refactor(weixin-ilink): 措辞纠正 —「会话过期」→「会话被 iLink 拒绝」（零逻辑改动）
事实（主人 2026-10-03 确认）：iLink 的 bot token 是长期凭据（一个月前扫码的仍可用）；errcode=-14 是 iLink 侧拒绝/作废该会话，不是时间性过期；且至今未观测到真实 -14（当日全部日志 0 次）。此前代码把这些写成「过期」，属沿用的旧命名，现纠正。 - 纯改名/文案：ErrSessionExpired→ErrSessionRejected、errSessionExpired→errcodeSessionRejected、expired/expiredToken→rejected/rejectedToken、markExpired/expiredLocked/expiredState→markRejected/rejectedLocked/rejectedState；409 错误码 session_expired→session_rejected - 行为一字未改：显式标记 / Connect 不假 OK / 面板 needsRescan+lastError / 扫码或换新 token 即清除 全部保留 - 微信协议自身的「二维码过期」与 auth 的 JWT/refresh 过期一律未动（那些是真·时间性过期） - Docs/api-client v0.39 补事实说明；顺手收尾 3 处残留注释（admin.go / channelbridge/inbound.go / readloop_test.go）
This commit is contained in:
AskaEth committed
1 parent
cdc370dc82
commit
a51aadeef4
14 files changed
+205
-192
No files matched your search
+5
-4
@@ -124,7 +124,7 @@
|
||||
| 4 | `/api/v1/admin/plugins` | GET | ✅ | 插件/能力列表（含 MCP/渠道） |
|
||||
| 5 | `/api/v1/admin/plugins/policy` | POST | ✅ | 写工具策略（owner-only，审计） |
|
||||
| 5a | `/api/v1/admin/plugins/installed` | GET | ✅ | **已装运行时插件列表**（owner/admin 读）：`{data:[{id,name,kind,transport,endpoint?,command?,args?,apiKey?,env?,createdAt?,live,toolCount}]}`，`apiKey`/敏感 `env` 值**掩码**（如 `****1234`），`live` = 是否已连接注册，`toolCount` = 该 server 注册工具数 |
|
||||
| 6 | `/api/v1/admin/channels` | GET | ✅ | 渠道列表/健康 + 每平台已配账号（脱敏 token 掩码，design/04 §3.1）；已连接渠道的账号附 **bot 身份**（`botId`/`botUsername`/`botNickname`，如 KOOK `GET /api/v3/user/me` 自动获取）；适配器要求重新授权时附 **`needsRescan`** + **`lastError`**（v0.39，仅微信 iLink 过期 token） |
|
||||
| 6 | `/api/v1/admin/channels` | GET | ✅ | 渠道列表/健康 + 每平台已配账号（脱敏 token 掩码，design/04 §3.1）；已连接渠道的账号附 **bot 身份**（`botId`/`botUsername`/`botNickname`，如 KOOK `GET /api/v3/user/me` 自动获取）；适配器要求重新授权时附 **`needsRescan`** + **`lastError`**（v0.39，仅微信 iLink 返回 `errcode=-14`、会话被 iLink 侧拒绝这一种） |
|
||||
| 7 | `/api/v1/admin/iot` | GET | ✅ | IoT 设备列表 |
|
||||
| 8 | `/api/v1/admin/users` | GET/POST | ✅(GET) | 用户/角色/API key（GET 已实现；POST 创建用户/签发 key 随 M10 落地） |
|
||||
| 9 | `/api/v1/admin/llm` | GET/POST | ✅ | LLM 多厂商多模型（models.json）：GET 列表（APIKey 脱敏，含 `provider` 协议与 `maxTokens` 预算）；POST 保存组→落盘 `models.json`→**热更新**运行中的 LLM stack（design/04 §3.1，无需重启） |
|
||||
@@ -160,9 +160,10 @@
|
||||
- `DELETE /admin/automations/{id}` → `200 {data:{id,deleted:true}}`；`404`。
|
||||
- `POST /admin/llm` body `{id?,provider?,baseUrl,apiKey?,model,multimodal?,fallback?,maxTokens?}` → `201 {data:{provider:{id,name,provider,baseUrl,model,multimodal,enabled,fallback?,maxTokens?}, persisted:true, path}}`。**真实持久化**：读-改-写 `models.json`（本地、gitignore），保存组提升为**生效组**（index 0），并**热更新**运行中的 LLM provider（`path` 为落盘文件路径）；API key 写入文件但**永不回显/不落日志**。`provider` 为空默认 `openai`；缺 `baseUrl`/`model` 回 `400`；`maxTokens` 为负回 `400`；未注入 LLM stack 回 `500 llm_unavailable`、写盘失败 `500 llm_persist_failed`、热重载失败 `500 llm_reload_failed`。`maxTokens` 缺省/`0` = 未设（回落 `LLM_FALLBACK_MAX_TOKENS` / 适配器默认）。`.env` 为兜底。
|
||||
- `POST /admin/llm/test` body `{provider?,baseUrl,model,apiKey?,prompt?}` → `200 {data:{ok,provider,model,reply,tokens}}`（**真实模型调用**）；无效/失败回 `400 invalid_provider` / `500 llm_test_failed`。API key 仅本次请求内使用，不落库、不进 wire。
|
||||
- `POST /admin/channels/open`、`POST /admin/channels/close` body `{name}` → `200 {data:{name,connected}}`（真实 Connect/Disconnect）；`404`（未注册渠道）/`409 session_expired`（微信 iLink bot token 已过期，重连无法修复，须先「扫码登录」重新绑定，v0.39）/`409 needs_login`（微信 iLink 尚无 token）/`500`（其它凭据缺失等连接失败）。
|
||||
- `POST /admin/channels/open`、`POST /admin/channels/close` body `{name}` → `200 {data:{name,connected}}`（真实 Connect/Disconnect）；`404`（未注册渠道）/`409 session_rejected`（微信 iLink 侧拒绝/作废了该会话，重连无法修复，须先「扫码登录」重新绑定，v0.39）/`409 needs_login`（微信 iLink 尚无 token）/`500`（其它凭据缺失等连接失败）。
|
||||
- `POST /admin/channels/test` body `{platform?,accountId,isGroup}` → `200 {data:{role,owner,isGroup,env,verdict}}`。**结构性判定**：channel 层 actor 元数据 × `configs/users/owner.yaml` 白名单，绝不靠提示词。
|
||||
- **微信 iLink「会话过期」契约**（v0.39，适配器级，非端点）：iLink 返回 `errcode=-14`（bot token 过期）时适配器进入**显式过期态**——`IsConnected()` 恒 `false`；`Connect()` **不再返回成功**，而是返回「需要重新扫码」类错误（`POST /admin/channels/open` 对应 `409 session_expired`）；`HealthCheck` 同样把「过期」与「未连接」区分开。`GET /admin/channels` 该平台行带 **`needsRescan:true`** + **`lastError`**（人类可读原因，**绝不含 token**）。**清除条件**：扫码登录拿到新 token（`login-status` 报 `confirmed`）或配置里换了新 token（保存后热重载）。过期期间：`login-status` **不**假报 `confirmed` 而是 `failed` + 过期原因（避免面板把死 token 当成功重新落盘）；`login-qr` 仍可正常出码（**不**回 `already_logged_in` 挡住重新扫码）；`get_bot_qrcode` 不再携带已失效 token（否则服务端会以「已绑定」应答而不发新凭据）。未实现该能力的平台：`needsRescan`/`lastError` **不出现**（`omitempty`），客户端按缺省处理。
|
||||
- **微信 iLink「会话被拒」契约**（v0.39，适配器级，非端点）：iLink 返回 `errcode=-14` 时适配器进入**显式被拒态**——`IsConnected()` 恒 `false`；`Connect()` **不再返回成功**，而是返回「需要重新扫码」类错误（`POST /admin/channels/open` 对应 `409 session_rejected`）；`HealthCheck` 同样把「被拒」与「未连接」区分开。`GET /admin/channels` 该平台行带 **`needsRescan:true`** + **`lastError`**（人类可读原因，**绝不含 token**）。**清除条件**：扫码登录拿到新 token（`login-status` 报 `confirmed`）或配置里换了新 token（保存后热重载）。被拒期间：`login-status` **不**假报 `confirmed` 而是 `failed` + 被拒原因（避免面板把已作废的凭据当成功重新落盘）；`login-qr` 仍可正常出码（**不**回 `already_logged_in` 挡住重新扫码）；`get_bot_qrcode` 不再携带已被拒的 token（否则服务端会以「已绑定」应答而不发新凭据）。未实现该能力的平台：`needsRescan`/`lastError` **不出现**（`omitempty`），客户端按缺省处理。
|
||||
- **事实说明（勿误读为「过期」）**：iLink 的 bot token 是**长期凭据**（实测一个月前扫码得到的 token 仍可用），`errcode=-14` 表示 **iLink 侧拒绝/作废了该会话凭据**（解绑、在别处重新登录、协议层拒绝等），**不是时间性过期**；恢复方式为**重新扫码绑定**（或配置换新 token）。当前尚未在真实日志中观测到 `-14`，此处按「被拒」语义处理以防静默变哑。
|
||||
- **KOOK 适配器面板端点**（design/17 §2，**owner-only + 审计**，仅 `kook` 平台实现；其它平台回 `501 not_implemented`，账号未找到回 `404`）：这些端点均带可选 `?accountId=` 定位到具体 channels.json 账号（不传=该平台首个账号）。**token/密钥不打印、不落日志**；子项拉取失败不伪造、记入 `errors`。
|
||||
- `GET /admin/channels/{platform}/view?accountId=` → `200 {data:{platform,accountId?,friends?,userChats?,guilds?,channels?,members?,errors?}}`。聚合该账号真实数据（好友/申请/屏蔽、服务器、首个服务器频道与成员、私信会话）；`errors` 为 `{子项:原因}` 记录失败的子项。
|
||||
- `GET /admin/channels/{platform}/friends?type=&accountId=` → `200 {data:{friends?,requests?,blocked?}}`。`type` ∈ `friend|request|block`（空=全部），调用 KOOK `GET /friend?type=`。
|
||||
@@ -328,7 +329,7 @@
|
||||
- 语音：上行 `voice_input`（base64 音频或已转写 text），下行 `voice_output`（合成音频 base64 + text）。
