Feat/feishu login#30
Open
evilstar9527 wants to merge 11 commits into
Open
Conversation
官方托管 MCP 的操作身份固化在挂载 URL 的 userKey 里,所有评论都显示为同一 个人(纪世赫)。新增 tool-provider plugin 直调飞书项目 open_api: - pat.ts:plugin_token 换发与按 plugin_id 键控的进程内缓存(模式同 plugin-feishu/tat.ts);凭证 plugin_id/plugin_secret 存平台 SecretStore, 经 X-TB-Upstream-Auth 每次传入,plugin 不自持。 - meegoApi.ts:add_comment / list_comments / query_user 直调 open_api, X-PLUGIN-TOKEN + X-USER-KEY 双头;token 失效归一 MeegoAuthError 供强制 重换发重试一次。 - index.ts:操作人按 ctx.keyId 从挂载 providerConfig.userKeys 映射解析 (admin 维护,调用方不可自改、不做工具入参防冒充);未绑定一律 permission_denied,绝不回落默认身份。whoami 工具验证"评论会显示为谁"。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat(plugin-meego): 直调 Meego open_api,评论以调用方绑定身份落地
分支初始写的 DJJ account_id 是过时值;生产网关(tb-gateway)与 plugin-feishu 实际都在 Lightspeed 账户(041d4868…),plugin-meego 须同账户部署才能被网关注册/注入凭证。已按此账户部署验证通过。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
meego2 此前只有评论相关工具,查工作项还得绕回旧 mcp/meego(固定纪世赫 身份)。新增 filter_work_items 封装 open_api /work_item/filter: - user_keys 内建"该用户全角色并集"(经办人/研发/负责人),替代旧 MQL 手写三路 OR;实测查王风雷名下缺陷 22 条,与 MQL 结果完全一致。 - 探测确认 open_api 无 MQL 端点(旧 meego 的 search_by_mql 是飞书 MCP 层封装),故底层走 filter、命名 filter_work_items 避免误导。 - 查询按字段筛,与调用方身份无关;X-USER-KEY 仅用于鉴权。 - 顺带修正 add_comment 描述:实现只发纯文本,原"markdown/富文本"措辞 与实现不符,改为"纯文本"。 至此 mcp/meego2 覆盖查(需求/缺陷)+评论,具备下掉旧 mcp/meego 的条件。 测试 17→20。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Feat/meego mcp
只读排查 pod(logs/events/describe/status/list/yaml),无 shell/exec/kubectl; 授权面为 namespace-scoped Role(pods/pods/log/events 的 get/list),结构性只读。 经 @tool-bridge/sdk 反向连接挂到 device/<id>/tools/pod-diag,纯 HTTP 可调。
feat(deploy): tb-pod-diag — 集群内只读 K8s 诊断服务
新增 /login + /~feishu/callback 两条树外免认证路由:企业成员飞书 OAuth 登录后自动 rotate 签发一把 mcp/plugins/skills 可用的 SK(read+call+write, 默认 90 天),owner=user:<open_id>,准入=能走完企业飞书 OAuth(不校验邮箱)。 - feishuLogin.ts:state 封解(AES-GCM,域前缀区隔 mcp-oauth)、飞书 OAuth 三段、 rotate 签发(同 owner 旧登录 key 先删再签)、meego 绑定(可注入,best-effort)、 成功/失败回调页(SK 一次性展示,no-store + CSP) - 复用 SecretStore 的 feishu-app 凭证(app_id/app_secret),经 TB_FEISHU_LOGIN_SECRET_REF 启用 - meego 自动绑定按决策做成降级待验证:接口齐全但默认关闭(open_id 跨 app 对齐未验证) - 14 个单测覆盖 state/rotate/scope/绑定;pnpm verify 全绿
- wrangler.jsonc:account_id/KV id/R2 endpoint 从旧账户(0cb9b897,无权限) 改到线上真实值 Lightspeed(041d4868),域名 pdjjq.org → fantacy.live, 加 TB_FEISHU_LOGIN_SECRET_REF=feishu-app 启用登录。值均从线上 tb-gateway 绑定反查,复用现有 KV(a1e48dcf),不丢 SK。 - 记录实证结论:登录 open_id(ou_)与 meego out_id(on_)不同源,基于 open_id 的自动绑定不可行;meego 绑定暂由管理员手动 patch。union_id 路待验证。
- oauth 集成测试 redirect_uri 断言同步 canonicalOrigin(否则测试红) - llmdoc(deploy/current-state/project-brief/npm-publish)与 .env.example 更新域名 - .env.example 账户代号 DJJ → Lightspeed 保持准确 - archive/ 历史快照保留原样(记录当时确实用 pdjjq 部署的事实)
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.