@milian/linker-cli 0.0.0-stage → 0.17.3

package/src/config.js

@@ -0,0 +1,227 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+// 允许用环境变量把配置/凭证放到别处（多环境切换、测试隔离时有用）
+const HOME_DIR = process.env.LINKER_CONFIG_DIR
+  ? path.resolve(process.env.LINKER_CONFIG_DIR)
+  : path.join(os.homedir(), '.linker-cli');
+const CONFIG_PATH = path.join(HOME_DIR, 'config.json');
+const CRED_PATH = path.join(HOME_DIR, 'credentials.json');
+
+const DEFAULTS = {
+  // 平台地址。**不设默认值**：首次登录时由用户在登录页填写，成功后写回此配置。
+  // 需要非交互场景（CI/脚本）时用 LINKER_BASE_URL 或 `config set baseUrl <地址>`。
+  baseUrl: '',
+  // 网关上下文前缀。平台所有接口都在 /index 之下，缺了它会落到前端页面（HTTP 200 但内容是 HTML）
+  apiPrefix: '/index',
+  loginPath: '/index/sys/api/v1/auth/login',
+
+  // 加密方式: rsa | aes | plain | cmd
+  cipher: 'rsa',
+  // rsa 填充: pkcs1 | oaep（前端 JSEncrypt 默认 PKCS#1 v1.5）
+  rsaPadding: 'pkcs1',
+  // RSA 公钥：支持 PEM 或裸 Base64(SPKI DER)。此为平台前端硬编码的公开公钥，非敏感信息。
+  publicKey:
+    'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCO/dd9T3CBFuHphAnPnAF6H4l24txvh20R1hdeMQWLLnOQj/owVFbvmYK2AMn29w1+4QhWgQkX76+uuOg9BSQ+ui9wgZIRAIleqJaUA2oept4KI2fVOHs7tjVIRfWnNJ0HvBxYbp+EPw2D0/QfxcCr15MqqCqf4mk4XMAlVvemIwIDAQAB',
+  // aes 参数（cipher=aes 时）
+  aesMode: 'cbc',
+  aesKey: '',
+  aesIv: '',
+  aesKeyEncoding: 'base64',
+  aesIvEncoding: 'base64',
+  // 外部命令加密（cipher=cmd 时），通过 stdin 收到 JSON，stdout 输出 encodeStr
+  cmdCommand: '',
+
+  // 明文格式: json（默认，对齐前端 JSON.stringify） | template（用下面的模板）
+  plainFormat: 'json',
+  rememberMe: true,
+  // template 模式下的拼接模板，支持 {username} {password}
+  encodeTemplate: '{username}:{password}',
+
+  tokenHeader: 'Authorization',
+  tokenPrefix: '',
+  requestTimeoutMs: 15000,
+  // 本地登录页总等待时长，需小于 WorkBuddy 的 5 分钟
+  authTimeoutMs: 240000
+};
+
+function ensureHomeDir() {
+  if (!fs.existsSync(HOME_DIR)) {
+    fs.mkdirSync(HOME_DIR, { recursive: true, mode: 0o700 });
+  }
+}
+
+function readJson(file, fallback) {
+  try {
+    if (!fs.existsSync(file)) return fallback;
+    const raw = fs.readFileSync(file, 'utf8');
+    if (!raw.trim()) return fallback;
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`无法解析配置文件 ${file}: ${err.message}`);
+  }
+}
+
+// 环境变量 -> 配置项。优先级：环境变量 > 用户配置 > 默认值
+const ENV_MAP = {
+  LINKER_BASE_URL: 'baseUrl',
+  LINKER_API_PREFIX: 'apiPrefix',
+  LINKER_LOGIN_PATH: 'loginPath',
+  LINKER_TOKEN_HEADER: 'tokenHeader',
+  LINKER_TOKEN_PREFIX: 'tokenPrefix',
+  LINKER_PUBLIC_KEY: 'publicKey'
+};
+
+function applyEnv(cfg) {
+  const hit = [];
+  for (const [envKey, cfgKey] of Object.entries(ENV_MAP)) {
+    const v = process.env[envKey];
+    if (v !== undefined && v !== '') {
+      cfg[cfgKey] = v;
+      hit.push(`${envKey}=${cfgKey === 'publicKey' ? '(已设置)' : v}`);
+    }
+  }
+  Object.defineProperty(cfg, '_envApplied', { value: hit, enumerable: false, writable: true });
+  return cfg;
+}
+
+function loadConfig() {
+  const userCfg = readJson(CONFIG_PATH, {});
+  const cfg = Object.assign({}, DEFAULTS, userCfg);
+  applyEnv(cfg);
+
+  // 向后兼容：旧版本内置了默认地址，用户可能只登录过、没写过 config.json。
+  // 这类机器的凭证里记录了签发地址，这里回填一次并落盘，避免升级后被迫重新登录。
+  // 注意只在「配置里根本没有 baseUrl 这个键」时回填 —— 若用户显式写了 baseUrl:""，
+  // 说明是他主动清空的，不能用凭证偷偷补回来。
+  const explicitBaseUrl = Object.prototype.hasOwnProperty.call(userCfg, 'baseUrl');
