@liujitcn/kratos-taro-app-core 0.0.66 → 0.0.67

package/package.json

@@ -7,7 +7,7 @@
     "type": "git",
     "url": "git@github.com:liujitcn/kratos-admin.git"
   },
-  "version": "0.0.66",
+  "version": "0.0.67",
   "type": "module",
   "files": [
     "dist",

package/src/api/base/v1/login.ts

@@ -5,8 +5,6 @@ import type {
   LogoutRequest,
   LoginRequest,
   LoginResponse,
-  PasswordPublicKeyRequest,
-  PasswordPublicKeyResponse,
   RefreshTokenRequest,
   RefreshTokenResponse,
   VerifyCaptchaRequest,
@@ -17,7 +15,6 @@ import type { Empty } from '../../../rpc/google/protobuf/empty'
 
 const CAPTCHA_URL = '/v1/base/captcha'
 const CAPTCHA_VERIFY_URL = '/v1/base/captcha/verify'
-const PASSWORD_PUBLIC_KEY_URL = '/v1/base/password-public-key'
 const SESSION_URL = '/v1/base/session'
 const TOKEN_URL = '/v1/base/token'
 
@@ -43,16 +40,6 @@ export class LoginServiceImpl implements LoginService {
       header: { Authorization: 'no-auth' },
     })
   }
-  /** 获取密码临时公钥 */
-  PasswordPublicKey(request: PasswordPublicKeyRequest): Promise<PasswordPublicKeyResponse> {
-    return http<PasswordPublicKeyResponse>({
-      url: `${PASSWORD_PUBLIC_KEY_URL}`,
-      method: 'GET',
-      authMode: 'none',
-      data: request,
-      header: { Authorization: 'no-auth' },
-    })
-  }
   /** 登出 */
   Logout(request: LogoutRequest): Promise<Empty> {
     return http<Empty>({

package/src/api/base/v1/secret_crypto.ts

@@ -0,0 +1,36 @@
+import { http } from '../../../utils/http'
+import type {
+  GetSecretPublicKeyRequest,
+  GetSecretPublicKeyResponse,
+  RevealSecretFieldRequest,
+  RevealSecretFieldResponse,
+  SecretCryptoService,
+} from '../../../rpc/base/v1/secret_crypto'
+
+const SECRET_PUBLIC_KEY_URL = '/v1/base/secret-public-key'
+const SECRET_FIELD_REVEAL_URL = '/v1/base/secret-field/reveal'
+
+/** 敏感字段加密公共服务 */
+export class SecretCryptoServiceImpl implements SecretCryptoService {
+  /** 获取敏感字段临时公钥 */
+  GetSecretPublicKey(request: GetSecretPublicKeyRequest): Promise<GetSecretPublicKeyResponse> {
+    return http<GetSecretPublicKeyResponse>({
+      url: `${SECRET_PUBLIC_KEY_URL}`,
+      method: 'GET',
+      authMode: 'none',
+      data: request,
+      header: { Authorization: 'no-auth' },
+    })
+  }
+
+  /** 查看密钥字段明文 */
+  RevealSecretField(request: RevealSecretFieldRequest): Promise<RevealSecretFieldResponse> {
+    return http<RevealSecretFieldResponse>({
+      url: `${SECRET_FIELD_REVEAL_URL}`,
+      method: 'POST',
+      data: request,
+    })
+  }
+}
+
+export const defSecretCryptoService = new SecretCryptoServiceImpl()

package/src/components/KratosTabBar.tsx

@@ -1,6 +1,7 @@
 import { Image, Text, View } from '@tarojs/components'
 import { resolveModuleIcon, resolveStaticView } from '../module'
 import { APP_MENU_ROOT_ID, navigateAppRoute, useAppMenuBadges, useAppNavigation } from '../navigation'
+import { useI18n } from '../locales'
 import { resolveRootMenuId } from '../navigation-tree.mjs'
 import './KratosTabBar.scss'
 