|
||||
|
||||
## 5. 变更记录
|
||||
- `v0.39`（**微信 iLink 会话过期可见化 + 不再假 OK**，对客户端**新增两个可选字段、一处错误码**，向后兼容）：① **`GET /api/v1/admin/channels` 每平台行新增可选 `needsRescan`（bool，`omitempty`）+ `lastError`（string，`omitempty`）**——仅当适配器**真的**要求重新授权时出现（今天只有微信 iLink 的 `errcode=-14` 过期 token 这一种），取值来自适配器新增的**可选能力接口** `RescanRequired() (bool, string)`，网关**经类型断言**读取（主 `PlatformAdapter` 契约**不变**；未实现该能力的平台字段**缺省不出现**）。用途：把「需要重新扫码」与「主人自己关掉的未连接」区分开——后者仅 `connected:false`。② **`POST /admin/channels/open`** 对「已过期」回 **`409 session_expired`**（message 明确要求用「扫码登录」重新绑定），**不再**吞掉错误回 200；`409 needs_login`（尚无 token，v0.8 起）不变。③ **适配器行为**：iLink `errcode=-14` 进入**显式过期态**——`IsConnected()` 恒 `false`；`Connect()` 返回过期错误（**不再**对已过期 token 报成功）；`HealthCheck` 区分「过期」与「未连接」；并以 **`ERROR`** 级日志写明「需要重新扫码登录」（只带 `bot_id` 等非敏感标识，**token 永不入日志**）。过期态在读循环与发送两条路径**都会**置位，并仅在**扫码登录拿到新 token** 或**配置换了新 token**（保存 + 热重载）时清除。④ 扫码登录侧：过期期间 `login-status` 报 **`failed` + 过期原因**（**不再**假报 `confirmed`，否则面板会把死 token 当成功重新落盘）；`login-qr` 仍可正常出码（**不**回 `already_logged_in`，否则重新扫码这条路被堵死）；`get_bot_qrcode` 不再携带已失效的 token（否则服务端以「已绑定」应答、**不**发新凭据）。**向后兼容**：只新增可选字段与一处更诚实的错误码；不读新字段、不处理 409 的客户端行为不变（此时面板显示「未连接」，仍可用「扫码登录」恢复）。详见 §2 行 6 与「微信 iLink『会话过期』契约」。
|
||||
- `v0.39`（**微信 iLink 会话被拒可见化 + 不再假 OK**，对客户端**新增两个可选字段、一处错误码**，向后兼容）：① **`GET /api/v1/admin/channels` 每平台行新增可选 `needsRescan`（bool，`omitempty`）+ `lastError`（string，`omitempty`）**——仅当适配器**真的**要求重新授权时出现（今天只有微信 iLink 返回 `errcode=-14` 这一种），取值来自适配器新增的**可选能力接口** `RescanRequired() (bool, string)`，网关**经类型断言**读取（主 `PlatformAdapter` 契约**不变**；未实现该能力的平台字段**缺省不出现**）。用途：把「需要重新扫码」与「主人自己关掉的未连接」区分开——后者仅 `connected:false`。② **`POST /admin/channels/open`** 对「iLink 已拒绝该会话」回 **`409 session_rejected`**（message 明确要求用「扫码登录」重新绑定），**不再**吞掉错误回 200；`409 needs_login`（尚无 token，v0.8 起）不变。③ **适配器行为**：iLink `errcode=-14` 进入**显式被拒态**——`IsConnected()` 恒 `false`；`Connect()` 返回被拒错误（**不再**对被拒会话报成功）；`HealthCheck` 区分「会话被拒」与「未连接」；并以 **`ERROR`** 级日志写明「本次会话已被 iLink 拒绝，需要重新扫码绑定」（只带 `bot_id` 等非敏感标识，**token 永不入日志**）。被拒态在读循环与发送两条路径**都会**置位，并仅在**扫码登录拿到新 token** 或**配置换了新 token**（保存 + 热重载）时清除。④ 扫码登录侧：被拒期间 `login-status` 报 **`failed` + 被拒原因**（**不再**假报 `confirmed`，否则面板会把已作废凭据当成功重新落盘）；`login-qr` 仍可正常出码（**不**回 `already_logged_in`，否则重新扫码这条路被堵死）；`get_bot_qrcode` 不再携带已被拒的 token（否则服务端以「已绑定」应答、**不**发新凭据）。**向后兼容**：只新增可选字段与一处更诚实的错误码；不读新字段、不处理 409 的客户端行为不变（此时面板显示「未连接」，仍可用「扫码登录」恢复）。**语义澄清（本次仅措辞，不改契约形状、不另起版本号——v0.39 尚未被任何客户端采用）**：iLink 的 bot token 是**长期凭据**（实测一个月前扫码得到的 token 仍可用），`errcode=-14` 表示 **iLink 侧拒绝/作废了该会话凭据**，**不是时间性过期**。详见 §2 行 6 与「微信 iLink『会话被拒』契约」。
|
||||
- `v0.38`（**B4 客户端共享枚举权威表 + 未知值回落约定**，对客户端**新增一个只读 REST 端点**）：新增 **`GET /api/v1/meta/enums`**（**任意已认证角色可读**，与 `GET /sessions` 同级；无 token `401`）→ `200 {data:{platforms,moods,modes,unknown}}`，每项 `{id,label}`：① **`platforms`**（6）= `web`/`kook`/`qq-obv11`/`weixin-ilink`/`telegram`/`webhook`——即各内置适配器 `Name()` + Web 主会话来源 `web`；② **`moods`**（5）= `calm`/`happy`/`excited`/`sad`/`angry`，与 persona 情绪状态机内置状态一致（该状态机**可扩展**，故非封闭集合）；③ **`modes`**（9）= `chat`/`code`/`home`/`work`/`docs`/`voice`/`vision`/`agents`/`settings`（design/07 §1）；④ **`unknown`** 恒 `"display-raw"` = **未知值回落约定机器可读**：客户端遇不在表中的取值**原样显示原始字符串**（**不丢弃、不报错、不占位符**），**服务端新增取值视为非破坏性变更**（forward-compatible）。**单一事实来源在 Go 侧**（`internal/contract/enums`），并有**反漂移测试**断言适配器 `Name()` / 情绪内置状态 / 前端九模式与三张表一致，漏登记即 CI FAIL。Web 侧镜像 `frontend/web/src/lib/enums.ts`（`labelFor` 未知值返回原值），顶栏/侧栏/消息气泡的「心情」标签已改用它渲染。**向后兼容**：仅新增端点，既有契约形状不变。详见 §1 行 15 与 §1.1。
|
||||
- `v0.37`（**D4 未读状态 / 已读游标**，对客户端**新增一个语义字段、一个 REST 端点、一个下行事件**）：① `chat_sessions` 新增 **`read_at INTEGER NOT NULL DEFAULT 0`**（迁移 **0010**，down 可逆；**毫秒 Unix 时间戳**，与 `chat_messages.created_at` **同单位**）。② **语义**：**会话级单一已读游标 + 单 owner 账号**——同一账号所有端共用一个游标，**读一处 = 全端已读**（不做 per-device/per-user 游标，与「同一账号所有浏览器都属于同一 owner」一致）；`createdAt <= readAt` 的消息算已读，未读数 = `createdAt > readAt` 的条数。③ **`GET /api/v1/sessions` 每项新增恒返回的 `unreadCount`**（整数，0 = 无未读）：与 `lastMessage` **同一条 SQL 派生**（关联子查询 `COUNT(*) WHERE session_id = s.id AND created_at > s.read_at`，走已有 `idx_chat_msgs_session_created`，**无 N+1、不新增索引**）。④ **新增 `POST /api/v1/sessions/{id}/read`**（owner/admin，与 `PATCH /sessions/{id}` 同鉴权）：body `{before?}`（可选毫秒；缺省= 现在）→ `200 {data:{sessionId,readAt}}`；`before` 为 0/负数/非数字/body 非对象 → `400`，未知会话（含隔离 `sess-xxx`）→ `404`，未注入 HistoryStore → `501`。**游标只前进不后退**（`read_at = MAX(read_at, before)`），乱序/并发/重试请求幂等安全。⑤ **新增下行事件 `session_read`**：`{type:"session_read", sessionId, data:{readAt}}`，全连接广播 + 客户端按 `sessionId` 过滤，用于同账号其它端清红点；失败路径不广播（§3.9）。⑥ **升级回填**：0010 把既有会话游标回填为「该会话现有最新消息时间」，**升级当天不误报未读**（既有历史全部视为已读）。⑦ `HistoryStore`（网关消费侧契约）新增 `MarkSessionRead(ctx, sessionID, before)`；`SessionMeta` 新增 `UnreadCount`。**向后兼容**：仅新增字段/端点/事件，既有契约形状不变；不消费 `unreadCount`/`session_read` 的客户端行为不变。详见 §1 行 4/8a 与 §3.9。
|
||||
- `v0.36`（**A1 流式帧附加会话 / 回合标识**，对客户端**新增两个可选字段、无端点变更**）：结构化流帧 `message.start/delta/end`、`thinking.start/delta/end`、`tool_call.start/delta/end`、`tool_execution.update` 现在带 `sessionId` + `turnId`（**向后兼容**：只新增帧字段，`data` 结构与既有事件形状不变）。`sessionId` 由 loop 在**回合边界**从运行上下文注入（模型适配器在 loop 之下、天然不感知会话，保持零值；loop 外无会话上下文时该字段为空）；`turnId` 由网关**每回合**新生成（`newTurnID`）并经 `loop.WithTurnID` 挂进运行上下文，`runTurn` 是编排层与 legacy 直连路径**唯一**的回合收口点，两路都覆盖——同一会话同时只有一个 in-flight 回合，故同轮内所有帧的 `turnId` 一致。此前这几帧属于 design/16 §4.2 标注的「若知道就带上」缺口（v0.10 起记录）：**多会话并发流式时前端会把别的会话的 delta 接进当前会话气泡**，现在客户端按 `sessionId === activeSessionId` 过滤即可路由到激活会话。`stream_chunk` / `stream_end` 的 `sessionId`/`turnId` 行为不变。详见 §3.1。
|
||||
|
||||
@@ -24,7 +24,7 @@ import (
|
||||
// messages alone.
|
||||
//
|
||||
// When the read path returns with readCtx still alive, the adapter stopped
|
||||
// reading on its own — today that is the weixin-iLink expired session
|
||||
// reading on its own — today that is the weixin-iLink rejecting the session
|
||||
// (errcode=-14, see plugins/channels/weixin_ilink/session_state.go), which used to
|
||||
// leave the bridge claiming the channel was connected while it could no longer
|
||||
// deliver anything. A cancelled readCtx is a deliberate stop (bridge Stop or a
|
||||
|
||||
@@ -10,7 +10,7 @@ import (
|
||||
)
|
||||
|
||||
// deadSessionAdapter mimics a channel whose session dies while the bridge is
|
||||
