@liujitcn/kratos-admin-core 0.0.66 → 0.0.67

package/dist/package/src/components/ProForm/components/SecretInput.vue

@@ -0,0 +1,117 @@
+<template>
+  <el-input
+    :model-value="modelValue"
+    :type="visible ? 'text' : 'password'"
+    autocomplete="new-password"
+    v-bind="inputAttrs"
+    @update:model-value="onInput"
+  >
+    <template #suffix>
+      <el-icon class="secret-input__toggle" @click="toggle">
+        <Loading v-if="loading" />
+        <View v-else-if="visible" />
+        <Hide v-else />
+      </el-icon>
+    </template>
+  </el-input>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, useAttrs } from "vue";
+import { ElMessage } from "element-plus";
+import { Hide, Loading, View } from "@element-plus/icons-vue";
+import type { ProFormSecretConfig } from "../../../components/ProForm/interface";
+import { revealSecret } from "../../../utils/secretCrypto";
+import { t } from "../../../locales";
+
+/** SecretInput 组件属性。 */
+interface SecretInputProps {
+  /** 字段值。 */
+  modelValue?: string;
+  /** 查看配置：声明后眼睛点击时按需拉取明文。 */
+  secret?: boolean | ProFormSecretConfig;
+  /** 查看的资源标识。 */
+  resource?: string;
+  /** 查看的字段名。 */
+  fieldName?: string;
+  /** 记录ID。 */
+  recordId?: number;
+  /** 是否已配置密钥。 */
+  configured?: boolean;
+}
+
+const props = defineProps<SecretInputProps>();
+
+const emit = defineEmits<{
+  (event: "update:modelValue", value: string): void;
+}>();
+
+/** 明文是否可见。 */
+const visible = ref(false);
+/** 明文是否来自远端查看。 */
+const revealed = ref(false);
+/** 查看请求进行中。 */
+const loading = ref(false);
+
+/** 解析查看配置。 */
+const secretConfig = computed<ProFormSecretConfig | null>(() =>
+  typeof props.secret === "object" ? props.secret : null
+);
+
+// 透传调用方的 el-input 参数（maxlength、placeholder 等）。
+const attrs = useAttrs();
+
+/** 过滤掉原生密码框专属参数后透传其余输入参数。 */
+const inputAttrs = computed(() => {
+  const { showPassword: _ignored, ...rest } = { ...(attrs as Record<string, unknown>) };
+  return rest;
+});
+
+/** 判断当前是否可以查看远端明文。 */
+function canReveal() {
+  return Boolean(
+    secretConfig.value && props.resource && props.fieldName && (props.recordId ?? 0) > 0 && props.configured
+  );
+}
+
+/** 切换明文可见状态：查看态隐藏时清空回填的明文，保持"留空表示保留"语义。 */
+async function toggle() {
+  if (loading.value) return;
+  if (visible.value) {
+    visible.value = false;
+    if (revealed.value) {
+      revealed.value = false;
+      emit("update:modelValue", "");
+    }
+    return;
+  }
+  if (props.modelValue) {
+    visible.value = true;
+    return;
+  }
+  if (!canReveal()) return;
+  loading.value = true;
+  try {
+    const text = await revealSecret(props.resource!, (props.recordId ?? 0), props.fieldName!);
+    emit("update:modelValue", text);
+    revealed.value = true;
+    visible.value = true;
+  } catch (error) {
+    ElMessage.error(error instanceof Error ? error.message : t("core.password.reveal_failed"));
+  } finally {
+    loading.value = false;
+  }
+}
+
+/** 输入回调：本地输入的值不再视为远端明文。 */
+function onInput(value: string) {
+  revealed.value = false;
+  emit("update:modelValue", value);
+}
+</script>
+
+<style scoped lang="scss">
+.secret-input__toggle {
+  cursor: pointer;
+}
+</style>

package/dist/package/src/components/ProForm/interface/index.ts

@@ -13,6 +13,7 @@ export type ProFormComponentType =
   | "switch"
   | "checkbox"
   | "select"
+  | "cascader"
   | "tenant-select"
   | "dict"
   | "radio-group"
@@ -45,6 +46,18 @@ export interface ProFormOption {
   isLeaf?: boolean;
 }
 
