@h-ai/cli 0.1.0-alpha.57 → 0.1.0-alpha.59

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/stores/management-store.svelte.ts.hbs

@@ -0,0 +1,399 @@
+import type { HaiResult } from '@h-ai/core'
+import type { ChangePasswordFormData, LoginFormData, UserProfileSubmitData } from '@h-ai/ui'
+import type { AdminAuditLog, AdminCreateUser, AdminRole, AdminUpdateUser, AdminUser, AvatarUpload, ProfileUpdate } from '{{fullstack.contractPackageName}}'
+import type { AppInfo, ManagementApiOptions } from '../api/api-client.js'
+import { HaiApiClientError } from '@h-ai/api-client'
+import { core } from '@h-ai/core'
+import { SvelteDate } from 'svelte/reactivity'
+import { initializeManagementApi, managementApi, resolveAvatarUrl } from '../api/api-client.js'
+import * as m from '../paraglide/messages.js'
+import { getLocale, locales, setLocale } from '../paraglide/runtime.js'
+import { AVAILABLE_THEMES, DEFAULT_THEME, themeStore } from './theme-store.svelte.js'
+
+type ResultData<T> = T extends { success: true, data: infer D } ? D : never
+export type CurrentUser = ResultData<Awaited<ReturnType<typeof managementApi.iam.auth.currentUser>>>
+export type ManagementPage = 'users' | 'roles' | 'audit' | 'settings'
+
+/** 页面状态和业务操作在共享 store 中收敛，宿主端仅装配平台能力。 */
+export class ManagementStore {
+  info = $state<AppInfo | null>(null)
+  user = $state<CurrentUser | null>(null)
+  page = $state<ManagementPage>('settings')
+  locale = $state(getLocale())
+  initializing = $state(true)
+  loading = $state(false)
+  saving = $state(false)
+  error = $state('')
+  notice = $state('')
+  users = $state<AdminUser[]>([])
+  usersTotal = $state(0)
+  usersPage = $state(1)
+  usersSearch = $state('')
+  usersStatus = $state('all')
+  roles = $state<AdminRole[]>([])
+  audit = $state<AdminAuditLog[]>([])
+  auditTotal = $state(0)
+  auditPage = $state(1)
+  auditAction = $state('')
+  auditResource = $state('')
+  auditStartDate = $state('')
+  auditEndDate = $state('')
+  readonly pageSize = 20
+  private requestVersion = 0
+  private sessionEpoch = 0
+  private onLocaleChange?: (locale: string) => void
+
+  get isAdmin(): boolean {
+    return this.user?.roles.includes('admin') ?? false
+  }
+
+  async initialize(options: ManagementApiOptions, onLocaleChange?: (locale: string) => void): Promise<void> {
+    this.onLocaleChange = onLocaleChange
+    this.initializing = true
+    this.error = ''
+    try {
+      const init = await initializeManagementApi({ ...options, onSessionExpired: () => this.expireSession() })
+      if (!init.success) {
+        this.error = init.error.code === HaiApiClientError.CONFIG_ERROR.code ? m.api_not_configured() : m.home_error()
+        return
+      }
+      const info = await managementApi.app.info()
+      if (!info.success) {
+        this.error = m.home_error()
+        return
+      }
+      this.info = info.data
+      this.applyLocale(info.data.defaultLocale)
+      // 默认 Cookie 存储通过 api-client 的加密刷新链路恢复会话。
+      const me = await managementApi.iam.auth.currentUser()
+      if (me.success) {
+        this.setUser(me.data)
+        await this.navigate(this.isAdmin ? 'users' : 'settings')
+      }
+      else if (me.error.httpStatus !== 401) {
+        this.error = m.operation_failed()
+      }
+    }
+    catch {
+      this.error = m.home_error()
+    }
+    finally {
+      this.initializing = false
+    }
+  }
+
+  async close(): Promise<void> {
+    this.requestVersion++
+    this.sessionEpoch++
+    this.loading = false
+    await managementApi.close()
+  }
+
+  async login(data: LoginFormData): Promise<void> {
+    await this.mutate(async () => {
+      const login = await managementApi.iam.auth.login({ identifier: data.username, password: data.password })
+      if (!login.success) {
+        this.error = login.error.httpStatus && login.error.httpStatus < 500 ? m.login_invalid() : m.network_error()
+        return
+      }
+      await managementApi.auth.setTokens(login.data.tokens)
+      const me = await this.request(() => managementApi.iam.auth.currentUser())
+      if (!me?.success)
+        return
+      this.setUser(me.data)
+      await this.navigate(this.isAdmin ? 'users' : 'settings')
+    })
+  }
+
+  async logout(): Promise<void> {
+    await this.mutate(async () => {
+      const result = await this.request(() => managementApi.iam.auth.logout({}))
+      if (!result?.success)
+        return
+      await managementApi.auth.clear()
+      this.clearSession()
+    })
+  }
+
+  async navigate(page: ManagementPage): Promise<void> {
+    if (!this.user)
+      return
+    this.requestVersion++
+    this.loading = false
+    this.page = this.isAdmin ? page : 'settings'
+    this.error = ''
+    this.notice = ''
