@dsh-plus/access-gate 0.1.3 → 0.2.0

package/lib/client.js

@@ -91,41 +91,6 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region ../shared/src/client/fields.tsx
-		function TextField(props) {
-			const p = props.prefix ?? "dshp";
-			const invalid = props.invalid === true;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: `${p}-field`,
-				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: `${p}-head`,
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
-							className: `${p}-label`,
-							htmlFor: props.id,
-							children: props.label
-						}), props.badge !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: `${p}-badge ${props.badge.set ? `${p}-badgeSet` : `${p}-badgeUnset`}`,
-							children: props.badge.text
-						}) : null]
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-						id: props.id,
-						className: `${p}-input${invalid ? ` ${p}-inputInvalid` : ""}`,
-						type: props.password === true ? "password" : "text",
-						inputMode: props.numeric === true ? "numeric" : void 0,
-						autoComplete: props.password === true ? "off" : void 0,
-						"aria-invalid": invalid || void 0,
-						value: props.value,
-						disabled: props.disabled === true,
-						onChange: (event) => props.onEdit(event.target.value)
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: invalid ? `${p}-invalid` : `${p}-hint`,
-						children: invalid ? props.invalidLabel ?? "" : props.hint ?? ""
-					})
-				]
-			});
-		}
 		/**
 		* 勾选行：自绘圆角扁平开关（switch），对齐官方 WebUI 无原生 checkbox 的
 		* 设计语言（官方选择类控件全走胶囊/菜单，见 cardCss 的 -switch 规则）。
@@ -196,14 +161,15 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region ../shared/src/client/scope.ts
 		/**
-		* api 直连实现的命名空间 scope（官方配置页 tab 同款模式）。
+		* remote.settings 直连实现的命名空间 scope（官方配置页 tab 同款模式）。
 		* 读：describe 取命名空间视图（脱敏 value/revision + 顶层 writable）；
 		* 刷新：remote `settings/document-updated`（按命名空间过滤）与
 		* `connection/reset`；generation 防旧读覆盖新发布。任何页面 origin
 		* （loopback 或 tailnet 信任域名）下行为一致。
 		* effect 归属调用方 fiber（label 需含插件名以便诊断）。
 		*/
-		function createApiScope(api, ns, c, label) {
+		function createSettingsScope(c, ns, label) {
+			const remote = c.get("remote");
 			let state = {
 				status: "loading",
 				value: void 0,
@@ -218,36 +184,37 @@ window.__ModuleLoader__.load({
 			};
 			const load = async () => {
 				const gen = ++generation;
-				let response;
+				let view;
 				try {
-					response = await api.describe({});
+					const response = await remote.settings.describe();
+					if (!response.ok) return;
+					view = response.value;
 				} catch {
 					return;
 				}
-				if (gen !== generation || !response.result.ok) return;
-				const writable = response.result.value?.writable ?? false;
-				const view = response.result.value?.namespaces.find((candidate) => candidate.ns === ns);
-				if (view === void 0) {
+				if (gen !== generation) return;
+				const namespace = view.namespaces.find((candidate) => candidate.ns === ns);
+				if (namespace === void 0) {
 					publish({
 						status: "unavailable",
 						value: void 0,
 						revision: void 0,
-						writable
+						writable: view.writable
 					});
 					return;
 				}
 				publish({
 					status: "ready",
-					value: view.value,
-					revision: view.revision,
-					writable
+					value: namespace.value,
+					revision: namespace.revision,
+					writable: view.writable
 				});
 			};
 			const refresh = (namespace) => {
 				if (namespace !== void 0 && namespace !== ns) return;
 				load();
 			};
-			const disposers = [c.get("remote").$on("settings/document-updated", refresh), c.on("connection/reset", () => {
+			const disposers = [remote.$on("settings/document-updated", refresh), c.on("connection/reset", () => {
 				load();
 			})];
