@liujitcn/kratos-uni-app-core 0.0.66 → 0.0.67

package/dist/module.mjs

@@ -167,7 +167,10 @@ var zh_CN_default = {
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "\u5220\u9664{resource}",
   "common.action.set_field_status": "\u8BBE\u7F6E{field}",
-  "common.action.load_more": "\u52A0\u8F7D\u66F4\u591A"
+  "common.action.load_more": "\u52A0\u8F7D\u66F4\u591A",
+  "common.status.loading": "\u52A0\u8F7D\u4E2D\u2026",
+  "core.navigation.analytics": "\u5206\u6790",
+  "core.navigation.report": "\u62A5\u8868"
 };
 
 // src/locales/en-US.json
@@ -314,7 +317,10 @@ var en_US_default = {
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "Delete {resource}",
   "common.action.set_field_status": "Set {field}",
-  "common.action.load_more": "Load more"
+  "common.action.load_more": "Load more",
+  "common.status.loading": "Loading\u2026",
+  "core.navigation.analytics": "Analytics",
+  "core.navigation.report": "Reports"
 };
 
 // src/locales/ja-JP.json
@@ -461,7 +467,10 @@ var ja_JP_default = {
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "{resource}\u3092\u524A\u9664",
   "common.action.set_field_status": "{field}\u3092\u8A2D\u5B9A",
-  "common.action.load_more": "\u3055\u3089\u306B\u8AAD\u307F\u8FBC\u3080"
+  "common.action.load_more": "\u3055\u3089\u306B\u8AAD\u307F\u8FBC\u3080",
+  "common.status.loading": "\u8AAD\u307F\u8FBC\u307F\u4E2D\u2026",
+  "core.navigation.analytics": "\u5206\u6790",
+  "core.navigation.report": "\u30EC\u30DD\u30FC\u30C8"
 };
 
 // src/locales/zh-TW.json
@@ -608,7 +617,10 @@ var zh_TW_default = {
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "\u522A\u9664{resource}",
   "common.action.set_field_status": "\u8A2D\u5B9A{field}",
-  "common.action.load_more": "\u8F09\u5165\u66F4\u591A"
+  "common.action.load_more": "\u8F09\u5165\u66F4\u591A",
+  "common.status.loading": "\u8F09\u5165\u4E2D\u2026",
+  "core.navigation.analytics": "\u5206\u6790",
+  "core.navigation.report": "\u5831\u8868"
 };
 
 // src/locales/generated.ts

package/package.json

@@ -7,7 +7,7 @@
     "type": "git",
     "url": "git@github.com:liujitcn/kratos-admin.git"
   },
-  "version": "0.0.66",
+  "version": "0.0.67",
   "type": "module",
   "files": [
     "dist",

package/src/api/base/v1/login.ts

@@ -5,8 +5,6 @@ import type {
   LogoutRequest,
   LoginRequest,
   LoginResponse,
-  PasswordPublicKeyRequest,
-  PasswordPublicKeyResponse,
   RefreshTokenRequest,
   RefreshTokenResponse,
   VerifyCaptchaRequest,
@@ -17,7 +15,6 @@ import type { Empty } from '../../../rpc/google/protobuf/empty'
 
 const CAPTCHA_URL = '/v1/base/captcha'
 const CAPTCHA_VERIFY_URL = '/v1/base/captcha/verify'
-const PASSWORD_PUBLIC_KEY_URL = '/v1/base/password-public-key'
 const SESSION_URL = '/v1/base/session'
 const TOKEN_URL = '/v1/base/token'
 
@@ -43,16 +40,6 @@ export class LoginServiceImpl implements LoginService {
       header: { Authorization: 'no-auth' },
     })
   }
-  /** 获取密码临时公钥 */
-  PasswordPublicKey(request: PasswordPublicKeyRequest): Promise<PasswordPublicKeyResponse> {
-    return http<PasswordPublicKeyResponse>({
-      url: `${PASSWORD_PUBLIC_KEY_URL}`,
-      method: 'GET',
-      authMode: 'none',
-      data: request,
-      header: { Authorization: 'no-auth' },
-    })
-  }
   /** 登出 */
   Logout(request: LogoutRequest): Promise<Empty> {
     return http<Empty>({