+    if (this.page === 'users')
+      await this.loadUsers()
+    else if (this.page === 'roles')
+      await this.loadRoles()
+    else if (this.page === 'audit')
+      await this.loadAudit()
+  }
+
+  async loadUsers(page = 1): Promise<void> {
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.users.list({
+        page,
+pageSize: this.pageSize,
+search: this.usersSearch.trim() || undefined,
+        enabled: this.usersStatus === 'all' ? undefined : this.usersStatus === 'enabled',
+      }), version)
+      if (result?.success && version === this.requestVersion) {
+        this.users = result.data.items.map(user => ({ ...user, avatarUrl: resolveAvatarUrl(user.avatarUrl) }))
+        this.usersTotal = result.data.total
+        this.usersPage = result.data.page
+      }
+    })
+  }
+
+  async loadRoles(): Promise<void> {
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.roles.list(), version)
+      if (result?.success && version === this.requestVersion)
+        this.roles = result.data.items
+    })
+  }
+
+  async loadAudit(page = 1): Promise<void> {
+    if (this.auditStartDate && this.auditEndDate && this.auditStartDate > this.auditEndDate) {
+      this.error = m.audit_date_invalid()
+      return
+    }
+    await this.load(async (version) => {
+      const result = await this.request(() => managementApi.admin.audit.list({
+        page,
+pageSize: this.pageSize,
+action: this.auditAction.trim() || undefined,
+        resource: this.auditResource.trim() || undefined,
+        startDate: this.auditStartDate ? new SvelteDate(`${this.auditStartDate}T00:00:00`).toISOString() : undefined,
+        endDate: this.auditEndDate ? new SvelteDate(`${this.auditEndDate}T23:59:59.999`).toISOString() : undefined,
+      }), version)
+      if (result?.success && version === this.requestVersion) {
+        this.audit = result.data.items
+        this.auditTotal = result.data.total
+        this.auditPage = result.data.page
+      }
+    })
+  }
+
+  async saveUser(data: AdminCreateUser | AdminUpdateUser): Promise<boolean> {
+    let saved = false
+    await this.mutate(async () => {
+      const result = 'id' in data
+        ? await this.request(() => managementApi.admin.users.update(data))
+        : await this.request(() => managementApi.admin.users.create(data))
+      if (!result?.success)
+        return
+      saved = true
+      await this.loadUsers(this.usersPage)
+      this.notice = m.saved()
+    })
+    return saved
+  }
+
+  async deleteUser(user: AdminUser): Promise<boolean> {
+    let deleted = false
+    await this.mutate(async () => {
+      const result = await this.request(() => managementApi.admin.users.delete({ id: user.id }))
+      if (!result?.success)
+        return
+      deleted = true
+      const page = this.users.length === 1 ? Math.max(1, this.usersPage - 1) : this.usersPage
+      await this.loadUsers(page)
+      this.notice = m.user_deleted()
+    })
+    return deleted
+  }
+
+  async saveRole(id: string, description: string): Promise<boolean> {
+    let saved = false
+    await this.mutate(async () => {
+      const result = await this.request(() => managementApi.admin.roles.update({ id, description }))
+      if (!result?.success)
+        return
+      saved = true
+      await this.loadRoles()
+      this.notice = m.saved()
+    })
+    return saved
+  }
+
+  async saveProfile(data: UserProfileSubmitData): Promise<void> {
+    await this.savePreferences({ displayName: data.displayName?.trim() ?? '', email: data.email?.trim() ?? '' })
+  }
+
+  async savePreferences(data: ProfileUpdate): Promise<void> {
+    await this.mutate(async () => {
+      const result = await this.request(() => managementApi.profile.update(data))
+      if (!result?.success)
+        return
+      const me = await this.request(() => managementApi.iam.auth.currentUser())
+      if (me?.success)
+        this.setUser(me.data)
+      this.notice = m.saved()
+    })
+  }
+
+  async changePassword(data: ChangePasswordFormData): Promise<void> {
+    await this.mutate(async () => {
+      if (!data.oldPassword || data.newPassword === data.oldPassword || data.newPassword !== data.confirmPassword || data.newPassword.length < 8) {
+        this.error = m.validation_failed()
+        return
+      }
+      const oldPassword = data.oldPassword
+      const result = await this.request(() => managementApi.iam.auth.changePassword({ oldPassword, newPassword: data.newPassword }))
+      if (!result?.success)
+        return
+      await managementApi.auth.clear()
+      this.clearSession()
+      this.notice = m.password_changed()
+    })
+  }
+
+  async uploadAvatar(file: File, userId?: string): Promise<void> {
+    await this.mutate(async () => {
