@fonlan/dsh-web-auth 0.1.7 → 0.1.8

package/cordis.patch.yml

@@ -11,13 +11,13 @@
 # the auth gate wraps the HTTP listener after it is bound.
 #
 # The package also declares `dsh.client` (see package.json), so the web app
-# loads the browser half (the plugin's own Settings Card) automatically. The
-# card registers on the `settings.plugin.item` slot keyed by the `web-auth`
-# settings namespace (see src/settings.ts) — the 设置 → 插件 → 插件配置 tab
-# pairs the two.
+# loads the browser half (the plugin's own settings page) automatically. The
+# page registers on the `settings.section` slot as the 「访问认证」 entry in the
+# settings sidebar and binds the `web-auth` settings namespace
+# (see src/settings.ts) through the client settings scope.
 #
 # There is intentionally NO password here: passwords are maintained through
-# the GUI (login page first setup / settings card change), stored hashed
+# the GUI (login page first setup / settings page change), stored hashed
 # under $DSH_HOME/web-auth/. Until a password is set, auth stays disabled
 # (see the README for the warning this prints at boot).
 - insert:

package/lib/client/index.d.ts

@@ -4,11 +4,11 @@ import type { Context } from '@deepseek-ai/cordis';
  * `connection` and `remote` are required by `settingsScope.bind` (it resolves
  * the settings transport and the forwarded-invalidation subscription through
  * `ctx.get`), so the fiber must wait for them — exactly like
- * dsh-client-ui-settings-plugins does for its own cards.
+ * the settings shell does for its own sections.
  */
 export declare const inject: string[];
 /**
- * Client plugin body: register the settings card. The shell's declaration
+ * Client plugin body: register the settings page. The shell's declaration
  * may not be on the ledger yet, so the registration waits via slots.inject.
  * @param ctx - the client cordis context.
  */

