create-lumal-admin 0.0.4-beta → 0.0.6-beta

package/templates/modes/http/tests/http.test.ts.template

@@ -0,0 +1,218 @@
+// @vitest-environment node
+import type { AddressInfo } from 'node:net';
+import { createServer } from 'node:http';
+import { setTimeout as delay } from 'node:timers/promises';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { createHttpBackend } from '../src/app/services/data-source';
+import { createApplicationSession } from '../src/app/services/session-runtime';
+
+const tokens = new Map<string, string>();
+const refreshTokens = new Map<string, string>();
+const expired = new Set<string>();
+const calls = new Map<string, number>();
+let failRefresh = false;
+let failLogout = false;
+let failAccess = false;
+let menuPayload: unknown;
+let baseURL = '';
+const server = createServer(async (request, response) => {
+  const path = new URL(request.url!, 'http://localhost').pathname;
+  calls.set(path, (calls.get(path) ?? 0) + 1);
+  let body = '';
+  for await (const part of request) body += String(part);
+  const input = body ? (JSON.parse(body) as Record<string, string>) : {};
+  const token = request.headers.authorization?.replace('Bearer ', '') ?? '';
+  function send(data: unknown, status = 200) {
+    response.writeHead(status, { 'content-type': 'application/json' });
+    response.end(JSON.stringify(data));
+  }
+  function issue(username: string) {
+    const accessToken = crypto.randomUUID();
+    const refreshToken = crypto.randomUUID();
+    tokens.set(accessToken, username);
+    refreshTokens.set(refreshToken, username);
+    return { accessToken, refreshToken };
+  }
+  if (path === '/auth/login') {
+    if (input.password !== 'valid') return send({ message: '登录失败' }, 401);
+    return send(issue(input.username!));
+  }
+  if (path === '/auth/refresh') {
+    await delay(40);
+    const username = refreshTokens.get(input.refreshToken!);
+    return !failRefresh && username ? send(issue(username)) : send({ message: '刷新失败' }, 401);
+  }
+  const username = tokens.get(token);
+  if (!username || expired.has(token)) return send({ message: '已过期' }, 401);
+  if (path === '/session/me') return send({ id: username, name: username, username });
+  if (path === '/session/access')
+    return failAccess
+      ? send({ message: '权限读取失败' }, 503)
+      : send({ roles: [username], permissions: [`${username}:read`] });
+  if (path === '/menus')
+    return send(
+      menuPayload ?? [{ path: '/deep', name: 'Deep', component: 'dashboard/index', meta: { title: username } }],
+    );
+  if (path === '/auth/logout') {
+    tokens.delete(token);
+    return send({}, failLogout ? 503 : 200);
+  }
+  if (path.startsWith('/system/')) return send({ items: [{ id: '1', owner: username }], total: 1 });
+  send({}, 404);
+});
+beforeAll(async () => {
+  await new Promise<void>((done) => server.listen(0, '127.0.0.1', done));
+  baseURL = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+});
+beforeEach(() => {
+  calls.clear();
+  tokens.clear();
+  refreshTokens.clear();
+  expired.clear();
+  failRefresh = false;
+  failLogout = false;
+  failAccess = false;
+  menuPayload = undefined;
+});
+afterAll(async () => {
+  server.closeAllConnections();
+  await new Promise<void>((done, reject) => server.close((error) => (error ? reject(error) : done())));
+});
+function memoryStorage(): Storage {
+  const values = new Map<string, string>();
+  return {
+    getItem: (key) => values.get(key) ?? null,
+    setItem: (key, value) => {
+      values.set(key, value);
+    },
+    removeItem: (key) => {
+      values.delete(key);
+    },
+    clear: () => values.clear(),
+    key: (index) => [...values.keys()][index] ?? null,
+    get length() {
+      return values.size;
+    },
+  };
+}
+function application(url = baseURL) {
+  const storage = memoryStorage();
+  return createApplicationSession((context) => createHttpBackend(context, url), storage, storage);
+}
+describe('真实 HTTP 应用服务', () => {
+  it('权限重读失败清理旧授权，保留凭据以供显式重试且并发刷新单飞', async () => {
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    const token = app.session.getToken();
+    failAccess = true;
+    const failed = app.refreshAccess();
+    expect(app.refreshAccess()).toBe(failed);
+    await expect(failed).rejects.toThrow('权限读取失败');
