甄甄养堂账号
+' . htmlspecialchars($error, ENT_QUOTES, 'UTF-8') . '
' + : strtr(self::FORM, ['__NONCE__' => $nonce, '__CTX__' => json_encode($ctx, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)]); + $html = strtr(self::LAYOUT, ['__NONCE__' => $nonce, '__BODY__' => $body]); + return response($html, $status, array_merge($this->headers(), [ + 'Content-Type' => 'text/html; charset=utf-8', + 'Content-Security-Policy' => "default-src 'none'; script-src 'nonce-{$nonce}'; style-src 'nonce-{$nonce}'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'", + 'X-Frame-Options' => 'DENY', + ])); + } + + private const LAYOUT = <<<'HTML' + + + + + + +使用甄养堂账号登录行知 AI 工作助手。登录后，行知会按你的甄养堂权限只读查询业务数据。
+你已登录甄养堂后台：
+密码只在甄养堂校验，不会发给行知。不是你本人发起的登录，请直接关闭此页。
+ +HTML; +} diff --git a/server/app/mcp/service/GrantService.php b/server/app/mcp/service/GrantService.php index 30bc7ee80..58f641911 100644 --- a/server/app/mcp/service/GrantService.php +++ b/server/app/mcp/service/GrantService.php @@ -27,11 +27,20 @@ class GrantService */ public static function issue(array $input, string $ip): array { - $account = trim((string) ($input['account'] ?? '')); - $password = (string) ($input['password'] ?? ''); $client = substr(trim((string) ($input['client'] ?? 'xingzhi')), 0, 32) ?: 'xingzhi'; $instance = substr(trim((string) ($input['client_instance'] ?? '')), 0, 64); $label = mb_substr(trim((string) ($input['label'] ?? '')), 0, 100); + $admin = self::verifyPassword((string) ($input['account'] ?? ''), (string) ($input['password'] ?? ''), $ip, '再绑定 AI 助手'); + return self::issueFor($admin, $client, $instance, $label, $ip); + } + + /** + * 账号密码校验（按 IP 限流、连续错误锁定）加各项门禁，通过返回后台账号。授权接口与登录行知（SsoService）共用。 + * $then：初始密码未修改时提示“请先在甄养堂后台修改初始密码，{$then}”。 + */ + public static function verifyPassword(string $account, string $password, string $ip, string $then): Admin + { + $account = trim($account); if ($account === '' || $password === '' || mb_strlen($account) > 64 || strlen($password) > 128) { throw new McpException('请输入正确的账号和密码', 'invalid_request'); } @@ -57,9 +66,16 @@ class GrantService self::assertAdminUsable($admin); if (McpConfig::requirePasswordChanged() && array_key_exists('is_paw', $admin->getData()) && (int) $admin['is_paw'] !== 1) { - throw new McpException('请先在甄养堂后台修改初始密码，再绑定 AI 助手', 'need_change_password'); + throw new McpException('请先在甄养堂后台修改初始密码，' . $then, 'need_change_password'); } + return $admin; + } + /** + * 给已通过校验的后台账号签发只读令牌；同一客户端实例的旧授权作废。 + */ + public static function issueFor(Admin $admin, string $client, string $instance, string $label, string $ip): array + { $now = time(); $token = TokenService::generate(); $expire = $now + McpConfig::tokenTtlDays() * 86400; @@ -197,8 +213,8 @@ class GrantService ]; } - /** 停用、企微强制绑定、AI 权限点：签发和每次调用都检查 */ - private static function assertAdminUsable(Admin $admin): void + /** 停用、企微强制绑定、AI 权限点：签发、每次调用和登录行知都检查 */ + public static function assertAdminUsable(Admin $admin): void { if ((int) $admin['disable'] === 1) { throw new McpException('甄养堂账号已停用', 'disabled'); diff --git a/server/app/mcp/service/McpConfig.php b/server/app/mcp/service/McpConfig.php index 26c35f4b5..990c5fdd2 100644 --- a/server/app/mcp/service/McpConfig.php +++ b/server/app/mcp/service/McpConfig.php @@ -139,11 +139,41 @@ class McpConfig return self::int('console_ttl_minutes', 120, 10, 480); } + /** 允许用甄养堂账号登录行知（SsoController；还需要 ENABLED 和下面三项） */ + public static function ssoEnabled(): bool + { + return self::bool('sso_enabled', false); + } + + /** 行知的客户端标识，与行知管理端里填写的一致 */ + public static function ssoClientId(): string + { + return