@liujitcn/kratos-admin-core 0.0.32 → 0.0.34

package/dist/package/declarations/src/locales/generated.d.ts

@@ -206,6 +206,13 @@ export declare const LOCALE_MESSAGES: {
         "core.oauth.unknown": string;
         "core.password.error": string;
         "core.password.crypto_unsupported": string;
+        "core.password.crypto_secure_context": string;
+        "core.password.base64_decode_unsupported": string;
+        "core.password.base64_encode_unsupported": string;
+        "core.password.encrypt_failed": string;
+        "core.password.password_too_long": string;
+        "core.password.public_key_invalid": string;
+        "core.password.random_failed": string;
         "core.password.required": string;
         "core.password.verify_title": string;
         "core.password.verify_label": string;
@@ -534,6 +541,13 @@ export declare const LOCALE_MESSAGES: {
         "core.oauth.unknown": string;
         "core.password.error": string;
         "core.password.crypto_unsupported": string;
+        "core.password.crypto_secure_context": string;
+        "core.password.base64_decode_unsupported": string;
+        "core.password.base64_encode_unsupported": string;
+        "core.password.encrypt_failed": string;
+        "core.password.password_too_long": string;
+        "core.password.public_key_invalid": string;
+        "core.password.random_failed": string;
         "core.password.required": string;
         "core.password.verify_title": string;
         "core.password.verify_label": string;
@@ -862,6 +876,13 @@ export declare const LOCALE_MESSAGES: {
         "core.oauth.unknown": string;
         "core.password.error": string;
         "core.password.crypto_unsupported": string;
+        "core.password.crypto_secure_context": string;
+        "core.password.base64_decode_unsupported": string;
+        "core.password.base64_encode_unsupported": string;
+        "core.password.encrypt_failed": string;
+        "core.password.password_too_long": string;
+        "core.password.public_key_invalid": string;
+        "core.password.random_failed": string;
         "core.password.required": string;
         "core.password.verify_title": string;
         "core.password.verify_label": string;
@@ -1190,6 +1211,13 @@ export declare const LOCALE_MESSAGES: {
         "core.oauth.unknown": string;
         "core.password.error": string;
         "core.password.crypto_unsupported": string;
+        "core.password.crypto_secure_context": string;
+        "core.password.base64_decode_unsupported": string;
+        "core.password.base64_encode_unsupported": string;
+        "core.password.encrypt_failed": string;
+        "core.password.password_too_long": string;
+        "core.password.public_key_invalid": string;
+        "core.password.random_failed": string;
         "core.password.required": string;
         "core.password.verify_title": string;
         "core.password.verify_label": string;

package/dist/package/src/locales/en-US.json

@@ -201,6 +201,13 @@
   "core.oauth.unknown": "Unknown provider",
   "core.password.error": "Password does not meet the active password policy",
   "core.password.crypto_unsupported": "Password encryption is not supported in this environment",
+  "core.password.crypto_secure_context": "Password encryption requires localhost or HTTPS. Please use a secure address.",
+  "core.password.base64_decode_unsupported": "Base64 decoding is not supported in this environment",
+  "core.password.base64_encode_unsupported": "Base64 encoding is not supported in this environment",
+  "core.password.encrypt_failed": "Password encryption failed",
+  "core.password.password_too_long": "Password exceeds the supported length",
+  "core.password.public_key_invalid": "Invalid public key",
+  "core.password.random_failed": "Failed to generate random data",
   "core.password.required": "Password is required",
   "core.password.verify_title": "Verify password",
   "core.password.verify_label": "Current password",

