@lark-apaas/auth-sdk 0.1.0-alpha.7 → 0.1.0-alpha.71

package/README.md

@@ -12,9 +12,11 @@ yarn add @lark-apaas/auth-sdk
 
 ## 快速开始
 
+### 模版接入
+
 ```tsx
 import React from 'react';
-import { AuthProvider, Can, useAuthAbility } from '@lark-apaas/auth-sdk';
+import { AuthProvider, CanRole, useAuthAbility } from '@lark-apaas/auth-sdk';
 
 export default function App() {
   return (
@@ -31,23 +33,75 @@ export default function App() {
     </AuthProvider>
   );
 }
+```
+
+
+### 开发组件 - 使用 CanRole 组件
+
+```tsx
+import { CanRole } from '@lark-apaas/auth-sdk';
+
+function Home() {
+  return (
+    <div>
+      <CanRole roles={['role_admin']}>
+        <div>管理员按钮</div>
+      </CanRole>
+      <CanRole roles={['role_admin', 'role_editor']}>
+        <div>编辑按钮</div>
+      </CanRole>
+    </div>
+  );
+}
+```
+
+### 开发组件 - 使用 AbilityContext 处理复杂场景
+
+```tsx
+import { useContext } from 'react';
+import { AbilityContext, ROLE_SUBJECT } from '@lark-apaas/auth-sdk';
 
 function Home() {
-  const ability = useAuthAbility();
+  const ability = useContext(AbilityContext);
   return (
     <div>
-      <Can I="admin" a="@role">
+      {ability.can('role_admin', ROLE_SUBJECT) || ability.can('role_editor', ROLE_SUBJECT) ? (
         <div>可见的仪表盘</div>
-      </Can>
-      <button disabled={ability.cannot('reader', '@role')}>创建任务</button>
+      ) : null}
     </div>
   );
 }
 ```
 
+### 开发组件 - 见 Client Toolkit
+
 ---
 
-## 核心 API
+## 核心 API - 面向 Agent
+
+### CanRole 组件 (推荐)
+
+- **作用**: 条件渲染，只有当角色 id 包含在 `roles` 中时才渲染子内容。
+
+```tsx
+<CanRole roles={['role_admin', 'role_editor']}>
+  <button>删除任务</button>
+</CanRole>
+```
+
+### AbilityContext 提供原子化的权限判断能力
+
+- **作用**: 从 React 上下文获取 CASL `Ability` 实例，使用 `ability.can(action, subject)` 做权限判断。
+
+```tsx
+import { useContext } from 'react';
+import { AbilityContext } from '@lark-apaas/auth-sdk';
+
+const ability = useContext(AbilityContext);
+const canCreate = ability.can('role_editor', '@role');
+```
+
+## 核心 API - 面向接入方
 
 ### AuthProvider
 
@@ -63,6 +117,7 @@ function Home() {
   - `children: React.ReactNode`
 
 示例：
+
 ```tsx
 <AuthProvider config={{
   enable: true,
@@ -72,37 +127,7 @@ function Home() {
 </AuthProvider>
 ```
 
-### useAuth
-
-- **作用**: 访问权限状态与方法。
-- **返回**:
-  - `ability: Ability` CASL `Ability` 实例
-  - `isLoading: boolean` 是否正在加载权限数据
-  - `error: Error | null` 最近一次加载错误（如果有）
-  - `fetchPermissions(userId?: string): Promise<void>` 手动拉取权限数据
-
-```tsx
-const { ability, isLoading, error, fetchPermissions } = useAuth();
-```
-
-### useAuthAbility
-
-- **作用**: 获取 CASL `Ability` 实例，使用 `ability.can(action, subject)` 做任意判断。
-
-```tsx
-const ability = useAuthAbility();
-const canCreate = ability.can('Editor', '@role');
-```
-
-### Can 组件
-
-- **作用**: 条件渲染，只有当 `I` 对 `a` 可操作时才渲染子内容。 `a` 为资源类型，需要保证为 `@role`。
-
-```tsx
-<Can I="Editor" a="@role">
-  <button>删除任务</button>
-</Can>
-```
+## 核心 API - 面向 SDK 开发者
 
