mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-09 00:40:45 +08:00
Bundle uds-skill-auth inside the uds-auth plugin for single-package handoff.
Move the public auth helper skill under uds-auth/skills and update docs to point there instead of the repo-root skills tree. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
parent
c5c6089f89
commit
b60c626d41
8 changed files with 51 additions and 94 deletions
|
|
@ -1,60 +0,0 @@
|
|||
---
|
||||
name: uds-skill-auth
|
||||
description: UDS 技能认证公共库。其它依赖 UDS 登录的 skill 必须安装本 skill，通过其 scripts/uds_skill_auth.py 取凭证或出站调用。需现场已安装 uds-auth 插件且用户已扫码登录。
|
||||
---
|
||||
|
||||
# uds-skill-auth（认证公共 Skill）
|
||||
|
||||
本 skill **不是业务能力**，而是给其它 skill 用的公共库。
|
||||
|
||||
## 现场依赖
|
||||
|
||||
```text
|
||||
1. 安装并启用 uds-auth 插件
|
||||
2. 安装本 skill（uds-skill-auth）到 skills 目录
|
||||
3. 用户扫码登录
|
||||
4. 再安装/使用业务 skill（如通讯录、发信等）
|
||||
```
|
||||
|
||||
## 给其它 Skill 用
|
||||
|
||||
业务 skill 的 Python 脚本里，把本 skill 的 `scripts/` 加入 `sys.path` 后：
|
||||
|
||||
```python
|
||||
from uds_skill_auth import resolve, request, UdsAuthError
|
||||
|
||||
# Mode Creds：拿到 empNo + token（可写进程内 EMP_NO/AUTH_VALUE）
|
||||
creds = resolve()
|
||||
|
||||
# Mode Outbound（推荐）：Host 代贴鉴权头
|
||||
out = request("POST", "https://icenterapi.zte.com.cn/...", headers={...}, body={...})
|
||||
```
|
||||
|
||||
定位本 skill 目录的推荐写法（与业务 skill 同级安装时）：
|
||||
|
||||
```python
|
||||
from pathlib import Path
|
||||
import sys
|
||||
|
||||
def load_uds_skill_auth():
|
||||
here = Path(__file__).resolve().parent
|
||||
# .../skills/<业务skill>/scripts → .../skills/uds-skill-auth/scripts
|
||||
for skills_root in [here.parents[1], *here.parents]:
|
||||
candidate = skills_root / "uds-skill-auth" / "scripts"
|
||||
if (candidate / "uds_skill_auth.py").is_file():
|
||||
sys.path.insert(0, str(candidate))
|
||||
import uds_skill_auth
|
||||
return uds_skill_auth
|
||||
raise RuntimeError("未找到 uds-skill-auth，请先安装该 skill")
|
||||
```
|
||||
|
||||
也可设置环境变量 `UDS_AUTH_HELPERS` 指向本 skill 的 `scripts` 绝对路径。
|
||||
|
||||
## 环境变量（Agent 已注入，勿教模型打印密钥）
|
||||
|
||||
- `DSH_SESSION_ID` — 当前会话
|
||||
- `DSH_WEB_URL` — Harness Web 地址（用于拼 `/uds-auth`）
|
||||
|
||||
## 标准文档
|
||||
|
||||
完整契约见插件仓库：`uds-auth/docs/skill-auth-standard.zh.md`。
|
||||
|
|
@ -1,180 +0,0 @@
|
|||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
uds-skill-auth — Python helpers for UDS-backed skills.
|
||||
|
||||
Resolve SSO credentials via loopback Host APIs, or call intranet APIs through
|
||||
the outbound proxy.
