openxiangda 1.0.159 → 1.0.160

package/README.md

@@ -439,7 +439,7 @@ await ctx.organization.accounts.resetPassword("user-alice", {
 })
 ```
 
-应用登录能力通过 auth resource 和 runtime SDK 提供：登录配置放在 `src/resources/auth/<code>.json`，默认 React SPA 模板已包含 `/view/:appType/login`，自定义页面可使用 `createAuthClient({ appType, servicePrefix })` 或 `LoginPage` / `useAuth` from `openxiangda/runtime/react`。手机号验证码、CAS/SSO 或其他外部登录可以由 App Function provider 校验外部凭证，但 provider 只能返回 `phone` / `email` / `externalId` / `unionId` 等身份声明；平台后端按 auth resource 策略执行账号匹配、绑定、创建或拒绝，并由平台统一签发 token/cookie。默认注册策略是拒绝，开启自动注册或白名单注册前必须确认身份匹配键、默认角色、验证码 TTL/频率/失败次数、审计字段和错误文案策略。
+应用登录能力通过 auth resource 和 runtime SDK 提供：登录配置放在 `src/resources/auth/<code>.json`，默认 React SPA 模板已包含 `/view/:appType/login`，自定义页面可使用 `createAuthClient({ appType, servicePrefix })` 或 `LoginPage` / `useAuth` from `openxiangda/runtime/react`。钉钉登录默认使用 `dingtalkFlow="auto"`：只有明确位于钉钉容器且 JSAPI 可用时才走免登码，普通浏览器会请求应用级 OAuth 地址并跳转钉钉认证页；自定义页可调用 `getDingTalkOAuthUrl({ returnUrl })` 接入相同能力。手机号验证码、CAS/SSO 或其他外部登录可以由 App Function provider 校验外部凭证，但 provider 只能返回 `phone` / `email` / `externalId` / `unionId` 等身份声明；平台后端按 auth resource 策略执行账号匹配、绑定、创建或拒绝，并由平台统一签发 token/cookie。默认注册策略是拒绝，开启自动注册或白名单注册前必须确认身份匹配键、默认角色、验证码 TTL/频率/失败次数、审计字段和错误文案策略。
 
 常用数据视图命令：
 

package/lib/cli.js

@@ -3568,8 +3568,15 @@ async function authConfig(args) {
     const result = {
       methods: [
         { type: 'password', requiredFields: ['username', 'password'] },
+        {
+          type: 'dingtalk',
+          requiredFields: [],
+          defaultFlow: 'auto',
+          supportedFlows: ['auto', 'jsapi', 'oauth'],
+        },
         { type: 'phone_code', requiredFields: ['phone', 'code'], provider: 'functionCode 或 connector' },
         { type: 'sso', requiredFields: ['provider', 'callbackUrl'] },
+        { type: 'guest', requiredFields: [] },
       ],
       defaultRegistration: { mode: 'reject' },
       defaultBinding: { mode: 'auto' },

package/openxiangda-skills/SKILL.md

@@ -29,7 +29,7 @@ OpenXiangda supports two workspace modes. Classic `sy-lowcode-app-workspace` pub
 | 审批流程 / workflow / 流程节点 / JS_CODE                 | `openxiangda-workflow-automation`                                                          | `openxiangda workflow validate / create / publish`                                                                                                       |
 | 自动化 / 定时任务 / 提交触发 / cron                      | `openxiangda-workflow-automation`                                                          | `openxiangda automation validate / create / publish / enable`                                                                                            |
 | App Function / function_call / 可复用后端逻辑            | `openxiangda-workflow-automation`                                                          | declare `src/resources/functions/<code>.json` + `src/functions/<code>/index.ts`                                                                          |
-| 应用登录 / Auth SDK / 手机号验证码 / CAS / 钉钉免登      | `openxiangda-architecture-design` + `openxiangda-page`                                     | design security gate first, then declare `src/resources/auth/<code>.json` and use `createAuthClient` / `LoginPage`                                       |
+| 应用登录 / Auth SDK / 手机号验证码 / CAS / 钉钉登录或免登 | `openxiangda-architecture-design` + `openxiangda-page`                                     | design security gate first, then declare `src/resources/auth/<code>.json` and use `createAuthClient` / `LoginPage`                                       |
