@liujitcn/kratos-admin-core 0.0.28 → 0.0.31

package/dist/package/src/stores/interface/index.ts

@@ -59,6 +59,20 @@ export interface UserState {
   userInfo: UserInfoForm;
 }
 
+/** 当前管理端锁屏状态。 */
+export interface LockScreenState {
+  /** 是否处于锁屏状态。 */
+  isLocked: boolean;
+  /** 当前锁屏密码的摘要，仅在锁屏期间持久化。 */
+  passwordHash: string;
+  /** 是否显示设置锁屏密码界面。 */
+  setupVisible: boolean;
+  /** 是否显示解锁输入界面。 */
+  unlockVisible: boolean;
+  /** 最近一次解锁是否失败。 */
+  unlockError: boolean;
+}
+
 /** 标签页菜单项状态。 */
 export interface TabsMenuProps {
   icon: string;
@@ -100,5 +114,5 @@ export interface SiteConfigState {
   /** 当前登录验证码配置 */
   captcha: LoginCaptchaConfig;
   /** 是否允许显式生成机器翻译草稿。 */
-  translationDraftEnabled: boolean;
+  i18nDraftEnabled: boolean;
 }

package/dist/package/src/stores/modules/config.ts

@@ -6,7 +6,7 @@ import defaultLogoUrl from "../../assets/images/logo.svg";
 import defaultBackgroundUrl from "../../assets/images/login_left.png";
 
 const CAPTCHA_TYPE_KEY = "captchaType";
-const TRANSLATION_DRAFT_ENABLED_KEY = "i18n.translation_draft.enabled";
+const I18N_DRAFT_ENABLED_KEY = "i18n.draft.enabled";
 
 const DEFAULT_SITE_DISPLAY_CONFIG: SiteDisplayConfig = {
   sysName: "Admin",
@@ -78,7 +78,7 @@ export const useConfigStore = defineStore("admin-config", {
   state: (): SiteConfigState => ({
     display: { ...DEFAULT_SITE_DISPLAY_CONFIG },
     captcha: { ...DEFAULT_LOGIN_CAPTCHA_CONFIG },
-    translationDraftEnabled: false
+    i18nDraftEnabled: false
   }),
   getters: {},
   actions: {
@@ -103,7 +103,7 @@ export const useConfigStore = defineStore("admin-config", {
     resetDisplayConfig() {
       this.display = { ...DEFAULT_SITE_DISPLAY_CONFIG };
       this.captcha = { ...DEFAULT_LOGIN_CAPTCHA_CONFIG };
-      this.translationDraftEnabled = false;
+      this.i18nDraftEnabled = false;
     },
     /**
      * 加载管理端站点配置，并以服务端返回值覆盖本地默认值。
@@ -116,7 +116,7 @@ export const useConfigStore = defineStore("admin-config", {
 
       this.setDisplayConfig(normalizeSiteDisplayConfig(configMap));
       this.setLoginCaptchaConfig(normalizeLoginCaptchaConfig(configMap));
-      this.translationDraftEnabled = configMap[TRANSLATION_DRAFT_ENABLED_KEY] === "true";
+      this.i18nDraftEnabled = configMap[I18N_DRAFT_ENABLED_KEY] === "true";
       return this.display;
     }
   }

