dsh-webui-oauth 0.7.9 → 0.8.1

package/lib/client.js

@@ -68,6 +68,33 @@ window.__ModuleLoader__.load({
 				if (styleEl.parentNode !== null) styleEl.parentNode.removeChild(styleEl);
 			}, 'dsh-webui-oauth: styles');
 
+			// ---------------- DeepSeek 登录：打开回调中转子窗口 ----------------
+			// 官方登录会新开窗口去 IdP；远程部署回调落在 127.0.0.1，打不开。
+			// 在用户点击「登录」的同一手势里打开中转窗口（避免被弹窗拦截），
+			// 用户授权后把回调 URL 粘进去即可。命中失败时仍有内联粘贴框兜底。
+			(function hookDeepSeekLogin() {
+				if (typeof document === 'undefined' || typeof document.addEventListener !== 'function') return;
+				let last = 0;
+				const handler = (ev) => {
+					try {
+						const target = ev.target;
+						const btn = target && target.closest ? target.closest('button,[role="button"]') : null;
+						if (!btn) return;
+						const label = (btn.textContent || '').trim();
+						if (!/^(登录|Sign in|继续登录|重新登录)$/i.test(label)) return;
+						const scope = btn.closest('[role="dialog"],section,form,div');
+						const text = scope ? (scope.textContent || '') : '';
+						if (!/DeepSeek|账号|Account/i.test(text)) return;
+						const now = Date.now();
+						if (now - last < 1500) return;
+						last = now;
+						window.open('/dsh-webui-oauth/relay-window', 'dsh-wua-relay', 'width=480,height=620');
+					} catch (e) { /* best effort */ }
+				};
+				document.addEventListener('click', handler, true);
+				ctx.effect(() => () => document.removeEventListener('click', handler, true), 'dsh-webui-oauth: deepseek relay hook');
+			})();
+
 			// ---------------- DeepSeek 登录回调：合并进官方「等待登录」对话框 ----------------
 			//
 			// 官方账号登录是 SignInDialog（另一个插件）渲染的，没有开放插槽；但它等待
@@ -105,8 +132,16 @@ window.__ModuleLoader__.load({
 					submit.type = 'button';
 					submit.className = 'wua-btn';
 					submit.textContent = '完成登录';
+					const pop = document.createElement('button');
+					pop.type = 'button';
+					pop.className = 'wua-btn ghost';
+					pop.textContent = '在新窗口打开';
+					pop.addEventListener('click', () => {
+						window.open('/dsh-webui-oauth/relay-window', 'dsh-wua-relay', 'width=480,height=620');
+					});
 					row.appendChild(input);
 					row.appendChild(submit);
+					row.appendChild(pop);
 
 					const msg = document.createElement('p');
 					msg.style.display = 'none';
@@ -276,8 +311,8 @@ window.__ModuleLoader__.load({
 				// （服务端只回传掩码，前端拿不到 sub 明文，也不应该拿）。
 				const [oidcBound, setOidcBound] = react.useState(false);
 				const [oidcBoundHint, setOidcBoundHint] = react.useState('');
-				const [unbindPw, setUnbindPw] = react.useState('');
 				const [bindMsg, setBindMsg] = react.useState(null);
+				const [bindWaiting, setBindWaiting] = react.useState(false);
 				// 敏感操作复验（保存配置 / 禁用 / 解绑）：密码或 SSO 一次性令牌。
 				const [saveOpen, setSaveOpen] = react.useState(false);
 				const [savePw, setSavePw] = react.useState('');
@@ -288,6 +323,13 @@ window.__ModuleLoader__.load({
 				// 远程访问信任开关。
 				const [remoteTrustBusy, setRemoteTrustBusy] = react.useState(false);
 				const [remoteTrustMsg, setRemoteTrustMsg] = react.useState(null);
+				// 设备会话（App / CLI）：独立列表，只有主动吊销才失效。
+				const [sessionList, setSessionList] = react.useState(null);
+				const [sessionBusy, setSessionBusy] = react.useState(false);
+				const [sessionMsg, setSessionMsg] = react.useState(null);
+				const [deviceList, setDeviceList] = react.useState(null);
+				const [deviceBusy, setDeviceBusy] = react.useState(false);
+				const [deviceMsg, setDeviceMsg] = react.useState(null);
 				// 服务端算好的完整回调地址（含 scheme/host/port）。原生 OIDC 要求
 				// redirect_uri 与 IdP 登记值精确匹配，少一个字符都会被拒，所以要显示全。
 				const [oidcRedirectUri, setOidcRedirectUri] = react.useState('');
@@ -330,6 +372,14 @@ window.__ModuleLoader__.load({
 						if (!alive) return;
 						if (r && r.ok && Array.isArray(r.entries)) setAudit(r.entries);
