asaihost-nodejs 0.0.1

package/dist/chunk-EOGZPRML.es.js

@@ -0,0 +1,740 @@
+import {
+  asRows,
+  getDataServer,
+  qNum,
+  qStr,
+  readJsonBlob,
+  resolveStoreConfig,
+  writeJsonBlob
+} from "./chunk-KUZQ36IJ.es.js";
+import {
+  __name
+} from "./chunk-6U2I5EON.es.js";
+
+// src/sysserver/api/login/store/user-db.ts
+var USER_FIELDS = [
+  "id",
+  "us",
+  "email",
+  "passHash",
+  "passSalt",
+  "lv",
+  "role",
+  "status",
+  "failCount",
+  "lockedUntil",
+  "mustChangePassword",
+  "passwordChangedAt",
+  "passHistory",
+  "createdAt",
+  "updatedAt"
+];
+var SESSION_FIELDS = ["id", "us", "ip", "createdAt", "expiresAt", "lastActivityAt", "pri", "pub"];
+var FILE_USERS = "users.json";
+var FILE_SESSIONS = "sessions.json";
+var TABLE_USERS = "auth_users";
+var TABLE_SESSIONS = "auth_sessions";
+function getUserStoreConfig($asai) {
+  const resolved = resolveStoreConfig($asai, "user");
+  return { type: resolved.type, opt: resolved.opt };
+}
+__name(getUserStoreConfig, "getUserStoreConfig");
+function getUserDataServer($asai) {
+  return getDataServer($asai, "user");
+}
+__name(getUserDataServer, "getUserDataServer");
+function rowToRecord(row, numericKeys) {
+  const out = { ...row };
+  for (const key of numericKeys) {
+    if (out[key] != null && out[key] !== "") out[key] = Number(out[key]);
+  }
+  if (out.lockedUntil === "" || out.lockedUntil == null) delete out.lockedUntil;
+  if (out.email === "") delete out.email;
+  return out;
+}
+__name(rowToRecord, "rowToRecord");
+async function readJsonArray(db, filename) {
+  return readJsonBlob(db, filename);
+}
+__name(readJsonArray, "readJsonArray");
+async function writeJsonArray(db, filename, data) {
+  await writeJsonBlob(db, filename, data);
+}
+__name(writeJsonArray, "writeJsonArray");
+async function dbListUsers($asai) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    return readJsonArray(db, FILE_USERS);
+  }
+  const res = await db.sqlDb({ type: "select", table: TABLE_USERS, field: [...USER_FIELDS] });
+  return asRows(res).map((r) => rowToRecord(r, ["lv", "failCount", "lockedUntil", "mustChangePassword", "passwordChangedAt", "createdAt", "updatedAt"]));
+}
+__name(dbListUsers, "dbListUsers");
+async function dbFindUser($asai, field, value) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    const users = await readJsonArray(db, FILE_USERS);
+    return users.find((u) => u[field] === value) || null;
+  }
+  const res = await db.sqlDb({
+    type: "select",
+    table: TABLE_USERS,
+    field: [...USER_FIELDS],
+    where: [[field, "=", qStr(value, cfg.type)]],
+    limit: 1
+  });
+  const rows = asRows(res);
+  return rows.length ? rowToRecord(rows[0], ["lv", "failCount", "lockedUntil", "mustChangePassword", "passwordChangedAt", "createdAt", "updatedAt"]) : null;
+}
+__name(dbFindUser, "dbFindUser");
+async function dbCreateUser($asai, user) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    const users = await readJsonArray(db, FILE_USERS);
+    users.push(user);
+    await writeJsonArray(db, FILE_USERS, users);
+    return user;
+  }
+  await db.sqlDb({
+    type: "insert",
+    table: TABLE_USERS,
+    field: [...USER_FIELDS],
+    value: [
+      USER_FIELDS.map((f) => {
+        const v = user[f];
+        if (typeof v === "number") return qNum(v);
