施工(HEL-226): 实现登录门户与本机免密切换账号
用设备 Cookie 和授权表记住本机已验证账号，登录页按确认样图做成门户，不再把密码写进浏览器。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>
This commit is contained in:
总工
co-authored by
Cursor
multica-agent
Cursor
multica-agent
parent
8a5e78f022
commit
f0a1adf52f
@@ -18,6 +18,8 @@ TOKEN_PATTERN = re.compile(r"^[A-Za-z0-9_-]{20,128}$")
|
||||
USERNAME_PATTERN = re.compile(r"^[A-Za-z0-9_\-\u4e00-\u9fff]{3,30}$")
|
||||
SESSION_COOKIE = "xiaobai_session"
|
||||
SESSION_MAX_AGE = 30 * 24 * 60 * 60
|
||||
DEVICE_COOKIE = "xiaobai_device"
|
||||
DEVICE_MAX_AGE = 180 * 24 * 60 * 60
|
||||
|
||||
|
||||
def load_local_env() -> None:
|
||||
|
||||
@@ -2,6 +2,7 @@ from .m0001_adopt_legacy import MIGRATION as M0001_ADOPT_LEGACY
|
||||
from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
|
||||
from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
|
||||
from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
|
||||
from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
|
||||
from .runner import Migration, MigrationError, MigrationRunner
|
||||
|
||||
MIGRATIONS = (
|
||||
@@ -9,6 +10,7 @@ MIGRATIONS = (
|
||||
M0002_JOB_RUNS,
|
||||
M0003_LLM_AUDIT,
|
||||
M0004_MENTOR_NOTES,
|
||||
M0005_ACCOUNT_SWITCH_GRANTS,
|
||||
)
|
||||
|
||||
__all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import sqlite3
|
||||
|
||||
from backend.database.migrations.runner import Migration
|
||||
|
||||
|
||||
def create_account_switch_grants(connection: sqlite3.Connection) -> None:
|
||||
connection.execute(
|
||||
"""
|
||||
CREATE TABLE IF NOT EXISTS account_switch_grants (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
device_hash TEXT NOT NULL,
|
||||
user_id INTEGER NOT NULL,
|
||||
granted_at TEXT NOT NULL,
|
||||
last_used_at TEXT NOT NULL,
|
||||
expires_at TEXT NOT NULL,
|
||||
UNIQUE (device_hash, user_id),
|
||||
FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
|
||||
)
|
||||
"""
|
||||
)
|
||||
connection.execute(
|
||||
"""
|
||||
CREATE INDEX IF NOT EXISTS idx_account_switch_grants_device
|
||||
ON account_switch_grants(device_hash, last_used_at DESC)
|
||||
"""
|
||||
)
|
||||
connection.execute(
|
||||
"""
|
||||
CREATE INDEX IF NOT EXISTS idx_account_switch_grants_expiry
|
||||
ON account_switch_grants(expires_at)
|
||||
"""
|
||||
)
|
||||
|
||||
|
||||
MIGRATION = Migration(
|
||||
version="0005",
|
||||
name="create_account_switch_grants",
|
||||
action=create_account_switch_grants,
|
||||
signature="account-switch-grants:v1:device,user,granted,used,expires,unique",
|
||||
)
|
||||
@@ -28,11 +28,11 @@ class AccountApplicationMixin:
|
||||
def update_membership(self, payload: dict[str, Any]) -> None:
|
||||
self.accounts.update_membership(payload)
|
||||
|
||||
def register_account(self, username: str, password: str) -> dict[str, Any]:
|
||||
return self.accounts.register(username, password)
|
||||
def register_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
|
||||
return self.accounts.register(username, password, device_hash)
|
||||
|
||||
def login_account(self, username: str, password: str) -> dict[str, Any]:
|
||||
return self.accounts.login(username, password)
|
||||
def login_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
|
||||
return self.accounts.login(username, password, device_hash)
|
||||
|
||||
def change_password(self, current_password: str, new_password: str) -> None:
|
||||
self.accounts.change_password(current_password, new_password)
|
||||
|
||||
@@ -1,49 +1,108 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import secrets
|
||||
from http import HTTPStatus
|
||||
|
||||
from backend.features.accounts.security import token_hash
|
||||
|
||||
|
||||
class AccountHttpMixin:
|
||||
def _device_hash(self) -> str:
|
||||
raw = self.device_token()
|
||||
return token_hash(raw) if raw else ""