 			c.effect(() => () => {
@@ -265,6 +232,20 @@ window.__ModuleLoader__.load({
 				load
 			};
 		}
+		/** 以 remote.settings 构造命名空间绑定的 api 面。 */
+		function createNamespaceApi(remote, ns) {
+			return {
+				update: async (patch, expectedRevision) => {
+					const response = await remote.update(ns, patch, expectedRevision);
+					if (!response.ok) throw new Error(response.error.message ?? "settings update failed");
+				},
+				describe: async () => {
+					const response = await remote.describe();
+					if (!response.ok) throw new Error(response.error.message ?? "settings describe failed");
+					return response.value;
+				}
+			};
+		}
 		//#endregion
 		//#region ../shared/src/client/styles.ts
 		/**
@@ -379,47 +360,39 @@ ${extra}
 		/**
 		* 「访问控制」配置卡片：注册进 settings.plugin.item 插槽（官方插件配置页）。
 		* 外壳与基础控件走 @dsh-plus/shared/client 套件（CardChrome/TextField/CheckRow），
-		* 本文件保留业务字段（token/白名单 textarea/诊断面板）与保存逻辑。
-		* 配置读写走官方 settingsScope 传输：value 为 schema 解析后的脱敏视图
-		* （token 不出现，tokenConfigured 经 describe 的 secrets 探测），
-		* 保存经 settings.update 深合并（空 token 剔除 = 保持不变）。
-		* 卡片顶部「当前页面诊断」读 /dsh-plus/gate/status（本页放行原因/客户端 IP）。
+		* 本文件保留业务字段（白名单 textarea/诊断面板）与保存逻辑。
+		* 配置读写走官方 settingsScope 传输：value 为 schema 解析后的视图，
+		* 保存经 settings.update 深合并。
+		* 卡片顶部「当前页面诊断」读 /dsh-plus/gate/status（本页放行原因/客户端 IP/
+		* 官方 cookie 状态）。
+		*
+		* 与官方认证合并后：访问凭据由官方 browser-auth 持有（30 天 cookie），
+		* 卡片不再管理令牌；allowedIps 仅为可选附加 IP 围栏。
 		* @module access-gate/client/card
 		*/
 		function draftFromValue(value) {
 			return {
 				enabled: value.enabled,
-				token: "",
 				allowedIpsText: value.allowedIps.join("\n"),
-				trustForwardedFor: value.trustForwardedFor,
-				cookieMaxAgeHours: String(value.cookieMaxAgeHours),
-				loginFailLimit: String(value.loginFailLimit),
-				loginCooldownMs: String(value.loginCooldownMs)
+				trustForwardedFor: value.trustForwardedFor
 			};
 		}
-		function isPositiveInt(text) {
-			return /^[0-9]+$/.test(text) && Number(text) > 0;
-		}
 		function toPatch(draft) {
 			return {
 				enabled: draft.enabled,
 				allowedIps: draft.allowedIpsText.split("\n").map((s) => s.trim()).filter((s) => s.length > 0),
-				trustForwardedFor: draft.trustForwardedFor,
-				cookieMaxAgeHours: Number(draft.cookieMaxAgeHours),
-				loginFailLimit: Number(draft.loginFailLimit),
-				loginCooldownMs: Number(draft.loginCooldownMs)
+				trustForwardedFor: draft.trustForwardedFor
 			};
 		}
 		/** reason 枚举 → 文案 key。 */
 		const REASON_KEYS = {
 			local: "diagLocal",
-			"allowed-ip": "diagAllowedIp",
-			token: "diagToken"
+			cookie: "diagCookie"
 		};
 		function verdictLabel(t, diag) {
 			if (!diag.enabled) return t("diagOff");
 			if (diag.verdict === "pass") return t("diagPass");
-			if (diag.verdict === "login") return t("diagLogin");
+			if (diag.verdict === "token-page") return t("diagTokenPage");
 			return t("diagBlock");
 		}
 		function AccessGateCard(props) {
@@ -428,7 +401,6 @@ ${extra}
 			const value = snapshot.value;
 			const [open, setOpen] = (0, react.useState)(false);
 			const [draft, setDraft] = (0, react.useState)(null);
-			const [tokenConfigured, setTokenConfigured] = (0, react.useState)(false);
 			const [diag, setDiag] = (0, react.useState)(null);
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [status, setStatus] = (0, react.useState)(IDLE_STATUS);
@@ -436,17 +408,6 @@ ${extra}
 				if (value === void 0 || draft !== null) return;
 				setDraft(draftFromValue(value));
 			}, [value, draft]);
-			(0, react.useEffect)(() => {
-				let alive = true;
-				api.describe({}).then((response) => {
-					if (!alive || !response.result.ok) return;
-					const view = response.result.value?.namespaces.find((ns) => ns.ns === SETTINGS_NS);
