRuntimeTokenCache()
|
||
clearCompatCache()
|
||
|
||
w := cmd.OutOrStdout()
|
||
fmt.Fprintln(w, "[OK] 授权码兑换成功！")
|
||
if strings.TrimSpace(uid) != "" {
|
||
fmt.Fprintf(w, "%-16s%s\n", "用户:", strings.TrimSpace(uid))
|
||
}
|
||
if strings.TrimSpace(tokenData.CorpID) != "" {
|
||
fmt.Fprintf(w, "%-16s%s\n", "企业 ID:", tokenData.CorpID)
|
||
}
|
||
if !tokenData.ExpiresAt.IsZero() {
|
||
fmt.Fprintf(w, "%-16s%s\n", "有效期:", authLoginFormatExpiry(tokenData.ExpiresAt))
|
||
}
|
||
return nil
|
||
},
|
||
}
|
||
cmd.Flags().String("code", "", "Authorization code")
|
||
cmd.Flags().String("uid", "", "Optional user identifier for compatibility")
|
||
cmd.Flags().String("client-id", "", "Compatibility flag")
|
||
cmd.Flags().String("authorize-url", "", "Compatibility flag")
|
||
cmd.Flags().String("token-url", "", "Compatibility flag")
|
||
cmd.Flags().String("refresh-url", "", "Compatibility flag")
|
||
cmd.Flags().String("redirect-url", "", "Compatibility flag")
|
||
cmd.Flags().String("scopes", "", "Compatibility flag")
|
||
return cmd
|
||
}
|
||
|
||
func newAuthResetCommand() *cobra.Command {
|
||
return &cobra.Command{
|
||
Use: "reset",
|
||
Short: "重置认证信息（清除本地 Token，触发重新授权）",
|
||
DisableAutoGenTag: true,
|
||
RunE: func(cmd *cobra.Command, args []string) error {
|
||
configDir := defaultConfigDir()
|
||
if err := authpkg.DeleteTokenData(configDir); err != nil {
|
||
return apperrors.NewInternal(fmt.Sprintf("failed to reset token data: %v", err))
|
||
}
|
||
_ = os.Remove(filepath.Join(configDir, "mcp_url"))
|
||
_ = os.Remove(filepath.Join(configDir, "token"))
|
||
ResetRuntimeTokenCache()
|
||
clearCompatCache()
|
||
w := cmd.OutOrStdout()
|
||
fmt.Fprintln(w, "[OK] 认证信息已重置")
|
||
if !edition.Get().IsEmbedded {
|
||
fmt.Fprintln(w, "请运行 dws auth login --recommend 重新登录")
|
||
}
|
||
return nil
|
||
},
|
||
}
|
||
}
|
||
|
||
func timeOrEmpty(t time.Time) string {
|
||
if t.IsZero() {
|
||
return ""
|
||
}
|
||
return t.UTC().Format(time.RFC3339)
|
||
}
|
||
|
||
func authLoginFormatExpiry(t time.Time) string {
|
||
remaining := time.Until(t)
|
||
if remaining <= 0 {
|
||
return "已过期"
|
||
}
|
||
if remaining > 24*time.Hour {
|
||
return fmt.Sprintf("%.0f 天后", remaining.Hours()/24)
|
||
}
|
||
return fmt.Sprintf("%.0f 小时后", remaining.Hours())
|
||
}
|
||
|
||
// authLoginDisplayExpiry 返回用于显示的有效期（优先显示 refresh token 有效期）
|
||
func authLoginDisplayExpiry(data *authpkg.TokenData) string {
|
||
if data == nil {
|
||
return ""
|
||
}
|
||
// 优先使用 refresh token 有效期（更长，对用户更有意义）
|
||
if data.IsRefreshTokenValid() {
|
||
return authLoginFormatExpiry(data.RefreshExpAt)
|
||
}
|
||
// 回退到 access token 有效期
|
||
if !data.ExpiresAt.IsZero() {
|
||
return authLoginFormatExpiry(data.ExpiresAt)
|
||
}
|
||
return ""
|
||
}
|
||
|
||
func selectLoginRecommendProducts(products []pat.LoginRecommendProduct) ([]string, error) {
|
||
if len(products) == 0 {
|
||
return nil, nil
|
||
}
|
||
selected := make([]string, 0, len(products))
|
||
options := make([]huh.Option[string], 0, len(products))
|
||
for _, product := range products {
|
||
code := strings.TrimSpace(product.ProductCode)
|
||
if code == "" {
|
||
continue
|
||
}
|
||
selected = append(selected, code)
|
||
options = append(options, huh.NewOption(loginRecommendProductLabel(product), code).Selected(true))
|
||
}
|
||
if len(options) == 0 {
|
||
return nil, nil
|
||
}
|
||
height := len(options)
|
||
if height > 15 {
|
||
height = 15
|
||
}
|
||
form := huh.NewForm(
|
||
huh.NewGroup(
|
||
huh.NewMultiSelect[string]().