|
||||
|
||||
def _ensure_device_token(self) -> str:
|
||||
return self.device_token() or secrets.token_urlsafe(32)
|
||||
|
||||
def _auth_success_headers(self, session_token: str, device_raw: str) -> list[tuple[str, str]]:
|
||||
return [
|
||||
("Set-Cookie", self.session_cookie(session_token)),
|
||||
("Set-Cookie", self.device_cookie(device_raw)),
|
||||
]
|
||||
|
||||
def _send_authenticated_session(self, result: dict, status: HTTPStatus, device_raw: str) -> None:
|
||||
self.send_json(
|
||||
{
|
||||
"ok": True,
|
||||
"authenticated": True,
|
||||
"user": result["user"],
|
||||
"csrf_token": result["csrf_token"],
|
||||
},
|
||||
status,
|
||||
self._auth_success_headers(result["session_token"], device_raw),
|
||||
)
|
||||
|
||||
def auth_register(self) -> None:
|
||||
try:
|
||||
body = self.read_json_body()
|
||||
device_raw = self._ensure_device_token()
|
||||
result = self.application_service.register_account(
|
||||
str(body.get("username") or ""),
|
||||
str(body.get("password") or ""),
|
||||
token_hash(device_raw),
|
||||
)
|
||||
self.send_json(
|
||||
{
|
||||
"ok": True,
|
||||
"authenticated": True,
|
||||
"user": result["user"],
|
||||
"csrf_token": result["csrf_token"],
|
||||
},
|
||||
HTTPStatus.CREATED,
|
||||
{"Set-Cookie": self.session_cookie(result["session_token"])},
|
||||
)
|
||||
self._send_authenticated_session(result, HTTPStatus.CREATED, device_raw)
|
||||
except (ValueError, json.JSONDecodeError) as exc:
|
||||
self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
|
||||
|
||||
def auth_login(self) -> None:
|
||||
try:
|
||||
body = self.read_json_body()
|
||||
device_raw = self._ensure_device_token()
|
||||
result = self.application_service.login_account(
|
||||
str(body.get("username") or ""),
|
||||
str(body.get("password") or ""),
|
||||
token_hash(device_raw),
|
||||
)
|
||||
self.send_json(
|
||||
{
|
||||
"ok": True,
|
||||
"authenticated": True,
|
||||
"user": result["user"],
|
||||
"csrf_token": result["csrf_token"],
|
||||
},
|
||||
headers={"Set-Cookie": self.session_cookie(result["session_token"])},
|
||||
)
|
||||
self._send_authenticated_session(result, HTTPStatus.OK, device_raw)
|
||||
except (ValueError, json.JSONDecodeError) as exc:
|
||||
self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
|
||||
|
||||
def auth_accounts(self) -> None:
|
||||
current_user_id = None
|
||||
if self.require_auth(send_error=False):
|
||||
current_user_id = int(self.auth_user["id"])
|
||||
payload = self.application_service.accounts.list_device_accounts(
|
||||
self._device_hash(),
|
||||
current_user_id,
|
||||
)
|
||||
self.send_json({"ok": True, **payload})
|
||||
|
||||
def auth_switch(self) -> None:
|
||||
try:
|
||||
body = self.read_json_body()
|
||||
try:
|
||||
user_id = int(body.get("user_id"))
|
||||
except (TypeError, ValueError):
|
||||
user_id = 0
|
||||
device_raw = self.device_token()
|
||||
result = self.application_service.accounts.switch_account(
|
||||
token_hash(device_raw) if device_raw else "",
|
||||
user_id,
|
||||
)
|
||||
self._send_authenticated_session(
|
||||
result,
|
||||
HTTPStatus.OK,
|
||||
device_raw or self._ensure_device_token(),
|
||||
)
|
||||
except PermissionError as exc:
|
||||
self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
|
||||
except (ValueError, json.JSONDecodeError) as exc:
|
||||
self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
|
||||
|
||||
def auth_forget(self) -> None:
|
||||
try:
|
||||
body = self.read_json_body()
|
||||
try:
|
||||
user_id = int(body.get("user_id"))
|
||||
except (TypeError, ValueError):
|
||||
user_id = 0
|
||||
self.application_service.accounts.forget_account(self._device_hash(), user_id)
|
||||
except (ValueError, json.JSONDecodeError):
|
||||
pass
|
||||
self.send_json({"ok": True})