// running — today the weixin-iLink expired bot token (iLink errcode=-14): Connect
|
||||
// running — today the iLink session rejection (errcode=-14): Connect
|
||||
// reports success, the read loop then returns on its own (nothing cancelled it)
|
||||
// and IsConnected reports false from that point on.
|
||||
type deadSessionAdapter struct {
|
||||
|
||||
@@ -178,7 +178,7 @@ func (s *Server) adminListChannels(w http.ResponseWriter, r *http.Request) {
|
||||
continue
|
||||
}
|
||||
sum := ChannelSummary{Name: platform, Connected: ch.IsConnected()}
|
||||
// Optional rescan capability (weixin-iLink expired token, v0.39): reported
|
||||
// Optional rescan capability (weixin-iLink rejected session, v0.39): reported
|
||||
// only when the adapter really asks for a re-scan, so a healthy adapter
|
||||
// keeps the fields omitted rather than shipping a fabricated value.
|
||||
if ra, ok := asRescanAware(cap.Value); ok {
|
||||
|
||||
@@ -18,7 +18,7 @@ import (
|
||||
|
||||
// rescanStubAdapter is a channel adapter that also exposes the optional rescan
|
||||
// capability, exactly as *weixin_ilink.Adapter does once iLink answers
|
||||
// errcode=-14 (expired bot token, re-scan required).
|
||||
// errcode=-14 (session rejected, re-scan required).
|
||||
type rescanStubAdapter struct {
|
||||
name string
|
||||
connected bool
|
||||
@@ -58,12 +58,12 @@ var (
|
||||
)
|
||||
|
||||
// TestAdminChannelsReportsNeedsRescan asserts the panel can tell "needs a fresh
|
||||
// scan" apart from plain "not connected": the expired adapter's row carries
|
||||
// scan" apart from plain "not connected": the rejected adapter's row carries
|
||||
// needsRescan + the reason, and a healthy adapter omits both rather than shipping
|
||||
// a fabricated value.
|
||||
func TestAdminChannelsReportsNeedsRescan(t *testing.T) {
|
||||
t.Parallel()
|
||||
const reason = "iLink getupdates 返回 errcode=-14（bot token 已过期）"
|
||||
const reason = "iLink getupdates 返回 errcode=-14（本次会话已被 iLink 拒绝）"
|
||||
caps := capreg.New()
|
||||
// Registered through the wrapper, the way the composition root registers it.
|
||||
if err := caps.Register(capreg.Capability{
|
||||
@@ -96,10 +96,10 @@ func TestAdminChannelsReportsNeedsRescan(t *testing.T) {
|
||||
t.Fatalf("no weixin-ilink row in %+v", items)
|
||||
}
|
||||
if wx.Connected {
|
||||
t.Error("weixin-ilink connected = true, want false while the token is expired")
|
||||
t.Error("weixin-ilink connected = true, want false while iLink rejects the session")
|
||||
}
|
||||
if !wx.NeedsRescan {
|
||||
t.Error("weixin-ilink needsRescan = false, want true (expired token must ask for a re-scan)")
|
||||
t.Error("weixin-ilink needsRescan = false, want true (a rejected session must ask for a re-scan)")
|
||||
}
|
||||
if wx.LastError != reason {
|
||||
t.Errorf("weixin-ilink lastError = %q, want %q", wx.LastError, reason)
|
||||
@@ -135,10 +135,10 @@ func TestAdminChannelsReportsNeedsRescan(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestAdminChannelOpenExpiredSessionReturns409 asserts the open endpoint answers
|
||||
// honestly for a session a reconnect cannot fix: 409 session_expired with the
|
||||
// TestAdminChannelOpenRejectedSessionReturns409 asserts the open endpoint answers
|
||||
// honestly for a session a reconnect cannot fix: 409 session_rejected with the
|
||||
// re-scan instruction, never a 200 that would make the panel show "connected".
|
||||
func TestAdminChannelOpenExpiredSessionReturns409(t *testing.T) {
|
||||
func TestAdminChannelOpenRejectedSessionReturns409(t *testing.T) {
|
||||
t.Parallel()
|
||||
caps := capreg.New()
|
||||
if err := caps.Register(capreg.Capability{
|
||||
@@ -146,8 +146,8 @@ func TestAdminChannelOpenExpiredSessionReturns409(t *testing.T) {
|
||||
Kind: capreg.KindChannel,
|
||||
Value: &rescanStubAdapter{
|
||||
name: "weixin-ilink", rescan: true,
|
||||
reason: "iLink bot token 已过期",
|
||||
connectErr: weixin_ilink.ErrSessionExpired,
|
||||
reason: "iLink 返回 errcode=-14（本次会话已被 iLink 拒绝）",
|
||||
connectErr: weixin_ilink.ErrSessionRejected,
|
||||
},
|
||||
}); err != nil {
|
||||
t.Fatalf("register weixin-ilink: %v", err)
|
||||
@@ -167,8 +167,8 @@ func TestAdminChannelOpenExpiredSessionReturns409(t *testing.T) {
|
||||
if err := json.Unmarshal(decodeBody(t, body)["error"], &eobj); err != nil {
|
||||
t.Fatalf("decode error envelope: %v (body=%s)", err, body)
|
||||
}
|
||||
if eobj.Code != "session_expired" {
|
||||
t.Fatalf("error code = %q, want session_expired", eobj.Code)
|
||||
if eobj.Code != "session_rejected" {
|
||||
t.Fatalf("error code = %q, want session_rejected", eobj.Code)
|
||||
}
|
||||
if !strings.Contains(eobj.Message, "扫码") {
|
||||
t.Fatalf("error message = %q, want the re-scan instruction", eobj.Message)
|
||||
@@ -198,7 +198,7 @@ func TestAdminChannelsRescanFromRealIlinkAdapter(t *testing.T) {
|
||||
t.Fatalf("new weixin adapter: %v", err)
|
||||
}
|
||||
if err := ad.Connect(context.Background()); err != nil {
|
||||
t.Fatalf("connect before expiry: %v", err)
|
||||
t.Fatalf("connect before rejection: %v", err)
|
||||
}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
@@ -231,10 +231,10 @@ func TestAdminChannelsRescanFromRealIlinkAdapter(t *testing.T) {
|
||||
t.Fatalf("channels = %+v, want one weixin-ilink row", items)
|
||||
}
|
||||
if items[0].Connected {
|
||||
t.Error("connected = true although iLink rejected the token")
|
||||
t.Error("connected = true although iLink rejected the session")
|
||||
}
|
||||
if !items[0].NeedsRescan {
|
||||
t.Error("needsRescan = false, want true for an expired iLink session")
|
||||
t.Error("needsRescan = false, want true for a rejected iLink session")
|
||||
}
|
||||
if items[0].LastError == "" {
|
||||
t.Error("lastError is empty, want the re-scan reason")
|
||||
|
||||
@@ -240,9 +240,9 @@ func (s *Server) adminChannelOpen(w http.ResponseWriter, r *http.Request) {
|
||||
// the weixin-iLink bot token was rejected by iLink (errcode=-14), so the
|
||||
// owner needs a fresh scan-code login. Answer 409 with that instruction
|
||||
// instead of pretending the channel opened (the panel marks it connected).
