@morehao/ark-iam-react 0.0.0-stage → 1.0.0

package/dist/_types/auth/index.js

@@ -0,0 +1,190 @@
+var _a;
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useState, useEffect, useCallback } from "react";
+import { BrowserRouter } from "react-router-dom";
+import { AuthProvider, useAuth } from "react-oidc-context";
+import { WebStorageStateStore } from "oidc-client-ts";
+import { message, Spin } from "antd";
+import { useSSOSessionProbe, setUserProvider, setSessionExpiredHandler, logoutAllAPI, getMyTenants } from "@ark-iam/api";
+const defaultIssuer = "/oidc";
+const defaultRedirectPath = "/auth/callback";
+const defaultPostLogoutRedirectPath = "/login";
+const defaultScope = "openid profile email offline_access";
+async function fetchRuntimeConfig(base) {
+  var _a2, _b;
+  const root = base ?? (((_b = (_a2 = import.meta) == null ? void 0 : _a2.env) == null ? void 0 : _b.BASE_URL) ?? "/");
+  try {
+    const res = await fetch(`${root}${root.endsWith("/") ? "" : "/"}config.json`, {
+      credentials: "same-origin",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+const oidcExtraQueryParams = {};
+let currentTenantId = "";
+function getCurrentTenantId() {
+  return currentTenantId;
+}
+function setCurrentTenantId(id) {
+  const next = id == null ? "" : String(id);
+  currentTenantId = next;
+  if (next) {
+    oidcExtraQueryParams.tenant = next;
+  } else {
+    delete oidcExtraQueryParams.tenant;
+  }
+}
+const ENV = ((_a = import.meta) == null ? void 0 : _a.env) ?? {};
+function buildConfig(opts, runtime) {
+  const issuer = opts.issuer || (runtime == null ? void 0 : runtime.issuer) || ENV.VITE_OIDC_ISSUER || defaultIssuer;
+  const clientId = opts.clientID || (runtime == null ? void 0 : runtime.clientId) || ENV.VITE_OIDC_CLIENT_ID || "";
+  const redirectPath = opts.redirectPath || (runtime == null ? void 0 : runtime.callbackPath) || defaultRedirectPath;
+  const postLogoutRedirectPath = opts.postLogoutRedirectPath || defaultPostLogoutRedirectPath;
+  return { issuer, clientId, redirectPath, postLogoutRedirectPath };
+}
+function createAuthProvider(opts = {}) {
+  return function AuthProvider$1({ children }) {
+    const useRuntime = opts.useRuntimeConfig !== false;
+    const [runtime, setRuntime] = useState(
+      useRuntime ? void 0 : null
+    );
+    useEffect(() => {
+      if (!useRuntime) return;
+      let cancelled = false;
+      void fetchRuntimeConfig(opts.runtimeConfigBase).then((cfg) => {
+        if (!cancelled) setRuntime(cfg);
+      });
+      return () => {
+        cancelled = true;
+      };
+    }, []);
+    if (runtime === void 0) return null;
+    const { issuer, clientId, redirectPath, postLogoutRedirectPath } = buildConfig(opts, runtime);
+    const oidcConfig = {
+      authority: issuer,
+      client_id: clientId,
+      ...opts.clientSecret ? { client_secret: opts.clientSecret } : {},
+      redirect_uri: window.location.origin + redirectPath,
+      post_logout_redirect_uri: window.location.origin + postLogoutRedirectPath,
+      scope: defaultScope,
+      automaticSilentRenew: true,
