docnest 0.1.9 → 0.1.10

package/README.md

@@ -68,6 +68,7 @@ export default defineConfig({
     enabled: true,
     passphrase: '请替换为项目自己的长口令',
     stateFile: '.docnest/auth.json',
+    localStorageKey: 'my-project:auth-passphrase',
     sessionTtlMinutes: 24 * 60,
   },
 })
@@ -75,7 +76,8 @@ export default defineConfig({
 
 授权只有一道关口，没有账号、密码组合或角色体系。首次启动时，`passphrase` 会初始化到由
 `stateFile` 指定的本地授权状态文件；状态文件只保存带随机盐的口令哈希，不保存明文口令。
-进入文档中心后，右上角的“修改口令”可以动态更新口令。修改后所有现有会话立即失效，必须使用新口令重新进入。
+按极简模式约定，前端会把可回填的口令永久保存到浏览器 `localStorage`（不写入 URL）；每次打开或刷新文档页面，前端都会把当前缓存的口令交给后台重新校验。校验失败会回到口令页，校验成功才会继续打开当前页面；输入页会保留跳转前的目标地址，错误口令会停留在输入页。由于 `localStorage` 是浏览器本地明文存储，请只在受信任的浏览器环境使用此模式。
+`localStorageKey` 可选，用于为不同宿主项目隔离浏览器存储键。右上角的“修改口令”可以动态更新口令，修改后会清除本地缓存并使所有现有会话立即失效，必须使用新口令重新进入。
 建议把 `.docnest/` 加入宿主项目的 `.gitignore`，并为口令状态文件设置仅当前用户可读写的权限。
 
 授权开启但既没有状态文件，也没有初始 `passphrase` 时，DocNest 会拒绝启动，避免意外以空口令开放文档。

package/dist/config.d.ts

@@ -29,6 +29,7 @@ export type DocNestConfig = {
         enabled?: boolean;
         passphrase?: string;
         stateFile?: string;
+        localStorageKey?: string;
         sessionTtlMinutes?: number;
     };
     export?: {
@@ -50,6 +51,7 @@ export type ResolvedDocNestConfig = Required<DocNestConfig> & {
         enabled: boolean;
         passphrase: string;
         stateFile: string;
+        localStorageKey: string;
         sessionTtlMinutes: number;
     };
     export: {

package/dist/config.js

@@ -89,6 +89,7 @@ async function loadConfig(projectRoot = process.cwd()) {
     const auth = userConfig.auth ?? {};
     const watermark = userConfig.export?.watermark ?? {};
     const storageKeyPrefix = site.storageKeyPrefix?.trim() || `docnest:${projectName}`;
+    const authLocalStorageKey = auth.localStorageKey?.trim() || `${storageKeyPrefix}:auth-passphrase`;
     return {
         projectRoot,
         docsDir: node_path_1.default.resolve(projectRoot, userConfig.docsDir?.trim() || 'docs'),
@@ -114,6 +115,7 @@ async function loadConfig(projectRoot = process.cwd()) {
             enabled: auth.enabled ?? false,
             passphrase: typeof auth.passphrase === 'string' ? auth.passphrase : '',
             stateFile: node_path_1.default.resolve(projectRoot, auth.stateFile?.trim() || '.docnest/auth.json'),
+            localStorageKey: authLocalStorageKey,
             sessionTtlMinutes: normalizePositiveNumber(auth.sessionTtlMinutes, 24 * 60),
         },
         export: {

