yd-admin 0.1.9 → 0.1.11

package/README.md

@@ -332,6 +332,11 @@ vp test
 
 ## 📋 更新日志
 
+### v0.1.11
+
+- **release**: 版本号更新至 v0.1.11
+- **enhancement**: 优化构建配置
+
 ### v0.1.9
 
 - **feat(AI Chat)**: AI 聊天页面组件 (YdChatPage) - 支持会话列表、模型选择、流式输出

package/dist/index.js

@@ -18,9 +18,15 @@ var __exportAll = (all, no_symbols) => {
 /**
 * Web Crypto API 加密工具
 * 使用 AES-GCM 算法进行对称加密
+*
+* 环境变量:
+* - VITE_CRYPTO_SALT: 自定义盐值 (允许使用项目覆盖)
+*   示例: VITE_CRYPTO_SALT=your-project-salt
 */
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
+const CRYPTO_SALT = import.meta.env.VITE_CRYPTO_SALT;
+if (!CRYPTO_SALT) throw new Error("[crypto] VITE_CRYPTO_SALT 环境变量未配置。请在 .env 文件中设置 VITE_CRYPTO_SALT");
 /**
 * 密钥派生缓存
 * 避免每次加密/解密都重新派生密钥 (PBKDF2 100000 次迭代开销较大)
@@ -41,7 +47,7 @@ async function deriveKey(password) {
 	const cached = keyCache.get(password);
 	if (cached) return cached.key;
 	const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), { name: "PBKDF2" }, false, ["deriveKey"]);
-	const salt = encoder.encode("yd-admin-salt-fixed");
+	const salt = encoder.encode(CRYPTO_SALT);
 	const key = await crypto.subtle.deriveKey({
 		name: "PBKDF2",
 		salt,
@@ -105,11 +111,33 @@ async function decrypt(base64Data, key) {
 		return null;
 	}
 }
+//#endregion
+//#region src/utils/secure-storage.ts
+/**
+* 安全存储工具
+* 混合加密策略：
+* - sessionStorage: 使用动态会话密钥 (内存中，刷新即焚)
+* - localStorage: 使用 Vite 环境变量密钥 (防普通篡改)
+*
+* 密钥来源优先级：
+* localStorage: 配置文件 → 运行时 → init配置 → 环境变量 VITE_STORAGE_KEY
+* sessionStorage: 运行时 → init配置 → 动态生成（每次会话）
+*/
+/**
+* 全局密钥存储（用于运行时/API注入）
+*/
+let globalLocalStorageKey = null;
+let globalSessionStorageKey = null;
 /**
 * 配置文件中的密钥缓存
 */
 let configLocalStorageKey;
 let configSessionStorageKey;
+/**
+* 密钥来源追踪
+*/
+let localKeySource = "default";
+let sessionKeySource = "dynamic";
 let sessionKey = null;
 let sessionKeyIsString = false;
 let storageReadyResolve = null;
@@ -117,8 +145,57 @@ const storageReady = new Promise((resolve) => {
 	storageReadyResolve = resolve;
 });
 let localStorageKey = null;
-const ENV_KEY = import.meta.env.VITE_STORAGE_KEY || "yd-admin-default-key";
-const ENV_SESSION_KEY = import.meta.env.VITE_SESSION_STORAGE_KEY || "yd-admin-session-key";
+const ENV_KEY = import.meta.env.VITE_STORAGE_KEY;
+const ENV_SESSION_KEY = import.meta.env.VITE_SESSION_STORAGE_KEY;
+if (import.meta.env.PROD) {
+	if (!ENV_KEY) throw new Error("[secure-storage] 生产环境必须配置 VITE_STORAGE_KEY 环境变量");
+	if (!ENV_SESSION_KEY) throw new Error("[secure-storage] 生产环境必须配置 VITE_SESSION_STORAGE_KEY 环境变量");
+}
+/**
+* 设置 localStorage 运行时密钥
+* @param key 加密密钥
+*/
+function setStorageEncryptionKey(key) {
+	globalLocalStorageKey = key;
+	localKeySource = "runtime";
+}
+/**
+* 设置 sessionStorage 运行时密钥
+* @param key 加密密钥
+*/
+function setSessionStorageEncryptionKey(key) {
+	globalSessionStorageKey = key;
+	sessionKeySource = "runtime";
+}
+/**
+* 获取密钥来源
+* @param type 存储类型
+* @returns 密钥来源
+*/
+function getKeySource(type) {
+	return type === "local" ? localKeySource : sessionKeySource;
+}
+/**
+* 重置密钥
+* @param type 存储类型
+*/
+function resetStorageKey(type) {
+	if (type === "local") {
+		globalLocalStorageKey = null;
+		localKeySource = "dynamic";
+	} else {
+		globalSessionStorageKey = null;
+		sessionKeySource = "dynamic";
+		sessionKey = null;
+	}
+}
+/**
+* 检查存储是否就绪
+* @returns 是否就绪
+*/
+function isStorageReady() {
