@h-ai/iam 0.1.0-alpha.73 → 0.1.0-alpha.74

package/dist/index.js

@@ -1,5 +1,5 @@
-import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-22SERPFD.js';
-export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-22SERPFD.js';
+import { HaiIamError, IamConfigSchema, SessionConfigSchema, SecurityConfigSchema, LoginConfigSchema, OtpConfigSchema, ApiKeyConfigSchema, AuthUiConfigSchema, PasswordConfigSchema, RbacConfigSchema, AgreementConfigSchema, PasswordResetConfigSchema, RegisterConfigSchema } from './chunk-KPG3M34Q.js';
+export { AccountConfigSchema, AgreementConfigSchema, ApiKeyConfigSchema, AuthStrategyTypeSchema, AuthUiConfigSchema, CaptchaConfigSchema, HaiIamError, IamConfigSchema, LdapConfigSchema, LoginAccessConfigSchema, LoginConfigSchema, OtpConfigSchema, PasswordConfigSchema, PasswordResetConfigSchema, RbacConfigSchema, RegisterConfigSchema, SecurityConfigSchema, SessionConfigSchema } from './chunk-KPG3M34Q.js';
 import { cache } from '@h-ai/cache';
 import { core, err, ok } from '@h-ai/core';
 import { crypto as crypto$1 } from '@h-ai/crypto';
@@ -213,7 +213,9 @@ var en_US_default = {
   iam_captchaRequired: "Complete the security check first",
   iam_captchaInvalid: "Security check is invalid or expired; try again",
   iam_captchaDisabled: "Security challenges are disabled",
-  iam_captchaUnavailable: "Security check is temporarily unavailable"
+  iam_captchaUnavailable: "Security check is temporarily unavailable",
+  iam_sensitiveOperationsInvalid: "Invalid sensitive operation IDs: use at most 1000 entries of 1\u2013128 characters each.",
+  iam_terminalTypeInvalid: "Invalid terminal type: use web, app, desktop or api."
 };
 
 // messages/ja-JP.json
@@ -419,7 +421,9 @@ var ja_JP_default = {
   iam_captchaRequired: "\u5148\u306B\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u5B8C\u4E86\u3057\u3066\u304F\u3060\u3055\u3044",
   iam_captchaInvalid: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u304C\u7121\u52B9\u307E\u305F\u306F\u671F\u9650\u5207\u308C\u3067\u3059\u3002\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
   iam_captchaDisabled: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u306F\u7121\u52B9\u3067\u3059",
-  iam_captchaUnavailable: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093"
+  iam_captchaUnavailable: "\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3\u78BA\u8A8D\u3092\u4E00\u6642\u7684\u306B\u5229\u7528\u3067\u304D\u307E\u305B\u3093",
+  iam_sensitiveOperationsInvalid: "\u91CD\u8981\u64CD\u4F5C ID \u306F\u6700\u59271000\u4EF6\u3001\u54041\uFF5E128\u6587\u5B57\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  iam_terminalTypeInvalid: "\u7AEF\u672B\u7A2E\u5225\u306F web\u3001app\u3001desktop\u3001api \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -625,7 +629,9 @@ var zh_CN_default = {
   iam_captchaRequired: "\u8BF7\u5148\u5B8C\u6210\u5B89\u5168\u9A8C\u8BC1",
   iam_captchaInvalid: "\u5B89\u5168\u9A8C\u8BC1\u65E0\u6548\u6216\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u8BD5",
   iam_captchaDisabled: "\u5B89\u5168\u9A8C\u8BC1\u672A\u542F\u7528",
-  iam_captchaUnavailable: "\u5B89\u5168\u9A8C\u8BC1\u6682\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5"
+  iam_captchaUnavailable: "\u5B89\u5168\u9A8C\u8BC1\u6682\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
+  iam_sensitiveOperationsInvalid: "\u654F\u611F\u64CD\u4F5C ID \u5217\u8868\u65E0\u6548\uFF1A\u6700\u591A 1000 \u9879\uFF0C\u6BCF\u9879\u4E3A 1\u2013128 \u5B57\u7B26\u3002",
+  iam_terminalTypeInvalid: "\u7EC8\u7AEF\u7C7B\u578B\u65E0\u6548\uFF0C\u8BF7\u4F7F\u7528 web\u3001app\u3001desktop \u6216 api\u3002"
 };
 
 // src/iam-i18n.ts
@@ -882,6 +888,7 @@ function buildSession(options, now, sessionTtl, accessToken, credentialVersion)
     roles: options.roles ?? [],
     permissions: options.permissions ?? [],
     source: options.source,
+    terminalType: options.terminalType ?? "web",
     accessToken,
     createdAt: now,
     startedAt: now,
@@ -1490,7 +1497,7 @@ function createApiKeyStrategy(config) {
