docnest 0.1.10 → 0.1.12

package/README.md

@@ -20,7 +20,7 @@ npx docnest serve
 
 ## 配置
 
-复制 `docnest.config.example.mjs` 为项目根目录的 `docnest.config.mjs`，配置项目自己的标题、目录顺序、存储键前缀和 PDF 水印。
+复制 `docnest.config.example.mjs` 为项目根目录的 `docnest.config.mjs`，配置项目自己的标题、目录顺序、存储键前缀和阅读限制策略。
 
 ### 外观主题
 
@@ -56,7 +56,18 @@ export default defineConfig({
 
 未配置 `appearance` 时使用 `slate-modern + auto`。旧配置中的 `current-docs` 会自动迁移到 `slate-modern`，正文视觉不会发生变化；旧版保存的 `markdown-theme` 明暗偏好也会自动迁移到新的项目级存储键。
 
-水印默认关闭。开启后，PDF 导出弹窗会读取配置文字，并允许本次导出临时修改；临时修改不会写回文件或浏览器存储。
+PDF、页面水印和图表外带能力由一个开关统一控制，默认使用普通阅读模式：
+
+```js
+export default defineConfig({
+  restrictedMode: false,
+})
+```
+
+- `restrictedMode: false`：显示打印和 PDF 导出，允许 Mermaid 图下载与大图查看。导出 PDF 时会弹出本次水印设置，可选择是否添加并自定义文案；默认文案为 `site.title`，不会写回配置。
+- `restrictedMode: true`：隐藏打印和 PDF 导出入口且不加载导出模块；使用 `site.title` 作为固定水印，禁止文字选择、复制、剪切和拖拽，并隐藏 Mermaid 下载与大图查看入口。Mermaid 仍会在正文中正常渲染。
+
+受限模式只移除 DocNest 提供的页面入口和脚本，不承诺对浏览器开发者工具或系统级截图提供绝对防护。
 
 ### 极简单口令授权
 
@@ -77,7 +88,7 @@ export default defineConfig({
 授权只有一道关口，没有账号、密码组合或角色体系。首次启动时，`passphrase` 会初始化到由
 `stateFile` 指定的本地授权状态文件；状态文件只保存带随机盐的口令哈希，不保存明文口令。
 按极简模式约定，前端会把可回填的口令永久保存到浏览器 `localStorage`（不写入 URL）；每次打开或刷新文档页面，前端都会把当前缓存的口令交给后台重新校验。校验失败会回到口令页，校验成功才会继续打开当前页面；输入页会保留跳转前的目标地址，错误口令会停留在输入页。由于 `localStorage` 是浏览器本地明文存储，请只在受信任的浏览器环境使用此模式。
-`localStorageKey` 可选，用于为不同宿主项目隔离浏览器存储键。右上角的“修改口令”可以动态更新口令，修改后会清除本地缓存并使所有现有会话立即失效，必须使用新口令重新进入。
+`localStorageKey` 可选，用于为不同宿主项目隔离浏览器存储键。内置授权不提供“修改口令”或“退出”按钮；需要更换口令时，停止服务、删除 `stateFile`，修改配置中的 `passphrase` 后重新启动。
 建议把 `.docnest/` 加入宿主项目的 `.gitignore`，并为口令状态文件设置仅当前用户可读写的权限。
 
 授权开启但既没有状态文件，也没有初始 `passphrase` 时，DocNest 会拒绝启动，避免意外以空口令开放文档。

package/dist/auth.d.ts

@@ -12,7 +12,5 @@ export type DocNestAuthManager = {
     verifyPassphrase: (passphrase: string) => boolean;
     createSession: (passphrase: string) => string | null;
     authenticateSession: (token: string | undefined) => boolean;
-    revokeSession: (token: string | undefined) => void;
-    changePassphrase: (currentPassphrase: string, nextPassphrase: string) => boolean;
 };
 export declare function createAuthManager(config: DocNestAuthConfig): DocNestAuthManager;

package/dist/auth.js

@@ -130,11 +130,9 @@ function createAuthManager(config) {
             verifyPassphrase: () => true,
             createSession: () => null,
             authenticateSession: () => true,
-            revokeSession: () => undefined,
-            changePassphrase: () => false,
         };
     }
-    let state = readOrCreateState(config);
+    const state = readOrCreateState(config);
     function verifyPassphrase(passphrase) {
         return matchesHash(passphrase, state);
     }
@@ -163,19 +161,6 @@ function createAuthManager(config) {
         session.expiresAt = Date.now() + sessionMaxAgeSeconds * 1000;
         return true;
     }
-    function revokeSession(token) {
-        if (token)
-            sessions.delete(token);
-    }
-    function changePassphrase(currentPassphrase, nextPassphrase) {
-        if (!verifyPassphrase(currentPassphrase))
-            return false;
-        assertPassphrase(nextPassphrase, '新授权口令');
-        state = createState(nextPassphrase);
-        writeState(config.stateFile, state);
-        sessions.clear();
-        return true;
-    }
     return {
         enabled,
         stateFile: config.stateFile,
@@ -184,7 +169,5 @@ function createAuthManager(config) {
         verifyPassphrase,
         createSession,
         authenticateSession,
-        revokeSession,
-        changePassphrase,
     };
 }

package/dist/cli.js

@@ -62,8 +62,7 @@ function exposeConfig(config) {
     process.env.DOCS_THEME_DEFAULT = config.appearance.defaultTheme;
     process.env.DOCS_THEME_MODE_DEFAULT = config.appearance.defaultMode;
     process.env.DOCS_THEME_ENABLED = JSON.stringify(config.appearance.enabledThemes);
-    process.env.DOCS_WATERMARK_ENABLED = String(config.export.watermark.enabled);
-    process.env.DOCS_WATERMARK_TEXT = config.export.watermark.text;
+    process.env.DOCS_RESTRICTED_MODE = String(config.restrictedMode);
     process.env.DOCS_HOST = config.server.host;
     process.env.DOCS_PORT_START = String(config.server.port);
     process.env.DOCS_WATCH_ENABLED = String(config.server.watch);

