@nocobase/plugin-idp-oauth 2.2.0-beta.7 → 2.2.0-beta.8

package/dist/client/DevicePage.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import React from 'react';
+export declare const DevicePage: () => React.JSX.Element;
+export default DevicePage;

package/dist/client/index.js

@@ -7,4 +7,4 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("antd"),require("react"),require("@nocobase/client"),require("react-router-dom")):"function"==typeof define&&define.amd?define("@nocobase/plugin-idp-oauth",["antd","react","@nocobase/client","react-router-dom"],t):"object"==typeof exports?exports["@nocobase/plugin-idp-oauth"]=t(require("antd"),require("react"),require("@nocobase/client"),require("react-router-dom")):e["@nocobase/plugin-idp-oauth"]=t(e.antd,e.react,e["@nocobase/client"],e["react-router-dom"])}(self,function(e,t,r,n){return function(){"use strict";var o={342:function(e){e.exports=r},59:function(t){t.exports=e},155:function(e){e.exports=t},442:function(e){e.exports=n}},i={};function a(e){var t=i[e];if(void 0!==t)return t.exports;var r=i[e]={exports:{}};return o[e](r,r.exports,a),r.exports}a.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(t,{a:t}),t},a.d=function(e,t){for(var r in t)a.o(t,r)&&!a.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:t[r]})},a.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||Function("return this")()}catch(e){if("object"==typeof window)return window}}(),a.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},a.r=function(e){"u">typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},a.g.importScripts&&(u=a.g.location+"");var u,c=a.g.document;if(!u&&c&&(c.currentScript&&"SCRIPT"===c.currentScript.tagName.toUpperCase()&&(u=c.currentScript.src),!u)){var l=c.getElementsByTagName("script");if(l.length)for(var s=l.length-1;s>-1&&(!u||!/^http(s?):/.test(u));)u=l[s--].src}if(!u)throw Error("Automatic publicPath is not supported in this browser");a.p=u.replace(/^blob:/,"").replace(/#.*$/,"").replace(/\?.*$/,"").replace(/\/[^\/]+$/,"/");var p={};return!function(){var e="",t="u">typeof document?document.currentScript:null;if(t&&t.src){var r=t.src.replace(/^blob:/,"").replace(/#.*$/,"").replace(/\?.*$/,"");r.indexOf("/static/plugins/@nocobase/plugin-idp-oauth/dist/client/")>=0&&(e=r.replace(/\/[^\/]+$/,"/"))}if(!e){var n=window.__webpack_public_path__||"";n&&("/"!==n.charAt(n.length-1)&&(n+="/"),e=n+"static/plugins/@nocobase/plugin-idp-oauth/dist/client/")}if(!e){var o=window.__nocobase_modern_client_prefix__||"v",i="/"+(o=String(o).replace(/^\/+|\/+$/g,"")||"v")+"/";if(!(e=window.__nocobase_public_path__||"")&&window.location&&window.location.pathname){var u=window.location.pathname||"/",c=u.indexOf(i);e=c>=0?u.slice(0,c+1):"/"}e&&(e=e.replace(RegExp("/"+o+"/?$"),"/")),e||(e="/"),"/"!==e.charAt(e.length-1)&&(e+="/"),e+="static/plugins/@nocobase/plugin-idp-oauth/dist/client/"}a.p=e}(),!function(){a.r(p),a.d(p,{default:function(){return _}});var e=a(342),t=a(59),r=a(155),n=a.n(r),o=a(442);function i(e,t){(null==t||t>e.length)&&(t=e.length);for(var r=0,n=Array(t);r<t;r++)n[r]=e[r];return n}var u=function(){var e,r=(function(e){if(Array.isArray(e))return e}(e=(0,o.useSearchParams)())||function(e){var t,r,n=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var o=[],i=!0,a=!1;try{for(n=n.call(e);!(i=(t=n.next()).done)&&(o.push(t.value),1!==o.length);i=!0);}catch(e){a=!0,r=e}finally{try{i||null==n.return||n.return()}finally{if(a)throw r}}return o}}(e)||function(e){if(e){if("string"==typeof e)return i(e,1);var t=Object.prototype.toString.call(e).slice(8,-1);if("Object"===t&&e.constructor&&(t=e.constructor.name),"Map"===t||"Set"===t)return Array.from(t);if("Arguments"===t||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t))return i(e,1)}}(e)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}())[0],a=r.get("error"),u=r.get("error_description"),c=r.get("iss");return n().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},n().createElement(t.Result,{status:"error",title:a||"Authentication failed",subTitle:u||void 0}),n().createElement(t.Space,{direction:"vertical",size:"middle",style:{width:"100%"}},c?n().createElement("div",null,n().createElement(t.Typography.Text,{type:"secondary"},"Issuer"),n().createElement("div",null,n().createElement(t.Typography.Text,{code:!0},c))):null))};function c(e,t){(null==t||t>e.length)&&(t=e.length);for(var r=0,n=Array(t);r<t;r++)n[r]=e[r];return n}function l(e,t,r,n,o,i,a){try{var u=e[i](a),c=u.value}catch(e){r(e);return}u.done?t(c):Promise.resolve(c).then(n,o)}function s(e){return function(){var t=this,r=arguments;return new Promise(function(n,o){var i=e.apply(t,r);function a(e){l(i,n,o,a,u,"next",e)}function u(e){l(i,n,o,a,u,"throw",e)}a(void 0)})}}function f(e,t){return null!=t&&"u">typeof Symbol&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):e instanceof t}function d(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var r,n,o=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=o){var i=[],a=!0,u=!1;try{for(o=o.call(e);!(a=(r=o.next()).done)&&(i.push(r.value),!t||i.length!==t);a=!0);}catch(e){u=!0,n=e}finally{try{a||null==o.return||o.return()}finally{if(u)throw n}}return i}}(e,t)||function(e,t){if(e){if("string"==typeof e)return c(e,t);var r=Object.prototype.toString.call(e).slice(8,-1);if("Object"===r&&e.constructor&&(r=e.constructor.name),"Map"===r||"Set"===r)return Array.from(r);if("Arguments"===r||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(r))return c(e,t)}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function y(e,t){var r,n,o,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},a=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),u=Object.defineProperty;return u(a,"next",{value:c(0)}),u(a,"throw",{value:c(1)}),u(a,"return",{value:c(2)}),"function"==typeof Symbol&&u(a,Symbol.iterator,{value:function(){return this}}),a;function c(u){return function(c){var l=[u,c];if(r)throw TypeError("Generator is already executing.");for(;a&&(a=0,l[0]&&(i=0)),i;)try{if(r=1,n&&(o=2&l[0]?n.return:l[0]?n.throw||((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,l[1])).done)return o;switch(n=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return i.label++,{value:l[1],done:!1};case 5:i.label++,n=l[1],l=[0];continue;case 7:l=i.ops.pop(),i.trys.pop();continue;default:if(!(o=(o=i.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){i=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){i.label=l[1];break}if(6===l[0]&&i.label<o[1]){i.label=o[1],o=l;break}if(o&&i.label<o[2]){i.label=o[2],i.ops.push(l);break}o[2]&&i.ops.pop(),i.trys.pop();continue}l=t.call(e,i)}catch(e){l=[6,e],n=0}finally{r=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}}function h(e,t){return f(e,Error)?e.message:t}var m=function(){var i=(0,e.useAPIClient)(),a=(0,e.useApp)(),u=(0,o.useNavigate)(),c=(0,o.useParams)(),l=d((0,r.useState)(!0),2),p=l[0],m=l[1],v=d((0,r.useState)(null),2),b=v[0],g=v[1],w=d((0,r.useState)(null),2),x=w[0],E=w[1],S=(0,r.useMemo)(function(){return c.uid?"main"===a.name?"idpOAuth/interaction/".concat(c.uid):"__app/".concat(a.name,"/idpOAuth/interaction/").concat(c.uid):null},[a.name,c.uid]),_=(0,r.useMemo)(function(){return c.uid?"/idp-oauth/interaction/".concat(c.uid):"/signin"},[c.uid]),O=(0,r.useCallback)(function(e,t){return s(function(){var r,n,o,a,c;return y(this,function(l){switch(l.label){case 0:if(!S)return g("Invalid interaction path"),m(!1),[2];return n=i.auth.getToken(),o=i.auth.getAuthenticator()||"basic",[4,i.request({url:S,method:e,skipNotify:!0,withCredentials:!0,data:"post"===e?t:void 0,headers:n?{Authorization:"Bearer ".concat(n),"X-Authenticator":o}:void 0})];case 1:if(null==(c=(null==(a=l.sent())||null==(r=a.data)?void 0:r.data)||(null==a?void 0:a.data))?void 0:c.redirectTo)return window.location.replace(c.redirectTo),[2];if((null==c?void 0:c.prompt)!=="login")return[3,4];if(!n)return u("/signin?redirect=".concat(encodeURIComponent(_)),{replace:!0}),[2];if("get"!==e)return[3,3];return[4,O("post")];case 2:return l.sent(),[2];case 3:return u("/signin?redirect=".concat(encodeURIComponent(_)),{replace:!0}),[2];case 4:return E(c),m(!1),[2]}})})()},[i,_,S,u]),j=(0,r.useCallback)(function(){var e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];return s(function(){return y(this,function(t){switch(t.label){case 0:m(!0),g(null),t.label=1;case 1:return t.trys.push([1,3,,4]),[4,O("post",e?{cancel:1}:{submit:1})];case 2:return t.sent(),[3,4];case 3:return g(h(t.sent(),"Failed to submit interaction")),m(!1),[3,4];case 4:return[2]}})})()},[O]);return((0,r.useEffect)(function(){var e=!1;return s(function(){var t;return y(this,function(r){switch(r.label){case 0:return r.trys.push([0,2,,3]),[4,O("get")];case 1:return r.sent(),[3,3];case 2:return t=r.sent(),e||(g(h(t,"Failed to load interaction")),m(!1)),[3,3];case 3:return[2]}})})(),function(){e=!0}},[O]),(0,r.useEffect)(function(){if((null==x?void 0:x.prompt)==="consent"&&!p){var e=function(e){if(!e.defaultPrevented){var t=e.target;if(null==t||!t.closest('input, textarea, select, [contenteditable="true"]')){if("Enter"===e.key&&!e.shiftKey&&!e.ctrlKey&&!e.metaKey&&!e.altKey){var r=document.activeElement;if(f(r,HTMLButtonElement)||f(r,HTMLAnchorElement))return;e.preventDefault(),j(!1);return}"Escape"===e.key&&(e.preventDefault(),j(!0))}}};return window.addEventListener("keydown",e),function(){return window.removeEventListener("keydown",e)}}},[null==x?void 0:x.prompt,p,j]),p)?n().createElement("div",{style:{position:"fixed",inset:0,display:"flex",alignItems:"center",justifyContent:"center"}},n().createElement(t.Spin,{style:{fontSize:72}})):b?n().