Add TKMind platform extensions, H5/MindSpace stack, and deployment tooling.

Fork goose with custom MCP widgets, platform extensions (aider, git, web, search),
MindSpace H5 backend/frontend, Plaza/Ops UIs, and deploy scripts for tkmind.cn.

Co-authored-by: Cursor <cursoragent@cursor.com>

ui/h5/auth.mjs

@@ -0,0 +1,117 @@
+import crypto from 'node:crypto';
+
+export const AUTH_COOKIE = 'tkmind_h5_session';
+
+export function parseCookies(header = '') {
+  return Object.fromEntries(
+    header
+      .split(';')
+      .map((part) => part.trim())
+      .filter(Boolean)
+      .map((part) => {
+        const separator = part.indexOf('=');
+        if (separator < 0) return [part, ''];
+        return [
+          decodeURIComponent(part.slice(0, separator)),
+          decodeURIComponent(part.slice(separator + 1)),
+        ];
+      }),
+  );
+}
+
+function safeEqual(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return (
+    leftBuffer.length === rightBuffer.length &&
+    crypto.timingSafeEqual(leftBuffer, rightBuffer)
+  );
+}
+
+export function createAuthManager({
+  password,
+  ttlMs = 7 * 24 * 60 * 60 * 1000,
+  maxFailures = 5,
+  failureWindowMs = 5 * 60 * 1000,
+}) {
+  if (!password) {
+    throw new Error('H5_ACCESS_PASSWORD is required');
+  }
+
+  const sessions = new Map();
+  const failures = new Map();
+
+  const prune = (now = Date.now()) => {
+    for (const [token, expiresAt] of sessions) {
+      if (expiresAt <= now) sessions.delete(token);
+    }
+    for (const [ip, state] of failures) {
+      if (state.resetAt <= now) failures.delete(ip);
+    }
+  };
+
+  const login = (candidate, ip = 'unknown', now = Date.now()) => {
+    prune(now);
+    const failure = failures.get(ip);
+    if (failure && failure.count >= maxFailures && failure.resetAt > now) {
+      return { ok: false, retryAfterMs: failure.resetAt - now };
+    }
+
+    if (!safeEqual(candidate, password)) {
+      const current =
+        failure && failure.resetAt > now
+          ? failure
+          : { count: 0, resetAt: now + failureWindowMs };
+      current.count += 1;
+      failures.set(ip, current);
+      return { ok: false, retryAfterMs: 0 };
+    }
+
+    failures.delete(ip);
+    const token = crypto.randomBytes(32).toString('base64url');
+    sessions.set(token, now + ttlMs);
+    return { ok: true, token };
+  };
+
+  const verify = (token, now = Date.now()) => {
+    if (!token) return false;
+    prune(now);
+    const expiresAt = sessions.get(token);
+    if (!expiresAt || expiresAt <= now) {
+      sessions.delete(token);
+      return false;
+    }
+    sessions.set(token, now + ttlMs);
+    return true;
+  };
+
+  const revoke = (token) => {
+    if (token) sessions.delete(token);
+  };
+
+  return { login, verify, revoke };
+}
+
+export function sessionCookie(token, secure) {
+  const parts = [
+    `${AUTH_COOKIE}=${encodeURIComponent(token)}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+    'Max-Age=604800',
+  ];
+  if (secure) parts.push('Secure');
+  return parts.join('; ');
+}
+
+export function clearSessionCookie(secure) {
+  const parts = [
+    `${AUTH_COOKIE}=`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+    'Max-Age=0',
+  ];
+  if (secure) parts.push('Secure');
+  return parts.join('; ');
+}