@liujitcn/kratos-uni-app-core 0.0.29 → 0.0.31

package/README.md

@@ -1,6 +1,6 @@
 # @liujitcn/kratos-uni-app-core
 
-`@liujitcn/kratos-uni-app-core` 是应用底座包，提供模块协议、启动流程、动态导航、认证与请求、共享状态、基础页面和构建期页面装配能力。业务模块只能通过本包公开 exports 使用这些能力。
+`@liujitcn/kratos-uni-app-core` 是应用底座包，提供模块协议、启动流程、动态导航、认证与请求、MFA 校验、共享状态、基础页面和构建期页面装配能力。业务模块只能通过本包公开 exports 使用这些能力。
 
 ## 目录结构
 
@@ -8,13 +8,13 @@
 packages/core
 ├── src
 │   ├── api                    # base、system 基础接口 service
-│   ├── components             # 启动状态和自绘 tabBar
+│   ├── components             # 启动状态、自绘 tabBar、公共设置页和 MFA 组件
 │   ├── rpc                    # Buf 生成的 TypeScript 接口类型
 │   ├── static                 # 底座图片和 tab 图标
 │   ├── stores                 # Pinia 设置与用户状态
 │   ├── styles                 # 全局基础样式
 │   ├── types                  # uni-app 与第三方类型补充
-│   ├── utils                  # HTTP、认证、文件和导航工具
+│   ├── utils                  # HTTP、认证、文件、MFA/WebAuthn 和导航工具
 │   ├── views                  # 首页、登录、状态页和 WebView
 │   ├── bootstrap.ts           # 应用初始化
 │   ├── module.ts              # 模块定义与注册表
@@ -26,14 +26,17 @@ packages/core
 └── package.json
 ```
 
-`src/rpc` 是生成产物，只能通过 workspace 根目录的 `pnpm generate:rpc` 更新；该命令委托 backend 的 `make ts-uni-app` 和 `backend/api/buf.uni-app.typescript.gen.yaml` 生成。
+`src/rpc` 是生成产物，只能通过 workspace 根目录的 `pnpm generate:rpc` 更新；该命令委托 Frontend 的 `make ts-uni-app` 和 `backend/api/buf.uni-app.typescript.gen.yaml` 生成。
 
 ## 功能
 
 - 定义 `KratosAppModule`、`viewKey`、静态页面覆盖和模块图标协议。
 - 从 `/v1/app/base/menu` 加载 `999` 下的扁平菜单，按 `parent_id` 构建树，以二级页面生成 tabBar，并原子更新动态路由和层级导航。
 - 按匿名态、登录态缓存导航，并在远端不可用时回退到最近缓存或默认菜单。
-- 统一认证、token、HTTP、上传、配置、Pinia 和基础页面能力。
+- 统一认证、token、MFA、HTTP、上传、配置、Pinia 和基础页面能力。
+- 提供可复用的 `KratosSettingsPage`，统一语言、MFA、微信设置和退出登录，并允许产品在最上方追加业务设置。
+- 公开通用密码弹窗、MFA 绑定面板与恢复码弹窗，供登录页和业务模块复用同一套绑定界面。
+- 登录阶段支持 TOTP、WebAuthn 和一次性恢复码校验；WebAuthn 编解码封装在 `src/utils/webauthn.ts`。
 - 构建时扫描模块 `src/views/**/*.vue`，逐文件合并模块 static，生成宿主页并在退出时按事务精确恢复。
 
 ## 公开入口
@@ -43,4 +46,24 @@ packages/core
 - `@liujitcn/kratos-uni-app-core/vite`：Vite 配置与页面装配插件。
 - `@liujitcn/kratos-uni-app-core/api/*`、`components/*.vue`、`utils/*`、`views/*`：白名单子路径。
 
+## 公共设置页
+
+产品设置页通过公开子路径引用 `KratosSettingsPage`。`extensions` 是唯一业务扩展插槽，固定直接渲染在页面视口最上方；没有传入内容时不会生成容器或额外间距。
+
+```vue
+<script setup lang="ts">
+import KratosSettingsPage from '@liujitcn/kratos-uni-app-core/components/KratosSettingsPage.vue'
+</script>
+
+<template>
+  <KratosSettingsPage>
+    <template #extensions>
+      <ShopSettingsSection />
+    </template>
+  </KratosSettingsPage>
+</template>
+```
+
+扩展内容由产品模块自行组织完整卡片。页面顺序固定为业务扩展、MFA 与语言、微信设置、退出登录；产品模块可以注册自己的物理页面，并通过后注册的 `SETTINGS` viewKey 覆盖 system 默认包装页。
+
 构建与验证命令见 [workspace 文档](../../README.md)。

package/dist/module.mjs

@@ -54,6 +54,8 @@ var zh_CN_default = {
   "core.crypto.public_key_invalid": "\u516C\u94A5\u683C\u5F0F\u65E0\u6548",
   "core.crypto.random_failed": "\u968F\u673A\u6570\u751F\u6210\u5931\u8D25",
   "core.crypto.unsupported": "\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u5BC6\u7801\u52A0\u5BC6",
+  "core.password.verify_title": "\u9A8C\u8BC1\u5BC6\u7801",
+  "core.password.verify_label": "\u5F53\u524D\u5BC6\u7801",
   "core.file.upload_failed": "\u4E0A\u4F20\u5931\u8D25",
   "core.home.account_capability": "\u8D26\u6237\u80FD\u529B",
   "core.home.account_capability_description": "\u4E2A\u4EBA\u8D44\u6599\u3001\u5E94\u7528\u8BBE\u7F6E\u4E0E\u667A\u80FD\u52A9\u624B\u5165\u53E3\u5DF2\u4FDD\u7559",
@@ -84,6 +86,23 @@ var zh_CN_default = {
   "core.login.captcha_write_failed": "\u9A8C\u8BC1\u7801\u56FE\u7247\u5199\u5165\u5931\u8D25",
   "core.login.default_sub_title": "\u6B22\u8FCE\u4F7F\u7528\u672C\u5E94\u7528",
   "core.login.login_success": "\u767B\u5F55\u6210\u529F",
+  "core.login.mfa_title": "\u591A\u56E0\u7D20\u8BA4\u8BC1",
+  "core.login.mfa_code": "\u8BF7\u8F93\u5165\u52A8\u6001\u53E3\u4EE4",
+  "core.login.mfa_recovery_code": "\u6062\u590D\u7801\uFF08\u53EF\u9009\uFF09",
+  "core.login.mfa_setup_title": "\u7ED1\u5B9A\u591A\u56E0\u7D20\u8BA4\u8BC1",
