@liujitcn/kratos-admin-core 0.0.65 → 0.0.67

package/dist/package/src/rpc/common/v1/types.ts

@@ -60,8 +60,8 @@ export interface BytesValues {
   value: Uint8Array[];
 }
 
-/** 密码密文。 */
-export interface PasswordCrypto {
+/** 敏感字段密文，密码与各类密钥字段统一使用。 */
+export interface SecretCrypto {
   /** 临时密钥ID */
   key_id: string;
   /** 随机值 */
@@ -72,6 +72,6 @@ export interface PasswordCrypto {
   encrypted_key: string;
   /** 初始化向量 */
   iv: string;
-  /** 密码加密数据 */
-  ciphertext: string;
+  /** 传输时为密文，服务端解密后回填明文 */
+  text: string;
 }

package/dist/package/src/rpc/system/admin/v1/auth.ts

@@ -5,7 +5,7 @@
 // source: system/admin/v1/auth.proto
 
 /* eslint-disable */
-import type { PasswordCrypto, StringValues } from "../../../common/v1/types";
+import type { SecretCrypto, StringValues } from "../../../common/v1/types";
 import type { Empty } from "../../../google/protobuf/empty";
 import type { BaseUserIDType } from "../../common/v1/common";
 import type { BaseMenuType } from "./common";
@@ -202,10 +202,10 @@ export interface RouteParams {
 export interface UserPasswordForm {
   /** 原密码 */
   old_pwd:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 新密码 */
-  new_pwd: PasswordCrypto | undefined;
+  new_pwd: SecretCrypto | undefined;
 }
 
 /** 用户手机号表单 */

package/dist/package/src/security.ts

@@ -1,5 +1,5 @@
 export * from "./utils/oauthProvider";
-export * from "./utils/passwordCrypto";
+export * from "./utils/secretCrypto";
 export * from "./utils/passwordStrength";
 export * from "./utils/webauthn";
 export * from "./utils/clipboard";

package/dist/package/src/utils/index.ts

@@ -256,7 +256,8 @@ export const getAllBreadcrumbList = (
 ) => {
   for (const item of menuList) {
     const routePath = item.path ?? "";
-    const breadcrumb = [...parent, item];
+    // 目录型菜单（path 为空的 Layout 容器）不进入面包屑，避免与重定向后的子页面同名重复。
+    const breadcrumb = routePath ? [...parent, item] : parent;
     if (routePath) result[routePath] = breadcrumb;
     if (item.children) getAllBreadcrumbList(item.children, breadcrumb, result);
   }

package/dist/package/src/utils/request.ts

@@ -22,7 +22,7 @@ const PASSWORD_CHANGE_STATE_STORAGE_KEY = "admin-password-change-required";
 const CAPTCHA_URL = "/v1/base/captcha";
 const CONFIG_URL = "/v1/base/config";
 const LANGUAGE_URL = "/v1/base/language";
-const PASSWORD_PUBLIC_KEY_URL = "/v1/base/password-public-key";
+const SECRET_PUBLIC_KEY_URL = "/v1/base/secret-public-key";
 const OAUTH_PROVIDER_URL = "/v1/base/oauth/provider";
 const OAUTH_AUTHORIZATION_URL = "/v1/base/oauth/authorization";
 const OAUTH_TICKET_URL = "/v1/base/oauth/ticket";
@@ -36,7 +36,7 @@ const NO_AUTH_URL_SET = new Set([
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
@@ -50,7 +50,7 @@ const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
@@ -369,7 +369,8 @@ service.interceptors.response.use(
     const requestConfig = error.config as RetryableRequestConfig | undefined;
 