 ### PermissionClient
 
@@ -141,54 +166,15 @@ updateAbility(ability, { permissions: [{ id: 'p1', name: 'Task Read', sub: 'Task
 ## 类型与再导出
 
 - 从本包导出的类型：`PermissionApiResponse`、`PermissionApiConfig`、`AuthSdkConfig`、`CaslRule`。
-- 便捷再导出：`MongoAbility`, `AbilityBuilder`, `AbilityClass`（来自 `@casl/ability`）。
 - 最终用户代码中仅需要使用到的 API 有：
-  - `useAuthAbility`: 获取 CASL `Ability` 实例，用于权限判断。
-  - `Can` 组件: 条件渲染，只有当 `I` 对 `a` 可操作时才渲染子内容。 `a` 为资源类型，需要保证为 `@role`。
-  - `ROLE_SUBJECT`: 特殊 subject `@role`，用于角色判断。
-  - `useAuth`: 获取权限接口的状态，配合 `fetchPermissions` 手动拉取权限数据。
-
+  - `CanRole` 组件: 条件渲染，只有当角色 id 包含在 `roles` 中时才渲染子内容。
+  - `AbilityContext`: 从 React 上下文获取 CASL `Ability` 实例，用于权限判断。
+  - `ROLE_SUBJECT`: 特殊 subject `@role` 常量，用于角色判断。
 
 ## 集成建议与最佳实践
 
-- **直接使用组件**：`Can` 组件是直接使用的主要入口，可以使用 `useAuthAbility` 在特殊场景下手动判断权限。
-- **错误处理**：实现 `onError` 上报或提示；`onSuccess` 可做埋点。
-- **渲染时机**：根据 `useAuth()` 的 `isLoading`/`error` 渲染 Loading/Error 页，避免闪烁。
-- **与路由结合**：页面级的访问控制需要结合路由库（如 `react-router-dom`）和 `useAuthAbility` hook 来自行实现。
-
----
-
-## 进阶示例
-
-### 菜单按权限过滤
-
-```tsx
-import { useAuthAbility } from '@lark-apaas/auth-sdk';
-
-const menus = [
-  { name: 'Dashboard', path: '/dashboard', p: { action: 'Editor', subject: '@role' } },
-  { name: 'Users', path: '/users', p: { action: 'Admin', subject: '@role' } },
-  { name: 'Settings', path: '/settings', p: { action: 'Admin', subject: '@role' } },
-];
-
-function Nav() {
-  const ability = useAuthAbility();
-  return (
-    <nav>
-      {menus.map(m => ability.can(m.p.action, m.p.subject) && (
-        <a key={m.path} href={m.path}>{m.name}</a>
-      ))}
-    </nav>
-  );
-}
-```
-
----
-
-## 常见问题（FAQ）
-
-- **如何做角色判断？** 角色被映射为对特殊 subject `@role` 的 action。你可以使用 `ability.can('admin_role', '@role')` 来判断当前用户是否拥有 `admin_role` 角色。
-- **如何实现路由守卫？** 您需要结合您使用的路由库（如 `react-router-dom`）和 `useAuthAbility` hook 来手动实现路由守卫。通过在路由渲染前检查权限，然后决定是否渲染组件或重定向。
+- **直接使用组件**：`CanRole` 组件是直接使用的主要入口，可以使用 `AbilityContext` 获取 `Ability` 实例，在特殊场景下手动判断权限。
+- **与路由结合**：页面级的访问控制需要结合路由库（如 `react-router-dom`）和 `AbilityContext` 来自行实现。
 