+      const payload = await this.readAvatar(file)
+      if (!payload)
+        return
+      const result = userId
+        ? await this.request(() => managementApi.admin.users.avatar({ id: userId, ...payload }))
+        : await this.request(() => managementApi.profile.avatar(payload))
+      if (!result?.success)
+        return
+      if (!userId || userId === this.user?.id) {
+        const me = await this.request(() => managementApi.iam.auth.currentUser())
+        if (me?.success)
+          this.setUser(me.data)
+      }
+      if (userId)
+        await this.loadUsers(this.usersPage)
+      this.notice = m.avatar_saved()
+    })
+  }
+
+  formatDate(value: string): string {
+    return new Intl.DateTimeFormat(this.locale, { dateStyle: 'medium', timeStyle: 'short' }).format(new SvelteDate(value))
+  }
+
+  private async readAvatar(file: File): Promise<AvatarUpload | undefined> {
+    if (file.size > 512 * 1024 || !['image/png', 'image/jpeg', 'image/webp'].includes(file.type)) {
+      this.error = m.avatar_invalid()
+      return undefined
+    }
+    const bytes = new Uint8Array(await file.arrayBuffer())
+    let binary = ''
+    for (const byte of bytes)
+      binary += String.fromCharCode(byte)
+    return { contentType: file.type as AvatarUpload['contentType'], base64: btoa(binary) }
+  }
+
+  private setUser(user: CurrentUser): void {
+    if (this.user?.id !== user.id)
+      this.sessionEpoch++
+    this.user = { ...user, avatarUrl: resolveAvatarUrl(user.avatarUrl) }
+    this.applyLocale(typeof user.metadata?.locale === 'string' ? user.metadata.locale : this.info?.defaultLocale ?? getLocale())
+    if (typeof user.metadata?.theme === 'string' && AVAILABLE_THEMES.includes(user.metadata.theme))
+      themeStore.set(user.metadata.theme)
+    else
+      themeStore.set(DEFAULT_THEME)
+  }
+
+  private applyLocale(value: string): void {
+    const locale = locales.find(locale => locale === value)
+    if (!locale)
+      return
+    this.locale = locale
+    setLocale(locale, { reload: false })
+    core.i18n.setGlobalLocale(locale)
+    if (typeof document !== 'undefined')
+      document.documentElement.lang = locale
+    this.onLocaleChange?.(locale)
+  }
+
+  private clearSession(): void {
+    this.requestVersion++
+    this.sessionEpoch++
+    this.loading = false
+    this.user = null
+    this.users = []
+    this.roles = []
+    this.audit = []
+    this.page = 'settings'
+  }
+
+  private expireSession(): void {
+    if (!this.user)
+      return
+    this.clearSession()
+    this.error = m.session_expired()
+    void managementApi.auth.clear()
+  }
+
+  private async request<T>(task: () => Promise<HaiResult<T>>, version?: number): Promise<HaiResult<T> | undefined> {
+    const epoch = this.sessionEpoch
+    const isCurrent = () => epoch === this.sessionEpoch && (version === undefined || version === this.requestVersion)
+    try {
+      const result = await task()
+      if (!isCurrent())
+        return undefined
+      if (!result.success) {
+        if (result.error.httpStatus === 401 && this.user) {
+          this.expireSession()
+}
+        else if (result.error.httpStatus === 403 && this.user) {
+          const current = await managementApi.iam.auth.currentUser()
+          if (!isCurrent())
+            return undefined
+          if (current.success) {
+            this.setUser(current.data)
+            if (!this.isAdmin) {
+              this.requestVersion++
+              this.loading = false
+              this.users = []
+              this.roles = []
+              this.audit = []
+              this.page = 'settings'
+            }
+          }
+          this.error = m.forbidden()
+        }
+        else {
+          this.error = result.error.httpStatus === 403 ? m.forbidden() : result.error.httpStatus === 409 ? m.conflict() : result.error.httpStatus === 400 || result.error.httpStatus === 422 ? m.validation_failed() : m.operation_failed()
+        }
+      }
+      return result
+    }
+    catch {
+      if (isCurrent())
+        this.error = m.network_error()
+      return undefined
+    }
+  }
+
+  private async load(task: (version: number) => Promise<void>): Promise<void> {
+    const version = ++this.requestVersion
+    this.loading = true
+    this.error = ''
+    await task(version)
+    if (version === this.requestVersion)
+      this.loading = false
+  }
+
+  private async mutate(task: () => Promise<void>): Promise<void> {
+    if (this.saving)
+      return
+    this.saving = true
+    this.error = ''
+    this.notice = ''
+    try {
+      await task()
+    }
+    catch {
+      this.error = m.network_error()
+    }
+    finally {
+      this.saving = false
+    }
+  }
+}