+    expect(app.permissionStore.permissions).toEqual([]);
+    expect(app.menus.value).toEqual([]);
+    expect(app.ready.value).toBe(false);
+    expect(app.session.getToken()).toBe(token);
+    failAccess = false;
+    await app.refreshAccess();
+    expect(app.ready.value).toBe(true);
+    expect(app.permissionStore.permissions).toEqual(['alice:read']);
+  });
+  it.each([
+    { component: 'constructor' },
+    { component: '__proto__' },
+    { component: 'not-registered' },
+    { meta: { externalLink: 'javascript:alert(1)' } },
+    { meta: { externalLink: '//evil.invalid' } },
+    { meta: { authority: [7] } },
+  ])('真实 HTTP 下发的恶意子菜单拒绝初始化 %j', async (invalid) => {
+    menuPayload = [
+      {
+        path: '/remote',
+        name: 'Remote',
+        children: [{ path: '/remote/page', name: 'RemotePage', component: 'dashboard/index', ...invalid }],
+      },
+    ];
+    const app = application();
+    await expect(app.login({ username: 'alice', password: 'valid' })).rejects.toThrow();
+    expect(app.ready.value).toBe(false);
+    expect(app.menus.value).toEqual([]);
+    expect(app.isAuthenticated()).toBe(false);
+  });
+  it('配置缺失明确失败，不产生演示会话', async () => {
+    const app = application('');
+    await expect(app.login({ username: 'alice', password: 'valid' })).rejects.toThrow('VITE_API_BASE_URL');
+    expect(app.isAuthenticated()).toBe(false);
+    expect(calls.size).toBe(0);
+  });
+  it('登录失败、成功、用户权限菜单与真实 CRUD 请求', async () => {
+    const app = application();
+    await expect(app.login({ username: 'alice', password: 'wrong' })).rejects.toThrow('登录失败');
+    expect(app.currentUser.value).toBeNull();
+    await app.login({ username: 'alice', password: 'valid' });
+    expect(app.ready.value).toBe(true);
+    expect(app.currentUser.value?.username).toBe('alice');
+    expect(app.permissionStore.permissions).toEqual(['alice:read']);
+    expect(app.permissionStore.roles).toEqual(['alice']);
+    expect(app.menus.value[0]?.path).toBe('/deep');
+    expect(await app.service.list('users', { page: 1, pageSize: 10, query: {} })).toEqual({
+      items: [{ id: '1', owner: 'alice' }],
+      total: 1,
+    });
+    await Promise.all([app.initialize(), app.initialize()]);
+    expect(calls.get('/session/me')).toBe(1);
+  });
+  it('401 并发请求只刷新一次，重放使用新凭据', async () => {
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    expired.add(app.session.getToken()!);
+    const signal = new AbortController().signal;
+    const [user, access, menus] = await Promise.all([
+      app.service.getUser(signal),
+      app.service.getAccess(signal),
+      app.service.getMenus(signal),
+    ]);
+    expect(user.username).toBe('alice');
+    expect(access.permissions).toEqual(['alice:read']);
+    expect(menus[0]?.path).toBe('/deep');
+    expect(calls.get('/auth/refresh')).toBe(1);
+    expect(calls.get('/session/me')).toBe(3);
+  });
+  it('刷新失败清理凭据、权限、菜单、标签和动态状态回调', async () => {
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    let resets = 0;
+    app.onReset(() => {
+      resets += 1;
+    });
+    expired.add(app.session.getToken()!);
+    failRefresh = true;
+    await expect(app.service.getUser(new AbortController().signal)).rejects.toThrow();
+    expect(app.isAuthenticated()).toBe(false);
+    expect(app.currentUser.value).toBeNull();
+    expect(app.menus.value).toEqual([]);
+    expect(app.permissionStore.permissions).toEqual([]);
+    expect(resets).toBe(1);
+  });
+  it('退出接口失败不保留本地身份', async () => {
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    failLogout = true;
+    await expect(app.logout()).rejects.toThrow();
+    expect(app.isAuthenticated()).toBe(false);
+    expect(app.permissionStore.roles).toEqual([]);
+    expect(calls.get('/auth/logout')).toBe(1);
+  });
+  it('刷新在途时切换账号，旧响应不能污染新用户', async () => {
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    expired.add(app.session.getToken()!);
+    const old = app.service.getUser(new AbortController().signal).catch((error) => error);
+    while (!calls.get('/auth/refresh')) await delay(1);
+    await app.login({ username: 'bob', password: 'valid' });
+    await old;
+    await delay(50);
+    expect(app.currentUser.value?.username).toBe('bob');
+    expect(app.permissionStore.permissions).toEqual(['bob:read']);
+    expect(app.ready.value).toBe(true);
+  });
+});

