whm/ai_site
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add Yuheng ticket bind, trial SMS off, shared bindings

Browse Source 
Ship ticket-exchange and bind/policy for Z13, keep trial binds SMS-free, allow shared company bindings, and align SyncPage plus sync docs.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
whm
2026-08-05 15:09:49 +08:00
parent f90245db9c
commit d195aa4804
19 changed files with 957 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

159
platform/internal/logic/applogic/bind_flow.go
View File

@@ -10,6 +10,7 @@ import (
"aijianzhan/platform/internal/authx"
"aijianzhan/platform/internal/bindcodestore"
"aijianzhan/platform/internal/dbsync"
"aijianzhan/platform/internal/smsstore"
"aijianzhan/platform/internal/userstore"
)
@@ -192,6 +193,50 @@ type PhoneLookupResp struct {
MaskedName string `json:"masked_name,omitempty"`
NeedConfirm bool `json:"need_confirm"`
Message string `json:"message,omitempty"`
// Z13c-2：试运行 RequireForBind=false 时为 false；正式开启后为 true（宇恒同号可 attested 免验）
SMSRequiredUnlessAttested bool `json:"sms_required_unless_attested"`
}
func (l *AuthLogic) bindSMSRequired() bool {
if l == nil || l.svcCtx == nil {
return false
}
if strings.EqualFold(strings.TrimSpace(l.svcCtx.Config.SMS.Provider), "off") {
return false
}
return l.svcCtx.Config.SMS.RequireForBind
}
// BindPolicy 公开策略，供宇恒决定是否弹短信 / 走凭票。
type BindPolicyResp struct {
RequireForBind bool `json:"require_for_bind"`
SMSProvider string `json:"sms_provider"`
YuhengTicketEnabled bool `json:"yuheng_ticket_enabled"`
TrialMode bool `json:"trial_mode"` // !require_for_bind
Message string `json:"message,omitempty"`
}
func (l *AuthLogic) BindPolicy() BindPolicyResp {
req := l.bindSMSRequired()
ticketOn := l.svcCtx != nil && l.svcCtx.Config.Agent.YuhengTicket.Enabled
prov := ""
if l.svcCtx != nil {
prov = strings.TrimSpace(l.svcCtx.Config.SMS.Provider)
}
msg := "试运行：绑定可不校验短信，仍须用户确认"
if req {
msg = "正式：异号须 sms_code；同号请用宇恒凭票 ticket-exchange（或 attested，若未启凭票）"
if ticketOn {
msg = "正式：异号须 sms_code；同号请用 POST /api/v1/auth/yuheng/ticket-exchange（已禁 attested_same_phone）"
}
}
return BindPolicyResp{
RequireForBind: req,
SMSProvider: prov,
YuhengTicketEnabled: ticketOn,
TrialMode: !req,
Message: msg,
}
}
func maskDisplayName(name string) string {
@@ -210,31 +255,41 @@ func maskDisplayName(name string) string {
}
func (l *AuthLogic) PhoneLookup(req PhoneLookupReq) (*PhoneLookupResp, error) {
smsReq := l.bindSMSRequired()
if l.svcCtx.Users == nil {
return nil, fmt.Errorf("user store unavailable")
}
phone, err := userstore.NormalizePhone(req.Phone)
if err != nil {
return &PhoneLookupResp{Exists: false, Message: "手机号格式不正确"}, nil
return &PhoneLookupResp{Exists: false, Message: "手机号格式不正确", SMSRequiredUnlessAttested: smsReq}, nil
}
u, err := l.svcCtx.Users.GetByPhone(l.ctx, phone)
if err != nil || u == nil {
return &PhoneLookupResp{Exists: false, NeedConfirm: false, Message: "无此成员；请使用绑定码或联系管理员"}, nil
return &PhoneLookupResp{Exists: false, NeedConfirm: false, Message: "无此成员；请使用绑定码或联系管理员", SMSRequiredUnlessAttested: smsReq}, nil
