@heybox/hb-sdk-protocol 0.8.0-alpha.9 → 0.8.1-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.md +3 -6
  2. package/dist/index.cjs.js +320 -47
  3. package/dist/index.esm.js +317 -48
  4. package/package.json +4 -2
  5. package/src/capabilities.ts +157 -42
  6. package/src/index.ts +1 -0
  7. package/src/permission-catalog.ts +168 -0
  8. package/src/permissions.ts +28 -10
  9. package/types/capabilities.d.ts +156 -42
  10. package/types/index.d.ts +1 -0
  11. package/types/permission-catalog.d.ts +108 -0
  12. package/types/permissions.d.ts +4 -3
package/README.md CHANGED
@@ -7,7 +7,7 @@
7
7
  `@heybox/hb-sdk-protocol` 拥有：
8
8
 
9
9
  - bridge namespace、协议版本、method 常量和事件名称；
10
- - capability metadata（module、capability、permission、risk）；
10
+ - capability metadata（module、capability、requirement、risk）和权限机器目录；
11
11
  - method payload/result 与错误的 wire 类型；
12
12
  - `runtime_permissions` schema 解析器和相关类型。
13
13
 
@@ -32,17 +32,14 @@
32
32
  宿主/Runtime 维护代码直接使用协议包：
33
33
 
34
34
  ```ts
35
- import {
36
- MINI_PROGRAM_PROTOCOL_CAPABILITIES,
37
- type MiniProgramBridgeMessage,
38
- } from '@heybox/hb-sdk-protocol';
35
+ import { MINI_PROGRAM_PROTOCOL_CAPABILITIES, type MiniProgramBridgeMessage } from '@heybox/hb-sdk-protocol';
39
36
  ```
40
37
 
41
38
  小程序业务代码不应导入该包；业务只使用 `@heybox/hb-sdk`。为了兼容已有 Host/Runtime 消费者，`@heybox/hb-sdk/protocol` 继续 re-export 本包的公开值和类型，但协议 owner 是本包。
42
39
 
43
40
  ## 权限快照
44
41
 
45
- `parseMiniProgramRuntimePermissions()` 是唯一的 schema v1 fail-closed 解析器。它校验 schema、entry 唯一性、managed key 和状态；未知但结构合法的新 key 会被保留/忽略，不会让当前版本误放行能力。Runtime 再使用 `hasMiniProgramNetworkRequestPermission()` 判断 `network.request` 是否明确启用。
42
+ `MINI_PROGRAM_PERMISSION_CATALOG` 定义 8 个公开权限，`MINI_PROGRAM_PROTOCOL_CAPABILITIES[].requirement` 将每个 bridge method 显式分类为无需声明或要求全部列出的权限。`parseMiniProgramRuntimePermissions()` 是 schema v1 的 fail-closed 解析器；旧 `network.request` entry 仅在解析边界归一为 `network`，不得进入新配置。跨语言目录由 `generated/permission-catalog.json` 提供。
46
43
 
47
44
  协议包不决定业务授权。`auth.login()` 的 UI、账号会话、授权码签发和 OpenAPI 都由 Host/服务端负责；协议层只传递经过约束的 request/response 数据。
48
45
 
package/dist/index.cjs.js CHANGED
@@ -42,135 +42,249 @@ const CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.getCu
42
42
  const CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD = 'cloud.leaderboard.deleteCurrentUserEntry';
43
43
  const CLOUD_LEADERBOARD_GET_INFO_METHOD = 'cloud.leaderboard.getInfo';
44
44
  const MINI_PROGRAM_PROTOCOL_CAPABILITIES = [
45
- { method: AUTH_LOGIN_METHOD, module: 'auth', capability: AUTH_LOGIN_METHOD, permission: 'auth.login', risk: 'medium' },
46
- { method: USER_GET_INFO_METHOD, module: 'user', capability: USER_GET_INFO_METHOD, permission: 'user.getInfo', risk: 'medium' },
45
+ {
46
+ method: AUTH_LOGIN_METHOD,
47
+ module: 'auth',
48
+ capability: AUTH_LOGIN_METHOD,
49