package/dist/server.js

@@ -92,6 +92,7 @@ const AUTH_CONFIG = globalThis.__DOCNEST_AUTH_CONFIG__ || {
     enabled: false,
     passphrase: '',
     stateFile: path.join(process.cwd(), '.docnest', 'auth.json'),
+    localStorageKey: `${DOCS_STORAGE_KEY_PREFIX}:auth-passphrase`,
     sessionTtlMinutes: 24 * 60,
 };
 const AUTH_MANAGER = createAuthManager(AUTH_CONFIG);
@@ -110,6 +111,7 @@ app.locals.docsThemeEnabled = DOCS_THEME_ENABLED;
 app.locals.docsWatermarkEnabled = DOCS_WATERMARK_ENABLED;
 app.locals.docsWatermarkText = DOCS_WATERMARK_TEXT;
 app.locals.docsAuthEnabled = BUILT_IN_AUTH_ENABLED;
+app.locals.docsAuthStorageKey = AUTH_CONFIG.localStorageKey || `${DOCS_STORAGE_KEY_PREFIX}:auth-passphrase`;
 function normalizeDocRelativePath(value) {
     const raw = String(value || '').replace(/\\/g, '/').replace(/^\/+/, '');
     const normalized = path.posix.normalize(raw);
@@ -295,14 +297,22 @@ function renderLoginPage(res, nextPath, error, status = 200) {
 app.get('/login', (req, res) => {
     if (!BUILT_IN_AUTH_ENABLED)
         return res.redirect('/');
-    if (AUTH_MANAGER.authenticateSession(readAuthToken(req))) {
-        return res.redirect(safeNextPath(req.query.next));
-    }
     const message = req.query.changed
         ? '口令已更新，请使用新口令重新进入。'
         : '';
     return renderLoginPage(res, req.query.next, message);
 });
+app.post('/auth/verify', (req, res) => {
+    if (!BUILT_IN_AUTH_ENABLED)
+        return res.json({ ok: true });
+    const token = AUTH_MANAGER.createSession(String(req.body?.passphrase || ''));
+    if (!token) {
+        clearAuthCookie(res);
+        return res.status(401).json({ ok: false, error: '口令不正确，请重试。' });
+    }
+    setAuthCookie(res, token);
+    return res.json({ ok: true });
+});
 app.post('/auth/login', (req, res) => {
     if (!BUILT_IN_AUTH_ENABLED)
         return res.redirect('/');

package/docnest.config.example.mjs

@@ -37,6 +37,8 @@ export default defineConfig({
     // 仅首次启动且授权状态文件不存在时使用，之后可在页面内修改。
     passphrase: '',
     stateFile: '.docnest/auth.json',
+    // 前端 localStorage 的键；口令会永久保存在浏览器本地，直到用户退出或修改口令。
+    localStorageKey: 'my-project:auth-passphrase',
     sessionTtlMinutes: 24 * 60,
   },
   export: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docnest",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "可复用的本地 Markdown 文档中心",
   "repository": {
     "type": "git",

package/server/static/css/styles.css

@@ -5762,6 +5762,22 @@ body[data-theme="dark"] .dir-listing-count {
 }
 
 /* 极简单口令授权 */
+html.docnest-auth-pending body > * {
+  visibility: hidden;
+}
+
+html.docnest-auth-pending::before {
+  content: '正在校验授权…';
+  position: fixed;
+  inset: 0;
+  z-index: 2000;
+  display: grid;
+  place-items: center;
+  color: var(--linear-text-muted, #63727f);
+  background: var(--linear-bg, #ffffff);
+  font-size: 0.9rem;
+}
+
 .auth-actions {
   display: inline-flex;
   align-items: center;

