@liujitcn/kratos-admin-core 0.0.29 → 0.0.32

package/dist/package/src/utils/request.ts

@@ -1,6 +1,6 @@
-import axios, { type InternalAxiosRequestConfig, type AxiosResponse, type AxiosError } from "axios";
+import axios, { type InternalAxiosRequestConfig, type AxiosResponse, type AxiosError, type AxiosRequestConfig } from "axios";
 import qs from "qs";
-import { ElMessage, ElMessageBox } from "element-plus";
+import { reactive } from "vue";
 import router from "../routers";
 import { LOGIN_URL } from "../config";
 import pinia from "../stores";
@@ -12,6 +12,11 @@ const apiTargetUrl = import.meta.env.VITE_API_URL || import.meta.env.VITE_APP_AP
 export const requestBaseURL = `${apiTargetUrl}${apiBasePath}`;
 const SESSION_URL = "/v1/base/session";
 const TOKEN_URL = "/v1/base/token";
+const REFRESH_EXPIRY_COOKIE = "kratos_refresh_exp";
+const REFRESH_TOKEN_TRANSPORT_HEADER = "X-Refresh-Token-Transport";
+const REFRESH_TOKEN_TRANSPORT_COOKIE = "cookie";
+const PASSWORD_CHANGE_REQUIRED_METADATA_KEY = "password_change_required";
+const PASSWORD_CHANGE_STATE_STORAGE_KEY = "admin-password-change-required";
 const CAPTCHA_URL = "/v1/base/captcha";
 const CONFIG_URL = "/v1/base/config";
 const LANGUAGE_URL = "/v1/base/language";
@@ -19,10 +24,10 @@ const PASSWORD_PUBLIC_KEY_URL = "/v1/base/password-public-key";
 const OAUTH_PROVIDER_URL = "/v1/base/oauth/provider";
 const OAUTH_AUTHORIZATION_URL = "/v1/base/oauth/authorization";
 const OAUTH_TICKET_URL = "/v1/base/oauth/ticket";
-const LEGACY_AUTH_URL = "/auth";
-const LEGACY_REFRESH_TOKEN_URL = `${LEGACY_AUTH_URL}/token`;
-const LEGACY_CAPTCHA_URL = "/login/captcha";
-// 认证公共接口不携带旧 token，同时保留旧路径兼容迁移期间的灰度访问。
+const MFA_VERIFY_URL = "/v1/base/mfa/verify";
+const MFA_ENROLLMENT_URL = "/v1/base/mfa/enrollment";
+const MFA_ENROLLMENT_CONFIRM_URL = "/v1/base/mfa/enrollment/confirm";
+// 认证公共接口不携带访问令牌。
 const NO_AUTH_URL_SET = new Set([
   SESSION_URL,
   TOKEN_URL,
@@ -33,9 +38,9 @@ const NO_AUTH_URL_SET = new Set([
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
-  LEGACY_AUTH_URL,
-  LEGACY_CAPTCHA_URL,
-  LEGACY_REFRESH_TOKEN_URL
+  MFA_VERIFY_URL,
+  MFA_ENROLLMENT_URL,
+  MFA_ENROLLMENT_CONFIRM_URL
 ]);
 const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   SESSION_URL,
@@ -47,9 +52,9 @@ const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
-  LEGACY_AUTH_URL,
-  LEGACY_REFRESH_TOKEN_URL,
-  LEGACY_CAPTCHA_URL
+  MFA_VERIFY_URL,
+  MFA_ENROLLMENT_URL,
+  MFA_ENROLLMENT_CONFIRM_URL
 ]);
 
 /** 支持自动重试的 Axios 请求配置。 */
@@ -58,19 +63,60 @@ type RetryableRequestConfig = InternalAxiosRequestConfig & {
   _authRetried?: boolean;
 };
 
