@jeffusion/bungee-core 5.26.0 → 6.0.2

package/dist/plugins/local-accounts/manifest.json

@@ -1,223 +0,0 @@
-{
-  "name": "local-accounts",
-  "version": "1.0.0",
-  "schemaVersion": 3,
-  "artifactKind": "runtime-plugin",
-  "main": "index.js",
-  "capabilities": [
-    "hooks",
-    "api",
-    "dynamicRuntimeLoad",
-    "controlPlane",
-    "nativeWidgetsStatic"
-  ],
-  "uiExtensionMode": "native-static",
-  "engines": {
-    "bungee": "^5.0.0"
-  },
-  "runtimeScope": "global",
-  "control": {
-    "entry": "control.js",
-    "rpc": []
-  },
-  "management": {
-    "loginComponent": "LocalAccountsLogin"
-  },
-  "builtin": true,
-  "ui": {
-    "components": [
-      {
-        "name": "LocalAccountsSettings",
-        "entry": "ui/Settings.svelte"
-      },
-      {
-        "name": "LocalAccountsLogin",
-        "entry": "ui/Login.svelte"
-      }
-    ]
-  },
-  "contributes": {
-    "api": [
-      {
-        "path": "/password",
-        "methods": [
-          "POST"
-        ],
-        "handler": "changePassword",
-        "execution": "control",
-        "capability": "self.password"
-      },
-      {
-        "path": "/session-policy",
-        "methods": [
-          "GET",
-          "PUT"
-        ],
-        "handler": "sessionPolicy",
-        "execution": "control",
-        "capability": "config.write"
-      },
-      {
-        "path": "/logout",
-        "methods": [
-          "POST"
-        ],
-        "handler": "logout",
-        "execution": "control",
-        "capability": "self.logout"
-      },
-      {
-        "path": "/self",
-        "methods": [
-          "GET"
-        ],
-        "handler": "self",
-        "execution": "control",
-        "capability": "self.password"
-      }
-    ],
-    "navigation": [
-      {
-        "label": "metadata.name",
-        "path": "/settings",
-        "component": "LocalAccountsSettings",
-        "icon": "manage_accounts",
-        "target": "header"
-      }
-    ]
-  },
-  "metadata": {
-    "name": "metadata.name",
-    "description": "metadata.description",
-    "icon": "manage_accounts"
-  },
-  "configSchema": [],
-  "translations": {
-    "zh-CN": {
-      "metadata.name": "认证管理",
-      "metadata.description": "可选的单管理员账号密码认证",
-      "login.title": "账号登录",
-      "login.description": "使用认证管理插件中设置的唯一管理员账号。",
-      "login.username": "账号",
-      "login.password": "密码",
-      "login.busy": "正在建立登录会话…",
-      "login.submit": "登录",
-      "login.technicalDetails": "技术详情",
-      "login.correctAddress": "使用正确地址：{origin}",
-      "login.errors.invalid_credentials": "账号或密码不正确。请重新输入。",
-      "login.errors.invalid_input": "账号格式不正确。账号名只允许字母、数字及 _ . @ -，长度为 1–64。",
-      "login.errors.forbidden": "当前登录请求无法完成。请刷新后重试。",
-      "login.errors.unauthorized": "登录会话未建立。请重新登录。",
-      "login.errors.invalid_origin": "当前访问地址与服务配置不匹配。请使用配置的公开地址登录，或请部署管理员调整公开地址。",
-      "login.errors.invalid_csrf": "当前会话或访问地址校验失败。请从配置的公开地址重新登录。",
-      "login.errors.login_limited": "登录尝试过多。请等待 15 分钟后重试。",
-      "login.errors.session_limit": "登录会话已达到上限。请退出不再使用的会话后重试。",
-      "login.errors.management_provider_unavailable": "账号服务暂时不可用。请检查服务状态，恢复后重试。",
-      "login.errors.provider_unavailable": "账号服务暂时不可用。请检查服务状态，恢复后重试。",
-      "login.errors.control_recovering": "账号服务正在恢复。请稍候重试。",
-      "login.errors.session_unavailable": "登录尚未完成。请检查连接后重试，或刷新管理访问状态。",
-      "login.errors.unknown": "登录未完成。请检查连接后重试。",
-      "recovery.summary": "忘记账号或密码？",
-      "recovery.intro": "请在部署服务器上恢复，网页不能直接重置管理员。",
-      "recovery.step1": "确认目标实例的配置数据库路径，停止该实例的全部进程并备份数据。",
-      "recovery.step2": "在原部署目录、使用原环境变量执行下面的命令，将数据库路径替换为实际绝对路径。",
-      "recovery.step3": "按提示输入新的账号和密码，然后重新启动实例。旧会话会失效，路由、服务及 API Key 保留。",
-      "recovery.docker": "Docker 部署：停止原容器后，使用同一镜像、原数据卷及环境变量启动临时交互容器，执行同一命令；完成后删除临时容器并启动原容器。请勿另建空数据卷。",
-      "recovery.note": "密码交互输入且不显示。若提示恢复失败，请确认实例已完全停止、路径及环境正确；旧版本存在多个管理员时需由部署人员处理。",
