@liujitcn/kratos-taro-app-core 0.0.58 → 0.0.60

package/package.json

@@ -7,7 +7,7 @@
     "type": "git",
     "url": "git@github.com:liujitcn/kratos-admin.git"
   },
-  "version": "0.0.58",
+  "version": "0.0.60",
   "type": "module",
   "files": [
     "dist",

package/src/api/base/v1/file.ts

@@ -7,7 +7,7 @@ import {
 } from '../../../rpc/base/v1/file'
 import { uploadFile, uploadFileList } from '../../../utils/file'
 import { getLocaleRequestHeaders, t } from '../../../locales'
-import { getRequestAccessToken, requestBaseURL } from '../../../utils/http'
+import { getRequestAccessToken, requestBaseURL, sourceClient } from '../../../utils/http'
 
 const FILE_URL = '/v1/base/file'
 
@@ -51,7 +51,7 @@ export class FileServiceImpl {
       header: {
         ...getLocaleRequestHeaders(),
         Authorization: token,
-        'source-client': 'miniapp',
+        'source-client': sourceClient,
       },
     })
     if (response.statusCode !== 200) throw new Error(t('core.file.download_failed'))

package/src/components/MfaRecoveryCodesDialog.tsx

@@ -1,5 +1,6 @@
 import { Button, Text, View } from '@tarojs/components'
 import Taro from '@tarojs/taro'
+import { useEffect, useRef } from 'react'
 import { useI18n } from '../locales'
 import './MfaRecoveryCodesDialog.scss'
 
@@ -20,6 +21,10 @@ export default function MfaRecoveryCodesDialog({
   onConfirm,
 }: MfaRecoveryCodesDialogProps) {
   const { t } = useI18n()
+  const confirmingRef = useRef(false)
+  useEffect(() => {
+    if (open) confirmingRef.current = false
+  }, [open])
   if (!open) return null
 
   const codesText = codes.join('\n')
@@ -31,6 +36,13 @@ export default function MfaRecoveryCodesDialog({
     await Taro.showToast({ icon: 'none', title: t('core.login.mfa_recovery_codes_copied') })
   }
 
+  /** 一次性消费确认动作，防止重复点击重复触发绑定流程。 */
+  const handleConfirm = () => {
+    if (confirmingRef.current) return
+    confirmingRef.current = true
+    void onConfirm()
+  }
+
   return (
     <View className='mfa-recovery-dialog'>
       <View className='mfa-recovery-dialog__panel' onClick={(event) => event.stopPropagation()}>
@@ -51,7 +63,7 @@ export default function MfaRecoveryCodesDialog({
           </Text>
         </View>
         <View className='mfa-recovery-dialog__footer'>
-          <Button className='mfa-recovery-dialog__confirm' onClick={() => void onConfirm()}>
+          <Button className='mfa-recovery-dialog__confirm' onClick={handleConfirm}>
             {t('core.login.mfa_recovery_codes_confirm')}
           </Button>
         </View>

package/src/locales/en-US.json

@@ -123,5 +123,6 @@
   "common.value.top_level": "Top level",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "Delete {resource}",
-  "common.action.set_field_status": "Set {field}"
+  "common.action.set_field_status": "Set {field}",
+  "common.action.load_more": "Load more"
 }

package/src/locales/ja-JP.json

@@ -123,5 +123,6 @@
   "common.value.top_level": "トップレベル",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "{resource}を削除",
-  "common.action.set_field_status": "{field}を設定"
+  "common.action.set_field_status": "{field}を設定",
+  "common.action.load_more": "さらに読み込む"
 }

package/src/locales/zh-CN.json

@@ -123,5 +123,6 @@
   "common.value.top_level": "顶级节点",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "删除{resource}",
-  "common.action.set_field_status": "设置{field}"
+  "common.action.set_field_status": "设置{field}",
+  "common.action.load_more": "加载更多"
 }

package/src/locales/zh-TW.json

@@ -123,5 +123,6 @@
   "common.value.top_level": "頂級節點",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "刪除{resource}",
-  "common.action.set_field_status": "設定{field}"
+  "common.action.set_field_status": "設定{field}",
+  "common.action.load_more": "載入更多"
 }

package/src/stores/user.ts

@@ -3,7 +3,7 @@ import { create } from 'zustand'
 import { defLoginService } from '../api/base/v1/login'
 import { defOauthService } from '../api/base/v1/oauth'
 import { defAuthService } from '../api/system/app/v1/auth'
-import type { LoginRequest, LoginResponse } from '../rpc/base/v1/login'
+import { LoginStatus, type LoginRequest, type LoginResponse } from '../rpc/base/v1/login'
 import type { VerifyMfaRequest } from '../rpc/base/v1/mfa'
 import { defMfaService } from '../api/base/v1/mfa'
 import type {
@@ -80,6 +80,15 @@ function persistUserInfo(userInfo?: UserProfileForm): void {
   else Taro.removeStorageSync(USER_STORAGE_KEY)
 }
 