 					}).catch(() => { /* 审计不可用时静默 */ });
+					api('/dsh-webui-oauth/devices').then((r) => {
+						if (!alive) return;
+						if (r && r.ok && Array.isArray(r.devices)) setDeviceList(r.devices);
+					}).catch(() => { /* 设备列表不可用时静默 */ });
+					api('/dsh-webui-oauth/sessions').then((r) => {
+						if (!alive) return;
+						if (r && r.ok && Array.isArray(r.sessions)) setSessionList(r.sessions);
+					}).catch(() => { /* 会话列表不可用时静默 */ });
 					return () => {
 						alive = false;
 					};
@@ -349,6 +399,18 @@ window.__ModuleLoader__.load({
 								if (s && !s.error) setStatus(s);
 							}).catch(() => {});
 						}
+						if (e.data && e.data.type === 'dsh-wua-bound' && e.data.ok) {
+							setBindWaiting(false);
+							api('/dsh-webui-oauth/status').then((s) => {
+								if (s && !s.error) {
+									setStatus(s);
+									const o = s.oidc || {};
+									setOidcBound(!!o.bound);
+									setOidcBoundHint(o.boundSubHint || '');
+								}
+							}).catch(() => {});
+							setBindMsg({ kind: 'ok', text: 'OIDC 身份绑定成功。此后只有该身份可通过 SSO 登录。' });
+						}
 					};
 					window.addEventListener('message', onMessage);
 					return () => window.removeEventListener('message', onMessage);
@@ -455,7 +517,10 @@ window.__ModuleLoader__.load({
 						setBusy(false);
 						if (r && r.ok) {
 							if (enabled) {
-								setMsg({ kind: 'ok', text: '已保存。其他已登录的设备/浏览器会话已全部吊销，当前会话保持有效。' });
+								const text = r.passwordChanged
+									? '已保存。密码已更新，已吊销 ' + (r.revoked || 0) + ' 个其他浏览器会话（设备会话不受影响）。'
+									: '已保存。当前会话保持有效。';
+								setMsg({ kind: 'ok', text });
 							} else {
 								setMsg({ kind: 'ok', text: '已保存并启用认证，当前浏览器已登录。' });
 							}
@@ -564,28 +629,39 @@ window.__ModuleLoader__.load({
 					setBindMsg(null);
 					// base 用当前页面的 origin：反代部署下浏览器看到的才是对外地址。
 					const base = location.origin || '';
-					location.href = '/dsh-webui-oauth/oidc/bind' + (base ? '?base=' + encodeURIComponent(base) : '');
+					const q = base ? '?base=' + encodeURIComponent(base) + '&popup=1' : '?popup=1';
+					const win = window.open('/dsh-webui-oauth/oidc/bind' + q, 'dsh-wua-bind', 'width=520,height=720');
+					if (!win) {
+						// 弹窗被拦截：回退整页跳转（回调会走 oidcbound=1 回执）
+						location.href = '/dsh-webui-oauth/oidc/bind' + (base ? '?base=' + encodeURIComponent(base) : '');
+						return;
+					}
+					setBindWaiting(true);
 				};
 
-				const onUnbind = () => {
+				const doUnbind = (auth) => {
 					if (busy) return;
-					if (!unbindPw) {
-						setBindMsg({ kind: 'err', text: '请输入当前密码以解除绑定' });
+					const credentials = auth || {};
+					if (!credentials.current && !reauthValid) {
+						setSaveErr('解除绑定需要验证：请输入当前密码，或使用 SSO 验证。');
 						return;
 					}
 					setBusy(true);
 					setBindMsg(null);
-					api('/dsh-webui-oauth/oidc/unbind', { current: unbindPw }).then((r) => {
+					api('/dsh-webui-oauth/oidc/unbind', { current: credentials.current || '' }).then((r) => {
 						setBusy(false);
 						if (r && r.ok) {
-							setUnbindPw('');
 							setOidcBound(false);
 							setOidcBoundHint('');
+							setSaveOpen(false);
+							setSavePw('');
+							setSaveErr('');
 							setBindMsg({ kind: 'ok', text: '已解除绑定。此后 OIDC 登录将被拒绝，直到重新绑定。' });
 							api('/dsh-webui-oauth/status').then((s) => {
 								if (s && !s.error) setStatus(s);
 							}).catch(() => {});
 						} else if (r && r.error === 'current-invalid') {
+							setSaveErr('当前密码不正确');
 							setBindMsg({ kind: 'err', text: '当前密码不正确' });
 						} else if (r && r.error === 'sso-only-active') {
 							setBindMsg({ kind: 'err', text: (r && r.hint) || '请先关闭「仅允许 SSO」再解绑' });
@@ -598,6 +674,14 @@ window.__ModuleLoader__.load({
 					});
 				};
 
+				const onUnbindClick = () => {
+					if (busy) return;
