openxiangda 1.0.149 → 1.0.150

package/packages/sdk/dist/runtime/index.cjs

@@ -43,6 +43,7 @@ __export(runtime_exports, {
   ProcessTimeline: () => ProcessTimeline,
   PublicAccessClientError: () => PublicAccessClientError,
   PublicAccessGate: () => PublicAccessGate,
+  RuntimeAuthGuard: () => RuntimeAuthGuard,
   createAuthClient: () => createAuthClient,
   createBrowserPageBridge: () => createBrowserPageBridge,
   createBrowserPageContext: () => createBrowserPageContext,
@@ -5581,14 +5582,14 @@ var useAuth = (options = {}) => {
     () => createAuthClient({
       appType: options.appType || runtime.appType,
       servicePrefix: options.servicePrefix || runtime.servicePrefix,
-      fetchImpl: options.fetchImpl || runtime.fetchImpl
+      fetchImpl: options.fetchImpl || runtime.baseFetchImpl
     }),
     [
       options.appType,
       options.fetchImpl,
       options.servicePrefix,
       runtime.appType,
-      runtime.fetchImpl,
+      runtime.baseFetchImpl,
       runtime.servicePrefix
     ]
   );
@@ -5867,7 +5868,19 @@ var LoginPage = ({
   };
   async function handleSuccess(data) {
     await onSuccess?.(data);
-    await runtime.reload();
+    const accessToken = data.accessToken || data.token;
+    const accessTokenOptions = {
+      expiresAt: data.accessTokenExpiresAt
+    };
+    if (accessToken) {
+      runtime.setAccessToken(accessToken, accessTokenOptions);
+    }
+    await runtime.reload(
+      accessToken ? {
+        accessToken,
+        accessTokenOptions
+      } : void 0
+    );
     if (redirectOnSuccess && typeof window !== "undefined") {
       window.location.replace(
         redirectUrl || getCallbackUrl() || `/view/${auth.client.appType}`
@@ -6151,27 +6164,125 @@ var OpenXiangdaProvider = ({
     () => appType || resolveAppTypeFromLocation(),
     [appType]
   );
-  const [accessToken, setAccessTokenState] = (0, import_react14.useState)(null);
+  const [, setAccessTokenState] = (0, import_react14.useState)(null);
+  const [authState, setAuthState] = (0, import_react14.useState)({
+    status: "unknown",
+    error: null
+  });
   const accessTokenRef = (0, import_react14.useRef)(null);
-  const setAccessToken = (0, import_react14.useCallback)(
+  const refreshRequestRef = (0, import_react14.useRef)(null);
+  const applyAccessToken = (0, import_react14.useCallback)(
     (nextAccessToken, options = {}) => {
       if (!nextAccessToken && options.clearIfToken && accessTokenRef.current?.token !== options.clearIfToken) {
-        return;
+        return accessTokenRef.current;
       }
       const normalizedAccessToken = nextAccessToken || null;
       const nextState = normalizedAccessToken ? {
         token: normalizedAccessToken,
         scope: options.scope || "default",
-        path: options.path || null
+        path: options.path || null,
+        expiresAt: options.expiresAt
       } : null;
       accessTokenRef.current = nextState;
       setAccessTokenState(nextState);
+      return nextState;
     },
     []
   );
+  const setAccessToken = (0, import_react14.useCallback)(
+    (nextAccessToken, options = {}) => {
+      const previousState = accessTokenRef.current;
+      const nextState = applyAccessToken(nextAccessToken, options);
+      if (nextState) {
+        if (nextState.scope === "public") return;
+        setAuthState({
+          status: "authenticated",
+          error: null
+        });
+      } else if (previousState?.scope !== "public") {
+        setAuthState({ status: "unauthenticated", error: null });
+      }
+    },
+    [applyAccessToken]
+  );
+  const markUnauthenticated = (0, import_react14.useCallback)(
+    (error) => {
+      const runtimeError = normalizeRuntimeError(error);
