agentworkshop 0.7.9 → 0.7.12

package/app/pages/permissions/index.vue

@@ -0,0 +1,330 @@
+<script setup lang="ts">
+/**
+ * 权限管理(admin 专属)—— 用户 × 产线授权矩阵。
+ * 三态:无权(none,后端不返回该产线数据)/ 仅查看(readonly,数采只读)/ 可操控(operate,数采+数控全量)。
+ * 用户详情抽屉含:基本信息、该用户创建的 Channel、产线授权矩阵(逐线三态选择,批量保存)。
+ */
+import { computed, onMounted, reactive, ref } from 'vue'
+import { message } from 'ant-design-vue'
+import { useUserStore } from '~/stores/workshop/user'
+
+const { t } = useI18n()
+const userStore = useUserStore()
+
+interface LineView { id: string, name: string }
+interface GrantRow { lineId: string, mode: string, grantedBy: string | null, grantedAt: string }
+interface UserRow {
+  id: string
+  name: string
+  email: string
+  role: string
+  status: string
+  createdAt: string
+  channels: Array<{ id: string, name: string, createdAt: string }>
+  grants: GrantRow[]
+}
+
+const lines = ref<LineView[]>([])
+const users = ref<UserRow[]>([])
+const loading = ref(false)
+const keyword = ref('')
+const drawerOpen = ref(false)
+const current = ref<UserRow | null>(null)
+// lineId → 'none' | 'readonly' | 'operate'
+const draft = reactive<Record<string, string>>({})
+const saving = ref(false)
+
+function authHeaders(): Record<string, string> {
+  const token = (userStore as { token?: string }).token
+  return token ? { authorization: `Bearer ${token}` } : {}
+}
+
+async function load() {
+  loading.value = true
+  try {
+    const d = await $fetch<{ code: number, data?: { lines: LineView[], users: UserRow[] } }>('/api/workshop/permissions', { headers: authHeaders() })
+    if (d.code !== 0 || !d.data) throw new Error('load fail')
+    lines.value = d.data.lines ?? []
+    users.value = d.data.users ?? []
+  }
+  catch (err) {
+    message.error(apiErrorMessage(err, t('permissions.loadFail')))
+  }
+  finally {
+    loading.value = false
+  }
+}
+
+const filteredUsers = computed(() => {
+  const kw = keyword.value.trim().toLowerCase()
+  if (!kw) return users.value
+  return users.value.filter(u => `${u.name} ${u.email}`.toLowerCase().includes(kw))
+})
+
+function openDetail(u: UserRow) {
+  current.value = u
+  draftClear(u)
+  drawerOpen.value = true
+}
+
+function draftClear(u: UserRow) {
+  for (const k of Object.keys(draft)) Reflect.deleteProperty(draft, k)
+  for (const l of lines.value) {
+    const g = u.grants.find(x => x.lineId === l.id)
+    draft[l.id] = (g?.mode === 'readonly' || g?.mode === 'operate') ? g.mode : 'none'
+  }
+}
+
+const dirtyCount = computed(() => {
+  if (!current.value) return 0
+  let n = 0
+  for (const l of lines.value) {
+    const g = current.value.grants.find(x => x.lineId === l.id)
+    const cur = (g?.mode === 'readonly' || g?.mode === 'operate') ? g.mode : 'none'
+    if ((draft[l.id] ?? 'none') !== cur) n++
+  }
+  return n
+})
+
+async function save() {
+  if (!current.value) return
+  saving.value = true
+  try {
+    const grants = lines.value
+      .filter(l => (draft[l.id] ?? 'none') !== 'none')
+      .map(l => ({ lineId: l.id, mode: draft[l.id] }))
+    const revoked = lines.value
+      .filter(l => (draft[l.id] ?? 'none') === 'none' && current.value!.grants.some(g => g.lineId === l.id))
+      .map(l => ({ lineId: l.id, mode: null }))
+    const d = await $fetch<{ code: number, data?: { grants: GrantRow[] } }>('/api/workshop/permissions', {
+      method: 'PUT',
+      headers: authHeaders(),
+      body: { userId: current.value.id, grants: [...grants, ...revoked] },
+    })
+    if (d.code !== 0 || !d.data) throw new Error('save fail')
+    current.value.grants = d.data.grants
+    const u = users.value.find(x => x.id === current.value?.id)
+    if (u) u.grants = d.data.grants
+    message.success(t('permissions.saved', { n: grants.length + revoked.length }))
+  }
+  catch (err) {
+    message.error(apiErrorMessage(err, t('permissions.saveFail')))
+  }
+  finally {
+    saving.value = false
+  }
+}
+
+function modeTag(mode: string): string {
+  return mode === 'operate' ? t('permissions.operate') : mode === 'readonly' ? t('permissions.readonly') : t('permissions.none')
+}
+
+// admin 专属页:非 admin 直接回仪表盘(后端 API 亦有 admin 拦截)
+watch(() => userStore.isLoggedIn, (ok) => {
+  if (ok && !userStore.isAdmin) navigateTo('/')
+}, { immediate: true })
+
+onMounted(load)
+</script>
+
+<template>
+  <div class="perm-page">
+    <header class="pg-head">
+      <div>
+        <p class="aw-kicker">
+          agentworkshop / permissions
+        </p>
+        <h1 class="pg-title">
+          {{ $t('permissions.title') }}
+        </h1>
+        <p class="pg-sub">
+          {{ $t('permissions.subtitle') }}
+        </p>
+      </div>
+      <a-input-search
+        v-model:value="keyword"
+        :placeholder="$t('permissions.search')"
+        style="max-width: 260px"
+        allow-clear
+      />
+    </header>
+
+    <a-table
+      :data-source="filteredUsers"
+      :loading="loading"
+      row-key="id"
+      size="middle"
+      :pagination="{ pageSize: 12, showSizeChanger: false }"
+    >
+      <a-table-column
+        :title="$t('permissions.colUser')"
+        data-index="name"
+      >
+        <template #default="{ record }">
+          <a @click.prevent="openDetail(record)">{{ record.name }}</a>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colEmail')"
+        data-index="email"
+      />
+      <a-table-column
