feat(auth): add support for optional security token in CLI access token generation

Author: lishengzxc

packages/commands/src/commands/auth/generate-access-token.ts

@@ -19,14 +19,19 @@ const FLAGS = {
     description: "Alibaba Cloud Access Key Secret",
     required: true,
   },
+  securityToken: {
+    type: "string",
+    valueHint: "<token>",
+    description: "Alibaba Cloud STS Security Token to store (optional)",
+  },
 } satisfies FlagsDef;
 
 export default defineCommand({
   description: "Generate a CLI access token using OpenAPI AK/SK",
   auth: "none",
-  usageArgs: "--access-key-id <id> --access-key-secret <secret>",
+  usageArgs: "--access-key-id <id> --access-key-secret <secret> --security-token <token>",
   flags: FLAGS,
-  exampleArgs: ["--access-key-id LTAIxxxxx --access-key-secret xxxxx"],
+  exampleArgs: ["--access-key-id LTAIxxxxx --access-key-secret xxxxx --security-token <token>"],
   async run(ctx) {
     const { identity, settings, flags } = ctx;
     const format = detectOutputFormat(settings.output);
@@ -37,6 +42,7 @@ export default defineCommand({
       baseUrl: ctx.client.baseUrl,
       accessKeyId: flags.accessKeyId,
       accessKeySecret: flags.accessKeySecret,
+      securityToken: flags.securityToken || undefined,
     });
 
     emitResult(resp, format);

packages/commands/src/commands/bootstrap/index.ts

@@ -4,9 +4,9 @@ import { emitResult, emitBare } from "bailian-cli-runtime";
 const API = {
   loginInfo: "zeldaEasy.cornerstone-portal.cs-console.loginInfo",
   initSpace: "zeldaEasy.bailian-dash-workspace.space.initSpace",
-  queryBuyResult: "zeldaEasy.broadscope-bailian.bill.queryBuyPostpaidResult",
-  commodityOrderInfo: "zeldaEasy.broadscope-bailian.bill.postpaidCommodityOrderInfo",
-  buyCommodity: "zeldaEasy.broadscope-bailian.bill.buyPostpaidCommodity",
+  queryBuyResult: "zeldaEasy.bailian-commerce.bill.queryBuyPostpaidResult",
+  commodityOrderInfo: "zeldaEasy.bailian-commerce.bill.postpaidCommodityOrderInfo",
+  buyCommodity: "zeldaEasy.bailian-commerce.bill.buyPostpaidCommodity",
 } as const;
 
 const POLL_INTERVAL_MS = 1000;
@@ -16,10 +16,13 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function extractData(resp: any): any {
+  return resp?.data?.DataV2?.data?.data;
+}
+
 interface CommodityItem {
-  commodity?: string;
+  commodityCode?: string;
   status?: number;
-  startDate?: string;
 }
 
 export default defineCommand({
@@ -36,9 +39,21 @@ export default defineCommand({
       emitResult(
         {
           apis: [
-            { step: 1, api: API.loginInfo, description: "Check login & workspace status" },
-            { step: 2, api: API.initSpace, description: "Initialize workspace (if needed)" },
-            { step: 3, api: API.queryBuyResult, description: "Query postpaid order status" },
+            {
+              step: 1,
+              api: API.loginInfo,
+              description: "Check login & workspace status",
+            },
+            {
+              step: 2,
+              api: API.initSpace,
+              description: "Initialize workspace (if needed)",
+            },
+            {
+              step: 3,
+              api: API.queryBuyResult,
+              description: "Query postpaid order status",
+            },
             {
               step: 4,
               api: API.commodityOrderInfo,
@@ -59,15 +74,21 @@ export default defineCommand({
     const verbose = settings.verbose;
     const callApi = async (api: string) => {
       if (verbose) process.stderr.write(`> ${api}\n`);
-      const resp = await ctx.client.console<any>(api, {});
-      if (verbose) process.stderr.write(`< ${JSON.stringify(resp)}\n`);
-      return resp;
+      try {
+        const resp = await ctx.client.console<any>(api, {});
+        if (verbose) process.stderr.write(`< ${JSON.stringify(resp)}\n`);
+        return resp;
+      } catch (err) {
+        if (verbose) process.stderr.write(`< ERROR: ${err instanceof Error ? err.message : err}\n`);
+        throw err;
+      }
     };
 