-					setTokenConfigured(view?.secrets.some((secret) => secret.path.join(".") === "token" && secret.set) ?? false);
-				}).catch(() => {});
-				return () => {
-					alive = false;
-				};
-			}, [api, snapshot]);
 			(0, react.useEffect)(() => {
 				let alive = true;
 				fetch("/dsh-plus/gate/status").then((res) => res.ok ? res.json() : null).then((body) => {
@@ -456,9 +417,7 @@ ${extra}
 					alive = false;
 				};
 			}, [snapshot]);
-			const failClosed = (0, react.useMemo)(() => value?.enabled === true && value.allowedIps.length === 0 && !tokenConfigured, [value, tokenConfigured]);
 			const dirty = (0, react.useMemo)(() => value !== void 0 && draft !== null && JSON.stringify(toPatch(draft)) !== JSON.stringify(toPatch(draftFromValue(value))), [value, draft]);
-			const invalid = (0, react.useMemo)(() => draft !== null && (!isPositiveInt(draft.cookieMaxAgeHours) || !isPositiveInt(draft.loginFailLimit) || !isPositiveInt(draft.loginCooldownMs)), [draft]);
 			if (value === void 0 || draft === null) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", {
 				className: "dag-card",
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -476,14 +435,8 @@ ${extra}
 			const onSave = () => {
 				setSaving(true);
 				const patch = toPatch(draft);
-				if (draft.token !== "") patch.token = draft.token;
 				const revision = scope.getSnapshot().revision;
-				api.update({
-					ns: SETTINGS_NS,
-					patch,
-					...revision !== void 0 ? { expectedRevision: revision } : {}
-				}).then(async (response) => {
-					if (!response.result.ok) throw new Error(response.result.error?.message ?? t("saveFailed"));
+				api.update(patch, revision).then(async () => {
 					await scope.load();
 					const next = scope.getSnapshot().value;
 					if (next !== void 0) setDraft(draftFromValue(next));
@@ -523,14 +476,14 @@ ${extra}
 					key: "save",
 					label: t(saving ? "saving" : "save"),
 					variant: "primary",
-					disabled: !dirty || invalid || saving || disabled,
+					disabled: !dirty || saving || disabled,
 					onClick: onSave
 				}],
 				children: [
-					failClosed ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: "dag-warn",
-						children: t("warnFailClosed")
-					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dag-hint",
+						children: t("mergedHint")
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(CheckRow, {
 						prefix: "dag",
 						id: "dag-enabled",
@@ -539,20 +492,6 @@ ${extra}
 						disabled,
 						onEdit: (v) => edit("enabled", v)
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-token",
-						label: t("token"),
-						hint: t("tokenHint"),
-						value: draft.token,
-						password: true,
-						disabled,
-						badge: {
-							text: t(tokenConfigured ? "tokenSet" : "tokenUnset"),
-							set: tokenConfigured
-						},
-						onEdit: (v) => edit("token", v)
-					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dag-field",
 						children: [
@@ -586,42 +525,6 @@ ${extra}
 						disabled,
 						onEdit: (v) => edit("trustForwardedFor", v)
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-cookie",
-						label: t("cookieMaxAgeHours"),
-						hint: t("cookieMaxAgeHoursHint"),
-						value: draft.cookieMaxAgeHours,
-						numeric: true,
-						disabled,
-						invalid: !isPositiveInt(draft.cookieMaxAgeHours),
-						invalidLabel: t("invalidNumber"),
-						onEdit: (v) => edit("cookieMaxAgeHours", v)
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-faillimit",
-						label: t("loginFailLimit"),
-						hint: t("loginFailLimitHint"),
-						value: draft.loginFailLimit,
-						numeric: true,
-						disabled,
-						invalid: !isPositiveInt(draft.loginFailLimit),
-						invalidLabel: t("invalidNumber"),
-						onEdit: (v) => edit("loginFailLimit", v)