+	return !!localStorageKey || !!sessionKey || !!globalLocalStorageKey || !!globalSessionStorageKey;
+}
 /**
 * 从配置文件加载密钥
 * @param filePath 配置文件路径，默认 config/storage.json
@@ -148,6 +225,10 @@ async function loadKeyFromConfig(filePath) {
 * 解析 localStorage 密钥（按优先级）
 */
 async function resolveLocalKey(config) {
+	if (globalLocalStorageKey) return {
+		key: globalLocalStorageKey,
+		source: "runtime"
+	};
 	if (config?.localStorageKey || config?.storageKey) return {
 		key: config.localStorageKey || config.storageKey,
 		source: "init"
@@ -163,7 +244,7 @@ async function resolveLocalKey(config) {
 		source: "env"
 	};
 	return {
-		key: ENV_KEY,
+		key: (import.meta.env.DEV ? "yd-admin-dev-local-key" : "") || ENV_KEY,
 		source: "default"
 	};
 }
@@ -171,6 +252,10 @@ async function resolveLocalKey(config) {
 * 解析 sessionStorage 密钥（按优先级）
 */
 async function resolveSessionKey(config) {
+	if (globalSessionStorageKey) return {
+		key: globalSessionStorageKey,
+		source: "runtime"
+	};
 	if (config?.sessionStorageKey || config?.storageKey) return {
 		key: config.sessionStorageKey || config.storageKey,
 		source: "init"
@@ -187,7 +272,7 @@ async function resolveSessionKey(config) {
 		source: "env"
 	};
 	return {
-		key: ENV_SESSION_KEY,
+		key: (import.meta.env.DEV ? "yd-admin-dev-session-key" : "") || ENV_SESSION_KEY,
 		source: "dynamic"
 	};
 }
@@ -197,14 +282,18 @@ async function resolveSessionKey(config) {
 * @param config 可选的初始化配置
 */
 async function initSecureStorage(config) {
-	localStorageKey = (await resolveLocalKey(config)).key;
-	if ((await resolveSessionKey(config)).source === "dynamic") {
+	const localResolved = await resolveLocalKey(config);
+	localStorageKey = localResolved.key;
+	localKeySource = localResolved.source;
+	const sessionResolved = await resolveSessionKey(config);
+	if (sessionResolved.source === "dynamic") {
 		sessionKey = await generateSessionKey();
 		sessionKeyIsString = false;
 	} else {
 		sessionKey = null;
 		sessionKeyIsString = true;
 	}
+	sessionKeySource = sessionResolved.source;
 	if (storageReadyResolve) {
 		storageReadyResolve();
 		storageReadyResolve = null;
@@ -230,7 +319,7 @@ var SecureStorage = class {
 	* 是否就绪
 	*/
 	get ready() {
-		return this.storageType === "session" ? !!sessionKey || !!ENV_SESSION_KEY : !!localStorageKey || !!ENV_KEY;
+		return this.storageType === "session" ? !!sessionKey || !!globalSessionStorageKey || !!ENV_SESSION_KEY : !!localStorageKey || !!ENV_KEY;
 	}
 	/**
 	* 获取密钥（根据存储类型）
@@ -240,6 +329,7 @@ var SecureStorage = class {
 		if (this.storageType === "session") {
 			if (sessionKey) return sessionKey;
 			if (sessionKeyIsString) {
+				if (globalSessionStorageKey) return globalSessionStorageKey;
 				if (import.meta.env.VITE_SESSION_STORAGE_KEY) return import.meta.env.VITE_SESSION_STORAGE_KEY;
 			}
 			return ENV_SESSION_KEY;
@@ -254,7 +344,7 @@ var SecureStorage = class {
 	*/
 	async setItem(key, value, options) {
 		const currentKey = this.getCurrentKey();
-		if (this.storageType === "session" && !sessionKey && true) {
+		if (this.storageType === "session" && !sessionKey && !globalSessionStorageKey) {
 			console.warn(`[secureStorage] sessionStorage key not ready, write "${key}" skipped`);
 			return;
 		}
@@ -350,8 +440,90 @@ var SecureStorage = class {
 		this.storage.clear();
 	}
 };
+/**
