@oj-module/cli 0.1.21 → 0.2.1

package/templates/pnpm-workspace.yaml

@@ -3,3 +3,12 @@
 # 命令报 ERR_PNPM_IGNORED_BUILDS（0.1.0 发布实测）。
 allowBuilds:
   esbuild: true
+
+# @oj-module/cli 经 `catalog:` 拉 @redocly/cli，但 catalog 协议只作用于 workspace
+# 自有 package.json 的依赖，对 cli（外部包）的 catalog: 传递依赖无效；生成工程
+# 不钉的话会漂到 latest，新发布的版本（如 2.64.1，发布当日）会撞本机
+# minimumReleaseAge supply-chain 策略被拒（ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION）。
+# 用 override 钉死到仓库 pnpm-workspace.yaml 的 minimumReleaseAgeExclude 白名单版本
+# 2.51.0（cli 实测通过的区间 ^2.51.0 内，且发布已久、过策略）。
+overrides:
+  '@redocly/cli': 2.51.0

package/templates/web/src/auth/__client/api.schemas.ts

@@ -4,5 +4,10 @@
 import { z } from "@oj-module/runtime";
 
 export const schemas = {
-
+	"authPasswordPut": {
+		body: z.object({
+	"old_password": z.string().min(1),
+	"new_password": z.string().min(6)
+}),
+	},
 };

package/templates/web/src/auth/__client/api.ts

@@ -33,7 +33,7 @@ export function createAuthClient(ctx: ModuleContext) {
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { authLoginPost, authLogoutPost, authRefreshPost };
+	return { authLoginPost, authLogoutPost, authRefreshPost, authPasswordPut, authLdapLoginPost };
 }
 
 /**
@@ -108,3 +108,35 @@ export async function authRefreshPost(): Promise<unknown> {
 		throw await toApiError(e);
 	}
 }
+
+export type AuthPasswordPutBody = z.input<(typeof schemas)["authPasswordPut"]["body"]>;
+
+export async function authPasswordPut(body: AuthPasswordPutBody): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`auth/password`, { json: body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export async function authLdapLoginPost(): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`auth/ldap-login`).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}

package/templates/web/src/login/entry.ts

@@ -34,6 +34,23 @@ export default defineModule({
 				},
 			],
 		},
+		{
+			// 首登/重置后强制改密（must_change 悬挂期唯一可用写端）；
+			// 管理面 403 msg=password change required 时也引导至此
+			path: "/change-password",
+			handle: {
+				layout: "fullscreen",
+				hideInMenu: true,
+				title: "login:page.changePwd.title",
+			},
+			children: [
+				{
+					index: true,
+					Component: lazy(() => import("./pages/change-password")),
+					handle: { title: "login:page.changePwd.title", hideInMenu: true },
+				},
+			],
+		},
 	],
 	i18n: {
 		"zh-CN": () => import("./locales/zh-CN.json"),

package/templates/web/src/login/locales/en-US.json

@@ -1,10 +1,20 @@
 {
 	"page": {
 		"title": "Sign in",
-		"subtitle": "Scaffold seed account: admin / 123456",
+		"subtitle": "Please sign in to continue",
 		"username": "Username",
 		"password": "Password",
 		"submit": "Sign in",
-		"success": "Signed in"
+		"success": "Signed in",
+		"changePwd": {
+			"title": "Change Password",
+			"hint": "After first login or an admin reset, you must change your password before using the system.",
+			"old": "Current password",
+			"new": "New password",
+			"confirm": "Confirm new password",
+			"min": "At least 6 characters",
+			"mismatch": "Passwords do not match",
+			"submit": "Change & sign in again"
+		}
 	}
 }

package/templates/web/src/login/locales/zh-CN.json

@@ -1,10 +1,20 @@
 {
 	"page": {
 		"title": "登录",
-		"subtitle": "脚手架种子账号：admin / 123456",
+		"subtitle": "请登录以继续使用系统",
 		"username": "用户名",
 		"password": "密码",
 		"submit": "登 录",
-		"success": "登录成功"
+		"success": "登录成功",
+		"changePwd": {
+			"title": "修改密码",
+			"hint": "首次登录或管理员重置口令后，需先修改密码才能使用系统。",
+			"old": "当前密码",
+			"new": "新密码",
+			"confirm": "确认新密码",
+			"min": "至少 6 位",
+			"mismatch": "两次输入的新密码不一致",
+			"submit": "修改并重新登录"
+		}
 	}
 }