+      // monitorSession 需要 OP 在 discovery 暴露 check_session_iframe（OIDC Session
+      // Management）。当前 OP（zitadel）未启用该端点，oidc-client-ts 会自动降级为不监控。
+      // "一处登出、处处登出"的即时性主要由后端请求粒度 SSO 活性校验保障
+      // （WithOIDCSSOValidation + HasActiveSession），此配置仅作跨标签页监控的尽力而为。
+      monitorSession: true,
+      loadUserInfo: true,
+      // 令牌存储：使用 sessionStorage（标签页级，关闭即清）而非 localStorage，
+      // 缩小 XSS 窃取令牌的持续暴露窗口。SSO 认证态本身在 OP 的 iam_sso_session
+      // cookie，不依赖前端存储；页面刷新/静默续期不受影响。
+      userStore: new WebStorageStateStore({ store: sessionStorage }),
+      extraQueryParams: {
+        ...oidcExtraQueryParams,
+        ...opts.getExtraQueryParams ? opts.getExtraQueryParams() : {}
+      }
+    };
+    return /* @__PURE__ */ jsx(BrowserRouter, { children: /* @__PURE__ */ jsx(AuthProvider, { ...oidcConfig, children }) });
+  };
+}
+function useTenantSwitching() {
+  const auth = useAuth();
+  const [tenants, setTenants] = useState([]);
+  const loadTenants = useCallback(async () => {
+    try {
+      const resp = await getMyTenants();
+      setTenants(resp.list || []);
+    } catch {
+      message.warning("获取可用租户失败");
+    }
+  }, []);
+  const handleSwitchTenant = useCallback(
+    async (tenantID) => {
+      if (String(tenantID) === getCurrentTenantId()) return;
+      setCurrentTenantId(tenantID);
+      try {
+        await auth.removeUser();
+      } catch {
+      }
+      await auth.signinRedirect({ extraQueryParams: { tenant: String(tenantID) }, redirectMethod: "replace" });
+    },
+    [auth]
+  );
+  return { tenants, loadTenants, handleSwitchTenant };
+}
+function useLogout() {
+  const auth = useAuth();
+  return useCallback(async () => {
+    var _a2;
+    try {
+      await logoutAllAPI(((_a2 = auth.user) == null ? void 0 : _a2.refresh_token) ?? "");
+    } catch {
+    }
+    try {
+      await auth.signoutRedirect();
+    } finally {
+      await auth.removeUser();
+    }
+  }, [auth]);
+}
+function useAuthGuard() {
+  const auth = useAuth();
+  useSSOSessionProbe(auth);
+  useEffect(() => {
+    setUserProvider(() => auth.user);
+  }, [auth.user]);
+  useEffect(() => {
+    setSessionExpiredHandler(() => {
+      void auth.removeUser();
+    });
+  }, [auth]);
+  useEffect(() => {
+    var _a2, _b;
+    const claim = (_b = (_a2 = auth.user) == null ? void 0 : _a2.profile) == null ? void 0 : _b.tenant_id;
+    if (claim != null && getCurrentTenantId() !== String(claim)) {
+      setCurrentTenantId(claim);
+    }
+  }, [auth.user]);
+  return auth;
+}
+const LOADING_BG = "#f6f7f9";
+const LOADING_TEXT = "#94a3b8";
+function FullPageSpinner() {
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      style: {
+        minHeight: "100vh",
+        display: "flex",
+        flexDirection: "column",
+        alignItems: "center",
+        justifyContent: "center",
+        gap: 16,
+        background: LOADING_BG
+      },
+      children: [
+        /* @__PURE__ */ jsx(Spin, { size: "large" }),
+        /* @__PURE__ */ jsx("span", { style: { color: LOADING_TEXT, fontSize: 13 }, children: "正在加载 IAM 平台…" })
+      ]
+    }
+  );
+}
+export {
+  FullPageSpinner,
