@morehao/ark-iam-react 0.0.0-stage → 1.0.0

package/dist/index-D3uUqZ5c.js

@@ -0,0 +1,190 @@
+import { jsxs, jsx } from "react/jsx-runtime";
+import { useState, useEffect, useCallback } from "react";
+import { BrowserRouter } from "react-router-dom";
+import { AuthProvider, useAuth } from "react-oidc-context";
+import { WebStorageStateStore } from "oidc-client-ts";
+import { Spin, message } from "antd";
+import { T as useSSOSessionProbe, F as logoutAllAPI, v as getMyTenants, L as setUserProvider, K as setSessionExpiredHandler } from "./index-BQuRl5A6.js";
+var _a;
+const defaultIssuer = "/oidc";
+const defaultRedirectPath = "/auth/callback";
+const defaultPostLogoutRedirectPath = "/login";
+const defaultScope = "openid profile email offline_access";
+async function fetchRuntimeConfig(base) {
+  var _a2, _b;
+  const root = base ?? (((_b = (_a2 = import.meta) == null ? void 0 : _a2.env) == null ? void 0 : _b.BASE_URL) ?? "/");
+  try {
+    const res = await fetch(`${root}${root.endsWith("/") ? "" : "/"}config.json`, {
+      credentials: "same-origin",
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+const oidcExtraQueryParams = {};
+let currentTenantId = "";
+function getCurrentTenantId() {
+  return currentTenantId;
+}
+function setCurrentTenantId(id) {
+  const next = id == null ? "" : String(id);
+  currentTenantId = next;
+  if (next) {
+    oidcExtraQueryParams.tenant = next;
+  } else {
+    delete oidcExtraQueryParams.tenant;
+  }
+}
+const ENV = ((_a = import.meta) == null ? void 0 : _a.env) ?? {};
+function buildConfig(opts, runtime) {
+  const issuer = opts.issuer || (runtime == null ? void 0 : runtime.issuer) || ENV.VITE_OIDC_ISSUER || defaultIssuer;
+  const clientId = opts.clientID || (runtime == null ? void 0 : runtime.clientId) || ENV.VITE_OIDC_CLIENT_ID || "";
+  const redirectPath = opts.redirectPath || (runtime == null ? void 0 : runtime.callbackPath) || defaultRedirectPath;
+  const postLogoutRedirectPath = opts.postLogoutRedirectPath || defaultPostLogoutRedirectPath;
+  return { issuer, clientId, redirectPath, postLogoutRedirectPath };
+}
+function createAuthProvider(opts = {}) {
+  return function AuthProvider$1({ children }) {
+    const useRuntime = opts.useRuntimeConfig !== false;
+    const [runtime, setRuntime] = useState(
+      useRuntime ? void 0 : null
+    );
+    useEffect(() => {
+      if (!useRuntime) return;
+      let cancelled = false;
+      void fetchRuntimeConfig(opts.runtimeConfigBase).then((cfg) => {
+        if (!cancelled) setRuntime(cfg);
+      });
+      return () => {
+        cancelled = true;
+      };
+    }, []);
+    if (runtime === void 0) return null;
+    const { issuer, clientId, redirectPath, postLogoutRedirectPath } = buildConfig(opts, runtime);
+    const oidcConfig = {
+      authority: issuer,
+      client_id: clientId,
