1057 lines
36 KiB
Python
1057 lines
36 KiB
Python
# -*- coding: utf-8 -*-
|
||
"""
|
||
Account service layer — use cases invoked by CLI commands.
|
||
|
||
Each function handles:
|
||
1. Input validation
|
||
2. Logging key nodes
|
||
3. Calling the repository layer
|
||
4. Formatting JSON/stdout output
|
||
|
||
Raw secret is NEVER logged or printed in plaintext.
|
||
"""
|
||
import json
|
||
import os
|
||
import shutil
|
||
import subprocess
|
||
import sys
|
||
import tempfile
|
||
import time
|
||
import uuid
|
||
from typing import Optional
|
||
|
||
from db.accounts_repo import (
|
||
acquire_lease,
|
||
cleanup_expired_leases,
|
||
account_exists_with_login_id,
|
||
find_account_ids,
|
||
find_accounts,
|
||
find_credentials,
|
||
get_account_by_id,
|
||
get_credential_by_id,
|
||
get_platform_from_db,
|
||
insert_account,
|
||
insert_credential,
|
||
list_active_leases,
|
||
list_platforms_from_db,
|
||
platform_exists,
|
||
release_lease,
|
||
resolve_auth_strategy_for_platform,
|
||
update_account_error,
|
||
update_account_last_used,
|
||
update_account_session_status,
|
||
update_credential_last_used,
|
||
)
|
||
from db.connection import get_conn, init_db
|
||
from util.constants import SKILL_SLUG
|
||
from util.logging_config import get_skill_logger
|
||
from util.platforms import (
|
||
PLATFORMS,
|
||
_platform_list_cn_for_help,
|
||
resolve_platform_key,
|
||
seed_platforms,
|
||
)
|
||
from util.runtime_paths import (
|
||
get_default_profile_dir_for_web,
|
||
get_skill_data_dir,
|
||
_runtime_paths_debug_text,
|
||
)
|
||
from service.secret_store import (
|
||
mask_secret,
|
||
make_windows_credential_target,
|
||
read_secret,
|
||
write_secret,
|
||
)
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Internal helpers
|
||
# ---------------------------------------------------------------------------
|
||
|
||
def _map_secret_read_error(exc: BaseException) -> tuple[str, str]:
|
||
"""Map secret read/write exceptions to ERROR:* codes (no secret text in code)."""
|
||
msg = str(exc)
|
||
if "SECRET_ENV_MISSING" in msg:
|
||
return "ERROR:SECRET_ENV_MISSING", msg
|
||
if "WINDOWS_CREDENTIAL_UNAVAILABLE" in msg:
|
||
return "ERROR:WINDOWS_CREDENTIAL_UNAVAILABLE", msg
|
||
return "ERROR:SECRET_READ_FAILED", msg
|
||
|
||
|
||
def _credential_ok_line(payload: dict) -> str:
|
||
"""Single-line JSON for credential commands (machine integration)."""
|
||
return json.dumps({"success": True, **payload}, ensure_ascii=False)
|
||
|
||
|
||
def _insert_secret_holder_account(
|
||
conn,
|
||
*,
|
||
platform_key: str,
|
||
account_label: str,
|
||
environment: str,
|
||
role: str,
|
||
provider_code: str,
|
||
url: Optional[str],
|
||
now: int,
|
||
) -> int:
|
||
"""Create a minimal accounts row so credentials can join on environment/role."""
|
||
return insert_account(
|
||
conn=conn,
|
||
platform_key=platform_key,
|
||
account_label=account_label,
|
||
login_id=None,
|
||
login_id_type="api_account",
|
||
tenant_id=None,
|
||
environment=environment,
|
||
role=role,
|
||
provider_code=provider_code,
|
||
profile_dir=None,
|
||
url=url,
|
||
extra_json="{}",
|
||
now=now,
|
||
auth_strategy=resolve_auth_strategy_for_platform(conn, platform_key),
|
||
)
|
||
|
||
|
||
def _err_json(code: str, message: str) -> str:
|
||
"""Return a JSON error line."""
|
||
return json.dumps(
|
||
{"success": False, "error": {"code": code, "message": message}},
|
||
ensure_ascii=False,
|
||
)
|
||
|
||
|
||
def _ok_json(data) -> str:
|
||
"""Return a JSON success line."""
|
||
return json.dumps(
|
||
{"success": True, "data": data},
|
||
ensure_ascii=False,
|
||
)
|
||
|
||
|
||
def _say(msg: str) -> None:
|
||
"""Print to stdout."""
|
||
print(msg)
|
||
|
||
|
||
def _say_err(msg: str) -> None:
|
||
"""Print to stderr."""
|
||
print(msg, file=sys.stderr)
|
||
|
||
|
||
def _fail_human(code: str, hint_lines: list[str]) -> None:
|
||
"""Print human-readable error block."""
