@ai-partner-x/aiko-boot-cli 0.1.4

package/templates/scaffold-default/packages/core/src/auth/backend-auth-provider.ts

@@ -0,0 +1,149 @@
+import type { AuthProviderConfig, AuthUser, LoginParams } from "./types"
+import { AUTH_ACCESS_TOKEN_KEY } from "./auth-constants"
+
+export type BackendAuthProviderOptions = {
+  /** 未授权时跳转的登录地址（通常是 "/login"） */
+  loginUrl?: string
+}
+
+type ApiEnvelope<T> = { success: boolean; data?: T; error?: string }
+
+async function readJson<T>(res: Response): Promise<T> {
+  return await res.json() as T
+}
+
+async function readTextSafe(res: Response): Promise<string> {
+  return await res.text().catch(() => "")
+}
+
+/**
+ * Parse backend response:
+ * - supports plain data (T)
+ * - supports envelope: { success, data, error }
+ */
+function unwrapEnvelope<T>(payload: T | ApiEnvelope<T>): T {
+  if (payload && typeof payload === "object" && "success" in payload) {
+    const env = payload as ApiEnvelope<T>
+    if (!env.success) throw new Error(env.error || "Request failed")
+    return env.data as T
+  }
+  return payload as T
+}
+
+/** Map backend userInfo to core AuthUser. Handles missing/optional fields safely. */
+function toAuthUser(info: {
+  id?: number | null
+  username?: string | null
+  realName?: string | null
+  email?: string | null
+  roles?: string[] | null
+  permissions?: string[] | null
+}): AuthUser {
+  const account = info.username ?? ""
+  return {
+    ...(info.id != null && { id: String(info.id) }),
+    account,
+    ...(info.email != null && info.email !== "" && { email: info.email }),
+    ...(info.realName != null && { realName: info.realName }),
+    ...(info.roles != null && info.roles.length > 0 && { roles: info.roles }),
+    ...(info.permissions != null && info.permissions.length > 0 && { permissions: info.permissions }),
+  }
+}
+
+function getAuthErrorMessage(error: unknown, fallbackMessage: string): string {
+  if (error instanceof Error && error.message.trim() !== "") return error.message
+  if (typeof error === "string" && error.trim() !== "") return error
+  return fallbackMessage
+}
+
+function logAuthError(context: string, error: unknown): void {
+  // Centralized auth error logging for easier debugging.
+  console.error(`[Auth] ${context} error:`, error)
+}
+
+/**
+ * Backend auth provider for both admin & mobile.
+ * - login: calls backend /auth/login
+ * - getIdentity: calls backend /auth/current-user with stored access token
+ * - logout: clears token
+ * - onError: clears token on 401/403 and redirects to login
+ */
+export function createBackendAuthProvider(
+  apiBaseUrl: string,
+  options: BackendAuthProviderOptions = {}
+): AuthProviderConfig {
+  const loginUrl = options.loginUrl ?? "/login"
+
+  return {
+    login: async (params: LoginParams) => {
+      try {
+        const res = await fetch(`${apiBaseUrl}/api/auth/login`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            username: params.account,
+            password: params.password ?? "",
+          }),
+        })
+        if (!res.ok) {
+          const text = await readTextSafe(res)
+          throw new Error(text || `Login failed (${res.status})`)
+        }
+        const raw = await readJson<ApiEnvelope<{ accessToken?: string; refreshToken?: string; userInfo?: any }> | { accessToken?: string; refreshToken?: string; userInfo?: any }>(res)
+        const result = unwrapEnvelope(raw)
+        if (result?.accessToken) {
+          localStorage.setItem(AUTH_ACCESS_TOKEN_KEY, result.accessToken)
+        }
+        return {
+          success: true,
+          user: toAuthUser(result?.userInfo ?? {}),
+          redirectTo: "/",
+        }
+      } catch (err) {
+        logAuthError("login", err)
+        const message = getAuthErrorMessage(err, "Login failed")
+        return {
+          success: false,
+          error: { name: "Login Error", message },
+        }
+      }
+    },
+
+    logout: async () => {
+      localStorage.removeItem(AUTH_ACCESS_TOKEN_KEY)
+      return { success: true }
+    },
+
+    getIdentity: async (): Promise<AuthUser | null> => {
+      const token = localStorage.getItem(AUTH_ACCESS_TOKEN_KEY)
+      if (!token) return null
+      try {
+        const res = await fetch(`${apiBaseUrl}/api/auth/current`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${token}` },
+        })
+        if (!res.ok) {
+          const text = await readTextSafe(res)
+          throw new Error(text || `Get identity failed (${res.status})`)
+        }
+        const raw = await readJson<ApiEnvelope<any> | any>(res)
+        const userInfo = unwrapEnvelope(raw)
+        return toAuthUser(userInfo ?? {})
+      } catch (err) {
+        logAuthError("getIdentity", err)
+        localStorage.removeItem(AUTH_ACCESS_TOKEN_KEY)
+        return null
+      }
+    },
+
+    onError: async (error: Error & { statusCode?: number }) => {
+      logAuthError("onError", error)
+      const status = error.statusCode
+      if (status === 401 || status === 403) {
+        localStorage.removeItem(AUTH_ACCESS_TOKEN_KEY)
+        return { logout: true, redirectTo: loginUrl }
+      }
+    },
+  }
+}
+