@@ -13,6 +14,18 @@ export interface KratosTabBarProps {
 export function KratosTabBar({ route }: KratosTabBarProps) {
   const menus = useAppNavigation((state) => state.menus)
   const tabBar = useAppNavigation((state) => state.tabBar)
+  const { t } = useI18n()
+
+  /** 按稳定 viewKey 优先取界面语言标签，未配置的菜单回退后端标题。 */
+  const tabBarTitleKeys: Record<string, string> = {
+    HOME: 'core.navigation.home',
+    APP_ANALYTIC: 'core.navigation.analytics',
+    APP_REPORT: 'core.navigation.report',
+    MESSAGE_INBOX: 'core.navigation.message',
+    PROFILE_HOME: 'core.navigation.my',
+  }
+  const tabBarTitle = (item: { viewKey: string; title: string }): string =>
+    (tabBarTitleKeys[item.viewKey] ? t(tabBarTitleKeys[item.viewKey]) : '') || item.title
   const messageBadge = useAppMenuBadges((state) => state.badges.MESSAGE_INBOX ?? 0)
   const routeMenu = menus.find((menu) => resolveStaticView(menu.viewKey) === route)
   const tabMenuId = routeMenu
@@ -41,7 +54,7 @@ export function KratosTabBar({ route }: KratosTabBarProps) {
             {item.viewKey === 'MESSAGE_INBOX' && messageBadge ? (
               <View className='kratos-tab-bar__badge' aria-hidden='true' />
             ) : null}
-            <Text className={active ? 'kratos-tab-bar__text--active' : ''}>{item.title}</Text>
+            <Text className={active ? 'kratos-tab-bar__text--active' : ''}>{tabBarTitle(item)}</Text>
           </View>
         )
       })}

package/src/components/PasswordVerifyDialog.tsx

@@ -1,9 +1,8 @@
 import { Button, Input, Text, View } from '@tarojs/components'
 import { useEffect, useState } from 'react'
 import { useI18n } from '../locales'
-import { PASSWORD_CRYPTO_SCENE, encryptPassword } from '../utils/passwordCrypto'
-import type { PasswordCryptoScene } from '../utils/passwordCrypto'
-import type { PasswordCrypto } from '../rpc/common/v1/types'
+import { encryptPassword } from '../utils/secretCrypto'
+import type { SecretCrypto } from '../rpc/common/v1/types'
 import './PasswordVerifyDialog.scss'
 
 /** Taro 通用密码验证弹窗属性。 */
@@ -24,12 +23,10 @@ export interface PasswordVerifyDialogProps {
   cancelText?: string
   /** 外部业务提交状态。 */
   confirmLoading?: boolean
-  /** 密码加密场景。 */
-  scene?: PasswordCryptoScene
   /** 是否允许点击遮罩关闭弹窗。 */
   closeOnClickModal?: boolean
   /** 确认并返回加密密码。 */
-  onConfirm: (password: PasswordCrypto) => void | Promise<void>
+  onConfirm: (password: SecretCrypto) => void | Promise<void>
   /** 取消验证。 */
   onCancel: () => void
 }
@@ -44,7 +41,7 @@ export default function PasswordVerifyDialog({
   confirmText,
   cancelText,
   confirmLoading = false,
-  scene = PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_MFA,
+
   closeOnClickModal = false,
   onConfirm,
   onCancel,
@@ -73,7 +70,7 @@ export default function PasswordVerifyDialog({
     setErrorMessage('')
     setEncrypting(true)
     try {
-      const encryptedPassword = await encryptPassword(password, scene)
+      const encryptedPassword = await encryptPassword(password)
       await onConfirm(encryptedPassword)
     } catch (error) {
       setErrorMessage(error instanceof Error ? error.message : t('common.message.request_error'))

package/src/index.ts

@@ -39,6 +39,6 @@ export * from './utils/auth'
 export * from './utils/file'
 export * from './utils/index'
 export * from './utils/navigation'
-export * from './utils/passwordCrypto'
+export * from './utils/secretCrypto'
 export { default as PasswordVerifyDialog } from './components/PasswordVerifyDialog'
 export type { PasswordVerifyDialogProps } from './components/PasswordVerifyDialog'

package/src/locales/README.md

@@ -9,4 +9,4 @@
 | `en-US.json` | 英文 Core 语言包。 | Taro 切换为英文时使用。 |
 | `ja-JP.json` | 日文 Core 语言包。 | Taro 切换为日文时使用。 |
 
