@liujitcn/kratos-admin-core 0.0.31 → 0.0.33

package/dist/package/src/rpc/system/admin/v1/common.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/admin/v1/common.proto
 

package/dist/package/src/rpc/system/common/v1/common.ts

@@ -0,0 +1,35 @@
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v2.12.1
+//   protoc               unknown
+// source: system/common/v1/common.proto
+
+/* eslint-disable */
+
+/** 系统公共用户相关枚举。 */
+export enum BaseUserIDType {
+  /** BASE_USER_ID_TYPE_UNSPECIFIED - 未指定证件类型。 */
+  BASE_USER_ID_TYPE_UNSPECIFIED = 0,
+  /** BASE_USER_ID_TYPE_ID_CARD - 居民身份证。 */
+  BASE_USER_ID_TYPE_ID_CARD = 1,
+  /** BASE_USER_ID_TYPE_PASSPORT - 护照。 */
+  BASE_USER_ID_TYPE_PASSPORT = 2,
+  /** BASE_USER_ID_TYPE_HK_MACAO_PERMIT - 港澳居民来往内地通行证。 */
+  BASE_USER_ID_TYPE_HK_MACAO_PERMIT = 3,
+  /** BASE_USER_ID_TYPE_TAIWAN_PERMIT - 台湾居民来往大陆通行证。 */
+  BASE_USER_ID_TYPE_TAIWAN_PERMIT = 4,
+  /** BASE_USER_ID_TYPE_FOREIGN_PERMANENT_RESIDENCE - 外国人永久居留身份证。 */
+  BASE_USER_ID_TYPE_FOREIGN_PERMANENT_RESIDENCE = 5,
+  /** BASE_USER_ID_TYPE_OTHER - 其他证件。 */
+  BASE_USER_ID_TYPE_OTHER = 6,
+}
+
+/** 用户密码修改状态。 */
+export enum BaseUserPasswordChangeStatus {
+  /** BASE_USER_PASSWORD_CHANGE_STATUS_UNSPECIFIED - 未指定密码修改状态。 */
+  BASE_USER_PASSWORD_CHANGE_STATUS_UNSPECIFIED = 0,
+  /** BASE_USER_PASSWORD_CHANGE_STATUS_REQUIRED - 当前必须修改密码。 */
+  BASE_USER_PASSWORD_CHANGE_STATUS_REQUIRED = 1,
+  /** BASE_USER_PASSWORD_CHANGE_STATUS_NOT_REQUIRED - 当前无需修改密码。 */
+  BASE_USER_PASSWORD_CHANGE_STATUS_NOT_REQUIRED = 2,
+}

package/dist/package/src/stores/interface/index.ts

@@ -53,9 +53,14 @@ export interface GlobalState {
 /** 当前登录用户认证状态。 */
 export interface UserState {
   token: string;
-  refreshToken: string;
   tokenType: string;
   tokenExpiresAt: number;
+  /** 是否正在执行退出登录，阻止后台请求刷新令牌。 */
+  isLoggingOut: boolean;
+  /** 认证状态版本，用于丢弃退出期间完成的旧刷新请求。 */
+  authVersion: number;
+  /** 当前认证是否已被本地显式清理。 */
+  authInvalidated: boolean;
   userInfo: UserInfoForm;
 }
 

package/dist/package/src/stores/modules/auth.ts

@@ -1,5 +1,5 @@
 import { defineStore } from "pinia";
-import { defAuthService } from "../../api/system/auth";
+import { defAuthService } from "../../api/system/admin/v1/auth";
 import { AuthState } from "../../stores/interface";
 import { getFlatMenuList, getShowMenuList, getAllBreadcrumbList, isExternalPath } from "../../utils";
 import type { RouteItem } from "../../rpc/system/admin/v1/auth";

package/dist/package/src/stores/modules/config.ts

@@ -1,5 +1,5 @@
 import { defineStore } from "pinia";
-import { defConfigService } from "../../api/base/config";
+import { defConfigService } from "../../api/base/v1/config";
 import { BaseConfigSite } from "../../rpc/base/v1/config";
 import type { LoginCaptchaConfig, SiteConfigState, SiteDisplayConfig } from "../../stores/interface";
 import defaultLogoUrl from "../../assets/images/logo.svg";
@@ -9,7 +9,7 @@ const CAPTCHA_TYPE_KEY = "captchaType";
 const I18N_DRAFT_ENABLED_KEY = "i18n.draft.enabled";
 