|
||||
|
||||
def auth_me(self) -> None:
|
||||
service = self.application_service
|
||||
if not self.require_auth(send_error=False):
|
||||
@@ -55,6 +114,15 @@ class AccountHttpMixin:
|
||||
}
|
||||
)
|
||||
return
|
||||
headers = None
|
||||
if not self.device_token():
|
||||
device_raw = secrets.token_urlsafe(32)
|
||||
service.accounts.remember_account(
|
||||
token_hash(device_raw),
|
||||
int(self.auth_user["id"]),
|
||||
fresh=True,
|
||||
)
|
||||
headers = [("Set-Cookie", self.device_cookie(device_raw))]
|
||||
self.send_json(
|
||||
{
|
||||
"ok": True,
|
||||
@@ -66,15 +134,19 @@ class AccountHttpMixin:
|
||||
"membership": service.membership(),
|
||||
},
|
||||
"csrf_token": str(self.auth_user["csrf_token"]),
|
||||
}
|
||||
},
|
||||
headers=headers,
|
||||
)
|
||||
|
||||
def auth_logout(self) -> None:
|
||||
raw_token = self.session_token()
|
||||
user_id = int(getattr(self, "auth_user", {}).get("id") or 0)
|
||||
if raw_token:
|
||||
from backend.features.accounts.security import token_hash
|
||||
|
||||
self.application_service.database.delete_session(token_hash(raw_token))
|
||||
self.application_service.accounts.revoke_current_device_grant(
|
||||
self._device_hash(),
|
||||
user_id,
|
||||
)
|
||||
self.send_json(
|
||||
{"ok": True},
|
||||
headers={"Set-Cookie": self.session_cookie("", clear=True)},
|
||||
|
||||
@@ -234,3 +234,96 @@ class AccountRepositoryMixin:
|
||||
(user_id,),
|
||||
)
|
||||
return cursor.rowcount > 0
|
||||
|
||||
def cleanup_expired_switch_grants(self, now: str) -> int:
|
||||
with self.connect() as connection:
|
||||
cursor = connection.execute(
|
||||
"DELETE FROM account_switch_grants WHERE expires_at <= ?",
|
||||
(now,),
|
||||
)
|
||||
return int(cursor.rowcount)
|
||||
|
||||
def list_switch_grants(self, device_hash: str, now: str) -> list[dict[str, Any]]:
|
||||
with self.connect() as connection:
|
||||
rows = connection.execute(
|
||||
"""
|
||||
SELECT u.id, u.username, u.role, u.llm_mode, u.membership_status,
|
||||
u.membership_plan, u.membership_starts_at, u.membership_expires_at,
|
||||
u.created_at, g.last_used_at, g.granted_at, g.expires_at
|
||||
FROM account_switch_grants AS g
|
||||
JOIN users AS u ON u.id = g.user_id
|
||||
WHERE g.device_hash = ? AND g.expires_at > ?
|
||||
ORDER BY g.last_used_at DESC, g.id DESC
|
||||
""",
|
||||
(device_hash, now),
|
||||
).fetchall()
|
||||
return [dict(row) for row in rows]
|
||||
|
||||
def get_switch_grant(self, device_hash: str, user_id: int) -> dict[str, Any] | None:
|
||||
with self.connect() as connection:
|
||||
row = connection.execute(
|
||||
"""
|
||||
SELECT device_hash, user_id, granted_at, last_used_at, expires_at
|
||||
FROM account_switch_grants
|
||||
WHERE device_hash = ? AND user_id = ?
|
||||
""",
|
||||
(device_hash, user_id),
|
||||
).fetchone()
|
||||
return dict(row) if row else None
|
||||
|
||||
def upsert_switch_grant(
|
||||
self,
|
||||
device_hash: str,
|
||||
user_id: int,
|
||||
granted_at: str,
|
||||
last_used_at: str,
|
||||
expires_at: str,
|
||||
) -> None:
|
||||
with self.connect() as connection:
|
||||
connection.execute(
|
||||
"""
|
||||
INSERT INTO account_switch_grants
|
||||
(device_hash, user_id, granted_at, last_used_at, expires_at)
|
||||
VALUES (?, ?, ?, ?, ?)
|
||||
ON CONFLICT(device_hash, user_id) DO UPDATE SET
|
||||
granted_at = excluded.granted_at,
|
||||
last_used_at = excluded.last_used_at,
|
||||
expires_at = excluded.expires_at
|
||||
""",
|
||||
(device_hash, user_id, granted_at, last_used_at, expires_at),
|
||||
)
|
||||
|
||||
def prune_switch_grants(self, device_hash: str, keep: int) -> int:
|
||||
with self.connect() as connection:
|
||||
rows = connection.execute(
|
||||
"""
|
||||
SELECT id FROM account_switch_grants
|
||||
WHERE device_hash = ?