+        return qStr(v == null ? "" : String(v), cfg.type);
+      })
+    ]
+  });
+  return user;
+}
+__name(dbCreateUser, "dbCreateUser");
+async function dbUpdateUser($asai, us, patch) {
+  const existing = await dbFindUser($asai, "us", us);
+  if (!existing) return null;
+  const merged = { ...existing, ...patch, updatedAt: Date.now() };
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    const users = await readJsonArray(db, FILE_USERS);
+    const idx = users.findIndex((u) => u.us === us);
+    if (idx < 0) return null;
+    users[idx] = merged;
+    await writeJsonArray(db, FILE_USERS, users);
+    return merged;
+  }
+  const sets = [];
+  for (const [key, val] of Object.entries(patch)) {
+    if (val === void 0) continue;
+    if (typeof val === "number") sets.push([key, val]);
+    else sets.push([key, val == null ? "" : String(val)]);
+  }
+  sets.push(["updatedAt", merged.updatedAt]);
+  await db.sqlDb({
+    type: "update",
+    table: TABLE_USERS,
+    set: sets,
+    where: [["us", "=", qStr(us, cfg.type)]]
+  });
+  return merged;
+}
+__name(dbUpdateUser, "dbUpdateUser");
+async function dbListSessions($asai) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    return readJsonArray(db, FILE_SESSIONS);
+  }
+  const res = await db.sqlDb({ type: "select", table: TABLE_SESSIONS, field: [...SESSION_FIELDS] });
+  return asRows(res).map((r) => rowToRecord(r, ["createdAt", "expiresAt", "lastActivityAt"]));
+}
+__name(dbListSessions, "dbListSessions");
+async function dbWriteSessions($asai, sessions) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    await writeJsonArray(db, FILE_SESSIONS, sessions);
+    return;
+  }
+  const existing = await dbListSessions($asai);
+  for (const s of existing) {
+    await db.sqlDb({
+      type: "delete",
+      table: TABLE_SESSIONS,
+      where: [["id", "=", qStr(String(s.id), cfg.type)]]
+    });
+  }
+  for (const s of sessions) {
+    await db.sqlDb({
+      type: "insert",
+      table: TABLE_SESSIONS,
+      field: [...SESSION_FIELDS],
+      value: [
+        SESSION_FIELDS.map((f) => {
+          const v = s[f];
+          if (typeof v === "number") return qNum(v);
+          return qStr(v == null ? "" : String(v), cfg.type);
+        })
+      ]
+    });
+  }
+}
+__name(dbWriteSessions, "dbWriteSessions");
+async function dbAddSession($asai, session) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    const sessions = await readJsonArray(db, FILE_SESSIONS);
+    sessions.push(session);
+    await writeJsonArray(db, FILE_SESSIONS, sessions);
+    return;
+  }
+  await db.sqlDb({
+    type: "insert",
+    table: TABLE_SESSIONS,
+    field: [...SESSION_FIELDS],
+    value: [
+      SESSION_FIELDS.map((f) => {
+        const v = session[f];
+        if (typeof v === "number") return qNum(v);
+        return qStr(v == null ? "" : String(v), cfg.type);
+      })
+    ]
+  });
+}
+__name(dbAddSession, "dbAddSession");
+async function dbRemoveSession($asai, sessionId) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    const sessions = await readJsonArray(db, FILE_SESSIONS);
+    await writeJsonArray(
+      db,
+      FILE_SESSIONS,
+      sessions.filter((s) => s.id !== sessionId)
+    );
+    return;
+  }
+  await db.sqlDb({
+    type: "delete",
+    table: TABLE_SESSIONS,