-      "settings.accountTitle": "管理员账号",
-      "settings.accountTag": "账号",
-      "settings.passwordTag": "密码",
-      "settings.loading": "正在读取管理员账号",
-      "settings.accountDescription": "认证管理使用此唯一管理员账号。停用插件后恢复匿名管理访问。",
-      "settings.passwordTitle": "修改登录密码",
-      "settings.passwordDescription": "修改后当前登录会话失效，需要重新登录。",
-      "settings.currentPassword": "当前密码",
-      "settings.newPassword": "新密码（6–64 个字符）",
-      "settings.confirmation": "确认新密码",
-      "settings.updating": "正在更新…",
-      "settings.submit": "修改并重新登录",
-      "settings.logout": "退出当前会话",
-      "session.title": "登录会话",
-      "session.tag": "有效期",
-      "session.description": "保存后仅影响新登录的会话，已有会话保留登录时的设置。时长设为 0 可关闭对应超时。",
-      "session.idle": "空闲超时",
-      "session.absolute": "登录最长有效期",
-      "session.minutes": "分钟",
-      "session.hours": "小时",
-      "session.days": "天",
-      "session.unit": "时长单位",
-      "session.browserNote": "关闭超时不影响退出登录、改密和身份恢复时撤销会话。浏览器仍可能清理 Cookie；正常核验会话时会续期 Cookie，但不会延长登录最长有效期。",
-      "session.loading": "正在读取会话设置",
-      "session.save": "保存会话设置",
-      "session.saving": "正在保存…",
-      "session.saved": "已保存，下次登录生效。",
-      "session.invalid": "请输入非负整数时长；0 表示关闭超时。",
-      "session.conflict": "设置已被其他页面修改。请重新读取后再保存。",
-      "session.failed": "会话设置读取或保存失败。",
-      "session.reload": "重新读取"
-    },
-    "en": {
-      "metadata.name": "Authentication Management",
-      "metadata.description": "Optional username and password authentication for a single administrator",
-      "login.title": "Account sign-in",
-      "login.description": "Use the sole administrator account configured in the management authentication plugin.",
-      "login.username": "Username",
-      "login.password": "Password",
-      "login.busy": "Establishing a sign-in session…",
-      "login.submit": "Sign in",
-      "login.technicalDetails": "Technical details",
-      "login.correctAddress": "Use the correct address: {origin}",
-      "login.errors.invalid_credentials": "Incorrect username or password. Enter your credentials again.",
-      "login.errors.invalid_input": "Invalid username. Use 1–64 characters containing letters, numbers, and _ . @ - only.",
-      "login.errors.forbidden": "This sign-in request could not be completed. Refresh and try again.",
-      "login.errors.unauthorized": "A sign-in session was not established. Sign in again.",
-      "login.errors.invalid_origin": "This address does not match the service configuration. Sign in at the configured public address, or ask the deployment administrator to update it.",
-      "login.errors.invalid_csrf": "Session or address verification failed. Sign in again at the configured public address.",
-      "login.errors.login_limited": "Too many sign-in attempts. Wait 15 minutes before trying again.",
-      "login.errors.session_limit": "The sign-in session limit has been reached. Sign out of unused sessions and try again.",
-      "login.errors.management_provider_unavailable": "The account service is temporarily unavailable. Check its status and try again after recovery.",
-      "login.errors.provider_unavailable": "The account service is temporarily unavailable. Check its status and try again after recovery.",
-      "login.errors.control_recovering": "The account service is recovering. Try again shortly.",
-      "login.errors.session_unavailable": "Sign-in has not completed. Check your connection and retry, or refresh management access status.",
-      "login.errors.unknown": "Sign-in did not complete. Check your connection and try again.",
-      "recovery.summary": "Forgot your username or password?",
-      "recovery.intro": "Recover access on the deployment server. The web page cannot reset the administrator directly.",
-      "recovery.step1": "Confirm the target instance’s configuration database path, stop all its processes, and back up the data.",