-语言包是标准 JSON，不能在文件内直接写注释；公共键使用 `common.` 或 `core.` 命名空间。新增语言后执行仓库根目录的 `make i18n`。语言切换选项固定显示后端 `base_language.native_name`，接口不可用时使用代码内置的原生名称；`common.language.*` 仅用于普通文案和语言迁移初始数据。新增语言的完整文件清单见[国际化语言扩展指南](../../../../../../docs/国际化语言扩展指南.md)。
+语言包是标准 JSON，不能在文件内直接写注释；公共键使用 `common.` 或 `core.` 命名空间。新增语言后执行仓库根目录的 `make i18n`。语言切换选项固定显示后端 `base_language.native_name`，接口不可用时使用代码内置的原生名称；`common.language.*` 仅用于普通文案和语言迁移初始数据。新增语言的完整文件清单见[国际化设计与语言扩展](../../../../../../docs/国际化最终方案.md)。

package/src/locales/en-US.json

@@ -125,5 +125,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "Delete {resource}",
   "common.action.set_field_status": "Set {field}",
-  "common.action.load_more": "Load more"
+  "common.action.load_more": "Load more",
+  "common.status.loading": "Loading…",
+  "core.navigation.analytics": "Analytics",
+  "core.navigation.report": "Reports"
 }

package/src/locales/ja-JP.json

@@ -125,5 +125,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "{resource}を削除",
   "common.action.set_field_status": "{field}を設定",
-  "common.action.load_more": "さらに読み込む"
+  "common.action.load_more": "さらに読み込む",
+  "common.status.loading": "読み込み中…",
+  "core.navigation.analytics": "分析",
+  "core.navigation.report": "レポート"
 }

package/src/locales/zh-CN.json

@@ -125,5 +125,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "删除{resource}",
   "common.action.set_field_status": "设置{field}",
-  "common.action.load_more": "加载更多"
+  "common.action.load_more": "加载更多",
+  "common.status.loading": "加载中…",
+  "core.navigation.analytics": "分析",
+  "core.navigation.report": "报表"
 }

package/src/locales/zh-TW.json

@@ -125,5 +125,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "刪除{resource}",
   "common.action.set_field_status": "設定{field}",
-  "common.action.load_more": "載入更多"
+  "common.action.load_more": "載入更多",
+  "common.status.loading": "載入中…",
+  "core.navigation.analytics": "分析",
+  "core.navigation.report": "報表"
 }

package/src/rpc/base/v1/login.ts

@@ -5,27 +5,9 @@
 // source: base/v1/login.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 
-/** 密码加密场景枚举。 */
-export enum PasswordCryptoScene {
-  /** PASSWORD_CRYPTO_SCENE_UNSPECIFIED - 未指定密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_UNSPECIFIED = 0,
-  /** PASSWORD_CRYPTO_SCENE_LOGIN - 登录密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_LOGIN = 1,
-  /** PASSWORD_CRYPTO_SCENE_CREATE_BASE_USER - 新增后台用户密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_CREATE_BASE_USER = 2,
-  /** PASSWORD_CRYPTO_SCENE_RESET_BASE_USER_PASSWORD - 重置后台用户密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_RESET_BASE_USER_PASSWORD = 3,
-  /** PASSWORD_CRYPTO_SCENE_UPDATE_USER_PASSWORD - 个人修改密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_UPDATE_USER_PASSWORD = 4,
-  /** PASSWORD_CRYPTO_SCENE_MFA - 多因素认证敏感操作场景。 */
-  PASSWORD_CRYPTO_SCENE_MFA = 5,
-  /** PASSWORD_CRYPTO_SCENE_CONFIGURE_PASSWORD_POLICY - 密码策略初始化密码配置场景。 */
-  PASSWORD_CRYPTO_SCENE_CONFIGURE_PASSWORD_POLICY = 6,
-}
-
 /**
  * LoginStatus 表示登录请求当前所处的认证阶段。
  * 只有 AUTHENTICATED 或 PASSWORD_CHANGE_REQUIRED 才会携带正式访问令牌，MFA 状态必须继续完成挑战。
@@ -49,12 +31,6 @@ export interface CaptchaRequest {
   type: string;
 }
 
