@dsh-plus/access-gate 0.2.4 → 0.3.1

package/lib/style.css

@@ -1,4 +1,4 @@
-.obLtqa_block {
+.nVxsMW_block {
   --dsl-diff-radius: 12px;
   --dsl-diff-line-height: 22px;
   color: var(--dsw-alias-label-primary);
@@ -8,7 +8,7 @@
   position: relative;
 }
 
-.obLtqa_copyButton {
+.nVxsMW_copyButton {
   z-index: 1;
   color: var(--dsw-alias-label-secondary);
   cursor: pointer;
@@ -22,46 +22,46 @@
   right: 12px;
 }
 
-.obLtqa_body {
+.nVxsMW_body {
   font: var(--dsw-font-markdown-code-block);
   padding: 12px 14px;
   overflow: auto hidden;
 }
 
-.obLtqa_line {
+.nVxsMW_line {
   min-height: var(--dsl-diff-line-height);
   white-space: pre;
 }
 
-.obLtqa_path {
+.nVxsMW_path {
   color: var(--dsw-alias-label-primary);
   padding-right: 56px;
   font-weight: 600;
 }
 
-.obLtqa_gap {
+.nVxsMW_gap {
   color: var(--dsw-alias-label-tertiary);
 }
 
-.obLtqa_del:before {
+.nVxsMW_del:before {
   content: "- ";
   color: var(--dsw-alias-state-error-primary);
 }
 
-.obLtqa_del {
+.nVxsMW_del {
   color: var(--dsw-alias-state-error-primary);
 }
 
-.obLtqa_add:before {
+.nVxsMW_add:before {
   content: "+ ";
   color: var(--dsw-alias-state-success-primary);
 }
 
-.obLtqa_add {
+.nVxsMW_add {
   color: var(--dsw-alias-state-success-primary);
 }
 
-.obLtqa_expand {
+.nVxsMW_expand {
   width: 100%;
   color: var(--dsw-alias-label-tertiary);
   cursor: pointer;
@@ -73,16 +73,16 @@
   display: block;
 }
 
-.obLtqa_expand:hover {
+.nVxsMW_expand:hover {
   color: var(--dsw-alias-label-secondary);
 }
 
-.obLtqa_footer {
+.nVxsMW_footer {
   font: var(--dsw-font-markdown-code-block);
   color: var(--dsw-alias-label-tertiary);
   padding: 0 14px 12px;
 }
-.folzqq_block {
+.Hbqh2W_block {
   --dsl-code-block-banner-background-color: var(--dsw-alias-markdown-code-block-banner);
   --dsl-code-block-border-radius: 12px;
   --dsl-code-block-banner-font: 11px/18px var(--dsw-font-family);
@@ -94,11 +94,11 @@
   position: relative;
 }
 
-.folzqq_block:not(:last-child) {
+.Hbqh2W_block:not(:last-child) {
   margin-bottom: 11px;
 }
 
-.folzqq_bannerWrap {
+.Hbqh2W_bannerWrap {
   z-index: 6;
   background-color: var(--dsw-alias-bg-base);
   border-top-left-radius: var(--dsl-code-block-border-radius);
@@ -107,7 +107,7 @@
   top: 0;
 }
 
-.folzqq_banner {
+.Hbqh2W_banner {
   background: var(--dsl-code-block-banner-background-color);
   font: var(--dsl-code-block-banner-font);
   border-top-left-radius: var(--dsl-code-block-border-radius);
@@ -119,7 +119,7 @@
   display: flex;
 }
 
-.folzqq_infostring {
+.Hbqh2W_infostring {
   color: var(--dsw-alias-label-primary);
   font-family: var(--ds-font-family-code);
   text-overflow: ellipsis;
@@ -130,13 +130,13 @@
   overflow: hidden;
 }
 
-.folzqq_action {
+.Hbqh2W_action {
   flex-shrink: 0;
   align-items: center;
   display: flex;
 }
 