package/dist/package/src/locales/ja-JP.json

@@ -201,6 +201,13 @@
   "core.oauth.unknown": "不明な方法です",
   "core.password.error": "パスワードが現在のパスワードポリシーを満たしていません",
   "core.password.crypto_unsupported": "現在の環境はパスワード暗号化をサポートしていません",
+  "core.password.crypto_secure_context": "パスワード暗号化には localhost または HTTPS が必要です。安全なアドレスでアクセスしてください。",
+  "core.password.base64_decode_unsupported": "現在の環境は Base64 デコードをサポートしていません",
+  "core.password.base64_encode_unsupported": "現在の環境は Base64 エンコードをサポートしていません",
+  "core.password.encrypt_failed": "パスワードの暗号化に失敗しました",
+  "core.password.password_too_long": "パスワードの長さが制限を超えています",
+  "core.password.public_key_invalid": "公開鍵の形式が無効です",
+  "core.password.random_failed": "乱数の生成に失敗しました",
   "core.password.required": "パスワードを空にすることはできません",
   "core.password.verify_title": "パスワードの確認",
   "core.password.verify_label": "現在のパスワード",

package/dist/package/src/locales/zh-CN.json

@@ -201,6 +201,13 @@
   "core.oauth.unknown": "未知方式",
   "core.password.error": "密码不符合当前生效的密码策略",
   "core.password.crypto_unsupported": "当前环境不支持密码加密",
+  "core.password.crypto_secure_context": "当前地址不支持密码加密，请使用 localhost 或 HTTPS 访问",
+  "core.password.base64_decode_unsupported": "当前环境不支持 Base64 解码",
+  "core.password.base64_encode_unsupported": "当前环境不支持 Base64 编码",
+  "core.password.encrypt_failed": "密码加密失败",
+  "core.password.password_too_long": "密码长度超出限制",
+  "core.password.public_key_invalid": "公钥格式无效",
+  "core.password.random_failed": "随机数生成失败",
   "core.password.required": "密码不能为空",
   "core.password.verify_title": "验证密码",
   "core.password.verify_label": "当前密码",

package/dist/package/src/locales/zh-TW.json

@@ -201,6 +201,13 @@
   "core.oauth.unknown": "未知方式",
   "core.password.error": "密碼不符合目前生效的密碼策略",
   "core.password.crypto_unsupported": "當前環境不支援密碼加密",
+  "core.password.crypto_secure_context": "目前地址不支援密碼加密，請使用 localhost 或 HTTPS 訪問",
+  "core.password.base64_decode_unsupported": "當前環境不支援 Base64 解碼",
+  "core.password.base64_encode_unsupported": "當前環境不支援 Base64 編碼",
+  "core.password.encrypt_failed": "密碼加密失敗",
+  "core.password.password_too_long": "密碼長度超出限制",
+  "core.password.public_key_invalid": "公鑰格式無效",
+  "core.password.random_failed": "隨機數生成失敗",
   "core.password.required": "密碼不能為空",
   "core.password.verify_title": "驗證密碼",
   "core.password.verify_label": "當前密碼",

package/dist/package/src/rpc/base/v1/config.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/config.proto
 

package/dist/package/src/rpc/base/v1/file.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/file.proto
 

package/dist/package/src/rpc/base/v1/language.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/language.proto
 

package/dist/package/src/rpc/base/v1/login.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/login.proto
 

package/dist/package/src/rpc/base/v1/mfa.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/mfa.proto
 

package/dist/package/src/rpc/base/v1/oauth.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/oauth.proto
 

package/dist/package/src/rpc/base/v1/oauth_client.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: base/v1/oauth_client.proto
 

package/dist/package/src/rpc/common/v1/common.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: common/v1/common.proto
 

package/dist/package/src/rpc/common/v1/enum.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: common/v1/enum.proto
 

package/dist/package/src/rpc/common/v1/types.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: common/v1/types.proto
 

package/dist/package/src/rpc/google/protobuf/empty.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: google/protobuf/empty.proto
 

package/dist/package/src/rpc/google/protobuf/wrappers.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: google/protobuf/wrappers.proto
 

package/dist/package/src/rpc/system/admin/v1/auth.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/admin/v1/auth.proto
 

package/dist/package/src/rpc/system/admin/v1/base_dict.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/admin/v1/base_dict.proto
 

package/dist/package/src/rpc/system/admin/v1/base_i18n.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/admin/v1/base_i18n.proto
 