|
||||
|
||||
Environment:
|
||||
DSH_SESSION_ID — agent session id (injected by DSH shell-env)
|
||||
DSH_WEB_URL — optional base URL of the Harness web server
|
||||
UDS_AUTH_BASE — optional override, e.g. http://127.0.0.1:PORT/uds-auth
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import ssl
|
||||
import urllib.error
|
||||
import urllib.request
|
||||
from typing import Any, Dict, Optional, Tuple
|
||||
from urllib.parse import urlparse
|
||||
|
||||
|
||||
class UdsAuthError(RuntimeError):
|
||||
def __init__(self, message: str, *, code: str = "uds_auth_error", status: int = 0):
|
||||
super().__init__(message)
|
||||
self.code = code
|
||||
self.status = status
|
||||
|
||||
|
||||
def _base_url() -> str:
|
||||
explicit = (os.environ.get("UDS_AUTH_BASE") or "").strip().rstrip("/")
|
||||
if explicit:
|
||||
return explicit
|
||||
web = (os.environ.get("DSH_WEB_URL") or "").strip().rstrip("/")
|
||||
if web:
|
||||
return web + "/uds-auth"
|
||||
return "http://127.0.0.1:8787/uds-auth"
|
||||
|
||||
|
||||
def _session_id() -> str:
|
||||
return (os.environ.get("DSH_SESSION_ID") or "").strip()
|
||||
|
||||
|
||||
def _opener_no_proxy():
|
||||
return urllib.request.build_opener(urllib.request.ProxyHandler({}))
|
||||
|
||||
|
||||
def _http_json(
|
||||
method: str,
|
||||
url: str,
|
||||
*,
|
||||
headers: Optional[Dict[str, str]] = None,
|
||||
body: Any = None,
|
||||
timeout: float = 30.0,
|
||||
) -> Tuple[int, Any, str]:
|
||||
data = None
|
||||
hdrs = dict(headers or {})
|
||||
if body is not None:
|
||||
if isinstance(body, (dict, list)):
|
||||
data = json.dumps(body, ensure_ascii=False).encode("utf-8")
|
||||
hdrs.setdefault("Content-Type", "application/json;charset=UTF-8")
|
||||
elif isinstance(body, str):
|
||||
data = body.encode("utf-8")
|
||||
elif isinstance(body, bytes):
|
||||
data = body
|
||||
else:
|
||||
data = json.dumps(body, ensure_ascii=False).encode("utf-8")
|
||||
hdrs.setdefault("Content-Type", "application/json;charset=UTF-8")
|
||||
req = urllib.request.Request(url, data=data, headers=hdrs, method=method.upper())
|
||||
ctx = ssl._create_unverified_context()
|
||||
try:
|
||||
if "127.0.0.1" in url or "localhost" in url.lower():
|
||||
opener = _opener_no_proxy()
|
||||
with opener.open(req, timeout=timeout) as resp:
|
||||
raw = resp.read().decode("utf-8", errors="replace")
|
||||
status = getattr(resp, "status", 200) or 200
|
||||
else:
|
||||
with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:
|
||||
raw = resp.read().decode("utf-8", errors="replace")
|
||||
status = getattr(resp, "status", 200) or 200
|
||||
except urllib.error.HTTPError as e:
|
||||
raw = (e.fp.read().decode("utf-8", errors="replace") if e.fp else "")
|
||||
status = e.code
|
||||
except urllib.error.URLError as e:
|
||||
raise UdsAuthError(f"无法连接 uds-auth: {e.reason}", code="uds_unreachable") from e
|
||||
|
||||
parsed: Any = None
|
||||
if raw.strip():
|
||||
try:
|
||||
parsed = json.loads(raw)
|
||||
except json.JSONDecodeError:
|
||||
parsed = None
|
||||
return status, parsed, raw
|
||||
|
||||
|
||||
def resolve(*, apply_env_aliases: bool = True) -> Dict[str, str]:
|
||||
"""
|
||||
Fetch {empNo, token} for the current DSH session from Host.
|
||||
Optionally set process-local EMP_NO / AUTH_VALUE (and coclaw_* aliases).