 const DEFAULT_SITE_DISPLAY_CONFIG: SiteDisplayConfig = {
-  sysName: "Admin",
+  sysName: import.meta.env.VITE_GLOB_APP_TITLE,
   icp: "",
   copyright: "2026 © Admin",
   watermark: "Admin",

package/dist/package/src/stores/modules/dict.ts

@@ -1,6 +1,6 @@
 import { defineStore } from "pinia";
 import pinia from "../../stores";
-import { defBaseDictService } from "../../api/system/base_dict";
+import { defBaseDictService } from "../../api/system/admin/v1/base_dict";
 import type { DictState } from "../../stores/interface";
 import piniaPersistConfig from "../../stores/helper/persist";
 import type { OptionBaseDictResponse_BaseDict, OptionBaseDictResponse_BaseDictItem } from "../../rpc/system/admin/v1/base_dict";

package/dist/package/src/stores/modules/user.ts

@@ -1,7 +1,7 @@
 import { defineStore } from "pinia";
-import { defAuthService } from "../../api/system/auth";
-import { defLoginService } from "../../api/base/login";
-import { defMfaService } from "../../api/base/mfa";
+import { defAuthService } from "../../api/system/admin/v1/auth";
+import { defLoginService } from "../../api/base/v1/login";
+import { defMfaService } from "../../api/base/v1/mfa";
 import type { LoginRequest, LoginResponse } from "../../rpc/base/v1/login";
 import type { VerifyMfaRequest } from "../../rpc/base/v1/mfa";
 import type { UserInfoForm } from "../../rpc/system/admin/v1/auth";
@@ -9,12 +9,14 @@ import { UserState } from "../../stores/interface";
 import piniaPersistConfig from "../../stores/helper/persist";
 import { useDictStoreHook } from "../../stores/modules/dict";
 import { useLockScreenStore } from "../../stores/modules/lockScreen";
-import { t } from "../../locales";
 
 const defaultUserInfo: UserInfoForm = {
   user_name: "",
   nick_name: "",
   phone: "",
+  email: "",
+  id_type: 0,
+  id_code: "",
   avatar: "",
   role_code: "",
   role_name: "",
@@ -26,9 +28,11 @@ const defaultUserInfo: UserInfoForm = {
 export const useUserStore = defineStore("admin-user", {
   state: (): UserState => ({
     token: "",
-    refreshToken: "",
     tokenType: "",
     tokenExpiresAt: 0,
+    isLoggingOut: false,
+    authVersion: 0,
+    authInvalidated: false,
     userInfo: defaultUserInfo
   }),
   getters: {},
@@ -37,10 +41,6 @@ export const useUserStore = defineStore("admin-user", {
     setToken(token: string) {
       this.token = token;
     },
-    /** 设置刷新令牌 */
-    setRefreshToken(refreshToken: string) {
-      this.refreshToken = refreshToken;
-    },
     /** 设置令牌类型 */
     setTokenType(tokenType: string) {
       this.tokenType = tokenType;
@@ -54,12 +54,12 @@ export const useUserStore = defineStore("admin-user", {
       this.userInfo = userInfo;
     },
     /** 根据接口返回统一更新令牌信息 */
-    updateTokenAuth(accessToken: string, refreshToken: string, tokenType: string, expiresIn?: number) {
+    updateTokenAuth(accessToken: string, tokenType: string, expiresIn?: number) {
       const tokenPrefix = tokenType ? `${tokenType} ` : "";
       const expiresAt = expiresIn ? Date.now() + expiresIn * 1000 : 0;
 