-      "recovery.step2": "Run the following command from the original deployment directory with the original environment variables. Replace the database path with its actual absolute path.",
-      "recovery.step3": "Enter a new username and password when prompted, then restart the instance. Old sessions will expire; routes, services, and API Keys will be retained.",
-      "recovery.docker": "For Docker deployments, stop the original container, start a temporary interactive container with the same image, original data volume, and environment variables, and run the same command. Afterwards, remove the temporary container and restart the original one. Do not create an empty data volume.",
-      "recovery.note": "Passwords are entered interactively and remain hidden. If recovery fails, confirm the instance is fully stopped and the path and environment are correct. Deployment staff must handle older versions with multiple administrators.",
-      "settings.accountTitle": "Administrator account",
-      "settings.accountTag": "Account",
-      "settings.passwordTag": "Password",
-      "settings.loading": "Loading administrator account",
-      "settings.accountDescription": "Management authentication uses this sole administrator account. Disabling the plugin restores anonymous management access.",
-      "settings.passwordTitle": "Change sign-in password",
-      "settings.passwordDescription": "Changing the password invalidates the current session. Sign in again afterwards.",
-      "settings.currentPassword": "Current password",
-      "settings.newPassword": "New password (6–64 characters)",
-      "settings.confirmation": "Confirm new password",
-      "settings.updating": "Updating…",
-      "settings.submit": "Change and sign in again",
-      "settings.logout": "Sign out of current session",
-      "session.title": "Sign-in sessions",
-      "session.tag": "LIFETIME",
-      "session.description": "Saved settings apply only to new sign-ins. Existing sessions retain their original settings. Set a duration to 0 to disable that timeout.",
-      "session.idle": "Idle timeout",
-      "session.absolute": "Maximum sign-in lifetime",
-      "session.minutes": "Minutes",
-      "session.hours": "Hours",
-      "session.days": "Days",
-      "session.unit": "Duration unit",
-      "session.browserNote": "Disabling timeouts does not prevent sign-out, password changes or identity recovery from revoking sessions. Browsers may still clear cookies. Session verification renews the cookie without extending the maximum sign-in lifetime.",
-      "session.loading": "Loading session settings",
-      "session.save": "Save session settings",
-      "session.saving": "Saving…",
-      "session.saved": "Saved. Applies to your next sign-in.",
-      "session.invalid": "Enter a non-negative whole-number duration. 0 disables the timeout.",
-      "session.conflict": "Another page changed these settings. Reload before saving.",
-      "session.failed": "Could not read or save session settings.",
-      "session.reload": "Reload settings"
-    }
-  }
-}

package/dist/plugins/local-accounts/ui/Login.svelte

@@ -1,47 +0,0 @@
-<script lang="ts">
-  import { onDestroy } from 'svelte';
-  import { isLoading } from 'svelte-i18n';
-  import { _, isManagementLoginStaleError, type ManagementLoginContext } from '@bungee/plugin-sdk';
-  import RecoveryHelp from './RecoveryHelp.svelte';
-  import { loginFailure, requireLoginSuccess } from './login-errors';
-
-  let { context }: { context: ManagementLoginContext } = $props();
-  const t = (key: string, values: Record<string, string> = {}) => $isLoading ? '' : $_(`plugins.local-accounts.${key}`, { values });
-  let username = $state(''), password = $state(''), busy = $state(false);
-  let error = $state(''), detail = $state('');
-  let destroyed = false;
-  onDestroy(() => { destroyed = true; });
-
