feat: shared API_TOKEN, qwen oauth in container, bot /getToken

ilyar · ilyar · commit 5a46c35796c2 · 2026-03-24T16:50:36.000+01:00
- Accept API_TOKEN for MCP and tunnel (apiToken query param)
- Wrap qwen-search image with oauth creds decode and qwen CLI invocation
- Pass PROD_QWEN_OAUTH_CREDS into container runs; deploy reads from env
- Add Telegram /getToken command for standalone package auth

Made-with: Cursor
diff --git a/docker/qwen-search/Dockerfile b/docker/qwen-search/Dockerfile
@@ -12,7 +12,12 @@ RUN npm install -g @qwen-code/qwen-code@latest
 
 WORKDIR /workspace
 
+# Runtime wrapper creates ~/.qwen/oauth_creds.json from env and runs qwen.
+COPY docker/qwen-search/entrypoint.sh /usr/local/bin/qwen-entrypoint
+COPY docker/qwen-search/qwen-search.sh /usr/local/bin/qwen-search
+RUN chmod +x /usr/local/bin/qwen-entrypoint /usr/local/bin/qwen-search
+
 # Default corpus mount point (host maps repo/api/knowledge here with :ro)
 VOLUME ["/corpus"]
 
-ENTRYPOINT ["qwen"]
+ENTRYPOINT ["qwen-entrypoint"]
diff --git a/docker/qwen-search/README.md b/docker/qwen-search/README.md
@@ -1,6 +1,6 @@
 # Qwen search container (SpawnDock API / MCP)
 
-OCI image that installs **@qwen-code/qwen-code** and runs `qwen` as `ENTRYPOINT`. The API server (`repo/api`) invokes this image for `QWEN_MODE=container` MCP search.
+OCI image that installs **@qwen-code/qwen-code** and runs `qwen-search` as `ENTRYPOINT`. The API server (`repo/api`) invokes this image for `QWEN_MODE=container` MCP search.
 
