@qimen-lab/core 0.1.1

package/dist/oauth2/OAuth2Manager.esm.js

@@ -0,0 +1,339 @@
+/**
+ * OAuth2Manager - OAuth2 认证核心管理器
+ *
+ * 职责：
+ * - 管理完整的 Token 生命周期（获取/刷新/撤销）
+ * - 支持密码模式、授权码模式、客户端凭证模式
+ * - 并发刷新去重
+ * - 事件通知
+ *
+ * @module oauth2/OAuth2Manager
+ */
+import { createTokenStorage } from './TokenStorage';
+import { DomainRegistrar } from '@/registry/registrars/DomainRegistrar';
+/**
+ * OAuth2 核心管理器
+ */
+export class OAuth2Manager {
+    constructor() {
+        this.config = null;
+        this.storage = createTokenStorage();
+        this.refreshPromise = null;
+        this.listeners = new Map();
+    }
+    /**
+     * 配置 OAuth2 参数
+     */
+    configure(config) {
+        this.config = config;
+        this.storage = createTokenStorage(config.storage);
+        // 尝试从存储恢复 token
+        const entry = this.storage.get();
+        if (entry === null || entry === void 0 ? void 0 : entry.accessToken) {
+            this.applyToken(entry.accessToken);
+        }
+    }
+    /**
+     * 密码模式登录
+     */
+    async loginWithPassword(credentials) {
+        const params = {
+            grant_type: 'password',
+            username: credentials.username,
+            password: credentials.password,
+        };
+        if (credentials.scope) {
+            params.scope = credentials.scope;
+        }
+        return this.requestToken(params);
+    }
+    /**
+     * 授权码换 token
+     */
+    async loginWithCode(code) {
+        var _a;
+        if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.redirectUri)) {
+            return {
+                success: false,
+                error: { message: 'redirectUri is required for authorization_code grant' },
+            };
+        }
+        const params = {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: this.config.redirectUri,
+        };
+        return this.requestToken(params);
+    }
+    /**
+     * 客户端凭证模式
+     */
+    async loginWithClientCredentials() {
+        const params = {
+            grant_type: 'client_credentials',
+        };
+        return this.requestToken(params);
+    }
+    /**
+     * 刷新 token（防并发去重）
+     */
+    async refreshToken() {
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this.doRefresh();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    /**
+     * 撤销 token
+     */
+    async revokeToken() {
+        var _a;
+        const entry = this.storage.get();
+        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) || !((_a = this.config) === null || _a === void 0 ? void 0 : _a.revokeEndpoint))
+            return;
+        try {
+            const params = {
+                token: entry.accessToken,
+            };
+            if (entry.tokenType) {
+                params.token_type_hint = entry.tokenType;
+            }
+            await this.sendRequest(this.config.revokeEndpoint, params);
+        }
+        catch (_b) {
+            // 撤销失败不阻塞登出流程
+        }
+    }
+    /**
+     * 获取当前有效 token
+     */
+    getToken() {
+        const entry = this.storage.get();
+        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken))
+            return null;
+        // 检查是否过期
+        if (this.isTokenExpired(entry)) {
+            return null;
+        }
+        return entry.accessToken;
+    }
+    /**
+     * 是否已认证
+     */
+    isAuthenticated() {
+        return this.getToken() !== null;
+    }
+    /**
+     * 登出（清除 token + 撤销）
+     */
+    async logout() {
+        await this.revokeToken();
+        this.storage.clear();
+        this.clearAppliedToken();
+    }
+    /**
+     * 获取授权码模式跳转 URL
+     */
+    getAuthorizationUrl(state) {
+        var _a, _b, _c, _d;
+        if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.authorizationEndpoint)) {
+            throw new Error('authorizationEndpoint is required');
+        }
+        if (!((_b = this.config) === null || _b === void 0 ? void 0 : _b.clientId)) {
+            throw new Error('clientId is required');
+        }
+        if (!((_c = this.config) === null || _c === void 0 ? void 0 : _c.redirectUri)) {
+            throw new Error('redirectUri is required');
+        }
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+        });
+        if ((_d = this.config.scopes) === null || _d === void 0 ? void 0 : _d.length) {
+            params.set('scope', this.config.scopes.join(' '));
+        }
+        if (state) {
+            params.set('state', state);
+        }