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},n().createElement(t.Alert,{type:"error",message:b,showIcon:!0})):(null==x?void 0:x.prompt)==="consent"?n().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},n().createElement(t.Card,null,n().createElement(t.Space,{direction:"vertical",size:"large",style:{width:"100%"}},n().createElement("div",null,n().createElement(t.Typography.Title,{level:3,style:{marginBottom:8}},"Authorize application"),n().createElement(t.Typography.Paragraph,{style:{marginBottom:0}},x.clientName||"Application"," requests access to your account.")),x.details?n().createElement(t.Alert,{type:"info",showIcon:!0,message:"Requested permissions",description:x.details}):null,n().createElement(t.Space,null,n().createElement(t.Button,{type:"primary",loading:p,onClick:function(){return j(!1)}},"Continue"),n().createElement(t.Button,{loading:p,onClick:function(){return j(!0)}},"Cancel"))))):n().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},n().createElement(t.Result,{title:"Redirecting...",subTitle:"Please wait while authorization continues."}))},v={};function b(e,t,r,n,o,i,a){try{var u=e[i](a),c=u.value}catch(e){r(e);return}u.done?t(c):Promise.resolve(c).then(n,o)}function g(e,t,r){return(g=S()?Reflect.construct:function(e,t,r){var n=[null];n.push.apply(n,t);var o=new(Function.bind.apply(e,n));return r&&x(o,r.prototype),o}).apply(null,arguments)}function w(e){return(w=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__||Object.getPrototypeOf(e)})(e)}function x(e,t){return(x=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e})(e,t)}function E(e){var t="function"==typeof Map?new Map:void 0;return(E=function(e){if(null===e||-1===Function.toString.call(e).indexOf("[native code]"))return e;if("function"!=typeof e)throw TypeError("Super expression must either be null or a function");if(void 0!==t){if(t.has(e))return t.get(e);t.set(e,r)}function r(){return g(e,arguments,w(this).constructor)}return r.prototype=Object.create(e.prototype,{constructor:{value:r,enumerable:!1,writable:!0,configurable:!0}}),x(r,e)})(e)}function S(){try{var e=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){}))}catch(e){}return(S=function(){return!!e})()}var _=function(e){var t;if("function"!=typeof e&&null!==e)throw TypeError("Super expression must either be null or a function");function r(){var e,t;if(!(this instanceof r))throw TypeError("Cannot call a class as a function");return e=r,t=arguments,e=w(e),function(e,t){var r;if(t&&("object"==((r=t)&&"u">typeof Symbol&&r.constructor===Symbol?"symbol":typeof r)||"function"==typeof t))return t;if(void 0===e)throw ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(this,S()?Reflect.construct(e,t||[],w(this).constructor):e.apply(this,t))}return r.prototype=Object.create(e&&e.prototype,{constructor:{value:r,writable:!0,configurable:!0}}),e&&x(r,e),t=[{key:"load",value:function(){var e;return(e=function(){var e;return function(e,t){var r,n,o,i={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},a=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),u=Object.defineProperty;return u(a,"next",{value:c(0)}),u(a,"throw",{value:c(1)}),u(a,"return",{value:c(2)}),"function"==typeof Symbol&&u(a,Symbol.iterator,{value:function(){return this}}),a;function c(u){return function(c){var l=[u,c];if(r)throw TypeError("Generator is already executing.");for(;a&&(a=0,l[0]&&(i=0)),i;)try{if(r=1,n&&(o=2&l[0]?n.return:l[0]?n.throw||((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,l[1])).done)return o;switch(n=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return i.label++,{value:l[1],done:!1};case 5:i.label++,n=l[1],l=[0];continue;case 7:l=i.ops.pop(),i.trys.pop();continue;default:if(!(o=(o=i.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){i=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){i.label=l[1];break}if(6===l[0]&&i.label<o[1]){i.label=o[1],o=l;break}if(o&&i.label<o[2]){i.label=o[2],i.ops.push(l);break}o[2]&&i.ops.pop(),i.trys.pop();continue}l=t.call(e,i)}catch(e){l=[6,e],n=0}finally{r=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}}(this,function(t){return e=this,e.flowEngine.registerModels(v),e.router.add("idp-oauth.interaction",{path:"/idp-oauth/interaction/:uid",Component:m,skipAuthCheck:!0}),e.router.add("idp-oauth.error",{path:"/idp-oauth/error",Component:u,skipAuthCheck:!0}),[2]})},function(){var t=this,r=arguments;return new Promise(function(n,o){var i=e.apply(t,r);function a(e){b(i,n,o,a,u,"next",e)}function u(e){b(i,n,o,a,u,"throw",e)}a(void 0)})}).call(this)}}],function(e,t){for(var r=0;r<t.length;r++){var n=t[r];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(e,n.key,n)}}(r.prototype,t),r}(E(e.Plugin))}(),p}()});
+!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("react"),require("antd"),require("@nocobase/client"),require("react-router-dom"),require("@nocobase/flow-engine")):"function"==typeof define&&define.amd?define("@nocobase/plugin-idp-oauth",["react","antd","@nocobase/client","react-router-dom","@nocobase/flow-engine"],t):"object"==typeof exports?exports["@nocobase/plugin-idp-oauth"]=t(require("react"),require("antd"),require("@nocobase/client"),require("react-router-dom"),require("@nocobase/flow-engine")):e["@nocobase/plugin-idp-oauth"]=t(e.react,e.antd,e["@nocobase/client"],e["react-router-dom"],e["@nocobase/flow-engine"])}(self,function(e,t,n,r,o){return function(){"use strict";var a={342:function(e){e.exports=n},694:function(e){e.exports=o},59:function(e){e.exports=t},155:function(t){t.exports=e},442:function(e){e.exports=r}},i={};function u(e){var t=i[e];if(void 0!==t)return t.exports;var n=i[e]={exports:{}};return a[e](n,n.exports,u),n.exports}u.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return u.d(t,{a:t}),t},u.d=function(e,t){for(var n in t)u.o(t,n)&&!u.o(e,n)&&Object.defineProperty(e,n,{enumerable:!0,get:t[n]})},u.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||Function("return this")()}catch(e){if("object"==typeof window)return window}}(),u.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},u.r=function(e){"u">typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},u.g.importScripts&&(c=u.g.location+"");var c,l=u.g.document;if(!c&&l&&(l.currentScript&&"SCRIPT"===l.currentScript.tagName.toUpperCase()&&(c=l.currentScript.src),!c)){var s=l.getElementsByTagName("script");if(s.length)for(var p=s.length-1;p>-1&&(!c||!/^http(s?):/.test(c));)c=s[p--].src}if(!c)throw Error("Automatic publicPath is not supported in this browser");u.p=c.replace(/^blob:/,"").replace(/#.*$/,"").replace(/\?.*$/,"").replace(/\/[^\/]+$/,"/");var f={};return!function(){var e="",t="u">typeof document?document.currentScript:null;if(t&&t.src){var n=t.src.replace(/^blob:/,"").replace(/#.*$/,"").replace(/\?.*$/,"");n.indexOf("/static/plugins/@nocobase/plugin-idp-oauth/dist/client/")>=0&&(e=n.replace(/\/[^\/]+$/,"/"))}if(!e){var r=window.__webpack_public_path__||"";r&&("/"!==r.charAt(r.length-1)&&(r+="/"),e=r+"static/plugins/@nocobase/plugin-idp-oauth/dist/client/")}if(!e){var o=window.__nocobase_modern_client_prefix__||"v",a="/"+(o=String(o).replace(/^\/+|\/+$/g,"")||"v")+"/";if(!(e=window.__nocobase_public_path__||"")&&window.location&&window.location.pathname){var i=window.location.pathname||"/",c=i.indexOf(a);e=c>=0?i.slice(0,c+1):"/"}e&&(e=e.replace(RegExp("/"+o+"/?$"),"/")),e||(e="/"),"/"!==e.charAt(e.length-1)&&(e+="/"),e+="static/plugins/@nocobase/plugin-idp-oauth/dist/client/"}u.p=e}(),!function(){u.r(f),u.d(f,{default:function(){return B}});var e=u(342),t=u(59),n=u(155),r=u.n(n),o=u(442),a=u(694),i=JSON.parse('{"UU":"@nocobase/plugin-idp-oauth"}');function c(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function l(e,t,n,r,o,a,i){try{var u=e[a](i),c=u.value}catch(e){n(e);return}u.done?t(c):Promise.resolve(c).then(r,o)}function s(e){return function(){var t=this,n=arguments;return new Promise(function(r,o){var a=e.apply(t,n);function i(e){l(a,r,o,i,u,"next",e)}function u(e){l(a,r,o,i,u,"throw",e)}i(void 0)})}}function p(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n,r,o=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=o){var a=[],i=!0,u=!1;try{for(o=o.call(e);!(i=(n=o.next()).done)&&(a.push(n.value),!t||a.length!