+					if (reauthValid) { doUnbind({}); return; }
+					setVerifyAction('unbind');
+					setSaveErr('');
+					setSaveOpen(true);
+				};
+
 				const onLogout = () => {
 					if (busy) return;
 					setBusy(true);
@@ -675,6 +759,54 @@ window.__ModuleLoader__.load({
 					return d.getFullYear() + '-' + pad(d.getMonth() + 1) + '-' + pad(d.getDate()) + ' ' + pad(d.getHours()) + ':' + pad(d.getMinutes());
 				}
 
+				const onRevokeSession = (id) => {
+					if (sessionBusy) return;
+					setSessionBusy(true);
+					setSessionMsg(null);
+					api('/dsh-webui-oauth/sessions/revoke-one', { id }).then((r) => {
+						setSessionBusy(false);
+						if (r && r.ok) {
+							setSessionList((list) => (list || []).filter((s) => s.id !== id));
+							setSessionMsg({ kind: 'ok', text: '已吊销该浏览器会话。' });
+						} else {
+							setSessionMsg({ kind: 'err', text: (r && (r.reason || r.error)) || '吊销失败' });
+						}
+					}).catch(() => {
+						setSessionBusy(false);
+						setSessionMsg({ kind: 'err', text: '无法连接认证服务' });
+					});
+				};
+
+				const refreshSessions = () => {
+					api('/dsh-webui-oauth/sessions').then((r) => {
+						if (r && r.ok && Array.isArray(r.sessions)) setSessionList(r.sessions);
+					}).catch(() => {});
+				};
+
+				const onRevokeDevice = (id) => {
+					if (deviceBusy) return;
+					setDeviceBusy(true);
+					setDeviceMsg(null);
+					api('/dsh-webui-oauth/devices/revoke', { id }).then((r) => {
+						setDeviceBusy(false);
+						if (r && r.ok) {
+							setDeviceList((list) => (list || []).filter((d) => d.id !== id));
+							setDeviceMsg({ kind: 'ok', text: '已吊销该设备会话，对应 token 立即失效。' });
+						} else {
+							setDeviceMsg({ kind: 'err', text: (r && (r.reason || r.error)) || '吊销失败' });
+						}
+					}).catch(() => {
+						setDeviceBusy(false);
+						setDeviceMsg({ kind: 'err', text: '无法连接认证服务' });
+					});
+				};
+
+				const refreshDevices = () => {
+					api('/dsh-webui-oauth/devices').then((r) => {
+						if (r && r.ok && Array.isArray(r.devices)) setDeviceList(r.devices);
+					}).catch(() => {});
+				};
+
 				const onToggleRemoteTrust = () => {
 					if (remoteTrustBusy) return;
 					const next = !remoteTrust;
@@ -825,20 +957,15 @@ window.__ModuleLoader__.load({
 								'。只有该身份可通过 SSO 登录。')
 							: react.createElement('p', { className: 'wua-warn' },
 								'尚未绑定任何 OIDC 身份。此时 OIDC 登录一律被拒绝，登录页也不会显示 SSO 按钮。请先保存上方配置，再点击「绑定 OIDC 身份」并完成一次 IdP 登录。'),
-						oidcBound
-							? react.createElement('div', { className: 'wua-row' },
-								react.createElement('label', { className: 'wua-label' }, '当前密码（解除绑定需验证）'),
-								react.createElement('input', { className: 'wua-input', type: 'password', value: unbindPw, autoComplete: 'current-password', onChange: (e) => setUnbindPw(e.target.value) }),
-							)
-							: null,
 						react.createElement('div', { className: 'wua-actions' },
 							oidcBound
-								? react.createElement('button', { className: 'wua-btn ghost', disabled: busy || status === null, onClick: onUnbind }, '解除绑定')
+								? react.createElement('button', { className: 'wua-btn ghost', disabled: busy || status === null, onClick: onUnbindClick }, '解除绑定')
 								: react.createElement('button', { className: 'wua-btn', disabled: busy || status === null, onClick: onBind }, '绑定 OIDC 身份'),
 							oidcBound
 								? react.createElement('button', { className: 'wua-btn ghost', disabled: busy || status === null, onClick: onBind }, '重新绑定其他身份')
 								: null,
 						),
+						bindWaiting ? react.createElement('p', { className: 'wua-msg' }, '等待绑定…请在打开的窗口中完成 IdP 授权。') : null,
 						bindMsg ? react.createElement('p', { className: bindMsg.kind === 'ok' ? 'wua-msg' : 'wua-err' }, bindMsg.text) : null,
 					]) : null,
 					card('远程访问', [
