@csntgao/uni-base 0.1.0

package/packages/web-components/src/uniplat-base-identity-ticket.ts

@@ -0,0 +1,202 @@
+import type { ApplicationLaunchResult } from './application-switcher-transport'
+import { resolveUniplatBaseApplicationEntryUrl } from './uniplat-base-application-ticket'
+
+export const UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY = 'uniplat_identity_ticket'
+export const UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY = 'source_system'
+
+export interface UniplatBaseIdentityTicketLoginOptions {
+  serviceBaseUrl: string
+  applicationName: string
+  setAccessToken(accessToken: string): void | Promise<void>
+  fetch?: typeof fetch
+}
+
+const LOGIN_PATH = 'anonymous/application.identity/login_with_ticket'
+const MIN_TICKET_LENGTH = 32
+const MAX_TICKET_LENGTH = 128
+const TICKET_LIFETIME_SECONDS = 15
+const MAX_SOURCE_SYSTEM_LENGTH = 128
+
+export async function loginWithUniplatBaseIdentityTicket(
+  options: UniplatBaseIdentityTicketLoginOptions,
+): Promise<boolean> {
+  if (!options || typeof options.setAccessToken !== 'function') {
+    throw new TypeError('Identity ticket login requires setAccessToken()')
+  }
+  const serviceBaseUrl = validateServiceBaseUrl(options.serviceBaseUrl)
+  const applicationName = requireText(options.applicationName, 'Application name', 255)
+  if (typeof window === 'undefined') return false
+
+  const fragment = readIdentityTicketFragment(window.location.hash)
+  if (!fragment.hasTicket) return false
+  let ticket = fragment.ticket
+  clearIdentityTicketFragment()
+  const fetchImplementation = options.fetch ?? globalThis.fetch
+  const endpoint = `${serviceBaseUrl}/${LOGIN_PATH}`
+  let accessToken = ''
+  let publicErrorMessage = ''
+  try {
+    ticket = requireTicket(ticket)
+    const sourceSystem = requireOptionalText(fragment.sourceSystem, MAX_SOURCE_SYSTEM_LENGTH)
+    if (!fetchImplementation) throw new Error('Fetch is unavailable')
+    const body: Record<string, string> = { application: applicationName, ticket }
+    if (sourceSystem) body.source_system = sourceSystem
+    const response = await fetchImplementation(endpoint, {
+      method: 'POST',
+      credentials: 'omit',
+      headers: {
+        accept: 'application/json',
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    })
+    if (!response.ok) throw new Error('Identity ticket login failed')
+    const envelope = asRecord(await response.json())
+    if (number(envelope.rescode) !== 0) {
+      publicErrorMessage = identityTicketPublicErrorMessage(envelope)
+      throw new Error('Identity ticket login failed')
+    }
+    const data = asRecord(envelope.data)
+    accessToken = text(data.token).trim()
+    if (!accessToken || text(data.application_name).trim() !== applicationName) {
+      throw new Error('Identity ticket login failed')
+    }
+    await options.setAccessToken(accessToken)
+    return true
+  } catch {
+    throw new Error(publicErrorMessage || '身份票据登录失败')
+  } finally {
+    accessToken = ''
+    ticket = ''
+  }
+}
+
+export function createIdentityTicketLaunchResult(
+  entryUrl: string,
+  rawTicket: unknown,
+  rawExpiresIn: unknown,
+  rawSourceSystem: unknown,
+): ApplicationLaunchResult {
+  const ticket = requireTicket(rawTicket)
+  const expiresIn = number(rawExpiresIn)
+  if (expiresIn !== TICKET_LIFETIME_SECONDS) {
+    throw new Error('Identity ticket response is invalid')
+  }
+  const sourceSystem = text(rawSourceSystem).trim()
+  if (!sourceSystem || sourceSystem.length > MAX_SOURCE_SYSTEM_LENGTH) {
+    throw new Error('Identity ticket response is invalid')
+  }
+  const url = new URL(resolveUniplatBaseApplicationEntryUrl(entryUrl))
+  url.hash = new URLSearchParams([
+    [UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY, ticket],
+    [UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY, sourceSystem],
+  ]).toString()
+  return { url: url.href }
+}
+
+function readIdentityTicketFragment(hash: string): {
+  hasTicket: boolean
+  ticket: string
+  sourceSystem: string
+} {
+  const fragment = hash.startsWith('#') ? hash.slice(1) : hash
+  const params = new URLSearchParams(fragment)
+  return {
+    hasTicket: params.has(UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY),