 | 账号权限 / 角色 / 权限组 / 字段权限 / 数据范围 / RBAC   | `openxiangda-permission-settings`                                                          | `openxiangda design gates --topic permissions --json` → choose permission mode → `openxiangda permission ...` / `openxiangda settings ...`              |
 | 平台部门 / 平台账号 / 重置密码 / 组织账号管理            | `openxiangda-architecture-design` + `openxiangda-page`                                     | check `openxiangda organization capabilities --json`; use `sdk.organization` / `ctx.organization` only after `app:organization:manage` is granted         |
 | 外部人员无需登录访问 / 公开报名 / 公开查询 / public page | `openxiangda-architecture-design` + `openxiangda-permission-settings` + `openxiangda-page` | 先确认公开范围、外部角色、ticket、grants；再声明 `routes` + `public-access`，并用 `OpenXiangdaProvider` + `OpenXiangdaPageProvider` + `PublicAccessGate` |
@@ -173,6 +173,7 @@ When the user provides a root domain such as `https://yida.wisejob.cn/`, use it
 - When a role such as 校区管理员 will create app roles, assign role members, grant role permissions, maintain permission groups, or manage organization accounts, its role manifest must declare the needed `apiPermissionCodes` such as `app:role:manage`, `app:page-permission-group:manage`, `app:form-permission-group:manage`, and `app:organization:manage`. If that administrator creates another administrator role, the new role must also declare its own `apiPermissionCodes`; permissions are not inherited from the creator.
 - If `resource publish` reports a missing API permission point such as `app:role:manage`, treat it as a platform seed/data problem. The platform tenant must have the permission code in `api_permissions`; do not remove the role manifest permission just to make publish pass.
 - For application login, declare auth resources in `src/resources/auth/<code>.json` and publish them with `openxiangda resource publish`. App Function auth providers may validate external credentials and return only an identity assertion; they must never issue tokens, set cookies, or write platform user/binding tables directly. The platform auth service decides create/bind/reject and issues tokens.
+- For DingTalk application login, prefer `flow: "auto"`: `LoginPage` uses JSAPI only inside a confirmed DingTalk container and otherwise starts platform-managed browser OAuth. Custom login pages call `getDingTalkOAuthUrl({ returnUrl })`; they must not assemble DingTalk OAuth URLs, manage callback state, or embed tenant secrets themselves.
 - For external/no-login pages in React SPA apps, declare `src/resources/routes/<code>.json` and `src/resources/public-access/<code>.json`, put the page under `/view/:appType/public/*`, and use `PublicAccessGate` or `createPublicAccessClient`. The route tree must also include `OpenXiangdaPageProvider` inside `OpenXiangdaProvider` before any `usePageSdk()` / `usePageContext()` / `useDataSource()` call; otherwise pages throw `usePageSdkStore 必须在 PageProvider 内使用`. Always provide `fallback` and `errorFallback` for public routes so slow networks, missing tickets, or expired tickets do not render blank pages. Public guest access to forms, dataViews, functions, and connectors is denied unless policy `grants` explicitly names the resource; backend permission groups still apply.
 - When verifying public access, parse the response body and reject string business errors such as `PUBLIC_GRANT_DENIED` even if the HTTP status is 200. Do not use `response.ok` alone as the success condition.
 - Before scaffolding a real app, complex page, data management page, portal shell, status lifecycle, role governance, or automation, read `references/best-practices.md` and pick the architecture first. Prefer copying the relevant pattern from `examples/best-practices/` into `src/` instead of generating a single large page file.