+  createAuthProvider,
+  defaultIssuer,
+  defaultPostLogoutRedirectPath,
+  defaultRedirectPath,
+  defaultScope,
+  fetchRuntimeConfig,
+  getCurrentTenantId,
+  oidcExtraQueryParams,
+  setCurrentTenantId,
+  useAuthGuard,
+  useLogout,
+  useTenantSwitching
+};
+//# sourceMappingURL=index.js.map

package/dist/_types/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/config.ts","../src/tenant.ts","../src/AuthProvider.tsx","../src/hooks.ts","../src/guards.tsx"],"sourcesContent":["// OIDC 客户端共享配置。\n//\n// 集中 OIDC 相关默认值，供 AuthProvider 与各业务 App（main.tsx）复用，\n// 避免 issuer / 默认路径等在多个文件间漂移。\n//\n// 配置优先级（越靠前越优先）：\n//   1. createAuthProvider(opts) 显式传入的 props（issuer / clientId / redirectPath ...）\n//   2. /config.json 运行时配置（createAuthProvider 启动先 fetch，见 fetchRuntimeConfig）\n//   3. import.meta.env.VITE_* 构建期常量（仅仓内 / 自托管构建期的便捷覆盖）\n//   4. 下方相对默认值（开发环境经 Vite 代理到后端）\n//\n// 外部接入方通常无需设任何 VITE_*：只需提供 clientID，或让后端 /config.json 下发。\n\n// defaultIssuer 是开发环境的默认 issuer（相对路径，经 Vite 代理到后端）。\nexport const defaultIssuer = '/oidc'\n\n// defaultRedirectPath 是 OIDC 授权回调路径（拼接在 window.location.origin 后）。\nexport const defaultRedirectPath = '/auth/callback'\n\n// defaultPostLogoutRedirectPath 是登出后回跳路径。\nexport const defaultPostLogoutRedirectPath = '/login'\n\n// defaultScope 是申请的标准 OIDC scope；offline_access 用于签发 refresh token。\nexport const defaultScope = 'openid profile email offline_access'\n\n/**\n * RuntimeConfig 是后端 /config.json 下发的运行时配置（见 backend/iam/app_frontend.go）。\n * 字段全部可选：缺失时逐字段回退到 VITE_* / 相对默认值。\n */\nexport interface RuntimeConfig {\n  issuer?: string\n  apiBase?: string\n  oidcBase?: string\n  callbackPath?: string\n  clientId?: string\n}\n\n/**\n * fetchRuntimeConfig 从 `{base}/config.json` 拉取运行时配置。\n *\n * - base 默认取 `import.meta.env.BASE_URL`（Vite 注入；自托管常为 '/'），保证子路径部署也能命中。\n * - 任一环节失败（网络、非 2xx、非 JSON）都 resolve 为 null，由调用方回退默认值，绝不 reject，\n *   避免因配置端点不可用而阻断整个应用启动。\n */\nexport async function fetchRuntimeConfig(base?: string): Promise<RuntimeConfig | null> {\n  // import.meta.env.BASE_URL 在 Vite 下恒为 '/'（或显式 base），保证末尾带 '/'。\n  const root: string = base ?? ((import.meta as any)?.env?.BASE_URL ?? '/')\n  try {\n    const res = await fetch(`${root}${root.endsWith('/') ? '' : '/'}config.json`, {\n      credentials: 'same-origin',\n      headers: { Accept: 'application/json' },\n    })\n    if (!res.ok) return null\n    return (await res.json()) as RuntimeConfig\n  } catch {\n    return null\n  }\n}\n","export const oidcExtraQueryParams: Record<string, string | number | boolean> = {}\n\nlet currentTenantId = ''\n\nexport function getCurrentTenantId(): string {\n  return currentTenantId\n}\n\nexport function setCurrentTenantId(id: string | number | undefined) {\n  const next = id == null ? '' : String(id)\n  currentTenantId = next\n  if (next) {\n    oidcExtraQueryParams.tenant = next\n  } else {\n    delete oidcExtraQueryParams.tenant\n  }\n}\n","import React, { useEffect, useState } from 'react'\nimport { BrowserRouter } from 'react-router-dom'\nimport { AuthProvider as OidcAuthProvider } from 'react-oidc-context'\nimport { WebStorageStateStore } from 'oidc-client-ts'\nimport {\n  defaultIssuer,\n  defaultRedirectPath,\n  defaultPostLogoutRedirectPath,\n  defaultScope,\n  fetchRuntimeConfig,\n  type RuntimeConfig,\n} from './config'\nimport { oidcExtraQueryParams } from './tenant'\n\nexport interface CreateAuthProviderOptions {\n  /**\n   * OIDC client_id（控制台应用的 application_client.code）。