package/lib/client.js

@@ -40,33 +40,11 @@ var dshWebAuthModule = (() => {
   var inject = ["slots", "settingsScope", "connection", "remote"];
   var WEB_AUTH_NS = "web-auth";
   var CSS = `
-.dwa-card {
-  border: 1px solid var(--dsw-alias-border-l2, #2a3346);
-  background: var(--dsw-alias-bg-layer-3, #0d1017);
-  border-radius: 12px;
-  list-style: none;
-  transition: border-color .16s, background .16s;
-}
-.dwa-card:hover { border-color: var(--dsw-alias-label-dimmed, #4a5468); }
-.dwa-card[data-open] {
-  background: var(--dsw-alias-bg-layer-2, #141a26);
-  border-color: var(--dsw-alias-label-dimmed, #4a5468);
-}
-.dwa-head {
-  appearance: none; width: 100%; font: inherit; color: inherit; text-align: left; cursor: pointer;
-  background: transparent; border: 0; border-radius: 12px;
-  align-items: center; gap: 12px; padding: 14px 16px; display: flex;
-}
-.dwa-head:focus-visible { outline: 2px solid var(--dsw-alias-brand-primary, #4f8cff); outline-offset: -2px; }
-.dwa-headText { flex-direction: column; flex: 1; gap: 4px; min-width: 0; display: flex; }
-.dwa-title { color: var(--dsw-alias-label-primary, #e6e6e6); font-size: 15px; font-weight: 600; line-height: 1.4; }
-.dwa-sub { color: var(--dsw-alias-label-tertiary, #8b93a7); font-size: 13px; line-height: 1.5; }
-.dwa-chevron {
-  color: var(--dsw-alias-label-tertiary, #8b93a7); flex: none;
-  transition: transform .16s; display: flex; align-items: center; justify-content: center;
-}
-.dwa-chevron[data-open] { transform: rotate(180deg); }
-.dwa-body { border-top: 1px solid var(--dsw-alias-border-l2, #2a3346); margin: 0 16px; padding: 12px 0 8px; display: flex; flex-direction: column; gap: 12px; }
+.dwa-page { display: flex; flex-direction: column; gap: 16px; max-width: 720px; }
+.dwa-page-head { display: flex; flex-direction: column; gap: 6px; }
+.dwa-page-title { color: var(--dsw-alias-label-primary, #e6e6e6); margin: 0; font-size: 15px; font-weight: 600; line-height: 1.4; }
+.dwa-page-sub { color: var(--dsw-alias-label-tertiary, #8b93a7); margin: 0; font-size: 13px; line-height: 1.5; }
+.dwa-body { display: flex; flex-direction: column; gap: 12px; }
 .dwa-row { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
 .dwa-status { font-size: 13px; line-height: 1.6; }
 .dwa-status[data-on] { color: var(--dsw-alias-label-primary, #e6e6e6); }
@@ -99,7 +77,7 @@ var dshWebAuthModule = (() => {
 .dwa-divider { border: none; border-top: 1px solid var(--dsw-alias-border-l1, #232a38); margin: 2px 0; }
 `;
   function injectStyle() {
-    const id = "dsh-web-auth/card.css";
+    const id = "dsh-web-auth/settings-section.css";
     if (document.getElementById(id) !== null) return;
     const tag = document.createElement("style");
     tag.id = id;
@@ -141,7 +119,7 @@ var dshWebAuthModule = (() => {
       return null;
     }
   }
-  function AuthCard(props) {
+  function WebAuthSettingsSection(props) {
     const { scope } = props;
     const snapshot = (0, import_react.useSyncExternalStore)(
       (listener) => scope.subscribe(listener),
@@ -157,7 +135,6 @@ var dshWebAuthModule = (() => {
     const [listenPick, setListenPick] = (0, import_react.useState)("127.0.0.1");
     const [listenBusy, setListenBusy] = (0, import_react.useState)(false);
     const [listenMsg, setListenMsg] = (0, import_react.useState)(null);
-    const [open, setOpen] = (0, import_react.useState)(false);
     (0, import_react.useEffect)(() => {
       let alive = true;
       void fetchStatus().then((status) => {
@@ -220,34 +197,12 @@ var dshWebAuthModule = (() => {
         setListenBusy(false);
       }
     };
-    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dwa-card", "data-open": open ? "" : void 0, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
-        "button",
-        {
-          type: "button",
-          className: "dwa-head",
-          "aria-expanded": open,
-          "aria-label": (open ? "\u6536\u8D77" : "\u5C55\u5F00") + "\uFF1A\u8BBF\u95EE\u8BA4\u8BC1",
-          onClick: () => setOpen(!open),
-          children: [
-            /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "dwa-headText", children: [
-              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "dwa-title", children: "\u8BBF\u95EE\u8BA4\u8BC1" }),
-              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "dwa-sub", children: "Web \u8BBF\u95EE\u5BC6\u7801\u4E0E\u76D1\u542C\u5730\u5740" })
-            ] }),
-            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "dwa-chevron", "data-open": open ? "" : void 0, "aria-hidden": "true", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("svg", { width: "14", height: "14", viewBox: "0 0 14 14", fill: "none", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-              "path",
-              {
-                d: "M3.5 5.25L7 8.75L10.5 5.25",
-                stroke: "currentColor",
-                strokeWidth: "1.5",
-                strokeLinecap: "round",
-                strokeLinejoin: "round"
-              }
-            ) }) })
-          ]
-        }
-      ),
-      open && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dwa-body", children: [
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dwa-page", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("header", { className: "dwa-page-head", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { className: "dwa-page-title", children: "\u8BBF\u95EE\u8BA4\u8BC1" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-page-sub", children: "Web \u8BBF\u95EE\u5BC6\u7801\u4E0E\u76D1\u542C\u5730\u5740" })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dwa-body", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dwa-row", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-status", "data-on": configured ? void 0 : "", "data-off": configured ? "" : void 0, children: configured === null ? "\u52A0\u8F7D\u4E2D\u2026" : configured ? "\u8BBF\u95EE\u8BA4\u8BC1\uFF1A\u5DF2\u542F\u7528" : "\u8BBF\u95EE\u8BA4\u8BC1\uFF1A\u672A\u8BBE\u7F6E\u5BC6\u7801\uFF08\u5F53\u524D\u672A\u542F\u7528\uFF09" }) }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-hint", children: "\u8BBE\u7F6E\u540E\uFF0C\u8BBF\u95EE\u672C\u670D\u52A1\u9700\u8981\u8F93\u5165\u5BC6\u7801\uFF1B\u4F1A\u8BDD\u6709\u6548\u671F 7 \u5929\uFF08\u6D3B\u52A8\u81EA\u52A8\u7EED\u671F\uFF09\u3002\u4FEE\u6539\u5BC6\u7801\u4F1A\u4F7F\u6240\u6709\u5DF2\u767B\u5F55\u4F1A\u8BDD\u7ACB\u5373\u5931\u6548\u3002" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("hr", { className: "dwa-divider" }),
@@ -334,14 +289,16 @@ var dshWebAuthModule = (() => {
     const services = ctx;
     const scope = services.settingsScope.bind({ namespace: WEB_AUTH_NS });
     services.slots.inject(
-      "settings.plugin.item",
+      "settings.section",
       () => services.slots.register(
         {
-          name: "settings.plugin.item",
-          key: WEB_AUTH_NS,
+          name: "settings.section",
+          id: "web-auth",
+          order: 120,
+          label: "\u8BBF\u95EE\u8BA4\u8BC1",
           inject: () => ({ scope })
         },
-        AuthCard
+        WebAuthSettingsSection
       )
     );
   }