}
if u.TenantID <= 0 {
return &PhoneLookupResp{Exists: true, NeedConfirm: false, Message: "该手机号账号尚未加入公司"}, nil
return &PhoneLookupResp{Exists: true, NeedConfirm: false, Message: "该手机号账号尚未加入公司", SMSRequiredUnlessAttested: smsReq}, nil
}
tenantName := ""
if t, err := l.svcCtx.Users.GetTenant(l.ctx, u.TenantID); err == nil && t != nil {
tenantName = t.Name
}
msg := fmt.Sprintf("已找到账号「%s」所属「%s」，是否绑定到本机？", maskDisplayName(u.DisplayName), tenantName)
if !smsReq {
msg += "（试运行：短信验证已关闭，确认即可）"
} else if l.svcCtx.Config.Agent.YuhengTicket.Enabled {
msg += "（正式：同号请用宇恒凭票 ticket-exchange；异号须 sms_code）"
} else {
msg += "（正式：宇恒同号可 attested_same_phone=true；异号须 sms_code）"
}
return &PhoneLookupResp{
Exists: true,
TenantID: u.TenantID,
TenantName: tenantName,
MaskedName: maskDisplayName(u.DisplayName),
NeedConfirm: true,
Message: fmt.Sprintf("已找到账号「%s」所属「%s」，是否绑定到本机？", maskDisplayName(u.DisplayName), tenantName),
Exists: true,
TenantID: u.TenantID,
TenantName: tenantName,
MaskedName: maskDisplayName(u.DisplayName),
NeedConfirm: true,
SMSRequiredUnlessAttested: smsReq,
Message: msg,
}, nil
}
@@ -244,6 +299,9 @@ type PhoneConfirmReq struct {
Name string `json:"name"`
Confirm bool `json:"confirm"` // 必须 true
LocalDBID string `json:"local_database_id"`
// Z13c-2：输入号=宇恒已绑手机时，宇恒置 true 可免短信；异号必须带 sms_code
AttestedSamePhone bool `json:"attested_same_phone"`
SMSCode string `json:"sms_code"`
}
type PhoneConfirmResp struct {
@@ -257,6 +315,35 @@ type PhoneConfirmResp struct {
Message string `json:"message,omitempty"`
}
func (l *AuthLogic) requirePhoneBindProof(phone string, attested bool, smsCode string) error {
// 正式模式且启用宇恒凭票：禁止明文 attested（须走 ticket-exchange）
formal := l.bindSMSRequired()
if attested && formal && l.svcCtx.Config.Agent.YuhengTicket.Enabled {
return fmt.Errorf("已启用宇恒凭票：请使用 POST /api/v1/auth/yuheng/ticket-exchange，勿再传 attested_same_phone")
}
if attested {
return nil
}
// 试运行：RequireForBind=false 或 Provider=off，跳过短信
if !formal {
return nil
}
code := strings.TrimSpace(smsCode)
if code == "" {
return fmt.Errorf("须提供 sms_code，或使用宇恒凭票 ticket-exchange（同号）")
}
if l.svcCtx.SMS == nil {
return fmt.Errorf("短信服务未启用，无法校验验证码")
}
if err := l.svcCtx.SMS.Consume(smsstore.PurposeBind, phone, code); err == nil {
return nil
}
if err := l.svcCtx.SMS.Consume(smsstore.PurposeLogin, phone, code); err == nil {
return nil
}
return fmt.Errorf("短信验证码无效或已过期")
}
func (l *AuthLogic) PhoneConfirm(req PhoneConfirmReq) (*PhoneConfirmResp, error) {
if !req.Confirm {
return nil, fmt.Errorf("须明确确认绑定（confirm=true）")
@@ -268,6 +355,9 @@ func (l *AuthLogic) PhoneConfirm(req PhoneConfirmReq) (*PhoneConfirmResp, error)
if err != nil {
return nil, fmt.Errorf("手机号格式不正确")
}
if err := l.requirePhoneBindProof(phone, req.AttestedSamePhone, req.SMSCode); err != nil {
return nil, err
}
hostKey := strings.TrimSpace(req.HostKey)
if hostKey == "" {
return nil, fmt.Errorf("host_key required")
@@ -279,58 +369,13 @@ func (l *AuthLogic) PhoneConfirm(req PhoneConfirmReq) (*PhoneConfirmResp, error)