+    ticket: params.get(UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY)?.trim() ?? '',
+    sourceSystem: params.get(UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY) ?? '',
+  }
+}
+
+function clearIdentityTicketFragment(): void {
+  const fragment = window.location.hash.startsWith('#')
+    ? window.location.hash.slice(1)
+    : window.location.hash
+  const params = new URLSearchParams(fragment)
+  params.delete(UNIPLAT_IDENTITY_TICKET_FRAGMENT_KEY)
+  params.delete(UNIPLAT_IDENTITY_TICKET_SOURCE_SYSTEM_FRAGMENT_KEY)
+  const remainingFragment = params.toString()
+  const cleanUrl = `${window.location.pathname}${window.location.search}${remainingFragment ? `#${remainingFragment}` : ''}`
+  window.history.replaceState(window.history.state, '', cleanUrl)
+}
+
+function identityTicketPublicErrorMessage(envelope: Record<string, unknown>): string {
+  const allowedCodes = new Set([
+    'IDENTITY_TICKET_INVALID',
+    'IDENTITY_TICKET_SYSTEM_UNAVAILABLE',
+    'IDENTITY_TICKET_SOURCE_UNAVAILABLE',
+    'IDENTITY_TICKET_IDENTITY_NOT_READY',
+    'IDENTITY_TICKET_APPLICATION_ACCESS_DENIED',
+  ])
+  const code = text(envelope.error_code)
+  const message = text(envelope.msg)
+  if (
+    !allowedCodes.has(code) ||
+    !message ||
+    message.length > 200 ||
+    [...message].some((character) => {
+      const codePoint = character.charCodeAt(0)
+      return codePoint <= 31 || codePoint === 127
+    })
+  ) {
+    return ''
+  }
+  return message
+}
+
+function requireTicket(rawValue: unknown): string {
+  const ticket = text(rawValue).trim()
+  if (
+    ticket.length < MIN_TICKET_LENGTH ||
+    ticket.length > MAX_TICKET_LENGTH ||
+    !/^[A-Za-z0-9_-]+$/.test(ticket)
+  ) {
+    throw new Error('Identity ticket response is invalid')
+  }
+  return ticket
+}
+
+function requireText(rawValue: unknown, label: string, maxLength: number): string {
+  const value = text(rawValue).trim()
+  if (!value || value.length > maxLength) throw new TypeError(`${label} is required`)
+  return value
+}
+
+function requireOptionalText(rawValue: unknown, maxLength: number): string {
+  const value = text(rawValue).trim()
+  if (value.length > maxLength) throw new Error('Identity ticket response is invalid')
+  return value
+}
+
+function validateServiceBaseUrl(rawValue: string): string {
+  const value = typeof rawValue === 'string' ? rawValue.trim() : ''
+  if (!value) throw new TypeError('UniplatBase serviceBaseUrl is required')
+  const documentBase = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let url: URL
+  try {
+    url = new URL(value, documentBase)
+  } catch {
+    throw new TypeError('UniplatBase serviceBaseUrl is invalid')
+  }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+    throw new TypeError('UniplatBase serviceBaseUrl must use HTTP(S) without user credentials')
+  }
+  if (url.search || url.hash) {
+    throw new TypeError('UniplatBase serviceBaseUrl must not contain query or hash')
+  }
+  return url.href.replace(/\/$/, '')
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {}
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' ? value : ''
+}
+
+function number(value: unknown): number {
+  return typeof value === 'number' ? value : Number.NaN
+}

package/packages/web-components/src/uniplat-base-notification-center-transport.ts

@@ -0,0 +1,378 @@
+import type {
+  NotificationAttachment,
+  NotificationCenterTransport,
+  NotificationContentType,
+  NotificationDto,
+  NotificationInboxQuery,
+  NotificationInboxResult,
+  NotificationReadStatus,
+  NotificationRealtimeChange,
+  NotificationResource,
+  NotificationSource,
+  NotificationTypeSummary,
+} from '@uniplat/ai-employee-client'
+
+export interface UniplatBaseNotificationCenterTransportOptions {
+  serviceBaseUrl: string
+  getAccessToken(): string | Promise<string>
+  fetch?: typeof fetch
+}
+
+const NOTIFICATION_SERVICE = 'messaging.notification_api'
+const FILESYSTEM_SERVICE = 'filesystem.api'
+const INBOX_ACTION = 'inbox'
+const UNREAD_COUNT_ACTION = 'unread_count'
+const MARK_READ_ACTION = 'mark_read'
+const MARK_ALL_READ_ACTION = 'mark_all_read'
+const ARCHIVE_ACTION = 'archive'
+const CREATE_DOWNLOAD_TICKET_ACTION = 'create_download_ticket'
+
+export function createUniplatBaseNotificationCenterTransport(