-  async function login(event: SubmitEvent) {
-    event.preventDefault();
-    if (busy) return;
-    const activeContext = context;
-    busy = true; error = ''; detail = '';
-    try {
-      const result = await activeContext.login({ username, password, transport: 'cookie' });
-      if (destroyed || context !== activeContext || result === undefined) return;
-      requireLoginSuccess(result);
-      await activeContext.complete();
-    } catch (cause) {
-      if (destroyed || context !== activeContext || isManagementLoginStaleError(cause)) return;
-      const failure = loginFailure(cause);
-      error = failure.key; detail = failure.detail;
-    } finally {
-      password = '';
-      if (!destroyed && context === activeContext) busy = false;
-    }
-  }
-</script>
-
-<form onsubmit={login} aria-label={t('login.title')} aria-busy={busy} class="space-y-4">
-  <p class="text-sm text-zinc-400">{t('login.description')}</p>
-  <label class="grid gap-1"><span class="nx-field-label">{t('login.username')}</span><input class="nx-input" bind:value={username} autocomplete="username" required maxlength="64" disabled={busy} /></label>
-  <label class="grid gap-1"><span class="nx-field-label">{t('login.password')}</span><input class="nx-input" bind:value={password} type="password" autocomplete="current-password" required disabled={busy} /></label>
-  {#if error}
-    <p role="alert" class="text-sm text-red-400">{t(error)}</p>
-    {#if detail === 'invalid_origin' && context.provider.publicOrigin}<a class="text-sm text-nexus-300 underline break-all" href={`${context.provider.publicOrigin}/#/login`}>{t('login.correctAddress', { origin: context.provider.publicOrigin })}</a>{/if}
-    <details class="text-sm text-zinc-400"><summary>{t('login.technicalDetails')}</summary><pre class="whitespace-pre-wrap break-all">{detail}</pre></details>
-  {/if}
-  <RecoveryHelp />
-  <button class="nx-btn-primary w-full justify-center" disabled={busy}>{busy ? t('login.busy') : t('login.submit')}</button>
-</form>

package/dist/plugins/local-accounts/ui/Settings.svelte

@@ -1,117 +0,0 @@
-<script lang="ts">
-  import { _, isLoading } from 'svelte-i18n';
-  import { getPluginText } from '$utils/plugin-i18n';
-  import { onMount } from 'svelte';
-  import { requestPluginControl } from '$api/client';
-  import { logout } from '$stores/auth';
-  import { PanelCard, LoadingIndicator, BSelect } from '$components/industrial';
-  import { Input } from '$components/ui/input';
-  import { Button } from '$components/ui/button';
-  import { accountError } from '$components/domain/plugin/activation-state';
-  const t = (key: string) => $isLoading ? '' : getPluginText(key, 'local-accounts', (id, options) => $_(id, options));
-  const core = (key: string, values: Record<string, string> = {}) => $isLoading ? '' : $_(key, { values });
-  let { pluginName = 'local-accounts' }: { pluginName?: string; apiBase?: string } = $props();
-  let administrator = $state<{id:string;username:string;requiresPasswordChange?:boolean} | null>(null);
-  let currentPassword = $state(''), password = $state(''), confirmation = $state(''), error = $state(''), detail = $state(''), busy = $state(false), loading = $state(true);
-  type SessionPolicy = {idleTimeoutMinutes: number; absoluteTimeoutMinutes: number};
-  type PolicyResult = {version: number; policy: SessionPolicy};
-  const factors: Record<string, number> = {minutes: 1, hours: 60, days: 1440};
-  const maxMinutes = Math.floor(Number.MAX_SAFE_INTEGER / 60_000);
-  let durations = $state<{key: keyof SessionPolicy; label: string; value: number | undefined; unit: string}[]>([
-    {key: 'idleTimeoutMinutes', label: 'session.idle', value: 30, unit: 'minutes'},
-    {key: 'absoluteTimeoutMinutes', label: 'session.absolute', value: 8, unit: 'hours'},
-  ]);
-  let policyVersion = $state<number | null>(null), savedPolicy = $state<SessionPolicy | null>(null);
