feat(auth): 添加 M0A.5a 正式认证基础（重提 #83）#2
Closed
wangjk9527 wants to merge 2 commits into
Closed
Conversation
wangjk9527
force-pushed
the
cursor/native-one-click-deployment-v2-f252
branch
from
July 26, 2026 07:16
7e2da5b to
1694cc7
Compare
实现 password 模式会话/CSRF/注册策略，并修复 HITL 事件桥、cookie Path 与缺失注册策略静默 open 等确定性缺陷。脚本侧统一正式认证客户端，并为 FORMAL_HTTP_AUTH_TARGETS 增加 node --check 语法门禁。 基于 main reset 后重提原 datagallery-lab#83，叠在 DataLink 外置的一键部署分支之上。 Co-authored-by: wing <wangjk9527@users.noreply.github.com>
parseCookies 在 percent-encoding 非法时抛 URIError，会使 /api/v1/* 落入 500。改为跳过坏 cookie 项；部署 HTTP 脚本分类仅在文件存在时生效， 便于本分支直接基于 main 合入而不依赖部署目录。
wangjk9527
force-pushed
the
cursor/m0a5a-formal-auth-foundation-f252
branch
from
July 26, 2026 08:10
851d690 to
5442fab
Compare
6 tasks
Owner
Author
|
已 rebase 到 upstream/main（去掉部署叠层），并开主仓 PR：datagallery-lab#88 （HEAD |
Owner
Author
|
由主仓 datagallery-lab#88 承接（基于 main，不再叠部署分支）。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
基于 main reset 后重提原 #83：落地 M0A.5a 正式 password 认证基础；可复用的认证契约与共享测试客户端，同时保留现有
dev认证入口。叠在 DataLink 外置 的一键部署分支
cursor/native-one-click-deployment-v2-f252之上（不再依赖仓内 DataLink / 旧 datagallery-lab#82）。GET /api/v1/auth/statusexpiresAtCSRF_INVALID）createAuthenticatedTestClient()；核心 HTTP smoke/seed 迁到 password 模式，动态userId/workspaceIdscripts/**/*.mjsHTTP 认证分类门禁；CIcore-smoke-tests跑 password 模式test:auth-foundationask_user/submit_plan绕过 ActionRouter；在合成RUN_FINISHED前发TOOL_CALL_END，以便interaction.requested完成AUTH_REGISTRATION_MODE=open（不引入任何DATALINK_*）不在范围：M0A.5b（TUI 登录，原 datagallery-lab#84）、M0A.5c（password-only 切流）。
Test plan
npm run test:auth-foundation（24 pass）npm run smoke:authnpm run test:deploy（叠层后仍 87 pass）npm run smoke:config-apinpm run smoke:copilotkit-runnpm run typecheck/npm run test:web/ TUI testsCore Smoke TestsgreenNotes
devauth 仍保留；新测试不依赖它。registrationMode不完全一致，直到 M0A.5c。wangjk9527:cursor/m0a5a-formal-auth-foundation-f252为 head；若部署 PR 尚未合入，base 用部署分支，合入后改 rebase 到main。