openxiangda 1.0.149 → 1.0.151

package/packages/sdk/dist/runtime/react.cjs

@@ -42,6 +42,7 @@ __export(react_exports, {
   ProcessTimeline: () => ProcessTimeline,
   PublicAccessClientError: () => PublicAccessClientError,
   PublicAccessGate: () => PublicAccessGate,
+  RuntimeAuthGuard: () => RuntimeAuthGuard,
   createAuthClient: () => createAuthClient,
   createPageSdk: () => createPageSdk,
   createPublicAccessClient: () => createPublicAccessClient,
@@ -4797,14 +4798,14 @@ var useAuth = (options = {}) => {
     () => createAuthClient({
       appType: options.appType || runtime.appType,
       servicePrefix: options.servicePrefix || runtime.servicePrefix,
-      fetchImpl: options.fetchImpl || runtime.fetchImpl
+      fetchImpl: options.fetchImpl || runtime.baseFetchImpl
     }),
     [
       options.appType,
       options.fetchImpl,
       options.servicePrefix,
       runtime.appType,
-      runtime.fetchImpl,
+      runtime.baseFetchImpl,
       runtime.servicePrefix
     ]
   );
@@ -5083,7 +5084,19 @@ var LoginPage = ({
   };
   async function handleSuccess(data) {
     await onSuccess?.(data);
-    await runtime.reload();
+    const accessToken = data.accessToken || data.token;
+    const accessTokenOptions = {
+      expiresAt: data.accessTokenExpiresAt
+    };
+    if (accessToken) {
+      runtime.setAccessToken(accessToken, accessTokenOptions);
+    }
+    await runtime.reload(
+      accessToken ? {
+        accessToken,
+        accessTokenOptions
+      } : void 0
+    );
     if (redirectOnSuccess && typeof window !== "undefined") {
       window.location.replace(
         redirectUrl || getCallbackUrl() || `/view/${auth.client.appType}`
@@ -5367,27 +5380,125 @@ var OpenXiangdaProvider = ({
     () => appType || resolveAppTypeFromLocation(),
     [appType]
   );
-  const [accessToken, setAccessTokenState] = (0, import_react14.useState)(null);
+  const [, setAccessTokenState] = (0, import_react14.useState)(null);
+  const [authState, setAuthState] = (0, import_react14.useState)({
+    status: "unknown",
+    error: null
+  });
   const accessTokenRef = (0, import_react14.useRef)(null);
-  const setAccessToken = (0, import_react14.useCallback)(
+  const refreshRequestRef = (0, import_react14.useRef)(null);
+  const applyAccessToken = (0, import_react14.useCallback)(
     (nextAccessToken, options = {}) => {
       if (!nextAccessToken && options.clearIfToken && accessTokenRef.current?.token !== options.clearIfToken) {
-        return;
+        return accessTokenRef.current;
       }
       const normalizedAccessToken = nextAccessToken || null;
       const nextState = normalizedAccessToken ? {
         token: normalizedAccessToken,
         scope: options.scope || "default",
-        path: options.path || null
+        path: options.path || null,
+        expiresAt: options.expiresAt
       } : null;
       accessTokenRef.current = nextState;
       setAccessTokenState(nextState);
+      return nextState;
     },
     []
   );
+  const setAccessToken = (0, import_react14.useCallback)(
+    (nextAccessToken, options = {}) => {
+      const previousState = accessTokenRef.current;
+      const nextState = applyAccessToken(nextAccessToken, options);
+      if (nextState) {
+        if (nextState.scope === "public") return;
+        setAuthState({
+          status: "authenticated",
+          error: null
+        });
+      } else if (previousState?.scope !== "public") {
+        setAuthState({ status: "unauthenticated", error: null });
+      }
+    },
+    [applyAccessToken]
+  );
+  const markUnauthenticated = (0, import_react14.useCallback)(
+    (error) => {
+      const runtimeError = normalizeRuntimeError(error);
+      applyAccessToken(null);
+      setAuthState({ status: "unauthenticated", error: runtimeError });
+    },
+    [applyAccessToken]
+  );
+  const refreshAccessToken = (0, import_react14.useCallback)(async () => {
+    if (!resolvedAppType) return null;
+    if (!refreshRequestRef.current) {
+      setAuthState((prev) => ({ ...prev, status: "refreshing", error: null }));
+      refreshRequestRef.current = (async () => {
+        const response = await resolvedFetch(
+          buildServiceUrl2(
+            servicePrefix,
+            `/openxiangda-api/v1/apps/${encodeURIComponent(
+              resolvedAppType
+            )}/auth/refresh`
+          ),
+          {
+            method: "POST",
+            credentials: "include",