==t);i=!0);}catch(e){u=!0,r=e}finally{try{i||null==o.return||o.return()}finally{if(u)throw r}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return c(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);if("Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n)return Array.from(n);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return c(e,t)}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function d(e,t){var n,r,o,a={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},i=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),u=Object.defineProperty;return u(i,"next",{value:c(0)}),u(i,"throw",{value:c(1)}),u(i,"return",{value:c(2)}),"function"==typeof Symbol&&u(i,Symbol.iterator,{value:function(){return this}}),i;function c(u){return function(c){var l=[u,c];if(n)throw TypeError("Generator is already executing.");for(;i&&(i=0,l[0]&&(a=0)),a;)try{if(n=1,r&&(o=2&l[0]?r.return:l[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,l[1])).done)return o;switch(r=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return a.label++,{value:l[1],done:!1};case 5:a.label++,r=l[1],l=[0];continue;case 7:l=a.ops.pop(),a.trys.pop();continue;default:if(!(o=(o=a.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){a=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){a.label=l[1];break}if(6===l[0]&&a.label<o[1]){a.label=o[1],o=l;break}if(o&&a.label<o[2]){a.label=o[2],a.ops.push(l);break}o[2]&&a.ops.pop(),a.trys.pop();continue}l=t.call(e,a)}catch(e){l=[6,e],r=0}finally{n=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}}function y(e,t){var n;return(null!=(n=Error)&&"u">typeof Symbol&&n[Symbol.hasInstance]?!!n[Symbol.hasInstance](e):e instanceof n)?e.message:t}var m=function(){var u,c=(0,e.useAPIClient)(),l=(0,e.useApp)(),f=(0,o.useLocation)(),m=(0,o.useNavigate)(),h=(u=(0,a.useFlowEngine)(),(0,n.useCallback)(function(e,t){return u.context.t(e,function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{},r=Object.keys(n);"function"==typeof Object.getOwnPropertySymbols&&(r=r.concat(Object.getOwnPropertySymbols(n).filter(function(e){return Object.getOwnPropertyDescriptor(n,e).enumerable}))),r.forEach(function(t){var r;r=n[t],t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r})}return e}({ns:[i.UU,"client"]},t))},[u])),v=p((0,o.useSearchParams)(),2),b=v[0],g=v[1],w=p((0,n.useState)(!0),2),E=w[0],x=w[1],S=p((0,n.useState)(!1),2),O=S[0],C=S[1],_=p((0,n.useState)(null),2),T=_[0],A=_[1],k=p((0,n.useState)(null),2),j=k[0],I=k[1],P=b.get("user_code")||void 0,B=(0,n.useCallback)(function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:"",t=arguments.length>1?arguments[1]:void 0;return s(function(){var n,r;return d(this,function(o){switch(o.label){case 0:return[4,c.request({url:function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"";return"".concat("main"===e?"":"__app/".concat(e,"/"),"idpOAuth/device/verification").concat(t)}(l.name,e),method:e?"post":"get",skipNotify:!0,params:e?void 0:{user_code:P},data:t})];case 1:return[2,(null==(r=o.sent())||null==(n=r.data)?void 0:n.data)||(null==r?void 0:r.data)]}})})()},[c,l.name,P]),q=(0,n.useCallback)(function(){return s(function(){var e;return d(this,function(t){switch(t.label){case 0:x(!0),A(null),t.label=1;case 1:return t.trys.push([1,3,4,5]),[4,B()];case 2:if(I(e=t.sent()),"login"===e.status){var n,r,o,a;return m("/signin?redirect=".concat(encodeURIComponent((n=f.pathname,r=f.search,a=(o=e.userCode||P)?"?user_code=".concat(encodeURIComponent(o)):r,"".concat(n).concat(a)))),{replace:!0}),[2]}return[3,5];case 3:return A(y(t.sent(),h("Failed to load device sign-in."))),[3,5];case 4:return x(!1),[7];case 5:return[2]}})})()},[f.pathname,f.search,m,B,h,P]);(0,n.useEffect)(function(){q()},[q]);var R=(0,n.useCallback)(function(e){var t=e.user_code,n=null==t?void 0:t.trim();n&&g({user_code:n})},[g]),M=(0,n.useCallback)(function(e){return s(function(){return d(this,function(t){switch(t.label){case 0:C(!0),A(null),t.label=1;case 1:return t.trys.push([1,3,4,5]),[4,B(e,{user_code:(null==j?void 0:j.userCode)||P})];case 2:return I(t.sent()),[3,5];case 3:return A(y(t.sent(),h("Failed to submit device sign-in."))),[3,5];case 4:return C(!1),[7];case 5:return[2]}})})()},[null==j?void 0:j.userCode,B,h,P]);if(E)return r().createElement("div",{style:{position:"fixed",inset:0,display:"flex",alignItems:"center",justifyContent:"center"}},r().createElement(t.Spin,{style:{fontSize:72}}));if(T)return r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Alert,{type:"error",message:T,showIcon:!0}));if(!j||"missing_code"===j.status)return r().createElement("div",{style:{maxWidth:440,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Card,null,r().createElement(t.Space,{direction:"vertical",size:"large",style:{width:"100%"}},r().createElement("div",null,r().createElement(t.Typography.Title,{level:3,style:{marginBottom:8}},h("Device sign-in")),r().createElement(t.Typography.Paragraph,{style:{marginBottom:0}},h("Enter the code shown in your terminal to continue signing in."))),r().createElement(t.Form,{layout:"vertical",onFinish:R},r().createElement(t.Form.Item,{name:"user_code",rules:[{required:!0,message:h("Enter the device code.")}]},r().createElement(t.Input,{autoFocus:!0,size:"large",style:{textTransform:"uppercase"}})),r().createElement(t.Button,{type:"primary",htmlType:"submit",block:!0},h("Continue"))))));if("complete"===j.status)return r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Result,{status:"success",title:h("Device sign-in complete"),subTitle:h("Authorization is complete. You can return to the terminal."),extra:r().createElement(t.Button,{type:"primary",onClick:function(){return m("/")}},h("Back to home"))}));if("cancelled"===j.status)return r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Result,{status:"warning",title:h("Device sign-in cancelled"),subTitle:h("The device sign-in request was cancelled.")}));if("pending"!==j.status){var F={not_found:h("The device code was not found."),expired:h("The device code has expired."),already_used:h("The device code has already been used.")};return r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Result,{status:"error",title:h("Device sign-in failed"),subTitle:F[j.status]}))}return r().createElement("div",{style:{maxWidth:520,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Card,null,r().createElement(t.Space,{direction:"vertical",size:"large",style:{width:"100%"}},r().createElement("div",null,r().createElement(t.Typography.Title,{level:3,style:{marginBottom:8}},h("Confirm device")),r().createElement(t.Typography.Paragraph,{style:{marginBottom:0}},h("{{clientName}} is requesting access. Confirm that this code matches the one shown in your terminal.",{clientName:j.clientName||h("Application")}))),r().createElement(t.Typography.Title,{level:2,style:{margin:0,letterSpacing:"0.08em",textAlign:"center"}},j.userCode),r().createElement(t.Space,null,r().createElement(t.Button,{type:"primary",loading:O,onClick:function(){return M(":approve")}},h("Continue")),r().createElement(t.Button,{loading:O,onClick:function(){return M(":cancel")}},h("Cancel"))))))};function h(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}var v=function(){var e,n=(function(e){if(Array.isArray(e))return e}(e=(0,o.useSearchParams)())||function(e){var t,n,r=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=r){var o=[],a=!0,i=!1;try{for(r=r.call(e);!(a=(t=r.next()).done)&&(o.push(t.value),1!==o.length);a=!0);}catch(e){i=!0,n=e}finally{try{a||null==r.return||r.return()}finally{if(i)throw n}}return o}}(e)||function(e){if(e){if("string"==typeof e)return h(e,1);var t=Object.prototype.toString.call(e).slice(8,-1);if("Object"===t&&e.constructor&&(t=e.constructor.name),"Map"===t||"Set"===t)return Array.from(t);if("Arguments"===t||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t))return h(e,1)}}(e)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}())[0],a=n.get("error"),i=n.get("error_description"),u=n.get("iss");return r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Result,{status:"error",title:a||"Authentication failed",subTitle:i||void 0}),r().createElement(t.Space,{direction:"vertical",size:"middle",style:{width:"100%"}},u?r().createElement("div",null,r().createElement(t.Typography.Text,{type:"secondary"},"Issuer"),r().createElement("div",null,r().createElement(t.Typography.Text,{code:!0},u))):null))};function b(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function g(e,t,n,r,o,a,i){try{var u=e[a](i),c=u.value}catch(e){n(e);return}u.done?t(c):Promise.resolve(c).then(r,o)}function w(e){return function(){var t=this,n=arguments;return new Promise(function(r,o){var a=e.apply(t,n);function i(e){g(a,r,o,i,u,"next",e)}function u(e){g(a,r,o,i,u,"throw",e)}i(void 0)})}}function E(e,t){return null!=t&&"u">typeof Symbol&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):e instanceof t}function x(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n,r,o=null==e?null:"u">typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=o){var a=[],i=!0,u=!1;try{for(o=o.call(e);!(i=(n=o.next()).done)&&(a.push(n.value),!t||a.length!