源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

apps/server/src/enterprise-den-origin.ts

@@ -0,0 +1,70 @@
+import { desktopBootstrapPath } from "@openwork/paths";
+
+import { readJsoncFile } from "./jsonc.js";
+
+const MAX_BOOTSTRAP_BYTES = 256 * 1024;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Reduces an administrator-provisioned Den control-plane URL to its exact
+ * origin. Anything carrying credentials, a query, or a fragment is rejected
+ * rather than trimmed, so a malformed activation record can never widen the
+ * diagnostics trust list.
+ */
+export function exactEnterpriseOrigin(rawValue: unknown): string | null {
+  if (typeof rawValue !== "string") return null;
+  const raw = rawValue.trim();
+  if (!raw || raw.length > 2 * 1024) return null;
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "https:") return null;
+    if (url.username || url.password || url.search || url.hash) return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolves the origin of the enterprise/on-prem Den control plane this
+ * installation is already activated against.
+ *
+ * The desktop writes `enterpriseActivation` only after a signed connect-link
+ * activation claim verifies, so it is administrator-provisioned configuration
+ * rather than a renderer- or request-supplied URL — the one non-built-in
+ * source the credentialed diagnostics probe may trust without an explicit
+ * environment override. A missing, unreadable, or malformed record yields
+ * null and the probe stays fail-closed.
+ */
+export async function readActivatedEnterpriseDenOrigin(options?: {
+  signal?: AbortSignal;
+  path?: string;
+}): Promise<string | null> {
+  const path = options?.path ?? desktopBootstrapPath({ env: process.env });
+  if (typeof path !== "string" || !path.trim()) return null;
+  try {
+    const { data, invalid } = await readJsoncFile<Record<string, unknown>>(
+      path,
+      {},
+      {
+        allowInvalid: true,
+        maxBytes: MAX_BOOTSTRAP_BYTES,
+        regularFileOnly: true,
+        signal: options?.signal,
+      },
+    );
+    if (invalid) return null;
+    const activation = isRecord(data.enterpriseActivation) ? data.enterpriseActivation : null;
+    if (!activation) return null;
+    // Both fields are required by the desktop writer; an entry without a
+    // completed activation timestamp is not proof of a provisioned tenant.
+    if (typeof activation.activatedAt !== "string" || !activation.activatedAt.trim()) return null;
+    return exactEnterpriseOrigin(activation.denBaseUrl);
+  } catch {
+    options?.signal?.throwIfAborted();
+    return null;
+  }
+}