@jeffusion/bungee-core 5.7.0 → 5.8.0

package/dist/plugins/local-accounts/manifest.json

@@ -86,6 +86,28 @@
       "login.password": "密码",
       "login.busy": "正在建立登录会话…",
       "login.submit": "登录",
+      "login.technicalDetails": "技术详情",
+      "login.correctAddress": "使用正确地址：{origin}",
+      "login.errors.invalid_credentials": "账号或密码不正确。请重新输入。",
+      "login.errors.invalid_input": "账号格式不正确。账号名只允许字母、数字及 _ . @ -，长度为 1–64。",
+      "login.errors.forbidden": "当前登录请求无法完成。请刷新后重试。",
+      "login.errors.unauthorized": "登录会话未建立。请重新登录。",
+      "login.errors.invalid_origin": "当前访问地址与服务配置不匹配。请使用配置的公开地址登录，或请部署管理员调整公开地址。",
+      "login.errors.invalid_csrf": "当前会话或访问地址校验失败。请从配置的公开地址重新登录。",
+      "login.errors.login_limited": "登录尝试过多。请等待 15 分钟后重试。",
+      "login.errors.session_limit": "登录会话已达到上限。请退出不再使用的会话后重试。",
+      "login.errors.management_provider_unavailable": "账号服务暂时不可用。请检查服务状态，恢复后重试。",
+      "login.errors.provider_unavailable": "账号服务暂时不可用。请检查服务状态，恢复后重试。",
+      "login.errors.control_recovering": "账号服务正在恢复。请稍候重试。",
+      "login.errors.session_unavailable": "登录尚未完成。请检查连接后重试，或刷新管理访问状态。",
+      "login.errors.unknown": "登录未完成。请检查连接后重试。",
+      "recovery.summary": "忘记账号或密码？",
+      "recovery.intro": "请在部署服务器上恢复，网页不能直接重置管理员。",
+      "recovery.step1": "确认目标实例的配置数据库路径，停止该实例的全部进程并备份数据。",
+      "recovery.step2": "在原部署目录、使用原环境变量执行下面的命令，将数据库路径替换为实际绝对路径。",
+      "recovery.step3": "按提示输入新的账号和密码，然后重新启动实例。旧会话会失效，路由、服务及 API Key 保留。",
+      "recovery.docker": "Docker 部署：停止原容器后，使用同一镜像、原数据卷及环境变量启动临时交互容器，执行同一命令；完成后删除临时容器并启动原容器。请勿另建空数据卷。",
+      "recovery.note": "密码交互输入且不显示。若提示恢复失败，请确认实例已完全停止、路径及环境正确；旧版本存在多个管理员时需由部署人员处理。",
       "settings.accountTitle": "管理员账号",
       "settings.accountTag": "账号",
       "settings.passwordTag": "密码",
@@ -109,6 +131,28 @@
       "login.password": "Password",
       "login.busy": "Establishing a sign-in session…",
       "login.submit": "Sign in",
+      "login.technicalDetails": "Technical details",
+      "login.correctAddress": "Use the correct address: {origin}",
+      "login.errors.invalid_credentials": "Incorrect username or password. Enter your credentials again.",
+      "login.errors.invalid_input": "Invalid username. Use 1–64 characters containing letters, numbers, and _ . @ - only.",
+      "login.errors.forbidden": "This sign-in request could not be completed. Refresh and try again.",
+      "login.errors.unauthorized": "A sign-in session was not established. Sign in again.",
+      "login.errors.invalid_origin": "This address does not match the service configuration. Sign in at the configured public address, or ask the deployment administrator to update it.",
+      "login.errors.invalid_csrf": "Session or address verification failed. Sign in again at the configured public address.",
+      "login.errors.login_limited": "Too many sign-in attempts. Wait 15 minutes before trying again.",
+      "login.errors.session_limit": "The sign-in session limit has been reached. Sign out of unused sessions and try again.",
+      "login.errors.management_provider_unavailable": "The account service is temporarily unavailable. Check its status and try again after recovery.",
+      "login.errors.provider_unavailable": "The account service is temporarily unavailable. Check its status and try again after recovery.",
+      "login.errors.control_recovering": "The account service is recovering. Try again shortly.",
+      "login.errors.session_unavailable": "Sign-in has not completed. Check your connection and retry, or refresh management access status.",
+      "login.errors.unknown": "Sign-in did not complete. Check your connection and try again.",
+      "recovery.summary": "Forgot your username or password?",
+      "recovery.intro": "Recover access on the deployment server. The web page cannot reset the administrator directly.",
+      "recovery.step1": "Confirm the target instance’s configuration database path, stop all its processes, and back up the data.",
+      "recovery.step2": "Run the following command from the original deployment directory with the original environment variables. Replace the database path with its actual absolute path.",
+      "recovery.step3": "Enter a new username and password when prompted, then restart the instance. Old sessions will expire; routes, services, and API Keys will be retained.",
+      "recovery.docker": "For Docker deployments, stop the original container, start a temporary interactive container with the same image, original data volume, and environment variables, and run the same command. Afterwards, remove the temporary container and restart the original one. Do not create an empty data volume.",
+      "recovery.note": "Passwords are entered interactively and remain hidden. If recovery fails, confirm the instance is fully stopped and the path and environment are correct. Deployment staff must handle older versions with multiple administrators.",
       "settings.accountTitle": "Administrator account",
       "settings.accountTag": "Account",
       "settings.passwordTag": "Password",