package/templates/modes/local/src/app/services/data-source.ts

@@ -0,0 +1,113 @@
+import type {
+  AccessSnapshot,
+  ApplicationService,
+  BusinessRequest,
+  CurrentUser,
+  DataRow,
+  HttpMethod,
+  ServiceContext,
+} from './contracts';
+import type { LocalModule } from './local-contracts';
+import { object, stringArray } from '../menu-policy';
+import { permissionCodes, viewComponents } from '../router/views';
+import { buildStoredMenus } from '../stored-menus';
+import { createLocalDatabase } from './local-database';
+
+export const demoAccount = import.meta.env.DEV ? { username: 'admin', password: 'lumal123' } : null;
+const localModules = import.meta.glob<LocalModule>(['../../modules/*/local.ts', '../../modules/business/*/local.ts']);
+
+export function createBackend(context: ServiceContext): ApplicationService {
+  const db = createLocalDatabase();
+  let ownedToken = '';
+  let handlers: Promise<ReturnType<LocalModule['createLocalHandler']>[]> | undefined;
+  function assertDemo(): void {
+    if (import.meta.env.PROD && import.meta.env.VITE_ENABLE_LOCAL_DEMO !== 'true')
+      throw new Error('生产环境已禁用本地演示，请使用 HTTP 模式或显式启用演示');
+    context.getSignal().throwIfAborted();
+  }
+  function account(): DataRow {
+    assertDemo();
+    const token = context.getSession()?.accessToken ?? '';
+    const raw = sessionStorage.getItem(`demo:${token}`);
+    if (!raw) throw new Error('本地演示会话已失效');
+    const identity = object(JSON.parse(raw));
+    const user = db.read('users').find((row) => row.id === identity.id);
+    if (!user || user.status !== 'enabled') throw new Error('本地账号已停用或删除，请重新登录');
+    ownedToken = token;
+    return user;
+  }
+  function user(): CurrentUser {
+    const current = account();
+    return { id: String(current.id), username: String(current.username), name: String(current.nickname) };
+  }
+  function access(): AccessSnapshot {
+    const current = account();
+    const assigned = stringArray(current.roles);
+    const roles = db.read('roles').filter((row) => assigned.includes(String(row.code)) && row.status === 'enabled');
+    return {
+      roles: roles.map((row) => String(row.code)),
+      permissions: [...new Set(roles.flatMap((row) => stringArray(row.permissions)))].filter((code) =>
+        permissionCodes.includes(code),
+      ),
+    };
+  }
+  function assertPermission(code: string): void {
+    if (!access().permissions.includes(code)) throw new Error(`无操作权限：${code}`);
+  }
+  async function businessRequest<T>(method: HttpMethod, path: string, input: BusinessRequest = {}): Promise<T> {
+    user();
+    const signal = context.getSignal();
+    handlers ??= Promise.all(
+      Object.values(localModules).map(async (load) =>
+        (await load()).createLocalHandler({ db, user, assertPermission }),
+      ),
+    );
+    const handler = (await handlers).find((item) => item.handles(path));
+    signal.throwIfAborted();
+    if (handler) return (await handler.request(method, path, input)) as T;
+    throw new Error(`本地数据源不支持此业务接口：${method} ${path}`);
+  }
+  return {
+    request: businessRequest,
+    async login(input, signal) {
+      assertDemo();
+      signal.throwIfAborted();
+      const found = db.read('users').find((row) => row.username === input.username);
+      if (!found || found.status !== 'enabled' || input.password !== found.password)
+        throw new Error('账号或密码不正确');
+      ownedToken = crypto.randomUUID();
+      sessionStorage.setItem(`demo:${ownedToken}`, JSON.stringify({ id: found.id }));
+      return { accessToken: ownedToken };
+    },
+    getUser: async (signal) => {
+      signal.throwIfAborted();
+      return user();
+    },
+    getAccess: async (signal) => {
+      signal.throwIfAborted();
+      return access();
+    },
+    getMenus: async (signal) => {
+      signal.throwIfAborted();
+      user();
+      return buildStoredMenus(db.read('menus'), viewComponents);
+    },
+    logout: async (token) => {
+      sessionStorage.removeItem(`demo:${token}`);
+    },
+    clearCache() {
+      if (ownedToken) sessionStorage.removeItem(`demo:${ownedToken}`);
+      ownedToken = '';
+      handlers = undefined;
+    },
+    list: (resource, input) =>
+      businessRequest('GET', `/system/${resource}`, {
+        query: { page: input.page, pageSize: input.pageSize, ...input.query } as BusinessRequest['query'],
+      }),
+    save: (resource, model, id) =>
+      businessRequest(id ? 'PUT' : 'POST', `/system/${resource}${id ? `/${encodeURIComponent(id)}` : ''}`, {
+        body: model,
+      }),
+    remove: (resource, id) => businessRequest('DELETE', `/system/${resource}/${encodeURIComponent(id)}`),
+  };
+}

