@autional-cn/shared 0.1.0-rc.4 → 0.1.0-rc.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autional-cn/shared",
-  "version": "0.1.0-rc.4",
+  "version": "0.1.0-rc.6",
   "description": "Autional shared layer — API client, auth, types, hooks, utils",
   "license": "AGPL-3.0",
   "main": "./src/index.ts",

package/src/api/__tests__/namespace.test.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { needsNamespaceHeader } from '../namespace';
+
+describe('needsNamespaceHeader', () => {
+	it('密钥 admin 组端点（列表/子路径/查询）需注 X-Namespace', () => {
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/detail?key=a/b')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/batch-delete')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/policy')).toBe(true);
+	});
+
+	it('非密钥 admin 端点不注头', () => {
+		expect(needsNamespaceHeader('/notification/api/v1/admin/announcements')).toBe(false);
+		expect(needsNamespaceHeader('/tenant/api/v1/admin/tenants')).toBe(false);
+	});
+
+	it('secret 公开面/internal 面不注头（前端不消费）', () => {
+		expect(needsNamespaceHeader('/secret/public/jwt/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/secret/api/v1/secret/public/transmission/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/api/v1/internal/secret/jwt/keys')).toBe(false);
+	});
+
+	it('相对路径缺省（undefined/空）不注头', () => {
+		expect(needsNamespaceHeader(undefined)).toBe(false);
+		expect(needsNamespaceHeader('')).toBe(false);
+	});
+});

package/src/api/client.ts

@@ -9,9 +9,10 @@
 import axios, { AxiosError } from 'axios';
 import type { AxiosInstance, InternalAxiosRequestConfig } from 'axios';
 import { camelCaseKeys, snakeCaseKeys } from '../utils/case';
-import { getApiBaseUrl } from '../config';
+import { API_NAMESPACE, getApiBaseUrl } from '../config';
 import { getTraceParentHeader } from './trace';
 import { ENTRY_PLANE_HEADER, resolveEntryPlane } from './entry-plane';
+import { NAMESPACE_HEADER, needsNamespaceHeader } from './namespace';
 import { AuthService } from '../auth/service';
 
 function setupInterceptors(instance: AxiosInstance) {
@@ -39,6 +40,11 @@ function setupInterceptors(instance: AxiosInstance) {
 			config.headers['X-Tenant-ID'] = tenantId;
 		}
 
+		// secret 管理面（§13-A P1-B）：admin 组端点 fail-closed 要求 X-Namespace ∈ S
+		if (needsNamespaceHeader(config.url)) {
+			config.headers[NAMESPACE_HEADER] = API_NAMESPACE;
+		}
+
 		// 请求体 camelCase → snake_case 转换（后端 Go 期望 snake_case）
 		if (config.data && typeof config.data === 'object' && !(config.data instanceof FormData)) {
 			config.data = snakeCaseKeys(config.data);

package/src/api/namespace.ts

@@ -0,0 +1,14 @@
+/**
+ * secret 服务管理面 namespace（§13-A P1-B / SEC-204/207）：
+ * `/secret/api/v1/admin*` 端点 fail-closed 要求 `X-Namespace ∈ 实例服务集合 S`
+ * （NamespaceMiddleware，缺头/未服务 → 400）。值取部署配置 VITE_API_NAMESPACE
+ * （见 config，缺省 "dev" 与服务端 DefaultNamespace 对称）。
+ */
+
+export const NAMESPACE_HEADER = 'X-Namespace';
+
+export const SECRET_ADMIN_PATH_PREFIX = '/secret/api/v1/admin';
+
+export function needsNamespaceHeader(url?: string): boolean {
+	return !!url && url.includes(SECRET_ADMIN_PATH_PREFIX);
+}

package/src/config/index.ts

@@ -356,6 +356,10 @@ export function getPLATFORM_CONSOLE_URL(): string {
 }
 export const API_BASE_URL = getEnv('VITE_API_BASE_URL', '/bff');
 
+// secret 管理面 namespace（§13-A P1-B）：admin 组端点要求 X-Namespace ∈ S（fail-closed）；
+// 缺省 "dev" 与服务端 DefaultNamespace（service-core cross/registry keyid.go）对称
+export const API_NAMESPACE = getEnv('VITE_API_NAMESPACE', 'dev');
+
 export function getApiBaseUrl(): string {
 	return API_BASE_URL;
 }

package/src/generated/api.ts

@@ -1,6 +1,6 @@
 // Auto-generated from swagger.json annotations
 // DO NOT EDIT — run `python scripts/generate_api_ts.py` to regenerate
-// Generated: 2026-08-22 19:20:02
+// Generated: 2026-09-30 17:04:31
 
 // @ts-nocheck — auto-generated; validated by check-generated-api.py
 import type * as Types from './types';
@@ -6855,6 +6855,20 @@ export async function mfaWebauthnCredentialsByCredentialsPut(webauthnCredentialI
 // Notification Service
 // ============================================================
 
