@h-ai/kit 0.1.0-alpha.71 → 0.1.0-alpha.73

package/dist/index.js

@@ -1,15 +1,16 @@
 import { defineCrud } from './chunk-Y2YUA3VR.js';
 export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-Y2YUA3VR.js';
-import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, configureAuth, getAccessToken } from './chunk-YX2IFLPE.js';
+import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, getAccessToken, configureAuth } from './chunk-3L5QSJ3E.js';
 import { resolveA2AConfig, handleA2ARequest } from './chunk-2PWGJCWX.js';
 import { transportEncryptionMiddleware } from './chunk-UTCS6FR7.js';
 import './chunk-XC7I2L3G.js';
 import { kitM, setAllModulesLocale } from './chunk-OVRZIDCD.js';
 import { core, HaiCommonError } from '@h-ai/core';
+import { audit } from '@h-ai/audit';
 import { createHash } from 'crypto';
 import { isIP } from 'net';
 import process2 from 'process';
-import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema, FeedbackSubmitInputSchema, FeedbackListInputSchema, FeedbackIdInputSchema, FeedbackEvidenceQuerySchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackExportInputSchema, FeedbackUploadInputSchema, FeedbackAttachmentQuerySchema, FeedbackExportQuerySchema } from '@h-ai/api-contract';
+import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema, IamRenewPasswordInputSchema, IamReauthenticateInputSchema, IamCreateCaptchaInputSchema, IamLogoutInputSchema, FeedbackSubmitInputSchema, FeedbackListInputSchema, FeedbackIdInputSchema, FeedbackEvidenceQuerySchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackExportInputSchema, FeedbackUploadInputSchema, FeedbackAttachmentQuerySchema, FeedbackExportQuerySchema } from '@h-ai/api-contract';
 import { z } from 'zod';
 
 // src/guards/kit-permission.ts
@@ -56,6 +57,98 @@ function requirePermission(session, permission) {
     throw denied;
   }
 }
+function ok(data, requestId) {
+  const response = {
+    success: true,
+    data,
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status: 200,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function created(data, requestId) {
+  const response = {
+    success: true,
+    data,
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status: 201,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function noContent() {
+  return new Response(null, { status: 204 });
+}
+function error(code, message, status = 400, requestId, details) {
+  const safe = core.error.toPublic({ code, message, httpStatus: status }, requestId);
+  core.logger.error("API request failed", { traceId: safe.traceId, error: { code, message, httpStatus: status, details } });
+  const response = {
+    success: false,
+    error: {
+      code,
+      message: safe.message,
+      traceId: safe.traceId,
+      details: status < 500 ? core.sanitize.sanitizeSensitiveFields(details) : void 0
+    },
+    requestId: requestId ?? core.context.get().requestId ?? safe.traceId
+  };
+  return new Response(JSON.stringify(response), {
+    status,
+    headers: { "Content-Type": "application/json", "X-Trace-Id": safe.traceId }
+  });
+}
+function badRequest(message, requestId, details) {
+  return error("BAD_REQUEST", message, 400, requestId, details);
+}
+function unauthorized(message, requestId) {
+  return error("UNAUTHORIZED", message ?? kitM("kit_authRequired"), 401, requestId);
+}
+function forbidden(message, requestId) {
+  return error("FORBIDDEN", message ?? kitM("kit_accessDenied"), 403, requestId);
+}
+function notFound(message, requestId) {
+  return error("NOT_FOUND", message ?? kitM("kit_resourceNotFound"), 404, requestId);
+}
+function conflict(message, requestId) {
+  return error("CONFLICT", message, 409, requestId);
+}
+function validationError(errors, requestId) {
+  return error("VALIDATION_ERROR", kitM("kit_validationFailed"), 422, requestId, { errors });
+}
+function internalError(message, requestId) {
+  return error("INTERNAL_ERROR", message ?? kitM("kit_internalError"), 500, requestId);
+}
+function redirect(url, status = 302) {
+  return new Response(null, {
+    status,
+    headers: { Location: url }
+  });
+}
+function fromResult(result, httpStatusMap, requestId) {
+  if (result.success) {
+    return ok(result.data, requestId);