|
||||
if errors.Is(err, weixin_ilink.ErrSessionExpired) {
|
||||
writeError(w, apperr.Wrap(apperr.ErrConflict, "session_expired",
|
||||
"该渠道会话已过期（需要重新扫码登录）：请用「扫码登录」重新绑定后再连接"))
|
||||
if errors.Is(err, weixin_ilink.ErrSessionRejected) {
|
||||
writeError(w, apperr.Wrap(apperr.ErrConflict, "session_rejected",
|
||||
"该渠道会话已被 iLink 拒绝（errcode=-14）：请用「扫码登录」重新绑定后再连接"))
|
||||
return
|
||||
}
|
||||
// weixin-iLink with no token yet must not hang nor read as a credential
|
||||
|
||||
@@ -63,8 +63,12 @@ const (
|
||||
// ilinkVersion mirrors the upstream @tencent-weixin/openclaw-weixin version
|
||||
// whose client version we advertise on the wire as iLink-App-ClientVersion.
|
||||
ilinkVersion = "2.4.8"
|
||||
// errSessionExpired is the iLink errcode for an expired bot token.
|
||||
errSessionExpired = -14
|
||||
// errcodeSessionRejected is the iLink errcode meaning iLink rejected or
|
||||
// invalidated this session credential. It is NOT a time-based expiry: the bot
|
||||
// token is a long-lived credential (a token obtained by scanning a month ago
|
||||
// still works), so -14 means iLink no longer accepts this session — unbound,
|
||||
// re-logged-in elsewhere, or refused at the protocol level.
|
||||
errcodeSessionRejected = -14
|
||||
)
|
||||
|
||||
// Sentinel errors returned by this adapter, usable with errors.Is.
|
||||
@@ -73,8 +77,8 @@ var (
|
||||
ErrInvalidConfig = errors.New("weixin_ilink: invalid config")
|
||||
// ErrLoginTimeout is returned when the QR code is not confirmed in time.
|
||||
ErrLoginTimeout = errors.New("weixin_ilink: qr login timed out")
|
||||
// ErrSessionExpired is returned when iLink reports errcode=-14.
|
||||
ErrSessionExpired = errors.New("weixin_ilink: session expired, re-scan required")
|
||||
// ErrSessionRejected is returned when iLink reports errcode=-14.
|
||||
ErrSessionRejected = errors.New("weixin_ilink: iLink rejected the session (errcode=-14); re-scan required")
|
||||
// ErrNeedsLogin is returned by Connect when no bot_token is configured yet; the
|
||||
// scan-code bind must be driven via the panel login-qr/login-status endpoints.
|
||||
ErrNeedsLogin = errors.New("weixin_ilink: bot not logged in yet, scan the QR")
|
||||
@@ -159,15 +163,15 @@ type Adapter struct {
|
||||
|
||||
mu sync.RWMutex
|
||||
connected bool
|
||||
// expired marks a session iLink rejected with errcode=-14: the bot token is
|
||||
// dead and only a fresh scan-code login re-binds it (session_state.go).
|
||||
// expiredToken records WHICH token was rejected, so a subsequently configured
|
||||
// rejected marks a session iLink rejected with errcode=-14: the credential is
|
||||
// refused until a fresh scan-code login re-binds it (session_state.go).
|
||||
// rejectedToken records WHICH token was rejected, so a subsequently configured
|
||||
// token clears the state; rescanDetail is the panel-visible reason. All three
|
||||
// are guarded by mu.
|
||||
expired bool
|
||||
expiredToken string
|
||||
rescanDetail string
|
||||
qrcode string
|
||||
rejected bool
|
||||
rejectedToken string
|
||||
rescanDetail string
|
||||
qrcode string
|
||||
// pollBaseURL optionally overrides cfg.BaseURL for get_qrcode_status polling.
|
||||
// It is set when the server returns scaned_but_redirect with a redirect_host,
|
||||
// so subsequent status polls follow the IDC host. Guarded by mu.
|
||||
@@ -242,14 +246,14 @@ func (a *Adapter) Config() map[string]any {
|
||||
// runs the scan-code login flow (see login.go).
|
||||
//
|
||||
// A token iLink already rejected with errcode=-14 is NOT usable: Connect refuses
|
||||
// it with ErrSessionExpired (re-scan required) instead of reporting a session
|
||||
// it with ErrSessionRejected (re-scan required) instead of reporting a session
|
||||
// that the very next poll would tear down, and the scan-code login flow is the
|
||||
// way back (see login_admin.go StartLogin).
|
||||
func (a *Adapter) Connect(ctx context.Context) error {
|
||||
if expired, reason := a.expiredState(); expired {
|
||||
a.log.Error("ilink connect refused: session expired, 需要重新扫码登录",
|
||||
if rejected, reason := a.rejectedState(); rejected {
|
||||
a.log.Error("ilink connect refused: session rejected, 需要重新扫码绑定（请用「扫码登录」）",
|
||||
"bot_id", a.botID(), "reason", reason)
|
||||
return fmt.Errorf("%w: %s", ErrSessionExpired, reason)
|
||||
return fmt.Errorf("%w: %s", ErrSessionRejected, reason)
|
||||
}
|
||||
a.mu.RLock()
|
||||
connected := a.connected
|
||||
@@ -300,14 +304,14 @@ func (a *Adapter) IsConnected() bool {
|
||||
}
|
||||
|
||||
// HealthCheck verifies the session is usable: it must be connected and carry a
|
||||
// bot_token. An expired session (iLink rejected the token with errcode=-14) is
|
||||
// reported as ErrSessionExpired — "re-scan required" — so a caller can tell a
|
||||
// dead credential apart from a plain disconnected adapter. It does not probe the
|
||||
// bot_token. A session iLink rejected (errcode=-14) is reported as
|
||||
// ErrSessionRejected — "re-scan required" — so a caller can tell a refused
|
||||
// credential apart from a plain disconnected adapter. It does not probe the
|
||||
// network so callers can use it cheaply after a reconnect without incurring a
|
||||
// request.
|
||||
func (a *Adapter) HealthCheck(ctx context.Context) error {
|
||||
if expired, reason := a.expiredState(); expired {
|
||||
return fmt.Errorf("%w: %s", ErrSessionExpired, reason)
|
||||
if rejected, reason := a.rejectedState(); rejected {
|
||||
return fmt.Errorf("%w: %s", ErrSessionRejected, reason)
|
||||
}
|
||||
a.mu.RLock()
|
||||
defer a.mu.RUnlock()
|
||||
|
||||
@@ -145,7 +145,7 @@ func (a *Adapter) runLogin(sess *loginSession, sessCtx context.Context) {
|
||||
// completeLogin persists the confirmed credentials and marks the session live.
|
||||
// It writes cfg under a.mu, then clears the session under loginMu (never nesting
|
||||
// the two locks), and finally signals the waiting Connect path. A confirmed scan
|
||||
// delivers a fresh bot_token, which is the canonical way OUT of the expired state
|
||||
// delivers a fresh bot_token, which is the canonical way OUT of the rejected state
|
||||
// (session_state.go): the rescan flag is cleared here.
