@csntgao/uni-base 0.1.0

package/packages/web-components/src/user-login-transport.ts

@@ -0,0 +1,563 @@
+/** @deprecated The 40.1 login prototype does not use an image captcha. */
+export interface UserLoginCaptcha {
+  seed: string
+  imageUrl: string
+}
+
+export interface UserLoginSmsRequest {
+  mobile: string
+}
+
+export interface UserLoginRequest {
+  mobile: string
+  smsCode: string
+  /** Host-configured application name. Optional only for legacy direct transport calls. */
+  applicationName?: string
+}
+
+export interface UserLoginPasswordRequest {
+  mobile: string
+  password: string
+  applicationName: string
+  rememberSession: boolean
+}
+
+export interface UserLoginQrChallengeRequest {
+  applicationName: string
+}
+
+export interface UserLoginQrChallenge {
+  challengeId: string
+  imageUrl: string
+  /** Server-advertised polling interval. The component falls back to its configured interval. */
+  pollIntervalMs?: number
+  expiresInSeconds?: number
+}
+
+export type UserLoginQrStatus = 'pending' | 'scanned' | 'confirmed' | 'expired' | 'rejected'
+
+export interface UserLoginQrPollResult {
+  status: UserLoginQrStatus
+  result?: UserLoginSuccess
+}
+
+export interface UserLoginSuccess {
+  applicationName: string
+  /** True only when this login request created the account. */
+  isNewUser?: boolean
+}
+
+export type UserLoginTransportErrorCode =
+  | 'INVALID_ARGUMENT'
+  | 'SMS_CODE_INVALID_OR_EXPIRED'
+  | 'SMS_SEND_TOO_FREQUENT'
+  | 'SMS_LOGIN_FAILED'
+  | 'PASSWORD_INVALID'
+  | 'ACCOUNT_LOCKED'
+  | 'ACCOUNT_DISABLED'
+  | 'ORG_ACCESS_DENIED'
+  | 'QR_CHALLENGE_INVALID'
+  | 'QR_CHALLENGE_EXPIRED'
+  | 'QR_LOGIN_REJECTED'
+  | 'QR_LOGIN_UNAVAILABLE'
+  | 'UNKNOWN'
+
+export class UserLoginTransportError extends Error {
+  readonly code: UserLoginTransportErrorCode
+  readonly displayMessage?: string
+
+  constructor(code: UserLoginTransportErrorCode, displayMessage?: string) {
+    super('User login transport request failed')
+    this.name = 'UserLoginTransportError'
+    this.code = code
+    this.displayMessage =
+      code === 'ORG_ACCESS_DENIED'
+        ? normalizeOrganizationAccessDeniedMessage(displayMessage)
+        : undefined
+  }
+}
+
+export interface UserLoginTransport {
+  /** @deprecated Retained for source compatibility; the component does not call it. */
+  createCaptcha?(): UserLoginCaptcha | Promise<UserLoginCaptcha>
+  sendSmsCode(request: UserLoginSmsRequest): Promise<void>
+  login(request: UserLoginRequest): Promise<UserLoginSuccess>
+  loginWithPassword?(request: UserLoginPasswordRequest): Promise<UserLoginSuccess>
+  createQrChallenge?(request: UserLoginQrChallengeRequest): Promise<UserLoginQrChallenge>
+  pollQrChallenge?(challengeId: string, applicationName?: string): Promise<UserLoginQrPollResult>
+}
+
+export interface UniplatBaseUserLoginMetadata {
+  readonly [key: string]: unknown
+}
+
+/**
+ * Optional browser/device context recorded with an application login.
+ *
+ * A Host-provided `deviceId` takes priority over the SDK's deterministic
+ * browser-fingerprint identifier. The SDK never persists this information.