package/templates/scaffold-default/packages/core/src/auth/default-auth-provider.ts

@@ -0,0 +1,38 @@
+import { AuthProviderConfig, AuthUser } from "./types"
+
+/** Demo/local provider only: stores serialized user blob. Backend providers use AUTH_ACCESS_TOKEN_KEY in auth-constants.ts. */
+const AUTH_STORAGE_KEY = "_kdid"
+
+const defaultAuthProvider: AuthProviderConfig = {
+  // 表单登录，根据实现情况调整
+  login: async ({ account }) => {
+    const user: AuthUser = {
+      account
+    }
+    try {
+      localStorage.setItem(AUTH_STORAGE_KEY, JSON.stringify(user))
+      return { success: true, user, redirectTo: "/" }
+    } catch {
+      return {
+        success: false,
+        error: { name: "Login Error", message: "Failed to save session" },
+      }
+    }
+  },
+  logout: async () => {
+    localStorage.removeItem(AUTH_STORAGE_KEY)
+    return { success: true }
+  },
+  // prod: 获取当前登录用户，换成接口
+  getIdentity: async () => {
+    const raw = localStorage.getItem(AUTH_STORAGE_KEY)
+    if (!raw) return null
+    try {
+      return JSON.parse(raw) as AuthUser
+    } catch {
+      return null
+    }
+  }
+}
+
+export default defaultAuthProvider

package/templates/scaffold-default/packages/core/src/auth/index.ts

@@ -0,0 +1,12 @@
+export { appAuth } from "./auth-service"
+export { AUTH_ACCESS_TOKEN_KEY } from "./auth-constants"
+export { default as defaultAuthProvider } from "./default-auth-provider"
+export { createBackendAuthProvider } from "./backend-auth-provider"
+export { createAuthClientMiddleware } from "./auth-client-middleware"
+export type {
+  AuthUser,
+  LoginParams,
+  AuthProviderConfig,
+  AuthProviderResult,
+  AuthConfig
+} from "./types"

package/templates/scaffold-default/packages/core/src/auth/types.ts

@@ -0,0 +1,38 @@
+import { ReactNode } from "react"
+
+export type AuthUser = {
+  id?: string
+  /** 登录账号/用户名（替代原 name 字段） */
+  account: string
+  /** 可选：邮箱 */
+  email?: string
+  avatar?: string | ReactNode
+  /** 允许携带额外的用户数据（例如 roles、dept、tenant 等） */
+  [key: string]: unknown
+}
+
+export type LoginParams = {
+  account: string
+  password?: string,
+  [key: string]: unknown
+}
+
+export type AuthProviderResult = {
+  success: boolean
+  redirectTo?: string
+  user?: AuthUser
+  error?: { name: string; message: string }
+}
+
+export type AuthProviderConfig = {
+  login?: (params: LoginParams) => Promise<AuthProviderResult>
+  logout: () => Promise<AuthProviderResult>
+  getIdentity: () => Promise<AuthUser | null>
+  onError?: (
+    error: Error & { statusCode?: number }
+  ) => Promise<{ logout?: boolean; redirectTo?: string } | void>
+}
+
+export type AuthConfig = {
+  provider?: AuthProviderConfig
+}

package/templates/scaffold-default/packages/core/src/authorization/authorization-client-middleware.ts