+    where: [["id", "=", qStr(sessionId, cfg.type)]]
+  });
+}
+__name(dbRemoveSession, "dbRemoveSession");
+async function dbRemoveSessionsByUser($asai, us) {
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  if (cfg.type === "file") {
+    const sessions = await readJsonArray(db, FILE_SESSIONS);
+    await writeJsonArray(
+      db,
+      FILE_SESSIONS,
+      sessions.filter((s) => s.us !== us)
+    );
+    return;
+  }
+  await db.sqlDb({
+    type: "delete",
+    table: TABLE_SESSIONS,
+    where: [["us", "=", qStr(us, cfg.type)]]
+  });
+}
+__name(dbRemoveSessionsByUser, "dbRemoveSessionsByUser");
+async function dbDeleteUser($asai, us) {
+  const existing = await dbFindUser($asai, "us", us);
+  if (!existing) return false;
+  const db = getUserDataServer($asai);
+  const cfg = getUserStoreConfig($asai);
+  await dbRemoveSessionsByUser($asai, us);
+  if (cfg.type === "file") {
+    const users = await readJsonArray(db, FILE_USERS);
+    const next = users.filter((u) => u.us !== us);
+    if (next.length === users.length) return false;
+    await writeJsonArray(db, FILE_USERS, next);
+    return true;
+  }
+  await db.sqlDb({
+    type: "delete",
+    table: TABLE_USERS,
+    where: [["us", "=", qStr(us, cfg.type)]]
+  });
+  return true;
+}
+__name(dbDeleteUser, "dbDeleteUser");
+
+// src/infra/security-policy.ts
+import { createHash } from "crypto";
+
+// src/sysserver/api/login/service/user-level-config.ts
+import fs from "fs/promises";
+import path from "path";
+
+// src/sysserver/api/login/service/route-defaults.ts
+var DEFAULT_ROUTE_RIGHTS = [
+  { route: "testkdd", title: "testkdd", minLv: 0, public: true },
+  { route: "testkdd/testindex", title: "\u529F\u80FD\u603B\u89C8", minLv: 0, public: true },
+  { route: "user/login", title: "\u7528\u6237\u767B\u5F55", minLv: 0, public: true },
+  { route: "user/reg", title: "\u7528\u6237\u6CE8\u518C", minLv: 0, public: true },
+  { route: "user/exit", title: "\u9000\u51FA\u767B\u5F55", minLv: 0, public: true },
+  { route: "testkdd/testerrorcodes", title: "\u9519\u8BEF\u7801\u6CE8\u518C\u8868", minLv: 0, public: true },
+  { route: "testkdd/testhealth", title: "\u5065\u5EB7\u76D1\u63A7", minLv: 0, public: true },
+  { route: "testkdd/testauth", title: "\u8BA4\u8BC1\u5B9E\u9A8C\u5BA4", minLv: 0, public: true },
+  { route: "testkdd/testasdb", title: "AsDb \u603B\u89C8", minLv: 0, public: true },
+  { route: "testkdd/testasdbfile", title: "AsDb \u6587\u4EF6", minLv: 0, public: true },
+  { route: "testkdd/testasdbsqlite", title: "AsDb SQLite", minLv: 0, public: true },
+  { route: "testkdd/testmfc", title: "AES MFC", minLv: 0, public: true },
+  { route: "testkdd/testws", title: "WebSocket", minLv: 0, public: true },
+  { route: "testkdd/testchat", title: "WS \u804A\u5929\u5BA4", minLv: 0, public: true },
+  { route: "testkdd/testascss", title: "AsCss", minLv: 0, public: true },
+  { route: "testkdd/testpopbox", title: "\u5F39\u7A97\u7EC4\u4EF6", minLv: 0, public: true },
+  { route: "testkdd/testaes", title: "AES \u52A0\u89E3\u5BC6", minLv: 0, public: true },
+  { route: "testkdd/testdirectives", title: "Vue \u6307\u4EE4", minLv: 0, public: true },
+  { route: "testkdd/testjsonp", title: "JSONP", minLv: 0, public: true },
+  { route: "testkdd/testlv1", title: "\u6743\u9650\u6F14\u793A\xB7\u64CD\u4F5C\u5458", minLv: 3 },