+ requirement: { kind: 'all', permissions: ['userInfo'] },
50
+ risk: 'medium',
51
+ },
52
+ {
53
+ method: USER_GET_INFO_METHOD,
54
+ module: 'user',
55
+ capability: USER_GET_INFO_METHOD,
56
+ requirement: { kind: 'all', permissions: ['userInfo'] },
57
+ risk: 'medium',
58
+ },
47
59
  {
48
60
  method: USER_REVOKE_AUTHORIZATION_METHOD,
49
61
  module: 'user',
50
62
  capability: USER_REVOKE_AUTHORIZATION_METHOD,
51
- permission: 'user.revokeAuthorization',
63
+ requirement: { kind: 'none' },
52
64
  risk: 'high',
53
65
  },
54
66
  {
55
67
  method: USER_GET_STEAM_GAME_LIST_METHOD,
56
68
  module: 'user',
57
69
  capability: USER_GET_STEAM_GAME_LIST_METHOD,
58
- permission: 'user.platformAccount.steam',
70
+ requirement: { kind: 'all', permissions: ['steamLibrary'] },
59
71
  risk: 'high',
60
72
  },
61
- { method: SHARE_COPY_LINK_METHOD, module: 'share', capability: SHARE_COPY_LINK_METHOD, permission: 'share.copyLink', risk: 'medium' },
62
- { method: SHARE_SHOW_SHARE_MENU_METHOD, module: 'share', capability: SHARE_SHOW_SHARE_MENU_METHOD, permission: 'share.basic', risk: 'low' },
63
- { method: SHARE_SCREENSHOT_METHOD, module: 'share', capability: SHARE_SCREENSHOT_METHOD, permission: 'share.screenshot', risk: 'medium' },
73
+ {
74
+ method: SHARE_COPY_LINK_METHOD,
75
+ module: 'share',
76
+ capability: SHARE_COPY_LINK_METHOD,
77
+ requirement: { kind: 'all', permissions: ['share'] },
78
+ risk: 'medium',
79
+ },
80
+ {
81
+ method: SHARE_SHOW_SHARE_MENU_METHOD,
82
+ module: 'share',
83
+ capability: SHARE_SHOW_SHARE_MENU_METHOD,
84
+ requirement: { kind: 'all', permissions: ['share'] },
85
+ risk: 'low',
86
+ },
87
+ {
88
+ method: SHARE_SCREENSHOT_METHOD,
89
+ module: 'share',
90
+ capability: SHARE_SCREENSHOT_METHOD,
91
+ requirement: { kind: 'all', permissions: ['share'] },
92
+ risk: 'medium',
93
+ },
64
94
  {
65
95
  method: VIEWPORT_GET_WINDOW_INFO_METHOD,
66
96
  module: 'viewport',
67
97
  capability: VIEWPORT_GET_WINDOW_INFO_METHOD,
68
- permission: 'viewport.windowInfo',
98
+ requirement: { kind: 'none' },
69
99
  risk: 'low',
70
100
  },
71
101
  {
72
102
  method: VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD,
73
103
  module: 'viewport',
74
104
  capability: VIEWPORT_SET_NAVIGATION_BAR_STYLE_METHOD,
75
- permission: 'viewport.navigationBarStyle',
105
+ requirement: { kind: 'none' },
106
+ risk: 'low',
107
+ },
108
+ {
109
+ method: STORAGE_GET_STORAGE_METHOD,
110
+ module: 'storage',
111
+ capability: STORAGE_GET_STORAGE_METHOD,
112
+ requirement: { kind: 'all', permissions: ['storage'] },
76
113
  risk: 'low',
77
114
  },
78
- { method: STORAGE_GET_STORAGE_METHOD, module: 'storage', capability: STORAGE_GET_STORAGE_METHOD, permission: 'storage.read', risk: 'low' },
79
- { method: STORAGE_SET_STORAGE_METHOD, module: 'storage', capability: STORAGE_SET_STORAGE_METHOD, permission: 'storage.write', risk: 'medium' },