|
||||
func (a *Adapter) completeLogin(sess *loginSession, status qrcodeStatusResp) {
|
||||
a.mu.Lock()
|
||||
@@ -175,14 +175,14 @@ func (a *Adapter) completeLogin(sess *loginSession, status qrcodeStatusResp) {
|
||||
// completeBindedRedirect treats binded_redirect as an already-bound outcome: the
|
||||
// scanned bot is already linked to this instance, so the server issues no new
|
||||
// credentials and any existing token remains valid. Because NO new token arrives,
|
||||
// an expired session stays expired here — binded_redirect carries no proof that a
|
||||
// a rejected session stays rejected here — binded_redirect carries no proof that a
|
||||
// token iLink already rejected with errcode=-14 works again, so the adapter does
|
||||
// not claim a live session on the strength of it. A confirmed scan (completeLogin)
|
||||
// is what clears the expired state.
|
||||
// is what clears the rejected state.
|
||||
func (a *Adapter) completeBindedRedirect(sess *loginSession) {
|
||||
a.log.Info("weixin_ilink: login already bound (binded_redirect)")
|
||||
a.mu.Lock()
|
||||
a.connected = a.cfg.BotToken != "" && !a.expiredLocked()
|
||||
a.connected = a.cfg.BotToken != "" && !a.rejectedLocked()
|
||||
a.loginStatus = LoginStatusConfirmed
|
||||
a.loginDetail = loginBindedRedirectDetail
|
||||
a.mu.Unlock()
|
||||
@@ -218,12 +218,12 @@ func (a *Adapter) failLogin(sess *loginSession, err error) {
|
||||
// localTokenList returns the locally-held bot tokens to advertise on
|
||||
// get_bot_qrcode, so an already-bound bot can be detected (binded_redirect). On a
|
||||
// fresh bind it returns an empty (non-nil) slice so the wire carries `[]` rather
|
||||
// than `null`, matching the official client. An EXPIRED token is deliberately not
|
||||
// advertised: it is not a usable bind, and offering it lets the server answer
|
||||
// binded_redirect (no new credentials) — which would leave the owner stuck with a
|
||||
// dead token and no way back. Reporting `[]` asks for a real rebind.
|
||||
// than `null`, matching the official client. A token iLink REJECTED is deliberately
|
||||
// not advertised: it is not a usable bind, and offering it lets the server answer
|
||||
// binded_redirect (no new credentials) — which would leave the owner stuck with an
|
||||
// unusable credential and no way back. Reporting `[]` asks for a real rebind.
|
||||
func (a *Adapter) localTokenList() []string {
|
||||
if expired, _ := a.expiredState(); expired {
|
||||
if rejected, _ := a.rejectedState(); rejected {
|
||||
return []string{}
|
||||
}
|
||||
a.mu.RLock()
|
||||
|
||||
@@ -119,11 +119,11 @@ func (a *Adapter) StartLogin(ctx context.Context) (LoginQR, error) {
|
||||
a.loginMu.Lock()
|
||||
defer a.loginMu.Unlock()
|
||||
|
||||
// Already bound → scanning is moot — unless the stored token is EXPIRED: iLink
|
||||
// rejected it with errcode=-14, so it is not a usable bind and the owner must
|
||||
// be able to re-scan (otherwise the only way out of the expired state would be
|
||||
// Already bound → scanning is moot — unless iLink REJECTED the stored token
|
||||
// (errcode=-14), so it is not a usable bind and the owner must be able to
|
||||
// re-scan (otherwise the only way out of the rejected state would be
|
||||
// unreachable). A live token still short-circuits the QR flow as before.
|
||||
if expired, _ := a.expiredState(); a.hasToken() && !expired {
|
||||
if rejected, _ := a.rejectedState(); a.hasToken() && !rejected {
|
||||
return LoginQR{}, ErrAlreadyLoggedIn
|
||||
}
|
||||
if sess := a.loginSession; sess != nil {
|
||||
@@ -181,19 +181,19 @@ func (a *Adapter) StartLogin(ctx context.Context) (LoginQR, error) {
|
||||
|
||||
// LoginStatus reports the current scan-login state. A non-empty bot token
|
||||
// overrides to "confirmed" even if a stale session is still recorded, so the panel
|
||||
// always sees the true binding — except when that token is EXPIRED: iLink rejected
|
||||
// it with errcode=-14, so reporting "confirmed" would make the panel re-persist a
|
||||
// dead credential and call the bind a success. An expired bind is reported as
|
||||
// failed with the re-scan reason instead, while a re-scan already in progress
|
||||
// always sees the true binding — except when iLink REJECTED that token
|
||||
// (errcode=-14), so reporting "confirmed" would make the panel re-persist a dead
|
||||
// credential and call the bind a success. A rejected bind is reported as failed
|
||||
// with the re-scan reason instead, while a re-scan already in progress
|
||||
// keeps its own state. detail provides the bot id on confirmation and the failure
|
||||
// reason on failure.
|
||||
func (a *Adapter) LoginStatus(ctx context.Context) (status, detail string) {
|
||||
a.mu.Lock()
|
||||
defer a.mu.Unlock()
|
||||
if a.expiredLocked() {
|
||||
if a.rejectedLocked() {
|
||||
if a.loginStatus == LoginStatusWaiting || a.loginStatus == LoginStatusNeedVerifyCode {
|
||||
// A re-scan the owner already started: report its progress, not the
|
||||
// expired state it is meant to replace.
|
||||
// rejected state it is meant to replace.
|
||||
return a.loginStatus, a.loginDetail
|
||||
}
|
||||
return LoginStatusFailed, a.rescanDetail
|
||||
|
||||
@@ -35,7 +35,7 @@ const (
|
||||
type getupdatesResp struct {
|
||||
// Ret is the top-level business result; non-zero is a transient error.
|
||||
Ret int `json:"ret"`
|
||||
// Errcode is the platform error code; -14 means the session expired.
|
||||
// Errcode is the platform error code; -14 means iLink rejected the session.
|
||||
Errcode int `json:"errcode"`
|
||||
// Msgs holds the raw inbound messages delivered in this poll.
|
||||
Msgs []json.RawMessage `json:"msgs"`
|
||||
@@ -94,13 +94,13 @@ func (a *Adapter) ReadMessages(ctx context.Context, emit func(adapter.UnifiedMes
|
||||
}
|
||||
|
||||
failures = 0
|
||||
if resp.Errcode == errSessionExpired {
|
||||
// The bot token is dead: retrying cannot help and the poll loop would go
|
||||
// mute for good. Record the explicit expired state (which also drops the
|
||||
// connected flag and logs at ERROR) and stop the loop; the owner has to
|
||||
// re-scan, and everything downstream sees ErrSessionExpired until a fresh
|
||||
// token arrives.
|
||||
a.markExpired(rescanReasonGetUpdates)
|
||||
if resp.Errcode == errcodeSessionRejected {
|
||||
// iLink rejected this session credential: retrying cannot help and the poll
|
||||
// loop would go mute for good. Record the explicit rejected state (which also
|
||||
// drops the connected flag and logs at ERROR) and stop the loop; the owner
|
||||
// has to re-scan, and everything downstream sees ErrSessionRejected until a
|
||||
// fresh token arrives.
|
||||
a.markRejected(rescanReasonGetUpdates)
|
||||
return
|
||||
}
|
||||
if resp.Ret != 0 {
|
||||
|
||||
@@ -216,7 +216,7 @@ func TestReadMessages_GroupMessage(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestReadMessages_SessionExpired(t *testing.T) {
|
||||
func TestReadMessages_SessionRejected(t *testing.T) {
|
||||
t.Parallel()
|
||||
srv := newJSONServer(t, nil, func(req recordedReq) handlerResult {
|
||||
if req.path != "/ilink/bot/getupdates" {
|
||||
@@ -237,11 +237,11 @@ func TestReadMessages_SessionExpired(t *testing.T) {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
cancel()
|
||||
t.Fatal("ReadMessages did not stop on session expired")
|
||||
t.Fatal("ReadMessages did not stop on a session iLink rejected")
|
||||
}
|
||||
cancel()
|
||||
if ad.IsConnected() {
|
||||
t.Fatal("IsConnected() = true after session expired")
|
||||
t.Fatal("IsConnected() = true after iLink rejected the session")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -73,13 +73,12 @@ func (a *Adapter) SendProactive(ctx context.Context, msg adapter.UnifiedMessage)
|
||||
return a.sendToOne(ctx, peer, msg)
|
||||
}
|
||||
|
||||
// sendGuard reports the error a send must surface before touching the network: an
|
||||
// expired session (iLink already refused this token with errcode=-14) reads as
|
||||
// ErrSessionExpired — the owner must re-scan — while any other down session stays
|
||||
// ErrNotConnected.
|
||||
// sendGuard reports the error a send must surface before touching the network: a
|
||||
// session iLink already rejected (errcode=-14) reads as ErrSessionRejected — the
|
||||
// owner must re-scan — while any other down session stays ErrNotConnected.