|
||||
ORDER BY last_used_at DESC, id DESC
|
||||
""",
|
||||
(device_hash,),
|
||||
).fetchall()
|
||||
extra = [int(row["id"]) for row in rows[keep:]]
|
||||
if not extra:
|
||||
return 0
|
||||
connection.execute(
|
||||
f"DELETE FROM account_switch_grants WHERE id IN ({','.join('?' * len(extra))})",
|
||||
extra,
|
||||
)
|
||||
return len(extra)
|
||||
|
||||
def delete_switch_grant(self, device_hash: str, user_id: int) -> bool:
|
||||
with self.connect() as connection:
|
||||
cursor = connection.execute(
|
||||
"DELETE FROM account_switch_grants WHERE device_hash = ? AND user_id = ?",
|
||||
(device_hash, user_id),
|
||||
)
|
||||
return cursor.rowcount > 0
|
||||
|
||||
def delete_switch_grants_for_user(self, user_id: int) -> int:
|
||||
with self.connect() as connection:
|
||||
cursor = connection.execute(
|
||||
"DELETE FROM account_switch_grants WHERE user_id = ?",
|
||||
(user_id,),
|
||||
)
|
||||
return int(cursor.rowcount)
|
||||
|
||||
@@ -6,6 +6,9 @@ class AccountRoutesMixin:
|
||||
if parsed.path == "/api/auth/me":
|
||||
self.auth_me()
|
||||
return True
|
||||
if parsed.path == "/api/auth/accounts":
|
||||
self.auth_accounts()
|
||||
return True
|
||||
return False
|
||||
|
||||
def _handle_accounts_get(self, parsed) -> bool:
|
||||
|
||||
@@ -77,15 +77,22 @@ class AccountService:
|
||||
access = self.access_supplier() or self.database.user_access(self.current_user_id) or {}
|
||||
return self.membership_for_access(access)
|
||||
|
||||
def register(self, username: str, password: str) -> dict[str, Any]:
|
||||
GRANT_SLIDE_DAYS = 30
|
||||
GRANT_HARD_DAYS = 180
|
||||
MAX_GRANTS_PER_DEVICE = 5
|
||||
SWITCH_REAUTH_MESSAGE = "该账号需重新验证"
|
||||
|
||||
def register(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
|
||||
username = username.strip()
|
||||
self.validate_input(username, password)
|
||||
with self.auth_lock:
|
||||
salt, password_digest = hash_password(password)
|
||||
user = self.database.create_user(username, salt, password_digest)
|
||||
return self.create_session(user)
|
||||
result = self.create_session(user)
|
||||
self.remember_account(device_hash, int(user["id"]), fresh=True)
|
||||
return result
|
||||
|
||||
def login(self, username: str, password: str) -> dict[str, Any]:
|
||||
def login(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
|
||||
username = username.strip()
|
||||
if not username or not password:
|
||||
raise ValueError("账号名和密码不能为空。")
|
||||
@@ -96,7 +103,9 @@ class AccountService:
|
||||
str(user.get("password_hash") or ""),
|
||||
):
|
||||
raise ValueError("账号名或密码不正确。")
|
||||
return self.create_session(user)
|
||||
result = self.create_session(user)
|
||||
self.remember_account(device_hash, int(user["id"]), fresh=True)
|
||||
return result
|
||||
|
||||
def change_password(self, current_password: str, new_password: str) -> None:
|
||||
current_password = str(current_password or "")
|
||||
@@ -112,6 +121,86 @@ class AccountService:
|
||||
salt, digest = hash_password(new_password)
|
||||
if not self.database.update_user_password(self.current_user_id, salt, digest):
|
||||
raise ValueError("账号不存在。")
|
||||
self.database.delete_switch_grants_for_user(self.current_user_id)
|
||||
|
||||
@staticmethod
|
||||
def _utc_now() -> datetime:
|
||||
return datetime.now(timezone.utc)
|
||||
|
||||
@classmethod
|
||||
def _iso(cls, value: datetime) -> str:
|
||||
return value.isoformat(timespec="seconds")
|
||||
|
||||
def remember_account(self, device_hash: str, user_id: int, *, fresh: bool = False) -> None:
|
||||
if not device_hash or user_id <= 0:
|
||||
return
|
||||
now = self._utc_now()
|
||||
now_text = self._iso(now)
|
||||
self.database.cleanup_expired_switch_grants(now_text)
|
||||
existing = None if fresh else self.database.get_switch_grant(device_hash, user_id)
|
||||
granted_at = parse_iso_datetime(existing["granted_at"]) if existing else now
