@quantabit/security-sdk 1.0.0

package/dist/index.esm.js

@@ -0,0 +1,1444 @@
+import React, { useState, useEffect, useCallback, useContext, createContext } from 'react';
+import { BaseApiClient, logger, consentManager } from '@quantabit/sdk-config';
+
+/**
+ * Security SDK - API 客户端
+ * 安全系统后端接口封装
+ * 
+ * 使用 BaseApiClient 基类简化代码
+ */
+
+
+/**
+ * 安全 API 客户端
+ */
+class SecurityApiClient extends BaseApiClient {
+  constructor(config = {}) {
+    super('/security', config);
+  }
+
+  // ============ 密码管理 ============
+
+  /**
+   * 修改密码
+   * @param {string} oldPassword - 旧密码
+   * @param {string} newPassword - 新密码
+   */
+  async changePassword(oldPassword, newPassword) {
+    return this.post('/password/change', {
+      old_password: oldPassword,
+      new_password: newPassword
+    });
+  }
+
+  /**
+   * 重置密码
+   * @param {string} token - 重置 Token
+   * @param {string} newPassword - 新密码
+   */
+  async resetPassword(token, newPassword) {
+    return this.post('/password/reset', {
+      token,
+      new_password: newPassword
+    });
+  }
+
+  /**
+   * 发送重置密码邮件
+   * @param {string} email - 邮箱
+   */
+  async sendPasswordResetEmail(email) {
+    return this.post('/password/forgot', {
+      email
+    });
+  }
+
+  /**
+   * 验证密码强度
+   * @param {string} password - 密码
+   */
+  async checkPasswordStrength(password) {
+    return this.post('/password/strength', {
+      password
+    });
+  }
+
+  // ============ 双因素认证 ============
+
+  /**
+   * 获取 2FA 状态
+   */
+  async get2FAStatus() {
+    return this.get('/2fa/status');
+  }
+
+  /**
+   * 启用 2FA
+   * @param {string} type - 类型（totp, sms, email）
+   */
+  async enable2FA(type) {
+    return this.post('/2fa/enable', {
+      type
+    });
+  }
+
+  /**
+   * 验证并激活 2FA
+   * @param {string} code - 验证码
+   */
+  async verify2FA(code) {
+    return this.post('/2fa/verify', {
+      code
+    });
+  }
+
+  /**
+   * 禁用 2FA
+   * @param {string} code - 验证码
+   */
+  async disable2FA(code) {
+    return this.post('/2fa/disable', {
+      code
+    });
+  }
+
+  /**
+   * 获取备份码
+   */
+  async getBackupCodes() {
+    return this.get('/2fa/backup-codes');
+  }
+
+  /**
+   * 重新生成备份码
+   */
+  async regenerateBackupCodes() {
+    return this.post('/2fa/backup-codes/regenerate');
+  }
+
+  // ============ 登录安全 ============
+
+  /**
+   * 获取登录历史
+   * @param {Object} params - 查询参数
+   */
+  async getLoginHistory(params = {}) {
+    return this.get('/login/history', params);
+  }
+
+  /**
+   * 获取活动设备
+   */
+  async getActiveDevices() {
+    return this.get('/devices');
+  }
+
+  /**
+   * 登出设备
+   * @param {string} deviceId - 设备 ID
+   */
+  async logoutDevice(deviceId) {
+    return this.post(`/devices/${deviceId}/logout`);
+  }
+
+  /**
+   * 登出所有设备
+   */
+  async logoutAllDevices() {
+    return this.post('/devices/logout-all');
+  }
+
+  /**
+   * 信任设备
+   * @param {string} deviceId - 设备 ID
+   */
+  async trustDevice(deviceId) {
+    return this.post(`/devices/${deviceId}/trust`);
+  }
+
+  // ============ 安全设置 ============
+
+  /**
+   * 获取安全设置
+   */
+  async getSecuritySettings() {
+    return this.get('/settings');
+  }
+
+  /**
+   * 更新安全设置
+   * @param {Object} settings - 设置数据
+   */
+  async updateSecuritySettings(settings) {
+    return this.put('/settings', settings);
+  }
+
+  /**
+   * 获取登录通知设置
+   */
+  async getLoginNotificationSettings() {
+    return this.get('/settings/login-notification');
+  }
+
+  /**
+   * 更新登录通知设置
+   * @param {Object} settings - 设置数据
+   */
+  async updateLoginNotificationSettings(settings) {
+    return this.put('/settings/login-notification', settings);
+  }
+
+  // ============ 安全检查 ============
+
+  /**
+   * 安全状态检查
+   */
+  async getSecurityStatus() {
+    return this.get('/status');
+  }
+
+  /**
+   * 获取安全建议
+   */
+  async getSecurityRecommendations() {
+    return this.get('/recommendations');
+  }
+
+  /**
+   * 获取安全事件
+   * @param {Object} params - 查询参数
+   */
+  async getSecurityEvents(params = {}) {
+    return this.get('/events', params);
+  }
+
+  // ============ 恢复选项 ============
+
+  /**
+   * 获取恢复选项
+   */
+  async getRecoveryOptions() {
+    return this.get('/recovery/options');
+  }
+
+  /**
+   * 设置恢复邮箱
+   * @param {string} email - 恢复邮箱
+   */
+  async setRecoveryEmail(email) {
+    return this.post('/recovery/email', {
+      email
+    });
+  }
+
+  /**
+   * 设置恢复手机
+   * @param {string} phone - 恢复手机
+   */
+  async setRecoveryPhone(phone) {
+    return this.post('/recovery/phone', {
+      phone
+    });
+  }
+
+  /**
+   * 设置安全问题