 ---
 

package/lib/AuthProvider.d.ts

@@ -11,6 +11,7 @@ export declare const AbilityContext: React.Context<MongoAbility<import("@casl/ab
  */
 interface AuthStateContextValue {
     ability: MongoAbility;
+    permissions: string[];
     isLoading: boolean;
     error: Error | null;
     fetchPermissions: (userId?: string) => Promise<void>;
@@ -33,10 +34,9 @@ export interface AuthProviderProps {
  *
  * function App() {
  *   return (
- *     <AuthProvider userId="user-123" config={{
+ *     <AuthProvider config={{
  *       permissionApi: {
- *         baseUrl: 'http://localhost:3000',
- *         endpoint: '/mock-api/users/:userId/permissions'
+ *         url: '/app/app_xxx/__runtime__/api/v1/permissions/roles',
  *       }
  *     }}>
  *       <YourApp />
@@ -46,6 +46,13 @@ export interface AuthProviderProps {
  * ```
  */
 export declare function AuthProvider({ children, config }: AuthProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * 获取 Ability 实例
+ *
+ * @param permissionApiConfig - 权限 API 配置
+ * @returns Ability 实例或错误
+ */
+export declare function getAbility(permissionApiConfig: AuthSdkConfig['permissionApi']): Promise<Error | MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>>;
 /**
  * useAuth Hook - 获取权限数据和加载状态
  *
@@ -104,6 +111,9 @@ export declare function useAuthAbility(): MongoAbility;
  * ```
  */
 export declare const Can: React.FunctionComponent<import("@casl/react").BoundCanProps<MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>>>;
+export declare const useCanRole: ({ roles }: {
+    roles: string[];
+}) => boolean;
 /**
  * CanRole Component - 基于 Ability 实例的角色条件渲染组件
  *
@@ -113,16 +123,49 @@ export declare const Can: React.FunctionComponent<import("@casl/react").BoundCan
  *
  * function MyComponent() {
  *   return (
- *     <CanRole I="Admin">
+ *     <CanRole roles={['role_admin', 'role_editor']}>
  *       <TaskList />
  *     </CanRole>
  *   );
  * }
  * ```
  */
-export declare const CanRole: ({ children, I, }: {
+export declare function CanRole({ children, roles, }: {
+    children: React.ReactNode;
+    roles: string[];
+}): import("react/jsx-runtime").JSX.Element | null;
+/**
+ * useUserPermissions Hook - 获取当前用户的权限点位列表
+ */
+export declare function useUserPermissions(): string[];
+/**
+ * useCanPermission Hook - 判断用户是否拥有指定权限点位
+ *
+ * @param permissions - 需要检查的权限点位列表
+ * @param match - 匹配模式：'any' 任一匹配即可，'all' 需要全部匹配
+ */
+export declare function useCanPermission(permissions: string[], match?: 'any' | 'all'): boolean;
+/**
+ * CanPermission Component - 基于权限点位的条件渲染组件
+ *
+ * @example
+ * ```tsx
+ * import { CanPermission } from '@lark-apaas/auth-sdk';
+ *
+ * function MyComponent() {
+ *   return (
+ *     <CanPermission permissions={['task:create', 'task:edit']} match="any">
+ *       <TaskEditor />
+ *     </CanPermission>
+ *   );
+ * }
+ * ```
+ */
+export declare function CanPermission({ children, permissions, match, fallback, }: {
     children: React.ReactNode;
-    I: string;
-}) => import("react/jsx-runtime").JSX.Element;
+    permissions: string[];
+    match?: 'any' | 'all';
+    fallback?: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAMN,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAK7C;;GAEG;AACH,eAAO,MAAM,cAAc,uGAE1B,CAAC;AAEF;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAOD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,iBAAiB,2CA2DnE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,OAAO,IAAI,qBAAqB,CAQ/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,IAAI,YAAY,CAE7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,GAAG,sJAA+C,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,OAAO,GAAI,kBAGrB;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,CAAC,EAAE,MAAM,CAAC;CACX,4CAIA,CAAC"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAMN,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAK7C;;GAEG;AACH,eAAO,MAAM,cAAc,uGAE1B,CAAC;AAOF;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAOD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,iBAAiB,2CA4EnE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,mBAAmB,EAAE,aAAa,CAAC,eAAe,CAAC,2GAmBpD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,OAAO,IAAI,qBAAqB,CAQ/C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,IAAI,YAAY,CAE7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,GAAG,sJAA+C,CAAC;AAEhE,eAAO,MAAM,UAAU,GAAa,WAAW;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,KAAG,OASpE,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CAAC,EACtB,QAAQ,EACR,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,kDAIA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAK,GAAG,KAAa,GAC3B,OAAO,CAOT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,WAAW,EACX,KAAa,EACb,QAAe,GAChB,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACtB,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,2CAGA"}