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/stores/theme-store.svelte.ts.hbs

@@ -1,54 +1,22 @@
-{{!-- Shared theme store for {{projectName}} fullstack apps. --}}
-const STORAGE_KEY = 'hai-theme'
-const DEFAULT_THEME = '{{fullstack.theme.defaultTheme}}'
-export const AVAILABLE_THEMES: readonly string[] = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
-
-function isBrowser(): boolean {
-  return typeof window !== 'undefined' && typeof document !== 'undefined'
-}
+import { applyTheme, getSavedTheme } from '@h-ai/ui/theme'
 
-function readInitialTheme(): string {
-  if (!isBrowser())
-    return DEFAULT_THEME
-  try {
-    const stored = window.localStorage.getItem(STORAGE_KEY)
-    if (stored && AVAILABLE_THEMES.includes(stored))
-      return stored
-  }
-  catch {
-    // localStorage 不可用时（隐私模式 / SSR），回退到默认主题
-  }
-  return DEFAULT_THEME
-}
+export const DEFAULT_THEME = '{{fullstack.theme.defaultTheme}}'
+export const AVAILABLE_THEMES: readonly string[] = [{{#each fullstack.theme.themes}}'{{this}}'{{#unless @last}}, {{/unless}}{{/each}}]
 
+/** 只维护响应式状态和已编译主题白名单，DOM 与安全持久化复用 UI 公共工具。 */
 class ThemeState {
   current = $state<string>(DEFAULT_THEME)
 
   constructor() {
-    this.current = readInitialTheme()
-    if (isBrowser())
-      this.apply(this.current)
+    const saved = getSavedTheme(DEFAULT_THEME)
+    this.set(AVAILABLE_THEMES.includes(saved) ? saved : DEFAULT_THEME)
   }
 
   set(value: string): void {
     if (!AVAILABLE_THEMES.includes(value))
       return
     this.current = value
-    this.apply(value)
-    if (isBrowser()) {
-      try {
-        window.localStorage.setItem(STORAGE_KEY, value)
-      }
-      catch {
-        // 忽略 localStorage 写入失败
-      }
-    }
-  }
-
-  private apply(value: string): void {
-    if (!isBrowser())
-      return
-    document.documentElement.dataset.theme = value
+    applyTheme(value)
   }
 }
 

package/templates/apps/fullstack/packages/{{projectName}}-shared/svelte.config.js.hbs