|
||||
func (a *Adapter) sendGuard() error {
|
||||
if expired, reason := a.expiredState(); expired {
|
||||
return fmt.Errorf("weixin_ilink: send: %w: %s", ErrSessionExpired, reason)
|
||||
if rejected, reason := a.rejectedState(); rejected {
|
||||
return fmt.Errorf("weixin_ilink: send: %w: %s", ErrSessionRejected, reason)
|
||||
}
|
||||
if !a.IsConnected() {
|
||||
return adapter.ErrNotConnected
|
||||
@@ -165,12 +164,12 @@ func (a *Adapter) sendNative(ctx context.Context, peer, ctxToken string, items [
|
||||
bytes.NewReader(body), &out); err != nil {
|
||||
return fmt.Errorf("weixin_ilink: sendmessage: %w", err)
|
||||
}
|
||||
if out.Errcode == errSessionExpired {
|
||||
// The send path sees the same dead token as the poll path: record the
|
||||
// expired state so the adapter stops claiming a live session and the panel
|
||||
// can ask for a re-scan.
|
||||
a.markExpired(rescanReasonSendMessage)
|
||||
return ErrSessionExpired
|
||||
if out.Errcode == errcodeSessionRejected {
|
||||
// The send path sees the same rejected credential as the poll path: record
|
||||
// the rejected state so the adapter stops claiming a live session and the
|
||||
// panel can ask for a re-scan.
|
||||
a.markRejected(rescanReasonSendMessage)
|
||||
return ErrSessionRejected
|
||||
}
|
||||
if out.Ret != 0 {
|
||||
return fmt.Errorf("weixin_ilink: sendmessage ret=%d", out.Ret)
|
||||
@@ -190,11 +189,11 @@ func (a *Adapter) getUploadURL(ctx context.Context) (string, error) {
|
||||
bytes.NewReader(body), &raw); err != nil {
|
||||
return "", fmt.Errorf("weixin_ilink: getuploadurl: %w", err)
|
||||
}
|
||||
if intOf(raw["errcode"]) == errSessionExpired {
|
||||
// Media upload is part of the send path, so the same dead token is recorded
|
||||
// here too rather than degrading into "no url returned".
|
||||
a.markExpired(rescanReasonUploadURL)
|
||||
return "", ErrSessionExpired
|
||||
if intOf(raw["errcode"]) == errcodeSessionRejected {
|
||||
// Media upload is part of the send path, so the same rejected credential is
|
||||
// recorded here too rather than degrading into "no url returned".
|
||||
a.markRejected(rescanReasonUploadURL)
|
||||
return "", ErrSessionRejected
|
||||
}
|
||||
u := firstString(raw, "upload_url", "url", "uploadUrl", "cdn_url")
|
||||
if u == "" {
|
||||
|
||||
@@ -1,82 +1,89 @@
|
||||
package weixin_ilink
|
||||
|
||||
// This file holds the adapter's session-expiry state machine (design/08 §4-§5).
|
||||
// This file holds the adapter's session-rejection state machine (design/08 §4-§5).
|
||||
//
|
||||
// iLink answers errcode=-14 when the bot token is no longer valid. That is not a
|
||||
// transient failure the read loop can retry away: the token is dead until the
|
||||
// owner scans a fresh QR code. The adapter therefore keeps an EXPLICIT expired
|
||||
// flag instead of silently dropping the connection, so:
|
||||
// iLink answers errcode=-14 when it rejects or invalidates the session credential.
|
||||
// The bot token is a LONG-LIVED credential — a token obtained by scanning a month
|
||||
// ago still works — so -14 is NOT a time-based expiry: it means iLink no longer
|
||||
// accepts this session (unbound, re-logged-in elsewhere, a protocol-level refusal).
|
||||
// It is worth recording that no log has ever actually shown -14; the earlier
|
||||
// reading of it as a time-based expiry was an inference, not an observation.
|
||||
//
|
||||
// Either way it is not a transient failure the read loop can retry away: the same
|
||||
// credential keeps being refused until the owner scans a fresh QR code. The adapter
|
||||
// therefore keeps an EXPLICIT rejected flag instead of silently dropping the
|
||||
// connection, so:
|
||||
//
|
||||
// - the read loop cannot exit and leave the adapter quietly mute while still
|
||||
// reporting "connected" (the "过期后静默变哑" defect);
|
||||
// - Connect/HealthCheck/send surface ErrSessionExpired — "re-scan required" —
|
||||
// reporting "connected" (the "credential rejected → silently mute" defect);
|
||||
// - Connect/HealthCheck/send surface ErrSessionRejected — "re-scan required" —
|
||||
// rather than a fake OK or a generic "not connected";
|
||||
// - the admin panel can read RescanRequired() and show 需要重新扫码 (see
|
||||
// internal/services/gateway/admin.go).
|
||||
//
|
||||
// Lifecycle (set once, cleared on a usable credential):
|
||||
//
|
||||
// SET markExpired iLink returned errcode=-14 on getupdates,
|
||||
// SET markRejected iLink returned errcode=-14 on getupdates,
|
||||
// sendmessage or getuploadurl.
|
||||
// CLEAR clearRescanLocked a scan-code login delivered a new bot_token
|
||||
// (completeLogin), or
|
||||
// expiredLocked saw a bot_token different from the one
|
||||
// rejectedLocked saw a bot_token different from the one
|
||||
// iLink rejected — a config change / hot reload that
|
||||
// supplied a fresh token.
|
||||
|
||||
// Rescan reasons recorded on the expired state. They are short, human-readable
|
||||
// Rescan reasons recorded on the rejected state. They are short, human-readable
|
||||
// and carry no credential: the bot token itself never leaves cfg.
|
||||
const (
|
||||
rescanReasonGetUpdates = "iLink getupdates 返回 errcode=-14（bot token 已过期）"
|
||||
rescanReasonSendMessage = "iLink sendmessage 返回 errcode=-14（bot token 已过期）"
|
||||
rescanReasonUploadURL = "iLink getuploadurl 返回 errcode=-14（bot token 已过期）"
|
||||
rescanReasonGetUpdates = "iLink getupdates 返回 errcode=-14（本次会话已被 iLink 拒绝）"
|
||||
rescanReasonSendMessage = "iLink sendmessage 返回 errcode=-14（本次会话已被 iLink 拒绝）"
|
||||
rescanReasonUploadURL = "iLink getuploadurl 返回 errcode=-14（本次会话已被 iLink 拒绝）"
|
||||
)
|
||||
|
||||
// markExpired records that iLink rejected the current bot token (errcode=-14).
|
||||
// It drops the connected flag so IsConnected can never keep claiming a live
|
||||
// session for a dead token, and logs the transition at ERROR level exactly once
|
||||
// (a failing poll loop or a repeated send must not flood the log). Only the
|
||||
// non-secret bot_id and the reason are logged.
|
||||
func (a *Adapter) markExpired(reason string) {
|
||||
// markRejected records that iLink rejected the current session credential
|
||||
// (errcode=-14). It drops the connected flag so IsConnected can never keep claiming
|
||||
// a live session for a rejected credential, and logs the transition at ERROR level
|
||||
// exactly once (a failing poll loop or a repeated send must not flood the log). Only
|
||||
// the non-secret bot_id and the reason are logged.
|
||||
func (a *Adapter) markRejected(reason string) {
|
||||
a.mu.Lock()
|
||||
first := !a.expired
|
||||
a.expired = true
|
||||
a.expiredToken = a.cfg.BotToken
|
||||
first := !a.rejected
|
||||
a.rejected = true
|
||||
a.rejectedToken = a.cfg.BotToken
|
||||
a.rescanDetail = reason
|
||||
a.connected = false
|
||||
botID := a.cfg.BotID
|
||||
a.mu.Unlock()
|
||||
|
||||
if first {
|
||||
a.log.Error("ilink session expired: 需要重新扫码登录（请用「扫码登录」重新绑定）",
|
||||
"bot_id", botID, "errcode", errSessionExpired, "reason", reason)
|
||||
a.log.Error("ilink session rejected（errcode=-14）：本次会话已被 iLink 拒绝，需要重新扫码绑定（请用「扫码登录」）",
|
||||
"bot_id", botID, "errcode", errcodeSessionRejected, "reason", reason)
|
||||
}
|
||||
}
|
||||
|
||||
// clearRescanLocked drops the expired state. Callers must hold a.mu.
|
||||
// clearRescanLocked drops the rejected state. Callers must hold a.mu.
|
||||
func (a *Adapter) clearRescanLocked() {
|
||||
a.expired = false
|
||||
a.expiredToken = ""
|
||||
a.rejected = false
|
||||
a.rejectedToken = ""
|
||||
a.rescanDetail = ""
|
||||
}
|
||||
|
||||
// expiredLocked reports whether the session is expired. It first clears the state
|
||||
// when the configured bot_token is no longer the one iLink rejected, so a fresh
|
||||
// token (scan login, operator config change, hot reload) restores the session
|
||||
// rejectedLocked reports whether iLink rejected the session. It first clears the
|
||||
// state when the configured bot_token is no longer the one iLink rejected, so a
|
||||
// fresh token (scan login, operator config change, hot reload) restores the session
|
||||
// without extra bookkeeping. Callers must hold a.mu.
