@autional-cn/shared 0.1.0-rc.5 → 0.1.0-rc.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autional-cn/shared",
-  "version": "0.1.0-rc.5",
+  "version": "0.1.0-rc.6",
   "description": "Autional shared layer — API client, auth, types, hooks, utils",
   "license": "AGPL-3.0",
   "main": "./src/index.ts",

package/src/api/__tests__/namespace.test.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { needsNamespaceHeader } from '../namespace';
+
+describe('needsNamespaceHeader', () => {
+	it('密钥 admin 组端点（列表/子路径/查询）需注 X-Namespace', () => {
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/detail?key=a/b')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/batch-delete')).toBe(true);
+		expect(needsNamespaceHeader('/secret/api/v1/admin/secrets/policy')).toBe(true);
+	});
+
+	it('非密钥 admin 端点不注头', () => {
+		expect(needsNamespaceHeader('/notification/api/v1/admin/announcements')).toBe(false);
+		expect(needsNamespaceHeader('/tenant/api/v1/admin/tenants')).toBe(false);
+	});
+
+	it('secret 公开面/internal 面不注头（前端不消费）', () => {
+		expect(needsNamespaceHeader('/secret/public/jwt/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/secret/api/v1/secret/public/transmission/public-key')).toBe(false);
+		expect(needsNamespaceHeader('/api/v1/internal/secret/jwt/keys')).toBe(false);
+	});
+
+	it('相对路径缺省（undefined/空）不注头', () => {
+		expect(needsNamespaceHeader(undefined)).toBe(false);
+		expect(needsNamespaceHeader('')).toBe(false);
+	});
+});

package/src/api/client.ts

@@ -9,9 +9,10 @@
 import axios, { AxiosError } from 'axios';
 import type { AxiosInstance, InternalAxiosRequestConfig } from 'axios';
 import { camelCaseKeys, snakeCaseKeys } from '../utils/case';
-import { getApiBaseUrl } from '../config';
+import { API_NAMESPACE, getApiBaseUrl } from '../config';
 import { getTraceParentHeader } from './trace';
 import { ENTRY_PLANE_HEADER, resolveEntryPlane } from './entry-plane';
+import { NAMESPACE_HEADER, needsNamespaceHeader } from './namespace';
 import { AuthService } from '../auth/service';
 
 function setupInterceptors(instance: AxiosInstance) {
@@ -39,6 +40,11 @@ function setupInterceptors(instance: AxiosInstance) {
 			config.headers['X-Tenant-ID'] = tenantId;
 		}
 
+		// secret 管理面（§13-A P1-B）：admin 组端点 fail-closed 要求 X-Namespace ∈ S
+		if (needsNamespaceHeader(config.url)) {
+			config.headers[NAMESPACE_HEADER] = API_NAMESPACE;
+		}
+
 		// 请求体 camelCase → snake_case 转换（后端 Go 期望 snake_case）
 		if (config.data && typeof config.data === 'object' && !(config.data instanceof FormData)) {
 			config.data = snakeCaseKeys(config.data);

package/src/api/namespace.ts

@@ -0,0 +1,14 @@
+/**
+ * secret 服务管理面 namespace（§13-A P1-B / SEC-204/207）：
+ * `/secret/api/v1/admin*` 端点 fail-closed 要求 `X-Namespace ∈ 实例服务集合 S`
+ * （NamespaceMiddleware，缺头/未服务 → 400）。值取部署配置 VITE_API_NAMESPACE
+ * （见 config，缺省 "dev" 与服务端 DefaultNamespace 对称）。
+ */
+
+export const NAMESPACE_HEADER = 'X-Namespace';
+
+export const SECRET_ADMIN_PATH_PREFIX = '/secret/api/v1/admin';
+
+export function needsNamespaceHeader(url?: string): boolean {
+	return !!url && url.includes(SECRET_ADMIN_PATH_PREFIX);
+}

package/src/config/index.ts

@@ -356,6 +356,10 @@ export function getPLATFORM_CONSOLE_URL(): string {
 }
 export const API_BASE_URL = getEnv('VITE_API_BASE_URL', '/bff');
 
+// secret 管理面 namespace（§13-A P1-B）：admin 组端点要求 X-Namespace ∈ S（fail-closed）；
+// 缺省 "dev" 与服务端 DefaultNamespace（service-core cross/registry keyid.go）对称
+export const API_NAMESPACE = getEnv('VITE_API_NAMESPACE', 'dev');
+
 export function getApiBaseUrl(): string {
 	return API_BASE_URL;
 }

package/src/vite-env.d.ts

@@ -9,6 +9,7 @@ interface ImportMetaEnv {
 	readonly VITE_OAUTH_CLIENT_ID: string;
 	readonly VITE_AUTH_PAGES_URL: string;
 	readonly VITE_API_BASE_URL: string;
+	readonly VITE_API_NAMESPACE: string;
 	readonly VITE_AUDIT_BASE_URL: string;
 	[key: string]: string | boolean | undefined;
 }