package/dist/config.d.ts

@@ -32,12 +32,11 @@ export type DocNestConfig = {
         localStorageKey?: string;
         sessionTtlMinutes?: number;
     };
-    export?: {
-        watermark?: {
-            enabled?: boolean;
-            text?: string;
-        };
-    };
+    /**
+     * Restrict the reading experience to in-browser viewing only.
+     * Restricted mode also enables the fixed site-title watermark.
+     */
+    restrictedMode?: boolean;
 };
 export declare function defineConfig(config: DocNestConfig): DocNestConfig;
 export type ResolvedDocNestConfig = Required<DocNestConfig> & {
@@ -54,9 +53,7 @@ export type ResolvedDocNestConfig = Required<DocNestConfig> & {
         localStorageKey: string;
         sessionTtlMinutes: number;
     };
-    export: {
-        watermark: Required<NonNullable<NonNullable<DocNestConfig['export']>['watermark']>>;
-    };
+    restrictedMode: boolean;
 };
 export declare function loadConfig(projectRoot?: string): Promise<ResolvedDocNestConfig>;
 export {};

package/dist/config.js

@@ -87,7 +87,6 @@ async function loadConfig(projectRoot = process.cwd()) {
     const appearance = userConfig.appearance ?? {};
     const server = userConfig.server ?? {};
     const auth = userConfig.auth ?? {};
-    const watermark = userConfig.export?.watermark ?? {};
     const storageKeyPrefix = site.storageKeyPrefix?.trim() || `docnest:${projectName}`;
     const authLocalStorageKey = auth.localStorageKey?.trim() || `${storageKeyPrefix}:auth-passphrase`;
     return {
@@ -118,11 +117,6 @@ async function loadConfig(projectRoot = process.cwd()) {
             localStorageKey: authLocalStorageKey,
             sessionTtlMinutes: normalizePositiveNumber(auth.sessionTtlMinutes, 24 * 60),
         },
-        export: {
-            watermark: {
-                enabled: watermark.enabled ?? false,
-                text: watermark.text?.trim() || site.title?.trim() || projectName,
-            },
-        },
+        restrictedMode: userConfig.restrictedMode === true,
     };
 }

package/dist/server.js

@@ -54,8 +54,9 @@ const DOCS_THEME_ENABLED = (() => {
         return [...DOCS_THEME_NAMES];
     }
 })();
-const DOCS_WATERMARK_ENABLED = process.env.DOCS_WATERMARK_ENABLED === 'true';
-const DOCS_WATERMARK_TEXT = process.env.DOCS_WATERMARK_TEXT || DOCS_TITLE;
+const DOCS_RESTRICTED_MODE = process.env.DOCS_RESTRICTED_MODE === 'true';
+const DOCS_PDF_ENABLED = !DOCS_RESTRICTED_MODE;
+const DOCS_PAGE_WATERMARK_TEXT = DOCS_TITLE;
 const DOCS_DIR = path.resolve(process.env.DOCS_ROOT || path.join(process.cwd(), 'docs'));
 exports.docsDir = DOCS_DIR;
 const ROOT_DIRECTORY_ORDER = (() => {
@@ -108,8 +109,8 @@ app.locals.docsStorageKeyPrefix = DOCS_STORAGE_KEY_PREFIX;
 app.locals.docsThemeDefault = DOCS_THEME_DEFAULT;
 app.locals.docsThemeModeDefault = DOCS_THEME_MODE_DEFAULT;
 app.locals.docsThemeEnabled = DOCS_THEME_ENABLED;
-app.locals.docsWatermarkEnabled = DOCS_WATERMARK_ENABLED;
-app.locals.docsWatermarkText = DOCS_WATERMARK_TEXT;
+app.locals.docsRestrictedMode = DOCS_RESTRICTED_MODE;
+app.locals.docsPageWatermarkText = DOCS_PAGE_WATERMARK_TEXT;
 app.locals.docsAuthEnabled = BUILT_IN_AUTH_ENABLED;
 app.locals.docsAuthStorageKey = AUTH_CONFIG.localStorageKey || `${DOCS_STORAGE_KEY_PREFIX}:auth-passphrase`;
 function normalizeDocRelativePath(value) {
@@ -239,11 +240,13 @@ app.get('/favicon.ico', (req, res) => {
 app.use('/mermaid', express.static(MERMAID_DIR));
 // GitHub Markdown 样式（本地，避免 CDN 慢）
 app.use('/vendor/github-markdown-css', express.static(MARKDOWN_THEME_DIR));
-// html2canvas / DOMPurify / jsPDF（本地，用于前端导出 PDF）
-app.use('/vendor/html2canvas', express.static(HTML2CANVAS_DIR));
-app.use('/vendor/dompurify', express.static(DOMPURIFY_DIR));
-// jsPDF（本地，用于 Mermaid 图导出 PDF）
-app.use('/vendor/jspdf', express.static(JSPDF_DIR));
+if (DOCS_PDF_ENABLED) {
+    // html2canvas / DOMPurify / jsPDF（本地，用于前端导出 PDF）
+    app.use('/vendor/html2canvas', express.static(HTML2CANVAS_DIR));
+    app.use('/vendor/dompurify', express.static(DOMPURIFY_DIR));
+    // jsPDF（本地，用于 Mermaid 图导出 PDF）
+    app.use('/vendor/jspdf', express.static(JSPDF_DIR));
+}
 app.use(express.json({ limit: '16kb' }));
 app.use(express.urlencoded({ extended: false, limit: '16kb' }));
 function readCookie(cookieHeader, name) {
@@ -297,10 +300,7 @@ function renderLoginPage(res, nextPath, error, status = 200) {
 app.get('/login', (req, res) => {
     if (!BUILT_IN_AUTH_ENABLED)
         return res.redirect('/');
-    const message = req.query.changed
-        ? '口令已更新，请使用新口令重新进入。'
-        : '';
-    return renderLoginPage(res, req.query.next, message);
+    return renderLoginPage(res, req.query.next, '');
 });
 app.post('/auth/verify', (req, res) => {
     if (!BUILT_IN_AUTH_ENABLED)
@@ -323,29 +323,6 @@ app.post('/auth/login', (req, res) => {
     setAuthCookie(res, token);
     return res.redirect(nextPath);
 });
-app.post('/auth/logout', (req, res) => {
-    AUTH_MANAGER.revokeSession(readAuthToken(req));
-    clearAuthCookie(res);
-    return res.redirect('/login');
-});
-app.post('/auth/change-password', (req, res) => {
-    if (!BUILT_IN_AUTH_ENABLED || !AUTH_MANAGER.authenticateSession(readAuthToken(req))) {
-        return res.status(401).json({ ok: false, error: '当前会话未授权。' });
-    }
-    try {
-        const changed = AUTH_MANAGER.changePassphrase(String(req.body?.currentPassphrase || ''), String(req.body?.nextPassphrase || ''));
-        if (!changed)
-            return res.status(401).json({ ok: false, error: '当前口令不正确。' });
-        clearAuthCookie(res);
-        return res.json({ ok: true });
-    }
-    catch (error) {
-        return res.status(400).json({
-            ok: false,
-            error: error instanceof Error ? error.message : '新口令无效。',
-        });
-    }
-});
 function documentAuthMiddleware(req, res, next) {
     if (!BUILT_IN_AUTH_ENABLED)
         return next();
@@ -526,8 +503,11 @@ function renderTree(tree, level = 0) {
         else {
             // 文件路径直接使用，路径重定向在 resolveDocPath 中处理
             const url = `/doc?path=${encodeURIComponent(item.path)}`;
+            const isReadme = item.name.toLowerCase() === 'readme.md';
+            const readmeClass = isReadme ? ' readme-link' : '';
+            const readmeBadge = isReadme ? '<span class="tree-readme-badge">README</span>' : '';
             html += `<li class="file">
-        <a href="${url}" class="file-link" title="${itemName}"><span class="tree-kind-icon tree-kind-icon-file" aria-hidden="true">📄</span>${itemName}</a>
+        <a href="${url}" class="file-link${readmeClass}" title="${itemName}"><span class="tree-kind-icon tree-kind-icon-file" aria-hidden="true">📄</span><span class="tree-file-name">${itemName}</span>${readmeBadge}</a>
       </li>`;
         }
     }