package/src/api/base/v1/secret_crypto.ts

@@ -0,0 +1,36 @@
+import { http } from '../../../utils/http'
+import type {
+  GetSecretPublicKeyRequest,
+  GetSecretPublicKeyResponse,
+  RevealSecretFieldRequest,
+  RevealSecretFieldResponse,
+  SecretCryptoService,
+} from '../../../rpc/base/v1/secret_crypto'
+
+const SECRET_PUBLIC_KEY_URL = '/v1/base/secret-public-key'
+const SECRET_FIELD_REVEAL_URL = '/v1/base/secret-field/reveal'
+
+/** 敏感字段加密公共服务 */
+export class SecretCryptoServiceImpl implements SecretCryptoService {
+  /** 获取敏感字段临时公钥 */
+  GetSecretPublicKey(request: GetSecretPublicKeyRequest): Promise<GetSecretPublicKeyResponse> {
+    return http<GetSecretPublicKeyResponse>({
+      url: `${SECRET_PUBLIC_KEY_URL}`,
+      method: 'GET',
+      authMode: 'none',
+      data: request,
+      header: { Authorization: 'no-auth' },
+    })
+  }
+
+  /** 查看密钥字段明文 */
+  RevealSecretField(request: RevealSecretFieldRequest): Promise<RevealSecretFieldResponse> {
+    return http<RevealSecretFieldResponse>({
+      url: `${SECRET_FIELD_REVEAL_URL}`,
+      method: 'POST',
+      data: request,
+    })
+  }
+}
+
+export const defSecretCryptoService = new SecretCryptoServiceImpl()

package/src/components/KratosTabBar.vue

@@ -2,10 +2,23 @@
 import { computed, onMounted } from 'vue'
 import { resolveModuleIcon, resolveStaticView } from '../module'
 import { APP_MENU_ROOT_ID, useAppMenuBadge, useAppNavigation } from '../navigation'
+import { useI18n } from '../locales'
 import { resolveRootMenuId } from '../navigation-tree.mjs'
 
 const props = defineProps<{ route: string }>()
 const { menus, tabBar, navigate } = useAppNavigation()
+const { t } = useI18n()
+
+/** 按稳定 viewKey 优先取界面语言标签，未配置的菜单回退后端标题。 */
+const tabBarTitleKeys: Record<string, string> = {
+  HOME: 'core.navigation.home',
+  APP_ANALYTIC: 'core.navigation.analytics',
+  APP_REPORT: 'core.navigation.report',
+  MESSAGE_INBOX: 'core.navigation.message',
+  PROFILE_HOME: 'core.navigation.my',
+}
+const tabBarTitle = (item: { viewKey: string; title: string }): string =>
+  (tabBarTitleKeys[item.viewKey] ? t(tabBarTitleKeys[item.viewKey]) : '') || item.title
 const activeMenu = computed(() => {
   const routeMenu = menus.value.find((menu) => resolveStaticView(menu.viewKey) === props.route)
   if (!routeMenu) return
@@ -52,7 +65,7 @@ onMounted(() => {
         aria-hidden="true"
       />
       <text :class="{ 'kratos-tab-bar__text--active': activeMenu?.id === item.id }">
-        {{ item.title }}
+        {{ tabBarTitle(item) }}
       </text>
     </view>
   </view>

package/src/components/MfaManageDialog.vue

@@ -8,7 +8,7 @@ import type {
   DisableMfaRequest,
 } from '../rpc/base/v1/mfa'
 import { createWebAuthnCredential, getWebAuthnAssertion } from '../utils/webauthn'
-import { PASSWORD_CRYPTO_SCENE, encryptPassword } from '../utils/passwordCrypto'
+import { encryptPassword } from '../utils/secretCrypto'
 import { useI18n } from '../locales'
 import { defMfaService } from '../api/base/v1/mfa'
 
