@h-ai/cli 0.1.0-alpha.58 → 0.1.0-alpha.60

package/templates/base/e2e/app.spec.ts.hbs

@@ -1,3 +1,8 @@
+{{#if features.iam}}
+import { mkdir } from 'node:fs/promises'
+import path from 'node:path'
+{{/if}}
+import process from 'node:process'
 import { expect, test } from '@playwright/test'
 
 /** 首页从真实浏览器页面发起，覆盖基础渲染链路。 */
@@ -9,3 +14,103 @@ test('home page renders from browser', async ({ page }) => {
   await expect(pageErrors).toEqual([])
   await expect(page.locator('main, section').first()).toBeVisible()
 })
+{{#if features.iam}}
+
+/** 实际注册和密码登录；截图只保存空白表单。 */
+test('configured IAM registration and password login', async ({ page, context }) => {
+  test.setTimeout(90_000)
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  const username = `scaf${Date.now()}`
+  const password = 'ScaffoldPassword123'
+  const authUrl = '{{#if isCapacitorApp}}/{{else}}/auth/login{{/if}}'
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /立即注册|Register now/i }).click()
+  await expect(page.locator('input[name="username"]')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  if (process.env.IAM_NOTIFICATION_URL) {
+    // 协议弹窗留在认证页，关闭后继续填写注册表单。
+    await page.getByRole('button', { name: /用户协议|User Agreement/i, exact: true }).click()
+    await expect(page.getByRole('dialog')).toBeVisible()
+    await expect(page.getByRole('dialog').getByRole('heading', { name: 'Configured registration agreement' })).toBeVisible()
+    await expect(page.locator('iframe')).toHaveCount(0)
+    await page.screenshot({ path: path.join(evidence, '{{projectName}}-agreement.png'), fullPage: true })
+    await page.keyboard.press('Escape')
+    await expect(page.getByRole('dialog')).not.toBeVisible()
+  }
+  await page.locator('input[name="username"]').fill(username)
+  await page.locator('input[name="email"]').fill(`${username}@example.com`)
+  await page.locator('input[type="password"]').nth(0).fill(password)
+  await page.locator('input[type="password"]').nth(1).fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.register-form')).not.toBeVisible()
+{{#unless isCapacitorApp}}
+  const me = await page.request.get('/api/auth/me')
+  expect(me.ok()).toBe(true)
+  await context.clearCookies()
+{{/unless}}
+  await page.reload()
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+
+  if (!process.env.IAM_NOTIFICATION_URL)
+    return
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  const email = `${username}@example.com`
+  await page.locator('#login-username').fill(email)
+  await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
+  await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
+  async function received(template: string) {
+    const response = await page.request.get(`${process.env.IAM_NOTIFICATION_URL}/messages?to=${encodeURIComponent(email)}`)
+    const messages = await response.json() as { template: string, vars: Record<string, string> }[]
+    return messages.findLast(item => item.template === template)?.vars
+  }
+  const otp = await received('otp_email')
+  expect(Boolean(otp?.code)).toBe(true)
+  await page.locator('#login-code').fill(otp?.code ?? '')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.locator('input[type="email"]').fill(email)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.alert-success')).toBeVisible()
+  const reset = await received('password_reset')
+  expect(Boolean(reset?.token)).toBe(true)
+  await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  await page.goto(`{{#if isCapacitorApp}}/{{else}}/auth/reset-password{{/if}}?token=${encodeURIComponent(reset?.token ?? '')}`)
+  await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
+  await page.locator('input[type="password"]').nth(0).fill('ScaffoldReset456')
+  await page.locator('input[type="password"]').nth(1).fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.alert-success')).toBeVisible()
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /^(登录|Sign in|Login)$/i }).click()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(new URL(page.url()).searchParams.has('token')).toBe(false)
+  await page.reload()
+{{#if isCapacitorApp}}
+  // Web 预览采用内存 TokenStore，刷新后应回到登录，而不是已消费令牌的重置页面。
+  await expect(page.locator('#login-username')).toBeVisible()
+{{else}}
+  await expect(await page.request.get('/api/auth/me')).toBeOK()
+{{/if}}
+})
+{{/if}}