package/docnest.config.example.mjs

@@ -34,17 +34,14 @@ export default defineConfig({
   auth: {
     // 极简单口令授权；关闭时文档中心保持本地开放。
     enabled: false,
-    // 仅首次启动且授权状态文件不存在时使用，之后可在页面内修改。
+    // 仅首次启动且授权状态文件不存在时使用；更换口令需手动删除状态文件后重启。
     passphrase: '',
     stateFile: '.docnest/auth.json',
-    // 前端 localStorage 的键；口令会永久保存在浏览器本地，直到用户退出或修改口令。
+    // 前端 localStorage 的键；口令会永久保存在浏览器本地，直到手动清除或口令失效。
     localStorageKey: 'my-project:auth-passphrase',
     sessionTtlMinutes: 24 * 60,
   },
-  export: {
-    watermark: {
-      enabled: false,
-      text: '我的项目文档',
-    },
-  },
+  // 受限阅读模式；默认关闭。开启后隐藏打印/PDF、Mermaid 下载和大图查看，
+  // 并使用 site.title 显示固定水印，同时禁止页面文字选择与复制。
+  restrictedMode: false,
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docnest",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "可复用的本地 Markdown 文档中心",
   "repository": {
     "type": "git",
@@ -66,5 +66,6 @@
     "@types/node": "^22.10.0",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2"
-  }
+  },
+  "packageManager": "pnpm@9.15.0+sha512.76e2379760a4328ec4415815bcd6628dee727af3779aaa4c914e3944156c4299921a89f976381ee107d41f12cfa4b66681ca9c718f0668fa0831ed4c6d8ba56c"
 }

package/server/static/css/styles.css

@@ -451,7 +451,9 @@ body[data-theme="dark"] .dir-toggle.active {
   color: var(--linear-text);
   text-decoration: none;
   font-size: 0.8125rem;
-  display: block;
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
   padding: 0.35rem 0.5rem;
   border-radius: var(--linear-radius);
   transition: background-color 0.15s ease, color 0.15s ease;
@@ -460,6 +462,40 @@ body[data-theme="dark"] .dir-toggle.active {
   white-space: nowrap;
 }
 
+.tree-kind-icon-file {
+  flex: 0 0 auto;
+}
+
+.tree-file-name {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.file-link.readme-link {
+  background: rgba(94, 106, 210, 0.07);
+  font-weight: 600;
+}
+
+.file-link.readme-link:hover,
+.file-link.readme-link.active {
+  background: rgba(94, 106, 210, 0.14);
+}
+
+.tree-readme-badge,
+.dir-listing-item-badge {
+  flex: 0 0 auto;
+  margin-left: auto;
+  padding: 0.1rem 0.4rem;
+  border: 1px solid rgba(94, 106, 210, 0.34);
+  border-radius: 999px;
+  color: var(--linear-accent);
+  font-size: 0.625rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  line-height: 1.2;
+}
+
 .file-link:hover {
   background-color: rgba(0, 0, 0, 0.04);
   color: var(--linear-accent);
@@ -2230,6 +2266,7 @@ body[data-theme="dark"] .pdf-export-modal__desc {
 }
 
 body[data-theme="dark"] .pdf-export-modal__option,
+body[data-theme="dark"] .pdf-export-modal__watermark-input,
 body[data-theme="dark"] .pdf-export-modal__btn {
   background: #1c1c1e;
   border-color: #2c2c2e;
@@ -5696,6 +5733,17 @@ body[data-theme="dark"] .breadcrumb-separator {
   color: var(--linear-text-muted);
 }
 