==t);i=!0);}catch(e){u=!0,r=e}finally{try{i||null==o.return||o.return()}finally{if(u)throw r}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return b(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);if("Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n)return Array.from(n);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return b(e,t)}}(e,t)||function(){throw TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function S(e,t){var n,r,o,a={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},i=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),u=Object.defineProperty;return u(i,"next",{value:c(0)}),u(i,"throw",{value:c(1)}),u(i,"return",{value:c(2)}),"function"==typeof Symbol&&u(i,Symbol.iterator,{value:function(){return this}}),i;function c(u){return function(c){var l=[u,c];if(n)throw TypeError("Generator is already executing.");for(;i&&(i=0,l[0]&&(a=0)),a;)try{if(n=1,r&&(o=2&l[0]?r.return:l[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,l[1])).done)return o;switch(r=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return a.label++,{value:l[1],done:!1};case 5:a.label++,r=l[1],l=[0];continue;case 7:l=a.ops.pop(),a.trys.pop();continue;default:if(!(o=(o=a.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){a=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){a.label=l[1];break}if(6===l[0]&&a.label<o[1]){a.label=o[1],o=l;break}if(o&&a.label<o[2]){a.label=o[2],a.ops.push(l);break}o[2]&&a.ops.pop(),a.trys.pop();continue}l=t.call(e,a)}catch(e){l=[6,e],r=0}finally{n=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}}function O(e,t){return E(e,Error)?e.message:t}var C=function(){var a=(0,e.useAPIClient)(),i=(0,e.useApp)(),u=(0,o.useNavigate)(),c=(0,o.useParams)(),l=x((0,n.useState)(!0),2),s=l[0],p=l[1],f=x((0,n.useState)(null),2),d=f[0],y=f[1],m=x((0,n.useState)(null),2),h=m[0],v=m[1],b=(0,n.useMemo)(function(){return c.uid?"main"===i.name?"idpOAuth/interaction/".concat(c.uid):"__app/".concat(i.name,"/idpOAuth/interaction/").concat(c.uid):null},[i.name,c.uid]),g=(0,n.useMemo)(function(){return c.uid?"/idp-oauth/interaction/".concat(c.uid):"/signin"},[c.uid]),C=(0,n.useCallback)(function(e,t){return w(function(){var n,r,o,i,c;return S(this,function(l){switch(l.label){case 0:if(!b)return y("Invalid interaction path"),p(!1),[2];return r=a.auth.getToken(),o=a.auth.getAuthenticator()||"basic",[4,a.request({url:b,method:e,skipNotify:!0,withCredentials:!0,data:"post"===e?t:void 0,headers:r?{Authorization:"Bearer ".concat(r),"X-Authenticator":o}:void 0})];case 1:if(null==(c=(null==(i=l.sent())||null==(n=i.data)?void 0:n.data)||(null==i?void 0:i.data))?void 0:c.redirectTo)return window.location.replace(c.redirectTo),[2];if((null==c?void 0:c.prompt)!=="login")return[3,4];if(!r)return u("/signin?redirect=".concat(encodeURIComponent(g)),{replace:!0}),[2];if("get"!==e)return[3,3];return[4,C("post")];case 2:return l.sent(),[2];case 3:return u("/signin?redirect=".concat(encodeURIComponent(g)),{replace:!0}),[2];case 4:return v(c),p(!1),[2]}})})()},[a,g,b,u]),_=(0,n.useCallback)(function(){var e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];return w(function(){return S(this,function(t){switch(t.label){case 0:p(!0),y(null),t.label=1;case 1:return t.trys.push([1,3,,4]),[4,C("post",e?{cancel:1}:{submit:1})];case 2:return t.sent(),[3,4];case 3:return y(O(t.sent(),"Failed to submit interaction")),p(!1),[3,4];case 4:return[2]}})})()},[C]);return((0,n.useEffect)(function(){var e=!1;return w(function(){var t;return S(this,function(n){switch(n.label){case 0:return n.trys.push([0,2,,3]),[4,C("get")];case 1:return n.sent(),[3,3];case 2:return t=n.sent(),e||(y(O(t,"Failed to load interaction")),p(!1)),[3,3];case 3:return[2]}})})(),function(){e=!0}},[C]),(0,n.useEffect)(function(){if((null==h?void 0:h.prompt)==="consent"&&!s){var e=function(e){if(!e.defaultPrevented){var t=e.target;if(null==t||!t.closest('input, textarea, select, [contenteditable="true"]')){if("Enter"===e.key&&!e.shiftKey&&!e.ctrlKey&&!e.metaKey&&!e.altKey){var n=document.activeElement;if(E(n,HTMLButtonElement)||E(n,HTMLAnchorElement))return;e.preventDefault(),_(!1);return}"Escape"===e.key&&(e.preventDefault(),_(!0))}}};return window.addEventListener("keydown",e),function(){return window.removeEventListener("keydown",e)}}},[null==h?void 0:h.prompt,s,_]),s)?r().createElement("div",{style:{position:"fixed",inset:0,display:"flex",alignItems:"center",justifyContent:"center"}},r().createElement(t.Spin,{style:{fontSize:72}})):d?r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Alert,{type:"error",message:d,showIcon:!0})):(null==h?void 0:h.prompt)==="consent"?r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Card,null,r().createElement(t.Space,{direction:"vertical",size:"large",style:{width:"100%"}},r().createElement("div",null,r().createElement(t.Typography.Title,{level:3,style:{marginBottom:8}},"Authorize application"),r().createElement(t.Typography.Paragraph,{style:{marginBottom:0}},h.clientName||"Application"," requests access to your account.")),h.details?r().createElement(t.Alert,{type:"info",showIcon:!0,message:"Requested permissions",description:h.details}):null,r().createElement(t.Space,null,r().createElement(t.Button,{type:"primary",loading:s,onClick:function(){return _(!1)}},"Continue"),r().createElement(t.Button,{loading:s,onClick:function(){return _(!0)}},"Cancel"))))):r().createElement("div",{style:{maxWidth:640,margin:"48px auto",padding:"0 24px"}},r().createElement(t.Result,{title:"Redirecting...",subTitle:"Please wait while authorization continues."}))},_={};function T(e,t,n,r,o,a,i){try{var u=e[a](i),c=u.value}catch(e){n(e);return}u.done?t(c):Promise.resolve(c).then(r,o)}function A(e,t,n){return(A=P()?Reflect.construct:function(e,t,n){var r=[null];r.push.apply(r,t);var o=new(Function.bind.apply(e,r));return n&&j(o,n.prototype),o}).apply(null,arguments)}function k(e){return(k=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__||Object.getPrototypeOf(e)})(e)}function j(e,t){return(j=Object.setPrototypeOf||function(e,t){return e.__proto__=t,e})(e,t)}function I(e){var t="function"==typeof Map?new Map:void 0;return(I=function(e){if(null===e||-1===Function.toString.call(e).indexOf("[native code]"))return e;if("function"!=typeof e)throw TypeError("Super expression must either be null or a function");if(void 0!==t){if(t.has(e))return t.get(e);t.set(e,n)}function n(){return A(e,arguments,k(this).constructor)}return n.prototype=Object.create(e.prototype,{constructor:{value:n,enumerable:!1,writable:!0,configurable:!0}}),j(n,e)})(e)}function P(){try{var e=!Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){}))}catch(e){}return(P=function(){return!!e})()}var B=function(e){var t;if("function"!=typeof e&&null!==e)throw TypeError("Super expression must either be null or a function");function n(){var e,t;if(!(this instanceof n))throw TypeError("Cannot call a class as a function");return e=n,t=arguments,e=k(e),function(e,t){var n;if(t&&("object"==((n=t)&&"u">typeof Symbol&&n.constructor===Symbol?"symbol":typeof n)||"function"==typeof t))return t;if(void 0===e)throw ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(this,P()?Reflect.construct(e,t||[],k(this).constructor):e.apply(this,t))}return n.prototype=Object.create(e&&e.prototype,{constructor:{value:n,writable:!0,configurable:!0}}),e&&j(n,e),t=[{key:"load",value:function(){var e;return(e=function(){var e;return function(e,t){var n,r,o,a={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]},i=Object.create(("function"==typeof Iterator?Iterator:Object).prototype),u=Object.defineProperty;return u(i,"next",{value:c(0)}),u(i,"throw",{value:c(1)}),u(i,"return",{value:c(2)}),"function"==typeof Symbol&&u(i,Symbol.iterator,{value:function(){return this}}),i;function c(u){return function(c){var l=[u,c];if(n)throw TypeError("Generator is already executing.");for(;i&&(i=0,l[0]&&(a=0)),a;)try{if(n=1,r&&(o=2&l[0]?r.return:l[0]?r.throw||((o=r.return)&&o.call(r),0):r.next)&&!(o=o.call(r,l[1])).done)return o;switch(r=0,o&&(l=[2&l[0],o.value]),l[0]){case 0:case 1:o=l;break;case 4:return a.label++,{value:l[1],done:!1};case 5:a.label++,r=l[1],l=[0];continue;case 7:l=a.ops.pop(),a.trys.pop();continue;default:if(!(o=(o=a.trys).length>0&&o[o.length-1])&&(6===l[0]||2===l[0])){a=0;continue}if(3===l[0]&&(!o||l[1]>o[0]&&l[1]<o[3])){a.label=l[1];break}if(6===l[0]&&a.label<o[1]){a.label=o[1],o=l;break}if(o&&a.label<o[2]){a.label=o[2],a.ops.push(l);break}o[2]&&a.ops.pop(),a.trys.pop();continue}l=t.call(e,a)}catch(e){l=[6,e],r=0}finally{n=o=0}if(5&l[0])throw l[1];return{value:l[0]?l[1]:void 0,done:!0}}}}(this,function(t){return e=this,e.flowEngine.registerModels(_),e.router.add("idp-oauth.interaction",{path:"/idp-oauth/interaction/:uid",Component:C,skipAuthCheck:!0}),e.router.add("idp-oauth.device",{path:"/idpOAuth/device",Component:m,skipAuthCheck:!0}),e.router.add("idp-oauth.error",{path:"/idp-oauth/error",Component:v,skipAuthCheck:!0}),[2]})},function(){var t=this,n=arguments;return new Promise(function(r,o){var a=e.apply(t,n);function i(e){T(a,r,o,i,u,"next",e)}function u(e){T(a,r,o,i,u,"throw",e)}i(void 0)})}).call(this)}}],function(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}(n.prototype,t),n}(I(e.Plugin))}(),f}()});