package/lib/AuthProvider.js

@@ -1,26 +1,34 @@
-import { jsx } from "react/jsx-runtime";
+import { Fragment, jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useContext, useEffect, useState } from "react";
-import { ROLE_SUBJECT, createAbility, updateAbility } from "./ability-factory.js";
+import { ROLE_SUBJECT, createAbility } from "./ability-factory.js";
 import { PermissionClient } from "./permission-client.js";
 import { createContextualCan } from "@casl/react";
 const AbilityContext = /*#__PURE__*/ createContext(createAbility({
     permissions: [],
     roles: []
 }));
+const PermissionsContext = /*#__PURE__*/ createContext([]);
 const AuthStateContext = /*#__PURE__*/ createContext(null);
 function AuthProvider({ children, config }) {
-    const [ability] = useState(()=>createAbility({}));
+    const [ability, setAbility] = useState(()=>createAbility({}));
+    const [permissions, setPermissions] = useState([]);
     const [isLoading, setIsLoading] = useState(false);
     const [error, setError] = useState(null);
-    const [client] = useState(()=>new PermissionClient(config?.permissionApi));
+    const [client] = useState(()=>config?.permissionApi ? new PermissionClient(config.permissionApi) : null);
     const fetchPermissions = useCallback(async ()=>{
+        if (!client) return;
         setIsLoading(true);
         setError(null);
         try {
             const data = await client.fetchPermissions();
-            updateAbility(ability, {
+            const newAbility = createAbility({
                 roles: data.roles
             });
+            setAbility(newAbility);
+            if (config?.permissionPointsApi) try {
+                const userPermissions = await client.fetchUserPermissions(config.permissionPointsApi);
+                setPermissions(userPermissions);
+            } catch  {}
             config?.onSuccess?.(data);
         } catch (err) {
             const error = err instanceof Error ? err : new Error(String(err));
@@ -30,7 +38,6 @@ function AuthProvider({ children, config }) {
             setIsLoading(false);
         }
     }, [
-        ability,
         client,
         config
     ]);
@@ -42,18 +49,36 @@ function AuthProvider({ children, config }) {
     ]);
     const stateContextValue = {
         ability,
+        permissions,
         isLoading,
         error,
         fetchPermissions
     };
     return /*#__PURE__*/ jsx(AbilityContext.Provider, {
         value: ability,
-        children: /*#__PURE__*/ jsx(AuthStateContext.Provider, {
-            value: stateContextValue,
-            children: children
+        children: /*#__PURE__*/ jsx(PermissionsContext.Provider, {
+            value: permissions,
+            children: /*#__PURE__*/ jsx(AuthStateContext.Provider, {
+                value: stateContextValue,
+                children: children
+            })
         })
     });
 }
+async function getAbility(permissionApiConfig) {
+    if (!permissionApiConfig) return new Error('permissionApi config is required');
+    const client = new PermissionClient(permissionApiConfig);
+    try {
+        const data = await client.fetchPermissions();
+        const ability = createAbility({
+            roles: data.roles
+        });
+        return ability;
+    } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        return error;
+    }
+}
 function useAuth() {
     const context = useContext(AuthStateContext);
     if (!context) throw new Error('useAuth must be used within an AuthProvider');
@@ -63,9 +88,34 @@ function useAuthAbility() {
     return useContext(AbilityContext);
 }
 const Can = createContextualCan(AbilityContext.Consumer);
-const CanRole = ({ children, I })=>/*#__PURE__*/ jsx(Can, {
-        I: I,
-        a: ROLE_SUBJECT,
+const useCanRole = function({ roles }) {
+    const ability = useContext(AbilityContext);
+    const allowed = !roles || 0 === roles.length || roles.length > 0 && roles.some((role)=>ability.can(role, ROLE_SUBJECT));
