@oj-module/cli 0.1.21 → 0.2.2

package/templates/pnpm-workspace.yaml

@@ -3,3 +3,12 @@
 # 命令报 ERR_PNPM_IGNORED_BUILDS（0.1.0 发布实测）。
 allowBuilds:
   esbuild: true
+
+# @oj-module/cli 经 `catalog:` 拉 @redocly/cli，但 catalog 协议只作用于 workspace
+# 自有 package.json 的依赖，对 cli（外部包）的 catalog: 传递依赖无效；生成工程
+# 不钉的话会漂到 latest，新发布的版本（如 2.64.1，发布当日）会撞本机
+# minimumReleaseAge supply-chain 策略被拒（ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION）。
+# 用 override 钉死到仓库 pnpm-workspace.yaml 的 minimumReleaseAgeExclude 白名单版本
+# 2.51.0（cli 实测通过的区间 ^2.51.0 内，且发布已久、过策略）。
+overrides:
+  '@redocly/cli': 2.51.0

package/templates/web/src/auth/__client/api.schemas.ts

@@ -4,5 +4,10 @@
 import { z } from "@oj-module/runtime";
 
 export const schemas = {
-
+	"authPasswordPut": {
+		body: z.object({
+	"old_password": z.string().min(1),
+	"new_password": z.string().min(6)
+}),
+	},
 };

package/templates/web/src/auth/__client/api.ts

@@ -33,7 +33,7 @@ export function createAuthClient(ctx: ModuleContext) {
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { authLoginPost, authLogoutPost, authRefreshPost };
+	return { authLoginPost, authLogoutPost, authRefreshPost, authPasswordPut, authLdapLoginPost };
 }
 
 /**
@@ -108,3 +108,35 @@ export async function authRefreshPost(): Promise<unknown> {
 		throw await toApiError(e);
 	}
 }
+
+export type AuthPasswordPutBody = z.input<(typeof schemas)["authPasswordPut"]["body"]>;
+
+export async function authPasswordPut(body: AuthPasswordPutBody): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`auth/password`, { json: body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export async function authLdapLoginPost(): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`auth/ldap-login`).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}

package/templates/web/src/login/entry.ts

@@ -34,6 +34,23 @@ export default defineModule({
 				},
 			],
 		},
+		{
+			// 首登/重置后强制改密（must_change 悬挂期唯一可用写端）；
+			// 管理面 403 msg=password change required 时也引导至此
+			path: "/change-password",
+			handle: {
+				layout: "fullscreen",
+				hideInMenu: true,
+				title: "login:page.changePwd.title",
+			},
+			children: [
+				{
+					index: true,
+					Component: lazy(() => import("./pages/change-password")),
+					handle: { title: "login:page.changePwd.title", hideInMenu: true },
+				},
+			],
+		},
 	],
 	i18n: {
 		"zh-CN": () => import("./locales/zh-CN.json"),

package/templates/web/src/login/locales/en-US.json

@@ -1,10 +1,20 @@
 {
 	"page": {
 		"title": "Sign in",
-		"subtitle": "Scaffold seed account: admin / 123456",
+		"subtitle": "Please sign in to continue",
 		"username": "Username",
 		"password": "Password",
 		"submit": "Sign in",
-		"success": "Signed in"
+		"success": "Signed in",
+		"changePwd": {
+			"title": "Change Password",
+			"hint": "After first login or an admin reset, you must change your password before using the system.",
+			"old": "Current password",
+			"new": "New password",
+			"confirm": "Confirm new password",
+			"min": "At least 6 characters",
+			"mismatch": "Passwords do not match",
+			"submit": "Change & sign in again"
+		}
 	}
 }

