|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| package panel
|
|
|
| import (
|
| "bytes"
|
| "encoding/json"
|
| "fmt"
|
| "io"
|
| "log"
|
| "net/http"
|
| "os"
|
| "path/filepath"
|
| "time"
|
|
|
| "github.com/linguo2625469/workbuddy2api-panel/internal/auth"
|
| )
|
|
|
| const (
|
| upstreamBaseCN = "https://copilot.tencent.com"
|
| upstreamBaseGlobal = "https://www.workbuddy.ai"
|
| clientUA = "CLI/2.63.2 CodeBuddy/2.63.2"
|
| originRefererCN = "https://www.codebuddy.cn"
|
| originRefererGlobal = "https://www.workbuddy.ai"
|
| )
|
|
|
|
|
|
|
| func loginEndpoints(realm string) (state, token, account, origin string) {
|
| if realm == "global" {
|
| base := upstreamBaseGlobal
|
| return base + "/v2/plugin/auth/state?platform=CLI",
|
| base + "/v2/plugin/auth/token?state=",
|
| base + "/v2/plugin/login/account?state=",
|
| originRefererGlobal
|
| }
|
| base := upstreamBaseCN
|
| return base + "/v2/plugin/auth/state?platform=CLI",
|
| base + "/v2/plugin/auth/token?state=",
|
| base + "/v2/plugin/login/account?state=",
|
| originRefererCN
|
| }
|
|
|
|
|
| var loginHTTP = &http.Client{Timeout: 30 * time.Second}
|
|
|
| func commonHeaders(req *http.Request, origin string) {
|
| req.Header.Set("Content-Type", "application/json")
|
| req.Header.Set("Accept", "application/json, text/plain, */*")
|
| req.Header.Set("X-Requested-With", "XMLHttpRequest")
|
| req.Header.Set("Origin", origin)
|
| req.Header.Set("Referer", origin+"/")
|
| req.Header.Set("User-Agent", clientUA)
|
| }
|
|
|
|
|
|
|
|
|
| func validUID(uid string) bool {
|
| if uid == "" || len(uid) > 64 {
|
| return false
|
| }
|
| for _, c := range uid {
|
| switch {
|
| case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9', c == '-', c == '_':
|
| default:
|
| return false
|
| }
|
| }
|
| return true
|
| }
|
|
|
|
|
| type apiEnvelope struct {
|
| Code int `json:"code"`
|
| Msg string `json:"msg"`
|
| Data json.RawMessage `json:"data"`
|
| }
|
|
|
|
|
| func doJSON(method, fullURL, bearer string, body io.Reader, origin string) (json.RawMessage, int, error) {
|
| req, err := http.NewRequest(method, fullURL, body)
|
| if err != nil {
|
| return nil, 0, err
|
| }
|
| commonHeaders(req, origin)
|
| if bearer != "" {
|
| req.Header.Set("Authorization", "Bearer "+bearer)
|
| }
|
| resp, err := loginHTTP.Do(req)
|
| if err != nil {
|
| return nil, 0, err
|
| }
|
| defer resp.Body.Close()
|
| raw, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
| if resp.StatusCode >= 300 {
|
| return nil, resp.StatusCode, fmt.Errorf("http_error: upstream %d", resp.StatusCode)
|
| }
|
| var env apiEnvelope
|
| if err := json.Unmarshal(raw, &env); err != nil {
|
| return nil, resp.StatusCode, fmt.Errorf("parse failed: %w", err)
|
| }
|
| if env.Code != 0 {
|
| return nil, resp.StatusCode, fmt.Errorf("code=%d msg=%s", env.Code, env.Msg)
|
| }
|
| return env.Data, resp.StatusCode, nil
|
| }
|
|
|
|
|
|
|
| func (p *Panel) loginStart(w http.ResponseWriter, r *http.Request) {
|
