@allbluecn/admin-app 0.3.2 → 0.3.3

package/src/components/user/user-detail/user-detail-dialogs.tsx

@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import { m } from '@/paraglide/messages.js'
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@allbluecn/ui/dialog'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@allbluecn/ui/alert-dialog'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@allbluecn/ui/select'
+import { Input } from '@allbluecn/ui/input'
+import { Label } from '@allbluecn/ui/label'
+import { Button } from '@allbluecn/ui/button'
+
+export type UserDialogState = { open: boolean; value: string }
+export type UserDeleteDialogState = { open: boolean; confirmName: string }
+
+type DialogProps = {
+  username: string
+  isPending: boolean
+}
+
+/** 角色变更对话框（提交逻辑经 onSubmit/onCancel 由页面注入，保持页面侧事务编排） */
+export function UserRoleDialog({
+  open,
+  value,
+  username,
+  isPending,
+  onOpenChange,
+  onValueChange,
+  onSubmit,
+  onCancel,
+}: DialogProps & {
+  open: boolean
+  value: string
+  onOpenChange: (open: boolean) => void
+  onValueChange: (value: string) => void
+  onSubmit: () => void
+  onCancel: () => void
+}) {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-100">
+        <DialogHeader>
+          <DialogTitle>{m['admin-users_dialog_role_title']({ username })}</DialogTitle>
+        </DialogHeader>
+        <div className="py-4">
+          <Label>{m['admin-users_dialog_role_newRole']()}</Label>
+          <Select value={value} onValueChange={(v) => onValueChange(v ?? "")}>
+            <SelectTrigger><SelectValue /></SelectTrigger>
+            <SelectContent>
+              <SelectItem value="USER">{m['admin-users_role_user']()}</SelectItem>
+              <SelectItem value="ADMIN">{m['admin-users_role_admin']()}</SelectItem>
+              <SelectItem value="SUPER_ADMIN">{m['admin-users_role_superAdmin']()}</SelectItem>
+            </SelectContent>
+          </Select>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={onCancel}>{m.common_button_cancel()}</Button>
+          <Button disabled={isPending} onClick={onSubmit}>{m.common_button_confirm()}</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+/** 状态变更对话框 */
+export function UserStatusDialog({
+  open,
+  value,
+  username,
+  isPending,
+  onOpenChange,
+  onValueChange,
+  onSubmit,
+  onCancel,
+}: DialogProps & {
+  open: boolean
+  value: string
+  onOpenChange: (open: boolean) => void
+  onValueChange: (value: string) => void
+  onSubmit: () => void
+  onCancel: () => void
+}) {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-100">
+        <DialogHeader>
+          <DialogTitle>{m['admin-users_dialog_status_title']({ username })}</DialogTitle>
+        </DialogHeader>
+        <div className="py-4">
+          <Label>{m['admin-users_dialog_status_newStatus']()}</Label>
+          <Select value={value} onValueChange={(v) => onValueChange(v ?? "")}>
+            <SelectTrigger><SelectValue /></SelectTrigger>
+            <SelectContent>
+              <SelectItem value="ACTIVE">{m['admin-users_status_active']()}</SelectItem>
+              <SelectItem value="INACTIVE">{m['admin-users_status_inactive']()}</SelectItem>
+              <SelectItem value="BANNED">{m['admin-users_status_banned']()}</SelectItem>
+            </SelectContent>
+          </Select>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={onCancel}>{m.common_button_cancel()}</Button>
+          <Button disabled={isPending} onClick={onSubmit}>{m.common_button_confirm()}</Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+/** 密码重置对话框（表单提交） */
+export function UserPasswordDialog({
+  open,
+  value,
+  username,
+  isPending,
+  onOpenChange,
+  onValueChange,
+  onSubmit,
+  onCancel,
+}: DialogProps & {
+  open: boolean
+  value: string
+  onOpenChange: (open: boolean) => void
+  onValueChange: (value: string) => void
+  onSubmit: () => void
+  onCancel: () => void
+}) {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-100">
+        <DialogHeader>
+          <DialogTitle>{m['admin-users_dialog_password_title']({ username })}</DialogTitle>
+        </DialogHeader>
+        <form onSubmit={(e) => { e.preventDefault(); onSubmit() }}>
+          <div className="py-4">
+            <Label>{m['admin-users_dialog_password_newPassword']()}</Label>
+            <Input type="password" required value={value} onChange={(e: React.ChangeEvent<HTMLInputElement>) => onValueChange(e.target.value)} />
+          </div>
+          <DialogFooter>
+            <Button type="button" variant="outline" onClick={onCancel}>{m.common_button_cancel()}</Button>
+            <Button type="submit" disabled={isPending}>{m['admin-users_dialog_password_confirm']()}</Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+/** 删除用户确认对话框（输入用户名确认） */
+export function UserDeleteDialog({
+  open,
+  confirmName,
+  username,
+  isPending,
+  onOpenChange,
+  onConfirmNameChange,
+  onSubmit,
+}: DialogProps & {
+  open: boolean
+  confirmName: string
+  onOpenChange: (open: boolean) => void
+  onConfirmNameChange: (value: string) => void
+  onSubmit: () => void
+}) {
+  return (
+    <AlertDialog open={open} onOpenChange={onOpenChange}>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>{m['admin-users_dialog_delete_title']()}</AlertDialogTitle>
+          <AlertDialogDescription>
+            {m['admin-users_dialog_delete_description']({ username })}
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <Input placeholder={m['admin-users_dialog_delete_placeholder']()} value={confirmName} onChange={(e: React.ChangeEvent<HTMLInputElement>) => onConfirmNameChange(e.target.value)} />
+        <AlertDialogFooter>
+          <AlertDialogCancel>{m.common_button_cancel()}</AlertDialogCancel>
+          <AlertDialogAction
+            disabled={confirmName !== username || isPending}
+            onClick={onSubmit}
+          >{m['admin-users_dialog_delete_confirm']()}</AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  )
+}