package/server/static/js/core/auth.js

@@ -1,61 +1,226 @@
 (function () {
-  var modal = document.getElementById('auth-change-password-modal');
-  var openButton = document.getElementById('auth-change-password-btn');
-  var form = document.getElementById('auth-change-password-form');
-  var error = document.getElementById('auth-change-password-error');
-  if (!modal || !openButton || !form) return;
-
-  var closeButtons = modal.querySelectorAll('[data-auth-close]');
-
-  function setError(message) {
-    if (!error) return;
-    error.textContent = message || '';
-    error.hidden = !message;
-  }
-
-  function closeModal() {
-    modal.hidden = true;
-    setError('');
-    form.reset();
-  }
-
-  openButton.addEventListener('click', function () {
-    modal.hidden = false;
-    var firstInput = form.querySelector('input');
-    if (firstInput) firstInput.focus();
-  });
-
-  closeButtons.forEach(function (button) {
-    button.addEventListener('click', closeModal);
-  });
-
-  form.addEventListener('submit', async function (event) {
-    event.preventDefault();
-    setError('');
-    var formData = new FormData(form);
-    var nextPassphrase = String(formData.get('nextPassphrase') || '');
-    var confirmPassphrase = String(formData.get('confirmPassphrase') || '');
-    if (nextPassphrase !== confirmPassphrase) {
-      setError('两次输入的新口令不一致。');
-      return;
+  var config = window.DOCNEST_CONFIG || {};
+  if (config.authEnabled !== true) return;
+
+  var storageKey = config.authStorageKey || 'docnest:auth-passphrase';
+  var verificationPromise = null;
+
+  function readPassphrase() {
+    try {
+      return window.localStorage.getItem(storageKey) || '';
+    } catch (error) {
+      return '';
+    }
+  }
+
+  function writePassphrase(passphrase) {
+    try {
+      window.localStorage.setItem(storageKey, passphrase);
+      return true;
+    } catch (error) {
+      return false;
     }
+  }
 
