@h-ai/api-contract 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/chunk-PS3OHILQ.js

@@ -0,0 +1,571 @@
+import { PaginationQuerySchema, paginatedSchema } from './chunk-CCCPHO6X.js';
+import { haiResultSchema, route, HaiVoidResultSchema } from './chunk-5LBEMLDK.js';
+import { z } from 'zod';
+
+var captchaProofSchema = z.string().min(1).max(4096).optional();
+var IamCreateCaptchaInputSchema = z.object({
+  operation: z.enum([
+    "login",
+    "register",
+    "sendOtp",
+    "passwordReset",
+    "renewPassword"
+  ])
+});
+var IamCaptchaChallengeSchema = z.object({
+  id: z.string().regex(/^[a-f0-9]{64}$/),
+  challenge: z.object({
+    signature: z.string().max(256).optional(),
+    parameters: z.object({
+      algorithm: z.string().refine((value) => value === "PBKDF2/SHA-256"),
+      nonce: z.string().min(1).max(256),
+      salt: z.string().min(1).max(256),
+      cost: z.number().int().min(100).max(5e4),
+      keyLength: z.number().int().min(16).max(64),
+      keyPrefix: z.string().min(1).max(128),
+      keySignature: z.string().max(256).optional(),
+      data: z.record(z.string(), z.union([
+        z.string(),
+        z.number(),
+        z.boolean(),
+        z.null()
+      ])).optional()
+    })
+  })
+});
+var IamUserSchema = z.object({
+  id: z.string(),
+  username: z.string(),
+  email: z.string().optional(),
+  phone: z.string().optional(),
+  displayName: z.string().optional(),
+  avatarUrl: z.string().optional(),
+  accountType: z.enum(["permanent", "temporary"]).optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]),
+  accountExpiresAt: z.coerce.date().nullable().optional(),
+  lastLoginAt: z.coerce.date().nullable().optional(),
+  mustChangePassword: z.boolean().optional(),
+  emailVerified: z.boolean().optional(),
+  phoneVerified: z.boolean().optional(),
+  createdAt: z.coerce.date(),
+  updatedAt: z.coerce.date(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var IamTokenPairSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string().optional(),
+  expiresIn: z.number(),
+  tokenType: z.literal("Bearer")
+});
+var IamAgreementDisplaySchema = z.object({
+  /** 配置中的 Markdown 原文由客户端安全渲染。 */
+  userAgreementMarkdown: z.string().min(1).optional(),
+  privacyPolicyMarkdown: z.string().min(1).optional(),
+  userAgreementUrl: z.string().optional(),
+  privacyPolicyUrl: z.string().optional(),
+  showOnRegister: z.boolean(),
+  showOnLogin: z.boolean()
+});
+var IamAuthResultSchema = z.object({
+  user: IamUserSchema,
+  tokens: IamTokenPairSchema,
+  roles: z.array(z.string()).default([]),
+  permissions: z.array(z.string()).default([]),
+  agreements: IamAgreementDisplaySchema.optional()
+});
+var IamCurrentUserSchema = IamUserSchema.extend({
+  roles: z.array(z.string()),
+  permissions: z.array(z.string())
+});
+var IamLoginInputSchema = z.object({
+  expectedUserId: z.string().min(1).max(200).optional(),
+  captcha: captchaProofSchema,
+  identifier: z.string().min(1),
+  password: z.string().min(1)
+});
+var IamSessionErrorCodeSchema = z.enum([
+  "hai:iam:101",
+  "hai:iam:102",
+  "hai:iam:103",
+  "hai:iam:105",
+  "hai:iam:106",
+  "hai:iam:107"
+]);
+var IamLdapLoginInputSchema = z.object({
+  username: z.string().trim().min(1),
+  password: z.string().min(1),
+  captcha: captchaProofSchema,
+  expectedUserId: z.string().min(1).max(200).optional()
+});
+var IamRequestPasswordResetInputSchema = z.object({
+  identifier: z.string().trim().min(1),
+  captcha: captchaProofSchema