+  "core.login.mfa_copy_uri": "\u590D\u5236\u7ED1\u5B9A\u5730\u5740",
+  "core.login.mfa_copy_success": "\u7ED1\u5B9A\u5730\u5740\u5DF2\u590D\u5236",
+  "core.login.mfa_recovery_codes_copied": "\u6062\u590D\u7801\u5DF2\u590D\u5236",
+  "core.login.mfa_recovery_codes_title": "\u4FDD\u5B58 MFA \u6062\u590D\u7801",
+  "core.login.mfa_recovery_codes_warning": "\u6BCF\u4E2A\u6062\u590D\u7801\u53EA\u80FD\u4F7F\u7528\u4E00\u6B21\uFF0C\u6B64\u5F39\u7A97\u5173\u95ED\u540E\u4E0D\u4F1A\u518D\u6B21\u663E\u793A\u3002",
+  "core.login.mfa_copy_recovery_codes": "\u590D\u5236\u6062\u590D\u7801",
+  "core.login.mfa_recovery_codes_confirm": "\u6211\u5DF2\u4FDD\u5B58",
+  "core.login.mfa_setup_success": "\u591A\u56E0\u7D20\u8BA4\u8BC1\u7ED1\u5B9A\u6210\u529F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55\u3002",
+  "core.login.mfa_webauthn_action": "\u4F7F\u7528 Passkey",
+  "core.login.mfa_webauthn_setup_unsupported": "\u5F53\u524D\u5E73\u53F0\u4E0D\u652F\u6301 WebAuthn\uFF0C\u8BF7\u4F7F\u7528 TOTP \u6216\u6062\u590D\u7801\u3002",
+  "core.login.mfa_webauthn_setup_invalid": "WebAuthn \u6CE8\u518C\u672A\u8FD4\u56DE\u6709\u6548\u51ED\u636E\u3002",
+  "core.login.mfa_webauthn_login_unsupported": "\u5F53\u524D\u5E73\u53F0\u4E0D\u652F\u6301 WebAuthn\uFF0C\u8BF7\u4F7F\u7528\u6062\u590D\u7801\u3002",
+  "core.login.mfa_webauthn_login_invalid": "WebAuthn \u767B\u5F55\u672A\u8FD4\u56DE\u6709\u6548\u51ED\u636E\u3002",
   "core.login.password": "\u8BF7\u8F93\u5165\u5BC6\u7801",
   "core.login.privacy": "\u300A\u9690\u79C1\u534F\u8BAE\u300B",
   "core.login.protocol_missing": "\u670D\u52A1\u6761\u6B3E\u548C\u9690\u79C1\u534F\u8BAE\u672A\u914D\u7F6E",
@@ -97,6 +116,7 @@ var zh_CN_default = {
   "core.login.wechat_bind_tip": "\u8BE5\u5FAE\u4FE1\u5C1A\u672A\u7ED1\u5B9A\uFF0C\u8BF7\u767B\u5F55\u5DF2\u6709\u8D26\u53F7\u5B8C\u6210\u7ED1\u5B9A",
   "core.login.wechat_failed": "\u5FAE\u4FE1\u767B\u5F55\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
   "core.navigation.home": "\u9996\u9875",
+  "core.navigation.message": "\u6D88\u606F",
   "core.navigation.error.access": "\u83DC\u5355\u8BBF\u95EE\u6A21\u5F0F\u65E0\u6548\uFF1A{access}",
   "core.navigation.error.child_tab": "\u53EA\u6709\u79FB\u52A8\u7AEF\u4E8C\u7EA7\u83DC\u5355\u53EF\u4EE5\u4F5C\u4E3A tab\uFF1A{name}",
   "core.navigation.error.cycle": "\u79FB\u52A8\u7AEF\u83DC\u5355\u5B58\u5728\u5FAA\u73AF\u7236\u7EA7\uFF1A{name}",
@@ -118,6 +138,22 @@ var zh_CN_default = {
   "core.protocol.not_configured": "{title}\u672A\u914D\u7F6E\uFF0C\u6682\u65F6\u65E0\u6CD5\u67E5\u770B",
   "core.protocol.privacy": "\u9690\u79C1\u534F\u8BAE",
   "core.protocol.service": "\u670D\u52A1\u6761\u6B3E",
+  "core.settings.authorization": "\u6388\u6743\u7BA1\u7406",
+  "core.settings.contact": "\u8054\u7CFB\u6211\u4EEC",
+  "core.settings.feedback": "\u95EE\u9898\u53CD\u9988",
+  "core.settings.logout_confirm": "\u662F\u5426\u9000\u51FA\u767B\u5F55\uFF1F",
+  "core.settings.logout_failed": "\u9000\u51FA\u767B\u5F55\u5931\u8D25",
+  "core.settings.mfa_bind_success": "\u591A\u56E0\u7D20\u8BA4\u8BC1\u7ED1\u5B9A\u6210\u529F",
+  "core.settings.mfa_disable_action": "\u7981\u7528",
+  "core.settings.mfa_disable_factor_required": "\u8BF7\u8F93\u5165\u52A8\u6001\u53E3\u4EE4\u6216\u6062\u590D\u7801\u3002",
+  "core.settings.mfa_disable_success": "\u591A\u56E0\u7D20\u8BA4\u8BC1\u5DF2\u7981\u7528",
+  "core.settings.mfa_disable_title": "\u7981\u7528\u591A\u56E0\u7D20\u8BA4\u8BC1",
+  "core.settings.mfa_disabled": "\u672A\u542F\u7528",
+  "core.settings.mfa_enabled_method": "\u5DF2\u542F\u7528\uFF08{method}\uFF09",
+  "core.settings.mfa_method_totp": "TOTP",
+  "core.settings.mfa_method_webauthn": "WebAuthn",
+  "core.settings.mfa_title": "\u591A\u56E0\u7D20\u8BA4\u8BC1",
+  "core.settings.title": "\u8BBE\u7F6E",
   "core.status.CONFIG_ERROR": "\u5BFC\u822A\u914D\u7F6E\u65E0\u6548",
   "core.status.forbidden": "\u6682\u65E0\u8BBF\u95EE\u6743\u9650",
   "core.status.NOT_FOUND": "\u9875\u9762\u4E0D\u5B58\u5728",
@@ -126,7 +162,11 @@ var zh_CN_default = {
   "core.status.loading": "\u6B63\u5728\u52A0\u8F7D",