package/dist/package/src/rpc/system/admin/v1/base_tenant.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/admin/v1/base_tenant.proto
 

package/dist/package/src/rpc/system/admin/v1/common.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/admin/v1/common.proto
 

package/dist/package/src/rpc/system/common/v1/common.ts

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-ts_proto. DO NOT EDIT.
 // versions:
-//   protoc-gen-ts_proto  v2.11.8
+//   protoc-gen-ts_proto  v2.12.1
 //   protoc               unknown
 // source: system/common/v1/common.proto
 

package/dist/package/src/typings/global.d.ts

@@ -55,6 +55,12 @@ declare interface ViteEnv {
   VITE_PUBLIC_PATH: string;
   VITE_API_URL: string;
   VITE_PROXY: [string, string][];
+  /** 是否启用 Vite HTTPS 开发服务。 */
+  VITE_HTTPS: boolean;
+  /** HTTPS 私钥路径，相对于宿主 apps/admin 目录。 */
+  VITE_HTTPS_KEY: string;
+  /** HTTPS 证书路径，相对于宿主 apps/admin 目录。 */
+  VITE_HTTPS_CERT: string;
   VITE_CODEINSPECTOR: boolean;
 }
 

package/dist/package/src/utils/passwordCrypto.ts

@@ -1,7 +1,10 @@
 import { defLoginService } from "../api/base/v1/login";
-import { PasswordCryptoScene } from "../rpc/base/v1/login";
+import { PasswordCryptoScene, type PasswordPublicKeyResponse } from "../rpc/base/v1/login";
 import type { PasswordCrypto } from "../rpc/common/v1/types";
 import { t } from "../locales";
+import * as portableCrypto from "asmcrypto.js";
+
+type PortableCrypto = typeof import("asmcrypto.js");
 
 export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene;
 export type { PasswordCryptoScene };
@@ -12,7 +15,11 @@ function pemToArrayBuffer(pem: string) {
     .replace(/-----BEGIN PUBLIC KEY-----/g, "")
     .replace(/-----END PUBLIC KEY-----/g, "")
     .replace(/\s/g, "");
-  const binary = window.atob(base64);
+  const decode = globalThis.atob;
+  if (!decode) {
+    throw new Error(t("core.password.base64_decode_unsupported"));
+  }
+  const binary = decode(base64);
   const buffer = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i += 1) {
     buffer[i] = binary.charCodeAt(i);
@@ -27,18 +34,163 @@ function arrayBufferToBase64(buffer: ArrayBuffer) {
   for (let i = 0; i < bytes.byteLength; i += 1) {
     binary += String.fromCharCode(bytes[i]);
   }
-  return window.btoa(binary);
+  const encode = globalThis.btoa;
+  if (!encode) {
+    throw new Error(t("core.password.base64_encode_unsupported"));
+  }
+  return encode(binary);
 }
 
 /** 获取浏览器 WebCrypto 能力。 */
 function getSubtleCrypto() {
   const cryptoApi = globalThis.crypto;
-  if (!cryptoApi?.subtle) {
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
     throw new Error(t("core.password.crypto_unsupported"));
   }
   return cryptoApi;
 }
 