+            headers: {
+              accept: "application/json",
+              "content-type": "application/json"
+            },
+            body: "{}"
+          }
+        );
+        const payload = await readJsonPayload(response);
+        if (isRuntimeEnvelopeFailure(response, payload)) {
+          throw createRuntimeHttpError(
+            response,
+            payload,
+            payload?.message || `Token refresh failed: ${response.status}`
+          );
+        }
+        const data = unwrapRuntimePayload(payload);
+        const nextAccessToken = getRecordString(data, "accessToken") || getRecordString(data, "token");
+        if (!nextAccessToken) {
+          throw createRuntimeError({
+            type: "unauthenticated",
+            status: response.status,
+            code: getRecordValue2(payload, "code"),
+            message: "Token refresh response missing accessToken",
+            payload
+          });
+        }
+        const nextState = applyAccessToken(nextAccessToken, {
+          expiresAt: getRecordNumber(data, "accessTokenExpiresAt")
+        });
+        setAuthState({
+          status: "authenticated",
+          error: null,
+          refreshedAt: Date.now()
+        });
+        return nextState;
+      })().catch((error) => {
+        const runtimeError = normalizeRuntimeError(error);
+        applyAccessToken(null);
+        setAuthState({ status: "unauthenticated", error: runtimeError });
+        throw runtimeError;
+      }).finally(() => {
+        refreshRequestRef.current = null;
+      });
+    }
+    return refreshRequestRef.current;
+  }, [applyAccessToken, resolvedAppType, resolvedFetch, servicePrefix]);
   const authorizedFetch = (0, import_react14.useMemo)(
-    () => createAuthorizedFetch(resolvedFetch, accessToken),
-    [accessToken, resolvedFetch]
+    () => createAuthorizedFetch({
+      appType: resolvedAppType,
+      baseFetch: resolvedFetch,
+      accessTokenRef,
+      markUnauthenticated,
+      refreshAccessToken
+    }),
+    [markUnauthenticated, refreshAccessToken, resolvedAppType, resolvedFetch]
   );
   const getAuthHeaders = (0, import_react14.useCallback)(() => {
     const state2 = accessTokenRef.current;
@@ -5413,13 +5524,13 @@ var OpenXiangdaProvider = ({
       return;
     }
     setState((prev) => ({ ...prev, loading: true, error: null }));
-    const requestFetch = options.accessToken !== void 0 ? createAuthorizedFetch(
+    const requestFetch = options.accessToken !== void 0 ? createAccessTokenFetch(
       resolvedFetch,
       createAccessTokenState(
         options.accessToken || null,
         options.accessTokenOptions
       )
-    ) : createAuthorizedFetch(resolvedFetch, accessTokenRef.current);
+    ) : authorizedFetch;
     try {
       const response = await requestFetch(
         buildServiceUrl2(
@@ -5441,19 +5552,29 @@ var OpenXiangdaProvider = ({
           payload?.message || `Runtime bootstrap failed: ${response.status}`
         );
       }
+      const nextData = payload?.data || null;
       setState({
-        data: payload?.data || null,
+        data: nextData,
         loading: false,
         error: null
       });
+      if (isAuthenticatedBootstrap(nextData)) {
+        setAuthState(
+          (prev) => prev.status === "authenticated" ? prev : { status: "authenticated", error: null }
+        );
+      }
     } catch (error) {
+      const runtimeError = normalizeRuntimeError(error);
       setState({
         data: null,
         loading: false,
-        error: normalizeRuntimeError(error)
+        error: runtimeError
       });
+      if (runtimeError.type === "unauthenticated") {
+        setAuthState({ status: "unauthenticated", error: runtimeError });
+      }
     }
-  }, [resolvedAppType, resolvedFetch, servicePrefix]);
+  }, [authorizedFetch, resolvedAppType, resolvedFetch, servicePrefix]);
   (0, import_react14.useEffect)(() => {
     void reload();
   }, [reload]);
@@ -5464,6 +5585,7 @@ var OpenXiangdaProvider = ({
       servicePrefix,
       fetchImpl: authorizedFetch,
       baseFetchImpl: resolvedFetch,
+      authState,
       getAuthHeaders,
       reload,
       setAccessToken
@@ -5475,7 +5597,8 @@ var OpenXiangdaProvider = ({
       resolvedAppType,
       resolvedFetch,
       servicePrefix,
-      state
+      state,
+      authState
     ]
   );
   return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(OpenXiangdaRuntimeContext.Provider, { value, children });