   "core.webview.embed_blocked": "\u5F53\u524D H5 \u9875\u9762\u53EF\u80FD\u88AB\u76EE\u6807\u7AD9\u70B9\u9650\u5236\u5D4C\u5165",
   "core.webview.invalid_url": "\u7F3A\u5C11\u6709\u6548\u94FE\u63A5\u5730\u5740",
-  "core.webview.open_failed": "\u94FE\u63A5\u65E0\u6CD5\u6253\u5F00"
+  "core.webview.open_failed": "\u94FE\u63A5\u65E0\u6CD5\u6253\u5F00",
+  "common.value.top_level": "\u9876\u7EA7\u8282\u70B9",
+  "common.resource.default": "{resource}",
+  "common.action.delete_resource": "\u5220\u9664{resource}",
+  "common.action.set_field_status": "\u8BBE\u7F6E{field}"
 };
 
 // src/locales/en-US.json
@@ -160,6 +200,8 @@ var en_US_default = {
   "core.crypto.public_key_invalid": "Invalid public key",
   "core.crypto.random_failed": "Failed to generate random data",
   "core.crypto.unsupported": "Password encryption is not supported in this environment",
+  "core.password.verify_title": "Verify password",
+  "core.password.verify_label": "Current password",
   "core.file.upload_failed": "Upload failed",
   "core.home.account_capability": "Account features",
   "core.home.account_capability_description": "Profile, app settings, and AI assistant access are included",
@@ -190,6 +232,23 @@ var en_US_default = {
   "core.login.captcha_write_failed": "Failed to save verification image",
   "core.login.default_sub_title": "Welcome",
   "core.login.login_success": "Logged in",
+  "core.login.mfa_title": "Multi-factor authentication",
+  "core.login.mfa_code": "Enter the authenticator code",
+  "core.login.mfa_recovery_code": "Recovery code (optional)",
+  "core.login.mfa_setup_title": "Bind multi-factor authentication",
+  "core.login.mfa_copy_uri": "Copy binding address",
+  "core.login.mfa_copy_success": "Binding address copied",
+  "core.login.mfa_recovery_codes_copied": "Recovery codes copied",
+  "core.login.mfa_recovery_codes_title": "Save MFA recovery codes",
+  "core.login.mfa_recovery_codes_warning": "Each code works once and will not be shown again after this dialog closes.",
+  "core.login.mfa_copy_recovery_codes": "Copy recovery codes",
+  "core.login.mfa_recovery_codes_confirm": "I saved them",
+  "core.login.mfa_setup_success": "Multi-factor authentication enabled. Please sign in again.",
+  "core.login.mfa_webauthn_action": "Use passkey",
+  "core.login.mfa_webauthn_setup_unsupported": "WebAuthn is not supported on this platform. Use TOTP or a recovery code.",
+  "core.login.mfa_webauthn_setup_invalid": "WebAuthn registration did not return a valid credential.",
+  "core.login.mfa_webauthn_login_unsupported": "WebAuthn is not supported on this platform. Use a recovery code.",
+  "core.login.mfa_webauthn_login_invalid": "WebAuthn authentication did not return a valid credential.",
   "core.login.password": "Enter password",
   "core.login.privacy": "Privacy Policy",
   "core.login.protocol_missing": "Terms of Service and Privacy Policy are not configured",
@@ -203,6 +262,7 @@ var en_US_default = {
   "core.login.wechat_bind_tip": "This WeChat account is not linked. Log in to an existing account to link it.",
   "core.login.wechat_failed": "WeChat login failed. Try again later.",
   "core.navigation.home": "Home",
+  "core.navigation.message": "Messages",
   "core.navigation.error.access": "Invalid menu access mode: {access}",
   "core.navigation.error.child_tab": "Only second-level app menus can be tabs: {name}",
   "core.navigation.error.cycle": "Menu parent cycle detected: {name}",
@@ -224,6 +284,22 @@ var en_US_default = {
   "core.protocol.not_configured": "{title} is not configured and cannot be viewed",
   "core.protocol.privacy": "Privacy Policy",
   "core.protocol.service": "Terms of Service",
+  "core.settings.authorization": "Authorization settings",
+  "core.settings.contact": "Contact us",
+  "core.settings.feedback": "Feedback",
+  "core.settings.logout_confirm": "Log out now?",
+  "core.settings.logout_failed": "Logout failed",
+  "core.settings.mfa_bind_success": "Multi-factor authentication enabled",
+  "core.settings.mfa_disable_action": "Disable",