-.folzqq_copyButton {
+.Hbqh2W_copyButton {
   color: inherit;
   cursor: pointer;
   font: inherit;
@@ -146,7 +146,7 @@
   padding: 0;
 }
 
-.folzqq_block :where(pre) {
+.Hbqh2W_block :where(pre) {
   font: var(--dsl-code-block-content-font);
   white-space: pre-wrap;
   word-break: break-all;
@@ -158,72 +158,72 @@
   margin: 0 !important;
 }
 
-.folzqq_block :where(pre.folzqq_shiki) {
+.Hbqh2W_block :where(pre.Hbqh2W_shiki) {
   background: var(--dsw-alias-markdown-code-block) !important;
 }
 
-.folzqq_block :where(pre) code {
+.Hbqh2W_block :where(pre) code {
   font: inherit;
   background: none;
   padding: 0;
 }
 
-.folzqq_plain {
+.Hbqh2W_plain {
   color: var(--dsw-alias-label-primary);
 }
-.vrxa6G_markdown {
+.BL43XG_markdown {
   overflow-wrap: anywhere;
   min-width: 0;
   font: var(--dsw-font-markdown-base);
   color: var(--dsw-alias-label-primary);
 }
 
-.vrxa6G_markdown strong {
+.BL43XG_markdown strong {
   font-weight: 600;
 }
 
-.vrxa6G_markdown h1 {
+.BL43XG_markdown h1 {
   font: var(--dsw-font-markdown-h1);
   margin: 32px 0 16px;
 }
 
-.vrxa6G_markdown h2 {
+.BL43XG_markdown h2 {
   font: var(--dsw-font-markdown-h2);
   margin: 32px 0 16px;
 }
 
-.vrxa6G_markdown h3 {
+.BL43XG_markdown h3 {
   font: var(--dsw-font-markdown-h3);
   margin: 32px 0 16px;
 }
 
-.vrxa6G_markdown h4 {
+.BL43XG_markdown h4 {
   font: var(--dsw-font-markdown-h4);
   margin: 16px 0;
 }
 
-.vrxa6G_markdown :where(h5, h6) {
+.BL43XG_markdown :where(h5, h6) {
   font: var(--dsw-font-markdown-base-strong);
   margin: 16px 0;
 }
 
-.vrxa6G_markdown :where(h1, h2, h3, h4, h5, h6) strong {
+.BL43XG_markdown :where(h1, h2, h3, h4, h5, h6) strong {
   font-weight: inherit;
 }
 
-.vrxa6G_markdown p {
+.BL43XG_markdown p {
   margin: 16px 0;
 }
 
-.vrxa6G_markdown :where(h4, h5, h6) + :where(ul, ol) {
+.BL43XG_markdown :where(h4, h5, h6) + :where(ul, ol) {
   margin-top: 8px;
 }
 
-.vrxa6G_markdown :where(h4, h5, h6):has( + :where(ul, ol)) {
+.BL43XG_markdown :where(h4, h5, h6):has( + :where(ul, ol)) {
   margin-bottom: 8px;
 }
 
-.vrxa6G_markdown a {
+.BL43XG_markdown a {
   color: var(--dsw-alias-link);
   transition: box-shadow var(--ds-transition-duration) var(--ds-ease-in-out);
   border: 2px solid #fff0;
@@ -235,17 +235,17 @@
   position: relative;
 }
 
-.vrxa6G_markdown a:hover, .vrxa6G_markdown a:focus {
+.BL43XG_markdown a:hover, .BL43XG_markdown a:focus {
   text-decoration: underline dotted var(--dsw-alias-link);
   text-underline-offset: 3px;
   outline: none;
 }
 
-.vrxa6G_markdown a:focus-visible {
+.BL43XG_markdown a:focus-visible {
   box-shadow: 0 0 0 2px var(--dsw-alias-state-business-primary);
 }
 