       if (!isUserActive(userResult.data)) {
         return err(HaiIamError.USER_DISABLED, iamM("iam_accountDisabled"));
       }
-      logger2.info("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
+      logger2.debug("API Key authentication succeeded", { userId: userResult.data.id, keyId: apiKey.id });
       return ok({ user: { ...toUser(userResult.data), credentialVersion: userResult.data.credentialVersion ?? "" }, apiKey });
     }
   };
@@ -1892,7 +1899,7 @@ function createLdapStrategy(config) {
         const resetResult = await resetLoginFailures(userRepository, storedUser, failurePolicy);
         if (!resetResult.success)
           return resetResult;
-        logger4.info("LDAP authentication succeeded", { userId: storedUser.id });
+        logger4.debug("LDAP authentication succeeded", { userId: storedUser.id });
         return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
       } finally {
         await client.unbind();
@@ -2080,7 +2087,7 @@ function createOtpStrategy(config) {
       const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger5.info("OTP authentication succeeded", { userId: storedUser.id });
+      logger5.debug("OTP authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -2243,7 +2250,7 @@ function createPasswordStrategy(config) {
       const resetResult = await resetLoginFailures(config.userRepository, storedUser, failurePolicy);
       if (!resetResult.success)
         return resetResult;
-      logger6.info("Password authentication succeeded", { userId: storedUser.id });
+      logger6.debug("Password authentication succeeded", { userId: storedUser.id });
       return ok({ ...toUser(storedUser), credentialVersion: storedUser.credentialVersion ?? "" });
     }
   };
@@ -2430,7 +2437,8 @@ function buildAuthnOperations(deps) {
       avatarUrl: user.avatarUrl,
       ...effective,
       apiKeyId: apiKey?.id,
-      apiKeyScopes: apiKey?.scopes
+      apiKeyScopes: apiKey?.scopes,
+      terminalType: context?.terminalType ?? (apiKey ? "api" : "web")
     });
     if (!sessionResult.success) {
       return sessionResult;
@@ -2476,6 +2484,8 @@ function buildAuthnOperations(deps) {
       logger7.warn("Login failed", { type, reason: authResult.error.code });
       return authResult;
     }
+    if (credentials.expectedUserId && credentials.expectedUserId !== authResult.data.id)
+      return err(HaiIamError.INVALID_CREDENTIALS, iamM("iam_passwordWrong"));
     const result = await buildAuthResult(authResult.data, void 0, context);
     if (result.success) {
       logger7.info("Login succeeded", { type, userId: authResult.data.id });
@@ -2503,7 +2513,14 @@ function buildAuthnOperations(deps) {
   }
   const tickets = createTicketOperations();
   const sensitive = config.reauthentication;
-  const requiresProof = (operation) => sensitive?.enabled && sensitive.operations.includes(operation);
+  async function requiresProof(operation) {
+    if (!sensitive?.enabled)
+      return ok(false);
+    const configured = await authzFunctions.getSensitiveOperations();
+    if (!configured.success)
+      return configured;
+    return ok(sensitive.operations.includes(operation) || configured.data.includes(operation));
+  }
   return { loginRegisteredUser: async (user, context) => {
     const stored = await userRepository.findById(user.id);
     if (!stored.success)
@@ -2514,7 +2531,10 @@ function buildAuthnOperations(deps) {
   }, authn: {
     createCaptcha: (input) => createIamCaptcha(config.captcha, input),
     async reauthenticate(accessToken, password, operation) {
-      if (!requiresProof(operation))
+      const required = await requiresProof(operation);
+      if (!required.success)
+        return required;
+      if (!required.data)
         return err(HaiIamError.PERMISSION_DENIED, iamM("iam_reauthenticationRequired"));
       const current = await verifyCurrentSession(accessToken);
       if (!current.success)
@@ -2535,7 +2555,10 @@ function buildAuthnOperations(deps) {