+   * @param {Object[]} questions - 安全问题列表
+   */
+  async setSecurityQuestions(questions) {
+    return this.post('/recovery/questions', {
+      questions
+    });
+  }
+}
+
+// 创建默认实例
+const securityApi = new SecurityApiClient();
+
+/**
+ * Security SDK - 国际化 i18n
+ */
+
+const SUPPORTED_LANGUAGES = ['en', 'zh', 'ja', 'ko'];
+const messages = {
+  zh: {
+    loading: '加载中...',
+    security: '安全中心',
+    riskControl: '风控中心',
+    // 风险等级
+    riskLow: '低风险',
+    riskMedium: '中风险',
+    riskHigh: '高风险',
+    riskCritical: '极高风险',
+    // 风险类型
+    riskLogin: '登录异常',
+    riskTransaction: '交易风险',
+    riskAccount: '账户安全',
+    riskDevice: '设备异常',
+    riskBehavior: '行为异常',
+    riskContent: '内容违规',
+    // 状态
+    statusNormal: '正常',
+    statusWarning: '警告',
+    statusBlocked: '已拦截',
+    statusReview: '人工审核',
+    // 设备指纹
+    deviceFingerprint: '设备指纹',
+    deviceInfo: '设备信息',
+    trustedDevices: '信任设备',
+    currentDevice: '当前设备',
+    newDevice: '新设备',
+    // 操作
+    verify: '验证',
+    block: '拦截',
+    allow: '放行',
+    review: '审核',
+    appeal: '申诉',
+    // 安全设置
+    securitySettings: '安全设置',
+    loginProtection: '登录保护',
+    paymentProtection: '支付保护',
+    antiTheft: '防盗保护',
+    // 验证
+    captcha: '验证码',
+    smsCode: 'SMS验证',
+    emailCode: '邮箱验证',
+    twoFactor: '两步验证',
+    // 提示
+    riskDetected: '检测到风险',
+    pleaseVerify: '请完成验证',
+    verifySuccess: '验证成功',
+    blocked: '操作已拦截'
+  },
+  en: {
+    loading: 'Loading...',
+    security: 'Security Center',
+    riskControl: 'Risk Control',
+    riskLow: 'Low Risk',
+    riskMedium: 'Medium Risk',
+    riskHigh: 'High Risk',
+    riskCritical: 'Critical',
+    riskLogin: 'Login Anomaly',
+    riskTransaction: 'Transaction Risk',
+    riskAccount: 'Account Security',
+    riskDevice: 'Device Anomaly',
+    riskBehavior: 'Behavior Anomaly',
+    riskContent: 'Content Violation',
+    statusNormal: 'Normal',
+    statusWarning: 'Warning',
+    statusBlocked: 'Blocked',
+    statusReview: 'Under Review',
+    deviceFingerprint: 'Device Fingerprint',
+    deviceInfo: 'Device Info',
+    trustedDevices: 'Trusted Devices',
+    currentDevice: 'Current Device',
+    newDevice: 'New Device',
+    verify: 'Verify',
+    block: 'Block',
+    allow: 'Allow',
+    review: 'Review',
+    appeal: 'Appeal',
+    securitySettings: 'Security Settings',
+    loginProtection: 'Login Protection',
+    paymentProtection: 'Payment Protection',
+    antiTheft: 'Anti-Theft',
+    captcha: 'CAPTCHA',
+    smsCode: 'SMS Code',
+    emailCode: 'Email Code',
+    twoFactor: '2FA',
+    riskDetected: 'Risk Detected',
+    pleaseVerify: 'Please verify',
+    verifySuccess: 'Verified',
+    blocked: 'Action blocked'
+  },
+  ja: {
+    loading: '読み込み中...',
+    security: 'セキュリティセンター',
+    riskControl: 'リスクコントロール',
+    riskLow: '低リスク',
+    riskMedium: '中リスク',
+    riskHigh: '高リスク',
+    riskCritical: '重大',
+    riskLogin: 'ログイン異常',
+    riskTransaction: '取引リスク',
+    riskAccount: 'アカウントセキュリティ',
+    riskDevice: 'デバイス異常',
+    riskBehavior: '動作異常',
+    riskContent: 'コンテンツ違反',
+    statusNormal: '正常',
+    statusWarning: '警告',
+    statusBlocked: 'ブロック済み',
+    statusReview: '審査中',
+    deviceFingerprint: 'デバイス指紋',
+    deviceInfo: 'デバイス情報',
+    trustedDevices: '信頼済みデバイス',
+    currentDevice: '現在のデバイス',
+    newDevice: '新しいデバイス',
+    verify: '確認',
+    block: 'ブロック',
+    allow: '許可',
+    review: '審査',
+    appeal: '異議申し立て',
+    securitySettings: 'セキュリティ設定',
+    loginProtection: 'ログイン保護',
+    paymentProtection: '支払い保護',
+    antiTheft: '盗難防止',
+    captcha: 'キャプチャ',
+    smsCode: 'SMSコード',
+    emailCode: 'メールコード',
+    twoFactor: '2段階認証',
+    riskDetected: 'リスクが検出されました',
+    pleaseVerify: '確認してください',
+    verifySuccess: '確認成功',
+    blocked: 'アクションがブロックされました'
+  },
+  ko: {
+    loading: '로딩 중...',
+    security: '보안 센터',
+    riskControl: '위험 관리',
+    riskLow: '낮은 위험',
+    riskMedium: '중간 위험',
+    riskHigh: '높은 위험',
+    riskCritical: '치명적',
+    riskLogin: '로그인 이상',
+    riskTransaction: '거래 위험',
+    riskAccount: '계정 보안',
+    riskDevice: '기기 이상',
+    riskBehavior: '동작 이상',
+    riskContent: '콘텐츠 위반',
+    statusNormal: '정상',
+    statusWarning: '경고',
+    statusBlocked: '차단됨',
+    statusReview: '검토 중',
+    deviceFingerprint: '기기 지문',
+    deviceInfo: '기기 정보',
+    trustedDevices: '신뢰할 수 있는 기기',
+    currentDevice: '현재 기기',
+    newDevice: '새 기기',
+    verify: '확인',
+    block: '차단',
+    allow: '허용',
+    review: '검토',
+    appeal: '이의 제기',
+    securitySettings: '보안 설정',
+    loginProtection: '로그인 보호',
