@liujitcn/kratos-uni-app-core 0.0.59 → 0.0.60

package/dist/module.mjs

@@ -164,7 +164,8 @@ var zh_CN_default = {
   "common.value.top_level": "\u9876\u7EA7\u8282\u70B9",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "\u5220\u9664{resource}",
-  "common.action.set_field_status": "\u8BBE\u7F6E{field}"
+  "common.action.set_field_status": "\u8BBE\u7F6E{field}",
+  "common.action.load_more": "\u52A0\u8F7D\u66F4\u591A"
 };
 
 // src/locales/en-US.json
@@ -308,7 +309,8 @@ var en_US_default = {
   "common.value.top_level": "Top level",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "Delete {resource}",
-  "common.action.set_field_status": "Set {field}"
+  "common.action.set_field_status": "Set {field}",
+  "common.action.load_more": "Load more"
 };
 
 // src/locales/ja-JP.json
@@ -452,7 +454,8 @@ var ja_JP_default = {
   "common.value.top_level": "\u30C8\u30C3\u30D7\u30EC\u30D9\u30EB",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "{resource}\u3092\u524A\u9664",
-  "common.action.set_field_status": "{field}\u3092\u8A2D\u5B9A"
+  "common.action.set_field_status": "{field}\u3092\u8A2D\u5B9A",
+  "common.action.load_more": "\u3055\u3089\u306B\u8AAD\u307F\u8FBC\u3080"
 };
 
 // src/locales/zh-TW.json
@@ -596,7 +599,8 @@ var zh_TW_default = {
   "common.value.top_level": "\u9802\u7D1A\u7BC0\u9EDE",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "\u522A\u9664{resource}",
-  "common.action.set_field_status": "\u8A2D\u5B9A{field}"
+  "common.action.set_field_status": "\u8A2D\u5B9A{field}",
+  "common.action.load_more": "\u8F09\u5165\u66F4\u591A"
 };
 
 // src/locales/generated.ts

package/package.json

@@ -7,7 +7,7 @@
     "type": "git",
     "url": "git@github.com:liujitcn/kratos-admin.git"
   },
-  "version": "0.0.59",
+  "version": "0.0.60",
   "type": "module",
   "files": [
     "dist",

package/src/components/KratosSettingsPage.vue

@@ -15,6 +15,15 @@ defineSlots<{
 
 const userStore = useUserStore()
 const { locale, setLocale, t } = useI18n()
+/** 登录态失效时请求层已弹窗引导重新登录，页面侧不再叠加失败提示。 */
+const isAuthExpiredError = (error: unknown) => {
+  if (error && typeof error === 'object') {
+    const statusCode = (error as { statusCode?: number }).statusCode
+    if (statusCode === 401 || statusCode === 403) return true
+  }
+  return error instanceof Error && /auth (required|expired)/.test(error.message)
+}
+
 const logoutLoading = ref(false)
 const mfaDialogVisible = ref(false)
 const mfaDialogMode = ref<'setup' | 'disable'>('setup')
@@ -136,10 +145,12 @@ const onLogout = () => {
         await userStore.logout()
         uni.navigateBack()
       } catch (error) {
-        await uni.showToast({
-          icon: 'none',
-          title: t('core.settings.logout_failed'),
-        })
+        if (!isAuthExpiredError(error)) {
+          await uni.showToast({
+            icon: 'none',
+            title: t('core.settings.logout_failed'),
+          })
+        }
       } finally {
         logoutLoading.value = false
       }

package/src/components/MfaRecoveryCodesDialog.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, onBeforeUnmount, ref } from 'vue'
+import { computed, onBeforeUnmount, ref, watch } from 'vue'
 import { useI18n } from '../locales'
 import { copyText } from '../utils/clipboard'
 
@@ -23,6 +23,7 @@ const emit = defineEmits<{
 
 const { t } = useI18n()
 const codesText = computed(() => props.codes.join('\n'))
+const confirming = ref(false)
 const copyState = ref<'idle' | 'copied' | 'failed'>('idle')
 const copyTextLabel = computed(() => {
   if (copyState.value === 'copied') return t('core.login.mfa_recovery_codes_copied')
@@ -48,10 +49,20 @@ async function copyRecoveryCodes() {
 
 /** 关闭弹窗并通知调用方继续完成绑定流程。 */
 function handleConfirm() {
+  if (confirming.value) return
+  confirming.value = true
   emit('update:modelValue', false)
   emit('confirm')
 }
 