package/templates/web/src/login/pages/change-password.tsx

@@ -0,0 +1,74 @@
+import { fetchChangePassword } from "@oj-module/runtime";
+
+import { Alert, Button, Form, Input, Typography } from "antd";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useNavigate } from "react-router";
+
+interface ChangePwdValues {
+	old_password: string
+	new_password: string
+	confirm: string
+}
+
+/**
+ * 首登/重置后强制改密页（AC1-27）：must_change 悬挂期唯一可用写端是
+ * PUT /api/auth/password（后端对未改密用户拒绝其余全部端点）。登录响应
+ * data.user.must_change / 管理面 403 msg 均会引导到此页。走 runtime 全局
+ * request 出口（fetchChangePassword）——auth 无 web 模块、无 client 宿。
+ */
+export default function ChangePasswordPage() {
+	const { t } = useTranslation();
+	const navigate = useNavigate();
+	const [error, setError] = useState<string>();
+	const [loading, setLoading] = useState(false);
+
+	async function onFinish(values: ChangePwdValues) {
+		setLoading(true);
+		setError(undefined);
+		try {
+			await fetchChangePassword({ old_password: values.old_password, new_password: values.new_password });
+			// 改密级联吊销 refresh，旧会话状态陈旧——回登录页重新认证
+			navigate("/login");
+		}
+		catch (e) {
+			setError(e instanceof Error ? e.message : String(e));
+		}
+		finally {
+			setLoading(false);
+		}
+	}
+
+	return (
+		<>
+			<Typography.Title level={3}>
+				{t("login:page.changePwd.title")}
+			</Typography.Title>
+			<Typography.Paragraph type="secondary">
+				{t("login:page.changePwd.hint")}
+			</Typography.Paragraph>
+			{error && <Alert style={{ marginBottom: 16 }} type="error" message={error} showIcon />}
+			<Form<ChangePwdValues> layout="vertical" onFinish={onFinish}>
+				<Form.Item name="old_password" label={t("login:page.changePwd.old")} rules={[{ required: true }]}>
+					<Input.Password autoFocus />
+				</Form.Item>
+				<Form.Item name="new_password" label={t("login:page.changePwd.new")} rules={[{ required: true }, { min: 6 }]} extra={t("login:page.changePwd.min")}>
+					<Input.Password />
+				</Form.Item>
+				<Form.Item
+					name="confirm"
+					label={t("login:page.changePwd.confirm")}
+					dependencies={["new_password"]}
+					rules={[{ required: true }, ({ getFieldValue }) => ({
+						validator: (_, value) => value === getFieldValue("new_password") ? Promise.resolve() : Promise.reject(new Error(t("login:page.changePwd.mismatch"))),
+					})]}
+				>
+					<Input.Password />
+				</Form.Item>
+				<Button type="primary" htmlType="submit" block loading={loading}>
+					{t("login:page.changePwd.submit")}
+				</Button>
+			</Form>
+		</>
+	);
+}