package/openxiangda-skills/references/architecture-design.md

@@ -186,7 +186,7 @@ Default: reusable calculations and validations become App Functions; one-off bac
 
 Ask these before generating any login/auth design:
 
-- Which methods are enabled: password, DingTalk in-app free login, CAS/SSO, phone code, guest?
+- Which methods are enabled: password, DingTalk browser OAuth/in-app free login, CAS/SSO, phone code, guest?
 - What is the phone registration policy: reject, auto-create, bind existing only, whitelist, or manual approval?
 - What are the identity match keys and priorities: `phone`, `email`, `externalId`, `unionId`, `jobNumber`, `username`?
 - Which App Function provider validates each external credential, and what identity assertion fields must it return?
@@ -280,6 +280,7 @@ For simple CRUD/admin lists, design can proceed with the appropriate OpenXiangda
 - Auth resources use stable local codes under `src/resources/auth/`.
 - Use `/view/:appType/login` or `LoginPage` from `openxiangda/runtime/react` for default React login.
 - Use `createAuthClient({ appType, servicePrefix })` for custom React login pages.
+- DingTalk `flow: "auto"` uses JSAPI only in a confirmed DingTalk container and otherwise starts platform-managed browser OAuth. The platform owns callback state and secrets; app code supplies only an app-local `returnUrl` through `getDingTalkOAuthUrl`.
 - Phone-code providers are App Functions. They validate send/verify events and return identity assertions; they do not issue tokens or mutate platform users.
 - New-user registration must be explicit, with default roles and identity conflict behavior documented.
 

package/openxiangda-skills/references/openxiangda-api.md

@@ -78,6 +78,33 @@ Body:
 
 Requires Bearer token. Revokes the current CLI token session.
 
+## App Runtime Auth
+
+### POST `/apps/:appType/auth/dingtalk/oauth/start`
+
+Starts platform-managed DingTalk browser OAuth for an application. This endpoint is called without an existing app login session. The platform creates and stores one-time callback state; application code must not build the DingTalk authorization URL itself.
+
+Body:
+
+```json
+{
+  "returnUrl": "/view/APP_EXAMPLE/admin"
+}
+```
+
+`returnUrl` is optional and, when present, must stay under the current application's `/view/:appType/*` routes.
+
+Response data:
+
+```json
+{
+  "loginUrl": "https://login.dingtalk.com/oauth2/auth?...",
+  "expiresIn": 600
+}
+```
+
+The platform-owned callback consumes the one-time state, creates the authenticated platform session, and redirects to the validated `returnUrl`. React applications normally use `LoginPage dingtalkFlow="auto"`; custom login pages call `createAuthClient(...).getDingTalkOAuthUrl({ returnUrl })` and navigate to `loginUrl`.
+
 ## App Snapshot
 
 ### GET `/apps/`

package/openxiangda-skills/references/pages/page-sdk.md

@@ -247,7 +247,7 @@ Application auth:
 import { LoginPage, useAuth, useLoginMethods } from "openxiangda/runtime/react";
 
 export function DefaultLogin() {
-  return <LoginPage />;
+  return <LoginPage dingtalkFlow="auto" />;
 }
 
 export function CustomPhoneLogin() {
@@ -269,6 +269,14 @@ import { createAuthClient } from "openxiangda/runtime";
 
 const auth = createAuthClient({ appType, servicePrefix: "/service" });
 const methods = await auth.getMethods();
+
+async function startDingTalkLogin() {
+  const { loginUrl } = await auth.getDingTalkOAuthUrl({
+    returnUrl: `/view/${encodeURIComponent(appType)}/admin`,
+  });
+  window.location.assign(loginUrl);
+}
+
 const sent = await auth.sendPhoneCode({ phone, purpose: "login" });
 const result = await auth.phoneCodeLogin({
   phone,
@@ -277,6 +285,8 @@ const result = await auth.phoneCodeLogin({
 });
 ```
 