+        return `${this.config.authorizationEndpoint}?${params.toString()}`;
+    }
+    /**
+     * 跳转到授权页面
+     */
+    authorize(state) {
+        const url = this.getAuthorizationUrl(state);
+        window.location.href = url;
+    }
+    /**
+     * 监听事件
+     */
+    on(event, handler) {
+        if (!this.listeners.has(event)) {
+            this.listeners.set(event, new Set());
+        }
+        this.listeners.get(event).add(handler);
+        return () => { var _a; return (_a = this.listeners.get(event)) === null || _a === void 0 ? void 0 : _a.delete(handler); };
+    }
+    // ---- 内部方法 ----
+    async requestToken(params) {
+        var _a;
+        if (!this.config) {
+            return { success: false, error: { message: 'OAuth2 is not configured' } };
+        }
+        // 添加客户端认证
+        if (this.config.clientId) {
+            params.client_id = this.config.clientId;
+        }
+        if (this.config.clientSecret) {
+            params.client_secret = this.config.clientSecret;
+        }
+        if (((_a = this.config.scopes) === null || _a === void 0 ? void 0 : _a.length) && !params.scope) {
+            params.scope = this.config.scopes.join(' ');
+        }
+        try {
+            const response = await this.sendRequest(this.config.tokenEndpoint, params);
+            if (!response.ok) {
+                const errorData = await this.parseErrorResponse(response);
+                return {
+                    success: false,
+                    error: {
+                        code: errorData.error,
+                        message: errorData.error_description ||
+                            `Token request failed: ${response.status}`,
+                    },
+                };
+            }
+            const tokenData = await response.json();
+            this.saveToken(tokenData);
+            this.applyToken(tokenData.access_token);
+            this.emit('oauth2:token-acquired', {
+                accessToken: tokenData.access_token,
+                refreshToken: tokenData.refresh_token,
+                expiresIn: tokenData.expires_in,
+            });
+            return {
+                success: true,
+                accessToken: tokenData.access_token,
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { message: e.message || 'Network error' },
+            };
+        }
+    }
+    async doRefresh() {
+        const entry = this.storage.get();
+        if (!(entry === null || entry === void 0 ? void 0 : entry.refreshToken) || !this.config) {
+            this.emit('oauth2:refresh-failed', { error: new Error('No refresh token available') });
+            return false;
+        }
+        const params = {
+            grant_type: 'refresh_token',
+            refresh_token: entry.refreshToken,
+        };
+        if (this.config.clientId) {
+            params.client_id = this.config.clientId;
+        }
+        if (this.config.clientSecret) {
+            params.client_secret = this.config.clientSecret;
+        }
+        try {
+            const response = await this.sendRequest(this.config.tokenEndpoint, params);
+            if (!response.ok) {
+                this.emit('oauth2:refresh-failed', {
+                    error: new Error(`Refresh failed: ${response.status}`),
+                });
+                return false;
+            }
+            const tokenData = await response.json();
+            this.saveToken(tokenData);
+            this.applyToken(tokenData.access_token);
+            this.emit('oauth2:token-refreshed', {
+                accessToken: tokenData.access_token,
+                refreshToken: tokenData.refresh_token,
+                expiresIn: tokenData.expires_in,
+            });
+            return true;
+        }
+        catch (e) {
+            this.emit('oauth2:refresh-failed', { error: e });
+            return false;
+        }
+    }
+    saveToken(tokenData) {
+        const entry = {
+            accessToken: tokenData.access_token,
+            refreshToken: tokenData.refresh_token,
+            tokenType: tokenData.token_type,
+            expiresIn: tokenData.expires_in,
+            scope: tokenData.scope,
+            acquiredAt: Date.now(),
+        };
+        this.storage.set(entry);
+    }
+    applyToken(accessToken) {
+        if (!this.config)
+            return;
+        const domains = Array.isArray(this.config.domain)
+            ? this.config.domain