package/templates/web/src/system/entry.ts

@@ -0,0 +1,90 @@
+import type { AppRouteRecordRaw } from "@oj-module/runtime";
+
+import { SettingOutlined } from "@ant-design/icons";
+import { defineModule } from "@oj-module/runtime";
+
+import { createElement, lazy } from "react";
+
+import { createSystemClient } from "./__client/api";
+
+const Users = lazy(() => import("./pages/users"));
+const UserRoles = lazy(() => import("./pages/users/roles"));
+const Roles = lazy(() => import("./pages/roles"));
+const Oplog = lazy(() => import("./pages/oplog"));
+const Settings = lazy(() => import("./pages/settings"));
+const LoginMethods = lazy(() => import("./pages/login-methods"));
+
+const routes: AppRouteRecordRaw[] = [
+	{
+		path: "/system",
+		handle: {
+			icon: createElement(SettingOutlined),
+			title: "system:menu.system",
+			order: 100,
+			layout: "container",
+		},
+		children: [
+			{
+				path: "/system/users",
+				Component: Users,
+				handle: { title: "system:menu.users" },
+			},
+			{
+				// 成员资格（superadmin 入口从用户管理页进入，菜单不出现）
+				path: "/system/users/:uid/roles",
+				Component: UserRoles,
+				handle: { title: "system:menu.userRoles", hideInMenu: true },
+			},
+			{
+				path: "/system/roles",
+				Component: Roles,
+				handle: { title: "system:menu.roles" },
+			},
+			{
+				path: "/system/oplog",
+				Component: Oplog,
+				handle: { title: "system:menu.oplog" },
+			},
+			{
+				path: "/system/settings",
+				Component: Settings,
+				handle: { title: "system:menu.settings" },
+			},
+			{
+				path: "/system/login-methods",
+				Component: LoginMethods,
+				handle: { title: "system:menu.loginMethods" },
+			},
+		],
+	},
+];
+
+/**
+ * system 模块：框架管理面（用户/成员资格/角色权限/操作日志/站点设置/登录方式），
+ * 数据源为 oj 后端 /api/system/*（模板 api 模块）。__client 不随模板分发——
+ * init 后 `oj openapi -o openapi.json` + `ojm api` 生成（生成前本文件 ts 报红属预期，
+ * devkit manual §2.2）。
+ */
+export default defineModule({
+	name: "system",
+	description: "系统管理模块（框架管理面）",
+	version: "0.1.0",
+	peerRuntime: ">=0.0.0",
+	// 路由级门禁（B16）：非系统管理员不注入 /system 路由、菜单不可见；
+	// API 级 403 由 assertSystemAdmin + service 层硬 enforcement 兜底。
+	// 角色口径对齐后端 assertSystemAdmin（access.ts:90）——superadmin **或**
+	// admin 均可；seed 的 admin 账号只有 superadmin，写 ["admin"] 会把它自己挡在门外。
+	config: { requiredRoles: ["admin", "superadmin"] },
+	routes,
+	i18n: {
+		"zh-CN": () => import("./locales/zh-CN.json"),
+		"en-US": () => import("./locales/en-US.json"),
+	},
+	lifecycle: {
+		async onInit(ctx) {
+			// 构造即接线：登记 /system 前缀 + 绑定 scoped request（D11 前缀收敛），
+			// 页面直接 import 生成的端点函数（模块级单槽 req 已由本调用绑定）。
+			createSystemClient(ctx);
+		},
+	},
+});

package/templates/web/src/system/locales/en-US.json

@@ -0,0 +1,98 @@
+{
+	"menu": {
+		"system": "System",
+		"users": "Users",
+		"userRoles": "Membership",
+		"roles": "Roles & Permissions",
+		"oplog": "Audit Log",
+		"settings": "Site Settings",
+		"loginMethods": "Login Methods"
+	},
+	"common": {
+		"confirm": "Confirm",
+		"cancel": "Cancel",
+		"save": "Save",
+		"saved": "Saved",
+		"search": "Search",
+		"reset": "Reset",
+		"create": "Create"
+	},
+	"users": {
+		"create": "Create User",
+		"resetPwd": "Reset Password",
+		"forbidden": "Forbidden",
+		"createOk": "User created: password change required on first login",
+		"firstLoginHint": "Must change on first login",
+		"membership": "Membership",
+		"pwdPlaceholder": "At least 6 characters",
+		"columns": {
+			"username": "Username",
+			"displayName": "Display Name",
+			"email": "Email",
+			"roles": "Roles",
+			"status": "Status",
+			"actions": "Actions"
+		}
+	},
+	"userRoles": {
+		"title": "Membership",
+		"saved": "Roles updated",
+		"none": "(no roles)"
+	},
+	"rolesPage": {
+		"tabRoles": "Roles",
+		"tabPerms": "Permissions",
+		"builtin": "Built-in",
+		"deprecated": "Deprecated",
+		"holders": "Holders",
+		"permissions": "Bound Permissions",
+		"titleKey": "Title Key",
+		"readonlyHint": "Read-only view: roles and bindings are managed by solution tooling (upsertSolutionPerms)"
+	},
+	"oplog": {
+		"filterAction": "Action",
+		"filterUsername": "Username (prefix)",
+		"filterModule": "Module",
+		"filterLimit": "Limit",
+		"truncated": "Results truncated by limit; narrow your filters",
+		"columns": {
+			"time": "Time",
+			"username": "Username",
+			"action": "Action",
+			"module": "Module",
+			"target": "Target",
+			"detail": "Detail",
+			"level": "Level"
+		}
+	},
+	"settingsPage": {
+		"secretHint": "Secret items cannot be edited online",
+		"saved": "Settings saved"
+	},
+	"loginMethodsPage": {
+		"title": "Enabled login methods",
+		"methodLocal": "Local password",
+		"methodLdap": "LDAP",
+		"methodSso": "SSO"
+	},
+	"err": {
+		"forbidden": "Forbidden",
+		"selfAction": "You cannot perform this action on yourself",
+		"pwdTooShort": "Password must be at least 6 characters",
+		"usernameExists": "Username already exists",
+		"usernameReserved": "This username prefix is reserved for external identity sources",
+		"mustChange": {
+			"title": "Password change required",
+			"hint": "This account must change its password before admin features become available.",
+			"go": "Change password now"
+		}
+	},
+	"setting": {
+		"site_title": "Site Title",
+		"ldap_enabled": "Enable LDAP login",
+		"sso_enabled": "Enable SSO login",
+		"ldap_base_dn": "LDAP Base DN",
+		"ldap_uid_attr": "LDAP UID Attribute",
+		"ldap_email_attr": "LDAP Email Attribute"
+	}
+}