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.58",
+  "version": "0.1.0-alpha.60",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",

package/templates/base/src/hooks.server.ts.hbs

@@ -89,10 +89,10 @@ const haiHandle = kit.createHandle({
         data: session.data,
       }
     },
-    operations: iam.auth,
     loginUrl: '/auth/login',
     protectedPaths: ['/admin/*', '/api/*'],
-    publicPaths: ['/api/auth/*', '/api/public/*', '/api/health'],
+    publicPaths: [...kit.auth.publicPaths, '/api/auth/logout', '/api/public/*', '/api/health'],
+    operations: () => iam.auth,
   },
 {{/if}}
   rateLimit: { windowMs: 60000, maxRequests: 200 },

package/templates/base/src/lib/server/init.ts.hbs

@@ -190,7 +190,7 @@ export async function initApp(): Promise<void> {
 
 {{#if features.iam}}
   // ─── 初始化 IAM ───
-  const iamResult = await iam.init(iamConfig)
+  const iamResult = await iam.init({ ...iamConfig{{#if features.reach}}, reach{{/if}} })
   if (!iamResult.success) {
     throw new Error(`IAM initialization failed: ${iamResult.error.message}`)
   }

package/templates/base/src/routes/+layout.server.ts.hbs

@@ -2,11 +2,17 @@
 {{#unless isSvelteOnlyApp}}
 import type { CoreConfig } from '@h-ai/core'
 import { core } from '@h-ai/core'
+{{#if features.iam}}
+import { iam } from '@h-ai/iam'
+{{/if}}
 
 /** 只向浏览器提供公开配置，避免暴露日志上下文、凭证或其它模块配置。 */
 export function load() {
   const config = core.config.getOrThrow<CoreConfig>('core')
   return {
+{{#if features.iam}}
+    iamPublicConfig: iam.publicConfig,
+{{/if}}
     appConfig: {
       name: config.name,
       version: config.version,

package/templates/base/tests/scaffold.test.ts.hbs

@@ -55,6 +55,9 @@ describe('generated scaffold', () => {
     const config = core.config.getOrThrow<CoreConfig>('core')
     expect(core.logger.getLevel()).toBe(config.logging?.level ?? 'info')
     expect(load()).toEqual({
+{{#if features.iam}}
+      iamPublicConfig: null,
+{{/if}}
       appConfig: { name: config.name, version: config.version, env: config.env, defaultLocale: config.defaultLocale },
     })
   })

package/templates/base/vite.config.ts.hbs

@@ -42,6 +42,7 @@ export default defineConfig(({ mode }) => {
 {{/if}}
 
   return {
+    envPrefix: ['VITE_', 'PUBLIC_'],
 {{#if isSvelteOnlyApp}}
     define: { __APP_CORE_CONFIG__: JSON.stringify(appConfig) },
 {{/if}}

package/templates/features/iam/routes-admin/(auth)/+layout.svelte.hbs

@@ -1,21 +1,7 @@
-{{!-- 认证布局（登录/注册共用） --}}
 <script lang='ts'>
-  /**
-   * 认证布局（登录/注册共用）
-   */
   import type { Snippet } from 'svelte'
 
-  interface Props {
-    children: Snippet
-  }
-
-  const { children }: Props = $props()
+  const { children }: { children: Snippet } = $props()
 </script>
 
-<div class='min-h-screen flex items-center justify-center bg-base-200'>
-  <div class='card w-full max-w-md bg-base-100 shadow-xl'>
-    <div class='card-body'>
-      {@render children()}
-    </div>
-  </div>
-</div>
+{@render children()}

package/templates/features/iam/routes-admin/(auth)/auth/forgot-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions()
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='forgot' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-admin/(auth)/auth/login/+page.svelte.hbs

@@ -1,100 +1,11 @@
-{{!-- Admin 登录页面 --}}
 <script lang='ts'>
-  /**
-   * 登录页面
-   */
+  import { goto } from '$app/navigation'
   import { resolve } from '$app/paths'
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-  import { Alert, Button, FormField, Input } from '@h-ai/ui'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
 