package/dist/package/src/stores/modules/lockScreen.ts

@@ -0,0 +1,78 @@
+import { defineStore } from "pinia";
+import type { LockScreenState } from "../../stores/interface";
+import piniaPersistConfig from "../../stores/helper/persist";
+
+/** 将锁屏密码转换为不可逆摘要，避免在本地持久化明文密码。 */
+async function hashPassword(password: string): Promise<string> {
+  const data = new TextEncoder().encode(password);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, "0")).join("");
+}
+
+/** 管理端锁屏状态仓库。 */
+export const useLockScreenStore = defineStore("admin-lock-screen", {
+  state: (): LockScreenState => ({
+    isLocked: false,
+    passwordHash: "",
+    setupVisible: false,
+    unlockVisible: false,
+    unlockError: false
+  }),
+  getters: {
+    /** 当前是否已配置可用于解锁的密码。 */
+    isConfigured: state => Boolean(state.passwordHash)
+  },
+  actions: {
+    /** 打开锁屏密码设置界面。 */
+    openSetup() {
+      this.setupVisible = true;
+      this.unlockVisible = false;
+      this.unlockError = false;
+    },
+    /** 关闭锁屏密码设置界面。 */
+    closeSetup() {
+      this.setupVisible = false;
+    },
+    /** 设置锁屏密码并立即进入锁屏状态。 */
+    async lock(password: string) {
+      this.passwordHash = await hashPassword(password);
+      this.isLocked = true;
+      this.setupVisible = false;
+      this.unlockVisible = false;
+      this.unlockError = false;
+    },
+    /** 打开锁屏解锁输入界面。 */
+    openUnlock() {
+      this.unlockVisible = true;
+      this.unlockError = false;
+    },
+    /** 返回锁屏首页。 */
+    closeUnlock() {
+      this.unlockVisible = false;
+      this.unlockError = false;
+    },
+    /** 校验锁屏密码，成功后解除当前锁定。 */
+    async unlock(password: string): Promise<boolean> {
+      const passwordHash = await hashPassword(password);
+      if (!this.passwordHash || passwordHash !== this.passwordHash) {
+        this.unlockError = true;
+        return false;
+      }
+
+      this.isLocked = false;
+      this.passwordHash = "";
+      this.unlockVisible = false;
+      this.unlockError = false;
+      return true;
+    },
+    /** 清理锁屏状态，供退出登录时使用。 */
+    clearLock() {
+      this.isLocked = false;
+      this.passwordHash = "";
+      this.setupVisible = false;
+      this.unlockVisible = false;
+      this.unlockError = false;
+    }
+  },
+  persist: piniaPersistConfig("admin-lock-screen", ["isLocked", "passwordHash"])
+});

package/dist/package/src/stores/modules/user.ts

@@ -1,11 +1,14 @@
 import { defineStore } from "pinia";
 import { defAuthService } from "../../api/system/auth";
 import { defLoginService } from "../../api/base/login";
-import type { LoginRequest } from "../../rpc/base/v1/login";
+import { defMfaService } from "../../api/base/mfa";
+import type { LoginRequest, LoginResponse } from "../../rpc/base/v1/login";
+import type { VerifyMfaRequest } from "../../rpc/base/v1/mfa";
 import type { UserInfoForm } from "../../rpc/system/admin/v1/auth";
 import { UserState } from "../../stores/interface";
 import piniaPersistConfig from "../../stores/helper/persist";
 import { useDictStoreHook } from "../../stores/modules/dict";
+import { useLockScreenStore } from "../../stores/modules/lockScreen";
 import { t } from "../../locales";
 
 const defaultUserInfo: UserInfoForm = {
@@ -65,9 +68,18 @@ export const useUserStore = defineStore("admin-user", {
       return Boolean(this.token.trim() && this.tokenExpiresAt > Date.now());
     },
     /** 登录 */
-    async login(loginRequest: LoginRequest) {
+    async login(loginRequest: LoginRequest): Promise<LoginResponse> {
       const data = await defLoginService.Login(loginRequest);
+      if (data.status === 1 || data.status === 0 || data.status === 4) {
+        this.updateTokenAuth(data.access_token, data.refresh_token ?? "", data.token_type ?? "", data.expires_in);
+      }
+      return data;
+    },
+    /** 校验登录阶段的多因素认证并保存正式令牌。 */
+    async verifyMfa(request: VerifyMfaRequest): Promise<LoginResponse> {
+      const data = await defMfaService.VerifyMfa(request);
       this.updateTokenAuth(data.access_token, data.refresh_token ?? "", data.token_type ?? "", data.expires_in);
+      return data;
     },
     /** 刷新认证令牌 */
     async refreshAccessToken() {
@@ -89,6 +101,7 @@ export const useUserStore = defineStore("admin-user", {
     clearAuthData() {
       // 清理登录态时同步清空字典缓存，避免切换账号后读到旧字典。
       useDictStoreHook().clearDictionaryCache();
+      useLockScreenStore().clearLock();
       this.setToken("");
       this.setRefreshToken("");
       this.setTokenType("");
@@ -106,5 +119,5 @@ export const useUserStore = defineStore("admin-user", {
       }
     }
   },
-  persist: piniaPersistConfig("admin-user")
+  persist: piniaPersistConfig("admin-user", ["token", "tokenType", "tokenExpiresAt", "userInfo"])
 });