80
- { method: NETWORK_REQUEST_METHOD, module: 'network', capability: NETWORK_REQUEST_METHOD, permission: 'network.request', risk: 'high' },
81
- { method: NETWORK_DOWNLOAD_METHOD, module: 'network', capability: NETWORK_DOWNLOAD_METHOD, permission: 'network.request', risk: 'high' },
82
- { method: FILES_PICK_FILES_METHOD, module: 'files', capability: FILES_PICK_FILES_METHOD, permission: 'files.external', risk: 'high' },
115
+ {
116
+ method: STORAGE_SET_STORAGE_METHOD,
117
+ module: 'storage',
118
+ capability: STORAGE_SET_STORAGE_METHOD,
119
+ requirement: { kind: 'all', permissions: ['storage'] },
120
+ risk: 'medium',
121
+ },
122
+ {
123
+ method: NETWORK_REQUEST_METHOD,
124
+ module: 'network',
125
+ capability: NETWORK_REQUEST_METHOD,
126
+ requirement: { kind: 'all', permissions: ['network'] },
127
+ risk: 'high',
128
+ },
129
+ {
130
+ method: NETWORK_DOWNLOAD_METHOD,
131
+ module: 'network',
132
+ capability: NETWORK_DOWNLOAD_METHOD,
133
+ requirement: { kind: 'all', permissions: ['network', 'filesystem'] },
134
+ risk: 'high',
135
+ },
136
+ {
137
+ method: FILES_PICK_FILES_METHOD,
138
+ module: 'files',
139
+ capability: FILES_PICK_FILES_METHOD,
140
+ requirement: { kind: 'all', permissions: ['filesystem'] },
141
+ risk: 'high',
142
+ },
83
143
  {
84
144
  method: FILES_PICK_DIRECTORY_METHOD,
85
145
  module: 'files',
86
146
  capability: FILES_PICK_DIRECTORY_METHOD,
87
- permission: 'files.external',
147
+ requirement: { kind: 'all', permissions: ['filesystem'] },
148
+ risk: 'high',
149
+ },
150
+ {
151
+ method: FILES_SAVE_FILE_METHOD,
152
+ module: 'files',
153
+ capability: FILES_SAVE_FILE_METHOD,
154
+ requirement: { kind: 'all', permissions: ['filesystem'] },
88
155
  risk: 'high',
89
156
  },
90
- { method: FILES_SAVE_FILE_METHOD, module: 'files', capability: FILES_SAVE_FILE_METHOD, permission: 'files.external', risk: 'high' },
91
- { method: FILE_CREATE_METHOD, module: 'file', capability: FILE_CREATE_METHOD, permission: 'files.access', risk: 'high' },
92
- { method: FILE_REMOVE_METHOD, module: 'file', capability: FILE_REMOVE_METHOD, permission: 'files.access', risk: 'high' },
93
- { method: FILE_EXISTS_METHOD, module: 'file', capability: FILE_EXISTS_METHOD, permission: 'files.access', risk: 'high' },
94
- { method: FILE_READ_TEXT_METHOD, module: 'file', capability: FILE_READ_TEXT_METHOD, permission: 'files.access', risk: 'high' },
95
- { method: FILE_WRITE_TEXT_METHOD, module: 'file', capability: FILE_WRITE_TEXT_METHOD, permission: 'files.access', risk: 'high' },
96
- { method: FILE_READ_BYTES_METHOD, module: 'file', capability: FILE_READ_BYTES_METHOD, permission: 'files.access', risk: 'high' },
97
- { method: FILE_WRITE_BYTES_METHOD, module: 'file', capability: FILE_WRITE_BYTES_METHOD, permission: 'files.access', risk: 'high' },