+// 每次重新打开弹窗时重置一次性确认锁。
+watch(
+  () => props.modelValue,
+  (open) => {
+    if (open) confirming.value = false
+  },
+)
+
 onBeforeUnmount(() => {
   if (resetCopyStateTimer) clearTimeout(resetCopyStateTimer)
 })

package/src/locales/en-US.json

@@ -138,5 +138,6 @@
   "common.value.top_level": "Top level",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "Delete {resource}",
-  "common.action.set_field_status": "Set {field}"
+  "common.action.set_field_status": "Set {field}",
+  "common.action.load_more": "Load more"
 }

package/src/locales/ja-JP.json

@@ -138,5 +138,6 @@
   "common.value.top_level": "トップレベル",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "{resource}を削除",
-  "common.action.set_field_status": "{field}を設定"
+  "common.action.set_field_status": "{field}を設定",
+  "common.action.load_more": "さらに読み込む"
 }

package/src/locales/zh-CN.json

@@ -138,5 +138,6 @@
   "common.value.top_level": "顶级节点",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "删除{resource}",
-  "common.action.set_field_status": "设置{field}"
+  "common.action.set_field_status": "设置{field}",
+  "common.action.load_more": "加载更多"
 }

package/src/locales/zh-TW.json

@@ -138,5 +138,6 @@
   "common.value.top_level": "頂級節點",
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "刪除{resource}",
-  "common.action.set_field_status": "設定{field}"
+  "common.action.set_field_status": "設定{field}",
+  "common.action.load_more": "載入更多"
 }

package/src/stores/modules/user.ts

@@ -4,7 +4,7 @@ import type {
   CreateOauthSessionRequest,
   CreateOauthSessionResponse,
 } from '../../rpc/base/v1/oauth'
-import type { LoginRequest, LoginResponse } from '../../rpc/base/v1/login'
+import { LoginStatus, type LoginRequest, type LoginResponse } from '../../rpc/base/v1/login'
 import type { VerifyMfaRequest } from '../../rpc/base/v1/mfa'
 import { defMfaService } from '../../api/base/v1/mfa'
 import { defAuthService } from '../../api/system/app/v1/auth'
@@ -69,6 +69,15 @@ export const useUserStore = defineStore(
       return Boolean(userInfo.value && hasValidToken())
     }
 
+    /** 仅当登录阶段已签发非空令牌时，才允许写入本地登录态。 */
+    function shouldApplyLoginToken(data: LoginResponse | CreateOauthSessionResponse) {
+      return (
+        (data.status === LoginStatus.LOGIN_STATUS_AUTHENTICATED ||
+          data.status === LoginStatus.LOGIN_STATUS_PASSWORD_CHANGE_REQUIRED) &&
+        Boolean(data.access_token && data.refresh_token)
+      )
+    }
+
     /** 保存登录接口返回的认证令牌，并通知已注册的业务扩展。 */
     async function applyLoginToken(data: LoginResponse | CreateOauthSessionResponse) {
       const { token_type, access_token, refresh_token, expires_in } = data
@@ -95,8 +104,7 @@ export const useUserStore = defineStore(
         defLoginService
           .Login(request)
           .then(async (data) => {
-            if (data.status === 1 || data.status === 0 || data.status === 4)
-              await applyLoginToken(data)
+            if (shouldApplyLoginToken(data)) await applyLoginToken(data)
             resolve(data)
           })
           .catch((error) => {
@@ -111,7 +119,7 @@ export const useUserStore = defineStore(
         defMfaService
           .VerifyMfa(request)
           .then(async (data) => {
-            await applyLoginToken(data)
+            if (shouldApplyLoginToken(data)) await applyLoginToken(data)
             resolve(data)
           })
           .catch((error) => reject(error))
@@ -133,8 +141,7 @@ export const useUserStore = defineStore(
               resolve(data)
               return
             }
-            if (data.status === 1 || data.status === 0 || data.status === 4)
-              await applyLoginToken(data)
+            if (shouldApplyLoginToken(data)) await applyLoginToken(data)
             resolve(data)
           })
           .catch((error) => {
@@ -149,8 +156,7 @@ export const useUserStore = defineStore(
         defOauthService
           .BindOauthSession(request)
           .then(async (data) => {
-            if (data.status === 1 || data.status === 0 || data.status === 4)
-              await applyLoginToken(data)
+            if (shouldApplyLoginToken(data)) await applyLoginToken(data)
             resolve(data)
           })
           .catch((error) => {
@@ -183,19 +189,13 @@ export const useUserStore = defineStore(
     /**
      * 登出
      */
-    function logout() {
-      return new Promise<void>((resolve, reject) => {
-        defLoginService
-          .Logout({})
-          .then(() => {
-            clearUserData().then(() => {
-              resolve()
-            })
-          })
-          .catch((error) => {
-            reject(error)
-          })
-      })
+    async function logout() {
+      try {
+        await defLoginService.Logout({})
+      } finally {
+        // 登出接口失败时仍清理本地登录态，避免残留有效 token 造成“假登录”。
+        await clearUserData()
+      }
     }
 