package/dist/client/locale.d.ts

@@ -6,5 +6,5 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-export declare function useT(): (str: string) => string;
+export declare function useT(): (str: string, options?: Record<string, unknown>) => string;
 export declare function tExpr(key: string): string;

package/dist/externalVersion.js

@@ -8,14 +8,14 @@
  */
 
 module.exports = {
+  "@nocobase/client": "2.2.0-beta.8",
   "antd": "5.24.2",
   "react": "18.2.0",
   "react-router-dom": "6.30.1",
-  "@nocobase/client": "2.2.0-beta.7",
-  "@nocobase/flow-engine": "2.2.0-beta.7",
-  "@nocobase/server": "2.2.0-beta.7",
-  "@nocobase/cache": "2.2.0-beta.7",
-  "@nocobase/plugin-auth": "2.2.0-beta.7",
-  "@nocobase/utils": "2.2.0-beta.7",
-  "@nocobase/database": "2.2.0-beta.7"
+  "@nocobase/flow-engine": "2.2.0-beta.8",
+  "@nocobase/server": "2.2.0-beta.8",
+  "@nocobase/cache": "2.2.0-beta.8",
+  "@nocobase/plugin-auth": "2.2.0-beta.8",
+  "@nocobase/utils": "2.2.0-beta.8",
+  "@nocobase/database": "2.2.0-beta.8"
 };

package/dist/locale/en-US.json

@@ -1 +1,21 @@
-{}
+{
+  "Application": "Application",
+  "Authorization is complete. You can return to the terminal.": "Authorization is complete. You can return to the terminal.",
+  "Back to home": "Back to home",
+  "Cancel": "Cancel",
+  "Confirm device": "Confirm device",
+  "Continue": "Continue",
+  "Device sign-in": "Device sign-in",
+  "Device sign-in cancelled": "Device sign-in cancelled",
+  "Device sign-in complete": "Device sign-in complete",
+  "Device sign-in failed": "Device sign-in failed",
+  "Enter the code shown in your terminal to continue signing in.": "Enter the code shown in your terminal to continue signing in.",
+  "Enter the device code.": "Enter the device code.",
+  "Failed to load device sign-in.": "Failed to load device sign-in.",
+  "Failed to submit device sign-in.": "Failed to submit device sign-in.",
+  "The device code has already been used.": "The device code has already been used.",
+  "The device code has expired.": "The device code has expired.",
+  "The device code was not found.": "The device code was not found.",
+  "The device sign-in request was cancelled.": "The device sign-in request was cancelled.",
+  "{{clientName}} is requesting access. Confirm that this code matches the one shown in your terminal.": "{{clientName}} is requesting access. Confirm that this code matches the one shown in your terminal."
+}

package/dist/locale/zh-CN.json

@@ -1 +1,21 @@
-{}
+{
+  "Application": "应用",
+  "Authorization is complete. You can return to the terminal.": "授权已完成。你可以返回终端。",
+  "Back to home": "返回首页",
+  "Cancel": "取消",
+  "Confirm device": "确认设备",
+  "Continue": "继续",
+  "Device sign-in": "设备登录",
+  "Device sign-in cancelled": "设备登录已取消",
+  "Device sign-in complete": "设备登录完成",
+  "Device sign-in failed": "设备登录失败",
+  "Enter the code shown in your terminal to continue signing in.": "输入终端中显示的代码以继续登录。",
+  "Enter the device code.": "请输入设备代码。",
+  "Failed to load device sign-in.": "加载设备登录失败。",
+  "Failed to submit device sign-in.": "提交设备登录失败。",
+  "The device code has already been used.": "设备代码已被使用。",
+  "The device code has expired.": "设备代码已过期。",
+  "The device code was not found.": "未找到设备代码。",
+  "The device sign-in request was cancelled.": "设备登录请求已取消。",
+  "{{clientName}} is requesting access. Confirm that this code matches the one shown in your terminal.": "{{clientName}} 正在请求访问。请确认此代码与终端中显示的代码一致。"
+}

package/dist/node_modules/light-my-request/package.json

@@ -1 +1 @@
-{"name":"light-my-request","version":"6.6.0","description":"Fake HTTP injection library","main":"index.js","type":"commonjs","types":"types/index.d.ts","dependencies":{"cookie":"^1.0.1","process-warning":"^4.0.0","set-cookie-parser":"^2.6.0"},"devDependencies":{"@fastify/ajv-compiler":"^4.0.0","@fastify/pre-commit":"^2.1.0","@types/node":"^22.7.7","c8":"^10.1.2","end-of-stream":"^1.4.4","eslint":"^9.17.0","express":"^4.19.2","form-auto-content":"^3.2.1","form-data":"^4.0.0","formdata-node":"^6.0.3","multer":"^1.4.5-lts.1","neostandard":"^0.12.0","tinybench":"^3.0.0","tsd":"^0.31.0","undici":"^7.0.0"},"scripts":{"benchmark":"node benchmark/benchmark.js","coverage":"npm run unit -- --cov --coverage-report=html","lint":"eslint","lint:fix":"eslint --fix","test":"npm run lint && npm run test:unit && npm run test:typescript","test:typescript":"tsd","test:unit":"c8 --100 node --test"},"repository":{"type":"git","url":"git+https://github.com/fastify/light-my-request.git"},"keywords":["http","inject","fake","request","server"],"author":"Tomas Della Vedova - @delvedor (http://delved.org)","contributors":[{"name":"Matteo Collina","email":"hello@matteocollina.com"},{"name":"Manuel Spigolon","email":"behemoth89@gmail.com"},{"name":"Aras Abbasi","email":"aras.abbasi@gmail.com"},{"name":"Frazer Smith","email":"frazer.dev@icloud.com","url":"https://github.com/fdawgs"}],"license":"BSD-3-Clause","bugs":{"url":"https://github.com/fastify/light-my-request/issues"},"homepage":"https://github.com/fastify/light-my-request#readme","funding":[{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}],"_lastModified":"2026-06-25T01:02:59.135Z"}
+{"name":"light-my-request","version":"6.6.0","description":"Fake HTTP injection library","main":"index.js","type":"commonjs","types":"types/index.d.ts","dependencies":{"cookie":"^1.0.1","process-warning":"^4.0.0","set-cookie-parser":"^2.6.0"},"devDependencies":{"@fastify/ajv-compiler":"^4.0.0","@fastify/pre-commit":"^2.1.0","@types/node":"^22.7.7","c8":"^10.1.2","end-of-stream":"^1.4.4","eslint":"^9.17.0","express":"^4.19.2","form-auto-content":"^3.2.1","form-data":"^4.0.0","formdata-node":"^6.0.3","multer":"^1.4.5-lts.1","neostandard":"^0.12.0","tinybench":"^3.0.0","tsd":"^0.31.0","undici":"^7.0.0"},"scripts":{"benchmark":"node benchmark/benchmark.js","coverage":"npm run unit -- --cov --coverage-report=html","lint":"eslint","lint:fix":"eslint --fix","test":"npm run lint && npm run test:unit && npm run test:typescript","test:typescript":"tsd","test:unit":"c8 --100 node --test"},"repository":{"type":"git","url":"git+https://github.com/fastify/light-my-request.git"},"keywords":["http","inject","fake","request","server"],"author":"Tomas Della Vedova - @delvedor (http://delved.org)","contributors":[{"name":"Matteo Collina","email":"hello@matteocollina.com"},{"name":"Manuel Spigolon","email":"behemoth89@gmail.com"},{"name":"Aras Abbasi","email":"aras.abbasi@gmail.com"},{"name":"Frazer Smith","email":"frazer.dev@icloud.com","url":"https://github.com/fdawgs"}],"license":"BSD-3-Clause","bugs":{"url":"https://github.com/fastify/light-my-request/issues"},"homepage":"https://github.com/fastify/light-my-request#readme","funding":[{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}],"_lastModified":"2026-06-29T01:53:47.387Z"}

package/dist/node_modules/ms/package.json

@@ -1 +1 @@
-{"name":"ms","version":"2.1.3","description":"Tiny millisecond conversion utility","repository":"vercel/ms","main":"./index","files":["index.js"],"scripts":{"precommit":"lint-staged","lint":"eslint lib/* bin/*","test":"mocha tests.js"},"eslintConfig":{"extends":"eslint:recommended","env":{"node":true,"es6":true}},"lint-staged":{"*.js":["npm run lint","prettier --single-quote --write","git add"]},"license":"MIT","devDependencies":{"eslint":"4.18.2","expect.js":"0.3.1","husky":"0.14.3","lint-staged":"5.0.0","mocha":"4.0.1","prettier":"2.0.5"},"_lastModified":"2026-06-25T01:02:59.181Z"}
+{"name":"ms","version":"2.1.3","description":"Tiny millisecond conversion utility","repository":"vercel/ms","main":"./index","files":["index.js"],"scripts":{"precommit":"lint-staged","lint":"eslint lib/* bin/*","test":"mocha tests.js"},"eslintConfig":{"extends":"eslint:recommended","env":{"node":true,"es6":true}},"lint-staged":{"*.js":["npm run lint","prettier --single-quote --write","git add"]},"license":"MIT","devDependencies":{"eslint":"4.18.2","expect.js":"0.3.1","husky":"0.14.3","lint-staged":"5.0.0","mocha":"4.0.1","prettier":"2.0.5"},"_lastModified":"2026-06-29T01:53:47.435Z"}