     // 退出或认证失效后，页面中的在途请求返回 401 属于预期结果，不再重复刷新令牌、弹窗或提示错误。
-    if (isAuthTransitioning()) {
+    // 登录等公共认证接口不受此限制：用户在登录页主动提交失败时必须给出错误反馈（如用户名或密码错误）。
+    if (isAuthTransitioning() && !shouldSkipAuthExpiredPrompt(requestConfig)) {
       return Promise.reject(error);
     }
 

package/dist/package/src/utils/{passwordCrypto.ts → secretCrypto.ts}

@@ -1,13 +1,112 @@
-import { defLoginService } from "../api/base/v1/login";
-import { PasswordCryptoScene, type PasswordPublicKeyResponse } from "../rpc/base/v1/login";
-import type { PasswordCrypto } from "../rpc/common/v1/types";
+import { defSecretCryptoService } from "../api/base/v1/secret_crypto";
+import type { GetSecretPublicKeyResponse } from "../rpc/base/v1/secret_crypto";
+import type { SecretCrypto } from "../rpc/common/v1/types";
+import type { ProFormField } from "../components/ProForm/interface";
 import { t } from "../locales";
 import * as portableCrypto from "asmcrypto.js";
 
 type PortableCrypto = typeof import("asmcrypto.js");
 
-export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene;
-export type { PasswordCryptoScene };
+/** 获取敏感字段一次性临时公钥，同一次提交的多个密文字段共用该公钥。 */
+export async function fetchSecretPublicKey(): Promise<GetSecretPublicKeyResponse> {
+  return defSecretCryptoService.GetSecretPublicKey({});
+}
+
+/** encodeSecretFields 在提交前把声明 secret 的字段统一加密为 SecretCrypto，返回模型浅克隆且不改动原表单。 */
+export async function encodeSecretFields(
+  fields: ProFormField[],
+  model: Record<string, any>
+): Promise<Record<string, any>> {
+  const secretFields = fields.filter(field => field.secret);
+  const filled = secretFields
+    .map(field => ({ field, value: getByPath(model, field.prop) }))
+    .filter((item): item is { field: ProFormField; value: string } => typeof item.value === "string" && item.value.trim() !== "");
+  if (secretFields.length === 0) {
+    return { ...model };
+  }
+  const publicKey = filled.length > 0 ? await fetchSecretPublicKey() : null;
+  const payload = { ...model };
+  for (const item of secretFields) {
+    const value = getByPath(model, item.prop);
+    if (typeof value === "string" && value.trim() !== "") {
+      payload[item.prop] = await encryptWithPublicKey(publicKey!, value);
+    } else {
+      payload[item.prop] = undefined;
+    }
+  }
+  return payload;
+}
+
+/** 按点路径读取对象字段值。 */
+function getByPath(model: Record<string, any>, path: string) {
+  return path.split(".").reduce((current, key) => (current == null ? current : current[key]), model as any);
+}
+
+/** 使用已获取的临时公钥加密单个敏感值，供一次取钥加密多个字段的场景复用。 */
+export async function encryptWithPublicKey(publicKey: GetSecretPublicKeyResponse, value: string): Promise<SecretCrypto> {
+  if (!value) {
+    throw new Error(t("core.password.required"));
+  }
+  const cryptoApi = globalThis.crypto;
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
+    return encryptPortableSecret(portableCrypto, value, publicKey);
+  }
+  const subtleCrypto = getSubtleCrypto();
+  const publicKeyKey = await subtleCrypto.subtle.importKey(
+    "spki",
+    pemToArrayBuffer(publicKey.public_key),
+    { name: "RSA-OAEP", hash: "SHA-256" },
+    false,
+    ["encrypt"]
+  );
+  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
+  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
+  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(value));
+  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKeyKey, rawAesKey);
+
+  return {
+    key_id: publicKey.key_id,
+    nonce: publicKey.nonce,
+    algorithm: publicKey.algorithm,
+    encrypted_key: arrayBufferToBase64(encryptedKey),
+    iv: arrayBufferToBase64(iv.buffer),
+    text: arrayBufferToBase64(ciphertext)
+  };
+}
+
+/** 加密单个敏感字段值，自动获取一次性临时公钥。 */
+export async function encryptSecret(value: string): Promise<SecretCrypto> {
+  return encryptWithPublicKey(await fetchSecretPublicKey(), value);
+}
+
+/** SecretRevealHandler 按资源标识与字段名查看密钥明文的实现。 */
+export type SecretRevealHandler = (resource: string, id: number, field: string) => Promise<string>;
+
+let secretRevealHandler: SecretRevealHandler | null = null;
+
+/** registerSecretRevealHandler 注册密钥明文查看实现，由业务模块在启动时注入。 */
+export function registerSecretRevealHandler(handler: SecretRevealHandler) {
+  secretRevealHandler = handler;
+}
+
+/** revealSecret 查看注册过的密钥字段明文。 */
+export async function revealSecret(resource: string, id: number, field: string): Promise<string> {
+  if (!secretRevealHandler) {
+    throw new Error(t("core.password.reveal_unsupported"));
+  }
+  return secretRevealHandler(resource, id, field);
+}
+
+/** 加密密码字段：去除首尾空白且不允许为空。 */
+export async function encryptPassword(value: string): Promise<SecretCrypto> {
+  const plainPassword = value.trim();
+  if (!plainPassword) {
+    throw new Error(t("core.password.required"));
+  }
+  return encryptSecret(plainPassword);
+}
 