package/templates/modes/local/src/app/services/local-database.ts

@@ -0,0 +1,67 @@
+import type { DataRow } from './contracts';
+import type { LocalDatabase } from './local-contracts';
+import { localMenus, permissionCodes } from '../router/views';
+import { seedMenuRows } from '../stored-menus';
+
+// 仅开发用途。存储和校验不能替代生产后端的认证、授权与密码散列。
+export function createLocalDatabase(): LocalDatabase {
+  const initial: Record<string, DataRow[]> = {
+    users: [
+      {
+        id: 'admin',
+        username: 'admin',
+        nickname: '管理员',
+        organizationId: 'root',
+        roles: ['admin'],
+        status: 'enabled',
+        phone: '',
+        createdAt: '',
+        password: 'lumal123',
+      },
+      {
+        id: 'guest',
+        username: 'guest',
+        nickname: '访客',
+        organizationId: 'root',
+        roles: ['guest'],
+        status: 'enabled',
+        phone: '',
+        createdAt: '',
+        password: 'lumal123',
+      },
+    ],
+    roles: [
+      {
+        id: 'admin',
+        code: 'admin',
+        name: '管理员',
+        description: '内置管理员',
+        builtIn: true,
+        status: 'enabled',
+        permissions: permissionCodes,
+      },
+      {
+        id: 'guest',
+        code: 'guest',
+        name: '访客',
+        description: '默认访客',
+        builtIn: true,
+        status: 'enabled',
+        permissions: [],
+      },
+    ],
+    menus: seedMenuRows(localMenus),
+  };
+  return {
+    read<T extends DataRow>(resource: string, fallback?: () => T[]): T[] {
+      const raw = localStorage.getItem(`demo:system:${resource}`);
+      const value: unknown = raw ? JSON.parse(raw) : structuredClone(initial[resource] ?? fallback?.() ?? []);
+      if (!Array.isArray(value) || value.some((row) => !row || typeof row !== 'object' || Array.isArray(row)))
+        throw new Error(`本地演示数据损坏：${resource}`);
+      return value as T[];
+    },
+    write(resource, rows) {
+      localStorage.setItem(`demo:system:${resource}`, JSON.stringify(rows));
+    },
+  };
+}