@@ -0,0 +1,38 @@
+import { redirect } from "react-router"
+import { authorizationConfig } from "./authorization-config"
+import { NormalizedPermissions, PermissionSet } from "./types"
+
+export function normalizePermissions(input: PermissionSet | null | undefined): NormalizedPermissions {
+  if (!input) return { set: new Set() }
+  if (Array.isArray(input)) {
+    // 忽略 "*"，必须显式配置每个权限 key
+    const keys = input.filter((k) => k && k !== "*")
+    return { set: new Set(keys) }
+  }
+  const keys = Object.keys(input).filter((k) => k && k !== "*" && input[k] === true)
+  return { set: new Set(keys) }
+}
+
+export const createAuthorizationClientMiddleware = (key?: string) => {
+  return async function authorizationClientMiddleware(
+    _args: {
+      request: Request
+      context: unknown
+    },
+    next: () => Promise<unknown>
+  ): Promise<void> {
+    if (!authorizationConfig.useMiddleware || !authorizationConfig.provider) {
+      await next()
+      return
+    }
+    const { permissionPoints } = await authorizationConfig.provider.getPermissions()
+    const p = normalizePermissions(permissionPoints)
+    if (!key) {
+      key = location.pathname
+    }
+    if (!p.set.has(key)) {
+      throw redirect(authorizationConfig.fallbackUrl!)
+    }
+    await next()
+  }
+}

package/templates/scaffold-default/packages/core/src/authorization/authorization-config.ts

@@ -0,0 +1,13 @@
+import defaultAuthorizationProvider from "./default-authorization-provider"
+import type { AuthorizationConfig } from "./types"
+
+export const authorizationConfig: AuthorizationConfig = {
+  fallbackUrl: "/not-found",
+  useMiddleware: true,
+  provider: defaultAuthorizationProvider,
+}
+
+/** 初始化/覆盖 authorization 配置（与 auth 的 setAppAuthConfig 对齐） */
+export const setAppAuthorizationConfig = (config: Partial<AuthorizationConfig>) => {
+  Object.assign(authorizationConfig, config)
+}

package/templates/scaffold-default/packages/core/src/authorization/authorization-provider.tsx

@@ -0,0 +1,116 @@
+"use client"
+
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from "react"
+import { authorizationConfig } from "./authorization-config"
+import type { AuthorizationState, PermissionSet } from "./types"
+import { normalizePermissions } from "./authorization-client-middleware"
+import { appAuth } from "../auth"
+
+const AuthorizationContext = createContext<{
+  state: AuthorizationState
+} | null>(null)
+
+export function AuthorizationProvider({
+  children,
+}: {
+  children: ReactNode
+}) {
+  const result = appAuth.check()
+  const isAuthenticated = result.isAuthenticated ?? false
+
+  const provider = authorizationConfig.provider!
+
+  const [data, setData] = useState<PermissionSet | null>(null)
+  const [isLoading, setIsLoading] = useState(false)
+
+  const load = useCallback(
+    async () => {
+      if (!isAuthenticated) {
+        setData(null)
+        setIsLoading(false)
+        return
+      }
+
+      setIsLoading(true)
+      try {
+        const { permissionPoints } = await provider.getPermissions()
+        setData(permissionPoints)
+      } catch {
+        setData(null)
+      } finally {
+        setIsLoading(false)
+      }
+    },
+    [isAuthenticated, provider]
+  )
+
+  // Login/logout/provider-change => refresh permissions
+  useEffect(() => {
+    if (!isAuthenticated) {
+      setData(null)
+      setIsLoading(false)
+      return
+    }
+    void load()
+  }, [isAuthenticated, provider, load])
+
+  const state: AuthorizationState = useMemo(
+    () => ({
+      permissions: normalizePermissions(data),
+      isLoading,
+    }),
+    [data, isLoading]
+  )
+
+  const value = useMemo(
+    () => ({
+      state,
+    }),
+    [state]
+  )
+
+  return (
+    <AuthorizationContext.Provider value={value}>
+      {isAuthenticated && state.isLoading ? (
+        <div className="flex min-h-screen items-center justify-center bg-background">
+          <span className="inline-flex h-6 w-6 animate-spin rounded-full border-2 border-muted border-t-primary" />
+        </div>
+      ) : (
+        children
+      )}
+    </AuthorizationContext.Provider>
+  )
+}
+
+export function useAuthorizationContext() {
+  const ctx = useContext(AuthorizationContext)
+  if (!ctx) throw new Error("useAuthorizationContext must be used within AuthorizationProvider")
+  return ctx
+}
+
+/** Single-key authz check (returns boolean). */
+export function useAuthorization(key: string): boolean {
+  const { state } = useAuthorizationContext()
+  if (state.isLoading) return false
+  return state.permissions.set.has(key)
+}
+
+/** Bulk/imperative checker for loops and filters. */
+export function useAuthorizationChecker() {
+  const { state } = useAuthorizationContext()
+  return useCallback(
+    (key: string) => {
+      if (state.isLoading) return false
+      return state.permissions.set.has(key)
+    },
+    [state.isLoading, state.permissions.set]
+  )
+}