+  "core.settings.mfa_disable_factor_required": "Enter a TOTP code or recovery code.",
+  "core.settings.mfa_disable_success": "Multi-factor authentication disabled",
+  "core.settings.mfa_disable_title": "Disable multi-factor authentication",
+  "core.settings.mfa_disabled": "Not enabled",
+  "core.settings.mfa_enabled_method": "Enabled ({method})",
+  "core.settings.mfa_method_totp": "TOTP",
+  "core.settings.mfa_method_webauthn": "WebAuthn",
+  "core.settings.mfa_title": "Multi-factor authentication",
+  "core.settings.title": "Settings",
   "core.status.CONFIG_ERROR": "Invalid navigation configuration",
   "core.status.forbidden": "Access denied",
   "core.status.NOT_FOUND": "Page not found",
@@ -232,7 +308,11 @@ var en_US_default = {
   "core.status.loading": "Loading",
   "core.webview.embed_blocked": "The destination may block embedding on H5",
   "core.webview.invalid_url": "No valid link was provided",
-  "core.webview.open_failed": "Unable to open link"
+  "core.webview.open_failed": "Unable to open link",
+  "common.value.top_level": "Top level",
+  "common.resource.default": "{resource}",
+  "common.action.delete_resource": "Delete {resource}",
+  "common.action.set_field_status": "Set {field}"
 };
 
 // src/locales/ja-JP.json
@@ -266,6 +346,8 @@ var ja_JP_default = {
   "core.crypto.public_key_invalid": "\u516C\u958B\u9375\u306E\u5F62\u5F0F\u304C\u7121\u52B9\u3067\u3059",
   "core.crypto.random_failed": "\u4E71\u6570\u306E\u751F\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
   "core.crypto.unsupported": "\u73FE\u5728\u306E\u74B0\u5883\u306F\u30D1\u30B9\u30EF\u30FC\u30C9\u6697\u53F7\u5316\u3092\u30B5\u30DD\u30FC\u30C8\u3057\u3066\u3044\u307E\u305B\u3093",
+  "core.password.verify_title": "\u30D1\u30B9\u30EF\u30FC\u30C9\u306E\u78BA\u8A8D",
+  "core.password.verify_label": "\u73FE\u5728\u306E\u30D1\u30B9\u30EF\u30FC\u30C9",
   "core.file.upload_failed": "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
   "core.home.account_capability": "\u30A2\u30AB\u30A6\u30F3\u30C8\u306E\u6A5F\u80FD",
   "core.home.account_capability_description": "\u500B\u4EBA\u60C5\u5831\u3001\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u8A2D\u5B9A\u3001\u30B9\u30DE\u30FC\u30C8\u30A2\u30B7\u30B9\u30BF\u30F3\u30C8\u5165\u53E3\u304C\u4E88\u7D04\u3055\u308C\u3066\u3044\u307E\u3059",
@@ -296,6 +378,23 @@ var ja_JP_default = {
   "core.login.captcha_write_failed": "\u691C\u8A3C\u30B3\u30FC\u30C9\u30A4\u30E1\u30FC\u30B8\u306E\u66F8\u304D\u8FBC\u307F\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
   "core.login.default_sub_title": "\u3053\u306E\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u3078\u3088\u3046\u3053\u305D",
   "core.login.login_success": "\u30ED\u30B0\u30A4\u30F3\u306B\u6210\u529F\u3057\u307E\u3057\u305F",
+  "core.login.mfa_title": "\u591A\u8981\u7D20\u8A8D\u8A3C",
+  "core.login.mfa_code": "\u8A8D\u8A3C\u30B3\u30FC\u30C9\u3092\u5165\u529B",
+  "core.login.mfa_recovery_code": "\u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\uFF08\u4EFB\u610F\uFF09",
+  "core.login.mfa_setup_title": "\u591A\u8981\u7D20\u8A8D\u8A3C\u3092\u8A2D\u5B9A",
+  "core.login.mfa_copy_uri": "\u767B\u9332\u30A2\u30C9\u30EC\u30B9\u3092\u30B3\u30D4\u30FC",
+  "core.login.mfa_copy_success": "\u767B\u9332\u30A2\u30C9\u30EC\u30B9\u3092\u30B3\u30D4\u30FC\u3057\u307E\u3057\u305F",
+  "core.login.mfa_recovery_codes_copied": "\u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\u3092\u30B3\u30D4\u30FC\u3057\u307E\u3057\u305F",
+  "core.login.mfa_recovery_codes_title": "MFA \u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\u3092\u4FDD\u5B58",
+  "core.login.mfa_recovery_codes_warning": "\u5404\u30B3\u30FC\u30C9\u306F\u4E00\u5EA6\u3060\u3051\u4F7F\u7528\u3067\u304D\u3001\u30C0\u30A4\u30A2\u30ED\u30B0\u3092\u9589\u3058\u308B\u3068\u518D\u8868\u793A\u3055\u308C\u307E\u305B\u3093\u3002",
+  "core.login.mfa_copy_recovery_codes": "\u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\u3092\u30B3\u30D4\u30FC",