package/dist/server/device-verification.d.ts

@@ -0,0 +1,26 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import type { IdpOauthService } from './service';
+type DeviceVerificationAction = 'show' | 'approve' | 'cancel';
+type DeviceVerificationContext = {
+    method: string;
+    path: string;
+    query?: Record<string, unknown>;
+    request: {
+        body?: unknown;
+    };
+    status?: number;
+    body?: unknown;
+    withoutDataWrapping?: boolean;
+    throw: (...args: unknown[]) => never;
+};
+export declare function getDeviceVerificationAction(pathname: string, apiBasePath: string): DeviceVerificationAction | null;
+export declare function isProviderDeviceVerificationPage(pathname: string, apiBasePath: string): boolean;
+export declare function handleDeviceVerificationRequest(ctx: DeviceVerificationContext, service: IdpOauthService, apiBasePath: string): Promise<boolean>;
+export {};

package/dist/server/device-verification.js

@@ -0,0 +1,256 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var device_verification_exports = {};
+__export(device_verification_exports, {
+  getDeviceVerificationAction: () => getDeviceVerificationAction,
+  handleDeviceVerificationRequest: () => handleDeviceVerificationRequest,
+  isProviderDeviceVerificationPage: () => isProviderDeviceVerificationPage
+});
+module.exports = __toCommonJS(device_verification_exports);
+var import_utils = require("./utils");
+const OIDC_SCOPES = /* @__PURE__ */ new Set(["openid", "offline_access", "profile", "email"]);
+function epochTime(date = Date.now()) {
+  return Math.floor(date / 1e3);
+}
+function normalizeUserCode(input) {
+  return String(input || "").replace(/[a-z]/g, (char) => char.toUpperCase()).replace(/\W/g, "");
+}
+function formatUserCode(input) {
+  var _a;
+  const userCode = normalizeUserCode(input);
+  return ((_a = userCode.match(/.{1,4}/g)) == null ? void 0 : _a.join("-")) || "";
+}
+function splitScopes(value) {
+  return typeof value === "string" ? value.split(/\s+/).filter(Boolean) : [];
+}
+function getStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.filter((item) => typeof item === "string" && !!item);
+  }
+  return typeof value === "string" && value ? [value] : [];
+}
+function isRecordLike(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function getUserCode(ctx) {
+  var _a;
+  const body = isRecordLike(ctx.request.body) ? ctx.request.body : void 0;
+  return normalizeUserCode((body == null ? void 0 : body.user_code) || ((_a = ctx.query) == null ? void 0 : _a.user_code));
+}
+function getDeviceVerificationAction(pathname, apiBasePath) {
+  const basePath = `${apiBasePath}/idpOAuth/device/verification`;
+  if (pathname === basePath) {
+    return "show";
+  }
+  if (pathname === `${basePath}:approve`) {
+    return "approve";
+  }
+  if (pathname === `${basePath}:cancel`) {
+    return "cancel";
+  }
+  return null;
+}
+function isProviderDeviceVerificationPage(pathname, apiBasePath) {
+  const devicePath = `${apiBasePath}/idpOAuth/device`;
+  if (pathname === devicePath) {
+    return true;
+  }
+  if (!pathname.startsWith(`${devicePath}/`)) {
+    return false;
+  }
+  return !pathname.startsWith(`${devicePath}/auth`) && !pathname.startsWith(`${devicePath}/verification`);
+}
+async function findDeviceCode(provider, userCode) {
+  return provider.DeviceCode.findByUserCode(userCode, {
+    ignoreExpiration: true
+  });
+}
+async function getDeviceClient(provider, code) {
+  if (!code.clientId) {
+    return void 0;
+  }
+  return provider.Client.find(code.clientId);
+}
+function getClientName(client) {
+  return (client == null ? void 0 : client.clientName) || (client == null ? void 0 : client.clientId) || "Application";
+}
+async function buildDeviceState(ctx, provider, user) {
+  const userCode = getUserCode(ctx);
+  const displayUserCode = formatUserCode(userCode);
+  if (!userCode) {
+    return {
+      status: "missing_code"
+    };
+  }
+  const code = await findDeviceCode(provider, userCode);
+  if (!code) {
+    return {
+      status: "not_found",
+      userCode: displayUserCode
+    };
+  }
+  const client = await getDeviceClient(provider, code);
+  const baseState = {
+    userCode: displayUserCode,
+    clientName: getClientName(client)
+  };
+  if (code.isExpired) {
+    return {
+      ...baseState,
+      status: "expired"
+    };
+  }
+  if (code.error) {
+    return {
+      ...baseState,
+      status: "cancelled"
+    };
+  }
+  if (code.accountId) {
+    return {
+      ...baseState,
+      status: "complete"
+    };
+  }
+  if (code.inFlight || code.consumed) {
+    return {
+      ...baseState,
+      status: "already_used"
+    };
+  }
+  if (!user) {
+    return {
+      ...baseState,
+      status: "login"
+    };
+  }
+  return {
+    ...baseState,
+    status: "pending"
+  };
+}
+function getRequestedResources(params) {
+  return getStringArray(params.resource);
+}
+function splitRequestedScopes(params) {
+  const requestedScopes = splitScopes(params.scope);
+  const oidcScopes = requestedScopes.filter((scope) => OIDC_SCOPES.has(scope));
+  const resourceScopes = requestedScopes.filter((scope) => !OIDC_SCOPES.has(scope));
+  return {
+    requestedScopes,
+    oidcScopes,
+    resourceScopes
+  };
+}
+async function approveDeviceCode(ctx, provider, user) {
+  if (!(user == null ? void 0 : user.id)) {
+    ctx.throw(401, "Authentication required");
+  }
+  const userCode = getUserCode(ctx);
+  const displayUserCode = formatUserCode(userCode);
+  const code = userCode ? await findDeviceCode(provider, userCode) : void 0;
+  if (!code || code.isExpired || code.error || code.accountId || code.inFlight || code.consumed) {
+    return buildDeviceState(ctx, provider, user);
+  }
+  const clientId = code.clientId;
+  const params = code.params || {};
+  const { requestedScopes, oidcScopes, resourceScopes } = splitRequestedScopes(params);
+  const resources = getRequestedResources(params);
+  const grant = new provider.Grant({
+    accountId: String(user.id),
+    clientId
+  });
+  if (oidcScopes.length) {
+    grant.addOIDCScope(oidcScopes.join(" "));
+  }
+  if (resourceScopes.length) {
+    resources.forEach((resource) => grant.addResourceScope(resource, resourceScopes.join(" ")));
+  }
+  Object.assign(code, {
+    accountId: String(user.id),
+    authTime: epochTime(),
+    grantId: await grant.save(),
+    resource: resources.length > 1 ? resources : resources[0],
+    scope: requestedScopes.join(" ")
+  });
+  if (!resources.length) {
+    delete code.resource;
+  }
+  await code.save();
+  return {
+    status: "complete",
+    userCode: displayUserCode,
+    clientName: getClientName(await getDeviceClient(provider, code))
+  };
+}
+async function cancelDeviceCode(ctx, provider) {
+  const userCode = getUserCode(ctx);
+  const displayUserCode = formatUserCode(userCode);
+  const code = userCode ? await findDeviceCode(provider, userCode) : void 0;
+  if (!code || code.isExpired || code.error || code.accountId || code.inFlight || code.consumed) {
+    return buildDeviceState(ctx, provider);
+  }
+  Object.assign(code, {
+    error: "access_denied",
+    errorDescription: "End-User aborted interaction"
+  });
+  await code.save();
+  return {
+    status: "cancelled",
+    userCode: displayUserCode,
+    clientName: getClientName(await getDeviceClient(provider, code))
+  };
+}
+async function handleDeviceVerificationRequest(ctx, service, apiBasePath) {
+  const action = getDeviceVerificationAction(ctx.path, apiBasePath);
+  if (!action) {
+    return false;
+  }
+  if (action === "show" && ctx.method !== "GET" || action !== "show" && ctx.method !== "POST") {
+    ctx.throw(405);
+  }
+  ctx.withoutDataWrapping = true;
+  const provider = await service.ensureProviderForContext(ctx);
+  const user = await (0, import_utils.resolveCurrentUser)(ctx, service);
+  const body = await service.runWithProviderContext(ctx, async () => {
+    if (action === "approve") {
+      return approveDeviceCode(ctx, provider, user);
+    }
+    if (action === "cancel") {
+      return cancelDeviceCode(ctx, provider);
+    }
+    return buildDeviceState(ctx, provider, user);
+  });
+  ctx.body = body;
+  return true;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getDeviceVerificationAction,
+  handleDeviceVerificationRequest,
+  isProviderDeviceVerificationPage
+});

package/dist/server/interaction.d.ts

@@ -14,6 +14,7 @@ type InteractionUser = {
 type InteractionContext = {
     req: any;
     res: any;
+    status?: number;
     throw: (...args: any[]) => never;
     request: {
         body?: Record<string, any>;

package/dist/server/interaction.js

@@ -50,6 +50,24 @@ function shouldSkipConsent(clientId) {
 function getClientId(details) {
   return String(details.params.client_id || "");
 }
+function isInteractionSessionNotFound(error) {
+  return error instanceof Error && error.name === "SessionNotFound" && error.error === "invalid_request";
+}
+async function getInteractionDetails(ctx, provider) {
+  try {
+    return await provider.interactionDetails(ctx.req, ctx.res);
+  } catch (error) {
+    if (!isInteractionSessionNotFound(error)) {
+      throw error;
+    }
+    ctx.status = 400;
+    ctx.body = {
+      error: "invalid_request",
+      error_description: "The authorization request has expired or is no longer available."
+    };
+    return null;
+  }
+}
 async function getInteractionRedirect(ctx, provider, service, result, mergeWithLastSubmission) {
   const redirectTo = await provider.interactionResult(ctx.req, ctx.res, result, {
     mergeWithLastSubmission
@@ -130,7 +148,10 @@ async function completeConsent(ctx, provider, service, details, accountId) {
 }
 async function handleInteractionGet(ctx, provider, user, service) {
   var _a;
-  const details = await provider.interactionDetails(ctx.req, ctx.res);
+  const details = await getInteractionDetails(ctx, provider);
+  if (!details) {
+    return;
+  }
   const interactionUser = user || await service.resolveInteractionSessionUser((_a = details.session) == null ? void 0 : _a.accountId);
   if (details.prompt.name === "login") {
     if (!interactionUser) {
@@ -165,7 +186,10 @@ async function handleInteractionGet(ctx, provider, user, service) {
 }
 async function handleInteractionPost(ctx, provider, user, service) {
   var _a, _b;
-  const details = await provider.interactionDetails(ctx.req, ctx.res);
+  const details = await getInteractionDetails(ctx, provider);
+  if (!details) {
+    return;
+  }
   const interactionUser = user || await service.resolveInteractionSessionUser((_a = details.session) == null ? void 0 : _a.accountId);
   if ((_b = ctx.request.body) == null ? void 0 : _b.cancel) {
     ctx.body = {