+      this.authInvalidated = false;
       this.setToken(`${tokenPrefix}${accessToken}`.trim());
-      this.setRefreshToken(refreshToken ?? "");
       this.setTokenType(tokenType ?? "");
       this.setTokenExpiresAt(expiresAt);
     },
@@ -71,24 +71,20 @@ export const useUserStore = defineStore("admin-user", {
     async login(loginRequest: LoginRequest): Promise<LoginResponse> {
       const data = await defLoginService.Login(loginRequest);
       if (data.status === 1 || data.status === 0 || data.status === 4) {
-        this.updateTokenAuth(data.access_token, data.refresh_token ?? "", data.token_type ?? "", data.expires_in);
+        this.updateTokenAuth(data.access_token, data.token_type ?? "", data.expires_in);
       }
       return data;
     },
     /** 校验登录阶段的多因素认证并保存正式令牌。 */
     async verifyMfa(request: VerifyMfaRequest): Promise<LoginResponse> {
       const data = await defMfaService.VerifyMfa(request);
-      this.updateTokenAuth(data.access_token, data.refresh_token ?? "", data.token_type ?? "", data.expires_in);
+      this.updateTokenAuth(data.access_token, data.token_type ?? "", data.expires_in);
       return data;
     },
-    /** 刷新认证令牌 */
+    /** 通过 HttpOnly Cookie 刷新认证令牌。 */
     async refreshAccessToken() {
-      if (!this.refreshToken) {
-        return Promise.reject(new Error(t("core.auth.refresh_token_missing")));
-      }
-
-      const data = await defLoginService.RefreshToken({ refresh_token: this.refreshToken });
-      this.updateTokenAuth(data.access_token, data.refresh_token ?? this.refreshToken, data.token_type ?? "", data.expires_in);
+      const data = await defLoginService.RefreshToken({});
+      this.updateTokenAuth(data.access_token, data.token_type ?? "", data.expires_in);
       return data;
     },
     /** 获取用户信息 */
@@ -102,22 +98,25 @@ export const useUserStore = defineStore("admin-user", {
       // 清理登录态时同步清空字典缓存，避免切换账号后读到旧字典。
       useDictStoreHook().clearDictionaryCache();
       useLockScreenStore().clearLock();
+      this.authVersion += 1;
+      this.authInvalidated = true;
       this.setToken("");
-      this.setRefreshToken("");
       this.setTokenType("");
       this.setTokenExpiresAt(0);
       this.setUserInfo({ ...defaultUserInfo });
     },
     /** 退出登录 */
     async logout() {
+      this.isLoggingOut = true;
       try {
         await defLoginService.Logout({});
       } catch {
         // 退出接口返回异常时，前端仍需清理本地登录态，避免用户卡在当前会话。
       } finally {
         this.clearAuthData();
+        this.isLoggingOut = false;
       }
     }
   },
-  persist: piniaPersistConfig("admin-user", ["token", "tokenType", "tokenExpiresAt", "userInfo"])
+  persist: piniaPersistConfig("admin-user-security-v2", ["userInfo"])
 });

package/dist/package/src/styles/element.scss

@@ -1,3 +1,9 @@
+/* 统一 Element Plus 矩形控件与后台页面的圆角。 */
+html:root {
+  --el-border-radius-base: var(--admin-page-radius);
+  --el-border-radius-small: 2px;
+}
+
 /* el-alert */
 .el-alert {
   border: 1px solid;
@@ -27,7 +33,18 @@
   overflow-x: hidden;
   background-color: var(--el-bg-color);
   border: 1px solid var(--el-border-color-light);
-  border-radius: 6px;
+  border-radius: var(--admin-page-radius);
+  box-shadow: 0 0 12px rgb(0 0 0 / 5%);
+}
+
+/* 非列表业务页沿用 ProTable 卡片外观 */
+.el-card.admin-page-card {
+  background-color: var(--el-bg-color);
+  border: 1px solid var(--el-border-color-light);
+  border-radius: var(--admin-page-radius);
+  box-shadow: 0 0 12px rgb(0 0 0 / 5%);
+}
+.el-card.admin-page-card.is-always-shadow {
   box-shadow: 0 0 12px rgb(0 0 0 / 5%);
 }
 
@@ -165,10 +182,9 @@
       }
     }
 
-    // 设置 el-table 中 header 文字不换行，并省略
+    // 设置 el-table 表头文字单行省略，完整内容由列标题悬浮提示展示。
     .el-table__header .el-table__cell > .cell {
-      // white-space: nowrap;
-      white-space: wrap;
+      white-space: nowrap;
     }
 