-/** 密码临时公钥获取条件 */
-export interface PasswordPublicKeyRequest {
-  /** 使用场景 */
-  scene: PasswordCryptoScene;
-}
-
 /** 登出请求条件 */
 export interface LogoutRequest {
 }
@@ -85,20 +61,6 @@ export interface VerifyCaptchaResponse {
   expires_in: number;
 }
 
-/** 密码临时公钥响应 */
-export interface PasswordPublicKeyResponse {
-  /** 临时密钥ID */
-  key_id: string;
-  /** 临时公钥 */
-  public_key: string;
-  /** 加密算法 */
-  algorithm: string;
-  /** 随机值 */
-  nonce: string;
-  /** 有效时间，单位秒 */
-  expires_in: number;
-}
-
 /** 刷新令牌请求参数 */
 export interface RefreshTokenRequest {
   /** 更新令牌；未填写时由服务端从HttpOnly Cookie读取。 */
@@ -125,7 +87,7 @@ export interface LoginRequest {
   user_name: string;
   /** 用户的密码，必选项。 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 验证码 */
   captcha_code: string;
@@ -165,8 +127,6 @@ export interface LoginService {
   Captcha(request: CaptchaRequest): Promise<CaptchaResponse>;
   /** 验证码预校验 */
   VerifyCaptcha(request: VerifyCaptchaRequest): Promise<VerifyCaptchaResponse>;
-  /** 获取密码临时公钥 */
-  PasswordPublicKey(request: PasswordPublicKeyRequest): Promise<PasswordPublicKeyResponse>;
   /** 登出 */
   Logout(request: LogoutRequest): Promise<Empty>;
   /** 刷新认证令牌 */

package/src/rpc/base/v1/mfa.ts

@@ -5,7 +5,7 @@
 // source: base/v1/mfa.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 import type { LoginResponse } from "./login";
 
@@ -79,7 +79,7 @@ export interface MfaStatusResponse {
 export interface BeginMfaSetupRequest {
   /** 当前登录密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 强制绑定场景下的临时票据 */
   setup_ticket: string;
@@ -135,7 +135,7 @@ export interface BeginMfaDisableResponse {
 export interface DisableMfaRequest {
   /** 当前登录密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** TOTP 动态口令 */
   code: string;

package/src/rpc/base/v1/oauth.ts

@@ -5,7 +5,7 @@
 // source: base/v1/oauth.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 import type { LoginStatus } from "./login";
 
@@ -77,7 +77,7 @@ export interface BindOauthSessionRequest {
   user_name: string;
   /** 用户密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 验证码 */
   captcha_code: string;

package/src/rpc/base/v1/secret_crypto.ts

@@ -0,0 +1,49 @@
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v2.11.8
+//   protoc               unknown
+// source: base/v1/secret_crypto.proto
+
+/* eslint-disable */
+
+/** 敏感字段临时公钥获取条件 */
+export interface GetSecretPublicKeyRequest {
+}
+
+/** 敏感字段临时公钥响应 */
+export interface GetSecretPublicKeyResponse {
+  /** 临时密钥ID */
+  key_id: string;
+  /** 临时公钥 */
+  public_key: string;
+  /** 加密算法 */
+  algorithm: string;
+  /** 随机值 */
+  nonce: string;
+  /** 有效时间，单位秒 */
+  expires_in: number;
+}
+
+/** 密钥字段查看条件 */
+export interface RevealSecretFieldRequest {
+  /** 资源标识，如 ai_provider、base_oauth_provider、base_message_provider */
+  resource: string;
+  /** 记录ID */
+  id: number;
+  /** 字段名，如 api_key、client_secret */
+  field: string;
+}
+
+/** 密钥字段查看响应 */
+export interface RevealSecretFieldResponse {
+  /** 密钥明文 */
+  text: string;
+}
+
+/** 敏感字段加密公共服务 */
+export interface SecretCryptoService {
+  /** 获取敏感字段临时公钥，同一次提交的多个密文字段共用该公钥 */
+  GetSecretPublicKey(request: GetSecretPublicKeyRequest): Promise<GetSecretPublicKeyResponse>;
+  /** 查看密钥字段明文，仅允许查询注册过的密钥字段 */
+  RevealSecretField(request: RevealSecretFieldRequest): Promise<RevealSecretFieldResponse>;
+}