package/templates/scaffold-default/packages/core/src/authorization/default-authorization-provider.ts

@@ -0,0 +1,26 @@
+import { promiseResultCache } from "../utils/promise-result-cache"
+import type {
+  AuthorizationProviderConfig,
+} from "./types"
+
+const PERMISSIONS_CACHE_KEY = "authorization/permissions"
+
+/**
+ * Default authorization provider:
+ * - caches permissions in-memory (promiseCache)
+ * - replace getPermissions with real API call in production
+ */
+const defaultAuthorizationProvider: AuthorizationProviderConfig = {
+  getPermissions: async () => {
+    return promiseResultCache(PERMISSIONS_CACHE_KEY, async () => {
+      // 返回菜单树、授权控制点列表
+      return {
+        permissionPoints: [],
+        menuTree: [],
+      }
+    })
+  }
+}
+
+export { PERMISSIONS_CACHE_KEY }
+export default defaultAuthorizationProvider

package/templates/scaffold-default/packages/core/src/authorization/index.ts

@@ -0,0 +1,15 @@
+export {
+  AuthorizationProvider,
+  useAuthorization,
+  useAuthorizationChecker,
+  useAuthorizationContext,
+} from "./authorization-provider"
+
+export { setAppAuthorizationConfig } from "./authorization-config"
+export { createAuthorizationClientMiddleware } from "./authorization-client-middleware"
+export type {
+  PermissionKey,
+  PermissionSet,
+  AuthorizationProviderConfig,
+  AuthorizationConfig,
+} from "./types"

package/templates/scaffold-default/packages/core/src/authorization/types.ts

@@ -0,0 +1,42 @@
+export type PermissionKey = string
+
+export type PermissionSet = PermissionKey[] | Record<PermissionKey, boolean>
+
+export type PermissionResult = {
+  permissionPoints: PermissionSet
+  menuTree: PermissionMenuItem[]
+}
+
+export type PermissionMenuItem = {
+  id: string
+  label: string
+  icon?: string,
+  path?: string
+  children?: PermissionMenuItem[]
+}
+
+export type AuthorizationProviderConfig = {
+  /** Fetch current user's permissions */
+  getPermissions: () => Promise<PermissionResult>
+  onError?: (
+    error: Error & { statusCode?: number }
+  ) => Promise<{ logout?: boolean; redirectTo?: string } | void>
+}
+
+export type AuthorizationConfig = {
+  /** 无权限时重定向地址（middleware 使用） */
+  fallbackUrl?: string
+  /** 是否启用授权 middleware */
+  useMiddleware?: boolean
+  provider?: AuthorizationProviderConfig
+}
+
+
+export type NormalizedPermissions = {
+  set: Set<string>
+}
+
+export type AuthorizationState = {
+  permissions: NormalizedPermissions
+  isLoading: boolean
+}

package/templates/scaffold-default/packages/core/src/index.ts

@@ -0,0 +1,3 @@
+export * from "./auth"
+export * from "./authorization"
+export * from './utils/promise-result-cache'

package/templates/scaffold-default/packages/core/src/utils/promise-result-cache.ts

