mirror of
https://github.com/This-weiyuqing/mi-fitness-health.git
synced 2026-10-17 18:55:37 +08:00
49 lines
2.6 KiB
Python
49 lines
2.6 KiB
Python
"""同一台本机内把已授权凭据从 Windows 密钥环传入加密容器；从不输出凭据。"""
|
|
import json
|
|
import sqlite3
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
root = Path(__file__).resolve().parents[2]
|
|
sys.path.insert(0, str(root / 'work/mi-fitness-mcp-cn/src'))
|
|
from mi_fitness_mcp.security import load_api_key_secret
|
|
|
|
with sqlite3.connect(root / 'work/local-validation/state/mi_fitness.db') as conn:
|
|
rows = conn.execute('SELECT key,user_id,region,pass_token FROM api_keys WHERE revoked=0').fetchall()
|
|
if len(rows) != 1 or rows[0][3]:
|
|
raise SystemExit('本机授权状态不符合预期，停止')
|
|
key, user, region, _ = rows[0]
|
|
token = load_api_key_secret(key)
|
|
if not token:
|
|
raise SystemExit('无法读取本机已授权凭据，停止')
|
|
code = r'''
|
|
import sys,json,sqlite3
|
|
sys.path.insert(0,'/opt/health')
|
|
import runtime
|
|
runtime.setup_credentials()
|
|
from mi_fitness_mcp.api import _create_key_record
|
|
from mi_fitness_mcp.storage import Database
|
|
from mi_fitness_mcp.security import load_api_key_secret
|
|
data=json.load(sys.stdin)
|
|
db=Database('/state/data/mi_fitness.db')
|
|
with db._get_connection() as c:
|
|
if c.execute('SELECT count(*) FROM api_keys WHERE revoked=0').fetchone()[0]:
|
|
raise SystemExit('目标不是空授权库，停止')
|
|
new_key=_create_key_record(db,data['user_id'],data['pass_token'],data['region'],'local-linux-verification')
|
|
with db._get_connection() as c:
|
|
clear=c.execute("SELECT count(*) FROM api_keys WHERE pass_token!=''").fetchone()[0]
|
|
encrypted=load_api_key_secret(new_key)==data['pass_token']
|
|
not_plain=data['pass_token'] not in open('/state/credentials/encrypted-keyring.cfg',encoding='utf-8').read()
|
|
print(json.dumps({'active_authorizations':1,'plaintext_account_token_rows':clear,'encrypted_keyring_round_trip':encrypted,'token_absent_from_keyring_plaintext':not_plain}))
|
|
if clear or not encrypted or not not_plain: raise SystemExit(1)
|
|
'''
|
|
docker = r'C:/Users/35861/AppData/Local/Programs/DockerDesktop/resources/bin/docker.exe'
|
|
result = subprocess.run([docker,'--context','desktop-linux','exec','-i','mi-fitness-production-local-backend-1','python','-c',code],input=json.dumps({'user_id':user,'pass_token':token,'region':region}),capture_output=True,text=True,encoding='utf-8',timeout=60)
|
|
if result.returncode:
|
|
# 错误输出可能包含第三方异常上下文，因此不直接转发。
|
|
raise SystemExit('容器授权导入未通过，错误内容留在进程内，未输出凭据')
|
|
report = json.loads(result.stdout)
|
|
print(json.dumps(report))
|
|
(root / 'work/deployment-tests/linux-credential-proof.json').write_text(json.dumps(report,indent=2),encoding='utf-8')
|