ship 1.4.41：Arcrun@89b80ff90e95

2026-08-12 20:24:44 +08:00
parent f2bb71112b
commit 643f8746d5
5 changed files with 557 additions and 198 deletions
@@ -13285,7 +13285,12 @@ portalRouter.post(
      session_token: token,
      display_name: rec.values.display_name ?? "",
      role: rec.values.role ?? "user",
-      libraries: parseLibraries(rec.values.libraries)
+      libraries: parseLibraries(rec.values.libraries),
+      // session 還能活多久（秒）。**非機密**（是這台實例的 TTL 設定，不是任何人的憑據），
+      // 但呼叫端需要它才能把自己發的憑證對齊這個上限——arcrun-mcp 用它把 OAuth
+      // access_token 的 TTL 夾到 min(自己的 TTL, 這個值)：否則 MCP token 活 30 天、
+      // 底下的 portal session 7 天就死，使用者會在第 8 天遇到「連著卻查不到」的鬼打牆。
+      session_expires_in: sessionTtl(c.env)
      // 絕不回租戶字串（design §3.3：portal_user 拿到租戶字串就能繞過庫 filter 直打 /kbdb/*）
    });
  })
@@ -15363,6 +15368,151 @@ portalDataRouter.get(
    return c.json({ success: true, workflows, total: workflows.length, read_only: true });
  })
 );
+function recordLibrary(values) {
+  const lib = values?.library;
+  return typeof lib === "string" && lib.trim() ? lib.trim() : null;
+}
+function canReadRecord(rec, tenant2, libraries) {
+  if ((rec.owner_id ?? "") !== tenant2) return false;
+  const lib = recordLibrary(rec.values);
+  return lib === null || canReadLibrary(libraries, lib);
+}
+portalDataRouter.get(
+  "/portal/data/map",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const libraries = parseLibraries(auth.user.values.libraries);
+    if (libraries.length === 0) {
+      return c.json({ success: true, libraries: [], count: 0, note: "\u6B64\u5E33\u865F\u5C1A\u672A\u88AB\u6388\u6B0A\u4EFB\u4F55\u77E5\u8B58\u5EAB\uFF0C\u8ACB\u806F\u7D61\u7BA1\u7406\u54E1\u3002" });
+    }
+    const res = await kbdbFetch(c.env, `/map?owner_id=${encodeURIComponent(portalTenant(c.env))}`);
+    if (!res.ok) {
+      return new Response(res.body, { status: res.status, headers: { "Content-Type": "application/json" } });
+    }
+    const body = await res.json().catch(() => null);
+    if (!body || !Array.isArray(body.libraries)) {
+      return c.json({ error: "\u85CF\u66F8\u5730\u5716\u8B80\u53D6\u5931\u6557\uFF1AKBDB \u56DE\u61C9\u4E0D\u662F\u9810\u671F\u7684 libraries \u6E05\u55AE" }, 502);
+    }
+    const allowed = body.libraries.filter(
+      (l) => typeof l?.library === "string" && canReadLibrary(libraries, l.library)
+    );
+    return c.json({ success: true, libraries: allowed, count: allowed.length });
+  })
+);
+portalDataRouter.get(
+  "/portal/data/map/:library",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const libraries = parseLibraries(auth.user.values.libraries);
+    const library = c.req.param("library");
+    if (!canReadLibrary(libraries, library)) return notFound(c);
+    const res = await kbdbFetch(
+      c.env,
+      `/map/${encodeURIComponent(library)}?owner_id=${encodeURIComponent(portalTenant(c.env))}`
+    );
+    if (res.status === 404) return notFound(c);
+    if (!res.ok) return c.json({ error: `KBDB \u56DE\u932F\uFF08HTTP ${res.status}\uFF09` }, 502);
+    return new Response(res.body, { status: 200, headers: { "Content-Type": "application/json" } });
+  })
+);
+portalDataRouter.get(
+  "/portal/data/templates",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const res = await kbdbFetch(c.env, "/templates");
+    if (!res.ok) return c.json({ error: `KBDB \u56DE\u932F\uFF08HTTP ${res.status}\uFF09` }, 502);
+    return new Response(res.body, { status: 200, headers: { "Content-Type": "application/json" } });
+  })
+);
+portalDataRouter.post(
+  "/portal/data/templates",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const body = await c.req.json().catch(() => null);