+/** 读取 DER 编码节点，用于解析 RSA SubjectPublicKeyInfo。 */
+function readDerNode(data: Uint8Array, offset: number) {
+  if (offset + 2 > data.length) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  const tag = data[offset];
+  const firstLengthByte = data[offset + 1];
+  let length = firstLengthByte;
+  let valueOffset = offset + 2;
+  if (firstLengthByte & 0x80) {
+    const lengthByteCount = firstLengthByte & 0x7f;
+    if (lengthByteCount === 0 || valueOffset + lengthByteCount > data.length) {
+      throw new Error(t("core.password.public_key_invalid"));
+    }
+    length = 0;
+    for (let index = 0; index < lengthByteCount; index += 1) {
+      length = length * 256 + data[valueOffset + index];
+    }
+    valueOffset += lengthByteCount;
+  }
+  const end = valueOffset + length;
+  if (end > data.length) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  return { tag, value: data.subarray(valueOffset, end), next: end };
+}
+
+/** 去除 DER 正整数前导零字节。 */
+function trimDerInteger(value: Uint8Array) {
+  let offset = 0;
+  while (offset < value.length - 1 && value[offset] === 0) {
+    offset += 1;
+  }
+  return value.subarray(offset);
+}
+
+/** 从 PEM SubjectPublicKeyInfo 中提取 RSA 模数和指数。 */
+function parsePortableRsaPublicKey(publicKey: string): [Uint8Array, Uint8Array] {
+  const der = new Uint8Array(pemToArrayBuffer(publicKey));
+  const subjectPublicKeyInfo = readDerNode(der, 0);
+  const algorithm = readDerNode(subjectPublicKeyInfo.value, 0);
+  const bitString = readDerNode(subjectPublicKeyInfo.value, algorithm.next);
+  if (bitString.tag !== 0x03 || bitString.value[0] !== 0) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  const rsaPublicKey = readDerNode(bitString.value, 1);
+  const modulus = readDerNode(rsaPublicKey.value, 0);
+  const exponent = readDerNode(rsaPublicKey.value, modulus.next);
+  if (modulus.tag !== 0x02 || exponent.tag !== 0x02) {
+    throw new Error(t("core.password.public_key_invalid"));
+  }
+  return [trimDerInteger(modulus.value), trimDerInteger(exponent.value)];
+}
+
+/** 计算 RSA-OAEP 所需的 MGF1 掩码。 */
+function generateMgf1Mask(cryptoApi: PortableCrypto, seed: Uint8Array, length: number) {
+  const mask = new Uint8Array(length);
+  const counter = new Uint8Array(4);
+  const hash = new cryptoApi.Sha256();
+  const blockCount = Math.ceil(length / hash.HASH_SIZE);
+  for (let index = 0; index < blockCount; index += 1) {
+    counter[0] = index >>> 24;
+    counter[1] = index >>> 16;
+    counter[2] = index >>> 8;
+    counter[3] = index;
+    let block = hash.reset().process(seed).process(counter).finish().result;
+    if (!block) {
+      throw new Error(t("core.password.encrypt_failed"));
+    }
+    const target = mask.subarray(index * hash.HASH_SIZE);
+    if (block.length > target.length) {
+      block = block.subarray(0, target.length);
+    }
+    target.set(block);
+  }
+  return mask;
+}
+
+/** 生成纯 JavaScript 密码加密所需的随机字节。 */
+function getPortableRandomBytes(length: number) {
+  const cryptoApi = globalThis.crypto;
+  if (!cryptoApi?.getRandomValues) {
+    throw new Error(t("core.password.random_failed"));
+  }
+  return cryptoApi.getRandomValues(new Uint8Array(length));
+}
+
+/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的密码加密协议。 */
+async function encryptPortablePassword(
+  cryptoApi: PortableCrypto,
+  password: string,
+  publicKeyResponse: PasswordPublicKeyResponse
+): Promise<PasswordCrypto> {
+  const aesKey = getPortableRandomBytes(32);
+  const iv = getPortableRandomBytes(12);
+  const plaintext = cryptoApi.string_to_bytes(password, true);
+  const [modulus, exponent] = parsePortableRsaPublicKey(publicKeyResponse.public_key);
+  const hash = new cryptoApi.Sha256();
+  const keySize = Math.ceil(new cryptoApi.BigNumber(modulus).bitLength / 8);
+  const seed = getPortableRandomBytes(hash.HASH_SIZE);
+  const dataBlockLength = keySize - hash.HASH_SIZE - 1;
+  const paddingLength = dataBlockLength - aesKey.length - hash.HASH_SIZE - 1;
+  if (paddingLength < 0) {
+    throw new Error(t("core.password.password_too_long"));
+  }
+  const encodedMessage = new Uint8Array(keySize);
+  const maskedSeed = encodedMessage.subarray(1, hash.HASH_SIZE + 1);
+  const dataBlock = encodedMessage.subarray(hash.HASH_SIZE + 1);
+  const labelHash = hash.reset().process(new Uint8Array()).finish().result;
+  if (!labelHash) {
+    throw new Error(t("core.password.encrypt_failed"));
+  }
+  dataBlock.set(labelHash, 0);
+  dataBlock.set(aesKey, hash.HASH_SIZE + paddingLength + 1);
+  dataBlock[hash.HASH_SIZE + paddingLength] = 1;
+  const dataBlockMask = generateMgf1Mask(cryptoApi, seed, dataBlock.length);
+  for (let index = 0; index < dataBlock.length; index += 1) {
+    dataBlock[index] ^= dataBlockMask[index];
+  }
+  const seedMask = generateMgf1Mask(cryptoApi, dataBlock, maskedSeed.length);
+  maskedSeed.set(seed);
+  for (let index = 0; index < maskedSeed.length; index += 1) {
+    maskedSeed[index] ^= seedMask[index];
+  }
+  const encryptedKey = new cryptoApi.RSA([modulus, exponent]).encrypt(new cryptoApi.BigNumber(encodedMessage)).result;
+  if (!encryptedKey) {
+    throw new Error(t("core.password.encrypt_failed"));
+  }
+  const ciphertext = cryptoApi.AES_GCM.encrypt(plaintext, aesKey, iv);
+
+  return {
+    key_id: publicKeyResponse.key_id,
+    nonce: publicKeyResponse.nonce,
+    algorithm: publicKeyResponse.algorithm,
+    encrypted_key: arrayBufferToBase64(encryptedKey.slice().buffer),
+    iv: arrayBufferToBase64(iv.buffer),
+    ciphertext: arrayBufferToBase64(ciphertext.slice().buffer)
+  };
+}
+
 /** 加密单个密码字段，返回后端可解析的密码密文。 */
 export async function encryptPassword(password: string, scene: PasswordCryptoScene): Promise<PasswordCrypto> {
   const plainPassword = password.trim();
@@ -46,20 +198,25 @@ export async function encryptPassword(password: string, scene: PasswordCryptoSce
     throw new Error(t("core.password.required"));
   }
 