|
||||
"""
|
||||
sid = _session_id()
|
||||
if not sid:
|
||||
raise UdsAuthError("缺少 DSH_SESSION_ID，请在 Agent shell 中运行", code="no_session")
|
||||
|
||||
url = _base_url() + "/agent-credentials"
|
||||
status, parsed, raw = _http_json(
|
||||
"POST",
|
||||
url,
|
||||
headers={"X-DSH-Session-Id": sid, "Accept": "application/json"},
|
||||
body={"sessionId": sid},
|
||||
timeout=15.0,
|
||||
)
|
||||
if status == 401 or (isinstance(parsed, dict) and parsed.get("error") == "no_skill_credentials"):
|
||||
msg = (parsed or {}).get("message") if isinstance(parsed, dict) else None
|
||||
raise UdsAuthError(msg or "请先完成 UDS 扫码登录", code="no_credentials", status=status)
|
||||
if status != 200 or not isinstance(parsed, dict):
|
||||
raise UdsAuthError(
|
||||
f"获取凭证失败 (HTTP {status})",
|
||||
code="credentials_http",
|
||||
status=status,
|
||||
)
|
||||
emp_no = str(parsed.get("empNo") or "").strip()
|
||||
token = str(parsed.get("token") or "").strip()
|
||||
if not emp_no or not token:
|
||||
raise UdsAuthError("凭证响应不完整", code="bad_credentials")
|
||||
|
||||
if apply_env_aliases:
|
||||
os.environ["EMP_NO"] = emp_no
|
||||
os.environ["AUTH_VALUE"] = token
|
||||
os.environ["coclaw_empno"] = emp_no
|
||||
os.environ["coclaw_token"] = token
|
||||
|
||||
return {"empNo": emp_no, "token": token, "updatedAt": str(parsed.get("updatedAt") or "")}
|
||||
|
||||
|
||||
def request(
|
||||
method: str,
|
||||
url: str,
|
||||
*,
|
||||
headers: Optional[Dict[str, str]] = None,
|
||||
body: Any = None,
|
||||
timeout: float = 30.0,
|
||||
) -> Dict[str, Any]:
|
||||
"""
|
||||
Call an intranet URL via Host outbound proxy (injects X-Emp-No / X-Auth-Value).
|
||||
Returns {statusCode, headers, body, json}.
|
||||
"""
|
||||
sid = _session_id()
|
||||
if not sid:
|
||||
raise UdsAuthError("缺少 DSH_SESSION_ID，请在 Agent shell 中运行", code="no_session")
|
||||
|
||||
host = urlparse(url).hostname or ""
|
||||
payload = {
|
||||
"sessionId": sid,
|
||||
"method": method.upper(),
|
||||
"url": url,
|
||||
"headers": headers or {},
|
||||
"body": body,
|
||||
"timeoutMs": int(timeout * 1000),
|
||||
}
|
||||
status, parsed, raw = _http_json(
|
||||
"POST",
|
||||
_base_url() + "/outbound",
|
||||
headers={"X-DSH-Session-Id": sid, "Accept": "application/json"},
|
||||
body=payload,
|
||||
timeout=timeout + 5.0,
|
||||
)
|
||||
if status == 401 or (isinstance(parsed, dict) and parsed.get("error") == "no_skill_credentials"):
|
||||
msg = (parsed or {}).get("message") if isinstance(parsed, dict) else None
|
||||
raise UdsAuthError(msg or "请先完成 UDS 扫码登录", code="no_credentials", status=status)
|
||||
if status == 403 and isinstance(parsed, dict) and parsed.get("error") == "host_not_allowed":
|
||||
raise UdsAuthError(f"主机不在 outbound 白名单: {host}", code="host_not_allowed", status=403)
|
||||
if not isinstance(parsed, dict) or "statusCode" not in parsed:
|
||||
raise UdsAuthError(
|
||||
f"outbound 失败 (HTTP {status}): {raw[:200]}",
|
||||
code="outbound_http",
|
||||
status=status,
|
||||
)
|
||||
return parsed
|
||||
Loading…
Add table
Add a link
Reference in a new issue