@nocobase/plugin-auth 2.1.0-alpha.40 → 2.1.0-alpha.46

package/dist/server/index.d.ts

@@ -10,7 +10,7 @@ export { BasicAuth } from './basic-auth';
 export { AuthModel } from './model/authenticator';
 export { presetAuthType } from '../preset';
 export { defaultTokenPolicyConfig } from '../constants';
-export { buildRedirectPath } from './utils/buildRedirectPath';
-export type { BuildRedirectPathOptions } from './utils/buildRedirectPath';
+export { buildRedirectPath, getModernClientPrefix, resolveSigninPrefix } from './utils/buildRedirectPath';
+export type { BuildRedirectPathOptions, ResolveSigninPrefixOptions } from './utils/buildRedirectPath';
 export { default } from './plugin';
 export * from '../constants';

package/dist/server/index.js

@@ -42,7 +42,9 @@ __export(server_exports, {
   buildRedirectPath: () => import_buildRedirectPath.buildRedirectPath,
   default: () => import_plugin.default,
   defaultTokenPolicyConfig: () => import_constants.defaultTokenPolicyConfig,
-  presetAuthType: () => import_preset.presetAuthType
+  getModernClientPrefix: () => import_buildRedirectPath.getModernClientPrefix,
+  presetAuthType: () => import_preset.presetAuthType,
+  resolveSigninPrefix: () => import_buildRedirectPath.resolveSigninPrefix
 });
 module.exports = __toCommonJS(server_exports);
 var import_basic_auth = require("./basic-auth");
@@ -58,6 +60,8 @@ __reExport(server_exports, require("../constants"), module.exports);
   BasicAuth,
   buildRedirectPath,
   defaultTokenPolicyConfig,
+  getModernClientPrefix,
   presetAuthType,
+  resolveSigninPrefix,
   ...require("../constants")
 });

package/dist/server/plugin.d.ts

@@ -8,8 +8,10 @@
  */
 import { Cache } from '@nocobase/cache';
 import { InstallOptions, Plugin } from '@nocobase/server';
+import { Storer } from './storer';
 export declare class PluginAuthServer extends Plugin {
     cache: Cache;
+    storer: Storer;
     afterAdd(): void;
     beforeLoad(): Promise<void>;
     load(): Promise<void>;

package/dist/server/plugin.js

@@ -53,6 +53,7 @@ var import_token_blacklist = require("./token-blacklist");
 var import_token_controller = require("./token-controller");
 class PluginAuthServer extends import_server.Plugin {
   cache;
+  storer;
   afterAdd() {
     this.app.on("afterLoad", async () => {
       if (this.app.authManager.tokenController) {
@@ -90,6 +91,7 @@ class PluginAuthServer extends import_server.Plugin {
       cache: this.cache,
       authManager: this.app.authManager
     });
+    this.storer = storer;
     this.app.authManager.setStorer(storer);
     if (!this.app.authManager.jwt.blacklist) {
       this.app.authManager.setTokenBlacklistService(new import_token_blacklist.TokenBlacklistService(this));

package/dist/server/token-controller.d.ts

@@ -26,14 +26,16 @@ export declare class TokenController implements TokenControlService {
     getConfig(): Promise<NumericTokenPolicyConfig>;
     setConfig(config: TokenPolicyConfig): Promise<void>;
     removeSessionExpiredTokens(userId: number): Promise<number>;
-    add({ userId }: {
+    add({ userId, authenticator }: {
         userId: number;
+        authenticator?: string;
     }): Promise<{
         jti: `${string}-${string}-${string}-${string}-${string}`;
         issuedTime: number;
         signInTime: number;
         renewed: boolean;
         userId: number;
+        authenticator: string;
     }>;
     renew: TokenControlService['renew'];
 }

package/dist/server/token-controller.js

@@ -93,7 +93,7 @@ class TokenController {
       }
     });
   }
-  async add({ userId }) {
+  async add({ userId, authenticator }) {
     const jti = (0, import_crypto.randomUUID)();
     const currTS = Date.now();
     const data = {
@@ -101,7 +101,8 @@ class TokenController {
       issuedTime: currTS,
       signInTime: currTS,
       renewed: false,
-      userId
+      userId,
+      authenticator
     };
     await this.setTokenInfo(jti, data);
     try {