|
||||
if granted_at is None:
|
||||
granted_at = now
|
||||
expires = min(
|
||||
now + timedelta(days=self.GRANT_SLIDE_DAYS),
|
||||
granted_at + timedelta(days=self.GRANT_HARD_DAYS),
|
||||
)
|
||||
if not existing:
|
||||
self.database.prune_switch_grants(device_hash, self.MAX_GRANTS_PER_DEVICE - 1)
|
||||
self.database.upsert_switch_grant(
|
||||
device_hash,
|
||||
user_id,
|
||||
self._iso(granted_at),
|
||||
now_text,
|
||||
self._iso(expires),
|
||||
)
|
||||
|
||||
def list_device_accounts(
|
||||
self, device_hash: str, current_user_id: int | None = None
|
||||
) -> dict[str, Any]:
|
||||
if not device_hash:
|
||||
return {"accounts": [], "current_user_id": current_user_id}
|
||||
now_text = self._iso(self._utc_now())
|
||||
self.database.cleanup_expired_switch_grants(now_text)
|
||||
accounts = []
|
||||
for row in self.database.list_switch_grants(device_hash, now_text):
|
||||
accounts.append(
|
||||
{
|
||||
"user_id": int(row["id"]),
|
||||
"username": str(row["username"]),
|
||||
"role": str(row.get("role") or "user"),
|
||||
"membership": self.membership_for_access(row),
|
||||
"last_used_at": str(row.get("last_used_at") or ""),
|
||||
}
|
||||
)
|
||||
return {"accounts": accounts, "current_user_id": current_user_id}
|
||||
|
||||
def switch_account(self, device_hash: str, user_id: int) -> dict[str, Any]:
|
||||
if not device_hash or user_id <= 0:
|
||||
raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
|
||||
now = self._utc_now()
|
||||
now_text = self._iso(now)
|
||||
self.database.cleanup_expired_switch_grants(now_text)
|
||||
grant = self.database.get_switch_grant(device_hash, user_id)
|
||||
expires = parse_iso_datetime(grant.get("expires_at")) if grant else None
|
||||
if not grant or not expires or expires <= now:
|
||||
if grant:
|
||||
self.database.delete_switch_grant(device_hash, user_id)
|
||||
raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
|
||||
user = self.database.user_access(user_id)
|
||||
if not user:
|
||||
raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
|
||||
result = self.create_session(user)
|
||||
self.remember_account(device_hash, user_id)
|
||||
return result
|
||||
|
||||
def forget_account(self, device_hash: str, user_id: int) -> None:
|
||||
if device_hash and user_id > 0:
|
||||
self.database.delete_switch_grant(device_hash, user_id)
|
||||
|
||||
def revoke_current_device_grant(self, device_hash: str, user_id: int) -> None:
|
||||
if device_hash and user_id > 0:
|
||||
self.database.delete_switch_grant(device_hash, user_id)
|
||||
|
||||
def create_session(self, user: dict[str, Any]) -> dict[str, Any]:
|
||||
session_token = secrets.token_urlsafe(32)
|
||||
|
||||
@@ -7,6 +7,8 @@ from urllib.parse import urlparse
|
||||
PUBLIC_POST_HANDLERS = {
|
||||
"/api/auth/register": "auth_register",
|
||||
"/api/auth/login": "auth_login",
|
||||
"/api/auth/switch": "auth_switch",
|
||||
"/api/auth/forget": "auth_forget",
|
||||
}
|
||||
|
||||
AUTHENTICATED_POST_HANDLERS = {
|
||||
|
||||
+26
-10
@@ -9,7 +9,13 @@ from http.cookies import SimpleCookie
|
||||
from typing import Any
|
||||
from urllib.parse import unquote
|
||||
|
||||
from backend.bootstrap.config import SESSION_COOKIE, SESSION_MAX_AGE, STATIC_DIR
|
||||
from backend.bootstrap.config import (
|
||||
DEVICE_COOKIE,
|
||||
DEVICE_MAX_AGE,
|
||||
SESSION_COOKIE,
|
||||
SESSION_MAX_AGE,
|
||||
STATIC_DIR,
|
||||
)
|
||||
from backend.features.accounts.security import token_hash
|
||||
from backend.http.context import correlation_id
|
||||
from backend.http.errors import normalize_error_payload
|
||||
@@ -21,15 +27,21 @@ class HttpTransportMixin:
|
||||
application_service: Any
|
||||
route_registry: Any
|
||||
|
||||
def session_token(self) -> str:
|
||||
def cookie_value(self, name: str) -> str:
|
||||