+      applyAccessToken(null);
+      setAuthState({ status: "unauthenticated", error: runtimeError });
+    },
+    [applyAccessToken]
+  );
+  const refreshAccessToken = (0, import_react14.useCallback)(async () => {
+    if (!resolvedAppType) return null;
+    if (!refreshRequestRef.current) {
+      setAuthState((prev) => ({ ...prev, status: "refreshing", error: null }));
+      refreshRequestRef.current = (async () => {
+        const response = await resolvedFetch(
+          buildServiceUrl3(
+            servicePrefix,
+            `/openxiangda-api/v1/apps/${encodeURIComponent(
+              resolvedAppType
+            )}/auth/refresh`
+          ),
+          {
+            method: "POST",
+            credentials: "include",
+            headers: {
+              accept: "application/json",
+              "content-type": "application/json"
+            },
+            body: "{}"
+          }
+        );
+        const payload = await readJsonPayload(response);
+        if (isRuntimeEnvelopeFailure(response, payload)) {
+          throw createRuntimeHttpError(
+            response,
+            payload,
+            payload?.message || `Token refresh failed: ${response.status}`
+          );
+        }
+        const data = unwrapRuntimePayload(payload);
+        const nextAccessToken = getRecordString(data, "accessToken") || getRecordString(data, "token");
+        if (!nextAccessToken) {
+          throw createRuntimeError({
+            type: "unauthenticated",
+            status: response.status,
+            code: getRecordValue3(payload, "code"),
+            message: "Token refresh response missing accessToken",
+            payload
+          });
+        }
+        const nextState = applyAccessToken(nextAccessToken, {
+          expiresAt: getRecordNumber(data, "accessTokenExpiresAt")
+        });
+        setAuthState({
+          status: "authenticated",
+          error: null,
+          refreshedAt: Date.now()
+        });
+        return nextState;
+      })().catch((error) => {
+        const runtimeError = normalizeRuntimeError(error);
+        applyAccessToken(null);
+        setAuthState({ status: "unauthenticated", error: runtimeError });
+        throw runtimeError;
+      }).finally(() => {
+        refreshRequestRef.current = null;
+      });
+    }
+    return refreshRequestRef.current;
+  }, [applyAccessToken, resolvedAppType, resolvedFetch, servicePrefix]);
   const authorizedFetch = (0, import_react14.useMemo)(
-    () => createAuthorizedFetch(resolvedFetch, accessToken),
-    [accessToken, resolvedFetch]
+    () => createAuthorizedFetch({
+      appType: resolvedAppType,
+      baseFetch: resolvedFetch,
+      accessTokenRef,
+      markUnauthenticated,
+      refreshAccessToken
+    }),
+    [markUnauthenticated, refreshAccessToken, resolvedAppType, resolvedFetch]
   );
   const getAuthHeaders = (0, import_react14.useCallback)(() => {
     const state2 = accessTokenRef.current;
@@ -6197,13 +6308,13 @@ var OpenXiangdaProvider = ({
       return;
     }
     setState((prev) => ({ ...prev, loading: true, error: null }));
-    const requestFetch = options.accessToken !== void 0 ? createAuthorizedFetch(
+    const requestFetch = options.accessToken !== void 0 ? createAccessTokenFetch(
       resolvedFetch,
       createAccessTokenState(
         options.accessToken || null,
         options.accessTokenOptions
       )
-    ) : createAuthorizedFetch(resolvedFetch, accessTokenRef.current);
+    ) : authorizedFetch;
     try {
       const response = await requestFetch(
         buildServiceUrl3(
@@ -6225,19 +6336,29 @@ var OpenXiangdaProvider = ({
           payload?.message || `Runtime bootstrap failed: ${response.status}`
         );
       }