if u.TenantID <= 0 {
return nil, fmt.Errorf("该账号尚未加入公司")
}
cfg := l.svcCtx.Config.DBSync
driver := dbsync.Driver(strings.TrimSpace(cfg.DefaultRemoteDriver))
if driver == "" {
driver = dbsync.DriverPostgres
}
ch, err := l.svcCtx.DBSync.Store().EnsureSystemDefaultChannel(dbsync.DefaultChannelOpts{
TenantID: u.TenantID,
RemoteDriver: driver,
RemoteDSN: strings.TrimSpace(cfg.DefaultRemoteDSN),
})
if err != nil {
return nil, fmt.Errorf("ensure channel: %w", err)
}
acc, err := l.svcCtx.Agents.FindByHostKey(l.ctx, hostKey)
if err != nil {
name := strings.TrimSpace(req.Name)
if name == "" {
name = "离线终端 · " + maskDisplayName(u.DisplayName)
}
created, _, _, regErr := l.svcCtx.Agents.Register(l.ctx, u.TenantID, name, hostKey)
if regErr != nil {
return nil, regErr
}
acc = created
}
online := dbsync.ResolveOnlineDBID("", ch.ID)
// 个人落点：按用户隔离 online_db_id
online = fmt.Sprintf("%s_u%d", online, u.UserID)
dbName := fmt.Sprintf("%s", strings.TrimSpace(u.DisplayName))
if dbName == "" {
dbName = fmt.Sprintf("user_%d", u.UserID)
}
updated, err := l.svcCtx.Agents.AttachSyncBind(l.ctx, acc.AgentID, u.TenantID, ch.ID, online, dbName, true)
updated, _, err := l.bindUserHostSync(u, hostKey, req.Name, req.LocalDBID, "phone-confirm")
if err != nil {
return nil, err
}
localID := strings.TrimSpace(req.LocalDBID)
if localID == "" {
localID = "host:" + hostKey
}
_, _ = l.svcCtx.DBSync.Store().EnsureBinding(dbsync.Binding{
TenantID: u.TenantID,
UserID: u.UserID,
LocalDatabaseID: localID,
OnlineDBID: online,
ChannelID: ch.ID,
DatabaseName: dbName,
DisplayName: dbName,
Note: "phone-confirm",
})
_ = l.ensureAgentSyncPerm(updated)
_ = l.writeBindAudit("phone_confirm_bind", u.TenantID, updated.AgentID, map[string]any{
"phone": phone, "user_id": u.UserID, "channel_id": ch.ID, "online_db_id": online,
"phone": phone, "user_id": u.UserID, "channel_id": updated.ChannelID, "online_db_id": updated.OnlineDBID,
})
return &PhoneConfirmResp{
OK: true,

210
platform/internal/logic/applogic/yuheng_ticket.go Normal file
View File

@@ -0,0 +1,210 @@
package applogic
import (
"fmt"
"strings"
"aijianzhan/platform/internal/agentcap"
"aijianzhan/platform/internal/agentstore"
"aijianzhan/platform/internal/authx"
"aijianzhan/platform/internal/dbsync"
"aijianzhan/platform/internal/types"
"aijianzhan/platform/internal/userstore"
"aijianzhan/platform/internal/yuhticket"
)
type YuhengTicketExchangeReq struct {
Ticket string `json:"ticket"`
HostKey string `json:"host_key"` // 须与票内一致
LocalDatabaseID string `json:"local_database_id,omitempty"`
Name string `json:"name,omitempty"`
}
type YuhengTicketExchangeResp struct {
*types.TokenResp
OK bool `json:"ok"`
ClientID string `json:"client_id,omitempty"`
ClientSecret string `json:"client_secret,omitempty"` // 仅新注册/轮换时返回一次
Message string `json:"message,omitempty"`
}
// ExchangeYuhengTicket 宇恒专属：验签凭票 → 绑定落点 → 签发智能体 JWT（免智建账号密码登录）。
func (l *AuthLogic) ExchangeYuhengTicket(req YuhengTicketExchangeReq) (*YuhengTicketExchangeResp, error) {