cookie = SimpleCookie()
|
||||
try:
|
||||
cookie.load(self.headers.get("Cookie", ""))
|
||||
except Exception:
|
||||
return ""
|
||||
morsel = cookie.get(SESSION_COOKIE)
|
||||
morsel = cookie.get(name)
|
||||
return morsel.value if morsel else ""
|
||||
|
||||
def session_token(self) -> str:
|
||||
return self.cookie_value(SESSION_COOKIE)
|
||||
|
||||
def device_token(self) -> str:
|
||||
return self.cookie_value(DEVICE_COOKIE)
|
||||
|
||||
def require_auth(self, send_error: bool = True) -> bool:
|
||||
raw_token = self.session_token()
|
||||
service = self.application_service
|
||||
@@ -79,15 +91,18 @@ class HttpTransportMixin:
|
||||
return self.require_member()
|
||||
return True
|
||||
|
||||
def session_cookie(self, value: str, clear: bool = False) -> str:
|
||||
max_age = 0 if clear else SESSION_MAX_AGE
|
||||
cookie = (
|
||||
f"{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
|
||||
)
|
||||
def _cookie_header(self, name: str, value: str, max_age: int) -> str:
|
||||
cookie = f"{name}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
|
||||
if self.headers.get("X-Forwarded-Proto", "").lower() == "https":
|
||||
cookie += "; Secure"
|
||||
return cookie
|
||||
|
||||
def session_cookie(self, value: str, clear: bool = False) -> str:
|
||||
return self._cookie_header(SESSION_COOKIE, value, 0 if clear else SESSION_MAX_AGE)
|
||||
|
||||
def device_cookie(self, value: str, clear: bool = False) -> str:
|
||||
return self._cookie_header(DEVICE_COOKIE, value, 0 if clear else DEVICE_MAX_AGE)
|
||||
|
||||
def read_json_body(self, allow_empty: bool = False) -> dict[str, Any]:
|
||||
length = int(self.headers.get("Content-Length", "0"))
|
||||
if length == 0 and allow_empty:
|
||||
@@ -132,7 +147,7 @@ class HttpTransportMixin:
|
||||
self,
|
||||
payload: dict[str, Any],
|
||||
status: HTTPStatus = HTTPStatus.OK,
|
||||
headers: dict[str, str] | None = None,
|
||||
headers: dict[str, str] | list[tuple[str, str]] | tuple[tuple[str, str], ...] | None = None,
|
||||
) -> None:
|
||||
request_id = getattr(self, "_correlation_id", "")
|
||||
if not request_id:
|
||||
@@ -145,7 +160,8 @@ class HttpTransportMixin:
|
||||
self.send_header("Content-Length", str(len(content)))
|
||||
self.send_header("Cache-Control", "no-store")
|
||||
self.send_header("X-Request-ID", request_id)
|
||||
for name, value in (headers or {}).items():
|
||||
header_items = headers.items() if isinstance(headers, dict) else (headers or ())
|
||||
for name, value in header_items:
|
||||
self.send_header(name, value)
|
||||
self.end_headers()
|
||||
self.wfile.write(content)
|
||||
|
||||
@@ -128,6 +128,20 @@
|
||||
"feature": "auction",
|
||||
"access": "authenticated"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "/api/auth/accounts",
|
||||
"match": "exact",
|
||||
"feature": "auth",
|
||||
"access": "public"
|
||||
},
|
||||
{
|
||||
"method": "POST",
|
||||
"path": "/api/auth/forget",
|
||||
"match": "exact",
|
||||
"feature": "auth",
|
||||
"access": "public"
|
||||
},
|
||||
{
|
||||
"method": "POST",
|
||||
"path": "/api/auth/login",
|
||||
@@ -156,6 +170,13 @@
|
||||
"feature": "auth",
|
||||
"access": "public"
|
||||
},
|
||||
{
|
||||
"method": "POST",
|
||||
"path": "/api/auth/switch",
|
||||
"match": "exact",
|
||||
"feature": "auth",
|
||||
"access": "public"
|
||||
},
|
||||
{
|
||||
"method": "POST",
|
||||
"path": "/api/backfill",
|
||||
|
||||
@@ -10,10 +10,10 @@
|
||||
},
|
||||
"counts": {
|
||||
"primary_pages": 16,
|
||||
"api_exact_paths": 53,
|
||||
"api_exact_paths": 56,
|
||||
"api_prefixes": 0,
|
||||
"api_patterns": 11,
|
||||
"database_tables": 36,
|
||||
"database_tables": 37,
|
||||
"frontend_page_fragments": 12
|
||||
},
|
||||
"pages": [
|
||||
@@ -96,10 +96,13 @@
|
||||
"/api/assistant/chat",
|
||||
"/api/assistant/messages",
|
||||
"/api/auction",
|
||||
