@ysgroup/core 0.1.10 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ysgroup/core",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/index.ts

@@ -2,4 +2,18 @@
 
 export { YsWsClient, YsRpcError, type Envelope } from "./ws";
 export { useYsStore } from "./store";
-export { YsRest, YsRestError, type YsAdminRpcCall, type DeleteBlocker, type DeleteImpact, type RevealedCredential, type TopologyNode } from "./rest";
+export {
+  YsRest,
+  YsRestError,
+  type YsAdminRpcCall,
+  type DeleteBlocker,
+  type DeleteImpact,
+  type RevealedCredential,
+  type TopologyNode,
+} from "./rest";
+export {
+  applyPasswordWrap,
+  sealLoginPassword,
+  sealPassword,
+  type PasswordWrap,
+} from "./password";

package/src/password.ts

@@ -0,0 +1,162 @@
+/* 登录口令密封：X25519 临时密钥 + HKDF-SHA256 + AES-256-GCM，与 Auth/ys_base 对齐。 */
+
+export interface PasswordWrap {
+  password_wrap: string;
+  password_public_key_kid: string;
+  password_public_key: string;
+}
+
+const ALG = "x25519-seal";
+const PREFIX = "pwd.v1.";
+const INFO = new TextEncoder().encode("ys-pwd-v1");
+const SALT = new Uint8Array(32);
+const NONCE = new Uint8Array(12);
+const KID_RE = /^[A-Za-z0-9_-]+$/;
+
+let current: PasswordWrap | null = null;
+const waiters: Array<() => void> = [];
+
+export function applyPasswordWrap(data: unknown): void {
+  if (!data || typeof data !== "object") return;
+  const rec = data as Record<string, unknown>;
+  const wrap = String(rec.password_wrap ?? "");
+  const kid = String(rec.password_public_key_kid ?? "");
+  const key = String(rec.password_public_key ?? "");
+  if (wrap !== ALG || !KID_RE.test(kid) || !key) return;
+  current = {
+    password_wrap: wrap,
+    password_public_key_kid: kid,
+    password_public_key: key,
+  };
+  while (waiters.length) waiters.shift()?.();
+}
+
+export function clearPasswordWrap(): void {
+  current = null;
+}
+
+export function passwordWrap(): PasswordWrap | null {
+  return current;
+}
+
+export async function waitForPasswordWrap(
+  timeoutMs = 10_000,
+): Promise<PasswordWrap> {
+  if (current) return current;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      const index = waiters.indexOf(onReady);
+      if (index >= 0) waiters.splice(index, 1);
+      reject(new Error("登录公钥尚未就绪"));
+    }, timeoutMs);
+    const onReady = () => {
+      clearTimeout(timer);
+      if (current) resolve(current);
+      else reject(new Error("登录公钥尚未就绪"));
+    };
+    waiters.push(onReady);
+  });
+}
+
+export async function sealLoginPassword(plaintext: string): Promise<string> {
+  const wrap = await waitForPasswordWrap();
+  return sealPassword(
+    plaintext,
+    wrap.password_public_key,
+    wrap.password_public_key_kid,
+  );
+}
+
+export async function sealPassword(
+  plaintext: string,
+  publicKeyB64: string,
+  kid = "e1",
+): Promise<string> {
+  if (!plaintext) throw new Error("密码不能为空");
+  if (!KID_RE.test(kid)) throw new Error("密码信封密钥标识无效");
+  const recipientRaw = b64uDecode(publicKeyB64);
+  if (recipientRaw.byteLength !== 32) throw new Error("登录公钥长度无效");
+
+  const ephemeral = (await crypto.subtle.generateKey({ name: "X25519" }, true, [
+    "deriveBits",
+  ])) as CryptoKeyPair;
+  const recipient = await crypto.subtle.importKey(
+    "raw",
+    asArrayBuffer(recipientRaw),
+    { name: "X25519" },
+    false,
+    [],
+  );
+  const shared = new Uint8Array(
+    await crypto.subtle.deriveBits(
+      { name: "X25519", public: recipient },
+      ephemeral.privateKey,
+      256,
+    ),
+  );
+  const hkdfKey = await crypto.subtle.importKey(
+    "raw",
+    asArrayBuffer(shared),
+    "HKDF",
+    false,
+    ["deriveBits"],
+  );
+  const aesRaw = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: asArrayBuffer(SALT),
+      info: asArrayBuffer(INFO),
+    },
+    hkdfKey,
+    256,
+  );
+  const aesKey = await crypto.subtle.importKey(
+    "raw",
+    aesRaw,
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"],
+  );
+  const aad = new TextEncoder().encode(`${PREFIX}${kid}`);
+  const packedCt = new Uint8Array(
+    await crypto.subtle.encrypt(
+      {
+        name: "AES-GCM",
+        iv: asArrayBuffer(NONCE),
+        additionalData: aad,
+        tagLength: 128,
+      },
+      aesKey,
+      new TextEncoder().encode(plaintext),
+    ),
+  );
+  const ephPk = new Uint8Array(
+    await crypto.subtle.exportKey("raw", ephemeral.publicKey),
+  );
+  const packed = new Uint8Array(ephPk.byteLength + packedCt.byteLength);
+  packed.set(ephPk, 0);
+  packed.set(packedCt, ephPk.byteLength);
+  return `${PREFIX}${kid}.${b64uEncode(packed)}`;
+}
+
+function asArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer;
+}
+
+function b64uEncode(raw: Uint8Array): string {
+  let bin = "";
+  for (const byte of raw) bin += String.fromCharCode(byte);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function b64uDecode(text: string): Uint8Array {
+  const pad = "=".repeat((4 - (text.length % 4)) % 4);
+  const bin = atob(text.replace(/-/g, "+").replace(/_/g, "/") + pad);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}

