293 lines
6.8 KiB
Go
293 lines
6.8 KiB
Go
package demote
|
||
|
||
import (
|
||
"bytes"
|
||
"encoding/base64"
|
||
"encoding/json"
|
||
"fmt"
|
||
"net/http"
|
||
"strings"
|
||
|
||
"codex-pool/internal/client"
|
||
)
|
||
|
||
// DemoteRequest 降级请求
|
||
type DemoteRequest struct {
|
||
AccessToken string `json:"access_token"` // JWT Token 或完整的 session JSON
|
||
AccountID string `json:"account_id"` // 可选，Team ID
|
||
Role string `json:"role"` // 目标角色: standard-user 或 account-admin
|
||
Proxy string `json:"proxy"` // 可选，代理
|
||
}
|
||
|
||
// DemoteResult 降级结果
|
||
type DemoteResult struct {
|
||
Success bool `json:"success"`
|
||
Email string `json:"email,omitempty"`
|
||
OriginalRole string `json:"original_role,omitempty"`
|
||
NewRole string `json:"new_role,omitempty"`
|
||
Message string `json:"message,omitempty"`
|
||
Error string `json:"error,omitempty"`
|
||
}
|
||
|
||
// SessionData ChatGPT session 数据结构
|
||
type SessionData struct {
|
||
AccessToken string `json:"accessToken"`
|
||
User struct {
|
||
ID string `json:"id"`
|
||
Email string `json:"email"`
|
||
} `json:"user"`
|
||
Account struct {
|
||
ID string `json:"id"`
|
||
} `json:"account"`
|
||
}
|
||
|
||
// JWTPayload JWT 解析结构
|
||
type JWTPayload struct {
|
||
Auth struct {
|
||
AccountUserID string `json:"chatgpt_account_user_id"`
|
||
} `json:"https://api.openai.com/auth"`
|
||
Profile struct {
|
||
Email string `json:"email"`
|
||
} `json:"https://api.openai.com/profile"`
|
||
}
|
||
|
||
// decodeJWTPayload 解码 JWT 的 payload 部分
|
||
func decodeJWTPayload(token string) (*JWTPayload, error) {
|
||
parts := strings.Split(token, ".")
|
||
if len(parts) != 3 {
|
||
return nil, fmt.Errorf("invalid JWT format")
|
||
}
|
||
|
||
payload := parts[1]
|
||
// 补齐 base64 padding
|
||
if m := len(payload) % 4; m != 0 {
|
||
payload += strings.Repeat("=", 4-m)
|
||
}
|
||
|
||
decoded, err := base64.URLEncoding.DecodeString(payload)
|
||
if err != nil {
|
||
// 尝试标准 base64
|
||
decoded, err = base64.StdEncoding.DecodeString(payload)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("failed to decode JWT payload: %v", err)
|
||
}
|
||
}
|
||
|
||
var result JWTPayload
|
||
if err := json.Unmarshal(decoded, &result); err != nil {
|
||
return nil, fmt.Errorf("failed to parse JWT payload: %v", err)
|
||
}
|
||
|
||
return &result, nil
|
||
}
|
||
|
||
// extractUserInfo 从 Token 和 Session 中提取用户信息
|
||
func extractUserInfo(token string, session *SessionData) (userID, accountID, email string) {
|
||
// 优先从 session 获取（更准确）
|
||
if session != nil {
|
||
if session.User.ID != "" {
|
||
userID = session.User.ID
|
||
}
|
||
if session.Account.ID != "" {
|
||
accountID = session.Account.ID
|
||
}
|
||
if session.User.Email != "" {
|
||
email = session.User.Email
|
||
}
|
||
|
||
// 如果已经获取到必要信息，直接返回
|
||
if userID != "" && accountID != "" {
|
||
return
|
||
}
|
||
}
|
||
|
||
// 备选：从 JWT 解析
|
||
payload, err := decodeJWTPayload(token)
|
||
if err != nil {
|
||
return
|
||
}
|
||
|
||
// 解析 chatgpt_account_user_id，格式可能是 user-xxx__account-id
|
||
accountUserID := payload.Auth.AccountUserID
|
||
if accountUserID != "" {
|
||
if strings.Contains(accountUserID, "__") {
|
||
parts := strings.Split(accountUserID, "__")
|
||
if userID == "" {
|
||
userID = parts[0]
|
||
}
|
||
if accountID == "" && len(parts) > 1 {
|
||
accountID = parts[1]
|
||
}
|
||
} else if userID == "" {
|
||
userID = accountUserID
|
||
}
|
||
}
|
||
|
||
if email == "" {
|
||
email = payload.Profile.Email
|
||
}
|
||
|
||
return
|
||
}
|
||
|
||
// DemoteOwner 执行 Owner 降级
|
||
func DemoteOwner(req DemoteRequest) *DemoteResult {
|
||
// 验证角色
|
||
validRoles := map[string]bool{
|
||
"standard-user": true,
|
||
"account-admin": true,
|
||
}
|
||