+        :title="$t('permissions.colRole')"
+        data-index="role"
+      >
+        <template #default="{ record }">
+          <a-tag :color="record.role === 'admin' ? 'green' : record.role === 'editor' ? 'blue' : 'default'">
+            {{ record.role }}
+          </a-tag>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colStatus')"
+        data-index="status"
+      >
+        <template #default="{ record }">
+          <a-tag :color="record.status === 'active' ? 'cyan' : 'red'">
+            {{ record.status === 'active' ? $t('permissions.active') : record.status }}
+          </a-tag>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colChannels')"
+        data-index="channels"
+      >
+        <template #default="{ record }">
+          {{ record.channels.length }}
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colGrants')"
+        data-index="grants"
+      >
+        <template #default="{ record }">
+          <a-tag
+            v-for="g in record.grants"
+            :key="g.lineId"
+            style="margin-bottom: 2px"
+          >
+            {{ (lines.find(l => l.id === g.lineId)?.name ?? g.lineId).slice(0, 14) }} · {{ modeTag(g.mode) }}
+          </a-tag>
+          <span
+            v-if="!record.grants.length"
+            class="dim"
+          >—</span>
+        </template>
+      </a-table-column>
+      <a-table-column
+        :title="$t('permissions.colOps')"
+        :width="90"
+      >
+        <template #default="{ record }">
+          <a-button
+            size="small"
+            @click="openDetail(record)"
+          >
+            {{ $t('permissions.manage') }}
+          </a-button>
+        </template>
+      </a-table-column>
+    </a-table>
+
+    <a-drawer
+      v-model:open="drawerOpen"
+      :title="current ? `${current.name} · ${$t('permissions.detail')}` : ''"
+      width="560"
+    >
+      <template v-if="current">
+        <h4 class="sec">
+          {{ $t('permissions.secProfile') }}
+        </h4>
+        <dl class="detail">
+          <dt>email</dt><dd>{{ current.email }}</dd>
+          <dt>role</dt><dd>{{ current.role }}</dd>
+          <dt>status</dt><dd>{{ current.status }}</dd>
+          <dt>created</dt><dd>{{ current.createdAt }}</dd>
+        </dl>
+
+        <h4 class="sec">
+          {{ $t('permissions.secChannels') }}({{ current.channels.length }})
+        </h4>
+        <div
+          v-if="current.channels.length"
+          class="ch-list"
+        >
+          <code
+            v-for="c in current.channels"
+            :key="c.id"
+          >{{ c.name || c.id.slice(0, 8) }}</code>
+        </div>
+        <p
+          v-else
+          class="dim"
+        >
+          {{ $t('permissions.noChannels') }}
+        </p>
+
+        <h4 class="sec">
+          {{ $t('permissions.secMatrix') }}
+          <a-button
+            type="primary"
+            size="small"
+            :loading="saving"
+            :disabled="dirtyCount === 0"
+            style="margin-left: 12px"
+            @click="save"
+          >
+            {{ $t('permissions.save', { n: dirtyCount }) }}
+          </a-button>
+        </h4>
+        <p class="hint">
+          {{ $t('permissions.matrixHint') }}
+        </p>
+        <div class="matrix">
+          <div
+            v-for="l in lines"
+            :key="l.id"
+            class="row"
+          >
+            <span
+              class="line-name"
+              :title="l.id"
+            >{{ l.name }}</span>
+            <a-radio-group
+              v-model:value="draft[l.id]"
+              size="small"
+            >
+              <a-radio-button value="none">
+                {{ $t('permissions.none') }}
+              </a-radio-button>
+              <a-radio-button value="readonly">
+                {{ $t('permissions.readonly') }}
+              </a-radio-button>
+              <a-radio-button value="operate">
+                {{ $t('permissions.operate') }}
+              </a-radio-button>
+            </a-radio-group>
+          </div>
+        </div>
+      </template>
+    </a-drawer>
+  </div>
+</template>
+
+<style scoped lang="css">
+.perm-page { max-width: 1180px; margin: 0 auto; padding: 24px 20px 48px; }
+.pg-head { display: flex; align-items: flex-end; justify-content: space-between; gap: 16px; margin-bottom: 18px; }
+.pg-title { margin: 0; font-size: 22px; font-weight: 700; letter-spacing: .5px; }
+.pg-sub { margin: 4px 0 0; opacity: .6; font-size: 12px; }
+.dim { opacity: .45; }
+.sec { margin: 20px 0 8px; font-size: 13px; font-weight: 700; }
+.detail dt { margin-top: 8px; font-size: 11px; opacity: .5; }
+.detail dd { margin: 2px 0 0; font-family: ui-monospace, monospace; font-size: 12px; }
+.ch-list { display: flex; flex-wrap: wrap; gap: 6px; }
+.ch-list code { padding: 2px 8px; border: 1px solid rgba(128, 152, 199, .3); border-radius: 6px; font-size: 11px; }
+.hint { font-size: 11px; opacity: .55; margin: 4px 0 10px; }
+.matrix { display: flex; flex-direction: column; gap: 8px; }
+.matrix .row { display: flex; align-items: center; justify-content: space-between; gap: 12px;
+  padding: 8px 12px; border: 1px solid var(--aw-border, rgba(128, 152, 199, .25)); border-radius: 10px; }
+.line-name { font-size: 13px; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+</style>