+.dir-listing-item.is-readme {
+  background: rgba(94, 106, 210, 0.07);
+  border-left: 3px solid var(--linear-accent);
+  padding-left: calc(0.875rem - 3px);
+}
+
+.dir-listing-item.is-readme .dir-listing-item-name {
+  color: var(--linear-text);
+  font-weight: 650;
+}
+
 .dir-listing-item.is-dir .dir-listing-item-name {
   font-weight: 550;
   color: var(--linear-text);
@@ -5778,43 +5826,6 @@ html.docnest-auth-pending::before {
   font-size: 0.9rem;
 }
 
-.auth-actions {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4rem;
-}
-
-.auth-logout-form {
-  display: inline-flex;
-  margin: 0;
-}
-
-.auth-change-password-btn,
-.auth-logout-btn {
-  white-space: nowrap;
-}
-
-.auth-modal[hidden] {
-  display: none;
-}
-
-.auth-modal {
-  position: fixed;
-  inset: 0;
-  z-index: 1000;
-  display: grid;
-  place-items: center;
-  padding: 1.25rem;
-}
-
-.auth-modal-backdrop {
-  position: absolute;
-  inset: 0;
-  background: rgba(10, 16, 24, 0.42);
-  backdrop-filter: blur(4px);
-}
-
-.auth-modal-card,
 .auth-login-card {
   position: relative;
   z-index: 1;
@@ -5825,25 +5836,11 @@ html.docnest-auth-pending::before {
   box-shadow: 0 24px 70px rgba(17, 29, 40, 0.2);
 }
 
-.auth-modal-card {
-  width: min(100%, 440px);
-  padding: 1.5rem;
-}
-
-.auth-modal-header {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-}
-
-.auth-modal-header h2,
 .auth-login-card h1 {
   margin: 0;
   color: var(--linear-text, #18212a);
 }
 
-.auth-modal-eyebrow,
 .auth-login-eyebrow {
   margin: 0 0 0.35rem;
   color: var(--linear-accent, #267c83);
@@ -5852,35 +5849,12 @@ html.docnest-auth-pending::before {
   letter-spacing: 0.12em;
 }
 
-.auth-modal-close {
-  width: 2rem;
-  height: 2rem;
-  padding: 0;
-  border: 0;
-  border-radius: 999px;
-  color: var(--linear-text-muted, #63727f);
-  background: transparent;
-  font-size: 1.5rem;
-  line-height: 1;
-  cursor: pointer;
-}
-
-.auth-modal-close:hover {
-  background: var(--linear-bg-subtle, #eef2f5);
-}
-
-.auth-modal-help,
 .auth-login-description,
 .auth-login-note {
   color: var(--linear-text-muted, #63727f);
   line-height: 1.6;
 }
 
-.auth-modal-help {
-  margin: 1rem 0 1.25rem;
-  font-size: 0.875rem;
-}
-
 .auth-form {
   display: grid;
   gap: 0.9rem;
@@ -5920,15 +5894,7 @@ html.docnest-auth-pending::before {
   font-size: 0.875rem;
 }
 
-.auth-modal-actions {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.6rem;
-  margin-top: 0.25rem;
-}
-
-.auth-primary-btn,
-.auth-secondary-btn {
+.auth-primary-btn {
   min-height: 2.5rem;
   padding: 0.55rem 0.95rem;
   border-radius: 8px;
@@ -5943,12 +5909,6 @@ html.docnest-auth-pending::before {
   background: var(--linear-accent, #267c83);
 }
 
-.auth-secondary-btn {
-  border: 1px solid var(--linear-border, #d7dee5);
-  color: var(--linear-text, #18212a);
-  background: var(--linear-bg-subtle, #eef2f5);
-}
-
 .auth-page {
   min-height: 100vh;
   display: grid;
@@ -6010,16 +5970,3 @@ html.docnest-auth-pending::before {
   font-size: 0.75rem;
   text-align: center;
 }
-
-@media (max-width: 768px) {
-  .auth-actions {
-    gap: 0.25rem;
-  }
-
-  .auth-change-password-btn,
-  .auth-logout-btn {
-    min-width: 44px;
-    padding-inline: 0.5rem;
-    font-size: 0.75rem;
-  }
-}

package/server/static/css/themes.css

@@ -40,6 +40,58 @@ body {
   font-family: var(--doc-font-ui);
 }
 
+/* Protected reading mode: no text selection/copy and a persistent viewport watermark. */
+html.docnest-page-protected body,
+html.docnest-page-protected body * {
+  -webkit-user-select: none !important;
+  -moz-user-select: none !important;
+  user-select: none !important;
+}
+
+html.docnest-page-protected body input,
+html.docnest-page-protected body textarea,
+html.docnest-page-protected body select,
+html.docnest-page-protected body [contenteditable="true"] {
+  -webkit-user-select: text !important;
+  -moz-user-select: text !important;
+  user-select: text !important;
+}
+
+/* Restricted mode keeps Mermaid inline but removes every affordance for opening
+ * or exporting a larger copy of the diagram. */
+html.docnest-restricted .markdown-body .mermaid {
+  cursor: default;
+}
+
+html.docnest-restricted .markdown-body .mermaid::after,
+html.docnest-restricted .markdown-body .mermaid-download-btn {
+  display: none !important;
+}
+
+.docnest-page-watermark {
+  position: fixed;
+  inset: 0;
+  z-index: 9990;
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  grid-template-rows: repeat(4, minmax(0, 1fr));
+  overflow: hidden;
+  pointer-events: none;
+  user-select: none;
+}
+
+.docnest-page-watermark__item {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  color: var(--linear-text, rgba(15, 23, 42, 0.42));
+  font: 700 clamp(0.75rem, 1.5vw, 1.5rem)/1 var(--doc-font-mono);
+  letter-spacing: 0.08em;
+  opacity: 0.12;
+  transform: rotate(-24deg);
+  white-space: nowrap;
+}
+
 ::selection {
   background: var(--doc-selection);
 }
@@ -318,8 +370,7 @@ body[data-doc-theme][data-theme="dark"] .pdf-export-modal__panel {
 }
 
