@h-ai/cli 0.1.0-alpha.59 → 0.1.0-alpha.60

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/app-server.test.ts.hbs

@@ -113,11 +113,18 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     }
   })
 
-  it('does not mount unselected default IAM routes', async () => {
+  it('mounts public auth routes while keeping default IAM administration routes private', async () => {
+    const config = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/config`)
+    expect(config.status).toBe(200)
+    for (const route of ['/auth/register', '/auth/login/ldap', '/auth/login/otp', '/auth/otp/send', '/auth/password-reset/request', '/auth/password-reset/confirm']) {
+      const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{}',
+      })
+      expect(response.status).toBe(400)
+    }
     for (const [route, method] of [
-      ['/auth/register', 'POST'],
-      ['/auth/login/otp', 'POST'],
-      ['/auth/otp/send', 'POST'],
       ['/iam/users', 'GET'],
       ['/iam/roles', 'POST'],
     ] as const) {

package/templates/apps/fullstack/packages/{{projectName}}-shared/README.md.hbs

@@ -25,8 +25,20 @@ Language and theme preferences are saved in IAM user metadata, restored after lo
 
 Shared page copy belongs in `messages/{zh-CN,en-US}.json`. Frontend-specific copy belongs in each app's own messages directory. Keep `baseLocale` and `locales` aligned across all enabled projects, then run root `pnpm i18n:compile`; do not edit generated Paraglide files.
 
+All frontend and shared projects load the installed message-format plugin from the workspace root `node_modules`, matching the scaffold's hoisted dependency layout. Compilation uses the workspace dependency version and does not fetch a plugin from a CDN.
+
 The scaffold theme configuration determines the themes compiled into frontend CSS. Personal settings offer only those available themes. Customize the common layout in `src/lib/components/AppShell.svelte`, the management pages in adjacent components, and business behavior in `src/lib/stores/management-store.svelte.ts`.
 
 ## Validation
 
 Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout.
+
+## IAM configuration
+
+The service's `config/_iam.yml` controls login methods, registration, password reset, agreements and `ui` branding. Email and SMS use providers/templates in `_reach.yml` or custom callbacks. `AuthPanel` uses the public configuration and framework auth actions to manage tokens, resend countdowns and errors. All service nodes must share the same database and Redis; memory cache is for a single process.
+
+LDAP and Reach are optional. Install ldapts in the IAM service workspace only when using its default LDAP client, then enable login.ldap and set connection settings. Custom onOtpSendEmail/onOtpSendSms/onPasswordResetRequest callbacks work without Reach and must reject on delivery failure. Agreements open in a Modal. LoginForm/RegisterForm support header/extraFields/footer snippets; AuthPanel forwards loginHeader/loginFields/loginFooter and registerHeader/registerFields/registerFooter. See the generated hai-iam/hai-ui skills for configuration and examples.
+
+协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
+
+See `.agents/skills/hai-iam/reference.md` in the generated application for the complete contract.

package/templates/apps/fullstack/packages/{{projectName}}-shared/messages/en-US.json.hbs

@@ -39,7 +39,7 @@
   "preferences_title": "Preferences",
   "preferences_description": "Your language and appearance preferences follow your account across devices.",
   "password_title": "Change password",
-  "password_rules": "Use at least 8 characters. Choose a different password. You will need to sign in again after changing it.",
+  "password_rules": "Choose a different password.",
   "password_changed": "Password updated. Please sign in with your new password.",
   "avatar_hint": "Upload a PNG, JPEG or WebP image, up to 512 KB.",
   "avatar_invalid": "Choose a PNG, JPEG or WebP image no larger than 512 KB.",
@@ -55,7 +55,7 @@
   "user_role": "Role",
   "user_status": "Status",
   "user_create": "Add user",
-  "initial_password_rules": "Use at least 8 characters.",
+  "initial_password_rules": "Use at least {min} characters.",
   "account_enabled": "Allow sign-in",
   "users_empty": "No matching accounts. Try another search or create a user.",
   "user_edit": "Edit user",

package/templates/apps/fullstack/packages/{{projectName}}-shared/messages/zh-CN.json.hbs

