docnest 0.1.9 → 0.1.11

package/README.md

@@ -68,6 +68,7 @@ export default defineConfig({
     enabled: true,
     passphrase: '请替换为项目自己的长口令',
     stateFile: '.docnest/auth.json',
+    localStorageKey: 'my-project:auth-passphrase',
     sessionTtlMinutes: 24 * 60,
   },
 })
@@ -75,7 +76,8 @@ export default defineConfig({
 
 授权只有一道关口，没有账号、密码组合或角色体系。首次启动时，`passphrase` 会初始化到由
 `stateFile` 指定的本地授权状态文件；状态文件只保存带随机盐的口令哈希，不保存明文口令。
-进入文档中心后，右上角的“修改口令”可以动态更新口令。修改后所有现有会话立即失效，必须使用新口令重新进入。
+按极简模式约定，前端会把可回填的口令永久保存到浏览器 `localStorage`（不写入 URL）；每次打开或刷新文档页面，前端都会把当前缓存的口令交给后台重新校验。校验失败会回到口令页，校验成功才会继续打开当前页面；输入页会保留跳转前的目标地址，错误口令会停留在输入页。由于 `localStorage` 是浏览器本地明文存储，请只在受信任的浏览器环境使用此模式。
+`localStorageKey` 可选，用于为不同宿主项目隔离浏览器存储键。内置授权不提供“修改口令”或“退出”按钮；需要更换口令时，停止服务、删除 `stateFile`，修改配置中的 `passphrase` 后重新启动。
 建议把 `.docnest/` 加入宿主项目的 `.gitignore`，并为口令状态文件设置仅当前用户可读写的权限。
 
 授权开启但既没有状态文件，也没有初始 `passphrase` 时，DocNest 会拒绝启动，避免意外以空口令开放文档。

package/dist/auth.d.ts

@@ -12,7 +12,5 @@ export type DocNestAuthManager = {
     verifyPassphrase: (passphrase: string) => boolean;
     createSession: (passphrase: string) => string | null;
     authenticateSession: (token: string | undefined) => boolean;
-    revokeSession: (token: string | undefined) => void;
-    changePassphrase: (currentPassphrase: string, nextPassphrase: string) => boolean;
 };
 export declare function createAuthManager(config: DocNestAuthConfig): DocNestAuthManager;

package/dist/auth.js

@@ -130,11 +130,9 @@ function createAuthManager(config) {
             verifyPassphrase: () => true,
             createSession: () => null,
             authenticateSession: () => true,
-            revokeSession: () => undefined,
-            changePassphrase: () => false,
         };
     }
-    let state = readOrCreateState(config);
+    const state = readOrCreateState(config);
     function verifyPassphrase(passphrase) {
         return matchesHash(passphrase, state);
     }
@@ -163,19 +161,6 @@ function createAuthManager(config) {
         session.expiresAt = Date.now() + sessionMaxAgeSeconds * 1000;
         return true;
     }
-    function revokeSession(token) {
-        if (token)
-            sessions.delete(token);
-    }
-    function changePassphrase(currentPassphrase, nextPassphrase) {
-        if (!verifyPassphrase(currentPassphrase))
-            return false;
-        assertPassphrase(nextPassphrase, '新授权口令');
-        state = createState(nextPassphrase);
-        writeState(config.stateFile, state);
-        sessions.clear();
-        return true;
-    }
     return {
         enabled,
         stateFile: config.stateFile,
@@ -184,7 +169,5 @@ function createAuthManager(config) {
         verifyPassphrase,
         createSession,
         authenticateSession,
-        revokeSession,
-        changePassphrase,
     };
 }

package/dist/config.d.ts

@@ -29,6 +29,7 @@ export type DocNestConfig = {
         enabled?: boolean;
         passphrase?: string;
         stateFile?: string;
+        localStorageKey?: string;
         sessionTtlMinutes?: number;
     };
     export?: {
@@ -50,6 +51,7 @@ export type ResolvedDocNestConfig = Required<DocNestConfig> & {
         enabled: boolean;
         passphrase: string;
         stateFile: string;
+        localStorageKey: string;
         sessionTtlMinutes: number;
     };
     export: {