package/src/components/user/user-filters.tsx

@@ -15,18 +15,18 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { useNavigate, useSearch } from "@tanstack/react-router";
+import { useNavigate } from "@tanstack/react-router";
 import { m } from '@/paraglide/messages.js'
 import { useCallback } from "react";
-import { Input } from "@/components/ui/input";
-import { Button } from "@/components/ui/button";
+import { Input } from "@allbluecn/ui/input";
+import { Button } from "@allbluecn/ui/button";
 import {
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
   SelectValue,
-} from "@/components/ui/select";
+} from "@allbluecn/ui/select";
 import { SearchIcon, XIcon } from "lucide-react";
 
 interface UserFiltersProps {

package/src/lib/auth/page-gate.ts

@@ -0,0 +1,28 @@
+import { redirect } from '@tanstack/react-router'
+
+interface SessionLike {
+  user?: { id?: string; role?: string | null } | null
+}
+
+/**
+ * admin「需登录页面」beforeLoad gate：未登录跳登录并携带回跳；
+ * 已登录但非管理员（ADMIN/SUPER_ADMIN）拒绝回登录页。
+ * session 取自 __root beforeLoad 注入的 context.session（勿在此重复调 getSessionFn）。
+ */
+export function requireAdminPage(args: {
+  context: { session: SessionLike | null }
+  location: { pathname: string; searchStr: string }
+}): void {
+  if (!args.context.session?.user?.id) {
+    throw redirect({
+      to: '/login',
+      search: { redirect: args.location.pathname + args.location.searchStr },
+    })
+  }
+  if (
+    args.context.session.user.role !== 'ADMIN' &&
+    args.context.session.user.role !== 'SUPER_ADMIN'
+  ) {
+    throw redirect({ to: '/login' })
+  }
+}

package/src/lib/auth.config.ts

@@ -22,6 +22,7 @@ import type { PrismaClient } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/avatar/avatar-config'
 import { resolveIpLocation, getClientIp } from '@allbluecn/kernel'
+import { isLoginBlocked, recordLoginFailure, clearLoginFailures } from '@/server/middlewares/auth-rate-limit'
 
 let _prisma: PrismaClient | null = null
 async function getDb(): Promise<PrismaClient> {
@@ -66,13 +67,7 @@ export const authConfig: StartAuthJSConfig = {
         const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string }
         if (!creds.email || !creds.password) return null
 
