@liujitcn/kratos-admin-core 0.0.66 → 0.0.68

package/dist/package/src/utils/{passwordCrypto.ts → secretCrypto.ts}

@@ -1,13 +1,112 @@
-import { defLoginService } from "../api/base/v1/login";
-import { PasswordCryptoScene, type PasswordPublicKeyResponse } from "../rpc/base/v1/login";
-import type { PasswordCrypto } from "../rpc/common/v1/types";
+import { defSecretCryptoService } from "../api/base/v1/secret_crypto";
+import type { GetSecretPublicKeyResponse } from "../rpc/base/v1/secret_crypto";
+import type { SecretCrypto } from "../rpc/common/v1/types";
+import type { ProFormField } from "../components/ProForm/interface";
 import { t } from "../locales";
 import * as portableCrypto from "asmcrypto.js";
 
 type PortableCrypto = typeof import("asmcrypto.js");
 
-export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene;
-export type { PasswordCryptoScene };
+/** 获取敏感字段一次性临时公钥，同一次提交的多个密文字段共用该公钥。 */
+export async function fetchSecretPublicKey(): Promise<GetSecretPublicKeyResponse> {
+  return defSecretCryptoService.GetSecretPublicKey({});
+}
+
+/** encodeSecretFields 在提交前把声明 secret 的字段统一加密为 SecretCrypto，返回模型浅克隆且不改动原表单。 */
+export async function encodeSecretFields(
+  fields: ProFormField[],
+  model: Record<string, any>
+): Promise<Record<string, any>> {
+  const secretFields = fields.filter(field => field.secret);
+  const filled = secretFields
+    .map(field => ({ field, value: getByPath(model, field.prop) }))
+    .filter((item): item is { field: ProFormField; value: string } => typeof item.value === "string" && item.value.trim() !== "");
+  if (secretFields.length === 0) {
+    return { ...model };
+  }
+  const publicKey = filled.length > 0 ? await fetchSecretPublicKey() : null;
+  const payload = { ...model };
+  for (const item of secretFields) {
+    const value = getByPath(model, item.prop);
+    if (typeof value === "string" && value.trim() !== "") {
+      payload[item.prop] = await encryptWithPublicKey(publicKey!, value);
+    } else {
+      payload[item.prop] = undefined;
+    }
+  }
+  return payload;
+}
+
+/** 按点路径读取对象字段值。 */
+function getByPath(model: Record<string, any>, path: string) {
+  return path.split(".").reduce((current, key) => (current == null ? current : current[key]), model as any);
+}
+
+/** 使用已获取的临时公钥加密单个敏感值，供一次取钥加密多个字段的场景复用。 */
+export async function encryptWithPublicKey(publicKey: GetSecretPublicKeyResponse, value: string): Promise<SecretCrypto> {
+  if (!value) {
+    throw new Error(t("core.password.required"));
+  }
+  const cryptoApi = globalThis.crypto;
+  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
+  if (!cryptoApi?.subtle || !isSecureContext) {
+    return encryptPortableSecret(portableCrypto, value, publicKey);
+  }
+  const subtleCrypto = getSubtleCrypto();
+  const publicKeyKey = await subtleCrypto.subtle.importKey(
+    "spki",
+    pemToArrayBuffer(publicKey.public_key),
+    { name: "RSA-OAEP", hash: "SHA-256" },
+    false,
+    ["encrypt"]
+  );
+  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
+  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
+  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(value));
+  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKeyKey, rawAesKey);
+
+  return {
+    key_id: publicKey.key_id,
+    nonce: publicKey.nonce,
+    algorithm: publicKey.algorithm,
+    encrypted_key: arrayBufferToBase64(encryptedKey),
+    iv: arrayBufferToBase64(iv.buffer),
+    text: arrayBufferToBase64(ciphertext)
+  };
+}
+
+/** 加密单个敏感字段值，自动获取一次性临时公钥。 */
+export async function encryptSecret(value: string): Promise<SecretCrypto> {
+  return encryptWithPublicKey(await fetchSecretPublicKey(), value);
+}
+
+/** SecretRevealHandler 按资源标识与字段名查看密钥明文的实现。 */
+export type SecretRevealHandler = (resource: string, id: number, field: string) => Promise<string>;
+
+let secretRevealHandler: SecretRevealHandler | null = null;
+
+/** registerSecretRevealHandler 注册密钥明文查看实现，由业务模块在启动时注入。 */
+export function registerSecretRevealHandler(handler: SecretRevealHandler) {
+  secretRevealHandler = handler;
+}
+
+/** revealSecret 查看注册过的密钥字段明文。 */
+export async function revealSecret(resource: string, id: number, field: string): Promise<string> {
+  if (!secretRevealHandler) {
+    throw new Error(t("core.password.reveal_unsupported"));
+  }
+  return secretRevealHandler(resource, id, field);
+}
+
+/** 加密密码字段：去除首尾空白且不允许为空。 */
+export async function encryptPassword(value: string): Promise<SecretCrypto> {
+  const plainPassword = value.trim();
+  if (!plainPassword) {
+    throw new Error(t("core.password.required"));
+  }
+  return encryptSecret(plainPassword);
+}
 