+  function clearPassphrase() {
     try {
-      var response = await fetch('/auth/change-password', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-        body: JSON.stringify({
-          currentPassphrase: String(formData.get('currentPassphrase') || ''),
-          nextPassphrase: nextPassphrase,
-        }),
+      window.localStorage.removeItem(storageKey);
+    } catch (error) {
+      // The browser may block storage; the next request will simply ask again.
+    }
+  }
+
+  function currentPageUrl() {
+    return window.location.pathname + window.location.search + window.location.hash;
+  }
+
+  function safeNextPath(value) {
+    if (
+      typeof value !== 'string' ||
+      value.charAt(0) !== '/' ||
+      value.indexOf('//') === 0 ||
+      value.indexOf('\\') !== -1 ||
+      /[\r\n]/.test(value)
+    ) return '/';
+    return value;
+  }
+
+  function redirectToLogin() {
+    var next = encodeURIComponent(currentPageUrl() || '/');
+    window.location.replace('/login?next=' + next);
+  }
+
+  function verifyWithBackend(passphrase) {
+    return fetch('/auth/verify', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify({ passphrase: passphrase }),
+    }).then(function (response) {
+      return response.json().catch(function () { return {}; }).then(function (result) {
+        return { ok: response.ok && result.ok === true, error: result.error || '', unavailable: false };
+      });
+    }).catch(function () {
+      return { ok: false, error: '无法连接授权服务，请稍后重试。', unavailable: true };
+    });
+  }
+
+  function ensureAuthorized() {
+    if (verificationPromise) return verificationPromise;
+    var passphrase = readPassphrase();
+    if (!passphrase) return Promise.resolve(false);
+
+    verificationPromise = verifyWithBackend(passphrase).then(function (result) {
+      if (!result.ok) {
+        clearPassphrase();
+        return false;
+      }
+      return true;
+    }).finally(function () {
+      verificationPromise = null;
+    });
+    return verificationPromise;
+  }
+
+  window.docNestEnsureAuthorized = ensureAuthorized;
+  window.docNestRedirectToLogin = redirectToLogin;
+
+  function removePendingState() {
+    document.documentElement.classList.remove('docnest-auth-pending');
+  }
+
+  function initChangePassword() {
+    var modal = document.getElementById('auth-change-password-modal');
+    var openButton = document.getElementById('auth-change-password-btn');
+    var form = document.getElementById('auth-change-password-form');
+    var error = document.getElementById('auth-change-password-error');
+    if (!modal || !openButton || !form) return;
+
+    var closeButtons = modal.querySelectorAll('[data-auth-close]');
+
+    function setError(message) {
+      if (!error) return;
+      error.textContent = message || '';
+      error.hidden = !message;
+    }
+
+    function closeModal() {
+      modal.hidden = true;
+      setError('');
+      form.reset();
+    }
+
+    openButton.addEventListener('click', function () {
+      modal.hidden = false;
+      var firstInput = form.querySelector('input');
+      if (firstInput) firstInput.focus();
+    });
+
+    closeButtons.forEach(function (button) {
+      button.addEventListener('click', closeModal);
+    });
+
+    form.addEventListener('submit', async function (event) {
+      event.preventDefault();
+      setError('');
+      var formData = new FormData(form);
+      var nextPassphrase = String(formData.get('nextPassphrase') || '');
+      var confirmPassphrase = String(formData.get('confirmPassphrase') || '');
+      if (nextPassphrase !== confirmPassphrase) {
+        setError('两次输入的新口令不一致。');
+        return;
+      }
+
+      try {
+        var response = await fetch('/auth/change-password', {
+          method: 'POST',
+          credentials: 'same-origin',
+          headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+          body: JSON.stringify({
+            currentPassphrase: String(formData.get('currentPassphrase') || ''),
+            nextPassphrase: nextPassphrase,
+          }),
+        });
+        var result = await response.json().catch(function () { return {}; });
+        if (!response.ok || !result.ok) {
+          throw new Error(result.error || '修改口令失败，请重试。');
+        }
+        clearPassphrase();
+        window.location.assign('/login?changed=1');
+      } catch (requestError) {
+        setError(requestError instanceof Error ? requestError.message : '修改口令失败，请重试。');
+      }
+    });
+  }
+
+  function initLogout() {
+    document.querySelectorAll('.auth-logout-form').forEach(function (form) {
+      form.addEventListener('submit', function () {
+        clearPassphrase();
       });
-      var result = await response.json().catch(function () { return {}; });
-      if (!response.ok || !result.ok) {
-        throw new Error(result.error || '修改口令失败，请重试。');
+    });
+  }
+
+  function initLoginPage() {
+    var form = document.querySelector('.auth-login-form');
+    var error = document.querySelector('.auth-login-form .auth-form-error');
+    var passphraseInput = form ? form.querySelector('input[name="passphrase"]') : null;
+    var nextInput = form ? form.querySelector('input[name="next"]') : null;
+    if (!form || !passphraseInput) return;
+
+    function setError(message) {
+      if (!error) return;
+      error.textContent = message || '';
+      error.hidden = !message;
+    }
+
+    async function submitPassphrase(passphrase, auto) {
+      if (!passphrase) return false;
+      if (!auto) setError('');
+      var result = await verifyWithBackend(passphrase);
+      if (!result.ok) {
+        if (auto && !result.unavailable) clearPassphrase();
+        setError(auto && !result.unavailable ? '本地保存的口令已失效，请输入新口令。' : (result.error || '口令不正确，请重试。'));
+        if (!auto) passphraseInput.focus();
+        return false;
       }
-      window.location.assign('/login?changed=1');
-    } catch (requestError) {
-      setError(requestError instanceof Error ? requestError.message : '修改口令失败，请重试。');
+      if (!writePassphrase(passphrase)) {
+        setError('浏览器拒绝保存口令，请检查本地存储权限。');
+        return false;
+      }
+      window.location.replace(safeNextPath(nextInput ? nextInput.value : '/'));
+      return true;
     }
-  });
+
+    form.addEventListener('submit', function (event) {
+      event.preventDefault();
+      submitPassphrase(String(passphraseInput.value || ''), false);
+    });
+
+    var cachedPassphrase = readPassphrase();
+    if (cachedPassphrase) submitPassphrase(cachedPassphrase, true);
+  }
+
+  function initProtectedPage() {
+    ensureAuthorized().then(function (authorized) {
+      if (!authorized) {
+        redirectToLogin();
+        return;
+      }
+      removePendingState();
+      initChangePassword();
+      initLogout();
+    });
+  }
+
+  if (document.body && document.body.classList.contains('auth-page')) {
+    initLoginPage();
+  } else if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', initProtectedPage);
+  } else {
+    initProtectedPage();
+  }
 })();

package/server/static/js/core/doc-client-nav.js

@@ -155,7 +155,24 @@
     article.style.opacity = '0.6';
     article.style.pointerEvents = 'none';
 