+  }
+  const status = httpStatusMap?.[result.error.code] ?? (typeof result.error.httpStatus === "number" ? result.error.httpStatus : 400);
+  return fromError({ ...result.error, httpStatus: status }, requestId);
+}
+function fromError(haiError, requestId) {
+  const safe = core.error.toPublic(haiError, requestId);
+  core.logger.error("API operation failed", { traceId: safe.traceId, error: haiError });
+  return error(String(safe.code), safe.message, safe.httpStatus ?? 400, safe.traceId);
+}
+
+// src/guards/kit-sensitive.ts
+async function requireSensitiveOperation(iam, event, operation) {
+  const policy = iam.publicConfig?.reauthentication;
+  if (!policy?.enabled || !policy.operations.includes(operation))
+    return;
+  const checked = await iam.auth.checkSensitiveOperation(getAccessToken(event.request, event.cookies) ?? "", operation, event.request.headers.get("x-hai-reauthentication") ?? void 0);
+  if (!checked.success)
+    throw fromError(checked.error);
+}
 
 // src/kit-utils.ts
 function isResponseLike(value) {
@@ -382,7 +475,36 @@ function createHandle(config = {}) {
   return async ({ event, resolve }) => {
     const suppliedRequestId = event.request.headers.get("x-request-id");
     const requestId = suppliedRequestId && /^[\w.:-]{1,128}$/.test(suppliedRequestId) ? suppliedRequestId : generateId("req");
-    return core.context.run({ requestId, userId: void 0, scopeId: void 0, jobId: void 0 }, async () => {
+    let clientAddress;
+    try {
+      clientAddress = event.getClientAddress();
+    } catch {
+    }
+    return core.context.run({ requestId, userId: void 0, scopeId: void 0, jobId: void 0 }, () => audit.withContext({
+      actor: null,
+      requestId,
+      traceId: requestId,
+      scopeId: void 0,
+      ipAddress: clientAddress,
+      userAgent: event.request.headers.get("user-agent")?.slice(0, 4096)
+    }, async () => {
+      let actor = null;
+      let guardDenied = false;
+      let requestFailed = false;
+      const captureRequest = async (status) => {
+        const resource = event.route.id ?? "unmatched";
+        const written = await audit.capture({
+          action: "request.execute",
+          resource,
+          userId: actor?.id ?? null,
+          actorSnapshot: actor,
+          category: /\/(?:auth|iam|audit)(?:\/|$)/.test(resource) ? "system" : "business",
+          outcome: guardDenied || [401, 403, 423, 429].includes(status) ? "denied" : requestFailed || status >= 400 ? "failure" : "success",
+          details: { method: event.request.method, status }
+        }, { read: ["GET", "HEAD", "OPTIONS"].includes(event.request.method) });
+        if (!written.success)
+          core.logger.error("Request audit failed", { requestId, resource, error: written.error });
+      };
       const context = {
         event,
         requestId
@@ -416,10 +538,12 @@ function createHandle(config = {}) {
             }
           }
           context.session = session;
-          return await core.context.run({ userId: session?.userId }, async () => {
+          actor = session ? { id: session.userId, username: session.username, roles: session.roles } : null;
+          return await audit.withContext({ actor }, () => core.context.run({ userId: session?.userId }, async () => {
             for (const guardConfig of guards) {
               const guardResult = await executeGuard(guardConfig, event, session);
               if (!guardResult.allowed) {
+                guardDenied = true;
                 if (guardResult.redirect) {
                   return new Response(null, {
                     status: 302,
@@ -448,11 +572,14 @@ function createHandle(config = {}) {
               () => resolve(event)
             );
             return response2;
-          });
+          }));
         } catch (error2) {
           if (isSvelteKitControlFlow(error2)) {
+            if (typeof error2 === "object" && error2 !== null && "status" in error2 && typeof error2.status === "number")
+              await captureRequest(error2.status);
             throw error2;
           }
+          requestFailed = true;
           core.logger.error("Request failed", { requestId, error: error2 });
