feat(bootstrap): 支持使用AK/SK生成CLI访问令牌并重构用户创建流程

- 新增命令行参数，支持通过--access-key-id和--access-key-secret传入阿里云凭证
- 集成generateCLIAccessToken接口实现AK/SK转CLI访问令牌
- 调用BailianControl OpenAPI完成用户创建，实现与控制台用户同步
- 新增获取工作空间列表接口，解析agentId以便权限管理
- 调用ResetPolicies4Agent接口完成用户权限授权
- 优化命令步骤日志输出，更详细展示执行流程
- 将轮询次数由120次减少至20次，缩短等待激活时长
- 移除旧有测试代码，适配新实现
- core包新增bailian-control客户端支持对应OpenAPI调用
- client模块添加openApiJson通用方法支持ROA风格接口调用
- console模块导出类型扩展，涵盖新的网关目标类型
- 修改acs请求签名类型支持number类型参数，增强签名兼容性

Author: lishengzxc

packages/commands/src/commands/bootstrap/index.ts

@@ -1,17 +1,47 @@
-import { defineCommand, detectOutputFormat, BailianError, ExitCode } from "bailian-cli-core";
+import {
+  defineCommand,
+  detectOutputFormat,
+  BailianError,
+  ExitCode,
+  generateCLIAccessToken,
+  callConsoleGateway,
+  effectiveConsoleGatewayConfig,
+  createBailianControlUser,
+  listBailianControlWorkspaces,
+  resetBailianControlPolicies4Agent,
+  type ConsoleGatewayTarget,
+  type FlagsDef,
+} from "bailian-cli-core";
 import { emitResult, emitBare } from "bailian-cli-runtime";
 
 const API = {
   loginInfo: "zeldaEasy.cornerstone-portal.cs-console.loginInfo",
   initSpace: "zeldaEasy.bailian-dash-workspace.space.initSpace",
-  createUser: "zeldaEasy.bailian-dash-workspace.account.createUser",
   queryBuyResult: "zeldaEasy.bailian-commerce.bill.queryBuyPostpaidResult",
   commodityOrderInfo: "zeldaEasy.bailian-commerce.bill.postpaidCommodityOrderInfo",
   buyCommodity: "zeldaEasy.bailian-commerce.bill.buyPostpaidCommodity",
 } as const;
 
+const FLAGS = {
+  accessKeyId: {
+    type: "string",
+    valueHint: "<id>",
+    description: "Alibaba Cloud Access Key ID",
+  },
+  accessKeySecret: {
+    type: "string",
+    valueHint: "<secret>",
+    description: "Alibaba Cloud Access Key Secret",
+  },
+  securityToken: {
+    type: "string",
+    valueHint: "<token>",
+    description: "Alibaba Cloud STS Security Token (optional)",
+  },
+} satisfies FlagsDef;
+
 const POLL_INTERVAL_MS = 1000;
-const MAX_POLL_ATTEMPTS = 120;
+const MAX_POLL_ATTEMPTS = 20;
 
 function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -21,25 +51,44 @@ function extractData(resp: any): any {
   return resp?.data?.DataV2?.data?.data;
 }
 
+/**
+ * Resolve the agent id from a ListWorkspaces response. Workspaces live under
+ * `data.data`; the agent id is the workspace's `tenantId`. Prefer the default
+ * workspace (`defaultAgent`), else fall back to the first one.
+ */
+function extractAgentId(resp: any): number | undefined {
+  const workspaces = resp?.data?.data;
+  if (!Array.isArray(workspaces) || workspaces.length === 0) return undefined;
+  const chosen = workspaces.find((workspace) => workspace?.defaultAgent === true) ?? workspaces[0];
+  const tenantId = chosen?.tenantId;
+  const agentId = typeof tenantId === "string" ? Number(tenantId) : tenantId;
+  return typeof agentId === "number" && Number.isFinite(agentId) ? agentId : undefined;
+}
+
 interface CommodityItem {
   commodityCode?: string;
   status?: number;
 }
 
 export default defineCommand({
   description: "Initialize Bailian workspace and activate postpaid services",
-  auth: "console",
-  usageArgs: "",
-  flags: {},
-  exampleArgs: [],
+  auth: "none",
+  usageArgs: "--access-key-id <id> --access-key-secret <secret> [--security-token <token>]",
+  flags: FLAGS,
+  exampleArgs: ["--access-key-id LTAIxxxxx --access-key-secret xxxxx"],
   async run(ctx) {
-    const { settings } = ctx;
+    const { settings, flags } = ctx;
     const format = detectOutputFormat(settings.output);
 