@@ -92,10 +92,7 @@ async function beginMfaSetup() {
   loading.value = true
   errorMessage.value = ''
   try {
-    const password = await encryptPassword(
-      setupPasswordInput.value,
-      PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_MFA,
-    )
+    const password = await encryptPassword(setupPasswordInput.value)
     const request: BeginMfaSetupRequest = { password, setup_ticket: '' }
     const result = await defMfaService.BeginMfaSetup(request)
     setupTicket.value = result.setup_ticket
@@ -136,10 +133,7 @@ async function handleDisableConfirm() {
   loading.value = true
   errorMessage.value = ''
   try {
-    const password = await encryptPassword(
-      disablePasswordInput.value,
-      PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_MFA,
-    )
+    const password = await encryptPassword(disablePasswordInput.value)
     let request: DisableMfaRequest
     if (disableRecoveryCode.value.trim()) {
       request = {

package/src/components/PasswordVerifyDialog.vue

@@ -1,9 +1,8 @@
 <script setup lang="ts">
 import { computed, ref, watch } from 'vue'
 import { useI18n } from '../locales'
-import { PASSWORD_CRYPTO_SCENE, encryptPassword } from '../utils/passwordCrypto'
-import type { PasswordCryptoScene } from '../utils/passwordCrypto'
-import type { PasswordCrypto } from '../rpc/common/v1/types'
+import { encryptPassword } from '../utils/secretCrypto'
+import type { SecretCrypto } from '../rpc/common/v1/types'
 
 const { t } = useI18n()
 
@@ -26,7 +25,6 @@ interface PasswordVerifyDialogProps {
   /** 外部业务提交状态。 */
   confirmLoading?: boolean
   /** 密码加密场景。 */
-  scene?: PasswordCryptoScene
   /** 是否允许点击遮罩关闭。 */
   closeOnClickModal?: boolean
 }
@@ -39,13 +37,12 @@ const props = withDefaults(defineProps<PasswordVerifyDialogProps>(), {
   confirmText: '',
   cancelText: '',
   confirmLoading: false,
-  scene: PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_MFA,
   closeOnClickModal: false,
 })
 
 const emit = defineEmits<{
   'update:modelValue': [value: boolean]
-  confirm: [password: PasswordCrypto]
+  confirm: [password: SecretCrypto]
   cancel: []
   closed: []
 }>()
@@ -87,7 +84,7 @@ async function handleConfirm() {
   errorMessage.value = ''
   encrypting.value = true
   try {
-    const encryptedPassword = await encryptPassword(password.value, props.scene)
+    const encryptedPassword = await encryptPassword(password.value)
     emit('confirm', encryptedPassword)
   } finally {
     encrypting.value = false

package/src/index.ts

@@ -7,3 +7,4 @@ export { default as KratosSettingsPage } from './components/KratosSettingsPage.v
 export { default as KratosTabBar } from './components/KratosTabBar.vue'
 export { default as pinia } from './stores'
 export * from './stores'
+export * from './utils/secretCrypto'

package/src/locales/README.md

@@ -9,4 +9,4 @@
 | `en-US.json` | 英文 Core 语言包。 | uni-app 切换为英文时使用。 |
 | `ja-JP.json` | 日文 Core 语言包。 | uni-app 切换为日文时使用。 |
 
-语言包是标准 JSON，不能在文件内直接写注释；公共键使用 `common.` 或 `core.` 命名空间。新增语言后执行仓库根目录的 `make i18n`。语言切换选项固定显示后端 `base_language.native_name`，接口不可用时使用代码内置的原生名称；`common.language.*` 仅用于普通文案和语言迁移初始数据。新增语言的完整文件清单见[国际化语言扩展指南](../../../../../../docs/国际化语言扩展指南.md)。
+语言包是标准 JSON，不能在文件内直接写注释；公共键使用 `common.` 或 `core.` 命名空间。新增语言后执行仓库根目录的 `make i18n`。语言切换选项固定显示后端 `base_language.native_name`，接口不可用时使用代码内置的原生名称；`common.language.*` 仅用于普通文案和语言迁移初始数据。新增语言的完整文件清单见[国际化设计与语言扩展](../../../../../../docs/国际化最终方案.md)。

package/src/locales/en-US.json

@@ -141,5 +141,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "Delete {resource}",
   "common.action.set_field_status": "Set {field}",
-  "common.action.load_more": "Load more"
+  "common.action.load_more": "Load more",
+  "common.status.loading": "Loading…",
+  "core.navigation.analytics": "Analytics",
+  "core.navigation.report": "Reports"
 }