package/dist/config.js

@@ -89,6 +89,7 @@ async function loadConfig(projectRoot = process.cwd()) {
     const auth = userConfig.auth ?? {};
     const watermark = userConfig.export?.watermark ?? {};
     const storageKeyPrefix = site.storageKeyPrefix?.trim() || `docnest:${projectName}`;
+    const authLocalStorageKey = auth.localStorageKey?.trim() || `${storageKeyPrefix}:auth-passphrase`;
     return {
         projectRoot,
         docsDir: node_path_1.default.resolve(projectRoot, userConfig.docsDir?.trim() || 'docs'),
@@ -114,6 +115,7 @@ async function loadConfig(projectRoot = process.cwd()) {
             enabled: auth.enabled ?? false,
             passphrase: typeof auth.passphrase === 'string' ? auth.passphrase : '',
             stateFile: node_path_1.default.resolve(projectRoot, auth.stateFile?.trim() || '.docnest/auth.json'),
+            localStorageKey: authLocalStorageKey,
             sessionTtlMinutes: normalizePositiveNumber(auth.sessionTtlMinutes, 24 * 60),
         },
         export: {

package/dist/server.js

@@ -92,6 +92,7 @@ const AUTH_CONFIG = globalThis.__DOCNEST_AUTH_CONFIG__ || {
     enabled: false,
     passphrase: '',
     stateFile: path.join(process.cwd(), '.docnest', 'auth.json'),
+    localStorageKey: `${DOCS_STORAGE_KEY_PREFIX}:auth-passphrase`,
     sessionTtlMinutes: 24 * 60,
 };
 const AUTH_MANAGER = createAuthManager(AUTH_CONFIG);
@@ -110,6 +111,7 @@ app.locals.docsThemeEnabled = DOCS_THEME_ENABLED;
 app.locals.docsWatermarkEnabled = DOCS_WATERMARK_ENABLED;
 app.locals.docsWatermarkText = DOCS_WATERMARK_TEXT;
 app.locals.docsAuthEnabled = BUILT_IN_AUTH_ENABLED;
+app.locals.docsAuthStorageKey = AUTH_CONFIG.localStorageKey || `${DOCS_STORAGE_KEY_PREFIX}:auth-passphrase`;
 function normalizeDocRelativePath(value) {
     const raw = String(value || '').replace(/\\/g, '/').replace(/^\/+/, '');
     const normalized = path.posix.normalize(raw);
@@ -295,13 +297,18 @@ function renderLoginPage(res, nextPath, error, status = 200) {
 app.get('/login', (req, res) => {
     if (!BUILT_IN_AUTH_ENABLED)
         return res.redirect('/');
-    if (AUTH_MANAGER.authenticateSession(readAuthToken(req))) {
-        return res.redirect(safeNextPath(req.query.next));
+    return renderLoginPage(res, req.query.next, '');
+});
+app.post('/auth/verify', (req, res) => {
+    if (!BUILT_IN_AUTH_ENABLED)
+        return res.json({ ok: true });
+    const token = AUTH_MANAGER.createSession(String(req.body?.passphrase || ''));
+    if (!token) {
+        clearAuthCookie(res);
+        return res.status(401).json({ ok: false, error: '口令不正确，请重试。' });
     }
-    const message = req.query.changed
-        ? '口令已更新，请使用新口令重新进入。'
-        : '';
-    return renderLoginPage(res, req.query.next, message);
+    setAuthCookie(res, token);
+    return res.json({ ok: true });
 });
 app.post('/auth/login', (req, res) => {
     if (!BUILT_IN_AUTH_ENABLED)
@@ -313,29 +320,6 @@ app.post('/auth/login', (req, res) => {
     setAuthCookie(res, token);
     return res.redirect(nextPath);
 });
-app.post('/auth/logout', (req, res) => {
-    AUTH_MANAGER.revokeSession(readAuthToken(req));
-    clearAuthCookie(res);
-    return res.redirect('/login');
-});
-app.post('/auth/change-password', (req, res) => {
-    if (!BUILT_IN_AUTH_ENABLED || !AUTH_MANAGER.authenticateSession(readAuthToken(req))) {
-        return res.status(401).json({ ok: false, error: '当前会话未授权。' });
-    }
-    try {
-        const changed = AUTH_MANAGER.changePassphrase(String(req.body?.currentPassphrase || ''), String(req.body?.nextPassphrase || ''));
-        if (!changed)
-            return res.status(401).json({ ok: false, error: '当前口令不正确。' });
-        clearAuthCookie(res);
-        return res.json({ ok: true });
-    }
-    catch (error) {
-        return res.status(400).json({
-            ok: false,
-            error: error instanceof Error ? error.message : '新口令无效。',
-        });
-    }
-});
 function documentAuthMiddleware(req, res, next) {
     if (!BUILT_IN_AUTH_ENABLED)
         return next();