package/src/rest.ts

@@ -1,5 +1,6 @@
 /* @ysgroup/core —— 管理接口客户端（支持 HTTP 或统一 WS RPC 传输）。 */
 
+import { sealLoginPassword } from "./password";
 import { YsRpcError } from "./ws";
 
 export type YsAdminRpcCall = (data: {
@@ -47,7 +48,11 @@ export class YsRest {
     private rpcCall?: YsAdminRpcCall,
   ) {}
 
-  private async request<T>(method: string, path: string, body?: unknown): Promise<T> {
+  private async request<T>(
+    method: string,
+    path: string,
+    body?: unknown,
+  ): Promise<T> {
     if (this.rpcCall) {
       try {
         return (await this.rpcCall({
@@ -109,7 +114,9 @@ export class YsRest {
       body: form,
     });
     if (!resp.ok) {
-      const parsed = await resp.json().catch(() => ({ detail: resp.statusText }));
+      const parsed = await resp
+        .json()
+        .catch(() => ({ detail: resp.statusText }));
       throw new YsRestError(resp.status, parsed.detail ?? parsed);
     }
     return (await resp.json()) as T;
@@ -122,16 +129,25 @@ export class YsRest {
   list<T = Record<string, unknown>>(table: string) {
     return this.request<T[]>("GET", `/api/tables/${table}`);
   }
-  upsert<T = Record<string, unknown>>(table: string, doc: Record<string, unknown>) {
+  upsert<T = Record<string, unknown>>(
+    table: string,
+    doc: Record<string, unknown>,
+  ) {
     return this.request<T>("PUT", `/api/tables/${table}`, doc);
   }
   remove(table: string, id: string) {
-    return this.request<{ deleted: string }>("DELETE", `/api/tables/${table}/${id}`);
+    return this.request<{ deleted: string }>(
+      "DELETE",
+      `/api/tables/${table}/${id}`,
+    );
   }
   deleteImpact(table: string, id: string) {
-    return this.request<DeleteImpact>("GET", `/api/tables/${table}/${id}/delete-impact`);
+    return this.request<DeleteImpact>(
+      "GET",
+      `/api/tables/${table}/${id}/delete-impact`,
+    );
   }
-  revealCredentials(
+  async revealCredentials(
     table: string,
     id: string,
     body: {
@@ -143,9 +159,12 @@ export class YsRest {
     return this.request<{
       credentials: Record<string, RevealedCredential>;
       expires_in: number;
-    }>("POST", `/api/tables/${table}/${id}/credentials/reveal`, body);
+    }>("POST", `/api/tables/${table}/${id}/credentials/reveal`, {
+      ...body,
+      password: await sealLoginPassword(body.password),
+    });
   }
-  updateCredentials(
+  async updateCredentials(
     table: string,
     id: string,
     body: {
@@ -154,13 +173,23 @@ export class YsRest {
       reason: string;
     },
   ) {
-    return this.request<{ updated_fields: string[] }>("POST", `/api/tables/${table}/${id}/credentials/update`, body);
+    return this.request<{ updated_fields: string[] }>(
+      "POST",
+      `/api/tables/${table}/${id}/credentials/update`,
+      {
+        ...body,
+        password: await sealLoginPassword(body.password),
+      },
+    );
   }
   listApps() {
     return this.request<Record<string, unknown>[]>("GET", "/api/apps");
   }
   listAppReferences() {
-    return this.request<Record<string, unknown>[]>("GET", "/api/apps/reference-list");
+    return this.request<Record<string, unknown>[]>(
+      "GET",
+      "/api/apps/reference-list",
+    );
   }
   createApp(body: Record<string, unknown>) {
     return this.request<Record<string, unknown>>("POST", "/api/apps", body);
@@ -172,54 +201,92 @@ export class YsRest {