+  "core.login.mfa_recovery_codes_confirm": "\u4FDD\u5B58\u3057\u307E\u3057\u305F",
+  "core.login.mfa_setup_success": "\u591A\u8981\u7D20\u8A8D\u8A3C\u3092\u8A2D\u5B9A\u3057\u307E\u3057\u305F\u3002\u518D\u5EA6\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  "core.login.mfa_webauthn_action": "\u30D1\u30B9\u30AD\u30FC\u3092\u4F7F\u7528",
+  "core.login.mfa_webauthn_setup_unsupported": "\u3053\u306E\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u306F WebAuthn \u306B\u5BFE\u5FDC\u3057\u3066\u3044\u307E\u305B\u3093\u3002TOTP \u307E\u305F\u306F\u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  "core.login.mfa_webauthn_setup_invalid": "WebAuthn \u767B\u9332\u3067\u6709\u52B9\u306A\u30AF\u30EC\u30C7\u30F3\u30B7\u30E3\u30EB\u304C\u8FD4\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F\u3002",
+  "core.login.mfa_webauthn_login_unsupported": "\u3053\u306E\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u306F WebAuthn \u306B\u5BFE\u5FDC\u3057\u3066\u3044\u307E\u305B\u3093\u3002\u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  "core.login.mfa_webauthn_login_invalid": "WebAuthn \u8A8D\u8A3C\u3067\u6709\u52B9\u306A\u30AF\u30EC\u30C7\u30F3\u30B7\u30E3\u30EB\u304C\u8FD4\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F\u3002",
   "core.login.password": "\u30D1\u30B9\u30EF\u30FC\u30C9\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
   "core.login.privacy": "\u300C\u30D7\u30E9\u30A4\u30D0\u30B7\u30FC\u540C\u610F\u66F8\u300D",
   "core.login.protocol_missing": "\u5229\u7528\u898F\u7D04\u3068\u30D7\u30E9\u30A4\u30D0\u30B7\u30FC\u898F\u7D04\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
@@ -309,6 +408,7 @@ var ja_JP_default = {
   "core.login.wechat_bind_tip": "\u3053\u306E WeChat \u30A2\u30AB\u30A6\u30F3\u30C8\u306F\u307E\u3060\u30D0\u30A4\u30F3\u30C9\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u30D0\u30A4\u30F3\u30C9\u3092\u5B8C\u4E86\u3059\u308B\u306B\u306F\u3001\u65E2\u5B58\u306E\u30A2\u30AB\u30A6\u30F3\u30C8\u306B\u30ED\u30B0\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   "core.login.wechat_failed": "WeChat \u30ED\u30B0\u30A4\u30F3\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u5F8C\u3067\u3082\u3046\u4E00\u5EA6\u8A66\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   "core.navigation.home": "\u30DB\u30FC\u30E0",
+  "core.navigation.message": "\u30E1\u30C3\u30BB\u30FC\u30B8",
   "core.navigation.error.access": "\u7121\u52B9\u306A\u30E1\u30CB\u30E5\u30FC \u30A2\u30AF\u30BB\u30B9 \u30E2\u30FC\u30C9: {access}",
   "core.navigation.error.child_tab": "\u30E2\u30D0\u30A4\u30EB \u30BB\u30AB\u30F3\u30C0\u30EA \u30E1\u30CB\u30E5\u30FC\u306E\u307F\u304C\u30BF\u30D6\u3068\u3057\u3066\u4F7F\u7528\u3067\u304D\u307E\u3059: {name}",
   "core.navigation.error.cycle": "\u30E2\u30D0\u30A4\u30EB \u30E1\u30CB\u30E5\u30FC\u306B\u306F\u30EB\u30FC\u30D7\u306E\u89AA\u304C\u3042\u308A\u307E\u3059: {name}",
@@ -330,6 +430,22 @@ var ja_JP_default = {
   "core.protocol.not_configured": "{title} \u306F\u69CB\u6210\u3055\u308C\u3066\u3044\u306A\u3044\u305F\u3081\u3001\u4E00\u6642\u7684\u306B\u8868\u793A\u3067\u304D\u307E\u305B\u3093\u3002",
   "core.protocol.privacy": "\u30D7\u30E9\u30A4\u30D0\u30B7\u30FC\u898F\u7D04",
   "core.protocol.service": "\u5229\u7528\u898F\u7D04",
+  "core.settings.authorization": "\u8A8D\u53EF\u7BA1\u7406",
+  "core.settings.contact": "\u304A\u554F\u3044\u5408\u308F\u305B",
+  "core.settings.feedback": "\u554F\u984C\u306E\u30D5\u30A3\u30FC\u30C9\u30D0\u30C3\u30AF",
+  "core.settings.logout_confirm": "\u30ED\u30B0\u30A2\u30A6\u30C8\u3057\u307E\u3059\u304B?",
+  "core.settings.logout_failed": "\u30ED\u30B0\u30A2\u30A6\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  "core.settings.mfa_bind_success": "\u591A\u8981\u7D20\u8A8D\u8A3C\u3092\u6709\u52B9\u306B\u3057\u307E\u3057\u305F",
+  "core.settings.mfa_disable_action": "\u7121\u52B9\u306B\u3059\u308B",
+  "core.settings.mfa_disable_factor_required": "TOTP \u30B3\u30FC\u30C9\u307E\u305F\u306F\u30EA\u30AB\u30D0\u30EA\u30FC\u30B3\u30FC\u30C9\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  "core.settings.mfa_disable_success": "\u591A\u8981\u7D20\u8A8D\u8A3C\u3092\u7121\u52B9\u306B\u3057\u307E\u3057\u305F",
