@dsh-plus/access-gate 0.1.4 → 0.2.1

package/lib/client.js

@@ -91,41 +91,6 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region ../shared/src/client/fields.tsx
-		function TextField(props) {
-			const p = props.prefix ?? "dshp";
-			const invalid = props.invalid === true;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: `${p}-field`,
-				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: `${p}-head`,
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("label", {
-							className: `${p}-label`,
-							htmlFor: props.id,
-							children: props.label
-						}), props.badge !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: `${p}-badge ${props.badge.set ? `${p}-badgeSet` : `${p}-badgeUnset`}`,
-							children: props.badge.text
-						}) : null]
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-						id: props.id,
-						className: `${p}-input${invalid ? ` ${p}-inputInvalid` : ""}`,
-						type: props.password === true ? "password" : "text",
-						inputMode: props.numeric === true ? "numeric" : void 0,
-						autoComplete: props.password === true ? "off" : void 0,
-						"aria-invalid": invalid || void 0,
-						value: props.value,
-						disabled: props.disabled === true,
-						onChange: (event) => props.onEdit(event.target.value)
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: invalid ? `${p}-invalid` : `${p}-hint`,
-						children: invalid ? props.invalidLabel ?? "" : props.hint ?? ""
-					})
-				]
-			});
-		}
 		/**
 		* 勾选行：自绘圆角扁平开关（switch），对齐官方 WebUI 无原生 checkbox 的
 		* 设计语言（官方选择类控件全走胶囊/菜单，见 cardCss 的 -switch 规则）。
@@ -385,8 +350,9 @@ ${extra}
 		//#region src/ns.ts
 		/**
 		* settings 命名空间字面量（纯常量，零依赖，浏览器半可安全引入）。
-		* 服务端经 settingsNamespace() 品牌化后使用（config.ts），浏览器半将其作为
-		* settings.plugin.item keyed 槽位的 key —— 同一字面量两处共用，防止漂移。
+		* 服务端直接以字面量注册（0.1.2-alpha.2 起 dsh-settings 编译期校验命名空间
+		* 语法，见 config.ts），浏览器半将其作为 settings.plugin.item keyed 槽位的
+		* key —— 同一字面量两处共用，防止漂移。
 		* @module access-gate/ns
 		*/
 		const SETTINGS_NS = "dsh-plus-access-gate";
@@ -395,47 +361,39 @@ ${extra}
 		/**
 		* 「访问控制」配置卡片：注册进 settings.plugin.item 插槽（官方插件配置页）。
 		* 外壳与基础控件走 @dsh-plus/shared/client 套件（CardChrome/TextField/CheckRow），
-		* 本文件保留业务字段（token/白名单 textarea/诊断面板）与保存逻辑。
-		* 配置读写走官方 settingsScope 传输：value 为 schema 解析后的脱敏视图
-		* （token 不出现，tokenConfigured 经 describe 的 secrets 探测），
-		* 保存经 settings.update 深合并（空 token 剔除 = 保持不变）。
-		* 卡片顶部「当前页面诊断」读 /dsh-plus/gate/status（本页放行原因/客户端 IP）。
+		* 本文件保留业务字段（白名单 textarea/诊断面板）与保存逻辑。
+		* 配置读写走官方 settingsScope 传输：value 为 schema 解析后的视图，
+		* 保存经 settings.update 深合并。
+		* 卡片顶部「当前页面诊断」读 /dsh-plus/gate/status（本页放行原因/客户端 IP/
+		* 官方 cookie 状态）。
+		*
+		* 与官方认证合并后：访问凭据由官方 browser-auth 持有（30 天 cookie），
+		* 卡片不再管理令牌；allowedIps 仅为可选附加 IP 围栏。
 		* @module access-gate/client/card
 		*/
 		function draftFromValue(value) {
 			return {
 				enabled: value.enabled,
-				token: "",
 				allowedIpsText: value.allowedIps.join("\n"),
-				trustForwardedFor: value.trustForwardedFor,
-				cookieMaxAgeHours: String(value.cookieMaxAgeHours),
-				loginFailLimit: String(value.loginFailLimit),
-				loginCooldownMs: String(value.loginCooldownMs)
+				trustForwardedFor: value.trustForwardedFor
 			};
 		}
-		function isPositiveInt(text) {
-			return /^[0-9]+$/.test(text) && Number(text) > 0;
-		}
 		function toPatch(draft) {
 			return {
 				enabled: draft.enabled,
 				allowedIps: draft.allowedIpsText.split("\n").map((s) => s.trim()).filter((s) => s.length > 0),
-				trustForwardedFor: draft.trustForwardedFor,
-				cookieMaxAgeHours: Number(draft.cookieMaxAgeHours),
-				loginFailLimit: Number(draft.loginFailLimit),
-				loginCooldownMs: Number(draft.loginCooldownMs)
+				trustForwardedFor: draft.trustForwardedFor
 			};
 		}
 		/** reason 枚举 → 文案 key。 */
 		const REASON_KEYS = {
 			local: "diagLocal",