package/docnest.config.example.mjs

@@ -34,9 +34,11 @@ export default defineConfig({
   auth: {
     // 极简单口令授权；关闭时文档中心保持本地开放。
     enabled: false,
-    // 仅首次启动且授权状态文件不存在时使用，之后可在页面内修改。
+    // 仅首次启动且授权状态文件不存在时使用；更换口令需手动删除状态文件后重启。
     passphrase: '',
     stateFile: '.docnest/auth.json',
+    // 前端 localStorage 的键；口令会永久保存在浏览器本地，直到手动清除或口令失效。
+    localStorageKey: 'my-project:auth-passphrase',
     sessionTtlMinutes: 24 * 60,
   },
   export: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docnest",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "可复用的本地 Markdown 文档中心",
   "repository": {
     "type": "git",

package/server/static/css/styles.css

@@ -5762,43 +5762,22 @@ body[data-theme="dark"] .dir-listing-count {
 }
 
 /* 极简单口令授权 */
-.auth-actions {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4rem;
-}
-
-.auth-logout-form {
-  display: inline-flex;
-  margin: 0;
-}
-
-.auth-change-password-btn,
-.auth-logout-btn {
-  white-space: nowrap;
-}
-
-.auth-modal[hidden] {
-  display: none;
+html.docnest-auth-pending body > * {
+  visibility: hidden;
 }
 
-.auth-modal {
+html.docnest-auth-pending::before {
+  content: '正在校验授权…';
   position: fixed;
   inset: 0;
-  z-index: 1000;
+  z-index: 2000;
   display: grid;
   place-items: center;
-  padding: 1.25rem;
-}
-
-.auth-modal-backdrop {
-  position: absolute;
-  inset: 0;
-  background: rgba(10, 16, 24, 0.42);
-  backdrop-filter: blur(4px);
+  color: var(--linear-text-muted, #63727f);
+  background: var(--linear-bg, #ffffff);
+  font-size: 0.9rem;
 }
 
-.auth-modal-card,
 .auth-login-card {
   position: relative;
   z-index: 1;
@@ -5809,25 +5788,11 @@ body[data-theme="dark"] .dir-listing-count {
   box-shadow: 0 24px 70px rgba(17, 29, 40, 0.2);
 }
 
-.auth-modal-card {
-  width: min(100%, 440px);
-  padding: 1.5rem;
-}
-
-.auth-modal-header {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-}
-
-.auth-modal-header h2,
 .auth-login-card h1 {
   margin: 0;
   color: var(--linear-text, #18212a);
 }
 
-.auth-modal-eyebrow,
 .auth-login-eyebrow {
   margin: 0 0 0.35rem;
   color: var(--linear-accent, #267c83);
@@ -5836,35 +5801,12 @@ body[data-theme="dark"] .dir-listing-count {
   letter-spacing: 0.12em;
 }
 
-.auth-modal-close {
-  width: 2rem;
-  height: 2rem;
-  padding: 0;
-  border: 0;
-  border-radius: 999px;
-  color: var(--linear-text-muted, #63727f);
-  background: transparent;
-  font-size: 1.5rem;
-  line-height: 1;
-  cursor: pointer;
-}
-
-.auth-modal-close:hover {
-  background: var(--linear-bg-subtle, #eef2f5);
-}
-
-.auth-modal-help,
 .auth-login-description,
 .auth-login-note {
   color: var(--linear-text-muted, #63727f);
   line-height: 1.6;
 }
 
-.auth-modal-help {
-  margin: 1rem 0 1.25rem;
-  font-size: 0.875rem;
-}
-
 .auth-form {
   display: grid;
   gap: 0.9rem;
@@ -5904,15 +5846,7 @@ body[data-theme="dark"] .dir-listing-count {
   font-size: 0.875rem;
 }
 
-.auth-modal-actions {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.6rem;
-  margin-top: 0.25rem;
-}
-
-.auth-primary-btn,
-.auth-secondary-btn {
+.auth-primary-btn {
   min-height: 2.5rem;
   padding: 0.55rem 0.95rem;
   border-radius: 8px;
@@ -5927,12 +5861,6 @@ body[data-theme="dark"] .dir-listing-count {
   background: var(--linear-accent, #267c83);
 }
 