+  "core.settings.mfa_disable_title": "\u591A\u8981\u7D20\u8A8D\u8A3C\u3092\u7121\u52B9\u5316",
+  "core.settings.mfa_disabled": "\u672A\u8A2D\u5B9A",
+  "core.settings.mfa_enabled_method": "\u6709\u52B9\uFF08{method}\uFF09",
+  "core.settings.mfa_method_totp": "TOTP",
+  "core.settings.mfa_method_webauthn": "WebAuthn",
+  "core.settings.mfa_title": "\u591A\u8981\u7D20\u8A8D\u8A3C",
+  "core.settings.title": "\u8A2D\u5B9A",
   "core.status.CONFIG_ERROR": "\u30CA\u30D3\u30B2\u30FC\u30B7\u30E7\u30F3\u69CB\u6210\u304C\u7121\u52B9\u3067\u3059",
   "core.status.forbidden": "\u307E\u3060\u30A2\u30AF\u30BB\u30B9\u3067\u304D\u307E\u305B\u3093",
   "core.status.NOT_FOUND": "\u30DA\u30FC\u30B8\u304C\u5B58\u5728\u3057\u307E\u305B\u3093",
@@ -338,7 +454,11 @@ var ja_JP_default = {
   "core.status.loading": "\u3092\u30ED\u30FC\u30C9\u4E2D\u3067\u3059",
   "core.webview.embed_blocked": "\u73FE\u5728\u306E H5 \u30DA\u30FC\u30B8\u306F\u3001\u30BF\u30FC\u30B2\u30C3\u30C8 \u30B5\u30A4\u30C8\u306B\u3088\u3063\u3066\u57CB\u3081\u8FBC\u307F\u304C\u5236\u9650\u3055\u308C\u3066\u3044\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059",
   "core.webview.invalid_url": "\u6709\u52B9\u306A\u30EA\u30F3\u30AF \u30A2\u30C9\u30EC\u30B9\u304C\u3042\u308A\u307E\u305B\u3093",
-  "core.webview.open_failed": "\u30EA\u30F3\u30AF\u3092\u958B\u3051\u307E\u305B\u3093"
+  "core.webview.open_failed": "\u30EA\u30F3\u30AF\u3092\u958B\u3051\u307E\u305B\u3093",
+  "common.value.top_level": "\u30C8\u30C3\u30D7\u30EC\u30D9\u30EB",
+  "common.resource.default": "{resource}",
+  "common.action.delete_resource": "{resource}\u3092\u524A\u9664",
+  "common.action.set_field_status": "{field}\u3092\u8A2D\u5B9A"
 };
 
 // src/locales/zh-TW.json
@@ -372,6 +492,8 @@ var zh_TW_default = {
   "core.crypto.public_key_invalid": "\u516C\u9470\u683C\u5F0F\u7121\u6548",
   "core.crypto.random_failed": "\u96A8\u6A5F\u6578\u751F\u6210\u5931\u6557",
   "core.crypto.unsupported": "\u7576\u524D\u74B0\u5883\u4E0D\u652F\u63F4\u5BC6\u78BC\u52A0\u5BC6",
+  "core.password.verify_title": "\u9A57\u8B49\u5BC6\u78BC",
+  "core.password.verify_label": "\u7576\u524D\u5BC6\u78BC",
   "core.file.upload_failed": "\u4E0A\u50B3\u5931\u6557",
   "core.home.account_capability": "\u8CEC\u6236\u80FD\u529B",
   "core.home.account_capability_description": "\u500B\u4EBA\u8CC7\u6599\u3001\u61C9\u7528\u8A2D\u5B9A\u8207\u667A\u6167\u52A9\u624B\u5165\u53E3\u5DF2\u4FDD\u7559",
@@ -402,6 +524,23 @@ var zh_TW_default = {
   "core.login.captcha_write_failed": "\u9A57\u8B49\u78BC\u5716\u7247\u5BEB\u5165\u5931\u6557",
   "core.login.default_sub_title": "\u6B61\u8FCE\u4F7F\u7528\u672C\u61C9\u7528",
   "core.login.login_success": "\u767B\u5165\u6210\u529F",
+  "core.login.mfa_title": "\u591A\u56E0\u7D20\u8A8D\u8B49",
+  "core.login.mfa_code": "\u8ACB\u8F38\u5165\u52D5\u614B\u5BC6\u78BC",
+  "core.login.mfa_recovery_code": "\u6062\u5FA9\u78BC\uFF08\u53EF\u9078\uFF09",
+  "core.login.mfa_setup_title": "\u7D81\u5B9A\u591A\u56E0\u7D20\u8A8D\u8B49",
+  "core.login.mfa_copy_uri": "\u8907\u88FD\u7D81\u5B9A\u5730\u5740",
+  "core.login.mfa_copy_success": "\u7D81\u5B9A\u5730\u5740\u5DF2\u8907\u88FD",
+  "core.login.mfa_recovery_codes_copied": "\u6062\u5FA9\u78BC\u5DF2\u8907\u88FD",
+  "core.login.mfa_recovery_codes_title": "\u5132\u5B58 MFA \u6062\u5FA9\u78BC",
+  "core.login.mfa_recovery_codes_warning": "\u6BCF\u500B\u6062\u5FA9\u78BC\u53EA\u80FD\u4F7F\u7528\u4E00\u6B21\uFF0C\u95DC\u9589\u6B64\u8996\u7A97\u5F8C\u4E0D\u6703\u518D\u6B21\u986F\u793A\u3002",
+  "core.login.mfa_copy_recovery_codes": "\u8907\u88FD\u6062\u5FA9\u78BC",
+  "core.login.mfa_recovery_codes_confirm": "\u6211\u5DF2\u5132\u5B58",
+  "core.login.mfa_setup_success": "\u591A\u56E0\u7D20\u8A8D\u8B49\u7D81\u5B9A\u6210\u529F\uFF0C\u8ACB\u91CD\u65B0\u767B\u5165\u3002",
+  "core.login.mfa_webauthn_action": "\u4F7F\u7528 Passkey",