     return this.request("POST", `/api/apps/${appId}/grants`, grants);
   }
   updateApp(appId: string, body: Record<string, unknown>) {
-    return this.request<Record<string, unknown>>("PUT", `/api/apps/${appId}`, body);
+    return this.request<Record<string, unknown>>(
+      "PUT",
+      `/api/apps/${appId}`,
+      body,
+    );
   }
   rotateSecret(appId: string) {
-    return this.request<{ secret: string }>("POST", `/api/apps/${appId}/rotate_secret`, {});
+    return this.request<{ secret: string }>(
+      "POST",
+      `/api/apps/${appId}/rotate_secret`,
+      {},
+    );
   }
   disableUser(userId: string) {
     return this.request("POST", `/api/users/${userId}/disable`, {});
   }
   issueSso(appName: string) {
-    return this.request<{ code: string; expires_in: number }>("POST", "/api/sso/issue", {
-      app_name: appName,
-    });
+    return this.request<{ code: string; expires_in: number }>(
+      "POST",
+      "/api/sso/issue",
+      {
+        app_name: appName,
+      },
+    );
   }
   portalApps() {
     return this.request<Record<string, unknown>[]>("GET", "/api/portal/apps");
   }
-  createUser(body: Record<string, unknown>) {
-    return this.request<Record<string, unknown>>("POST", "/api/users", body);
+  async createUser(body: Record<string, unknown>) {
+    const password =
+      typeof body.password === "string"
+        ? await sealLoginPassword(body.password)
+        : body.password;
+    return this.request<Record<string, unknown>>("POST", "/api/users", {
+      ...body,
+      password,
+    });
   }
   updateUser(id: string, body: Record<string, unknown>) {
-    return this.request<Record<string, unknown>>("PUT", `/api/users/${id}`, body);
+    return this.request<Record<string, unknown>>(
+      "PUT",
+      `/api/users/${id}`,
+      body,
+    );
   }
   setUserEnabled(id: string, enabled: boolean) {
-    return this.request("POST", `/api/users/${id}/${enabled ? "enable" : "disable"}`, {});
+    return this.request(
+      "POST",
+      `/api/users/${id}/${enabled ? "enable" : "disable"}`,
+      {},
+    );
   }
-  resetUserPassword(id: string, newPassword: string, reason: string) {
+  async resetUserPassword(id: string, newPassword: string, reason: string) {
     return this.request("POST", `/api/users/${id}/reset-password`, {
-      new_password: newPassword,
+      new_password: await sealLoginPassword(newPassword),
       reason,
     });
   }
-  changeMyPassword(currentPassword: string, newPassword: string) {
+  async changeMyPassword(currentPassword: string, newPassword: string) {
     return this.request("POST", "/api/me/change-password", {
-      current_password: currentPassword,
-      new_password: newPassword,
+      current_password: await sealLoginPassword(currentPassword),
+      new_password: await sealLoginPassword(newPassword),
     });
   }
   removeUser(id: string) {
     return this.request("DELETE", `/api/users/${id}`);
   }
   getUserApps(id: string) {
-    return this.request<{ app_id: string; admin: boolean }[]>("GET", `/api/users/${id}/apps`);
+    return this.request<{ app_id: string; admin: boolean }[]>(
+      "GET",
+      `/api/users/${id}/apps`,
+    );
   }
-  setUserApps(id: string, grants: { app_id: string; admin: boolean }[], reason = "") {
-    return this.request<{ grants: { app_id: string; admin: boolean }[] }>("PUT", `/api/users/${id}/apps`, {