+/** 仅当登录阶段已签发非空令牌时，才允许写入本地登录态。 */
+function shouldApplyLoginToken(data: LoginResponse | CreateOauthSessionResponse): boolean {
+  return (
+    (data.status === LoginStatus.LOGIN_STATUS_AUTHENTICATED ||
+      data.status === LoginStatus.LOGIN_STATUS_PASSWORD_CHANGE_REQUIRED) &&
+    Boolean(data.access_token && data.refresh_token)
+  )
+}
+
 /** 用户 Zustand Store。 */
 export const useUserStore = create<UserStoreState>((set, get) => ({
   userInfo: undefined,
@@ -105,22 +114,22 @@ export const useUserStore = create<UserStoreState>((set, get) => ({
   },
   async login(request) {
     const response = await defLoginService.Login(request)
-    if (response.status === 1 || response.status === 0 || response.status === 4) await get().applyLoginToken(response)
+    if (shouldApplyLoginToken(response)) await get().applyLoginToken(response)
     return response
   },
   async verifyMfa(request) {
     const response = await defMfaService.VerifyMfa(request)
-    await get().applyLoginToken(response)
+    if (shouldApplyLoginToken(response)) await get().applyLoginToken(response)
     return response
   },
   async createOauthSession(request) {
     const response = await defOauthService.CreateOauthSession(request)
-    if (!response.binding_required && (response.status === 1 || response.status === 0 || response.status === 4)) await get().applyLoginToken(response)
+    if (!response.binding_required && shouldApplyLoginToken(response)) await get().applyLoginToken(response)
     return response
   },
   async bindOauthSession(request) {
     const response = await defOauthService.BindOauthSession(request)
-    if (response.status === 1 || response.status === 0 || response.status === 4) await get().applyLoginToken(response)
+    if (shouldApplyLoginToken(response)) await get().applyLoginToken(response)
     return response
   },
   async getUserProfile() {
@@ -131,8 +140,12 @@ export const useUserStore = create<UserStoreState>((set, get) => ({
     return profile
   },
   async logout() {
-    await defLoginService.Logout({})
-    await get().clearUserData()
+    try {
+      await defLoginService.Logout({})
+    } finally {
+      // 登出接口失败时仍清理本地登录态，避免残留有效 token 造成“假登录”。
+      await get().clearUserData()
+    }
   },
   async refreshToken() {
     const response = await defLoginService.RefreshToken({ refresh_token: getRefreshToken() })

package/src/utils/file.ts

@@ -2,7 +2,7 @@ import Taro from '@tarojs/taro'
 import { BaseFileAccessMode, type FileInfo, type MultiUploadFileResponse } from '../rpc/base/v1/file'
 import { getLocaleRequestHeaders, t } from '../locales'
 import { formatSrc } from './index'
-import { getRequestAccessToken, requestBaseURL } from './http'
+import { getRequestAccessToken, requestBaseURL, sourceClient } from './http'
 
 /** 上传单个文件。 */
 export async function uploadFile(
@@ -18,7 +18,7 @@ export async function uploadFile(
     formData: { fileType, accessMode: String(accessMode) },
     header: {
       ...getLocaleRequestHeaders(),
-      'source-client': 'miniapp',
+      'source-client': sourceClient,
       ...(token ? { Authorization: token } : {}),
     },
   })

package/src/utils/http.ts

@@ -18,7 +18,14 @@ const normalizedApiBasePath = apiBasePath.startsWith('/') ? apiBasePath : `/${ap
 const requestOrigin = process.env.TARO_ENV === 'h5' ? '' : apiTargetUrl.replace(/\/$/, '')
 /** 请求基础地址。 */
 export const requestBaseURL = `${requestOrigin}${normalizedApiBasePath}`
-const sourceClient = process.env.TARO_ENV === 'weapp' ? 'taro-weapp' : 'taro-h5'
+/** 站点根地址（不含 API 基础路径），供事件流等非 API 端点复用。 */
+export const siteBaseURL =
+  process.env.TARO_ENV === 'h5'
+    ? typeof window !== 'undefined'
+      ? window.location.origin
+      : ''
+    : apiTargetUrl.replace(/\/$/, '')
+export const sourceClient = process.env.TARO_ENV === 'weapp' ? 'taro-weapp' : 'taro-h5'
 
 const SESSION_URL = '/v1/base/session'
 const REFRESH_TOKEN_URL = '/v1/base/token'
@@ -176,7 +183,13 @@ async function getAccessTokenByMode(authMode: AuthMode): Promise<string> {
     }
     return ''
   }
-  if (shouldRefreshToken()) await handleTokenRefresh(authMode)
+  if (shouldRefreshToken()) {
+    try {
+      await handleTokenRefresh()
+    } catch {
+      // 刷新失败已撤销本地认证，交由下方 hasValidToken 分支按当前调用方 authMode 处理。
+    }
+  }
   if (hasValidToken()) return getToken()
   if (authMode === 'required') {
     await promptRelogin()
@@ -186,12 +199,12 @@ async function getAccessTokenByMode(authMode: AuthMode): Promise<string> {
   return ''
 }
 