@@ -861,6 +988,68 @@ window.__ModuleLoader__.load({
 						react.createElement('p', { className: 'wua-hint', style: { borderTop: 'none', paddingTop: 0 } },
 							'在「设置 → 账号」点击 DeepSeek 登录后，浏览器会跳到 127.0.0.1 的回调地址（远程机器上通常打不开）。官方「等待登录」窗口里会直接出现一个粘贴框：把地址栏里的完整 URL 粘进去即可。'),
 					]),
+					card('浏览器会话', [
+						sessionList === null ? null : badge(String(sessionList.length) + ' 个', sessionList.length ? 'ok' : 'muted'),
+					], [
+						react.createElement('p', { className: 'wua-intro' },
+							'当前已登录的浏览器。可单独吊销某个会话；设备会话在下一张卡片单独管理。'),
+						sessionList === null
+							? react.createElement('p', { className: 'wua-intro' }, '正在读取…')
+							: (sessionList.length === 0
+								? react.createElement('p', { className: 'wua-intro' }, '暂无活动的浏览器会话')
+								: react.createElement('div', { className: 'wua-audit' },
+									sessionList.map((s) => react.createElement('div', {
+										key: s.id,
+										className: 'wua-audit-row',
+										style: { alignItems: 'center' },
+									},
+										react.createElement('span', { className: 'wua-audit-event' }, s.current ? '当前会话' : (s.device || '浏览器')),
+										react.createElement('span', { className: 'wua-audit-user' }, [s.os, s.browser].filter(Boolean).join(' · ') || '未知设备'),
+										react.createElement('span', { className: 'wua-audit-time' }, '指纹 ' + (s.fingerprint || '—')),
+										react.createElement('span', { className: 'wua-audit-time' }, '最近 ' + fmtTime(s.lastSeenAt)),
+										react.createElement('span', { style: { flex: 1 } }),
+										react.createElement('button', {
+											className: 'wua-btn ghost',
+											disabled: sessionBusy || s.current,
+											title: s.current ? '当前会话请用「退出登录」' : '吊销该会话',
+											onClick: () => onRevokeSession(s.id),
+										}, s.current ? '当前' : '吊销'),
+									)))),
+						react.createElement('div', { className: 'wua-actions' },
+							react.createElement('button', { className: 'wua-btn ghost', onClick: refreshSessions }, '刷新列表'),
+						),
+						sessionMsg ? react.createElement('p', { className: sessionMsg.kind === 'ok' ? 'wua-msg' : 'wua-err' }, sessionMsg.text) : null,
+					]),
+					card('设备会话（App / CLI）', [
+						deviceList === null ? null : badge(String(deviceList.length) + ' 个', deviceList.length ? 'ok' : 'muted'),
+					], [
+						react.createElement('p', { className: 'wua-intro' },
+							'设备通过 OAuth 2.1 设备授权（无回调）登录。它们与浏览器会话完全独立，不会过期，只有主动吊销才会失效。'),
+						deviceList === null
+							? react.createElement('p', { className: 'wua-intro' }, '正在读取…')
+							: (deviceList.length === 0
+								? react.createElement('p', { className: 'wua-intro' }, '暂无设备会话')
+								: react.createElement('div', { className: 'wua-audit' },
+									deviceList.map((d) => react.createElement('div', {
+										key: d.id,
+										className: 'wua-audit-row',
+										style: { alignItems: 'center' },
+									},
+										react.createElement('span', { className: 'wua-audit-event' }, d.name || '设备'),
+										react.createElement('span', { className: 'wua-audit-time' }, '创建 ' + fmtTime(d.createdAt)),
+										d.lastUsedAt ? react.createElement('span', { className: 'wua-audit-time' }, '最近 ' + fmtTime(d.lastUsedAt)) : null,
+										react.createElement('span', { style: { flex: 1 } }),
+										react.createElement('button', {
+											className: 'wua-btn ghost',
+											disabled: deviceBusy,
+											onClick: () => onRevokeDevice(d.id),
+										}, '吊销'),
+									)))),
+						react.createElement('div', { className: 'wua-actions' },
+							react.createElement('button', { className: 'wua-btn ghost', onClick: refreshDevices }, '刷新列表'),
+						),
+						deviceMsg ? react.createElement('p', { className: deviceMsg.kind === 'ok' ? 'wua-msg' : 'wua-err' }, deviceMsg.text) : null,