-.auth-secondary-btn {
-  border: 1px solid var(--linear-border, #d7dee5);
-  color: var(--linear-text, #18212a);
-  background: var(--linear-bg-subtle, #eef2f5);
-}
-
 .auth-page {
   min-height: 100vh;
   display: grid;
@@ -5994,16 +5922,3 @@ body[data-theme="dark"] .dir-listing-count {
   font-size: 0.75rem;
   text-align: center;
 }
-
-@media (max-width: 768px) {
-  .auth-actions {
-    gap: 0.25rem;
-  }
-
-  .auth-change-password-btn,
-  .auth-logout-btn {
-    min-width: 44px;
-    padding-inline: 0.5rem;
-    font-size: 0.75rem;
-  }
-}

package/server/static/js/core/auth.js

@@ -1,61 +1,152 @@
 (function () {
-  var modal = document.getElementById('auth-change-password-modal');
-  var openButton = document.getElementById('auth-change-password-btn');
-  var form = document.getElementById('auth-change-password-form');
-  var error = document.getElementById('auth-change-password-error');
-  if (!modal || !openButton || !form) return;
-
-  var closeButtons = modal.querySelectorAll('[data-auth-close]');
-
-  function setError(message) {
-    if (!error) return;
-    error.textContent = message || '';
-    error.hidden = !message;
-  }
-
-  function closeModal() {
-    modal.hidden = true;
-    setError('');
-    form.reset();
-  }
-
-  openButton.addEventListener('click', function () {
-    modal.hidden = false;
-    var firstInput = form.querySelector('input');
-    if (firstInput) firstInput.focus();
-  });
-
-  closeButtons.forEach(function (button) {
-    button.addEventListener('click', closeModal);
-  });
-
-  form.addEventListener('submit', async function (event) {
-    event.preventDefault();
-    setError('');
-    var formData = new FormData(form);
-    var nextPassphrase = String(formData.get('nextPassphrase') || '');
-    var confirmPassphrase = String(formData.get('confirmPassphrase') || '');
-    if (nextPassphrase !== confirmPassphrase) {
-      setError('两次输入的新口令不一致。');
-      return;
+  var config = window.DOCNEST_CONFIG || {};
+  if (config.authEnabled !== true) return;
+
+  var storageKey = config.authStorageKey || 'docnest:auth-passphrase';
+  var verificationPromise = null;
+
+  function readPassphrase() {
+    try {
+      return window.localStorage.getItem(storageKey) || '';
+    } catch (error) {
+      return '';
+    }
+  }
+
+  function writePassphrase(passphrase) {
+    try {
+      window.localStorage.setItem(storageKey, passphrase);
+      return true;
+    } catch (error) {
+      return false;
     }
+  }
 