-    fetch(absoluteUrl, { headers: { 'X-Requested-With': 'XMLHttpRequest' } })
+    var authCheck = typeof window.docNestEnsureAuthorized === 'function'
+      ? window.docNestEnsureAuthorized()
+      : Promise.resolve(true);
+
+    authCheck.then(function(authorized) {
+      if (!authorized) {
+        if (typeof window.docNestRedirectToLogin === 'function') {
+          window.docNestRedirectToLogin();
+        }
+        var redirectError = new Error('AUTH_REDIRECT');
+        redirectError.redirected = true;
+        throw redirectError;
+      }
+      return fetch(absoluteUrl, {
+        credentials: 'same-origin',
+        headers: { 'X-Requested-With': 'XMLHttpRequest' },
+      });
+    })
       .then(function(res) {
         if (!res.ok) {
           throw new Error('HTTP ' + res.status);
@@ -198,6 +215,7 @@
         }
       })
       .catch(function(err) {
+        if (err && err.redirected) return;
         showNavError('文档加载失败，请稍后重试');
         console.warn('SPA 加载失败，保持当前页面:', err);
       })

package/server/views/login.ejs

@@ -7,6 +7,12 @@
   <link rel="icon" href="/favicon.ico?v=<%= assetVersion %>" sizes="any">
   <link rel="stylesheet" href="/static/css/styles.css?v=<%= assetVersion %>">
   <link rel="stylesheet" href="/static/css/themes.css?v=<%= assetVersion %>">
+  <script>
+    window.DOCNEST_CONFIG = {
+      authEnabled: true,
+      authStorageKey: <%- JSON.stringify(docsAuthStorageKey) %>
+    };
+  </script>
 </head>
 <body class="auth-page">
   <main class="auth-login-card" aria-labelledby="auth-login-title">
@@ -30,12 +36,11 @@
         授权口令
         <input type="password" name="passphrase" autocomplete="current-password" autofocus required>
       </label>
-      <% if (error) { %>
-        <p class="auth-form-error" role="alert"><%= error %></p>
-      <% } %>
+      <p class="auth-form-error" role="alert" id="auth-login-error" <%= error ? '' : 'hidden' %>><%= error %></p>
       <button type="submit" class="auth-primary-btn">进入文档中心</button>
     </form>
     <p class="auth-login-note">没有账号体系，也没有角色区分；口令是唯一的入口。</p>
   </main>
+  <script src="/static/js/core/auth.js?v=<%= assetVersion %>"></script>
 </body>
 </html>

package/server/views/partials/appearance-head.ejs

@@ -1,5 +1,7 @@
 <script>
   window.DOCNEST_CONFIG = {
+    authEnabled: <%= docsAuthEnabled ? 'true' : 'false' %>,
+    authStorageKey: <%- JSON.stringify(docsAuthStorageKey) %>,
     watermarkEnabled: <%= docsWatermarkEnabled ? 'true' : 'false' %>,
     watermarkText: <%- JSON.stringify(docsWatermarkText) %>,
     storageKeyPrefix: <%- JSON.stringify(docsStorageKeyPrefix) %>,
@@ -9,4 +11,7 @@
       enabledThemes: <%- JSON.stringify(docsThemeEnabled) %>
     }
   };
+  if (window.DOCNEST_CONFIG.authEnabled) {
+    document.documentElement.classList.add('docnest-auth-pending');
+  }
 </script>