|
||
_say(f"ERROR:{code}")
|
||
for line in hint_lines:
|
||
_say(line)
|
||
|
||
|
||
def _remove_profile_dir(path: str) -> None:
|
||
p = (path or "").strip()
|
||
if not p or not os.path.isdir(p):
|
||
return
|
||
try:
|
||
shutil.rmtree(p)
|
||
except OSError as e:
|
||
_say_err(f"WARNING: 未能删除用户数据目录（可手工删）：{p}\n {e}")
|
||
|
||
|
||
def _resolve_or_fail(input_name: str, hint: str = "") -> Optional[str]:
|
||
"""Resolve platform key or print ERROR:INVALID_PLATFORM and return None."""
|
||
key = resolve_platform_key((input_name or "").strip())
|
||
if not key:
|
||
_say(f"ERROR:INVALID_PLATFORM 无法识别的平台「{input_name}」。")
|
||
if hint:
|
||
_say(hint)
|
||
else:
|
||
_say("支持：" + _platform_list_cn_for_help())
|
||
return None
|
||
return key
|
||
|
||
|
||
# ============================================================================
|
||
# Platform commands
|
||
# ============================================================================
|
||
|
||
def cmd_platform_list(domain: Optional[str] = None) -> None:
|
||
"""platform list [--domain logistics|llm|content]"""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=platform_list domain=%s", domain)
|
||
init_db()
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
platforms = list_platforms_from_db(conn, domain=domain)
|
||
finally:
|
||
conn.close()
|
||
_say(_ok_json({"platforms": platforms}))
|
||
|
||
|
||
def cmd_platform_get(input_key: str) -> None:
|
||
"""platform get <platform>"""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=platform_get key=%s", input_key)
|
||
key = _resolve_or_fail(input_key)
|
||
if not key:
|
||
return
|
||
init_db()
|
||
conn = get_conn()
|
||
try:
|
||
plat = get_platform_from_db(conn, key)
|
||
finally:
|
||
conn.close()
|
||
if plat:
|
||
_say(_ok_json(plat))
|
||
else:
|
||
_say(_err_json("ERROR:INVALID_PLATFORM", f"Platform '{key}' not found in DB."))
|
||
|
||
|
||
# ============================================================================
|
||
# Account add-web
|
||
# ============================================================================
|
||
|
||
def cmd_account_add_web(
|
||
platform_input: str,
|
||
login_id: Optional[str],
|
||
login_id_type: str,
|
||
label: Optional[str],
|
||
tenant_id: Optional[str],
|
||
environment: str,
|
||
role: str,
|
||
provider_code: Optional[str],
|
||
url: Optional[str],
|
||
extra_json_str: Optional[str],
|
||
profile_dir_override: Optional[str],
|
||
) -> None:
|
||
"""account add-web — create a web/RPA account record."""
|
||
log = get_skill_logger()
|
||
log.info("account_add_web_attempt platform=%s login_id_type=%s env=%s role=%s",
|
||
platform_input, login_id_type, environment, role)
|
||
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
|
||
init_db()
|
||
platform_spec = PLATFORMS.get(key, {})
|
||
now = int(time.time())
|
||
safe_label = (label or "").strip() or f"{platform_spec.get('display_name', key)} {environment} {role}"
|
||
extra = {}
|
||
if extra_json_str:
|
||
try:
|
||
extra = json.loads(extra_json_str)
|
||
except json.JSONDecodeError:
|
||
_say(_err_json("ERROR:CLI_BAD_ARGS", "extra_json 不是合法的 JSON 字符串。"))
|
||
return
|
||
|
||
# Auto-generate or use provided profile_dir
|
||
if profile_dir_override:
|
||
resolved_profile_dir = os.path.abspath(profile_dir_override)
|
||
else:
|
||
resolved_profile_dir = get_default_profile_dir_for_web(
|
||
platform_key=key,
|
||
label=safe_label,
|
||
login_id=login_id,
|
||
domain=platform_spec.get("domain", "generic"),
|
||
)
|
||
os.makedirs(resolved_profile_dir, exist_ok=True)
|
||
|
||
resolved_url = (url or "").strip() or platform_spec.get("default_url", "")
|
||
resolved_provider = provider_code or platform_spec.get("provider_code") or key
|
||
resolved_extra = json.dumps(extra, ensure_ascii=False)
|
||
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
resolved_auth = resolve_auth_strategy_for_platform(conn, key)
|
||
new_id = insert_account(
|
||
conn=conn,
|
||
platform_key=key,
|
||
account_label=safe_label,
|
||
login_id=login_id or None,
|
||
login_id_type=login_id_type,
|
||
tenant_id=tenant_id or None,
|
||
environment=environment,
|
||
role=role,
|
||
provider_code=resolved_provider,
|
||
profile_dir=resolved_profile_dir,
|
||
url=resolved_url,
|
||
extra_json=resolved_extra,
|
||
now=now,
|
||
auth_strategy=resolved_auth,
|
||
)
|
||
conn.commit()
|
||
except Exception:
|
||
conn.rollback()
|
||
log.exception("account_add_web_failure")
|
||
_say(_err_json("ERROR:DB_ERROR", "Database insert failed."))