-.vrxa6G_linkIcon {
+.BL43XG_linkIcon {
   vertical-align: -.25em;
   flex: none;
   width: 1.1em;
@@ -253,46 +253,46 @@
   margin-right: 5px;
 }
 
-.vrxa6G_markdown :where(ul, ol) {
+.BL43XG_markdown :where(ul, ol) {
   margin: 16px 0;
   padding-left: 18px;
 }
 
-.vrxa6G_markdown li:not(:first-child) {
+.BL43XG_markdown li:not(:first-child) {
   margin-top: 6px;
 }
 
-.vrxa6G_markdown li > :where(ul, ol) {
+.BL43XG_markdown li > :where(ul, ol) {
   margin-top: 4px;
 }
 
-.vrxa6G_markdown li::marker {
+.BL43XG_markdown li::marker {
   color: var(--dsw-alias-label-secondary);
   line-height: 24px;
 }
 
-.vrxa6G_markdown :where(ul, ol) ol {
+.BL43XG_markdown :where(ul, ol) ol {
   padding-left: 0;
   list-style-position: inside;
 }
 
-.vrxa6G_markdown :where(ul, ol) ol li p {
+.BL43XG_markdown :where(ul, ol) ol li p {
   display: inline;
 }
 
-.vrxa6G_markdown li > p {
+.BL43XG_markdown li > p {
   margin: 8px 0;
 }
 
-.vrxa6G_markdown li > :first-child {
+.BL43XG_markdown li > :first-child {
   margin-top: 0;
 }
 
-.vrxa6G_markdown li > :last-child:not(.md-code-block) {
+.BL43XG_markdown li > :last-child:not(.md-code-block) {
   margin-bottom: 0;
 }
 
-.vrxa6G_markdown hr {
+.BL43XG_markdown hr {
   background: var(--dsw-alias-border-l2);
   border: none;
   height: .5px;
@@ -300,19 +300,19 @@
   display: block;
 }
 
-.vrxa6G_markdown blockquote {
+.BL43XG_markdown blockquote {
   border-left: 2px solid var(--dsw-alias-label-caption);
   margin: 16px 0 0;
   padding-left: 14px;
 }
 
-.vrxa6G_markdown pre {
+.BL43XG_markdown pre {
   font-family: var(--ds-font-family-code);
   margin: 16px 0;
   overflow: auto;
 }
 
-.vrxa6G_markdown :not(pre) > code {
+.BL43XG_markdown :not(pre) > code {
   box-sizing: border-box;
   font: var(--dsw-font-markdown-code);
   font-family: var(--ds-font-family-code);
@@ -325,54 +325,54 @@
   font-size: .875em !important;
 }
 
-.vrxa6G_markdown :where(h1, h2, h3, h4, h5, h6) code {
+.BL43XG_markdown :where(h1, h2, h3, h4, h5, h6) code {
   font: inherit;
   font-family: var(--ds-font-family-code);
 }
 
-.vrxa6G_markdown .katex-display {
+.BL43XG_markdown .katex-display {
   max-width: 100%;
   overflow: auto hidden;
 }
 
-.vrxa6G_markdown input[type="checkbox"] {
+.BL43XG_markdown input[type="checkbox"] {
   accent-color: var(--dsw-alias-label-secondary);
   margin: 0 8px 0 0;
 }
 
-.vrxa6G_tableScroll {
+.BL43XG_tableScroll {
   overscroll-behavior-x: contain;
   max-width: 100%;
   overflow-x: auto;
 }
 
-.vrxa6G_tableScroll.md-table-wide {
+.BL43XG_tableScroll.md-table-wide {
   padding-bottom: var(--dsh-scrollbar-width, 8px);
   overflow-x: hidden;
 }
 
-.vrxa6G_tableScroll.md-table-wide:hover, .vrxa6G_tableScroll.md-table-wide:focus-visible {
+.BL43XG_tableScroll.md-table-wide:hover, .BL43XG_tableScroll.md-table-wide:focus-visible {
   padding-bottom: 0;
   overflow-x: auto;
 }
 