+ */
+export interface UniplatBaseUserLoginDeviceInfo {
+  deviceType?: string
+  deviceName?: string
+  deviceId?: string
+  deviceBrand?: string
+}
+
+export interface UniplatBaseUserLoginTransportOptions {
+  apiBaseUrl: string
+  /** @deprecated Pass applicationName to the User Login component instead. */
+  applicationName?: string
+  /** Optional Host-provided device context for UniplatBase login event records. */
+  deviceInfo?: UniplatBaseUserLoginDeviceInfo
+  setAccessToken(accessToken: string, metadata: UniplatBaseUserLoginMetadata): void | Promise<void>
+  fetch?: typeof fetch
+  /** @deprecated The 40.1 login prototype does not use an image captcha. */
+  seedFactory?: () => string | number
+}
+
+const SMS_PATH = 'general/project/uniplat_base/service/anonymous/system.user/sendVerifyCode'
+const LOGIN_PATH =
+  'general/project/uniplat_base/service/anonymous/application.identity/login-application'
+
+export function createUniplatBaseUserLoginTransport(
+  options: UniplatBaseUserLoginTransportOptions,
+): UserLoginTransport {
+  if (!options || typeof options.setAccessToken !== 'function') {
+    throw new TypeError('UniplatBase user login transport requires setAccessToken()')
+  }
+  const apiBaseUrl = validateApiBaseUrl(options.apiBaseUrl)
+  const legacyApplicationName = normalizeOptionalText(options.applicationName)
+  const loginDeviceInfo = resolveLoginDeviceInfo(options.deviceInfo)
+  const fetchImplementation = options.fetch ?? globalThis.fetch
+  const smsEndpoint = `${apiBaseUrl}/${SMS_PATH}`
+  const loginEndpoint = `${apiBaseUrl}/${LOGIN_PATH}`
+
+  return {
+    async sendSmsCode(request) {
+      const mobile = requireMobile(request.mobile)
+      await requestData(fetchImplementation, smsEndpoint, {
+        mobile,
+      })
+    },
+    async login(request) {
+      const mobile = requireMobile(request.mobile)
+      const smsCode = normalizeRequiredText(request.smsCode, 'SMS code')
+      const applicationName = normalizeRequiredText(
+        request.applicationName || legacyApplicationName,
+        'Application name',
+      )
+      const deviceInfo = await loginDeviceInfo
+      const data = await requestData(fetchImplementation, loginEndpoint, {
+        auth_method: 'sms',
+        mobile,
+        verify_code: smsCode,
+        application_name: applicationName,
+        client_id: applicationName,
+        ...deviceInfo,
+      })
+      return persistLogin(data, applicationName, options.setAccessToken)
+    },
+    async loginWithPassword(request) {
+      const mobile = requireMobile(request.mobile)
+      let password = requirePassword(request.password)
+      const applicationName = normalizeRequiredText(
+        request.applicationName || legacyApplicationName,
+        'Application name',
+      )
+      try {
+        const deviceInfo = await loginDeviceInfo
+        const data = await requestData(fetchImplementation, loginEndpoint, {
+          auth_method: 'password',
+          mobile,
+          password,
+          application_name: applicationName,
+          client_id: applicationName,
+          remember_session: request.rememberSession === true,
+          ...deviceInfo,
+        })
+        return await persistLogin(data, applicationName, options.setAccessToken)
+      } finally {
+        password = ''
+      }
+    },
+    async createQrChallenge(request) {
+      const applicationName = normalizeRequiredText(
+        request.applicationName || legacyApplicationName,
+        'Application name',
+      )
+      const deviceInfo = await loginDeviceInfo
+      const data = await requestData(fetchImplementation, loginEndpoint, {
+        auth_method: 'qr',
+        action: 'create',
+        application_name: applicationName,
+        client_id: applicationName,
+        ...deviceInfo,
+      })
+      const challengeId = normalizeQrChallengeId(data.challenge_id)
+      const imageUrl = normalizeQrImageUrl(data.image_data_url)
+      const pollIntervalMs = optionalInteger(data.poll_interval_ms, 500, 10_000)
+      const expiresInSeconds = optionalInteger(data.expires_in, 1, 600)
+      if (!challengeId || !imageUrl || imageUrl.includes(challengeId)) {
+        throw new UserLoginTransportError('UNKNOWN')