\n   * 未传时优先用 /config.json 的 clientId，再退回 import.meta.env.VITE_OIDC_CLIENT_ID。\n   */\n  clientID?: string\n  clientSecret?: string\n  /**\n   * OIDC issuer（OP 地址）。未传时优先级：/config.json.issuer > VITE_OIDC_ISSUER > '/oidc'。\n   * 多源部署时可显式传 OP 的绝对地址（如 https://iam.example.com/oidc）。\n   */\n  issuer?: string\n  redirectPath?: string\n  postLogoutRedirectPath?: string\n  getExtraQueryParams?: () => Record<string, string | number | boolean>\n  /**\n   * 是否在启动时拉取 `{base}/config.json` 作为运行时配置来源（默认 true）。\n   * 置 false 则完全走 props / VITE_* / 默认值，适用于无 IAM 托管 / 无 config.json 的场景。\n   */\n  useRuntimeConfig?: boolean\n  /** config.json 的拉取基址；默认 import.meta.env.BASE_URL。 */\n  runtimeConfigBase?: string\n}\n\nconst ENV = (import.meta as any)?.env ?? {}\n\n// buildConfig 把「props > /config.json > VITE_* > 相对默认值」的优先级收敛为一层。\nfunction buildConfig(opts: CreateAuthProviderOptions, runtime: RuntimeConfig | null) {\n  const issuer = opts.issuer || runtime?.issuer || ENV.VITE_OIDC_ISSUER || defaultIssuer\n  const clientId =\n    opts.clientID || runtime?.clientId || ENV.VITE_OIDC_CLIENT_ID || ''\n  const redirectPath = opts.redirectPath || runtime?.callbackPath || defaultRedirectPath\n  const postLogoutRedirectPath = opts.postLogoutRedirectPath || defaultPostLogoutRedirectPath\n  return { issuer, clientId, redirectPath, postLogoutRedirectPath }\n}\n\nexport function createAuthProvider(opts: CreateAuthProviderOptions = {}) {\n  return function AuthProvider({ children }: { children: React.ReactNode }) {\n    const useRuntime = opts.useRuntimeConfig !== false\n    // runtime 为 undefined 表示「尚未就绪」（加载中）；null 表示「已尝试但不可用」，走回退。\n    const [runtime, setRuntime] = useState<RuntimeConfig | null | undefined>(\n      useRuntime ? undefined : null,\n    )\n\n    useEffect(() => {\n      if (!useRuntime) return\n      let cancelled = false\n      void fetchRuntimeConfig(opts.runtimeConfigBase).then((cfg) => {\n        if (!cancelled) setRuntime(cfg)\n      })\n      return () => {\n        cancelled = true\n      }\n      // 仅挂载时拉取一次：运行时配置在应用生命周期内不变。\n      // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [])\n\n    // 加载中：先渲染 children 会拿到未就绪配置（issuer/clientId 可能为默认值），\n    // 故等待 config.json 拉取完成（成功或失败都落定）再接 AuthProvider，避免一次错误的授权跳转。\n    if (runtime === undefined) return null\n\n    const { issuer, clientId, redirectPath, postLogoutRedirectPath } = buildConfig(opts, runtime)\n\n    const oidcConfig = {\n      authority: issuer,\n      client_id: clientId,\n      ...(opts.clientSecret ? { client_secret: opts.clientSecret } : {}),\n      redirect_uri: window.location.origin + redirectPath,\n      post_logout_redirect_uri: window.location.origin + postLogoutRedirectPath,\n      scope: defaultScope,\n      automaticSilentRenew: true,\n      // monitorSession 需要 OP 在 discovery 暴露 check_session_iframe（OIDC Session\n      // Management）。