zmdms-utils 0.0.96 → 0.0.98

package/dist/es/file.js

@@ -1,7 +1,7 @@
 import { getPreToken } from './auth.js';
 import { dangerouslyXss, specialString, getFileExtension, isImageExtension } from './common.js';
 import { BASIC_KEY, TOKEN_KEY, FILE_SERVICE, FILE_PRVIEW_SERVICE_URL } from './constants.js';
-import { Crypto } from './crypto.js';
+import { getOssCrypto } from './securityKey.js';
 
 /**
  * 附件相关接口
@@ -418,7 +418,10 @@ function getBasicInfo(baseURL, token) {
  */
 function encodeFileId(fileId, encodeNum) {
     if (encodeNum === void 0) { encodeNum = 1; }
-    var crypto = new Crypto(window.__CRYPTO_AES_KEY__, window.__CRYPTO_DES_KEY__);
+    var crypto = getOssCrypto();
+    if (!crypto) {
+        throw new Error("缺少附件加密密钥，请先调用initSecurityKeys初始化或设置window.__CRYPTO_AES_KEY__");
+    }
     if (encodeNum === 0) {
         return crypto.encrypt(fileId);
     }

package/dist/es/request.d.ts

@@ -23,6 +23,11 @@ declare class AxiosRequest {
     private responseError;
     private logoutHandle;
     request(options: IOptions): Promise<AxiosResponse<any, any>>;
+    /**
+     * 推断密钥接口的请求前缀地址
+     * 绝对地址的请求取其origin 其他情况取实例的baseURL(同源场景为空串)
+     */
+    private getSecurityKeyBaseURL;
 }
 interface IOptions extends AxiosRequestConfig {
     isFormData?: boolean;
@@ -75,6 +80,12 @@ interface IOtherOptions {
     baseURL?: string;
     /** 加密实例方法 */
     crypto?: Crypto;
+    /**
+     * 开启自动密钥模式
+     * 开启后无需传crypto 加密请求会自动等待密钥就绪后加密
+     * 带token的请求会顺带预热密钥
+     */
+    securityKey?: boolean;
     /** 超时是否需要弹框 */
     isTimeoutConfirm?: boolean;
     /** 超时弹框提示内容 */

package/dist/es/request.js

@@ -1,6 +1,7 @@
-import { __rest, __assign } from './_virtual/_tslib.js';
+import { __awaiter, __rest, __assign, __generator } from './_virtual/_tslib.js';
 import axios from 'axios';
 import { removeToken, getPreToken } from './auth.js';
+import { getApiCrypto, initSecurityKeys } from './securityKey.js';
 import { TOKEN_KEY } from './constants.js';
 