cfg := l.svcCtx.Config.Agent.YuhengTicket
if !cfg.Enabled {
return nil, fmt.Errorf("宇恒凭票未启用（Agent.YuhengTicket.Enabled）")
}
if strings.TrimSpace(cfg.Secret) == "" {
return nil, fmt.Errorf("宇恒凭票 Secret 未配置")
}
if l.svcCtx.Users == nil || l.svcCtx.Agents == nil || l.svcCtx.DBSync == nil {
return nil, fmt.Errorf("bind service unavailable")
}
claims, err := yuhticket.Verify(req.Ticket, yuhticket.VerifyOpts{
Secret: cfg.Secret,
Issuer: cfg.Issuer,
Audience: cfg.Audience,
})
if err != nil {
return nil, err
}
hostKey := strings.TrimSpace(req.HostKey)
if hostKey == "" {
hostKey = strings.TrimSpace(claims.HostKey)
}
if hostKey == "" || hostKey != strings.TrimSpace(claims.HostKey) {
return nil, fmt.Errorf("host_key 与凭票不一致")
}
if l.svcCtx.YuhengJTI != nil {
if err := l.svcCtx.YuhengJTI.Consume(claims.JTI, claims.Exp); err != nil {
return nil, err
}
}
phone, err := userstore.NormalizePhone(claims.Phone)
if err != nil {
return nil, fmt.Errorf("凭票手机号无效")
}
u, err := l.svcCtx.Users.GetByPhone(l.ctx, phone)
if err != nil || u == nil {
return nil, fmt.Errorf("无此成员；请先在智建绑定手机或使用绑定码")
}
if u.TenantID <= 0 {
return nil, fmt.Errorf("该账号尚未加入公司")
}
name := strings.TrimSpace(req.Name)
if name == "" {
name = strings.TrimSpace(claims.Name)
}
localID := strings.TrimSpace(req.LocalDatabaseID)
if localID == "" {
localID = strings.TrimSpace(claims.LocalDatabaseID)
}
acc, secret, err := l.bindUserHostSync(u, hostKey, name, localID, "yuheng-ticket")
if err != nil {
return nil, err
}
if err := l.ensureAgentSyncPerm(acc); err != nil {
return nil, err
}
// 重新加载 perms
acc, err = l.svcCtx.Agents.Get(l.ctx, acc.TenantID, acc.AgentID)
if err != nil {
return nil, err
}
token, exp, err := authx.IssueAgentToken(l.svcCtx.JWT, acc.TenantID, acc.AgentID, acc.Perms)
if err != nil {
return nil, err
}
_ = l.svcCtx.Agents.TouchToken(l.ctx, acc.AgentID)
capSecret := l.svcCtx.Config.Agent.CapsuleSecret
if capSecret == "" {
capSecret = l.svcCtx.JWT.AccessSecret
}
tr := &types.TokenResp{
AccessToken: token,
TokenType: "Bearer",
ExpiresAt: exp,
TenantID: acc.TenantID,
UserID: acc.AgentID,
Username: acc.ClientID,
DisplayName: acc.Name,
Role: authx.RoleAgent,
AgentKey: agentcap.PublicAgentKey(capSecret, acc.TenantID, acc.AgentID),
AgentID: acc.AgentID,
Permissions: append([]string{}, acc.Perms...),
AppSlugs: append([]string{}, acc.AppSlugs...),
}
fillAgentSyncOnToken(tr, acc)
_ = l.writeBindAudit("yuheng_ticket_exchange", acc.TenantID, acc.AgentID, map[string]any{
"phone": phone, "jti": claims.JTI, "yuheng_user_id": claims.YuhengUserID,
})
return &YuhengTicketExchangeResp{
TokenResp: tr,
OK: true,
ClientID: acc.ClientID,
ClientSecret: secret,
Message: "凭票换票成功（仅宇恒）",
}, nil
}
func (l *AuthLogic) ensureAgentSyncPerm(acc *agentstore.Account) error {
if acc == nil {
return nil
}
has := false
for _, p := range acc.Perms {
if p == authx.Perm数据同步 {
has = true
break
}
}
if has && acc.Status == agentstore.StatusActive {
return nil
}
perms := append([]string{}, acc.Perms...)
