@allbluecn/admin-app 0.2.3 → 0.2.5

package/src/server/serverFns/oauth-providers.ts

@@ -0,0 +1,161 @@
+// ⚠ serverFn 纯净原则：本文件禁止 export 普通函数/常量；只允许 createServerFn 返回值和 interface。
+//   工具函数（如 maskSecret）如需复用请放同目录其他 .ts 文件。
+//
+// 跨 app 缓存失效：admin 与 web 是独立 app（各自独立 prisma 实例），admin 写 DB 后 web 端
+// oauth-config 60s 缓存最长延迟 60s 生效（TTL 自然过期，符合 plan2 spec），无跨进程失效通道。
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { decryptSecret, encryptSecret } from '@allbluecn/kernel/crypto'
+
+export interface OAuthProviderView {
+  provider: string
+  clientId: string
+  /** 数据库行是否含有效密文（v1. 前缀）；'***' 占位视为 false */
+  hasSecret: boolean
+  enabled: boolean
+  hasEnvFallback: boolean
+  fromDb: boolean
+}
+
+const PROVIDER_KEY = 'google'
+
+const GOOGLE_OPENID_URL = 'https://accounts.google.com/.well-known/openid-configuration'
+
+function hasGoogleEnvFallback(): boolean {
+  return Boolean(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET)
+}
+
+export const listOAuthProvidersFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async (): Promise<{ providers: OAuthProviderView[] }> => {
+    await requireAdmin()
+    const row = await prisma.oAuthProviderConfig.findUnique({
+      where: { provider: PROVIDER_KEY },
+    })
+    return {
+      providers: [
+        row
+          ? {
+              provider: PROVIDER_KEY,
+              clientId: row.clientId,
+              hasSecret:
+                row.clientSecret.startsWith('v1.') &&
+                decryptSecret(row.clientSecret) !== null,
+              enabled: row.enabled,
+              hasEnvFallback: false,
+              fromDb: true,
+            }
+          : {
+              provider: PROVIDER_KEY,
+              clientId: '',
+              hasSecret: false,
+              enabled: false,
+              hasEnvFallback: hasGoogleEnvFallback(),
+              fromDb: false,
+            },
+      ],
+    }
+  })
+
+export const saveOAuthProviderFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      provider: z.literal('google'),
+      clientId: z.string().min(1, 'clientId 不能为空'),
+      clientSecret: z.string().optional(),
+      enabled: z.boolean(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const hasSecret = Boolean(data.clientSecret && data.clientSecret.length > 0)
+    if (!hasSecret) {
+      // 无 secret：仅当 DB 已有记录时更新 clientId/enabled；无记录时创建 secret='***' 占位
+      // （'***' 会被 web 端 decryptSecret 返回 null，filter 掉，实际回落 env）
+      const existing = await prisma.oAuthProviderConfig.findUnique({
+        where: { provider: data.provider },
+      })
+      if (existing) {
+        await prisma.oAuthProviderConfig.update({
+          where: { provider: data.provider },
+          data: { clientId: data.clientId, enabled: data.enabled },
+        })
+      } else {
+        await prisma.oAuthProviderConfig.create({
+          data: {
+            provider: data.provider,
+            clientId: data.clientId,
+            clientSecret: '***',
+            enabled: data.enabled,
+          },
+        })
+      }
+      return { ok: true }
+    }
+    const encrypted = encryptSecret(data.clientSecret as string)
+    await prisma.oAuthProviderConfig.upsert({
+      where: { provider: data.provider },
+      create: {
+        provider: data.provider,
+        clientId: data.clientId,
+        clientSecret: encrypted,
+        enabled: data.enabled,
+      },
+      update: {
+        clientId: data.clientId,
+        clientSecret: encrypted,
+        enabled: data.enabled,
+      },
+    })
+    return { ok: true }
+  })
+
+export const testOAuthProviderFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      provider: z.literal('google'),
+      clientId: z.string(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    if (!data.clientId || data.clientId.trim().length === 0) {
+      return { ok: false, detail: 'clientId 为空，无法测试' }
+    }
+    let res: Response
+    try {
+      res = await fetch(GOOGLE_OPENID_URL, {
+        method: 'GET',
+        headers: { 'accept': 'application/json' },
+        signal: AbortSignal.timeout(10_000),
+      })
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e)
+      return { ok: false, detail: `无法访问 Google OpenID 端点：${msg}` }
+    }
+    if (!res.ok) {
+      return { ok: false, detail: `Google OpenID 端点返回 HTTP ${res.status}` }
+    }
+    return {
+      ok: true,
+      detail:
+        '仅验证 Google OAuth 端点可达，key 真伪需在实际登录流程中验证',
+    }
+  })
+
+export const deleteOAuthProviderFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ provider: z.literal('google') }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    try {
+      await prisma.oAuthProviderConfig.delete({ where: { provider: data.provider } })
+    } catch (e) {
+      const code = (e as { code?: string }).code
+      if (code !== 'P2025') {
+        throw e
+      }
+    }
+    return { ok: true, fallbackToEnv: hasGoogleEnvFallback() }
+  })

package/src/start.ts

@@ -20,6 +20,7 @@ import {
   sentryGlobalRequestMiddleware,
 } from '@sentry/tanstackstart-react'
 import { createStart, createMiddleware, createCsrfMiddleware } from '@tanstack/react-start'
+import { securityHeadersMiddleware } from '@/server/middlewares/security-headers'
 import { requestContextMiddleware } from '@/server/middlewares/request'
 import {
   observabilityMiddleware,
@@ -80,6 +81,6 @@ if (typeof process !== 'undefined' && process.versions?.node && process.env.NODE
 }
 
 export const startInstance = createStart(() => ({
-  requestMiddleware: [sentryGlobalRequestMiddleware, requestContextMiddleware, observabilityMiddleware, debugMiddleware, apiCorsMiddleware, csrfMiddleware],
+  requestMiddleware: [securityHeadersMiddleware, sentryGlobalRequestMiddleware, requestContextMiddleware, observabilityMiddleware, debugMiddleware, apiCorsMiddleware, csrfMiddleware],
   functionMiddleware: [sentryGlobalFunctionMiddleware],
 }))

package/src/types/jest-dom-vitest.d.ts

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// Vitest 5 类型兼容层（与 apps/web 同名文件保持一致）：Vitest 5 的 `Assertion`
+// 接口使用双类型参数 `Assertion<R, T>`，而 @testing-library/jest-dom 官方
+// types/vitest.d.ts 声明单参数 `Assertion<T = any>`，泛型参数个数不一致导致
+// 声明合并报 TS2428。这里以正确的双参数签名重写增强，使 `toBeInTheDocument`
+// 等 jest-dom matcher 类型可用。运行时 matcher 注册在 src/__tests__/setup.ts
+// 的 `import '@testing-library/jest-dom/vitest'`。
+import type { TestingLibraryMatchers } from '@testing-library/jest-dom/matchers'
+
+declare module 'vitest' {
+  interface Assertion<R extends void | Promise<void> = void, T = unknown>
+    extends TestingLibraryMatchers<R, T> {}
+  interface AsymmetricMatchersContaining
+    extends TestingLibraryMatchers<any, any> {}
+}