     /**

package/src/utils/file.ts

@@ -5,7 +5,7 @@ import {
 } from '../rpc/base/v1/file'
 import { formatSrc } from './index'
 import { getLocaleRequestHeaders, t } from '../locales'
-import { getRequestAccessToken } from './http'
+import { getRequestAccessToken, sourceClient } from './http'
 
 // 文件上传-兼容小程序端、H5端、App端
 export const uploadFile = async (
@@ -24,7 +24,7 @@ export const uploadFile = async (
     },
     header: {
       ...getLocaleRequestHeaders(),
-      'source-client': 'miniapp',
+      'source-client': sourceClient,
       ...(token ? { Authorization: token } : {}),
     },
   })
@@ -65,7 +65,7 @@ export const multiUploadFile = async (
     },
     header: {
       ...getLocaleRequestHeaders(),
-      'source-client': 'miniapp',
+      'source-client': sourceClient,
       ...(token ? { Authorization: token } : {}),
     },
   })

package/src/utils/http.ts

@@ -22,7 +22,7 @@ const apiBasePath = import.meta.env.VITE_APP_BASE_API || '/api'
 const apiTargetUrl = import.meta.env.VITE_APP_API_URL || ''
 const normalizedApiBasePath = apiBasePath.startsWith('/') ? apiBasePath : `/${apiBasePath}`
 
-let sourceClient = 'uni-h5'
+export let sourceClient = 'uni-h5'
 // #ifdef MP-WEIXIN
 sourceClient = 'uni-weapp'
 // #endif
@@ -37,6 +37,11 @@ const requestOrigin =
     : apiTargetUrl.replace(/\/$/, '')
 const baseURL = `${requestOrigin}${normalizedApiBasePath}`
 export const requestBaseURL = baseURL
+/** 站点根地址（不含 API 基础路径），供事件流等非 API 端点复用。 */
+export const siteBaseURL =
+  typeof window !== 'undefined' && window.location?.protocol?.startsWith('http')
+    ? window.location.origin
+    : apiTargetUrl.replace(/\/$/, '')
 const SESSION_URL = '/v1/base/session'
 const REFRESH_TOKEN_URL = '/v1/base/token'
 const CAPTCHA_URL = '/v1/base/captcha'
@@ -265,18 +270,15 @@ export function handleAuthExpired(authMode: AuthMode = 'required') {
 }
 
 // 刷新 Token 处理
-function handleTokenRefresh(authMode: AuthMode) {
+function handleTokenRefresh() {
   if (refreshTokenPromise) {
     return refreshTokenPromise
   }
   isRefreshing = true
   refreshTokenPromise = refreshAccessToken()
-    .catch(async (error) => {
+    .catch((error) => {
       // 刷新失败后立即撤销本地认证，避免弹窗等待期间后台请求反复提交旧刷新令牌。
       silentClearAuthData()
-      if (authMode === 'required') {
-        await promptRelogin()
-      }
       throw error
     })
     .finally(() => {
@@ -300,7 +302,11 @@ async function getAccessTokenByMode(authMode: AuthMode) {
   }
 
   if (shouldRefreshToken()) {
-    await handleTokenRefresh(authMode)
+    try {
+      await handleTokenRefresh()
+    } catch {
+      // 刷新失败已撤销本地认证，交由下方 hasValidToken 分支按当前调用方 authMode 处理。
+    }
   }
 
   if (hasValidToken()) {

package/src/views/pages/login/login.vue

@@ -2,7 +2,7 @@
 import { useSettingStore, useUserStore } from '../../../stores'
 import type { LoginRequest } from '../../../rpc/base/v1/login'
 import { LoginStatus, type LoginResponse } from '../../../rpc/base/v1/login'
-import { onLoad } from '@dcloudio/uni-app'
+import { onLoad, onUnload } from '@dcloudio/uni-app'
 import { computed, defineAsyncComponent, nextTick, reactive, ref, watch } from 'vue'
 import { defLoginService } from '../../../api/base/v1/login'
 import { defMfaService } from '../../../api/base/v1/mfa'
@@ -102,10 +102,15 @@ const toggleAgreePrivacy = () => {
   isAgreePrivacy.value = !isAgreePrivacy.value
 }
 