if !validRoles[req.Role] {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Error: "无效的角色，必须是 standard-user 或 account-admin",
|
||
}
|
||
}
|
||
|
||
accessToken := strings.TrimSpace(req.AccessToken)
|
||
var session *SessionData
|
||
|
||
// 检测是否是完整的 session JSON
|
||
if strings.HasPrefix(accessToken, "{") {
|
||
if err := json.Unmarshal([]byte(accessToken), &session); err != nil {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Error: "无法解析 session JSON: " + err.Error(),
|
||
}
|
||
}
|
||
accessToken = session.AccessToken
|
||
if accessToken == "" {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Error: "session JSON 中没有 accessToken",
|
||
}
|
||
}
|
||
}
|
||
|
||
// 提取用户信息
|
||
userID, accountID, email := extractUserInfo(accessToken, session)
|
||
|
||
// 如果请求中指定了 account_id，优先使用
|
||
if req.AccountID != "" {
|
||
accountID = req.AccountID
|
||
}
|
||
|
||
if userID == "" {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Error: "无法获取 user_id，请提供完整的 session JSON",
|
||
}
|
||
}
|
||
if accountID == "" {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Error: "无法获取 account_id，请提供完整的 session JSON 或指定 account_id",
|
||
}
|
||
}
|
||
|
||
// 创建 TLS 客户端
|
||
var tlsClient *client.TLSClient
|
||
var lastErr error
|
||
|
||
// 403 重试机制 - 最多 3 次
|
||
for retry := 0; retry < 3; retry++ {
|
||
var err error
|
||
tlsClient, err = client.New(req.Proxy)
|
||
if err != nil {
|
||
lastErr = err
|
||
continue
|
||
}
|
||
|
||
// 初始化会话 - 先访问 chatgpt.com 通过 CF 验证
|
||
resp, err := tlsClient.Get("https://chatgpt.com")
|
||
if err != nil {
|
||
lastErr = err
|
||
tlsClient.Close()
|
||
continue
|
||
}
|
||
resp.Body.Close()
|
||
|
||
if resp.StatusCode == 403 {
|
||
lastErr = fmt.Errorf("Cloudflare 403")
|
||
tlsClient.Close()
|
||
continue
|
||
}
|
||
|
||
if resp.StatusCode == 200 {
|
||
lastErr = nil
|
||
break
|
||
}
|
||
|
||
lastErr = fmt.Errorf("HTTP %d", resp.StatusCode)
|
||
tlsClient.Close()
|
||
}
|
||
|
||
if lastErr != nil {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Email: email,
|
||
Error: fmt.Sprintf("初始化会话失败（已重试3次）: %v", lastErr),
|
||
}
|
||
}
|
||
defer tlsClient.Close()
|
||
|
||
// 构建降级 API 请求
|
||
apiURL := fmt.Sprintf("https://chatgpt.com/backend-api/accounts/%s/users/%s", accountID, userID)
|
||
|
||
payload := map[string]string{"role": req.Role}
|
||
jsonBody, _ := json.Marshal(payload)
|
||
|
||
patchReq, err := http.NewRequest("PATCH", apiURL, bytes.NewReader(jsonBody))
|
||
if err != nil {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Email: email,
|
||
Error: "创建请求失败: " + err.Error(),
|
||
}
|
||
}
|
||
|
||
patchReq.Header.Set("Authorization", "Bearer "+accessToken)
|
||
patchReq.Header.Set("Content-Type", "application/json")
|
||
patchReq.Header.Set("Accept", "*/*")
|
||
patchReq.Header.Set("Origin", "https://chatgpt.com")
|
||
patchReq.Header.Set("Referer", "https://chatgpt.com/")
|
||
|
||
resp, err := tlsClient.Do(patchReq)
|
||
if err != nil {
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Email: email,
|
||
Error: "请求失败: " + err.Error(),
|
||
}
|
||
}
|
||
defer resp.Body.Close()
|
||
|
||
body, _ := client.ReadBodyString(resp)
|
||
|
||
if resp.StatusCode == 200 {
|
||
roleDisplay := "普通成员"
|
||
if req.Role == "account-admin" {
|
||
roleDisplay = "管理员"
|
||
}
|
||
return &DemoteResult{
|
||
Success: true,
|
||
Email: email,
|
||
NewRole: req.Role,
|
||
Message: fmt.Sprintf("成功降级为%s", roleDisplay),
|
||
}
|
||
}
|
||
|
||
return &DemoteResult{
|
||
Success: false,
|
||
Email: email,
|
||
Error: fmt.Sprintf("HTTP %d: %s", resp.StatusCode, truncateStr(body, 200)),
|
||
}
|
||
}
|
||
|
||
func truncateStr(s string, max int) string {
|
||
if len(s) <= max {
|
||
return s
|
||
}
|
||
return s[:max] + "..."
|
||
}
|