 /** 将 PEM 公钥转换为二进制 DER 数据。 */
 function pemToArrayBuffer(pem: string) {
@@ -129,7 +228,7 @@ function generateMgf1Mask(cryptoApi: PortableCrypto, seed: Uint8Array, length: n
   return mask;
 }
 
-/** 生成纯 JavaScript 密码加密所需的随机字节。 */
+/** 生成纯 JavaScript 加密所需的随机字节。 */
 function getPortableRandomBytes(length: number) {
   const cryptoApi = globalThis.crypto;
   if (!cryptoApi?.getRandomValues) {
@@ -138,15 +237,15 @@ function getPortableRandomBytes(length: number) {
   return cryptoApi.getRandomValues(new Uint8Array(length));
 }
 
-/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的密码加密协议。 */
-async function encryptPortablePassword(
+/** 使用纯 JavaScript 实现兼容缺少 WebCrypto 环境的敏感值加密协议。 */
+async function encryptPortableSecret(
   cryptoApi: PortableCrypto,
-  password: string,
-  publicKeyResponse: PasswordPublicKeyResponse
-): Promise<PasswordCrypto> {
+  value: string,
+  publicKeyResponse: GetSecretPublicKeyResponse
+): Promise<SecretCrypto> {
   const aesKey = getPortableRandomBytes(32);
   const iv = getPortableRandomBytes(12);
-  const plaintext = cryptoApi.string_to_bytes(password, true);
+  const plaintext = cryptoApi.string_to_bytes(value, true);
   const [modulus, exponent] = parsePortableRsaPublicKey(publicKeyResponse.public_key);
   const hash = new cryptoApi.Sha256();
   const keySize = Math.ceil(new cryptoApi.BigNumber(modulus).bitLength / 8);
@@ -187,43 +286,6 @@ async function encryptPortablePassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: arrayBufferToBase64(encryptedKey.slice().buffer),
     iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext.slice().buffer)
-  };
-}
-
-/** 加密单个密码字段，返回后端可解析的密码密文。 */
-export async function encryptPassword(password: string, scene: PasswordCryptoScene): Promise<PasswordCrypto> {
-  const plainPassword = password.trim();
-  if (!plainPassword) {
-    throw new Error(t("core.password.required"));
-  }
-
-  const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene });
-  const cryptoApi = globalThis.crypto;
-  const isSecureContext = typeof window === "undefined" || window.isSecureContext;
-  if (!cryptoApi?.subtle || !isSecureContext) {
-    return encryptPortablePassword(portableCrypto, plainPassword, publicKeyResponse);
-  }
-  const subtleCrypto = getSubtleCrypto();
-  const publicKey = await subtleCrypto.subtle.importKey(
-    "spki",
-    pemToArrayBuffer(publicKeyResponse.public_key),
-    { name: "RSA-OAEP", hash: "SHA-256" },
-    false,
-    ["encrypt"]
-  );
-  const aesKey = await subtleCrypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt"]);
-  const rawAesKey = await subtleCrypto.subtle.exportKey("raw", aesKey);
-  const iv = subtleCrypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await subtleCrypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(plainPassword));
-  const encryptedKey = await subtleCrypto.subtle.encrypt({ name: "RSA-OAEP" }, publicKey, rawAesKey);
-
-  return {
-    key_id: publicKeyResponse.key_id,
-    nonce: publicKeyResponse.nonce,
-    algorithm: publicKeyResponse.algorithm,
-    encrypted_key: arrayBufferToBase64(encryptedKey),
-    iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext)
+    text: arrayBufferToBase64(ciphertext.slice().buffer)
   };
 }

package/dist/package/src/views/demo/components/DemoFormDialog.vue

@@ -123,13 +123,13 @@ const deptTreeOptions: ProFormOption[] = demoDeptTree.map(dept => ({
 
 /** 租户静态选项：tenant-select 传入 options 后不再请求租户接口，纯静态可渲染。 */
 const tenantOptions: ProFormOption[] = [
-  { label: "Demo 总租户", value: 1 },
-  { label: "Demo 子租户", value: 2 }
+  { label: t("core.demo.form.tenant.main"), value: 1 },
+  { label: t("core.demo.form.tenant.sub"), value: 2 }
 ];
 