+* 创建独立的 SecureStorage 实例
+* @param type 存储类型
+* @param key 可选的独立密钥
+* @returns SecureStorage 实例
+*/
+function createSecureStorage(type, key) {
+	const instance = new SecureStorage(type);
+	if (key) if (type === "local") setStorageEncryptionKey(key);
+	else setSessionStorageEncryptionKey(key);
+	return instance;
+}
 const secureLocal = new SecureStorage("local");
 const secureSession = new SecureStorage("session");
+/**
+* 密钥轮换
+* @param type 存储类型
+* @param newKey 新密钥
+*/
+async function rotateStorageKey(type, newKey) {
+	const storage = type === "local" ? localStorage : sessionStorage;
+	const keys = [];
+	for (let i = 0; i < storage.length; i++) keys.push(storage.key(i));
+	if (type === "local") {
+		const oldKey = globalLocalStorageKey || localStorageKey || ENV_KEY;
+		globalLocalStorageKey = newKey;
+		localKeySource = "runtime";
+		for (const key of keys) try {
+			const encrypted = storage.getItem(key);
+			if (!encrypted) continue;
+			const decrypted = await decrypt(encrypted, oldKey);
+			if (!decrypted) continue;
+			const reEncrypted = await encrypt(decrypted, newKey);
+			storage.setItem(key, reEncrypted);
+		} catch {}
+	} else {
+		const oldKey = globalSessionStorageKey || ENV_SESSION_KEY;
+		globalSessionStorageKey = newKey;
+		sessionKeySource = "runtime";
+		for (const key of keys) try {
+			const encrypted = storage.getItem(key);
+			if (!encrypted) continue;
+			const decrypted = await decrypt(encrypted, oldKey);
+			if (!decrypted) continue;
+			const reEncrypted = await encrypt(decrypted, newKey);
+			storage.setItem(key, reEncrypted);
+		} catch {}
+	}
+}
+/**
+* 生成 HMAC 签名
+* @param data 数据字符串
+* @param key 密钥
+* @returns 签名
+*/
+async function signData(data, key) {
+	const encoder = new TextEncoder();
+	const keyData = await crypto.subtle.importKey("raw", encoder.encode(key), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", keyData, encoder.encode(data));
+	return btoa(String.fromCharCode(...new Uint8Array(signature)));
+}
+/**
+* 验证签名
+* @param data 数据字符串
+* @param signature 签名
+* @param key 密钥
+* @returns 是否有效
+*/
+async function verifyData(data, signature, key) {
+	try {
+		const encoder = new TextEncoder();
+		const keyData = await crypto.subtle.importKey("raw", encoder.encode(key), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["verify"]);
+		const signatureBytes = Uint8Array.from(atob(signature), (c) => c.charCodeAt(0));
+		return crypto.subtle.verify("HMAC", keyData, signatureBytes, encoder.encode(data));
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/utils/router.ts
 /**
@@ -792,9 +964,20 @@ var icon_default = /* @__PURE__ */ export_helper_default(/* @__PURE__ */ defineC
 		function e(element) {
 			return `yd-icon__${element}`;
 		}
+		/**
+		* 清理 SVG 内容以防止 XSS 攻击
+		* 移除 script 标签、事件处理器等危险内容
+		*/
+		function sanitizeSvg(svg) {
+			let cleaned = svg.replace(/<script[\s\S]*?<\/script>/gi, "");
+			cleaned = cleaned.replace(/\s*on\w+\s*=\s*(["'])[^"']*\1/gi, "");
+			cleaned = cleaned.replace(/javascript:/gi, "");
+			cleaned = cleaned.replace(/data:/gi, "");
+			return cleaned;
+		}
 		const svgContent = computed(() => {
 			if (!props.name) return "";
-			if (props.name.includes("<svg") || props.name.includes("<path")) return props.name;
+			if (props.name.includes("<svg") || props.name.includes("<path")) return sanitizeSvg(props.name);