|
||
Title("选择要授权的业务域").
|
||
Description("空格选择 回车确认").
|
||
Options(options...).
|
||
Height(height).
|
||
Value(&selected).
|
||
Validate(func(values []string) error {
|
||
if len(values) == 0 {
|
||
return fmt.Errorf("至少选择一个授权业务域")
|
||
}
|
||
return nil
|
||
}),
|
||
),
|
||
).WithTheme(authLoginHuhTheme())
|
||
if err := form.Run(); err != nil {
|
||
return nil, fmt.Errorf("授权业务域选择中止: %w", err)
|
||
}
|
||
return selected, nil
|
||
}
|
||
|
||
func authLoginHuhTheme() *huh.Theme {
|
||
t := huh.ThemeBase()
|
||
|
||
t.Form.Base = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
t.FieldSeparator = lipgloss.NewStyle().SetString("\n")
|
||
|
||
t.Focused.Base = t.Focused.Base.BorderForeground(authLoginBrandBlue)
|
||
t.Focused.Card = t.Focused.Base
|
||
t.Focused.Title = lipgloss.NewStyle().Foreground(authLoginBrandBlue).Bold(true)
|
||
t.Focused.NoteTitle = t.Focused.Title.MarginBottom(1)
|
||
t.Focused.Description = authLoginMutedStyle()
|
||
t.Focused.ErrorIndicator = lipgloss.NewStyle().SetString(" *").Foreground(authLoginDanger)
|
||
t.Focused.ErrorMessage = lipgloss.NewStyle().SetString(" *").Foreground(authLoginDanger)
|
||
t.Focused.SelectSelector = lipgloss.NewStyle().SetString("› ").Foreground(authLoginBrandBlue).Bold(true)
|
||
t.Focused.MultiSelectSelector = t.Focused.SelectSelector
|
||
t.Focused.Option = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
t.Focused.SelectedOption = lipgloss.NewStyle().Foreground(authLoginBrandBlue).Bold(true)
|
||
t.Focused.SelectedPrefix = lipgloss.NewStyle().SetString("● ").Foreground(authLoginBrandBlue)
|
||
t.Focused.UnselectedOption = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
t.Focused.UnselectedPrefix = lipgloss.NewStyle().SetString("○ ").Foreground(authLoginMuted)
|
||
t.Focused.NextIndicator = lipgloss.NewStyle().SetString("→").Foreground(authLoginBrandBlue)
|
||
t.Focused.PrevIndicator = lipgloss.NewStyle().SetString("←").Foreground(authLoginMuted)
|
||
t.Focused.FocusedButton = lipgloss.NewStyle().
|
||
Foreground(lipgloss.AdaptiveColor{Light: "#FFFFFF", Dark: "#0B1220"}).
|
||
Background(authLoginBrandBlue).
|
||
Padding(0, 2).
|
||
Bold(true)
|
||
t.Focused.BlurredButton = lipgloss.NewStyle().
|
||
Foreground(authLoginInk).
|
||
Background(authLoginLine).