|
||
return
|
||
finally:
|
||
conn.close()
|
||
|
||
log.info("account_add_web_success id=%s platform=%s profile_dir=%s", new_id, key, resolved_profile_dir)
|
||
_say(_ok_json({
|
||
"id": new_id,
|
||
"platform_key": key,
|
||
"account_label": safe_label,
|
||
"profile_dir": resolved_profile_dir,
|
||
"url": resolved_url,
|
||
"environment": environment,
|
||
"role": role,
|
||
"tenant_id": tenant_id or "",
|
||
"provider_code": resolved_provider,
|
||
"status": "active",
|
||
"session_status": "unknown",
|
||
}))
|
||
|
||
|
||
# ============================================================================
|
||
# Account add-secret
|
||
# ============================================================================
|
||
|
||
def cmd_account_add_secret(
|
||
platform_input: str,
|
||
credential_type: str,
|
||
label: Optional[str],
|
||
secret_storage: str,
|
||
secret_stdin: bool,
|
||
secret_ref: Optional[str],
|
||
account_id: Optional[int],
|
||
environment: Optional[str],
|
||
role: Optional[str],
|
||
extra_json_str: Optional[str],
|
||
) -> None:
|
||
"""account add-secret — create a credential record with masked secret."""
|
||
log = get_skill_logger()
|
||
log.info("account_add_secret_attempt platform=%s type=%s storage=%s",
|
||
platform_input, credential_type, secret_storage)
|
||
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
|
||
storage_n = secret_storage.strip().lower()
|
||
if storage_n not in ("none", "env", "windows_credential"):
|
||
_say(_err_json("ERROR:SECRET_STORAGE_UNSUPPORTED",
|
||
f"不支持的存储方式：{secret_storage}。支持：none / env / windows_credential"))
|
||
return
|
||
|
||
# Validate storage/type combinations
|
||
if storage_n == "none" and credential_type not in ("browser_profile", "note"):
|
||
_say(_err_json("ERROR:SECRET_STORAGE_UNSUPPORTED",
|
||
"storage=none 仅允许 credential_type=browser_profile 或 note。"))
|
||
return
|
||
if storage_n == "env" and not secret_ref:
|
||
_say(_err_json("ERROR:SECRET_REF_MISSING",
|
||
"env 存储时必须提供 --secret-ref 环境变量名。"))
|
||
return
|
||
|
||
init_db()
|
||
platform_spec = PLATFORMS.get(key, {})
|
||
now = int(time.time())
|
||
safe_label = (label or "").strip() or f"{platform_spec.get('display_name', key)} {credential_type}"
|
||
|
||
# For env storage: just use the env var name as ref, mask is optional
|
||
if storage_n == "env":
|
||
secret_ref_value = secret_ref.strip()
|
||
secret_mask_value = mask_secret(f"env:{secret_ref_value}")
|
||
extra = {}
|
||
if extra_json_str:
|
||
try:
|
||
extra = json.loads(extra_json_str)
|
||
except json.JSONDecodeError:
|
||
extra = {}
|
||
resolved_env = environment or "production"
|
||
resolved_role = role or "api"
|
||
extra["environment"] = resolved_env
|
||
extra["role"] = resolved_role
|
||
extra_json_final = json.dumps(extra, ensure_ascii=False)
|
||
|
||
resolved_url = (platform_spec.get("default_url") or "").strip() or None
|
||
resolved_provider = platform_spec.get("provider_code") or key
|
||
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
holder_id = account_id
|
||
if holder_id is None:
|
||
holder_id = _insert_secret_holder_account(
|
||
conn,
|
||
platform_key=key,
|
||
account_label=safe_label,
|
||
environment=resolved_env,
|
||
role=resolved_role,
|
||
provider_code=resolved_provider,
|
||
url=resolved_url,
|
||
now=now,
|
||
)
|
||
cred_id = insert_credential(
|
||
conn=conn,
|
||
account_id=holder_id,
|
||
platform_key=key,
|
||
credential_label=safe_label,
|
||
credential_type=credential_type,
|
||
secret_storage=storage_n,
|
||
secret_ref=secret_ref_value,
|
||
secret_mask=secret_mask_value,
|
||
expires_at=None,
|
||
extra_json=extra_json_final,
|
||
now=now,
|
||
)
|
||
conn.commit()
|
||
except Exception:
|
||
conn.rollback()
|
||
log.exception("account_add_secret_failure")
|
||
_say(_err_json("ERROR:DB_ERROR", "Database insert failed."))