package/dist/server/plugin.js

@@ -31,6 +31,7 @@ __export(plugin_exports, {
 });
 module.exports = __toCommonJS(plugin_exports);
 var import_server = require("@nocobase/server");
+var import_device_verification = require("./device-verification");
 var import_interaction = require("./interaction");
 var import_paths = require("./paths");
 var import_provider_dispatch = require("./provider-dispatch");
@@ -71,6 +72,17 @@ class PluginIdpOauthServer extends import_server.Plugin {
           await next();
           return;
         }
+        if (await (0, import_device_verification.handleDeviceVerificationRequest)(ctx, this.service, paths.apiBasePath)) {
+          return;
+        }
+        if ((0, import_device_verification.isProviderDeviceVerificationPage)(ctx.path, paths.apiBasePath)) {
+          ctx.withoutDataWrapping = true;
+          ctx.status = 404;
+          ctx.body = {
+            error: "not_found"
+          };
+          return;
+        }
         if (paths.isProviderPath(ctx.path)) {
           await (0, import_provider_dispatch.dispatchCurrentRequestToProvider)(ctx, this.service, paths.apiBasePath);
           return;

package/dist/server/provider-dispatch.js

@@ -44,6 +44,7 @@ module.exports = __toCommonJS(provider_dispatch_exports);
 var import_light_my_request = __toESM(require("light-my-request"));
 var import_paths = require("./paths");
 const LOOPBACK_REDIRECT_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 function getRequestBody(ctx) {
   const body = ctx.request.body;
   if (typeof body === "string") {
@@ -77,7 +78,12 @@ function assertRegistrationRedirectUris(ctx, pathname) {
     };
     return false;
   }
+  const grantTypes = Array.isArray(body == null ? void 0 : body.grant_types) ? body.grant_types.filter((grantType) => typeof grantType === "string") : [];
+  const isDeviceCodeOnlyClient = grantTypes.includes(DEVICE_CODE_GRANT_TYPE) && !grantTypes.includes("authorization_code");
   const redirectUris = body == null ? void 0 : body.redirect_uris;
+  if (isDeviceCodeOnlyClient && (redirectUris === void 0 || Array.isArray(redirectUris) && !redirectUris.length)) {
+    return true;
+  }
   if (!Array.isArray(redirectUris) || !redirectUris.length || !redirectUris.every((uri) => typeof uri === "string" && isLoopbackRedirectUri(uri))) {
     ctx.status = 400;
     ctx.body = {
@@ -152,12 +158,28 @@ function rewriteProviderUrl(ctx, service, value) {
 function rewriteProviderLocationHeader(ctx, service, location) {
   return rewriteProviderUrl(ctx, service, location);
 }
+function rewriteDeviceVerificationUrl(ctx, service, value) {
+  const { appName, origin, issuerPath } = service.getProviderContext(ctx);
+  const publicOriginUrl = new URL(origin);
+  const publicDevicePath = service.getFrontendDevicePath(appName, issuerPath);
+  try {
+    const url = value.startsWith("/") ? new URL(value, origin) : new URL(value);
+    url.protocol = publicOriginUrl.protocol;
+    url.host = publicOriginUrl.host;
+    url.pathname = publicDevicePath;
+    return url.toString();
+  } catch (error) {
+    return value;
+  }
+}
 function getFrontendInteractionCookiePath(originalPath) {
-  const match = originalPath.match(/^\/(?:apps\/([^/]+)\/)?idp-oauth\/interaction\/([^/]+)$/);
-  if (!match) {
+  const segments = originalPath.split("/").filter(Boolean);
+  const interactionIndex = segments.lastIndexOf("idp-oauth");
+  if (interactionIndex < 0 || segments[interactionIndex + 1] !== "interaction" || !segments[interactionIndex + 2] || segments.length !== interactionIndex + 3) {
     return void 0;
   }
-  const [, appName, uid] = match;
+  const appName = segments[interactionIndex - 2] === "apps" ? segments[interactionIndex - 1] : void 0;
+  const uid = segments[interactionIndex + 2];
   return { appName, uid };
 }
 function rewriteProviderSetCookieHeader(ctx, service, cookie) {
@@ -188,6 +210,7 @@ function rewriteProviderJsonBody(ctx, service, body) {
     "/idpOAuth/authorize",
     "/idpOAuth/token",
     "/idpOAuth/register",
+    "/idpOAuth/device/auth",
     "/idpOAuth/revoke",
     "/idpOAuth/jwks",
     "/idpOAuth/me",
@@ -198,6 +221,7 @@ function rewriteProviderJsonBody(ctx, service, body) {
     "authorization_endpoint",
     "token_endpoint",
     "registration_endpoint",
+    "device_authorization_endpoint",
     "revocation_endpoint",
     "jwks_uri",
     "userinfo_endpoint",
@@ -216,8 +240,23 @@ function rewriteProviderJsonBody(ctx, service, body) {
     const clientId = body.client_id || registrationClientUri.pathname.split("/").pop();
     body.registration_client_uri = `${issuer}/idpOAuth/register/${clientId}`;
   }
+  if (typeof body.verification_uri === "string") {
+    body.verification_uri = rewriteDeviceVerificationUrl(ctx, service, body.verification_uri);
+  }
+  if (typeof body.verification_uri_complete === "string") {
+    body.verification_uri_complete = rewriteDeviceVerificationUrl(ctx, service, body.verification_uri_complete);
+  }
   return body;
 }
+function rewriteProviderHtmlBody(ctx, service, html) {
+  return html.replace(/\b(action|href)=(["'])(.*?)\2/g, (match, attribute, quote, value) => {
+    const rewritten = rewriteProviderUrl(ctx, service, value);
+    if (rewritten === value) {
+      return match;
+    }
+    return `${attribute}=${quote}${rewritten}${quote}`;
+  });
+}
 function rewriteProviderResponseHeaders(ctx, service, headers) {
   for (const [name, value] of Object.entries(headers)) {
     if (value === void 0) {
@@ -239,6 +278,27 @@ function rewriteProviderResponseHeaders(ctx, service, headers) {
     ctx.set(name, Array.isArray(value) ? value.map(String) : String(value));
   }
 }
+function decodeProviderPayload(payload) {
+  if (typeof payload === "string") {
+    return payload;
+  }
+  if (Buffer.isBuffer(payload)) {
+    return payload.toString("utf8");
+  }
+  if (payload instanceof Uint8Array) {
+    return Buffer.from(payload).toString("utf8");
+  }
+  if (payload && typeof payload === "object" && payload.type === "Buffer" && Array.isArray(payload.data)) {
+    return Buffer.from(payload.data).toString("utf8");
+  }
+  return String(payload ?? "");
+}
+function resolveProviderPayloadBody(payload, payloadText) {
+  if (typeof payload === "string" || Buffer.isBuffer(payload) || payload instanceof Uint8Array) {
+    return payload.length ? payload : void 0;
+  }
+  return payloadText || void 0;
+}
 async function dispatchToProvider(ctx, provider, pathname, service) {
   var _a, _b, _c, _d, _e, _f;
   ctx.withoutDataWrapping = true;
@@ -261,8 +321,9 @@ async function dispatchToProvider(ctx, provider, pathname, service) {
   });
   ctx.status = response.statusCode;
   rewriteProviderResponseHeaders(ctx, service, response.headers);
+  const responseHeaders = response.headers;
   const payload = response.rawPayload;
-  const contentType = String(response.headers["content-type"] || "").toLowerCase();
+  const contentType = String(responseHeaders["content-type"] || responseHeaders["Content-Type"] || "").toLowerCase();
   (_d = (_c = ctx.logger) == null ? void 0 : _c.debug) == null ? void 0 : _d.call(_c, "idp-oauth provider response", {
     method: ctx.method,
     externalPath: ctx.path,
@@ -271,9 +332,11 @@ async function dispatchToProvider(ctx, provider, pathname, service) {
     contentType,
     location: response.headers.location
   });
-  if (payload.length && (contentType.includes("application/json") || contentType.includes("+json"))) {
+  const isDiscoveryResponse = ctx.path.endsWith("/.well-known/oauth-authorization-server") || ctx.path.endsWith("/.well-known/openid-configuration") || pathname.endsWith("/.well-known/oauth-authorization-server") || pathname.endsWith("/.well-known/openid-configuration");
+  const payloadText = decodeProviderPayload(payload);
+  if (payloadText && (isDiscoveryResponse || contentType.includes("application/json") || contentType.includes("+json"))) {
     try {
-      const body = rewriteProviderJsonBody(ctx, service, JSON.parse(payload.toString("utf8")));
+      const body = rewriteProviderJsonBody(ctx, service, JSON.parse(payloadText));
       ctx.body = body;
       return;
     } catch (error) {
@@ -284,11 +347,15 @@ async function dispatchToProvider(ctx, provider, pathname, service) {
         status: response.statusCode,
         contentType,
         error: error instanceof Error ? error.message : String(error),
-        payloadPreview: payload.toString("utf8").slice(0, 500)
+        payloadPreview: payloadText.slice(0, 500)
       });
     }
   }
-  ctx.body = payload.length ? payload : void 0;
+  if (payloadText && contentType.includes("text/html")) {
+    ctx.body = rewriteProviderHtmlBody(ctx, service, payloadText);
+    return;
+  }
+  ctx.body = resolveProviderPayloadBody(payload, payloadText);
 }
 async function dispatchCurrentRequestToProvider(ctx, service, apiBasePath) {
   const provider = await service.ensureProviderForContext(ctx);