self::str('sso_client_id'); + } + + /** 行知服务器换取登录结果时出示的密钥（行知管理端生成，至少 32 位） */ + public static function ssoClientSecret(): string + { + return self::str('sso_client_secret'); + } + + /** 登录后允许回到的行知地址（逗号分隔，必须完全一致），例如 http://xz.zhenyangtang.cn:8787/api/auth/sso/zyt/callback */ + public static function ssoRedirectUris(): array + { + return self::list('sso_redirect_uris'); + } + private static function raw(string $key) { return env('ai_mcp.' . $key); } + private static function str(string $key): string + { + $value = self::raw($key); + return is_string($value) || is_int($value) || is_float($value) ? trim((string) $value) : ''; + } + private static function bool(string $key, bool $default): bool { $value = self::raw($key); diff --git a/server/app/mcp/service/SsoService.php b/server/app/mcp/service/SsoService.php new file mode 100644 index 000000000..a13e69399 --- /dev/null +++ b/server/app/mcp/service/SsoService.php @@ -0,0 +1,128 @@ +where('token', $token)->where('expire_time', '>', time())->whereIn('terminal', self::SESSION_TERMINALS)->find() + : null; + $admin = $session ? Admin::where('id', '=', (int) $session['admin_id'])->findOrEmpty() : null; + if ($admin === null || $admin->isEmpty()) { + throw new McpException('后台登录已失效，请输入账号密码', 'session_invalid', 401); + } + GrantService::assertAdminUsable($admin); + if (McpConfig::requirePasswordChanged() && array_key_exists('is_paw', $admin->getData()) && (int) $admin['is_paw'] !== 1) { + throw new McpException('请先在甄养堂后台修改初始密码，再登录行知', 'need_change_password'); + } + return $admin; + } + + /** 一次性授权码：只存哈希，绑定账号、客户端和回调地址 */ + public static function issueCode(Admin $admin, string $clientId, string $redirectUri, string $via): string + { + $code = bin2hex(random_bytes(32)); + Cache::set(self::codeKey($code), [ + 'admin_id' => (int) $admin['id'], + 'client_id' => $clientId, + 'redirect_uri' => $redirectUri, + 'via' => $via, + 'issued' => time(), + ], self::CODE_TTL); + return $code; + } + + /** + * 兑换授权码（只能用一次），返回 [后台账号, 确认方式]；账号此刻仍须满足各项门禁。 + */ + public static function redeem(string $code, string $clientId, string $redirectUri): array + { + $data = preg_match('/^[0-9a-f]{64}$/', $code) === 1 ? self::take(self::codeKey($code)) : null; + if (!is_array($data) || !hash_equals((string) $data['client_id'], $clientId) || $data['redirect_uri'] !== $redirectUri + || time() - (int) $data['issued'] > self::CODE_TTL) { + throw new McpException('登录授权码无效、已过期或已使用，请重新登录', 'invalid_grant', 400); + } + $admin = Admin::where('id', '=', (int) $data['admin_id'])->findOrEmpty(); + if ($admin->isEmpty()) { + throw new McpException('甄养堂账号已删除', 'invalid_grant', 400); + } + GrantService::assertAdminUsable($admin); + return [$admin, (string) $data['via']]; + } + + /** 回到行知的地址：登记的 redirect_uri 加上参数 */ + public static function redirectWith(string $redirectUri, array $params): string + { + return $redirectUri . (str_contains($redirectUri, '?') ? '&' : '?') . http_build_query($params); + } + + private static function codeKey(string $code): string + { + return 'ai_sso_code_' . hash('sha256', $code); + } + + /** 读取并删除；加文件锁，同一授权码并发兑换时只有一个能拿到 */ + private static function take(string $key) + { + $lock = fopen(runtime_path() . 'ai_sso.lock', 'c'); + if ($lock === false) { + return null; + } + try { + flock($lock, LOCK_EX); + $data = Cache::get($key); + if ($data !