package/dist/package/src/stores/runtime.ts

@@ -1,5 +1,6 @@
 export { useAuthStore } from "./modules/auth";
 export { useConfigStore } from "./modules/config";
 export { useGlobalStore } from "./modules/global";
+export { useLockScreenStore } from "./modules/lockScreen";
 export { useTabsStore } from "./modules/tabs";
 export { useUserStore } from "./modules/user";

package/dist/package/src/utils/clipboard.ts

@@ -0,0 +1,22 @@
+/** 将文本复制到系统剪贴板，并兼容非安全上下文的管理端开发地址。 */
+export async function copyText(content: string): Promise<void> {
+  if (typeof navigator !== "undefined" && navigator.clipboard && typeof window !== "undefined" && window.isSecureContext) {
+    try {
+      await navigator.clipboard.writeText(content);
+      return;
+    } catch {
+      // Clipboard API 受权限限制时继续尝试传统 DOM 方案。
+    }
+  }
+  if (typeof document === "undefined") throw new Error("copy failed");
+  const textarea = document.createElement("textarea");
+  textarea.value = content;
+  textarea.style.position = "fixed";
+  textarea.style.opacity = "0";
+  document.body.appendChild(textarea);
+  textarea.focus();
+  textarea.select();
+  const copied = document.execCommand("copy");
+  document.body.removeChild(textarea);
+  if (!copied) throw new Error("copy failed");
+}

package/dist/package/src/utils/request.ts

@@ -1,6 +1,5 @@
 import axios, { type InternalAxiosRequestConfig, type AxiosResponse, type AxiosError } from "axios";
 import qs from "qs";
-import { ElMessage, ElMessageBox } from "element-plus";
 import router from "../routers";
 import { LOGIN_URL } from "../config";
 import pinia from "../stores";
@@ -12,6 +11,7 @@ const apiTargetUrl = import.meta.env.VITE_API_URL || import.meta.env.VITE_APP_AP
 export const requestBaseURL = `${apiTargetUrl}${apiBasePath}`;
 const SESSION_URL = "/v1/base/session";
 const TOKEN_URL = "/v1/base/token";
+const REFRESH_EXPIRY_COOKIE = "kratos_refresh_exp";
 const CAPTCHA_URL = "/v1/base/captcha";
 const CONFIG_URL = "/v1/base/config";
 const LANGUAGE_URL = "/v1/base/language";
@@ -19,6 +19,9 @@ const PASSWORD_PUBLIC_KEY_URL = "/v1/base/password-public-key";
 const OAUTH_PROVIDER_URL = "/v1/base/oauth/provider";
 const OAUTH_AUTHORIZATION_URL = "/v1/base/oauth/authorization";
 const OAUTH_TICKET_URL = "/v1/base/oauth/ticket";
+const MFA_VERIFY_URL = "/v1/base/mfa/verify";
+const MFA_ENROLLMENT_URL = "/v1/base/mfa/enrollment";
+const MFA_ENROLLMENT_CONFIRM_URL = "/v1/base/mfa/enrollment/confirm";
 const LEGACY_AUTH_URL = "/auth";
 const LEGACY_REFRESH_TOKEN_URL = `${LEGACY_AUTH_URL}/token`;
 const LEGACY_CAPTCHA_URL = "/login/captcha";
@@ -33,6 +36,9 @@ const NO_AUTH_URL_SET = new Set([
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
+  MFA_VERIFY_URL,
+  MFA_ENROLLMENT_URL,
+  MFA_ENROLLMENT_CONFIRM_URL,
   LEGACY_AUTH_URL,
   LEGACY_CAPTCHA_URL,
   LEGACY_REFRESH_TOKEN_URL
@@ -47,6 +53,9 @@ const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
+  MFA_VERIFY_URL,
+  MFA_ENROLLMENT_URL,
+  MFA_ENROLLMENT_CONFIRM_URL,
   LEGACY_AUTH_URL,
   LEGACY_REFRESH_TOKEN_URL,
   LEGACY_CAPTCHA_URL
@@ -70,7 +79,8 @@ const service = axios.create({
 const refreshService = axios.create({
   baseURL: requestBaseURL,
   timeout: 50000,
-  headers: { "Content-Type": "application/json;charset=utf-8" }
+  headers: { "Content-Type": "application/json;charset=utf-8" },
+  withCredentials: true
 });
 