+/** secret 字段的查看配置：声明后输入框眼睛点击时按需拉取明文。 */
+export interface ProFormSecretConfig {
+  /** 查看明文的资源标识。 */
+  resource: string;
+  /** 查看明文的字段名。 */
+  field: string;
+  /** 记录ID字段名，默认 "id"。 */
+  idProp?: string;
+  /** 已配置标记字段名，默认 `${field}_configured`。 */
+  configuredProp?: string;
+}
+
 /** ProForm 字段配置。 */
 export interface ProFormField {
   /** 字段绑定路径，支持点路径访问嵌套对象。 */
@@ -69,6 +82,8 @@ export interface ProFormField {
   suffixSlotName?: string;
   /** 标题提示文案。 */
   labelTooltip?: string;
+  /** 提交时是否加密为 SecretCrypto 结构；配置对象时输入框眼睛支持按需查看明文。 */
+  secret?: boolean | ProFormSecretConfig;
   /** 字段校验规则。 */
   rules?: FormItemRule[];
   /** 字段是否显示。 */

package/dist/package/src/locales/README.md

@@ -9,4 +9,4 @@
 | `en-US.json` | 英文公共语言包。 | 管理端切换为英文时由 Vue I18n 使用。 |
 | `ja-JP.json` | 日文公共语言包。 | 管理端切换为日文时由 Vue I18n 使用。 |
 
-语言包是标准 JSON，不能在文件内直接写注释；新增语言或修改键后执行仓库根目录的 `make i18n`，脚本会校验所有语言并生成注册产物。语言切换选项固定显示后端 `base_language.native_name`，接口不可用时使用代码内置的原生名称；`common.language.*` 仅用于普通文案和语言迁移初始数据。新增语言的完整文件清单见[国际化语言扩展指南](../../../../../../docs/国际化语言扩展指南.md)。
+语言包是标准 JSON，不能在文件内直接写注释；新增语言或修改键后执行仓库根目录的 `make i18n`，脚本会校验所有语言并生成注册产物。语言切换选项固定显示后端 `base_language.native_name`，接口不可用时使用代码内置的原生名称；`common.language.*` 仅用于普通文案和语言迁移初始数据。新增语言的完整文件清单见[国际化设计与语言扩展](../../../../../../docs/国际化最终方案.md)。

package/dist/package/src/locales/en-US.json

@@ -475,5 +475,13 @@
   "core.demo.detail.timeline.created": "Record created",
   "core.demo.detail.timeline.updated": "Base info updated",
   "core.demo.detail.timeline.enabled": "Record enabled",
-  "core.demo.detail.timeline.disabled": "Record disabled"
+  "core.demo.detail.timeline.disabled": "Record disabled",
+  "core.password.reveal_unsupported": "Secret reveal is not registered in this environment",
+  "core.password.reveal_failed": "Failed to reveal the secret",
+  "core.demo.table.tag_item": "Tag {index}",
+  "core.demo.table.money_unit": " CNY",
+  "core.demo.form.tenant.main": "Demo main tenant",
+  "core.demo.form.tenant.sub": "Demo sub-tenant",
+  "core.demo.form.leader_title": "{name} Lead",
+  "core.demo.tree.new_dir": "Demo directory {id}"
 }