+  options: UniplatBaseNotificationCenterTransportOptions,
+): NotificationCenterTransport {
+  if (!options || typeof options.getAccessToken !== 'function') {
+    throw new TypeError('Notification center transport requires getAccessToken()')
+  }
+  const serviceBaseUrl = validateServiceBaseUrl(options.serviceBaseUrl)
+  const fetchImplementation = options.fetch ?? globalThis.fetch
+  const request = async (
+    service: string,
+    action: string,
+    body: Record<string, unknown>,
+  ): Promise<unknown> => {
+    const token = await resolveAccessToken(options.getAccessToken)
+    return requestData(fetchImplementation, `${serviceBaseUrl}/${service}/${action}`, token, body)
+  }
+
+  return {
+    async listInbox(query: NotificationInboxQuery): Promise<NotificationInboxResult> {
+      const body: Record<string, unknown> = {
+        page_size: Math.max(1, Math.floor(query.pageSize)),
+      }
+      assignApplicationName(body, query.applicationName)
+      if (query.beforeId) body.before_id = requiredText(query.beforeId, 128)
+      if (query.includeTypeFacets) body.include_type_facets = true
+      const types = (query.notificationTypes ?? [])
+        .map((value) => optionalText(value, 64))
+        .filter(Boolean)
+      if (types.length) body.notification_types = types
+      if (query.readStatus) body.read_status = query.readStatus
+      if (query.includeArchived) body.include_archived = true
+      const data = record(await request(NOTIFICATION_SERVICE, INBOX_ACTION, body))
+      return {
+        items: Array.isArray(data.items)
+          ? data.items
+              .map(parseNotification)
+              .filter((value): value is NotificationDto => value !== null)
+          : [],
+        hasMore: data.has_more === true,
+        nextId: textOrNull(data.next_id),
+        ...(Array.isArray(data.type_facets)
+          ? { types: parseTypeFacets(data.type_facets) }
+          : undefined),
+      }
+    },
+    async getUnreadCount(params) {
+      const body: Record<string, unknown> = {}
+      assignApplicationName(body, params.applicationName)
+      const data = record(await request(NOTIFICATION_SERVICE, UNREAD_COUNT_ACTION, body))
+      return { unreadCount: nonNegativeInteger(data.unread_count) }
+    },
+    async markRead(params) {
+      const body: Record<string, unknown> = {
+        notification_id: requiredText(params.notificationId, 128),
+      }
+      assignApplicationName(body, params.applicationName)
+      const data = record(await request(NOTIFICATION_SERVICE, MARK_READ_ACTION, body))
+      return {
+        unreadCount: nonNegativeInteger(data.unread_count),
+        readAt: textOrNull(data.read_at),
+      }
+    },
+    async markAllRead(params) {
+      const body: Record<string, unknown> = {}
+      assignApplicationName(body, params.applicationName)
+      if (params.beforeId) body.before_id = requiredText(params.beforeId, 128)
+      const types = (params.notificationTypes ?? [])
+        .map((value) => optionalText(value, 64))
+        .filter(Boolean)
+      if (types.length) body.notification_types = types
+      const data = record(await request(NOTIFICATION_SERVICE, MARK_ALL_READ_ACTION, body))
+      return {
+        markedCount: nonNegativeInteger(data.marked_count),
+        unreadCount: nonNegativeInteger(data.unread_count),
+      }
+    },
+    async archive(params) {
+      const body: Record<string, unknown> = {
+        notification_id: requiredText(params.notificationId, 128),
+      }
+      assignApplicationName(body, params.applicationName)
+      const data = record(await request(NOTIFICATION_SERVICE, ARCHIVE_ACTION, body))
+      return { unreadCount: nonNegativeInteger(data.unread_count) }
+    },
+    async downloadAttachment(params) {
+      const fileId = requiredText(params.fileId, 128)
+      const ticketBody: Record<string, unknown> = { file_id: fileId, disposition: 'attachment' }
+      const ticketData = record(
+        await request(FILESYSTEM_SERVICE, CREATE_DOWNLOAD_TICKET_ACTION, ticketBody),
+      )
+      const downloadUrl = resolveDownloadUrl(text(ticketData.download_url), serviceBaseUrl)
+      if (!downloadUrl) throw new Error('Notification attachment download ticket is invalid')