@@ -0,0 +1 @@
+export default {}

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/api-client.test.ts.hbs

@@ -0,0 +1,151 @@
+import type { EncryptedPayload } from '@h-ai/crypto'
+import { HaiApiClientError } from '@h-ai/api-client'
+import { crypto, TRANSPORT_PROTOCOL } from '@h-ai/crypto'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { initializeManagementApi, managementApi, resolveAvatarUrl } from '../src/lib/api/api-client.js'
+
+const runtimeInfo = {
+  name: 'Configured workspace',
+  version: '9.8.7',
+  env: 'test',
+  defaultLocale: 'zh-CN',
+  supportedLocales: ['zh-CN', 'en-US'],
+  startedAt: '2026-01-01T00:00:00.000Z',
+  frontends: ['web'],
+}
+
+/** 使用真实 crypto 公共入口模拟对端，覆盖握手及双向加解密。 */
+function createServerFetch() {
+  const created = crypto.transport.createServer()
+  if (!created.success)
+    throw new Error(created.error.message)
+  const server = created.data
+  const requests: Request[] = []
+  const messages: string[] = []
+  const fetchFn: typeof fetch = async (input, init) => {
+    const request = new Request(input, init)
+    requests.push(request.clone())
+    const url = new URL(request.url)
+    if (url.pathname.endsWith('/_hai/key-exchange')) {
+      const body = await request.json() as { clientPublicKey: string }
+      const clientId = await server.registerClientKey(body.clientPublicKey)
+      return Response.json({ serverPublicKey: server.getServerPublicKey(), clientId })
+    }
+    const clientId = request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER)
+    if (!clientId)
+      return Response.json({ success: false }, { status: 400 })
+    let data: unknown = runtimeInfo
+    if (url.pathname.endsWith('/app/echo')) {
+      expect(request.headers.get(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)).toBe(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE)
+      const encrypted = await request.json() as EncryptedPayload
+      expect(JSON.stringify(encrypted)).not.toContain('private message')
+      const decrypted = server.decryptRequest(encrypted)
+      expect(decrypted.success).toBe(true)
+      if (!decrypted.success)
+        throw new Error(decrypted.error.message)
+      const payload = JSON.parse(decrypted.data) as { message: string }
+      messages.push(payload.message)
+      data = { message: payload.message, echoedAt: '2026-01-01T00:00:00.000Z', requestId: 'test-request' }
+    }
+    const response = await server.encryptResponse(clientId, JSON.stringify({ success: true, data }))
+    if (!response.success)
+      throw new Error(response.error.message)
+    return Response.json(response.data, { headers: { [TRANSPORT_PROTOCOL.ENCRYPTED_HEADER]: TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE } })
+  }
+  return { fetchFn, requests, messages }
+}
+
+describe('shared API transport', () => {
+  beforeAll(async () => {
+    expect((await crypto.init()).success).toBe(true)
+  })
+  afterAll(async () => {
+    await managementApi.close()
+    await crypto.close()
+  })
+
+  it('decrypts configured core metadata and includes refresh cookies', async () => {
+    const server = createServerFetch()
+    expect((await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://api.example.com', clientName: 'configured-client' })).success).toBe(true)
+    const info = await managementApi.app.info()
+    expect(info.success).toBe(true)
+    if (info.success)
+      expect(info.data).toEqual(runtimeInfo)
+    expect(server.requests.every(request => request.credentials === 'include')).toBe(true)