|
||
Padding(0, 2)
|
||
t.Focused.Next = t.Focused.FocusedButton
|
||
t.Focused.TextInput.Cursor = lipgloss.NewStyle().Foreground(authLoginBrandBlue)
|
||
t.Focused.TextInput.CursorText = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
t.Focused.TextInput.Placeholder = authLoginMutedStyle()
|
||
t.Focused.TextInput.Prompt = lipgloss.NewStyle().Foreground(authLoginBrandBlue)
|
||
t.Focused.TextInput.Text = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
|
||
t.Blurred = t.Focused
|
||
t.Blurred.Base = t.Focused.Base.BorderStyle(lipgloss.HiddenBorder()).BorderForeground(authLoginLine)
|
||
t.Blurred.Card = t.Blurred.Base
|
||
t.Blurred.Title = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
t.Blurred.NoteTitle = t.Blurred.Title.MarginBottom(1)
|
||
t.Blurred.Description = authLoginMutedStyle()
|
||
t.Blurred.SelectSelector = lipgloss.NewStyle().SetString(" ")
|
||
t.Blurred.MultiSelectSelector = t.Blurred.SelectSelector
|
||
t.Blurred.SelectedOption = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
t.Blurred.SelectedPrefix = lipgloss.NewStyle().SetString("● ").Foreground(authLoginBrandBlue)
|
||
t.Blurred.UnselectedOption = lipgloss.NewStyle().Foreground(authLoginMuted)
|
||
t.Blurred.UnselectedPrefix = lipgloss.NewStyle().SetString("○ ").Foreground(authLoginMuted)
|
||
t.Blurred.NextIndicator = lipgloss.NewStyle()
|
||
t.Blurred.PrevIndicator = lipgloss.NewStyle()
|
||
t.Blurred.TextInput.Prompt = lipgloss.NewStyle().Foreground(authLoginMuted)
|
||
t.Blurred.TextInput.Text = lipgloss.NewStyle().Foreground(authLoginInk)
|
||
|
||
t.Group.Title = t.Focused.Title
|
||
t.Group.Description = t.Focused.Description
|
||
|
||
t.Help.ShortKey = authLoginMutedStyle()
|
||
t.Help.ShortDesc = authLoginMutedStyle()
|
||
t.Help.ShortSeparator = authLoginMutedStyle()
|
||
t.Help.FullKey = authLoginMutedStyle()
|
||
t.Help.FullDesc = authLoginMutedStyle()
|
||
t.Help.FullSeparator = authLoginMutedStyle()
|
||
t.Help.Ellipsis = authLoginMutedStyle()
|
||
|
||
return t
|
||
}
|
||
|
||
func authLoginStatusLine(message string) string {
|
||
return fmt.Sprintf("%s %s",
|
||
lipgloss.NewStyle().Foreground(authLoginBrandBlue).Bold(true).Render("[OK]"),
|
||
lipgloss.NewStyle().Foreground(authLoginInk).Bold(true).Render(message),
|
||
)
|
||
}
|
||
|
||
func authLoginInfoLine(key, value string) string {
|
||
label := authLoginMutedStyle().Width(14).Render(key + ":")
|
||
return fmt.Sprintf("%s %s", label, value)
|
||
}
|
||
|
||
func authLoginMutedStyle() lipgloss.Style {
|
||
return lipgloss.NewStyle().Foreground(authLoginMuted)
|
||
}
|
||
|
||
func authLoginShouldShowPostLoginTUI(cmd *cobra.Command, format string, recommend bool) bool {
|
||
return authLoginShouldUsePostLoginTUIModeForTerminal(cmd, format, recommend, authLoginInteractiveTerminal())
|
||
}
|
||
|
||
func authLoginShouldShowPostLoginTUIForTerminal(cmd *cobra.Command, format string, recommend bool, interactive bool) bool {
|
||
return authLoginShouldUsePostLoginTUIModeForTerminal(cmd, format, recommend, interactive)
|
||
}
|
||
|
||
func authLoginShouldUsePostLoginTUIMode(cmd *cobra.Command, format string, recommend bool) bool {
|
||
return authLoginShouldUsePostLoginTUIModeForTerminal(cmd, format, recommend, authLoginInteractiveTerminal())
|
||
}
|
||
|
||
func authLoginShouldUsePostLoginTUIModeForTerminal(cmd *cobra.Command, format string, recommend bool, interactive bool) bool {
|
||
if recommend || !interactive {
|
||
return false
|
||
}
|
||
return authLoginAllowsInteractiveDefault(cmd, format)