 body[data-doc-theme][data-theme="dark"] .download-menu-content button,
-body[data-doc-theme][data-theme="dark"] .pdf-export-modal__option,
-body[data-doc-theme][data-theme="dark"] .pdf-export-modal__watermark-input {
+body[data-doc-theme][data-theme="dark"] .pdf-export-modal__btn {
   border-color: var(--linear-border);
   background: var(--linear-bg-subtle);
   color: var(--linear-text);

package/server/static/js/core/auth.js

@@ -92,78 +92,6 @@
     document.documentElement.classList.remove('docnest-auth-pending');
   }
 
-  function initChangePassword() {
-    var modal = document.getElementById('auth-change-password-modal');
-    var openButton = document.getElementById('auth-change-password-btn');
-    var form = document.getElementById('auth-change-password-form');
-    var error = document.getElementById('auth-change-password-error');
-    if (!modal || !openButton || !form) return;
-
-    var closeButtons = modal.querySelectorAll('[data-auth-close]');
-
-    function setError(message) {
-      if (!error) return;
-      error.textContent = message || '';
-      error.hidden = !message;
-    }
-
-    function closeModal() {
-      modal.hidden = true;
-      setError('');
-      form.reset();
-    }
-
-    openButton.addEventListener('click', function () {
-      modal.hidden = false;
-      var firstInput = form.querySelector('input');
-      if (firstInput) firstInput.focus();
-    });
-
-    closeButtons.forEach(function (button) {
-      button.addEventListener('click', closeModal);
-    });
-
-    form.addEventListener('submit', async function (event) {
-      event.preventDefault();
-      setError('');
-      var formData = new FormData(form);
-      var nextPassphrase = String(formData.get('nextPassphrase') || '');
-      var confirmPassphrase = String(formData.get('confirmPassphrase') || '');
-      if (nextPassphrase !== confirmPassphrase) {
-        setError('两次输入的新口令不一致。');
-        return;
-      }
-
-      try {
-        var response = await fetch('/auth/change-password', {
-          method: 'POST',
-          credentials: 'same-origin',
-          headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-          body: JSON.stringify({
-            currentPassphrase: String(formData.get('currentPassphrase') || ''),
-            nextPassphrase: nextPassphrase,
-          }),
-        });
-        var result = await response.json().catch(function () { return {}; });
-        if (!response.ok || !result.ok) {
-          throw new Error(result.error || '修改口令失败，请重试。');
-        }
-        clearPassphrase();
-        window.location.assign('/login?changed=1');
-      } catch (requestError) {
-        setError(requestError instanceof Error ? requestError.message : '修改口令失败，请重试。');
-      }
-    });
-  }
-
-  function initLogout() {
-    document.querySelectorAll('.auth-logout-form').forEach(function (form) {
-      form.addEventListener('submit', function () {
-        clearPassphrase();
-      });
-    });
-  }
-
   function initLoginPage() {
     var form = document.querySelector('.auth-login-form');
     var error = document.querySelector('.auth-login-form .auth-form-error');
@@ -211,8 +139,6 @@
         return;
       }
       removePendingState();
-      initChangePassword();
-      initLogout();
     });
   }
 

package/server/static/js/core/doc-pdf-export.js

@@ -313,7 +313,7 @@
     return Math.max(minBreakY - startY, searchStartY + bestRow - startY);
   }
 
-  function addCanvasToPdf(pdf, canvas, margin, blockBreakpoints, watermarkEnabled, watermarkText) {
+  function addCanvasToPdf(pdf, canvas, margin, blockBreakpoints, watermark) {
     var pageWidth = pdf.internal.pageSize.getWidth();
     var pageHeight = pdf.internal.pageSize.getHeight();
     var usableWidth = pageWidth - margin * 2;
@@ -357,8 +357,14 @@
         sliceHeight
       );
 
-      if (watermarkEnabled) {
-        drawWatermarkPattern(context, pageCanvas.width, pageCanvas.height, pageCanvasHeight, watermarkText);
+      if (watermark && watermark.enabled) {
+        drawWatermarkPattern(
+          context,
+          pageCanvas.width,
+          pageCanvas.height,
+          pageCanvasHeight,
+          watermark.text,
+        );
       }
 
       if (pageIndex > 0) {
@@ -413,18 +419,17 @@
   function openPdfExportDialog() {
     return new Promise(function(resolve) {
       var config = window.DOCNEST_CONFIG || {};
-      var defaultWatermarkEnabled = config.watermarkEnabled === true;
-      var defaultWatermarkText = String(config.watermarkText || document.title || '');
+      var defaultWatermarkText = String(config.siteTitle || document.title || '');
       var modalId = 'pdf-export-modal';
       var overlay = document.createElement('div');
       overlay.className = 'pdf-export-modal';
       overlay.innerHTML = [
         '<div class="pdf-export-modal__panel" role="dialog" aria-modal="true" aria-labelledby="pdf-export-title">',
           '<div class="pdf-export-modal__title" id="pdf-export-title">下载 PDF</div>',
-          '<div class="pdf-export-modal__desc">导出前确认本次 PDF 是否需要水印；本次修改不会写回项目配置。</div>',
+          '<div class="pdf-export-modal__desc">可为本次导出的 PDF 临时添加水印，不会修改项目配置。</div>',
           '<label class="pdf-export-modal__option">',
             '<input type="checkbox" id="pdf-export-watermark-checkbox">',
-            '<span class="pdf-export-modal__option-text">启用水印</span>',
+            '<span class="pdf-export-modal__option-text">本次导出添加水印</span>',
           '</label>',
           '<label class="pdf-export-modal__watermark-field" for="pdf-export-watermark-text">水印文字</label>',
           '<input class="pdf-export-modal__watermark-input" id="pdf-export-watermark-text" type="text" maxlength="80">',
@@ -446,45 +451,38 @@
       }
 