@@ -39,7 +39,7 @@
   "preferences_title": "偏好设置",
   "preferences_description": "语言与界面风格保存到个人账户，在不同设备上保持一致。",
   "password_title": "修改密码",
-  "password_rules": "密码至少 8 个字符，请使用与旧密码不同的新密码。修改后需要重新登录。",
+  "password_rules": "请使用与旧密码不同的新密码。",
   "password_changed": "密码已修改，请使用新密码重新登录。",
   "avatar_hint": "支持 PNG、JPEG 和 WebP 图片，大小不超过 512 KB。",
   "avatar_invalid": "请选择不超过 512 KB 的 PNG、JPEG 或 WebP 图片。",
@@ -55,7 +55,7 @@
   "user_role": "角色",
   "user_status": "状态",
   "user_create": "新增用户",
-  "initial_password_rules": "密码至少 8 个字符。",
+  "initial_password_rules": "密码至少 {min} 个字符。",
   "account_enabled": "启用账户",
   "users_empty": "没有匹配的账户，请调整查询条件或新增用户。",
   "user_edit": "编辑用户",

package/templates/apps/fullstack/packages/{{projectName}}-shared/package.json.hbs

@@ -31,6 +31,7 @@
   },
   "dependencies": {
     "@h-ai/api-client": "{{haiPackageSpecifier}}",
+    "@h-ai/api-contract": "{{haiPackageSpecifier}}",
     "@h-ai/core": "{{haiPackageSpecifier}}",
     "@h-ai/crypto": "{{haiPackageSpecifier}}",
     "@h-ai/ui": "{{haiPackageSpecifier}}",

package/templates/apps/fullstack/packages/{{projectName}}-shared/project.inlang/settings.json.hbs

@@ -3,7 +3,7 @@
   "baseLocale": "{{fullstack.i18n.baseLocale}}",
   "locales": [{{#each fullstack.i18n.locales}}"{{this}}"{{#unless @last}}, {{/unless}}{{/each}}],
   "modules": [
-    "https://cdn.jsdelivr.net/npm/@inlang/plugin-message-format@latest/dist/index.js"
+    "../../node_modules/@inlang/plugin-message-format/dist/index.js"
   ],
   "plugin.inlang.messageFormat": {
     "pathPattern": "./messages/{locale}.json"

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/api/api-client.ts.hbs

@@ -86,3 +86,6 @@ function normalizeApiBaseUrl(value: string): string {
     url.pathname = '/api/v1'
   return url.toString().replace(/\/+$/, '')
 }
+
+/** 标准 IAM 表单动作，平台安全 TokenStorage 由原有初始化配置决定。 */
+export const managementAuthActions = apiClient.createAuthActions(managementApi)

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/AdminWorkspace.svelte.hbs

@@ -1,9 +1,10 @@
-<script lang="ts">
+<script lang='ts'>
   import type { ManagementApiOptions } from '../api/api-client.js'
   import { Alert, Skeleton } from '@h-ai/ui/components/compounds/index'
   import { Button } from '@h-ai/ui/components/primitives/index'
-  import { LoginForm } from '@h-ai/ui/components/scenes/iam/index'
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
   import { onMount } from 'svelte'
+  import { managementAuthActions } from '../api/api-client.js'
   import * as m from '../paraglide/messages.js'
   import { ManagementStore } from '../stores/management-store.svelte.js'
   import AppShell from './AppShell.svelte'
@@ -15,7 +16,16 @@
   }
   const { platform, apiOptions = {}, onLocaleChange }: Props = $props()
   const store = new ManagementStore()
-  const loginErrors = $derived({ general: store.error })
+  let resetToken = $state('')
+  async function authenticated() {
+    await store.authenticated()
+    if (resetToken) {
+      const url = new URL(location.href)
+      url.searchParams.delete('token')
+      history.replaceState(history.state, '', url)
+    }
+    resetToken = ''
+  }
   const pageComponent = $derived.by(() => {
     if (store.isAdmin && store.page === 'users')
       return import('./UserManagement.svelte')
@@ -26,6 +36,7 @@
     return import('./ProfileSettings.svelte')
   })
   onMount(() => {
+    resetToken = new URL(location.href).searchParams.get('token') ?? ''
     void store.initialize(apiOptions, onLocaleChange)
     return () => {
       void store.close()
@@ -39,31 +50,29 @@
 