98
- { method: FILE_STAT_METHOD, module: 'file', capability: FILE_STAT_METHOD, permission: 'files.access', risk: 'high' },
157
+ {
158
+ method: FILE_CREATE_METHOD,
159
+ module: 'file',
160
+ capability: FILE_CREATE_METHOD,
161
+ requirement: { kind: 'all', permissions: ['filesystem'] },
162
+ risk: 'high',
163
+ },
164
+ {
165
+ method: FILE_REMOVE_METHOD,
166
+ module: 'file',
167
+ capability: FILE_REMOVE_METHOD,
168
+ requirement: { kind: 'all', permissions: ['filesystem'] },
169
+ risk: 'high',
170
+ },
171
+ {
172
+ method: FILE_EXISTS_METHOD,
173
+ module: 'file',
174
+ capability: FILE_EXISTS_METHOD,
175
+ requirement: { kind: 'all', permissions: ['filesystem'] },
176
+ risk: 'high',
177
+ },
178
+ {
179
+ method: FILE_READ_TEXT_METHOD,
180
+ module: 'file',
181
+ capability: FILE_READ_TEXT_METHOD,
182
+ requirement: { kind: 'all', permissions: ['filesystem'] },
183
+ risk: 'high',
184
+ },
185
+ {
186
+ method: FILE_WRITE_TEXT_METHOD,
187
+ module: 'file',
188
+ capability: FILE_WRITE_TEXT_METHOD,
189
+ requirement: { kind: 'all', permissions: ['filesystem'] },
190
+ risk: 'high',
191
+ },
192
+ {
193
+ method: FILE_READ_BYTES_METHOD,
194
+ module: 'file',
195
+ capability: FILE_READ_BYTES_METHOD,
196
+ requirement: { kind: 'all', permissions: ['filesystem'] },
197
+ risk: 'high',
198
+ },
199
+ {
200
+ method: FILE_WRITE_BYTES_METHOD,
201
+ module: 'file',
202
+ capability: FILE_WRITE_BYTES_METHOD,
203
+ requirement: { kind: 'all', permissions: ['filesystem'] },
204
+ risk: 'high',
205
+ },
206
+ { method: FILE_STAT_METHOD, module: 'file', capability: FILE_STAT_METHOD, requirement: { kind: 'all', permissions: ['filesystem'] }, risk: 'high' },
99
207
  {
100
208
  method: DIRECTORY_CREATE_METHOD,
101
209
  module: 'directory',
102
210
  capability: DIRECTORY_CREATE_METHOD,
103
- permission: 'files.access',
211
+ requirement: { kind: 'all', permissions: ['filesystem'] },
104
212
  risk: 'high',
105
213
  },
106
214
  {
107
215
  method: DIRECTORY_REMOVE_METHOD,
108
216
  module: 'directory',
109
217
  capability: DIRECTORY_REMOVE_METHOD,
110
- permission: 'files.access',
218
+ requirement: { kind: 'all', permissions: ['filesystem'] },
111
219
  risk: 'high',
112
220
  },
113
221
  {
114
222
  method: DIRECTORY_EXISTS_METHOD,
115
223
  module: 'directory',
116
224
  capability: DIRECTORY_EXISTS_METHOD,
117
- permission: 'files.access',
225
+ requirement: { kind: 'all', permissions: ['filesystem'] },
118
226
  risk: 'high',
119
227
  },
120
- { method: DIRECTORY_LIST_METHOD, module: 'directory', capability: DIRECTORY_LIST_METHOD, permission: 'files.access', risk: 'high' },
121
- { method: UI_SHOW_TOAST_METHOD, module: 'ui', capability: UI_SHOW_TOAST_METHOD, permission: 'ui.toast', risk: 'low' },
122