       overlay.addEventListener('click', function(event) {
-        if (event.target === overlay) {
-          close(null);
-        }
+        if (event.target === overlay) close(null);
       });
-
       overlay.querySelector('[data-action="cancel"]').addEventListener('click', function() {
         close(null);
       });
-
       overlay.querySelector('[data-action="confirm"]').addEventListener('click', function() {
         var checkbox = overlay.querySelector('#pdf-export-watermark-checkbox');
         var watermarkInput = overlay.querySelector('#pdf-export-watermark-text');
         close({
-          watermarkEnabled: !!(checkbox && checkbox.checked),
-          watermarkText: watermarkInput ? watermarkInput.value.trim() : defaultWatermarkText,
+          enabled: !!(checkbox && checkbox.checked),
+          text: watermarkInput ? watermarkInput.value.trim() : defaultWatermarkText,
         });
       });
 
       document.body.appendChild(overlay);
       if (typeof pushModal === 'function') {
-        pushModal(modalId, function() {
-          close(null);
-        });
+        pushModal(modalId, function() { close(null); });
       }
 
       var checkbox = overlay.querySelector('#pdf-export-watermark-checkbox');
+      var watermarkInput = overlay.querySelector('#pdf-export-watermark-text');
+      if (watermarkInput) {
+        watermarkInput.value = defaultWatermarkText;
+        watermarkInput.disabled = true;
+      }
       if (checkbox) {
-        checkbox.checked = defaultWatermarkEnabled;
+        checkbox.checked = false;
         checkbox.addEventListener('change', function() {
-          var watermarkInput = overlay.querySelector('#pdf-export-watermark-text');
           if (watermarkInput) watermarkInput.disabled = !checkbox.checked;
         });
         checkbox.focus();
       }
-      var watermarkInput = overlay.querySelector('#pdf-export-watermark-text');
-      if (watermarkInput) {
-        watermarkInput.value = defaultWatermarkText;
-        watermarkInput.disabled = !defaultWatermarkEnabled;
-      }
     });
   }
 
@@ -568,7 +566,7 @@
     }
   }
 
-  function exportCurrentDoc(button, options) {
+  function exportCurrentDoc(button, watermark) {
     var article = document.querySelector('.main-content .markdown-body');
     if (!article) {
       showPdfExportError('未找到当前文档内容，无法导出 PDF。');
@@ -588,21 +586,13 @@
           format: 'a4',
           compress: true,
         });
-        var config = window.DOCNEST_CONFIG || {};
-        var watermarkEnabled = options && typeof options.watermarkEnabled === 'boolean'
-          ? options.watermarkEnabled
-          : config.watermarkEnabled === true;
-        var watermarkText = options && options.watermarkText
-          ? options.watermarkText
-          : String(config.watermarkText || document.title || '');
-
         return waitForExportReady()
           .then(function() {
             return renderCanvas(exportRoot);
           })
           .then(function(canvas) {
             var blockBreakpoints = collectBlockBreakpoints(exportRoot, canvas.height / Math.max(exportRoot.scrollHeight, 1));
-            addCanvasToPdf(pdf, canvas, margin, blockBreakpoints, watermarkEnabled, watermarkText);
+            addCanvasToPdf(pdf, canvas, margin, blockBreakpoints, watermark);
             pdf.save(getExportFileName() + '.pdf');
           })
           .finally(function() {
@@ -619,13 +609,13 @@
   }
 
   function init() {
+    if (window.DOCNEST_CONFIG && window.DOCNEST_CONFIG.restrictedMode === true) return;
     var button = document.getElementById('download-doc-pdf-btn');
     if (!button) return;
 
     button.addEventListener('click', function() {
-      openPdfExportDialog().then(function(result) {
-        if (!result) return;
-        exportCurrentDoc(button, result);
+      openPdfExportDialog().then(function(watermark) {
+        if (watermark) exportCurrentDoc(button, watermark);
       });
     });
   }

package/server/static/js/diagram/diagram-download.js

@@ -1,5 +1,10 @@
 // 图表下载和复制功能
+function isDocNestRestrictedMode() {
+  return !!(window.DOCNEST_CONFIG && window.DOCNEST_CONFIG.restrictedMode === true);
+}
+
 function downloadCurrentDiagram() {
+  if (isDocNestRestrictedMode()) return;
   if (!currentSvg) return;
   // 获取原始 SVG（移除缩放样式）
   const originalSvg = currentSvg.cloneNode(true);
@@ -10,6 +15,7 @@ function downloadCurrentDiagram() {
 }
 
 function copyCurrentDiagram() {
+  if (isDocNestRestrictedMode()) return;
   if (!currentSvg) return;
   
   // 获取原始 SVG（移除缩放样式）
@@ -199,6 +205,7 @@ function showCopyNotification(message, success) {
 
 // 下载功能
 function showDownloadMenu(svgElement, defaultName) {
+  if (isDocNestRestrictedMode()) return;
   const menu = document.createElement('div');
   menu.className = 'download-menu';
   menu.id = 'download-menu';
@@ -246,6 +253,7 @@ function closeDownloadMenu() {
 }
 
 function downloadDiagram(format, name) {
+  if (isDocNestRestrictedMode()) return;
   const svg = window.currentDownloadSvg;
   if (!svg) return;
   

package/server/static/js/diagram/diagram-viewer.js

@@ -4,7 +4,12 @@ let defaultZoom = 1;
 let currentSvg = null;
 let isFullscreen = false;
 