+  if (!cfg.baseUrl && !explicitBaseUrl && !isBaseUrlFromEnv(cfg)) {
+    const cred = loadCredentials();
+    if (cred && cred.baseUrl) {
+      cfg.baseUrl = cred.baseUrl;
+      try {
+        saveConfig({ baseUrl: cred.baseUrl });
+      } catch {
+        /* 只读环境或权限不足时忽略，本次运行仍用内存值 */
+      }
+    }
+  }
+
+  return cfg;
+}
+
+function saveConfig(patch) {
+  ensureHomeDir();
+  const current = readJson(CONFIG_PATH, {});
+  const next = Object.assign({}, current, patch);
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+  return next;
+}
+
+function loadCredentials() {
+  try {
+    return readJson(CRED_PATH, null);
+  } catch {
+    return null;
+  }
+}
+
+function saveCredentials(cred) {
+  ensureHomeDir();
+  const payload = Object.assign({}, cred, { savedAt: new Date().toISOString() });
+  fs.writeFileSync(CRED_PATH, JSON.stringify(payload, null, 2) + '\n', { mode: 0o600 });
+  try {
+    fs.chmodSync(CRED_PATH, 0o600);
+  } catch {
+    /* Windows 上 chmod 无效，忽略 */
+  }
+  return payload;
+}
+
+function clearCredentials() {
+  try {
+    if (fs.existsSync(CRED_PATH)) fs.unlinkSync(CRED_PATH);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * 凭证是否仍对当前 baseUrl 有效。
+ * 平台地址一换，旧 token 就作废，必须重新登录——否则会拿到 401 却不知道为什么。
+ */
+function credMatchesBaseUrl(cred, cfg) {
+  if (!cred || !cred.tokenValue) return false;
+  if (!cred.baseUrl) return true; // 老版本凭证没记地址，不阻断
+  return String(cred.baseUrl).replace(/\/+$/, '') === String(cfg.baseUrl || '').replace(/\/+$/, '');
+}
+
+/**
+ * 规范化用户输入的平台地址。
+ *
+ * 用户可能填的形态（都应当能用）：
+ *   http://10.0.0.10:8082
+ *   10.0.0.10:8082                       → 补 http://
+ *   http://10.0.0.10:8082/               → 去尾斜杠
+ *   http://10.0.0.10:8082/index/sys/...  → 剥掉网关前缀与后续路径
+ *   https://platform.example.com         → 保留 https
+ *
+ * baseUrl 只承载「协议 + 主机 + 端口 + 可选子路径」，网关前缀由 apiPrefix 单独表达，
+ * 因此这里要把用户从浏览器地址栏复制来的 /index/... 尾巴剥掉，否则会拼出双前缀。
+ *
+ * @returns {{ok: boolean, value: string, reason: string}}
+ *   reason: '' | 'empty' | 'invalid' | 'protocol'
+ */
+function normalizeBaseUrl(raw) {
+  let s = String(raw == null ? '' : raw).trim();
+  if (!s) return { ok: false, value: '', reason: 'empty' };
+
+  // 未写协议时默认 http（内网平台绝大多数是 http）。
+  // 注意：不能先去掉末尾斜杠再补协议，否则 "http://" 会被削成 "http:" 再被补成 "http://http:"。
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) s = 'http://' + s;
+
+  let u;
+  try {
+    u = new URL(s);
+  } catch {
+    return { ok: false, value: '', reason: 'invalid' };
+  }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+    return { ok: false, value: '', reason: 'protocol' };
+  }
+  if (!u.hostname) return { ok: false, value: '', reason: 'invalid' };
+
+  // 剥掉尾部斜杠与 /index 及其后续（用户从登录页地址栏复制很容易带上）
+  let pathname = u.pathname.replace(/\/+$/, '');
+  pathname = pathname.replace(/\/index(\/.*)?$/i, '');
+  pathname = pathname.replace(/\/+$/, '');
+
+  // query / hash 不属于 baseUrl，丢弃
+  return { ok: true, value: u.origin + pathname, reason: '' };
+}
+
+/** baseUrl 是否被环境变量锁定（锁定时登录页不允许改，因为改了下次也不生效） */
+function isBaseUrlFromEnv(cfg) {
+  const hit = (cfg && cfg._envApplied) || [];
+  return hit.some((item) => String(item).startsWith('LINKER_BASE_URL='));
+}
+
+module.exports = {