package/dist/package/src/locales/ja-JP.json

@@ -475,5 +475,13 @@
   "core.demo.detail.timeline.created": "記録を作成しました",
   "core.demo.detail.timeline.updated": "基本情報を更新しました",
   "core.demo.detail.timeline.enabled": "記録を有効化しました",
-  "core.demo.detail.timeline.disabled": "記録を無効化しました"
+  "core.demo.detail.timeline.disabled": "記録を無効化しました",
+  "core.password.reveal_unsupported": "この環境ではシークレット表示が登録されていません",
+  "core.password.reveal_failed": "シークレットの表示に失敗しました",
+  "core.demo.table.tag_item": "タグ {index}",
+  "core.demo.table.money_unit": " 円",
+  "core.demo.form.tenant.main": "Demoメインテナント",
+  "core.demo.form.tenant.sub": "Demoサブテナント",
+  "core.demo.form.leader_title": "{name}リーダー",
+  "core.demo.tree.new_dir": "Demoディレクトリ {id}"
 }

package/dist/package/src/locales/zh-CN.json

@@ -475,5 +475,13 @@
   "core.demo.detail.timeline.created": "创建了记录",
   "core.demo.detail.timeline.updated": "更新了基础信息",
   "core.demo.detail.timeline.enabled": "启用了记录",
-  "core.demo.detail.timeline.disabled": "停用了记录"
+  "core.demo.detail.timeline.disabled": "停用了记录",
+  "core.password.reveal_unsupported": "当前环境未注册密钥查看能力",
+  "core.password.reveal_failed": "查看密钥失败",
+  "core.demo.table.tag_item": "标签 {index}",
+  "core.demo.table.money_unit": " 元",
+  "core.demo.form.tenant.main": "Demo 总租户",
+  "core.demo.form.tenant.sub": "Demo 子租户",
+  "core.demo.form.leader_title": "{name}负责人",
+  "core.demo.tree.new_dir": "Demo 目录 {id}"
 }

package/dist/package/src/locales/zh-TW.json

@@ -475,5 +475,13 @@
   "core.demo.detail.timeline.created": "創建了記錄",
   "core.demo.detail.timeline.updated": "更新了基礎資訊",
   "core.demo.detail.timeline.enabled": "啟用了記錄",
-  "core.demo.detail.timeline.disabled": "停用了記錄"
+  "core.demo.detail.timeline.disabled": "停用了記錄",
+  "core.password.reveal_unsupported": "目前環境未註冊密鑰查看能力",
+  "core.password.reveal_failed": "查看密鑰失敗",
+  "core.demo.table.tag_item": "標籤 {index}",
+  "core.demo.table.money_unit": " 元",
+  "core.demo.form.tenant.main": "Demo 總租戶",
+  "core.demo.form.tenant.sub": "Demo 子租戶",
+  "core.demo.form.leader_title": "{name}負責人",
+  "core.demo.tree.new_dir": "Demo 目錄 {id}"
 }

package/dist/package/src/rpc/base/v1/login.ts

@@ -5,27 +5,9 @@
 // source: base/v1/login.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 
-/** 密码加密场景枚举。 */
-export enum PasswordCryptoScene {
-  /** PASSWORD_CRYPTO_SCENE_UNSPECIFIED - 未指定密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_UNSPECIFIED = 0,
-  /** PASSWORD_CRYPTO_SCENE_LOGIN - 登录密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_LOGIN = 1,
-  /** PASSWORD_CRYPTO_SCENE_CREATE_BASE_USER - 新增后台用户密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_CREATE_BASE_USER = 2,
-  /** PASSWORD_CRYPTO_SCENE_RESET_BASE_USER_PASSWORD - 重置后台用户密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_RESET_BASE_USER_PASSWORD = 3,
-  /** PASSWORD_CRYPTO_SCENE_UPDATE_USER_PASSWORD - 个人修改密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_UPDATE_USER_PASSWORD = 4,
-  /** PASSWORD_CRYPTO_SCENE_MFA - 多因素认证敏感操作场景。 */
-  PASSWORD_CRYPTO_SCENE_MFA = 5,
-  /** PASSWORD_CRYPTO_SCENE_CONFIGURE_PASSWORD_POLICY - 密码策略初始化密码配置场景。 */
-  PASSWORD_CRYPTO_SCENE_CONFIGURE_PASSWORD_POLICY = 6,
-}
-
 /**
  * LoginStatus 表示登录请求当前所处的认证阶段。
  * 只有 AUTHENTICATED 或 PASSWORD_CHANGE_REQUIRED 才会携带正式访问令牌，MFA 状态必须继续完成挑战。
@@ -49,12 +31,6 @@ export interface CaptchaRequest {
   type: string;
 }
 