 /** 将 PEM 公钥转换为二进制 DER 数据。 */
 function pemToArrayBuffer(pem: string) {
@@ -129,7 +228,7 @@ function generateMgf1Mask(cryptoApi: PortableCrypto, seed: Uint8Array, length: n
   return mask;
 }
 
-/** 生成纯 JavaScript 密码加密所需的随机字节。 */
+/** 生成纯 JavaScript 加密所需的随机字节。 */
 function getPortableRandomBytes(length: number) {
   const cryptoApi = globalThis.crypto;
   if (!cryptoApi?.getRandomValues) {
@@ -138,15 +237,15 @@ function getPortableRandomBytes(length: number) {
   return cryptoApi.getRandomValues(new Uint8Array(length));
 }
 
-/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的密码加密协议。 */
-async function encryptPortablePassword(
+/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 环境的敏感值加密协议。 */
+async function encryptPortableSecret(
   cryptoApi: PortableCrypto,
-  password: string,
-  publicKeyResponse: PasswordPublicKeyResponse
-): Promise<PasswordCrypto> {
+  value: string,
+  publicKeyResponse: GetSecretPublicKeyResponse
+): Promise<SecretCrypto> {
   const aesKey = getPortableRandomBytes(32);
   const iv = getPortableRandomBytes(12);
-  const plaintext = cryptoApi.string_to_bytes(password, true);
+  const plaintext = cryptoApi.string_to_bytes(value, true);
   const [modulus, exponent] = parsePortableRsaPublicKey(publicKeyResponse.public_key);
   const hash = new cryptoApi.Sha256();
   const keySize = Math.ceil(new cryptoApi.BigNumber(modulus).bitLength / 8);
@@ -187,43 +286,6 @@ async function encryptPortablePassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: arrayBufferToBase64(encryptedKey.slice().buffer),
     iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext.slice().buffer)
-  };
-}
-
-/** 加密单个密码字段，返回后端可解析的密码密文。 */
-export async function encryptPassword(password: string, scene: PasswordCryptoScene): Promise<PasswordCrypto> {
-  const plainPassword = password.trim();
-  if (!plainPassword) {
-    throw new Error(t("core.password.required"));
-  }
-
-  const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene });
-  const cryptoApi = globalThis.crypto;
-  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
-  if (!cryptoApi?.subtle || !isSecureContext) {
-    return encryptPortablePassword(portableCrypto, plainPassword, publicKeyResponse);
-  }
-  const subtleCrypto = getSubtleCrypto();
-  const publicKey = await subtleCrypto.subtle.importKey(
-    "spki",
-    pemToArrayBuffer(publicKeyResponse.public_key),
-    { name: "RSA-OAEP", hash: "SHA-256" },
-    false,
-    ["encrypt"]
-  );
-  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
-  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
-  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
-  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
-
-  return {
-    key_id: publicKeyResponse.key_id,
-    nonce: publicKeyResponse.nonce,
-    algorithm: publicKeyResponse.algorithm,
-    encrypted_key: arrayBufferToBase64(encryptedKey),
-    iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext)
+    text: arrayBufferToBase64(ciphertext.slice().buffer)
   };
 }