+      }
+      return {
+        challengeId,
+        imageUrl,
+        ...(pollIntervalMs === undefined ? {} : { pollIntervalMs }),
+        ...(expiresInSeconds === undefined ? {} : { expiresInSeconds }),
+      }
+    },
+    async pollQrChallenge(challengeId, requestedApplicationName) {
+      const normalizedChallengeId = normalizeQrChallengeId(challengeId)
+      const applicationName = normalizeRequiredText(
+        requestedApplicationName || legacyApplicationName,
+        'Application name',
+      )
+      if (!normalizedChallengeId) throw new UserLoginTransportError('QR_CHALLENGE_INVALID')
+      let data: Record<string, unknown>
+      try {
+        const deviceInfo = await loginDeviceInfo
+        data = await requestData(fetchImplementation, loginEndpoint, {
+          auth_method: 'qr',
+          action: 'poll',
+          application_name: applicationName,
+          client_id: applicationName,
+          challenge_id: normalizedChallengeId,
+          ...deviceInfo,
+        })
+      } catch (error) {
+        if (error instanceof UserLoginTransportError && error.code === 'QR_CHALLENGE_EXPIRED') {
+          return { status: 'expired' }
+        }
+        if (error instanceof UserLoginTransportError && error.code === 'QR_LOGIN_REJECTED') {
+          return { status: 'rejected' }
+        }
+        throw error
+      }
+      const status = normalizeQrStatus(data.status)
+      if (!status) throw new UserLoginTransportError('UNKNOWN')
+      if (status !== 'confirmed') return { status }
+      return {
+        status,
+        result: await persistLogin(data, applicationName, options.setAccessToken),
+      }
+    },
+  }
+}
+
+function resolveLoginDeviceInfo(
+  configured: UniplatBaseUserLoginDeviceInfo | undefined,
+): Promise<Record<string, string>> {
+  return resolveLoginDeviceInfoAsync(configured)
+}
+
+async function resolveLoginDeviceInfoAsync(
+  configured: UniplatBaseUserLoginDeviceInfo | undefined,
+): Promise<Record<string, string>> {
+  const defaults = defaultBrowserDeviceInfo()
+  const deviceType = normalizeOptionalLoginDeviceText(
+    configured?.deviceType ?? defaults.device_type,
+    'device_type',
+    50,
+  )
+  const deviceName = normalizeOptionalLoginDeviceText(
+    configured?.deviceName ?? defaults.device_name,
+    'device_name',
+    200,
+  )
+  const deviceId = normalizeOptionalLoginDeviceText(configured?.deviceId, 'device_id', 200)
+  const deviceBrand = normalizeOptionalLoginDeviceText(
+    configured?.deviceBrand ?? defaults.device_brand,
+    'device_brand',
+    500,
+  )
+  return {
+    ...(deviceType ? { device_type: deviceType } : {}),
+    ...(deviceName ? { device_name: deviceName } : {}),
+    device_id: deviceId ?? (await createBrowserFingerprintId()),
+    ...(deviceBrand ? { device_brand: deviceBrand } : {}),
+  }
+}
+
+function defaultBrowserDeviceInfo(): Record<string, string> {
+  if (typeof navigator === 'undefined') {
+    return { device_type: 'web', device_name: 'Browser', device_brand: 'Web' }
+  }
+  const userAgent = navigator.userAgent || ''
+  const userAgentData = (navigator as NavigatorWithUserAgentData).userAgentData
+  const platform = userAgentData?.platform || navigator.platform || ''
+  const brands = userAgentData?.brands
+    ?.map(({ brand, version }) => [brand, version].filter(Boolean).join(' '))
+    .filter(Boolean)
+    .join(', ')
+  return {
+    device_type: userAgentData?.mobile ? 'mobile_web' : 'web',
+    device_name: [browserName(userAgent), platform].filter(Boolean).join(' on '),
+    device_brand: brands || navigator.vendor || platform || 'Web',
+  }
+}
+
+interface NavigatorWithUserAgentData extends Navigator {
+  userAgentData?: {
+    mobile?: boolean
+    platform?: string
+    brands?: readonly { brand?: string; version?: string }[]
+  }
+  deviceMemory?: number
+}
+
+async function createBrowserFingerprintId(): Promise<string> {
+  const fingerprint = browserFingerprintSource()
+  const subtle = globalThis.crypto?.subtle
+  if (subtle && typeof TextEncoder !== 'undefined') {
+    const digest = await subtle.digest('SHA-256', new TextEncoder().encode(fingerprint))