+  HOME_DIR,
+  CONFIG_PATH,
+  CRED_PATH,
+  DEFAULTS,
+  ENV_MAP,
+  loadConfig,
+  saveConfig,
+  loadCredentials,
+  saveCredentials,
+  clearCredentials,
+  credMatchesBaseUrl,
+  normalizeBaseUrl,
+  isBaseUrlFromEnv
+};

package/src/crypto.js

@@ -0,0 +1,175 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+
+function renderTemplate(tpl, vars) {
+  return String(tpl).replace(/\{(username|password)\}/g, (_, key) => {
+    const v = vars[key];
+    if (v === undefined || v === null) return '';
+    return String(v);
+  });
+}
+
+function decodeByEncoding(value, encoding) {
+  const enc = String(encoding || 'base64').toLowerCase();
+  if (enc === 'base64') return Buffer.from(value, 'base64');
+  if (enc === 'hex') return Buffer.from(value, 'hex');
+  return Buffer.from(value, 'utf8');
+}
+
+function toKeyObject(publicKey) {
+  const raw = String(publicKey || '').trim();
+  if (!raw) {
+    throw new Error('未配置 RSA 公钥。请执行: wb config set publicKey "<公钥>"');
+  }
+  if (raw.includes('BEGIN PUBLIC KEY')) {
+    return crypto.createPublicKey(raw);
+  }
+  // 前端常把公钥写成裸 Base64（SPKI DER），这里直接按 DER 解析
+  const der = Buffer.from(raw.replace(/\s+/g, ''), 'base64');
+  return crypto.createPublicKey({ key: der, format: 'der', type: 'spki' });
+}
+
+function rsaEncrypt(plain, publicKeyPem, padding) {
+  const keyObject = toKeyObject(publicKeyPem);
+
+  const pad =
+    String(padding || 'pkcs1').toLowerCase() === 'oaep'
+      ? crypto.constants.RSA_PKCS1_OAEP_PADDING
+      : crypto.constants.RSA_PKCS1_PADDING;
+
+  const data = Buffer.from(plain, 'utf8');
+  const modulusBits = (keyObject.asymmetricKeyDetails && keyObject.asymmetricKeyDetails.modulusLength) || 1024;
+  const padLen = pad === crypto.constants.RSA_PKCS1_OAEP_PADDING ? 2 * 20 + 2 : 11;
+  const maxBytes = Math.floor(modulusBits / 8) - padLen;
+
+  if (data.length > maxBytes) {
+    throw new Error(
+      `待加密明文 ${data.length} 字节，超出当前密钥上限 ${maxBytes} 字节。请缩短明文或更换更长密钥。`
+    );
+  }
+
+  const out = crypto.publicEncrypt({ key: keyObject, padding: pad }, data);
+  return out.toString('base64');
+}
+
+function aesEncrypt(plain, cfg) {
+  const key = decodeByEncoding(cfg.aesKey, cfg.aesKeyEncoding);
+  if (![16, 24, 32].includes(key.length)) {
+    throw new Error(`AES 密钥长度非法: ${key.length} 字节，应为 16/24/32`);
+  }
+  const mode = String(cfg.aesMode || 'cbc').toLowerCase();
+
+  if (mode === 'ecb') {
+    const cipher = crypto.createCipheriv(`aes-${key.length * 8}-ecb`, key, null);
+    cipher.setAutoPadding(true);
+    return Buffer.concat([cipher.update(Buffer.from(plain, 'utf8')), cipher.final()]).toString('base64');
+  }
+
+  const iv = decodeByEncoding(cfg.aesIv, cfg.aesIvEncoding);
+  if (iv.length !== 16) {
+    throw new Error(`AES IV 长度非法: ${iv.length} 字节，应为 16`);
+  }
+  const cipher = crypto.createCipheriv(`aes-${key.length * 8}-cbc`, key, iv);
+  cipher.setAutoPadding(true);
+  return Buffer.concat([cipher.update(Buffer.from(plain, 'utf8')), cipher.final()]).toString('base64');
+}
+
+function cmdEncrypt(plain, cfg, vars) {
+  if (!cfg.cmdCommand) {
+    throw new Error('cipher=cmd 但未配置 cmdCommand');
+  }
+  const payload = JSON.stringify({ plain, username: vars.username, password: vars.password });