package/templates/web/src/system/locales/zh-CN.json

@@ -0,0 +1,98 @@
+{
+	"menu": {
+		"system": "系统管理",
+		"users": "用户管理",
+		"userRoles": "成员资格",
+		"roles": "角色权限",
+		"oplog": "操作日志",
+		"settings": "站点设置",
+		"loginMethods": "登录方式"
+	},
+	"common": {
+		"confirm": "确认",
+		"cancel": "取消",
+		"save": "保存",
+		"saved": "已保存",
+		"search": "查询",
+		"reset": "重置",
+		"create": "新建"
+	},
+	"users": {
+		"create": "建号",
+		"resetPwd": "重置口令",
+		"forbidden": "禁用",
+		"createOk": "建号成功，首次登录须改密",
+		"firstLoginHint": "首登改密",
+		"membership": "成员资格",
+		"pwdPlaceholder": "至少 6 位",
+		"columns": {
+			"username": "用户名",
+			"displayName": "显示名",
+			"email": "邮箱",
+			"roles": "角色",
+			"status": "状态",
+			"actions": "操作"
+		}
+	},
+	"userRoles": {
+		"title": "成员资格",
+		"saved": "角色已更新",
+		"none": "（无角色）"
+	},
+	"rolesPage": {
+		"tabRoles": "角色",
+		"tabPerms": "权限点",
+		"builtin": "内置",
+		"deprecated": "已废弃",
+		"holders": "持有者",
+		"permissions": "已绑定权限点",
+		"titleKey": "标题键",
+		"readonlyHint": "只读视图：角色与绑定由解决方案工具链（upsertSolutionPerms）管理"
+	},
+	"oplog": {
+		"filterAction": "操作 (action)",
+		"filterUsername": "用户名（前缀匹配）",
+		"filterModule": "模块",
+		"filterLimit": "条数上限",
+		"truncated": "结果已按上限截断，请缩小过滤范围",
+		"columns": {
+			"time": "时间",
+			"username": "用户名",
+			"action": "操作",
+			"module": "模块",
+			"target": "目标",
+			"detail": "详情",
+			"level": "级别"
+		}
+	},
+	"settingsPage": {
+		"secretHint": "敏感项不可在线修改",
+		"saved": "设置已保存"
+	},
+	"loginMethodsPage": {
+		"title": "当前启用的登录方式",
+		"methodLocal": "本地口令",
+		"methodLdap": "LDAP",
+		"methodSso": "SSO 单点登录"
+	},
+	"err": {
+		"forbidden": "无权限",
+		"selfAction": "不能对自己执行该操作",
+		"pwdTooShort": "口令至少 6 位",
+		"usernameExists": "用户名已存在",
+		"usernameReserved": "该用户名前缀为外部身份源保留",
+		"mustChange": {
+			"title": "需要先修改密码",
+			"hint": "当前账号尚未完成首次改密，管理功能暂不可用。修改完成后将自动返回。",
+			"go": "去修改密码"
+		}
+	},
+	"setting": {
+		"site_title": "站点标题",
+		"ldap_enabled": "启用 LDAP 登录",
+		"sso_enabled": "启用 SSO 登录",
+		"ldap_base_dn": "LDAP Base DN",
+		"ldap_uid_attr": "LDAP UID 属性",
+		"ldap_email_attr": "LDAP 邮箱属性"
+	}
+}