-      grants,
-      reason,
-    });
+  setUserApps(
+    id: string,
+    grants: { app_id: string; admin: boolean }[],
+    reason = "",
+  ) {
+    return this.request<{ grants: { app_id: string; admin: boolean }[] }>(
+      "PUT",
+      `/api/users/${id}/apps`,
+      {
+        grants,
+        reason,
+      },
+    );
   }
   uploadOpenAccountConfirmation(ownerId: string, file: File) {
     return this.upload<{
@@ -230,21 +297,49 @@ export class YsRest {
     }>(`/api/owners/${ownerId}/open-account-confirmation`, file);
   }
   upsertMountExchangeAccount(body: Record<string, unknown>) {
-    return this.request<Record<string, unknown>>("PUT", "/api/mount-exchange-accounts", body);
+    return this.request<Record<string, unknown>>(
+      "PUT",
+      "/api/mount-exchange-accounts",
+      body,
+    );
   }
   setProjectOwners(projectId: string, ownerIds: string[]) {
-    return this.request<{ owner_ids: string[] }>("PUT", `/api/projects/${projectId}/owners`, {
-      owner_ids: ownerIds,
-    });
+    return this.request<{ owner_ids: string[] }>(
+      "PUT",
+      `/api/projects/${projectId}/owners`,
+      {
+        owner_ids: ownerIds,
+      },
+    );
   }
-  getRelations(entity: "owners" | "accounts", id: string, relation: "apps" | "strategies") {
-    return this.request<{ ids: string[] }>("GET", `/api/${entity}/${id}/relations/${relation}`);
+  getRelations(
+    entity: "owners" | "accounts",
+    id: string,
+    relation: "apps" | "strategies",
+  ) {
+    return this.request<{ ids: string[] }>(
+      "GET",
+      `/api/${entity}/${id}/relations/${relation}`,
+    );
   }
-  setRelations(entity: "owners" | "accounts", id: string, relation: "apps" | "strategies", ids: string[], reason = "") {
-    return this.request<{ ids: string[] }>("PUT", `/api/${entity}/${id}/relations/${relation}`, { ids, reason });
+  setRelations(
+    entity: "owners" | "accounts",
+    id: string,
+    relation: "apps" | "strategies",
+    ids: string[],
+    reason = "",
+  ) {
+    return this.request<{ ids: string[] }>(
+      "PUT",
+      `/api/${entity}/${id}/relations/${relation}`,
+      { ids, reason },
+    );
   }
   listOwnerFiles(ownerId: string) {
-    return this.request<Record<string, unknown>[]>("GET", `/api/owners/${ownerId}/files`);
+    return this.request<Record<string, unknown>[]>(
+      "GET",
+      `/api/owners/${ownerId}/files`,
+    );
   }
   async downloadFile(fileId: string) {
     if (this.rpcCall) {
@@ -291,7 +386,8 @@ function rpcError(error: unknown): YsRestError {
 function fileToBase64(file: File): Promise<string> {
   return new Promise((resolve, reject) => {
     const reader = new FileReader();
-    reader.onerror = () => reject(reader.error ?? new Error("读取上传文件失败"));
+    reader.onerror = () =>
+      reject(reader.error ?? new Error("读取上传文件失败"));
     reader.onload = () => resolve(String(reader.result).split(",", 2)[1] ?? "");
     reader.readAsDataURL(file);
   });
@@ -300,7 +396,8 @@ function fileToBase64(file: File): Promise<string> {
 function base64ToBlob(value: string, contentType: string): Blob {
   const binary = atob(value);
   const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  for (let index = 0; index < binary.length; index += 1)
+    bytes[index] = binary.charCodeAt(index);
   return new Blob([bytes], { type: contentType });
 }
 