+  { route: "testkdd/testlv2", title: "\u6743\u9650\u6F14\u793A\xB7\u7BA1\u7406\u5458", minLv: 7 },
+  { route: "testkdd/testlv3", title: "\u6743\u9650\u6F14\u793A\xB7\u5F00\u53D1\u8005", minLv: 9 },
+  { route: "testkdd/testlog", title: "IEC62443 \u65E5\u5FD7", minLv: 3 },
+  { route: "user/manage", title: "\u7528\u6237\u7BA1\u7406", minLv: 7 }
+];
+var LEGACY_RIGHTS_MIN_LV = {
+  lv0: 0,
+  lv1: 3,
+  lv2: 7,
+  lv3: 9
+};
+function normalizeRouteRight(item) {
+  if (!item || typeof item !== "object") return null;
+  const route = String(item.route || "").trim().replace(/^\/+|\/+$/g, "");
+  if (!route) return null;
+  const minLv = Number(item.minLv ?? 0);
+  return {
+    route,
+    title: item.title ? String(item.title).trim().slice(0, 128) : void 0,
+    minLv: Number.isFinite(minLv) ? Math.max(0, Math.floor(minLv)) : 0,
+    public: !!item.public || minLv === 0
+  };
+}
+__name(normalizeRouteRight, "normalizeRouteRight");
+function mergeRouteRights(existing, incoming) {
+  const map = /* @__PURE__ */ new Map();
+  for (const r of existing) map.set(r.route, { ...r });
+  for (const r of incoming) {
+    const prev = map.get(r.route);
+    map.set(r.route, prev ? { ...prev, ...r, route: r.route } : r);
+  }
+  return [...map.values()].sort((a, b) => a.route.localeCompare(b.route));
+}
+__name(mergeRouteRights, "mergeRouteRights");
+function routesFromLegacyRights(rights, titles) {
+  const out = [];
+  if (!rights || typeof rights !== "object") return out;
+  for (const [bucket, routes] of Object.entries(rights)) {
+    if (!Array.isArray(routes)) continue;
+    const minLv = LEGACY_RIGHTS_MIN_LV[bucket] ?? 0;
+    for (const route of routes) {
+      const r = String(route || "").trim();
+      if (!r) continue;
+      out.push({
+        route: r,
+        title: titles?.[r],
+        minLv,
+        public: minLv === 0
+      });
+    }
+  }
+  return out;
+}
+__name(routesFromLegacyRights, "routesFromLegacyRights");
+
+// src/sysserver/api/login/service/user-level-config.ts
+var DEFAULT_LEVELS = [
+  { lv: 0, key: "guest", name: "\u666E\u901A\u7528\u6237", nameEn: "Guest" },
+  { lv: 3, key: "operator", name: "\u64CD\u4F5C\u5458", nameEn: "Operator" },
+  { lv: 5, key: "engineer", name: "\u5DE5\u7A0B\u5E08", nameEn: "Engineer" },
+  { lv: 7, key: "admin", name: "\u7BA1\u7406\u5458", nameEn: "Administrator" },
+  { lv: 9, key: "developer", name: "\u5F00\u53D1\u8005", nameEn: "Developer" },
+  { lv: 99, key: "superadmin", name: "\u8D85\u7EA7\u7BA1\u7406\u5458", nameEn: "Super Administrator" }
+];
+var DEFAULT_THRESHOLDS = {
+  logRead: 3,
+  adminRead: 7,
+  adminWrite: 9
+};
+var META_FILE = "_meta/user-levels.json";
+function configPath($asai) {
+  const dir = String(getUserStoreConfig($asai).opt?.dir || "webdata/webdb/users/");
+  return path.resolve(dir, META_FILE);
+}
+__name(configPath, "configPath");
+function fromHostLevels($asai) {
+  const raw = $asai?.hostconfig?.security?.userLevels;
+  if (!Array.isArray(raw) || !raw.length) return null;
+  const levels = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") continue;
+    const lv = Number(item.lv);
+    const key = String(item.key || "").trim();
+    const name = String(item.name || item.label || "").trim();
+    if (!Number.isFinite(lv) || !key || !name) continue;