 			return getIcon(props.name) || "";
 		});
 		const iconStyle = computed(() => {
@@ -823,7 +1006,7 @@ var icon_default = /* @__PURE__ */ export_helper_default(/* @__PURE__ */ defineC
 			}, null, 10, _hoisted_1$56)) : (openBlock(), createElementBlock(Fragment, { key: 1 }, [createCommentVNode(" Slot Fallback "), renderSlot(_ctx.$slots, "default", {}, void 0, true)], 2112))], 16);
 		};
 	}
-}), [["__scopeId", "data-v-20774ae9"]]);
+}), [["__scopeId", "data-v-bb6b8302"]]);
 //#endregion
 //#region src/components/base/input/input.vue
 const _hoisted_1$55 = [
@@ -15790,17 +15973,19 @@ function createPermissionGuard(options) {
 * @returns 角色守卫函数
 */
 function createRoleGuard(options) {
-	const { checker, forbiddenPath = "/403" } = options;
+	const { checker, forbiddenPath = "/403", getUserPermissions } = options;
 	return async (to, _from, next) => {
 		const requiredRoles = to.meta?.roles;
 		if (!requiredRoles || requiredRoles.length === 0) {
 			next();
 			return;
 		}
-		if (!await checker(requiredRoles, {
+		let userPermissions = {
 			roles: [],
 			permissions: []
-		})) {
+		};
+		if (getUserPermissions) userPermissions = await getUserPermissions() ?? userPermissions;
+		if (!await checker(requiredRoles, userPermissions)) {
 			next({ path: forbiddenPath });
 			return;
 		}
@@ -16052,4 +16237,4 @@ var router_exports = /* @__PURE__ */ __exportAll({
 	setRouter: () => setRouter
 });
 //#endregion
-export { ANIMATION_DURATION, COMPONENT_PREFIX, CSS_PREFIX, DEBOUNCE_DEFAULTS, DEBOUNCE_DELAY, DEFAULT_LAYOUT_SIZE, Message, Notification, THROTTLE_DEFAULTS, THROTTLE_DELAY, YdAdminResolver, ai_loader_default as YdAiLoader, anchor_default as YdAnchor, auto_complete_default as YdAutoComplete, avatar_default as YdAvatar, badge_default as YdBadge, breadcrumb_default as YdBreadcrumb, button_default as YdButton, calendar_default as YdCalendar, captcha_default as YdCaptcha, card_default as YdCard, cascader_default as YdCascader, chat_bubble_default as YdChatBubble, chat_page_default as YdChatPage, checkbox_default as YdCheckbox, checkbox_group_default as YdCheckboxGroup, code_block_default as YdCodeBlock, collapse_default as YdCollapse, color_picker_default as YdColorPicker, config_provider_default as YdConfigProvider, context_menu_default as YdContextMenu, conversation_default as YdConversation, crud_page_default as YdCrudPage, date_picker_default as YdDatePicker, date_range_picker_default as YdDateRangePicker, divider_default as YdDivider, drawer_default as YdDrawer, dropdown_default as YdDropdown, empty_default as YdEmpty, flow_chart_default as YdFlowChart, form_default as YdForm, form_item_default as YdFormItem, icon_default as YdIcon, image_default as YdImage, image_preview_group_default as YdImagePreviewGroup, input_default as YdInput, input_number_default as YdInputNumber, layout_default as YdLayout, layout_content_default as YdLayoutContent, layout_header_default as YdLayoutHeader, layout_sidebar_default as YdLayoutSidebar, list_default as YdList, loading_bar_default as YdLoadingBar, login_default as YdLogin, login_centered_default as YdLoginCentered, menu_default as YdMenu, modal_default as YdModal, model_selector_default as YdModelSelector, pagination_default as YdPagination, pin_input_default as YdPinInput, popconfirm_default as YdPopconfirm, progress_default as