| realm := "cn"
|
| if r.Body != nil {
|
| var reqBody struct {
|
| Realm string `json:"realm"`
|
| }
|
| if err := json.NewDecoder(io.LimitReader(r.Body, 1<<12)).Decode(&reqBody); err == nil {
|
| if reqBody.Realm == "global" {
|
| realm = "global"
|
| }
|
| }
|
| }
|
| epState, _, _, origin := loginEndpoints(realm)
|
| data, status, err := doJSON(http.MethodPost, epState, "", bytes.NewReader([]byte("{}")), origin)
|
| if err != nil {
|
| writeErr(w, http.StatusBadGateway, fmt.Sprintf("auth state (upstream %d): %v", status, err))
|
| return
|
| }
|
| var st struct {
|
| State string `json:"state"`
|
| AuthURL string `json:"authUrl"`
|
| }
|
| if err := json.Unmarshal(data, &st); err != nil || st.State == "" || st.AuthURL == "" {
|
| writeErr(w, http.StatusBadGateway, "auth state: missing state or authUrl")
|
| return
|
| }
|
| p.loginMu.Lock()
|
|
|
| for s, sess := range p.logins {
|
| if time.Since(sess.created) > loginTTL {
|
| delete(p.logins, s)
|
| }
|
| }
|
| p.logins[st.State] = loginSession{created: time.Now(), realm: realm}
|
| p.loginMu.Unlock()
|
| log.Printf("panel: 发起 OAuth 添加账号 realm=%s（state=%s...）", realm, st.State[:min(8, len(st.State))])
|
| writeJSON(w, http.StatusOK, map[string]any{"ok": true, "url": st.AuthURL, "state": st.State, "realm": realm})
|
| }
|
|
|
|
|
| func (p *Panel) loginPoll(w http.ResponseWriter, r *http.Request) {
|
| state := r.URL.Query().Get("state")
|
| if state == "" {
|
| writeErr(w, http.StatusBadRequest, "missing state")
|
| return
|
| }
|
| p.loginMu.Lock()
|
| sess, known := p.logins[state]
|
| p.loginMu.Unlock()
|
| if !known {
|
| writeErr(w, http.StatusNotFound, "unknown or expired state（请重新发起添加账号）")
|
| return
|
| }
|
| _, epToken, epAcct, origin := loginEndpoints(sess.realm)
|
|
|
|
|
| tokRaw, _, err := doJSON(http.MethodGet, epToken+state, "", nil, origin)
|
| if err != nil {
|
|
|
| writeJSON(w, http.StatusOK, map[string]any{"done": false, "message": err.Error()})
|
| return
|
| }
|
| var tok struct {
|
| AccessToken string `json:"accessToken"`
|
| RefreshToken string `json:"refreshToken"`
|
| ExpiresIn int64 `json:"expiresIn"`
|
| Domain string `json:"domain"`
|
| }
|
| if err := json.Unmarshal(tokRaw, &tok); err != nil || tok.AccessToken == "" {
|
| writeJSON(w, http.StatusOK, map[string]any{"done": false, "message": "waiting for login"})
|
| return
|
| }
|
|
|
|
|
| var acct struct {
|
| UID string `json:"uid"`
|
| EnterpriseID string `json:"enterpriseId"`
|
| Nickname string `json:"nickname"`
|
| }
|
| if acctRaw, _, err := doJSON(http.MethodGet, epAcct+state, tok.AccessToken, nil, origin); err == nil {
|
| _ = json.Unmarshal(acctRaw, &acct)
|
| }
|
| if acct.UID == "" {
|
| writeErr(w, http.StatusBadGateway, "login done but no uid（token 已发但账号信息获取失败，请重试）")
|
| return
|
| }
|
|
|
|
|
|
|
| if !validUID(acct.UID) {
|
| writeErr(w, http.StatusBadGateway, "上游返回的 uid 含非法字符，拒绝落盘（防路径穿越）")
|
| return
|
| }
|
|
|
|
|
| if err := os.MkdirAll(p.cfg.AuthDir, 0o755); err != nil {
|