- { method: UI_SHOW_LOADING_METHOD, module: 'ui', capability: UI_SHOW_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
123
- { method: UI_HIDE_LOADING_METHOD, module: 'ui', capability: UI_HIDE_LOADING_METHOD, permission: 'ui.loading', risk: 'low' },
124
- { method: DEVICE_VIBRATE_METHOD, module: 'device', capability: DEVICE_VIBRATE_METHOD, permission: 'device.vibrate', risk: 'low' },
228
+ {
229
+ method: DIRECTORY_LIST_METHOD,
230
+ module: 'directory',
231
+ capability: DIRECTORY_LIST_METHOD,
232
+ requirement: { kind: 'all', permissions: ['filesystem'] },
233
+ risk: 'high',
234
+ },
235
+ { method: UI_SHOW_TOAST_METHOD, module: 'ui', capability: UI_SHOW_TOAST_METHOD, requirement: { kind: 'none' }, risk: 'low' },
236
+ { method: UI_SHOW_LOADING_METHOD, module: 'ui', capability: UI_SHOW_LOADING_METHOD, requirement: { kind: 'none' }, risk: 'low' },
237
+ { method: UI_HIDE_LOADING_METHOD, module: 'ui', capability: UI_HIDE_LOADING_METHOD, requirement: { kind: 'none' }, risk: 'low' },
238
+ { method: DEVICE_VIBRATE_METHOD, module: 'device', capability: DEVICE_VIBRATE_METHOD, requirement: { kind: 'none' }, risk: 'low' },
125
239
  {
126
240
  method: DEVICE_SET_CLIPBOARD_METHOD,
127
241
  module: 'device',
128
242
  capability: DEVICE_SET_CLIPBOARD_METHOD,
129
- permission: 'device.clipboard.write',
243
+ requirement: { kind: 'all', permissions: ['clipboard'] },
130
244
  risk: 'medium',
131
245
  },
132
- { method: NAVIGATION_CLOSE_METHOD, module: 'navigation', capability: NAVIGATION_CLOSE_METHOD, permission: 'navigation.close', risk: 'medium' },
133
- { method: NAVIGATION_RELOAD_METHOD, module: 'navigation', capability: NAVIGATION_RELOAD_METHOD, permission: 'navigation.reload', risk: 'medium' },
246
+ { method: NAVIGATION_CLOSE_METHOD, module: 'navigation', capability: NAVIGATION_CLOSE_METHOD, requirement: { kind: 'none' }, risk: 'medium' },
247
+ { method: NAVIGATION_RELOAD_METHOD, module: 'navigation', capability: NAVIGATION_RELOAD_METHOD, requirement: { kind: 'none' }, risk: 'medium' },
134
248
  {
135
249
  method: NAVIGATION_OPEN_APP_PAGE_METHOD,
136
250
  module: 'navigation',
137
251
  capability: NAVIGATION_OPEN_APP_PAGE_METHOD,
138
- permission: 'navigation.openAppPage',
252
+ requirement: { kind: 'none' },
139
253
  risk: 'medium',
140
254
  },
141
255
  {
142
256
  method: CLOUD_LEADERBOARD_SUBMIT_METHOD,
143
257
  module: 'cloud',
144
258
  capability: CLOUD_LEADERBOARD_SUBMIT_METHOD,
145
- permission: 'cloud.leaderboard.write',
259
+ requirement: { kind: 'all', permissions: ['leaderboard'] },
146
260
  risk: 'medium',
147
261
  },
148
262
  {
149
263
  method: CLOUD_LEADERBOARD_GET_LIST_METHOD,
150
264
  module: 'cloud',
151
265
  capability: CLOUD_LEADERBOARD_GET_LIST_METHOD,
152
- permission: 'cloud.leaderboard.read',
266
+ requirement: { kind: 'all', permissions: ['leaderboard'] },