-			"allowed-ip": "diagAllowedIp",
-			token: "diagToken"
+			cookie: "diagCookie"
 		};
 		function verdictLabel(t, diag) {
 			if (!diag.enabled) return t("diagOff");
 			if (diag.verdict === "pass") return t("diagPass");
-			if (diag.verdict === "login") return t("diagLogin");
+			if (diag.verdict === "token-page") return t("diagTokenPage");
 			return t("diagBlock");
 		}
 		function AccessGateCard(props) {
@@ -444,7 +402,6 @@ ${extra}
 			const value = snapshot.value;
 			const [open, setOpen] = (0, react.useState)(false);
 			const [draft, setDraft] = (0, react.useState)(null);
-			const [tokenConfigured, setTokenConfigured] = (0, react.useState)(false);
 			const [diag, setDiag] = (0, react.useState)(null);
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [status, setStatus] = (0, react.useState)(IDLE_STATUS);
@@ -452,17 +409,6 @@ ${extra}
 				if (value === void 0 || draft !== null) return;
 				setDraft(draftFromValue(value));
 			}, [value, draft]);
-			(0, react.useEffect)(() => {
-				let alive = true;
-				api.describe().then((view) => {
-					if (!alive) return;
-					const ns = view.namespaces.find((candidate) => candidate.ns === SETTINGS_NS);
-					setTokenConfigured(ns?.secrets.some((secret) => secret.path.join(".") === "token" && secret.set) ?? false);
-				}).catch(() => {});
-				return () => {
-					alive = false;
-				};
-			}, [api, snapshot]);
 			(0, react.useEffect)(() => {
 				let alive = true;
 				fetch("/dsh-plus/gate/status").then((res) => res.ok ? res.json() : null).then((body) => {
@@ -472,9 +418,7 @@ ${extra}
 					alive = false;
 				};
 			}, [snapshot]);
-			const failClosed = (0, react.useMemo)(() => value?.enabled === true && value.allowedIps.length === 0 && !tokenConfigured, [value, tokenConfigured]);
 			const dirty = (0, react.useMemo)(() => value !== void 0 && draft !== null && JSON.stringify(toPatch(draft)) !== JSON.stringify(toPatch(draftFromValue(value))), [value, draft]);
-			const invalid = (0, react.useMemo)(() => draft !== null && (!isPositiveInt(draft.cookieMaxAgeHours) || !isPositiveInt(draft.loginFailLimit) || !isPositiveInt(draft.loginCooldownMs)), [draft]);
 			if (value === void 0 || draft === null) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", {
 				className: "dag-card",
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
@@ -492,7 +436,6 @@ ${extra}
 			const onSave = () => {
 				setSaving(true);
 				const patch = toPatch(draft);
-				if (draft.token !== "") patch.token = draft.token;
 				const revision = scope.getSnapshot().revision;
 				api.update(patch, revision).then(async () => {
 					await scope.load();
@@ -534,14 +477,14 @@ ${extra}
 					key: "save",
 					label: t(saving ? "saving" : "save"),
 					variant: "primary",
-					disabled: !dirty || invalid || saving || disabled,
+					disabled: !dirty || saving || disabled,
 					onClick: onSave
 				}],
 				children: [
-					failClosed ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						className: "dag-warn",
-						children: t("warnFailClosed")
-					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dag-hint",
+						children: t("mergedHint")
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(CheckRow, {
 						prefix: "dag",
 						id: "dag-enabled",
@@ -550,20 +493,6 @@ ${extra}
 						disabled,
 						onEdit: (v) => edit("enabled", v)
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-token",
-						label: t("token"),
-						hint: t("tokenHint"),
-						value: draft.token,
-						password: true,
-						disabled,
-						badge: {
-							text: t(tokenConfigured ? "tokenSet" : "tokenUnset"),
-							set: tokenConfigured
-						},
-						onEdit: (v) => edit("token", v)
-					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dag-field",
 						children: [
@@ -597,42 +526,6 @@ ${extra}