+`dingtalkFlow="auto"` is the default. It uses DingTalk JSAPI only when both the container and `requestAuthCode` are available; otherwise it starts browser OAuth. Explicit `dingtalkFlow="jsapi"` or `"oauth"` overrides the auth method's `flow` setting. Browser OAuth is a full-page redirect whose callback is handled by the platform, so custom pages should pass an app-local `/view/:appType/*` return URL and must not implement their own callback or OAuth `state`. `LoginPage` normalizes a same-origin absolute guard callback to that relative form and rejects cross-origin or other-app callbacks before making the OAuth start request.
+
 For phone-code auth, the App Function provider receives `event`, `appType`, `method`, `credential`, `requestId`, `request`, and `challenge`. It may return `{ ok, providerState }` for send and `{ ok, identity }` for verify. It must not return `token`, `accessToken`, `refreshToken`, cookies, or mutate platform account tables.
 
 Public access route:

package/openxiangda-skills/references/resource-manifest-cheatsheet.md

@@ -74,7 +74,7 @@ openxiangda permission role-update external_visitor --json-file src/resources/ro
   "configJson": {
     "methods": [
       { "type": "password", "enabled": true, "label": "账号密码" },
-      { "type": "dingtalk", "enabled": true, "label": "钉钉免登" },
+      { "type": "dingtalk", "enabled": true, "label": "钉钉登录", "flow": "auto" },
       { "type": "sso", "enabled": true, "label": "CAS", "protocol": "cas" },
       {
         "type": "phone_code",
@@ -127,7 +127,7 @@ React 默认页：
 import { LoginPage } from "openxiangda/runtime/react";
 
 export default function AppLogin() {
-  return <LoginPage />;
+  return <LoginPage dingtalkFlow="auto" />;
 }
 ```
 
@@ -138,10 +138,20 @@ import { createAuthClient } from "openxiangda/runtime";
 
 const auth = createAuthClient({ appType, servicePrefix: "/service" });
 const methods = await auth.getMethods();
+
+async function startDingTalkLogin() {
+  const { loginUrl } = await auth.getDingTalkOAuthUrl({
+    returnUrl: `/view/${encodeURIComponent(appType)}/admin`,
+  });
+  window.location.assign(loginUrl);
+}
+
 const sent = await auth.sendPhoneCode({ phone, purpose: "login" });
 await auth.phoneCodeLogin({ phone, code, challengeId: sent.challengeId });
 ```
 
+钉钉 `flow: "auto"` 会在确认处于钉钉容器且 JSAPI 可用时走免登，否则走平台托管的浏览器 OAuth。`returnUrl` 只能是当前应用的 `/view/:appType/*` 路径；应用不要自行拼装钉钉授权 URL、保存 OAuth `state` 或实现回调页。
+
 设计前必须确认启用方式、注册策略、身份匹配键、provider 边界、默认权限、安全参数、第三方配置归属。
 
 ## 1. Storage — `src/resources/storage/<code>.json`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.159",
+  "version": "1.0.160",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/packages/sdk/dist/runtime/index.cjs