+});
+var IamConfirmPasswordResetInputSchema = z.object({
+  token: z.string().min(1),
+  newPassword: z.string().min(1)
+});
+var IamRenewPasswordInputSchema = z.object({
+  identifier: z.string().trim().min(1),
+  password: z.string().min(1),
+  newPassword: z.string().min(1),
+  captcha: captchaProofSchema
+});
+var IamReauthenticateInputSchema = z.object({
+  password: z.string().min(1),
+  operation: z.string().trim().min(1).max(128)
+});
+var IamReauthenticationProofSchema = z.object({
+  ticket: z.string().min(1),
+  expiresAt: z.number()
+});
+var IamPublicConfigSchema = z.object({
+  captcha: z.object({
+    enabled: z.boolean()
+  }).default({ enabled: false }),
+  reauthentication: z.object({
+    enabled: z.boolean(),
+    operations: z.array(z.string())
+  }).optional(),
+  initialCredentials: z.object({
+    enabled: z.boolean()
+  }).optional(),
+  password: z.object({
+    minLength: z.number(),
+    maxLength: z.number(),
+    requireUppercase: z.boolean(),
+    requireLowercase: z.boolean(),
+    requireNumber: z.boolean(),
+    requireSpecialChar: z.boolean(),
+    expirationDays: z.number(),
+    minCharacterClasses: z.number().optional(),
+    preventSamePassword: z.boolean().optional(),
+    requireInitialChange: z.boolean().optional()
+  }),
+  register: z.object({
+    enabled: z.boolean()
+  }),
+  login: z.object({
+    password: z.boolean(),
+    otp: z.boolean(),
+    ldap: z.boolean(),
+    email: z.boolean(),
+    sms: z.boolean()
+  }),
+  passwordReset: z.object({
+    enabled: z.boolean(),
+    mode: z.enum(["email", "phone"])
+  }),
+  otp: z.object({
+    length: z.number(),
+    resendInterval: z.number()
+  }),
+  agreements: IamAgreementDisplaySchema,
+  ui: z.object({
+    variant: z.enum(["card", "split"]),
+    title: z.string().optional(),
+    subtitle: z.string().optional(),
+    brandTitle: z.string().optional(),
+    brandText: z.string().optional(),
+    logoUrl: z.string().optional(),
+    illustrationUrl: z.string().optional()
+  }),
+  session: z.object({
+    maxAge: z.number(),
+    endOnPageHide: z.boolean().default(false)
+  })
+});
+var IamOtpLoginInputSchema = z.object({
+  expectedUserId: z.string().min(1).max(200).optional(),
+  captcha: captchaProofSchema,
+  identifier: z.string().min(1),
+  code: z.string().min(1)
+});
+var IamLogoutInputSchema = z.object({
+  accessToken: z.string().min(1).optional()
+});
+var IamSendOtpInputSchema = z.object({
+  captcha: captchaProofSchema,
+  identifier: z.string().min(1)
+});
+var IamSendOtpDataSchema = z.object({
+  expiresAt: z.coerce.date()
+});
+var IamRefreshTokenInputSchema = z.object({
+  refreshToken: z.string().min(1)
+});
+var IamRefreshTokenDataSchema = z.object({
+  tokens: IamTokenPairSchema
+});
+var IamRegisterInputSchema = z.object({
+  captcha: captchaProofSchema,
+  username: z.string().min(1),
+  password: z.string().min(1),
+  email: z.string().email().optional(),
+  phone: z.string().optional(),
+  displayName: z.string().optional(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var IamChangePasswordInputSchema = z.object({
+  oldPassword: z.string().min(1),
+  newPassword: z.string().min(1)
+});
+var IamUpdateCurrentUserInputSchema = z.object({
+  username: z.string().min(1).optional(),
+  email: z.string().email().optional(),
+  displayName: z.string().optional(),
+  avatarUrl: z.string().optional(),
+  phone: z.string().optional(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var IamListUsersInputSchema = PaginationQuerySchema.extend({