       const current = await verifyCurrentSession(accessToken);
       if (!current.success)
         return current;
-      if (!requiresProof(operation))
+      const required = await requiresProof(operation);
+      if (!required.success)
+        return required;
+      if (!required.data)
         return ok(void 0);
       if (!ticket)
         return err(HaiIamError.REAUTHENTICATION_REQUIRED, iamM("iam_reauthenticationRequired"));
@@ -2590,6 +2613,7 @@ function buildAuthnOperations(deps) {
 }
 var TABLE_NAME3 = "hai_iam_permissions";
 var PERMISSION_FIELDS = [
+  { fieldName: "sensitiveOperations", columnName: "sensitive_operations", def: { type: "JSON" }, select: true, create: true, update: true },
   {
     fieldName: "id",
     columnName: "id",
@@ -2679,6 +2703,27 @@ async function createDbPermissionRepository() {
   return repo;
 }
 var DbPermissionRepository = class extends BaseReldbCrudRepository {
+  async getSensitiveOperations() {
+    const result = await reldb.sql.query("SELECT sensitive_operations FROM hai_iam_permissions WHERE sensitive_operations IS NOT NULL");
+    if (!result.success)
+      return result;
+    const operations = /* @__PURE__ */ new Set();
+    try {
+      for (const row of result.data) {
+        const values = typeof row.sensitive_operations === "string" ? JSON.parse(row.sensitive_operations) : row.sensitive_operations;
+        if (!Array.isArray(values) || values.length > 1e3)
+          return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+        for (const value of values) {
+          if (typeof value !== "string" || !value.trim() || value.length > 128)
+            return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+          operations.add(value.trim());
+        }
+      }
+      return ok([...operations].sort());
+    } catch {
+      return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_reauthenticationRequired"));
+    }
+  }
   constructor() {
     super(reldb, {
       table: TABLE_NAME3,
@@ -3428,6 +3473,22 @@ function createRbacManager(config) {
     return ok(void 0);
   }
   return {
+    getSensitiveOperations: () => rbacConfig.enabled ? permissionRepository.getSensitiveOperations() : Promise.resolve(ok([])),
+    async setPermissionSensitiveOperations(permissionId, operations) {
+      if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+      const updated = await permissionRepository.updateById(permissionId, { sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] });
+      if (!updated.success)
+        return updated;
+      if (updated.data.changes === 0) {
+        const existing = await permissionRepository.findById(permissionId);
+        if (!existing.success)
+          return existing;
+        if (!existing.data)
+          return err(HaiIamError.PERMISSION_NOT_FOUND, iamM("iam_permissionNotExist"));
+      }
+      return ok(void 0);
+    },
     async checkPermission(userId, permission) {
       if (!rbacConfig.enabled) {
         return ok(true);
@@ -3779,6 +3840,10 @@ function createRbacManager(config) {
     },
     // ─── 权限管理 ───
     async createPermission(permission, tx) {
+      const operations = permission.sensitiveOperations ?? [];
+      if (!Array.isArray(operations) || operations.length > 1e3 || operations.some((value) => typeof value !== "string" || !value.trim() || value.length > 128))
+        return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sensitiveOperationsInvalid"));
+      permission = { ...permission, sensitiveOperations: [...new Set(operations.map((value) => value.trim()))] };
       const ownTx = !tx;
       if (!tx) {
         const txResult = await reldb.tx.begin();
@@ -4065,6 +4130,7 @@ function observeAuthorization(operations) {
     updateRole: (id, data, tx) => observe(() => operations.updateRole(id, data, tx), { action: "role.update", resource: "iam.roles", resourceId: id, details: { fields: Object.keys(data), permissionIds: data.permissionIds } }, tx),