|
||||
func (a *Adapter) expiredLocked() bool {
|
||||
if a.expired && a.expiredToken != a.cfg.BotToken {
|
||||
func (a *Adapter) rejectedLocked() bool {
|
||||
if a.rejected && a.rejectedToken != a.cfg.BotToken {
|
||||
a.clearRescanLocked()
|
||||
}
|
||||
return a.expired
|
||||
return a.rejected
|
||||
}
|
||||
|
||||
// expiredState reports the expired flag together with the rescan reason in one
|
||||
// lock acquisition. reason is "" when the session is not expired.
|
||||
func (a *Adapter) expiredState() (bool, string) {
|
||||
// rejectedState reports the rejected flag together with the rescan reason in one
|
||||
// lock acquisition. reason is "" when the session has not been rejected.
|
||||
func (a *Adapter) rejectedState() (bool, string) {
|
||||
a.mu.Lock()
|
||||
defer a.mu.Unlock()
|
||||
if !a.expiredLocked() {
|
||||
if !a.rejectedLocked() {
|
||||
return false, ""
|
||||
}
|
||||
return true, a.rescanDetail
|
||||
@@ -88,5 +95,5 @@ func (a *Adapter) expiredState() (bool, string) {
|
||||
// human-readable reason (never a secret). A healthy adapter reports false with an
|
||||
// empty reason.
|
||||
func (a *Adapter) RescanRequired() (bool, string) {
|
||||
return a.expiredState()
|
||||
return a.rejectedState()
|
||||
}
|
||||
@@ -11,26 +11,27 @@ import (
|
||||
"git.yeij.top/AskaEth/Cyrene_v2/internal/channel/adapter"
|
||||
)
|
||||
|
||||
// These tests cover the explicit session-expiry state machine (session_state.go):
|
||||
// These tests cover the explicit session-rejection state machine (session_state.go):
|
||||
// iLink answering errcode=-14 must be visible as "re-scan required" instead of a
|
||||
// silently mute adapter or a connect that reports success with a dead token.
|
||||
// silently mute adapter or a connect that reports success with a credential iLink
|
||||
// already refused.
|
||||
|
||||
// expiringServer answers every getupdates long poll with the expired-session
|
||||
// errcode, the way iLink reports a dead bot token.
|
||||
func expiringServer(t *testing.T) *httptest.Server {
|
||||
// rejectingServer answers every getupdates long poll with the rejected-session
|
||||
// errcode, the way iLink refuses a session credential.
|
||||
func rejectingServer(t *testing.T) *httptest.Server {
|
||||
t.Helper()
|
||||
return newJSONServer(t, nil, func(req recordedReq) handlerResult {
|
||||
if req.path != "/ilink/bot/getupdates" {
|
||||
return handlerResult{status: 404}
|
||||
}
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errSessionExpired})}
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errcodeSessionRejected})}
|
||||
})
|
||||
}
|
||||
|
||||
// expireByPoll drives the adapter into the expired state through the long poll:
|
||||
// rejectByPoll drives the adapter into the rejected state through the long poll:
|
||||
// ReadMessages must return on errcode=-14 and the adapter must report the
|
||||
// rescan-required state.
|
||||
func expireByPoll(t *testing.T, ad *Adapter) {
|
||||
func rejectByPoll(t *testing.T, ad *Adapter) {
|
||||
t.Helper()
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
@@ -43,22 +44,23 @@ func expireByPoll(t *testing.T, ad *Adapter) {
|
||||
}
|
||||
}
|
||||
|
||||
// newExpiredByPollAdapter builds a connected adapter and expires it via the poll
|
||||
// path.
|
||||
func newExpiredByPollAdapter(t *testing.T, srv *httptest.Server) *Adapter {
|
||||
// newRejectedByPollAdapter builds a connected adapter and drives it into the
|
||||
// rejected state via the poll path.
|
||||
func newRejectedByPollAdapter(t *testing.T, srv *httptest.Server) *Adapter {
|
||||
t.Helper()
|
||||
ad := newConnectedAdapter(t, Config{BaseURL: srv.URL, PollInterval: time.Millisecond, BotToken: "tok-old"}, srv)
|
||||
expireByPoll(t, ad)
|
||||
rejectByPoll(t, ad)
|
||||
return ad
|
||||
}
|
||||
|
||||
// assertExpiredSession asserts the observable contract of an expired session: not
|
||||
// connected, rescan required with a reason, HealthCheck distinguishing expired from
|
||||
// not-connected, and Connect refusing with ErrSessionExpired instead of a fake OK.
|
||||
func assertExpiredSession(t *testing.T, ad *Adapter) {
|
||||
// assertRejectedSession asserts the observable contract of a session iLink rejected:
|
||||
// not connected, rescan required with a reason, HealthCheck distinguishing the
|
||||
// rejected state from not-connected, and Connect refusing with ErrSessionRejected
|
||||
// instead of a fake OK.
|
||||
func assertRejectedSession(t *testing.T, ad *Adapter) {
|
||||
t.Helper()
|
||||
if ad.IsConnected() {
|
||||
t.Fatal("IsConnected() = true while the session is expired")
|
||||
t.Fatal("IsConnected() = true while iLink rejects the session")
|
||||
}
|
||||
required, reason := ad.RescanRequired()
|
||||
if !required {
|
||||
@@ -69,40 +71,40 @@ func assertExpiredSession(t *testing.T, ad *Adapter) {
|
||||
}
|
||||
|
||||
herr := ad.HealthCheck(context.Background())
|
||||
if !errors.Is(herr, ErrSessionExpired) {
|
||||
t.Fatalf("HealthCheck() = %v, want ErrSessionExpired", herr)
|
||||
if !errors.Is(herr, ErrSessionRejected) {
|
||||
t.Fatalf("HealthCheck() = %v, want ErrSessionRejected", herr)
|
||||
}
|
||||
if errors.Is(herr, adapter.ErrNotConnected) {
|
||||
t.Fatal("HealthCheck() also matches ErrNotConnected, want expired to be distinguishable")
|
||||
t.Fatal("HealthCheck() also matches ErrNotConnected, want the rejected state to be distinguishable")
|
||||
}
|
||||
|
||||
cerr := ad.Connect(context.Background())
|
||||
if cerr == nil {
|
||||
t.Fatal("Connect() = nil on an expired session, want ErrSessionExpired (no fake OK)")
|
||||
t.Fatal("Connect() = nil on a rejected session, want ErrSessionRejected (no fake OK)")
|
||||
}
|
||||
if !errors.Is(cerr, ErrSessionExpired) {
|
||||
t.Fatalf("Connect() = %v, want ErrSessionExpired", cerr)
|
||||
if !errors.Is(cerr, ErrSessionRejected) {
|
||||
t.Fatalf("Connect() = %v, want ErrSessionRejected", cerr)
|
||||
}
|
||||
if errors.Is(cerr, ErrNeedsLogin) {
|
||||
t.Fatal("Connect() = ErrNeedsLogin, want ErrSessionExpired (expired is not 'unconfigured')")
|
||||
t.Fatal("Connect() = ErrNeedsLogin, want ErrSessionRejected (a rejected session is not 'unconfigured')")
|
||||
}
|
||||
if ad.IsConnected() {
|
||||
t.Fatal("IsConnected() = true after a refused Connect on an expired session")
|
||||
t.Fatal("IsConnected() = true after a refused Connect on a rejected session")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSessionExpired_PollMarksRescanAndRefusesConnect(t *testing.T) {
|
||||
func TestSessionRejected_PollMarksRescanAndRefusesConnect(t *testing.T) {
|
||||
t.Parallel()
|
||||
srv := expiringServer(t)
|
||||
ad := newExpiredByPollAdapter(t, srv)
|
||||
assertExpiredSession(t, ad)
|
||||
srv := rejectingServer(t)
|
||||
ad := newRejectedByPollAdapter(t, srv)
|
||||
assertRejectedSession(t, ad)
|
||||
}
|
||||
|
||||
func TestSessionExpired_SendMarksRescan(t *testing.T) {
|
||||
func TestSessionRejected_SendMarksRescan(t *testing.T) {
|
||||
t.Parallel()
|
||||
srv := newJSONServer(t, nil, func(req recordedReq) handlerResult {
|
||||
if req.method == http.MethodPost && req.path == "/ilink/bot/sendmessage" {
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errSessionExpired})}
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errcodeSessionRejected})}
|
||||
}
|
||||
return handlerResult{status: 404}
|
||||
})
|
||||
@@ -112,33 +114,33 @@ func TestSessionExpired_SendMarksRescan(t *testing.T) {
|
||||
err := ad.SendMessage(context.Background(), adapter.UnifiedResponse{
|
||||
Messages: []adapter.UnifiedMessage{{SenderID: "u-1", Content: "hi"}},
|
||||
})
|
||||
if !errors.Is(err, ErrSessionExpired) {
|
||||
t.Fatalf("SendMessage() = %v, want ErrSessionExpired", err)
|
||||
if !errors.Is(err, ErrSessionRejected) {
|
||||
t.Fatalf("SendMessage() = %v, want ErrSessionRejected", err)
|
||||
}
|
||||
if ad.IsConnected() {
|
||||
t.Fatal("IsConnected() = true after a send saw errcode=-14")
|
||||
}
|
||||
// A later send reports the expired session itself, not a bare "not connected".