 						disabled,
 						onEdit: (v) => edit("trustForwardedFor", v)
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-cookie",
-						label: t("cookieMaxAgeHours"),
-						hint: t("cookieMaxAgeHoursHint"),
-						value: draft.cookieMaxAgeHours,
-						numeric: true,
-						disabled,
-						invalid: !isPositiveInt(draft.cookieMaxAgeHours),
-						invalidLabel: t("invalidNumber"),
-						onEdit: (v) => edit("cookieMaxAgeHours", v)
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-faillimit",
-						label: t("loginFailLimit"),
-						hint: t("loginFailLimitHint"),
-						value: draft.loginFailLimit,
-						numeric: true,
-						disabled,
-						invalid: !isPositiveInt(draft.loginFailLimit),
-						invalidLabel: t("invalidNumber"),
-						onEdit: (v) => edit("loginFailLimit", v)
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
-						prefix: "dag",
-						id: "dag-cooldown",
-						label: t("loginCooldownMs"),
-						hint: t("loginCooldownMsHint"),
-						value: draft.loginCooldownMs,
-						numeric: true,
-						disabled,
-						invalid: !isPositiveInt(draft.loginCooldownMs),
-						invalidLabel: t("invalidNumber"),
-						onEdit: (v) => edit("loginCooldownMs", v)
-					}),
 					diag !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: `dag-diag${diag.invalidEntries.length > 0 ? " dag-diagWarn" : ""}`,
 						children: [
@@ -670,6 +563,16 @@ ${extra}
 									children: diag.reason !== null ? t(REASON_KEYS[diag.reason] ?? diag.reason) : "—"
 								})]
 							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dag-diagRow",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dag-diagKey",
+									children: t("diagOfficial")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dag-diagVal",
+									children: diag.officialAuthed ? t("diagOfficialYes") : t("diagOfficialNo")
+								})]
+							}),
 							diag.invalidEntries.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "dag-diagRow",
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
@@ -695,69 +598,53 @@ ${extra}
 		const NS = "dsh-plus-access-gate";
 		const ownZh = {
 			title: "访问控制",
-			description: "Web 访问围栏：本机直连放行；远程按白名单 IP 或访问令牌放行，其余拦截到登录页。",
+			description: "Web 访问围栏：与官方登录合并——官方 cookie 为唯一凭据；未认证导航显示启动令牌输入页（PWA 内可用）；可选 IP 附加围栏。",
 			enabled: "启用访问围栏",
-			enabledHint: "关闭即完全旁路（等价插件缺席）；启用后远程流量需命中白名单或令牌。",
-			token: "访问令牌",
-			tokenHint: "留空表示保持已存令牌不变；清空并保存需先输入既有令牌确认。",
-			tokenSet: "已配置",
-			tokenUnset: "未配置",
-			allowedIps: "放行 IP 白名单",
-			allowedIpsHint: "每行一个：精确 IP 或 CIDR（IPv4/IPv6 皆可），如 100.86.108.55 或 fd7a:115c:a1e0::/48。",
+			enabledHint: "关闭即完全旁路（等价插件缺席）；启用后未认证流量被拦截到令牌输入页或拒绝。",
+			mergedHint: "登录凭据由官方认证持有（启动令牌换 30 天 cookie）。获取当前令牌：服务器执行 dshctl url，或本机访问 /dsh-plus/gate/launch-url。",
+			allowedIps: "附加 IP 围栏白名单",
+			allowedIpsHint: "每行一个：精确 IP 或 CIDR（IPv4/IPv6 皆可）。非空时仅白名单来源可通行与登录；留空 = 不限制来源 IP（仅官方登录保护）。",
 			trustForwardedFor: "信任 x-forwarded-for 还原客户端 IP",
 			trustForwardedForHint: "仅当入口代理强制覆盖该头时开启（tailscale serve 满足）；直连暴露场景必须关闭。",
-			cookieMaxAgeHours: "登录有效期（小时）",
-			cookieMaxAgeHoursHint: "令牌登录后 cookie 的有效期。",
-			loginFailLimit: "登录失败阈值",
-			loginFailLimitHint: "每个 IP 在冷却窗口内允许的失败次数，超出进入冷却。",
-			loginCooldownMs: "登录冷却（毫秒）",
-			loginCooldownMsHint: "失败达到阈值后的冷却时长。",
 			diagTitle: "当前页面诊断",
 			diagVerdict: "本页判定",
 			diagClientIp: "客户端 IP",
 			diagReason: "放行原因",
 			diagLocal: "本机直连",
-			diagAllowedIp: "白名单 IP",
-			diagToken: "令牌",
+			diagCookie: "官方 cookie",
+			diagOfficial: "官方登录状态",
+			diagOfficialYes: "已登录",
+			diagOfficialNo: "未登录",
 			diagPass: "放行",
 			diagBlock: "拦截",
-			diagLogin: "登录页",
+			diagTokenPage: "令牌输入页",
 			diagOff: "围栏未启用",
-			diagInvalid: "白名单存在无法解析的条目：",
-			warnFailClosed: "警告：已启用但令牌与白名单均为空——所有远程访问将被拒绝（含本页之外的设备）。"
+			diagInvalid: "白名单存在无法解析的条目："
 		};
 		const ownEn = {