+    return !!allowed;
+};
+function CanRole({ children, roles }) {
+    const allowed = useCanRole({
+        roles
+    });
+    return allowed ? /*#__PURE__*/ jsx(Fragment, {
+        children: children
+    }) : null;
+}
+function useUserPermissions() {
+    return useContext(PermissionsContext);
+}
+function useCanPermission(permissions, match = 'any') {
+    const userPermissions = useContext(PermissionsContext);
+    if (!permissions || 0 === permissions.length) return true;
+    const permSet = new Set(userPermissions);
+    return 'all' === match ? permissions.every((p)=>permSet.has(p)) : permissions.some((p)=>permSet.has(p));
+}
+function CanPermission({ children, permissions, match = 'any', fallback = null }) {
+    const allowed = useCanPermission(permissions, match);
+    return allowed ? /*#__PURE__*/ jsx(Fragment, {
         children: children
+    }) : /*#__PURE__*/ jsx(Fragment, {
+        children: fallback
     });
-export { AbilityContext, AuthProvider, Can, CanRole, useAuth, useAuthAbility };
+}
+export { AbilityContext, AuthProvider, Can, CanPermission, CanRole, getAbility, useAuth, useAuthAbility, useCanPermission, useCanRole, useUserPermissions };

package/lib/index.d.ts

@@ -7,6 +7,7 @@
 export type { PermissionApiResponse, PermissionApiConfig, AuthSdkConfig, } from './types';
 export { ROLE_SUBJECT } from './ability-factory';
 export { PermissionClient } from './permission-client';
-export { AuthProvider, useAuth, useAuthAbility, Can, AbilityContext, } from './AuthProvider';
+export { AuthProvider, useAuth, CanRole, AbilityContext, useUserPermissions, useCanPermission, CanPermission, } from './AuthProvider';
+export { CanPermission as CanPerm } from './AuthProvider';
 export type { AuthProviderProps } from './AuthProvider';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACd,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EACL,YAAY,EACZ,OAAO,EACP,cAAc,EACd,GAAG,EACH,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACd,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EACL,YAAY,EACZ,OAAO,EACP,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/index.js

@@ -1,4 +1,4 @@
 import { ROLE_SUBJECT } from "./ability-factory.js";
 import { PermissionClient } from "./permission-client.js";
-import { AbilityContext, AuthProvider, Can, useAuth, useAuthAbility } from "./AuthProvider.js";
-export { AbilityContext, AuthProvider, Can, PermissionClient, ROLE_SUBJECT, useAuth, useAuthAbility };
+import { AbilityContext, AuthProvider, CanPermission, CanRole, useAuth, useCanPermission, useUserPermissions } from "./AuthProvider.js";
+export { AbilityContext, AuthProvider, CanPermission as CanPerm, CanPermission, CanRole, PermissionClient, ROLE_SUBJECT, useAuth, useCanPermission, useUserPermissions };

package/lib/permission-client.d.ts

@@ -4,11 +4,15 @@ import type { PermissionApiConfig, PermissionApiResponse } from './types';
  */
 export declare class PermissionClient {
     private config;
-    constructor(config?: PermissionApiConfig);
+    constructor(config: PermissionApiConfig);
     /**
      * 获取用户权限数据
      */
     fetchPermissions(): Promise<PermissionApiResponse>;
+    /**
+     * 获取用户权限点位列表
+     */
+    fetchUserPermissions(config: PermissionApiConfig): Promise<string[]>;
     /**
      * 更新配置
      */

package/lib/permission-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-client.d.ts","sourceRoot":"","sources":["../src/permission-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAU1E;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,CAAC,EAAE,mBAAmB;IAOxC;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAyDxD;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI;IAOxD;;OAEG;IACH,SAAS,IAAI,mBAAmB;CAGjC"}
+{"version":3,"file":"permission-client.d.ts","sourceRoot":"","sources":["../src/permission-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAG1E;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,EAAE,mBAAmB;IAIvC;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAoDxD;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4C1E;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI;IAOxD;;OAEG;IACH,SAAS,IAAI,mBAAmB;CAGjC"}

package/lib/permission-client.js

@@ -1,22 +1,14 @@
-const DEFAULT_CONFIG = {
-    baseUrl: '',
-    timeout: 5000
-};
+import { slardar } from "@lark-apaas/internal-slardar";
 class PermissionClient {
     constructor(config){
-        this.config = {