+    return `web-${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('')}`
+  }
+  return `web-${stableFingerprintHash(fingerprint)}`
+}
+
+function browserFingerprintSource(): string {
+  if (typeof navigator === 'undefined') return 'uniplat:web:unknown-browser'
+  const userAgentData = (navigator as NavigatorWithUserAgentData).userAgentData
+  const screenInfo = typeof screen === 'undefined' ? undefined : screen
+  const screenSize = screenInfo
+    ? [screenInfo.width, screenInfo.height].sort((left, right) => left - right).join('x')
+    : ''
+  return JSON.stringify({
+    userAgent: navigator.userAgent || '',
+    platform: userAgentData?.platform || navigator.platform || '',
+    vendor: navigator.vendor || '',
+    languages: navigator.languages?.join(',') || navigator.language || '',
+    mobile: userAgentData?.mobile === true,
+    brands: userAgentData?.brands ?? [],
+    screen: screenSize,
+    colorDepth: screenInfo?.colorDepth ?? 0,
+    pixelDepth: screenInfo?.pixelDepth ?? 0,
+    touchPoints: navigator.maxTouchPoints ?? 0,
+    hardwareConcurrency: navigator.hardwareConcurrency ?? 0,
+    deviceMemory: (navigator as NavigatorWithUserAgentData).deviceMemory ?? 0,
+    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || '',
+  })
+}
+
+function stableFingerprintHash(value: string): string {
+  let hash = 2_166_136_261
+  for (let index = 0; index < value.length; index += 1) {
+    hash = Math.imul(hash ^ value.charCodeAt(index), 16_777_619)
+  }
+  return (hash >>> 0).toString(16).padStart(8, '0')
+}
+
+function browserName(userAgent: string): string {
+  if (/Edg\//.test(userAgent)) return 'Microsoft Edge'
+  if (/Firefox\//.test(userAgent)) return 'Firefox'
+  if (/Chrome\//.test(userAgent) || /Chromium\//.test(userAgent)) return 'Chrome'
+  if (/Safari\//.test(userAgent)) return 'Safari'
+  return 'Browser'
+}
+
+function normalizeOptionalLoginDeviceText(
+  rawValue: string | undefined,
+  field: string,
+  maxLength: number,
+): string | undefined {
+  if (rawValue === undefined) return undefined
+  const value = normalizeOptionalText(rawValue)
+  if (value.length > maxLength) {
+    throw new TypeError(`${field} must contain at most ${maxLength} characters`)
+  }
+  return value || undefined
+}
+
+async function persistLogin(
+  data: Record<string, unknown>,
+  expectedApplicationName: string,
+  setAccessToken: UniplatBaseUserLoginTransportOptions['setAccessToken'],
+): Promise<UserLoginSuccess> {
+  let accessToken = text(data.token).trim()
+  try {
+    const responseApplicationName = text(data.application_name).trim()
+    if (!accessToken || responseApplicationName !== expectedApplicationName) {
+      throw new UserLoginTransportError('UNKNOWN')
+    }
+    await setAccessToken(accessToken, withoutCredentials(data))
+    const isNewUser = optionalBoolean(data.is_new_user)
+    return {
+      applicationName: responseApplicationName,
+      ...(isNewUser === undefined ? {} : { isNewUser }),
+    }
+  } finally {
+    accessToken = ''
+  }
+}
+
+async function requestData(
+  fetchImplementation: typeof fetch | undefined,
+  endpoint: string,
+  body: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  if (!fetchImplementation) throw new UserLoginTransportError('UNKNOWN')
+  const response = await fetchImplementation(endpoint, {
+    method: 'POST',
+    credentials: 'include',
+    headers: {
+      accept: 'application/json',
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify(body),
+  })
+  if (!response.ok) throw new UserLoginTransportError('UNKNOWN')
+
+  const envelope = asRecord(await response.json())
+  if (number(envelope.rescode) !== 0) {
+    const code = normalizeTransportErrorCode(envelope.error_code)
+    throw new UserLoginTransportError(code, code === 'ORG_ACCESS_DENIED' ? text(envelope.msg) : '')
+  }
+  return asRecord(envelope.data)
+}
+
+function validateApiBaseUrl(rawValue: string): string {
+  const value = typeof rawValue === 'string' ? rawValue.trim() : ''
+  if (!value) throw new TypeError('UniplatBase API base URL is required')
+  const documentBase = typeof document === 'undefined' ? 'https://localhost/' : document.baseURI
+  let url: URL
+  try {
+    url = new URL(value, documentBase)
+  } catch {