+      const nextData = payload?.data || null;
       setState({
-        data: payload?.data || null,
+        data: nextData,
         loading: false,
         error: null
       });
+      if (isAuthenticatedBootstrap(nextData)) {
+        setAuthState(
+          (prev) => prev.status === "authenticated" ? prev : { status: "authenticated", error: null }
+        );
+      }
     } catch (error) {
+      const runtimeError = normalizeRuntimeError(error);
       setState({
         data: null,
         loading: false,
-        error: normalizeRuntimeError(error)
+        error: runtimeError
       });
+      if (runtimeError.type === "unauthenticated") {
+        setAuthState({ status: "unauthenticated", error: runtimeError });
+      }
     }
-  }, [resolvedAppType, resolvedFetch, servicePrefix]);
+  }, [authorizedFetch, resolvedAppType, resolvedFetch, servicePrefix]);
   (0, import_react14.useEffect)(() => {
     void reload();
   }, [reload]);
@@ -6248,6 +6369,7 @@ var OpenXiangdaProvider = ({
       servicePrefix,
       fetchImpl: authorizedFetch,
       baseFetchImpl: resolvedFetch,
+      authState,
       getAuthHeaders,
       reload,
       setAccessToken
@@ -6259,7 +6381,8 @@ var OpenXiangdaProvider = ({
       resolvedAppType,
       resolvedFetch,
       servicePrefix,
-      state
+      state,
+      authState
     ]
   );
   return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(OpenXiangdaRuntimeContext.Provider, { value, children });
@@ -6526,7 +6649,7 @@ var useRuntimeAuth = () => {
           buildServiceUrl3(runtime.servicePrefix, "/api/sso/status"),
           { domain }
         );
-        const statusResponse = await runtime.fetchImpl(statusUrl, {
+        const statusResponse = await runtime.baseFetchImpl(statusUrl, {
           credentials: "include",
           headers: { accept: "application/json" }
         });
@@ -6537,7 +6660,7 @@ var useRuntimeAuth = () => {
           enabled && (sso.forceLogin ?? sso.autoRedirect ?? true)
         );
         if (shouldUseSso) {
-          const loginUrlResponse = await runtime.fetchImpl(
+          const loginUrlResponse = await runtime.baseFetchImpl(
             withQuery(buildServiceUrl3(runtime.servicePrefix, "/api/sso/login-url"), {
               domain,
               redirectUri,
@@ -6561,7 +6684,7 @@ var useRuntimeAuth = () => {
       }
       return attachCallback("/platform/login", redirectUri);
     },
-    [runtime.data?.app, runtime.fetchImpl, runtime.servicePrefix]
+    [runtime.baseFetchImpl, runtime.data?.app, runtime.servicePrefix]
   );
   const redirectToLogin = (0, import_react14.useCallback)(
     async (options = {}) => {
@@ -6578,7 +6701,7 @@ var useRuntimeAuth = () => {
     [resolveLoginUrl2]
   );
   const logout = (0, import_react14.useCallback)(async () => {
-    const response = await runtime.fetchImpl(
+    const response = await runtime.baseFetchImpl(
       buildServiceUrl3(runtime.servicePrefix, "/api/auth/logout"),
       {
         method: "POST",
@@ -6594,8 +6717,9 @@ var useRuntimeAuth = () => {
         payload?.message || `Logout failed: ${response.status}`
       );
     }
+    runtime.setAccessToken(null);
     return payload;
-  }, [runtime.fetchImpl, runtime.servicePrefix]);
+  }, [runtime.baseFetchImpl, runtime.servicePrefix, runtime.setAccessToken]);
   const logoutAndRedirect = (0, import_react14.useCallback)(
     async (options = {}) => {
       try {
@@ -6614,12 +6738,83 @@ var useRuntimeAuth = () => {
     resolveLoginUrl: resolveLoginUrl2
   };
 };
+var RuntimeAuthGuard = ({
+  children,
+  fallback = null,
+  disabled = false,
+  excludedPaths = [],
+  ...redirectOptions
+}) => {
+  const runtime = useOpenXiangda();
+  const auth = useRuntimeAuth();