-            ...DEFAULT_CONFIG,
-            ...config
-        };
+        this.config = config;
     }
     async fetchPermissions() {
-        const { timeout = DEFAULT_CONFIG.timeout, headers = {} } = this.config;
-        const { appId } = window;
-        if (!appId) throw new Error('appId is required');
-        const url = `/spark/app/${appId}/runtime/api/v1/permissions/roles`;
+        const { url, timeout = 5000, headers = {} } = this.config;
         const requestHeaders = {
+            ...headers,
             'Content-Type': 'application/json',
-            ...headers
+            'X-Suda-Csrf-Token': window.csrfToken || ''
         };
         const controller = new AbortController();
         const timeoutId = setTimeout(()=>controller.abort(), timeout);
@@ -36,7 +28,43 @@ class PermissionClient {
             };
         } catch (error) {
             clearTimeout(timeoutId);
-            if (error instanceof Error && 'AbortError' === error.name) throw new Error(`Permission API request timeout after ${timeout}ms`);
+            if (error instanceof Error && 'AbortError' === error.name) {
+                slardar.captureException(error, {
+                    source: 'auth-sdk',
+                    type: 'timeout'
+                });
+                throw new Error(`Permission API request timeout after ${timeout}ms`);
+            }
+            slardar.captureException(error, {
+                source: 'auth-sdk',
+                type: 'fetch'
+            });
+            throw error;
+        }
+    }
+    async fetchUserPermissions(config) {
+        const { url, timeout = 5000, headers = {} } = config;
+        const requestHeaders = {
+            ...headers,
+            'Content-Type': 'application/json',
+            'X-Suda-Csrf-Token': window.csrfToken || ''
+        };
+        const controller = new AbortController();
+        const timeoutId = setTimeout(()=>controller.abort(), timeout);
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: requestHeaders,
+                signal: controller.signal,
+                credentials: 'include'
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) throw new Error(`Permissions API returned ${response.status}: ${response.statusText}`);
+            const data = await response.json();
+            return data.data?.permissions || [];
+        } catch (error) {
+            clearTimeout(timeoutId);
+            if (error instanceof Error && 'AbortError' === error.name) throw new Error(`Permissions API request timeout after ${timeout}ms`);
             throw error;
         }
     }

package/lib/types.d.ts

@@ -1,3 +1,10 @@
+declare global {
+    interface Window {
+        appId?: string;
+        csrfToken?: string;
+        userID?: string;
+    }
+}
 /**
  * 权限操作类型
  */
@@ -28,6 +35,8 @@ export interface UserRole {
  */
 export interface PermissionApiResponse {
     roles: string[];
+    /** 用户的有效权限点位列表 */
+    permissions?: string[];
     fetchedAt?: string | Date;
 }
 /**
@@ -35,10 +44,9 @@ export interface PermissionApiResponse {
  */
 export interface PermissionApiConfig {
     /**
-     * API 基础 URL
-     * @default ''
+     * 权限接口完整 URL，由上层注入，不在 SDK 内部硬编码
      */
-    baseUrl?: string;
+    url: string;
     /**
      * 请求超时时间（毫秒）
      * @default 5000
@@ -57,6 +65,11 @@ export interface AuthSdkConfig {
      * 权限 API 配置
      */
     permissionApi?: PermissionApiConfig;
+    /**
+     * 权限点位 API 配置（可选）
+     * 配置后 AuthProvider 会额外请求用户的有效权限点位
+     */
+    permissionPointsApi?: PermissionApiConfig;
     /**
      * 是否在初始化时使用获取权限
      * @default false

package/lib/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,MAAM,GACd,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;CACF;AAED;;GAEG;AACH,MAAM,MAAM,MAAM,GACd,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/auth-sdk",
-  "version": "0.1.0-alpha.7",
+  "version": "0.1.0-alpha.71",
   "description": "基于 CASL 的前端鉴权 SDK",
   "types": "./lib/index.d.ts",
   "main": "./lib/index.js",
@@ -15,11 +15,13 @@
   "scripts": {
     "build": "rslib build",
     "dev": "rslib build --watch",
-    "type-check": "tsc --noEmit"
+    "type-check": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@casl/ability": "^6.7.1",
-    "@casl/react": "^4.0.0"
+    "@casl/ability": "^6.7.5",
+    "@casl/react": "^5.0.0",
+    "@lark-apaas/internal-slardar": "^0.0.3"
   },
   "devDependencies": {
     "@rsbuild/core": "~1.4.13",