package/src/locales/ja-JP.json

@@ -141,5 +141,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "{resource}を削除",
   "common.action.set_field_status": "{field}を設定",
-  "common.action.load_more": "さらに読み込む"
+  "common.action.load_more": "さらに読み込む",
+  "common.status.loading": "読み込み中…",
+  "core.navigation.analytics": "分析",
+  "core.navigation.report": "レポート"
 }

package/src/locales/zh-CN.json

@@ -141,5 +141,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "删除{resource}",
   "common.action.set_field_status": "设置{field}",
-  "common.action.load_more": "加载更多"
+  "common.action.load_more": "加载更多",
+  "common.status.loading": "加载中…",
+  "core.navigation.analytics": "分析",
+  "core.navigation.report": "报表"
 }

package/src/locales/zh-TW.json

@@ -141,5 +141,8 @@
   "common.resource.default": "{resource}",
   "common.action.delete_resource": "刪除{resource}",
   "common.action.set_field_status": "設定{field}",
-  "common.action.load_more": "載入更多"
+  "common.action.load_more": "載入更多",
+  "common.status.loading": "載入中…",
+  "core.navigation.analytics": "分析",
+  "core.navigation.report": "報表"
 }

package/src/rpc/base/v1/login.ts

@@ -5,27 +5,9 @@
 // source: base/v1/login.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 
-/** 密码加密场景枚举。 */
-export enum PasswordCryptoScene {
-  /** PASSWORD_CRYPTO_SCENE_UNSPECIFIED - 未指定密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_UNSPECIFIED = 0,
-  /** PASSWORD_CRYPTO_SCENE_LOGIN - 登录密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_LOGIN = 1,
-  /** PASSWORD_CRYPTO_SCENE_CREATE_BASE_USER - 新增后台用户密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_CREATE_BASE_USER = 2,
-  /** PASSWORD_CRYPTO_SCENE_RESET_BASE_USER_PASSWORD - 重置后台用户密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_RESET_BASE_USER_PASSWORD = 3,
-  /** PASSWORD_CRYPTO_SCENE_UPDATE_USER_PASSWORD - 个人修改密码加密场景。 */
-  PASSWORD_CRYPTO_SCENE_UPDATE_USER_PASSWORD = 4,
-  /** PASSWORD_CRYPTO_SCENE_MFA - 多因素认证敏感操作场景。 */
-  PASSWORD_CRYPTO_SCENE_MFA = 5,
-  /** PASSWORD_CRYPTO_SCENE_CONFIGURE_PASSWORD_POLICY - 密码策略初始化密码配置场景。 */
-  PASSWORD_CRYPTO_SCENE_CONFIGURE_PASSWORD_POLICY = 6,
-}
-
 /**
  * LoginStatus 表示登录请求当前所处的认证阶段。
  * 只有 AUTHENTICATED 或 PASSWORD_CHANGE_REQUIRED 才会携带正式访问令牌，MFA 状态必须继续完成挑战。
@@ -49,12 +31,6 @@ export interface CaptchaRequest {
   type: string;
 }
 
-/** 密码临时公钥获取条件 */
-export interface PasswordPublicKeyRequest {
-  /** 使用场景 */
-  scene: PasswordCryptoScene;
-}
-
 /** 登出请求条件 */
 export interface LogoutRequest {
 }
@@ -85,20 +61,6 @@ export interface VerifyCaptchaResponse {
   expires_in: number;
 }
 