-.vrxa6G_tableScroll:focus-visible {
+.BL43XG_tableScroll:focus-visible {
   box-shadow: 0 0 0 2px var(--dsw-alias-state-business-primary);
   outline: none;
 }
 
-.vrxa6G_tableScroll table {
+.BL43XG_tableScroll table {
   border-collapse: collapse;
   width: max-content;
   max-width: max-content;
 }
 
-.vrxa6G_tableFill table {
+.BL43XG_tableFill table {
   width: 100%;
   max-width: none;
 }
 
-.vrxa6G_tableScroll th {
+.BL43XG_tableScroll th {
   text-align: start;
   border-bottom: .5px solid var(--dsw-alias-border-l3);
   font: var(--dsw-font-markdown-table-head);
@@ -382,7 +382,7 @@
   padding: 10px 16px;
 }
 
-.vrxa6G_tableScroll td {
+.BL43XG_tableScroll td {
   border-bottom: .5px solid var(--dsw-alias-border-l2);
   font: var(--dsw-font-markdown-table);
   min-width: 100px;
@@ -390,32 +390,32 @@
   padding: 10px 16px;
 }
 
-.vrxa6G_tableScroll th:first-child, .vrxa6G_tableScroll td:first-child {
+.BL43XG_tableScroll th:first-child, .BL43XG_tableScroll td:first-child {
   padding-left: 0;
 }
 
-.vrxa6G_tableScroll td:last-child {
+.BL43XG_tableScroll td:last-child {
   padding-right: 0;
 }
 
-.vrxa6G_tableScroll table code {
+.BL43XG_tableScroll table code {
   font-size: 11px;
 }
 
-.vrxa6G_markdown > :first-child, .vrxa6G_markdown p:first-child {
+.BL43XG_markdown > :first-child, .BL43XG_markdown p:first-child {
   margin-top: 0 !important;
 }
 
-.vrxa6G_markdown > :last-child, .vrxa6G_markdown p:last-child {
+.BL43XG_markdown > :last-child, .BL43XG_markdown p:last-child {
   margin-bottom: 0 !important;
 }
 
-.vrxa6G_imageAlt {
+.BL43XG_imageAlt {
   color: var(--dsw-alias-label-tertiary);
   font-style: italic;
 }
 
-.vrxa6G_image {
+.BL43XG_image {
   background: var(--dsw-alias-bg-base);
   object-fit: contain;
   border-radius: 8px;
@@ -426,7 +426,7 @@
   display: block;
 }
 
-.vrxa6G_fileMention {
+.BL43XG_fileMention {
   font: inherit;
   color: var(--dsw-alias-link);
   cursor: pointer;
@@ -438,7 +438,7 @@
   text-decoration: none;
 }
 
-.vrxa6G_fileMention:hover, .vrxa6G_fileMention:focus {
+.BL43XG_fileMention:hover, .BL43XG_fileMention:focus {
   text-decoration: underline dotted var(--dsw-alias-link);
   text-underline-offset: 3px;
   outline: none;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-plus/access-gate",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "dsh-plus service+ui plugin: dsh web 全量访问围栏——与官方 browser-auth 合并：官方 cookie 为唯一凭据，可选 IP 附加围栏，未认证导航渲染 token 输入页（PWA 可恢复），loopback 管理通道",
   "type": "module",
   "main": "lib/index.js",
@@ -31,20 +31,20 @@
     }
   },
   "dependencies": {
-    "@dsh-plus/shared": "0.1.10"
+    "@dsh-plus/shared": "0.1.11"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-home-paths": "^0.1.3-alpha.2",
-    "@deepseek-ai/dsh-settings": "^0.1.3-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-home-paths": "*",
+    "@deepseek-ai/dsh-settings": "*",
+    "@deepseek-ai/schemastery": "^3.18.2"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.3-alpha.2",
-    "@deepseek-ai/dsh-home-paths": "0.1.3-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.3-alpha.2",
-    "@deepseek-ai/dsh-settings": "0.1.3-alpha.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-alpha.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.5-alpha.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.5-alpha.1",
+    "@deepseek-ai/dsh-settings": "0.1.5-alpha.1",
     "@deepseek-ai/schemastery": "3.18.2",
     "@types/react": "~18.3.31",
     "react": "^18.2.0"