package/lib/handlers.d.ts

@@ -1,7 +1,7 @@
 /**
  * dsh-web-auth — request handlers: the gate decision (whitelist + session
  * check), the /login page + form processing (including first-password setup),
- * /logout, and the JSON change-password API for the settings card.
+ * /logout, and the JSON change-password API for the settings page.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type RateLimiter } from './auth-core.ts';
@@ -45,7 +45,7 @@ export interface HandlerEnv {
     loopbackAuthority?: string;
     /**
      * Listen-address controller (bound by the host half when the profile
-     * patch layer is reachable). Absent = the settings card cannot change
+     * patch layer is reachable). Absent = the settings page cannot change
      * the bind host.
      */
     listen?: ListenController;

package/lib/handlers.js

@@ -353,7 +353,7 @@ export function handleLogout(req, res, env) {
     clearCookie(res, isSecureRequest(req));
     redirect(res, '/login?loggedOut=1');
 }
-// ── GET /api/web-auth/status — settings-card state ─────────────────────────
+// ── GET /api/web-auth/status — settings page state ─────────────────────────
 export function handleStatus(req, res, env) {
     const body = { configured: env.state.readHash() !== undefined };
     const current = env.listen?.current();

package/lib/index.js

@@ -4,7 +4,7 @@
  * Host half: wraps the webserver's HTTP/upgrade listeners so every request
  * (routes, static fallback, WebSocket upgrades) must carry a valid session
  * cookie, serves the /login page (including first-password setup), /logout,
- * and the JSON change-password API used by the settings card (client half).
+ * and the JSON change-password API used by the settings page (client half).
  *
  * State lives under $DSH_HOME/web-auth/ (password.hash, secret) — see
  * state.ts. Until a password is configured the gate is OPEN and a boot
@@ -86,10 +86,10 @@ export function apply(ctx, config) {
         // away; failures are logged, never thrown — the client was confirmed.
         listen: buildListenController(ctx)
     };
-    // The plugin's own Settings Card (设置 → 插件配置 → web-auth) rides the
-    // `web-auth` settings namespace: registering it makes the tab dispatch the
-    // card, and committed listenHost changes are applied here. Attaches only
-    // when a settings service exists (CLI/headless profiles skip it).
+    // The plugin's own settings page (设置 → 侧栏「访问认证」) rides the
+    // `web-auth` settings namespace: binding the namespace is how the page reads
+    // and writes it, and committed listenHost changes are applied here. Attaches
+    // only when a settings service exists (CLI/headless profiles skip it).
     installWebAuthSettings(ctx, env.listen);
     if (state.readHash() === undefined) {
         // console.error, not ctx.logger.warn: the cordis default logger level

package/lib/settings.d.ts

@@ -1,10 +1,10 @@
 /**
  * dsh-web-auth — the `web-auth` settings namespace.
  *
- * The namespace exists so the plugin's browser half can register its own
- * Settings Card: the settings section ("插件配置" tab) dispatches
- * `settings.plugin.item` for every namespace the Host serves, keyed by the
- * namespace string, and the client registers its card under the same key.
+ * The namespace exists so the plugin's browser half can read and write its
+ * own settings page: the page registers on the `settings.section` slot (the
+ * 「访问认证」 entry in the settings sidebar) and binds this namespace through
+ * the client settings scope, which is the only write path to `listenHost`.
  * The namespace carries the one genuine configuration value the plugin owns:
  * the web server's bind host (`listenHost`). The password is deliberately
  * NOT here — it is a secret stored hashed under `$DSH_HOME/web-auth/` and

package/lib/settings.js

@@ -1,10 +1,10 @@
 /**
  * dsh-web-auth — the `web-auth` settings namespace.
  *
- * The namespace exists so the plugin's browser half can register its own
- * Settings Card: the settings section ("插件配置" tab) dispatches
- * `settings.plugin.item` for every namespace the Host serves, keyed by the
- * namespace string, and the client registers its card under the same key.
+ * The namespace exists so the plugin's browser half can read and write its
+ * own settings page: the page registers on the `settings.section` slot (the
+ * 「访问认证」 entry in the settings sidebar) and binds this namespace through
+ * the client settings scope, which is the only write path to `listenHost`.
  * The namespace carries the one genuine configuration value the plugin owns:
  * the web server's bind host (`listenHost`). The password is deliberately
  * NOT here — it is a secret stored hashed under `$DSH_HOME/web-auth/` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fonlan/dsh-web-auth",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "DSH web plugin: password-gate authentication (login page + HttpOnly signed cookie) for exposing dsh web behind a reverse proxy",
   "type": "module",
   "license": "MIT",