           if (onError) {
             return onError(error2, event);
@@ -475,11 +602,12 @@ function createHandle(config = {}) {
         }
       };
       const response = transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
+      await captureRequest(response.status);
       applyDefaultSecurityHeaders(response);
       response.headers.set("X-Request-Id", requestId);
       response.headers.set("X-Trace-Id", requestId);
       return response;
-    });
+    }));
   };
 }
 function buildAuthGuard(verifyToken, loginUrl) {
@@ -602,90 +730,6 @@ function sequence(...handles) {
     return applyHandle(0, event);
   };
 }
-function ok(data, requestId) {
-  const response = {
-    success: true,
-    data,
-    requestId
-  };
-  return new Response(JSON.stringify(response), {
-    status: 200,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-function created(data, requestId) {
-  const response = {
-    success: true,
-    data,
-    requestId
-  };
-  return new Response(JSON.stringify(response), {
-    status: 201,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-function noContent() {
-  return new Response(null, { status: 204 });
-}
-function error(code, message, status = 400, requestId, details) {
-  const safe = core.error.toPublic({ code, message, httpStatus: status }, requestId);
-  core.logger.error("API request failed", { traceId: safe.traceId, error: { code, message, httpStatus: status, details } });
-  const response = {
-    success: false,
-    error: {
-      code,
-      message: safe.message,
-      traceId: safe.traceId,
-      details: status < 500 ? core.sanitize.sanitizeSensitiveFields(details) : void 0
-    },
-    requestId: requestId ?? core.context.get().requestId ?? safe.traceId
-  };
-  return new Response(JSON.stringify(response), {
-    status,
-    headers: { "Content-Type": "application/json", "X-Trace-Id": safe.traceId }
-  });
-}
-function badRequest(message, requestId, details) {
-  return error("BAD_REQUEST", message, 400, requestId, details);
-}
-function unauthorized(message, requestId) {
-  return error("UNAUTHORIZED", message ?? kitM("kit_authRequired"), 401, requestId);
-}
-function forbidden(message, requestId) {
-  return error("FORBIDDEN", message ?? kitM("kit_accessDenied"), 403, requestId);
-}
-function notFound(message, requestId) {
-  return error("NOT_FOUND", message ?? kitM("kit_resourceNotFound"), 404, requestId);
-}
-function conflict(message, requestId) {
-  return error("CONFLICT", message, 409, requestId);
-}
-function validationError(errors, requestId) {
-  return error("VALIDATION_ERROR", kitM("kit_validationFailed"), 422, requestId, { errors });
-}
-function internalError(message, requestId) {
-  return error("INTERNAL_ERROR", message ?? kitM("kit_internalError"), 500, requestId);
-}
-function redirect(url, status = 302) {
-  return new Response(null, {
-    status,
-    headers: { Location: url }
-  });
-}
-function fromResult(result, httpStatusMap, requestId) {
-  if (result.success) {
-    return ok(result.data, requestId);
-  }
-  const status = httpStatusMap?.[result.error.code] ?? (typeof result.error.httpStatus === "number" ? result.error.httpStatus : 400);
-  return fromError({ ...result.error, httpStatus: status }, requestId);
-}
-function fromError(haiError, requestId) {
-  const safe = core.error.toPublic(haiError, requestId);
-  core.logger.error("API operation failed", { traceId: safe.traceId, error: haiError });
-  return error(String(safe.code), safe.message, safe.httpStatus ?? 400, safe.traceId);
-}
-
-// src/kit-handler.ts
 function handler(fn) {
   return async (event) => {
     try {
@@ -784,40 +828,68 @@ var PaginationQuerySchema = z.object({
 });
 
 // src/kit-auth-api.ts
-var authApiPublicPaths = ["/api/auth/config", "/api/auth/login", "/api/auth/login/ldap", "/api/auth/login/otp", "/api/auth/register", "/api/auth/otp/send", "/api/auth/password-reset/request", "/api/auth/password-reset/confirm"];
+var authApiPublicPaths = ["/api/auth/session/close", "/api/auth/logout", "/api/auth/captcha", "/api/auth/config", "/api/auth/login", "/api/auth/login/ldap", "/api/auth/login/otp", "/api/auth/register", "/api/auth/otp/send", "/api/auth/password-reset/request", "/api/auth/password-reset/confirm", "/api/auth/password/renew"];