 ## Build
 
@@ -10,6 +10,12 @@ From `repo/api`:
 docker build -t spawndock/qwen-search:local -f docker/qwen-search/Dockerfile .
 ```
 
+## Runtime contract
+
+- `ENTRYPOINT` is `qwen-search` (wrapper over `qwen --output-format json --prompt "<TERM>"`).
+- At container start it decodes `PROD_QWEN_OAUTH_CREDS` (or `QWEN_OAUTH_CREDS_B64`) into `~/.qwen/oauth_creds.json`.
+- Knowledge directory is mounted read-only.
+
 ## Volume contract (read-only)
 
 | Host path | Container path | Mode |
@@ -25,9 +31,9 @@ Replace `/abs/path/to/repo/api/knowledge` with your checkout:
 ```bash
 docker run --rm \
   -v /abs/path/to/repo/api/knowledge:/corpus:ro \
-  -e QWEN_OAUTH=true \
+  -e PROD_QWEN_OAUTH_CREDS="$(cat ~/.qwen/oauth_creds.json | base64 -w0)" \
   spawndock/qwen-search:local \
-  --help
+  --term "how to build TON mini app auth flow"
 ```
 
 Pass auth / API keys only via `-e` as required by your Qwen CLI setup; do not bake secrets into the image.
diff --git a/docker/qwen-search/entrypoint.sh b/docker/qwen-search/entrypoint.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env sh
+set -eu
+
+ensure_oauth_file() {
+  creds_b64="${PROD_QWEN_OAUTH_CREDS:-${QWEN_OAUTH_CREDS_B64:-}}"
+  if [ -z "${creds_b64}" ]; then
+    return 0
+  fi
+
+  mkdir -p "${HOME}/.qwen"
+  printf "%s" "${creds_b64}" | base64 -d > "${HOME}/.qwen/oauth_creds.json"
+  chmod 600 "${HOME}/.qwen/oauth_creds.json"
+}
+
+ensure_oauth_file
+exec /usr/local/bin/qwen-search "$@"
diff --git a/docker/qwen-search/qwen-search.sh b/docker/qwen-search/qwen-search.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env sh
+set -eu
+
+prompt=""
+output_format="json"
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --term|--prompt|-p)
+      if [ "$#" -lt 2 ]; then
+        echo "Missing value for $1" >&2
+        exit 2
+      fi
+      prompt="$2"
+      shift 2
+      ;;
+    --output-format)
+      if [ "$#" -lt 2 ]; then
+        echo "Missing value for --output-format" >&2
+        exit 2
+      fi
+      output_format="$2"
+      shift 2
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
+
+if [ -z "$prompt" ]; then
+  echo "Missing --term/--prompt value" >&2
+  exit 2
+fi
+
+exec qwen --output-format "$output_format" --prompt "$prompt"
diff --git a/package-lock.json b/package-lock.json
diff --git a/scripts/deploy-prod.sh b/scripts/deploy-prod.sh
@@ -1,17 +1,22 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-if [[ $# -lt 3 ]]; then
-  echo "Usage: $0 <ssh-password> <qwen-oauth-creds-b64> <telegram-bot-token> [ssh-host] [ssh-user] [public-origin]" >&2
+if [[ $# -lt 2 ]]; then
+  echo "Usage: $0 <ssh-password> <telegram-bot-token> [ssh-host] [ssh-user] [public-origin]" >&2
+  echo "Required env: PROD_QWEN_OAUTH_CREDS (base64 of ~/.qwen/oauth_creds.json)" >&2
   exit 1
 fi
 
 SSH_PASSWORD="$1"
-QWEN_OAUTH_CREDS_B64="$2"
-TELEGRAM_BOT_TOKEN="$3"
-SSH_HOST="${4-spawn-dock.w3voice.net}"
-SSH_USER="${5:-ops}"
-PUBLIC_ORIGIN="${6:-https://spawn-dock.w3voice.net}"
+TELEGRAM_BOT_TOKEN="$2"
+SSH_HOST="${3-spawn-dock.w3voice.net}"
+SSH_USER="${4:-ops}"
+PUBLIC_ORIGIN="${5:-https://spawn-dock.w3voice.net}"
+QWEN_OAUTH_CREDS_B64="${PROD_QWEN_OAUTH_CREDS:-}"
+if [[ -z "$QWEN_OAUTH_CREDS_B64" ]]; then
+  echo "PROD_QWEN_OAUTH_CREDS is required" >&2
+  exit 1
+fi
 TARGET_DIR="/srv/spawndock-api"
 BOT_SECRET="$(openssl rand -hex 24)"
 BOT_CONTROL_PLANE_URL="http://mcp-server:3000"
@@ -69,6 +74,7 @@ QWEN_CODE_COMMAND=qwen
 QWEN_CODE_AUTH_TYPE=qwen-oauth
 QWEN_CONTAINER_IMAGE=spawndock/qwen-search:prod
 QWEN_KNOWLEDGE_HOST_PATH=${TARGET_DIR}/knowledge
+PROD_QWEN_OAUTH_CREDS=${QWEN_OAUTH_CREDS_B64}
 QWEN_OAUTH_CREDS_B64=${QWEN_OAUTH_CREDS_B64}
 HF_TOKEN=
 EOF
diff --git a/src/__tests__/bot-commands.test.ts b/src/__tests__/bot-commands.test.ts
@@ -33,6 +33,9 @@ describe("parseCommand", () => {
   it("parses unknown /lang code as lang-invalid", () => {
     expect(parseCommand("/lang de")).toEqual({ tag: "lang-invalid", arg: "de" });
   });
+  it("parses /getToken", () => {