@@ -5742,7 +5865,7 @@ var useRuntimeAuth = () => {
           buildServiceUrl2(runtime.servicePrefix, "/api/sso/status"),
           { domain }
         );
-        const statusResponse = await runtime.fetchImpl(statusUrl, {
+        const statusResponse = await runtime.baseFetchImpl(statusUrl, {
           credentials: "include",
           headers: { accept: "application/json" }
         });
@@ -5753,7 +5876,7 @@ var useRuntimeAuth = () => {
           enabled && (sso.forceLogin ?? sso.autoRedirect ?? true)
         );
         if (shouldUseSso) {
-          const loginUrlResponse = await runtime.fetchImpl(
+          const loginUrlResponse = await runtime.baseFetchImpl(
             withQuery(buildServiceUrl2(runtime.servicePrefix, "/api/sso/login-url"), {
               domain,
               redirectUri,
@@ -5777,7 +5900,7 @@ var useRuntimeAuth = () => {
       }
       return attachCallback("/platform/login", redirectUri);
     },
-    [runtime.data?.app, runtime.fetchImpl, runtime.servicePrefix]
+    [runtime.baseFetchImpl, runtime.data?.app, runtime.servicePrefix]
   );
   const redirectToLogin = (0, import_react14.useCallback)(
     async (options = {}) => {
@@ -5794,7 +5917,7 @@ var useRuntimeAuth = () => {
     [resolveLoginUrl2]
   );
   const logout = (0, import_react14.useCallback)(async () => {
-    const response = await runtime.fetchImpl(
+    const response = await runtime.baseFetchImpl(
       buildServiceUrl2(runtime.servicePrefix, "/api/auth/logout"),
       {
         method: "POST",
@@ -5810,8 +5933,9 @@ var useRuntimeAuth = () => {
         payload?.message || `Logout failed: ${response.status}`
       );
     }
+    runtime.setAccessToken(null);
     return payload;
-  }, [runtime.fetchImpl, runtime.servicePrefix]);
+  }, [runtime.baseFetchImpl, runtime.servicePrefix, runtime.setAccessToken]);
   const logoutAndRedirect = (0, import_react14.useCallback)(
     async (options = {}) => {
       try {
@@ -5823,19 +5947,93 @@ var useRuntimeAuth = () => {
     },
     [logout, redirectToLogin]
   );
-  return {
-    logout,
-    logoutAndRedirect,
-    redirectToLogin,
-    resolveLoginUrl: resolveLoginUrl2
-  };
+  return (0, import_react14.useMemo)(
+    () => ({
+      logout,
+      logoutAndRedirect,
+      redirectToLogin,
+      resolveLoginUrl: resolveLoginUrl2
+    }),
+    [logout, logoutAndRedirect, redirectToLogin, resolveLoginUrl2]
+  );
+};
+var RuntimeAuthGuard = ({
+  children,
+  fallback = null,
+  disabled = false,
+  excludedPaths = [],
+  ...redirectOptions
+}) => {
+  const runtime = useOpenXiangda();
+  const auth = useRuntimeAuth();
+  const redirectedRef = (0, import_react14.useRef)(false);
+  const currentPath = getCurrentPathname();
+  const excluded = isRuntimeAuthGuardExcluded(
+    currentPath,
+    runtime.appType,
+    excludedPaths
+  );
+  const shouldRedirect = !disabled && !excluded && !runtime.loading && (runtime.authState.status === "unauthenticated" || runtime.error?.type === "unauthenticated");
+  (0, import_react14.useEffect)(() => {
+    if (!shouldRedirect || redirectedRef.current) return;
+    redirectedRef.current = true;
+    void auth.redirectToLogin({
+      ...redirectOptions,
+      redirectUri: redirectOptions.redirectUri || getCurrentHref4()
+    }).catch(() => {
+      redirectedRef.current = false;
+    });
+  }, [
+    auth,
+    redirectOptions.domain,
+    redirectOptions.loginUrl,
+    redirectOptions.redirectUri,
+    redirectOptions.replace,
+    shouldRedirect
+  ]);
+  if (excluded) return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children });
+  if (shouldRedirect) return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: fallback });
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children });
 };
 var buildServiceUrl2 = (servicePrefix, path) => {
   const prefix = servicePrefix.endsWith("/") ? servicePrefix.slice(0, -1) : servicePrefix;
   const suffix = path.startsWith("/") ? path : `/${path}`;
   return `${prefix}${suffix}`;
 };
-var createAuthorizedFetch = (baseFetch, accessToken) => {
+var createAuthorizedFetch = ({
+  appType,
+  baseFetch,
+  accessTokenRef,
+  refreshAccessToken,
+  markUnauthenticated
+}) => (async (input, init = {}) => {
+  const currentTokenState = accessTokenRef.current;
+  const response = await createAccessTokenFetch(
+    baseFetch,
+    currentTokenState
+  )(input, init);