+  sortBy: z.enum([
+    "username",
+    "email",
+    "displayName",
+    "accountStatus",
+    "createdAt"
+  ]).optional(),
+  sortDirection: z.enum(["asc", "desc"]).optional(),
+  roleCode: z.string().trim().min(1).max(100).optional(),
+  search: z.string().optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]).optional()
+}).strict();
+var IamAdminCreateUserInputSchema = z.strictObject({
+  accountType: z.enum(["permanent", "temporary"]).optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]).optional(),
+  accountExpiresAt: z.coerce.date().optional(),
+  username: z.string().min(1),
+  email: z.string().email().optional(),
+  phone: z.string().optional(),
+  password: z.string().min(1),
+  displayName: z.string().optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  roleIds: z.array(z.string()).optional()
+});
+var IamInviteUserInputSchema = IamAdminCreateUserInputSchema.omit({ password: true }).extend({
+  accountStatus: z.literal("active").optional()
+});
+var IamAdminUpdateUserInputSchema = z.strictObject({
+  accountType: z.enum(["permanent", "temporary"]).optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]).optional(),
+  accountExpiresAt: z.coerce.date().nullable().optional(),
+  id: z.string().min(1),
+  username: z.string().min(1).optional(),
+  email: z.string().email().optional(),
+  phone: z.string().optional(),
+  displayName: z.string().optional(),
+  avatarUrl: z.string().optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  roleIds: z.array(z.string()).optional()
+});
+var IamUserIdInputSchema = z.object({
+  id: z.string().min(1)
+});
+var IamAdminResetPasswordInputSchema = z.object({
+  id: z.string().min(1),
+  newPassword: z.string().min(1)
+});
+var IamRoleSchema = z.object({
+  id: z.string(),
+  code: z.string(),
+  name: z.string(),
+  description: z.string().optional(),
+  isSystem: z.boolean().optional(),
+  createdAt: z.coerce.date(),
+  updatedAt: z.coerce.date()
+});
+var IamCreateRoleInputSchema = z.object({
+  code: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional(),
+  isSystem: z.boolean().optional()
+});
+var IamUpdateRoleInputSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1).optional(),
+  description: z.string().optional()
+});
+var IamPermissionTypeSchema = z.enum(["menu", "api", "button"]);
+var IamPermissionSchema = z.object({
+  sensitiveOperations: z.array(z.string().trim().min(1).max(128)).max(1e3).nullish().transform((value) => value ?? []),
+  id: z.string(),
+  code: z.string(),
+  name: z.string(),
+  description: z.string().optional(),
+  type: IamPermissionTypeSchema.optional(),
+  resource: z.string().optional(),
+  action: z.string().optional(),
+  createdAt: z.coerce.date(),
+  updatedAt: z.coerce.date()
+});
+var IamListPermissionsInputSchema = PaginationQuerySchema.extend({
+  search: z.string().optional(),
+  type: IamPermissionTypeSchema.optional()
+});
+var IamCreatePermissionInputSchema = z.object({
+  sensitiveOperations: z.array(z.string().trim().min(1).max(128)).max(1e3).default([]),
+  code: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional(),
+  resource: z.string().optional(),
+  action: z.string().optional(),
+  type: IamPermissionTypeSchema.optional()
+});
+
+// src/iam/iam-contract.ts
+var authResultOutputSchema = haiResultSchema(IamAuthResultSchema);
+var userOutputSchema = haiResultSchema(IamUserSchema);
+var roleOutputSchema = haiResultSchema(IamRoleSchema);