-/** 密码临时公钥获取条件 */
-export interface PasswordPublicKeyRequest {
-  /** 使用场景 */
-  scene: PasswordCryptoScene;
-}
-
 /** 登出请求条件 */
 export interface LogoutRequest {
 }
@@ -85,20 +61,6 @@ export interface VerifyCaptchaResponse {
   expires_in: number;
 }
 
-/** 密码临时公钥响应 */
-export interface PasswordPublicKeyResponse {
-  /** 临时密钥ID */
-  key_id: string;
-  /** 临时公钥 */
-  public_key: string;
-  /** 加密算法 */
-  algorithm: string;
-  /** 随机值 */
-  nonce: string;
-  /** 有效时间，单位秒 */
-  expires_in: number;
-}
-
 /** 刷新令牌请求参数 */
 export interface RefreshTokenRequest {
   /** 更新令牌；未填写时由服务端从HttpOnly Cookie读取。 */
@@ -125,7 +87,7 @@ export interface LoginRequest {
   user_name: string;
   /** 用户的密码，必选项。 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 验证码 */
   captcha_code: string;
@@ -165,8 +127,6 @@ export interface LoginService {
   Captcha(request: CaptchaRequest): Promise<CaptchaResponse>;
   /** 验证码预校验 */
   VerifyCaptcha(request: VerifyCaptchaRequest): Promise<VerifyCaptchaResponse>;
-  /** 获取密码临时公钥 */
-  PasswordPublicKey(request: PasswordPublicKeyRequest): Promise<PasswordPublicKeyResponse>;
   /** 登出 */
   Logout(request: LogoutRequest): Promise<Empty>;
   /** 刷新认证令牌 */

package/dist/package/src/rpc/base/v1/mfa.ts

@@ -5,7 +5,7 @@
 // source: base/v1/mfa.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 import type { LoginResponse } from "./login";
 
@@ -79,7 +79,7 @@ export interface MfaStatusResponse {
 export interface BeginMfaSetupRequest {
   /** 当前登录密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 强制绑定场景下的临时票据 */
   setup_ticket: string;
@@ -135,7 +135,7 @@ export interface BeginMfaDisableResponse {
 export interface DisableMfaRequest {
   /** 当前登录密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** TOTP 动态口令 */
   code: string;

package/dist/package/src/rpc/base/v1/oauth.ts

@@ -5,7 +5,7 @@
 // source: base/v1/oauth.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 import type { LoginStatus } from "./login";
 
@@ -77,7 +77,7 @@ export interface BindOauthSessionRequest {
   user_name: string;
   /** 用户密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 验证码 */
   captcha_code: string;

package/dist/package/src/rpc/base/v1/secret_crypto.ts

@@ -0,0 +1,49 @@
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v2.11.8
+//   protoc               unknown
+// source: base/v1/secret_crypto.proto
+
+/* eslint-disable */
+
+/** 敏感字段临时公钥获取条件 */
+export interface GetSecretPublicKeyRequest {
+}
+
+/** 敏感字段临时公钥响应 */
+export interface GetSecretPublicKeyResponse {
+  /** 临时密钥ID */
+  key_id: string;
+  /** 临时公钥 */
+  public_key: string;
+  /** 加密算法 */
+  algorithm: string;
+  /** 随机值 */
+  nonce: string;
+  /** 有效时间，单位秒 */
+  expires_in: number;
+}
+
+/** 密钥字段查看条件 */
+export interface RevealSecretFieldRequest {
+  /** 资源标识，如 ai_provider、base_oauth_provider、base_message_provider */
+  resource: string;
+  /** 记录ID */
+  id: number;
+  /** 字段名，如 api_key、client_secret */
+  field: string;
+}
+
+/** 密钥字段查看响应 */
+export interface RevealSecretFieldResponse {
+  /** 密钥明文 */
+  text: string;
+}
+
+/** 敏感字段加密公共服务 */
+export interface SecretCryptoService {
+  /** 获取敏感字段临时公钥，同一次提交的多个密文字段共用该公钥 */
+  GetSecretPublicKey(request: GetSecretPublicKeyRequest): Promise<GetSecretPublicKeyResponse>;
+  /** 查看密钥字段明文，仅允许查询注册过的密钥字段 */
+  RevealSecretField(request: RevealSecretFieldRequest): Promise<RevealSecretFieldResponse>;
+}