package/src/rpc/common/v1/types.ts

@@ -60,8 +60,8 @@ export interface BytesValues {
   value: Uint8Array[];
 }
 
-/** 密码密文。 */
-export interface PasswordCrypto {
+/** 敏感字段密文，密码与各类密钥字段统一使用。 */
+export interface SecretCrypto {
   /** 临时密钥ID */
   key_id: string;
   /** 随机值 */
@@ -72,6 +72,6 @@ export interface PasswordCrypto {
   encrypted_key: string;
   /** 初始化向量 */
   iv: string;
-  /** 密码加密数据 */
-  ciphertext: string;
+  /** 传输时为密文，服务端解密后回填明文 */
+  text: string;
 }

package/src/utils/http.ts

@@ -32,21 +32,21 @@ const REFRESH_TOKEN_URL = '/v1/base/token'
 const CAPTCHA_URL = '/v1/base/captcha'
 const CONFIG_URL = '/v1/base/config'
 const LANGUAGE_URL = '/v1/base/language'
-const PASSWORD_PUBLIC_KEY_URL = '/v1/base/password-public-key'
+const SECRET_PUBLIC_KEY_URL = '/v1/base/secret-public-key'
 const NO_AUTH_URL_SET = new Set([
   SESSION_URL,
   REFRESH_TOKEN_URL,
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
 ])
 const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   SESSION_URL,
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
 ])
 /** 认证状态被静默清理的事件名。 */
 export const AUTH_SILENT_LOGOUT_EVENT = 'auth:silent-logout'

package/src/utils/{passwordCrypto.ts → secretCrypto.ts}

@@ -1,15 +1,12 @@
 import Taro from '@tarojs/taro'
 import * as miniCrypto from 'asmcrypto.js'
-import { defLoginService } from '../api/base/v1/login'
+import { defSecretCryptoService } from '../api/base/v1/secret_crypto'
 import { t } from '../locales'
-import { PasswordCryptoScene } from '../rpc/base/v1/login'
-import type { PasswordCrypto } from '../rpc/common/v1/types'
+import type { GetSecretPublicKeyResponse } from '../rpc/base/v1/secret_crypto'
+import type { SecretCrypto } from '../rpc/common/v1/types'
 
 type MiniCrypto = typeof import('asmcrypto.js')
 
-export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene
-export type { PasswordCryptoScene }
-
 /** 将 PEM 公钥转换为二进制 DER 数据。 */
 function pemToArrayBuffer(pem: string) {
   const base64 = pem
@@ -152,19 +149,14 @@ function miniBytesToBase64(value: Uint8Array) {
 }
 
 /** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的运行时。 */
-async function encryptPortablePassword(
+async function encryptPortableSecret(
   crypto: MiniCrypto,
-  password: string,
-  publicKeyResponse: {
-    key_id: string
-    public_key: string
-    algorithm: string
-    nonce: string
-  },
-): Promise<PasswordCrypto> {
+  value: string,
+  publicKeyResponse: GetSecretPublicKeyResponse,
+): Promise<SecretCrypto> {
   const aesKey = new Uint8Array(await getRandomBytes(32))
   const iv = new Uint8Array(await getRandomBytes(12))
-  const plaintext = crypto.string_to_bytes(password, true)
+  const plaintext = crypto.string_to_bytes(value, true)
   const [modulus, exponent] = parseMiniRsaPublicKey(publicKeyResponse.public_key)
   const hash = new crypto.Sha256()
   const keySize = Math.ceil(new crypto.BigNumber(modulus).bitLength / 8)
@@ -206,26 +198,25 @@ async function encryptPortablePassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: miniBytesToBase64(encryptedKey),
     iv: miniBytesToBase64(iv),
-    ciphertext: miniBytesToBase64(ciphertext),
+    text: miniBytesToBase64(ciphertext),
   }
 }
 