+  const out = execFileSync('/bin/sh', ['-c', cfg.cmdCommand], {
+    input: payload,
+    encoding: 'utf8',
+    timeout: 15000
+  });
+  const trimmed = String(out).trim();
+  if (!trimmed) throw new Error('外部加密命令未返回内容');
+  return trimmed;
+}
+
+/**
+ * 生成待加密明文。
+ * json 模式严格对齐前端: JSON.stringify({username, password, rememberMe})
+ * 注意字段顺序与 rememberMe 的布尔类型必须保持一致，否则服务端校验会失败。
+ */
+function buildPlain(vars, cfg) {
+  const fmt = String(cfg.plainFormat || 'json').toLowerCase();
+  if (fmt === 'template') {
+    return renderTemplate(cfg.encodeTemplate, vars);
+  }
+  return JSON.stringify({
+    username: vars.username,
+    password: vars.password,
+    rememberMe: cfg.rememberMe !== false
+  });
+}
+
+/**
+ * 根据配置生成登录接口所需的 encodeStr
+ * @param {{username:string, password:string}} vars
+ * @param {object} cfg
+ */
+function buildEncodeStr(vars, cfg) {
+  const plain = buildPlain(vars, cfg);
+  const cipher = String(cfg.cipher || 'rsa').toLowerCase();
+
+  if (cipher === 'plain') return plain;
+  if (cipher === 'rsa') return rsaEncrypt(plain, cfg.publicKey, cfg.rsaPadding);
+  if (cipher === 'aes') return aesEncrypt(plain, cfg);
+  if (cipher === 'cmd') return cmdEncrypt(plain, cfg, vars);
+  throw new Error(`不支持的 cipher: ${cfg.cipher}`);
+}
+
+function describeCipher(cfg) {
+  const cipher = String(cfg.cipher || 'rsa').toLowerCase();
+  const lines = [];
+  lines.push('cipher          = ' + cipher);
+  if (cipher === 'rsa') {
+    lines.push('rsaPadding      = ' + cfg.rsaPadding);
+    const hasKey = Boolean(cfg.publicKey);
+    lines.push('publicKey       = ' + (hasKey ? '已配置' : '未配置'));
+    if (hasKey) {
+      try {
+        const keyObject = toKeyObject(cfg.publicKey);
+        const det = keyObject.asymmetricKeyDetails || {};
+        lines.push('modulusLength   = ' + det.modulusLength + ' bit');
+        lines.push('publicExponent  = ' + String(det.publicExponent));
+        const maxBytes = Math.floor((det.modulusLength || 1024) / 8) - 11;
+        lines.push('明文上限        = ' + maxBytes + ' 字节（PKCS#1 v1.5）');
+      } catch (e) {
+        lines.push('公钥解析        = 失败: ' + e.message);
+      }
+    }
+  }
+  if (cipher === 'aes') {
+    lines.push('aesMode         = ' + cfg.aesMode);
+    lines.push('aesKey          = ' + (cfg.aesKey ? '已配置' : '未配置'));
+    lines.push('aesIv           = ' + (cfg.aesIv ? '已配置' : '未配置'));
+  }
+  if (cipher === 'cmd') {
+    lines.push('cmdCommand      = ' + (cfg.cmdCommand || '未配置'));
+  }
+  lines.push('plainFormat     = ' + (cfg.plainFormat || 'json'));
+  if (String(cfg.plainFormat || 'json').toLowerCase() === 'template') {
+    lines.push('encodeTemplate  = ' + cfg.encodeTemplate);
+  }
+  lines.push('');
+  const sample = buildPlain({ username: 'admin', password: '******' }, cfg);
+  lines.push('待加密明文样例  = ' + sample);
+  lines.push('样例字节数      = ' + Buffer.byteLength(sample, 'utf8'));
+  return lines.join('\n');
+}
+
+module.exports = {
+  renderTemplate,
+  toKeyObject,
+  rsaEncrypt,
+  aesEncrypt,
+  buildPlain,
+  buildEncodeStr,
+  describeCipher
+};

package/src/login-page.js

@@ -0,0 +1,175 @@
+'use strict';
+
+/**
+ * 本地登录页 HTML。
+ * 表单通过同源 POST /login 提交，由 CLI 进程内部持有账号密码并调用原系统登录接口，