package/dist/plugins/local-accounts/ui/Login.svelte

@@ -1,36 +1,47 @@
 <script lang="ts">
-  import { _, isLoading } from 'svelte-i18n';
-  import { getPluginText } from '$utils/plugin-i18n';
-  import { createEventDispatcher } from 'svelte';
-  import { api } from '$api/client';
-  import { readAuthMode } from '$api/auth';
-  import { token, csrfToken } from '$stores/auth';
-  import RecoveryHelp from '$components/domain/plugin/RecoveryHelp.svelte';
-  import { accountError, originMatches } from '$components/domain/plugin/activation-state';
-  const t = (key: string) => $isLoading ? '' : getPluginText(key, 'local-accounts', (id, options) => $_(id, options));
-  const core = (key: string, values: Record<string, string> = {}) => $isLoading ? '' : $_(key, { values });
-  let { endpoint = '/api/auth/login' }: {endpoint?: string} = $props();
-  const dispatch = createEventDispatcher();
-  let username = $state(''), password = $state(''), busy = $state(false), error = $state(''), detail = $state(''), publicOrigin = $state('');
+  import { onDestroy } from 'svelte';
+  import { isLoading } from 'svelte-i18n';
+  import { _, isManagementLoginStaleError, type ManagementLoginContext } from '@bungee/plugin-sdk';
+  import RecoveryHelp from './RecoveryHelp.svelte';
+  import { loginFailure, requireLoginSuccess } from './login-errors';
+
+  let { context }: { context: ManagementLoginContext } = $props();
+  const t = (key: string, values: Record<string, string> = {}) => $isLoading ? '' : $_(`plugins.local-accounts.${key}`, { values });
+  let username = $state(''), password = $state(''), busy = $state(false);
+  let error = $state(''), detail = $state('');
+  let destroyed = false;
+  onDestroy(() => { destroyed = true; });
+
   async function login(event: SubmitEvent) {
-    event.preventDefault(); if (busy) return;
+    event.preventDefault();
+    if (busy) return;
+    const activeContext = context;
     busy = true; error = ''; detail = '';
     try {
-      const mode = await readAuthMode(); publicOrigin = mode.publicOrigin ?? '';
-      if (!originMatches(mode.publicOrigin, window.location.origin)) throw new Error('invalid_origin');
-      token.set(null); csrfToken.set(null);
-      const result = await api.post(endpoint.replace(/^\/api/, ''), {username, password, transport:'cookie'}, {preserveSessionOnUnauthorized:true});
-      dispatch('login', result);
-    } catch (e) { const result = accountError(e); error = result.key; detail = result.detail; }
-    finally { password = ''; busy = false; }
+      const result = await activeContext.login({ username, password, transport: 'cookie' });
+      if (destroyed || context !== activeContext || result === undefined) return;
+      requireLoginSuccess(result);
+      await activeContext.complete();
+    } catch (cause) {
+      if (destroyed || context !== activeContext || isManagementLoginStaleError(cause)) return;
+      const failure = loginFailure(cause);
+      error = failure.key; detail = failure.detail;
+    } finally {
+      password = '';
+      if (!destroyed && context === activeContext) busy = false;
+    }
   }
 </script>
+
 <form onsubmit={login} aria-label={t('login.title')} aria-busy={busy} class="space-y-4">
-  <h2 class="font-mono text-sm text-zinc-100">{t('login.title')}</h2>
   <p class="text-sm text-zinc-400">{t('login.description')}</p>
   <label class="grid gap-1"><span class="nx-field-label">{t('login.username')}</span><input class="nx-input" bind:value={username} autocomplete="username" required maxlength="64" disabled={busy} /></label>
   <label class="grid gap-1"><span class="nx-field-label">{t('login.password')}</span><input class="nx-input" bind:value={password} type="password" autocomplete="current-password" required disabled={busy} /></label>
-  {#if error}<p role="alert" class="text-sm text-red-400">{core(error)}</p>{#if detail === 'invalid_origin' && publicOrigin}<a class="text-sm text-nexus-300 underline break-all" href={`${publicOrigin}/#/login`}>{core('pluginActivation.correctAddress', { origin: publicOrigin })}</a>{/if}<details class="text-sm text-zinc-400"><summary>{core('pluginActivation.technicalDetails')}</summary><pre class="whitespace-pre-wrap break-all">{detail}</pre></details>{/if}
+  {#if error}
+    <p role="alert" class="text-sm text-red-400">{t(error)}</p>
+    {#if detail === 'invalid_origin' && context.provider.publicOrigin}<a class="text-sm text-nexus-300 underline break-all" href={`${context.provider.publicOrigin}/#/login`}>{t('login.correctAddress', { origin: context.provider.publicOrigin })}</a>{/if}
+    <details class="text-sm text-zinc-400"><summary>{t('login.technicalDetails')}</summary><pre class="whitespace-pre-wrap break-all">{detail}</pre></details>
+  {/if}
   <RecoveryHelp />
   <button class="nx-btn-primary w-full justify-center" disabled={busy}>{busy ? t('login.busy') : t('login.submit')}</button>
 </form>