-  let username = $state('')
-  let password = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleLogin(event: SubmitEvent) {
-    event.preventDefault()
-    error = ''
-    loading = true
-    try {
-      const res = await fetch('/api/auth/login', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ identifier: username, password }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/admin'
-      }
-      else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_login_failed()
-{{else}}
-        error = data.error?.message || '登录失败'
-{{/if}}
-      }
-    }
-    catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    }
-    finally {
-      loading = false
-    }
-  }
+  const actions = kit.client.createAuthActions()
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_login_title()}</title>
-{{else}}
-  <title>登录</title>
-{{/if}}
-</svelte:head>
-
-{{#if hasI18n}}
-<h2 class='text-2xl font-bold text-center mb-6'>{m.auth_login_title()}</h2>
-{{else}}
-<h2 class='text-2xl font-bold text-center mb-6'>登录</h2>
-{{/if}}
-
-{#if error}
-  <Alert variant='error' class='mb-4'>{error}</Alert>
-{/if}
-
-<form onsubmit={handleLogin} class='space-y-4'>
-{{#if hasI18n}}
-  <FormField label={m.auth_label_username()} required>
-    <Input id='username' type='text' bind:value={username} required />
-  </FormField>
-  <FormField label={m.auth_label_password()} required>
-    <Input id='password' type='password' bind:value={password} required />
-  </FormField>
-  <Button type='submit' variant='primary' loading={loading} class='w-full'>
-    {loading ? m.auth_login_loading() : m.auth_login_submit()}
-  </Button>
-{{else}}
-  <FormField label='用户名' required>
-    <Input id='username' type='text' bind:value={username} required />
-  </FormField>
-  <FormField label='密码' required>
-    <Input id='password' type='password' bind:value={password} required />
-  </FormField>
-  <Button type='submit' variant='primary' loading={loading} class='w-full'>
-    {loading ? '登录中...' : '登录'}
-  </Button>
-{{/if}}
-</form>
-
-<div class='text-center mt-4'>
-{{#if hasI18n}}
-  <a href={resolve('/auth/register', {})} class='link link-primary text-sm'>{m.auth_login_to_register()}</a>
-{{else}}
-  <a href={resolve('/auth/register', {})} class='link link-primary text-sm'>没有账号？立即注册</a>
-{{/if}}
-</div>
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='login' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/admin', {}))} />

package/templates/features/iam/routes-admin/(auth)/auth/register/+page.svelte.hbs

@@ -1,122 +1,11 @@
-{{!-- Admin 注册页面 --}}
 <script lang='ts'>
-  /**
-   * 注册页面
-   */
+  import { goto } from '$app/navigation'
   import { resolve } from '$app/paths'
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-  import { Alert, Button, FormField, Input } from '@h-ai/ui'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
 
-  let username = $state('')
-  let email = $state('')
-  let password = $state('')
-  let confirmPassword = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleRegister(event: SubmitEvent) {
-    event.preventDefault()
-    error = ''
-    if (password !== confirmPassword) {
-{{#if hasI18n}}
-      error = m.auth_error_password_mismatch()
-{{else}}
-      error = '密码不一致'
-{{/if}}
-      return
-    }
-    loading = true
-    try {
-      const res = await fetch('/api/auth/register', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ username, email, password, confirmPassword }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/auth/login'
-      }
-      else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_register_failed()
-{{else}}
-        error = data.error?.message || '注册失败'
-{{/if}}
-      }
-    }
-    catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    }
-    finally {
-      loading = false
-    }
-  }
+  const actions = kit.client.createAuthActions()
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_register_title()}</title>
-{{else}}
-  <title>注册</title>
-{{/if}}
-</svelte:head>
-
-{{#if hasI18n}}
-<h2 class='text-2xl font-bold text-center mb-6'>{m.auth_register_title()}</h2>
-{{else}}
-<h2 class='text-2xl font-bold text-center mb-6'>注册</h2>
-{{/if}}
-
-{#if error}
-  <Alert variant='error' class='mb-4'>{error}</Alert>
-{/if}
-
-<form onsubmit={handleRegister} class='space-y-4'>
-{{#if hasI18n}}
-  <FormField label={m.auth_label_username()} required>
-    <Input id='username' type='text' bind:value={username} required />
-  </FormField>
-  <FormField label={m.auth_label_email()} required>
-    <Input id='email' type='email' bind:value={email} required />
-  </FormField>
-  <FormField label={m.auth_label_password()} required>
-    <Input id='password' type='password' bind:value={password} required />
-  </FormField>
-  <FormField label={m.auth_label_confirm_password()} required>
-    <Input id='confirmPassword' type='password' bind:value={confirmPassword} required />
-  </FormField>
-  <Button type='submit' variant='primary' loading={loading} class='w-full'>
-    {loading ? m.auth_register_loading() : m.auth_register_submit()}
-  </Button>
-{{else}}
-  <FormField label='用户名' required>
-    <Input id='username' type='text' bind:value={username} required />
-  </FormField>
-  <FormField label='邮箱' required>
-    <Input id='email' type='email' bind:value={email} required />
-  </FormField>
-  <FormField label='密码' required>
-    <Input id='password' type='password' bind:value={password} required />
-  </FormField>
-  <FormField label='确认密码' required>
-    <Input id='confirmPassword' type='password' bind:value={confirmPassword} required />
-  </FormField>
-  <Button type='submit' variant='primary' loading={loading} class='w-full'>
-    {loading ? '注册中...' : '注册'}
-  </Button>
-{{/if}}
-</form>
-
-<div class='text-center mt-4'>
-{{#if hasI18n}}
-  <a href={resolve('/auth/login', {})} class='link link-primary text-sm'>{m.auth_register_to_login()}</a>
-{{else}}
-  <a href={resolve('/auth/login', {})} class='link link-primary text-sm'>已有账号？立即登录</a>
-{{/if}}
-</div>
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='register' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/admin', {}))} />

package/templates/features/iam/routes-admin/(auth)/auth/reset-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions()
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='reset' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-h5/auth/forgot-password/+page.svelte.hbs