+  function clearPassphrase() {
     try {
-      var response = await fetch('/auth/change-password', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-        body: JSON.stringify({
-          currentPassphrase: String(formData.get('currentPassphrase') || ''),
-          nextPassphrase: nextPassphrase,
-        }),
+      window.localStorage.removeItem(storageKey);
+    } catch (error) {
+      // The browser may block storage; the next request will simply ask again.
+    }
+  }
+
+  function currentPageUrl() {
+    return window.location.pathname + window.location.search + window.location.hash;
+  }
+
+  function safeNextPath(value) {
+    if (
+      typeof value !== 'string' ||
+      value.charAt(0) !== '/' ||
+      value.indexOf('//') === 0 ||
+      value.indexOf('\\') !== -1 ||
+      /[\r\n]/.test(value)
+    ) return '/';
+    return value;
+  }
+
+  function redirectToLogin() {
+    var next = encodeURIComponent(currentPageUrl() || '/');
+    window.location.replace('/login?next=' + next);
+  }
+
+  function verifyWithBackend(passphrase) {
+    return fetch('/auth/verify', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify({ passphrase: passphrase }),
+    }).then(function (response) {
+      return response.json().catch(function () { return {}; }).then(function (result) {
+        return { ok: response.ok && result.ok === true, error: result.error || '', unavailable: false };
       });
-      var result = await response.json().catch(function () { return {}; });
-      if (!response.ok || !result.ok) {
-        throw new Error(result.error || '修改口令失败，请重试。');
+    }).catch(function () {
+      return { ok: false, error: '无法连接授权服务，请稍后重试。', unavailable: true };
+    });
+  }
+
+  function ensureAuthorized() {
+    if (verificationPromise) return verificationPromise;
+    var passphrase = readPassphrase();
+    if (!passphrase) return Promise.resolve(false);
+
+    verificationPromise = verifyWithBackend(passphrase).then(function (result) {
+      if (!result.ok) {
+        clearPassphrase();
+        return false;
       }
-      window.location.assign('/login?changed=1');
-    } catch (requestError) {
-      setError(requestError instanceof Error ? requestError.message : '修改口令失败，请重试。');
+      return true;
+    }).finally(function () {
+      verificationPromise = null;
+    });
+    return verificationPromise;
+  }
+
+  window.docNestEnsureAuthorized = ensureAuthorized;
+  window.docNestRedirectToLogin = redirectToLogin;
+
+  function removePendingState() {
+    document.documentElement.classList.remove('docnest-auth-pending');
+  }
+
+  function initLoginPage() {
+    var form = document.querySelector('.auth-login-form');
+    var error = document.querySelector('.auth-login-form .auth-form-error');
+    var passphraseInput = form ? form.querySelector('input[name="passphrase"]') : null;
+    var nextInput = form ? form.querySelector('input[name="next"]') : null;
+    if (!form || !passphraseInput) return;
+
+    function setError(message) {
+      if (!error) return;
+      error.textContent = message || '';
+      error.hidden = !message;
     }
-  });
+
+    async function submitPassphrase(passphrase, auto) {
+      if (!passphrase) return false;
+      if (!auto) setError('');
+      var result = await verifyWithBackend(passphrase);
+      if (!result.ok) {
+        if (auto && !result.unavailable) clearPassphrase();
+        setError(auto && !result.unavailable ? '本地保存的口令已失效，请输入新口令。' : (result.error || '口令不正确，请重试。'));
+        if (!auto) passphraseInput.focus();
+        return false;
+      }
+      if (!writePassphrase(passphrase)) {
+        setError('浏览器拒绝保存口令，请检查本地存储权限。');
+        return false;
+      }
+      window.location.replace(safeNextPath(nextInput ? nextInput.value : '/'));
+      return true;
+    }
+
+    form.addEventListener('submit', function (event) {
+      event.preventDefault();
+      submitPassphrase(String(passphraseInput.value || ''), false);
+    });
+
+    var cachedPassphrase = readPassphrase();
+    if (cachedPassphrase) submitPassphrase(cachedPassphrase, true);
+  }
+
+  function initProtectedPage() {
+    ensureAuthorized().then(function (authorized) {
+      if (!authorized) {
+        redirectToLogin();
+        return;
+      }
+      removePendingState();
+    });
+  }
+
+  if (document.body && document.body.classList.contains('auth-page')) {
+    initLoginPage();
+  } else if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', initProtectedPage);
+  } else {
+    initProtectedPage();
+  }
 })();

package/server/static/js/core/doc-client-nav.js

@@ -155,7 +155,24 @@
     article.style.opacity = '0.6';
     article.style.pointerEvents = 'none';
 
-    fetch(absoluteUrl, { headers: { 'X-Requested-With': 'XMLHttpRequest' } })
+    var authCheck = typeof window.docNestEnsureAuthorized === 'function'
+      ? window.docNestEnsureAuthorized()
+      : Promise.resolve(true);
+
+    authCheck.then(function(authorized) {
+      if (!authorized) {
+        if (typeof window.docNestRedirectToLogin === 'function') {
+          window.docNestRedirectToLogin();
+        }
+        var redirectError = new Error('AUTH_REDIRECT');
+        redirectError.redirected = true;
+        throw redirectError;
+      }
+      return fetch(absoluteUrl, {
+        credentials: 'same-origin',
+        headers: { 'X-Requested-With': 'XMLHttpRequest' },
+      });
+    })
       .then(function(res) {
         if (!res.ok) {
           throw new Error('HTTP ' + res.status);
@@ -198,6 +215,7 @@
         }
       })
       .catch(function(err) {
+        if (err && err.redirected) return;
         showNavError('文档加载失败，请稍后重试');
         console.warn('SPA 加载失败，保持当前页面:', err);
       })