 /** 协作成员穿梭框数据源：value 即选中后的 key。 */
 const memberOptions: ProFormOption[] = demoDeptTree[0].children!.map((dept, index) => ({
-  label: `${dept.name}负责人`,
+  label: t("core.demo.form.leader_title", { name: dept.name }),
   value: index + 1
 }));
 

package/dist/package/src/views/demo/table/index.vue

@@ -68,7 +68,7 @@ const statusTagOptions = [
 ];
 
 /** select-v2 大数据下拉的静态选项（isShow: false，仅出现在搜索区）。 */
-const tagSearchOptions = Array.from({ length: 50 }, (_, index) => ({ label: `标签 ${index + 1}`, value: `tag-${index + 1}` }));
+const tagSearchOptions = Array.from({ length: 50 }, (_, index) => ({ label: t("core.demo.table.tag_item", { index: index + 1 }), value: `tag-${index + 1}` }));
 
 /** tree-select 搜索项的静态团队树（isShow: false，仅出现在搜索区）。 */
 const ownerGroupOptions = demoRegionTree;
@@ -121,7 +121,7 @@ const columns = computed<ColumnProps[]>(() => [
     minWidth: 130,
     align: "right",
     cellType: "money",
-    moneyProps: { prefix: "¥", suffix: " 元" }
+    moneyProps: { prefix: "¥", suffix: t("core.demo.table.money_unit") }
   },
   {
     // 多级表头：_children 嵌套的列渲染在“任务情况”分组下

package/dist/package/src/views/demo/tree-grid/index.vue

@@ -180,7 +180,7 @@ function handleCreateChild(parentId?: number) {
 function handleFormSubmit(data: Record<string, any>) {
   const node: DemoCatalog = {
     id: ++nextId,
-    name: String(data.name || `Demo 目录 ${nextId}`),
+    name: String(data.name || t("core.demo.tree.new_dir", { id: nextId })),
     code: `demo-${nextId}`,
     owner: data.visibility === "private" ? "--" : "Demo",
     status: data.enabled ? STATUS_ENABLE : STATUS_DISABLE,

package/dist/package/src/views/login/components/LoginForm.vue

@@ -217,7 +217,7 @@ import { useKeepAliveStore } from "../../../stores/modules/keepAlive";
 import { initDynamicRouter } from "../../../routers/modules/dynamicRouter";
 import { isUnmatchedRoute, navigateTo, resolveFrontendRouteURL } from "../../../utils/router";
 import type { ElForm, FormRules } from "element-plus";
-import { PASSWORD_CRYPTO_SCENE, encryptPassword } from "../../../utils/passwordCrypto";
+import { encryptPassword } from "../../../utils/secretCrypto";
 import { useConfigStore } from "../../../stores/modules/config";
 import { Click as GoCaptchaClick, Rotate as GoCaptchaRotate, Slide as GoCaptchaSlide } from "go-captcha-vue";
 import "go-captcha-vue/dist/style.css";
@@ -797,7 +797,7 @@ const verifyCaptchaToken = async (captchaCode: string) => {
 const submitLogin = async (captchaToken: string) => {
   loading.value = true;
   try {
-    const password = await encryptPassword(loginForm.password, PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_LOGIN);
+    const password = await encryptPassword(loginForm.password);
     const loginRequest: LoginRequest = {
       tenant_code: configStore.showTenantCode ? loginForm.tenant_code : "0000",
       user_name: loginForm.user_name,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@liujitcn/kratos-admin-core",
   "private": false,
-  "version": "0.0.66",
+  "version": "0.0.68",
   "type": "module",
   "description": "kratos-admin frontend runtime and base modules",
   "author": {
@@ -232,7 +232,11 @@
       "types": "./dist/package/declarations/vite.config.d.ts",
       "default": "./vite.config.ts"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./utils/secretCrypto": {
+      "types": "./dist/package/declarations/src/utils/secretCrypto.d.ts",
+      "default": "./dist/package/src/utils/secretCrypto.ts"
+    }
   },
   "files": [
     "dist/package",

package/dist/package/declarations/src/utils/passwordCrypto.d.ts

@@ -1,6 +0,0 @@
-import { PasswordCryptoScene } from "../rpc/base/v1/login";
-import type { PasswordCrypto } from "../rpc/common/v1/types";
-export declare const PASSWORD_CRYPTO_SCENE: typeof PasswordCryptoScene;
-export type { PasswordCryptoScene };
-/** 加密单个密码字段，返回后端可解析的密码密文。 */
-export declare function encryptPassword(password: string, scene: PasswordCryptoScene): Promise<PasswordCrypto>;