企业知识库接入文档

{
  "mcpServers": {
    "telos-kb": {
      "type": "http",
      "url": "https://<知识库地址>/api/v1/kb-mcp/<端点 ID>",
      "headers": { "Authorization": "Bearer <你的密钥>" }
    }
  }
}

<script src="https://<知识库地址>/widget/loader.js"></script>
<script>
  TelosWidget.init({
    widgetId: 'wgt_7f3a9c2e41b8',   // 换成你的挂件 ID
    mode: 'overlay',              // overlay 浮在页面上；push 右侧占位、页面左移
    getToken: async () => {
      const r = await fetch('/api/telos-widget-token', { credentials: 'same-origin', cache: 'no-store' })
      if (r.status === 401) return null       // 没登录：挂件显示「请先登录」
      if (!r.ok) throw new Error('获取通行证失败')
      return (await r.json()).token
    },
  })
</script>

<!-- pom.xml -->
<dependency>
  <groupId>com.shtelos.telos</groupId>
  <artifactId>telos-widget-spring-boot-starter</artifactId>
  <version>0.1.0</version>
</dependency>

# application.yml（三个值都从环境变量或配置中心读）
telos:
  widget:
    widget-id: ${TELOS_WIDGET_ID}
    key-id: ${TELOS_WIDGET_KEY_ID}
    secret: ${TELOS_WIDGET_SECRET}
    # path: /api/telos-widget-token   默认就是这个地址

// 唯一要写的代码：告诉 SDK 当前登录用户是谁（以 Spring Security 为例）
@Bean
TelosWidgetUserResolver telosWidgetUserResolver() {
  return request -> {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth == null || !auth.isAuthenticated()
        || auth instanceof AnonymousAuthenticationToken) return null;   // 未登录 → 401
    LoginUser u = (LoginUser) auth.getPrincipal();                   // 换成你们的用户类
    return new TelosUser(String.valueOf(u.getId()), u.getRealName());
  };
}

// 只依赖 telos-widget-core（零第三方依赖）；Jakarta 项目把 javax.servlet 换成 jakarta.servlet
public final class TelosWidgetTokenServlet extends HttpServlet {
  private final TelosWidgetSigner signer = TelosWidgetSigner.builder()
      .widgetId(System.getenv("TELOS_WIDGET_ID"))
      .keyId(System.getenv("TELOS_WIDGET_KEY_ID"))
      .secret(System.getenv("TELOS_WIDGET_SECRET"))
      .build();

  @Override
  protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
    resp.setHeader(TelosWidgetSigner.CACHE_CONTROL_HEADER, TelosWidgetSigner.CACHE_CONTROL_VALUE);
    LoginUser u = LoginContext.current(req);              // 换成你们取当前登录用户的方法
    if (u == null) { resp.setStatus(401); return; }
    resp.setContentType("application/json;charset=UTF-8");
    resp.getWriter().write(signer.createTokenResponseJson(new TelosUser(u.getId(), u.getRealName())));
  }
}

// npm install jsonwebtoken
import jwt from 'jsonwebtoken'
import { randomUUID } from 'node:crypto'

app.get('/api/telos-widget-token', (req, res) => {
  res.set('Cache-Control', 'no-store')
  const user = req.session?.user                  // 只从服务端登录态取
  if (!user) return res.status(401).end()
  const token = jwt.sign(
    { sub: String(user.id), name: user.name, jti: randomUUID() },
    process.env.TELOS_WIDGET_SECRET,
    { algorithm: 'HS256', audience: process.env.TELOS_WIDGET_ID,
      keyid: process.env.TELOS_WIDGET_KEY_ID, expiresIn: 300 },
  )
  res.json({ token })
})

# pip install pyjwt
import os, time, uuid, jwt
from flask import session, jsonify

@app.get("/api/telos-widget-token")
def telos_widget_token():
    nocache = {"Cache-Control": "no-store"}
    user = session.get("user")                       # 只从服务端登录态取
    if not user:
        return "", 401, nocache
    now = int(time.time())
    token = jwt.encode(
        {"aud": os.environ["TELOS_WIDGET_ID"], "sub": str(user["id"]), "name": user["name"],
         "iat": now, "exp": now + 300, "jti": str(uuid.uuid4())},
        os.environ["TELOS_WIDGET_SECRET"], algorithm="HS256",
        headers={"kid": os.environ["TELOS_WIDGET_KEY_ID"]},
    )
    return jsonify(token=token), 200, nocache

// go get github.com/golang-jwt/jwt/v5 github.com/google/uuid
func telosWidgetToken(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Cache-Control", "no-store")
	user, ok := currentUser(r) // 只从服务端登录态取
	if !ok {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	now := time.Now()
	t := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
		"aud": os.Getenv("TELOS_WIDGET_ID"), "sub": user.ID, "name": user.Name,
		"iat": now.Unix(), "exp": now.Add(5 * time.Minute).Unix(), "jti": uuid.NewString(),
	})
	t.Header["kid"] = os.Getenv("TELOS_WIDGET_KEY_ID")
	token, err := t.SignedString([]byte(os.Getenv("TELOS_WIDGET_SECRET")))
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		return
	}
	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(map[string]string{"token": token})
}