@autional-cn/shared 0.1.0-rc

package/src/hooks/useSodMode.ts

@@ -0,0 +1,73 @@
+/**
+ * useSodMode — 租户 SoD 模式 Hook
+ *
+ * 通过 tenant-service API 读取当前租户的 sod_mode 配置，
+ * 决定 `admin` 角色对审计功能的可见性。
+ *
+ * 模式:
+ *   'single' — 小客户模式（默认）: admin 可看 L1 统计 + L2 操作反馈
+ *   'strict' — 大客户/受监管: admin 仅看 L1 统计摘要
+ *
+ * API: GET /api/v1/admin/tenants/{tenantSlug}/sod-config
+ *       PUT /api/v1/admin/tenants/{tenantSlug}/sod-config
+ *
+ * @see document/architecture/decisions/007-security-dashboard-audit.md §2.3
+ */
+
+'use client';
+
+import { useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { apiClient } from '../api/client';
+import { extractItem } from '../utils/response';
+import { useTenantSlug } from '../auth/tenant-slug-context';
+import { useCurrentRole } from './useCurrentRole';
+
+export type SodMode = 'single' | 'strict';
+
+interface SodConfigResponse {
+	tenant_id: string;
+	sod_mode: SodMode;
+	updated_at: string;
+}
+
+/**
+ * 返回当前用户的 sod_mode。
+ * 从 tenant-service 的 /api/v1/admin/tenants/{slug}/sod-config 读取。
+ * 失败或未配置时默认返回 'single'。
+ */
+export function useSodMode(): SodMode {
+	const tenantSlug = useTenantSlug();
+
+	const { data: config } = useQuery<SodConfigResponse | null>({
+		queryKey: ['sod-config', tenantSlug],
+		queryFn: () => fetchSodConfig(tenantSlug),
+		staleTime: 5 * 60 * 1000, // 5 min cache
+		retry: 1,
+		enabled: !!tenantSlug,
+	});
+
+	return config?.sod_mode ?? 'single';
+}
+
+async function fetchSodConfig(slug: string | undefined): Promise<SodConfigResponse | null> {
+	if (!slug) return null;
+	try {
+		const res = await apiClient.get(`/api/v1/admin/tenants/${slug}/sod-config`);
+		return extractItem<SodConfigResponse>(res.data);
+	} catch {
+		return null; // 默认 single
+	}
+}
+
+/**
+ * 判断当前用户在 strict 模式下是否被限制查看审计详情。
+ */
+export function useIsAuditRestricted(): boolean {
+	const sodMode = useSodMode();
+	const role = useCurrentRole();
+
+	return useMemo(() => {
+		return sodMode === 'strict' && role === 'admin';
+	}, [sodMode, role]);
+}