+    paymentProtection: '결제 보호',
+    antiTheft: '도난 방지',
+    captcha: '보안 문자',
+    smsCode: 'SMS 코드',
+    emailCode: '이메일 코드',
+    twoFactor: '2단계 인증',
+    riskDetected: '위험 감지됨',
+    pleaseVerify: '확인해주세요',
+    verifySuccess: '확인 성공',
+    blocked: '작업이 차단되었습니다'
+  }
+};
+let currentLanguage = 'zh';
+function setLanguage(lang) {
+  if (SUPPORTED_LANGUAGES.includes(lang)) currentLanguage = lang;
+}
+function getLanguage() {
+  return currentLanguage;
+}
+function t(key, params) {
+  const msgs = messages[getLanguage()] || messages.zh;
+  let text = msgs[key] || key;
+  if (params) {
+    Object.keys(params).forEach(k => {
+      text = text.replace(new RegExp(`\\{${k}\\}`, 'g'), params[k]);
+    });
+  }
+  return text;
+}
+
+/**
+ * Security SDK - 设备指纹 (隐私合规增强版)
+ * 
+ * ⚠️ 设备指纹属于 essential 级别（安全必需），但收集深度据 consent 策略分级：
+ * - essential:   仅收集基础安全信息（UA, 屏幕, 时区）
+ * - functional:  收集增强信息（Canvas, WebGL, 插件等）
+ * - analytics:   完整指纹信息
+ * 
+ * 遵循 DNT (Do Not Track) 信号
+ */
+
+const SDK_NAME = 'security-sdk';
+
+/**
+ * 设备指纹生成器
+ */
+class DeviceFingerprintClass {
+  constructor() {
+    this.cachedFingerprint = null;
+    this.components = {};
+  }
+
+  /**
+   * 获取设备指纹
+   * @param {object} options - 选项
+   * @param {boolean} options.respectDNT - 是否尊重 DNT 信号 (默认 true)
+   * @param {boolean} options.minimal - 是否仅收集最小信息集 (默认 false)
+   */
+  async getFingerprint(options = {}) {
+    const {
+      respectDNT = true,
+      minimal = false
+    } = options;
+    if (this.cachedFingerprint) {
+      return this.cachedFingerprint;
+    }
+
+    // 检查 DNT (Do Not Track) 信号
+    if (respectDNT && typeof navigator !== 'undefined' && navigator.doNotTrack === '1') {
+      logger.debug(`[${SDK_NAME}] DNT 信号已检测，使用最小化指纹`);
+      await this.collectMinimalComponents();
+    } else if (minimal) {
+      await this.collectMinimalComponents();
+    } else {
+      await this.collectComponents();
+    }
+    const fingerprintData = JSON.stringify(this.components);
+    const hash = await this.hash(fingerprintData);
+    this.cachedFingerprint = hash;
+    return hash;
+  }
+
+  /**
+   * 获取指纹组件
+   */
+  getComponents() {
+    return this.components;
+  }
+
+  /**
+   * 收集最小化组件 — essential 级别
+   * 仅包含安全验证所必需的基础信息，不含高侵入性指纹
+   */
+  async collectMinimalComponents() {
+    if (typeof window === 'undefined') {
+      this.components = {
+        server: true
+      };
+      return;
+    }
+    this.components = {
+      // 基础安全信息
+      screenWidth: screen.width,
+      screenHeight: screen.height,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      timezoneOffset: new Date().getTimezoneOffset(),
+      language: navigator.language,
+      platform: navigator.platform
+      // 不收集 Canvas、WebGL、插件等高侵入性指纹
+    };
+  }
+
+  /**
+   * 收集完整设备信息组件
+   * 据 ConsentManager 状态分级收集
+   */
+  async collectComponents() {
+    if (typeof window === 'undefined') {
+      this.components = {
+        server: true
+      };
+      return;
+    }
+    consentManager.init();
+    const hasFunctional = consentManager.hasConsent('functional');
+    const hasAnalytics = consentManager.hasConsent('analytics');
+
+    // === essential 层 — 始终收集 ===
+    this.components = {
+      language: navigator.language,
+      platform: navigator.platform,
+      screenWidth: screen.width,
+      screenHeight: screen.height,
+      screenDepth: screen.colorDepth,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      timezoneOffset: new Date().getTimezoneOffset(),
+      doNotTrack: navigator.doNotTrack
+    };
+
+    // === functional 层 — 需要 functional 同意 ===
+    if (hasFunctional) {
+      Object.assign(this.components, {
+        userAgent: navigator.userAgent,
+        languages: navigator.languages?.join(','),
+        screenPixelRatio: window.devicePixelRatio,
+        hardwareConcurrency: navigator.hardwareConcurrency,
+        deviceMemory: navigator.deviceMemory,
+        touchSupport: this.getTouchSupport(),
+        localStorage: this.hasLocalStorage(),
+        sessionStorage: this.hasSessionStorage(),
+        indexedDB: this.hasIndexedDB()
+      });
+    }
+
+    // === analytics 层 — 需要 analytics 同意 ===
+    if (hasAnalytics) {
+      const canvas = await this.getCanvasFingerprint();
+      const webgl = this.getWebGLInfo();
+      const plugins = this.getPlugins();
+      Object.assign(this.components, {
+        canvas,
+        webgl,
+        plugins
+      });
+    }
+  }
+
+  /**
+   * Canvas指纹
+   */
+  async getCanvasFingerprint() {
+    try {
+      const canvas = document.createElement('canvas');