package/dist/server/service.d.ts

@@ -42,6 +42,7 @@ export declare class IdpOauthService {
     private getBridgeTokenCache;
     getOrigin(ctx: any): string;
     private getApiBasePath;
+    private getAppPublicPath;
     private getRequestPath;
     private getAppIssuerPath;
     getIssuerPath(appName?: string, ctx?: any): string;
@@ -49,6 +50,7 @@ export declare class IdpOauthService {
     private shouldUseSubAppPublicPrefix;
     getFrontendInteractionPath(appName: string, uid: string, issuerPath?: string): string;
     getFrontendErrorPath(appName: string, issuerPath?: string): string;
+    getFrontendDevicePath(appName: string, issuerPath?: string): string;
     getProviderContext(ctx: any): ProviderContext;
     getCurrentProviderContext(): ProviderContext;
     runWithProviderContext<T>(ctx: any, callback: () => T): T;

package/dist/server/service.js

@@ -69,12 +69,121 @@ const envJwksKeys = ["IDP_OAUTH_JWKS", "OAUTH_JWKS"];
 const MAX_CACHE_TTL_MS = 2147483647;
 const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = Math.floor((0, import_ms.default)(String(import_plugin_auth.defaultTokenPolicyConfig.tokenExpirationTime)) / 1e3);
 const DEFAULT_SESSION_TTL_SECONDS = Math.floor((0, import_ms.default)(String(import_plugin_auth.defaultTokenPolicyConfig.sessionExpirationTime)) / 1e3);
+const DEVICE_CODE_TTL_SECONDS = 10 * 60;
 function policyMillisecondsToSeconds(value, fallback) {
   if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
     return fallback;
   }
   return Math.max(1, Math.floor(value / 1e3));
 }
+function escapeHtmlText(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function renderDevicePage(options) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtmlText(options.title)}</title>
+  <style>
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      background: #f5f5f5;
+      color: rgba(0, 0, 0, 0.88);
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    }
+    main {
+      width: min(100%, 440px);
+      padding: 32px;
+      border: 1px solid #f0f0f0;
+      border-radius: 8px;
+      background: #fff;
+      box-shadow: 0 12px 32px rgba(0, 0, 0, 0.08);
+    }
+    h1 { margin: 0 0 12px; font-size: 26px; line-height: 1.25; font-weight: 600; }
+    p { margin: 0 0 20px; color: rgba(0, 0, 0, 0.65); line-height: 1.7; }
+    form { display: grid; gap: 12px; }
+    input[type="text"] {
+      width: 100%;
+      height: 44px;
+      padding: 0 12px;
+      border: 1px solid #d9d9d9;
+      border-radius: 6px;
+      font-size: 18px;
+      text-align: center;
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+    }
+    button {
+      min-height: 40px;
+      border: 1px solid #1677ff;
+      border-radius: 6px;
+      background: #1677ff;
+      color: #fff;
+      cursor: pointer;
+      font-size: 14px;
+      font-weight: 500;
+    }
+    button[name="abort"] {
+      margin-top: 8px;
+      border: 0;
+      background: transparent;
+      color: rgba(0, 0, 0, 0.45);
+    }
+    code {
+      display: inline-block;
+      margin: 8px 0;
+      font-size: 28px;
+      letter-spacing: 0.08em;
+      color: rgba(0, 0, 0, 0.88);
+    }
+    .footer { margin-top: 20px; margin-bottom: 0; font-size: 13px; color: rgba(0, 0, 0, 0.45); }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${escapeHtmlText(options.heading)}</h1>
+    <p>${escapeHtmlText(options.description)}</p>
+    ${options.form ?? ""}
+    ${options.footer ? `<p class="footer">${escapeHtmlText(options.footer)}</p>` : ""}
+  </main>
+</body>
+</html>`;
+}
+async function renderDeviceCodeInput(ctx, form, out, error) {
+  const description = error || (out == null ? void 0 : out.error) ? "The code could not be verified. Check the code from your device and try again." : "Enter the code shown in your terminal to continue signing in.";
+  ctx.body = renderDevicePage({
+    title: "Device sign-in",
+    heading: "Device sign-in",
+    description,
+    form: `${form}<button type="submit" form="op.deviceInputForm">Continue</button>`
+  });
+}
+async function renderDeviceCodeConfirmation(ctx, form, client, _deviceInfo, userCode) {
+  const clientName = client.clientName || client.clientId || "Application";
+  ctx.body = renderDevicePage({
+    title: "Confirm device",
+    heading: "Confirm device",
+    description: `${clientName} is requesting access. Confirm that this code matches the one shown in your terminal.`,
+    form: `<p><code>${escapeHtmlText(
+      userCode
+    )}</code></p>${form}<button autofocus type="submit" form="op.deviceConfirmForm">Continue</button><button type="submit" form="op.deviceConfirmForm" value="yes" name="abort">Cancel</button>`
+  });
+}
+async function renderDeviceSuccess(ctx) {
+  ctx.body = renderDevicePage({
+    title: "Device sign-in complete",
+    heading: "Device sign-in complete",
+    description: "Authorization is complete. You can return to the terminal.",
+    footer: "This browser tab can be closed."
+  });
+}
 class IdpOauthService {
   constructor(app, bridgeTokenCache) {
     this.app = app;
@@ -105,6 +214,15 @@ class IdpOauthService {
   getApiBasePath() {
     return (0, import_utils2.normalizeBasePath)(process.env.API_BASE_PATH || "/api");
   }
+  getAppPublicPath() {
+    const appPublicPath = (0, import_utils2.normalizeBasePath)(process.env.APP_PUBLIC_PATH || "");
+    if (appPublicPath !== "/") {
+      return appPublicPath;
+    }
+    const apiBasePath = this.getApiBasePath();
+    const inferredPublicPath = apiBasePath.endsWith("/api") ? (0, import_utils2.normalizeBasePath)(apiBasePath.slice(0, -4)) : "";
+    return inferredPublicPath === "/" ? "" : inferredPublicPath;
+  }
   getRequestPath(ctx) {
     var _a, _b;
     if (typeof ((_a = ctx == null ? void 0 : ctx.req) == null ? void 0 : _a.originalUrl) === "string") {
@@ -154,16 +272,25 @@ class IdpOauthService {
     return issuerPath !== this.getApiBasePath();
   }
   getFrontendInteractionPath(appName, uid, issuerPath = this.getIssuerPath(appName)) {
+    const appPublicPath = this.getAppPublicPath();
     if (!this.shouldUseSubAppPublicPrefix(appName, issuerPath)) {
-      return `/idp-oauth/interaction/${uid}`;
+      return `${appPublicPath}/idp-oauth/interaction/${uid}`;
     }
-    return `/apps/${appName}/idp-oauth/interaction/${uid}`;
+    return `${appPublicPath}/apps/${appName}/idp-oauth/interaction/${uid}`;
   }
   getFrontendErrorPath(appName, issuerPath = this.getIssuerPath(appName)) {
+    const appPublicPath = this.getAppPublicPath();
+    if (!this.shouldUseSubAppPublicPrefix(appName, issuerPath)) {
+      return `${appPublicPath}/idp-oauth/error`;
+    }
+    return `${appPublicPath}/apps/${appName}/idp-oauth/error`;
+  }
+  getFrontendDevicePath(appName, issuerPath = this.getIssuerPath(appName)) {
+    const appPublicPath = this.getAppPublicPath();
     if (!this.shouldUseSubAppPublicPrefix(appName, issuerPath)) {
-      return "/idp-oauth/error";
+      return `${appPublicPath}/idpOAuth/device`;
     }
-    return `/apps/${appName}/idp-oauth/error`;
+    return `${appPublicPath}/apps/${appName}/idpOAuth/device`;
   }
   getProviderContext(ctx) {
     var _a;
@@ -574,6 +701,8 @@ class IdpOauthService {
       routes: {
         authorization: "/idpOAuth/authorize",
         token: "/idpOAuth/token",
+        code_verification: "/idpOAuth/device",
+        device_authorization: "/idpOAuth/device/auth",
         jwks: "/idpOAuth/jwks",
         registration: "/idpOAuth/register",
         revocation: "/idpOAuth/revoke",
@@ -582,6 +711,12 @@ class IdpOauthService {
         end_session: "/idpOAuth/end-session"
       },
       features: {
+        deviceFlow: {
+          enabled: true,
+          userCodeInputSource: renderDeviceCodeInput,
+          userCodeConfirmSource: renderDeviceCodeConfirmation,
+          successSource: renderDeviceSuccess
+        },
         devInteractions: { enabled: false },
         registration: { enabled: true },
         revocation: { enabled: true },
@@ -619,6 +754,7 @@ class IdpOauthService {
       ttl: {
         AccessToken: accessTokenTtl,
         AuthorizationCode: 60,
+        DeviceCode: DEVICE_CODE_TTL_SECONDS,
         Grant: sessionTtl,
         IdToken: 60 * 60,
         RefreshToken: sessionTtl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-idp-oauth",
-  "version": "2.2.0-beta.7",
+  "version": "2.2.0-beta.8",
   "main": "dist/server/index.js",
   "displayName": "IdP: OAuth",
   "displayName.zh-CN": "IdP: OAuth",
@@ -22,5 +22,5 @@
   "keywords": [
     "Authentication"
   ],
-  "gitHead": "e6a3fa8963a73cd9ddfc1273d71b0012483e1ad8"
+  "gitHead": "fa2502c1e9faf6d74b3f51b42dbc6546638d46af"
 }