+/** 统一的结构化错误响应。 */
+type ErrorResponseData = {
+  code?: string | number;
+  message?: string;
+  reason?: string;
+  metadata?: Record<string, string>;
+};
+
+/** 本地持久化的强制改密状态，仅包含非敏感的显示信息。 */
+interface PersistedPasswordChangeState {
+  /** 是否需要强制修改密码。 */
+  required: boolean;
+  /** 后端返回的提示文案。 */
+  message: string;
+}
+
+/** 读取刷新前保存的强制改密状态。 */
+function getPersistedPasswordChangeState(): PersistedPasswordChangeState {
+  const emptyState = { required: false, message: "" };
+  if (typeof window === "undefined") return emptyState;
+
+  try {
+    const value = window.localStorage.getItem(PASSWORD_CHANGE_STATE_STORAGE_KEY);
+    if (!value) return emptyState;
+    const parsed = JSON.parse(value) as unknown;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return emptyState;
+    const persisted = parsed as { message?: unknown };
+    return {
+      required: true,
+      message: typeof persisted.message === "string" ? persisted.message : ""
+    };
+  } catch {
+    return emptyState;
+  }
+}
+
+/** 强制改密弹窗状态。 */
+export const passwordChangeState = reactive(getPersistedPasswordChangeState());
+
 // 创建 axios 实例
 const service = axios.create({
   baseURL: requestBaseURL,
   timeout: 50000,
   headers: { "Content-Type": "application/json;charset=utf-8" },
-  paramsSerializer: params => qs.stringify(params)
+  paramsSerializer: params => qs.stringify(params),
+  withCredentials: true
 });
 
 // 刷新令牌请求使用独立实例，避免与主请求拦截器互相递归。
 const refreshService = axios.create({
   baseURL: requestBaseURL,
   timeout: 50000,
-  headers: { "Content-Type": "application/json;charset=utf-8" }
+  headers: { "Content-Type": "application/json;charset=utf-8" },
+  withCredentials: true
 });
 
 /** 获取用户状态仓库 */
@@ -83,6 +129,9 @@ function shouldSkipAuth(config: InternalAxiosRequestConfig) {
   if (config.headers.Authorization === "no-auth") return true;
 
   const requestUrl = config.url ?? "";
+  const requestMethod = String(config.method ?? "").toLowerCase();
+  // 登录请求会显式声明 no-auth，登出请求则必须带访问令牌让服务端清理会话和刷新令牌。
+  if (requestUrl === SESSION_URL && requestMethod === "delete") return false;
   return NO_AUTH_URL_SET.has(requestUrl);
 }
 
@@ -100,7 +149,57 @@ function shouldSkipErrorMessage(config?: InternalAxiosRequestConfig) {
 
   const requestUrl = config.url ?? "";
   const requestMethod = String(config.method ?? "").toLowerCase();
-  return (requestUrl === SESSION_URL || requestUrl === LEGACY_AUTH_URL) && requestMethod === "delete";
+  return requestUrl === SESSION_URL && requestMethod === "delete";
+}
+
+/** 判断响应是否要求用户先修改密码。 */
+function isPasswordChangeRequired(data?: ErrorResponseData) {
+  return data?.metadata?.[PASSWORD_CHANGE_REQUIRED_METADATA_KEY] === "true";
+}
+
+/** 判断最近是否已经处理过强制改密响应。 */
+function isPasswordChangeRequiredPromptActive() {
+  return passwordChangePromptUntil > Date.now();
+}
+
+/** 处理强制改密响应，避免并发请求重复提示并打开全局改密弹窗。 */
+export function handlePasswordChangeRequired(message: string) {
+  if (isPasswordChangeRequiredPromptActive()) return;
+  passwordChangePromptUntil = Date.now() + 10 * 1000;
+  passwordChangeState.required = true;
+  passwordChangeState.message = message;
+  persistPasswordChangeState();
+}
+
+/** 清理强制改密弹窗状态。 */
+export function clearPasswordChangeRequired() {
+  passwordChangeState.required = false;
+  passwordChangeState.message = "";
+  passwordChangePromptUntil = 0;
+  persistPasswordChangeState();
+}
+
+/** 持久化或删除强制改密状态，兼容浏览器禁用本地存储的场景。 */
+function persistPasswordChangeState() {
+  if (typeof window === "undefined") return;
+
+  try {
+    if (passwordChangeState.required) {
+      window.localStorage.setItem(
+        PASSWORD_CHANGE_STATE_STORAGE_KEY,
+        JSON.stringify({ message: passwordChangeState.message })
+      );
+    } else {
+      window.localStorage.removeItem(PASSWORD_CHANGE_STATE_STORAGE_KEY);
+    }
+  } catch {
+    // 本地存储不可用时仍保留当前页面内的响应式状态。
+  }
+}
+
+/** 统一展示请求错误，合并并发请求产生的相同提示。 */
+function showRequestError(message: string) {
+  ElMessage.error({ message, grouping: true });
 }
 
 /** 读取访问令牌过期时间 */
@@ -108,6 +207,15 @@ function getTokenExpiresAt() {
   return getUserStore().tokenExpiresAt;
 }
 