package/src/client/card.tsx

@@ -33,12 +33,14 @@ export interface ConfigValue {
   enabled: boolean
   allowedIps: string[]
   trustForwardedFor: boolean
+  autoLoginTrustedIps: boolean
 }
 
 interface Draft {
   enabled: boolean
   allowedIpsText: string
   trustForwardedFor: boolean
+  autoLoginTrustedIps: boolean
 }
 
 interface Diag {
@@ -50,6 +52,8 @@ interface Diag {
   ipFenceActive: boolean
   invalidEntries: string[]
   allowedCount: number
+  autoLoginActive: boolean
+  autoLoginReady: boolean
 }
 
 function draftFromValue(value: ConfigValue): Draft {
@@ -57,6 +61,7 @@ function draftFromValue(value: ConfigValue): Draft {
     enabled: value.enabled,
     allowedIpsText: value.allowedIps.join('\n'),
     trustForwardedFor: value.trustForwardedFor,
+    autoLoginTrustedIps: value.autoLoginTrustedIps,
   }
 }
 
@@ -68,6 +73,7 @@ function toPatch(draft: Draft): Record<string, unknown> {
       .map((s) => s.trim())
       .filter((s) => s.length > 0),
     trustForwardedFor: draft.trustForwardedFor,
+    autoLoginTrustedIps: draft.autoLoginTrustedIps,
   }
 }
 
@@ -75,12 +81,14 @@ function toPatch(draft: Draft): Record<string, unknown> {
 const REASON_KEYS: Record<string, string> = {
   local: 'diagLocal',
   cookie: 'diagCookie',
+  'trusted-ip': 'diagTrustedIp',
 }
 
 function verdictLabel(t: (key: string) => string, diag: Diag): string {
   if (!diag.enabled) return t('diagOff')
   if (diag.verdict === 'pass') return t('diagPass')
   if (diag.verdict === 'token-page') return t('diagTokenPage')
+  if (diag.verdict === 'autologin') return t('diagAutoLogin')
   return t('diagBlock')
 }
 
@@ -213,6 +221,14 @@ export function AccessGateCard(props: CardProps): ReactElement | null {
         />
         <p className="dag-hint">{t('allowedIpsHint')}</p>
       </div>
+      <CheckRow
+        prefix="dag"
+        id="dag-autologin"
+        label={t('autoLoginHint')}
+        checked={draft.autoLoginTrustedIps}
+        disabled={disabled}
+        onEdit={(v) => edit('autoLoginTrustedIps', v)}
+      />
       <CheckRow
         prefix="dag"
         id="dag-xff"
@@ -244,6 +260,14 @@ export function AccessGateCard(props: CardProps): ReactElement | null {
               {diag.officialAuthed ? t('diagOfficialYes') : t('diagOfficialNo')}
             </span>
           </div>
+          {diag.autoLoginActive ? (
+            <div className="dag-diagRow">
+              <span className="dag-diagKey">{t('diagAutoLogin')}</span>
+              <span className="dag-diagVal">
+                {diag.autoLoginReady ? t('diagAutoLoginReady') : t('diagAutoLoginNoSecret')}
+              </span>
+            </div>
+          ) : null}
           {diag.invalidEntries.length > 0 ? (
             <div className="dag-diagRow">
               <span className="dag-diagKey">!</span>