+					]),
 					card('最近登录记录', [], [
 						react.createElement('p', { className: 'wua-hint', style: { borderTop: 'none', paddingTop: 0 } },
 							'完整审计日志可用 node index.js audit 查看。'),
@@ -880,7 +1069,10 @@ window.__ModuleLoader__.load({
 					saveOpen ? react.createElement('div', { className: 'wua-modal-mask' },
 						react.createElement('div', { className: 'wua-modal' },
 							react.createElement('h4', { className: 'wua-card-title' },
-								verifyAction === 'disable' ? '验证后禁用' : (verifyAction === 'revoke' ? '验证后吊销会话' : '验证后保存')),
+								verifyAction === 'disable' ? '验证后禁用'
+									: verifyAction === 'revoke' ? '验证后吊销会话'
+										: verifyAction === 'unbind' ? '验证后解绑'
+											: '验证后保存'),
 							react.createElement('p', { className: 'wua-hint', style: { borderTop: 'none', paddingTop: 0 } },
 								reauthValid
 									? '已通过 SSO 验证（2 分钟内有效），可直接继续。'
@@ -898,8 +1090,13 @@ window.__ModuleLoader__.load({
 									const auth = reauthValid ? {} : { current: savePw };
 									if (verifyAction === 'disable') doDisable(auth);
 									else if (verifyAction === 'revoke') doRevoke(auth);
+									else if (verifyAction === 'unbind') doUnbind(auth);
 									else onSave(auth);
-								} }, busy ? '处理中…' : (verifyAction === 'disable' ? '验证并禁用' : (verifyAction === 'revoke' ? '验证并吊销' : '验证并保存'))),
+								} }, busy ? '处理中…' : (
+									verifyAction === 'disable' ? '验证并禁用'
+										: verifyAction === 'revoke' ? '验证并吊销'
+											: verifyAction === 'unbind' ? '验证并解绑'
+												: '验证并保存')),
 								react.createElement('button', { className: 'wua-btn ghost', disabled: busy, onClick: () => setSaveOpen(false) }, '取消'),
 							),
 							(status && status.oidc && status.oidc.enabled && status.oidc.bound)

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "dsh-webui-oauth",
-  "version": "0.7.9",
+  "version": "0.8.1",
   "type": "module",
   "main": "index.js",
   "scripts": {
-    "test": "node test/redirect-scheme.test.mjs && node test/proxy-host.test.mjs && node test/trusted-origin.test.mjs && node test/oidc.test.mjs && node test/oidc-state-ttl.test.mjs && node test/set-cookie-multi.test.mjs && node test/oidc-integration.test.mjs && node test/oidc-config-store.test.mjs && node test/adopt-data-dir.test.mjs && node test/oidc-ec.test.mjs && node test/jwks-refresh.test.mjs && node test/oidc-bind.test.mjs && node test/client-bundle-id.test.mjs && node test/client-prefill.test.mjs && node test/displace-original.test.mjs && node test/oidc-redirect-matrix.test.mjs && node test/gate-default-deny.test.mjs && node test/fallback-shape.test.mjs && node test/desktop-marker.test.mjs && node test/audit-null.test.mjs && node test/remote-trust.test.mjs && node test/oauth-relay.test.mjs && node test/lifecycle.test.mjs"
+    "test": "node test/redirect-scheme.test.mjs && node test/proxy-host.test.mjs && node test/trusted-origin.test.mjs && node test/oidc.test.mjs && node test/oidc-state-ttl.test.mjs && node test/set-cookie-multi.test.mjs && node test/oidc-integration.test.mjs && node test/oidc-config-store.test.mjs && node test/adopt-data-dir.test.mjs && node test/oidc-ec.test.mjs && node test/jwks-refresh.test.mjs && node test/oidc-bind.test.mjs && node test/client-bundle-id.test.mjs && node test/client-prefill.test.mjs && node test/displace-original.test.mjs && node test/oidc-redirect-matrix.test.mjs && node test/gate-default-deny.test.mjs && node test/fallback-shape.test.mjs && node test/desktop-marker.test.mjs && node test/audit-null.test.mjs && node test/remote-trust.test.mjs && node test/oauth-relay.test.mjs && node test/lifecycle.test.mjs && node test/device-flow.test.mjs"
   },
   "exports": {
     ".": "./index.js",