package/src/index.ts

@@ -0,0 +1,209 @@
+// API
+export { apiClient, createApiClient } from './api/client';
+export {
+	setTraceParentProvider,
+	getTraceParentHeader,
+	resetSessionTraceId,
+	enableOtelBridge,
+} from './api/trace';
+export { bffLogin, bffRefresh, bffLogout, isBFFAvailable } from './api/bff-client';
+
+// Auth
+export {
+	useAuthStore,
+	getAccessToken,
+	getRefreshToken,
+	getCurrentTenantId,
+	getCurrentRole,
+	loginWithTokens,
+	logout,
+	isTokenExpired,
+	refreshAccessToken,
+} from './auth/store';
+export { AuthService } from './auth/service';
+export { generatePKCE, generateCodeChallenge } from './auth/pkce';
+export type { PKCEPair } from './auth/pkce';
+export { initiateOAuthLogin, handleOAuthCallback, isOAuthEnabled } from './auth/oauth-login';
+export { buildLoginUrl } from './auth/roles';
+
+// Types
+export type {
+	User,
+	LoginRequest,
+	LoginResponse,
+	RegisterRequest,
+	Tenant,
+	TenantMember,
+	Role,
+	Permission,
+	Application,
+	AuditLog,
+	Session,
+	Department,
+	ListResponse,
+	PageRequest,
+	ApiError,
+	ApiResponse,
+} from './types';
+
+// Hooks
+export {
+	useAuth,
+	useAuthActions,
+	useIsAuthenticated,
+	useUser,
+	useUserId,
+	useAccessToken,
+	useAuthPermissions,
+	useCurrentTenantId,
+	useTenants,
+} from './hooks/useAuth';
+export type { AuthSnapshot, AuthActions } from './hooks/useAuth';
+export { usePermission } from './hooks/usePermission';
+export type { PermissionResult } from './hooks/usePermission';
+export { useLogout } from './hooks/useLogout';
+export { useBootstrap } from './hooks/useBootstrap';
+export type { BootstrapState } from './hooks/useBootstrap';
+export { useSodMode, useIsAuditRestricted } from './hooks/useSodMode';
+export type { SodMode } from './hooks/useSodMode';
+export { useCurrentRole } from './hooks/useCurrentRole';
+
+// Constants
+export { API as API_PATHS } from './constants/api-paths';
+
+// Config
+export {
+	getAUTH_PAGES_URL as AUTH_PAGES_URL,
+	getAUTH_PAGES_URL,
+	getADMIN_CONSOLE_URL as ADMIN_CONSOLE_URL,
+	getADMIN_CONSOLE_URL,
+	getDEVELOPER_PORTAL_URL as DEVELOPER_PORTAL_URL,
+	getDEVELOPER_PORTAL_URL,
+	getEND_USER_PORTAL_URL as END_USER_PORTAL_URL,
+	getEND_USER_PORTAL_URL,
+	getSECURITY_DASHBOARD_URL as SECURITY_DASHBOARD_URL,
+	getSECURITY_DASHBOARD_URL,
+	getSTATUS_PAGE_URL as STATUS_PAGE_URL,
+	getSTATUS_PAGE_URL,
+	getLANDING_SITE_URL as LANDING_SITE_URL,
+	getLANDING_SITE_URL,
+	getAUTHENTICATOR_APP_URL as AUTHENTICATOR_APP_URL,
+	getAUTHENTICATOR_APP_URL,
+	getTRUST_CENTER_URL as TRUST_CENTER_URL,
+	getTRUST_CENTER_URL,
+	getPLATFORM_CONSOLE_URL as PLATFORM_CONSOLE_URL,
+	getPLATFORM_CONSOLE_URL,
+	API_BASE_URL,
+	BASE_PATH,
+	ROUTER_BASENAME,
+	getRouterBasename,
+	VITE_BASE,
+	appPath,
+	navigateTo,
+	crossAppUrl,
+	isValidRedirect,
+	// Portal URL resolver (VITE_PORTAL_CONFIG driven)
+	getRootDomain,
+	getPortalUrl,
+	getAppPortalSlugs,
+} from './config';
+export {
+	SITE_DOMAIN,
+	SITE_EMAIL,
+	SITE_BASE_URL,
+	AUTH_DOMAIN,
+	USER_DOMAIN,
+	APP_DOMAIN,
+	AUTHENTICATOR_DOMAIN,
+	AUTH_BASE_URL,
+	USER_BASE_URL,
+	APP_BASE_URL,
+	AUTHENTICATOR_BASE_URL,
+	DEFAULT_OG_IMAGE,
+	DEFAULT_LOGO,
+} from './config/constants';
+
+// SEO
+export * from './seo';
+
+// Components
+export { RequireAuth } from './components/RequireAuth';
+export { OAuthCallbackPage } from './components/OAuthCallbackPage';
+export { TenantSlugProvider, useTenantSlug } from './auth/tenant-slug-context';
+export { useTenantSlugFromUrl, extractSlugFromPath, registerNonTenantSegments, clearNonTenantSegments } from './auth/slug-from-url';
+export { useOAuthClientIdFromUrl, fetchOAuthClientIdBySlug } from './auth/oauth-client-from-slug';
+export {
+	useTenantRoute,
+	resolveEffectiveClientId,
+	isSameDomainOAuth,
+} from './auth/tenant-route-middleware';
+export {
+	usePermissionsQuery,
+	useTenantsQuery,
+	useMeQuery,
+	AUTH_DATA_STALE_TIME,
+} from './auth/auth-queries';
+export { authQueryKeys } from './auth/auth-queries';
+export type { TenantRouteResult } from './auth/tenant-route-middleware';
+export {
+	AdminGuard,
+	UserMgmtGuard,
+	SecurityGuard,
+	SecurityAdminGuard,
+	AuditorGuard,
+	PlatformGuard,
+	AuthGuard,
+} from './components/PortalGuard';
+export { AuditStatsOnly } from './components/AuditStatsOnly';
+export { TenantIndexGuard, usePublicTenantSlugs } from './components/TenantIndexGuard';
+export type { TenantIndexGuardProps } from './components/TenantIndexGuard';
+export { buildTenantUrls } from './auth/build-tenant-urls';
+export { resolvePortalBasename } from './config/resolve-basename';
+
+// 这里原来有 4 行 re-export：GeneratedApi / ApiGenerated / GeneratedTypes / ApiTypes，
+// 全部指向 @autional-cn/api-generated。2026-09 实测：**全舰队 0 处使用它们**
+// （唯一的出现就是这 4 行自己），而它们正是那份 file: 依赖的唯一消费者。
+// 删掉之后 shared 才能作为 npm 包发布——否则发布出去的清单里会留着一条
+// file:../../scripts/generate/api-generated-package，消费方永远解析不到。
+// 真正的生成代码走的是 @autional-cn/shared/generated/{api,types,queries}（src/generated/*），
+// 五个子路径里全舰队都在用的是那一组，不是这一组。
+
+// Branding（租户品牌 → CSS 变量 / favicon / customCss）
+export {
+	useBranding,
+	applyBrandColors,
+	BrandingInitializer,
+	useTenantBrandingStore,
+	extractBranding,
+	readCachedBranding,
+	writeCachedBranding,
+	BRANDING_CACHE_PREFIX,
+} from './branding';
+export type { Branding } from './branding';
+
+// Lib
+export { getVapidPublicKey, subscribeBrowserPush, unsubscribeBrowserPush } from './lib/push';
+
+// Utils
+export { urlBase64ToUint8Array } from './utils/browser';
+export { camelCaseKeys, snakeCaseKeys } from './utils/case';
+export { extractApiErrorMessage, extractApiError, createHandleApiError } from './utils/error';
+export {
+	extractList,
+	extractItem,
+	extractPagination,
+	extractListResult,
+	fetchList,
+	fetchItem,
+	fetchListResult,
+} from './utils/response';
+export { formatTime, formatDate, formatRelativeTime, setLocaleGetter } from './utils/format';
+export { normalizeViteBase } from './utils/vite';
+export {
+	processPasswordForTransmission,
+	hashPasswordForTransmission,
+} from './utils/password-transmission';
+export type { TransmissionResult } from './utils/password-transmission';
+export type { ExtractedApiError } from './utils/error';
+export type { PaginationInfo, ListResult } from './utils/response';
+// force rebuild 1781616516