     // 空表时去掉底部那条默认分隔线，和菜单管理页保持一致。
@@ -328,6 +344,21 @@
   }
 }
 
+// ProDialog 需要去掉 Element Plus 默认的外层内边距，避免异步样式重复加载后覆盖紧凑布局。
+.el-dialog.pro-dialog {
+  padding: 0;
+
+  // 对齐原生 MessageBox 的紧凑上下间距，避免标题和操作区留白过大。
+  .el-dialog__header,
+  .el-dialog__body {
+    padding: 12px 20px;
+  }
+
+  .el-dialog__footer {
+    padding: 0 20px 12px;
+  }
+}
+
 @media screen and (width <= 768px) {
   .el-dialog {
     margin-top: 4vh;

package/dist/package/src/typings/global.d.ts

@@ -55,6 +55,12 @@ declare interface ViteEnv {
   VITE_PUBLIC_PATH: string;
   VITE_API_URL: string;
   VITE_PROXY: [string, string][];
+  /** 是否启用 Vite HTTPS 开发服务。 */
+  VITE_HTTPS: boolean;
+  /** HTTPS 私钥路径，相对于宿主 apps/admin 目录。 */
+  VITE_HTTPS_KEY: string;
+  /** HTTPS 证书路径，相对于宿主 apps/admin 目录。 */
+  VITE_HTTPS_CERT: string;
   VITE_CODEINSPECTOR: boolean;
 }
 

package/dist/package/src/utils/passwordCrypto.ts

@@ -1,7 +1,10 @@
-import { defLoginService } from "../api/base/login";
-import { PasswordCryptoScene } from "../rpc/base/v1/login";
+import { defLoginService } from "../api/base/v1/login";
+import { PasswordCryptoScene, type PasswordPublicKeyResponse } from "../rpc/base/v1/login";
 import type { PasswordCrypto } from "../rpc/common/v1/types";
 import { t } from "../locales";
+import * as portableCrypto from "asmcrypto.js";
+
+type PortableCrypto = typeof import("asmcrypto.js");
 
 export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene;
 export type { PasswordCryptoScene };
@@ -12,7 +15,11 @@ function pemToArrayBuffer(pem: string) {
     .replace(/-----BEGIN PUBLIC KEY-----/g, "")
     .replace(/-----END PUBLIC KEY-----/g, "")
     .replace(/\s/g, "");
-  const binary = window.atob(base64);
+  const decode = globalThis.atob;
+  if (!decode) {
+    throw new Error(t("core.password.base64_decode_unsupported"));
+  }
+  const binary = decode(base64);
   const buffer = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i += 1) {
     buffer[i] = binary.charCodeAt(i);
@@ -27,18 +34,163 @@ function arrayBufferToBase64(buffer: ArrayBuffer) {
   for (let i = 0; i < bytes.byteLength; i += 1) {
     binary += String.fromCharCode(bytes[i]);
   }
-  return window.btoa(binary);
+  const encode = globalThis.btoa;
+  if (!encode) {
+    throw new Error(t("core.password.base64_encode_unsupported"));
+  }
+  return encode(binary);
 }
 
 /** 获取浏览器 WebCrypto 能力。 */
 function getSubtleCrypto() {
   const cryptoApi = globalThis.crypto;
-  if (!cryptoApi?.subtle) {
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
     throw new Error(t("core.password.crypto_unsupported"));
   }
   return cryptoApi;
 }
 