+  "core.login.mfa_webauthn_setup_unsupported": "\u76EE\u524D\u5E73\u53F0\u4E0D\u652F\u63F4 WebAuthn\uFF0C\u8ACB\u4F7F\u7528 TOTP \u6216\u6062\u5FA9\u78BC\u3002",
+  "core.login.mfa_webauthn_setup_invalid": "WebAuthn \u8A3B\u518A\u672A\u56DE\u50B3\u6709\u6548\u6191\u8B49\u3002",
+  "core.login.mfa_webauthn_login_unsupported": "\u76EE\u524D\u5E73\u53F0\u4E0D\u652F\u63F4 WebAuthn\uFF0C\u8ACB\u4F7F\u7528\u6062\u5FA9\u78BC\u3002",
+  "core.login.mfa_webauthn_login_invalid": "WebAuthn \u767B\u5165\u672A\u56DE\u50B3\u6709\u6548\u6191\u8B49\u3002",
   "core.login.password": "\u8ACB\u8F38\u5165\u5BC6\u78BC",
   "core.login.privacy": "\u300A\u96B1\u79C1\u5354\u8B70\u300B",
   "core.login.protocol_missing": "\u670D\u52D9\u689D\u6B3E\u548C\u96B1\u79C1\u5354\u8B70\u672A\u914D\u7F6E",
@@ -415,6 +554,7 @@ var zh_TW_default = {
   "core.login.wechat_bind_tip": "\u8A72\u5FAE\u4FE1\u5C1A\u672A\u7E6B\u7D50\uFF0C\u8ACB\u767B\u5165\u5DF2\u6709\u8CEC\u865F\u5B8C\u6210\u7E6B\u7D50",
   "core.login.wechat_failed": "\u5FAE\u4FE1\u767B\u5165\u5931\u6557\uFF0C\u8ACB\u7A0D\u5F8C\u91CD\u8A66",
   "core.navigation.home": "\u9996\u9801",
+  "core.navigation.message": "\u6D88\u606F",
   "core.navigation.error.access": "\u9078\u55AE\u8A2A\u554F\u6A21\u5F0F\u7121\u6548\uFF1A{access}",
   "core.navigation.error.child_tab": "\u53EA\u6709\u79FB\u52D5\u7AEF\u4E8C\u7D1A\u9078\u55AE\u53EF\u4EE5\u4F5C\u70BA tab\uFF1A{name}",
   "core.navigation.error.cycle": "\u79FB\u52D5\u7AEF\u9078\u55AE\u5B58\u5728\u8FF4\u5708\u7236\u7D1A\uFF1A{name}",
@@ -436,6 +576,22 @@ var zh_TW_default = {
   "core.protocol.not_configured": "{title}\u672A\u914D\u7F6E\uFF0C\u66AB\u6642\u7121\u6CD5\u6AA2\u8996",
   "core.protocol.privacy": "\u96B1\u79C1\u5354\u8B70",
   "core.protocol.service": "\u670D\u52D9\u689D\u6B3E",
+  "core.settings.authorization": "\u6388\u6B0A\u7BA1\u7406",
+  "core.settings.contact": "\u806F\u7D61\u6211\u5011",
+  "core.settings.feedback": "\u554F\u984C\u53CD\u994B",
+  "core.settings.logout_confirm": "\u662F\u5426\u9000\u51FA\u767B\u5165\uFF1F",
+  "core.settings.logout_failed": "\u9000\u51FA\u767B\u5165\u5931\u6557",
+  "core.settings.mfa_bind_success": "\u591A\u56E0\u7D20\u8A8D\u8B49\u7D81\u5B9A\u6210\u529F",
+  "core.settings.mfa_disable_action": "\u505C\u7528",
+  "core.settings.mfa_disable_factor_required": "\u8ACB\u8F38\u5165\u52D5\u614B\u5BC6\u78BC\u6216\u6062\u5FA9\u78BC\u3002",
+  "core.settings.mfa_disable_success": "\u591A\u56E0\u7D20\u8A8D\u8B49\u5DF2\u505C\u7528",
+  "core.settings.mfa_disable_title": "\u505C\u7528\u591A\u56E0\u7D20\u8A8D\u8B49",
+  "core.settings.mfa_disabled": "\u672A\u555F\u7528",
+  "core.settings.mfa_enabled_method": "\u5DF2\u555F\u7528\uFF08{method}\uFF09",
+  "core.settings.mfa_method_totp": "TOTP",
+  "core.settings.mfa_method_webauthn": "WebAuthn",
+  "core.settings.mfa_title": "\u591A\u56E0\u7D20\u8A8D\u8B49",
+  "core.settings.title": "\u8A2D\u5B9A",
   "core.status.CONFIG_ERROR": "\u5C0E\u822A\u914D\u7F6E\u7121\u6548",
   "core.status.forbidden": "\u66AB\u7121\u8A2A\u554F\u8A31\u53EF\u6B0A",
   "core.status.NOT_FOUND": "\u9801\u9762\u4E0D\u5B58\u5728",
@@ -444,7 +600,11 @@ var zh_TW_default = {
   "core.status.loading": "\u6B63\u5728\u8F09\u5165",
   "core.webview.embed_blocked": "\u7576\u524D H5 \u9801\u9762\u53EF\u80FD\u88AB\u76EE\u6A19\u7AD9\u9EDE\u9650\u5236\u5D4C\u5165",
   "core.webview.invalid_url": "\u7F3A\u5C11\u6709\u6548\u9023\u7D50\u5730\u5740",
-  "core.webview.open_failed": "\u9023\u7D50\u7121\u6CD5\u958B\u555F"
+  "core.webview.open_failed": "\u9023\u7D50\u7121\u6CD5\u958B\u555F",
+  "common.value.top_level": "\u9802\u7D1A\u7BC0\u9EDE",
+  "common.resource.default": "{resource}",
+  "common.action.delete_resource": "\u522A\u9664{resource}",
+  "common.action.set_field_status": "\u8A2D\u5B9A{field}"
 };
 
 // src/locales/generated.ts

package/package.json

@@ -7,7 +7,7 @@
     "type": "git",
     "url": "git@github.com:liujitcn/kratos-admin.git"
   },
-  "version": "0.0.29",
+  "version": "0.0.31",
   "type": "module",
   "files": [
     "dist",
@@ -25,6 +25,7 @@
     "./components/*.vue": "./src/components/*.vue",