package/dist/plugins/local-accounts/ui/RecoveryHelp.svelte

@@ -0,0 +1,18 @@
+<script lang="ts">
+  import { isLoading } from 'svelte-i18n';
+  import { _ } from '@bungee/plugin-sdk';
+  const t = (key: string) => $isLoading ? '' : $_(`plugins.local-accounts.recovery.${key}`);
+</script>
+
+<details class="text-sm text-zinc-400 space-y-2">
+  <summary class="cursor-pointer text-nexus-300">{t('summary')}</summary>
+  <p>{t('intro')}</p>
+  <ol class="list-decimal pl-5 space-y-2">
+    <li>{t('step1')}</li>
+    <li>{t('step2')}</li>
+    <li>{t('step3')}</li>
+  </ol>
+  <code class="block border border-carbon-600 p-3 font-mono text-xs whitespace-pre-wrap break-all">bun packages/core/dist/main.js --recover-admin /path/to/data/bungee.db</code>
+  <p>{t('docker')}</p>
+  <p class="text-xs">{t('note')}</p>
+</details>

package/dist/plugins/local-accounts/ui/login-errors.test.ts

@@ -0,0 +1,22 @@
+import { expect, test } from 'bun:test';
+import { loginFailure, requireLoginSuccess } from './login-errors';
+import manifest from '../manifest.json';
+
+test('only explicit provider success can proceed to context completion', () => {
+  expect(() => requireLoginSuccess({ success: true })).not.toThrow();
+  for (const result of [null, undefined, true, {}, { success: 'true' }, { success: false }]) {
+    expect(() => requireLoginSuccess(result)).toThrow('login_failed');
+  }
+  expect(() => requireLoginSuccess({ success: false, error: 'invalid_credentials' })).toThrow('invalid_credentials');
+});
+
+test('credential errors are plugin-owned and translated in both locales', () => {
+  for (const code of ['invalid_credentials', 'invalid_input', 'forbidden', 'unauthorized', 'invalid_origin', 'invalid_csrf', 'login_limited', 'session_limit', 'management_provider_unavailable', 'provider_unavailable', 'control_recovering']) {
+    const failure = loginFailure(new Error(code));
+    expect(failure).toEqual({ key: `login.errors.${code}`, detail: code });
+    for (const messages of Object.values(manifest.translations)) expect(messages[failure.key as keyof typeof messages]).toBeTruthy();
+  }
+  expect(loginFailure(new Error('unrecognized')).key).toBe('login.errors.unknown');
+  const incomplete = new Error('management_login_initialization_failed'); incomplete.name = 'ManagementAuthenticationError';
+  expect(loginFailure(incomplete).key).toBe('login.errors.session_unavailable');
+});

package/dist/plugins/local-accounts/ui/login-errors.ts

@@ -0,0 +1,20 @@
+const loginCodes = new Set([
+  'invalid_credentials', 'invalid_input', 'forbidden', 'unauthorized', 'invalid_origin',
+  'invalid_csrf', 'login_limited', 'session_limit', 'management_provider_unavailable',
+  'provider_unavailable', 'control_recovering',
+]);
+
+/** Only the local account provider interprets its credential result. */
+export function requireLoginSuccess(result: unknown): void {
+  if (typeof result === 'object' && result !== null && 'success' in result && result.success === true) return;
+  const code = typeof result === 'object' && result !== null && 'error' in result && typeof result.error === 'string'
+    ? result.error : 'login_failed';
+  throw new Error(code);
+}
+
+export function loginFailure(error: unknown): { key: string; detail: string } {
+  const detail = error instanceof Error ? error.message : String(error);
+  const code = error instanceof Error && error.name === 'ManagementAuthenticationError'
+    ? 'session_unavailable' : loginCodes.has(detail) ? detail : 'unknown';
+  return { key: `login.errors.${code}`, detail };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee-core",
-  "version": "5.7.0",
+  "version": "5.8.0",
   "description": "Bungee reverse proxy core engine",
   "main": "./dist/main.js",
   "types": "./dist/main.d.ts",
@@ -12,7 +12,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@jeffusion/bungee-types": "^5.7.0",
+    "@jeffusion/bungee-types": "^5.8.0",
     "@types/lodash-es": "^4.17.12",
     "acorn": "^8.15.0",
     "canonicalize": "3.0.0",