+function isDocNestRestrictedMode() {
+  return !!(window.DOCNEST_CONFIG && window.DOCNEST_CONFIG.restrictedMode === true);
+}
+
 function setupDiagramViewer() {
+  if (isDocNestRestrictedMode()) return;
   const diagrams = document.querySelectorAll('.markdown-body .mermaid');
   diagrams.forEach((diagram, index) => {
     // 添加下载按钮
@@ -38,6 +43,7 @@ function setupDiagramViewer() {
 }
 
 function openDiagramViewer(svgElement) {
+  if (isDocNestRestrictedMode()) return;
   const viewer = document.getElementById('diagram-viewer');
   const container = document.getElementById('diagram-viewer-svg-container');
   

package/server/views/dir.ejs

@@ -15,6 +15,7 @@
   <script src="/static/js/core/sidebar.js?v=<%= assetVersion %>"></script>
 </head>
 <body data-current-dir-path="<%= currentDirPath %>">
+  <%- include('partials/page-protection') %>
   <div class="container">
     <%- include('partials/header', { showBackLink: true, showPrintButton: false, showPdfButton: false }) %>
     <div class="content">
@@ -47,9 +48,11 @@
                 </a>
               <% }); %>
               <% listing.files.forEach(function(file) { %>
-                <a href="/doc?path=<%= encodeURIComponent(file.path) %>" class="dir-listing-item is-file">
+                <% const isReadme = file.name.toLowerCase() === 'readme.md'; %>
+                <a href="/doc?path=<%= encodeURIComponent(file.path) %>" class="dir-listing-item is-file<%= isReadme ? ' is-readme' : '' %>">
                   <span class="dir-listing-item-icon">📄</span>
                   <span class="dir-listing-item-name"><%= file.name %></span>
+                  <% if (isReadme) { %><span class="dir-listing-item-badge">目录说明</span><% } %>
                 </a>
               <% }); %>
             </div>

package/server/views/doc.ejs

@@ -15,10 +15,13 @@
   <script src="/static/js/core/theme.js?v=<%= assetVersion %>"></script>
   <script src="/static/js/core/mermaid-init.js?v=<%= assetVersion %>"></script>
   <script src="/static/js/core/doc-client-nav.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/core/doc-pdf-export.js?v=<%= assetVersion %>"></script>
+  <% if (!docsRestrictedMode) { %>
+    <script src="/static/js/core/doc-pdf-export.js?v=<%= assetVersion %>"></script>
+  <% } %>
   <script src="/static/js/core/sidebar.js?v=<%= assetVersion %>"></script>
 </head>
 <body data-current-path="<%= currentPath %>">
+  <%- include('partials/page-protection') %>
   <div class="container">
     <%- include('partials/header', { showBackLink: true, showPrintButton: true, showPdfButton: true }) %>
     <div class="content">
@@ -34,26 +37,31 @@
       </main>
     </div>
   </div>
-  <%- include('partials/diagram-viewer') %>
-  <!-- 按依赖顺序加载模块 -->
-  <script src="/static/js/utils/modal-stack.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-viewer.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-zoom.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-drag.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-controls.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-download.js?v=<%= assetVersion %>"></script>
+  <% if (!docsRestrictedMode) { %>
+    <%- include('partials/diagram-viewer') %>
+    <!-- 按依赖顺序加载模块 -->
+    <script src="/static/js/utils/modal-stack.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-viewer.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-zoom.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-drag.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-controls.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-download.js?v=<%= assetVersion %>"></script>
+  <% } %>
   <script src="/static/js/utils/app.js?v=<%= assetVersion %>"></script>
+  <% if (!docsRestrictedMode) { %>
+    <script>
+      // 打印当前文章
+      (function() {
+        const printBtn = document.getElementById('print-doc-btn');
+        if (printBtn) {
+          printBtn.addEventListener('click', function() {
+            window.print();
+          });
+        }
+      })();
+    </script>
+  <% } %>
   <script>
-    // 打印当前文章
-    (function() {
-      const printBtn = document.getElementById('print-doc-btn');
-      if (printBtn) {
-        printBtn.addEventListener('click', function() {
-          window.print();
-        });
-      }
-    })();
-
     // 高亮当前文档；展开状态：恢复上次保存的 + 当前文档所在路径，不折叠其他已展开项
     (function() {
       const STORAGE_KEY = <%- JSON.stringify(docsStorageKeyPrefix + ':open-dirs') %>;

package/server/views/index.ejs

@@ -17,6 +17,7 @@
   <script src="/static/js/core/sidebar.js?v=<%= assetVersion %>"></script>
 </head>
 <body>
+  <%- include('partials/page-protection') %>
   <div class="container">
     <%- include('partials/header', { showBackLink: false }) %>
     <div class="content">
@@ -29,14 +30,16 @@
       </main>
     </div>
   </div>
-  <%- include('partials/diagram-viewer') %>
-  <!-- 按依赖顺序加载模块 -->
-  <script src="/static/js/utils/modal-stack.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-viewer.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-zoom.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-drag.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-controls.js?v=<%= assetVersion %>"></script>
-  <script src="/static/js/diagram/diagram-download.js?v=<%= assetVersion %>"></script>
+  <% if (!docsRestrictedMode) { %>
+    <%- include('partials/diagram-viewer') %>
+    <!-- 按依赖顺序加载模块 -->
+    <script src="/static/js/utils/modal-stack.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-viewer.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-zoom.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-drag.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-controls.js?v=<%= assetVersion %>"></script>
+    <script src="/static/js/diagram/diagram-download.js?v=<%= assetVersion %>"></script>
+  <% } %>
   <script src="/static/js/utils/app.js?v=<%= assetVersion %>"></script>
   <script src="/socket.io/socket.io.js"></script>
   <script>