     deleteRole: (id, tx) => observe(() => operations.deleteRole(id, tx), { action: "role.delete", resource: "iam.roles", resourceId: id }, tx),
     createPermission: (input, tx) => observe(() => operations.createPermission(input, tx), (result) => ({ action: "permission.create", resource: "iam.permissions", resourceId: result.success ? result.data.id : void 0, details: { code: input.code } }), tx),
+    setPermissionSensitiveOperations: (id, operationIds) => observe(() => operations.setPermissionSensitiveOperations(id, operationIds), { action: "permission.sensitive-operations", resource: "iam.permissions", resourceId: id, details: { operations: operationIds } }),
     deletePermission: (id, tx) => observe(() => operations.deletePermission(id, tx), { action: "permission.delete", resource: "iam.permissions", resourceId: id }, tx),
     assignPermissionToRole: (id, permissionId, tx) => observe(() => operations.assignPermissionToRole(id, permissionId, tx), { action: "permission.assign", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx),
     removePermissionFromRole: (id, permissionId, tx) => observe(() => operations.removePermissionFromRole(id, permissionId, tx), { action: "permission.remove", resource: "iam.role-permissions", resourceId: id, details: { permissionId } }, tx)
@@ -4151,6 +4217,17 @@ var steps = [{
     const added = await sql.execute("ALTER TABLE hai_iam_users ADD COLUMN first_login_failed_at TIMESTAMP");
     return added.success ? ok(void 0) : added;
   }
+}, {
+  version: 5,
+  name: "permission-sensitive-operations",
+  async needed(sql) {
+    const found = await schemaColumns(reldb, "hai_iam_permissions", sql);
+    return found.success ? ok(found.data.length > 0 && !found.data.includes("sensitive_operations")) : found;
+  },
+  async apply(sql) {
+    const added = await sql.execute("ALTER TABLE hai_iam_permissions ADD COLUMN sensitive_operations JSON");
+    return added.success ? ok(void 0) : added;
+  }
 }];
 function migrateIam(options = {}) {
   return migrateSchema(reldb, "iam", steps, options);
@@ -4331,7 +4408,7 @@ function retainedUntil(entry) {
 }
 function restoreSession(session) {
   const result = { ...session, createdAt: new Date(session.createdAt), startedAt: new Date(session.startedAt ?? session.createdAt), lastActiveAt: new Date(session.lastActiveAt), expiresAt: new Date(session.expiresAt) };
-  if (typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.startedAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
+  if (result.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(result.terminalType) || typeof result.credentialVersion !== "string" || !result.version || !Number.isSafeInteger(result.maxAge) || result.maxAge <= 0 || !Array.isArray(result.roles) || !result.roles.every((role) => typeof role === "string") || !Array.isArray(result.permissions) || !result.permissions.every((permission) => typeof permission === "string") || ![result.createdAt, result.startedAt, result.lastActiveAt, result.expiresAt].every((date) => Number.isFinite(date.getTime()))) {
     throw new TypeError("Invalid session state");
   }
   return result;
@@ -4410,12 +4487,29 @@ function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
   }
   return {
     save: (session, tokens, singleDevice = false) => mutate(getUserSessionScope(session.userId), (state) => {
-      const count = Object.values(state.sessions).filter((entry) => entry.session.credentialVersion === session.credentialVersion).length;
-      if (singleDevice && policy.singleDeviceMode !== "reject") {
-        state.sessions = {};
-      } else if (singleDevice && count > 0 || maxSessions > 0 && count >= maxSessions) {
+      const active = Object.entries(state.sessions).filter(([, entry]) => entry.session.credentialVersion === session.credentialVersion);
+      const terminal = session.terminalType ?? "web";
+      const limits = policy.terminalLimits ?? {};
+      const cap = limits[terminal];
+      if (Object.keys(limits).length && cap === void 0)
         return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+      const removed = /* @__PURE__ */ new Set();