|
||
return
|
||
finally:
|
||
conn.close()
|
||
|
||
log.info("account_add_secret_success id=%s platform=%s storage=env ref=%s",
|
||
cred_id, key, secret_ref_value)
|
||
_say(_ok_json({
|
||
"account_id": holder_id,
|
||
"credential_id": cred_id,
|
||
"platform_key": key,
|
||
"credential_label": safe_label,
|
||
"credential_type": credential_type,
|
||
"secret_storage": storage_n,
|
||
"secret_ref": secret_ref_value,
|
||
"secret_mask": secret_mask_value,
|
||
"warning": "env 存储方式：请确保环境变量在运行时可用。",
|
||
}))
|
||
return
|
||
|
||
# For windows_credential: read secret from stdin
|
||
if storage_n == "windows_credential":
|
||
if not secret_stdin:
|
||
_say(_err_json("ERROR:CLI_BAD_ARGS",
|
||
"windows_credential 需要 --secret-stdin 从 stdin 读取 secret。"))
|
||
return
|
||
# Read secret from stdin (one line)
|
||
secret_value = sys.stdin.readline().strip()
|
||
if not secret_value:
|
||
_say(_err_json("ERROR:CLI_BAD_ARGS", "stdin 中未读到 secret 值。"))
|
||
return
|
||
|
||
secret_mask_value = mask_secret(secret_value)
|
||
cred_label_for_target = safe_label
|
||
target = make_windows_credential_target(key, credential_type, cred_label_for_target)
|
||
|
||
# Write to Windows Credential Manager
|
||
try:
|
||
write_secret("windows_credential", target, secret_value)
|
||
except (OSError, ValueError) as e:
|
||
log.error("secret_write_failed storage=windows_credential error=%s", str(e))
|
||
_say(_err_json("ERROR:SECRET_WRITE_FAILED", f"写 Windows Credential Manager 失败：{e}"))
|
||
return
|
||
|
||
extra = {}
|
||
if extra_json_str:
|
||
try:
|
||
extra = json.loads(extra_json_str)
|
||
except json.JSONDecodeError:
|
||
extra = {}
|
||
resolved_env = environment or "production"
|
||
resolved_role = role or "api"
|
||
extra["environment"] = resolved_env
|
||
extra["role"] = resolved_role
|
||
extra_json_final = json.dumps(extra, ensure_ascii=False)
|
||
|
||
resolved_url = (platform_spec.get("default_url") or "").strip() or None
|
||
resolved_provider = platform_spec.get("provider_code") or key
|
||
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
holder_id = account_id
|
||
if holder_id is None:
|
||
holder_id = _insert_secret_holder_account(
|
||
conn,
|
||
platform_key=key,
|
||
account_label=safe_label,
|
||
environment=resolved_env,
|
||
role=resolved_role,
|
||
provider_code=resolved_provider,
|
||
url=resolved_url,
|
||
now=now,
|
||
)
|
||
cred_id = insert_credential(
|
||
conn=conn,
|
||
account_id=holder_id,
|
||
platform_key=key,
|
||
credential_label=safe_label,
|
||
credential_type=credential_type,
|
||
secret_storage=storage_n,
|
||
secret_ref=target,
|
||
secret_mask=secret_mask_value,
|
||
expires_at=None,
|
||
extra_json=extra_json_final,
|
||
now=now,
|
||
)
|
||
conn.commit()
|
||
except Exception:
|
||
conn.rollback()
|
||
log.exception("account_add_secret_failure")
|
||
_say(_err_json("ERROR:DB_ERROR", "Database insert failed."))
|
||
return
|
||
finally:
|
||
conn.close()
|
||
|
||
log.info("account_add_secret_success id=%s platform=%s storage=windows_credential",
|
||
cred_id, key)
|
||
# Clear secret value from memory
|
||
secret_value = ""
|
||
|
||
_say(_ok_json({
|
||
"account_id": holder_id,
|
||
"credential_id": cred_id,
|
||
"platform_key": key,
|
||
"credential_label": safe_label,
|
||
"credential_type": credential_type,
|
||
"secret_storage": storage_n,
|
||
"secret_ref": target,
|
||
"secret_mask": secret_mask_value,
|
||
}))
|
||
return
|
||
|
||
# storage = none (browser_profile / note)
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
cred_id = insert_credential(
|
||
conn=conn,
|
||
account_id=account_id,
|
||
platform_key=key,
|
||
credential_label=safe_label,
|
||
credential_type=credential_type,
|
||
secret_storage=storage_n,
|
||
secret_ref=None,
|
||
secret_mask="",
|
||
expires_at=None,
|
||
extra_json=extra_json_str or "{}",
|
||
now=now,
|
||
)
|
||
conn.commit()
|
||
except Exception:
|
||
conn.rollback()
|
||
log.exception("account_add_secret_failure")
|
||
_say(_err_json("ERROR:DB_ERROR", "Database insert failed."))