+/** 判断浏览器是否存在非敏感的刷新令牌过期提示。 */
+function hasRefreshCookieHint() {
+  if (typeof document === "undefined") return false;
+  const item = document.cookie.split(";").find(value => value.trim().startsWith(`${REFRESH_EXPIRY_COOKIE}=`));
+  if (!item) return false;
+  const expiresAt = Number(item.split("=")[1]);
+  return Number.isFinite(expiresAt) && expiresAt * 1000 > Date.now();
+}
+
 /** 判断当前访问令牌是否仍在有效期内。 */
 export function hasValidAccessToken() {
   const userStore = getUserStore();
@@ -117,7 +225,13 @@ export function hasValidAccessToken() {
 /** 读取最新可用访问令牌，必要时先串行刷新，供 axios、fetch 与 SSE 共用。 */
 export async function getRequestAccessToken(): Promise<string> {
   const userStore = getUserStore();
-  if (!userStore.token && userStore.refreshToken) {
+  if (userStore.isLoggingOut) {
+    return userStore.token.trim();
+  }
+  if (userStore.authInvalidated) {
+    return "";
+  }
+  if (!userStore.token && hasRefreshCookieHint()) {
     await handleTokenRefresh(false);
   }
 
@@ -132,12 +246,15 @@ export async function getRequestAccessToken(): Promise<string> {
 
 /** 尝试通过刷新令牌恢复访问令牌，供路由守卫进入页面前调用。 */
 export async function ensureAccessToken() {
+  const userStore = getUserStore();
+  if (userStore.isLoggingOut || userStore.authInvalidated) {
+    return false;
+  }
   if (hasValidAccessToken()) {
     return true;
   }
 
-  const userStore = getUserStore();
-  if (!userStore.refreshToken) {
+  if (!hasRefreshCookieHint()) {
     return false;
   }
 
@@ -152,6 +269,7 @@ export async function ensureAccessToken() {
 
 // 防止并发 401 重复弹出认证失效确认框。
 let isHandlingAuthExpired = false;
+let passwordChangePromptUntil = 0;
 
 /** 统一处理认证失效 */
 export function handleAuthExpired() {
@@ -171,6 +289,7 @@ export function handleAuthExpired() {
       const userStore = getUserStore();
       const currentRoute = router.currentRoute.value;
       const redirect = currentRoute.path === LOGIN_URL ? undefined : currentRoute.fullPath;
+      clearPasswordChangeRequired();
       userStore.clearAuthData();
       return router.replace({
         path: LOGIN_URL,
@@ -188,7 +307,8 @@ service.interceptors.request.use(
     const skipAuth = shouldSkipAuth(config);
     const accessToken = skipAuth ? "" : await getRequestAccessToken();
     Object.assign(config.headers, getLocaleRequestHeaders());
-    // 登录、验证码、刷新令牌接口不携带旧 token，避免请求头污染。
+    config.headers[REFRESH_TOKEN_TRANSPORT_HEADER] = REFRESH_TOKEN_TRANSPORT_COOKIE;
+    // 登录、验证码、刷新令牌接口不携带访问令牌，避免请求头污染。
     if (!skipAuth && accessToken) {
       config.headers.Authorization = accessToken;
     } else {
@@ -207,24 +327,30 @@ service.interceptors.response.use(
       return response;
     }
 
-    const { code, message, reason, metadata } = response.data;
+    const responseData = response.data as ErrorResponseData;
+    const { code, message, reason, metadata } = responseData;
     if (code === undefined || message === undefined || reason === undefined || metadata === undefined) {
       return response.data;
     }
 
-    ElMessage.error(message || t("common.message.system_error"));
-    return Promise.reject(new Error(message || "Error"));
+    if (isPasswordChangeRequired(responseData)) {
+      handlePasswordChangeRequired(message || t("common.message.system_error"));
+    } else {
+      showRequestError(message || t("common.message.system_error"));
+    }
+    return Promise.reject(new Error(message || t("common.message.system_error")));
   },
   async (error: AxiosError) => {
     const status = error.response?.status;
-    const data = error.response?.data as { code?: string | number; message?: string } | undefined;
+    const data = error.response?.data as ErrorResponseData | undefined;
     const code = data?.code;
     const message = data?.message;
     const requestConfig = error.config as RetryableRequestConfig | undefined;
 