package/templates/web/src/login/locales/zh-CN.json

@@ -1,10 +1,20 @@
 {
 	"page": {
 		"title": "登录",
-		"subtitle": "脚手架种子账号：admin / 123456",
+		"subtitle": "请登录以继续使用系统",
 		"username": "用户名",
 		"password": "密码",
 		"submit": "登 录",
-		"success": "登录成功"
+		"success": "登录成功",
+		"changePwd": {
+			"title": "修改密码",
+			"hint": "首次登录或管理员重置口令后，需先修改密码才能使用系统。",
+			"old": "当前密码",
+			"new": "新密码",
+			"confirm": "确认新密码",
+			"min": "至少 6 位",
+			"mismatch": "两次输入的新密码不一致",
+			"submit": "修改并重新登录"
+		}
 	}
 }

package/templates/web/src/login/pages/change-password.tsx

@@ -0,0 +1,74 @@
+import { fetchChangePassword } from "@oj-module/runtime";
+
+import { Alert, Button, Form, Input, Typography } from "antd";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useNavigate } from "react-router";
+
+interface ChangePwdValues {
+	old_password: string
+	new_password: string
+	confirm: string
+}
+
+/**
+ * 首登/重置后强制改密页（AC1-27）：must_change 悬挂期唯一可用写端是
+ * PUT /api/auth/password（后端对未改密用户拒绝其余全部端点）。登录响应
+ * data.user.must_change / 管理面 403 msg 均会引导到此页。走 runtime 全局
+ * request 出口（fetchChangePassword）——auth 无 web 模块、无 client 宿。
+ */
+export default function ChangePasswordPage() {
+	const { t } = useTranslation();
+	const navigate = useNavigate();
+	const [error, setError] = useState<string>();
+	const [loading, setLoading] = useState(false);
+
+	async function onFinish(values: ChangePwdValues) {
+		setLoading(true);
+		setError(undefined);
+		try {
+			await fetchChangePassword({ old_password: values.old_password, new_password: values.new_password });
+			// 改密级联吊销 refresh，旧会话状态陈旧——回登录页重新认证
+			navigate("/login");
+		}
+		catch (e) {
+			setError(e instanceof Error ? e.message : String(e));
+		}
+		finally {
+			setLoading(false);
+		}
+	}
+
+	return (
+		<>
+			<Typography.Title level={3}>
+				{t("login:page.changePwd.title")}
+			</Typography.Title>
+			<Typography.Paragraph type="secondary">
+				{t("login:page.changePwd.hint")}
+			</Typography.Paragraph>
+			{error && <Alert style={{ marginBottom: 16 }} type="error" message={error} showIcon />}
+			<Form<ChangePwdValues> layout="vertical" onFinish={onFinish}>
+				<Form.Item name="old_password" label={t("login:page.changePwd.old")} rules={[{ required: true }]}>
+					<Input.Password autoFocus />
+				</Form.Item>
+				<Form.Item name="new_password" label={t("login:page.changePwd.new")} rules={[{ required: true }, { min: 6 }]} extra={t("login:page.changePwd.min")}>
+					<Input.Password />
+				</Form.Item>
+				<Form.Item
+					name="confirm"
+					label={t("login:page.changePwd.confirm")}
+					dependencies={["new_password"]}
+					rules={[{ required: true }, ({ getFieldValue }) => ({
+						validator: (_, value) => value === getFieldValue("new_password") ? Promise.resolve() : Promise.reject(new Error(t("login:page.changePwd.mismatch"))),
+					})]}
+				>
+					<Input.Password />
+				</Form.Item>
+				<Button type="primary" htmlType="submit" block loading={loading}>
+					{t("login:page.changePwd.submit")}
+				</Button>
+			</Form>
+		</>
+	);
+}