-  const cryptoApi = getSubtleCrypto();
   const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene });
-  const publicKey = await cryptoApi.subtle.importKey(
+  const cryptoApi = globalThis.crypto;
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
+    return encryptPortablePassword(portableCrypto, plainPassword, publicKeyResponse);
+  }
+  const subtleCrypto = getSubtleCrypto();
+  const publicKey = await subtleCrypto.subtle.importKey(
     "spki",
     pemToArrayBuffer(publicKeyResponse.public_key),
     { name: "RSA-OAEP", hash: "SHA-256" },
     false,
     ["encrypt"]
   );
-  const aesKey = await cryptoApi.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
-  const rawAesKey = await cryptoApi.subtle.exportKey("raw", aesKey);
-  const iv = cryptoApi.getRandomValues(new Uint8Array(12));
-  const ciphertext = await cryptoApi.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
-  const encryptedKey = await cryptoApi.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
+  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
+  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
+  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
+  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
 
   return {
     key_id: publicKeyResponse.key_id,

package/dist/package/src/views/login/components/LoginForm.vue

@@ -766,7 +766,10 @@ const submitLogin = async (captchaToken: string) => {
     // 1.执行登录接口，挑战态不保存令牌，等待 MFA 完成。
     const result = await userStore.login(loginRequest);
     await handleLoginResponse(result);
-  } catch (_error) {
+  } catch (error) {
+    if (error instanceof Error && error.message === t("core.password.crypto_secure_context")) {
+      ElMessage.error(error.message);
+    }
     await loadPageCaptcha();
   } finally {
     loading.value = false;

package/dist/package/types/generated/auto-imports.d.ts

@@ -1,5 +1,7 @@
 /* eslint-disable */
 /* prettier-ignore */
+/* oxlint-disable */
+/* oxfmt-ignore */
 // @ts-nocheck
 // noinspection JSUnusedGlobalSymbols
 // Generated by unplugin-auto-import