+ * 密码不落盘、不写日志，仅在内存中用于生成 encodeStr。
+ *
+ * 平台地址可在此页直接修改：用户从浏览器地址栏复制的地址往往带 /index/... 尾巴，
+ * 服务端会调用 normalizeBaseUrl 规范化，成功后写回配置。
+ */
+function renderLoginPage(opts) {
+  const o = opts || {};
+  const baseUrl = o.baseUrl ? String(o.baseUrl) : '';
+  const loginSuffix = o.loginSuffix ? String(o.loginSuffix) : '';
+  const editable = o.editable !== false;
+  const lockedReason = o.lockedReason ? String(o.lockedReason) : '';
+  const error = o.error ? String(o.error) : '';
+
+  return `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>登录 幂链iPaaS集成管理平台</title>
+<style>
+  :root { color-scheme: light; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Microsoft YaHei", sans-serif;
+    background: #f5f6f8; color: #1f2328;
+  }
+  .card {
+    width: 380px; background: #fff; border: 1px solid #e3e5e8; border-radius: 12px;
+    padding: 28px 26px 24px; box-shadow: 0 1px 2px rgba(0,0,0,.04);
+  }
+  h1 { margin: 0 0 4px; font-size: 18px; font-weight: 500; }
+  .sub { margin: 0 0 20px; font-size: 12px; color: #6b7280; word-break: break-all; }
+  label { display: block; font-size: 12px; color: #4b5563; margin: 0 0 6px; }
+  input {
+    width: 100%; height: 38px; padding: 0 10px; margin-bottom: 6px;
+    border: 1px solid #d6d9dd; border-radius: 8px; font-size: 14px; outline: none;
+  }
+  input:focus { border-color: #185FA5; }
+  input[readonly] { background: #f7f8f9; color: #6b7280; }
+  .field { margin-bottom: 14px; }
+  .field-hint { font-size: 11px; color: #9ca3af; line-height: 1.5; word-break: break-all; }
+  .field-hint.warn { color: #854F0B; }
+  button {
+    width: 100%; height: 40px; margin-top: 4px; border: 0; border-radius: 8px;
+    background: #185FA5; color: #fff; font-size: 14px; cursor: pointer;
+  }
+  button:disabled { opacity: .6; cursor: default; }
+  .msg { margin-top: 14px; font-size: 13px; min-height: 18px; }
+  .msg.err { color: #A32D2D; }
+  .msg.ok { color: #0F6E56; }
+  .hint { margin-top: 18px; font-size: 11px; color: #9ca3af; line-height: 1.6; }
+  .done { text-align: center; padding: 12px 0 4px; }
+  .done .check {
+    width: 40px; height: 40px; margin: 0 auto 14px; border-radius: 50%;
+    background: #E1F5EE; color: #0F6E56; font-size: 22px; line-height: 40px;
+  }
+</style>
+</head>
+<body>
+<div class="card" id="card">
+  <h1>登录 幂链iPaaS集成管理平台</h1>
+  <p class="sub">${baseUrl ? escapeHtml(baseUrl) : '首次使用，请填写平台地址'}</p>
+  <form id="form" autocomplete="on">
+    <div class="field">
+      <label for="b">平台地址</label>
+      <input id="b" name="baseUrl" value="${escapeHtml(baseUrl)}" placeholder="http://主机:端口" ${editable ? 'autofocus' : 'readonly'} spellcheck="false">
+      <div class="field-hint${editable ? '' : ' warn'}" id="hint">${
+        editable
+          ? '填到端口即可，形如 http://主机:端口'
+          : escapeHtml(lockedReason || '当前地址由环境变量指定，不可在此修改')
+      }</div>
+    </div>
+    <div class="field">
+      <label for="u">用户名</label>
+      <input id="u" name="username" autocomplete="username" required ${editable ? '' : 'autofocus'}>
+    </div>
+    <div class="field">
+      <label for="p">密码</label>
+      <input id="p" name="password" type="password" autocomplete="current-password" required>
+    </div>