"/api/auth/accounts",
|
||||
"/api/auth/forget",
|
||||
"/api/auth/login",
|
||||
"/api/auth/logout",
|
||||
"/api/auth/me",
|
||||
"/api/auth/register",
|
||||
"/api/auth/switch",
|
||||
"/api/backfill",
|
||||
"/api/chart/intraday",
|
||||
"/api/dashboard",
|
||||
@@ -189,6 +192,7 @@
|
||||
"assistant_messages",
|
||||
"heaven_readings",
|
||||
"job_runs",
|
||||
"account_switch_grants",
|
||||
"schema_migrations"
|
||||
],
|
||||
"background_job_methods": [
|
||||
@@ -370,10 +374,10 @@
|
||||
}
|
||||
],
|
||||
"css_layers": [
|
||||
"/shared/tokens.css?v=20260820-3",
|
||||
"/shared/tokens.css?v=20260829-1",
|
||||
"/shared/base.css?v=20260806-1",
|
||||
"/shared/shell.css?v=20260820-8",
|
||||
"/shared/auth.css?v=20260820-5",
|
||||
"/shared/auth.css?v=20260829-1",
|
||||
"/shared/components/controls.css?v=20260820-2",
|
||||
"/shared/components/navigation.css?v=20260820-1",
|
||||
"/shared/components/cards.css?v=20260820-1",
|
||||
@@ -461,8 +465,8 @@
|
||||
},
|
||||
{
|
||||
"path": "frontend/index.html",
|
||||
"bytes": 47871,
|
||||
"lines": 661
|
||||
"bytes": 48037,
|
||||
"lines": 663
|
||||
},
|
||||
{
|
||||
"path": "backend/features/screener/catalog.py",
|
||||
@@ -551,8 +555,8 @@
|
||||
},
|
||||
{
|
||||
"path": "frontend/shared/session.js",
|
||||
"bytes": 13176,
|
||||
"lines": 293
|
||||
"bytes": 12848,
|
||||
"lines": 283
|
||||
},
|
||||
{
|
||||
"path": "backend/features/market/insights_auction_data.py",
|
||||
@@ -716,8 +720,8 @@
|
||||
},
|
||||
{
|
||||
"path": "backend/http/dispatch.py",
|
||||
"bytes": 4118,
|
||||
"lines": 115
|
||||
"bytes": 4196,
|
||||
"lines": 117
|
||||
},
|
||||
{
|
||||
"path": "frontend/shared/table.js",
|
||||
@@ -734,16 +738,16 @@
|
||||
"bytes": 3369,
|
||||
"lines": 81
|
||||
},
|
||||
{
|
||||
"path": "frontend/app.js",
|
||||
"bytes": 3337,
|
||||
"lines": 95
|
||||
},
|
||||
{
|
||||
"path": "frontend/pages/themes/page.html",
|
||||
"bytes": 3316,
|
||||
"lines": 55
|
||||
},
|
||||
{
|
||||
"path": "frontend/app.js",
|
||||
"bytes": 3201,
|
||||
"lines": 93
|
||||
},
|
||||
{
|
||||
"path": "backend/features/market/insights_context.py",
|
||||
"bytes": 3175,
|
||||
@@ -761,7 +765,7 @@
|
||||
},
|
||||
{
|
||||
"path": "backend/features/accounts/application.py",
|
||||
"bytes": 2442,
|
||||
"bytes": 2514,
|
||||
"lines": 63
|
||||
},
|
||||
{
|
||||
@@ -849,6 +853,11 @@
|
||||
"bytes": 1143,
|
||||
"lines": 19
|
||||
},
|
||||
{
|
||||
"path": "backend/features/accounts/routes.py",
|
||||
"bytes": 908,
|
||||
"lines": 25
|
||||
},
|
||||
{
|
||||
"path": "backend/features/popularity/routes.py",
|
||||
"bytes": 822,
|
||||
@@ -859,11 +868,6 @@
|
||||
"bytes": 817,
|
||||
"lines": 23
|
||||
},
|
||||
{
|
||||
"path": "backend/features/accounts/routes.py",
|
||||
"bytes": 803,
|
||||
"lines": 22
|
||||
},
|
||||
{
|
||||
"path": "backend/features/sentiment/routes.py",
|
||||
"bytes": 724,
|
||||
|
||||
+4
-2
@@ -25,8 +25,10 @@ async function initialize() {
|
||||
try {
|
||||
const session = await apiRequest("/api/auth/me");
|
||||
if (!session.authenticated) {
|
||||
if (session.registration_required) selectAuthMode("register");
|
||||
showAuthGate();
|
||||
const params = new URLSearchParams();
|
||||
if (session.registration_required) params.set("mode", "register");
|
||||
const query = params.toString();
|
||||
window.location.replace("/login/" + (query ? `?${query}` : ""));
|
||||
return;
|
||||
}
|
||||
await applyAuthenticatedSession(session);
|
||||
|
||||
+6
-4
@@ -24,7 +24,9 @@
|
||||
(() => {
|
||||
let theme = "light";
|
||||
try {
|
||||
theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
|
||||
const stored = localStorage.getItem("xiaobaiTheme");
|
||||
if (stored === "dark" || stored === "light") theme = stored;
|
||||
else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
|
||||
} catch (_error) {