153
267
  risk: 'low',
154
268
  },
155
269
  {
156
270
  method: CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD,
157
271
  module: 'cloud',
158
272
  capability: CLOUD_LEADERBOARD_GET_CURRENT_USER_ENTRY_METHOD,
159
- permission: 'cloud.leaderboard.currentUserEntry.read',
273
+ requirement: { kind: 'all', permissions: ['leaderboard'] },
160
274
  risk: 'medium',
161
275
  },
162
276
  {
163
277
  method: CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD,
164
278
  module: 'cloud',
165
279
  capability: CLOUD_LEADERBOARD_DELETE_CURRENT_USER_ENTRY_METHOD,
166
- permission: 'cloud.leaderboard.currentUserEntry.delete',
280
+ requirement: { kind: 'all', permissions: ['leaderboard'] },
167
281
  risk: 'medium',
168
282
  },
169
283
  {
170
284
  method: CLOUD_LEADERBOARD_GET_INFO_METHOD,
171
285
  module: 'cloud',
172
286
  capability: CLOUD_LEADERBOARD_GET_INFO_METHOD,
173
- permission: 'cloud.leaderboard.info.read',
287
+ requirement: { kind: 'all', permissions: ['leaderboard'] },
174
288
  risk: 'low',
175
289
  },
176
290
  ];
@@ -315,7 +429,146 @@ function isRecord$1(value) {
315
429
  /** 当前用户信息与登录能力支持的完整 scope 目录。 */
316
430
  const USER_INFO_AUTHORIZATION_SCOPES = ['identity', 'profile'];
317
431
 
318
- const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(['network.request']);
432
+ const MINI_PROGRAM_PERMISSION_KEYS = [
433
+ 'userInfo',
434
+ 'steamLibrary',
435
+ 'share',
436
+ 'storage',
437
+ 'filesystem',
438
+ 'clipboard',
439
+ 'leaderboard',
440
+ 'network',
441
+ ];
442
+ const MINI_PROGRAM_PERMISSION_CATALOG = [
443
+ {
444
+ key: 'userInfo',
445
+ name: '用户信息',
446
+ description: '登录小程序并读取当前用户的授权信息。',
447
+ access: 'declaration',
448
+ risk: 'medium',
449
+ config: {},
450
+ methods: ['auth.login', 'user.getInfo'],
451
+ conditions: ['继续执行黑盒登录、用户授权和可信手势规则。'],
452
+ },
453
+ {
454
+ key: 'steamLibrary',
455
+ name: 'Steam 游戏库',
456
+ description: '读取当前用户授权的 Steam 游戏库。',
457
+ access: 'declaration',
458
+ risk: 'high',
459
+ config: {},
460
+ methods: ['user.getSteamGameList'],
461
+ conditions: ['继续执行账号绑定和数据可用性规则。'],
462
+ },
463
+ {
464
+ key: 'share',
465
+ name: '分享',
466
+ description: '使用小程序分享、分享菜单和截图能力。',
467
+ access: 'declaration',
468
+ risk: 'medium',
469
+ config: {},
470
+ methods: ['share.copyLink', 'share.showShareMenu', 'share.screenshot'],
471
+ conditions: ['继续执行分享参数校验和 Host 支持检查。'],
472
+ },
473
+ {
474
+ key: 'storage',
475
+ name: '键值存储',
476
+ description: '读写按小程序隔离的简单键值数据。',
477
+ access: 'declaration',
478
+ risk: 'medium',
479
+ config: {},
480
+ methods: ['storage.getStorage', 'storage.setStorage'],
481
+ conditions: ['仅用于简单键值存储，不包含文件系统。'],
482
+ },
483
+ {
484
+ key: 'filesystem',
485
+ name: '文件系统',
486
+ description: '访问小程序沙盒文件和用户选择的外部文件。',
487
+ access: 'declaration',
488
+ risk: 'high',
489