-        const user = await getDb().then(db => db.user.findUnique({
-          where: { email: creds.email },
-          select: { id: true, email: true, username: true, password: true, role: true, status: true },
-        }))
-
-        // 用户不存在：userId 为外键，无法记录日志（保持现状）
-        if (!user) return null
+        const loginEmail = creds.email.toLowerCase().trim()
 
         // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
         let ip: string | null = null
@@ -84,7 +79,26 @@ export const authConfig: StartAuthJSConfig = {
             userAgent = headers.get('user-agent') || null
           }
         } catch {
-          // 忽略：IP/UA 仅用于日志，获取失败不影响登录
+          // 忽略：IP/UA 仅用于限流与日志，获取失败不影响登录
+        }
+
+        // SEC-09：登录失败限流（email+IP 维度，仅失败计数，成功清零）。
+        // 被限流返回 null——与密码错误不可区分，不暴露「被限流」细节（防枚举）。
+        // 测试环境豁免（NODE_ENV=test）在限流器内部处理，e2e 成功登录不受影响。
+        if (isLoginBlocked(loginEmail, ip)) return null
+
+        const user = await getDb().then(db => db.user.findUnique({
+          // 邮箱按原样查询：admin 建号/初始 setup 均原样大小写入库（zod .email() 不转
+          // 小写），归一化查询会静默锁死存量混合大小写账号。限流 key 的归一在
+          // auth-rate-limit 的 loginKey() 内部完成，与 DB 查询口径无关。
+          where: { email: creds.email },
+          select: { id: true, email: true, username: true, password: true, role: true, status: true },
+        }))
+
+        // 用户不存在：userId 为外键，无法记录日志（保持现状）
+        if (!user) {
+          recordLoginFailure(loginEmail, ip)
+          return null
         }
 
         // 安全记录登录日志（DB 异常不阻塞登录流程）
@@ -128,11 +142,13 @@ export const authConfig: StartAuthJSConfig = {
         // 密码校验
         const isValid = await bcrypt.compare(creds.password, user.password)
         if (!isValid) {
+          recordLoginFailure(loginEmail, ip)
           await recordLog(false, '密码错误')
           return null
         }
 
-        // 登录成功：记录 IP/UA/地理位置
+        // 登录成功：清零失败计数 + 记录 IP/UA/地理位置
+        clearLoginFailures(loginEmail, ip)
         const location = await resolveIpLocation(ip)
         await recordLog(true, undefined, location)
         await getDb().then(db => db.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } }))

package/src/lib/i18n/detect.ts

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import { supportedLngs, fallbackLng, isSupportedLocale, type AppLocale } from './config'
+import { fallbackLng, isSupportedLocale, type AppLocale } from './config'
 
 export function detectLocale(request: Request, userLocale: string | null): AppLocale {
   const url = new URL(request.url)

package/src/lib/loader-serial.ts

@@ -0,0 +1,14 @@
+// loader 预取数据的 JSON 归一化：客户端 RPC 路径返回纯 JSON（Date → ISO 字符串），
+// SSR loader 路径若保留 Date 会让同组件在两条路径下收到不同形态。
+// 统一在 loader 出口归一为 JSON 形态，保证与既有 useState + 客户端 fetch 行为一致。
+export type Jsonified<T> = T extends (infer U)[]
+  ? Jsonified<U>[]
+  : T extends Date
+    ? string
+    : T extends object
+      ? { [K in keyof T]: Jsonified<T[K]> }
+      : T
+
+export function jsonify<T>(value: T): Jsonified<T> {
+  return JSON.parse(JSON.stringify(value)) as Jsonified<T>
+}

package/src/providers/index.tsx

@@ -18,7 +18,7 @@
 
 import { ThemeProvider } from "next-themes";
 import { type ReactNode } from "react";
-import { TooltipProvider } from "@/components/ui/tooltip";
+import { TooltipProvider } from "@allbluecn/ui/tooltip";
 
 export function Providers({
   children,