if !has {
perms = append(perms, authx.Perm数据同步)
}
st := agentstore.StatusActive
_, err := l.svcCtx.Agents.Update(l.ctx, acc.TenantID, acc.AgentID, agentstore.UpdateInput{
Status: &st,
Perms: &perms,
})
return err
}
// bindUserHostSync 将 host_key 智能体挂到用户公司默认同步落点并写 Binding。
func (l *AuthLogic) bindUserHostSync(u *userstore.User, hostKey, name, localID, note string) (*agentstore.Account, string, error) {
cfg := l.svcCtx.Config.DBSync
driver := dbsync.Driver(strings.TrimSpace(cfg.DefaultRemoteDriver))
if driver == "" {
driver = dbsync.DriverPostgres
}
ch, err := l.svcCtx.DBSync.Store().EnsureSystemDefaultChannel(dbsync.DefaultChannelOpts{
TenantID: u.TenantID,
RemoteDriver: driver,
RemoteDSN: strings.TrimSpace(cfg.DefaultRemoteDSN),
})
if err != nil {
return nil, "", fmt.Errorf("ensure channel: %w", err)
}
var secret string
acc, err := l.svcCtx.Agents.FindByHostKey(l.ctx, hostKey)
if err != nil {
if name == "" {
name = "离线终端 · " + maskDisplayName(u.DisplayName)
}
created, sec, _, regErr := l.svcCtx.Agents.Register(l.ctx, u.TenantID, name, hostKey)
if regErr != nil {
return nil, "", regErr
}
acc, secret = created, sec
} else if acc.TenantID != u.TenantID && acc.Status == agentstore.StatusPending {
// 允许 pending 迁公司；已激活异租户拒绝
} else if acc.TenantID != u.TenantID {
return nil, "", fmt.Errorf("host_key 已绑定其它公司")
}
online := fmt.Sprintf("%s_u%d", dbsync.ResolveOnlineDBID("", ch.ID), u.UserID)
dbName := strings.TrimSpace(u.DisplayName)
if dbName == "" {
dbName = fmt.Sprintf("user_%d", u.UserID)
}
updated, err := l.svcCtx.Agents.AttachSyncBind(l.ctx, acc.AgentID, u.TenantID, ch.ID, online, dbName, true)
if err != nil {
return nil, "", err
}
if localID == "" {
localID = "host:" + hostKey
}
_, _ = l.svcCtx.DBSync.Store().EnsureBinding(dbsync.Binding{
TenantID: u.TenantID,
UserID: u.UserID,
LocalDatabaseID: localID,
OnlineDBID: online,
ChannelID: ch.ID,
DatabaseName: dbName,
DisplayName: dbName,
Note: note,
})
return updated, secret, nil
}