package/dist/package/src/rpc/common/v1/types.ts

@@ -60,8 +60,8 @@ export interface BytesValues {
   value: Uint8Array[];
 }
 
-/** 密码密文。 */
-export interface PasswordCrypto {
+/** 敏感字段密文，密码与各类密钥字段统一使用。 */
+export interface SecretCrypto {
   /** 临时密钥ID */
   key_id: string;
   /** 随机值 */
@@ -72,6 +72,6 @@ export interface PasswordCrypto {
   encrypted_key: string;
   /** 初始化向量 */
   iv: string;
-  /** 密码加密数据 */
-  ciphertext: string;
+  /** 传输时为密文，服务端解密后回填明文 */
+  text: string;
 }

package/dist/package/src/rpc/system/admin/v1/auth.ts

@@ -5,7 +5,7 @@
 // source: system/admin/v1/auth.proto
 
 /* eslint-disable */
-import type { PasswordCrypto, StringValues } from "../../../common/v1/types";
+import type { SecretCrypto, StringValues } from "../../../common/v1/types";
 import type { Empty } from "../../../google/protobuf/empty";
 import type { BaseUserIDType } from "../../common/v1/common";
 import type { BaseMenuType } from "./common";
@@ -202,10 +202,10 @@ export interface RouteParams {
 export interface UserPasswordForm {
   /** 原密码 */
   old_pwd:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 新密码 */
-  new_pwd: PasswordCrypto | undefined;
+  new_pwd: SecretCrypto | undefined;
 }
 
 /** 用户手机号表单 */

package/dist/package/src/security.ts

@@ -1,5 +1,5 @@
 export * from "./utils/oauthProvider";
-export * from "./utils/passwordCrypto";
+export * from "./utils/secretCrypto";
 export * from "./utils/passwordStrength";
 export * from "./utils/webauthn";
 export * from "./utils/clipboard";

package/dist/package/src/utils/request.ts

@@ -22,7 +22,7 @@ const PASSWORD_CHANGE_STATE_STORAGE_KEY = "admin-password-change-required";
 const CAPTCHA_URL = "/v1/base/captcha";
 const CONFIG_URL = "/v1/base/config";
 const LANGUAGE_URL = "/v1/base/language";
-const PASSWORD_PUBLIC_KEY_URL = "/v1/base/password-public-key";
+const SECRET_PUBLIC_KEY_URL = "/v1/base/secret-public-key";
 const OAUTH_PROVIDER_URL = "/v1/base/oauth/provider";
 const OAUTH_AUTHORIZATION_URL = "/v1/base/oauth/authorization";
 const OAUTH_TICKET_URL = "/v1/base/oauth/ticket";
@@ -36,7 +36,7 @@ const NO_AUTH_URL_SET = new Set([
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,
@@ -50,7 +50,7 @@ const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
   OAUTH_PROVIDER_URL,
   OAUTH_AUTHORIZATION_URL,
   OAUTH_TICKET_URL,

package/dist/package/src/utils/{passwordCrypto.ts → secretCrypto.ts}

@@ -1,13 +1,112 @@
-import { defLoginService } from "../api/base/v1/login";
-import { PasswordCryptoScene, type PasswordPublicKeyResponse } from "../rpc/base/v1/login";
-import type { PasswordCrypto } from "../rpc/common/v1/types";
+import { defSecretCryptoService } from "../api/base/v1/secret_crypto";
+import type { GetSecretPublicKeyResponse } from "../rpc/base/v1/secret_crypto";
+import type { SecretCrypto } from "../rpc/common/v1/types";
+import type { ProFormField } from "../components/ProForm/interface";
 import { t } from "../locales";
 import * as portableCrypto from "asmcrypto.js";
 
 type PortableCrypto = typeof import("asmcrypto.js");
 