+    levels.push({
+      lv,
+      key,
+      name,
+      nameEn: item.nameEn ? String(item.nameEn) : void 0
+    });
+  }
+  return levels.length ? levels.sort((a, b) => a.lv - b.lv) : null;
+}
+__name(fromHostLevels, "fromHostLevels");
+function fromHostThresholds($asai) {
+  const t = $asai?.hostconfig?.security?.permissionThresholds;
+  if (!t || typeof t !== "object") return { ...DEFAULT_THRESHOLDS };
+  return {
+    logRead: Number(t.logRead ?? DEFAULT_THRESHOLDS.logRead),
+    adminRead: Number(t.adminRead ?? DEFAULT_THRESHOLDS.adminRead),
+    adminWrite: Number(t.adminWrite ?? DEFAULT_THRESHOLDS.adminWrite)
+  };
+}
+__name(fromHostThresholds, "fromHostThresholds");
+function getDefaultRouteRights($asai) {
+  const fromHost = $asai?.hostconfig?.security?.routeRights;
+  let base = DEFAULT_ROUTE_RIGHTS.map((r) => ({ ...r }));
+  if (Array.isArray(fromHost) && fromHost.length) {
+    const parsed = [];
+    for (const item of fromHost) {
+      const row = normalizeRouteRight(item);
+      if (row) parsed.push(row);
+    }
+    if (parsed.length) base = mergeRouteRights(base, parsed);
+  }
+  const legacy = $asai?.hostconfig?.security?.routerRights;
+  if (legacy && typeof legacy === "object") {
+    base = mergeRouteRights(base, routesFromLegacyRights(legacy));
+  }
+  return base;
+}
+__name(getDefaultRouteRights, "getDefaultRouteRights");
+function getDefaultUserLevelConfig($asai) {
+  return {
+    levels: fromHostLevels($asai) || DEFAULT_LEVELS.map((l) => ({ ...l })),
+    thresholds: fromHostThresholds($asai),
+    routeRights: getDefaultRouteRights($asai)
+  };
+}
+__name(getDefaultUserLevelConfig, "getDefaultUserLevelConfig");
+function normalizeLevel(item) {
+  if (!item || typeof item !== "object") return null;
+  const lv = Number(item.lv);
+  const key = String(item.key || "").trim().slice(0, 32);
+  const name = String(item.name || "").trim().slice(0, 64);
+  if (!Number.isFinite(lv) || lv < 0 || !key || !name) return null;
+  return {
+    lv: Math.floor(lv),
+    key,
+    name,
+    nameEn: item.nameEn ? String(item.nameEn).trim().slice(0, 64) : void 0
+  };
+}
+__name(normalizeLevel, "normalizeLevel");
+function normalizeUserLevelConfig(input, $asai) {
+  const base = getDefaultUserLevelConfig($asai);
+  const synced = getUserLevelConfigSync($asai);
+  const levelBase = synced.levels?.length ? synced : base;
+  const levels = [];
+  const seenLv = /* @__PURE__ */ new Set();
+  const seenKey = /* @__PURE__ */ new Set();
+  if (Array.isArray(input.levels) && input.levels.length) {
+    for (const raw of input.levels) {
+      const row = normalizeLevel(raw);
+      if (!row || seenLv.has(row.lv) || seenKey.has(row.key)) continue;
+      seenLv.add(row.lv);
+      seenKey.add(row.key);
+      levels.push(row);
+    }
+  } else {
+    levels.push(...levelBase.levels.map((l) => ({ ...l })));
+  }
+  if (!levels.some((l) => l.lv === 0)) {
+    levels.unshift({ lv: 0, key: "guest", name: "\u666E\u901A\u7528\u6237", nameEn: "Guest" });
+  }
+  levels.sort((a, b) => a.lv - b.lv);
+  const th = input.thresholds || {};
+  const thresholds = {
+    logRead: Number.isFinite(Number(th.logRead)) ? Number(th.logRead) : base.thresholds.logRead,
+    adminRead: Number.isFinite(Number(th.adminRead)) ? Number(th.adminRead) : base.thresholds.adminRead,