== null) { + Cache::delete($key); + } + return $data; + } finally { + flock($lock, LOCK_UN); + fclose($lock); + } + } +} diff --git a/server/tests/AiMcpSsoTest.php b/server/tests/AiMcpSsoTest.php new file mode 100644 index 000000000..8b7fa8b94 --- /dev/null +++ b/server/tests/AiMcpSsoTest.php @@ -0,0 +1,212 @@ + PHP_AI_MCP_SSO_REDIRECT_URIS=http://127.0.0.1:18787/api/auth/sso/zyt/callback + * AI_MCP_TEST_MYSQL=1 AI_MCP_TEST_BASE_URL=http://127.0.0.1:8099 php server/tests/AiMcpSsoTest.php + * 夹具 ID 段：账号 93201-93204、角色 301-302。 + */ + +require dirname(__DIR__) . '/vendor/autoload.php'; + +use think\App; +use think\cache\driver\File as FileCache; +use think\facade\Db; + +function aiMcpSsoExpect(bool $condition, string $message): void +{ + if (!$condition) { + fwrite(STDERR, "FAIL: {$message}\n"); + exit(1); + } +} + +$base = rtrim((string) getenv('AI_MCP_TEST_BASE_URL'), '/'); +$secret = (string) getenv('PHP_AI_MCP_SSO_CLIENT_SECRET'); +$redirect = trim(explode(',', (string) getenv('PHP_AI_MCP_SSO_REDIRECT_URIS'))[0]); +$clientId = (string) getenv('PHP_AI_MCP_SSO_CLIENT_ID'); +if (getenv('AI_MCP_TEST_MYSQL') !== '1' || $base === '' || strlen($secret) < 32 || $redirect === '' || $clientId === '') { + echo "AiMcpSsoTest SKIP (set AI_MCP_TEST_MYSQL=1, AI_MCP_TEST_BASE_URL, PHP_DATABASE_* for a disposable *_test database and the PHP_AI_MCP_SSO_* settings the server runs with)\n"; + exit(0); +} + +$app = new App(dirname(__DIR__) . DIRECTORY_SEPARATOR); +$app->initialize(); +$database = (string) config('database.connections.' . config('database.default') . '.database'); +aiMcpSsoExpect(str_ends_with($database, '_test'), "refusing to run on database '{$database}' (name must end with _test)"); +aiMcpSsoExpect((int) Db::name('system_menu')->where('perms', 'ai.mcp/access')->count() === 1, 'run 2026_09_24_ai_mcp.sql on the test database first'); + +// ---------------------------------------------------------------- 夹具 +$now = time(); +$pwd = create_password('Test@123456', (string) config('project.unique_identification')); +Db::name('system_role')->whereIn('id', [301, 302])->delete(); +foreach ([301 => 'AI 查询', 302 => '无 AI 权限'] as $id => $name) { + Db::name('system_role')->insert(['id' => $id, 'name' => $name, 'desc' => 'ai-mcp-sso-test', 'sort' => 0, 'data_scope' => 4, 'create_time' => $now, 'update_time' => $now]); +} +Db::name('system_role_menu')->whereIn('role_id', [301, 302])->delete(); +Db::name('system_role_menu')->insert(['role_id' => 301, 'menu_id' => (int) Db::name('system_menu')->where('perms', 'ai.mcp/access')->value('id')]); +// 账号 => [名称, 角色, is_paw, disable] +$admins = [93201 => ['s_doc', '单点医生', 301, 1, 0], 93202 => ['s_noai', '无权限', 302, 1, 0], 93203 => ['s_new', '新账号', 301, 0, 0], 93204 => ['s_off', '已停用', 301, 1, 1]]; +Db::name('admin')->whereIn('id', array_keys($admins))->delete(); +Db::name('admin_role')->whereIn('admin_id', array_keys($admins))->delete(); +Db::name('admin_session')->whereIn('admin_id', array_keys($admins))->delete(); +Db::name('ai_grant')->whereIn('admin_id', array_keys($admins))->delete(); +Db::name('ai_access_log')->whereIn('admin_id', array_keys($admins))->delete(); +Db::name('ai_access_log')->whereIn('tool', ['sso.login', 'sso.approve', 'sso.token'])->where('admin_id', 0)->delete(); +foreach ($admins as $id => [$account, $name, $role, $isPaw, $disable]) { + Db::name('admin')->insert(['id' => $id, 'root' => 0, 'name' => $name, 'avatar' => '', 'account' => $account, 'password' => $pwd, 'multipoint_login' => 1, + 'is_paw' => $isPaw, 'work_wechat_userid' => '', 'disable' => $disable, 'phone' => '1370000' . substr((string) $id, -4), 'create_time' => $now, 'update_time' => $now]); + Db::name('admin_role')->insert(['admin_id' => $id, 'role_id' => $role]); +} +$pcToken = substr(md5('sso-test-pc-' . $now), 0, 32); +$aiToken = substr(md5('sso-test-ai-' . $now), 