-/** 密码临时公钥响应 */
-export interface PasswordPublicKeyResponse {
-  /** 临时密钥ID */
-  key_id: string;
-  /** 临时公钥 */
-  public_key: string;
-  /** 加密算法 */
-  algorithm: string;
-  /** 随机值 */
-  nonce: string;
-  /** 有效时间，单位秒 */
-  expires_in: number;
-}
-
 /** 刷新令牌请求参数 */
 export interface RefreshTokenRequest {
   /** 更新令牌；未填写时由服务端从HttpOnly Cookie读取。 */
@@ -125,7 +87,7 @@ export interface LoginRequest {
   user_name: string;
   /** 用户的密码，必选项。 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 验证码 */
   captcha_code: string;
@@ -165,8 +127,6 @@ export interface LoginService {
   Captcha(request: CaptchaRequest): Promise<CaptchaResponse>;
   /** 验证码预校验 */
   VerifyCaptcha(request: VerifyCaptchaRequest): Promise<VerifyCaptchaResponse>;
-  /** 获取密码临时公钥 */
-  PasswordPublicKey(request: PasswordPublicKeyRequest): Promise<PasswordPublicKeyResponse>;
   /** 登出 */
   Logout(request: LogoutRequest): Promise<Empty>;
   /** 刷新认证令牌 */

package/src/rpc/base/v1/mfa.ts

@@ -5,7 +5,7 @@
 // source: base/v1/mfa.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 import type { LoginResponse } from "./login";
 
@@ -79,7 +79,7 @@ export interface MfaStatusResponse {
 export interface BeginMfaSetupRequest {
   /** 当前登录密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 强制绑定场景下的临时票据 */
   setup_ticket: string;
@@ -135,7 +135,7 @@ export interface BeginMfaDisableResponse {
 export interface DisableMfaRequest {
   /** 当前登录密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** TOTP 动态口令 */
   code: string;

package/src/rpc/base/v1/oauth.ts

@@ -5,7 +5,7 @@
 // source: base/v1/oauth.proto
 
 /* eslint-disable */
-import type { PasswordCrypto } from "../../common/v1/types";
+import type { SecretCrypto } from "../../common/v1/types";
 import type { Empty } from "../../google/protobuf/empty";
 import type { LoginStatus } from "./login";
 
@@ -77,7 +77,7 @@ export interface BindOauthSessionRequest {
   user_name: string;
   /** 用户密码 */
   password:
-    | PasswordCrypto
+    | SecretCrypto
     | undefined;
   /** 验证码 */
   captcha_code: string;

package/src/rpc/base/v1/secret_crypto.ts

@@ -0,0 +1,49 @@
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v2.11.8
+//   protoc               unknown
+// source: base/v1/secret_crypto.proto
+
+/* eslint-disable */
+
+/** 敏感字段临时公钥获取条件 */
+export interface GetSecretPublicKeyRequest {
+}
+
+/** 敏感字段临时公钥响应 */
+export interface GetSecretPublicKeyResponse {
+  /** 临时密钥ID */
+  key_id: string;
+  /** 临时公钥 */
+  public_key: string;
+  /** 加密算法 */
+  algorithm: string;
+  /** 随机值 */
+  nonce: string;
+  /** 有效时间，单位秒 */
+  expires_in: number;
+}
+
+/** 密钥字段查看条件 */
+export interface RevealSecretFieldRequest {
+  /** 资源标识，如 ai_provider、base_oauth_provider、base_message_provider */
+  resource: string;
+  /** 记录ID */
+  id: number;
+  /** 字段名，如 api_key、client_secret */
+  field: string;
+}
+
+/** 密钥字段查看响应 */
+export interface RevealSecretFieldResponse {
+  /** 密钥明文 */
+  text: string;
+}
+
+/** 敏感字段加密公共服务 */
+export interface SecretCryptoService {
+  /** 获取敏感字段临时公钥，同一次提交的多个密文字段共用该公钥 */
+  GetSecretPublicKey(request: GetSecretPublicKeyRequest): Promise<GetSecretPublicKeyResponse>;
+  /** 查看密钥字段明文，仅允许查询注册过的密钥字段 */
+  RevealSecretField(request: RevealSecretFieldRequest): Promise<RevealSecretFieldResponse>;
+}

package/src/rpc/common/v1/types.ts

@@ -60,8 +60,8 @@ export interface BytesValues {
   value: Uint8Array[];
 }
 
-/** 密码密文。 */
-export interface PasswordCrypto {
+/** 敏感字段密文，密码与各类密钥字段统一使用。 */
+export interface SecretCrypto {
   /** 临时密钥ID */
   key_id: string;
   /** 随机值 */
@@ -72,6 +72,6 @@ export interface PasswordCrypto {
   encrypted_key: string;
   /** 初始化向量 */
   iv: string;
-  /** 密码加密数据 */
-  ciphertext: string;
+  /** 传输时为密文，服务端解密后回填明文 */
+  text: string;
 }