+    expect(parseCommand("/getToken")).toEqual({ tag: "get-token" });
+  });
   it("returns unknown for random text", () => {
     expect(parseCommand("hello").tag).toBe("unknown");
   });
diff --git a/src/__tests__/mcp-auth.test.ts b/src/__tests__/mcp-auth.test.ts
@@ -2,6 +2,8 @@ import { describe, expect, it } from "vitest";
 import { authenticateMcpRequest, findDeviceCredentialByMcpApiKey, readMcpApiKey } from "../mcp-auth.js";
 import type { StoreState } from "../types.js";
 
+delete process.env.API_TOKEN;
+
 const state: StoreState = {
   projects: [],
   pairingTokens: [],
diff --git a/src/__tests__/qwen-container.test.ts b/src/__tests__/qwen-container.test.ts
@@ -86,7 +86,7 @@ describe("runQwenSearchInContainer", () => {
         "-v",
         expect.stringMatching(/\/host\/knowledge:\/corpus:ro$/),
         "spawndock/qwen-search:local",
-        "-p",
+        "--term",
         "test prompt",
         "--output-format",
         "json",
diff --git a/src/bot/commands.ts b/src/bot/commands.ts
@@ -11,6 +11,7 @@ export type BotCommand =
   | { tag: "lang-help" }
   | { tag: "lang-set"; locale: BotLocale }
   | { tag: "lang-invalid"; arg: string }
+  | { tag: "get-token" }
   | { tag: "unknown"; input: string };
 
 export function parseCommand(input: string): BotCommand {
@@ -31,6 +32,9 @@ export function parseCommand(input: string): BotCommand {
     const slug = text.slice(7).trim();
     return slug ? { tag: "launch", slug } : { tag: "launch-missing" };
   }
+  if (text === "/getToken" || text === "/gettoken") {
+    return { tag: "get-token" };
+  }
   return { tag: "unknown", input: text };
 }
 
diff --git a/src/bot/config.ts b/src/bot/config.ts
@@ -6,6 +6,7 @@ export interface BotConfig {
   controlPlaneUrl: string;
   controlPlaneBotSecret: string;
   pollingTimeout: number;
+  apiToken: string;
 }
 
 export function readBotConfig(): BotConfig {
@@ -20,6 +21,7 @@ export function readBotConfig(): BotConfig {
     controlPlaneUrl: process.env.CONTROL_PLANE_URL || "http://localhost:3000",
     controlPlaneBotSecret: process.env.SPAWNDOCK_BOT_SECRET || "spawndock-dev-bot-secret",
     pollingTimeout: parseInt(process.env.BOT_POLL_TIMEOUT || "25", 10),
+    apiToken: process.env.API_TOKEN?.trim() || "",
   };
 }
 
diff --git a/src/bot/i18n.ts b/src/bot/i18n.ts
@@ -39,6 +39,7 @@ export function welcomeMessage(locale: BotLocale): string {
       "Команды:",
       "/new &lt;название проекта&gt; — создать TMA и получить bootstrap-команду",
       "/launch &lt;slug&gt; — получить TMA и preview ссылки проекта",
+      "/getToken — показать общий API_TOKEN для MCP и dev tunnel",
       "/lang &lt;en|ru&gt; — язык интерфейса",
       "/help — показать справку",
     ].join("\n");
@@ -49,11 +50,38 @@ export function welcomeMessage(locale: BotLocale): string {
     "Commands:",
     "/new &lt;project title&gt; — create a TMA and get the bootstrap command",
     "/launch &lt;slug&gt; — get TMA and preview links for the project",
+    "/getToken — show shared API_TOKEN for MCP and dev tunnel",
     "/lang &lt;en|ru&gt; — interface language",
     "/help — show this help",
   ].join("\n");
 }
 
+export function getTokenMessage(locale: BotLocale, token: string): string {
+  if (token.length === 0) {
+    return locale === "ru"
+      ? "API_TOKEN не настроен на сервере."
+      : "API_TOKEN is not configured on the server.";
+  }
+
+  if (locale === "ru") {
+    return [
+      "Общий токен для MCP и dev tunnel:",
+      `<code>${esc(token)}</code>`,
+      "",
+      "Пример:",
+      "<code>export API_TOKEN=...</code>",
+    ].join("\n");
+  }
+
+  return [
+    "Shared token for MCP and dev tunnel:",
+    `<code>${esc(token)}</code>`,
+    "",
+    "Example:",
+    "<code>export API_TOKEN=...</code>",
+  ].join("\n");
+}
+
 export function unknownMessage(locale: BotLocale): string {
   if (locale === "ru") {
     return "Не понял команду.\n\nИспользуй /new &lt;название проекта&gt; или /help.";
diff --git a/src/bot/polling.ts b/src/bot/polling.ts
