@svadmin/core 0.25.4 → 0.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.25.4",
+  "version": "0.26.0",
   "author": "zuohuadong",
   "repository": {
     "type": "git",

package/src/http.ts

@@ -0,0 +1,88 @@
+/**
+ * HTTP fetch 工具 — 带 CSRF 防护、401 自动跳转、403 拦截的 fetch wrapper。
+ */
+
+export interface FetchWithInterceptorOptions {
+  /** 401 时跳转的登录页路径 */
+  loginPath?: string;
+  /** 403 时抛出的错误消息 */
+  forbiddenMessage?: string;
+  /** 是否自动添加 X-Requested-With header (CSRF 防护) */
+  csrfProtection?: boolean;
+  /** 自定义 fetch 实现，便于测试或 SSR 环境注入 */
+  fetchImpl?: FetchWithInterceptor;
+  /** 自定义 401 重定向处理，便于测试或 SSR 环境注入 */
+  onUnauthorized?: (loginPath: string, returnTo: string) => void;
+}
+
+export type FetchWithInterceptor = (url: string, init?: RequestInit) => Promise<Response>;
+
+const DEFAULT_OPTIONS: Required<Omit<FetchWithInterceptorOptions, 'fetchImpl' | 'onUnauthorized'>> & {
+  fetchImpl: FetchWithInterceptor;
+  onUnauthorized: (loginPath: string, returnTo: string) => void;
+} = {
+  loginPath: "/auth/login",
+  forbiddenMessage: "Forbidden: 该操作已被安全策略拒绝",
+  csrfProtection: true,
+  get fetchImpl() {
+    if (typeof globalThis !== "undefined" && typeof globalThis.fetch === "function") {
+      return (url: string, init?: RequestInit) => globalThis.fetch(url, init);
+    }
+    return async () => {
+      throw new Error("No fetch implementation found. Pass fetchImpl in options.");
+    };
+  },
+  onUnauthorized: (loginPath, returnTo) => {
+    if (typeof window !== "undefined") {
+      window.location.href = `${loginPath}?returnTo=${returnTo}`;
+    }
+  },
+};
+
+/**
+ * 带拦截器的 fetch — 自动注入 CSRF header，401 跳转登录，403 抛异常。
+ *
+ * @example
+ * ```ts
+ * const fetcher = createFetchWithInterceptor({ loginPath: '/login' });
+ * const res = await fetcher('/api/users');
+ * ```
+ */
+export function createFetchWithInterceptor(
+  options: FetchWithInterceptorOptions = {},
+): FetchWithInterceptor {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+
+  return async (url: string, init: RequestInit = {}): Promise<Response> => {
+    const headers = new Headers(init.headers || {});
+
+    if (
+      opts.csrfProtection &&
+      init.method &&
+      ["POST", "PUT", "DELETE", "PATCH"].includes(init.method.toUpperCase())
+    ) {
+      headers.set("X-Requested-With", "XMLHttpRequest");
+    }
+
+    const res = await opts.fetchImpl(url, { ...init, headers });
+
+    if (!res.ok) {
+      if (res.status === 401) {
+        const returnTo = typeof window !== "undefined"
+          ? encodeURIComponent(window.location.pathname)
+          : "";
+        opts.onUnauthorized(opts.loginPath, returnTo);
+        throw new Error("Unauthorized");
+      }
+      if (res.status === 403) {
+        throw new Error(opts.forbiddenMessage);
+      }
+    }
+    return res;
+  };
+}
+
+/**
+ * 便捷全局实例 — 使用默认配置。
+ */
+export const fetchWithInterceptor = createFetchWithInterceptor();

package/src/index.ts

@@ -32,7 +32,7 @@ export {
 export { matchRoute, navigate, currentPath, setActiveRouterProvider, beforeEach, afterEach, resetRouter } from './router';
 export type { RouteGuard } from './router';
 export { readURLState, writeURLState } from './url-sync';
-export { setAccessControlProvider, getAccessControlProvider, getAccessControlOptions, canAccessAsync } from './permissions.svelte';
+export { setAccessControlProvider, getAccessControlProvider, getAccessControlOptions, canAccessAsync, createFeatureGate } from './permissions.svelte';
 export { useLive, useSubscription, usePublish } from './live.svelte';
 export { toast, getToastQueue, consumeToastQueue, getPromiseQueue, consumePromiseQueue, resetToast } from './toast.svelte';
 export { notify, closeNotification, setNotificationProvider, getNotificationProvider } from './notification.svelte';
@@ -72,7 +72,7 @@ export type {
 } from './types';
 export type { InvalidateScope } from './options.svelte';
 export type { LiveProvider, LiveEvent, LiveMode } from './live.svelte';
-export type { Action, CanParams, CanResult, AccessControlProvider } from './permissions.svelte';
+export type { Action, CanParams, CanResult, AccessControlProvider, FeatureGateConfig, FeatureGateUser } from './permissions.svelte';
 export type { AuditEntry, AuditHandler } from './audit';
 export { useCan } from './useCan';
 export type { UseCanOptions, UseCanResult } from './useCan';
@@ -127,3 +127,7 @@ export type {
   TaskListResult,
   TaskSubscription,
 } from './types';
+
+// HTTP fetch utilities
+export { createFetchWithInterceptor, fetchWithInterceptor } from './http';
+export type { FetchWithInterceptor, FetchWithInterceptorOptions } from './http';