+  const redirectedRef = (0, import_react14.useRef)(false);
+  const currentPath = getCurrentPathname2();
+  const excluded = isRuntimeAuthGuardExcluded(
+    currentPath,
+    runtime.appType,
+    excludedPaths
+  );
+  const shouldRedirect = !disabled && !excluded && !runtime.loading && (runtime.authState.status === "unauthenticated" || runtime.error?.type === "unauthenticated");
+  (0, import_react14.useEffect)(() => {
+    if (!shouldRedirect || redirectedRef.current) return;
+    redirectedRef.current = true;
+    void auth.redirectToLogin({
+      ...redirectOptions,
+      redirectUri: redirectOptions.redirectUri || getCurrentHref4()
+    }).catch(() => {
+      redirectedRef.current = false;
+    });
+  }, [
+    auth,
+    redirectOptions.domain,
+    redirectOptions.loginUrl,
+    redirectOptions.redirectUri,
+    redirectOptions.replace,
+    shouldRedirect
+  ]);
+  if (excluded) return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children });
+  if (shouldRedirect) return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: fallback });
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children });
+};
 var buildServiceUrl3 = (servicePrefix, path) => {
   const prefix = servicePrefix.endsWith("/") ? servicePrefix.slice(0, -1) : servicePrefix;
   const suffix = path.startsWith("/") ? path : `/${path}`;
   return `${prefix}${suffix}`;
 };
-var createAuthorizedFetch = (baseFetch, accessToken) => {
+var createAuthorizedFetch = ({
+  appType,
+  baseFetch,
+  accessTokenRef,
+  refreshAccessToken,
+  markUnauthenticated
+}) => (async (input, init = {}) => {
+  const currentTokenState = accessTokenRef.current;
+  const response = await createAccessTokenFetch(
+    baseFetch,
+    currentTokenState
+  )(input, init);
+  if (!shouldAttemptAuthRefresh({
+    appType,
+    input,
+    init,
+    tokenState: currentTokenState
+  })) {
+    return response;
+  }
+  if (!await isUnauthenticatedResponse(response)) return response;
+  try {
+    const refreshedTokenState = await refreshAccessToken();
+    if (!refreshedTokenState) return response;
+    return await createAccessTokenFetch(
+      baseFetch,
+      refreshedTokenState
+    )(input, init);
+  } catch (error) {
+    markUnauthenticated(error);
+    return response;
+  }
+});
+var createAccessTokenFetch = (baseFetch, accessToken) => {
   if (!accessToken) return baseFetch;
   return ((input, init = {}) => {
     const token = resolveAccessTokenForCurrentRoute(accessToken);
@@ -6637,8 +6832,53 @@ var createAuthorizedFetch = (baseFetch, accessToken) => {
 var createAccessTokenState = (accessToken, options = {}) => accessToken ? {
   token: accessToken,
   scope: options.scope || "default",
-  path: options.path || null
+  path: options.path || null,
+  expiresAt: options.expiresAt
 } : null;
+var shouldAttemptAuthRefresh = ({
+  appType,
+  input,
+  init,
+  tokenState
+}) => {
+  if (!appType) return false;
+  if (tokenState?.scope === "public") return false;
+  if (isPublicRoutePath(normalizeRoutePath(getCurrentPathname2()))) return false;
+  if (hasAuthorizationHeader(init?.headers)) return false;
+  const pathname = getFetchInputPathname(input);
+  if (!pathname) return false;
+  if (/\/openxiangda-api\/v1\/apps\/[^/]+\/auth(?:\/|$)/.test(pathname)) {
+    return false;
+  }
+  if (/\/openxiangda-api\/v1\/apps\/[^/]+\/public\/session(?:\/|$)/.test(pathname)) {
+    return false;
+  }
+  if (/\/openxiangda-api\/v1\/auth(?:\/|$)/.test(pathname)) return false;
+  if (/\/api\/auth\/logout(?:\/|$)/.test(pathname)) return false;
+  if (/\/api\/sso(?:\/|$)/.test(pathname)) return false;
+  return true;
+};
+var isUnauthenticatedResponse = async (response) => {
+  if (response.status === 401) return true;