package/src/lib/push.ts

@@ -0,0 +1,41 @@
+import { pushVapidPublicKey } from '../generated/api';
+import { extractItem } from '../utils/response';
+import { urlBase64ToUint8Array } from '../utils/browser';
+
+export async function getVapidPublicKey(): Promise<string> {
+	const res = await pushVapidPublicKey();
+	const data = extractItem(res) as { public_key?: string } | null;
+	if (!data?.public_key) {
+		throw new Error('Failed to get VAPID public key');
+	}
+	return data.public_key;
+}
+
+export async function subscribeBrowserPush(
+	vapidPublicKey: string,
+): Promise<PushSubscription | null> {
+	if (!('serviceWorker' in navigator) || !('PushManager' in window)) return null;
+	const registration = await navigator.serviceWorker.ready;
+	const existing = await registration.pushManager.getSubscription();
+	if (existing) return existing;
+	try {
+		return await registration.pushManager.subscribe({
+			userVisibleOnly: true,
+			applicationServerKey: urlBase64ToUint8Array(vapidPublicKey),
+		});
+	} catch (err) {
+		console.error('Push subscription failed:', err);
+		return null;
+	}
+}
+
+export async function unsubscribeBrowserPush(): Promise<boolean> {
+	if (!('serviceWorker' in navigator)) return false;
+	const registration = await navigator.serviceWorker.ready;
+	const sub = await registration.pushManager.getSubscription();
+	if (sub) {
+		await sub.unsubscribe();
+		return true;
+	}
+	return false;
+}