+      ...opts.clientSecret ? { client_secret: opts.clientSecret } : {},
+      redirect_uri: window.location.origin + redirectPath,
+      post_logout_redirect_uri: window.location.origin + postLogoutRedirectPath,
+      scope: defaultScope,
+      automaticSilentRenew: true,
+      // monitorSession 需要 OP 在 discovery 暴露 check_session_iframe（OIDC Session
+      // Management）。当前 OP（zitadel）未启用该端点，oidc-client-ts 会自动降级为不监控。
+      // "一处登出、处处登出"的即时性主要由后端请求粒度 SSO 活性校验保障
+      // （WithOIDCSSOValidation + HasActiveSession），此配置仅作跨标签页监控的尽力而为。
+      monitorSession: true,
+      loadUserInfo: true,
+      // 令牌存储：使用 sessionStorage（标签页级，关闭即清）而非 localStorage，
+      // 缩小 XSS 窃取令牌的持续暴露窗口。SSO 认证态本身在 OP 的 iam_sso_session
+      // cookie，不依赖前端存储；页面刷新/静默续期不受影响。
+      userStore: new WebStorageStateStore({ store: sessionStorage }),
+      extraQueryParams: {
+        ...oidcExtraQueryParams,
+        ...opts.getExtraQueryParams ? opts.getExtraQueryParams() : {}
+      }
+    };
+    return /* @__PURE__ */ jsx(BrowserRouter, { children: /* @__PURE__ */ jsx(AuthProvider, { ...oidcConfig, children }) });
+  };
+}
+function useTenantSwitching() {
+  const auth = useAuth();
+  const [tenants, setTenants] = useState([]);
+  const loadTenants = useCallback(async () => {
+    try {
+      const resp = await getMyTenants();
+      setTenants(resp.list || []);
+    } catch {
+      message.warning("获取可用租户失败");
+    }
+  }, []);
+  const handleSwitchTenant = useCallback(
+    async (tenantID) => {
+      if (String(tenantID) === getCurrentTenantId()) return;
+      setCurrentTenantId(tenantID);
+      try {
+        await auth.removeUser();
+      } catch {
+      }
+      await auth.signinRedirect({ extraQueryParams: { tenant: String(tenantID) }, redirectMethod: "replace" });
+    },
+    [auth]
+  );
+  return { tenants, loadTenants, handleSwitchTenant };
+}
+function useLogout() {
+  const auth = useAuth();
+  return useCallback(async () => {
+    var _a2;
+    try {
+      await logoutAllAPI(((_a2 = auth.user) == null ? void 0 : _a2.refresh_token) ?? "");
+    } catch {
+    }
+    try {
+      await auth.signoutRedirect();
+    } finally {
+      await auth.removeUser();
+    }
+  }, [auth]);
+}
+function useAuthGuard() {
+  const auth = useAuth();
+  useSSOSessionProbe(auth);
+  useEffect(() => {
+    setUserProvider(() => auth.user);
+  }, [auth.user]);
+  useEffect(() => {
+    setSessionExpiredHandler(() => {
+      void auth.removeUser();
+    });
+  }, [auth]);
+  useEffect(() => {
+    var _a2, _b;
+    const claim = (_b = (_a2 = auth.user) == null ? void 0 : _a2.profile) == null ? void 0 : _b.tenant_id;
+    if (claim != null && getCurrentTenantId() !== String(claim)) {
+      setCurrentTenantId(claim);
+    }
+  }, [auth.user]);
+  return auth;
+}
+const LOADING_BG = "#f6f7f9";
+const LOADING_TEXT = "#94a3b8";
+function FullPageSpinner() {