package/templates/web/src/system/__client/api.schemas.ts

@@ -0,0 +1,150 @@
+/* eslint-disable */
+// 生成物：ojm api 从契约生成，勿手改（改动请改契约文件后重跑 ojm api）
+// AC-D15：仅供 DEV 校验动态 import，生产构建不进产物
+import { z } from "@oj-module/runtime";
+
+export const schemas = {
+	"systemLoginMethodsGet": {
+		data: z.object({
+	"methods": z.array(z.string())
+}),
+	},
+	"systemOplogGet": {
+		query: z.object({
+	"action": z.string().optional(),
+	"username": z.string().optional(),
+	"module": z.string().optional(),
+	"limit": z.number().min(1).max(200).optional()
+}),
+		data: z.object({
+	"list": z.array(z.object({
+	"id": z.number(),
+	"create_time": z.number(),
+	"user_id": z.number(),
+	"username": z.string(),
+	"action": z.string(),
+	"module": z.string(),
+	"version": z.string().nullable(),
+	"target": z.string().nullable(),
+	"detail": z.string().nullable(),
+	"level": z.number()
+})),
+	"total": z.number(),
+	"truncated": z.boolean()
+}),
+	},
+	"systemPermissionsGet": {
+		data: z.array(z.object({
+	"code": z.string(),
+	"module": z.string(),
+	"title_key": z.string().nullable(),
+	"deprecated": z.boolean()
+})),
+	},
+	"systemRolesGet": {
+		data: z.array(z.object({
+	"name": z.string(),
+	"module": z.string(),
+	"title": z.string().nullable(),
+	"description": z.string().nullable(),
+	"builtin": z.boolean(),
+	"deprecated": z.boolean(),
+	"holders": z.number(),
+	"permissions": z.array(z.string())
+})),
+	},
+	"systemRolesPost": {
+		body: z.object({
+	"name": // @oj-warn: pattern="^custom\\.[a-z0-9][a-z0-9-]*$" 为 Rust regex，未在前端执行（跨语言语义漂移/ReDoS 风险）
+	z.string(),
+	"title": z.string().min(1),
+	"permissions": z.array(z.string()).optional()
+}),
+		data: z.object({
+	"name": z.string(),
+	"module": z.string()
+}),
+	},
+	"systemRolesDelete": {
+		query: z.object({
+	"name": z.string().min(1)
+}),
+	},
+	"systemRolesBindingsPut": {
+		query: z.object({
+	"name": z.string().min(1)
+}),
+		body: z.object({
+	"permissions": z.array(z.string())
+}),
+	},
+	"systemSettingsGet": {
+		data: z.array(z.object({
+	"group": z.string(),
+	"items": z.array(z.object({
+	"key": z.string(),
+	"module": z.string(),
+	"group": z.string(),
+	"type": z.string(),
+	"value": z.string().nullable(),
+	"default_value": z.string().nullable(),
+	"label_key": z.string().nullable(),
+	"options": z.string().nullable(),
+	"secret": z.boolean(),
+	"update_time": z.number()
+}))
+})),
+	},
+	"systemSettingsPut": {
+		body: z.object({
+	"key": z.string().min(1),
+	"value": z.string()
+}),
+	},
+	"systemUsersGet": {
+		data: z.array(z.object({
+	"id": z.number(),
+	"username": z.string(),
+	"display_name": z.string().nullable(),
+	"email": z.string().nullable(),
+	"is_forbidden": z.boolean(),
+	"must_change": z.boolean(),
+	"roles": z.array(z.string())
+})),
+	},
+	"systemUsersPost": {
+		body: z.object({
+	"username": z.string().min(1),
+	"password": z.string().min(6),
+	"displayName": z.string().optional(),
+	"email": z.string().optional()
+}),
+		data: z.object({
+	"id": z.number()
+}),
+	},
+	"systemUsersForbiddenPut": {
+		query: z.object({
+	"uid": z.number()
+}),
+		body: z.object({
+	"forbidden": z.boolean()
+}),
+	},
+	"systemUsersPasswordPut": {
+		query: z.object({
+	"uid": z.number()
+}),
+		body: z.object({
+	"password": z.string().min(6)
+}),
+	},
+	"systemUsersRolesPut": {
+		query: z.object({
+	"uid": z.number()
+}),
+		body: z.object({
+	"roles": z.array(z.string())
+}),
+	},
+};