package/src/seo/dom-utils.ts

@@ -0,0 +1,94 @@
+export function upsertMeta(
+	attribute: string,
+	value: string,
+	attrName: 'name' | 'property' = 'name',
+): () => void {
+	const selector = `meta[${attrName}="${attribute}"]`;
+	const el = document.querySelector<HTMLMetaElement>(selector);
+	const previous = el?.content;
+
+	if (el) {
+		el.content = value;
+	} else {
+		const meta = document.createElement('meta');
+		meta.setAttribute(attrName, attribute);
+		meta.content = value;
+		document.head.appendChild(meta);
+		return () => {
+			meta.remove();
+		};
+	}
+
+	return () => {
+		if (previous !== undefined) {
+			el.content = previous;
+		}
+	};
+}
+
+export function upsertCanonical(href: string): () => void {
+	let link = document.querySelector<HTMLLinkElement>('link[rel="canonical"]');
+	const previous = link?.href;
+
+	if (link) {
+		link.href = href;
+	} else {
+		link = document.createElement('link');
+		link.rel = 'canonical';
+		link.href = href;
+		document.head.appendChild(link);
+		return () => {
+			link!.remove();
+		};
+	}
+
+	return () => {
+		if (previous !== undefined && link) {
+			link.href = previous;
+		}
+	};
+}
+
+export function upsertLink(
+	rel: string,
+	href: string,
+	extraAttrs?: Record<string, string>,
+): () => void {
+	const selector = `link[rel="${rel}"]${extraAttrs?.hreflang ? `[hreflang="${extraAttrs.hreflang}"]` : ''}`;
+	const existing = document.querySelector<HTMLLinkElement>(selector);
+	const previous = existing?.href;
+
+	if (existing) {
+		existing.href = href;
+		return () => {
+			if (previous !== undefined) {
+				existing.href = previous;
+			}
+		};
+	} else {
+		const link = document.createElement('link');
+		link.rel = rel;
+		link.href = href;
+		if (extraAttrs) {
+			Object.entries(extraAttrs).forEach(([k, v]) => link.setAttribute(k, v));
+		}
+		document.head.appendChild(link);
+		return () => {
+			link.remove();
+		};
+	}
+}
+
+export function injectJSONLD(schemas: object[]): () => void {
+	schemas.forEach((schema, idx) => {
+		const script = document.createElement('script');
+		script.type = 'application/ld+json';
+		script.setAttribute('data-seo-jsonld', String(idx));
+		script.textContent = JSON.stringify(schema);
+		document.head.appendChild(script);
+	});
+
+	return () => {
+		document.querySelectorAll('script[data-seo-jsonld]').forEach((el) => el.remove());
+	};
+}

package/src/seo/index.ts

@@ -0,0 +1,6 @@
+export { useSEO } from './useSEO';
+export { usePageTitle } from './usePageTitle';
+export { usePageMeta } from './usePageMeta';
+export { getArticleSchema } from './jsonld';
+export { upsertMeta, upsertCanonical, upsertLink, injectJSONLD } from './dom-utils';
+export type { SEOConfig, SiteSEOConfig, BlogPostSchema } from './types';

package/src/seo/jsonld.ts

@@ -0,0 +1,29 @@
+import type { BlogPostSchema } from './types';
+
+export function getArticleSchema(post: BlogPostSchema, baseBlogUrl: string) {
+	const article: Record<string, unknown> = {
+		'@context': 'https://schema.org',
+		'@type': 'BlogPosting',
+		headline: post.title,
+		description: post.excerpt,
+		datePublished: post.date,
+		url: `${baseBlogUrl}/${post.slug}`,
+	};
+
+	if (post.author) {
+		article.author = {
+			'@type': 'Person',
+			name: post.author,
+		};
+	}
+
+	if (post.image) {
+		article.image = post.image;
+	}
+
+	if (post.tags && post.tags.length > 0) {
+		article.keywords = post.tags.join(', ');
+	}
+
+	return article;
+}

package/src/seo/types.ts

@@ -0,0 +1,29 @@
+export interface SiteSEOConfig {
+	siteName?: string;
+	baseUrl?: string;
+	defaultOgImage?: string;
+	hreflang?: boolean;
+	hreflangLanguages?: string[];
+	hreflangXDefault?: string;
+}
+
+export interface SEOConfig {
+	title: string;
+	description: string;
+	ogImage?: string;
+	canonical?: string;
+	type?: 'website' | 'article';
+	publishedTime?: string;
+	author?: string;
+	jsonld?: object[];
+}
+
+export interface BlogPostSchema {
+	title: string;
+	excerpt: string;
+	date: string;
+	author?: string;
+	image?: string;
+	slug: string;
+	tags?: string[];
+}