 {#key store.locale}
   {#if store.initializing}
-    <div class="grid min-h-dvh place-items-center bg-base-200/50"><div class="w-72 space-y-4"><Skeleton variant="title" /><Skeleton count={3} /><p class="text-center text-sm text-base-content/50">{m.home_loading()}</p></div></div>
-  {:else if !store.user}
-    <main class="grid min-h-dvh place-items-center bg-base-200/50 px-4 py-10">
-      <section class="w-full max-w-md rounded-2xl border border-base-content/8 bg-base-100 p-7 shadow-xl shadow-base-content/3 sm:p-9" data-testid="login-page">
-        <div class="mb-7 flex items-center gap-3">
-          <span class="grid size-11 place-items-center rounded-xl bg-primary text-primary-content"><span class="icon-[tabler--hexagon-letter-h] size-6"></span></span>
-          <div><h1 class="text-lg font-semibold" data-testid="app-name">{store.info?.name || m.login_title()}</h1><p class="mt-1 text-xs text-base-content/45">{m.login_description()}</p></div>
+    <div class='grid min-h-dvh place-items-center bg-base-200/50'><div class='w-72 space-y-4'><Skeleton variant='title' /><Skeleton count={3} /><p class='text-center text-sm text-base-content/50'>{m.home_loading()}</p></div></div>
+  {:else if !store.user || resetToken}
+    <main data-testid='login-page'>
+      {#if !store.info || !store.authConfig}
+        <section class='mx-auto mt-20 max-w-md space-y-4 p-6'>
+          <Alert variant='error'>{store.error || m.home_error()}</Alert>
+          <Button variant='primary' onclick={() => void store.initialize(apiOptions, onLocaleChange)}>{m.home_refresh()}</Button>
+        </section>
+      {:else}
+        <div data-testid='login-form'>
+          {#if store.authConfig && store.error}<Alert variant='error' class='mx-auto max-w-lg'>{store.error}</Alert>{/if}
+          <AuthPanel config={store.authConfig} actions={managementAuthActions} {resetToken} initialMode={resetToken ? 'reset' : 'login'} error={store.authConfig ? '' : store.error} onretry={() => void store.initialize(apiOptions, onLocaleChange)} onauthenticated={authenticated} />
         </div>
-        {#if store.notice}<Alert variant="success" class="mb-5" data-testid="notice">{store.notice}</Alert>{/if}
-        {#if !store.info}
-          <Alert variant="error">{store.error || m.home_error()}</Alert>
-          <Button class="mt-5 w-full" variant="primary" onclick={() => void store.initialize(apiOptions, onLocaleChange)}>{m.home_refresh()}</Button>
-        {:else}
-          <LoginForm loading={store.saving} showRememberMe={false} showForgotPassword={false} errors={loginErrors} onsubmit={data => store.login(data)} data-testid="login-form" />
-          <p class="mt-6 text-center text-xs text-base-content/40"><span data-testid="app-version">v{store.info.version}</span> · <span data-testid="app-environment">{store.info.env}</span></p>
-        {/if}
-      </section>
+        <p class='fixed bottom-3 left-0 right-0 text-center text-xs text-base-content/50'><span data-testid='app-name'>{store.info.name}</span> · <span data-testid='app-version'>v{store.info.version}</span> · <span data-testid='app-environment'>{store.info.env}</span></p>
+      {/if}
     </main>
   {:else}
     <AppShell {platform} {store}>
-      <div class="space-y-5">
-        {#if store.error}<Alert variant="error" data-testid="error">{store.error}</Alert>{/if}
-        {#if store.notice}<Alert variant="success" data-testid="notice">{store.notice}</Alert>{/if}
+      <div class='space-y-5'>
+        {#if store.error}<Alert variant='error' data-testid='error'>{store.error}</Alert>{/if}
+        {#if store.notice}<Alert variant='success' data-testid='notice'>{store.notice}</Alert>{/if}
         {#await pageComponent}
-          <div class="space-y-4"><Skeleton variant="title" /><Skeleton count={3} /></div>
+          <div class='space-y-4'><Skeleton variant='title' /><Skeleton count={3} /></div>
         {:then { default: Page }}
           <Page {store} />
         {/await}

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/ProfileSettings.svelte.hbs

@@ -1,4 +1,4 @@
-<script lang="ts">
+<script lang='ts'>
   import type { ManagementStore } from '../stores/management-store.svelte.js'
   import { Card } from '@h-ai/ui/components/compounds/index'
   import { Avatar, Select } from '@h-ai/ui/components/primitives/index'
@@ -14,44 +14,44 @@
   const themeOptions = AVAILABLE_THEMES.map(theme => ({ value: theme, label: getThemeInfo(theme)?.name ?? theme }))
 </script>
 