+var iamContract = {
+  auth: {
+    createCaptcha: route({
+      method: "POST",
+      path: "/auth/captcha",
+      operationId: "iam.auth.createCaptcha",
+      summary: "Create self-hosted security challenge",
+      tags: ["iam", "auth"]
+    }).input(IamCreateCaptchaInputSchema).output(haiResultSchema(IamCaptchaChallengeSchema)),
+    reauthenticate: route({
+      method: "POST",
+      path: "/auth/reauthenticate",
+      operationId: "iam.auth.reauthenticate",
+      summary: "Verify current password for one sensitive operation",
+      tags: ["iam", "auth"]
+    }).input(IamReauthenticateInputSchema).output(haiResultSchema(IamReauthenticationProofSchema)),
+    publicConfig: route({
+      method: "GET",
+      path: "/auth/config",
+      operationId: "iam.auth.publicConfig",
+      summary: "Public authentication configuration",
+      tags: ["iam", "auth"]
+    }).output(haiResultSchema(IamPublicConfigSchema.nullable())),
+    renewPassword: route({
+      method: "POST",
+      path: "/auth/password/renew",
+      operationId: "iam.auth.renewPassword",
+      summary: "Change initial or expired password",
+      tags: ["iam", "auth"]
+    }).input(IamRenewPasswordInputSchema).output(HaiVoidResultSchema),
+    loginWithLdap: route({
+      method: "POST",
+      path: "/auth/login/ldap",
+      operationId: "iam.auth.loginWithLdap",
+      summary: "LDAP login",
+      tags: ["iam", "auth"]
+    }).input(IamLdapLoginInputSchema).output(authResultOutputSchema),
+    requestPasswordReset: route({
+      method: "POST",
+      path: "/auth/password-reset/request",
+      operationId: "iam.auth.requestPasswordReset",
+      summary: "Request password reset",
+      tags: ["iam", "auth"]
+    }).input(IamRequestPasswordResetInputSchema).output(HaiVoidResultSchema),
+    confirmPasswordReset: route({
+      method: "POST",
+      path: "/auth/password-reset/confirm",
+      operationId: "iam.auth.confirmPasswordReset",
+      summary: "Confirm password reset",
+      tags: ["iam", "auth"]
+    }).input(IamConfirmPasswordResetInputSchema).output(HaiVoidResultSchema),
+    login: route({
+      method: "POST",
+      path: "/auth/login",
+      operationId: "iam.auth.login",
+      summary: "Password login",
+      tags: ["iam", "auth"]
+    }).input(IamLoginInputSchema).output(authResultOutputSchema),
+    loginWithOtp: route({
+      method: "POST",
+      path: "/auth/login/otp",
+      operationId: "iam.auth.loginWithOtp",
+      summary: "OTP login",
+      tags: ["iam", "auth"]
+    }).input(IamOtpLoginInputSchema).output(authResultOutputSchema),
+    logout: route({
+      method: "POST",
+      path: "/auth/logout",
+      operationId: "iam.auth.logout",
+      summary: "Logout",
+      tags: ["iam", "auth"]
+    }).input(IamLogoutInputSchema).output(HaiVoidResultSchema),
+    closeSession: route({
+      method: "POST",
+      path: "/auth/session/close",
+      operationId: "iam.auth.closeSession",
+      summary: "Revoke departing client session without clearing newer cookies",
+      tags: ["iam", "auth"]
+    }).input(IamLogoutInputSchema).output(HaiVoidResultSchema),
+    currentUser: route({
+      method: "GET",
+      path: "/auth/me",
+      operationId: "iam.auth.currentUser",
+      summary: "Get current user and access scope",
+      tags: ["iam", "auth"]
+    }).output(haiResultSchema(IamCurrentUserSchema)),
+    refresh: route({
+      method: "POST",
+      path: "/auth/refresh",