 var defaultOptions = {
@@ -236,67 +237,106 @@ var AxiosRequest = /** @class */ (function () {
     };
     // 实例方法
     AxiosRequest.prototype.request = function (options) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-        var isFormData = options.isFormData, _k = options.isAuth, isAuth = _k === void 0 ? true : _k, resetOptions = __rest(options, ["isFormData", "isAuth"]);
-        var newOptions = resetOptions;
-        // 自定义请求头
-        if (!newOptions.headers) {
-            newOptions.headers = {};
-        }
-        if (isAuth) {
-            var token = getPreToken();
-            if (token) {
-                newOptions.headers[this.tokenKey] = token;
-            }
-        }
-        // 遍历params，将undefined值 转为null值
-        if (newOptions.data) {
-            newOptions.data = transformData(newOptions.data);
-        }
-        if (newOptions.params) {
-            newOptions.params = transformData(newOptions.params);
-        }
-        // 处理特殊请求
-        var specialMethod = ["POST", "PUT", "PATCH"];
-        var method = ((_a = newOptions.method) === null || _a === void 0 ? void 0 : _a.toUpperCase()) || "";
-        if (specialMethod.includes(method)) {
-            if (isFormData) {
-                var formData = new FormData();
-                var dataObj = newOptions.data || {};
-                var dataKey = Object.keys(dataObj);
-                var dataVal = Object.values(dataObj);
-                for (var i = 0; i < dataKey.length; i++) {
-                    if (dataVal[i]) {
-                        formData.append(dataKey[i], dataVal[i]);
-                    }
+        var _a, _b, _c, _d, _e;
+        return __awaiter(this, void 0, void 0, function () {
+            var isFormData, _f, isAuth, resetOptions, newOptions, token, specialMethod, method, formData, dataObj, dataKey, dataVal, i, crypto;
+            return __generator(this, function (_g) {
+                switch (_g.label) {
+                    case 0:
+                        isFormData = options.isFormData, _f = options.isAuth, isAuth = _f === void 0 ? true : _f, resetOptions = __rest(options, ["isFormData", "isAuth"]);
+                        newOptions = resetOptions;
+                        // 自定义请求头
+                        if (!newOptions.headers) {
+                            newOptions.headers = {};
+                        }
+                        if (isAuth) {
+                            token = getPreToken();
+                            if (token) {
+                                newOptions.headers[this.tokenKey] = token;
+                            }
+                            // 自动密钥模式：带token的请求顺带预热密钥 不阻塞当前请求
+                            // 预热失败静默处理 真正需要密钥的请求会再走到等待逻辑并报错
+                            if (this.otherOptions.securityKey) {
+                                initSecurityKeys({
+                                    baseURL: this.getSecurityKeyBaseURL(options),
+                                }).catch(function () { });
+                            }
+                        }
+                        if (!(newOptions.isCrypto && !this.crypto && this.otherOptions.securityKey)) return [3 /*break*/, 2];
+                        return [4 /*yield*/, initSecurityKeys({
+                                baseURL: this.getSecurityKeyBaseURL(options),
+                            })];
+                    case 1:
+                        _g.sent();
+                        _g.label = 2;
+                    case 2:
+                        // 遍历params，将undefined值 转为null值
+                        if (newOptions.data) {
+                            newOptions.data = transformData(newOptions.data);
+                        }
+                        if (newOptions.params) {
+                            newOptions.params = transformData(newOptions.params);
+                        }
+                        specialMethod = ["POST", "PUT", "PATCH"];
+                        method = ((_a = newOptions.method) === null || _a === void 0 ? void 0 : _a.toUpperCase()) || "";
+                        if (specialMethod.includes(method)) {
+                            if (isFormData) {
+                                formData = new FormData();
+                                dataObj = newOptions.data || {};
+                                dataKey = Object.keys(dataObj);
+                                dataVal = Object.values(dataObj);
+                                for (i = 0; i < dataKey.length; i++) {
+                                    if (dataVal[i]) {
+                                        formData.append(dataKey[i], dataVal[i]);
+                                    }
+                                }
+                                newOptions.headers["Content-Type"] = "multipart/form-data";
+                                newOptions.data = formData;
+                            }
+                            else {
+                                newOptions.headers = __assign({ "Content-Type": "application/json" }, newOptions.headers);
+                            }
+                        }
+                        crypto = this.crypto ||
+                            (this.otherOptions.securityKey ? getApiCrypto() : undefined);
+                        // 将参数进行aes加密
+                        if (newOptions.isCrypto === true || newOptions.isCrypto === "aes") {
+                            if (newOptions.data) {
+                                newOptions.data = (_b = crypto === null || crypto === void 0 ? void 0 : crypto.encrypt) === null || _b === void 0 ? void 0 : _b.call(crypto, JSON.stringify(newOptions.data));
+                            }
+                            if (newOptions.params) {
+                                newOptions.params = (_c = crypto === null || crypto === void 0 ? void 0 : crypto.encrypt) === null || _c === void 0 ? void 0 : _c.call(crypto, JSON.stringify(newOptions.params));
+                            }
+                        }
+                        // 将参数进行des加密
+                        if (newOptions.isCrypto === "des") {
+                            if (newOptions.data) {
+                                newOptions.data = (_d = crypto === null || crypto === void 0 ? void 0 : crypto.encrypt_des) === null || _d === void 0 ? void 0 : _d.call(crypto, JSON.stringify(newOptions.data));
+                            }
+                            if (newOptions.params) {
+                                newOptions.params = (_e = crypto === null || crypto === void 0 ? void 0 : crypto.encrypt_des) === null || _e === void 0 ? void 0 : _e.call(crypto, JSON.stringify(newOptions.params));
+                            }
+                        }
+                        return [2 /*return*/, this.instanceAxios(newOptions)];
                 }
-                newOptions.headers["Content-Type"] = "multipart/form-data";
-                newOptions.data = formData;
-            }
-            else {
-                newOptions.headers = __assign({ "Content-Type": "application/json" }, newOptions.headers);
-            }
-        }
-        // 数据加密处理 TODO:
-        // 将参数进行aes加密
-        if (newOptions.isCrypto === true || newOptions.isCrypto === "aes") {
-            if (newOptions.data) {
-                newOptions.data = (_c = (_b = this.crypto) === null || _b === void 0 ? void 0 : _b.encrypt) === null || _c === void 0 ? void 0 : _c.call(_b, JSON.stringify(newOptions.data));
-            }
-            if (newOptions.params) {
-                newOptions.params = (_e = (_d = this.crypto) === null || _d === void 0 ? void 0 : _d.encrypt) === null || _e === void 0 ? void 0 : _e.call(_d, JSON.stringify(newOptions.params));
-            }
-        }
-        // 将参数进行des加密
-        if (newOptions.isCrypto === "des") {
-            if (newOptions.data) {
-                newOptions.data = (_g = (_f = this.crypto) === null || _f === void 0 ? void 0 : _f.encrypt_des) === null || _g === void 0 ? void 0 : _g.call(_f, JSON.stringify(newOptions.data));
+            });
+        });
+    };
+    /**
+     * 推断密钥接口的请求前缀地址
+     * 绝对地址的请求取其origin 其他情况取实例的baseURL(同源场景为空串)
+     */
+    AxiosRequest.prototype.getSecurityKeyBaseURL = function (options) {
+        var url = options.url || "";
+        if (/^https?:\/\//i.test(url)) {
+            try {
+                return new URL(url).origin;
             }
-            if (newOptions.params) {
-                newOptions.params = (_j = (_h = this.crypto) === null || _h === void 0 ? void 0 : _h.encrypt_des) === null || _j === void 0 ? void 0 : _j.call(_h, JSON.stringify(newOptions.params));
+            catch (err) {
+                console.log(err);
             }
         }
-        return this.instanceAxios(newOptions);
+        return this.otherOptions.baseURL || "";
     };
     return AxiosRequest;
 }());

