@olares/lares-mobile 0.15.2 → 0.15.5

package/README.md

@@ -19,6 +19,24 @@ import { LaresApp, laresPortsFromAccount, findLaresEntrance } from "@olares/lare
 
 PC 预览：`IS_PC_TEST` 时走 `/laresHost` 代理，`laresPortsFromAccount` 会继续用 `PROTOCOL` / `LARES_SUB_DOMAIN` / `ACCOUNT_DOMAIN`。自定义鉴权请求再传 `request`。
 
+宿主页面与 Host 跨源时（打包桌面端是 `file://`）必须传 `request`，浏览器不会带上 Olares cookie，靠 cookie 的默认实现一律 401。`request` 会用在所有调用上，包括聊天附件上传和语音转写这两个二进制请求——它们的 `body` 是 `File` / `Blob`，`headers` 里自带 `content-type`，实现里不要再当成 JSON 序列化。
+
+```js
+async function request(url, { method = "GET", body, headers, signal } = {}) {
+  // body 可能是 File / Blob，原样发出去
+  const res = await send(url, { method, body, headers, signal, token });
+  return { ok: res.ok, status: res.status, body: res.json }; // 4xx 也要返回，不要 throw
+}
+```
+
+事件流 `/api/events.mux` 是唯一带不了 header 的调用——浏览器 `WebSocket` 构造器不收 header。Olares 会从 `Sec-WebSocket-Protocol` 取 token 提升成 `X-Authorization` 再走入口鉴权，所以另外传 `socketProtocol`：
+
+```js
+ports.socketProtocol = () => currentUser.access_token; // 传函数则每次连接现取，换 token 无需重建 runtime
+```
+
+也接受直接给字符串或数组。**不传就不传**，不要传空串——服务端不回应的子协议会让握手直接失败，同源的 PC 端保持裸构造。
+
 切账号时更新 `baseUrl` / `env` 即可，客户端会丢掉上一台的 runtime 和设置缓存，改连新 Host。
 
 本地联调（包未上 registry 时）：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olares/lares-mobile",
-  "version": "0.15.2",
+  "version": "0.15.5",
   "description": "Lares chat component for LarePass",
   "type": "module",
   "repository": {
@@ -28,7 +28,7 @@
     "vue": "^3.2.0"
   },
   "dependencies": {
-    "@olares/lares-core": "0.15.2",
+    "@olares/lares-core": "0.15.5",
     "markdown-it": "^14.3.0"
   }
 }

package/src/App.vue

@@ -110,6 +110,7 @@
 </template>
 
 <script>
+import { pickHostPorts } from "@olares/lares-core/larepass/host";
 import { connectChat } from "./runtime.js";
 import { createT } from "./i18n.js";
 import { failText, withPendingUser } from "./chat/format.js";
@@ -140,6 +141,9 @@ export default {
     proxyPrefix: { type: String, default: undefined },
     request: { type: Function, default: undefined },
     env: { type: Object, default: undefined },
+    // Vue drops an undeclared prop into attrs, so a port missing from this list
+    // never reaches `ports` below no matter what the host passes.
+    socketProtocol: { type: [Function, String, Array], default: undefined },
   },
   data() {
     return {
@@ -178,12 +182,9 @@ export default {
   },
   computed: {
     ports() {
-      return {
-        baseUrl: this.baseUrl,
-        proxyPrefix: this.proxyPrefix,
-        request: this.request,
-        env: this.env,
-      };
+      // Built from the canonical key list rather than spelled out, so adding a
+      // port does not need this object edited in lockstep.
+      return pickHostPorts(this);
     },
     runtime() {
       return connectChat(this.ports);

package/src/host.js

@@ -15,7 +15,25 @@ function pageOrigin() {
   }
 }
 
-function openMuxSocket(httpUrl, signal) {
+/**
+ * A browser `WebSocket` takes no headers, so the mux upgrade cannot carry the
+ * `X-Authorization` every other call uses and a cross-origin host page — a
+ * packaged LarePass build sends no Olares cookie — is answered 401. Olares
+ * reads the token off `Sec-WebSocket-Protocol` instead and promotes it to the
+ * header before the entrance auth runs, so the host hands one down here.
+ *
+ * Read at connect time rather than captured with the client: a refreshed token
+ * then lands on the next reconnect instead of needing a rebuilt runtime.
+ */
+function socketProtocols(ports) {
+  const value = typeof ports.socketProtocol === "function"
+    ? ports.socketProtocol()
+    : ports.socketProtocol;
+  if (Array.isArray(value)) return value.length > 0 ? value : undefined;
+  return value ? String(value) : undefined;
+}
+
+function openMuxSocket(httpUrl, signal, protocols) {
   const Socket = globalThis.WebSocket;
   if (typeof Socket !== "function") {
     return Promise.resolve({
@@ -26,7 +44,10 @@ function openMuxSocket(httpUrl, signal) {
   }
   return new Promise((resolve) => {
     let settled = false;
-    const socket = new Socket(muxWsUrl(httpUrl, pageOrigin()));
+    const url = muxWsUrl(httpUrl, pageOrigin());
+    // Offering a subprotocol the server does not echo back aborts the
+    // handshake, so a host that hands down none keeps the bare constructor.
+    const socket = protocols === undefined ? new Socket(url) : new Socket(url, protocols);
     const finish = (result) => {
       if (settled) return;
       settled = true;
@@ -137,15 +158,26 @@ export function createHostClient(ports = {}) {
     downloadUrl(sessionId, path) {
       return urlFor(downloadFileUrl(sessionId, path));
     },
+    // Both carry a binary body, so neither can go through `request` as an RPC —
+    // but both must still ride the host's auth. `ports.request` is passed
+    // through rather than called here so a host that supplies none keeps the
+    // cookie `fetch` these two used before.
     upload(sessionId, file, options) {
-      return uploadFile(file, sessionId, { ...options, url: urlFor(FILES_UPLOAD_PATH) });
+      return uploadFile(file, sessionId, {
+        ...options,
+        url: urlFor(FILES_UPLOAD_PATH),
+        request: ports.request,
+      });
     },
     transcribe(blob, language, signal) {
-      return postTranscribe(blob, language, signal, { baseUrl: urlFor(VOICE_API) });
+      return postTranscribe(blob, language, signal, {
+        baseUrl: urlFor(VOICE_API),
+        request: ports.request,
+      });
     },
     async openMux(signal) {
       try {
-        return await openMuxSocket(urlFor(MUX_PATH), signal);
+        return await openMuxSocket(urlFor(MUX_PATH), signal, socketProtocols(ports));
       } catch (err) {
         return {
           ok: false,

package/src/index.d.ts

@@ -25,6 +25,11 @@ export type HostPorts = {
   proxyPrefix?: string;
   env?: HostEnv;
   request?: (url: string, init?: HostRequestInit) => Promise<HostResponse>;
+  /**
+   * Token offered as `Sec-WebSocket-Protocol` on the mux upgrade, which cannot
+   * carry `X-Authorization`. Pass a function to have it read per connect.
+   */
+  socketProtocol?: string | string[] | (() => string | string[] | undefined);
 };
 
 export const PC_TEST_PROXY: string;