-  let policyLoading = $state(true), policyBusy = $state(false), policyError = $state(''), policyDetail = $state(''), policySaved = $state(false);
-  let units = $derived(['minutes', 'hours', 'days'].map(unit => ({value: unit, label: t('session.' + unit)})));
-  let draftPolicy = $derived(Object.fromEntries(durations.map(field => [field.key, field.value === undefined ? NaN : field.value * factors[field.unit]!])) as SessionPolicy);
-  let validPolicy = $derived(durations.every(field => Number.isSafeInteger(field.value) && field.value! >= 0)
-    && Object.values(draftPolicy).every(value => Number.isSafeInteger(value) && value >= 0 && value <= maxMinutes));
-  let policyDirty = $derived(savedPolicy !== null && (draftPolicy.idleTimeoutMinutes !== savedPolicy.idleTimeoutMinutes || draftPolicy.absoluteTimeoutMinutes !== savedPolicy.absoluteTimeoutMinutes));
-  function applyPolicy(result: PolicyResult) {
-    policyVersion = result.version; savedPolicy = result.policy;
-    for (const field of durations) {
-      const minutes = result.policy[field.key];
-      field.unit = minutes > 0 && minutes % 1440 === 0 ? 'days' : minutes > 0 && minutes % 60 === 0 ? 'hours' : 'minutes';
-      field.value = minutes / factors[field.unit]!;
-    }
-  }
-  function policyFailure(e: unknown) {
-    const result = accountError(e); policyDetail = result.detail;
-    policyError = result.detail === 'version_conflict' ? 'session.conflict' : result.detail === 'invalid_session_policy' ? 'session.invalid' : 'session.failed';
-  }
-  async function loadPolicy() {
-    if (policyBusy) return;
-    policyLoading = true; policyError = ''; policyDetail = ''; policySaved = false;
-    try { applyPolicy(await requestPluginControl<PolicyResult>(pluginName, '/session-policy', 'GET')); }
-    catch (e) { policyFailure(e); }
-    finally { policyLoading = false; }
-  }
-  async function savePolicy(event: SubmitEvent) {
-    event.preventDefault(); if (policyBusy || policyLoading || policyVersion === null) return;
-    if (!validPolicy) { policyError = 'session.invalid'; return; }
-    policyBusy = true; policyError = ''; policyDetail = ''; policySaved = false;
-    try {
-      applyPolicy(await requestPluginControl<PolicyResult>(pluginName, '/session-policy', 'PUT', {version: policyVersion, policy: draftPolicy}));
-      policySaved = true;
-    } catch (e) { policyFailure(e); }
-    finally { policyBusy = false; }
-  }
-  function failure(e: unknown) { const result = accountError(e); error = result.key; detail = result.detail; }
-  onMount(() => { void requestPluginControl<{administrator: typeof administrator}>(pluginName, '/self', 'GET').then(result => { administrator = result.administrator; }).catch(failure).finally(() => { loading = false; }); });
-  onMount(() => { void loadPolicy(); });
-  async function change(event: SubmitEvent) {
-    event.preventDefault(); if (busy) return;
-    if (password !== confirmation) { failure(new Error('password_confirmation')); return; }
-    if ([...password].length < 6 || [...password].length > 64) { failure(new Error('invalid_password')); return; }
-    busy = true; error = ''; detail = '';
-    try { await requestPluginControl(pluginName, '/password', 'POST', {currentPassword,password,passwordConfirmation:confirmation}, undefined, {preserveSessionOnUnauthorized:true}); logout(); window.location.hash = '#/login'; }
-    catch(e) { failure(e); }
-    finally { currentPassword = ''; password = ''; confirmation = ''; busy = false; }
-  }
-  async function leave() {
-    if (busy) return; busy = true;
-    try { await requestPluginControl(pluginName, '/logout', 'POST'); logout(); window.location.hash = '#/login'; }
-    catch(e) { failure(e); } finally { busy = false; }
-  }
-</script>
-<div class="space-y-4" data-testid="management-auth-settings">
-  <PanelCard title={t('settings.accountTitle')} tag={t('settings.accountTag')}>