package/src/utils/http.ts

@@ -47,7 +47,7 @@ const REFRESH_TOKEN_URL = '/v1/base/token'
 const CAPTCHA_URL = '/v1/base/captcha'
 const CONFIG_URL = '/v1/base/config'
 const LANGUAGE_URL = '/v1/base/language'
-const PASSWORD_PUBLIC_KEY_URL = '/v1/base/password-public-key'
+const SECRET_PUBLIC_KEY_URL = '/v1/base/secret-public-key'
 // 认证公共接口不携带访问令牌。
 const NO_AUTH_URL_SET = new Set([
   SESSION_URL,
@@ -55,14 +55,14 @@ const NO_AUTH_URL_SET = new Set([
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
 ])
 const AUTH_EXPIRED_EXCLUDED_URL_SET = new Set([
   SESSION_URL,
   CAPTCHA_URL,
   CONFIG_URL,
   LANGUAGE_URL,
-  PASSWORD_PUBLIC_KEY_URL,
+  SECRET_PUBLIC_KEY_URL,
 ])
 
 const AUTH_SILENT_LOGOUT_EVENT = 'auth:silent-logout'

package/src/utils/{passwordCrypto.ts → secretCrypto.ts}

@@ -1,14 +1,11 @@
-import { defLoginService } from '../api/base/v1/login'
+import { defSecretCryptoService } from '../api/base/v1/secret_crypto'
 import { t } from '../locales'
-import { PasswordCryptoScene } from '../rpc/base/v1/login'
-import type { PasswordCrypto } from '../rpc/common/v1/types'
+import type { GetSecretPublicKeyResponse } from '../rpc/base/v1/secret_crypto'
+import type { SecretCrypto } from '../rpc/common/v1/types'
 import * as miniCrypto from 'asmcrypto.js'
 
 type MiniCrypto = typeof import('asmcrypto.js')
 
-export const PASSWORD_CRYPTO_SCENE = PasswordCryptoScene
-export type { PasswordCryptoScene }
-
 /** 将 PEM 公钥转换为二进制 DER 数据。 */
 function pemToArrayBuffer(pem: string) {
   const base64 = pem
@@ -179,19 +176,14 @@ function portableBytesToBase64(value: Uint8Array) {
 }
 
 /** 使用纯 JavaScript 实现兼容缺少 WebCrypto 的密码加密协议。 */
-async function encryptPortablePassword(
+async function encryptPortableSecret(
   crypto: MiniCrypto,
-  password: string,
-  publicKeyResponse: {
-    key_id: string
-    public_key: string
-    algorithm: string
-    nonce: string
-  },
-): Promise<PasswordCrypto> {
+  value: string,
+  publicKeyResponse: GetSecretPublicKeyResponse,
+): Promise<SecretCrypto> {
   const aesKey = new Uint8Array(await getPortableRandomBytes(32))
   const iv = new Uint8Array(await getPortableRandomBytes(12))
-  const plaintext = crypto.string_to_bytes(password, true)
+  const plaintext = crypto.string_to_bytes(value, true)
   const [modulus, exponent] = parsePortableRsaPublicKey(publicKeyResponse.public_key)
   const hash = new crypto.Sha256()
   const keySize = Math.ceil(new crypto.BigNumber(modulus).bitLength / 8)
@@ -233,26 +225,24 @@ async function encryptPortablePassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: portableBytesToBase64(encryptedKey),
     iv: portableBytesToBase64(iv),
-    ciphertext: portableBytesToBase64(ciphertext),
+    text: portableBytesToBase64(ciphertext),
   }
 }
 
-/** 加密单个密码字段，返回后端可解析的密码密文。 */
-export async function encryptPassword(
-  password: string,
-  scene: PasswordCryptoScene,
-): Promise<PasswordCrypto> {
-  const plainPassword = password.trim()
-  if (!plainPassword) {
-    throw new Error(t('core.crypto.password_required'))
-  }
-
-  const publicKeyResponse = await defLoginService.PasswordPublicKey({ scene })
+/** 获取敏感字段一次性临时公钥，同一次提交的多个密文字段共用该公钥。 */
+export async function fetchSecretPublicKey(): Promise<GetSecretPublicKeyResponse> {
+  return defSecretCryptoService.GetSecretPublicKey({})
+}
 