+/** 读取 DER 编码节点，用于解析 RSA SubjectPublicKeyInfo。 */
+function readDerNode(data: Uint8Array, offset: number) {
+  if (offset + 2 > data.length) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  const tag = data[offset];
+  const firstLengthByte = data[offset + 1];
+  let length = firstLengthByte;
+  let valueOffset = offset + 2;
+  if (firstLengthByte & 0x80) {
+    const lengthByteCount = firstLengthByte & 0x7f;
+    if (lengthByteCount === 0 || valueOffset + lengthByteCount > data.length) {
+      throw new Error(t("core.password.public_key_invalid"));
+    }
+    length = 0;
+    for (let index = 0; index < lengthByteCount; index += 1) {
+      length = length * 256 + data[valueOffset + index];
+    }
+    valueOffset += lengthByteCount;
+  }
+  const end = valueOffset + length;
+  if (end > data.length) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  return { tag, value: data.subarray(valueOffset, end), next: end };
+}
+
+/** 去除 DER 正整数前导零字节。 */
+function trimDerInteger(value: Uint8Array) {
+  let offset = 0;
+  while (offset < value.length - 1 && value[offset] === 0) {
+    offset += 1;
+  }
+  return value.subarray(offset);
+}
+
+/** 从 PEM SubjectPublicKeyInfo 中提取 RSA 模数和指数。 */
+function parsePortableRsaPublicKey(publicKey: string): [Uint8Array, Uint8Array] {
+  const der = new Uint8Array(pemToArrayBuffer(publicKey));
+  const subjectPublicKeyInfo = readDerNode(der, 0);
+  const algorithm = readDerNode(subjectPublicKeyInfo.value, 0);
+  const bitString = readDerNode(subjectPublicKeyInfo.value, algorithm.next);
+  if (bitString.tag !== 0x03 || bitString.value[0] !== 0) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  const rsaPublicKey = readDerNode(bitString.value, 1);
+  const modulus = readDerNode(rsaPublicKey.value, 0);
+  const exponent = readDerNode(rsaPublicKey.value, modulus.next);
+  if (modulus.tag !== 0x02 || exponent.tag !== 0x02) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  return [trimDerInteger(modulus.value), trimDerInteger(exponent.value)];
+}
+
+/** 计算 RSA-OAEP 所需的 MGF1 掩码。 */
+function generateMgf1Mask(cryptoApi: PortableCrypto, seed: Uint8Array, length: number) {
+  const mask = new Uint8Array(length);
+  const counter = new Uint8Array(4);
+  const hash = new cryptoApi.Sha256();
+  const blockCount = Math.ceil(length / hash.HASH_SIZE);
+  for (let index = 0; index < blockCount; index += 1) {
+    counter[0] = index >>> 24;
+    counter[1] = index >>> 16;
+    counter[2] = index >>> 8;
+    counter[3] = index;
+    let block = hash.reset().process(seed).process(counter).finish().result;
+    if (!block) {
+      throw new Error(t("core.password.encrypt_failed"));
+    }
+    const target = mask.subarray(index * hash.HASH_SIZE);
+    if (block.length > target.length) {
+      block = block.subarray(0, target.length);
+    }
+    target.set(block);
+  }
+  return mask;
+}
+
+/** 生成纯 JavaScript 密码加密所需的随机字节。 */
+function getPortableRandomBytes(length: number) {
+  const cryptoApi = globalThis.crypto;
+  if (!cryptoApi?.getRandomValues) {
+    throw new Error(t("core.password.random_failed"));
+  }
+  return cryptoApi.getRandomValues(new Uint8Array(length));
+}
+
+/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的密码加密协议。 */
+async function encryptPortablePassword(
+  cryptoApi: PortableCrypto,
+  password: string,
+  publicKeyResponse: PasswordPublicKeyResponse
+): Promise<PasswordCrypto> {
+  const aesKey = getPortableRandomBytes(32);
+  const iv = getPortableRandomBytes(12);
+  const plaintext = cryptoApi.string_to_bytes(password, true);
+  const [modulus, exponent] = parsePortableRsaPublicKey(publicKeyResponse.public_key);
+  const hash = new cryptoApi.Sha256();
+  const keySize = Math.ceil(new cryptoApi.BigNumber(modulus).bitLength / 8);
+  const seed = getPortableRandomBytes(hash.HASH_SIZE);
+  const dataBlockLength = keySize - hash.HASH_SIZE - 1;
+  const paddingLength = dataBlockLength - aesKey.length - hash.HASH_SIZE - 1;
+  if (paddingLength < 0) {
+    throw new Error(t("core.password.password_too_long"));
+  }
+  const encodedMessage = new Uint8Array(keySize);
+  const maskedSeed = encodedMessage.subarray(1, hash.HASH_SIZE + 1);
+  const dataBlock = encodedMessage.subarray(hash.HASH_SIZE + 1);
+  const labelHash = hash.reset().process(new Uint8Array()).finish().result;
+  if (!labelHash) {
+    throw new Error(t("core.password.encrypt_failed"));
+  }
+  dataBlock.set(labelHash, 0);
+  dataBlock.set(aesKey, hash.HASH_SIZE + paddingLength + 1);
+  dataBlock[hash.HASH_SIZE + paddingLength] = 1;
+  const dataBlockMask = generateMgf1Mask(cryptoApi, seed, dataBlock.length);
+  for (let index = 0; index < dataBlock.length; index += 1) {
+    dataBlock[index] ^= dataBlockMask[index];
+  }
+  const seedMask = generateMgf1Mask(cryptoApi, dataBlock, maskedSeed.length);
+  maskedSeed.set(seed);
+  for (let index = 0; index < maskedSeed.length; index += 1) {
+    maskedSeed[index] ^= seedMask[index];
+  }
+  const encryptedKey = new cryptoApi.RSA([modulus, exponent]).encrypt(new cryptoApi.BigNumber(encodedMessage)).result;
+  if (!encryptedKey) {
+    throw new Error(t("core.password.encrypt_failed"));
+  }
+  const ciphertext = cryptoApi.AES_GCM.encrypt(plaintext, aesKey, iv);
+
+  return {
+    key_id: publicKeyResponse.key_id,
+    nonce: publicKeyResponse.nonce,
+    algorithm: publicKeyResponse.algorithm,
+    encrypted_key: arrayBufferToBase64(encryptedKey.slice().buffer),
+    iv: arrayBufferToBase64(iv.buffer),
+    ciphertext: arrayBufferToBase64(ciphertext.slice().buffer)
+  };
+}
+
 /** 加密单个密码字段，返回后端可解析的密码密文。 */
 export async function encryptPassword(password: string, scene: PasswordCryptoScene): Promise<PasswordCrypto> {
   const plainPassword = password.trim();
@@ -46,20 +198,25 @@ export async function encryptPassword(password: string, scene: PasswordCryptoSce
     throw new Error(t("core.password.required"));
   }
 