package/templates/modes/local/tests/local.test.ts.template

@@ -0,0 +1,132 @@
+import type { LumalMenuRecord } from '@lumal/core/router';
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { localMenus } from '../src/app/router/views';
+import { createBackend } from '../src/app/services/data-source';
+import { createApplicationSession } from '../src/app/services/session-runtime';
+
+function storage(): Storage {
+  const values = new Map<string, string>();
+  return {
+    getItem: (key) => values.get(key) ?? null,
+    setItem: (key, value) => {
+      values.set(key, value);
+    },
+    removeItem: (key) => {
+      values.delete(key);
+    },
+    clear: () => values.clear(),
+    key: (index) => [...values.keys()][index] ?? null,
+    get length() {
+      return values.size;
+    },
+  };
+}
+beforeEach(() => {
+  vi.unstubAllEnvs();
+  vi.stubGlobal('localStorage', storage());
+  vi.stubGlobal('sessionStorage', storage());
+});
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.unstubAllEnvs();
+});
+function application() {
+  return createApplicationSession(createBackend, localStorage, sessionStorage);
+}
+describe('本地应用服务', () => {
+  it('认证、动态菜单和重新初始化使用同一服务契约', async () => {
+    const app = application();
+    await expect(app.login({ username: 'admin', password: 'wrong' })).rejects.toThrow('账号或密码');
+    await app.login({ username: 'admin', password: 'lumal123' });
+    expect(app.currentUser.value?.username).toBe('admin');
+    expect(app.menus.value.some((menu) => menu.path === '/dashboard')).toBe(true);
+    const token = app.session.getToken();
+    const restored = application();
+    await restored.initialize();
+    expect(restored.session.getToken()).toBe(token);
+    expect(restored.ready.value).toBe(true);
+    await restored.logout();
+    expect(sessionStorage.getItem(`demo:${token}`)).toBeNull();
+    expect(restored.permissionStore.roles).toEqual([]);
+  });
+  it('生产默认拒绝演示账号，显式启用仅用于演示站点', async () => {
+    vi.stubEnv('PROD', true);
+    vi.stubEnv('VITE_ENABLE_LOCAL_DEMO', '');
+    await expect(application().login({ username: 'admin', password: 'lumal123' })).rejects.toThrow('生产环境');
+    vi.stubEnv('VITE_ENABLE_LOCAL_DEMO', 'true');
+    await expect(application().login({ username: 'admin', password: 'lumal123' })).resolves.toBeUndefined();
+  });
+  it('管理能力按预设启用，访客无写权限', async () => {
+    const app = application();
+    await app.login({ username: 'admin', password: 'lumal123' });
+    const flatten = (menus: LumalMenuRecord[]): LumalMenuRecord[] =>
+      menus.flatMap((menu) => [menu, ...flatten(menu.children ?? [])]);
+    if (flatten(localMenus).some((menu) => menu.component === 'system/users')) {
+      await app.service.save('users', { username: 'new-user', nickname: '新增', roles: ['guest'], status: 'enabled' });
+      const result = await app.service.list('users', { page: 1, pageSize: 10, query: { keyword: 'new-user' } });
+      expect(result.total).toBe(1);
+      await app.service.remove('users', String(result.items[0]?.id));
+      await expect(app.service.remove('users', 'admin')).rejects.toThrow('内置管理员');
+      await expect(
+        app.service.save('users', { username: 'admin', nickname: '重复', roles: ['guest'] }),
+      ).rejects.toThrow('重复');
+      await expect(
+        app.service.save('roles', { code: 'admin', name: '管理员', status: 'disabled' }, 'admin'),
+      ).rejects.toThrow('内置角色');
+      await app.service.save('roles', { code: 'reader', name: '只读角色', status: 'enabled' });
+      await app.service.request('PUT', '/system/roles/reader/permissions', {
+        body: { permissions: ['system:user:list'] },
+      });
+      await app.service.save('users', {
+        username: 'reader',
+        nickname: '只读用户',
+        roles: ['reader'],
+        status: 'enabled',
+      });
+      await app.service.save('dictionaries/items', { typeCode: 'status', label: '待审核', value: 'pending' });
+      expect(await app.service.request('GET', '/system/dictionaries/items', { query: { typeCode: 'other' } })).toEqual(
+        [],
+      );
+      await app.service.save('menus', { title: '目录', path: '/group', name: 'Group', type: 'directory' });
+      const group = (await app.service.request<Record<string, unknown>[]>('GET', '/system/menus')).find(
+        (row) => row.name === 'Group',
+      )!;
+      await expect(app.service.save('menus', { ...group, parentId: group.id }, String(group.id))).rejects.toThrow(
+        '循环',
+      );
+      await expect(
+        app.service.save('menus', {
+          title: '恶意',
+          path: '/bad',
+          name: 'Bad',
+          type: 'menu',
+          component: 'https://evil.invalid/a.js',
+        }),
+      ).rejects.toThrow('白名单');
+      await app.login({ username: 'reader', password: 'lumal123' });
+      expect(app.permissionStore.permissions).toEqual(['system:user:list']);
+      await expect(app.service.list('users', { page: 1, pageSize: 10, query: {} })).resolves.toHaveProperty('total');
+      await expect(app.service.save('users', { username: 'denied' })).rejects.toThrow('无操作权限');
+    } else if (flatten(localMenus).some((menu) => menu.component === 'migration/users')) {
+      expect(app.permissionStore.permissions).toContain('system:user:create');
+      await app.service.save('users', {
+        username: 'migration-only',
+        nickname: '迁移用户',
+        roles: ['guest'],
+        status: 'enabled',
+      });
+      const result = await app.service.list('users', { page: 1, pageSize: 10, query: { keyword: 'migration-only' } });
+      expect(result.total).toBe(1);
+      await app.service.remove('users', String(result.items[0]?.id));
+      expect(
+        (await app.service.list('users', { page: 1, pageSize: 10, query: { keyword: 'migration-only' } })).total,
+      ).toBe(0);
+    } else {
+      await expect(app.service.list('users', { page: 1, pageSize: 10, query: {} })).rejects.toThrow('不支持');
+    }
+    await app.login({ username: 'guest', password: 'lumal123' });
+    expect(app.permissionStore.permissions).toEqual([]);
+    await expect(app.service.save('users', { username: 'denied' })).rejects.toThrow();
+  });
+});