@@ -2284,6 +2284,10 @@ var createAuthClient = ({
     getMethods: () => request(appAuthPath("/methods")),
     passwordLogin: (input) => request(appAuthPath("/password/login"), postJson(input)),
     dingtalkLogin: (input) => request(appAuthPath("/dingtalk/login"), postJson(input)),
+    getDingTalkOAuthUrl: (input) => request(
+      appAuthPath("/dingtalk/oauth/start"),
+      postJson(input || {})
+    ),
     guestLogin: (input) => request(appAuthPath("/guest/login"), postJson(input || {})),
     sendPhoneCode: (input) => request(appAuthPath("/phone-code/send"), postJson(input)),
     phoneCodeLogin: (input) => request(appAuthPath("/phone-code/login"), postJson(input)),
@@ -8274,6 +8278,7 @@ var useAuth = (options = {}) => {
       getMethods: client.getMethods,
       passwordLogin: client.passwordLogin,
       dingtalkLogin: client.dingtalkLogin,
+      getDingTalkOAuthUrl: client.getDingTalkOAuthUrl,
       guestLogin: client.guestLogin,
       sendPhoneCode: client.sendPhoneCode,
       phoneCodeLogin: client.phoneCodeLogin,
@@ -8340,6 +8345,7 @@ var LoginPage = ({
   className,
   style,
   defaultMethod,
+  dingtalkFlow,
   redirectUrl,
   redirectOnSuccess = true,
   onSuccess,
@@ -8497,6 +8503,21 @@ var LoginPage = ({
     setSubmitting(true);
     setError(null);
     try {
+      const flow = resolveDingTalkLoginFlow(dingtalkFlow, dingtalkMethod);
+      if (flow === "oauth") {
+        const returnUrl = resolveDingTalkOAuthReturnUrl(
+          auth.client.appType,
+          redirectUrl || getCallbackUrl() || void 0
+        );
+        const result = await auth.getDingTalkOAuthUrl({
+          returnUrl
+        });
+        if (typeof window === "undefined") {
+          throw new Error("\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u8DF3\u8F6C\u9489\u9489\u767B\u5F55");
+        }
+        window.location.assign(result.loginUrl);
+        return;
+      }
       const code = await requestDingTalkCode(dingtalkMethod);
       await handleSuccess(
         await auth.dingtalkLogin({
@@ -8613,7 +8634,7 @@ var LoginPage = ({
                   icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_icons10.QrcodeOutlined, {}),
                   loading: submitting,
                   onClick: handleDingTalkLogin,
-                  children: dingtalkMethod.label || "\u9489\u9489\u514D\u767B"
+                  children: dingtalkMethod.label || "\u9489\u9489\u767B\u5F55"
                 }
               ) : null,
               ssoMethod ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
@@ -8764,6 +8785,50 @@ var getString = (value, key) => {
   const result = value[key];
   return typeof result === "string" ? result : void 0;
 };
+var resolveDingTalkLoginFlow = (explicitFlow, method) => {
+  const configuredFlow = normalizeDingTalkLoginFlow(getString(method, "flow"));
+  const flow = explicitFlow || configuredFlow || "auto";
+  if (flow !== "auto") return flow;
+  return canUseDingTalkJsApi() ? "jsapi" : "oauth";
+};
+var resolveDingTalkOAuthReturnUrl = (appType, returnUrl, origin = getCurrentOrigin()) => {
+  const normalizedAppType = String(appType || "").trim();
+  if (!normalizedAppType) throw new Error("appType \u4E0D\u80FD\u4E3A\u7A7A");
+  const appRoot = `/view/${encodeURIComponent(normalizedAppType)}`;
+  const rawReturnUrl = String(returnUrl || "").trim();
+  if (!rawReturnUrl) return appRoot;
+  if (!origin || rawReturnUrl.startsWith("//")) {
+    throw createInvalidDingTalkReturnUrlError(appRoot);
+  }
+  let baseUrl;
+  let targetUrl;
+  try {
+    baseUrl = new URL(origin);
+    targetUrl = new URL(rawReturnUrl, baseUrl);
+  } catch {
+    throw createInvalidDingTalkReturnUrlError(appRoot);
+  }
+  if (targetUrl.origin !== baseUrl.origin || targetUrl.username || targetUrl.password || targetUrl.pathname !== appRoot && !targetUrl.pathname.startsWith(`${appRoot}/`)) {
+    throw createInvalidDingTalkReturnUrlError(appRoot);
+  }
+  return `${targetUrl.pathname}${targetUrl.search}${targetUrl.hash}`;
+};
+var createInvalidDingTalkReturnUrlError = (appRoot) => new Error(`\u9489\u9489\u767B\u5F55\u8FD4\u56DE\u5730\u5740\u5FC5\u987B\u4F4D\u4E8E\u5F53\u524D\u5E94\u7528 ${appRoot} \u4E0B`);
+var normalizeDingTalkLoginFlow = (value) => value === "auto" || value === "jsapi" || value === "oauth" ? value : void 0;
+var canUseDingTalkJsApi = () => {
+  if (typeof window === "undefined") return false;
+  const dd = window.dd;
+  const requestAuthCode = dd?.runtime?.permission?.requestAuthCode || dd?.requestAuthCode;
+  if (typeof requestAuthCode !== "function") return false;
+  const platform = String(dd?.env?.platform || "").trim().toLowerCase();
+  if (platform === "notindingtalk") return false;
+  if (["android", "iphone", "ipad", "ios", "pc", "mac", "windows", "win"].includes(
+    platform
+  )) {
+    return true;
+  }
+  return /dingtalk/i.test(window.navigator?.userAgent || "");
+};
 var requestDingTalkCode = (method) => {
   const dd = typeof window === "undefined" ? void 0 : window.dd;
   const corpId = getString(method, "corpId");
@@ -8808,6 +8873,7 @@ var readChallengeId = (challenge) => {
 };
 var readChallengeQuestion = (challenge) => typeof challenge.question === "string" ? challenge.question : void 0;
 var getCurrentHref3 = () => typeof window === "undefined" ? "" : window.location.href;
+var getCurrentOrigin = () => typeof window === "undefined" ? "" : window.location.origin;
 var getCurrentHostname = () => typeof window === "undefined" ? "" : window.location.hostname;
 var getCallbackUrl = () => {
   if (typeof window === "undefined") return "";