+  if (!shouldAttemptAuthRefresh({
+    appType,
+    input,
+    init,
+    tokenState: currentTokenState
+  })) {
+    return response;
+  }
+  if (!await isUnauthenticatedResponse(response)) return response;
+  try {
+    const refreshedTokenState = await refreshAccessToken();
+    if (!refreshedTokenState) return response;
+    return await createAccessTokenFetch(
+      baseFetch,
+      refreshedTokenState
+    )(input, init);
+  } catch (error) {
+    markUnauthenticated(error);
+    return response;
+  }
+});
+var createAccessTokenFetch = (baseFetch, accessToken) => {
   if (!accessToken) return baseFetch;
   return ((input, init = {}) => {
     const token = resolveAccessTokenForCurrentRoute(accessToken);
@@ -5853,8 +6051,53 @@ var createAuthorizedFetch = (baseFetch, accessToken) => {
 var createAccessTokenState = (accessToken, options = {}) => accessToken ? {
   token: accessToken,
   scope: options.scope || "default",
-  path: options.path || null
+  path: options.path || null,
+  expiresAt: options.expiresAt
 } : null;
+var shouldAttemptAuthRefresh = ({
+  appType,
+  input,
+  init,
+  tokenState
+}) => {
+  if (!appType) return false;
+  if (tokenState?.scope === "public") return false;
+  if (isPublicRoutePath(normalizeRoutePath(getCurrentPathname()))) return false;
+  if (hasAuthorizationHeader(init?.headers)) return false;
+  const pathname = getFetchInputPathname(input);
+  if (!pathname) return false;
+  if (/\/openxiangda-api\/v1\/apps\/[^/]+\/auth(?:\/|$)/.test(pathname)) {
+    return false;
+  }
+  if (/\/openxiangda-api\/v1\/apps\/[^/]+\/public\/session(?:\/|$)/.test(pathname)) {
+    return false;
+  }
+  if (/\/openxiangda-api\/v1\/auth(?:\/|$)/.test(pathname)) return false;
+  if (/\/api\/auth\/logout(?:\/|$)/.test(pathname)) return false;
+  if (/\/api\/sso(?:\/|$)/.test(pathname)) return false;
+  return true;
+};
+var isUnauthenticatedResponse = async (response) => {
+  if (response.status === 401) return true;
+  const payload = await readJsonPayload(response.clone());
+  const code = getRecordValue2(payload, "code");
+  return classifyRuntimeError(response.status, code) === "unauthenticated";
+};
+var hasAuthorizationHeader = (headers) => {
+  if (!headers) return false;
+  const normalized = new Headers(headers);
+  return normalized.has("authorization");
+};
+var getFetchInputPathname = (input) => {
+  const text = typeof input === "string" ? input : input instanceof URL ? input.toString() : typeof Request !== "undefined" && input instanceof Request ? input.url : String(input || "");
+  if (!text) return "";
+  try {
+    const base = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+    return new URL(text, base).pathname;
+  } catch {
+    return text.split(/[?#]/, 1)[0] || "";
+  }
+};
 var resolveAccessTokenForCurrentRoute = (accessToken) => {
   if (accessToken.scope !== "public") return accessToken.token;
   const scopedPath = normalizeRoutePath(accessToken.path);
@@ -6039,6 +6282,31 @@ var getRecordString = (value, key) => {
   const result = getRecordValue2(value, key);
   return typeof result === "string" ? result : void 0;
 };
+var getRecordNumber = (value, key) => {
+  const result = getRecordValue2(value, key);
+  const numberValue = Number(result);
+  return Number.isFinite(numberValue) ? numberValue : void 0;
+};
+var unwrapRuntimePayload = (payload) => {
+  if (!payload || typeof payload !== "object") return payload;
+  const record = payload;
+  return "data" in record ? record.data : payload;
+};
+var isAuthenticatedBootstrap = (value) => {
+  if (!value || typeof value !== "object") return false;
+  const user = toRuntimeRecord(getRecordValue2(value, "user"));
+  if (!getRecordValue2(user, "id") && !getRecordValue2(user, "username")) {
+    return false;
+  }
+  return !getRecordValue2(user, "publicAccess");
+};
+var isRuntimeAuthGuardExcluded = (path, appType, excludedPaths) => {
+  const normalizedPath = normalizeRoutePath(path);
+  if (isPublicRoutePath(normalizedPath)) return true;
+  const loginPath = normalizeRoutePath(`/view/${encodeURIComponent(appType)}/login`);
+  if (appType && normalizedPath === loginPath) return true;
+  return excludedPaths.map((item) => normalizeRoutePath(item)).some((item) => item && normalizedPath === item);
+};
 var resolveAppTypeFromLocation = () => {
   if (typeof window === "undefined") return "";
   const segments = window.location.pathname.split("/").filter(Boolean);