-function handleTokenRefresh(authMode: AuthMode): Promise<void> {
+function handleTokenRefresh(): Promise<void> {
   if (refreshTokenPromise) return refreshTokenPromise
   refreshTokenPromise = refreshAccessToken()
-    .catch(async (error) => {
-      if (authMode === 'required') await promptRelogin()
-      else silentClearAuthData()
+    .catch((error) => {
+      // 刷新失败后立即撤销本地认证，避免弹窗等待期间后台请求反复提交旧刷新令牌。
+      silentClearAuthData()
       throw error
     })
     .finally(() => {
@@ -243,8 +256,7 @@ async function promptRelogin(): Promise<void> {
     })
     if (!modal.confirm) return
     await new Promise((resolve) => setTimeout(resolve, 80))
-    clearToken()
-    Taro.removeStorageSync('user')
+    silentClearAuthData()
     saveCurrentRoute()
     await Taro.reLaunch({ url: '/pages/login/login' })
   } finally {

package/src/views/pages/login/login.tsx

@@ -37,16 +37,8 @@ const emptyLoginForm = (): LoginRequest => ({
 
 function isWechatUnboundError(error: unknown): boolean {
   if (!error || typeof error !== 'object') return false
-  const response = error as {
-    data?: {
-      reason?: string | number
-      message?: string
-      binding_required?: boolean
-      error?: { reason?: string | number; message?: string }
-    }
-  }
-  const reason = response.data?.reason ?? response.data?.error?.reason
-  return response.data?.binding_required === true || String(reason || '') === 'UNAUTHENTICATED'
+  const response = error as { data?: { binding_required?: boolean } }
+  return response.data?.binding_required === true
 }
 
 /** 提取小程序请求失败时后端返回的可展示消息。 */
@@ -120,6 +112,7 @@ export default function LoginPage() {
   const [mfaSetupWebAuthnOptionsJson, setMfaSetupWebAuthnOptionsJson] = useState('')
   const [mfaRecoveryCodesVisible, setMfaRecoveryCodesVisible] = useState(false)
   const [mfaRecoveryCodes, setMfaRecoveryCodes] = useState<string[]>([])
+  const shakeTimerRef = useRef<ReturnType<typeof setTimeout>>()
 
   const currentLanguageName =
     languageOptions.find((item) => item.language_code === locale)?.native_name || locale
@@ -178,7 +171,13 @@ export default function LoginPage() {
 
   useEffect(() => {
     void Taro.setNavigationBarTitle({ title: t('common.action.login') })
-  }, [locale, t])
+  }, [locale])
+
+  useEffect(() => {
+    return () => {
+      if (shakeTimerRef.current) clearTimeout(shakeTimerRef.current)
+    }
+  }, [])
 
   const updateForm = (key: keyof LoginRequest, value: string) => {
     setForm((current) => ({ ...current, [key]: value }))
@@ -279,7 +278,11 @@ export default function LoginPage() {
     }
     if (agreed) return true
     setShake(true)
-    setTimeout(() => setShake(false), 500)
+    if (shakeTimerRef.current) clearTimeout(shakeTimerRef.current)
+    shakeTimerRef.current = setTimeout(() => {
+      shakeTimerRef.current = undefined
+      setShake(false)
+    }, 500)
     const result = await Taro.showModal({
       title: t('common.title.notice'),
       content: t('core.login.protocol_prompt'),

package/src/views/pages/webview/webview.tsx

@@ -4,6 +4,17 @@ import { useEffect, useState } from 'react'
 import './webview.scss'
 import { useI18n } from '../../../locales'
 
+/** 只放行 http(s) 外链，其它协议按非法地址处理。 */
+const isAllowedUrl = (value: string) => /^https?:\/\//i.test(value)
+
+const safeDecodeURIComponent = (value: string) => {
+  try {
+    return decodeURIComponent(value)
+  } catch {
+    return value
+  }
+}
+
 /** 统一外链承载页。 */
 export default function WebViewPage() {
   const { t } = useI18n()
@@ -13,9 +24,9 @@ export default function WebViewPage() {
   const isH5 = process.env.TARO_ENV === 'h5'
 
   useLoad((query) => {
-    const nextUrl = decodeURIComponent(query?.url || '')
-    const title = decodeURIComponent(query?.title || '')
-    setUrl(nextUrl)
+    const nextUrl = safeDecodeURIComponent(query?.url || '')
+    setUrl(isAllowedUrl(nextUrl) ? nextUrl : '')
+    const title = safeDecodeURIComponent(query?.title || '')
     if (title) void Taro.setNavigationBarTitle({ title })
   })
 
@@ -35,11 +46,7 @@ export default function WebViewPage() {
   return (
     <View className='webview-container'>
       {url ? (
-        <WebView
-          src={url}
-          onLoad={() => setIframeLoaded(true)}
-          onMessage={(event) => console.log('收到H5消息:', event.detail)}
-        />
+        <WebView src={url} onLoad={() => setIframeLoaded(true)} />
       ) : null}
       {showFallback ? (
         <View className='webview-empty'>