package/server/views/login.ejs

@@ -7,6 +7,12 @@
   <link rel="icon" href="/favicon.ico?v=<%= assetVersion %>" sizes="any">
   <link rel="stylesheet" href="/static/css/styles.css?v=<%= assetVersion %>">
   <link rel="stylesheet" href="/static/css/themes.css?v=<%= assetVersion %>">
+  <script>
+    window.DOCNEST_CONFIG = {
+      authEnabled: true,
+      authStorageKey: <%- JSON.stringify(docsAuthStorageKey) %>
+    };
+  </script>
 </head>
 <body class="auth-page">
   <main class="auth-login-card" aria-labelledby="auth-login-title">
@@ -30,12 +36,11 @@
         授权口令
         <input type="password" name="passphrase" autocomplete="current-password" autofocus required>
       </label>
-      <% if (error) { %>
-        <p class="auth-form-error" role="alert"><%= error %></p>
-      <% } %>
+      <p class="auth-form-error" role="alert" id="auth-login-error" <%= error ? '' : 'hidden' %>><%= error %></p>
       <button type="submit" class="auth-primary-btn">进入文档中心</button>
     </form>
     <p class="auth-login-note">没有账号体系，也没有角色区分；口令是唯一的入口。</p>
   </main>
+  <script src="/static/js/core/auth.js?v=<%= assetVersion %>"></script>
 </body>
 </html>

package/server/views/partials/appearance-head.ejs

@@ -1,5 +1,7 @@
 <script>
   window.DOCNEST_CONFIG = {
+    authEnabled: <%= docsAuthEnabled ? 'true' : 'false' %>,
+    authStorageKey: <%- JSON.stringify(docsAuthStorageKey) %>,
     watermarkEnabled: <%= docsWatermarkEnabled ? 'true' : 'false' %>,
     watermarkText: <%- JSON.stringify(docsWatermarkText) %>,
     storageKeyPrefix: <%- JSON.stringify(docsStorageKeyPrefix) %>,
@@ -9,4 +11,7 @@
       enabledThemes: <%- JSON.stringify(docsThemeEnabled) %>
     }
   };
+  if (window.DOCNEST_CONFIG.authEnabled) {
+    document.documentElement.classList.add('docnest-auth-pending');
+  }
 </script>

package/server/views/partials/header.ejs

@@ -54,52 +54,10 @@
           <span class="theme-icon" aria-hidden="true">A</span>
           <span class="theme-text">跟随系统</span>
         </button>
-        <% if (docsAuthEnabled) { %>
-          <div class="auth-actions" aria-label="文档授权">
-            <button id="auth-change-password-btn" class="header-action-btn auth-change-password-btn" type="button">
-              修改口令
-            </button>
-            <form action="/auth/logout" method="post" class="auth-logout-form">
-              <button class="header-action-btn auth-logout-btn" type="submit">退出</button>
-            </form>
-          </div>
-        <% } %>
       </div>
     </div>
   </div>
 </header>
 <% if (docsAuthEnabled) { %>
-  <div class="auth-modal" id="auth-change-password-modal" hidden>
-    <div class="auth-modal-backdrop" data-auth-close></div>
-    <section class="auth-modal-card" role="dialog" aria-modal="true" aria-labelledby="auth-change-password-title">
-      <div class="auth-modal-header">
-        <div>
-          <p class="auth-modal-eyebrow">DOCUMENT ACCESS</p>
-          <h2 id="auth-change-password-title">修改授权口令</h2>
-        </div>
-        <button type="button" class="auth-modal-close" data-auth-close aria-label="关闭">×</button>
-      </div>
-      <p class="auth-modal-help">修改后所有已打开的文档会退出授权，需要使用新口令重新进入。</p>
-      <form id="auth-change-password-form" class="auth-form">
-        <label>
-          当前口令
-          <input type="password" name="currentPassphrase" autocomplete="current-password" required>
-        </label>
-        <label>
-          新口令
-          <input type="password" name="nextPassphrase" autocomplete="new-password" required>
-        </label>
-        <label>
-          确认新口令
-          <input type="password" name="confirmPassphrase" autocomplete="new-password" required>
-        </label>
-        <p class="auth-form-error" id="auth-change-password-error" role="alert" hidden></p>
-        <div class="auth-modal-actions">
-          <button type="button" class="auth-secondary-btn" data-auth-close>取消</button>
-          <button type="submit" class="auth-primary-btn">保存新口令</button>
-        </div>
-      </form>
-    </section>
-  </div>
   <script src="/static/js/core/auth.js?v=<%= typeof assetVersion !== 'undefined' ? assetVersion : 'dev' %>"></script>
 <% } %>