+    if (!body || typeof body.name !== "string" || !body.name.trim() || !Array.isArray(body.slots)) {
+      return c.json({ error: "name \u8207 slots[] \u5FC5\u586B" }, 400);
+    }
+    const res = await kbdbFetch(c.env, "/templates", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        name: body.name,
+        slots: body.slots,
+        description: typeof body.description === "string" ? body.description : void 0,
+        created_by: portalTenant(c.env)
+      })
+    });
+    return new Response(res.body, { status: res.status, headers: { "Content-Type": "application/json" } });
+  })
+);
+portalDataRouter.get(
+  "/portal/data/records/by-template/:template",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const libraries = parseLibraries(auth.user.values.libraries);
+    if (libraries.length === 0) return c.json({ success: true, records: [], count: 0 });
+    const tenant2 = portalTenant(c.env);
+    const res = await kbdbFetch(
+      c.env,
+      `/records/by-template/${encodeURIComponent(c.req.param("template"))}?owner_id=${encodeURIComponent(tenant2)}`
+    );
+    if (!res.ok) return c.json({ error: `KBDB \u56DE\u932F\uFF08HTTP ${res.status}\uFF09` }, 502);
+    const body = await res.json().catch(() => null);
+    if (!body || !Array.isArray(body.records)) {
+      return c.json({ error: "record \u8B80\u53D6\u5931\u6557\uFF1AKBDB \u56DE\u61C9\u4E0D\u662F\u9810\u671F\u7684 records \u6E05\u55AE" }, 502);
+    }
+    const records = body.records.filter((r) => canReadRecord(r, tenant2, libraries));
+    return c.json({ success: true, records, count: records.length });
+  })
+);
+portalDataRouter.get(
+  "/portal/data/records/:recordId",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const libraries = parseLibraries(auth.user.values.libraries);
+    if (libraries.length === 0) return notFound(c);
+    const res = await kbdbFetch(c.env, `/records/${encodeURIComponent(c.req.param("recordId"))}`);
+    if (res.status === 404) return notFound(c);
+    if (!res.ok) return c.json({ error: `KBDB \u56DE\u932F\uFF08HTTP ${res.status}\uFF09` }, 502);
+    const body = await res.json().catch(() => null);
+    const record = body?.record;
+    if (!record) return notFound(c);
+    if (!canReadRecord(record, portalTenant(c.env), libraries)) return notFound(c);
+    return c.json({ success: true, record });
+  })
+);
+portalDataRouter.post(
+  "/portal/data/records",
+  (c) => run(c, async () => {
+    const auth = await requirePortalUser(c);
+    if (!auth.ok) return auth.res;
+    const libraries = parseLibraries(auth.user.values.libraries);
+    if (libraries.length === 0) {
+      return c.json({ error: "\u6B64\u5E33\u865F\u5C1A\u672A\u88AB\u6388\u6B0A\u4EFB\u4F55\u77E5\u8B58\u5EAB\uFF0C\u7121\u6CD5\u5BEB\u5165" }, 403);
+    }
+    const body = await c.req.json().catch(() => null);
+    if (!body || typeof body.template !== "string" || !body.template.trim() || !body.values || typeof body.values !== "object") {
+      return c.json({ error: "template \u8207 values \u5FC5\u586B" }, 400);
+    }
+    const values = body.values;
+    const targetLib = recordLibrary(values);
+    if (targetLib !== null && !canReadLibrary(libraries, targetLib)) {
+      return c.json({ error: `\u7121\u300C${targetLib}\u300D\u5EAB\u7684\u6B0A\u9650\uFF0C\u4E0D\u80FD\u5BEB\u5165\u8A72\u5EAB` }, 403);
+    }
+    const res = await kbdbFetch(c.env, "/records", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ template: body.template, values, owner_id: portalTenant(c.env) })
+    });
+    return new Response(res.body, { status: res.status, headers: { "Content-Type": "application/json" } });
+  })
+);
 portalDataRouter.get(
  "/portal/data/diagnostics",
  (c) => run(c, async () => {