+            : [this.config.domain];
+        DomainRegistrar.getInstance().updateToken(accessToken, ...domains);
+    }
+    clearAppliedToken() {
+        if (!this.config)
+            return;
+        const domains = Array.isArray(this.config.domain)
+            ? this.config.domain
+            : [this.config.domain];
+        DomainRegistrar.getInstance().clearToken(...domains);
+    }
+    isTokenExpired(entry) {
+        var _a, _b;
+        if (!entry.expiresIn)
+            return false;
+        const buffer = (_b = (_a = this.config) === null || _a === void 0 ? void 0 : _a.refreshBuffer) !== null && _b !== void 0 ? _b : 60000;
+        return Date.now() >= entry.acquiredAt + entry.expiresIn * 1000 - buffer;
+    }
+    async sendRequest(url, params) {
+        return fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(params).toString(),
+        });
+    }
+    async parseErrorResponse(response) {
+        try {
+            return await response.json();
+        }
+        catch (_a) {
+            return {};
+        }
+    }
+    emit(event, data) {
+        const handlers = this.listeners.get(event);
+        if (!handlers)
+            return;
+        for (const handler of handlers) {
+            try {
+                handler(data);
+            }
+            catch (_a) {
+                // 事件处理器异常不阻塞主流程
+            }
+        }
+    }
+}
+/**
+ * 全局单例
+ */
+export const oauth2 = new OAuth2Manager();
+//# sourceMappingURL=OAuth2Manager.js.map

package/dist/oauth2/OAuth2Manager.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuth2Manager.js","sourceRoot":"","sources":["../../../src/oauth2/OAuth2Manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,EAAE,kBAAkB,EAAsB,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAExE;;GAEG;AACH,MAAM,OAAO,aAAa;IAA1B;QACY,WAAM,GAAwB,IAAI,CAAC;QACnC,YAAO,GAAkB,kBAAkB,EAAE,CAAC;QAC9C,mBAAc,GAA4B,IAAI,CAAC;QAC/C,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;IA2V9D,CAAC;IAzVG;;OAEG;IACH,SAAS,CAAC,MAAoB;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElD,gBAAgB;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,WAAsC;QAC1D,MAAM,MAAM,GAA2B;YACnC,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;SACjC,CAAC;QAEF,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;;QAC5B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,WAAW,CAAA,EAAE,CAAC;YAC5B,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE;aAC7E,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAA2B;YACnC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACxC,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,0BAA0B;QAC5B,MAAM,MAAM,GAA2B;YACnC,UAAU,EAAE,oBAAoB;SACnC,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QACd,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC;QACrC,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC/B,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,CAAA,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,cAAc,CAAA;YAAE,OAAO;QAEhE,IAAI,CAAC;YACD,MAAM,MAAM,GAA2B;gBACnC,KAAK,EAAE,KAAK,CAAC,WAAW;aAC3B,CAAC;YAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC;YAC7C,CAAC;YAED,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,WAAM,CAAC;YACL,cAAc;QAClB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,CAAA;YAAE,OAAO,IAAI,CAAC;QAErC,SAAS;QACT,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC,WAAW,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,eAAe;QACX,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAAc;;QAC9B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,qBAAqB,CAAA,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,QAAQ,CAAA,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,WAAW,CAAA,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAC/B,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACxC,CAAC,CAAC;QAEH,IAAI,MAAA,IAAI,CAAC,MAAM,CAAC,MAAM,0CAAE,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAc;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,EAAE,CAAC,KAAa,EAAE,OAAiB;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,GAAG,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,0CAAE,MAAM,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC;IAC5D,CAAC;IAED,iBAAiB;IAET,KAAK,CAAC,YAAY,CAAC,MAA8B;;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC9E,CAAC;QAED,UAAU;QACV,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpD,CAAC;QACD,IAAI,CAAA,MAAA,IAAI,CAAC,MAAM,CAAC,MAAM,0CAAE,MAAM,KAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAE3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBAC1D,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACH,IAAI,EAAE,SAAS,CAAC,KAAK;wBACrB,OAAO,EACH,SAAS,CAAC,iBAAiB;4BAC3B,yBAAyB,QAAQ,CAAC,MAAM,EAAE;qBACjD;iBACJ,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAwB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAExC,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBAC/B,WAAW,EAAE,SAAS,CAAC,YAAY;gBACnC,YAAY,EAAE,SAAS,CAAC,aAAa;gBACrC,SAAS,EAAE,SAAS,CAAC,UAAU;aAClC,CAAC,CAAC;YAEH,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,SAAS,CAAC,YAAY;aACtC,CAAC;QACN,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,eAAe,EAAE;aACnD,CAAC;QACN,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,CAAA,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAA2B;YACnC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;SACpC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpD,CAAC;QAED,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAE3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC/B,KAAK,EAAE,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,EAAE,CAAC;iBACzD,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,SAAS,GAAwB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAExC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBAChC,WAAW,EAAE,SAAS,CAAC,YAAY;gBACnC,YAAY,EAAE,SAAS,CAAC,aAAa;gBACrC,SAAS,EAAE,SAAS,CAAC,UAAU;aAClC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,SAA8B;QAC5C,MAAM,KAAK,GAAqB;YAC5B,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,YAAY,EAAE,SAAS,CAAC,aAAa;YACrC,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACzB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAEO,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YACpB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,eAAe,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC;IACvE,CAAC;IAEO,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YACpB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,eAAe,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC;IACzD,CAAC;IAEO,cAAc,CAAC,KAAuB;;QAC1C,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,MAAM,GAAG,MAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,aAAa,mCAAI,KAAK,CAAC;QACnD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,MAA8B;QACjE,OAAO,KAAK,CAAC,GAAG,EAAE;YACd,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SAC/C,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC5B,QAAkB;QAElB,IAAI,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,IAAS;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAAC,WAAM,CAAC;gBACL,gBAAgB;YACpB,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC"}

package/dist/oauth2/OAuth2Manager.js

@@ -0,0 +1,343 @@
+"use strict";
+/**
+ * OAuth2Manager - OAuth2 认证核心管理器
+ *
+ * 职责：
+ * - 管理完整的 Token 生命周期（获取/刷新/撤销）
+ * - 支持密码模式、授权码模式、客户端凭证模式
+ * - 并发刷新去重
+ * - 事件通知
+ *
+ * @module oauth2/OAuth2Manager
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauth2 = exports.OAuth2Manager = void 0;
+const TokenStorage_1 = require("./TokenStorage");
+const DomainRegistrar_1 = require("@/registry/registrars/DomainRegistrar");
+/**
+ * OAuth2 核心管理器
+ */
+class OAuth2Manager {
+    constructor() {
+        this.config = null;
+        this.storage = (0, TokenStorage_1.createTokenStorage)();
+        this.refreshPromise = null;
+        this.listeners = new Map();
+    }
+    /**
+     * 配置 OAuth2 参数
+     */
+    configure(config) {
+        this.config = config;
+        this.storage = (0, TokenStorage_1.createTokenStorage)(config.storage);
+        // 尝试从存储恢复 token
+        const entry = this.storage.get();
+        if (entry === null || entry === void 0 ? void 0 : entry.accessToken) {
+            this.applyToken(entry.accessToken);
+        }
+    }
+    /**
+     * 密码模式登录
+     */
+    async loginWithPassword(credentials) {
+        const params = {
+            grant_type: 'password',
+            username: credentials.username,
+            password: credentials.password,
+        };
+        if (credentials.scope) {
+            params.scope = credentials.scope;
+        }
+        return this.requestToken(params);
+    }
+    /**
+     * 授权码换 token
+     */
+    async loginWithCode(code) {
+        var _a;
+        if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.redirectUri)) {
+            return {
+                success: false,
+                error: { message: 'redirectUri is required for authorization_code grant' },