+/** 使用已获取的临时公钥加密单个敏感值，供一次取钥加密多个字段的场景复用。 */
+export async function encryptWithPublicKey(
+  publicKeyResponse: GetSecretPublicKeyResponse,
+  value: string,
+): Promise<SecretCrypto> {
   const cryptoApi = globalThis.crypto
   const isSecureContext = typeof window === 'undefined' || window.isSecureContext
   if (!cryptoApi?.subtle || !isSecureContext) {
-    return encryptPortablePassword(miniCrypto, plainPassword, publicKeyResponse)
+    return encryptPortableSecret(miniCrypto, value, publicKeyResponse)
   }
 
   const subtleCrypto = getSubtleCrypto()
@@ -271,7 +261,7 @@ export async function encryptPassword(
   const ciphertext = await subtleCrypto.subtle.encrypt(
     { name: 'AES-GCM', iv },
     aesKey,
-    new TextEncoder().encode(plainPassword),
+    new TextEncoder().encode(value),
   )
   const encryptedKey = await subtleCrypto.subtle.encrypt({ name: 'RSA-OAEP' }, publicKey, rawAesKey)
 
@@ -281,6 +271,20 @@ export async function encryptPassword(
     algorithm: publicKeyResponse.algorithm,
     encrypted_key: arrayBufferToBase64(encryptedKey),
     iv: arrayBufferToBase64(iv.buffer),
-    ciphertext: arrayBufferToBase64(ciphertext),
+    text: arrayBufferToBase64(ciphertext),
+  }
+}
+
+/** 加密单个敏感字段值，自动获取一次性临时公钥。 */
+export async function encryptSecret(value: string): Promise<SecretCrypto> {
+  return encryptWithPublicKey(await fetchSecretPublicKey(), value)
+}
+
+/** 加密密码字段：去除首尾空白且不允许为空。 */
+export async function encryptPassword(password: string): Promise<SecretCrypto> {
+  const plainPassword = password.trim()
+  if (!plainPassword) {
+    throw new Error(t('core.crypto.password_required'))
   }
+  return encryptSecret(plainPassword)
 }

package/src/views/pages/login/login.vue

@@ -9,7 +9,7 @@ import { defMfaService } from '../../../api/base/v1/mfa'
 import defaultLogo from '../../../static/images/logo_icon.png'
 import { formatSrc } from '../../../utils'
 import { homeTabPage } from '../../../utils/navigation'
-import { PASSWORD_CRYPTO_SCENE, encryptPassword } from '../../../utils/passwordCrypto'
+import { encryptPassword } from '../../../utils/secretCrypto'
 import { createWebAuthnCredential, getWebAuthnAssertion } from '../../../utils/webauthn'
 import { navigateAppRoute } from '../../../navigation'
 import { getLanguageOptions, useI18n, type SupportedLocale } from '../../../locales'
@@ -274,10 +274,7 @@ const bindMiniAccount = async () => {
   }
   loading.value = true
   try {
-    const password = await encryptPassword(
-      miniPasswordValue.value,
-      PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_LOGIN,
-    )
+    const password = await encryptPassword(miniPasswordValue.value)
     const code = (await wx.login()).code
     const response = await userStore.bindOauthSession({
       provider: wechatMiniProvider,
@@ -685,10 +682,7 @@ const verifyCaptchaToken = async (captchaCode: string) => {
 
 // 执行真正的账号登录流程。
 const submitLogin = async (captchaCode: string) => {
-  const password = await encryptPassword(
-    passwordValue.value,
-    PASSWORD_CRYPTO_SCENE.PASSWORD_CRYPTO_SCENE_LOGIN,
-  )
+  const password = await encryptPassword(passwordValue.value)
   return userStore.login({
     ...form.value,
     tenant_code: showTenantCode.value ? form.value.tenant_code : '0000',