+      const ctx = canvas.getContext('2d');
+      if (!ctx) return null;
+      canvas.width = 200;
+      canvas.height = 50;
+      ctx.textBaseline = 'alphabetic';
+      ctx.fillStyle = '#f60';
+      ctx.fillRect(125, 1, 62, 20);
+      ctx.fillStyle = '#069';
+      ctx.font = '11pt Arial';
+      ctx.fillText('QuantaBit <canvas> 1.0', 2, 15);
+      ctx.fillStyle = 'rgba(102, 204, 0, 0.7)';
+      ctx.font = '18pt Arial';
+      ctx.fillText('QuantaBit <canvas> 1.0', 4, 45);
+      const dataUrl = canvas.toDataURL();
+      return await this.hash(dataUrl);
+    } catch (e) {
+      return null;
+    }
+  }
+
+  /**
+   * WebGL信息
+   */
+  getWebGLInfo() {
+    try {
+      const canvas = document.createElement('canvas');
+      const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
+      if (!gl) return null;
+      const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
+      return {
+        vendor: gl.getParameter(gl.VENDOR),
+        renderer: debugInfo ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) : null,
+        version: gl.getParameter(gl.VERSION)
+      };
+    } catch (e) {
+      return null;
+    }
+  }
+
+  /**
+   * 触摸支持
+   */
+  getTouchSupport() {
+    return {
+      maxTouchPoints: navigator.maxTouchPoints || 0,
+      touchEvent: 'ontouchstart' in window,
+      touchPoints: navigator.msMaxTouchPoints || 0
+    };
+  }
+
+  /**
+   * 插件列表
+   */
+  getPlugins() {
+    const plugins = [];
+    for (let i = 0; i < navigator.plugins.length; i++) {
+      plugins.push({
+        name: navigator.plugins[i].name,
+        filename: navigator.plugins[i].filename
+      });
+    }
+    return plugins.slice(0, 10);
+  }
+
+  /**
+   * 存储检测
+   */
+  hasLocalStorage() {
+    try {
+      localStorage.setItem('test', 'test');
+      localStorage.removeItem('test');
+      return true;
+    } catch (e) {
+      return false;
+    }
+  }
+  hasSessionStorage() {
+    try {
+      sessionStorage.setItem('test', 'test');
+      sessionStorage.removeItem('test');
+      return true;
+    } catch (e) {
+      return false;
+    }
+  }
+  hasIndexedDB() {
+    return !!window.indexedDB;
+  }
+
+  /**
+   * 哈希函数
+   */
+  async hash(str) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(str);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
+  }
+
+  /**
+   * 清除缓存的指纹
+   */
+  clearCache() {
+    this.cachedFingerprint = null;
+    this.components = {};
+  }
+
+  /**
+   * 获取隐私说明 — 当前指纹收集的数据项说明
+   * 可用于向用户展示透明度信息
+   */
+  getPrivacyDisclosure() {
+    consentManager.init();
+    const levels = [];
+    levels.push({
+      level: 'essential',
+      items: ['Screen resolution', 'Timezone', 'Language', 'Platform'],
+      description: 'Basic device information for security verification.',
+      descriptionZh: '用于安全验证的基础设备信息。'
+    });
+    if (consentManager.hasConsent('functional')) {
+      levels.push({
+        level: 'functional',
+        items: ['User agent', 'Hardware specs', 'Touch support', 'Storage availability'],
+        description: 'Enhanced device information for better experience.',
+        descriptionZh: '增强型设备信息，用于改善使用体验。'
+      });
+    }
+    if (consentManager.hasConsent('analytics')) {
+      levels.push({
+        level: 'analytics',
+        items: ['Canvas fingerprint', 'WebGL renderer', 'Browser plugins'],
+        description: 'Advanced fingerprinting for fraud prevention.',
+        descriptionZh: '高级指纹信息，用于反欺诈保护。'
+      });
+    }
+    return levels;
+  }
+}
+const deviceFingerprint = new DeviceFingerprintClass();
+
+/**
+ * 便捷函数 — 获取设备指纹（遵循隐私设置）
+ */
+async function getDeviceFingerprint(options = {}) {
+  return deviceFingerprint.getFingerprint(options);
+}
+
+/**
+ * Security SDK - Context Provider
+ */
+
+const SecurityContext = /*#__PURE__*/createContext(null);
+function SecurityProvider({
+  children,
+  apiUrl,
+  token,
+  language = 'zh',
+  onRiskDetected,
+  onBlocked,
+  onError
+}) {
+  const [riskLevel, setRiskLevel] = useState('low');
+  const [deviceId, setDeviceId] = useState(null);
+  const [trustedDevices, setTrustedDevices] = useState([]);
+  const [riskEvents, setRiskEvents] = useState([]);
+  const [verificationRequired, setVerificationRequired] = useState(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState(null);
+  useEffect(() => {
+    if (apiUrl) securityApi.setBaseUrl(apiUrl);
+    if (token) securityApi.setToken(token);
+    if (language) setLanguage(language);
+
+    // 初始化设备指纹
+    initDeviceFingerprint();
+  }, [apiUrl, token, language]);