|
||
return
|
||
finally:
|
||
conn.close()
|
||
|
||
log.info("account_add_secret_success id=%s platform=%s storage=none", cred_id, key)
|
||
_say(_ok_json({
|
||
"account_id": account_id,
|
||
"credential_id": cred_id,
|
||
"platform_key": key,
|
||
"credential_label": safe_label,
|
||
"credential_type": credential_type,
|
||
"secret_storage": storage_n,
|
||
"secret_ref": "",
|
||
"secret_mask": "",
|
||
}))
|
||
|
||
|
||
# ============================================================================
|
||
# Account get (single)
|
||
# ============================================================================
|
||
|
||
def cmd_account_get(account_id, include_credentials: bool = False) -> None:
|
||
"""Get a single account by id. Returns JSON."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=account_get id=%r", account_id)
|
||
init_db()
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
log.warning("account_get_not_found id=%r", account_id)
|
||
_say(f"ERROR:ACCOUNT_NOT_FOUND 账号 id={account_id} 不存在。")
|
||
_say_err(_runtime_paths_debug_text())
|
||
return
|
||
if include_credentials:
|
||
creds = find_credentials(
|
||
platform_key=acc["platform_key"],
|
||
limit=20,
|
||
)
|
||
# Filter to only credentials linked to this account or any for same platform
|
||
linked_creds = [c for c in creds if c["account_id"] == acc["id"]]
|
||
if not linked_creds:
|
||
linked_creds = [c for c in creds if c["account_id"] is None]
|
||
acc["credentials"] = [
|
||
{
|
||
"id": c["id"],
|
||
"credential_label": c["credential_label"],
|
||
"credential_type": c["credential_type"],
|
||
"secret_storage": c["secret_storage"],
|
||
"secret_ref": c["secret_ref"],
|
||
"secret_mask": c["secret_mask"],
|
||
"status": c["status"],
|
||
}
|
||
for c in linked_creds
|
||
]
|
||
_say(json.dumps(acc, ensure_ascii=False))
|
||
|
||
|
||
# Legacy alias
|
||
def cmd_get(account_id) -> None:
|
||
"""Legacy: get <id> — same as account get <id>."""
|
||
cmd_account_get(account_id, include_credentials=False)
|
||
|
||
|
||
# ============================================================================
|
||
# Account list
|
||
# ============================================================================
|
||
|
||
def cmd_account_list(
|
||
platform_input: Optional[str] = None,
|
||
environment: Optional[str] = None,
|
||
tenant_id: Optional[str] = None,
|
||
role: Optional[str] = None,
|
||
limit: int = 200,
|
||
) -> None:
|
||
"""account list — output JSON array of accounts matching filters."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=account_list platform=%s env=%s tenant=%s role=%s",
|
||
platform_input, environment, tenant_id, role)
|
||
init_db()
|
||
key = None
|
||
if platform_input and platform_input not in ("all", "全部", ""):
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
|
||
accounts = find_accounts(
|
||
platform_key=key,
|
||
environment=environment,
|
||
tenant_id=tenant_id,
|
||
role=role,
|
||
limit=limit,
|
||
)
|
||
_say(json.dumps(accounts, ensure_ascii=False))
|
||
|
||
|
||
# Legacy alias
|
||
def cmd_list_json(platform_input: str, limit: int = 200) -> None:
|
||
"""Legacy: list-json <platform|all> [--limit N]"""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=list_json filter=%r limit=%s", platform_input, limit)
|
||
init_db()
|
||
raw = (platform_input or "all").strip()
|
||
if not raw or raw.lower() == "all" or raw == "全部":
|
||
key = None
|
||
else:
|
||
key = _resolve_or_fail(raw)
|
||
if not key:
|
||
return
|
||
lim = max(1, min(int(limit), 500))
|
||
accounts = find_accounts(platform_key=key, limit=lim)
|
||
_say(json.dumps(accounts, ensure_ascii=False))
|
||
|
||
|
||
# ============================================================================
|
||
# Account pick-web
|
||
# ============================================================================
|
||
|
||
def cmd_account_pick_web(
|
||
platform_input: str,
|
||
environment: Optional[str] = None,
|
||
tenant_id: Optional[str] = None,
|
||
role: Optional[str] = None,
|
||
do_lease: bool = False,
|
||
ttl_sec: int = 900,
|
||
holder: Optional[str] = None,
|
||
purpose: Optional[str] = None,
|
||
) -> None:
|
||
"""Pick a web/RPA account for use. Optionally acquire a lease."""