package/templates/web/src/system/pages/errors.ts

@@ -0,0 +1,51 @@
+/**
+ * 错误归一辅助：兼容两种形态——生成物 client 抛的 ContractApiError（code/msg）
+ * 与 ky HTTPError（response.status / data 信封）。判断尽量宽，避免依赖单一
+ * 形态的脆弱字段（ky 版本间 HTTPError.data 行为有差异）。
+ */
+
+/** HTTP 状态：ContractApiError.code 优先，HTTPError 回落 response.status */
+function statusOf(e: unknown): number | undefined {
+	const err = e as { code?: number, response?: Response } | null;
+	if (typeof err?.code === "number")
+		return err.code;
+	return err?.response?.status;
+}
+
+/** 该错误是否为 403（页面切「无权限/引导」面板的判据） */
+export function isForbidden(e: unknown): boolean {
+	return statusOf(e) === 403;
+}
+
+/** must_change 判定：悬挂期 403 的 msg 为后端固定文案（access.ts 硬编码） */
+export function isMustChange(e: unknown): boolean {
+	const err = e as { msg?: string, data?: { code?: string } } | null;
+	return err?.data?.code === "must_change" || (err?.msg ?? "").includes("password change required");
+}
+
+/** 人话 msg：优先信封 msg，未知透传后端原文 */
+export function errMsg(e: unknown): string {
+	const err = e as { msg?: string, data?: { msg?: string } } | null;
+	return err?.msg ?? err?.data?.msg ?? (e instanceof Error ? e.message : String(e));
+}
+
+/**
+ * 已知业务错误 → i18n 人话；未知透传后端 msg。与后端 fail(status, message)
+ * 的 message 逐字匹配（users.ts 等 service 的 fail 文案）。
+ */
+export function explainError(e: unknown, t: (key: string) => string): string {
+	if (isForbidden(e))
+		return t("system:err.forbidden");
+	if (isMustChange(e))
+		return t("system:err.mustChange.title");
+	const msg = errMsg(e);
+	if (msg.includes("yourself"))
+		return t("system:err.selfAction");
+	if (msg.includes("password too short"))
+		return t("system:err.pwdTooShort");
+	if (msg.includes("username exists"))
+		return t("system:err.usernameExists");
+	if (msg.includes("reserved"))
+		return t("system:err.usernameReserved");
+	return msg;
+}

package/templates/web/src/system/pages/forbidden.tsx

@@ -0,0 +1,35 @@
+import type { TFunction } from "i18next";
+
+import { Button, Card, Result } from "antd";
+import { useNavigate } from "react-router";
+
+import { isMustChange } from "./errors";
+
+/**
+ * 页面级「无权限」面板：路由可进但 API 403——规格 §4：渲染引导而非落 error
+ * boundary。路由级门禁由 requiredRoles 过滤（B16）负责，本组件不承担。
+ *
+ * 特判 must_change（后端对未改密用户拒绝全部管理端点）：渲染改密引导卡跳
+ * /change-password——表单唯一真源在 login 模块，此处不重复实现（DRY）。
+ */
+export function ForbiddenPanel({ t, error }: { t: TFunction, error?: unknown }) {
+	const navigate = useNavigate();
+
+	if (isMustChange(error)) {
+		return (
+			<Card style={{ maxWidth: 480, margin: "48px auto" }}>
+				<Result
+					status="warning"
+					title={t("system:err.mustChange.title")}
+					subTitle={t("system:err.mustChange.hint")}
+					extra={(
+						<Button type="primary" onClick={() => navigate("/change-password")}>
+							{t("system:err.mustChange.go")}
+						</Button>
+					)}
+				/>
+			</Card>
+		);
+	}
+	return <Result status="403" title={t("system:err.forbidden")} />;
+}

package/templates/web/src/system/pages/login-methods/index.tsx

@@ -0,0 +1,29 @@
+import { useQuery } from "@tanstack/react-query";
+import { Card, Descriptions, Tag } from "antd";
+import { useTranslation } from "react-i18next";
+
+import { systemLoginMethodsGet } from "../../__client/api";
+
+const METHOD_KEY: Record<string, string> = {
+	local: "system:loginMethodsPage.methodLocal",
+	ldap: "system:loginMethodsPage.methodLdap",
+	sso: "system:loginMethodsPage.methodSso",
+};
+
+/** 登录方式发现（C5/D2，只读）：local 恒在，ldap/sso 由设置项开关。 */
+export default function LoginMethodsPage() {
+	const { t } = useTranslation();
+	const query = useQuery({ queryKey: ["system", "login-methods"], queryFn: systemLoginMethodsGet });
+
+	return (
+		<Card loading={query.isLoading} title={t("system:loginMethodsPage.title")}>
+			<Descriptions column={1}>
+				<Descriptions.Item label={t("system:menu.loginMethods")}>
+					{(query.data?.methods ?? []).map(m => (
+						<Tag key={m}>{METHOD_KEY[m] ? t(METHOD_KEY[m]) : m}</Tag>
+					))}
+				</Descriptions.Item>
+			</Descriptions>
+		</Card>
+	);
+}