+    adminWrite: Number.isFinite(Number(th.adminWrite)) ? Number(th.adminWrite) : base.thresholds.adminWrite
+  };
+  return {
+    levels,
+    thresholds,
+    routeRights: normalizeRouteRightsList(input.routeRights, base.routeRights || getDefaultRouteRights($asai)),
+    updatedAt: input.updatedAt,
+    updatedBy: input.updatedBy
+  };
+}
+__name(normalizeUserLevelConfig, "normalizeUserLevelConfig");
+function normalizeRouteRightsList(raw, fallback) {
+  if (!Array.isArray(raw) || !raw.length) return fallback.map((r) => ({ ...r }));
+  const parsed = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    const row = normalizeRouteRight(item);
+    if (!row || seen.has(row.route)) continue;
+    seen.add(row.route);
+    parsed.push(row);
+  }
+  return parsed.length ? parsed : fallback.map((r) => ({ ...r }));
+}
+__name(normalizeRouteRightsList, "normalizeRouteRightsList");
+function validateUserLevelConfig(cfg) {
+  if (!cfg.levels.length) return "LEVELS_EMPTY";
+  const keys = /* @__PURE__ */ new Set();
+  const lvs = /* @__PURE__ */ new Set();
+  for (const l of cfg.levels) {
+    if (keys.has(l.key) || lvs.has(l.lv)) return "LEVELS_DUPLICATE";
+    keys.add(l.key);
+    lvs.add(l.lv);
+  }
+  if (!lvs.has(0)) return "LEVELS_GUEST_REQUIRED";
+  const { thresholds } = cfg;
+  if (thresholds.logRead > thresholds.adminRead) return "THRESHOLD_ORDER";
+  if (thresholds.adminRead > thresholds.adminWrite) return "THRESHOLD_ORDER";
+  for (const r of cfg.routeRights || []) {
+    if (!r.route) return "ROUTE_INVALID";
+    if (!Number.isFinite(r.minLv) || r.minLv < 0) return "ROUTE_MINLV_INVALID";
+  }
+  return null;
+}
+__name(validateUserLevelConfig, "validateUserLevelConfig");
+function getUserLevelConfigSync($asai) {
+  return $asai._userLevelConfig || getDefaultUserLevelConfig($asai);
+}
+__name(getUserLevelConfigSync, "getUserLevelConfigSync");
+async function loadUserLevelConfig($asai) {
+  const file = configPath($asai);
+  try {
+    const text = await fs.readFile(file, "utf8");
+    const parsed = JSON.parse(text);
+    const cfg = normalizeUserLevelConfig(parsed, $asai);
+    const err = validateUserLevelConfig(cfg);
+    if (err) {
+      $asai._userLevelConfig = getDefaultUserLevelConfig($asai);
+    } else {
+      $asai._userLevelConfig = cfg;
+    }
+  } catch {
+    $asai._userLevelConfig = getDefaultUserLevelConfig($asai);
+  }
+  return $asai._userLevelConfig;
+}
+__name(loadUserLevelConfig, "loadUserLevelConfig");
+async function saveUserLevelConfig($asai, input, updatedBy) {
+  const cfg = normalizeUserLevelConfig(input, $asai);
+  const err = validateUserLevelConfig(cfg);
+  if (err) throw new Error(err);
+  cfg.updatedAt = Date.now();
+  cfg.updatedBy = updatedBy;
+  const file = configPath($asai);
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  await fs.writeFile(file, JSON.stringify(cfg, null, 2), "utf8");
+  $asai._userLevelConfig = cfg;
+  return cfg;
+}
+__name(saveUserLevelConfig, "saveUserLevelConfig");
+function getPermissionThreshold($asai, key) {
+  return getUserLevelConfigSync($asai).thresholds[key];
+}
+__name(getPermissionThreshold, "getPermissionThreshold");
+function getLevelDef($asai, lv) {
+  return getUserLevelConfigSync($asai).levels.find((l) => l.lv === lv);
+}
+__name(getLevelDef, "getLevelDef");