+  const payload = await readJsonPayload(response.clone());
+  const code = getRecordValue3(payload, "code");
+  return classifyRuntimeError(response.status, code) === "unauthenticated";
+};
+var hasAuthorizationHeader = (headers) => {
+  if (!headers) return false;
+  const normalized = new Headers(headers);
+  return normalized.has("authorization");
+};
+var getFetchInputPathname = (input) => {
+  const text = typeof input === "string" ? input : input instanceof URL ? input.toString() : typeof Request !== "undefined" && input instanceof Request ? input.url : String(input || "");
+  if (!text) return "";
+  try {
+    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+    return new URL(text, base).pathname;
+  } catch {
+    return text.split(/[?#]/, 1)[0] || "";
+  }
+};
 var resolveAccessTokenForCurrentRoute = (accessToken) => {
   if (accessToken.scope !== "public") return accessToken.token;
   const scopedPath = normalizeRoutePath(accessToken.path);
@@ -6823,6 +7063,31 @@ var getRecordString = (value, key) => {
   const result = getRecordValue3(value, key);
   return typeof result === "string" ? result : void 0;
 };
+var getRecordNumber = (value, key) => {
+  const result = getRecordValue3(value, key);
+  const numberValue = Number(result);
+  return Number.isFinite(numberValue) ? numberValue : void 0;
+};
+var unwrapRuntimePayload = (payload) => {
+  if (!payload || typeof payload !== "object") return payload;
+  const record = payload;
+  return "data" in record ? record.data : payload;
+};
+var isAuthenticatedBootstrap = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const user = toRuntimeRecord(getRecordValue3(value, "user"));
+  if (!getRecordValue3(user, "id") && !getRecordValue3(user, "username")) {
+    return false;
+  }
+  return !getRecordValue3(user, "publicAccess");
+};
+var isRuntimeAuthGuardExcluded = (path, appType, excludedPaths) => {
+  const normalizedPath = normalizeRoutePath(path);
+  if (isPublicRoutePath(normalizedPath)) return true;
+  const loginPath = normalizeRoutePath(`/view/${encodeURIComponent(appType)}/login`);
+  if (appType && normalizedPath === loginPath) return true;
+  return excludedPaths.map((item) => normalizeRoutePath(item)).some((item) => item && normalizedPath === item);
+};
 var resolveAppTypeFromLocation = () => {
   if (typeof window === "undefined") return "";
   const segments = window.location.pathname.split("/").filter(Boolean);
@@ -17187,7 +17452,7 @@ async function fetchRuntimeFormData(api, appType, params) {
       order: order ? JSON.stringify(order) : void 0
     }
   });
-  const payload = unwrapRuntimePayload(response);
+  const payload = unwrapRuntimePayload2(response);
   const data = Array.isArray(payload?.data) ? payload.data : Array.isArray(payload) ? payload : [];
   return {
     data,
@@ -17244,7 +17509,7 @@ function FormProvider({
     let cancelled = false;
     api.getUserById("current").then((payload) => {
       if (cancelled || !payload) return;
-      const currentUser = normalizeUser(unwrapRuntimePayload(payload));
+      const currentUser = normalizeUser(unwrapRuntimePayload2(payload));
       const departments = normalizeDepartmentArray(currentUser.departments);
       const currentDepartment = departments[0];
       const currentUserManagers = normalizeUserArray(
@@ -17641,7 +17906,7 @@ function needsCurrentUserRuntime(shortcutType) {
     ].includes(shortcutType)
   );
 }
-function unwrapRuntimePayload(payload) {
+function unwrapRuntimePayload2(payload) {
   return payload?.data || payload?.result || payload?.user || payload;
 }
 function isBlankFormValue(value) {
@@ -19585,7 +19850,7 @@ var DraftManager = ({
 // packages/sdk/src/components/templates/FormSubmitTemplate.tsx