     // Step 1: Check login info
     emitBare("Checking workspace status...");
-    const loginInfo = await callApi(API.loginInfo);
-    const spaceInited = loginInfo?.spaceInited === true;
+    const loginResp = await callApi(API.loginInfo);
+    const loginData = extractData(loginResp);
+    const spaceInited = loginData?.spaceInited === true;
 
     // Step 2: Init space if needed
     if (!spaceInited) {
@@ -90,7 +111,8 @@ async function ensureCommoditiesActive(call: ApiCall, format: "text" | "json"):
   let buyResult: string | undefined;
   for (let i = 0; i < MAX_POLL_ATTEMPTS; i++) {
     const resp = await call(API.queryBuyResult);
-    buyResult = resp?.result;
+    const data = extractData(resp);
+    buyResult = typeof data === "string" ? data : data?.result;
     if (buyResult !== "buying") break;
     if (i === 0) emitBare("Service activation in progress, polling...");
     await sleep(POLL_INTERVAL_MS);
@@ -108,43 +130,48 @@ async function ensureCommoditiesActive(call: ApiCall, format: "text" | "json"):
   await checkAndActivateCommodities(call, format);
 }
 
+function extractCommodities(resp: any): CommodityItem[] {
+  const data = extractData(resp);
+  return Array.isArray(data) ? data : [];
+}
+
 async function checkAndActivateCommodities(call: ApiCall, format: "text" | "json"): Promise<void> {
   const resp = await call(API.commodityOrderInfo);
-  const items: CommodityItem[] = resp?.result ?? [];
+  const items = extractCommodities(resp);
 
   const overdue = items.filter((c) => c.status === 11);
   if (overdue.length > 0) {
     emitBare("Warning: Some services are overdue:");
-    for (const c of overdue) emitBare(`  - ${c.commodity}`);
+    for (const c of overdue) emitBare(`  - ${c.commodityCode}`);
   }
 
   const notActivated = items.filter((c) => c.status === 1);
   if (notActivated.length > 0) {
-    emitBare("Activating postpaid services...");
+    emitBare(`Activating ${notActivated.length} postpaid services...`);
     await call(API.buyCommodity);
     await pollCommoditiesUntilActive(call, format);
     return;
   }
 
   const active = items.filter((c) => c.status === 10);
-  emitResult({ status: "ready", activeServices: active.map((c) => c.commodity) }, format);
+  emitResult({ status: "ready", activeServices: active.map((c) => c.commodityCode) }, format);
 }
 
 async function pollCommoditiesUntilActive(call: ApiCall, format: "text" | "json"): Promise<void> {
   emitBare("Waiting for services to activate...");
   for (let i = 0; i < MAX_POLL_ATTEMPTS; i++) {
     const resp = await call(API.commodityOrderInfo);
-    const items: CommodityItem[] = resp?.result ?? [];
+    const items = extractCommodities(resp);
 
     const pending = items.filter((c) => c.status !== 10 && c.status !== 11);
     if (pending.length === 0) {
       const overdue = items.filter((c) => c.status === 11);
       if (overdue.length > 0) {
         emitBare("Warning: Some services are overdue:");
-        for (const c of overdue) emitBare(`  - ${c.commodity}`);
+        for (const c of overdue) emitBare(`  - ${c.commodityCode}`);
       }
       const active = items.filter((c) => c.status === 10);
-      emitResult({ status: "ready", activeServices: active.map((c) => c.commodity) }, format);
+      emitResult({ status: "ready", activeServices: active.map((c) => c.commodityCode) }, format);
       return;
     }
     await sleep(POLL_INTERVAL_MS);