+function requestContext(event) {
+  let ip;
+  try {
+    ip = event.getClientAddress();
+  } catch {
+  }
+  return { ip, userAgent: event.request.headers.get("user-agent") ?? void 0 };
+}
 function createAuthApi(iam) {
   function response(result) {
     return result.success ? ok(result.data) : fromError(result.error);
   }
   return {
+    closeSession: handler(async ({ request, cookies }) => {
+      const input = await validateFormOrFail(request, IamLogoutInputSchema);
+      return response(await iam.auth.logout(input.accessToken ?? getAccessToken(request, cookies) ?? ""));
+    }),
+    createCaptcha: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamCreateCaptchaInputSchema);
+      return response(await iam.auth.createCaptcha(input));
+    }),
+    reauthenticate: handler(async ({ request, cookies }) => {
+      const input = await validateFormOrFail(request, IamReauthenticateInputSchema);
+      return response(await iam.auth.reauthenticate(getAccessToken(request, cookies) ?? "", input.password, input.operation));
+    }),
     publicConfig: handler(() => ok(iam.publicConfig)),
-    login: handler(async ({ request, cookies }) => {
+    renewPassword: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamRenewPasswordInputSchema);
+      return response(await iam.user.renewPassword(input));
+    }),
+    login: handler(async (event) => {
+      const { request, cookies } = event;
       const input = await validateFormOrFail(request, IamLoginInputSchema);
-      const result = await login(cookies, input);
+      const result = await login(cookies, input, requestContext(event));
       return result.success ? ok({ user: result.data.user }) : fromError(result.error);
     }),
-    loginWithLdap: handler(async ({ request, cookies }) => {
+    loginWithLdap: handler(async (event) => {
+      const { request, cookies } = event;
       const input = await validateFormOrFail(request, IamLdapLoginInputSchema);
-      const result = await loginWithLdap(cookies, input);
+      const result = await loginWithLdap(cookies, input, requestContext(event));
       return result.success ? ok({ user: result.data.user }) : fromError(result.error);
     }),
-    loginWithOtp: handler(async ({ request, cookies }) => {
+    loginWithOtp: handler(async (event) => {
+      const { request, cookies } = event;
       const input = await validateFormOrFail(request, IamOtpLoginInputSchema);
-      const result = await loginWithOtp(cookies, input);
+      const result = await loginWithOtp(cookies, input, requestContext(event));
       return result.success ? ok({ user: result.data.user }) : fromError(result.error);
     }),
-    register: handler(async ({ request, cookies }) => {
+    register: handler(async (event) => {
+      const { request, cookies } = event;
       const input = await validateFormOrFail(request, IamRegisterInputSchema);
-      const result = await registerAndLogin(cookies, input);
+      const result = await registerAndLogin(cookies, input, requestContext(event));
       return result.success ? ok({ user: result.data.user }) : fromError(result.error);
     }),
     sendOtp: handler(async ({ request }) => {
       const input = await validateFormOrFail(request, IamSendOtpInputSchema);
-      return response(await iam.auth.sendOtp(input.identifier));
+      return response(await iam.auth.sendOtp(input.identifier, input));
     }),
     requestPasswordReset: handler(async ({ request }) => {
       const input = await validateFormOrFail(request, IamRequestPasswordResetInputSchema);
-      return response(await iam.user.requestPasswordReset(input.identifier));
+      return response(await iam.user.requestPasswordReset(input.identifier, input));
     }),
     confirmPasswordReset: handler(async ({ request }) => {
       const input = await validateFormOrFail(request, IamConfirmPasswordResetInputSchema);
@@ -960,6 +1032,8 @@ var kit = {
   handler,
   // ─── 路由守卫 ───
   guard: {
+    /** 选定敏感操作要求单次再鉴别；先调用现有权限与资源守卫。 */
+    requireSensitive: requireSensitiveOperation,
     /** 要求权限，不满足时 throw Response（SvelteKit 控制流） */
     require: requirePermission,
     /** 检查会话是否具有指定权限（布尔） */