     if (settings.dryRun) {
       emitResult(
         {
           apis: [
+            {
+              step: 0,
+              api: "GenerateCLIAccessToken",
+              description: "Generate CLI access token from AK/SK",
+            },
             {
               step: 1,
               api: API.loginInfo,
@@ -52,21 +101,31 @@ export default defineCommand({
             },
             {
               step: 3,
-              api: API.createUser,
-              description: "Create console account user",
+              api: "CreateUser",
+              description: "Create console user via BailianControl OpenAPI (CreateUser)",
             },
             {
               step: 4,
+              api: "ListWorkspaces",
+              description: "List workspaces to resolve agentId",
+            },
+            {
+              step: 5,
+              api: "ResetPolicies4Agent",
+              description: "Authorize user permissions",
+            },
+            {
+              step: 6,
               api: API.queryBuyResult,
               description: "Query postpaid order status",
             },
             {
-              step: 5,
+              step: 7,
               api: API.commodityOrderInfo,
               description: "Query commodity activation status",
             },
             {
-              step: 6,
+              step: 8,
               api: API.buyCommodity,
               description: "Activate postpaid commodities (if needed)",
             },
@@ -77,11 +136,42 @@ export default defineCommand({
       return;
     }
 
+    const { accessKeyId, accessKeySecret } = flags;
+    if (!accessKeyId || !accessKeySecret) {
+      throw new BailianError(
+        "bootstrap requires --access-key-id and --access-key-secret.",
+        ExitCode.USAGE,
+      );
+    }
+    const securityToken = flags.securityToken || undefined;
+
+    // Step 0: Exchange AK/SK for a temporary CLI access token used by console calls.
+    const tokenResp = await generateCLIAccessToken({
+      identity: ctx.identity,
+      settings,
+      baseUrl: ctx.client.baseUrl,
+      accessKeyId,
+      accessKeySecret,
+      securityToken,
+    });
+    const accessToken: string | undefined = tokenResp.cliAccessToken;
+    if (!accessToken) {
+      throw new BailianError("Failed to generate CLI access token from AK/SK.", ExitCode.GENERAL);
+    }
+
+    const gateway = effectiveConsoleGatewayConfig(settings);
+    const target: ConsoleGatewayTarget = {
+      region: gateway.consoleRegion,
+      site: gateway.consoleSite,
+      ...(gateway.consoleSwitchAgent != null ? { switchAgent: gateway.consoleSwitchAgent } : {}),
+      token: accessToken,
+    };
+
     const verbose = settings.verbose;
     const callApi = async (api: string, data: Record<string, unknown> = {}) => {
       if (verbose) process.stderr.write(`> ${api}\n`);
       try {
-        const resp = await ctx.client.console<any>(api, data);
+        const resp = await callConsoleGateway(target, settings.timeout, { api, data }, settings);
         if (verbose) process.stderr.write(`< ${JSON.stringify(resp)}\n`);
         return resp;
       } catch (err) {
@@ -109,20 +199,60 @@ export default defineCommand({
       emitBare("Workspace already initialized.");
     }
 
-    // Step 3: Create console user
+    // Step 3: Create console user via BailianControl OpenAPI (AK/SK signed)
     const uid = loginData?.aliyun?.uid;
     if (typeof uid !== "string" || uid.length === 0) {
       throw new BailianError("Console login info did not include aliyun.uid.", ExitCode.GENERAL);
     }
-    await callApi(API.createUser, {
-      reqDTO: {
-        outerKey: uid,
-        nickName: uid,
-        userName: uid,
-      },
+    const bailianControlAuth = {
+      identity: ctx.identity,
+      settings,
+      baseUrl: ctx.client.baseUrl,
+      regionId: gateway.consoleRegion,
+      accessKeyId,
+      accessKeySecret,
+      securityToken,
+    };
+
+    try {
+      await createBailianControlUser({
+        ...bailianControlAuth,
+        reqDTO: {
+          outerKey: uid,
+          nickName: uid,
+          userName: uid,
+        },
+      });
+    } catch (err) {
+      // Re-running bootstrap is idempotent: an already-existing user is not
+      // fatal, so swallow it and continue with the remaining steps.
+      if (!(err instanceof BailianError) || !/already exists/i.test(err.message)) {
+        throw err;
+      }
+      emitBare("Console user already exists, continuing.");
+    }
+
+    // Step 4-5: Resolve the workspace agent id, then authorize user permissions.
+    emitBare("Resolving workspace agent...");
+    const workspacesResp = await listBailianControlWorkspaces(bailianControlAuth);
+    const agentId = extractAgentId(workspacesResp);
+    if (agentId == null) {
+      throw new BailianError(
+        "Could not resolve agentId from ListWorkspaces response.",
+        ExitCode.GENERAL,
+        "Re-run with --verbose to inspect the ListWorkspaces response body.",
+      );
+    }
+
+    emitBare("Authorizing user permissions...");
+    await resetBailianControlPolicies4Agent({
+      ...bailianControlAuth,
+      outerKey: uid,
+      agentId,
+      policyIndexList: [1],
     });
 
-    // Step 4-6: Order & commodity flow
+    // Step 6-8: Order & commodity flow
     await ensureCommoditiesActive(callApi, format);
   },
 });