+  const initDeviceFingerprint = async () => {
+    const fp = await getDeviceFingerprint();
+    setDeviceId(fp);
+  };
+  const handleError = useCallback(err => {
+    setError(err.message);
+    onError?.(err);
+  }, [onError]);
+
+  // 风险检测
+  const checkRisk = useCallback(async (action, data = {}) => {
+    setLoading(true);
+    try {
+      const result = await securityApi.checkRisk({
+        action,
+        device_id: deviceId,
+        ...data
+      });
+      setRiskLevel(result.risk_level || 'low');
+      if (result.blocked) {
+        onBlocked?.(result);
+        return {
+          allowed: false,
+          reason: result.reason
+        };
+      }
+      if (result.verification_required) {
+        setVerificationRequired(result.verification_type);
+        onRiskDetected?.(result);
+        return {
+          allowed: false,
+          verification: result.verification_type
+        };
+      }
+      return {
+        allowed: true
+      };
+    } catch (err) {
+      handleError(err);
+      return {
+        allowed: true
+      }; // 风控服务异常时默认放行
+    } finally {
+      setLoading(false);
+    }
+  }, [deviceId, handleError, onBlocked, onRiskDetected]);
+
+  // 完成验证
+  const completeVerification = useCallback(async (type, code) => {
+    setLoading(true);
+    try {
+      const result = await securityApi.verify({
+        type,
+        code,
+        device_id: deviceId
+      });
+      if (result.success) {
+        setVerificationRequired(null);
+      }
+      return result;
+    } catch (err) {
+      handleError(err);
+      throw err;
+    } finally {
+      setLoading(false);
+    }
+  }, [deviceId, handleError]);
+
+  // 加载信任设备
+  const loadTrustedDevices = useCallback(async () => {
+    try {
+      const result = await securityApi.getTrustedDevices();
+      const devices = result.devices || result.data || result || [];
+      setTrustedDevices(devices);
+      return devices;
+    } catch (err) {
+      handleError(err);
+    }
+  }, [handleError]);
+
+  // 移除信任设备
+  const removeDevice = useCallback(async deviceIdToRemove => {
+    try {
+      await securityApi.removeDevice(deviceIdToRemove);
+      await loadTrustedDevices();
+    } catch (err) {
+      handleError(err);
+    }
+  }, [handleError, loadTrustedDevices]);
+
+  // 加载风险事件
+  const loadRiskEvents = useCallback(async (params = {}) => {
+    try {
+      const result = await securityApi.getRiskEvents(params);
+      const events = result.items || result.data || result || [];
+      setRiskEvents(events);
+      return events;
+    } catch (err) {
+      handleError(err);
+    }
+  }, [handleError]);
+  const value = {
+    riskLevel,
+    deviceId,
+    trustedDevices,
+    riskEvents,
+    verificationRequired,
+    loading,
+    error,
+    checkRisk,
+    completeVerification,
+    loadTrustedDevices,
+    removeDevice,
+    loadRiskEvents,
+    api: securityApi
+  };
+  return /*#__PURE__*/React.createElement(SecurityContext.Provider, {
+    value: value
+  }, children);
+}
+function useSecurity() {
+  const context = useContext(SecurityContext);
+  if (!context) {
+    throw new Error('useSecurity must be used within a SecurityProvider');
+  }
+  return context;
+}
+
+/**
+ * Security SDK - RiskBadge 组件
+ * 风险等级徽章
+ */
+
+const RISK_CONFIG = {
+  low: {
+    color: '#52c41a',
+    bg: '#f6ffed',
+    label: 'riskLow',
+    icon: '✓'
+  },
+  medium: {
+    color: '#faad14',
+    bg: '#fffbe6',
+    label: 'riskMedium',
+    icon: '⚠'
+  },
+  high: {
+    color: '#ff4d4f',
+    bg: '#fff2f0',
+    label: 'riskHigh',
+    icon: '⚠'
+  },
+  critical: {
+    color: '#cf1322',
+    bg: '#ffccc7',
+    label: 'riskCritical',
+    icon: '✕'
+  }
+};
+function RiskBadge({
+  level = 'low',
+  showIcon = true,
+  size = 'normal',
+  // 'small' | 'normal' | 'large'
+  className = ''
+}) {
+  const config = RISK_CONFIG[level] || RISK_CONFIG.low;
+  return /*#__PURE__*/React.createElement("span", {
+    className: `risk-badge risk-${level} size-${size} ${className}`,
+    style: {
+      color: config.color,
+      background: config.bg,
+      borderColor: config.color
+    }
+  }, showIcon && /*#__PURE__*/React.createElement("span", {
+    className: "risk-icon"
+  }, config.icon), /*#__PURE__*/React.createElement("span", {
+    className: "risk-label"
+  }, t(config.label)));
+}
+
+/**
+ * Security SDK - VerificationModal 组件
+ * 验证弹窗
+ */
+
+function VerificationModal({
+  type = 'captcha',
+  // 'captcha' | 'sms' | 'email' | 'twoFactor'
+  onSuccess,