|
||
log = get_skill_logger()
|
||
log.info("account_pick_web_attempt platform=%s env=%s tenant=%s role=%s lease=%s",
|
||
platform_input, environment, tenant_id, role, do_lease)
|
||
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
|
||
init_db()
|
||
conn = get_conn()
|
||
try:
|
||
seed_platforms(conn)
|
||
finally:
|
||
conn.close()
|
||
|
||
candidate_ids = find_account_ids(
|
||
platform_key=key,
|
||
environment=environment,
|
||
tenant_id=tenant_id,
|
||
role=role,
|
||
)
|
||
if not candidate_ids:
|
||
_say(_err_json("ERROR:NO_ACCOUNT",
|
||
"没有符合条件的可用账号（status=active 且未被其他 lease 占用）。"))
|
||
return
|
||
|
||
picked_id = candidate_ids[0]
|
||
acc = get_account_by_id(picked_id)
|
||
if not acc:
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", "选中的账号突然不存在了。"))
|
||
return
|
||
|
||
# Update last_used_at
|
||
update_account_last_used(picked_id)
|
||
|
||
result = {
|
||
"id": acc["id"],
|
||
"platform_key": acc["platform_key"],
|
||
"account_label": acc["account_label"],
|
||
"login_id": acc["login_id"],
|
||
"profile_dir": acc["profile_dir"],
|
||
"url": acc["url"],
|
||
"tenant_id": acc["tenant_id"],
|
||
"environment": acc["environment"],
|
||
"role": acc["role"],
|
||
"provider_code": acc["provider_code"],
|
||
"session_status": acc["session_status"],
|
||
}
|
||
|
||
# Lease handling
|
||
lease_info = None
|
||
if do_lease:
|
||
lease_token = uuid.uuid4().hex[:32]
|
||
resolved_holder = holder or "unknown"
|
||
try:
|
||
lease_info = acquire_lease(
|
||
account_id=picked_id,
|
||
lease_token=lease_token,
|
||
holder=resolved_holder,
|
||
purpose=purpose,
|
||
ttl_sec=ttl_sec,
|
||
)
|
||
result["lease_token"] = lease_info["lease_token"]
|
||
result["lease_expires_at"] = lease_info["expires_at"]
|
||
except ValueError as e:
|
||
log.warning("account_pick_web_lease_conflict id=%s", picked_id)
|
||
_say(_err_json("ERROR:LEASE_CONFLICT", str(e)))
|
||
return
|
||
|
||
log.info("account_pick_web_success id=%s token_prefix=%s",
|
||
picked_id, lease_info["lease_token"][:8] if lease_info else "none")
|
||
_say(json.dumps(result, ensure_ascii=False))
|
||
|
||
|
||
# Legacy alias
|
||
def cmd_pick_web(platform_input: str) -> None:
|
||
"""Legacy: pick-web <platform> — same as account pick-web without lease."""
|
||
cmd_account_pick_web(platform_input, do_lease=False)
|
||
|
||
|
||
# ============================================================================
|
||
# Credential pick / resolve
|
||
# ============================================================================
|
||
|
||
def cmd_credential_pick(
|
||
platform_input: str,
|
||
credential_type: Optional[str] = None,
|
||
environment: Optional[str] = None,
|
||
role: Optional[str] = None,
|
||
reveal: bool = False,
|
||
) -> None:
|
||
"""Pick a credential for a platform, optionally with reveal."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=credential_pick platform=%s type=%s env=%s role=%s reveal=%s",
|
||
platform_input, credential_type, environment, role, reveal)
|
||
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
|
||
init_db()
|
||
creds = find_credentials(
|
||
platform_key=key,
|
||
credential_type=credential_type,
|
||
environment=environment,
|
||
role=role,
|
||
status="active",
|
||
limit=1,
|
||
)
|
||
if not creds:
|
||
_say(_err_json("ERROR:CREDENTIAL_NOT_FOUND",
|
||
"没有符合条件的可用凭据。"))
|
||
return
|
||
|
||
cred = creds[0]
|
||
update_credential_last_used(cred["id"])
|
||
|
||
result = {
|
||
"id": cred["id"],
|
||
"platform_key": cred["platform_key"],
|
||
"credential_label": cred["credential_label"],
|
||
"credential_type": cred["credential_type"],
|
||
"secret_storage": cred["secret_storage"],
|
||
"secret_ref": cred["secret_ref"],
|
||
"secret_mask": cred["secret_mask"],
|
||
"status": cred["status"],
|
||
}
|
||
|
||
if reveal:
|
||
try:
|
||
secret_value = read_secret(cred["secret_storage"], cred["secret_ref"])
|
||
result["secret"] = secret_value
|
||
log.info(
|
||
"credential_pick_reveal_success id=%s storage=%s",
|
||
cred["id"],
|
||
cred["secret_storage"],
|
||
)
|
||
except (ValueError, OSError) as e:
|
||
code, msg = _map_secret_read_error(e)
|
||
log.error("credential_pick_reveal_failure id=%s error=%s", cred["id"], msg)
|
||
_say(_err_json(code, msg))
|
||
return
|
||
else:
|
||
log.info("credential_pick_success id=%s (masked)", cred["id"])
|
||
|
||
_say(_credential_ok_line(result))
|
||
|
||
|
||
def cmd_credential_resolve(credential_id: int, reveal: bool = False) -> None:
|
||