+function isValidUserLv($asai, lv) {
+  return getUserLevelConfigSync($asai).levels.some((l) => l.lv === lv);
+}
+__name(isValidUserLv, "isValidUserLv");
+function getLevelLabel($asai, lv, lang = "zh-CN") {
+  const def = getLevelDef($asai, lv);
+  if (!def) return `lv${lv}`;
+  if (lang.startsWith("en") && def.nameEn) return def.nameEn;
+  return def.name;
+}
+__name(getLevelLabel, "getLevelLabel");
+function toPublicUserLevels($asai, lang = "zh-CN") {
+  const cfg = getUserLevelConfigSync($asai);
+  return {
+    levels: cfg.levels.map((l) => ({
+      lv: l.lv,
+      key: l.key,
+      name: getLevelLabel($asai, l.lv, lang),
+      nameZh: l.name,
+      nameEn: l.nameEn || l.name
+    })),
+    thresholds: { ...cfg.thresholds },
+    routeRights: (cfg.routeRights || getDefaultRouteRights($asai)).map((r) => ({ ...r }))
+  };
+}
+__name(toPublicUserLevels, "toPublicUserLevels");
+
+// src/infra/security-policy.ts
+var DEFAULT_POLICY = {
+  minLength: 8,
+  requireUpper: false,
+  requireLower: true,
+  requireDigit: true,
+  requireSpecial: false,
+  maxAgeDays: 0,
+  historyCount: 0
+};
+var DEFAULT_ROLES = [
+  { name: "viewer", minLv: 0, permissions: ["read"] },
+  { name: "operator", minLv: 3, permissions: ["read", "operate"] },
+  { name: "engineer", minLv: 5, permissions: ["read", "operate", "audit"] },
+  { name: "admin", minLv: 7, permissions: ["read", "operate", "audit", "admin"] },
+  { name: "developer", minLv: 9, permissions: ["read", "operate", "audit", "admin", "develop"] },
+  { name: "superadmin", minLv: 99, permissions: ["read", "operate", "audit", "admin", "develop", "super"] }
+];
+function getSecurityBlock($asai) {
+  return $asai?.hostconfig?.security || {};
+}
+__name(getSecurityBlock, "getSecurityBlock");
+function getLoginBanner($asai) {
+  const sec = getSecurityBlock($asai);
+  const banner = sec.banner || {};
+  return {
+    enabled: banner.enabled === 1 || banner.enabled === true,
+    text: String(banner.text || "")
+  };
+}
+__name(getLoginBanner, "getLoginBanner");
+function getPasswordPolicy($asai) {
+  const sec = getSecurityBlock($asai);
+  const p = sec.passwordPolicy || {};
+  const minFromLegacy = Number(sec.passwordMinLength ?? DEFAULT_POLICY.minLength);
+  return {
+    minLength: Number(p.minLength ?? minFromLegacy) || DEFAULT_POLICY.minLength,
+    requireUpper: p.requireUpper === 1 || p.requireUpper === true,
+    requireLower: p.requireLower !== 0 && p.requireLower !== false,
+    requireDigit: p.requireDigit !== 0 && p.requireDigit !== false,
+    requireSpecial: p.requireSpecial === 1 || p.requireSpecial === true,
+    maxAgeDays: Number(p.maxAgeDays ?? 0) || 0,
+    historyCount: Number(p.historyCount ?? 0) || 0
+  };
+}
+__name(getPasswordPolicy, "getPasswordPolicy");
+function getSessionIdleMinutes($asai) {
+  const sec = getSecurityBlock($asai);
+  const v = sec.sessionIdleMinutes;
+  return v == null || v === 0 ? 0 : Number(v);
+}
+__name(getSessionIdleMinutes, "getSessionIdleMinutes");
+function getRoleDefinitions($asai) {
+  const sec = getSecurityBlock($asai);
+  const raw = sec.roles;
+  if (!Array.isArray(raw) || !raw.length) return DEFAULT_ROLES;
+  return raw.map((r) => ({
+    name: String(r.name || "role"),
+    minLv: Number(r.minLv ?? 0),