-<section class="space-y-5" data-testid="settings-page">
+<section class='space-y-5' data-testid='settings-page'>
   <div>
-    <h1 class="text-xl font-semibold tracking-tight">{m.settings_title()}</h1>
-    <p class="mt-1 text-sm text-base-content/50">{m.settings_description()}</p>
+    <h1 class='text-xl font-semibold tracking-tight'>{m.settings_title()}</h1>
+    <p class='mt-1 text-sm text-base-content/50'>{m.settings_description()}</p>
   </div>
   {#if store.user}
-    <div class="grid gap-5 xl:grid-cols-[0.75fr_1.25fr]">
-      <Card bordered shadow={false} class="h-fit">
-        <div class="flex items-center gap-4">
-          <Avatar name={store.user.displayName || store.user.username} src={store.user.avatarUrl} size="lg" />
-          <div class="min-w-0">
-            <h2 class="truncate text-lg font-semibold">{store.user.displayName || store.user.username}</h2>
-            <p class="text-sm text-base-content/50">@{store.user.username}</p>
-            <p class="mt-2 text-xs text-primary">{store.isAdmin ? m.role_admin() : m.role_user()}</p>
+    <div class='grid gap-5 xl:grid-cols-[0.75fr_1.25fr]'>
+      <Card bordered shadow={false} class='h-fit'>
+        <div class='flex items-center gap-4'>
+          <Avatar name={store.user.displayName || store.user.username} src={store.user.avatarUrl} size='lg' />
+          <div class='min-w-0'>
+            <h2 class='truncate text-lg font-semibold'>{store.user.displayName || store.user.username}</h2>
+            <p class='text-sm text-base-content/50'>@{store.user.username}</p>
+            <p class='mt-2 text-xs text-primary'>{store.isAdmin ? m.role_admin() : m.role_user()}</p>
           </div>
         </div>
-        <p class="mt-4 text-xs leading-6 text-base-content/50">{m.avatar_hint()}</p>
+        <p class='mt-4 text-xs leading-6 text-base-content/50'>{m.avatar_hint()}</p>
       </Card>
       <Card title={m.profile_title()} bordered shadow={false}>
-        <UserProfile user={store.user} editable alwaysEditable fields={['avatar', 'displayName', 'email']} avatarAccept="image/png,image/jpeg,image/webp" avatarHint={m.avatar_hint()} loading={store.saving} onsubmit={data => store.saveProfile(data)} onavatarchange={file => void store.uploadAvatar(file)} data-testid="profile-form" />
+        <UserProfile user={store.user} editable alwaysEditable fields={['avatar', 'displayName', 'email']} avatarAccept='image/png,image/jpeg,image/webp' avatarHint={m.avatar_hint()} loading={store.saving} onsubmit={data => store.saveProfile(data)} onavatarchange={file => void store.uploadAvatar(file)} data-testid='profile-form' />
       </Card>
     </div>
     <Card title={m.preferences_title()} bordered shadow={false}>
-      <p class="mb-5 text-sm text-base-content/50">{m.preferences_description()}</p>
-      <div class="grid gap-6 sm:grid-cols-2">
-        <div class="space-y-2">
-          <label class="text-sm font-medium" for="profile-language">{m.settings_language()}</label>
-          <Select id="profile-language" value={store.locale} options={languageOptions} disabled={store.saving} onchange={locale => void store.savePreferences({ locale })} data-testid="profile-language" />
+      <p class='mb-5 text-sm text-base-content/50'>{m.preferences_description()}</p>
+      <div class='grid gap-6 sm:grid-cols-2'>
+        <div class='space-y-2'>
+          <label class='text-sm font-medium' for='profile-language'>{m.settings_language()}</label>
+          <Select id='profile-language' value={store.locale} options={languageOptions} disabled={store.saving} onchange={locale => void store.savePreferences({ locale })} data-testid='profile-language' />
         </div>
-        <div class="space-y-2">
-          <label class="text-sm font-medium" for="profile-theme">{m.settings_theme()}</label>
-          <Select id="profile-theme" value={themeStore.current} options={themeOptions} disabled={store.saving} onchange={theme => void store.savePreferences({ theme })} data-testid="profile-theme" />
+        <div class='space-y-2'>
+          <label class='text-sm font-medium' for='profile-theme'>{m.settings_theme()}</label>
+          <Select id='profile-theme' value={themeStore.current} options={themeOptions} disabled={store.saving} onchange={theme => void store.savePreferences({ theme })} data-testid='profile-theme' />
         </div>
       </div>
     </Card>
     <Card title={m.password_title()} bordered shadow={false}>
-      <p class="mb-5 text-sm text-base-content/50">{m.password_rules()}</p>
-      <div class="max-w-xl"><ChangePasswordForm loading={store.saving} minPasswordLength={8} onsubmit={data => store.changePassword(data)} data-testid="password-form" /></div>
+      <p class='mb-5 text-sm text-base-content/50'>{m.password_rules()}</p>
+      <div class='max-w-xl'><ChangePasswordForm loading={store.saving} passwordPolicy={store.authConfig?.password} minPasswordLength={store.authConfig?.password.minLength ?? 8} onsubmit={data => store.changePassword(data)} data-testid='password-form' /></div>
     </Card>
   {/if}
 </section>

