管理 PAT 接入与旧版迁移

{"method":"password","scope":"access_token.generate","context":{"scopes":["profile:read"],"expires_at":1794679200},"password_encrypted":"<encrypted-password>","encryption_key_id":"<current-kid>"}

import { constants, createCipheriv, publicEncrypt, randomBytes } from 'node:crypto';

const base = 'https://api.beeaicloud.com';
const username = process.env.BB_USERNAME;
const password = process.env.BB_PASSWORD;
const expectedUserID = process.env.BB_EXPECTED_USER_ID;
if (!username || !password || !expectedUserID) throw new Error('Missing account configuration');

async function call(path, { method = 'GET', access, proof, body } = {}) {
  const response = await fetch(base + path, {
    method,
    headers: {
      ...(body ? { 'Content-Type': 'application/json' } : {}),
      ...(access ? { Authorization: `Bearer ${access}` } : {}),
      ...(proof ? { 'X-Security-Proof': proof } : {}),
    },
    ...(body ? { body: JSON.stringify(body) } : {}),
    redirect: 'error',
  });
  const result = await response.json();
  if (!response.ok || result.success !== true) {
    const code = result.code ?? result.data?.code ?? 'REQUEST_REJECTED';
    throw new Error(`${method} ${path}: HTTP ${response.status} ${code}`);
  }
  return result.data;
}

async function passwordFields() {
  const key = await call('/api/user/login/encryption-key');
  if (!key.enabled) return { password };
  const aesKey = randomBytes(32);
  const nonce = randomBytes(12);
  const cipher = createCipheriv('aes-256-gcm', aesKey, nonce);
  cipher.setAAD(Buffer.from(`password-v2:${key.kid}`));
  const ciphertext = Buffer.concat([
    cipher.update(password, 'utf8'), cipher.final(), cipher.getAuthTag(),
  ]);
  const wrappedKey = publicEncrypt({
    key: key.public_key, padding: constants.RSA_PKCS1_OAEP_PADDING,
    oaepHash: 'sha256', oaepLabel: Buffer.from('password-v2'),
  }, aesKey);
  return {
    password_encrypted: ['v2', wrappedKey.toString('base64'),
      nonce.toString('base64'), ciphertext.toString('base64')].join('.'),
    encryption_key_id: key.kid,
  };
}

const login = await call('/api/user/login', {
  method: 'POST', body: { username, ...await passwordFields() },
});
if (login.require_verification || !login.access_token) {
  throw new Error('Complete the required sign-in verification flow first');
}
const access = login.access_token;
const profile = await call('/api/user/self', { access });
if (String(profile.id) !== expectedUserID || profile.username !== username) {
  throw new Error('Account identity mismatch');
}
const catalog = await call('/api/user/access_tokens/catalog', { access });
const grantable = new Set(catalog.groups.flatMap(group => group.resources.flatMap(
  resource => resource.actions.map(action => `${resource.resource}:${action.action}`),
)));
const grant = {
  scopes: JSON.parse(process.env.BB_PAT_SCOPES ?? '["profile:read"]'),
  expires_at: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60,
};
if (!Array.isArray(grant.scopes) || grant.scopes.length === 0 ||
    grant.scopes.some(scope => !grantable.has(scope))) {
  throw new Error('Select grantable permissions from the catalog');
}
const methods = await call('/api/verify/methods?scope=access_token.generate', { access });
if (!methods.methods.some(method => method.method === 'password' && method.available)) {
  throw new Error('Use an available verification method for this account');
}
const verification = await call('/api/verify', {
  method: 'POST', access,
  body: { method: 'password', scope: 'access_token.generate',
    context: grant, ...await passwordFields() },
});
const created = await call('/api/user/access_tokens', {
  method: 'POST', access, proof: verification.proof_token,
  body: { name: 'business-integration', ...grant },
});
const pat = created.token;
// Store pat in your secret manager here. Never log it or blindly retry creation.
console.log({ id: created.item.id, expires_at: created.item.expires_at });