package/app/pages/plugins/index.vue

@@ -90,6 +90,9 @@ onMounted(load)
   <div class="plugins-page">
     <header class="pg-head">
       <div>
+        <p class="aw-kicker">
+          agentworkshop / plugins
+        </p>
         <h1 class="pg-title">
           {{ $t('plugins.title') }}
         </h1>
@@ -136,11 +139,11 @@ onMounted(load)
       {{ $t('plugins.empty') }}
     </div>
 
-    <div class="pg-grid">
+    <div class="pg-grid aw-stagger">
       <article
         v-for="p in plugins"
         :key="`${p.scope}:${p.name}`"
-        class="pg-card"
+        class="pg-card aw-liftable"
         :class="{ 'is-off': !p.enabled }"
         @click="openDetail(p)"
       >
@@ -254,7 +257,7 @@ onMounted(load)
 .tag.user { border-color: rgba(65, 200, 244, .5); color: #41c8f4; }
 .tag.on { border-color: rgba(53, 224, 160, .5); color: #35e0a0; }
 .tag.off { border-color: rgba(255, 107, 107, .4); color: #ff6b6b; }
-.tag.client { border-color: rgba(181, 140, 255, .5); color: #b58cff; }
+.tag.client { border-color: color-mix(in srgb, var(--ink) 24%, transparent); color: var(--ink-soft); }
 .card-routes { display: flex; flex-direction: column; gap: 2px; }
 .card-routes code { font-size: 10px; opacity: .65; }
 .detail dt { margin-top: 10px; font-size: 11px; opacity: .5; }

package/app/pages/settings.vue

@@ -60,7 +60,9 @@ async function saveRuntime() {
 async function resetRuntimeKey(key: string) {
   try {
     await rcStore.patch({ [key]: null })
-    syncRuntimeDraft()
+    // 只收敛被重置的键:整表 sync 会静默丢弃用户其他未保存编辑
+    dirtyKeys.value.delete(key)
+    draft.value[key] = rcStore.effective[key]
     runtimeNotice.value = { type: 'success', text: t('settings.runtime.keyReset', { key }) }
   }
   catch (e) {
@@ -80,7 +82,7 @@ async function resetAllRuntime() {
 }
 