+let agreePrivacyShakeTimer: ReturnType<typeof setTimeout> | undefined
+let loginSuccessTimer: ReturnType<typeof setTimeout> | undefined
+
 const triggerAgreePrivacyShake = () => {
   isAgreePrivacyShakeY.value = true
-  setTimeout(() => {
+  if (agreePrivacyShakeTimer) clearTimeout(agreePrivacyShakeTimer)
+  agreePrivacyShakeTimer = setTimeout(() => {
     isAgreePrivacyShakeY.value = false
+    agreePrivacyShakeTimer = undefined
   }, 500)
 }
 
@@ -203,17 +208,8 @@ const refreshMiniCaptcha = async () => {
 /** 仅将后端明确返回的未绑定错误转为账号绑定流程。 */
 const isWechatUnboundError = (error: unknown) => {
   if (!error || typeof error !== 'object') return false
-  const response = error as {
-    statusCode?: number
-    data?: {
-      reason?: string | number
-      message?: string
-      binding_required?: boolean
-      error?: { reason?: string | number; message?: string }
-    }
-  }
-  const reason = response.data?.reason ?? response.data?.error?.reason
-  return response.data?.binding_required === true || String(reason || '') === 'UNAUTHENTICATED'
+  const response = error as { data?: { binding_required?: boolean } }
+  return response.data?.binding_required === true
 }
 
 // 微信授权失败时保留请求层提示，避免异步登录异常冒泡到小程序调试器。
@@ -781,7 +777,9 @@ const loginSuccess = async () => {
   await userStore.getUserProfile()
   // 成功提示
   await uni.showToast({ icon: 'success', title: t('core.login.login_success') })
-  setTimeout(() => {
+  if (loginSuccessTimer) clearTimeout(loginSuccessTimer)
+  loginSuccessTimer = setTimeout(() => {
+    loginSuccessTimer = undefined
     const lastRoute = uni.getStorageSync('lastRoute') || homeTabPage
     if (lastRoute.startsWith(homeTabPage)) {
       uni.setStorageSync('SwitchTabIndex', true)
@@ -873,6 +871,13 @@ const ensureLoginSettings = () => loadLoginSettings()
 onLoad(() => {
   void loadLoginSettings()
 })
+
+onUnload(() => {
+  if (agreePrivacyShakeTimer) clearTimeout(agreePrivacyShakeTimer)
+  agreePrivacyShakeTimer = undefined
+  if (loginSuccessTimer) clearTimeout(loginSuccessTimer)
+  loginSuccessTimer = undefined
+})
 </script>
 
 <template>

package/src/views/pages/webview/webview.vue

@@ -41,6 +41,17 @@ const isIframeLoaded = ref(false)
 const isIframeTimedOut = ref(false)
 const { t } = useI18n()
 
+/** 只放行 http(s) 外链，其它协议按非法地址处理。 */
+const isAllowedUrl = (value: string) => /^https?:\/\//i.test(value)
+
+const safeDecodeURIComponent = (value: string) => {
+  try {
+    return decodeURIComponent(value)
+  } catch {
+    return value
+  }
+}
+
 const showFallback = computed(
   () => !url.value || (isH5.value && isIframeTimedOut.value && !isIframeLoaded.value),
 )
@@ -52,8 +63,9 @@ const emptyDesc = computed(() => {
 })
 
 onLoad((query) => {
-  url.value = decodeURIComponent(query?.url || '')
-  const title = decodeURIComponent(query?.title || '')
+  const nextUrl = safeDecodeURIComponent(query?.url || '')
+  url.value = isAllowedUrl(nextUrl) ? nextUrl : ''
+  const title = safeDecodeURIComponent(query?.title || '')
   // 调用方传入标题时同步更新原生导航栏，避免继续显示页面注册时的空标题。
   if (title) {
     void uni.setNavigationBarTitle({ title })
@@ -81,10 +93,8 @@ const openInBrowser = () => {
   // #endif
 }
 
-// 小程序接收消息
-const handleMessage = (e: any) => {
-  console.log('收到H5消息:', e.detail)
-}
+// 小程序接收消息（第三方消息不落日志，避免敏感信息泄漏）。
+const handleMessage = () => {}
 </script>
 
 <style scoped>