packages/core/src/auth/refresh-token.ts

@@ -30,14 +30,15 @@ export async function generateCLIAccessToken(opts: {
   baseUrl: string;
   accessKeyId: string;
   accessKeySecret: string;
+  securityToken?: string;
 }): Promise<any> {
-  const { identity, settings, baseUrl, accessKeyId, accessKeySecret } = opts;
+  const { identity, settings, baseUrl, accessKeyId, accessKeySecret, securityToken } = opts;
 
   const client = new Client({
     identity,
     settings,
     baseUrl,
-    openApiCred: { accessKeyId, accessKeySecret, source: "flag" },
+    openApiCred: { accessKeyId, accessKeySecret, securityToken, source: "flag" },
   });
 
   const host = modelStudioHost(baseUrl);

packages/core/src/auth/resolver.ts

@@ -55,6 +55,7 @@ export function resolveOpenApi(s: ResolutionSources): OpenApiCredential {
     s.flags.accessKeyId,
     s.flags.accessKeySecret,
     s.flags.accessKeyId !== undefined || s.flags.accessKeySecret !== undefined,
+    s.flags.securityToken,
   );
   if (flagCred) return flagCred;
 
@@ -66,6 +67,7 @@ export function resolveOpenApi(s: ResolutionSources): OpenApiCredential {
       trimNonEmpty(s.env.ALIBABA_CLOUD_ACCESS_KEY_ID) ||
       trimNonEmpty(s.env.ALIBABA_CLOUD_ACCESS_KEY_SECRET),
     ),
+    s.env.ALIBABA_CLOUD_SECURITY_TOKEN,
   );
   if (envCred) return envCred;
 
@@ -74,6 +76,7 @@ export function resolveOpenApi(s: ResolutionSources): OpenApiCredential {
     s.file.access_key_id,
     s.file.access_key_secret,
     Boolean(s.file.access_key_id || s.file.access_key_secret),
+    s.file.security_token,
   );
   if (configCred) return configCred;
 
@@ -89,6 +92,7 @@ function resolveOpenApiPair(
   rawAccessKeyId: string | undefined,
   rawAccessKeySecret: string | undefined,
   provided: boolean,
+  rawSecurityToken?: string,
 ): OpenApiCredential | undefined {
   if (!provided) return undefined;
 
@@ -103,7 +107,8 @@ function resolveOpenApiPair(
     );
   }
 
-  return { accessKeyId, accessKeySecret, source };
+  const securityToken = trimNonEmpty(rawSecurityToken);
+  return { accessKeyId, accessKeySecret, securityToken, source };
 }
 
 function trimNonEmpty(value: string | undefined): string | undefined {

packages/core/src/auth/store.ts

@@ -17,6 +17,7 @@ export type AuthPersistPatch = Pick<
   | "access_token"
   | "access_key_id"
   | "access_key_secret"
+  | "security_token"
   | "base_url"
   | "console_site"
   | "console_region"

packages/core/src/auth/types.ts

@@ -22,6 +22,7 @@ export interface ConsoleCredential {
 export interface OpenApiCredential {
   accessKeyId: string;
   accessKeySecret: string;
+  securityToken?: string;
   source: CredentialSource;
 }
 

packages/core/src/client/acs.ts

@@ -5,6 +5,7 @@ export type AcsQueryParams = Record<string, string | string[] | undefined>;
 export interface AcsSignConfig {
   accessKeyId: string;
   accessKeySecret: string;
+  securityToken?: string;
   action: string;
   version: string;
   body: string;
@@ -49,6 +50,7 @@ export function signAcsRequest(cfg: AcsSignConfig): Record<string, string> {
     "x-acs-content-sha256": hashedBody,
     "content-type": "application/json",
   };
+  if (cfg.securityToken) headers["x-acs-security-token"] = cfg.securityToken;
 
   const signedHeaderKeys = Object.keys(headers)
     .filter((k) => k === "host" || k === "content-type" || k.startsWith("x-acs-"))