package/src/store.ts

@@ -1,6 +1,7 @@
 /* @ysgroup/core —— 登录态 + 差量订阅缓存（Pinia store）。 */
 import { defineStore } from "pinia";
 import { ref, computed } from "vue";
+import { sealLoginPassword } from "./password";
 import { YsWsClient } from "./ws";
 
 interface LoginResult {
@@ -42,7 +43,9 @@ export const useYsStore = defineStore("ys", () => {
     ws.on("__disconnected", () => (connected.value = false));
     ws.on("snapshot", (d: unknown) => applySnapshot(d as SnapshotData));
     ws.on("delta", (d: unknown) => applyDelta(d as DeltaData));
-    ws.on("user_revoked", (d: unknown) => onRevoked(d as { user_id: string; reason?: string }));
+    ws.on("user_revoked", (d: unknown) =>
+      onRevoked(d as { user_id: string; reason?: string }),
+    );
     ws.on("resync", () => {}); // 前端订阅本子系统后端，resync 由后端 SDK 处理
     ws.start();
   }
@@ -98,12 +101,16 @@ export const useYsStore = defineStore("ys", () => {
     return "登录状态已失效，请重新登录。";
   }
 
-  async function login(username: string, password: string, otp = ""): Promise<void> {
+  async function login(
+    username: string,
+    password: string,
+    otp = "",
+  ): Promise<void> {
     if (!ws) throw new Error("未连接");
     sessionMessage.value = "";
     const result = (await ws.call("login", {
       username,
-      password,
+      password: await sealLoginPassword(password),
       otp,
       app_name: appName.value,
       user_agent: navigator.userAgent,
@@ -115,7 +122,9 @@ export const useYsStore = defineStore("ys", () => {
   async function loginByCode(code: string): Promise<void> {
     await waitUntilConnected();
     if (!ws) throw new Error("未连接");
-    const result = (await ws.call("exchange_sso_code", { code })) as LoginResult;
+    const result = (await ws.call("exchange_sso_code", {
+      code,
+    })) as LoginResult;
     setSession(result);
   }
 
@@ -135,7 +144,10 @@ export const useYsStore = defineStore("ys", () => {
     });
   }
 
-  async function changeMyPassword(currentPassword: string, newPassword: string): Promise<void> {
+  async function changeMyPassword(
+    currentPassword: string,
+    newPassword: string,
+  ): Promise<void> {
     if (!ws || !accessToken.value) throw new Error("未登录");
     if (
       String(user.value?.role ?? "") === "Root" ||
@@ -147,8 +159,8 @@ export const useYsStore = defineStore("ys", () => {
     }
     await ws.call("change_password", {
       access_token: accessToken.value,
-      current_password: currentPassword,
-      new_password: newPassword,
+      current_password: await sealLoginPassword(currentPassword),
+      new_password: await sealLoginPassword(newPassword),
     });
     clearSession();
   }

package/src/ws.ts

@@ -1,5 +1,7 @@
 /* @ysgroup/core —— 浏览器端 WS RPC 客户端（与 ys_base.ws.WsRpcClient 信封协议对齐）。 */
 
+import { applyPasswordWrap } from "./password";
+
 export interface Envelope {
   event: string;
   id?: string;
@@ -20,7 +22,8 @@ export class YsRpcError extends Error {
     message: string,
     public requestId = "",
   ) {
-    const display = code >= 500 && requestId ? `${message}（编号 ${requestId}）` : message;
+    const display =
+      code >= 500 && requestId ? `${message}（编号 ${requestId}）` : message;
     super(display);
     this.name = "YsRpcError";
     this.clientMessage = message;
@@ -33,7 +36,10 @@ export class YsWsClient {
   private ws: WebSocket | null = null;
   private seq = 0;
   private connectionId = "";
-  private pending = new Map<string, { resolve: (v: unknown) => void; reject: (e: Error) => void }>();
+  private pending = new Map<
+    string,
+    { resolve: (v: unknown) => void; reject: (e: Error) => void }
+  >();
   private handlers = new Map<string, EventHandler[]>();
   private reconnectDelay = 1000;
   private stopped = false;
@@ -101,11 +107,15 @@ export class YsWsClient {
     };
     ws.onmessage = (e) => this.onMessage(e);
     ws.onclose = () => {
-      for (const p of this.pending.values()) p.reject(new Error("connection lost"));
+      for (const p of this.pending.values())
+        p.reject(new Error("connection lost"));
       this.pending.clear();
       this.emit("__disconnected", null);
       if (!this.stopped) {
-        setTimeout(() => this.connect(), this.reconnectDelay + Math.random() * 1000);
+        setTimeout(
+          () => this.connect(),
+          this.reconnectDelay + Math.random() * 1000,
+        );
         this.reconnectDelay = Math.min(this.reconnectDelay * 2, 30_000);
       }
     };
@@ -123,14 +133,25 @@ export class YsWsClient {
       if (p) {
         this.pending.delete(msg.reply_to);
         if ((msg.code ?? 0) === 0) p.resolve(msg.data);
-        else p.reject(new YsRpcError(msg.code ?? 500, msg.message ?? "", msg.request_id ?? ""));
+        else
+          p.reject(
+            new YsRpcError(
+              msg.code ?? 500,
+              msg.message ?? "",
+              msg.request_id ?? "",
+            ),
+          );
       }
       return;
     }
     if (msg.event === "hello") {
-      this.connectionId = String((msg.data as { connection_id?: string })?.connection_id ?? "");
+      this.connectionId = String(
+        (msg.data as { connection_id?: string })?.connection_id ?? "",
+      );
+      applyPasswordWrap(msg.data);
       this.emit("__connected", msg.data);
     }
+    if (msg.event === "password_wrap") applyPasswordWrap(msg.data);
     this.emit(msg.event, msg.data);
   }