Canvas CLI 的 SSO 接入

SSO_API_URL=https://portal.example.com/auth/user

GET /auth/user?access_token=用户的Portal_SSO_token

{
  "id": "portal-user-001",
  "username": "alice",
  "tenantId": "tenant-a",
  "nickname": "Alice",
  "organizationIds": []
}

{
  "accessToken": "当前用户的Portal_SSO_token"
}

{
  "accessToken": "easyai_canvas_access_token",
  "accessTokenExpiresAt": "2026-09-11T04:10:00.000Z",
  "refreshToken": "cli_refresh_xxx",
  "refreshTokenExpiresAt": "2026-09-18T04:00:00.000Z",
  "sessionId": "cli_sess_xxx",
  "deviceId": "generated-device-uuid",
  "clientId": "easyai:canvas-cli",
  "scopes": ["canvas:read", "canvas:write", "canvas:execute", "canvas:collaborate"],
  "actor": {
    "kind": "agent",
    "principalUserId": "easyai-user-id",
    "name": "EasyAI Canvas Agent",
    "instanceId": "generated-device-uuid"
  },
  "user": {
    "id": "easyai-user-id",
    "username": "alice",
    "name": "Alice"
  }
}

canvasSession.accessToken
    → CLI 子进程的 EASYAI_CANVAS_ACCESS_TOKEN
    → CLI 请求头 Authorization: Bearer <canvasSession.accessToken>

EASYAI_CANVAS_BASE_URL="https://51easyai.com/api" \
EASYAI_CANVAS_ACCESS_TOKEN="兑换接口返回的画布accessToken" \
easyai-canvas project list

npm install -g @easyaigc/canvas-cli@0.5.0
easyai-canvas --version

import { execFile } from 'node:child_process';
import { promisify } from 'node:util';
import { mkdtemp, writeFile, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';

const execFileAsync = promisify(execFile);
const baseUrl = process.env.EASYAI_API_BASE_URL?.replace(/\/$/, '');
// 演示从环境变量取值；实际业务从当前用户的 Portal 服务端会话取得。
const ssoToken = process.env.PORTAL_SSO_ACCESS_TOKEN;
if (!baseUrl || !ssoToken) {
  throw new Error('请提供 EASYAI_API_BASE_URL 和 PORTAL_SSO_ACCESS_TOKEN');
}

async function post(path, body) {
  const response = await fetch(`${baseUrl}${path}`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
    signal: AbortSignal.timeout(15000),
  });
  if (!response.ok) {
    await response.body?.cancel();
    throw new Error(`EasyAI ${path} 请求失败：HTTP ${response.status}`);
  }
  return response.json();
}

let canvasSession;
let configDir;
try {
  // 1. Portal SSO token 换取这个用户的 EasyAI 画布会话。
  canvasSession = await post('/auth/client/sso', {
    accessToken: ssoToken,
    agentName: 'Portal Agent',
  });

  // 2. 隔离已有 CLI 配置，避免多用户之间混用凭证。
  configDir = await mkdtemp(join(tmpdir(), 'portal-canvas-'));
  const configFile = join(configDir, 'config.json');
  await writeFile(configFile, '{}', { mode: 0o600 });
  const cliEnv = { ...process.env };
  for (const key of Object.keys(cliEnv)) {
    if (key.startsWith('EASYAI_CANVAS_')) delete cliEnv[key];
  }
  delete cliEnv.PORTAL_SSO_ACCESS_TOKEN;

  // 3. 关键步骤：把响应里的 accessToken 交给 CLI 子进程。
  const { stdout } = await execFileAsync('easyai-canvas', ['project', 'list'], {
    env: {
      ...cliEnv,
      EASYAI_CANVAS_BASE_URL: baseUrl,
      EASYAI_CANVAS_ACCESS_TOKEN: canvasSession.accessToken,
      EASYAI_CANVAS_CONFIG: configFile,
    },
    timeout: 60000,
    maxBuffer: 10 * 1024 * 1024,
  });
  // 4. CLI 已经用 Bearer token 调用了 EasyAI，stdout 是项目列表。
  console.log(stdout);
} catch {
  // 不把包含凭证或子进程上下文的原始错误输出到业务日志。
  console.error('画布操作失败，请检查接口状态、CLI 安装和用户权限。');
  process.exitCode = 1;
} finally {
  try {
    // 5. 本示例是一次性任务，执行完主动注销会话。
    if (canvasSession) {
      await post('/auth/client/logout', {
        refreshToken: canvasSession.refreshToken,
        sessionId: canvasSession.sessionId,
        deviceId: canvasSession.deviceId,
        clientId: canvasSession.clientId,
      });
    }
  } catch {
    console.error('画布会话注销失败，Portal 需补偿处理。');
    process.exitCode = 1;
  } finally {
    if (configDir) await rm(configDir, { recursive: true, force: true });
  }
}

EASYAI_API_BASE_URL="https://你的EasyAI地址/api" \
PORTAL_SSO_ACCESS_TOKEN="当前用户的有效SSO_token" \
node portal-canvas.mjs

{
  "refreshToken": "当前refreshToken",
  "sessionId": "兑换返回的sessionId",
  "deviceId": "兑换返回的deviceId",
  "clientId": "easyai:canvas-cli"
}