当前 OP（zitadel）未启用该端点，oidc-client-ts 会自动降级为不监控。\n      // \"一处登出、处处登出\"的即时性主要由后端请求粒度 SSO 活性校验保障\n      // （WithOIDCSSOValidation + HasActiveSession），此配置仅作跨标签页监控的尽力而为。\n      monitorSession: true,\n      loadUserInfo: true,\n      // 令牌存储：使用 sessionStorage（标签页级，关闭即清）而非 localStorage，\n      // 缩小 XSS 窃取令牌的持续暴露窗口。SSO 认证态本身在 OP 的 iam_sso_session\n      // cookie，不依赖前端存储；页面刷新/静默续期不受影响。\n      userStore: new WebStorageStateStore({ store: sessionStorage }),\n      extraQueryParams: {\n        ...oidcExtraQueryParams,\n        ...(opts.getExtraQueryParams ? opts.getExtraQueryParams() : {}),\n      },\n    }\n\n    return (\n      <BrowserRouter>\n        <OidcAuthProvider {...oidcConfig}>{children}</OidcAuthProvider>\n      </BrowserRouter>\n    )\n  }\n}\n","import { useCallback, useEffect, useState } from 'react'\nimport { useAuth } from 'react-oidc-context'\nimport { message } from 'antd'\nimport {\n  getMyTenants,\n  logoutAllAPI,\n  setUserProvider,\n  setSessionExpiredHandler,\n  useSSOSessionProbe,\n} from '@ark-iam/api'\nimport { getCurrentTenantId, setCurrentTenantId } from './tenant'\n\nexport interface TenantSwitchInfo {\n  tenants: { tenantID: string; name: string }[]\n  loadTenants: () => Promise<void>\n  handleSwitchTenant: (tenantID: string) => Promise<void>\n}\n\nexport function useTenantSwitching(): TenantSwitchInfo {\n  const auth = useAuth()\n  const [tenants, setTenants] = useState<{ tenantID: string; name: string }[]>([])\n\n  const loadTenants = useCallback(async () => {\n    try {\n      const resp = await getMyTenants()\n      setTenants(resp.list || [])\n    } catch {\n      message.warning('获取可用租户失败')\n    }\n  }, [])\n\n  const handleSwitchTenant = useCallback(\n    async (tenantID: string) => {\n      if (String(tenantID) === getCurrentTenantId()) return\n      setCurrentTenantId(tenantID)\n      try {\n        await auth.removeUser()\n      } catch {\n        // 本地清理失败不阻断重授权\n      }\n      await auth.signinRedirect({ extraQueryParams: { tenant: String(tenantID) }, redirectMethod: 'replace' })\n    },\n    [auth],\n  )\n\n  return { tenants, loadTenants, handleSwitchTenant }\n}\n\nexport function useLogout() {\n  const auth = useAuth()\n  return useCallback(async () => {\n    try {\n      await logoutAllAPI(auth.user?.refresh_token ?? '')\n    } catch {\n      // ignore：撤销自有 refresh token 为尽力而为，失败不阻断登出\n    }\n    // 先 signoutRedirect 再 removeUser，保证 id_token_hint 仍存在以撤销后端 SSO session\n    try {\n      await auth.signoutRedirect()\n    } finally {\n      await auth.removeUser()\n    }\n  }, [auth])\n}\n\nexport function useAuthGuard() {\n  const auth = useAuth()\n\n  useSSOSessionProbe(auth)\n\n  useEffect(() => {\n    setUserProvider(() => auth.user)\n  }, [auth.user])\n\n  // 401（SSO 会话已被其它端点全局登出撤销）时，先移除本地 user 再跳转登录，\n  // 避免 \"401 → 刷新 → sessionStorage 残留 user → 再 401\" 的死循环。\n  useEffect(() => {\n    setSessionExpiredHandler(() => {\n      void auth.removeUser()\n    })\n  }, [auth])\n\n  useEffect(() => {\n    const claim = (auth.user?.profile as Record<string, unknown> | undefined)?.tenant_id\n    if (claim != null && getCurrentTenantId() !