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/components/UserManagement.svelte.hbs

@@ -141,7 +141,7 @@
     <FormField label={m.user_display_name()}><Input bind:value={displayName} maxlength={100} data-testid="user-display-name" /></FormField>
     <FormField label={m.user_email()}><Input type="email" bind:value={email} data-testid="user-email" /></FormField>
     {#if !editing}
-      <FormField label={m.user_password()} hint={m.initial_password_rules()} required><PasswordInput bind:value={password} autocomplete="new-password" minLength={8} data-testid="user-password" /></FormField>
+      <FormField label={m.user_password()} hint={m.initial_password_rules({ min: store.authConfig?.password.minLength ?? 8 })} required><PasswordInput bind:value={password} autocomplete="new-password" minLength={store.authConfig?.password.minLength ?? 8} data-testid="user-password" /></FormField>
     {/if}
     <FormField label={m.user_role()}><Select bind:value={role} options={roleOptions} disabled={editing?.id === store.user?.id} data-testid="user-role" /></FormField>
     <Checkbox bind:checked={enabled} label={m.account_enabled()} disabled={editing?.id === store.user?.id} />

package/templates/apps/fullstack/packages/{{projectName}}-shared/src/lib/stores/management-store.svelte.ts.hbs

@@ -1,5 +1,6 @@
+import type { IamPublicConfig } from '@h-ai/api-contract'
 import type { HaiResult } from '@h-ai/core'
-import type { ChangePasswordFormData, LoginFormData, UserProfileSubmitData } from '@h-ai/ui'
+import type { ChangePasswordFormData, UserProfileSubmitData } from '@h-ai/ui'
 import type { AdminAuditLog, AdminCreateUser, AdminRole, AdminUpdateUser, AdminUser, AvatarUpload, ProfileUpdate } from '{{fullstack.contractPackageName}}'
 import type { AppInfo, ManagementApiOptions } from '../api/api-client.js'
 import { HaiApiClientError } from '@h-ai/api-client'
@@ -17,6 +18,7 @@ export type ManagementPage = 'users' | 'roles' | 'audit' | 'settings'
 /** 页面状态和业务操作在共享 store 中收敛，宿主端仅装配平台能力。 */
 export class ManagementStore {
   info = $state<AppInfo | null>(null)
+  authConfig = $state<IamPublicConfig | null>(null)
   user = $state<CurrentUser | null>(null)
   page = $state<ManagementPage>('settings')
   locale = $state(getLocale())
@@ -63,6 +65,12 @@ export class ManagementStore {
         return
       }
       this.info = info.data
+      const authConfig = await managementApi.iam.auth.publicConfig()
+      if (!authConfig.success) {
+        this.error = authConfig.error.message
+        return
+      }
+      this.authConfig = authConfig.data
       this.applyLocale(info.data.defaultLocale)
       // 默认 Cookie 存储通过 api-client 的加密刷新链路恢复会话。
       const me = await managementApi.iam.auth.currentUser()
@@ -89,20 +97,12 @@ export class ManagementStore {
     await managementApi.close()
   }
 
-  async login(data: LoginFormData): Promise<void> {
-    await this.mutate(async () => {
-      const login = await managementApi.iam.auth.login({ identifier: data.username, password: data.password })
-      if (!login.success) {
-        this.error = login.error.httpStatus && login.error.httpStatus < 500 ? m.login_invalid() : m.network_error()
-        return
-      }
-      await managementApi.auth.setTokens(login.data.tokens)
-      const me = await this.request(() => managementApi.iam.auth.currentUser())
-      if (!me?.success)
-        return
-      this.setUser(me.data)
-      await this.navigate(this.isAdmin ? 'users' : 'settings')
-    })
+  async authenticated(): Promise<void> {
+    const me = await this.request(() => managementApi.iam.auth.currentUser())
+    if (!me?.success)
+      return
+    this.setUser(me.data)
+    await this.navigate(this.isAdmin ? 'users' : 'settings')
   }
 