-/** 加密单个密码字段，返回后端可解析的密码密文。 */
-export async function encryptPassword(
-  password: string,
-  scene: PasswordCryptoScene,
-): Promise<PasswordCrypto> {
-  const plainPassword = password.trim()
-  if (!plainPassword) {
-    throw new Error(t('core.crypto.password_required'))
-  }
+/** 获取敏感字段一次性临时公钥，同一次提交的多个密文字段共用该公钥。 */
+export async function fetchSecretPublicKey(): Promise<GetSecretPublicKeyResponse> {
+  return defSecretCryptoService.GetSecretPublicKey({})
+}
 
-  const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene })
+/** 使用已获取的临时公钥加密单个敏感值，供一次取钥加密多个字段的场景复用。 */
+export async function encryptWithPublicKey(
+  publicKeyResponse: GetSecretPublicKeyResponse,
+  value: string,
+): Promise<SecretCrypto> {
 
   const cryptoApi = globalThis.crypto
   const isSecureContext = typeof window === 'undefined' || window.isSecureContext
   if (process.env.TARO_ENV === 'weapp' || !cryptoApi?.subtle || !isSecureContext) {
-    return encryptPortablePassword(miniCrypto, plainPassword, publicKeyResponse)
+    return encryptPortableSecret(miniCrypto, value, publicKeyResponse)
   }
 
   const publicKey = await cryptoApi.subtle.importKey(
@@ -243,7 +234,7 @@ export async function encryptPassword(
   const ciphertext = await cryptoApi.subtle.encrypt(
     { name: 'AES-GCM', iv },
     aesKey,
-    new TextEncoder().encode(plainPassword),
+    new TextEncoder().encode(value),
   )
   const encryptedKey = await cryptoApi.subtle.encrypt({ name: 'RSA-OAEP' }, publicKey, rawAesKey)
 
@@ -253,6 +244,20 @@ export async function encryptPassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: arrayBufferToBase64(encryptedKey),
     iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext),
+    text: arrayBufferToBase64(ciphertext),
+  }
+}
+
+/** 加密单个敏感字段值，自动获取一次性临时公钥。 */
+export async function encryptSecret(value: string): Promise<SecretCrypto> {
+  return encryptWithPublicKey(await fetchSecretPublicKey(), value)
+}
+
+/** 加密密码字段：去除首尾空白且不允许为空。 */
+export async function encryptPassword(password: string): Promise<SecretCrypto> {
+  const plainPassword = password.trim()
+  if (!plainPassword) {
+    throw new Error(t('core.crypto.password_required'))
   }
+  return encryptSecret(plainPassword)
 }

package/src/views/pages/login/login.tsx

@@ -9,7 +9,7 @@ import { LoginStatus, type LoginRequest, type LoginResponse } from '../../../rpc
 import { useSettingStore, useUserStore } from '../../../stores'
 import { formatSrc } from '../../../utils'
 import { restoreLoginRedirect } from '../../../utils/navigation'
-import { encryptPassword, PASSWORD_CRYPTO_SCENE } from '../../../utils/passwordCrypto'
+import { encryptPassword } from '../../../utils/secretCrypto'
 import { createWebAuthnCredential, getWebAuthnAssertion } from '../../../utils/webauthn'
 import MfaRecoveryCodesDialog from '../../../components/MfaRecoveryCodesDialog'
 import MfaSetupPanel from '../../../components/MfaSetupPanel'
@@ -421,10 +421,7 @@ export default function LoginPage() {
   }
 
   const submitLogin = async (captchaCode: string) => {
-    const encrypted = await encryptPassword(
-      password,
-      PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_LOGIN,
-    )
+    const encrypted = await encryptPassword(password)
     return userStore.login({
       ...form,
       tenant_code: showTenantCode ? form.tenant_code : '0000',
@@ -536,10 +533,7 @@ export default function LoginPage() {
     }
     setLoading(true)
     try {
-      const encrypted = await encryptPassword(
-        miniPassword,
-        PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_LOGIN,
-      )
+      const encrypted = await encryptPassword(miniPassword)
       const code = (await Taro.login()).code
       const response = await userStore.bindOauthSession({
         provider: wechatMiniProvider,