+      operationId: "iam.auth.refresh",
+      summary: "Refresh access token",
+      tags: ["iam", "auth"]
+    }).input(IamRefreshTokenInputSchema).output(haiResultSchema(IamRefreshTokenDataSchema)),
+    sendOtp: route({
+      method: "POST",
+      path: "/auth/otp/send",
+      operationId: "iam.auth.sendOtp",
+      summary: "Send OTP",
+      tags: ["iam", "auth"]
+    }).input(IamSendOtpInputSchema).output(haiResultSchema(IamSendOtpDataSchema)),
+    register: route({
+      method: "POST",
+      path: "/auth/register",
+      operationId: "iam.auth.register",
+      summary: "Register and login",
+      tags: ["iam", "auth"]
+    }).input(IamRegisterInputSchema).output(authResultOutputSchema),
+    changePassword: route({
+      method: "POST",
+      path: "/auth/change-password",
+      operationId: "iam.auth.changePassword",
+      summary: "Change current user password",
+      tags: ["iam", "auth"]
+    }).input(IamChangePasswordInputSchema).output(HaiVoidResultSchema),
+    updateCurrentUser: route({
+      method: "PUT",
+      path: "/auth/me",
+      operationId: "iam.auth.updateCurrentUser",
+      summary: "Update current user",
+      tags: ["iam", "auth"]
+    }).input(IamUpdateCurrentUserInputSchema).output(userOutputSchema)
+  },
+  users: {
+    invite: route({
+      method: "POST",
+      path: "/iam/users/invite",
+      operationId: "iam.users.invite",
+      summary: "Create account with one-time setup invitation",
+      tags: ["iam", "users"]
+    }).input(IamInviteUserInputSchema).output(userOutputSchema),
+    list: route({
+      method: "GET",
+      path: "/iam/users",
+      operationId: "iam.users.list",
+      summary: "List users",
+      tags: ["iam", "users"]
+    }).input(IamListUsersInputSchema).output(haiResultSchema(paginatedSchema(IamUserSchema))),
+    get: route({
+      method: "GET",
+      path: "/iam/users/{id}",
+      operationId: "iam.users.get",
+      summary: "Get user",
+      tags: ["iam", "users"]
+    }).input(IamUserIdInputSchema).output(haiResultSchema(IamUserSchema.nullable())),
+    create: route({
+      method: "POST",
+      path: "/iam/users",
+      operationId: "iam.users.create",
+      summary: "Create user",
+      tags: ["iam", "users"]
+    }).input(IamAdminCreateUserInputSchema).output(userOutputSchema),
+    update: route({
+      method: "PUT",
+      path: "/iam/users/{id}",
+      operationId: "iam.users.update",
+      summary: "Update user",
+      tags: ["iam", "users"]
+    }).input(IamAdminUpdateUserInputSchema).output(userOutputSchema),
+    delete: route({
+      method: "DELETE",
+      path: "/iam/users/{id}",
+      operationId: "iam.users.delete",
+      summary: "Delete user",
+      tags: ["iam", "users"]
+    }).input(IamUserIdInputSchema).output(HaiVoidResultSchema),
+    resetPassword: route({
+      method: "POST",
+      path: "/iam/users/{id}/reset-password",
+      operationId: "iam.users.resetPassword",
+      summary: "Reset user password",
+      tags: ["iam", "users"]
+    }).input(IamAdminResetPasswordInputSchema).output(HaiVoidResultSchema)
+  },
+  roles: {
+    list: route({
+      method: "GET",
+      path: "/iam/roles",
+      operationId: "iam.roles.list",
+      summary: "List roles",
+      tags: ["iam", "roles"]
+    }).output(haiResultSchema(paginatedSchema(IamRoleSchema))),
+    get: route({
+      method: "GET",
+      path: "/iam/roles/{id}",
+      operationId: "iam.roles.get",
+      summary: "Get role",
