dsh-remote-panel 0.1.0 → 0.1.1

package/deploy/templates/Caddyfile.tmpl

@@ -16,6 +16,14 @@
 	# 第一层：来源白名单
 	@lan remote_ip 127.0.0.1 ::1 @@LAN_CIDR@@ @@VIRTUAL_IP@@
 	handle @lan {
+		# 配对入口：路径匹配（可靠），返回同源页面做一次「同站跳转」。
+		# 跨站导航不会带 SameSite=Strict 的 DSH Cookie，必须由同源页面自己发起。
+		handle /pair {
+			header Set-Cookie "dsh_gate=@@ACCESS_KEY@@; Max-Age=31536000; Path=/; HttpOnly; SameSite=Lax"
+			header Content-Type "text/html; charset=utf-8"
+			respond `<!doctype html><meta charset="utf-8"><title>正在连接…</title><script>const t=new URLSearchParams(location.search).get("token");location.replace(t?"/?token="+encodeURIComponent(t):"/")</script>` 200
+		}
+
 		# 诊断用：不经过任何认证
 		handle /healthz {
 			respond "ok" 200
@@ -26,9 +34,15 @@
 		handle @key {
 			# Cookie 值就是口令本身（24 位随机），而不是常量：常量能被手工伪造
 			header Set-Cookie "dsh_gate=@@ACCESS_KEY@@; Max-Age=31536000; Path=/; HttpOnly; SameSite=Lax"
-			# 显式写 * 匹配器：否则开头的 / 会被当成路径匹配器，
-			# 变成 Location: 303 的怪响应
-			redir * / 303
+
+			# 一张二维码走完两步：带 token 时转发到令牌地址，不带则回首页
+			@withToken query token=*
+			handle @withToken {
+				redir * /?token={query.token} 303
+			}
+			handle {
+				redir * / 303
+			}
 		}
 
 		# Caddy 默认没有 cookie 匹配器，用 Header 通配匹配替代

package/lib/client.js

@@ -651,12 +651,19 @@ window.__ModuleLoader__.load({
 
 		function PairCard() {
 			const [state, setState] = useState({ kind: 'loading' })
+			const [round, setRound] = useState(0)
+
+			// DSH 每次重启都会换令牌；面板开着时自动刷新，避免扫到过期的码
+			useEffect(() => {
+				const timer = setInterval(() => setRound((value) => value + 1), 60000)
+				return () => clearInterval(timer)
+			}, [])
 
 			useEffect(() => {
 				callApi('/pair')
 					.then((data) => setState({ kind: 'ok', data }))
 					.catch((error) => setState({ kind: 'error', message: error.message }))
-			}, [])
+			}, [round])
 
 			const data = state.kind === 'ok' ? state.data : null
 			return jsxs(Card, {
@@ -667,6 +674,7 @@ window.__ModuleLoader__.load({
 							jsx(Dot, { ok: data?.found === true }),
 							jsx('strong', { style: styles.title, children: '手机配对' }),
 							jsx('span', { style: styles.muted, children: state.kind === 'loading' ? '读取中…' : data?.found ? '扫码即可' : '未找到令牌' }),
+							jsx('button', { type: 'button', style: styles.button, onClick: () => setRound((value) => value + 1), children: '刷新' }),
 						],
 					}),
 					state.kind === 'error' && jsx('p', { style: styles.muted, children: state.message }),
@@ -685,20 +693,40 @@ window.__ModuleLoader__.load({
 								jsxs('div', {
 									style: { display: 'flex', flexDirection: 'column', gap: 6, flex: 1, minWidth: 210 },
 									children: [
-										jsx('span', { style: styles.hint, children: '① 门禁（一年）' }),
+										jsx('span', { style: styles.hint, children: '扫这一张即可：先种门禁（一年），再自动跳到令牌' }),
+										// 二维码编的就是这条组合链接，显示同一个值，别再换成别的
 										jsx('code', {
-											style: { ...styles.code, maxHeight: 56 },
-											children: data.urls.gate ?? '（回填码未含口令）',
+											style: { ...styles.code, maxHeight: 72 },
+											children: data.urls.combo ?? data.urls.token,
 										}),
-										jsx('span', { style: styles.hint, children: '② 令牌（30 天 Cookie）' }),
-										jsx('code', { style: { ...styles.code, maxHeight: 56 }, children: data.urls.token }),
 										jsxs('div', {
 											style: styles.row,
 											children: [
-												jsx(CopyButton, { text: data.urls.token, label: '复制令牌链接' }),
-												data.urls.gate
-													? jsx(CopyButton, { text: data.urls.gate, label: '复制门禁链接' })
-													: null,
+												jsx(CopyButton, { text: data.urls.combo ?? data.urls.token, label: '复制配对链接' }),
+											],
+										}),
+										jsx('details', {
+											children: [
+												jsx('summary', { style: styles.hint, children: '手动备用（门禁 / 令牌分开用）' }),
+												jsxs('div', {
+													style: { display: 'flex', flexDirection: 'column', gap: 6, marginTop: 6 },
+													children: [
+														jsx('code', {
+															style: { ...styles.code, maxHeight: 56 },
+															children: data.urls.gate ?? '（回填码未含口令）',
+														}),
+														jsx('code', { style: { ...styles.code, maxHeight: 56 }, children: data.urls.token }),
+														jsxs('div', {
+															style: styles.row,
+															children: [
+																jsx(CopyButton, { text: data.urls.token, label: '复制令牌链接' }),
+																data.urls.gate
+																	? jsx(CopyButton, { text: data.urls.gate, label: '复制门禁链接' })
+																	: null,
+															],
+														}),
+													],
+												}),
 											],
 										}),
 									],

package/lib/index.js

@@ -115,7 +115,7 @@ routes.set('GET /pair', async () => {
 		found: token !== undefined,
 		upstream,
 		urls,
-		qr: token === undefined ? null : await renderQr(urls.token),
+		qr: urls.combo === undefined ? null : await renderQr(urls.combo),
 	}
 })
 

package/lib/pair.js

@@ -92,9 +92,18 @@ export async function findToken(options) {
  */
 export function pairingUrls({ ip, port, accessKey, token }) {
 	const base = `http://${ip}:${port}`
+	const gate = accessKey === undefined ? undefined : `${base}/?k=${accessKey}`
+	const tokenUrl = token === undefined ? undefined : `${base}/?token=${token}`
 	return {
-		gate: accessKey === undefined ? undefined : `${base}/?k=${accessKey}`,
-		token: token === undefined ? undefined : `${base}/?token=${token}`,
+		gate,
+		token: tokenUrl,
+		// 一张二维码走完两步：先种门禁 Cookie，再由 Caddy 转发到令牌地址
+		// 走专用路径：Caddy 会回一个同源页面，由它发起跳转——
+		// 跨站导航不会携带 SameSite=Strict 的 DSH Cookie，非要同源页面自己发起才行
+		combo:
+			accessKey !== undefined && token !== undefined
+				? `${base}/pair?k=${accessKey}&token=${token}`
+				: undefined,
 	}
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-panel",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "DSH 远程访问控制面：部署向导、状态面板与一键配对（EasyTier + Caddy），数据面保持进程外。",
   "type": "module",
   "main": "./lib/index.js",