package/src/client/i18n.ts

@@ -18,6 +18,8 @@ const ownZh = {
   allowedIps: '附加 IP 围栏白名单',
   allowedIpsHint:
     '每行一个：精确 IP 或 CIDR（IPv4/IPv6 皆可）。非空时仅白名单来源可通行与登录；留空 = 不限制来源 IP（仅官方登录保护）。',
+  autoLoginHint:
+    'IP 信任自动登录：白名单来源未认证时自动签发官方登录 cookie，免输启动令牌。开启即视为信任白名单内全部设备（tailnet 内），请确保白名单准确。',
   trustForwardedFor: '信任 x-forwarded-for 还原客户端 IP',
   trustForwardedForHint:
     '仅当入口代理强制覆盖该头时开启（tailscale serve 满足）；直连暴露场景必须关闭。',
@@ -27,12 +29,17 @@ const ownZh = {
   diagReason: '放行原因',
   diagLocal: '本机直连',
   diagCookie: '官方 cookie',
+  diagTrustedIp: 'IP 信任白名单',
   diagOfficial: '官方登录状态',
   diagOfficialYes: '已登录',
   diagOfficialNo: '未登录',
   diagPass: '放行',
   diagBlock: '拦截',
   diagTokenPage: '令牌输入页',
+  diagAutoLogin: '自动登录',
+  diagAutoLoginVerdict: '自动登录（免 token 进入）',
+  diagAutoLoginReady: '已就绪（签名密钥可读）',
+  diagAutoLoginNoSecret: '不可用（签名密钥读取失败，已降级）',
   diagOff: '围栏未启用',
   diagInvalid: '白名单存在无法解析的条目：',
 }
@@ -49,6 +56,8 @@ const ownEn = {
   allowedIps: 'Additional IP fence allowlist',
   allowedIpsHint:
     'One per line: exact IP or CIDR (IPv4/IPv6). When non-empty only listed sources may pass or log in; empty = no IP restriction (official login only).',
+  autoLoginHint:
+    'Trusted-IP auto login: mint the official login cookie automatically for unauthenticated allowlisted sources, no launch token needed. Enabling trusts every allowlisted device (inside the tailnet); keep the allowlist accurate.',
   trustForwardedFor: 'Trust x-forwarded-for for client IP',
   trustForwardedForHint:
     'Enable only when the entry proxy overwrites that header (tailscale serve does); must be off for direct exposure.',
@@ -58,12 +67,17 @@ const ownEn = {
   diagReason: 'Reason',
   diagLocal: 'loopback',
   diagCookie: 'official cookie',
+  diagTrustedIp: 'trusted IP allowlist',
   diagOfficial: 'Official login',
   diagOfficialYes: 'authenticated',
   diagOfficialNo: 'not authenticated',
   diagPass: 'pass',
   diagBlock: 'blocked',
   diagTokenPage: 'token page',
+  diagAutoLogin: 'Auto login',
+  diagAutoLoginVerdict: 'auto login (token-free entry)',
+  diagAutoLoginReady: 'ready (signing secret readable)',
+  diagAutoLoginNoSecret: 'unavailable (signing secret unreadable, degraded)',
   diagOff: 'gate disabled',
   diagInvalid: 'Allowlist entries that failed to parse:',
 }

package/src/config.ts

@@ -34,6 +34,12 @@ export const Config = z.object({
       '是否信任 x-forwarded-for 还原真实客户端 IP（仅当入口代理强制覆盖该头时开启；tailscale serve 满足）',
     )
     .default(true),
+  autoLoginTrustedIps: z
+    .boolean()
+    .description(
+      'IP 信任自动登录：来源命中 allowedIps 白名单且未认证时，服务端自动签发官方登录 cookie（免启动 token，仅对白名单来源生效）；默认关闭，需显式开启',
+    )
+    .default(false),
 })
 
 export type AccessGateConfig = Schemastery.TypeT<typeof Config>
@@ -43,4 +49,5 @@ export interface GatePolicy {
   readonly enabled: boolean
   readonly allowedIps: readonly string[]
   readonly trustForwardedFor: boolean
+  readonly autoLoginTrustedIps: boolean
 }