     "./rpc/*": "./src/rpc/*",
     "./stores": "./src/stores/index.ts",
+    "./navigation": "./src/navigation.ts",
     "./static/*": "./src/static/*",
     "./styles/base.scss": "./src/styles/base.scss",
     "./uni.scss": "./src/uni.scss",
@@ -48,6 +49,7 @@
     "go-captcha-uni": "1.0.6",
     "pinia": "^2.0.27",
     "pinia-plugin-persistedstate": "^3.2.0",
+    "qrcode-generator": "^2.0.4",
     "vite": "5.2.8",
     "vue": "^3.4.21"
   },

package/src/api/base/mfa.ts

@@ -0,0 +1,127 @@
+import { http } from '../../utils/http'
+import type { LoginResponse } from '../../rpc/base/v1/login'
+import type {
+  BeginMfaDisableRequest,
+  BeginMfaDisableResponse,
+  BeginMfaEnrollmentRequest,
+  BeginMfaEnrollmentResponse,
+  BeginMfaSetupRequest,
+  BeginMfaSetupResponse,
+  ConfirmMfaEnrollmentRequest,
+  ConfirmMfaEnrollmentResponse,
+  ConfirmMfaSetupRequest,
+  ConfirmMfaSetupResponse,
+  DisableMfaRequest,
+  GetMfaStatusRequest,
+  MfaService,
+  MfaStatusResponse,
+  RecoveryCodesResponse,
+  RegenerateMfaRecoveryCodesRequest,
+  VerifyMfaRequest,
+} from '../../rpc/base/v1/mfa'
+import type { Empty } from '../../rpc/google/protobuf/empty'
+
+const MFA_URL = '/v1/base/mfa'
+
+/** 多因素认证公共服务。 */
+export class MfaServiceImpl implements MfaService {
+  /** 校验登录阶段多因素认证。 */
+  VerifyMfa(request: VerifyMfaRequest): Promise<LoginResponse> {
+    return http<LoginResponse>({
+      url: `${MFA_URL}/verify`,
+      method: 'POST',
+      authMode: 'none',
+      data: request,
+      header: { Authorization: 'no-auth' },
+    })
+  }
+
+  /** 开始登录阶段的强制多因素认证绑定。 */
+  BeginMfaEnrollment(request: BeginMfaEnrollmentRequest): Promise<BeginMfaEnrollmentResponse> {
+    return http<BeginMfaEnrollmentResponse>({
+      url: `${MFA_URL}/enrollment`,
+      method: 'POST',
+      authMode: 'none',
+      data: request,
+      header: { Authorization: 'no-auth' },
+    })
+  }
+
+  /** 确认登录阶段的强制多因素认证绑定。 */
+  ConfirmMfaEnrollment(
+    request: ConfirmMfaEnrollmentRequest,
+  ): Promise<ConfirmMfaEnrollmentResponse> {
+    return http<ConfirmMfaEnrollmentResponse>({
+      url: `${MFA_URL}/enrollment/confirm`,
+      method: 'POST',
+      authMode: 'none',
+      data: request,
+      header: { Authorization: 'no-auth' },
+    })
+  }
+
+  /** 查询当前用户多因素认证状态。 */
+  GetMfaStatus(request: GetMfaStatusRequest): Promise<MfaStatusResponse> {
+    return http<MfaStatusResponse>({
+      url: MFA_URL,
+      method: 'GET',
+      authMode: 'required',
+      data: request,
+    })
+  }
+
+  /** 开始绑定当前用户的多因素认证方式。 */
+  BeginMfaSetup(request: BeginMfaSetupRequest): Promise<BeginMfaSetupResponse> {
+    return http<BeginMfaSetupResponse>({
+      url: `${MFA_URL}/setup`,
+      method: 'POST',
+      authMode: 'required',
+      data: request,
+    })
+  }
+
+  /** 确认绑定当前用户的多因素认证方式。 */
+  ConfirmMfaSetup(request: ConfirmMfaSetupRequest): Promise<ConfirmMfaSetupResponse> {
+    return http<ConfirmMfaSetupResponse>({
+      url: `${MFA_URL}/setup/confirm`,
+      method: 'POST',
+      authMode: 'required',
+      data: request,
+    })
+  }
+
+  /** 开始禁用 WebAuthn 多因素认证的 Passkey 验证。 */
+  BeginMfaDisable(request: BeginMfaDisableRequest): Promise<BeginMfaDisableResponse> {
+    return http<BeginMfaDisableResponse>({
+      url: `${MFA_URL}/disable/challenge`,
+      method: 'POST',
+      authMode: 'required',
+      data: request,
+    })
+  }
+
+  /** 禁用当前用户的多因素认证。 */
+  DisableMfa(request: DisableMfaRequest): Promise<Empty> {
+    return http<Empty>({
+      url: `${MFA_URL}/disable`,
+      method: 'POST',
+      authMode: 'required',
+      data: request,
+    })
+  }
+
+  /** 重新生成当前用户的多因素认证恢复码。 */
+  RegenerateMfaRecoveryCodes(
+    request: RegenerateMfaRecoveryCodesRequest,
+  ): Promise<RecoveryCodesResponse> {
+    return http<RecoveryCodesResponse>({
+      url: `${MFA_URL}/recovery-codes`,
+      method: 'POST',
+      authMode: 'required',
+      data: request,
+    })
+  }
+}
+
+/** defMfaService 多因素认证公共服务实例。 */
+export const defMfaService = new MfaServiceImpl()