@@ -0,0 +1,18 @@
+const cache = new Map<string, unknown>()
+
+export async function promiseResultCache<T>(key: string, fn: () => Promise<T>): Promise<T> {
+  if (cache.has(key)) {
+    return cache.get(key) as T
+  }
+  const result = await fn()
+  cache.set(key, result)
+  return result
+}
+
+export function promiseResultCacheClear(key: string) {
+  cache.delete(key)
+}
+
+export function promiseResultCacheClearAll() {
+  cache.clear()
+}

package/templates/scaffold-default/packages/core/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "lib": ["DOM", "DOM.Iterable", "ESNext"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "jsx": "react-jsx",
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "noEmit": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["src"],
+  "exclude": ["node_modules"]
+}

package/templates/scaffold-default/packages/mobile/README.md

@@ -0,0 +1,56 @@
+# @scaffold/mobile
+
+移动端 H5 应用，Vite + React + 路由 + 鉴权。
+
+## 工程目录（最佳实践）
+
+```
+src/
+├── app/                 # 应用入口与全局样式
+│   └── globals.css
+├── components/          # 可复用 UI 组件
+│   └── LoginForm.tsx
+├── hooks/               # 自定义 Hooks
+│   └── index.ts
+├── lib/                 # 工具函数与通用逻辑
+│   └── utils.ts
+├── pages/               # 页面级组件（按路由对应）
+│   ├── index.ts
+│   ├── LoginPage.tsx
+│   └── HomePage.tsx
+├── routes/              # 路由配置与守卫
+│   ├── index.tsx        # 路由表与 Router
+│   ├── routes.ts        # 路径常量
+│   └── ProtectedRoute.tsx
+├── types/               # 全局类型
+│   └── index.ts
+├── App.tsx
+├── main.tsx
+└── vite-env.d.ts
+```
+
+## 路由
+
+| 路径     | 说明     | 鉴权   |
+|----------|----------|--------|
+| `/login` | 登录页   | 已登录则跳转首页 |
+| `/`      | 主页     | 需登录，未登录跳转登录 |
+
+登录成功后跳转到主页；访问未定义路径时重定向到 `/`。
+
+## 开发
+
+```bash
+pnpm dev      # 开发服务器 http://localhost:3002
+pnpm build    # 构建
+pnpm preview  # 预览构建结果
+```
+
+## 环境变量
+
+- **VITE_API_URL**: 后端 API Base URL（可选）。不配置时默认使用 `http://localhost:3001`（对应 scaffold/api 默认端口）。
+
+## 依赖
+
+- `@scaffold/core`：鉴权（与 admin 一致：appAuth + createBackendAuthProvider）
+- `react-router-dom`：路由

package/templates/scaffold-default/packages/mobile/index.html

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>AIKO-BOOT</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/templates/scaffold-default/packages/mobile/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@scaffold/mobile",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite --port 3002",
+    "build": "tsc --noEmit && vite build",
+    "preview": "vite preview",
+    "lint": "eslint src"
+  },
+  "dependencies": {
+    "@scaffold/core": "workspace:*",
+    "react": "19.1.0",
+    "react-dom": "19.1.0",
+    "react-router-dom": "^7.6.0"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4.1.4",
+    "@types/node": "^20",
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "@vitejs/plugin-react": "^4.4.1",
+    "tailwindcss": "^4.1.4",
+    "typescript": "^5.8.3",
+    "vite": "^6.3.5"
+  }
+}

package/templates/scaffold-default/packages/mobile/postcss.config.mjs

@@ -0,0 +1,7 @@
+const config = {
+  plugins: {
+    '@tailwindcss/postcss': {},
+  },
+};
+
+export default config;

package/templates/scaffold-default/packages/mobile/src/App.tsx

@@ -0,0 +1,5 @@
+import { AppRouter } from '@/routes';
+
+export default function App() {
+  return <AppRouter />;
+}

package/templates/scaffold-default/packages/mobile/src/app/globals.css

@@ -0,0 +1 @@
+@import "tailwindcss";