+/**
+ * 管理端列出公告
+ * 管理端分页查询本租户公告列表，支持按状态过滤和关键词搜索；与用户面 /announcements 同体（同租户范围），走 admin 受众供控制台读取 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
+ */
+export async function adminAnnouncements(params?: {
+  page?: number;  // 页码
+  page_size?: number;  // 每页条数
+  status?: string;  // 状态过滤: draft/scheduled/published/expired
+  search?: string;  // 搜索关键词
+}) {
+  const res = await api.get(`/notification/api/v1/admin/announcements`, { params });
+  return res.data;
+}
+
 /**
  * 创建公告
  * 创建新的公告，支持草稿/定时发布，可指定目标租户和角色 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
@@ -7224,15 +7238,25 @@ export async function notificationsStats() {
 
 /**
  * SSE实时通知流
- * 通过Server-Sent Events实时推送通知，客户端需传入user_id查询参数进行订阅 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
+ * 通过Server-Sent Events实时推送通知。P5-4：经 POST /notifications/stream-ticket 换取一次性票据后以 ?ticket= 建流（浏览器 EventSource 主路径）；非浏览器客户端可走 Authorization 头 JWT（?token= 兼容回退已删除）。订阅身份以认证上下文（票据/JWT claims）为准。 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
  */
 export async function notificationsStream(params?: {
-  user_id: string;  // 用户ID
+  ticket?: string;  // 一次性短期票据（P5-4 主路径，60s 内一次性消费）
+  user_id?: string;  // 用户ID（已弃用回退：仅在认证上下文无用户时使用）
 }) {
   const res = await api.get(`/notification/api/v1/notifications/stream`, { params });
   return res.data;
 }
 
+/**
+ * 签发 SSE 短期票据
+ * 为 /notifications/stream 签发一次性票据（P5-4）：浏览器 EventSource 不能携带 Authorization 头，故以 JWT 保护的本端点换取 60s 一次性票据，再以 ?ticket= 建流，避免 access token 进入 URL/接入日志。需 JWT 认证（正常 Authorization 头调用）。
+ */
+export async function notificationsStreamTicketPost() {
+  const res = await api.post(`/notification/api/v1/notifications/stream-ticket`);
+  return res.data;
+}
+
 /**
  * 列出通知模板
  * 获取所有通知模板列表，支持包含已停用模板的选项 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
@@ -7377,7 +7401,7 @@ export async function pushSubscriptionsBySubscriptions(subscriptionId: string) {
 
 /**
  * 获取 VAPID 公钥
- * 返回 Web Push VAPID 公钥，供前端注册 Push 订阅时使用 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
+ * 返回 Web Push VAPID 公钥，供前端注册 Push 订阅时使用（来源：communication-service） 参考：CAN-SPAM Act (15 U.S.C. §7701) — Commercial Email Compliance。
  */
 export async function pushVapidPublicKey() {
   const res = await api.get(`/notification/api/v1/push/vapid-public-key`);

package/src/generated/queries.ts

@@ -1,6 +1,6 @@
 // Auto-generated from swagger.json annotations
 // DO NOT EDIT — run `python scripts/generate_api_ts.py` to regenerate
-// Generated: 2026-08-22 19:20:02
+// Generated: 2026-09-30 17:04:31
 
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import * as api from './api';
@@ -2599,6 +2599,14 @@ export function useMfaWebauthnCredentialsByCredentials(webauthnCredentialId: str
 
 // --- notification-service ---
 
+/** 管理端列出公告 */
+export function useAdminAnnouncements(params?: any) {
+  return useQuery({
+    queryKey: ['notification-service', params] as const,
+    queryFn: () => api.adminAnnouncements(params),
+  });
+}
+
 /** 管理员查看指定用户通知列表 */
 export function useAdminNotifications(params?: any) {
   return useQuery({
@@ -9153,6 +9161,17 @@ export function usePostNotificationsSend_from_template() {
   });
 }
 
+/** 签发 SSE 短期票据 */
+export function usePostNotificationsStream_ticket() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: () => api.notificationsStreamTicketPost(),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['notification-service'] });
+    },
+  });
+}
+
 /** 发送测试通知 */
 export function usePostNotificationsTest() {
   const qc = useQueryClient();

package/src/generated/types.ts

@@ -1,6 +1,6 @@
 // Auto-generated from swagger.json annotations
 // DO NOT EDIT — run `python scripts/generate_api_ts.py` to regenerate
-// Generated: 2026-08-22 06:50:43
+// Generated: 2026-09-30 17:04:31
 
 // ============================================================
 // Shared generic types
@@ -7516,6 +7516,71 @@ export type COSEAlgorithmIdentifier = "-7" | "-8" | "-9" | "-19" | "-35" | "-36"
 // notification-service
 // ============================================================
 