| writeErr(w, http.StatusInternalServerError, "mkdir auth dir: "+err.Error())
|
| return
|
| }
|
| a := &auth.Auth{
|
| AccessToken: tok.AccessToken,
|
| RefreshToken: tok.RefreshToken,
|
| ExpiresAt: time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second).Unix(),
|
| Domain: tok.Domain,
|
| UID: acct.UID,
|
| EnterpriseID: acct.EnterpriseID,
|
| Nickname: acct.Nickname,
|
| FilePath: filepath.Join(p.cfg.AuthDir, fmt.Sprintf("workbuddy-%s.json", acct.UID)),
|
| }
|
|
|
| if sess.realm == "global" {
|
| if _, err := auth.BackfillRealmFor(a, "global"); err != nil {
|
| writeErr(w, http.StatusInternalServerError, "set realm: "+err.Error())
|
| return
|
| }
|
| } else {
|
|
|
| _, _ = a.BackfillRealm()
|
| }
|
| if err := a.SaveAtomic(); err != nil {
|
| writeErr(w, http.StatusInternalServerError, "save auth: "+err.Error())
|
| return
|
| }
|
| p.cfg.Pool.Add(a)
|
| p.cfg.Pool.Revive(acct.UID)
|
|
|
|
|
|
|
|
|
| checkinMsg := ""
|
| remain := int64(-1)
|
| total := int64(0)
|
| if sess.realm == "global" {
|
|
|
|
|
| if activated, err := p.cfg.Upstream.GlobalCompleteRegistration(a); err != nil {
|
| checkinMsg = "注册激活失败: " + err.Error()
|
| log.Printf("panel: global 注册激活 uid=%s: %v", acct.UID, err)
|
| } else if activated {
|
| log.Printf("panel: global 注册激活 uid=%s 完成", acct.UID)
|
| }
|
|
|
| if claimed, err := p.cfg.Upstream.ClaimTrial(a); err != nil {
|
| checkinMsg = joinMsg(checkinMsg, "trial 领取失败: "+err.Error())
|
| log.Printf("panel: global trial uid=%s: %v", acct.UID, err)
|
| } else if claimed {
|
| log.Printf("panel: global trial uid=%s 已领", acct.UID)
|
| }
|
| } else {
|
| if err := p.cfg.Upstream.DailyCheckin(a); err != nil {
|
| checkinMsg = err.Error()
|
| }
|
| }
|
| if rm, tt, err := p.cfg.Upstream.UserResource(a); err == nil {
|
| remain, total = rm, tt
|
| p.cfg.Pool.ReenableIfCredits(acct.UID, rm, tt)
|
| }
|
|
|
| p.loginMu.Lock()
|
| delete(p.logins, state)
|
| p.loginMu.Unlock()
|
| log.Printf("panel: 新账号已热加载 uid=%s nickname=%q realm=%s（免重启生效）", acct.UID, acct.Nickname, sess.realm)
|
| writeJSON(w, http.StatusOK, map[string]any{
|
| "done": true,
|
| "uid": acct.UID,
|
| "nickname": acct.Nickname,
|
| "realm": sess.realm,
|
| "credits": remain,
|
| "credits_total": total,
|
| "checkin_message": checkinMsg,
|
| })
|
| }
|
|
|
|
|
| func joinMsg(parts ...string) string {
|
| out := ""
|
| for _, s := range parts {
|
| if s == "" {
|
| continue
|
| }
|
| if out != "" {
|
| out += "；"
|
| }
|
| out += s
|
| }
|
| return out
|
| }
|
|
|
|
|
|
|
| func (p *Panel) loginRegions(w http.ResponseWriter, r *http.Request) {
|
|
|
| writeJSON(w, http.StatusOK, map[string]any{
|
| "ok": true,
|
| "regions": []map[string]string{
|
| {"code": "HK", "name": "Hong Kong"},
|
| {"code": "MO", "name": "Macao"},
|
| {"code": "SG", "name": "Singapore"},
|
| {"code": "TH", "name": "Thailand"},
|
| {"code": "PH", "name": "Philippines"},
|
| {"code": "MY", "name": "Malaysia"},
|
| {"code": "ID", "name": "Indonesia"},
|
| },
|
| })
|
| }
|
|
|