 			title: "Access Control",
-			description: "Web access gate: loopback passes; remote traffic needs an allowlisted IP or the token, others hit the login page.",
+			description: "Web access gate merged with official auth: the official cookie is the sole credential; unauthenticated navigations get a launch-token page (works inside the PWA); optional IP fence.",
 			enabled: "Enable access gate",
-			enabledHint: "Off means full bypass (as if absent); on, remote traffic must match the allowlist or the token.",
-			token: "Access token",
-			tokenHint: "Leave blank to keep the stored token; clearing requires typing the current one.",
-			tokenSet: "Set",
-			tokenUnset: "Not set",
-			allowedIps: "Allowed IP allowlist",
-			allowedIpsHint: "One per line: exact IP or CIDR (IPv4/IPv6), e.g. 100.86.108.55 or fd7a:115c:a1e0::/48.",
+			enabledHint: "Off means full bypass (as if absent); on, unauthenticated traffic hits the token page or is refused.",
+			mergedHint: "Credentials are owned by official auth (launch token exchange, 30-day cookie). Get the current token: run dshctl url on the server, or visit /dsh-plus/gate/launch-url locally.",
+			allowedIps: "Additional IP fence allowlist",
+			allowedIpsHint: "One per line: exact IP or CIDR (IPv4/IPv6). When non-empty only listed sources may pass or log in; empty = no IP restriction (official login only).",
 			trustForwardedFor: "Trust x-forwarded-for for client IP",
 			trustForwardedForHint: "Enable only when the entry proxy overwrites that header (tailscale serve does); must be off for direct exposure.",
-			cookieMaxAgeHours: "Login validity (hours)",
-			cookieMaxAgeHoursHint: "Cookie lifetime after a token login.",
-			loginFailLimit: "Login failure limit",
-			loginFailLimitHint: "Failures per IP within the cooldown window before throttling.",
-			loginCooldownMs: "Login cooldown (ms)",
-			loginCooldownMsHint: "Cooldown duration after reaching the limit.",
 			diagTitle: "This page",
 			diagVerdict: "Verdict",
 			diagClientIp: "Client IP",
 			diagReason: "Reason",
 			diagLocal: "loopback",
-			diagAllowedIp: "allowlisted IP",
-			diagToken: "token",
+			diagCookie: "official cookie",
+			diagOfficial: "Official login",
+			diagOfficialYes: "authenticated",
+			diagOfficialNo: "not authenticated",
 			diagPass: "pass",
 			diagBlock: "blocked",
-			diagLogin: "login page",
+			diagTokenPage: "token page",
 			diagOff: "gate disabled",
-			diagInvalid: "Allowlist entries that failed to parse:",
-			warnFailClosed: "Warning: enabled with no token and an empty allowlist — all remote access will be refused."
+			diagInvalid: "Allowlist entries that failed to parse:"
 		};
 		const zh = mergeDict(commonZh, ownZh);
 		const en = mergeDict(commonEn, ownEn);

package/lib/index.d.ts

@@ -3,26 +3,18 @@ import z from "@deepseek-ai/schemastery";
 //#region src/config.d.ts
 declare const Config: z<Schemastery.ObjectS<{
   enabled: z<boolean, boolean>;
-  token: z<string, string>;
   allowedIps: z<string[], string[]>;
   trustForwardedFor: z<boolean, boolean>;
-  cookieMaxAgeHours: z<number, number>;
-  loginFailLimit: z<number, number>;
-  loginCooldownMs: z<number, number>;
 }>, Schemastery.ObjectT<{
   enabled: z<boolean, boolean>;
-  token: z<string, string>;
   allowedIps: z<string[], string[]>;
   trustForwardedFor: z<boolean, boolean>;
-  cookieMaxAgeHours: z<number, number>;
-  loginFailLimit: z<number, number>;
-  loginCooldownMs: z<number, number>;
 }>>;
 type AccessGateConfig = Schemastery.TypeT<typeof Config>;
 //#endregion
 //#region src/index.d.ts
 declare const name = "dsh-plus-access-gate";
-declare const inject: readonly ["webServer"];
+declare const inject: readonly ["webServer", "connection"];
 declare module '@deepseek-ai/cordis' {
   interface Context {
     accessGate: AccessGateService;