-    {#if loading}<LoadingIndicator label={t('settings.loading')} height="sm" />{:else if administrator}<p class="text-sm text-zinc-200">{administrator.username}</p><p class="text-sm text-zinc-400 mt-2">{t('settings.accountDescription')}</p>{/if}
-  </PanelCard>
-  <PanelCard title={t('session.title')} tag={t('session.tag')}>
-    <p class="text-sm text-zinc-400 mb-4">{t('session.description')}</p>
-    {#if policyLoading}<LoadingIndicator label={t('session.loading')} height="sm" />{:else}
-      <form class="space-y-3" onsubmit={savePolicy} aria-busy={policyBusy} data-testid="session-policy-form">
-        <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
-          {#each durations as field (field.key)}
-            <div class="grid gap-1 min-w-0">
-              <label class="nx-field-label" for={'session-' + field.key}>{t(field.label)}</label>
-              <div class="flex items-center gap-2">
-                <Input id={'session-' + field.key} type="number" min={0} max={Math.floor(maxMinutes / factors[field.unit]!)} step={1} required bind:value={field.value} disabled={policyBusy || policyVersion === null} class="min-w-0 flex-1" />
-                <BSelect bind:value={field.unit} options={units} ariaLabel={t(field.label) + ' · ' + t('session.unit')} width="6rem" disabled={policyBusy || policyVersion === null} />
-              </div>
-            </div>
-          {/each}
-        </div>
-        <p class="text-sm text-zinc-400">{t('session.browserNote')}</p>
-        <div class="flex flex-wrap gap-2">
-          <Button type="submit" disabled={policyBusy || policyVersion === null || !policyDirty || !validPolicy}>{policyBusy ? t('session.saving') : t('session.save')}</Button>
-          {#if policyError}<Button type="button" variant="ghost" onclick={loadPolicy} disabled={policyBusy}>{t('session.reload')}</Button>{/if}
-        </div>
-        {#if policySaved && !policyDirty}<p role="status" class="text-sm text-emerald-400">{t('session.saved')}</p>{/if}
-      </form>
-    {/if}
-    {#if policyError}<p role="alert" class="text-sm text-red-400 mt-3">{t(policyError)}</p><details class="text-sm text-zinc-400"><summary>{core('pluginActivation.technicalDetails')}</summary><pre class="whitespace-pre-wrap break-all">{policyDetail}</pre></details>{/if}
-  </PanelCard>
-  <PanelCard title={t('settings.passwordTitle')} tag={t('settings.passwordTag')}>
-    <p class="text-sm text-zinc-400 mb-4">{t('settings.passwordDescription')}</p>
-    <form class="space-y-3" onsubmit={change} aria-busy={busy}>
-      <label class="grid gap-1"><span class="nx-field-label">{t('settings.currentPassword')}</span><input class="nx-input" type="password" autocomplete="current-password" bind:value={currentPassword} required disabled={busy || !administrator} /></label>
-      <label class="grid gap-1"><span class="nx-field-label">{t('settings.newPassword')}</span><input class="nx-input" type="password" autocomplete="new-password" bind:value={password} required disabled={busy || !administrator} /></label>
-      <label class="grid gap-1"><span class="nx-field-label">{t('settings.confirmation')}</span><input class="nx-input" type="password" autocomplete="new-password" bind:value={confirmation} required disabled={busy || !administrator} /></label>
-      <div class="flex gap-2"><button class="nx-btn-primary" disabled={busy || !administrator}>{busy ? t('settings.updating') : t('settings.submit')}</button><button type="button" class="nx-btn-ghost" disabled={busy || !administrator} onclick={leave}>{t('settings.logout')}</button></div>
-    </form>
-    {#if error}<p role="alert" class="text-sm text-red-400 mt-3">{core(error)}</p><details class="text-sm text-zinc-400"><summary>{core('pluginActivation.technicalDetails')}</summary><pre class="whitespace-pre-wrap break-all">{detail}</pre></details>{/if}
-  </PanelCard>
-</div>