feat(auth): 完成 M0A.5c password-only 切换#5
Draft
wangjk9527 wants to merge 4 commits into
Draft
Conversation
提供 deploy.sh 原生部署链路（configure/install/build/start/stop/doctor/tui）， 仅托管 Web + API；补齐无内置 DataLink 的 npm start / stack-runner。 语义 Data Link 改为外置 MCP 对接，deploy 不安装、不启动、不作健康门槛。 基于 main reset 后重提原 datagallery-lab#82。 Co-authored-by: wing <wangjk9527@users.noreply.github.com>
实现 password 模式会话/CSRF/注册策略，并修复 HITL 事件桥、cookie Path 与缺失注册策略静默 open 等确定性缺陷。脚本侧统一正式认证客户端，并为 FORMAL_HTTP_AUTH_TARGETS 增加 node --check 语法门禁。 基于 main reset 后重提原 datagallery-lab#83，叠在 DataLink 外置的一键部署分支之上。 Co-authored-by: wing <wangjk9527@users.noreply.github.com>
接入正式认证登录/会话恢复，并按复审加固： - 认证请求 redirect:manual，逐跳拒绝 HTTPS→HTTP 与跨 origin - AbortController 覆盖完整 body 读取；session 隔离/重置与保存同锁，锁支持过期回收 - CSRF 403 若 jar token 已更新则直接重试；session-invalid 去重先于清理副作用 基于 main reset 后重提原 datagallery-lab#84，rebase 到 DataLink 外置 deploy + M0A.5a 栈上； 同步清理 TUI 指南中残留的离线 Demo 模式表述。 Co-authored-by: wing <wangjk9527@users.noreply.github.com>
删除 API/Web/Metadata/测试中的 dev 身份旁路，原生部署默认 loopback，并加入 password-only 扫描门禁。 基于 main reset 后重提原 M0A.5c，rebase 到 DataLink 外置 deploy + M0A.5a/5b 栈； 不恢复仓内 DataLink / smoke-builtin-datalink。 Co-authored-by: wing <wangjk9527@users.noreply.github.com>
wangjk9527
force-pushed
the
cursor/m0a5b-tui-login-f252
branch
from
July 26, 2026 08:11
1ba3c88 to
62167a5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
基于 main reset 后重提原 M0A.5c（
cc83a4b）：删除 API / Web / Metadata / 测试中的dev身份旁路，原生部署默认 loopback，并加入 password-only 扫描门禁。叠在：
cursor/native-one-click-deployment-v2-f252（DataLink 外置一键部署）cursor/m0a5a-formal-auth-foundation-f252（M0A.5a）cursor/m0a5b-tui-login-f252（M0A.5b）相对旧 tip 的适配：
DATALINK_*默认项与smoke-builtin-datalink.mjsassertNativeAuthPublicBaseUrl/assertNativeBindHostsDATAFOUNDRY_AUTH_MODE/ WebNEXT_PUBLIC_DATAFOUNDRY_AUTH_MODE与相关 UI 旁路test:password-onlyTest plan
npm run test:deploy（90 pass）npm run test:auth-foundation（28 pass）npm run test:password-only（5 pass）npm run smoke:authnpm run smoke:tui-auth-sharingnpm --workspace @datafoundry/tui test（96 pass）npm run typechecknpm run test:web（585 pass）Notes
wangjk9527:cursor/m0a5c-password-only-cutover-f252cursor/m0a5b-tui-login-f252；底层合入后再改 base / rebase 到main