package/server/views/not-found.ejs

@@ -14,6 +14,7 @@
   <script src="/static/js/core/sidebar.js?v=<%= assetVersion %>"></script>
 </head>
 <body class="not-found-page">
+  <%- include('partials/page-protection') %>
   <div class="container">
     <%- include('partials/header', { showBackLink: true }) %>
     <div class="content">

package/server/views/partials/appearance-head.ejs

@@ -2,8 +2,8 @@
   window.DOCNEST_CONFIG = {
     authEnabled: <%= docsAuthEnabled ? 'true' : 'false' %>,
     authStorageKey: <%- JSON.stringify(docsAuthStorageKey) %>,
-    watermarkEnabled: <%= docsWatermarkEnabled ? 'true' : 'false' %>,
-    watermarkText: <%- JSON.stringify(docsWatermarkText) %>,
+    siteTitle: <%- JSON.stringify(docsTitle) %>,
+    restrictedMode: <%= docsRestrictedMode ? 'true' : 'false' %>,
     storageKeyPrefix: <%- JSON.stringify(docsStorageKeyPrefix) %>,
     appearance: {
       defaultTheme: <%- JSON.stringify(docsThemeDefault) %>,

package/server/views/partials/header.ejs

@@ -13,13 +13,13 @@
     </div>
     <div class="header-meta">
       <div class="header-actions">
-        <% if (typeof showPrintButton !== 'undefined' && showPrintButton) { %>
+        <% if (typeof showPrintButton !== 'undefined' && showPrintButton && !docsRestrictedMode) { %>
           <button type="button" id="print-doc-btn" class="header-action-btn print-btn" title="打印当前文章">
             <span class="print-icon">🖨️</span>
             <span class="header-action-text">打印</span>
           </button>
         <% } %>
-        <% if (typeof showPdfButton !== 'undefined' && showPdfButton) { %>
+        <% if (typeof showPdfButton !== 'undefined' && showPdfButton && !docsRestrictedMode) { %>
           <button type="button" id="download-doc-pdf-btn" class="header-action-btn download-pdf-btn" title="下载当前文章 PDF">
             <span class="download-pdf-icon">⬇️</span>
             <span class="header-action-text">下载 PDF</span>
@@ -54,52 +54,10 @@
           <span class="theme-icon" aria-hidden="true">A</span>
           <span class="theme-text">跟随系统</span>
         </button>
-        <% if (docsAuthEnabled) { %>
-          <div class="auth-actions" aria-label="文档授权">
-            <button id="auth-change-password-btn" class="header-action-btn auth-change-password-btn" type="button">
-              修改口令
-            </button>
-            <form action="/auth/logout" method="post" class="auth-logout-form">
-              <button class="header-action-btn auth-logout-btn" type="submit">退出</button>
-            </form>
-          </div>
-        <% } %>
       </div>
     </div>
   </div>
 </header>
 <% if (docsAuthEnabled) { %>
-  <div class="auth-modal" id="auth-change-password-modal" hidden>
-    <div class="auth-modal-backdrop" data-auth-close></div>
-    <section class="auth-modal-card" role="dialog" aria-modal="true" aria-labelledby="auth-change-password-title">
-      <div class="auth-modal-header">
-        <div>
-          <p class="auth-modal-eyebrow">DOCUMENT ACCESS</p>
-          <h2 id="auth-change-password-title">修改授权口令</h2>
-        </div>
-        <button type="button" class="auth-modal-close" data-auth-close aria-label="关闭">×</button>
-      </div>
-      <p class="auth-modal-help">修改后所有已打开的文档会退出授权，需要使用新口令重新进入。</p>
-      <form id="auth-change-password-form" class="auth-form">
-        <label>
-          当前口令
-          <input type="password" name="currentPassphrase" autocomplete="current-password" required>
-        </label>
-        <label>
-          新口令
-          <input type="password" name="nextPassphrase" autocomplete="new-password" required>
-        </label>
-        <label>
-          确认新口令
-          <input type="password" name="confirmPassphrase" autocomplete="new-password" required>
-        </label>
-        <p class="auth-form-error" id="auth-change-password-error" role="alert" hidden></p>
-        <div class="auth-modal-actions">
-          <button type="button" class="auth-secondary-btn" data-auth-close>取消</button>
-          <button type="submit" class="auth-primary-btn">保存新口令</button>
-        </div>
-      </form>
-    </section>
-  </div>
   <script src="/static/js/core/auth.js?v=<%= typeof assetVersion !== 'undefined' ? assetVersion : 'dev' %>"></script>
 <% } %>

package/server/views/partials/page-protection.ejs

@@ -0,0 +1,31 @@
+<% if (docsRestrictedMode) { %>
+  <div class="docnest-page-watermark" aria-hidden="true">
+    <% for (let index = 0; index < 12; index += 1) { %>
+      <span class="docnest-page-watermark__item"><%= docsPageWatermarkText %></span>
+    <% } %>
+  </div>
+  <script>
+    document.documentElement.classList.add('docnest-page-protected', 'docnest-restricted');
+    (function() {
+      function isEditableTarget(target) {
+        return !!(target && target.closest && target.closest('input, textarea, select, [contenteditable="true"]'));
+      }
+
+      function preventProtectedAction(event) {
+        if (!isEditableTarget(event.target)) event.preventDefault();
+      }
+
+      document.addEventListener('selectstart', preventProtectedAction);
+      document.addEventListener('copy', preventProtectedAction);
+      document.addEventListener('cut', preventProtectedAction);
+      document.addEventListener('dragstart', preventProtectedAction);
+      document.addEventListener('keydown', function(event) {
+        if (isEditableTarget(event.target)) return;
+        var key = String(event.key || '').toLowerCase();
+        if ((event.metaKey || event.ctrlKey) && (key === 'a' || key === 'c' || key === 'x')) {
+          event.preventDefault();
+        }
+      });
+    })();
+  </script>
+<% } %>