YdProgress, prompt_input_default as YdPromptInput, radio_default as YdRadio, radio_group_default as YdRadioGroup, rate_default as YdRate, reasoning_default as YdReasoning, result_default as YdResult, router_exports as YdRouter, SchemaForm_default as YdSchemaForm, select_default as YdSelect, skeleton_default as YdSkeleton, slider_default as YdSlider, sources_default as YdSources, space_default as YdSpace, spin_default as YdSpin, statistic_default as YdStatistic, stepper_default as YdStepper, steps_default as YdSteps, streaming_text_default as YdStreamingText, suggestion_default as YdSuggestion, switch_default as YdSwitch, table_default as YdTable, tabs_default as YdTabs, tag_default as YdTag, textarea_default as YdTextarea, time_picker_default as YdTimePicker, timeline_default as YdTimeline, tooltip_default as YdTooltip, transfer_default as YdTransfer, tree_default as YdTree, tree_select_default as YdTreeSelect, upload_default as YdUpload, watermark_default as YdWatermark, Z_INDEX, buildBreadcrumb, changeLocale, checkRoutePermission, clearKeyCache, cn, convertToSimpleRoute, createWatermark, debounce, decrypt, deepClone, dt, dynamicRouter, encrypt, filterMenuItems, findMenuItem, findMenuPath, flattenMenuItems, generateId, generateRouteTitle, generateSessionKey, getBreadcrumbPaths, getCurrentLocale, getIcon, getIconRegistry, i18n, initSecureStorage, isArray, isDate, isEmpty, isEmptyObject, isFunction, isObject, isPathMatch, isPromise, joinPath, loadingBar, menuToRoutes, nf, normalizePath, registerIcon, registerLazyLocale, removeWatermark, searchMenuItems, secureLocal, secureSession, secureStoragePlugin, setLocale, setupI18n, supportedLocales, t, tc, themes, throttle, useConfig, useFormSchema, useFormValidate, useLoading, useLoadingBar, useLoginForm, useNamespace };
+export { ANIMATION_DURATION, COMPONENT_PREFIX, CSS_PREFIX, DEBOUNCE_DEFAULTS, DEBOUNCE_DELAY, DEFAULT_LAYOUT_SIZE, Message, Notification, THROTTLE_DEFAULTS, THROTTLE_DELAY, YdAdminResolver, ai_loader_default as YdAiLoader, anchor_default as YdAnchor, auto_complete_default as YdAutoComplete, avatar_default as YdAvatar, badge_default as YdBadge, breadcrumb_default as YdBreadcrumb, button_default as YdButton, calendar_default as YdCalendar, captcha_default as YdCaptcha, card_default as YdCard, cascader_default as YdCascader, chat_bubble_default as YdChatBubble, chat_page_default as YdChatPage, checkbox_default as YdCheckbox, checkbox_group_default as YdCheckboxGroup, code_block_default as YdCodeBlock, collapse_default as YdCollapse, color_picker_default as YdColorPicker, config_provider_default as YdConfigProvider, context_menu_default as YdContextMenu, conversation_default as YdConversation, crud_page_default as YdCrudPage, date_picker_default as YdDatePicker, date_range_picker_default as YdDateRangePicker, divider_default as YdDivider, drawer_default as YdDrawer, dropdown_default as YdDropdown, empty_default as YdEmpty, flow_chart_default as YdFlowChart, form_default as YdForm, form_item_default as YdFormItem, icon_default as YdIcon, image_default as YdImage, image_preview_group_default as YdImagePreviewGroup, input_default as YdInput, input_number_default as YdInputNumber, layout_default as YdLayout, layout_content_default as YdLayoutContent, layout_header_default as YdLayoutHeader, layout_sidebar_default as YdLayoutSidebar, list_default