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      style: {
+        minHeight: "100vh",
+        display: "flex",
+        flexDirection: "column",
+        alignItems: "center",
+        justifyContent: "center",
+        gap: 16,
+        background: LOADING_BG
+      },
+      children: [
+        /* @__PURE__ */ jsx(Spin, { size: "large" }),
+        /* @__PURE__ */ jsx("span", { style: { color: LOADING_TEXT, fontSize: 13 }, children: "正在加载 IAM 平台…" })
+      ]
+    }
+  );
+}
+export {
+  FullPageSpinner as F,
+  defaultPostLogoutRedirectPath as a,
+  defaultRedirectPath as b,
+  createAuthProvider as c,
+  defaultIssuer as d,
+  defaultScope as e,
+  fetchRuntimeConfig as f,
+  getCurrentTenantId as g,
+  useLogout as h,
+  useTenantSwitching as i,
+  oidcExtraQueryParams as o,
+  setCurrentTenantId as s,
+  useAuthGuard as u
+};
+//# sourceMappingURL=index-D3uUqZ5c.js.map

package/dist/index-D3uUqZ5c.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-D3uUqZ5c.js","sources":["../../auth/dist/index.js"],"sourcesContent":["var _a;\nimport { jsx, jsxs } from \"react/jsx-runtime\";\nimport { useState, useEffect, useCallback } from \"react\";\nimport { BrowserRouter } from \"react-router-dom\";\nimport { AuthProvider, useAuth } from \"react-oidc-context\";\nimport { WebStorageStateStore } from \"oidc-client-ts\";\nimport { message, Spin } from \"antd\";\nimport { useSSOSessionProbe, setUserProvider, setSessionExpiredHandler, logoutAllAPI, getMyTenants } from \"@ark-iam/api\";\nconst defaultIssuer = \"/oidc\";\nconst defaultRedirectPath = \"/auth/callback\";\nconst defaultPostLogoutRedirectPath = \"/login\";\nconst defaultScope = \"openid profile email offline_access\";\nasync function fetchRuntimeConfig(base) {\n  var _a2, _b;\n  const root = base ?? (((_b = (_a2 = import.meta) == null ? void 0 : _a2.env) == null ? void 0 : _b.BASE_URL) ?? \"/\");\n  try {\n    const res = await fetch(`${root}${root.endsWith(\"/\") ? \"\" : \"/\"}config.json`, {\n      credentials: \"same-origin\",\n      headers: { Accept: \"application/json\" }\n    });\n    if (!res.ok) return null;\n    return await res.json();\n  } catch {\n    return null;\n  }\n}\nconst oidcExtraQueryParams = {};\nlet currentTenantId = \"\";\nfunction getCurrentTenantId() {\n  return currentTenantId;\n}\nfunction setCurrentTenantId(id) {\n  const next = id == null ? \"\" : String(id);\n  currentTenantId = next;\n  if (next) {\n    oidcExtraQueryParams.tenant = next;\n  } else {\n    delete oidcExtraQueryParams.tenant;\n  }\n}\nconst ENV = ((_a = import.meta) == null ? void 0 : _a.env) ?? {};\nfunction buildConfig(opts, runtime) {\n  const issuer = opts.issuer || (runtime == null ? void 0 : runtime.issuer) || ENV.VITE_OIDC_ISSUER || defaultIssuer;\n  const clientId = opts.clientID || (runtime == null ? void 0 : runtime.clientId) || ENV.VITE_OIDC_CLIENT_ID || \"\";\n  const redirectPath = opts.redirectPath || (runtime == null ? void 0 : runtime.callbackPath) || defaultRedirectPath;\n  const postLogoutRedirectPath = opts.postLogoutRedirectPath || defaultPostLogoutRedirectPath;\n  return { issuer, clientId, redirectPath, postLogoutRedirectPath };\n}\nfunction createAuthProvider(opts = {}) {\n  return function AuthProvider$1({ children }) {\n    const useRuntime = opts.useRuntimeConfig !== false;\n    const [runtime, setRuntime] = useState(\n      useRuntime ? void 0 : null\n    );\n    useEffect(() => {\n      if (!useRuntime) return;\n      let cancelled = false;\n      void fetchRuntimeConfig(opts.runtimeConfigBase).then((cfg) => {\n        if (!cancelled) setRuntime(cfg);\n      });\n      return () => {\n        cancelled = true;\n      };\n    }, []);\n    if (runtime === void 0) return null;\n    const { issuer, clientId, redirectPath, postLogoutRedirectPath } = buildConfig(opts, runtime);\n    const oidcConfig = {\n      authority: issuer,\n      client_id: clientId,\n      ...opts.clientSecret ? { client_secret: opts.clientSecret } : {},\n      redirect_uri: window.location.origin + redirectPath,\n      post_logout_redirect_uri: window.location.origin + postLogoutRedirectPath,\n      scope: defaultScope,\n      automaticSilentRenew: true,\n      // monitorSession 需要 OP 在 discovery 暴露 check_session_iframe（OIDC Session\n      // Management）。当前 OP（zitadel）未启用该端点，oidc-client-ts 会自动降级为不监控。\n      // \"一处登出、处处登出\"的即时性主要由后端请求粒度 SSO 活性校验保障\n      // （WithOIDCSSOValidation + HasActiveSession），此配置仅作跨标签页监控的尽力而为。\n      monitorSession: true,\n      loadUserInfo: true,\n      // 令牌存储：使用 sessionStorage（标签页级，关闭即清）而非 localStorage，\n      // 缩小 XSS 窃取令牌的持续暴露窗口。SSO 认证态本身在 OP 的 iam_sso_session\n      // cookie，不依赖前端存储；页面刷新/静默续期不受影响。\n      userStore: new WebStorageStateStore({ store: sessionStorage }),\n      extraQueryParams: {\n        ...oidcExtraQueryParams,\n        ...opts.getExtraQueryParams ? opts.getExtraQueryParams() : {}\n      }\n    };\n    return /* @__PURE__ */ jsx(BrowserRouter, { children: /* @__PURE__ */ jsx(AuthProvider, { ...oidcConfig, children }) });\n  };\n}\nfunction useTenantSwitching() {\n  const auth = useAuth();\n  const [tenants, setTenants] = useState([]);\n  const loadTenants = useCallback(async () => {\n    try {\n      const resp = await getMyTenants();\n      setTenants(resp.list || []);\n    } catch {\n      message.warning(\"获取可用租户失败\");\n    }\n  }, []);\n  const handleSwitchTenant = useCallback(\n    async (tenantID) => {\n      if (String(tenantID) === getCurrentTenantId()) return;\n      setCurrentTenantId(tenantID);\n      try {\n        await auth.removeUser();\n      } catch {\n      }\n      await auth.signinRedirect({ extraQueryParams: { tenant: String(tenantID) }, redirectMethod: \"replace\" });\n    },\n    [auth]\n  );\n  return { tenants, loadTenants, handleSwitchTenant };\n}\nfunction useLogout() {\n  const auth = useAuth();\n  return useCallback(async () => {\n    var _a2;\n    try {\n      await logoutAllAPI(((_a2 = auth.user) == null ? void 0 : _a2.refresh_token) ?? \"\");\n    } catch {\n    }\n    try {\n      await auth.signoutRedirect();\n    } finally {\n      await auth.removeUser();\n    }\n  }, [auth]);\n}\nfunction useAuthGuard() {\n  const auth = useAuth();\n  useSSOSessionProbe(auth);\n  useEffect(() => {\n    setUserProvider(() => auth.user);\n  }, [auth.user]);\n  useEffect(() => {\n    setSessionExpiredHandler(() => {\n      void auth.removeUser();\n    });\n  }, [auth]);\n  useEffect(() => {\n    var _a2, _b;\n    const claim = (_b = (_a2 = auth.user) == null ? void 0 : _a2.profile) == null ? void 0 : _b.tenant_id;\n    if (claim != null && getCurrentTenantId() !== String(claim)) {\n      setCurrentTenantId(claim);\n    }\n  }, [auth.user]);\n  return auth;\n}\nconst LOADING_BG = \"#f6f7f9\";\nconst LOADING_TEXT = \"#94a3b8\";\nfunction FullPageSpinner() {\n  return /* @__PURE__ */ jsxs(\n    \"div\",\n    {\n      style: {\n        minHeight: \"100vh\",\n        display: \"flex\",\n        flexDirection: \"column\",\n        alignItems: \"center\",\n        justifyContent: \"center\",\n        gap: 16,\n        background: LOADING_BG\n      },\n      children: [\n        /* @__PURE__ */ jsx(Spin, { size: \"large\" }),\n        /* @__PURE__ */ jsx(\"span\", { style: { color: LOADING_TEXT, fontSize: 13 }, children: \"正在加载 IAM 平台…\" })\n      ]\n    }\n  );\n}\nexport {\n  FullPageSpinner,\n  createAuthProvider,\n  defaultIssuer,\n  defaultPostLogoutRedirectPath,\n  defaultRedirectPath,\n  defaultScope,\n  fetchRuntimeConfig,\n  getCurrentTenantId,\n  oidcExtraQueryParams,\n  setCurrentTenantId,\n  useAuthGuard,\n  useLogout,\n  useTenantSwitching\n};\n//# sourceMappingURL=index.js.map\n"],"names":[],"mappings":";;;;;;;AAAA,IAAI;AAQC,MAAC,gBAAgB;AACjB,MAAC,sBAAsB;AACvB,MAAC,gCAAgC;AACjC,MAAC,eAAe;AACrB,eAAe,mBAAmB,MAAM;AACtC,MAAI,KAAK;AACT,QAAM,OAAO,WAAW,MAAM,MAAM,gBAAgB,OAAO,SAAS,IAAI,QAAQ,OAAO,SAAS,GAAG,aAAa;AAChH,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,KAAK,GAAG,eAAe;AAAA,MAC5E,aAAa;AAAA,MACb,SAAS,EAAE,QAAQ,mBAAkB;AAAA,IAC3C,CAAK;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,WAAO,MAAM,IAAI,KAAI;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACK,MAAC,uBAAuB,CAAA;AAC7B,IAAI,kBAAkB;AACtB,SAAS,qBAAqB;AAC5B,SAAO;AACT;AACA,SAAS,mBAAmB,IAAI;AAC9B,QAAM,OAAO,MAAM,OAAO,KAAK,OAAO,EAAE;AACxC,oBAAkB;AAClB,MAAI,MAAM;AACR,yBAAqB,SAAS;AAAA,EAChC,OAAO;AACL,WAAO,qBAAqB;AAAA,EAC9B;AACF;AACA,MAAM,QAAQ,KAAK,gBAAgB,OAAO,SAAS,GAAG,QAAQ,CAAA;AAC9D,SAAS,YAAY,MAAM,SAAS;AAClC,QAAM,SAAS,KAAK,WAAW,WAAW,OAAO,SAAS,QAAQ,WAAW,IAAI,oBAAoB;AACrG,QAAM,WAAW,KAAK,aAAa,WAAW,OAAO,SAAS,QAAQ,aAAa,IAAI,uBAAuB;AAC9G,QAAM,eAAe,KAAK,iBAAiB,WAAW,OAAO,SAAS,QAAQ,iBAAiB;AAC/F,QAAM,yBAAyB,KAAK,0BAA0B;AAC9D,SAAO,EAAE,QAAQ,UAAU,cAAc,uBAAsB;AACjE;AACA,SAAS,mBAAmB,OAAO,IAAI;AACrC,SAAO,SAAS,eAAe,EAAE,YAAY;AAC3C,UAAM,aAAa,KAAK,qBAAqB;AAC7C,UAAM,CAAC,SAAS,UAAU,IAAI;AAAA,MAC5B,aAAa,SAAS;AAAA,IAC5B;AACI,cAAU,MAAM;AACd,UAAI,CAAC,WAAY;AACjB,UAAI,YAAY;AAChB,WAAK,mBAAmB,KAAK,iBAAiB,EAAE,KAAK,CAAC,QAAQ;AAC5D,YAAI,CAAC,UAAW,YAAW,GAAG;AAAA,MAChC,CAAC;AACD,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF,GAAG,CAAA,CAAE;AACL,QAAI,YAAY,OAAQ,QAAO;AAC/B,UAAM,EAAE,QAAQ,UAAU,cAAc,uBAAsB,IAAK,YAAY,MAAM,OAAO;AAC5F,UAAM,aAAa;AAAA,MACjB,WAAW;AAAA,MACX,WAAW;AAAA,MACX,GAAG,KAAK,eAAe,EAAE,eAAe,KAAK,aAAY,IAAK,CAAA;AAAA,MAC9D,cAAc,OAAO,SAAS,SAAS;AAAA,MACvC,0BAA0B,OAAO,SAAS,SAAS;AAAA,MACnD,OAAO;AAAA,MACP,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKtB,gBAAgB;AAAA,MAChB,cAAc;AAAA;AAAA;AAAA;AAAA,MAId,WAAW,IAAI,qBAAqB,EAAE,OAAO,eAAc,CAAE;AAAA,MAC7D,kBAAkB;AAAA,QAChB,GAAG;AAAA,QACH,GAAG,KAAK,sBAAsB,KAAK,oBAAmB,IAAK,CAAA;AAAA,MACnE;AAAA,IACA;AACI,WAAuB,oBAAI,eAAe,EAAE,UAA0B,oBAAI,cAAc,EAAE,GAAG,YAAY,SAAQ,CAAE,GAAG;AAAA,EACxH;AACF;AACA,SAAS,qBAAqB;AAC5B,QAAM,OAAO,QAAO;AACpB,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,CAAA,CAAE;AACzC,QAAM,cAAc,YAAY,YAAY;AAC1C,QAAI;AACF,YAAM,OAAO,MAAM,aAAY;AAC/B,iBAAW,KAAK,QAAQ,EAAE;AAAA,IAC5B,QAAQ;AACN,cAAQ,QAAQ,UAAU;AAAA,IAC5B;AAAA,EACF,GAAG,CAAA,CAAE;AACL,QAAM,qBAAqB;AAAA,IACzB,OAAO,aAAa;AAClB,UAAI,OAAO,QAAQ,MAAM,qBAAsB;AAC/C,yBAAmB,QAAQ;AAC3B,UAAI;AACF,cAAM,KAAK,WAAU;AAAA,MACvB,QAAQ;AAAA,MACR;AACA,YAAM,KAAK,eAAe,EAAE,kBAAkB,EAAE,QAAQ,OAAO,QAAQ,EAAC,GAAI,gBAAgB,UAAS,CAAE;AAAA,IACzG;AAAA,IACA,CAAC,IAAI;AAAA,EACT;AACE,SAAO,EAAE,SAAS,aAAa,mBAAkB;AACnD;AACA,SAAS,YAAY;AACnB,QAAM,OAAO,QAAO;AACpB,SAAO,YAAY,YAAY;AAC7B,QAAI;AACJ,QAAI;AACF,YAAM,eAAe,MAAM,KAAK,SAAS,OAAO,SAAS,IAAI,kBAAkB,EAAE;AAAA,IACnF,QAAQ;AAAA,IACR;AACA,QAAI;AACF,YAAM,KAAK,gBAAe;AAAA,IAC5B,UAAC;AACC,YAAM,KAAK,WAAU;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AACX;AACA,SAAS,eAAe;AACtB,QAAM,OAAO,QAAO;AACpB,qBAAmB,IAAI;AACvB,YAAU,MAAM;AACd,oBAAgB,MAAM,KAAK,IAAI;AAAA,EACjC,GAAG,CAAC,KAAK,IAAI,CAAC;AACd,YAAU,MAAM;AACd,6BAAyB,MAAM;AAC7B,WAAK,KAAK,WAAU;AAAA,IACtB,CAAC;AAAA,EACH,GAAG,CAAC,IAAI,CAAC;AACT,YAAU,MAAM;AACd,QAAI,KAAK;AACT,UAAM,SAAS,MAAM,MAAM,KAAK,SAAS,OAAO,SAAS,IAAI,YAAY,OAAO,SAAS,GAAG;AAC5F,QAAI,SAAS,QAAQ,mBAAkB,MAAO,OAAO,KAAK,GAAG;AAC3D,yBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,KAAK,IAAI,CAAC;AACd,SAAO;AACT;AACA,MAAM,aAAa;AACnB,MAAM,eAAe;AACrB,SAAS,kBAAkB;AACzB,SAAuB;AAAA,IACrB;AAAA,IACA;AAAA,MACE,OAAO;AAAA,QACL,WAAW;AAAA,QACX,SAAS;AAAA,QACT,eAAe;AAAA,QACf,YAAY;AAAA,QACZ,gBAAgB;AAAA,QAChB,KAAK;AAAA,QACL,YAAY;AAAA,MACpB;AAAA,MACM,UAAU;AAAA,QACQ,oBAAI,MAAM,EAAE,MAAM,QAAO,CAAE;AAAA,QAC3B,oBAAI,QAAQ,EAAE,OAAO,EAAE,OAAO,cAAc,UAAU,GAAE,GAAI,UAAU,eAAc,CAAE;AAAA,MAC9G;AAAA,IACA;AAAA,EACA;AACA;"}