|
||
}
|
||
|
||
func authLoginShouldUseHumanAuthorizationMode(cmd *cobra.Command, format string, hasAuthorizationFlow bool) bool {
|
||
return authLoginShouldUseHumanAuthorizationModeForTerminal(cmd, format, hasAuthorizationFlow, authLoginInteractiveTerminal())
|
||
}
|
||
|
||
func authLoginShouldUseHumanAuthorizationModeForTerminal(cmd *cobra.Command, format string, hasAuthorizationFlow bool, interactive bool) bool {
|
||
if !hasAuthorizationFlow || !interactive {
|
||
return false
|
||
}
|
||
return authLoginAllowsInteractiveDefault(cmd, format)
|
||
}
|
||
|
||
func authLoginRecommendPlanSkipsInteractiveAuthorization(plan *pat.LoginRecommendPlan) bool {
|
||
if plan == nil {
|
||
return false
|
||
}
|
||
return plan.AllGranted || len(plan.Scopes) == 0
|
||
}
|
||
|
||
func authLoginAllowsInteractiveDefault(cmd *cobra.Command, format string) bool {
|
||
if cmd == nil || cmd.Root() == nil {
|
||
return false
|
||
}
|
||
if !strings.EqualFold(strings.TrimSpace(format), "json") {
|
||
return true
|
||
}
|
||
flags := cmd.Root().PersistentFlags()
|
||
return !flags.Changed("format")
|
||
}
|
||
|
||
func loginRecommendProductLabel(product pat.LoginRecommendProduct) string {
|
||
name := strings.TrimSpace(product.ProductName)
|
||
if name == "" || name == product.ProductCode {
|
||
name = product.ProductCode
|
||
}
|
||
summary := strings.TrimSpace(product.Summary)
|
||
if summary != "" {
|
||
summary = " - " + clipRunes(summary, 42)
|
||
}
|
||
return fmt.Sprintf("%-10s %s%s", product.ProductCode, name, summary)
|
||
}
|
||
|
||
func clipRunes(value string, limit int) string {
|
||
if limit <= 0 {
|
||
return ""
|
||
}
|
||
runes := []rune(value)
|
||
if len(runes) <= limit {
|
||
return value
|
||
}
|
||
return string(runes[:limit]) + "..."
|
||
}
|
||
|
||
func clearCompatCache() {
|
||
store := cacheStoreFromEnv()
|
||
if store != nil {
|
||
_ = os.RemoveAll(store.Root)
|
||
}
|
||
}
|
||
|
||
func resolveAuthLoginConfig(cmd *cobra.Command) (authLoginConfig, error) {
|
||
token, err := cmd.Flags().GetString("token")
|
||
if err != nil {
|
||
return authLoginConfig{}, apperrors.NewInternal("failed to read --token")
|
||
}
|
||
device, err := cmd.Flags().GetBool("device")
|
||
if err != nil {
|
||
return authLoginConfig{}, apperrors.NewInternal("failed to read --device")
|
||
}
|
||
force, err := cmd.Flags().GetBool("force")
|
||
if err != nil {
|
||
return authLoginConfig{}, apperrors.NewInternal("failed to read --force")
|
||
}
|
||
recommend, err := cmd.Flags().GetBool("recommend")
|
||
if err != nil {
|
||
return authLoginConfig{}, apperrors.NewInternal("failed to read --recommend")
|
||
}
|
||
yes := false
|
||
if cmd.Root() != nil {
|
||
yes, _ = cmd.Root().PersistentFlags().GetBool("yes")
|
||
}
|
||
return authLoginConfig{
|
||
Token: strings.TrimSpace(token),
|
||
Force: force,
|
||
Device: device,
|
||
Recommend: recommend,
|
||
Yes: yes,
|
||
}, nil
|
||
}
|
||
|
||
func authStatusAuthenticated(data *authpkg.TokenData) bool {
|
||
if data == nil {
|
||
return false
|
||
}
|
||
return data.IsAccessTokenValid() || data.IsRefreshTokenValid()
|
||
}
|
||
|
||
func authStatusUpdatedAt(data *authpkg.TokenData) string {
|
||
if data == nil {
|
||
return ""
|
||
}
|
||
if data.IsAccessTokenValid() {
|
||
return timeOrEmpty(data.ExpiresAt)
|
||
}
|
||
if data.IsRefreshTokenValid() {
|
||
return timeOrEmpty(data.RefreshExpAt)
|
||
}
|
||
return ""
|
||
}
|
||
|
||
// authStatusResponse is the JSON response for auth status command.