package/dist/package/src/views/demo/components/DemoDetailDrawer.vue

@@ -0,0 +1,108 @@
+<!--
+  Demo 共享详情抽屉：演示管理端标准的“详情展示”形态。
+
+  组成结构（均为 Element Plus 原生组件，core 未封装 ProDescriptions）：
+  - el-drawer（size 62%）承载数据，关闭时通过 update:modelValue 同步父组件；
+  - el-tabs 分页签：基本信息 / 流程进度 / 操作时间线 / 原始数据；
+  - el-descriptions 描述列表（参照 system/base/api/index.vue 的详情抽屉写法）；
+  - el-steps / el-timeline / el-collapse 展示流程、时间线与 JSON 原文。
+
+  各表格页把行数据组装成 DemoDetailModel 后传给本组件即可复用。
+-->
+<template>
+  <el-drawer
+    :model-value="modelValue"
+    :title="detail?.title ?? t('common.action.detail')"
+    size="62%"
+    @update:model-value="value => emit('update:modelValue', value)"
+  >
+    <el-tabs v-if="detail">
+      <!-- 页签一：基本信息，多组 el-descriptions 描述列表 -->
+      <el-tab-pane :label="t('core.demo.detail.tab.basic')">
+        <div v-for="section in detail.sections" :key="section.title" class="detail-section">
+          <el-divider content-position="left">{{ section.title }}</el-divider>
+          <el-descriptions :column="2" border>
+            <el-descriptions-item v-for="field in section.fields" :key="field.label" :label="field.label">
+              <el-tag v-if="field.tag" :type="field.tagType ?? 'info'" effect="plain">{{ field.value }}</el-tag>
+              <template v-else>{{ field.value }}</template>
+            </el-descriptions-item>
+          </el-descriptions>
+        </div>
+      </el-tab-pane>
+
+      <!-- 页签二：流程进度，el-steps 展示节点流转 -->
+      <el-tab-pane :label="t('core.demo.detail.tab.progress')">
+        <el-steps :active="detail.steps.length - 1" align-center finish-status="success">
+          <el-step v-for="(step, index) in detail.steps" :key="step.title" :title="step.title" :description="`T+${index}`" />
+        </el-steps>
+      </el-tab-pane>
+
+      <!-- 页签三：操作时间线，el-timeline 按时间倒序展示 -->
+      <el-tab-pane :label="t('core.demo.detail.tab.timeline')">
+        <el-timeline>
+          <el-timeline-item
+            v-for="item in detail.timeline"
+            :key="item.timestamp"
+            :timestamp="item.timestamp"
+            :type="item.type"
+          >
+            {{ item.title }}
+          </el-timeline-item>
+        </el-timeline>
+      </el-tab-pane>
+
+      <!-- 页签四：原始数据，el-collapse 折叠面板内展示格式化 JSON -->
+      <el-tab-pane :label="t('core.demo.detail.tab.raw')">
+        <el-collapse :model-value="rawPanelName">
+          <el-collapse-item :title="t('core.demo.detail.raw.title')" :name="rawPanelName">
+            <pre class="detail-raw">{{ JSON.stringify(detail.raw, null, 2) }}</pre>
+          </el-collapse-item>
+        </el-collapse>
+      </el-tab-pane>
+    </el-tabs>
+  </el-drawer>
+</template>
+
+<script setup lang="ts">
+import { t } from "../../../locales";
+import type { DemoDetailModel } from "../demo-data";
+
+defineOptions({
+  name: "DemoDetailDrawer"
+});
+
+/** 组件入参：modelValue 控制显隐，detail 为页面组装好的详情模型。 */
+defineProps<{
+  /** 抽屉显隐，v-model 双向绑定。 */
+  modelValue: boolean;
+  /** 详情模型，为空时抽屉仅显示标题占位。 */
+  detail: DemoDetailModel | null;
+}>();
+
+const emit = defineEmits<{
+  "update:modelValue": [value: boolean];
+}>();
+
+/** 原始数据折叠面板默认展开的名称。 */
+const rawPanelName = "raw";
+</script>
+
+<style scoped>
+/* 分组之间留出间距，描述列表与分组标题紧凑排列 */
+.detail-section + .detail-section {
+  margin-top: 16px;
+}
+
+/* JSON 原文使用等宽字体并限制纵向滚动，适配暗色主题文字变量 */
+.detail-raw {
+  max-height: 420px;
+  margin: 0;
+  overflow: auto;
+  font-family: var(--el-font-family-monospace, monospace);
+  font-size: 12px;
+  line-height: 1.6;
+  color: var(--el-text-color-regular);
+  white-space: pre-wrap;
+  word-break: break-all;
+}
+</style>