     // 业务请求仅在 401 时尝试刷新并重放，403 直接展示后端权限错误。
     if ((status === 401 || code === 401) && !shouldSkipAuthExpiredPrompt(requestConfig)) {
-      if (requestConfig && !requestConfig._authRetried && getUserStore().refreshToken) {
+      const userStore = getUserStore();
+      if (requestConfig && !requestConfig._authRetried && !userStore.isLoggingOut && !userStore.authInvalidated && hasRefreshCookieHint()) {
         requestConfig._authRetried = true;
         try {
           await handleTokenRefresh(false);
@@ -237,20 +363,27 @@ service.interceptors.response.use(
       handleAuthExpired();
     } else if (data) {
       if (!shouldSkipErrorMessage(requestConfig)) {
-        if (message) {
-          ElMessage.error(message);
+        if (isPasswordChangeRequired(data)) {
+          handlePasswordChangeRequired(message || t("common.message.system_error"));
+        } else if (message) {
+          showRequestError(message);
         } else {
-          ElMessage.error(t("common.message.system_error"));
+          showRequestError(t("common.message.system_error"));
         }
       }
     } else if (!shouldSkipErrorMessage(requestConfig)) {
-      ElMessage.error(error.message || t("common.message.system_error"));
+      showRequestError(error.message || t("common.message.system_error"));
     }
     return Promise.reject(error.message);
   }
 );
 
-export default service;
+/** 以请求体、响应体顺序提供带类型约束的 HTTP 请求函数。 */
+function request<Request = unknown, Response = unknown>(config: AxiosRequestConfig<Request>): Promise<Response> {
+  return service<Response, Response, Request>(config) as Promise<Response>;
+}
+
+export default request;
 
 // 刷新 Token 的锁
 let isRefreshing = false;
@@ -282,20 +415,22 @@ async function handleTokenRefresh(promptOnFailure = true) {
 /** 调用刷新令牌接口并回写最新认证信息 */
 async function refreshAccessToken() {
   const userStore = getUserStore();
-  if (!userStore.refreshToken) {
-    return Promise.reject(new Error(t("core.auth.refresh_token_missing")));
-  }
+  const authVersion = userStore.authVersion;
 
   const response = await refreshService.post(
     TOKEN_URL,
-    { refresh_token: userStore.refreshToken },
-    { headers: { Authorization: "no-auth", ...getLocaleRequestHeaders() } }
+    {},
+    {
+      headers: {
+        Authorization: "no-auth",
+        [REFRESH_TOKEN_TRANSPORT_HEADER]: REFRESH_TOKEN_TRANSPORT_COOKIE,
+        ...getLocaleRequestHeaders()
+      }
+    }
   );
   const data = response.data;
-  userStore.updateTokenAuth(
-    data.access_token,
-    data.refresh_token ?? userStore.refreshToken,
-    data.token_type ?? "",
-    data.expires_in
-  );
+  if (userStore.authVersion !== authVersion || userStore.isLoggingOut || userStore.authInvalidated) {
+    return;
+  }
+  userStore.updateTokenAuth(data.access_token, data.token_type ?? "", data.expires_in);
 }

package/dist/package/src/utils/tenant.ts

@@ -1,4 +1,4 @@
-import { defBaseTenantService } from "../api/system/base_tenant";
+import { defBaseTenantService } from "../api/system/admin/v1/base_tenant";
 
 /** 默认租户编码。 */
 export const DEFAULT_TENANT_CODE = "0000";

package/dist/package/src/utils/utils.ts

@@ -28,13 +28,32 @@ export function formatSrc(src: string) {
   }
 
   const configuredBase = String(import.meta.env.VITE_APP_STATIC_URL ?? "").trim();
-  if (value.startsWith("/admin/")) {
-    return new URL(value, `${window.location.origin}/`).toString();
-  }
-
   const staticBase = configuredBase
     ? new URL(`${configuredBase.replace(/\/$/, "")}/`, `${window.location.origin}/`).toString()
-    : `${window.location.origin}/admin/`;
-  const normalizedPath = value.replace(/^\/+/, "").replace(/^admin\/+/, "");
+    : `${window.location.origin}/`;
+  const normalizedPath = normalizeStaticAssetPath(value).replace(/^\/+/, "");
   return new URL(normalizedPath, staticBase).toString();
 }
+
+/** 将对象路径转换为统一的数据访问路径。 */
+export function normalizeStaticAssetPath(src: string) {
+  const value = String(src ?? "");
+  if (value.startsWith("http://") || value.startsWith("https://")) {
+    return value;
+  }
+  if (value.startsWith("/data/") || value.startsWith("/admin/")) return value;
+  if (value.startsWith("data/")) return `/${value}`;
+  return value;
+}
+
+/** 将富文本中的媒体路径转换为统一的数据访问路径。 */
+export function normalizeRichTextMediaPaths(html: string) {
+  if (typeof DOMParser === "undefined") return html;
+
+  const document = new DOMParser().parseFromString(html, "text/html");
+  document.body.querySelectorAll<HTMLElement>("img[src], video[src]").forEach(element => {
+    const src = element.getAttribute("src");
+    if (src) element.setAttribute("src", normalizeStaticAssetPath(src));
+  });
+  return document.body.innerHTML;
+}