|
||
type authStatusResponse struct {
|
||
Success bool `json:"success"`
|
||
Authenticated bool `json:"authenticated"`
|
||
Message string `json:"message,omitempty"`
|
||
Refreshed bool `json:"refreshed,omitempty"`
|
||
TokenValid bool `json:"token_valid,omitempty"`
|
||
RefreshTokenValid bool `json:"refresh_token_valid,omitempty"`
|
||
ExpiresAt string `json:"expires_at,omitempty"`
|
||
RefreshExpiresAt string `json:"refresh_expires_at,omitempty"`
|
||
CorpID string `json:"corp_id,omitempty"`
|
||
CorpName string `json:"corp_name,omitempty"`
|
||
UserID string `json:"user_id,omitempty"`
|
||
UserName string `json:"user_name,omitempty"`
|
||
}
|
||
|
||
func writeAuthStatusJSON(w io.Writer, authenticated, refreshed bool, data *authpkg.TokenData) error {
|
||
resp := authStatusResponse{
|
||
Success: true,
|
||
Authenticated: authenticated,
|
||
}
|
||
|
||
if !authenticated {
|
||
resp.Message = "未登录"
|
||
} else if data != nil {
|
||
resp.Refreshed = refreshed
|
||
resp.TokenValid = data.IsAccessTokenValid()
|
||
resp.RefreshTokenValid = data.IsRefreshTokenValid()
|
||
if !data.ExpiresAt.IsZero() {
|
||
resp.ExpiresAt = data.ExpiresAt.Format(time.RFC3339Nano)
|
||
}
|
||
if !data.RefreshExpAt.IsZero() {
|
||
resp.RefreshExpiresAt = data.RefreshExpAt.Format(time.RFC3339Nano)
|
||
}
|
||
resp.CorpID = data.CorpID
|
||
resp.CorpName = data.CorpName
|
||
resp.UserID = data.UserID
|
||
resp.UserName = data.UserName
|
||
}
|
||
|
||
enc := json.NewEncoder(w)
|
||
enc.SetIndent("", " ")
|
||
return enc.Encode(resp)
|
||
}
|
||
|
||
// authLoginResponse is the JSON response for auth login command.
|
||
type authLoginResponse struct {
|
||
Success bool `json:"success"`
|
||
Message string `json:"message"`
|
||
TokenValid bool `json:"token_valid,omitempty"`
|
||
RefreshTokenValid bool `json:"refresh_token_valid,omitempty"`
|
||
ExpiresAt string `json:"expires_at,omitempty"`
|
||
RefreshExpiresAt string `json:"refresh_expires_at,omitempty"`
|
||
CorpID string `json:"corp_id,omitempty"`
|
||
CorpName string `json:"corp_name,omitempty"`
|
||
UserID string `json:"user_id,omitempty"`
|
||
UserName string `json:"user_name,omitempty"`
|
||
}
|
||
|
||
func writeAuthLoginJSON(w io.Writer, data *authpkg.TokenData, forced bool) error {
|
||
resp := authLoginResponse{
|
||
Success: true,
|
||
Message: "登录成功",
|
||
}
|
||
|
||
if data != nil {
|
||
if data.IsAccessTokenValid() && !forced {
|
||
resp.Message = "Token 有效，无需重新登录"
|
||
}
|
||
resp.TokenValid = data.IsAccessTokenValid()
|
||
resp.RefreshTokenValid = data.IsRefreshTokenValid()
|
||
if !data.ExpiresAt.IsZero() {
|
||
resp.ExpiresAt = data.ExpiresAt.Format(time.RFC3339Nano)
|
||
}
|
||
if !data.RefreshExpAt.IsZero() {
|
||
resp.RefreshExpiresAt = data.RefreshExpAt.Format(time.RFC3339Nano)
|
||
}
|
||
resp.CorpID = data.CorpID
|
||
resp.CorpName = data.CorpName
|
||
resp.UserID = data.UserID
|
||
resp.UserName = data.UserName
|
||
}
|
||
|
||
enc := json.NewEncoder(w)
|
||
enc.SetIndent("", " ")
|
||
return enc.Encode(resp)
|
||
}
|