"""Resolve a credential by id."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=credential_resolve id=%s reveal=%s", credential_id, reveal)
|
||
|
||
init_db()
|
||
cred = get_credential_by_id(credential_id)
|
||
if not cred:
|
||
_say(_err_json("ERROR:CREDENTIAL_NOT_FOUND", f"凭据 id={credential_id} 不存在。"))
|
||
return
|
||
if cred["status"] != "active":
|
||
_say(_err_json("ERROR:CREDENTIAL_DISABLED", f"凭据 id={credential_id} 状态为 {cred['status']}，不可用。"))
|
||
return
|
||
|
||
result = {
|
||
"id": cred["id"],
|
||
"account_id": cred["account_id"],
|
||
"platform_key": cred["platform_key"],
|
||
"credential_label": cred["credential_label"],
|
||
"credential_type": cred["credential_type"],
|
||
"secret_storage": cred["secret_storage"],
|
||
"secret_ref": cred["secret_ref"],
|
||
"secret_mask": cred["secret_mask"],
|
||
"status": cred["status"],
|
||
}
|
||
|
||
if reveal:
|
||
try:
|
||
secret_value = read_secret(cred["secret_storage"], cred["secret_ref"])
|
||
result["secret"] = secret_value
|
||
log.info("credential_resolve_reveal_success id=%s", credential_id)
|
||
except (ValueError, OSError) as e:
|
||
code, msg = _map_secret_read_error(e)
|
||
log.error("credential_resolve_reveal_failure id=%s error=%s", credential_id, msg)
|
||
_say(_err_json(code, msg))
|
||
return
|
||
else:
|
||
log.info("credential_resolve_success id=%s (masked)", credential_id)
|
||
|
||
_say(_credential_ok_line(result))
|
||
|
||
|
||
# ============================================================================
|
||
# Lease commands
|
||
# ============================================================================
|
||
|
||
def cmd_lease_release(lease_token: str) -> None:
|
||
"""lease release <token>"""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=lease_release token_prefix=%s", lease_token[:8])
|
||
ok = release_lease(lease_token)
|
||
if ok:
|
||
_say(_ok_json({"lease_token": lease_token, "status": "released"}))
|
||
else:
|
||
_say(_err_json("ERROR:LEASE_NOT_FOUND", "未找到活跃的租约，或租约已释放/过期。"))
|
||
|
||
|
||
def cmd_lease_list(active_only: bool = False) -> None:
|
||
"""lease list [--active]"""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=lease_list active_only=%s", active_only)
|
||
leases = list_active_leases()
|
||
if active_only:
|
||
# Already filtered in list_active_leases
|
||
pass
|
||
_say(_ok_json({"leases": leases}))
|
||
|
||
|
||
def cmd_lease_cleanup() -> None:
|
||
"""lease cleanup — mark expired leases as expired."""
|
||
log = get_skill_logger()
|
||
log.info("cli_start subcommand=lease_cleanup")
|
||
count = cleanup_expired_leases()
|
||
_say(_ok_json({"cleaned": count}))
|
||
|
||
|
||
# ============================================================================
|
||
# Account mark commands
|
||
# ============================================================================
|
||
|
||
def cmd_account_mark_session(account_id: int, session_status: str) -> None:
|
||
"""account mark-session <id> --session-status <status>"""
|
||
log = get_skill_logger()
|
||
log.info("account_mark_session id=%s status=%s", account_id, session_status)
|
||
valid_statuses = ("unknown", "likely_valid", "needs_login", "expired")
|
||
if session_status not in valid_statuses:
|
||
_say(_err_json("ERROR:CLI_BAD_ARGS",
|
||
f"session_status 必须为 {valid_statuses} 之一。"))
|
||
return
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", f"账号 id={account_id} 不存在。"))
|
||
return
|
||
update_account_session_status(account_id, session_status)
|
||
_say(_ok_json({"id": account_id, "session_status": session_status}))
|
||
|
||
|
||
def cmd_account_mark_error(account_id: int, error_code: str, error_message: str) -> None:
|
||
"""account mark-error <id> --code <code> --message <message>"""
|
||
log = get_skill_logger()
|
||
log.info("account_mark_error id=%s code=%s", account_id, error_code)
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", f"账号 id={account_id} 不存在。"))
|
||
return
|
||
update_account_error(account_id, error_code, error_message)
|
||
_say(_ok_json({"id": account_id, "error_code": error_code}))
|
||
|
||
|
||
def cmd_account_mark_used(account_id: int) -> None:
|
||
"""account mark-used <id>"""
|
||
log = get_skill_logger()
|
||
log.info("account_mark_used id=%s", account_id)
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
_say(_err_json("ERROR:ACCOUNT_NOT_FOUND", f"账号 id={account_id} 不存在。"))
|
||
return
|
||
update_account_last_used(account_id)
|
||
_say(_ok_json({"id": account_id, "marked": "used"}))