as YdList, loading_bar_default as YdLoadingBar, login_default as YdLogin, login_centered_default as YdLoginCentered, menu_default as YdMenu, modal_default as YdModal, model_selector_default as YdModelSelector, pagination_default as YdPagination, pin_input_default as YdPinInput, popconfirm_default as YdPopconfirm, progress_default as YdProgress, prompt_input_default as YdPromptInput, radio_default as YdRadio, radio_group_default as YdRadioGroup, rate_default as YdRate, reasoning_default as YdReasoning, result_default as YdResult, router_exports as YdRouter, SchemaForm_default as YdSchemaForm, select_default as YdSelect, skeleton_default as YdSkeleton, slider_default as YdSlider, sources_default as YdSources, space_default as YdSpace, spin_default as YdSpin, statistic_default as YdStatistic, stepper_default as YdStepper, steps_default as YdSteps, streaming_text_default as YdStreamingText, suggestion_default as YdSuggestion, switch_default as YdSwitch, table_default as YdTable, tabs_default as YdTabs, tag_default as YdTag, textarea_default as YdTextarea, time_picker_default as YdTimePicker, timeline_default as YdTimeline, tooltip_default as YdTooltip, transfer_default as YdTransfer, tree_default as YdTree, tree_select_default as YdTreeSelect, upload_default as YdUpload, watermark_default as YdWatermark, Z_INDEX, buildBreadcrumb, changeLocale, checkRoutePermission, clearKeyCache, cn, convertToSimpleRoute, createSecureStorage, createWatermark, debounce, decrypt, deepClone, dt, dynamicRouter, encrypt, filterMenuItems, findMenuItem, findMenuPath, flattenMenuItems, generateId, generateRouteTitle, generateSessionKey, getBreadcrumbPaths, getCurrentLocale, getIcon, getIconRegistry, getKeySource, i18n, initSecureStorage, isArray, isDate, isEmpty, isEmptyObject, isFunction, isObject, isPathMatch, isPromise, isStorageReady, joinPath, loadingBar, menuToRoutes, nf, normalizePath, registerIcon, registerLazyLocale, removeWatermark, resetStorageKey, rotateStorageKey, searchMenuItems, secureLocal, secureSession, secureStoragePlugin, setLocale, setSessionStorageEncryptionKey, setStorageEncryptionKey, setupI18n, signData, storageReady, supportedLocales, t, tc, themes, throttle, useConfig, useFormSchema, useFormValidate, useLoading, useLoadingBar, useLoginForm, useNamespace, verifyData };

package/dist/style.css

@@ -113,24 +113,24 @@
   animation: yd-spin 1s linear infinite;
 }
 
-.yd-icon[data-v-20774ae9] {
+.yd-icon[data-v-bb6b8302] {
   display: inline-flex;
   align-items: center;
   justify-content: center;
   vertical-align: middle;
   line-height: 1;
 }
-.yd-icon__svg[data-v-20774ae9] {
+.yd-icon__svg[data-v-bb6b8302] {
   width: 100%;
   height: 100%;
   fill: none;
 }
 /* Spin animation */
-.yd-icon[style*="animation"] .yd-icon__svg[data-v-20774ae9],
-.yd-icon__svg--spin[data-v-20774ae9] {
-  animation: yd-icon-spin-20774ae9 1s linear infinite;
+.yd-icon[style*="animation"] .yd-icon__svg[data-v-bb6b8302],
+.yd-icon__svg--spin[data-v-bb6b8302] {
+  animation: yd-icon-spin-bb6b8302 1s linear infinite;
 }
-@keyframes yd-icon-spin-20774ae9 {
+@keyframes yd-icon-spin-bb6b8302 {
 from {
     transform: rotate(0deg);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yd-admin",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "基于 Vue 3 的后台管理框架通用组件库 - 轻量、高效、主题可定制",
   "keywords": [
     "admin",