 function groupLabel(group: string): string {
-  const known: Record<string, string> = { server: t('settings.runtime.groupServer'), app: t('settings.runtime.groupApp'), api: 'API', theme: t('settings.runtime.groupTheme'), i18n: t('settings.runtime.groupI18n'), security: t('settings.runtime.groupSecurity'), daq: t('settings.runtime.groupDaq'), memory: t('settings.runtime.groupMemory'), omp: t('settings.runtime.groupOmp'), dcw: t('settings.runtime.groupDcw'), workshop: t('settings.runtime.groupWorkshop'), backup: t('settings.runtime.groupBackup'), retention: t('settings.runtime.groupRetention'), log: t('settings.runtime.groupLog') }
+  const known: Record<string, string> = { server: t('settings.runtime.groupServer'), app: t('settings.runtime.groupApp'), api: t('settings.runtime.groupApi'), theme: t('settings.runtime.groupTheme'), i18n: t('settings.runtime.groupI18n'), security: t('settings.runtime.groupSecurity'), daq: t('settings.runtime.groupDaq'), memory: t('settings.runtime.groupMemory'), omp: t('settings.runtime.groupOmp'), harness: t('settings.runtime.groupHarness'), dcw: t('settings.runtime.groupDcw'), workshop: t('settings.runtime.groupWorkshop'), backup: t('settings.runtime.groupBackup'), retention: t('settings.runtime.groupRetention'), log: t('settings.runtime.groupLog') }
   return known[group] ?? group
 }
 function sourceClass(s: string): string {

package/app/pages/tokens.vue

@@ -272,6 +272,7 @@ useHead({ title: () => tt('titles.tokens') })
     <template v-else>
       <div class="head">
         <div>
+          <p class="aw-kicker">agentworkshop / api tokens</p>
           <h2>API Token</h2>
           <p class="sub">
             {{ userStore.user?.name }} · {{ $t('tokens.k1upppaw026') }}
@@ -319,37 +320,31 @@ useHead({ title: () => tt('titles.tokens') })
                 <code
                   class="tok-val"
                   :class="{ revealed: isRevealed(record.id) }"
-                  :title="isRevealed(record.id) ? '已显示明文,点击眼睛遮回' : '掩码预览,点击眼睛查看明文'"
+                  :title="isRevealed(record.id) ? '已显示明文,点击眼睛遮回' : '掩码预览'"
                 >{{ rowDisplay(record as TokenMeta) }}</code>
                 <a-button
+                  v-if="record.hasPlain"
                   type="text"
                   size="small"
                   class="tok-op"
                   :loading="revealingId === record.id"
-                  :disabled="!record.hasPlain"
-                  :title="!record.hasPlain ? '旧版本 token 未存档明文,不可查看' : (isRevealed(record.id) ? '遮回' : '查看明文')"
+                  :title="isRevealed(record.id) ? '遮回' : '查看明文'"
                   @click="toggleRowReveal(record as TokenMeta)"
                 >
                   <span :class="isRevealed(record.id) ? 'i-tabler-eye-off' : 'i-tabler-eye'" />
                 </a-button>
                 <a-button
+                  v-if="record.hasPlain"
                   type="text"
                   size="small"
                   class="tok-op"
                   :class="{ ok: copyId === record.id }"
-                  :disabled="!record.hasPlain"
                   :title="copyId === record.id ? '已复制' : '复制明文'"
                   @click="copyRow(record as TokenMeta)"
                 >
                   <span :class="copyId === record.id ? 'i-tabler-check' : 'i-tabler-copy'" />
                 </a-button>
-                <a-tag
-                  v-if="!record.hasPlain"
-                  class="legacy-tag"
-                  color="orange"
-                >
-                  {{ $t('tokens.kyelqk1008') }}
-                </a-tag>
+                <!-- 0.7.10 起 token 只存哈希:无明文是常态,不再打「旧版不可见」标签 -->
               </div>
             </template>
             <template v-else-if="column.key === 'createdAt'">
@@ -374,10 +369,11 @@ useHead({ title: () => tt('titles.tokens') })
                   :cancel-text="'取消'"
                   @confirm="doRevoke(record)"
                 >
+                  <!-- 安静文本按钮:常态墨灰,悬停转红 —— 红色只留给真实确认瞬间,不再整行批发 -->
                   <a-button
-                    type="link"
+                    type="text"
                     size="small"
-                    danger
+                    class="tok-revoke"
                   >
                     <span class="i-tabler-trash" />
                     {{ $t('tokens.k3xmrz010') }}

package/app/pages/workshop/index.vue

@@ -415,9 +415,11 @@ useHead({ title: () => t('titles.workshop') })
 