+ config: {},
490
+ methods: [
491
+ 'network.download',
492
+ 'files.pickFiles',
493
+ 'files.pickDirectory',
494
+ 'files.saveFile',
495
+ 'file.create',
496
+ 'file.remove',
497
+ 'file.exists',
498
+ 'file.readText',
499
+ 'file.writeText',
500
+ 'file.readBytes',
501
+ 'file.writeBytes',
502
+ 'file.stat',
503
+ 'directory.create',
504
+ 'directory.remove',
505
+ 'directory.exists',
506
+ 'directory.list',
507
+ ],
508
+ conditions: ['外部文件继续要求有效的用户选择、会话句柄和匹配的读写模式。'],
509
+ },
510
+ {
511
+ key: 'clipboard',
512
+ name: '剪贴板',
513
+ description: '向系统剪贴板写入文本。',
514
+ access: 'declaration',
515
+ risk: 'medium',
516
+ config: {},
517
+ methods: ['device.setClipboard'],
518
+ conditions: ['继续执行文本长度和 Host 支持限制。'],
519
+ },
520
+ {
521
+ key: 'leaderboard',
522
+ name: '排行榜',
523
+ description: '读写小程序云排行榜。',
524
+ access: 'declaration',
525
+ risk: 'medium',
526
+ config: {},
527
+ methods: [
528
+ 'cloud.leaderboard.submit',
529
+ 'cloud.leaderboard.getList',
530
+ 'cloud.leaderboard.getCurrentUserEntry',
531
+ 'cloud.leaderboard.deleteCurrentUserEntry',
532
+ 'cloud.leaderboard.getInfo',
533
+ ],
534
+ conditions: ['排行榜必须已创建，用户和资源规则保持不变。'],
535
+ },
536
+ {
537
+ key: 'network',
538
+ name: '网络',
539
+ description: '通过 network 模块请求或下载外部资源。',
540
+ access: 'platform-approval',
541
+ risk: 'high',
542
+ config: {
543
+ useOfficialDomain: {
544
+ type: 'boolean',
545
+ required: false,
546
+ default: false,
547
+ description: '是否申请访问小黑盒官方域名。',
548
+ },
549
+ },
550
+ methods: ['network.request', 'network.download'],
551
+ conditions: ['声明后仍需平台批准，并继续执行网络安全策略。'],
552
+ },
553
+ ];
554
+ const MINI_PROGRAM_NO_DECLARATION_METHODS = [
555
+ 'user.revokeAuthorization',
556
+ 'ui.showToast',
557
+ 'ui.showLoading',
558
+ 'ui.hideLoading',
559
+ 'viewport.getWindowInfo',
560
+ 'viewport.setNavigationBarStyle',
561
+ 'device.vibrate',
562
+ 'navigation.close',
563
+ 'navigation.reload',
564
+ 'navigation.openAppPage',
565
+ ];
566
+ const PERMISSION_KEY_SET = new Set(MINI_PROGRAM_PERMISSION_KEYS);
567
+ function isMiniProgramPermissionKey(key) {
568
+ return PERMISSION_KEY_SET.has(key);
569
+ }
570
+
571
+ const MANAGED_RUNTIME_PERMISSION_KEYS = new Set(MINI_PROGRAM_PERMISSION_KEYS);
319
572
  function isManagedMiniProgramRuntimePermissionKey(key) {
320
573
  return MANAGED_RUNTIME_PERMISSION_KEYS.has(key);
321
574
  }
@@ -332,20 +585,36 @@ function parseMiniProgramRuntimePermissions(snapshot) {
332
585
  if (!isRecord(rawEntry) || typeof rawEntry.key !== 'string' || !rawEntry.key.trim()) {
333
586
  return { valid: false, permissions: {} };
334
587
  }
335
- const key = rawEntry.key.trim();
336
- if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled') || !isRecord(rawEntry.config)) {
588
+ const inputKey = rawEntry.key.trim();
589
+ const key = inputKey === 'network.request' ? 'network' : inputKey;