packages/core/src/client/client.ts

@@ -117,11 +117,15 @@ export class Client {
     if (!this.deps.consoleCred) {
       throw new BailianError("This command needs a console access token.", ExitCode.AUTH);
     }
+    const gwOpts = { api, data };
+    const { timeout } = this.deps.settings;
     try {
-      return (await callConsoleGateway(this.deps.consoleCred, this.deps.settings.timeout, {
-        api,
-        data,
-      })) as T;
+      return (await callConsoleGateway(
+        this.deps.consoleCred,
+        timeout,
+        gwOpts,
+        this.deps.settings,
+      )) as T;
     } catch (err) {
       if (
         !(err instanceof BailianError) ||
@@ -138,8 +142,9 @@ export class Client {
       if (!newToken) throw err;
       return (await callConsoleGateway(
         { ...this.deps.consoleCred, token: newToken },
-        this.deps.settings.timeout,
-        { api, data },
+        timeout,
+        gwOpts,
+        this.deps.settings,
       )) as T;
     }
   }
@@ -151,6 +156,7 @@ export class Client {
     const headers = signAcsRequest({
       accessKeyId: cred.accessKeyId,
       accessKeySecret: cred.accessKeySecret,
+      securityToken: cred.securityToken,
       action: opts.action,
       version: opts.version,
       body: "",

packages/core/src/config/schema.ts

@@ -22,6 +22,8 @@ export interface ConfigFile {
   access_key_id?: string;
   /** Alibaba Cloud OpenAPI AccessKey secret from `bl auth login --open-api`. */
   access_key_secret?: string;
+  /** Alibaba Cloud STS Security Token (optional, for temporary credentials). */
+  security_token?: string;
   base_url?: string;
   /**
    * Dedicated base URL for the intent-detect model (tongyi-intent-detect-v3).
@@ -83,6 +85,8 @@ export function parseConfigFile(raw: unknown): ConfigFile {
     obj.openapi_access_key_secret.length > 0
   )
     out.access_key_secret = obj.openapi_access_key_secret;
+  if (typeof obj.security_token === "string" && obj.security_token.length > 0)
+    out.security_token = obj.security_token;
   if (typeof obj.base_url === "string" && isHttpUrl(obj.base_url)) out.base_url = obj.base_url;
   if (typeof obj.intent_detect_base_url === "string" && isHttpUrl(obj.intent_detect_base_url))
     out.intent_detect_base_url = obj.intent_detect_base_url;

packages/core/src/console/gateway.ts

@@ -100,6 +100,7 @@ export async function callConsoleGateway(
   target: ConsoleGatewayTarget,
   timeoutSec: number,
   { api, data }: ConsoleGatewayRequest,
+  settings?: Pick<Settings, "verbose">,
 ): Promise<unknown> {
   const resolved = resolveGateway(target.region, target.site);
   const gatewayBase = `https://${resolved.csGateway}`;
@@ -115,15 +116,21 @@ export async function callConsoleGateway(
   };
   if (target.token) headers.Authorization = `Bearer ${target.token}`;
 
-  const res = await fetch(
-    `${gatewayBase}/cli/api.json?action=${action}&product=${GATEWAY_PRODUCT}&api=${encodeURIComponent(api)}`,
-    {
-      method: "POST",
-      headers,
-      body: body.toString(),
-      signal: AbortSignal.timeout(timeoutMs),
-    },
-  );
+  const endpoint = `${gatewayBase}/cli/api.json?action=${action}&product=${GATEWAY_PRODUCT}&api=${encodeURIComponent(api)}`;
+  if (settings?.verbose) {
+    process.stderr.write(`> POST ${endpoint}\n`);
+  }
+
+  const res = await fetch(endpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+
+  if (settings?.verbose) {
+    process.stderr.write(`< ${res.status} ${res.statusText}\n`);
+  }
 
   if (!res.ok) {
     const t = await res.text().catch(() => "");
@@ -135,6 +142,9 @@ export async function callConsoleGateway(
   }
 
   const json = (await res.json()) as Record<string, unknown>;
+  if (settings?.verbose) {
+    process.stderr.write(`< ${JSON.stringify(json)}\n`);
+  }
 
   const innerData = json.data as Record<string, unknown> | undefined;
   if (innerData?.success === false && innerData.errorCode) {