-  const cryptoApi = getSubtleCrypto();
   const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene });
-  const publicKey = await cryptoApi.subtle.importKey(
+  const cryptoApi = globalThis.crypto;
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
+    return encryptPortablePassword(portableCrypto, plainPassword, publicKeyResponse);
+  }
+  const subtleCrypto = getSubtleCrypto();
+  const publicKey = await subtleCrypto.subtle.importKey(
     "spki",
     pemToArrayBuffer(publicKeyResponse.public_key),
     { name: "RSA-OAEP", hash: "SHA-256" },
     false,
     ["encrypt"]
   );
-  const aesKey = await cryptoApi.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
-  const rawAesKey = await cryptoApi.subtle.exportKey("raw", aesKey);
-  const iv = cryptoApi.getRandomValues(new Uint8Array(12));
-  const ciphertext = await cryptoApi.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
-  const encryptedKey = await cryptoApi.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
+  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
+  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
+  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
+  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
 
   return {
     key_id: publicKeyResponse.key_id,

package/dist/package/src/utils/passwordStrength.ts

@@ -9,12 +9,10 @@ export interface PasswordStrengthResult {
   strengthScore: number;
   /** 强度等级。 */
   level: PasswordStrengthLevel;
-  /** 是否达到允许提交的最高强度。 */
-  isValid: boolean;
 }
 
 /**
- * 计算密码强度结果，供表单展示和校验统一复用。
+ * 计算密码强度结果，供表单展示使用；最终规则由服务端密码策略校验。
  *
  * @param password 当前密码
  * @returns 密码强度分析结果
@@ -24,14 +22,13 @@ export function getPasswordStrength(password?: string): PasswordStrengthResult {
     return {
       ruleScore: 0,
       strengthScore: 0,
-      level: "empty",
-      isValid: false
+      level: "empty"
     };
   }
 
   let ruleScore = 0;
-  if (password.length >= 8) ruleScore += 1;
-  if (/[a-z]/.test(password) && /[A-Z]/.test(password)) ruleScore += 1;
+  if (/[a-z]/.test(password)) ruleScore += 1;
+  if (/[A-Z]/.test(password)) ruleScore += 1;
   if (/\d/.test(password)) ruleScore += 1;
   if (/[^A-Za-z0-9]/.test(password)) ruleScore += 1;
 
@@ -39,33 +36,19 @@ export function getPasswordStrength(password?: string): PasswordStrengthResult {
     return {
       ruleScore,
       strengthScore: 3,
-      level: "high",
-      isValid: true
+      level: "high"
     };
   }
   if (ruleScore === 3) {
     return {
       ruleScore,
       strengthScore: 2,
-      level: "medium",
-      isValid: false
+      level: "medium"
     };
   }
   return {
     ruleScore,
     strengthScore: 1,
-    level: "low",
-    isValid: false
+    level: "low"
   };
 }
-
-/**
- * 校验密码是否达到最高强度，便于表单规则直接复用。
- *
- * @param password 当前密码
- * @returns 校验结果
- */
-export function validatePasswordStrengthValue(password?: string) {
-  const result = getPasswordStrength(password);
-  return { valid: result.isValid };
-}