+      if (!fetchImplementation) throw new Error('Fetch is unavailable')
+      const response = await fetchImplementation(downloadUrl, {
+        method: 'GET',
+        credentials: 'include',
+      })
+      if (!response.ok) throw new Error('Notification attachment download failed')
+      return response.blob()
+    },
+    parseRealtimeEvent(event): NotificationRealtimeChange | null {
+      const data = record(event)
+      const eventType = text(data.event_type)
+      const unreadRaw = data.unread_count
+      const unreadCount =
+        typeof unreadRaw === 'number' && Number.isFinite(unreadRaw)
+          ? Math.max(0, Math.floor(unreadRaw))
+          : undefined
+      if (eventType === 'notification_created') {
+        const notification = parseNotification(data.notification)
+        if (!notification) return null
+        return { kind: 'created', notification, unreadCount }
+      }
+      if (eventType === 'notification_read') {
+        const ids = collectNotificationIds(data)
+        if (!ids.length) return null
+        return { kind: 'read', notificationIds: ids, unreadCount, readAt: textOrNull(data.read_at) }
+      }
+      if (eventType === 'notification_archived') {
+        const ids = collectNotificationIds(data)
+        if (!ids.length) return null
+        return { kind: 'archived', notificationIds: ids, unreadCount }
+      }
+      return null
+    },
+  }
+}
+
+function collectNotificationIds(data: Record<string, unknown>): string[] {
+  const ids: string[] = []
+  if (Array.isArray(data.notification_ids)) {
+    for (const value of data.notification_ids) {
+      const id = text(value)
+      if (id) ids.push(id)
+    }
+  }
+  const single = text(data.notification_id)
+  if (single && !ids.includes(single)) ids.push(single)
+  return ids
+}
+
+/** 只取分类目录需要的 code 与展示名；total/unread 暂不进入 UI，不做无用投影。 */
+function parseTypeFacets(value: readonly unknown[]): NotificationTypeSummary[] {
+  const summaries: NotificationTypeSummary[] = []
+  for (const entry of value) {
+    const data = record(entry)
+    const type = optionalText(data.notification_type, 64)
+    if (!type) continue
+    summaries.push({ type, name: optionalText(data.notification_type_name, 128) })
+  }
+  return summaries
+}
+
+function parseNotification(value: unknown): NotificationDto | null {
+  const data = record(value)
+  const id = text(data.notification_id ?? data.id)
+  if (!id) return null
+  return {
+    id,
+    type: text(data.notification_type) || 'other',
+    typeName: text(data.notification_type_name),
+    title: text(data.title),
+    summary: text(data.summary),
+    content: text(data.content),
+    contentType: contentType(data.content_type),
+    priority: text(data.priority) || 'normal',
+    source: parseSource(data.source),
+    resources: parseResources(data.resources),
+    attachments: parseAttachments(data.attachments),
+    readStatus: readStatus(data.read_status),
+    readAt: textOrNull(data.read_at),
+    archivedAt: textOrNull(data.archived_at),
+    createdAt: text(data.created_at),
+    expiresAt: textOrNull(data.expires_at),
+  }
+}
+
+function parseSource(value: unknown): NotificationSource | null {
+  const data = record(value)
+  const type = text(data.type)
+  const code = text(data.code)
+  const id = text(data.id)
+  const name = text(data.name)
+  const avatarUrl = safeImageUrl(data.avatar_url)
+  if (!type && !code && !id && !name && !avatarUrl) return null
+  return { type, code, id, name, avatarUrl }
+}
+
+function parseResources(value: unknown): NotificationResource[] {
+  if (!Array.isArray(value)) return []
+  const resources: NotificationResource[] = []
+  for (const entry of value) {
+    const data = record(entry)
+    const type = text(data.type)
+    const id = text(data.id)
+    const title = text(data.title)
+    const aeCode = text(data.ae_code)
+    if (!type && !id && !title && !aeCode) continue
+    resources.push({ type, id, title, aeCode })
+  }
+  return resources
+}
+
+function parseAttachments(value: unknown): NotificationAttachment[] {
+  if (!Array.isArray(value)) return []
+  const attachments: NotificationAttachment[] = []
+  for (const entry of value) {
+    const data = record(entry)
+    const fileId = text(data.file_id)