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@liujitcn/kratos-admin-core",
   "private": false,
-  "version": "0.0.32",
+  "version": "0.0.34",
   "type": "module",
   "description": "kratos-admin frontend runtime and base modules",
   "author": {
@@ -26,6 +26,7 @@
     "@vueuse/core": "^14.3.0",
     "@wangeditor/editor": "^5.1.23",
     "@wangeditor/editor-for-vue": "^5.1.12",
+    "asmcrypto.js": "2.3.2",
     "axios": "^1.7.2",
     "code-inspector-plugin": "^1.5.1",
     "dayjs": "^1.11.21",

package/types/generated/auto-imports.d.ts

@@ -1,5 +1,7 @@
 /* eslint-disable */
 /* prettier-ignore */
+/* oxlint-disable */
+/* oxfmt-ignore */
 // @ts-nocheck
 // noinspection JSUnusedGlobalSymbols
 // Generated by unplugin-auto-import

package/vite.config.ts

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
+import type { ServerOptions } from "node:https";
 import { createLogger, defineConfig, loadEnv, type ConfigEnv, type Logger, type UserConfig } from "vite";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -63,6 +64,8 @@ export function defineAdminViteConfig(options: AdminViteConfigOptions = {}) {
       pkg: packageInfo,
       lastBuildTime: dayjs().format("YYYY-MM-DD HH:mm:ss")
     };
+    const coreVariablesPath = resolve(coreSourceRoot, "styles/var.scss").replaceAll("\\", "/");
+    const httpsOptions = resolveHttpsOptions(viteEnv, root);
 
     return {
       base: viteEnv.VITE_PUBLIC_PATH,
@@ -75,7 +78,7 @@ export function defineAdminViteConfig(options: AdminViteConfigOptions = {}) {
       css: {
         preprocessorOptions: {
           scss: {
-            additionalData: `@use "${resolve(coreSourceRoot, "styles/var.scss")}" as *;`
+            additionalData: `@use "${coreVariablesPath}" as *;`
           }
         }
       },
@@ -107,6 +110,7 @@ export function defineAdminViteConfig(options: AdminViteConfigOptions = {}) {
         port: viteEnv.VITE_PORT,
         open: viteEnv.VITE_OPEN,
         cors: true,
+        https: httpsOptions,
         proxy: createProxy(viteEnv.VITE_PROXY)
       },
       plugins: createVitePlugins(viteEnv, {
@@ -188,6 +192,24 @@ function readDayjsLocaleDependencies(sourceRoot: string): string[] {
   );
 }
 
+/** 根据宿主环境变量加载 Vite HTTPS 证书。 */
+function resolveHttpsOptions(viteEnv: ViteEnv, root: string): ServerOptions | undefined {
+  if (!viteEnv.VITE_HTTPS) return undefined;
+
+  const keyPath = resolve(root, viteEnv.VITE_HTTPS_KEY || "../../../../certs/dev-key.pem");
+  const certPath = resolve(root, viteEnv.VITE_HTTPS_CERT || "../../../../certs/dev-cert.pem");
+  if (!existsSync(keyPath) || !existsSync(certPath)) {
+    throw new Error(
+      `VITE_HTTPS 已开启，但未找到证书文件，请先在仓库根目录运行 scripts/generate-dev-cert.sh；期望路径：${keyPath} 和 ${certPath}`
+    );
+  }
+
+  return {
+    key: readFileSync(keyPath),
+    cert: readFileSync(certPath)
+  };
+}
+
 /** 解析业务模块在当前宿主中的源码目录。 */
 function resolvePackageSource(root: string, packageName: string): Pick<AdminSourcePackage, "packageRoot" | "sourceRoot"> {
   const require = createRequire(resolve(root, "package.json"));