package/src/permissions.svelte.ts

@@ -95,3 +95,69 @@ export async function canAccessAsync(resourceOrBatch: string | CanParams[], acti
   
   return provider.can({ resource: resourceOrBatch, action: action!, params }) as Promise<CanResult>;
 }
+
+// ─── Feature Gate ─────────────────────────────────────────────
+
+/**
+ * 角色层级定义 (高权 → 低权)
+ */
+const ROLE_HIERARCHY = ["superadmin", "admin", "manager", "user", "viewer", "guest"];
+
+export interface FeatureGateConfig {
+  /** 允许访问的角色列表 */
+  roles?: string[];
+  /** 需要的最低角色 (含以上所有角色) */
+  minRole?: string;
+  /** 需要的权限列表 (全部匹配) */
+  permissions?: string[];
+}
+
+export interface FeatureGateUser {
+  role: string;
+  permissions: string[];
+}
+
+/**
+ * 创建功能门控函数 — 基于角色和权限判断用户是否可访问某功能。
+ *
+ * @example
+ * ```ts
+ * const canUseCode = createFeatureGate({
+ *   minRole: 'manager',
+ *   permissions: ['code:execute'],
+ * });
+ *
+ * if (canUseCode(user)) { ... }
+ * ```
+ */
+export function createFeatureGate(config: FeatureGateConfig): (user: FeatureGateUser) => boolean {
+  return (user: FeatureGateUser): boolean => {
+    // 角色白名单
+    if (config.roles && !config.roles.includes(user.role)) {
+      return false;
+    }
+
+    // 最低角色层级检查
+    if (config.minRole) {
+      const userIndex = ROLE_HIERARCHY.indexOf(user.role);
+      const minIndex = ROLE_HIERARCHY.indexOf(config.minRole);
+      if (userIndex === -1 || minIndex === -1 || userIndex > minIndex) {
+        return false;
+      }
+    }
+
+    // 权限检查 (全部匹配)
+    if (config.permissions && config.permissions.length > 0) {
+      const hasAll = config.permissions.every((permission) => {
+        if (user.permissions.includes("*")) return true;
+        if (user.permissions.includes(permission)) return true;
+        const [resource] = permission.split(":");
+        if (resource && user.permissions.includes(`${resource}:*`)) return true;
+        return false;
+      });
+      if (!hasAll) return false;
+    }
+
+    return true;
+  };
+}

package/src/query-hooks.svelte.ts

@@ -43,6 +43,20 @@ function extendQuery<Q extends object, E extends Record<string, unknown>>(
 
 export type MaybeGetter<T> = T | (() => T);
 
+function cloneQueryKeyPart<T>(value: T): T {
+  if (Array.isArray(value)) {
+    return value.map(item => cloneQueryKeyPart(item)) as T;
+  }
+  if (value && typeof value === 'object') {
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) return value;
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(([key, entry]) => [key, cloneQueryKeyPart(entry)])
+    ) as T;
+  }
+  return value;
+}
+
 export interface UseListOptions<TData extends BaseRecord = BaseRecord, TError = HttpError> {
   resource?: KnownResources;
   pagination?: Pagination;
@@ -71,15 +85,19 @@ export function useList<TData extends BaseRecord = BaseRecord, TError = HttpErro
     const resource = getResource();
     const provider = getDataProviderForResource(resource, opts.dataProviderName);
     const queryOptions = opts.queryOptions;
+    const pagination = cloneQueryKeyPart(opts.pagination);
+    const sorters = cloneQueryKeyPart(opts.sorters);
+    const filters = cloneQueryKeyPart(opts.filters);
+    const meta = cloneQueryKeyPart(opts.meta);
     
     return {
-      queryKey: [opts.dataProviderName, resource, 'list', opts.pagination, opts.sorters, opts.filters, opts.meta],
+      queryKey: [opts.dataProviderName, resource, 'list', pagination, sorters, filters, meta],
       queryFn: async () => provider.getList<TData>({
         resource,
-        pagination: opts.pagination,
-        sorters: opts.sorters,
-        filters: opts.filters,
-        meta: opts.meta,
+        pagination,
+        sorters,
+        filters,
+        meta,
       }),
       enabled: queryOptions?.enabled ?? true,
       staleTime: queryOptions?.staleTime ?? adminOptions.reactQuery?.staleTime,