   async logout(): Promise<void> {
@@ -135,8 +135,8 @@ export class ManagementStore {
     await this.load(async (version) => {
       const result = await this.request(() => managementApi.admin.users.list({
         page,
-pageSize: this.pageSize,
-search: this.usersSearch.trim() || undefined,
+        pageSize: this.pageSize,
+        search: this.usersSearch.trim() || undefined,
         enabled: this.usersStatus === 'all' ? undefined : this.usersStatus === 'enabled',
       }), version)
       if (result?.success && version === this.requestVersion) {
@@ -163,8 +163,8 @@ search: this.usersSearch.trim() || undefined,
     await this.load(async (version) => {
       const result = await this.request(() => managementApi.admin.audit.list({
         page,
-pageSize: this.pageSize,
-action: this.auditAction.trim() || undefined,
+        pageSize: this.pageSize,
+        action: this.auditAction.trim() || undefined,
         resource: this.auditResource.trim() || undefined,
         startDate: this.auditStartDate ? new SvelteDate(`${this.auditStartDate}T00:00:00`).toISOString() : undefined,
         endDate: this.auditEndDate ? new SvelteDate(`${this.auditEndDate}T23:59:59.999`).toISOString() : undefined,
@@ -340,7 +340,7 @@ action: this.auditAction.trim() || undefined,
       if (!result.success) {
         if (result.error.httpStatus === 401 && this.user) {
           this.expireSession()
-}
+        }
         else if (result.error.httpStatus === 403 && this.user) {
           const current = await managementApi.iam.auth.currentUser()
           if (!isCurrent())

package/templates/apps/fullstack/packages/{{projectName}}-shared/tests/management-store.test.ts.hbs

@@ -3,8 +3,8 @@ import * as m from '../src/lib/paraglide/messages.js'
 import { ManagementStore } from '../src/lib/stores/management-store.svelte.js'
 
 const api = vi.hoisted(() => ({
-  auth: { clear: vi.fn(), setTokens: vi.fn() },
-  iam: { auth: { login: vi.fn(), logout: vi.fn(), currentUser: vi.fn() } },
+  auth: { clear: vi.fn() },
+  iam: { auth: { logout: vi.fn(), currentUser: vi.fn() } },
   admin: { users: { list: vi.fn() } },
 }))
 vi.mock('../src/lib/api/api-client.js', () => ({
@@ -35,7 +35,6 @@ function deferred<T>() {
 
 beforeEach(() => {
   vi.resetAllMocks()
-  api.iam.auth.login.mockResolvedValue({ success: true, data: { tokens: { accessToken: 'test-access', expiresIn: 3600, tokenType: 'Bearer' } } })
   api.iam.auth.logout.mockResolvedValue({ success: true })
   api.iam.auth.currentUser.mockResolvedValue({ success: true, data: member })
 })
@@ -48,7 +47,7 @@ describe('management session and request ownership', () => {
     store.user = administrator
     const loading = store.loadUsers()
     await store.logout()
-    await store.login({ username: 'member', password: 'test-password', rememberMe: false })
+    await store.authenticated()
     oldRequest.resolve(forbidden)
     await loading
     expect(store.user?.id).toBe(member.id)
@@ -89,13 +88,13 @@ describe('management session and request ownership', () => {
     expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
   })
 
-  it('reports a connection failure separately from invalid credentials', async () => {
-    api.iam.auth.login.mockResolvedValueOnce({ success: false, error: { code: 'test:unavailable', message: 'Unavailable', httpStatus: 502 } })
+  it('reports a connection failure when loading the authenticated user', async () => {
+    api.iam.auth.currentUser.mockRejectedValueOnce(new Error('Connection unavailable'))
     const store = new ManagementStore()
-    await store.login({ username: 'member', password: 'test-password', rememberMe: false })
+    await store.authenticated()
     expect(store.error).toBe(m.network_error())
     expect(store.error).not.toBe(m.login_invalid())
     expect(store.saving).toBe(false)
-    expect(api.iam.auth.currentUser).not.toHaveBeenCalled()
+    expect(api.iam.auth.currentUser).toHaveBeenCalledTimes(1)
   })
 })