+            };
+        }
+        const params = {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: this.config.redirectUri,
+        };
+        return this.requestToken(params);
+    }
+    /**
+     * 客户端凭证模式
+     */
+    async loginWithClientCredentials() {
+        const params = {
+            grant_type: 'client_credentials',
+        };
+        return this.requestToken(params);
+    }
+    /**
+     * 刷新 token（防并发去重）
+     */
+    async refreshToken() {
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this.doRefresh();
+        try {
+            return await this.refreshPromise;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    /**
+     * 撤销 token
+     */
+    async revokeToken() {
+        var _a;
+        const entry = this.storage.get();
+        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken) || !((_a = this.config) === null || _a === void 0 ? void 0 : _a.revokeEndpoint))
+            return;
+        try {
+            const params = {
+                token: entry.accessToken,
+            };
+            if (entry.tokenType) {
+                params.token_type_hint = entry.tokenType;
+            }
+            await this.sendRequest(this.config.revokeEndpoint, params);
+        }
+        catch (_b) {
+            // 撤销失败不阻塞登出流程
+        }
+    }
+    /**
+     * 获取当前有效 token
+     */
+    getToken() {
+        const entry = this.storage.get();
+        if (!(entry === null || entry === void 0 ? void 0 : entry.accessToken))
+            return null;
+        // 检查是否过期
+        if (this.isTokenExpired(entry)) {
+            return null;
+        }
+        return entry.accessToken;
+    }
+    /**
+     * 是否已认证
+     */
+    isAuthenticated() {
+        return this.getToken() !== null;
+    }
+    /**
+     * 登出（清除 token + 撤销）
+     */
+    async logout() {
+        await this.revokeToken();
+        this.storage.clear();
+        this.clearAppliedToken();
+    }
+    /**
+     * 获取授权码模式跳转 URL
+     */
+    getAuthorizationUrl(state) {
+        var _a, _b, _c, _d;
+        if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.authorizationEndpoint)) {
+            throw new Error('authorizationEndpoint is required');
+        }
+        if (!((_b = this.config) === null || _b === void 0 ? void 0 : _b.clientId)) {
+            throw new Error('clientId is required');
+        }
+        if (!((_c = this.config) === null || _c === void 0 ? void 0 : _c.redirectUri)) {
+            throw new Error('redirectUri is required');
+        }
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+        });
+        if ((_d = this.config.scopes) === null || _d === void 0 ? void 0 : _d.length) {
+            params.set('scope', this.config.scopes.join(' '));
+        }
+        if (state) {
+            params.set('state', state);
+        }
+        return `${this.config.authorizationEndpoint}?${params.toString()}`;
+    }
+    /**
+     * 跳转到授权页面
+     */
+    authorize(state) {
+        const url = this.getAuthorizationUrl(state);
+        window.location.href = url;
+    }
+    /**
+     * 监听事件
+     */
+    on(event, handler) {
+        if (!this.listeners.has(event)) {
+            this.listeners.set(event, new Set());
+        }
+        this.listeners.get(event).add(handler);
+        return () => { var _a; return (_a = this.listeners.get(event)) === null || _a === void 0 ? void 0 : _a.delete(handler); };
+    }
+    // ---- 内部方法 ----
+    async requestToken(params) {
+        var _a;
+        if (!this.config) {
+            return { success: false, error: { message: 'OAuth2 is not configured' } };
+        }
+        // 添加客户端认证
+        if (this.config.clientId) {
+            params.client_id = this.config.clientId;
+        }
+        if (this.config.clientSecret) {
+            params.client_secret = this.config.clientSecret;
+        }
+        if (((_a = this.config.scopes) === null || _a === void 0 ? void 0 : _a.length) && !params.scope) {
+            params.scope = this.config.scopes.join(' ');
+        }
+        try {
+            const response = await this.sendRequest(this.config.tokenEndpoint, params);
+            if (!response.ok) {
+                const errorData = await this.parseErrorResponse(response);
+                return {
+                    success: false,
+                    error: {
+                        code: errorData.error,