package/dist/es/securityKey.d.ts

@@ -0,0 +1,49 @@
+import { Crypto } from './crypto.js';
+
+/**
+ * 密钥集合
+ */
+interface ISecurityKeys {
+    /** 接口请求参数加密用 AES 密钥 */
+    apiAesKey: string;
+    /** 接口请求参数加密用 DES 密钥 */
+    apiDesKey: string;
+    /** 附件(OSS)相关加密用 AES 密钥 */
+    ossAesKey: string;
+    /** 附件(OSS)相关加密用 DES 密钥 */
+    ossDesKey: string;
+}
+interface ISecurityKeysOptions {
+    /** 接口请求的前缀地址 必传 */
+    baseURL: string;
+}
+/**
+ * 初始化安全密钥
+ * 应用启动时(render之前)调用一次 并发调用会共享同一个请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+declare function initSecurityKeys(options: ISecurityKeysOptions): Promise<ISecurityKeys>;
+/**
+ * 强制刷新安全密钥
+ * 后端轮换密钥后可调用 会忽略已有缓存重新请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+declare function refreshSecurityKeys(options: ISecurityKeysOptions): Promise<ISecurityKeys>;
+/**
+ * 获取接口请求参数加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+declare function getApiCrypto(): Crypto | undefined;
+/**
+ * 获取附件(OSS)相关加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+declare function getOssCrypto(): Crypto | undefined;
+
+export { ISecurityKeys, getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys };

package/dist/es/securityKey.js

@@ -0,0 +1,121 @@
+import { __awaiter, __generator } from './_virtual/_tslib.js';
+import axios from 'axios';
+import { getPreToken } from './auth.js';
+import { TOKEN_KEY, BASIC_KEY } from './constants.js';
+import { Crypto } from './crypto.js';
+
+// 密钥内存缓存 不挂载到window 避免产生新的明文全局变量
+var securityKeys = null;
+// 进行中的密钥请求 并发调用initSecurityKeys/refreshSecurityKeys时共享同一个请求
+var securityKeysPromise = null;
+/**
+ * 初始化安全密钥
+ * 应用启动时(render之前)调用一次 并发调用会共享同一个请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+function initSecurityKeys(options) {
+    if (securityKeys) {
+        return Promise.resolve(securityKeys);
+    }
+    if (securityKeysPromise) {
+        return securityKeysPromise;
+    }
+    return requestSecurityKeys(options);
+}
+/**
+ * 强制刷新安全密钥
+ * 后端轮换密钥后可调用 会忽略已有缓存重新请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+function refreshSecurityKeys(options) {
+    return requestSecurityKeys(options);
+}
+/**
+ * 获取接口请求参数加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+function getApiCrypto() {
+    if (securityKeys === null || securityKeys === void 0 ? void 0 : securityKeys.apiAesKey) {
+        return new Crypto(securityKeys.apiAesKey, securityKeys.apiDesKey);
+    }
+    return createCryptoFromWindow();
+}
+/**
+ * 获取附件(OSS)相关加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+function getOssCrypto() {
+    if (securityKeys === null || securityKeys === void 0 ? void 0 : securityKeys.ossAesKey) {
+        return new Crypto(securityKeys.ossAesKey, securityKeys.ossDesKey);
+    }
+    return createCryptoFromWindow();
+}
+/**
+ * 请求密钥并缓存
+ */
+function requestSecurityKeys(options) {
+    securityKeysPromise = fetchSecurityKeys(options).then(function (keys) {
+        securityKeys = keys;
+        securityKeysPromise = null;
+        return keys;
+    }, function (err) {
+        securityKeysPromise = null;
+        throw err;
+    });
+    return securityKeysPromise;
+}
+/**
+ * 请求密钥接口
+ * 使用裸axios请求(不走AxiosRequest) 避免请求本身依赖密钥或触发统一的异常处理
+ */
+function fetchSecurityKeys(options) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function () {
+        var apiBaseURL, headers, token, response, _c, code, data, msg;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    apiBaseURL = ((_b = (_a = options.baseURL) === null || _a === void 0 ? void 0 : _a.endsWith) === null || _b === void 0 ? void 0 : _b.call(_a, "/"))
+                        ? options.baseURL.slice(0, options.baseURL.length - 1)
+                        : options.baseURL;
+                    headers = {};
+                    token = getPreToken();
+                    if (token) {
+                        headers[TOKEN_KEY] = token;
+                    }
+                    return [4 /*yield*/, axios.get("".concat(apiBaseURL, "/api/").concat(BASIC_KEY, "-resource/resource/get-security-key"), { headers: headers, timeout: 60000 })];
+                case 1:
+                    response = _d.sent();
+                    _c = (response === null || response === void 0 ? void 0 : response.data) || {}, code = _c.code, data = _c.data, msg = _c.msg;
+                    if (code === 200 && data) {
+                        return [2 /*return*/, {
+                                apiAesKey: data.apiAesKey,
+                                apiDesKey: data.apiDesKey,
+                                ossAesKey: data.ossAesKey,
+                                ossDesKey: data.ossDesKey,
+                            }];
+                    }
+                    throw new Error(msg || "获取安全密钥失败");
+            }
+        });
+    });
+}
+/**
+ * 从window旧密钥创建Crypto实例 兼容未改造的应用
+ */
+function createCryptoFromWindow() {
+    var aesKey = window.__CRYPTO_AES_KEY__;
+    var desKey = window.__CRYPTO_DES_KEY__;
+    if (aesKey) {
+        return new Crypto(aesKey, desKey);
+    }
+    return undefined;
+}
+
+export { getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys };

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { getPreToken, getToken, parseToken, removeToken, setToken } from './es/a
 export { AxiosRequest, IOptions, IOtherOptions } from './es/request.js';
 export { getBaseUrl } from './es/baseUrl.js';
 export { Crypto, md5 } from './es/crypto.js';
+export { ISecurityKeys, getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys } from './es/securityKey.js';
 export { addThousedSeparator, appendQueryParamsToUrl, copyToClipboard, dangerouslyXss, delay, emitter, getFileExtension, isChinese, isImageExtension, isNonEmpty, parseJoin, parseQueryParams, specialString, unescapeString } from './es/common.js';
 export { divide, exactRound, formatUnit, minus, plus, times } from './es/math.js';
 export { validatePassword } from './es/passwordValidate.js';

package/dist/index.js

@@ -5,6 +5,7 @@ export { getPreToken, getToken, parseToken, removeToken, setToken } from './es/a
 export { AxiosRequest } from './es/request.js';
 export { getBaseUrl } from './es/baseUrl.js';
 export { Crypto, md5 } from './es/crypto.js';
+export { getApiCrypto, getOssCrypto, initSecurityKeys, refreshSecurityKeys } from './es/securityKey.js';
 export { addThousedSeparator, appendQueryParamsToUrl, copyToClipboard, dangerouslyXss, delay, emitter, getFileExtension, isChinese, isImageExtension, isNonEmpty, parseJoin, parseQueryParams, specialString, unescapeString } from './es/common.js';
 export { divide, exactRound, formatUnit, minus, plus, times } from './es/math.js';
 export { validatePassword } from './es/passwordValidate.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zmdms-utils",
-  "version": "0.0.96",
+  "version": "0.0.98",
   "description": "",
   "main": "dist/index.js",
   "module": "dist/index.js",

package/src/file.ts

@@ -15,7 +15,7 @@ import {
   FILE_PRVIEW_SERVICE_URL,
 } from "./constants";
 import { AxiosResponse } from "axios";
-import { Crypto } from "./crypto";
+import { getOssCrypto } from "./securityKey";
 
 // 是否是中拓的附件服务
 const isZmdmsFileService = FILE_SERVICE === "zmdms";
@@ -546,10 +546,12 @@ interface IThumbnailLinkOptions extends Partial<IOptions> {
  * 3. 如果参数是通过body传输的，只需要encode一次
  */
 export function encodeFileId(fileId: string, encodeNum: number = 1) {
-  const crypto = new Crypto(
-    (window as any).__CRYPTO_AES_KEY__,
-    (window as any).__CRYPTO_DES_KEY__,
-  );
+  const crypto = getOssCrypto();
+  if (!crypto) {
+    throw new Error(
+      "缺少附件加密密钥，请先调用initSecurityKeys初始化或设置window.__CRYPTO_AES_KEY__",
+    );
+  }
   if (encodeNum === 0) {
     return crypto.encrypt(fileId);
   }

package/src/index.ts

@@ -11,6 +11,13 @@ export {
 export { AxiosRequest, type IOtherOptions, type IOptions } from "./request";
 export { getBaseUrl } from "./baseUrl";
 export { Crypto, md5, Base64 } from "./crypto";
+export {
+  initSecurityKeys,
+  refreshSecurityKeys,
+  getApiCrypto,
+  getOssCrypto,
+  type ISecurityKeys,
+} from "./securityKey";
 export {
   delay,
   emitter,

package/src/request.ts

@@ -7,6 +7,7 @@ import axios, {
 } from "axios";
 import { getPreToken, removeToken } from "./auth";
 import { Crypto } from "./crypto";
+import { initSecurityKeys, getApiCrypto } from "./securityKey";
 import { TOKEN_KEY } from "./constants";
 
 const defaultOptions: IOtherOptions = {
@@ -286,7 +287,7 @@ export class AxiosRequest {
   }
 