+    const name = text(data.name)
+    if (!fileId && !name) continue
+    attachments.push({
+      fileId,
+      versionId: text(data.version_id),
+      name,
+      sizeBytes: nonNegativeInteger(data.size_bytes),
+      mimeType: text(data.mime_type),
+    })
+  }
+  return attachments
+}
+
+async function requestData(
+  fetchImplementation: typeof fetch | undefined,
+  endpoint: string,
+  accessToken: string,
+  body: Record<string, unknown>,
+): Promise<unknown> {
+  if (!fetchImplementation) throw new Error('Fetch is unavailable')
+  const response = await fetchImplementation(endpoint, {
+    method: 'POST',
+    credentials: 'include',
+    headers: {
+      accept: 'application/json',
+      authorization: `Bearer ${accessToken}`,
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  })
+  if (!response.ok) throw new Error('Notification request failed')
+  const payload: unknown = await response.json()
+  const envelope = record(payload)
+  if ('rescode' in envelope) {
+    if (Number(envelope.rescode) !== 0) throw new Error('Notification request failed')
+    return envelope.data
+  }
+  return payload
+}
+
+function resolveDownloadUrl(rawUrl: string, serviceBaseUrl: string): string {
+  const value = rawUrl.trim()
+  if (!value) return ''
+  try {
+    const origin = new URL(serviceBaseUrl).origin
+    const url = new URL(value, origin)
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) return ''
+    return url.href
+  } catch {
+    return ''
+  }
+}
+
+function validateServiceBaseUrl(value: string): string {
+  const raw = typeof value === 'string' ? value.trim() : ''
+  if (!raw) throw new TypeError('Notification center serviceBaseUrl is required')
+  const base = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let parsed: URL
+  try {
+    parsed = new URL(raw, base)
+  } catch {
+    throw new TypeError('Notification center serviceBaseUrl is invalid')
+  }
+  if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password) {
+    throw new TypeError('Notification center serviceBaseUrl must use safe HTTP(S)')
+  }
+  if (parsed.search || parsed.hash) {
+    throw new TypeError('Notification center serviceBaseUrl must not contain query or hash')
+  }
+  return parsed.href.replace(/\/$/, '')
+}
+
+async function resolveAccessToken(provider: () => string | Promise<string>): Promise<string> {
+  let value = ''
+  try {
+    value = (await provider()).trim()
+  } catch {
+    // Provider details may contain credentials and are intentionally discarded.
+  }
+  if (!value) throw new Error('Access token is unavailable')
+  return value
+}
+
+function requiredText(value: unknown, maximumLength: number): string {
+  const normalized = optionalText(value, maximumLength)
+  if (!normalized) throw new Error('Required notification field is missing')
+  return normalized
+}
+
+function optionalText(value: unknown, maximumLength: number): string {
+  return typeof value === 'string' ? value.trim().slice(0, maximumLength) : ''
+}
+
+function assignApplicationName(body: Record<string, unknown>, value: unknown): void {
+  const applicationName = optionalText(value, 128)
+  if (applicationName) body.application_name = applicationName
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' || typeof value === 'number' ? String(value).trim() : ''
+}
+
+function textOrNull(value: unknown): string | null {
+  const normalized = text(value)
+  return normalized ? normalized : null
+}
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {}
+}
+
+function contentType(value: unknown): NotificationContentType {
+  return value === 'markdown' ? 'markdown' : 'text'
+}
+
+function readStatus(value: unknown): NotificationReadStatus {
+  return value === 'read' ? 'read' : 'unread'
+}
+
+function nonNegativeInteger(value: unknown): number {
+  const parsed = Number(value)
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : 0
+}
+
+function safeImageUrl(value: unknown): string {
+  const raw = text(value)
+  if (!raw) return ''
+  try {
+    const base = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+    const url = new URL(raw, base)
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) {
+      return ''
+    }
+    return url.href
+  } catch {
+    return ''
+  }
+}