+    permissions: Array.isArray(r.permissions) ? r.permissions.map(String) : []
+  }));
+}
+__name(getRoleDefinitions, "getRoleDefinitions");
+function resolveRoleForLevel($asai, lv) {
+  const roles = getRoleDefinitions($asai);
+  let best = roles[0];
+  for (const r of roles) {
+    if (lv >= r.minLv && r.minLv >= (best?.minLv ?? -1)) best = r;
+  }
+  return best || DEFAULT_ROLES[0];
+}
+__name(resolveRoleForLevel, "resolveRoleForLevel");
+function hashPasswordForHistory(password) {
+  return createHash("sha256").update(password).digest("hex");
+}
+__name(hashPasswordForHistory, "hashPasswordForHistory");
+function validatePasswordWithPolicy(password, policy) {
+  if (!password || typeof password !== "string") return "PASSWORD_REQUIRED";
+  if (password.length < policy.minLength) return "PASSWORD_TOO_SHORT";
+  if (policy.requireLower && !/[a-z]/.test(password)) return "PASSWORD_WEAK";
+  if (policy.requireUpper && !/[A-Z]/.test(password)) return "PASSWORD_WEAK";
+  if (policy.requireDigit && !/[0-9]/.test(password)) return "PASSWORD_WEAK";
+  if (policy.requireSpecial && !/[^a-zA-Z0-9]/.test(password)) return "PASSWORD_WEAK";
+  return null;
+}
+__name(validatePasswordWithPolicy, "validatePasswordWithPolicy");
+function parsePassHistory(raw) {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw.map(String);
+  if (typeof raw === "string" && raw.startsWith("[")) {
+    try {
+      const arr = JSON.parse(raw);
+      return Array.isArray(arr) ? arr.map(String) : [];
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+__name(parsePassHistory, "parsePassHistory");
+function isPasswordInHistory(password, history) {
+  const h = hashPasswordForHistory(password);
+  return history.includes(h);
+}
+__name(isPasswordInHistory, "isPasswordInHistory");
+function isPasswordExpired(passwordChangedAt, maxAgeDays) {
+  if (!maxAgeDays || maxAgeDays <= 0) return false;
+  if (!passwordChangedAt) return false;
+  return Date.now() - passwordChangedAt > maxAgeDays * 864e5;
+}
+__name(isPasswordExpired, "isPasswordExpired");
+function getPublicSecurityConfig($asai, lang = "zh-CN") {
+  const policy = getPasswordPolicy($asai);
+  const banner = getLoginBanner($asai);
+  return {
+    banner,
+    passwordPolicy: {
+      minLength: policy.minLength,
+      requireUpper: policy.requireUpper,
+      requireLower: policy.requireLower,
+      requireDigit: policy.requireDigit,
+      requireSpecial: policy.requireSpecial
+    },
+    sessionIdleMinutes: getSessionIdleMinutes($asai),
+    roles: getRoleDefinitions($asai).map((r) => ({ name: r.name, minLv: r.minLv })),
+    userLevels: toPublicUserLevels($asai, lang),
+    allowRegister: getSecurityBlock($asai).allowRegister !== 0
+  };
+}
+__name(getPublicSecurityConfig, "getPublicSecurityConfig");
+
+export {
+  dbListUsers,
+  dbFindUser,
+  dbCreateUser,
+  dbUpdateUser,
+  dbListSessions,
+  dbWriteSessions,
+  dbAddSession,
+  dbRemoveSession,
+  dbRemoveSessionsByUser,
+  dbDeleteUser,
+  getUserLevelConfigSync,
+  loadUserLevelConfig,
+  saveUserLevelConfig,
+  getPermissionThreshold,
+  isValidUserLv,
+  getPasswordPolicy,
+  resolveRoleForLevel,
+  hashPasswordForHistory,
+  validatePasswordWithPolicy,
+  parsePassHistory,
+  isPasswordInHistory,
+  isPasswordExpired,
+  getPublicSecurityConfig
+};
+//# sourceMappingURL=chunk-EOGZPRML.es.js.map