+      if (singleDevice) {
+        if (policy.singleDeviceMode === "reject" && active.length)
+          return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+        if (policy.singleDeviceMode !== "reject")
+          Object.keys(state.sessions).forEach((token) => removed.add(token));
+      } else if (cap) {
+        const same = active.filter(([, entry]) => (entry.session.terminalType ?? "web") === terminal).sort(([firstToken, first], [secondToken, second]) => new Date(first.session.startedAt ?? first.session.createdAt).getTime() - new Date(second.session.startedAt ?? second.session.createdAt).getTime() || firstToken.localeCompare(secondToken));
+        if (same.length >= cap) {
+          if (policy.terminalLimitMode !== "replace")
+            return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+          same.slice(0, same.length - cap + 1).forEach(([token]) => removed.add(token));
+        }
       }
+      if (maxSessions > 0 && active.filter(([token]) => !removed.has(token)).length >= maxSessions)
+        return err(HaiIamError.SESSION_LIMIT_EXCEEDED, iamM("iam_sessionLimitExceeded"));
+      removed.forEach((token) => delete state.sessions[token]);
       return storeSession(state, session, tokens);
     }),
     rotate: (previous, refreshToken, session, tokens) => mutate(getUserSessionScope(previous.userId), (state) => {
@@ -4466,6 +4560,8 @@ function createCacheSessionRepository(refreshTokenMaxAge, policy = {}) {
           return err(HaiIamError.SESSION_NOT_FOUND, iamM("iam_sessionNotExist"));
         if (!expectedVersion || entry.session.version !== expectedVersion)
           return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
+        if (patch.terminalType !== void 0 && patch.terminalType !== (entry.session.terminalType ?? "web"))
+          return err(HaiIamError.CONFLICT, iamM("iam_sessionStateConflict"));
         const updated = applySessionPatch(restoreSession(entry.session), patch);
         if (![updated.expiresAt, updated.lastActiveAt].every((date) => Number.isFinite(date.getTime())))
           return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_sessionMaxAgeInvalid"));
@@ -4580,6 +4676,8 @@ function buildSessionFunctions(config) {
   const singleDevice = config.singleDevice ?? false;
   const repo = config.sessionRepository;
   function candidate(options, credentialVersion) {
+    if (options.terminalType !== void 0 && !["web", "app", "desktop", "api"].includes(options.terminalType))
+      return err(HaiIamError.INVALID_ARGUMENT, iamM("iam_terminalTypeInvalid"));
     const now = /* @__PURE__ */ new Date();
     const ttl = options.maxAge ?? maxAge;
     if (!Number.isSafeInteger(ttl) || ttl <= 0 || !Number.isFinite(new Date(now.getTime() + ttl * 1e3).getTime()))
@@ -4738,6 +4836,7 @@ function buildSessionFunctions(config) {
           apiKeyId: effectiveSession.apiKeyId,
           apiKeyScopes: effectiveSession.apiKeyScopes,
           source: oldSession.source,
+          terminalType: oldSession.terminalType ?? "web",
           maxAge: oldSession.maxAge,
           data: oldSession.data ? { ...oldSession.data, _tokenPair: void 0 } : void 0
         }, oldSession.credentialVersion);
@@ -5701,6 +5800,18 @@ var iam = {
   get auth() {
     return currentAuth ?? notInitializedAuth;
   },
+  async getPublicConfig() {
+    const snapshot = currentPublicConfig ? structuredClone(currentPublicConfig) : null;
+    const authz = currentAuthz;
+    if (!snapshot || !authz)
+      return notInitialized.result();
+    if (!snapshot.reauthentication.enabled)
+      return ok(snapshot);
+    const configured = await authz.getSensitiveOperations();
+    if (!configured.success)
+      return configured;
+    return ok({ ...snapshot, reauthentication: { ...snapshot.reauthentication, operations: [.../* @__PURE__ */ new Set([...snapshot.reauthentication.operations, ...configured.data])].sort() } });
+  },
   get user() {
     return currentUser ?? notInitializedUser;
   },