源码快照 @ 2026-09-01 (source-only, 剔除非源码素材)

packages/runtime-host/src/server/access-credential-metadata.ts

@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { join } from 'node:path';
+import { runtimeHostAccessCredentialFingerprintFromHash } from '../access-credential-identity.js';
+import {
+  discoverMarkedStorageRoot,
+  resolveExistingStorageRootControlDirectory,
+  resolveExistingStorageRoot,
+} from '@maka/storage/root-authority';
+import type { OperationKey } from '../protocol/index.js';
+import { ACCESS_FILE_NAME, readAccessCredentialFile } from './access-credential-store.js';
+
+export interface RuntimeHostAccessCredentialMetadata {
+  readonly credentialId: string;
+  readonly credentialFingerprint: string;
+  readonly principalKind: 'remote_owner' | 'capability_provider';
+  readonly principalId: string;
+  readonly status: 'active' | 'pending';
+  readonly operationGrants: readonly OperationKey[];
+  readonly canPublishClientCapabilities: boolean;
+  readonly canUseHostPaths: boolean;
+  readonly createdAt: string;
+  readonly expiresAt?: string;
+}
+
+export async function readRuntimeHostAccessCredentialMetadata(
+  rootPath: string,
+  expectedRootId?: string,
+): Promise<{ readonly credentials: readonly RuntimeHostAccessCredentialMetadata[] }> {
+  const capability = expectedRootId
+    ? await resolveExistingStorageRoot({
+        path: rootPath,
+        kind: 'interactive',
+        expectedRootId,
+      })
+    : await discoverMarkedStorageRoot({ path: rootPath });
+  const { controlDirectory } = await resolveExistingStorageRootControlDirectory(capability);
+  const file = await readAccessCredentialFile(join(controlDirectory, ACCESS_FILE_NAME));
+  const now = Date.now();
+  return {
+    credentials: file.credentials.flatMap((credential) => {
+      if (
+        credential.principalKind === 'session_guest' ||
+        (credential.status !== 'active' &&
+          !(credential.status === 'pending' && Date.parse(credential.expiresAt!) > now))
+      ) {
+        return [];
+      }
+      return [
+        {
+          credentialId: credential.credentialId,
+          credentialFingerprint: runtimeHostAccessCredentialFingerprintFromHash(
+            credential.credentialHash,
+          ),
+          principalKind: credential.principalKind,
+          principalId: credential.principalId,
+          status: credential.status,
+          operationGrants: credential.operationGrants,
+          canPublishClientCapabilities: credential.canPublishClientCapabilities,
+          canUseHostPaths: credential.canUseHostPaths,
+          createdAt: credential.createdAt,
+          ...(credential.expiresAt ? { expiresAt: credential.expiresAt } : {}),
+        },
+      ];
+    }),
+  };
+}