+    expect(server.requests.at(-1)?.headers.get('x-request-client')).toBe('configured-client')
+  })
+
+  it('uses the API origin injected at container startup', async () => {
+    Object.assign(globalThis, { __HAI_PUBLIC_CONFIG__: { apiBase: 'https://runtime.example.com' } })
+    const server = createServerFetch()
+    try {
+      expect((await initializeManagementApi({ fetchFn: server.fetchFn })).success).toBe(true)
+      expect((await managementApi.app.info()).success).toBe(true)
+      expect(server.requests.every(request => request.url.startsWith('https://runtime.example.com/api/v1/'))).toBe(true)
+    }
+    finally {
+      Reflect.deleteProperty(globalThis, '__HAI_PUBLIC_CONFIG__')
+    }
+  })
+
+  it('encrypts business input and preserves the native token transport header', async () => {
+    const server = createServerFetch()
+    const init = await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://api.example.com/api/v1', headers: { 'X-HAI-Token-Transport': 'body' } })
+    expect(init.success).toBe(true)
+    try {
+      const result = await managementApi.app.echo({ message: 'private message' })
+      expect(result.success).toBe(true)
+      if (result.success)
+        expect(result.data.message).toBe('private message')
+      expect(server.messages).toEqual(['private message'])
+      expect(server.requests.at(-1)?.headers.get('X-HAI-Token-Transport')).toBe('body')
+    }
+    finally {
+      await managementApi.close()
+    }
+  })
+
+  it('resolves avatars only under the configured API origin', async () => {
+    const server = createServerFetch()
+    expect((await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://trusted.example.com/api/v1' })).success).toBe(true)
+    try {
+      const path = '/api/v1/assets/avatars/user-id/asset-id.png'
+      expect(resolveAvatarUrl(path)).toBe(`https://trusted.example.com${path}`)
+      expect(resolveAvatarUrl(`https://host-injection.example.com${path}`)).toBe(`https://trusted.example.com${path}`)
+      expect(resolveAvatarUrl('https://host-injection.example.com/pixel.png')).toBeUndefined()
+      expect(resolveAvatarUrl('/api/v1/assets/avatars/../secrets.txt')).toBeUndefined()
+      expect(resolveAvatarUrl('data:image/svg+xml,<svg/>')).toBeUndefined()
+    }
+    finally {
+      await managementApi.close()
+    }
+  })
+
+  it('requires an explicit API origin for a native build', async () => {
+    vi.stubEnv('PUBLIC_API_BASE', '')
+    try {
+      const result = await initializeManagementApi({ requireApiBase: true })
+      expect(result.success).toBe(false)
+      if (!result.success)
+        expect(result.error.code).toBe(HaiApiClientError.CONFIG_ERROR.code)
+    }
+    finally {
+      vi.unstubAllEnvs()
+    }
+  })
+
+  it('preserves a configured API prefix for transport and avatars', async () => {
+    const server = createServerFetch()
+    expect((await initializeManagementApi({ fetchFn: server.fetchFn, baseUrl: 'https://trusted.example.com/custom-api/' })).success).toBe(true)
+    try {
+      expect((await managementApi.app.info()).success).toBe(true)
+      expect(server.requests.every(request => request.url.startsWith('https://trusted.example.com/custom-api/'))).toBe(true)
+      const avatar = '/custom-api/assets/avatars/user-id/asset-id.png'
+      expect(resolveAvatarUrl(avatar)).toBe(`https://trusted.example.com${avatar}`)
+      expect(resolveAvatarUrl('/api/v1/assets/avatars/user-id/asset-id.png')).toBeUndefined()
+    }
+    finally {
+      await managementApi.close()
+    }
+  })
+})