-export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene;
-export type { PasswordCryptoScene };
+/** 获取敏感字段一次性临时公钥，同一次提交的多个密文字段共用该公钥。 */
+export async function fetchSecretPublicKey(): Promise<GetSecretPublicKeyResponse> {
+  return defSecretCryptoService.GetSecretPublicKey({});
+}
+
+/** encodeSecretFields 在提交前把声明 secret 的字段统一加密为 SecretCrypto，返回模型浅克隆且不改动原表单。 */
+export async function encodeSecretFields(
+  fields: ProFormField[],
+  model: Record<string, any>
+): Promise<Record<string, any>> {
+  const secretFields = fields.filter(field => field.secret);
+  const filled = secretFields
+    .map(field => ({ field, value: getByPath(model, field.prop) }))
+    .filter((item): item is { field: ProFormField; value: string } => typeof item.value === "string" && item.value.trim() !== "");
+  if (secretFields.length === 0) {
+    return { ...model };
+  }
+  const publicKey = filled.length > 0 ? await fetchSecretPublicKey() : null;
+  const payload = { ...model };
+  for (const item of secretFields) {
+    const value = getByPath(model, item.prop);
+    if (typeof value === "string" && value.trim() !== "") {
+      payload[item.prop] = await encryptWithPublicKey(publicKey!, value);
+    } else {
+      payload[item.prop] = undefined;
+    }
+  }
+  return payload;
+}
+
+/** 按点路径读取对象字段值。 */
+function getByPath(model: Record<string, any>, path: string) {
+  return path.split(".").reduce((current, key) => (current == null ? current : current[key]), model as any);
+}
+
+/** 使用已获取的临时公钥加密单个敏感值，供一次取钥加密多个字段的场景复用。 */
+export async function encryptWithPublicKey(publicKey: GetSecretPublicKeyResponse, value: string): Promise<SecretCrypto> {
+  if (!value) {
+    throw new Error(t("core.password.required"));
+  }
+  const cryptoApi = globalThis.crypto;
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
+    return encryptPortableSecret(portableCrypto, value, publicKey);
+  }
+  const subtleCrypto = getSubtleCrypto();
+  const publicKeyKey = await subtleCrypto.subtle.importKey(
+    "spki",
+    pemToArrayBuffer(publicKey.public_key),
+    { name: "RSA-OAEP", hash: "SHA-256" },
+    false,
+    ["encrypt"]
+  );
+  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
+  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
+  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(value));
+  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKeyKey, rawAesKey);
+
+  return {
+    key_id: publicKey.key_id,
+    nonce: publicKey.nonce,
+    algorithm: publicKey.algorithm,
+    encrypted_key: arrayBufferToBase64(encryptedKey),
+    iv: arrayBufferToBase64(iv.buffer),
+    text: arrayBufferToBase64(ciphertext)
+  };
+}
+
+/** 加密单个敏感字段值，自动获取一次性临时公钥。 */
+export async function encryptSecret(value: string): Promise<SecretCrypto> {
+  return encryptWithPublicKey(await fetchSecretPublicKey(), value);
+}
+
+/** SecretRevealHandler 按资源标识与字段名查看密钥明文的实现。 */
+export type SecretRevealHandler = (resource: string, id: number, field: string) => Promise<string>;
+
+let secretRevealHandler: SecretRevealHandler | null = null;
+
+/** registerSecretRevealHandler 注册密钥明文查看实现，由业务模块在启动时注入。 */
+export function registerSecretRevealHandler(handler: SecretRevealHandler) {
+  secretRevealHandler = handler;
+}
+
+/** revealSecret 查看注册过的密钥字段明文。 */
+export async function revealSecret(resource: string, id: number, field: string): Promise<string> {
+  if (!secretRevealHandler) {
+    throw new Error(t("core.password.reveal_unsupported"));
+  }
+  return secretRevealHandler(resource, id, field);
+}
+
+/** 加密密码字段：去除首尾空白且不允许为空。 */
+export async function encryptPassword(value: string): Promise<SecretCrypto> {
+  const plainPassword = value.trim();
+  if (!plainPassword) {
+    throw new Error(t("core.password.required"));
+  }
+  return encryptSecret(plainPassword);
+}
 