package/templates/apps/mobile-app/src/App.svelte.hbs

@@ -1,5 +1,12 @@
 <script lang='ts'>
+{{#if features.iam}}
+  import type { IamPublicConfig } from '@h-ai/api-contract'
+  import { apiClient } from '@h-ai/api-client'
+{{/if}}
   import { applyTheme, getSavedTheme, setGlobalLocale } from '@h-ai/ui'
+{{#if features.iam}}
+  import { AuthPanel } from '@h-ai/ui/components/scenes/iam/index'
+{{/if}}
   import { onMount } from 'svelte'
   import { closeApi, initApi, resolveApiBase, usesNativeTokenStorage } from './lib/api.js'
   import { appConfig, initClientCore } from './lib/app-config.js'
@@ -7,6 +14,23 @@
   import * as m from './lib/paraglide/messages.js'
   import { getLocale } from './lib/paraglide/runtime.js'
 
+{{#if features.iam}}
+  const authActions = apiClient.createAuthActions(apiClient)
+  let authConfig = $state<IamPublicConfig | null>(null)
+  let authenticated = $state(false)
+  let resetToken = $state('')
+
+  function handleAuthenticated() {
+    if (resetToken) {
+      const url = new URL(location.href)
+      url.searchParams.delete('token')
+      history.replaceState(history.state, '', url)
+    }
+    resetToken = ''
+    authenticated = true
+  }
+{{/if}}
+
   type TabId = 'home' | 'tasks' | 'profile'
 
   let booting = $state(true)
@@ -29,6 +53,16 @@
       setGlobalLocale(getLocale())
       await initCapacitor()
       await initApi()
+{{#if features.iam}}
+      const config = await authActions.publicConfig()
+      if (!config.success)
+        throw new Error(config.error.message)
+      authConfig = config.data
+      if (!authConfig)
+        throw new Error(m.boot_failed_title())
+      const me = await apiClient.iam.auth.currentUser()
+      authenticated = !resetToken && me.success
+{{/if}}
       nativeRuntime = await isNativeApp()
       nativeTokenStorage = await usesNativeTokenStorage()
     }
@@ -46,6 +80,9 @@
   }
 
   onMount(() => {
+{{#if features.iam}}
+    resetToken = new URL(location.href).searchParams.get('token') ?? ''
+{{/if}}
     void bootstrap()
 
     return () => {
@@ -73,6 +110,12 @@
       </div>
     </div>
   </div>
+{{#if features.iam}}
+{:else if !authenticated}
+  <main>
+    <AuthPanel config={authConfig} actions={authActions} {resetToken} initialMode={resetToken ? 'reset' : 'login'} onauthenticated={handleAuthenticated} />
+  </main>
+{{/if}}
 {:else}
   <div class='hai-mobile-viewport'>
     <div class='hai-mobile-shell max-w-lg'>

package/templates/base/e2e/app.spec.ts.hbs

@@ -1,3 +1,8 @@
+{{#if features.iam}}
+import { mkdir } from 'node:fs/promises'
+import path from 'node:path'
+{{/if}}
+import process from 'node:process'
 import { expect, test } from '@playwright/test'
 