+      tags: ["iam", "roles"]
+    }).input(IamUserIdInputSchema).output(haiResultSchema(IamRoleSchema.nullable())),
+    create: route({
+      method: "POST",
+      path: "/iam/roles",
+      operationId: "iam.roles.create",
+      summary: "Create role",
+      tags: ["iam", "roles"]
+    }).input(IamCreateRoleInputSchema).output(roleOutputSchema),
+    update: route({
+      method: "PUT",
+      path: "/iam/roles/{id}",
+      operationId: "iam.roles.update",
+      summary: "Update role",
+      tags: ["iam", "roles"]
+    }).input(IamUpdateRoleInputSchema).output(roleOutputSchema),
+    delete: route({
+      method: "DELETE",
+      path: "/iam/roles/{id}",
+      operationId: "iam.roles.delete",
+      summary: "Delete role",
+      tags: ["iam", "roles"]
+    }).input(IamUserIdInputSchema).output(HaiVoidResultSchema)
+  },
+  permissions: {
+    setSensitiveOperations: route({
+      method: "PUT",
+      path: "/iam/permissions/{id}/sensitive-operations",
+      operationId: "iam.permissions.sensitiveOperations",
+      summary: "Set permission sensitive operations",
+      tags: ["iam", "permissions"]
+    }).input(IamPermissionSchema.pick({ id: true, sensitiveOperations: true })).output(HaiVoidResultSchema),
+    list: route({
+      method: "GET",
+      path: "/iam/permissions",
+      operationId: "iam.permissions.list",
+      summary: "List permissions",
+      tags: ["iam", "permissions"]
+    }).input(IamListPermissionsInputSchema).output(haiResultSchema(paginatedSchema(IamPermissionSchema))),
+    get: route({
+      method: "GET",
+      path: "/iam/permissions/{id}",
+      operationId: "iam.permissions.get",
+      summary: "Get permission",
+      tags: ["iam", "permissions"]
+    }).input(IamUserIdInputSchema).output(haiResultSchema(IamPermissionSchema.nullable())),
+    create: route({
+      method: "POST",
+      path: "/iam/permissions",
+      operationId: "iam.permissions.create",
+      summary: "Create permission",
+      tags: ["iam", "permissions"]
+    }).input(IamCreatePermissionInputSchema).output(haiResultSchema(IamPermissionSchema)),
+    delete: route({
+      method: "DELETE",
+      path: "/iam/permissions/{id}",
+      operationId: "iam.permissions.delete",
+      summary: "Delete permission",
+      tags: ["iam", "permissions"]
+    }).input(IamUserIdInputSchema).output(HaiVoidResultSchema)
+  }
+};
+
+export { IamAdminCreateUserInputSchema, IamAdminResetPasswordInputSchema, IamAdminUpdateUserInputSchema, IamAgreementDisplaySchema, IamAuthResultSchema, IamCaptchaChallengeSchema, IamChangePasswordInputSchema, IamConfirmPasswordResetInputSchema, IamCreateCaptchaInputSchema, IamCreatePermissionInputSchema, IamCreateRoleInputSchema, IamCurrentUserSchema, IamInviteUserInputSchema, IamLdapLoginInputSchema, IamListPermissionsInputSchema, IamListUsersInputSchema, IamLoginInputSchema, IamLogoutInputSchema, IamOtpLoginInputSchema, IamPermissionSchema, IamPermissionTypeSchema, IamPublicConfigSchema, IamReauthenticateInputSchema, IamReauthenticationProofSchema, IamRefreshTokenDataSchema, IamRefreshTokenInputSchema, IamRegisterInputSchema, IamRenewPasswordInputSchema, IamRequestPasswordResetInputSchema, IamRoleSchema, IamSendOtpDataSchema, IamSendOtpInputSchema, IamSessionErrorCodeSchema, IamTokenPairSchema, IamUpdateCurrentUserInputSchema, IamUpdateRoleInputSchema, IamUserIdInputSchema, IamUserSchema, iamContract };
+//# sourceMappingURL=chunk-PS3OHILQ.js.map
+//# sourceMappingURL=chunk-PS3OHILQ.js.map