+    throw new TypeError('UniplatBase API base URL is invalid')
+  }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+    throw new TypeError('UniplatBase API base URL must use HTTP(S) without user credentials')
+  }
+  if (url.search || url.hash) {
+    throw new TypeError('UniplatBase API base URL must not contain query or hash')
+  }
+  return url.href.replace(/\/+$/, '')
+}
+
+function requireMobile(rawValue: string): string {
+  const mobile = typeof rawValue === 'string' ? rawValue.trim() : ''
+  if (!/^1[3-9]\d{9}$/.test(mobile)) throw new Error('Mobile number is invalid')
+  return mobile
+}
+
+function requirePassword(rawValue: string): string {
+  const password = typeof rawValue === 'string' ? rawValue : ''
+  if (!password || password.length > 1024) throw new TypeError('Password is required')
+  return password
+}
+
+function normalizeRequiredText(rawValue: unknown, label: string): string {
+  const value = typeof rawValue === 'string' ? rawValue.trim() : ''
+  if (!value) throw new TypeError(`${label} is required`)
+  return value
+}
+
+function normalizeOptionalText(rawValue: unknown): string {
+  return typeof rawValue === 'string' ? rawValue.trim() : ''
+}
+
+function withoutCredentials(data: Record<string, unknown>): UniplatBaseUserLoginMetadata {
+  const metadata = { ...data }
+  delete metadata.token
+  delete metadata.jwt
+  delete metadata.access_token
+  return metadata
+}
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {}
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' ? value : ''
+}
+
+function number(value: unknown): number {
+  return typeof value === 'number' && Number.isFinite(value) ? value : Number.NaN
+}
+
+function optionalBoolean(value: unknown): boolean | undefined {
+  return typeof value === 'boolean' ? value : undefined
+}
+
+function optionalInteger(value: unknown, minimum: number, maximum: number): number | undefined {
+  return typeof value === 'number' &&
+    Number.isInteger(value) &&
+    value >= minimum &&
+    value <= maximum
+    ? value
+    : undefined
+}
+
+function normalizeQrChallengeId(value: unknown): string {
+  const challengeId = text(value).trim()
+  return /^[A-Za-z0-9_-]{32,128}$/.test(challengeId) ? challengeId : ''
+}
+
+function normalizeQrImageUrl(value: unknown): string {
+  const imageUrl = text(value).trim()
+  if (/^data:image\/(?:png|jpeg|gif|webp|svg\+xml)[;,]/i.test(imageUrl)) return imageUrl
+  let url: URL
+  try {
+    url = new URL(imageUrl)
+  } catch {
+    return ''
+  }
+  if (
+    !['http:', 'https:'].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  ) {
+    return ''
+  }
+  return url.href
+}
+
+function normalizeQrStatus(value: unknown): UserLoginQrStatus | undefined {
+  return ['pending', 'scanned', 'confirmed', 'expired', 'rejected'].includes(text(value))
+    ? (value as UserLoginQrStatus)
+    : undefined
+}
+
+function normalizeTransportErrorCode(value: unknown): UserLoginTransportErrorCode {
+  if (
+    [
+      'INVALID_ARGUMENT',
+      'SMS_CODE_INVALID_OR_EXPIRED',
+      'SMS_SEND_TOO_FREQUENT',
+      'SMS_LOGIN_FAILED',
+      'PASSWORD_INVALID',
+      'ACCOUNT_LOCKED',
+      'ACCOUNT_DISABLED',
+      'ORG_ACCESS_DENIED',
+      'QR_CHALLENGE_INVALID',
+      'QR_CHALLENGE_EXPIRED',
+      'QR_LOGIN_REJECTED',
+      'QR_LOGIN_UNAVAILABLE',
+    ].includes(text(value))
+  ) {
+    return value as UserLoginTransportErrorCode
+  }
+  return 'UNKNOWN'
+}
+
+function normalizeOrganizationAccessDeniedMessage(value: unknown): string | undefined {
+  const message = text(value).trim()
+  const prefix = '当前用户没有可用的'
+  const suffix = '应用实例'
+  const content = message.endsWith('。') || message.endsWith('！') ? message.slice(0, -1) : message
+  if (!content.startsWith(prefix) || !content.endsWith(suffix)) return undefined
+  const applicationTitle = content.slice(prefix.length, -suffix.length)
+  if (!applicationTitle || applicationTitle.length > 64) return undefined
+  const containsUnsafeCharacter = [...applicationTitle].some((character) => {
+    const code = character.charCodeAt(0)
+    return code <= 31 || code === 127 || character === '<' || character === '>'
+  })
+  return containsUnsafeCharacter ? undefined : message
+}