+  onCancel,
+  className = ''
+}) {
+  const {
+    completeVerification,
+    loading
+  } = useSecurity();
+  const [code, setCode] = useState('');
+  const [error, setError] = useState(null);
+  const handleSubmit = async e => {
+    e.preventDefault();
+    setError(null);
+    if (!code.trim()) {
+      setError('请输入验证码');
+      return;
+    }
+    try {
+      const result = await completeVerification(type, code);
+      if (result.success) {
+        onSuccess?.(result);
+      } else {
+        setError(result.message || '验证失败');
+      }
+    } catch (err) {
+      setError(err.message);
+    }
+  };
+  const getTitle = () => {
+    switch (type) {
+      case 'sms':
+        return t('smsCode');
+      case 'email':
+        return t('emailCode');
+      case 'twoFactor':
+        return t('twoFactor');
+      default:
+        return t('captcha');
+    }
+  };
+  return /*#__PURE__*/React.createElement("div", {
+    className: `verification-modal-overlay ${className}`
+  }, /*#__PURE__*/React.createElement("div", {
+    className: "verification-modal"
+  }, /*#__PURE__*/React.createElement("button", {
+    className: "modal-close",
+    onClick: onCancel
+  }, "\u2715"), /*#__PURE__*/React.createElement("div", {
+    className: "modal-icon"
+  }, "\uD83D\uDD10"), /*#__PURE__*/React.createElement("h3", null, t('riskDetected')), /*#__PURE__*/React.createElement("p", null, t('pleaseVerify')), /*#__PURE__*/React.createElement("form", {
+    onSubmit: handleSubmit
+  }, /*#__PURE__*/React.createElement("div", {
+    className: "form-group"
+  }, /*#__PURE__*/React.createElement("label", null, getTitle()), /*#__PURE__*/React.createElement("input", {
+    type: "text",
+    value: code,
+    onChange: e => setCode(e.target.value),
+    placeholder: "\u8BF7\u8F93\u5165\u9A8C\u8BC1\u7801",
+    autoFocus: true,
+    maxLength: 6
+  })), error && /*#__PURE__*/React.createElement("div", {
+    className: "form-error"
+  }, error), /*#__PURE__*/React.createElement("div", {
+    className: "form-actions"
+  }, /*#__PURE__*/React.createElement("button", {
+    type: "button",
+    className: "btn-cancel",
+    onClick: onCancel
+  }, "\u53D6\u6D88"), /*#__PURE__*/React.createElement("button", {
+    type: "submit",
+    className: "btn-primary",
+    disabled: loading
+  }, loading ? t('loading') : t('verify'))))));
+}
+
+/**
+ * Security SDK - 加密工具
+ */
+
+class Utf8EncoderFallback {
+  encode(value) {
+    const utf8 = unescape(encodeURIComponent(String(value)));
+    const bytes = new Uint8Array(utf8.length);
+    for (let index = 0; index < utf8.length; index += 1) {
+      bytes[index] = utf8.charCodeAt(index);
+    }
+    return bytes;
+  }
+}
+class Utf8DecoderFallback {
+  decode(value) {
+    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+    let binary = '';
+    for (const byte of bytes) {
+      binary += String.fromCharCode(byte);
+    }
+    return decodeURIComponent(escape(binary));
+  }
+}
+function createTextEncoder() {
+  return typeof globalThis.TextEncoder === 'function' ? new globalThis.TextEncoder() : new Utf8EncoderFallback();
+}
+function createTextDecoder() {
+  return typeof globalThis.TextDecoder === 'function' ? new globalThis.TextDecoder() : new Utf8DecoderFallback();
+}
+
+/**
+ * 加密工具类
+ */
+class CryptoUtilsClass {
+  constructor() {
+    this.encoder = createTextEncoder();
+    this.decoder = createTextDecoder();
+  }
+
+  /**
+   * 生成随机字节
+   */
+  getRandomBytes(length) {
+    return crypto.getRandomValues(new Uint8Array(length));
+  }
+
+  /**
+   * 生成随机16进制字符串
+   */
+  getRandomHex(length) {
+    return Array.from(this.getRandomBytes(length)).map(b => b.toString(16).padStart(2, '0')).join('');
+  }
+
+  /**
+   * 生成UUID
+   */
+  generateUUID() {
+    return crypto.randomUUID?.() || 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+      const r = Math.random() * 16 | 0;
+      return (c === 'x' ? r : r & 0x3 | 0x8).toString(16);
+    });
+  }
+
+  /**
+   * 计算SHA-256哈希
+   */
+  async sha256(data) {
+    const buffer = typeof data === 'string' ? this.encoder.encode(data) : data;
+    const hashBuffer = await crypto.subtle.digest('SHA-256', buffer);
+    return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
+  }
+
+  /**
+   * 计算HMAC-SHA256
+   */
+  async hmacSha256(key, message) {
+    const keyBuffer = typeof key === 'string' ? this.encoder.encode(key) : key;
+    const messageBuffer = typeof message === 'string' ? this.encoder.encode(message) : message;
+    const cryptoKey = await crypto.subtle.importKey('raw', keyBuffer, {