   // 实例方法
-  public request(options: IOptions) {
+  public async request(options: IOptions) {
     const { isFormData, isAuth = true, ...resetOptions } = options;
 
     const newOptions = resetOptions;
@@ -300,6 +301,20 @@ export class AxiosRequest {
       if (token) {
         newOptions.headers[this.tokenKey] = token;
       }
+      // 自动密钥模式：带token的请求顺带预热密钥 不阻塞当前请求
+      // 预热失败静默处理 真正需要密钥的请求会再走到等待逻辑并报错
+      if (this.otherOptions.securityKey) {
+        initSecurityKeys({
+          baseURL: this.getSecurityKeyBaseURL(options),
+        }).catch(() => {});
+      }
+    }
+
+    // 自动密钥模式：加密请求优先等待密钥就绪(外部已传入crypto实例时除外)
+    if (newOptions.isCrypto && !this.crypto && this.otherOptions.securityKey) {
+      await initSecurityKeys({
+        baseURL: this.getSecurityKeyBaseURL(options),
+      });
     }
 
     // 遍历params，将undefined值 转为null值
@@ -335,15 +350,17 @@ export class AxiosRequest {
     }
 
     // 数据加密处理 TODO:
+    // 优先使用外部传入的crypto实例 自动密钥模式下使用密钥管理器的实例
+    const crypto =
+      this.crypto ||
+      (this.otherOptions.securityKey ? getApiCrypto() : undefined);
     // 将参数进行aes加密
     if (newOptions.isCrypto === true || newOptions.isCrypto === "aes") {
       if (newOptions.data) {
-        newOptions.data = this.crypto?.encrypt?.(
-          JSON.stringify(newOptions.data),
-        );
+        newOptions.data = crypto?.encrypt?.(JSON.stringify(newOptions.data));
       }
       if (newOptions.params) {
-        newOptions.params = this.crypto?.encrypt?.(
+        newOptions.params = crypto?.encrypt?.(
           JSON.stringify(newOptions.params),
         );
       }
@@ -351,12 +368,12 @@ export class AxiosRequest {
     // 将参数进行des加密
     if (newOptions.isCrypto === "des") {
       if (newOptions.data) {
-        newOptions.data = this.crypto?.encrypt_des?.(
+        newOptions.data = crypto?.encrypt_des?.(
           JSON.stringify(newOptions.data),
         );
       }
       if (newOptions.params) {
-        newOptions.params = this.crypto?.encrypt_des?.(
+        newOptions.params = crypto?.encrypt_des?.(
           JSON.stringify(newOptions.params),
         );
       }
@@ -364,6 +381,22 @@ export class AxiosRequest {
 
     return this.instanceAxios(newOptions);
   }
+
+  /**
+   * 推断密钥接口的请求前缀地址
+   * 绝对地址的请求取其origin 其他情况取实例的baseURL(同源场景为空串)
+   */
+  private getSecurityKeyBaseURL(options: IOptions): string {
+    const url = options.url || "";
+    if (/^https?:\/\//i.test(url)) {
+      try {
+        return new URL(url).origin;
+      } catch (err) {
+        console.log(err);
+      }
+    }
+    return this.otherOptions.baseURL || "";
+  }
 }
 
 function transformData(data?: any): any {
@@ -442,6 +475,12 @@ export interface IOtherOptions {
   baseURL?: string;
   /** 加密实例方法 */
   crypto?: Crypto;
+  /**
+   * 开启自动密钥模式
+   * 开启后无需传crypto 加密请求会自动等待密钥就绪后加密
+   * 带token的请求会顺带预热密钥
+   */
+  securityKey?: boolean;
   /** 超时是否需要弹框 */
   isTimeoutConfirm?: boolean;
   /** 超时弹框提示内容 */