package/templates/presets/standard/src/modules/dashboard/DashboardView.vue

@@ -0,0 +1,52 @@
+<script setup lang="ts">
+import { LumalPage } from '@lumal/core/components';
+import { ElEmpty } from 'element-plus';
+import { currentUser } from '../../app/services/session';
+import DashboardSessionStatus from './components/DashboardSessionStatus.vue';
+import DashboardShortcuts from './components/DashboardShortcuts.vue';
+
+/***********************工作台装配*********************/
+const today = new Intl.DateTimeFormat('zh-CN', { dateStyle: 'full' }).format(new Date());
+</script>
+
+<template>
+  <LumalPage class="lumal-admin-page" title="工作台">
+    <header class="dashboard-welcome">
+      <div>
+        <h2>你好，{{ currentUser?.name }}</h2>
+        <p>{{ today }}</p>
+      </div>
+    </header>
+    <DashboardShortcuts />
+    <DashboardSessionStatus />
+    <section class="dashboard-section">
+      <h3>业务动态</h3>
+      <ElEmpty description="暂无业务动态" :image-size="72" />
+    </section>
+  </LumalPage>
+</template>
+
+<style scoped>
+.dashboard-welcome {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 8px 0 24px;
+}
+.dashboard-welcome h2 {
+  margin: 0 0 8px;
+  font-size: 22px;
+}
+.dashboard-welcome p {
+  margin: 0;
+  color: var(--el-text-color-secondary);
+}
+.dashboard-section {
+  padding-top: 24px;
+  border-top: 1px solid var(--el-border-color-lighter);
+}
+.dashboard-section h3 {
+  margin: 0;
+  font-size: 16px;
+}
+</style>

package/templates/presets/standard/src/modules/dashboard/components/DashboardSessionStatus.vue