package/src/seo/usePageMeta.ts

@@ -0,0 +1,17 @@
+import { useEffect } from 'react';
+
+export function usePageMeta(description: string) {
+	useEffect(() => {
+		let meta = document.querySelector('meta[name="description"]') as HTMLMetaElement | null;
+		const previous = meta?.content;
+		if (!meta) {
+			meta = document.createElement('meta');
+			meta.name = 'description';
+			document.head.appendChild(meta);
+		}
+		meta.content = description;
+		return () => {
+			if (meta && previous !== undefined) meta.content = previous;
+		};
+	}, [description]);
+}

package/src/seo/usePageTitle.ts

@@ -0,0 +1,14 @@
+import { useEffect } from 'react';
+
+const DEFAULT_SITE_NAME = 'Autional';
+
+export function usePageTitle(title: string, siteName?: string) {
+	const name = siteName || DEFAULT_SITE_NAME;
+	useEffect(() => {
+		const previous = document.title;
+		document.title = title ? `${title} — ${name}` : name;
+		return () => {
+			document.title = previous;
+		};
+	}, [title, name]);
+}

package/src/seo/useSEO.ts

@@ -0,0 +1,80 @@
+import { useEffect } from 'react';
+import type { SEOConfig, SiteSEOConfig } from './types';
+import { upsertMeta, upsertCanonical, upsertLink, injectJSONLD } from './dom-utils';
+import { SITE_BASE_URL, DEFAULT_OG_IMAGE } from '../config/constants';
+
+const DEFAULTS: Required<SiteSEOConfig> = {
+	siteName: 'Autional',
+	baseUrl: SITE_BASE_URL,
+	defaultOgImage: DEFAULT_OG_IMAGE,
+	hreflang: false,
+	hreflangLanguages: ['zh', 'en'],
+	hreflangXDefault: `${SITE_BASE_URL}/zh/`,
+};
+
+export function useSEO(config: SEOConfig, siteConfig?: SiteSEOConfig) {
+	const s = { ...DEFAULTS, ...siteConfig };
+	const { title, description, ogImage, canonical, type, publishedTime, author, jsonld } = {
+		ogImage: s.defaultOgImage,
+		type: 'website' as const,
+		...config,
+	};
+
+	useEffect(() => {
+		const pageTitle = title ? `${title} — ${s.siteName}` : s.siteName;
+		const prevTitle = document.title;
+		document.title = pageTitle;
+
+		const cleanups: (() => void)[] = [];
+
+		if (s.hreflang) {
+			try {
+				const currentPath = window.location.pathname;
+				const pathMatch = currentPath.match(/^\/(zh|en)(\/.*)?$/);
+				if (pathMatch) {
+					const pagePath = pathMatch[2] || '/';
+					for (const lang of s.hreflangLanguages) {
+						const url = `${s.baseUrl}/${lang}${pagePath === '/' ? '' : pagePath}`;
+						cleanups.push(upsertLink('alternate', url, { hreflang: lang }));
+					}
+					cleanups.push(upsertLink('alternate', s.hreflangXDefault, { hreflang: 'x-default' }));
+				}
+			} catch {
+				/* SSR-safe */
+			}
+		}
+
+		cleanups.push(upsertMeta('description', description));
+		cleanups.push(upsertMeta('og:title', pageTitle, 'property'));
+		cleanups.push(upsertMeta('og:description', description, 'property'));
+		cleanups.push(upsertMeta('og:image', ogImage, 'property'));
+		cleanups.push(upsertMeta('og:type', type, 'property'));
+		cleanups.push(upsertMeta('og:url', canonical || window.location.href, 'property'));
+		cleanups.push(upsertMeta('twitter:card', 'summary_large_image'));
+		cleanups.push(upsertMeta('twitter:title', pageTitle));
+		cleanups.push(upsertMeta('twitter:description', description));
+		cleanups.push(upsertMeta('twitter:image', ogImage));
+
+		if (type === 'article' && publishedTime) {
+			cleanups.push(upsertMeta('article:published_time', publishedTime, 'property'));
+		}
+		if (type === 'article' && author) {
+			cleanups.push(upsertMeta('article:author', author, 'property'));
+		}
+
+		if (canonical) {
+			cleanups.push(upsertCanonical(canonical));
+		}
+
+		let cleanupJSONLD: (() => void) | undefined;
+		if (jsonld && jsonld.length > 0) {
+			cleanupJSONLD = injectJSONLD(jsonld);
+		}
+
+		return () => {
+			document.title = prevTitle;
+			cleanups.forEach((fn) => fn());
+			cleanupJSONLD?.();
+		};
+	}, [title, description, ogImage, canonical, type, publishedTime, author, JSON.stringify(jsonld)]);
+}