== String(claim)) {\n      setCurrentTenantId(claim as string | number)\n    }\n  }, [auth.user])\n\n  return auth\n}\n","import { Spin } from 'antd'\n\n// 注：auth 包处于 ui 下层（ui → auth 依赖方向），无法引用 @ark-iam/ui tokens，\n// 这里的中性色与 DESIGN.md「冷白工程台」灰阶保持一致，改动需手动同步。\nconst LOADING_BG = '#f6f7f9'\nconst LOADING_TEXT = '#94a3b8'\n\nexport function FullPageSpinner() {\n  return (\n    <div\n      style={{\n        minHeight: '100vh',\n        display: 'flex',\n        flexDirection: 'column',\n        alignItems: 'center',\n        justifyContent: 'center',\n        gap: 16,\n        background: LOADING_BG,\n      }}\n    >\n      <Spin size=\"large\" />\n      <span style={{ color: LOADING_TEXT, fontSize: 13 }}>正在加载 IAM 平台…</span>\n    </div>\n  )\n}\n"],"names":["_a","AuthProvider","OidcAuthProvider"],"mappings":";;;;;;;;AAcO,MAAM,gBAAgB;AAGtB,MAAM,sBAAsB;AAG5B,MAAM,gCAAgC;AAGtC,MAAM,eAAe;AAqB5B,eAAsB,mBAAmB,MAA8C;;AAErF,QAAM,OAAe,WAAU,MAAAA,MAAA,gCAAAA,IAAqB,QAArB,mBAA0B,aAAY;AACrE,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,KAAK,GAAG,eAAe;AAAA,MAC5E,aAAa;AAAA,MACb,SAAS,EAAE,QAAQ,mBAAA;AAAA,IAAmB,CACvC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAQ,MAAM,IAAI,KAAA;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;ACzDO,MAAM,uBAAkE,CAAA;AAE/E,IAAI,kBAAkB;AAEf,SAAS,qBAA6B;AAC3C,SAAO;AACT;AAEO,SAAS,mBAAmB,IAAiC;AAClE,QAAM,OAAO,MAAM,OAAO,KAAK,OAAO,EAAE;AACxC,oBAAkB;AAClB,MAAI,MAAM;AACR,yBAAqB,SAAS;AAAA,EAChC,OAAO;AACL,WAAO,qBAAqB;AAAA,EAC9B;AACF;ACsBA,MAAM,QAAO,wCAAqB,QAAO,CAAA;AAGzC,SAAS,YAAY,MAAiC,SAA+B;AACnF,QAAM,SAAS,KAAK,WAAU,mCAAS,WAAU,IAAI,oBAAoB;AACzE,QAAM,WACJ,KAAK,aAAY,mCAAS,aAAY,IAAI,uBAAuB;AACnE,QAAM,eAAe,KAAK,iBAAgB,mCAAS,iBAAgB;AACnE,QAAM,yBAAyB,KAAK,0BAA0B;AAC9D,SAAO,EAAE,QAAQ,UAAU,cAAc,uBAAA;AAC3C;AAEO,SAAS,mBAAmB,OAAkC,IAAI;AACvE,SAAO,SAASC,eAAa,EAAE,YAA2C;AACxE,UAAM,aAAa,KAAK,qBAAqB;AAE7C,UAAM,CAAC,SAAS,UAAU,IAAI;AAAA,MAC5B,aAAa,SAAY;AAAA,IAAA;AAG3B,cAAU,MAAM;AACd,UAAI,CAAC,WAAY;AACjB,UAAI,YAAY;AAChB,WAAK,mBAAmB,KAAK,iBAAiB,EAAE,KAAK,CAAC,QAAQ;AAC5D,YAAI,CAAC,UAAW,YAAW,GAAG;AAAA,MAChC,CAAC;AACD,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IAGF,GAAG,CAAA,CAAE;AAIL,QAAI,YAAY,OAAW,QAAO;AAElC,UAAM,EAAE,QAAQ,UAAU,cAAc,2BAA2B,YAAY,MAAM,OAAO;AAE5F,UAAM,aAAa;AAAA,MACjB,WAAW;AAAA,MACX,WAAW;AAAA,MACX,GAAI,KAAK,eAAe,EAAE,eAAe,KAAK,aAAA,IAAiB,CAAA;AAAA,MAC/D,cAAc,OAAO,SAAS,SAAS;AAAA,MACvC,0BAA0B,OAAO,SAAS,SAAS;AAAA,MACnD,OAAO;AAAA,MACP,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKtB,gBAAgB;AAAA,MAChB,cAAc;AAAA;AAAA;AAAA;AAAA,MAId,WAAW,IAAI,qBAAqB,EAAE,OAAO,gBAAgB;AAAA,MAC7D,kBAAkB;AAAA,QAChB,GAAG;AAAA,QACH,GAAI,KAAK,sBAAsB,KAAK,oBAAA,IAAwB,CAAA;AAAA,MAAC;AAAA,IAC/D;AAGF,+BACG,eAAA,EACC,UAAA,oBAACC,gBAAkB,GAAG,YAAa,UAAS,GAC9C;AAAA,EAEJ;AACF;ACzFO,SAAS,qBAAuC;AACrD,QAAM,OAAO,QAAA;AACb,QAAM,CAAC,SAAS,UAAU,IAAI,SAA+C,CAAA,CAAE;AAE/E,QAAM,cAAc,YAAY,YAAY;AAC1C,QAAI;AACF,YAAM,OAAO,MAAM,aAAA;AACnB,iBAAW,KAAK,QAAQ,EAAE;AAAA,IAC5B,QAAQ;AACN,cAAQ,QAAQ,UAAU;AAAA,IAC5B;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,QAAM,qBAAqB;AAAA,IACzB,OAAO,aAAqB;AAC1B,UAAI,OAAO,QAAQ,MAAM,qBAAsB;AAC/C,yBAAmB,QAAQ;AAC3B,UAAI;AACF,cAAM,KAAK,WAAA;AAAA,MACb,QAAQ;AAAA,MAER;AACA,YAAM,KAAK,eAAe,EAAE,kBAAkB,EAAE,QAAQ,OAAO,QAAQ,EAAA,GAAK,gBAAgB,UAAA,CAAW;AAAA,IACzG;AAAA,IACA,CAAC,IAAI;AAAA,EAAA;AAGP,SAAO,EAAE,SAAS,aAAa,mBAAA;AACjC;AAEO,SAAS,YAAY;AAC1B,QAAM,OAAO,QAAA;AACb,SAAO,YAAY,YAAY;;AAC7B,QAAI;AACF,YAAM,eAAaF,MAAA,KAAK,SAAL,gBAAAA,IAAW,kBAAiB,EAAE;AAAA,IACnD,QAAQ;AAAA,IAER;AAEA,QAAI;AACF,YAAM,KAAK,gBAAA;AAAA,IACb,UAAA;AACE,YAAM,KAAK,WAAA;AAAA,IACb;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AACX;AAEO,SAAS,eAAe;AAC7B,QAAM,OAAO,QAAA;AAEb,qBAAmB,IAAI;AAEvB,YAAU,MAAM;AACd,oBAAgB,MAAM,KAAK,IAAI;AAAA,EACjC,GAAG,CAAC,KAAK,IAAI,CAAC;AAId,YAAU,MAAM;AACd,6BAAyB,MAAM;AAC7B,WAAK,KAAK,WAAA;AAAA,IACZ,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,CAAC;AAET,YAAU,MAAM;;AACd,UAAM,SAAS,MAAAA,MAAA,KAAK,SAAL,gBAAAA,IAAW,YAAX,mBAA4D;AAC3E,QAAI,SAAS,QAAQ,mBAAA,MAAyB,OAAO,KAAK,GAAG;AAC3D,yBAAmB,KAAwB;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,KAAK,IAAI,CAAC;AAEd,SAAO;AACT;ACtFA,MAAM,aAAa;AACnB,MAAM,eAAe;AAEd,SAAS,kBAAkB;AAChC,SACE;AAAA,IAAC;AAAA,IAAA;AAAA,MACC,OAAO;AAAA,QACL,WAAW;AAAA,QACX,SAAS;AAAA,QACT,eAAe;AAAA,QACf,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,YAAY;AAAA,MAAA;AAAA,MAGd,UAAA;AAAA,QAAA,oBAAC,MAAA,EAAK,MAAK,QAAA,CAAQ;AAAA,QACnB,oBAAC,UAAK,OAAO,EAAE,OAAO,cAAc,UAAU,GAAA,GAAM,UAAA,eAAA,CAAY;AAAA,MAAA;AAAA,IAAA;AAAA,EAAA;AAGtE;"}

package/dist/_types/auth/tenant.d.ts

@@ -0,0 +1,3 @@
+export declare const oidcExtraQueryParams: Record<string, string | number | boolean>;
+export declare function getCurrentTenantId(): string;
+export declare function setCurrentTenantId(id: string | number | undefined): void;

package/dist/_types/types/auth.d.ts

@@ -0,0 +1,62 @@
+import type { OwnerType } from './tenant';
+/**
+ * 自然人可用性（后端具名类型 model.PersonStatus）：active-正常 / suspended-已挂起
+ * （suspended 禁止登录与签发令牌，语义对齐 tenant.status 的挂起）。
+ */
+export type PersonStatus = 'active' | 'suspended';
+/** 自然人密码状态（后端具名类型 model.PasswordStatus）：normal-正常 / must_change-必须改密。 */
+export type PasswordStatus = 'normal' | 'must_change';
+export interface PersonInfo {
+    personID: string;
+    name: string;
+    avatar: string;
+}
+export interface UserinfoResp {
+    personInfo: PersonInfo;
+    userInfo: {
+        userID: string;
+        tenantID: string;
+        name: string;
+        ownerType: OwnerType;
+    };
+}
+export interface MyTenantsResp {
+    list: {
+        tenantID: string;
+        name: string;
+    }[];
+}
+export interface PersonDetailResp {
+    personID: string;
+    username: string;
+    primaryEmail: string;
+    primaryPhone: string;
+    name: string;
+    avatar: string;
+    status: PersonStatus;
+    passwordStatus: PasswordStatus;
+}
+export interface PersonUpdatePasswordReq {
+    oldPassword: string;
+    newPassword: string;
+}
+export interface SessionResp {
+    id: string;
+    sessionID: string;
+    appID: string;
+    tenantID: string;
+    clientType: string;
+    clientIP: string;
+    userAgent: string;
+    expiresAt?: number | null;