@@ -0,0 +1,10 @@
+<script lang='ts'>
+  import { resolve } from '$app/paths'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+
+  const actions = kit.client.createAuthActions()
+</script>
+
+<AuthPanel config={page.data.iamPublicConfig} {actions} initialMode='forgot' resetToken={page.url.searchParams.get('token') ?? ''} loginUrl={resolve('/auth/login', {})} />

package/templates/features/iam/routes-h5/auth/login/+page.svelte.hbs

@@ -1,102 +1,11 @@
-{{!-- H5 登录页面 --}}
 <script lang='ts'>
-  /**
-   * H5 登录页面
-   */
+  import { goto } from '$app/navigation'
   import { resolve } from '$app/paths'
-{{#if hasI18n}}
-  import * as m from '$lib/paraglide/messages'
-{{/if}}
-  import { Alert, Button, FormField, Input } from '@h-ai/ui'
+  import { page } from '$app/state'
+  import { kit } from '@h-ai/kit'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
 
-  let username = $state('')
-  let password = $state('')
-  let error = $state('')
-  let loading = $state(false)
-
-  async function handleLogin(event: SubmitEvent) {
-    event.preventDefault()
-    error = ''
-    loading = true
-    try {
-      const res = await fetch('/api/auth/login', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ identifier: username, password }),
-      })
-      const data = await res.json()
-      if (data.success) {
-        window.location.href = '/'
-      }
-      else {
-{{#if hasI18n}}
-        error = data.error?.message || m.auth_login_failed()
-{{else}}
-        error = data.error?.message || '登录失败'
-{{/if}}
-      }
-    }
-    catch {
-{{#if hasI18n}}
-      error = m.auth_error_network()
-{{else}}
-      error = '网络错误'
-{{/if}}
-    }
-    finally {
-      loading = false
-    }
-  }
+  const authActions = kit.client.createAuthActions()
 </script>
 
-<svelte:head>
-{{#if hasI18n}}
-  <title>{m.auth_login_title()}</title>
-{{else}}
-  <title>登录</title>
-{{/if}}
-</svelte:head>
-
-<div class='p-4 pt-12 space-y-4'>
-{{#if hasI18n}}
-  <h1 class='text-2xl font-black tracking-tight text-center'>{m.auth_login_title()}</h1>
-{{else}}
-  <h1 class='text-2xl font-black tracking-tight text-center'>登录</h1>
-{{/if}}
-
-  {#if error}
-    <Alert variant='error'>{error}</Alert>
-  {/if}
-
-  <form onsubmit={handleLogin} class='space-y-4'>
-{{#if hasI18n}}
-    <FormField label={m.auth_label_username()} required>
-      <Input id='username' type='text' bind:value={username} required />
-    </FormField>
-    <FormField label={m.auth_label_password()} required>
-      <Input id='password' type='password' bind:value={password} required />
-    </FormField>
-    <Button type='submit' variant='primary' loading={loading} class='w-full'>
-      {loading ? m.auth_login_loading() : m.auth_login_submit()}
-    </Button>
-{{else}}
-    <FormField label='用户名' required>
-      <Input id='username' type='text' bind:value={username} required />
-    </FormField>
-    <FormField label='密码' required>
-      <Input id='password' type='password' bind:value={password} required />
-    </FormField>
-    <Button type='submit' variant='primary' loading={loading} class='w-full'>
-      {loading ? '登录中...' : '登录'}
-    </Button>
-{{/if}}
-  </form>
-
-  <div class='text-center'>
-{{#if hasI18n}}
-    <a href={resolve('/auth/register', {})} class='link link-primary text-sm'>{m.auth_login_to_register()}</a>
-{{else}}
-    <a href={resolve('/auth/register', {})} class='link link-primary text-sm'>没有账号？立即注册</a>
-{{/if}}
-  </div>
-</div>
+<AuthPanel config={page.data.iamPublicConfig} actions={authActions} initialMode='login' loginUrl={resolve('/auth/login', {})} registerUrl={resolve('/auth/register', {})} onauthenticated={() => goto(resolve('/', {}))} />