+export interface DataResponsegitee_com_autional_servicenotification_internal_handler_dto_EventMappingResponse {
+  code?: number;
+  data?: EventMappingResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsegitee_com_autional_servicenotification_internal_handler_dto_ExportUserDataResponse {
+  code?: number;
+  data?: ExportUserDataResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsegitee_com_autional_servicenotification_internal_handler_dto_NotificationPreferencesResponse {
+  code?: number;
+  data?: NotificationPreferencesResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsegitee_com_autional_servicenotification_internal_handler_dto_NotificationResponse {
+  code?: number;
+  data?: NotificationResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsegitee_com_autional_servicenotification_internal_handler_dto_StreamTicketResponse {
+  code?: number;
+  data?: StreamTicketResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsegitee_com_autional_servicenotification_internal_handler_dto_TemplateResponse {
+  code?: number;
+  data?: TemplateResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsehandler_HealthErrorResponse {
+  code?: number;
+  data?: HealthErrorResponse;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface DataResponsemap_string_string {
+  code?: number;
+  data?: Map_string_string;
+  message?: string;
+  timestamp?: string;
+}
+
+export interface ListResponsegitee_com_autional_servicenotification_internal_handler_dto_NotificationResponse {
+  code?: number;
+  items?: NotificationResponse[];  // 统一使用 items
+  message?: string;
+  pagination?: PageInfo;  // 分页信息（嵌套对象）
+  timestamp?: string;
+  total?: number;  // 总条数（平铺，便于直接读取）
+}
+
 export interface AnnouncementDetailResponse {
   code?: number;
   data?: AnnouncementResponse;
@@ -7641,48 +7706,6 @@ export interface CreateGlobalVariableRequest {
   value: string;
 }
 
-export interface DataResponsedto_ExportUserDataResponse {
-  code?: number;
-  data?: ExportUserDataResponse;
-  message?: string;
-  timestamp?: string;
-}
-
-export interface DataResponsedto_NotificationPreferencesResponse {
-  code?: number;
-  data?: NotificationPreferencesResponse;
-  message?: string;
-  timestamp?: string;
-}
-
-export interface DataResponsedto_NotificationResponse {
-  code?: number;
-  data?: NotificationResponse;
-  message?: string;
-  timestamp?: string;
-}
-
-export interface DataResponsedto_TemplateResponse {
-  code?: number;
-  data?: TemplateResponse;
-  message?: string;
-  timestamp?: string;
-}
-
-export interface DataResponsehandler_HealthErrorResponse {
-  code?: number;
-  data?: HealthErrorResponse;
-  message?: string;
-  timestamp?: string;
-}
-
-export interface DataResponsemap_string_string {
-  code?: number;
-  data?: Map_string_string;
-  message?: string;
-  timestamp?: string;
-}
-
 export interface DeleteNotificationDetailResponse {
   code?: number;
   data?: DeleteNotificationResponse;
@@ -7776,13 +7799,20 @@ export interface InternalPushSendRequest {
   userId?: string;  // @example user-001
 }
 
-export interface ListResponsedto_NotificationResponse {
-  code?: number;
-  items?: NotificationResponse[];  // 统一使用 items
-  message?: string;
-  pagination?: PageInfo;  // 分页信息（嵌套对象）
-  timestamp?: string;
-  total?: number;  // 总条数（平铺，便于直接读取）
+export interface InternalSendExternalRequest {
+  channel: string;  // @example email
+  locale?: string;  // @example en-US
+  recipient: string;  // @example user@example.com
+  templateCode: string;  // @example status_subscription_confirm
+  variables?: Record<string, string>;
+}
+
+export interface InternalUpsertEventMappingRequest {
+  channel?: string;  // 空 → in_app | @example in_app
+  eventType: string;  // @example user.registered
+  isEnabled?: boolean;  // 空 → true
+  priority?: string;  // 空 → medium | @example medium
+  templateCode: string;  // @example welcome
 }
 
 export interface MarkReadDetailResponse {
@@ -8008,6 +8038,12 @@ export interface SendNotificationRequest {
   userId: string;  // 用户ID | @example usr_abc123
 }
 
+/** 一次性 SSE 票据：60s 内有效、消费一次即失效；以 ?ticket= 建立 EventSource 流 */
+export interface StreamTicketResponse {
+  expiresIn?: number;  // 有效期（秒） | @example 60
+  ticket?: string;  // 一次性票据 | @example 1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0u1V2
+}
+
 export interface TestNotificationDetailResponse {
   code?: number;
   data?: TestNotificationResponse;
@@ -8873,6 +8909,13 @@ export interface DataResponsedomain_PointIntegrityResult {
   timestamp?: string;
 }
 
+export interface DataResponsedto_ExportUserDataResponse {
+  code?: number;
+  data?: ExportUserDataResponse;
+  message?: string;
+  timestamp?: string;
+}
+
 export interface DeleteUserDataRequest {
   userId: string;
 }

package/src/vite-env.d.ts

@@ -9,6 +9,7 @@ interface ImportMetaEnv {
 	readonly VITE_OAUTH_CLIENT_ID: string;
 	readonly VITE_AUTH_PAGES_URL: string;
 	readonly VITE_API_BASE_URL: string;
+	readonly VITE_API_NAMESPACE: string;
 	readonly VITE_AUDIT_BASE_URL: string;
 	[key: string]: string | boolean | undefined;
 }