+                        message: errorData.error_description ||
+                            `Token request failed: ${response.status}`,
+                    },
+                };
+            }
+            const tokenData = await response.json();
+            this.saveToken(tokenData);
+            this.applyToken(tokenData.access_token);
+            this.emit('oauth2:token-acquired', {
+                accessToken: tokenData.access_token,
+                refreshToken: tokenData.refresh_token,
+                expiresIn: tokenData.expires_in,
+            });
+            return {
+                success: true,
+                accessToken: tokenData.access_token,
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: { message: e.message || 'Network error' },
+            };
+        }
+    }
+    async doRefresh() {
+        const entry = this.storage.get();
+        if (!(entry === null || entry === void 0 ? void 0 : entry.refreshToken) || !this.config) {
+            this.emit('oauth2:refresh-failed', { error: new Error('No refresh token available') });
+            return false;
+        }
+        const params = {
+            grant_type: 'refresh_token',
+            refresh_token: entry.refreshToken,
+        };
+        if (this.config.clientId) {
+            params.client_id = this.config.clientId;
+        }
+        if (this.config.clientSecret) {
+            params.client_secret = this.config.clientSecret;
+        }
+        try {
+            const response = await this.sendRequest(this.config.tokenEndpoint, params);
+            if (!response.ok) {
+                this.emit('oauth2:refresh-failed', {
+                    error: new Error(`Refresh failed: ${response.status}`),
+                });
+                return false;
+            }
+            const tokenData = await response.json();
+            this.saveToken(tokenData);
+            this.applyToken(tokenData.access_token);
+            this.emit('oauth2:token-refreshed', {
+                accessToken: tokenData.access_token,
+                refreshToken: tokenData.refresh_token,
+                expiresIn: tokenData.expires_in,
+            });
+            return true;
+        }
+        catch (e) {
+            this.emit('oauth2:refresh-failed', { error: e });
+            return false;
+        }
+    }
+    saveToken(tokenData) {
+        const entry = {
+            accessToken: tokenData.access_token,
+            refreshToken: tokenData.refresh_token,
+            tokenType: tokenData.token_type,
+            expiresIn: tokenData.expires_in,
+            scope: tokenData.scope,
+            acquiredAt: Date.now(),
+        };
+        this.storage.set(entry);
+    }
+    applyToken(accessToken) {
+        if (!this.config)
+            return;
+        const domains = Array.isArray(this.config.domain)
+            ? this.config.domain
+            : [this.config.domain];
+        DomainRegistrar_1.DomainRegistrar.getInstance().updateToken(accessToken, ...domains);
+    }
+    clearAppliedToken() {
+        if (!this.config)
+            return;
+        const domains = Array.isArray(this.config.domain)
+            ? this.config.domain
+            : [this.config.domain];
+        DomainRegistrar_1.DomainRegistrar.getInstance().clearToken(...domains);
+    }
+    isTokenExpired(entry) {
+        var _a, _b;
+        if (!entry.expiresIn)
+            return false;
+        const buffer = (_b = (_a = this.config) === null || _a === void 0 ? void 0 : _a.refreshBuffer) !== null && _b !== void 0 ? _b : 60000;
+        return Date.now() >= entry.acquiredAt + entry.expiresIn * 1000 - buffer;
+    }
+    async sendRequest(url, params) {
+        return fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(params).toString(),
+        });
+    }
+    async parseErrorResponse(response) {
+        try {
+            return await response.json();
+        }
+        catch (_a) {
+            return {};
+        }
+    }
+    emit(event, data) {
+        const handlers = this.listeners.get(event);
+        if (!handlers)
+            return;
+        for (const handler of handlers) {
+            try {
+                handler(data);
+            }
+            catch (_a) {
+                // 事件处理器异常不阻塞主流程
+            }
+        }
+    }
+}
+exports.OAuth2Manager = OAuth2Manager;
+/**
+ * 全局单例
+ */
+exports.oauth2 = new OAuth2Manager();
+//# sourceMappingURL=OAuth2Manager.js.map