+      name: 'HMAC',
+      hash: 'SHA-256'
+    }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, messageBuffer);
+    return Array.from(new Uint8Array(signature)).map(b => b.toString(16).padStart(2, '0')).join('');
+  }
+
+  /**
+   * AES-GCM 加密
+   */
+  async encryptAES(plaintext, keyHex) {
+    const keyBuffer = this.hexToBytes(keyHex);
+    const iv = this.getRandomBytes(12);
+    const plaintextBuffer = this.encoder.encode(plaintext);
+    const cryptoKey = await crypto.subtle.importKey('raw', keyBuffer, 'AES-GCM', false, ['encrypt']);
+    const ciphertext = await crypto.subtle.encrypt({
+      name: 'AES-GCM',
+      iv
+    }, cryptoKey, plaintextBuffer);
+
+    // 返回 iv + ciphertext 的 base64
+    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+    combined.set(iv);
+    combined.set(new Uint8Array(ciphertext), iv.length);
+    return this.bytesToBase64(combined);
+  }
+
+  /**
+   * AES-GCM 解密
+   */
+  async decryptAES(cipherBase64, keyHex) {
+    const keyBuffer = this.hexToBytes(keyHex);
+    const combined = this.base64ToBytes(cipherBase64);
+    const iv = combined.slice(0, 12);
+    const ciphertext = combined.slice(12);
+    const cryptoKey = await crypto.subtle.importKey('raw', keyBuffer, 'AES-GCM', false, ['decrypt']);
+    const plaintext = await crypto.subtle.decrypt({
+      name: 'AES-GCM',
+      iv
+    }, cryptoKey, ciphertext);
+    return this.decoder.decode(plaintext);
+  }
+
+  /**
+   * 生成AES密钥
+   */
+  generateAESKey() {
+    return this.getRandomHex(32); // 256位
+  }
+
+  /**
+   * 生成RSA密钥对
+   */
+  async generateRSAKeyPair() {
+    const keyPair = await crypto.subtle.generateKey({
+      name: 'RSA-OAEP',
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash: 'SHA-256'
+    }, true, ['encrypt', 'decrypt']);
+    const publicKey = await crypto.subtle.exportKey('spki', keyPair.publicKey);
+    const privateKey = await crypto.subtle.exportKey('pkcs8', keyPair.privateKey);
+    return {
+      publicKey: this.bytesToBase64(new Uint8Array(publicKey)),
+      privateKey: this.bytesToBase64(new Uint8Array(privateKey))
+    };
+  }
+
+  /**
+   * 生成ECDSA密钥对（用于签名）
+   */
+  async generateECDSAKeyPair() {
+    const keyPair = await crypto.subtle.generateKey({
+      name: 'ECDSA',
+      namedCurve: 'P-256'
+    }, true, ['sign', 'verify']);
+    const publicKey = await crypto.subtle.exportKey('spki', keyPair.publicKey);
+    const privateKey = await crypto.subtle.exportKey('pkcs8', keyPair.privateKey);
+    return {
+      publicKey: this.bytesToBase64(new Uint8Array(publicKey)),
+      privateKey: this.bytesToBase64(new Uint8Array(privateKey))
+    };
+  }
+
+  /**
+   * ECDSA签名
+   */
+  async signECDSA(message, privateKeyBase64) {
+    const privateKeyBuffer = this.base64ToBytes(privateKeyBase64);
+    const messageBuffer = this.encoder.encode(message);
+    const privateKey = await crypto.subtle.importKey('pkcs8', privateKeyBuffer, {
+      name: 'ECDSA',
+      namedCurve: 'P-256'
+    }, false, ['sign']);
+    const signature = await crypto.subtle.sign({
+      name: 'ECDSA',
+      hash: 'SHA-256'
+    }, privateKey, messageBuffer);
+    return this.bytesToBase64(new Uint8Array(signature));
+  }
+
+  /**
+   * ECDSA验签
+   */
+  async verifyECDSA(message, signatureBase64, publicKeyBase64) {
+    const publicKeyBuffer = this.base64ToBytes(publicKeyBase64);
+    const messageBuffer = this.encoder.encode(message);
+    const signatureBuffer = this.base64ToBytes(signatureBase64);
+    const publicKey = await crypto.subtle.importKey('spki', publicKeyBuffer, {
+      name: 'ECDSA',
+      namedCurve: 'P-256'
+    }, false, ['verify']);
+    return crypto.subtle.verify({
+      name: 'ECDSA',
+      hash: 'SHA-256'
+    }, publicKey, signatureBuffer, messageBuffer);
+  }
+
+  // ============ 工具方法 ============
+
+  hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return bytes;
+  }
+  bytesToHex(bytes) {
+    return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
+  }
+  bytesToBase64(bytes) {
+    return btoa(String.fromCharCode(...bytes));
+  }
+  base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+  }
+}
+const cryptoUtils = new CryptoUtilsClass();
+
+/**
+ * Security SDK - API签名
+ */
+
+
+/**
+ * API签名器
+ * 用于API请求的签名验证
+ */
+class ApiSignerClass {
+  constructor(config = {}) {
+    this.secretKey = config.secretKey || '';
+    this.algorithm = config.algorithm || 'hmac-sha256';
+    this.timestampTolerance = config.timestampTolerance || 300; // 5分钟
+    this.nonceStore = new Set();