|
||
|
||
|
||
# ============================================================================
|
||
# Legacy delete commands (kept for compatibility)
|
||
# ============================================================================
|
||
|
||
def cmd_delete_by_id(account_id) -> None:
|
||
"""delete id <id> — legacy"""
|
||
log = get_skill_logger()
|
||
log.info("delete_by_id id=%r", account_id)
|
||
acc = get_account_by_id(account_id)
|
||
if not acc:
|
||
_say(f"ERROR:ACCOUNT_NOT_FOUND 账号 id={account_id} 不存在。")
|
||
_say_err(_runtime_paths_debug_text())
|
||
return
|
||
profile_dir = acc.get("profile_dir", "")
|
||
conn = get_conn()
|
||
try:
|
||
cur = conn.cursor()
|
||
cur.execute("DELETE FROM accounts WHERE id = ?", (int(account_id),))
|
||
# Also delete linked credentials
|
||
cur.execute("DELETE FROM credentials WHERE account_id = ?", (int(account_id),))
|
||
conn.commit()
|
||
finally:
|
||
conn.close()
|
||
_remove_profile_dir(profile_dir)
|
||
log.info("delete_by_id_done id=%s", account_id)
|
||
_say(f"✅ 已删除账号 ID {account_id}。")
|
||
|
||
|
||
def cmd_delete_by_platform(platform_input: str) -> None:
|
||
"""delete platform <platform> — legacy"""
|
||
log = get_skill_logger()
|
||
log.info("delete_by_platform platform=%r", platform_input)
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
conn = get_conn()
|
||
try:
|
||
cur = conn.cursor()
|
||
cur.execute("SELECT id, profile_dir FROM accounts WHERE platform_key = ?", (key,))
|
||
rows = cur.fetchall()
|
||
if not rows:
|
||
_say("ERROR:NO_ACCOUNTS_FOUND 该平台下没有账号记录。")
|
||
return
|
||
for rid, pdir in rows:
|
||
_remove_profile_dir(pdir)
|
||
cur.execute("DELETE FROM accounts WHERE platform_key = ?", (key,))
|
||
cur.execute(
|
||
"DELETE FROM credentials WHERE platform_key = ? AND account_id IS NOT NULL",
|
||
(key,),
|
||
)
|
||
conn.commit()
|
||
log.info("delete_by_platform_done platform=%s count=%s", key, len(rows))
|
||
_say(f"✅ 已删除 {PLATFORMS.get(key, {}).get('display_name', key)} 下共 {len(rows)} 条账号。")
|
||
finally:
|
||
conn.close()
|
||
|
||
|
||
def cmd_delete_by_platform_phone(platform_input: str, phone: str) -> None:
|
||
"""Legacy: delete by platform+phone — now uses login_id matching"""
|
||
log = get_skill_logger()
|
||
log.info("delete_by_platform_phone platform=%r", platform_input)
|
||
key = _resolve_or_fail(platform_input)
|
||
if not key:
|
||
return
|
||
phone_norm = "".join(c for c in phone if c.isdigit())
|
||
conn = get_conn()
|
||
try:
|
||
cur = conn.cursor()
|
||
cur.execute(
|
||
"SELECT id, profile_dir FROM accounts WHERE platform_key = ? AND login_id = ?",
|
||
(key, phone_norm),
|
||
)
|
||
row = cur.fetchone()
|
||
if not row:
|
||
_say("ERROR:ACCOUNT_NOT_FOUND 该平台下无此手机号。")
|
||
return
|
||
rid, pdir = row
|
||
_remove_profile_dir(pdir)
|
||
cur.execute("DELETE FROM accounts WHERE id = ?", (rid,))
|
||
cur.execute("DELETE FROM credentials WHERE account_id = ?", (rid,))
|
||
conn.commit()
|
||
log.info("delete_by_platform_phone_done id=%s", rid)
|
||
_say(f"✅ 已删除账号 ID {rid}。")
|
||
finally:
|
||
conn.close()
|
||
|
||
|
||
# ============================================================================
|
||
# Legacy list (human readable)
|
||
# ============================================================================
|
||
|
||
def cmd_list(platform="all", limit: int = 10) -> None:
|
||
"""Legacy: human-readable list output."""
|
||
log = get_skill_logger()
|
||
log.info("list filter=%r", platform)
|
||
init_db()
|
||
accounts = find_accounts(
|
||
platform_key=None if (not platform or platform in ("all", "全部")) else platform,
|
||
limit=limit,
|
||
)
|
||
if not accounts:
|
||
_say("ERROR:NO_ACCOUNTS_FOUND")
|
||
_say_err(_runtime_paths_debug_text())
|
||
return
|
||
log.info("list_ok rows=%s", len(accounts))
|
||
for i, acc in enumerate(accounts):
|
||
_say(f"id：{acc['id']}")
|
||
_say(f"label：{acc['account_label']}")
|
||
_say(f"platform：{acc['platform_key']}")
|
||
_say(f"login_id：{acc['login_id']}")
|
||
_say(f"env：{acc['environment']} role：{acc['role']}")
|
||
_say(f"status：{acc['status']} session：{acc['session_status']}")
|
||
_say(f"profile_dir：{acc['profile_dir']}")
|
||
_say(f"url：{acc['url']}")
|
||
_say(f"created_at：{acc['created_at']}")
|
||
_say(f"updated_at：{acc['updated_at']}")
|
||
if acc.get("last_error_code"):
|
||
_say(f"last_error：{acc['last_error_code']} {acc.get('last_error_message', '')}")
|
||
if i < len(accounts) - 1:
|
||
_say("_______________________________________")
|
||
_say("")
|