+    <button type="submit" id="btn">登录</button>
+  </form>
+  <div class="msg err" id="msg">${escapeHtml(error)}</div>
+  <div class="hint">凭据仅用于本次登录，不会写入日志或本地文件。登录成功后可直接关闭本页面。</div>
+</div>
+<script>
+  var SUFFIX = ${JSON.stringify(loginSuffix)};
+  var form = document.getElementById('form');
+  var btn = document.getElementById('btn');
+  var msg = document.getElementById('msg');
+  var baseInput = document.getElementById('b');
+  var hint = document.getElementById('hint');
+  var EDITABLE = ${editable ? 'true' : 'false'};
+  var DEFAULT_HINT = hint.textContent;
+
+  function composeLoginUrl() {
+    var b = (baseInput.value || '').trim().replace(/\\/+$/, '');
+    if (!b) return '';
+    if (!/^https?:\\/\\//i.test(b)) b = 'http://' + b;
+    return b + SUFFIX;
+  }
+
+  function refreshHint() {
+    if (!EDITABLE) return;
+    var preview = composeLoginUrl();
+    hint.textContent = preview ? '将请求：' + preview : DEFAULT_HINT;
+  }
+
+  baseInput.addEventListener('input', refreshHint);
+  refreshHint();
+
+  form.addEventListener('submit', function (e) {
+    e.preventDefault();
+    msg.className = 'msg';
+    msg.textContent = '正在登录…';
+    btn.disabled = true;
+
+    fetch('/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        username: document.getElementById('u').value,
+        password: document.getElementById('p').value,
+        baseUrl: EDITABLE ? baseInput.value : ''
+      })
+    }).then(function (r) {
+      return r.json().then(function (j) { return { ok: r.ok, body: j }; });
+    }).then(function (res) {
+      if (res.ok && res.body && res.body.ok) {
+        document.getElementById('card').innerHTML =
+          '<div class="done"><div class="check">✓</div>' +
+          '<h1>登录成功</h1>' +
+          '<p class="sub">' + (res.body.nickName || '') + '</p>' +
+          '<p class="sub">' + (res.body.baseUrl || '') + '</p>' +
+          '<div class="hint">授权信息已写入本地，可以关闭此页面返回 WorkBuddy。</div></div>';
+        setTimeout(function () { window.close(); }, 1200);
+      } else {
+        msg.className = 'msg err';
+        msg.textContent = (res.body && res.body.message) || '登录失败';
+        btn.disabled = false;
+      }
+    }).catch(function (err) {
+      msg.className = 'msg err';
+      msg.textContent = '请求失败：' + err.message;
+      btn.disabled = false;
+    });
+  });
+</script>
+</body>
+</html>`;
+}
+
+function renderDonePage(nickName) {
+  return `<!DOCTYPE html>
+<html lang="zh-CN"><head><meta charset="utf-8"><title>登录成功</title>
+<style>body{font-family:-apple-system,"PingFang SC",sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#f5f6f8;color:#1f2328}
+.b{text-align:center}.t{font-size:18px;margin:12px 0 4px}.s{font-size:13px;color:#6b7280}</style></head>
+<body><div class="b"><div style="font-size:36px;color:#0F6E56">✓</div>
+<div class="t">登录成功</div><div class="s">${escapeHtml(nickName || '')}</div>
+<div class="s" style="margin-top:10px">可以关闭此页面返回 WorkBuddy</div></div></body></html>`;
+}
+
+function escapeHtml(str) {
+  return String(str == null ? '' : str).replace(/[&<>"']/g, (ch) => {
+    return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch];
+  });
+}
+
+module.exports = { renderLoginPage, renderDonePage, escapeHtml };