package/src/securityKey.ts

@@ -0,0 +1,151 @@
+/**
+ * 安全密钥管理
+ * 从后端接口获取前端加解密密钥，替代打包时的硬编码密钥，避免密钥随JS泄露
+ */
+import axios from "axios";
+import { getPreToken } from "./auth";
+import { BASIC_KEY, TOKEN_KEY } from "./constants";
+import { Crypto } from "./crypto";
+
+/**
+ * 密钥集合
+ */
+export interface ISecurityKeys {
+  /** 接口请求参数加密用 AES 密钥 */
+  apiAesKey: string;
+  /** 接口请求参数加密用 DES 密钥 */
+  apiDesKey: string;
+  /** 附件(OSS)相关加密用 AES 密钥 */
+  ossAesKey: string;
+  /** 附件(OSS)相关加密用 DES 密钥 */
+  ossDesKey: string;
+}
+
+interface ISecurityKeysOptions {
+  /** 接口请求的前缀地址 必传 */
+  baseURL: string;
+}
+
+// 密钥内存缓存 不挂载到window 避免产生新的明文全局变量
+let securityKeys: ISecurityKeys | null = null;
+// 进行中的密钥请求 并发调用initSecurityKeys/refreshSecurityKeys时共享同一个请求
+let securityKeysPromise: Promise<ISecurityKeys> | null = null;
+
+/**
+ * 初始化安全密钥
+ * 应用启动时(render之前)调用一次 并发调用会共享同一个请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+export function initSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  if (securityKeys) {
+    return Promise.resolve(securityKeys);
+  }
+  if (securityKeysPromise) {
+    return securityKeysPromise;
+  }
+  return requestSecurityKeys(options);
+}
+
+/**
+ * 强制刷新安全密钥
+ * 后端轮换密钥后可调用 会忽略已有缓存重新请求
+ * @param options
+ * @param options.baseURL {string} 接口请求的前缀地址 必传
+ * @returns 密钥集合
+ */
+export function refreshSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  return requestSecurityKeys(options);
+}
+
+/**
+ * 获取接口请求参数加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+export function getApiCrypto(): Crypto | undefined {
+  if (securityKeys?.apiAesKey) {
+    return new Crypto(securityKeys.apiAesKey, securityKeys.apiDesKey);
+  }
+  return createCryptoFromWindow();
+}
+
+/**
+ * 获取附件(OSS)相关加密的Crypto实例
+ * 未初始化时回退读取window上的旧密钥(兼容未接入initSecurityKeys的应用)
+ * @returns Crypto实例 未获取到密钥时返回undefined
+ */
+export function getOssCrypto(): Crypto | undefined {
+  if (securityKeys?.ossAesKey) {
+    return new Crypto(securityKeys.ossAesKey, securityKeys.ossDesKey);
+  }
+  return createCryptoFromWindow();
+}
+
+/**
+ * 请求密钥并缓存
+ */
+function requestSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  securityKeysPromise = fetchSecurityKeys(options).then(
+    (keys) => {
+      securityKeys = keys;
+      securityKeysPromise = null;
+      return keys;
+    },
+    (err) => {
+      securityKeysPromise = null;
+      throw err;
+    },
+  );
+  return securityKeysPromise;
+}
+
+/**
+ * 请求密钥接口
+ * 使用裸axios请求(不走AxiosRequest) 避免请求本身依赖密钥或触发统一的异常处理
+ */
+async function fetchSecurityKeys(
+  options: ISecurityKeysOptions,
+): Promise<ISecurityKeys> {
+  const apiBaseURL = options.baseURL?.endsWith?.("/")
+    ? options.baseURL.slice(0, options.baseURL.length - 1)
+    : options.baseURL;
+  const headers: { [prop: string]: string } = {};
+  const token = getPreToken();
+  if (token) {
+    headers[TOKEN_KEY] = token;
+  }
+  const response = await axios.get(
+    `${apiBaseURL}/api/${BASIC_KEY}-resource/resource/get-security-key`,
+    { headers, timeout: 60000 },
+  );
+  const { code, data, msg } = response?.data || {};
+  if (code === 200 && data) {
+    return {
+      apiAesKey: data.apiAesKey,
+      apiDesKey: data.apiDesKey,
+      ossAesKey: data.ossAesKey,
+      ossDesKey: data.ossDesKey,
+    };
+  }
+  throw new Error(msg || "获取安全密钥失败");
+}
+
+/**
+ * 从window旧密钥创建Crypto实例 兼容未改造的应用
+ */
+function createCryptoFromWindow(): Crypto | undefined {
+  const aesKey = (window as any).__CRYPTO_AES_KEY__;
+  const desKey = (window as any).__CRYPTO_DES_KEY__;
+  if (aesKey) {
+    return new Crypto(aesKey, desKey);
+  }
+  return undefined;
+}