+    createdAt: number;
+    isActive: boolean;
+}
+export interface SessionListResp {
+    list: SessionResp[];
+    total: number;
+}
+export interface SessionListReq {
+    page?: number;
+    pageSize?: number;
+}

package/dist/_types/types/department.d.ts

@@ -0,0 +1,52 @@
+import type { UserStatus } from './tenant';
+export type DeptNodeStatus = 'enable' | 'disable';
+export interface DepartmentItem {
+    departmentID: string;
+    parentID: string;
+    deptPath: string;
+    deptDepth: number;
+    name: string;
+    sort: number;
+    status: DeptNodeStatus;
+    createdAt?: number;
+    children?: DepartmentItem[];
+}
+export interface DepartmentChildItem {
+    departmentID: string;
+    parentID: string;
+    deptDepth: number;
+    name: string;
+    sort: number;
+    status: DeptNodeStatus;
+    createdAt?: number;
+    updatedAt?: number;
+    hasChildren?: boolean;
+}
+export interface DepartmentUserItem {
+    departmentID: string;
+    userID: string;
+    userName: string;
+    username: string;
+    primaryEmail: string;
+    primaryPhone: string;
+    avatar: string;
+    status: UserStatus;
+    relationType: string;
+    joinedAt?: number;
+}
+export interface UserDepartmentItem {
+    departmentID: string;
+    departmentName: string;
+    relationType: string;
+}
+export interface DepartmentTreeResp {
+    list: DepartmentItem[];
+}
+export interface DepartmentChildrenResp {
+    list: DepartmentChildItem[];
+    total: number;
+}
+export interface PageListResp<T> {
+    list: T[];
+    total: number;
+}

package/dist/_types/types/index.d.ts

@@ -0,0 +1,5 @@
+export * from './response';
+export * from './auth';
+export * from './department';
+export * from './platform';
+export * from './tenant';

package/dist/_types/types/index.js

@@ -0,0 +1,14 @@
+var BizCode = /* @__PURE__ */ ((BizCode2) => {
+  BizCode2[BizCode2["Success"] = 0] = "Success";
+  BizCode2[BizCode2["Unauthorized"] = 11e4] = "Unauthorized";
+  BizCode2[BizCode2["Forbidden"] = 110001] = "Forbidden";
+  BizCode2[BizCode2["TokenInvalid"] = 110002] = "TokenInvalid";
+  BizCode2[BizCode2["TokenExpired"] = 110003] = "TokenExpired";
+  BizCode2[BizCode2["PermissionDenied"] = 110004] = "PermissionDenied";
+  BizCode2[BizCode2["ParamInvalid"] = 100104] = "ParamInvalid";
+  return BizCode2;
+})(BizCode || {});
+export {
+  BizCode
+};
+//# sourceMappingURL=index.js.map

package/dist/_types/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/response.ts"],"sourcesContent":["export interface ApiResponse<T> {\n  code: number\n  msg: string\n  data: T\n}\n\nexport enum BizCode {\n  Success = 0,\n  Unauthorized = 110000,\n  Forbidden = 110001,\n  TokenInvalid = 110002,\n  TokenExpired = 110003,\n  PermissionDenied = 110004,\n  ParamInvalid = 100104,\n}\n"],"names":["BizCode"],"mappings":"AAMO,IAAK,4BAAAA,aAAL;AACLA,WAAAA,SAAA,aAAU,CAAA,IAAV;AACAA,WAAAA,SAAA,kBAAe,IAAA,IAAf;AACAA,WAAAA,SAAA,eAAY,MAAA,IAAZ;AACAA,WAAAA,SAAA,kBAAe,MAAA,IAAf;AACAA,WAAAA,SAAA,kBAAe,MAAA,IAAf;AACAA,WAAAA,SAAA,sBAAmB,MAAA,IAAnB;AACAA,WAAAA,SAAA,kBAAe,MAAA,IAAf;AAPU,SAAAA;AAAA,GAAA,WAAA,CAAA,CAAA;"}