|
||||
// A later send reports the rejected session itself, not a bare "not connected".
|
||||
err = ad.SendMessage(context.Background(), adapter.UnifiedResponse{
|
||||
Messages: []adapter.UnifiedMessage{{SenderID: "u-1", Content: "again"}},
|
||||
})
|
||||
if !errors.Is(err, ErrSessionExpired) {
|
||||
t.Fatalf("second SendMessage() = %v, want ErrSessionExpired", err)
|
||||
if !errors.Is(err, ErrSessionRejected) {
|
||||
t.Fatalf("second SendMessage() = %v, want ErrSessionRejected", err)
|
||||
}
|
||||
perr := ad.SendProactive(context.Background(), adapter.UnifiedMessage{SenderID: "u-1", Content: "push"})
|
||||
if !errors.Is(perr, ErrSessionExpired) {
|
||||
t.Fatalf("SendProactive() = %v, want ErrSessionExpired", perr)
|
||||
if !errors.Is(perr, ErrSessionRejected) {
|
||||
t.Fatalf("SendProactive() = %v, want ErrSessionRejected", perr)
|
||||
}
|
||||
assertExpiredSession(t, ad)
|
||||
assertRejectedSession(t, ad)
|
||||
}
|
||||
|
||||
func TestSessionExpired_ClearedByScanLogin(t *testing.T) {
|
||||
func TestSessionRejected_ClearedByScanLogin(t *testing.T) {
|
||||
t.Parallel()
|
||||
rec := &reqRecorder{}
|
||||
srv := newJSONServer(t, rec, func(req recordedReq) handlerResult {
|
||||
switch req.path {
|
||||
case "/ilink/bot/getupdates":
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errSessionExpired})}
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errcodeSessionRejected})}
|
||||
case "/ilink/bot/get_bot_qrcode":
|
||||
return handlerResult{body: jsonBody(map[string]any{
|
||||
"qrcode": "qr-re", "qrcode_img_content": "https://img/qr",
|
||||
@@ -151,20 +153,20 @@ func TestSessionExpired_ClearedByScanLogin(t *testing.T) {
|
||||
}
|
||||
return handlerResult{status: 404}
|
||||
})
|
||||
ad := newExpiredByPollAdapter(t, srv)
|
||||
assertExpiredSession(t, ad)
|
||||
ad := newRejectedByPollAdapter(t, srv)
|
||||
assertRejectedSession(t, ad)
|
||||
|
||||
// An expired token must not short-circuit the scan flow: it is not a usable
|
||||
// A rejected token must not short-circuit the scan flow: it is not a usable
|
||||
// bind, and ErrAlreadyLoggedIn would leave the owner no way back.
|
||||
qr, err := ad.StartLogin(context.Background())
|
||||
if err != nil {
|
||||
t.Fatalf("StartLogin() on an expired session = %v, want a fresh QR", err)
|
||||
t.Fatalf("StartLogin() on a rejected session = %v, want a fresh QR", err)
|
||||
}
|
||||
if qr.Qrcode != "qr-re" {
|
||||
t.Fatalf("StartLogin() qrcode = %q, want qr-re", qr.Qrcode)
|
||||
}
|
||||
|
||||
// The confirmed scan delivers a new token: the expired state must clear.
|
||||
// The confirmed scan delivers a new token: the rejected state must clear.
|
||||
waitFor(t, func() bool { ok, _ := ad.RescanRequired(); return !ok })
|
||||
if err := ad.Connect(context.Background()); err != nil {
|
||||
t.Fatalf("Connect() after re-scan = %v, want nil", err)
|
||||
@@ -182,7 +184,7 @@ func TestSessionExpired_ClearedByScanLogin(t *testing.T) {
|
||||
t.Fatalf("LoginStatus() = %q, want confirmed after a successful re-scan", status)
|
||||
}
|
||||
|
||||
// The re-scan asked for a real rebind: the dead token is not advertised as a
|
||||
// The re-scan asked for a real rebind: the rejected token is not advertised as a
|
||||
// local token (that is what invites binded_redirect with no new credentials).
|
||||
reqs := rec.find(func(q recordedReq) bool { return q.path == "/ilink/bot/get_bot_qrcode" })
|
||||
if len(reqs) != 1 {
|
||||
@@ -195,17 +197,17 @@ func TestSessionExpired_ClearedByScanLogin(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestSessionExpired_ClearedByNewToken(t *testing.T) {
|
||||
func TestSessionRejected_ClearedByNewToken(t *testing.T) {
|
||||
t.Parallel()
|
||||
srv := expiringServer(t)
|
||||
ad := newExpiredByPollAdapter(t, srv)
|
||||
srv := rejectingServer(t)
|
||||
ad := newRejectedByPollAdapter(t, srv)
|
||||
|
||||
// The rejected token is still configured: the session stays expired.
|
||||
if err := ad.Connect(context.Background()); !errors.Is(err, ErrSessionExpired) {
|
||||
t.Fatalf("Connect() = %v, want ErrSessionExpired while the rejected token is unchanged", err)
|
||||
// The rejected token is still configured: the session stays rejected.
|
||||
if err := ad.Connect(context.Background()); !errors.Is(err, ErrSessionRejected) {
|
||||
t.Fatalf("Connect() = %v, want ErrSessionRejected while the rejected token is unchanged", err)
|
||||
}
|
||||
if err := ad.HealthCheck(context.Background()); !errors.Is(err, ErrSessionExpired) {
|
||||
t.Fatalf("HealthCheck() = %v, want ErrSessionExpired while the rejected token is unchanged", err)
|
||||
if err := ad.HealthCheck(context.Background()); !errors.Is(err, ErrSessionRejected) {
|
||||
t.Fatalf("HealthCheck() = %v, want ErrSessionRejected while the rejected token is unchanged", err)
|
||||
}
|
||||
|
||||
setBotToken(ad, "tok-fresh")
|
||||
@@ -223,12 +225,12 @@ func TestSessionExpired_ClearedByNewToken(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestSessionExpired_LoginStatusReportsRescanAndAllowsRescan(t *testing.T) {
|
||||
func TestSessionRejected_LoginStatusReportsRescanAndAllowsRescan(t *testing.T) {
|
||||
t.Parallel()
|
||||
srv := newJSONServer(t, nil, func(req recordedReq) handlerResult {
|
||||
switch req.path {
|
||||
case "/ilink/bot/getupdates":
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errSessionExpired})}
|
||||
return handlerResult{body: jsonBody(map[string]any{"errcode": errcodeSessionRejected})}
|
||||
case "/ilink/bot/get_bot_qrcode":
|
||||
return handlerResult{body: jsonBody(map[string]any{
|
||||
"qrcode": "qr-2", "qrcode_img_content": "https://img/qr2",
|
||||
@@ -241,13 +243,13 @@ func TestSessionExpired_LoginStatusReportsRescanAndAllowsRescan(t *testing.T) {
|
||||
LoginInterval: time.Millisecond, LoginTimeout: 30 * time.Millisecond,
|
||||
BotToken: "tok-old",
|
||||
}, srv)
|
||||
expireByPoll(t, ad)
|
||||
rejectByPoll(t, ad)
|
||||
|
||||
// A dead token must not read as "confirmed": the panel would re-persist it and
|
||||
// call the bind a success.
|
||||
// A rejected credential must not read as "confirmed": the panel would re-persist
|
||||
// it and call the bind a success.
|
||||
status, detail := ad.LoginStatus(context.Background())
|
||||
if status != LoginStatusFailed {
|
||||
t.Fatalf("LoginStatus() = %q, want failed while the stored token is expired", status)
|
||||
t.Fatalf("LoginStatus() = %q, want failed while iLink rejects the stored token", status)
|
||||
}
|
||||
if detail == "" {
|
||||
t.Fatal("LoginStatus() detail is empty, want the re-scan reason")
|
||||
@@ -262,7 +264,7 @@ func TestSessionExpired_LoginStatusReportsRescanAndAllowsRescan(t *testing.T) {
|
||||
if qr.Qrcode != "qr-2" {
|
||||
t.Fatalf("StartLogin() qrcode = %q, want qr-2", qr.Qrcode)
|
||||
}
|
||||
// While the re-scan is in progress its own state is reported, not the expired one.
|
||||
// While the re-scan is in progress its own state is reported, not the rejected one.
|
||||
if status, _ := ad.LoginStatus(context.Background()); status != LoginStatusWaiting {
|
||||
t.Fatalf("LoginStatus() during the re-scan = %q, want waiting", status)
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user