Pine
96659759b0
- Agent OS：agents 决策循环、runtime 编排、providers、governance/security/sandbox - app 服务层（认证转发到 server-core）、channels 19 路频道、memory、plugins
67 lines
1.7 KiB
Python
67 lines
1.7 KiB
Python
# -*- coding: utf-8 -*-
|
|
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
import click
|
|
|
|
from ..app.auth import (
|
|
_hash_password,
|
|
_load_auth_data,
|
|
_save_auth_data,
|
|
is_auth_enabled,
|
|
)
|
|
|
|
|
|
@click.group("auth", help="Manage web authentication.")
|
|
def auth_group() -> None:
|
|
"""Manage web authentication."""
|
|
|
|
|
|
@auth_group.command("reset-password")
|
|
def reset_password_cmd() -> None:
|
|
"""Reset the password for the registered web user."""
|
|
if not is_auth_enabled():
|
|
click.echo(
|
|
"Authentication is not enabled.\n"
|
|
"Set QWENPAW_AUTH_ENABLED=true to enable it first.",
|
|
)
|
|
return
|
|
|
|
data = _load_auth_data()
|
|
|
|
if data.get("_auth_load_error"):
|
|
raise click.ClickException(
|
|
"Failed to read auth data. Check auth.json for corruption.",
|
|
)
|
|
|
|
user = data.get("user")
|
|
if not user:
|
|
click.echo("No registered user found. Nothing to reset.")
|
|
return
|
|
|
|
username = user.get("username", "<unknown>")
|
|
click.echo(f"Resetting password for user: {username}")
|
|
|
|
new_password = click.prompt(
|
|
"New password",
|
|
hide_input=True,
|
|
confirmation_prompt=True,
|
|
)
|
|
|
|
if not new_password or not new_password.strip():
|
|
raise click.ClickException("Password cannot be empty.")
|
|
|
|
pw_hash, salt = _hash_password(new_password)
|
|
data["user"]["password_hash"] = pw_hash
|
|
data["user"]["password_salt"] = salt
|
|
|
|
# Invalidate existing tokens by rotating jwt_secret
|
|
data["jwt_secret"] = secrets.token_hex(32)
|
|
|
|
_save_auth_data(data)
|
|
click.echo(
|
|
"✓ Password reset successfully. "
|
|
"All existing sessions have been invalidated.",
|
|
)
|