 /** 将 PEM 公钥转换为二进制 DER 数据。 */
 function pemToArrayBuffer(pem: string) {
@@ -129,7 +228,7 @@ function generateMgf1Mask(cryptoApi: PortableCrypto, seed: Uint8Array, length: n
   return mask;
 }
 
-/** 生成纯 JavaScript 密码加密所需的随机字节。 */
+/** 生成纯 JavaScript 加密所需的随机字节。 */
 function getPortableRandomBytes(length: number) {
   const cryptoApi = globalThis.crypto;
   if (!cryptoApi?.getRandomValues) {
@@ -138,15 +237,15 @@ function getPortableRandomBytes(length: number) {
   return cryptoApi.getRandomValues(new Uint8Array(length));
 }
 
-/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的密码加密协议。 */
-async function encryptPortablePassword(
+/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 环境的敏感值加密协议。 */
+async function encryptPortableSecret(
   cryptoApi: PortableCrypto,
-  password: string,
-  publicKeyResponse: PasswordPublicKeyResponse
-): Promise<PasswordCrypto> {
+  value: string,
+  publicKeyResponse: GetSecretPublicKeyResponse
+): Promise<SecretCrypto> {
   const aesKey = getPortableRandomBytes(32);
   const iv = getPortableRandomBytes(12);
-  const plaintext = cryptoApi.string_to_bytes(password, true);
+  const plaintext = cryptoApi.string_to_bytes(value, true);
   const [modulus, exponent] = parsePortableRsaPublicKey(publicKeyResponse.public_key);
   const hash = new cryptoApi.Sha256();
   const keySize = Math.ceil(new cryptoApi.BigNumber(modulus).bitLength / 8);
@@ -187,43 +286,6 @@ async function encryptPortablePassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: arrayBufferToBase64(encryptedKey.slice().buffer),
     iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext.slice().buffer)
-  };
-}
-
-/** 加密单个密码字段，返回后端可解析的密码密文。 */
-export async function encryptPassword(password: string, scene: PasswordCryptoScene): Promise<PasswordCrypto> {
-  const plainPassword = password.trim();
-  if (!plainPassword) {
-    throw new Error(t("core.password.required"));
-  }
-
-  const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene });
-  const cryptoApi = globalThis.crypto;
-  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
-  if (!cryptoApi?.subtle || !isSecureContext) {
-    return encryptPortablePassword(portableCrypto, plainPassword, publicKeyResponse);
-  }
-  const subtleCrypto = getSubtleCrypto();
-  const publicKey = await subtleCrypto.subtle.importKey(
-    "spki",
-    pemToArrayBuffer(publicKeyResponse.public_key),
-    { name: "RSA-OAEP", hash: "SHA-256" },
-    false,
-    ["encrypt"]
-  );
-  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
-  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
-  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
-  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
-
-  return {
-    key_id: publicKeyResponse.key_id,
-    nonce: publicKeyResponse.nonce,
-    algorithm: publicKeyResponse.algorithm,
-    encrypted_key: arrayBufferToBase64(encryptedKey),
-    iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext)
+    text: arrayBufferToBase64(ciphertext.slice().buffer)
   };
 }