 /** 获取用户状态仓库 */
@@ -108,6 +118,15 @@ function getTokenExpiresAt() {
   return getUserStore().tokenExpiresAt;
 }
 
+/** 判断浏览器是否存在非敏感的刷新令牌过期提示。 */
+function hasRefreshCookieHint() {
+  if (typeof document === "undefined") return false;
+  const item = document.cookie.split(";").find(value => value.trim().startsWith(`${REFRESH_EXPIRY_COOKIE}=`));
+  if (!item) return false;
+  const expiresAt = Number(item.split("=")[1]);
+  return Number.isFinite(expiresAt) && expiresAt * 1000 > Date.now();
+}
+
 /** 判断当前访问令牌是否仍在有效期内。 */
 export function hasValidAccessToken() {
   const userStore = getUserStore();
@@ -117,7 +136,7 @@ export function hasValidAccessToken() {
 /** 读取最新可用访问令牌，必要时先串行刷新，供 axios、fetch 与 SSE 共用。 */
 export async function getRequestAccessToken(): Promise<string> {
   const userStore = getUserStore();
-  if (!userStore.token && userStore.refreshToken) {
+  if (!userStore.token && (userStore.refreshToken || hasRefreshCookieHint())) {
     await handleTokenRefresh(false);
   }
 
@@ -137,7 +156,7 @@ export async function ensureAccessToken() {
   }
 
   const userStore = getUserStore();
-  if (!userStore.refreshToken) {
+  if (!userStore.refreshToken && !hasRefreshCookieHint()) {
     return false;
   }
 
@@ -213,7 +232,7 @@ service.interceptors.response.use(
     }
 
     ElMessage.error(message || t("common.message.system_error"));
-    return Promise.reject(new Error(message || "Error"));
+    return Promise.reject(new Error(message || t("common.message.system_error")));
   },
   async (error: AxiosError) => {
     const status = error.response?.status;
@@ -224,7 +243,7 @@ service.interceptors.response.use(
 
     // 业务请求仅在 401 时尝试刷新并重放，403 直接展示后端权限错误。
     if ((status === 401 || code === 401) && !shouldSkipAuthExpiredPrompt(requestConfig)) {
-      if (requestConfig && !requestConfig._authRetried && getUserStore().refreshToken) {
+      if (requestConfig && !requestConfig._authRetried && (getUserStore().refreshToken || hasRefreshCookieHint())) {
         requestConfig._authRetried = true;
         try {
           await handleTokenRefresh(false);
@@ -282,13 +301,10 @@ async function handleTokenRefresh(promptOnFailure = true) {
 /** 调用刷新令牌接口并回写最新认证信息 */
 async function refreshAccessToken() {
   const userStore = getUserStore();
-  if (!userStore.refreshToken) {
-    return Promise.reject(new Error(t("core.auth.refresh_token_missing")));
-  }
 
   const response = await refreshService.post(
     TOKEN_URL,
-    { refresh_token: userStore.refreshToken },
+    { refresh_token: userStore.refreshToken || undefined },
     { headers: { Authorization: "no-auth", ...getLocaleRequestHeaders() } }
   );
   const data = response.data;