package/dist/package/src/utils/webauthn.ts

@@ -0,0 +1,90 @@
+import { t } from "../locales";
+
+/** WebAuthn 选项使用的 Base64URL 编解码。 */
+function decodeBase64Url(value: string): ArrayBuffer {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes.buffer;
+}
+
+/** 将 WebAuthn 二进制响应编码为服务端协议使用的 Base64URL。 */
+function encodeBase64Url(value: ArrayBuffer | Uint8Array): string {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  bytes.forEach(byte => {
+    binary += String.fromCharCode(byte);
+  });
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+/** 将服务端返回的 WebAuthn 创建选项转换为浏览器类型。 */
+function parseCreationOptions(optionsJson: string): PublicKeyCredentialCreationOptions {
+  const options = JSON.parse(optionsJson) as { publicKey: PublicKeyCredentialCreationOptions };
+  const publicKey = options.publicKey;
+  publicKey.challenge = decodeBase64Url(publicKey.challenge as unknown as string);
+  publicKey.user.id = decodeBase64Url(publicKey.user.id as unknown as string);
+  publicKey.excludeCredentials = publicKey.excludeCredentials?.map(item => ({
+    ...item,
+    id: decodeBase64Url(item.id as unknown as string)
+  }));
+  return publicKey;
+}
+
+/** 将服务端返回的 WebAuthn 断言选项转换为浏览器类型。 */
+function parseRequestOptions(optionsJson: string): PublicKeyCredentialRequestOptions {
+  const options = JSON.parse(optionsJson) as { publicKey: PublicKeyCredentialRequestOptions };
+  const publicKey = options.publicKey;
+  publicKey.challenge = decodeBase64Url(publicKey.challenge as unknown as string);
+  publicKey.allowCredentials = publicKey.allowCredentials?.map(item => ({
+    ...item,
+    id: decodeBase64Url(item.id as unknown as string)
+  }));
+  return publicKey;
+}
+
+/** 将 PublicKeyCredential 序列化为可提交给服务端的 JSON。 */
+function serializeCredential(credential: PublicKeyCredential): string {
+  const response = credential.response;
+  const serializedResponse: Record<string, unknown> = {
+    clientDataJSON: encodeBase64Url(response.clientDataJSON)
+  };
+  const payload: Record<string, unknown> = {
+    id: credential.id,
+    rawId: encodeBase64Url(credential.rawId),
+    type: credential.type,
+    response: serializedResponse,
+    clientExtensionResults: credential.getClientExtensionResults()
+  };
+  if ("attestationObject" in response) {
+    const attestation = response as AuthenticatorAttestationResponse;
+    serializedResponse.attestationObject = encodeBase64Url(attestation.attestationObject);
+  } else {
+    const assertion = response as AuthenticatorAssertionResponse;
+    Object.assign(serializedResponse, {
+      authenticatorData: encodeBase64Url(assertion.authenticatorData),
+      signature: encodeBase64Url(assertion.signature),
+      userHandle: assertion.userHandle ? encodeBase64Url(assertion.userHandle) : null
+    });
+  }
+  if (credential.authenticatorAttachment) payload.authenticatorAttachment = credential.authenticatorAttachment;
+  return JSON.stringify(payload);
+}
+
+/** 执行 WebAuthn 注册 ceremony。 */
+export async function createWebAuthnCredential(optionsJson: string): Promise<string> {
+  if (!navigator.credentials?.create) throw new Error(t("core.login.mfa_webauthn_setup_unsupported"));
+  const credential = await navigator.credentials.create({ publicKey: parseCreationOptions(optionsJson) });
+  if (!(credential instanceof PublicKeyCredential)) throw new Error(t("core.login.mfa_webauthn_setup_invalid"));
+  return serializeCredential(credential);
+}
+
+/** 执行 WebAuthn 登录 ceremony。 */
+export async function getWebAuthnAssertion(optionsJson: string): Promise<string> {
+  if (!navigator.credentials?.get) throw new Error(t("core.login.mfa_webauthn_login_unsupported"));
+  const credential = await navigator.credentials.get({ publicKey: parseRequestOptions(optionsJson) });
+  if (!(credential instanceof PublicKeyCredential)) throw new Error(t("core.login.mfa_webauthn_login_invalid"));
+  return serializeCredential(credential);
+}