590
+ if (seenKeys.has(key) || (rawEntry.status !== 'enabled' && rawEntry.status !== 'disabled')) {
337
591
  return { valid: false, permissions: {} };
338
592
  }
339
593
  seenKeys.add(key);
340
- if (!isManagedMiniProgramRuntimePermissionKey(key))
594
+ if (!isManagedMiniProgramRuntimePermissionKey(key)) {
595
+ if (!isRecord(rawEntry.config))
596
+ return { valid: false, permissions: {} };
341
597
  continue;
342
- if (key === 'network.request' && typeof rawEntry.config.useOfficialDomain !== 'boolean') {
598
+ }
599
+ if (key === 'network') {
600
+ const config = rawEntry.config;
601
+ if (!isRecord(config) || typeof config.useOfficialDomain !== 'boolean') {
602
+ return { valid: false, permissions: {} };
603
+ }
604
+ permissions[key] = {
605
+ key,
606
+ status: rawEntry.status,
607
+ config: { useOfficialDomain: config.useOfficialDomain },
608
+ };
609
+ continue;
610
+ }
611
+ if (rawEntry.config !== null && rawEntry.config !== undefined && (!isRecord(rawEntry.config) || Object.keys(rawEntry.config).length > 0)) {
343
612
  return { valid: false, permissions: {} };
344
613
  }
345
614
  permissions[key] = {
346
615
  key,
347
616
  status: rawEntry.status,
348
- config: { useOfficialDomain: rawEntry.config.useOfficialDomain },
617
+ config: {},
349
618
  };
350
619
  }
351
620
  return { valid: true, permissions };
@@ -380,7 +649,10 @@ exports.FILE_WRITE_TEXT_METHOD = FILE_WRITE_TEXT_METHOD;
380
649
  exports.MINI_PROGRAM_BRIDGE_NONCE_PARAM = MINI_PROGRAM_BRIDGE_NONCE_PARAM;
381
650
  exports.MINI_PROGRAM_MESSAGE_NAMESPACE = MINI_PROGRAM_MESSAGE_NAMESPACE;
382
651
  exports.MINI_PROGRAM_MESSAGE_VERSION = MINI_PROGRAM_MESSAGE_VERSION;
652
+ exports.MINI_PROGRAM_NO_DECLARATION_METHODS = MINI_PROGRAM_NO_DECLARATION_METHODS;
383
653
  exports.MINI_PROGRAM_OPERATION_PROGRESS_METHOD = MINI_PROGRAM_OPERATION_PROGRESS_METHOD;
654
+ exports.MINI_PROGRAM_PERMISSION_CATALOG = MINI_PROGRAM_PERMISSION_CATALOG;
655
+ exports.MINI_PROGRAM_PERMISSION_KEYS = MINI_PROGRAM_PERMISSION_KEYS;
384
656
  exports.MINI_PROGRAM_PROTOCOL_CAPABILITIES = MINI_PROGRAM_PROTOCOL_CAPABILITIES;
385
657
  exports.NAVIGATION_CLOSE_METHOD = NAVIGATION_CLOSE_METHOD;
386
658
  exports.NAVIGATION_OPEN_APP_PAGE_METHOD = NAVIGATION_OPEN_APP_PAGE_METHOD;
@@ -416,5 +688,6 @@ exports.isMiniProgramFileRef = isMiniProgramFileRef;
416
688
  exports.isMiniProgramFileStat = isMiniProgramFileStat;
417
689
  exports.isMiniProgramFileSystemEntityDescriptor = isMiniProgramFileSystemEntityDescriptor;
418
690
  exports.isMiniProgramPathRootRef = isMiniProgramPathRootRef;
691
+ exports.isMiniProgramPermissionKey = isMiniProgramPermissionKey;
419
692
  exports.isMiniProgramRelativePath = isMiniProgramRelativePath;
420
693
  exports.parseMiniProgramRuntimePermissions = parseMiniProgramRuntimePermissions;