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-cooldown",
-						label: t("loginCooldownMs"),
-						hint: t("loginCooldownMsHint"),
-						value: draft.loginCooldownMs,
-						numeric: true,
-						disabled,
-						invalid: !isPositiveInt(draft.loginCooldownMs),
-						invalidLabel: t("invalidNumber"),
-						onEdit: (v) => edit("loginCooldownMs", v)
-					}),
 					diag !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: `dag-diag${diag.invalidEntries.length > 0 ? " dag-diagWarn" : ""}`,
 						children: [
@@ -659,6 +562,16 @@ ${extra}
 									children: diag.reason !== null ? t(REASON_KEYS[diag.reason] ?? diag.reason) : "—"
 								})]
 							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dag-diagRow",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dag-diagKey",
+									children: t("diagOfficial")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dag-diagVal",
+									children: diag.officialAuthed ? t("diagOfficialYes") : t("diagOfficialNo")
+								})]
+							}),
 							diag.invalidEntries.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "dag-diagRow",
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
@@ -684,69 +597,53 @@ ${extra}
 		const NS = "dsh-plus-access-gate";
 		const ownZh = {
 			title: "访问控制",
-			description: "Web 访问围栏：本机直连放行；远程按白名单 IP 或访问令牌放行，其余拦截到登录页。",
+			description: "Web 访问围栏：与官方登录合并——官方 cookie 为唯一凭据；未认证导航显示启动令牌输入页（PWA 内可用）；可选 IP 附加围栏。",
 			enabled: "启用访问围栏",
-			enabledHint: "关闭即完全旁路（等价插件缺席）；启用后远程流量需命中白名单或令牌。",
-			token: "访问令牌",
-			tokenHint: "留空表示保持已存令牌不变；清空并保存需先输入既有令牌确认。",
-			tokenSet: "已配置",
-			tokenUnset: "未配置",
-			allowedIps: "放行 IP 白名单",
-			allowedIpsHint: "每行一个：精确 IP 或 CIDR（IPv4/IPv6 皆可），如 100.86.108.55 或 fd7a:115c:a1e0::/48。",
+			enabledHint: "关闭即完全旁路（等价插件缺席）；启用后未认证流量被拦截到令牌输入页或拒绝。",
+			mergedHint: "登录凭据由官方认证持有（启动令牌换 30 天 cookie）。获取当前令牌：服务器执行 dshctl url，或本机访问 /dsh-plus/gate/launch-url。",
+			allowedIps: "附加 IP 围栏白名单",
+			allowedIpsHint: "每行一个：精确 IP 或 CIDR（IPv4/IPv6 皆可）。非空时仅白名单来源可通行与登录；留空 = 不限制来源 IP（仅官方登录保护）。",
 			trustForwardedFor: "信任 x-forwarded-for 还原客户端 IP",
 			trustForwardedForHint: "仅当入口代理强制覆盖该头时开启（tailscale serve 满足）；直连暴露场景必须关闭。",
-			cookieMaxAgeHours: "登录有效期（小时）",
-			cookieMaxAgeHoursHint: "令牌登录后 cookie 的有效期。",
-			loginFailLimit: "登录失败阈值",
-			loginFailLimitHint: "每个 IP 在冷却窗口内允许的失败次数，超出进入冷却。",
-			loginCooldownMs: "登录冷却（毫秒）",
-			loginCooldownMsHint: "失败达到阈值后的冷却时长。",
 			diagTitle: "当前页面诊断",
 			diagVerdict: "本页判定",
 			diagClientIp: "客户端 IP",
 			diagReason: "放行原因",
 			diagLocal: "本机直连",
-			diagAllowedIp: "白名单 IP",
-			diagToken: "令牌",
+			diagCookie: "官方 cookie",
+			diagOfficial: "官方登录状态",
+			diagOfficialYes: "已登录",
+			diagOfficialNo: "未登录",
 			diagPass: "放行",
 			diagBlock: "拦截",
-			diagLogin: "登录页",
+			diagTokenPage: "令牌输入页",
 			diagOff: "围栏未启用",
-			diagInvalid: "白名单存在无法解析的条目：",
-			warnFailClosed: "警告：已启用但令牌与白名单均为空——所有远程访问将被拒绝（含本页之外的设备）。"
+			diagInvalid: "白名单存在无法解析的条目："
 		};
 		const ownEn = {
 			title: "Access Control",
-			description: "Web access gate: loopback passes; remote traffic needs an allowlisted IP or the token, others hit the login page.",
+			description: "Web access gate merged with official auth: the official cookie is the sole credential; unauthenticated navigations get a launch-token page (works inside the PWA); optional IP fence.",
 			enabled: "Enable access gate",
-			enabledHint: "Off means full bypass (as if absent); on, remote traffic must match the allowlist or the token.",
-			token: "Access token",
-			tokenHint: "Leave blank to keep the stored token; clearing requires typing the current one.",
-			tokenSet: "Set",
-			tokenUnset: "Not set",
-			allowedIps: "Allowed IP allowlist",