+    this.nonceMaxAge = 600000; // 10分钟
+  }
+  configure(config) {
+    Object.assign(this, config);
+  }
+
+  /**
+   * 生成签名
+   * @param {Object} params - 请求参数
+   * @param {string} method - HTTP方法
+   * @param {string} path - 请求路径
+   * @returns {Object} 签名信息
+   */
+  async sign(params = {}, method = 'GET', path = '/') {
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    const nonce = cryptoUtils.getRandomHex(16);
+
+    // 构建待签名字符串
+    const stringToSign = this.buildStringToSign(params, method, path, timestamp, nonce);
+
+    // 计算签名
+    const signature = await cryptoUtils.hmacSha256(this.secretKey, stringToSign);
+    return {
+      timestamp,
+      nonce,
+      signature
+    };
+  }
+
+  /**
+   * 验证签名
+   * @param {Object} params - 请求参数
+   * @param {string} method - HTTP方法
+   * @param {string} path - 请求路径
+   * @param {string} timestamp - 时间戳
+   * @param {string} nonce - 随机数
+   * @param {string} signature - 签名
+   * @returns {boolean} 是否有效
+   */
+  async verify(params, method, path, timestamp, nonce, signature) {
+    // 检查时间戳
+    const now = Math.floor(Date.now() / 1000);
+    if (Math.abs(now - parseInt(timestamp)) > this.timestampTolerance) {
+      return false;
+    }
+
+    // 检查nonce是否已使用（防重放）
+    if (this.nonceStore.has(nonce)) {
+      return false;
+    }
+
+    // 重新计算签名
+    const stringToSign = this.buildStringToSign(params, method, path, timestamp, nonce);
+    const expectedSignature = await cryptoUtils.hmacSha256(this.secretKey, stringToSign);
+
+    // 时间安全的比较
+    if (signature !== expectedSignature) {
+      return false;
+    }
+
+    // 记录nonce
+    this.nonceStore.add(nonce);
+    setTimeout(() => this.nonceStore.delete(nonce), this.nonceMaxAge);
+    return true;
+  }
+
+  /**
+   * 构建待签名字符串
+   */
+  buildStringToSign(params, method, path, timestamp, nonce) {
+    // 参数排序
+    const sortedParams = Object.keys(params).sort().map(key => `${key}=${params[key]}`).join('&');
+
+    // 拼接
+    return [method.toUpperCase(), path, timestamp, nonce, sortedParams].join('\n');
+  }
+
+  /**
+   * 创建签名请求头
+   */
+  async createAuthHeaders(params, method, path) {
+    const {
+      timestamp,
+      nonce,
+      signature
+    } = await this.sign(params, method, path);
+    return {
+      'X-Timestamp': timestamp,
+      'X-Nonce': nonce,
+      'X-Signature': signature
+    };
+  }
+}
+const apiSigner = new ApiSignerClass();
+
+/**
+ * Security SDK - 类型定义
+ */
+
+// 风险等级
+const RiskLevel = {
+  NONE: 'none',
+  LOW: 'low',
+  MEDIUM: 'medium',
+  HIGH: 'high',
+  CRITICAL: 'critical'
+};
+
+// 安全事件类型
+const SecurityEventType = {
+  LOGIN: 'login',
+  LOGOUT: 'logout',
+  PASSWORD_CHANGE: 'password_change',
+  MFA_ENABLED: 'mfa_enabled',
+  MFA_DISABLED: 'mfa_disabled',
+  PERMISSION_CHANGE: 'permission_change',
+  SUSPICIOUS_ACTIVITY: 'suspicious_activity',
+  BRUTE_FORCE: 'brute_force',
+  DATA_EXPORT: 'data_export',
+  API_ACCESS: 'api_access'
+};
+
+// 加密算法
+const EncryptionAlgorithm = {
+  AES_256_GCM: 'aes-256-gcm',
+  AES_256_CBC: 'aes-256-cbc',
+  RSA_OAEP: 'rsa-oaep',
+  ECDH: 'ecdh'
+};
+
+// 签名算法
+const SignatureAlgorithm = {
+  HMAC_SHA256: 'hmac-sha256',
+  RSA_SHA256: 'rsa-sha256',
+  ECDSA_P256: 'ecdsa-p256',
+  ED25519: 'ed25519'
+};
+
+// 设备信任状态
+const DeviceTrustStatus = {
+  TRUSTED: 'trusted',
+  UNKNOWN: 'unknown',
+  BLOCKED: 'blocked'
+};
+
+/**
+ * @quantabit/security-sdk
+ * 
+ * QuantaBit Security Module SDK
+ * 
+ * Features:
+ * - Encryption/Decryption (AES, RSA, ECDSA)
+ * - API signature verification
+ * - Device fingerprinting
+ * - Anti-fraud risk control
+ * - Security audit logs
+ */
+
+const sha256 = (...args) => cryptoUtils.sha256(...args);
+const hmacSha256 = (...args) => cryptoUtils.hmacSha256(...args);
+const encryptAES = (...args) => cryptoUtils.encryptAES(...args);
+const decryptAES = (...args) => cryptoUtils.decryptAES(...args);
+const generateAESKey = (...args) => cryptoUtils.generateAESKey(...args);
+const getFingerprint = (...args) => deviceFingerprint.getFingerprint(...args);
+
+export { ApiSignerClass, CryptoUtilsClass, DeviceFingerprintClass, DeviceTrustStatus, EncryptionAlgorithm, RiskBadge, RiskLevel, SUPPORTED_LANGUAGES, SecurityApiClient, SecurityEventType, SecurityProvider, SignatureAlgorithm, VerificationModal, apiSigner, cryptoUtils, decryptAES, deviceFingerprint, encryptAES, generateAESKey, getDeviceFingerprint, getFingerprint, getLanguage, hmacSha256, messages, securityApi, setLanguage, sha256, t, useSecurity };
+//# sourceMappingURL=index.esm.js.map