package/dist/server/utils/buildRedirectPath.d.ts

@@ -22,8 +22,8 @@ export interface BuildRedirectPathOptions {
     /**
      * The raw redirect the client supplied. May be:
      *  - v1 basename-relative (`/admin/abc`), needs full prefix prepended.
-     *  - v2 root-relative (`/nocobase/v2/admin/abc` or
-     *    `/nocobase/v2/apps/<id>/admin/abc`), already absolute under the
+     *  - modern-client root-relative (`/nocobase/v/admin/abc` or
+     *    `/nocobase/v/apps/<id>/admin/abc`), already absolute under the
      *    document root; must NOT be touched.
      *  - missing — falls back to `/admin`.
      */
@@ -35,16 +35,39 @@ export interface BuildRedirectPathOptions {
  *
  * v1 clients emit `redirect` as a basename-relative path (`/admin/abc`)
  * and the server is expected to prepend `APP_PUBLIC_PATH` + the legacy
- * sub-app segment. v2 clients emit `redirect` as an already-root-relative
- * path that includes `APP_PUBLIC_PATH` and (for sub-apps) the
- * `/v2/apps/<id>` segment — so any further prepending produces nonsense
- * URLs like `/nocobase/apps/<id>/nocobase/v2/apps/<id>/admin/…`.
+ * sub-app segment. Modern (v2) clients emit `redirect` as an already-root-
+ * relative path that includes `APP_PUBLIC_PATH` and (for sub-apps) the
+ * `/<modern-prefix>/apps/<id>` segment — so any further prepending produces
+ * nonsense URLs like `/nocobase/apps/<id>/nocobase/v/apps/<id>/admin/…`.
  *
- * Detection rule: a target is v2-shaped iff it starts with
+ * Detection rule: a target is modern-shaped iff it starts with
  * `appPublicPath + '/'`. The sub-app segment is irrelevant to detection
- * because v2 always prefixes with `appPublicPath` regardless of sub-app
- * (`/<APP_PUBLIC_PATH>/v2/...` or `/<APP_PUBLIC_PATH>/v2/apps/<id>/...`).
+ * because modern clients always prefix with `appPublicPath` regardless of
+ * sub-app (`/<APP_PUBLIC_PATH>/v/...` or `/<…>/v/apps/<id>/...`).
  *
  * Single export shared by all auth-related SSO plugins (CAS, SAML, …).
  */
 export declare function buildRedirectPath({ appPublicPath, subAppSegment, target }: BuildRedirectPathOptions): string;
+/**
+ * The runtime URL segment under which the modern (v2) client is served,
+ * read from `APP_MODERN_CLIENT_PREFIX` (default `v`). Returns a bare
+ * segment without surrounding slashes.
+ */
+export declare function getModernClientPrefix(): string;
+export interface ResolveSigninPrefixOptions {
+    /** `process.env.APP_PUBLIC_PATH`, with or without trailing slash. */
+    appPublicPath?: string | null;
+    /** The raw redirect target supplied by the client (RelayState / state / query). */
+    redirect?: string | null;
+    /** Legacy (v1) sub-app segment, e.g. `/apps/<name>` or empty. */
+    subAppSegment?: string | null;
+}
+/**
+ * On SSO failure the user must land back on the signin page of the *same*
+ * shell they started from (legacy v1 vs modern v2). Modern-client URLs always
+ * carry the `<APP_PUBLIC_PATH>/<modern-prefix>/` segment in the redirect;
+ * legacy URLs never do. Returns the signin prefix to prepend to `/signin`.
+ *
+ * Shared by all SSO plugins (SAML, OIDC, CAS).
+ */
+export declare function resolveSigninPrefix({ appPublicPath, redirect, subAppSegment }: ResolveSigninPrefixOptions): string;

package/dist/server/utils/buildRedirectPath.js

@@ -26,7 +26,9 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var buildRedirectPath_exports = {};
 __export(buildRedirectPath_exports, {
-  buildRedirectPath: () => buildRedirectPath
+  buildRedirectPath: () => buildRedirectPath,
+  getModernClientPrefix: () => getModernClientPrefix,
+  resolveSigninPrefix: () => resolveSigninPrefix
 });
 module.exports = __toCommonJS(buildRedirectPath_exports);
 function buildRedirectPath({ appPublicPath, subAppSegment, target }) {
@@ -38,7 +40,19 @@ function buildRedirectPath({ appPublicPath, subAppSegment, target }) {
   }
   return `${normalizedAppPublicPath}${normalizedSubAppSegment}${resolvedTarget}`;
 }
+function getModernClientPrefix() {
+  return String(process.env.APP_MODERN_CLIENT_PREFIX || "").trim().replace(/^\/+|\/+$/g, "") || "v";
+}
+function resolveSigninPrefix({ appPublicPath, redirect, subAppSegment }) {
+  const normalizedAppPublicPath = (appPublicPath || "").replace(/\/+$/, "");
+  const modernSegment = `/${getModernClientPrefix()}`;
+  const modernMarker = `${normalizedAppPublicPath}${modernSegment}`;
+  const isModernOrigin = typeof redirect === "string" && (redirect === modernMarker || redirect.startsWith(`${modernMarker}/`));
+  return `${normalizedAppPublicPath}${isModernOrigin ? modernSegment : ""}${subAppSegment || ""}`;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  buildRedirectPath
+  buildRedirectPath,
+  getModernClientPrefix,
+  resolveSigninPrefix
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-auth",
-  "version": "2.1.0-alpha.40",
+  "version": "2.1.0-alpha.46",
   "main": "./dist/server/index.js",
   "homepage": "https://docs.nocobase.com/handbook/auth",
   "homepage.ru-RU": "https://docs-ru.nocobase.com/handbook/auth",
@@ -31,7 +31,7 @@
   "description": "User authentication management, including password, SMS, and support for Single Sign-On (SSO) protocols, with extensibility.",
   "description.ru-RU": "Управление аутентификацией пользователей: пароли, SMS, поддержка протоколов единого входа (SSO) и возможность расширения.",
   "description.zh-CN": "用户认证管理，包括基础的密码认证、短信认证、SSO 协议的认证等，可扩展。",
-  "gitHead": "e73f99dd0abefe847f2e50ff0fea1f41a82fd048",
+  "gitHead": "42b269944cdd1908d7a848c0af4936fe94c03bb7",
   "keywords": [
     "Authentication",
     "Security"