-			allowedIpsHint: "One per line: exact IP or CIDR (IPv4/IPv6), e.g. 100.86.108.55 or fd7a:115c:a1e0::/48.",
+			enabledHint: "Off means full bypass (as if absent); on, unauthenticated traffic hits the token page or is refused.",
+			mergedHint: "Credentials are owned by official auth (launch token exchange, 30-day cookie). Get the current token: run dshctl url on the server, or visit /dsh-plus/gate/launch-url locally.",
+			allowedIps: "Additional IP fence allowlist",
+			allowedIpsHint: "One per line: exact IP or CIDR (IPv4/IPv6). When non-empty only listed sources may pass or log in; empty = no IP restriction (official login only).",
 			trustForwardedFor: "Trust x-forwarded-for for client IP",
 			trustForwardedForHint: "Enable only when the entry proxy overwrites that header (tailscale serve does); must be off for direct exposure.",
-			cookieMaxAgeHours: "Login validity (hours)",
-			cookieMaxAgeHoursHint: "Cookie lifetime after a token login.",
-			loginFailLimit: "Login failure limit",
-			loginFailLimitHint: "Failures per IP within the cooldown window before throttling.",
-			loginCooldownMs: "Login cooldown (ms)",
-			loginCooldownMsHint: "Cooldown duration after reaching the limit.",
 			diagTitle: "This page",
 			diagVerdict: "Verdict",
 			diagClientIp: "Client IP",
 			diagReason: "Reason",
 			diagLocal: "loopback",
-			diagAllowedIp: "allowlisted IP",
-			diagToken: "token",
+			diagCookie: "official cookie",
+			diagOfficial: "Official login",
+			diagOfficialYes: "authenticated",
+			diagOfficialNo: "not authenticated",
 			diagPass: "pass",
 			diagBlock: "blocked",
-			diagLogin: "login page",
+			diagTokenPage: "token page",
 			diagOff: "gate disabled",
-			diagInvalid: "Allowlist entries that failed to parse:",
-			warnFailClosed: "Warning: enabled with no token and an empty allowlist — all remote access will be refused."
+			diagInvalid: "Allowlist entries that failed to parse:"
 		};
 		const zh = mergeDict(commonZh, ownZh);
 		const en = mergeDict(commonEn, ownEn);
@@ -787,8 +684,8 @@ ${extra}
 		const inject = [
 			"slots",
 			"locale",
-			"connection",
-			"remote"
+			"remote",
+			"remote.settings"
 		];
 		function apply(ctx) {
 			const c = ctx;
@@ -800,8 +697,8 @@ ${extra}
 				zh,
 				en
 			}), "access-gate: locale");
-			const api = c.get("connection").api.settings;
-			const scope = createApiScope(api, SETTINGS_NS, c, "access-gate: settings scope");
+			const scope = createSettingsScope(c, SETTINGS_NS, "access-gate: settings scope");
+			const api = createNamespaceApi(c.get("remote").settings, SETTINGS_NS);
 			c.slots.inject("settings.plugin.item", () => c.slots.register({
 				name: "settings.plugin.item",
 				key: SETTINGS_NS,

package/lib/index.d.ts

@@ -3,26 +3,18 @@ import z from "@deepseek-ai/schemastery";
 //#region src/config.d.ts
 declare const Config: z<Schemastery.ObjectS<{
   enabled: z<boolean, boolean>;
-  token: z<string, string>;
   allowedIps: z<string[], string[]>;
   trustForwardedFor: z<boolean, boolean>;
-  cookieMaxAgeHours: z<number, number>;
-  loginFailLimit: z<number, number>;
-  loginCooldownMs: z<number, number>;
 }>, Schemastery.ObjectT<{
   enabled: z<boolean, boolean>;
-  token: z<string, string>;
   allowedIps: z<string[], string[]>;
   trustForwardedFor: z<boolean, boolean>;
-  cookieMaxAgeHours: z<number, number>;
-  loginFailLimit: z<number, number>;
-  loginCooldownMs: z<number, number>;
 }>>;
 type AccessGateConfig = Schemastery.TypeT<typeof Config>;
 //#endregion
 //#region src/index.d.ts
 declare const name = "dsh-plus-access-gate";
-declare const inject: readonly ["webServer"];
+declare const inject: readonly ["webServer", "connection"];
 declare module '@deepseek-ai/cordis' {
   interface Context {
     accessGate: AccessGateService;