           <div
             v-if="wsStore.workspaces.length === 0 && ready"
-            class="card placeholder"
+            class="card placeholder aw-empty"
             @click="createOpen = true"
           >
+            <span class="aw-empty-title">从一条产线、一个 Agent 开始</span>
+            <span class="aw-empty-sub">Workspace 是频道与任务的容器 —— 建立第一个工作区后,你的 Agent 团队即可上线作业。</span>
             <span class="i-tabler-plus big" />
             <span>新建第一个 Workspace</span>
           </div>

package/app/plugins/http.ts

@@ -5,6 +5,9 @@ import axios, {
   type InternalAxiosRequestConfig,
 } from 'axios'
 import { message } from 'ant-design-vue'
+import { useUserStore } from '~/stores/workshop/user'
+
+const g = globalThis as typeof globalThis & { __awShown401?: boolean }
 
 /**
  * HTTP 请求层（基于 axios 封装）
@@ -12,7 +15,7 @@ import { message } from 'ant-design-vue'
  * - 统一请求/响应拦截：注入 token、统一错误提示
  * - 通过 nuxt provide 暴露 $http，并提供 useHttp 组合式入口
  */
-export default defineNuxtPlugin(() => {
+export default defineNuxtPlugin((nuxtApp) => {
   const config = useRuntimeConfig().public
 
   const instance: AxiosInstance = axios.create({
@@ -40,7 +43,20 @@ export default defineNuxtPlugin(() => {
       const msg = error?.response?.data?.message || error.message || '请求失败'
 
       if (status === 401) {
-        message.error('登录已过期，请重新登录')
+        // 死 token 收尾:清登录态(cookie+pinia)防 401 toast 风暴;toast 3s 去重
+        try {
+          const cookie = useCookie<string | null>('token')
+          cookie.value = null
+          useUserStore(nuxtApp.$pinia).$reset()
+        }
+        catch { /* 无 pinia 上下文(极端时序) */ }
+        if (!g.__awShown401) {
+          g.__awShown401 = true
+          message.error('登录已过期,请重新登录')
+          setTimeout(() => {
+            g.__awShown401 = false
+          }, 3000)
+        }
       }
       else if (status >= 500) {
         message.error('服务器异常，请稍后重试')

package/app/plugins/session-restore.client.ts

@@ -16,9 +16,14 @@ export default defineNuxtPlugin(async () => {
   const token = cookie.value
   if (!token) return
   try {
-    await store.loginWithToken(token)
+    // 超时竞速:慢 auth API 不应阻塞整站首绘
+    await Promise.race([
+      store.loginWithToken(token),
+      new Promise(r => setTimeout(r, 5000)),
+    ])
   }
   catch {
-    /* token 已失效(吊销/用户删除):静默停留未登录态 */
+    // token 已失效(吊销/用户删除/过期):清死 cookie,避免每次刷新重复必然失败的校验
+    useCookie<string | null>('token').value = null
   }
 })

package/app/stores/workshop/user.ts

@@ -55,7 +55,8 @@ export const useUserStore = defineStore('workshop.user', {
       // 请求上下文已丢失,useCookie 会抛 NUXT_E1001(useNuxtApp outside context);
       // 请求期写 Set-Cookie 在响应完成后也无实效。客户端 useCookie 不依赖请求上下文。
       if (import.meta.server) return
-      const cookie = useCookie<string | null>('token', { maxAge: 60 * 60 * 24 * 365 })
+      // maxAge 与服务端 token TTL(30 天)对齐:365 天会让浏览器带着必死 token 往返
+      const cookie = useCookie<string | null>('token', { maxAge: 60 * 60 * 24 * 30 })
       cookie.value = this.user?.token ?? null
     },
     /** 以 me 响应补全 tokenId（注册/登录签发的新 token 尚未绑定 id） */
@@ -171,6 +172,18 @@ export const useUserStore = defineStore('workshop.user', {
     },
   },
   persist: {
+    // localStorage 不持久化 token(长命明文凭据,XSS 可读且跨标签页漂移):
+    // token 真源是 30 天 cookie;hydration 后从 cookie 回填,无 cookie 即回登出态
     pick: ['user'],
+    afterHydrate: (ctx) => {
+      const store = ctx.store as { user?: { token?: string } | null, user?: CurrentUser | null, applyCookie?: () => void }
+      if (!store.user) return
+      try {
+        const cookie = useCookie<string | null>('token')
+        if (cookie.value) store.user.token = cookie.value
+        else (store as { user?: CurrentUser | null }).user = null
+      }
+      catch { /* SSR 上下文:跳过(session-restore.client 负责) */ }
+    },
   },
 })