package/dist/package/src/utils/webauthn.ts

@@ -0,0 +1,90 @@
+import { t } from "../locales";
+
+/** WebAuthn 选项使用的 Base64URL 编解码。 */
+function decodeBase64Url(value: string): ArrayBuffer {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes.buffer;
+}
+
+/** 将 WebAuthn 二进制响应编码为服务端协议使用的 Base64URL。 */
+function encodeBase64Url(value: ArrayBuffer | Uint8Array): string {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  bytes.forEach(byte => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+/** 将服务端返回的 WebAuthn 创建选项转换为浏览器类型。 */
+function parseCreationOptions(optionsJson: string): PublicKeyCredentialCreationOptions {
+  const options = JSON.parse(optionsJson) as { publicKey: PublicKeyCredentialCreationOptions };
+  const publicKey = options.publicKey;
+  publicKey.challenge = decodeBase64Url(publicKey.challenge as unknown as string);
+  publicKey.user.id = decodeBase64Url(publicKey.user.id as unknown as string);
+  publicKey.excludeCredentials = publicKey.excludeCredentials?.map(item => ({
+    ...item,
+    id: decodeBase64Url(item.id as unknown as string)
+  }));
+  return publicKey;
+}
+
+/** 将服务端返回的 WebAuthn 断言选项转换为浏览器类型。 */
+function parseRequestOptions(optionsJson: string): PublicKeyCredentialRequestOptions {
+  const options = JSON.parse(optionsJson) as { publicKey: PublicKeyCredentialRequestOptions };
+  const publicKey = options.publicKey;
+  publicKey.challenge = decodeBase64Url(publicKey.challenge as unknown as string);
+  publicKey.allowCredentials = publicKey.allowCredentials?.map(item => ({
+    ...item,
+    id: decodeBase64Url(item.id as unknown as string)
+  }));
+  return publicKey;
+}
+
+/** 将 PublicKeyCredential 序列化为可提交给服务端的 JSON。 */
+function serializeCredential(credential: PublicKeyCredential): string {
+  const response = credential.response;
+  const serializedResponse: Record<string, unknown> = {
+    clientDataJSON: encodeBase64Url(response.clientDataJSON)
+  };
+  const payload: Record<string, unknown> = {
+    id: credential.id,
+    rawId: encodeBase64Url(credential.rawId),
+    type: credential.type,
+    response: serializedResponse,
+    clientExtensionResults: credential.getClientExtensionResults()
+  };
+  if ("attestationObject" in response) {
+    const attestation = response as AuthenticatorAttestationResponse;
+    serializedResponse.attestationObject = encodeBase64Url(attestation.attestationObject);
+  } else {
+    const assertion = response as AuthenticatorAssertionResponse;
+    Object.assign(serializedResponse, {
+      authenticatorData: encodeBase64Url(assertion.authenticatorData),
+      signature: encodeBase64Url(assertion.signature),
+      userHandle: assertion.userHandle ? encodeBase64Url(assertion.userHandle) : null
+    });
+  }
+  if (credential.authenticatorAttachment) payload.authenticatorAttachment = credential.authenticatorAttachment;
+  return JSON.stringify(payload);
+}
+
+/** 执行 WebAuthn 注册 ceremony。 */
+export async function createWebAuthnCredential(optionsJson: string): Promise<string> {
+  if (!navigator.credentials?.create) throw new Error(t("core.login.mfa_webauthn_setup_unsupported"));
+  const credential = await navigator.credentials.create({ publicKey: parseCreationOptions(optionsJson) });
+  if (!(credential instanceof PublicKeyCredential)) throw new Error(t("core.login.mfa_webauthn_setup_invalid"));
+  return serializeCredential(credential);
+}
+
+/** 执行 WebAuthn 登录 ceremony。 */
+export async function getWebAuthnAssertion(optionsJson: string): Promise<string> {
+  if (!navigator.credentials?.get) throw new Error(t("core.login.mfa_webauthn_login_unsupported"));
+  const credential = await navigator.credentials.get({ publicKey: parseRequestOptions(optionsJson) });
+  if (!(credential instanceof PublicKeyCredential)) throw new Error(t("core.login.mfa_webauthn_login_invalid"));
+  return serializeCredential(credential);
+}