@@ -0,0 +1,41 @@
+<script setup lang="ts">
+import { ElDescriptions, ElDescriptionsItem, ElTag } from 'element-plus';
+import { appConfig } from '../../../app.config';
+import { permissionStore } from '../../../app/services/session';
+
+/***********************真实应用与会话状态*********************/
+const source = appConfig.apiMode === 'local' ? '本地开发演示' : 'HTTP API';
+</script>
+
+<template>
+  <section class="session-status">
+    <h3>应用状态</h3>
+    <ElDescriptions :column="1" border>
+      <ElDescriptionsItem label="数据源">
+        <ElTag :type="appConfig.apiMode === 'local' ? 'warning' : 'success'">
+          {{ source }}
+        </ElTag>
+      </ElDescriptionsItem>
+      <ElDescriptionsItem label="当前角色">
+        {{ permissionStore.roles.join('、') || '无' }}
+      </ElDescriptionsItem>
+      <ElDescriptionsItem label="可用操作权限">
+        {{ permissionStore.permissions.length }}
+      </ElDescriptionsItem>
+      <ElDescriptionsItem label="启用模块">
+        {{ appConfig.features.join('、') || '无可选模块' }}
+      </ElDescriptionsItem>
+    </ElDescriptions>
+  </section>
+</template>
+
+<style scoped>
+.session-status {
+  padding: 24px 0;
+  border-top: 1px solid var(--el-border-color-lighter);
+}
+.session-status h3 {
+  margin: 0 0 16px;
+  font-size: 16px;
+}
+</style>

package/templates/presets/standard/src/modules/dashboard/components/DashboardShortcuts.vue

@@ -0,0 +1,51 @@
+<script setup lang="ts">
+import type { SidebarMenuItem } from '@lumal/core/router';
+import { LumalIcon } from '@lumal/icons-vue';
+import { ElButton, ElEmpty } from 'element-plus';
+import { computed } from 'vue';
+import { useRouter } from 'vue-router';
+import { createAdminSidebarMenus } from '../../../app/router';
+
+/***********************当前权限下的快捷入口*********************/
+const router = useRouter();
+function flatten(items: SidebarMenuItem[]): SidebarMenuItem[] {
+  return items.flatMap((item) => (item.children?.length ? flatten(item.children) : [item]));
+}
+const shortcuts = computed(() =>
+  flatten(createAdminSidebarMenus())
+    .filter((item) => item.path !== '/dashboard' && !item.externalLink)
+    .slice(0, 6),
+);
+</script>
+
+<template>
+  <section class="dashboard-shortcuts">
+    <h3>常用入口</h3>
+    <div v-if="shortcuts.length" class="shortcut-list">
+      <ElButton v-for="item in shortcuts" :key="item.path" @click="router.push(item.path)">
+        <LumalIcon :name="item.icon || 'lumal:grid'" />{{ item.title }}
+      </ElButton>
+    </div>
+    <ElEmpty v-else description="暂无可用入口" :image-size="48" />
+  </section>
+</template>
+
+<style scoped>
+.dashboard-shortcuts {
+  padding-bottom: 24px;
+}
+.dashboard-shortcuts h3 {
+  margin: 0 0 16px;
+  font-size: 16px;
+}
+.shortcut-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+}
+.shortcut-list :deep(.el-button) {
+  min-height: 40px;
+  margin: 0;
+  gap: 8px;
+}
+</style>