 /** 首页从真实浏览器页面发起，覆盖基础渲染链路。 */
@@ -9,3 +14,103 @@ test('home page renders from browser', async ({ page }) => {
   await expect(pageErrors).toEqual([])
   await expect(page.locator('main, section').first()).toBeVisible()
 })
+{{#if features.iam}}
+
+/** 实际注册和密码登录；截图只保存空白表单。 */
+test('configured IAM registration and password login', async ({ page, context }) => {
+  test.setTimeout(90_000)
+  const evidence = process.env.HAI_AUTH_EVIDENCE_DIR || path.resolve('test-results/auth-screenshots')
+  await mkdir(evidence, { recursive: true })
+  const username = `scaf${Date.now()}`
+  const password = 'ScaffoldPassword123'
+  const authUrl = '{{#if isCapacitorApp}}/{{else}}/auth/login{{/if}}'
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-login.png'), fullPage: true })
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /立即注册|Register now/i }).click()
+  await expect(page.locator('input[name="username"]')).toBeVisible()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-register.png'), fullPage: true })
+  if (process.env.IAM_NOTIFICATION_URL) {
+    // 协议弹窗留在认证页，关闭后继续填写注册表单。
+    await page.getByRole('button', { name: /用户协议|User Agreement/i, exact: true }).click()
+    await expect(page.getByRole('dialog')).toBeVisible()
+    await expect(page.getByRole('dialog').getByRole('heading', { name: 'Configured registration agreement' })).toBeVisible()
+    await expect(page.locator('iframe')).toHaveCount(0)
+    await page.screenshot({ path: path.join(evidence, '{{projectName}}-agreement.png'), fullPage: true })
+    await page.keyboard.press('Escape')
+    await expect(page.getByRole('dialog')).not.toBeVisible()
+  }
+  await page.locator('input[name="username"]').fill(username)
+  await page.locator('input[name="email"]').fill(`${username}@example.com`)
+  await page.locator('input[type="password"]').nth(0).fill(password)
+  await page.locator('input[type="password"]').nth(1).fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.register-form')).not.toBeVisible()
+{{#unless isCapacitorApp}}
+  const me = await page.request.get('/api/auth/me')
+  expect(me.ok()).toBe(true)
+  await context.clearCookies()
+{{/unless}}
+  await page.reload()
+  await page.goto(authUrl)
+  await expect(page.locator('#login-username')).toBeVisible()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill(password)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth)).toBe(true)
+
+  if (!process.env.IAM_NOTIFICATION_URL)
+    return
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /邮件验证码|Email code/i, exact: true }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-email.png'), fullPage: true })
+  const email = `${username}@example.com`
+  await page.locator('#login-username').fill(email)
+  await page.getByRole('button', { name: /发送验证码|Send code/i, exact: true }).click()
+  await expect(page.getByRole('button', { name: /秒后重发|Resend in/ })).toBeDisabled()
+  async function received(template: string) {
+    const response = await page.request.get(`${process.env.IAM_NOTIFICATION_URL}/messages?to=${encodeURIComponent(email)}`)
+    const messages = await response.json() as { template: string, vars: Record<string, string> }[]
+    return messages.findLast(item => item.template === template)?.vars
+  }
+  const otp = await received('otp_email')
+  expect(Boolean(otp?.code)).toBe(true)
+  await page.locator('#login-code').fill(otp?.code ?? '')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  await context.clearCookies()
+  await page.reload()
+  await page.goto(authUrl)
+  await page.getByRole('button', { name: /忘记密码|Forgot password/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-forgot.png'), fullPage: true })
+  await page.locator('input[type="email"]').fill(email)
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.alert-success')).toBeVisible()
+  const reset = await received('password_reset')
+  expect(Boolean(reset?.token)).toBe(true)
+  await page.getByRole('button', { name: /已有重置令牌|I have a reset token/i }).click()
+  await page.screenshot({ path: path.join(evidence, '{{projectName}}-reset.png'), fullPage: true })
+  await page.goto(`{{#if isCapacitorApp}}/{{else}}/auth/reset-password{{/if}}?token=${encodeURIComponent(reset?.token ?? '')}`)
+  await expect(page.locator('input[type="password"]').nth(0)).toBeVisible()
+  await page.locator('input[type="password"]').nth(0).fill('ScaffoldReset456')
+  await page.locator('input[type="password"]').nth(1).fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.alert-success')).toBeVisible()
+  await page.getByRole('{{#if isCapacitorApp}}button{{else}}link{{/if}}', { name: /^(登录|Sign in|Login)$/i }).click()
+  await page.locator('#login-username').fill(username)
+  await page.locator('input[type="password"]').fill('ScaffoldReset456')
+  await page.locator('button[type="submit"]').click()
+  await expect(page.locator('.login-form')).not.toBeVisible()
+  expect(new URL(page.url()).searchParams.has('token')).toBe(false)
+  await page.reload()
+{{#if isCapacitorApp}}
+  // Web 预览采用内存 TokenStore，刷新后应回到登录，而不是已消费令牌的重置页面。
+  await expect(page.locator('#login-username')).toBeVisible()
+{{else}}
+  await expect(await page.request.get('/api/auth/me')).toBeOK()
+{{/if}}
+})
+{{/if}}

package/templates/base/package.json.hbs

@@ -1,7 +1,7 @@
 {
   "engines": { "node": "^22.22.2 || ^24.15.0 || >=26.0.0" },
   "name": "{{projectName}}",
-  "version": "0.1.0-alpha.59",
+  "version": "0.1.0-alpha.60",
   "private": true,
   "packageManager": "pnpm@12.11.2",
   "description": "{{#if_eq appType 'admin'}}Enterprise management system built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'website'}}Enterprise website built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'h5'}}Mobile H5 app built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'api'}}REST API service built with hai Agent Framework{{/if_eq}}{{#if_eq appType 'mobile-app'}}Mobile app built with hai Agent Framework{{/if_eq}}",