@@ -21,6 +21,7 @@ import {
   langInvalid,
   langSetConfirm,
   linkButtonLabels,
+  getTokenMessage,
 } from "./i18n.js";
 import { buildGatewayMiniAppUrl, buildTelegramMiniAppUrl } from "./links.js";
 
@@ -139,6 +140,11 @@ async function processUpdate(cfg: ReturnType<typeof readBotConfig>, update: Tele
     return;
   }
 
+  if (cmd.tag === "get-token") {
+    await sendMessage(cfg.telegramBotToken, msg.chat.id, getTokenMessage(locale, cfg.apiToken));
+    return;
+  }
+
   if (cmd.tag === "new") {
     let data: any;
     const ackTimeout = scheduleAcknowledgement(cfg, msg.chat.id, ackCreatingProject(locale));
diff --git a/src/bot/telegram.ts b/src/bot/telegram.ts
@@ -205,6 +205,7 @@ export async function setMyCommands(token: string): Promise<void> {
       commands: [
         { command: "new", description: "Create TMA and get bootstrap command" },
         { command: "launch", description: "Get TMA and preview links for a project" },
+        { command: "getToken", description: "Get shared API token for MCP and dev tunnel" },
         { command: "lang", description: "Set language (en or ru)" },
         { command: "help", description: "Show help" },
       ],
diff --git a/src/config.ts b/src/config.ts
@@ -42,4 +42,9 @@ export const config = {
   tunnelPath: process.env.TUNNEL_PATH || "/tunnel/connect",
   previewPrefix: process.env.PREVIEW_PREFIX || "/preview",
   requestTimeoutMs: parseInt(process.env.REQUEST_TIMEOUT_MS || "15000", 10),
+  apiToken: process.env.API_TOKEN?.trim() || "",
+  qwenOauthCredsB64:
+    process.env.PROD_QWEN_OAUTH_CREDS?.trim() ||
+    process.env.QWEN_OAUTH_CREDS_B64?.trim() ||
+    "",
 };
diff --git a/src/mcp-auth.ts b/src/mcp-auth.ts
@@ -1,5 +1,6 @@
 import type { IncomingHttpHeaders } from "node:http";
 import type { DeviceCredential, StoreState } from "./types.js";
+import { config } from "./config.js";
 
 const MCP_API_KEY_HEADER = "x-spawndock-mcp-api-key";
 const BEARER_PREFIX = /^Bearer\s+/i;
@@ -42,5 +43,17 @@ export function authenticateMcpRequest(state: StoreState, headers: IncomingHttpH
     return null;
   }
 
+  if (config.apiToken.length > 0 && mcpApiKey === config.apiToken) {
+    return {
+      id: "global_api_token",
+      projectId: "global",
+      label: "Global API token",
+      secret: "",
+      mcpApiKey: config.apiToken,
+      createdAt: new Date(0).toISOString(),
+      revokedAt: null,
+    };
+  }
+
   return findDeviceCredentialByMcpApiKey(state, mcpApiKey);
 }
diff --git a/src/mcp.ts b/src/mcp.ts
@@ -25,6 +25,10 @@ function buildContainerEnvAllowlist(): Array<{ hostName: string; value: string }
     const v = process.env[key];
     if (v) list.push({ hostName: key, value: v });
   }
+  if (config.qwenOauthCredsB64.length > 0) {
+    list.push({ hostName: "PROD_QWEN_OAUTH_CREDS", value: config.qwenOauthCredsB64 });
+    list.push({ hostName: "QWEN_OAUTH_CREDS_B64", value: config.qwenOauthCredsB64 });
+  }
   return list;
 }
 
diff --git a/src/qwen/container-runner.ts b/src/qwen/container-runner.ts
@@ -34,7 +34,9 @@ export function redactForLogs(text: string): string {
     .replace(/OPENROUTER_KEY=\S+/gi, "OPENROUTER_KEY=[REDACTED]")
     .replace(/HF_TOKEN=\S+/gi, "HF_TOKEN=[REDACTED]")
     .replace(/OPENAI_API_KEY=\S+/gi, "OPENAI_API_KEY=[REDACTED]")
-    .replace(/TELEGRAM_BOT_TOKEN=\S+/gi, "TELEGRAM_BOT_TOKEN=[REDACTED]");
+    .replace(/TELEGRAM_BOT_TOKEN=\S+/gi, "TELEGRAM_BOT_TOKEN=[REDACTED]")
+    .replace(/PROD_QWEN_OAUTH_CREDS=\S+/gi, "PROD_QWEN_OAUTH_CREDS=[REDACTED]")
+    .replace(/QWEN_OAUTH_CREDS_B64=\S+/gi, "QWEN_OAUTH_CREDS_B64=[REDACTED]");
 }
 
 export function createCorrelationId(): string {
@@ -65,7 +67,7 @@ export async function runQwenSearchInContainer(
     }
   }
 
-  args.push(params.image, "-p", params.prompt, "--output-format", "json");
+  args.push(params.image, "--term", params.prompt, "--output-format", "json");
 
   const runtime = params.runtime;
   const child = spawn(runtime, args, {
diff --git a/src/tunnel.ts b/src/tunnel.ts