0, 32); +$oldToken = substr(md5('sso-test-old-' . $now), 0, 32); +Db::name('admin_session')->insert(['admin_id' => 93201, 'terminal' => 1, 'token' => $pcToken, 'update_time' => $now, 'expire_time' => $now + 3600]); +Db::name('admin_session')->insert(['admin_id' => 93201, 'terminal' => 8, 'token' => $aiToken, 'update_time' => $now, 'expire_time' => $now + 3600]); +Db::name('admin_session')->insert(['admin_id' => 93203, 'terminal' => 1, 'token' => $oldToken, 'update_time' => $now - 7200, 'expire_time' => $now - 60]); +// 服务端（mcp 应用自己的缓存目录）里的错误计数与限流桶，清掉让断言可重复 +$cacheOptions = (array) config('cache.stores.file'); +$cacheOptions['path'] = app()->getRootPath() . 'runtime' . DIRECTORY_SEPARATOR . 'mcp' . DIRECTORY_SEPARATOR . 'cache'; +$serverCache = new FileCache(app(), $cacheOptions); +foreach (array_column($admins, 0) as $account) { + $serverCache->delete('ai_mcp_grant_fail_' . md5($account)); +} +foreach (['sso_ip_', 'sso_token_', 'grant_ip_'] as $bucket) { + foreach (['127.0.0.1', '::1'] as $ip) { + $serverCache->delete('ai_mcp_rl_' . $bucket . md5($ip) . '_' . intdiv(time(), 600)); + } +} +\think\facade\Cache::clear(); + +// ---------------------------------------------------------------- HTTP 工具 +function aiMcpSsoHttp(string $method, string $url, ?array $body, array $headers = []): array +{ + $ch = curl_init($url); + $lines = ['Content-Type: application/json']; + foreach ($headers as $k => $v) { + $lines[] = $k . ': ' . $v; + } + $responseHeaders = []; + curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => $lines, CURLOPT_TIMEOUT => 60, + CURLOPT_HEADERFUNCTION => static function ($ch, string $line) use (&$responseHeaders): int { + $parts = explode(':', $line, 2); + if (count($parts) === 2) { + $responseHeaders[strtolower(trim($parts[0]))][] = trim($parts[1]); + } + return strlen($line); + }]); + if ($body !== null) { + curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body, JSON_UNESCAPED_UNICODE)); + } + $raw = (string) curl_exec($ch); + $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE); + curl_close($ch); + return [$status, json_decode($raw, true), $raw, $responseHeaders]; +} + +$state = 'state-' . bin2hex(random_bytes(8)); +$ctx = ['client_id' => $clientId, 'redirect_uri' => $redirect, 'state' => $state]; +$page = static fn (array $query) => aiMcpSsoHttp('GET', $base . '/mcp/sso/authorize?' . http_build_query($query), null); +$sso = static fn (string $action, array $body) => (array) (aiMcpSsoHttp('POST', $base . '/mcp/sso/' . $action, $ctx + $body)[1] ?? []); +$codeOf = static function (array $body) use ($redirect, $state): string { + $url = (string) ($body['data']['redirect'] ?? ''); + aiMcpSsoExpect(str_starts_with($url, $redirect . '?'), 'redirects back to the registered address: ' . json_encode($body, JSON_UNESCAPED_UNICODE)); + parse_str((string) parse_url($url, PHP_URL_QUERY), $query); + aiMcpSsoExpect(($query['state'] ?? '') === $state && preg_match('/^[0-9a-f]{64}$/', (string) ($query['code'] ?? '')) === 1, 'with the state and a one-time code'); + return (string) $query['code']; +}; +$exchange = static fn (string $code, array $override = []) => aiMcpSsoHttp('POST', $base . '/mcp/sso/token', + $override + ['client_id' => $clientId, 'client_secret' => $secret, 'code' => $code, 'redirect_uri' => $redirect, 'client_instance' => 'sso-test', 'label' => '行知 · 登录']); + +// ---------------------------------------------------------------- 登录确认页 +[$status, , $html, $headers] = $page($ctx); +aiMcpSsoExpect($status === 200 && str_contains($html, '登录「行知」') && str_contains($html, '