 var import_jsx_runtime96 = require("react/jsx-runtime");
 var SUPERVISOR_APPROVER_TYPE = "ext_target_approval_department_supervisor";
-var unwrapRuntimePayload2 = (value) => value?.data ?? value?.result ?? value;
+var unwrapRuntimePayload3 = (value) => value?.data ?? value?.result ?? value;
 var normalizeSubmitFormType = (value) => {
   const raw = String(value || "").toLowerCase();
   return raw === "process" || raw === "flow" ? "process" : "form";
@@ -19782,7 +20047,7 @@ var InnerFormContent = ({
       return departmentId;
     }
     const runtimeUser = schema.runtime?.currentUser;
-    const loadedUser = runtimeUser || unwrapRuntimePayload2(await api.getUserById("current"));
+    const loadedUser = runtimeUser || unwrapRuntimePayload3(await api.getUserById("current"));
     const departments = normalizeDepartmentOptions(loadedUser?.departments);
     if (departments.length === 0) {
       import_antd36.message.error("\u5F53\u524D\u8D26\u53F7\u672A\u5206\u914D\u90E8\u95E8\uFF0C\u65E0\u6CD5\u53D1\u8D77\u4E3B\u7BA1\u5BA1\u6279\u6D41\u7A0B");
@@ -22755,7 +23020,7 @@ var downloadBlobResponse = async (response, fallbackName) => {
   anchor.remove();
   window.URL.revokeObjectURL(url);
 };
-var unwrapRuntimePayload3 = (payload) => {
+var unwrapRuntimePayload4 = (payload) => {
   const data = payload?.data?.result ?? payload?.result ?? payload?.data ?? payload;
   return data?.items || data?.list || data?.data || data?.records || data || [];
 };
@@ -22854,14 +23119,14 @@ function AsyncEntityFilterSelect({
               method: "get",
               params: keyword ? { keyword, pageSize: 20 } : { pageSize: 20 }
             });
-            rows = unwrapRuntimePayload3(response);
+            rows = unwrapRuntimePayload4(response);
           }
         } else {
           const response = await api.request({
             url: keyword ? "/department/list" : "/department/root",
             method: "get"
           });
-          rows = unwrapRuntimePayload3(response);
+          rows = unwrapRuntimePayload4(response);
           if (keyword) {
             const normalizedKeyword = keyword.toLowerCase();
             rows = rows.filter(
@@ -24647,7 +24912,7 @@ var getDetailBasePath = (appType, formUuid, formType) => {
   const detailType = isProcessKind("data-manage-list", formType) ? "processDetail" : "formDetail";
   return `/view/${appType}/${detailType}/${formUuid}`;
 };
-var unwrapRuntimePayload4 = (payload) => payload?.data ?? payload?.result ?? payload;
+var unwrapRuntimePayload5 = (payload) => payload?.data ?? payload?.result ?? payload;
 var formatFileSize2 = (size) => {
   const value = Number(size || 0);
   if (!value) return "0 B";
@@ -24728,7 +24993,7 @@ var OnlyOfficePreview = ({
           url: configUrl || `/file/onlyoffice/config/${encodeURIComponent(ticket)}`,
           method: "get"
         });
-        const payload = unwrapRuntimePayload4(response);
+        const payload = unwrapRuntimePayload5(response);
         const scriptUrl = `${String(payload.documentServerUrl || "").replace(
           /\/+$/,
           ""
@@ -24786,7 +25051,7 @@ var BuiltinFilePreview = ({
           method: "get"
         });
         if (!disposed) {
-          setMetadata(unwrapRuntimePayload4(response));
+          setMetadata(unwrapRuntimePayload5(response));
         }
       } catch (currentError) {
         if (!disposed) {
@@ -24826,7 +25091,7 @@ var BuiltinFilePreview = ({
       try {
         const response = await request({ url, method: "get" });
         if (!disposed) {
-          setPayload(unwrapRuntimePayload4(response));
+          setPayload(unwrapRuntimePayload5(response));
         }
       } catch (currentError) {
         if (!disposed) {