|
||||
theme = "light";
|
||||
}
|
||||
@@ -32,10 +34,10 @@
|
||||
document.documentElement.style.colorScheme = theme;
|
||||
})();
|
||||
</script>
|
||||
<link rel="stylesheet" href="/shared/tokens.css?v=20260820-3">
|
||||
<link rel="stylesheet" href="/shared/tokens.css?v=20260829-1">
|
||||
<link rel="stylesheet" href="/shared/base.css?v=20260806-1">
|
||||
<link rel="stylesheet" href="/shared/shell.css?v=20260820-8">
|
||||
<link rel="stylesheet" href="/shared/auth.css?v=20260820-5">
|
||||
<link rel="stylesheet" href="/shared/auth.css?v=20260829-1">
|
||||
<link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
|
||||
<link rel="stylesheet" href="/shared/components/navigation.css?v=20260820-1">
|
||||
<link rel="stylesheet" href="/shared/components/cards.css?v=20260820-1">
|
||||
@@ -57,7 +59,7 @@
|
||||
<link rel="stylesheet" href="/pages/review/foundation.css?v=20260820-4">
|
||||
</head>
|
||||
<body>
|
||||
<section id="authGate" class="auth-gate" aria-label="账号登录">
|
||||
<section id="authGate" class="auth-gate" aria-label="账号登录" hidden>
|
||||
<div class="auth-shell">
|
||||
<div class="auth-brand">
|
||||
<div class="brand-mark" aria-hidden="true"><span class="brand-glyph">复</span></div>
|
||||
|
||||
@@ -0,0 +1,59 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="color-scheme" content="light dark">
|
||||
<title>登录 · 小白复盘</title>
|
||||
<script>
|
||||
(() => {
|
||||
let theme = "light";
|
||||
try {
|
||||
const stored = localStorage.getItem("xiaobaiTheme");
|
||||
if (stored === "dark" || stored === "light") theme = stored;
|
||||
else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
|
||||
} catch (_error) {
|
||||
theme = "light";
|
||||
}
|
||||
document.documentElement.dataset.theme = theme;
|
||||
document.documentElement.style.colorScheme = theme;
|
||||
})();
|
||||
</script>
|
||||
<link rel="stylesheet" href="/shared/tokens.css?v=20260829-1">
|
||||
<link rel="stylesheet" href="/shared/base.css?v=20260806-1">
|
||||
<link rel="stylesheet" href="/shared/auth.css?v=20260829-1">
|
||||
<link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
|
||||
</head>
|
||||
<body class="login-portal">
|
||||
<button id="loginThemeToggle" class="login-theme-toggle" type="button">🌙 夜间</button>
|
||||
<aside class="login-brand" aria-hidden="true">
|
||||
<div class="login-brand-mark"><span class="login-brand-glyph">复</span></div>
|
||||
<p class="login-brand-kicker">收盘之后 · 复盘开始</p>
|
||||
<h1 class="login-brand-title">小白复盘</h1>
|
||||
<p class="login-brand-lead">看懂情绪周期，把复盘变成下一次的先手。</p>
|
||||
<dl class="login-brand-stats">
|
||||
<div class="login-stat">
|
||||
<dt>市场情绪</dt>
|
||||
<dd>72 <span class="login-stat-tag">高热</span></dd>
|
||||
</div>
|
||||
<div class="login-stat">
|
||||
<dt>涨停</dt>
|
||||
<dd>63</dd>
|
||||
</div>
|
||||
<div class="login-stat">
|
||||
<dt>跌停</dt>
|
||||
<dd>4</dd>
|
||||
</div>
|
||||
<div class="login-stat">
|
||||
<dt>两市成交</dt>
|
||||
<dd>1.02万亿</dd>
|
||||
</div>
|
||||
</dl>
|
||||
</aside>
|
||||
<main class="login-stage">
|
||||
<section class="login-card" id="loginCard" aria-live="polite"></section>
|
||||
</main>
|
||||
<script src="/shared/api.js?v=20260803-2"></script>
|
||||
<script src="/login/page.js?v=20260829-1"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,273 @@
|
||||
(function bootLoginPortal(global) {
|
||||
"use strict";
|
||||
|
||||
const THEME_KEY = "xiaobaiTheme";
|
||||
const api = global.XiaobaiAPI;
|
||||
const card = document.querySelector("#loginCard");
|
||||
const themeButton = document.querySelector("#loginThemeToggle");
|
||||
const state = {
|
||||
view: "first",
|
||||
mode: "login",
|
||||
accounts: [],
|
||||
currentUserId: null,
|
||||
loading: false,
|
||||
confirmingId: null,
|
||||
error: "",
|
||||
};
|
||||
|
||||
function escapeHtml(value) {
|
||||
return String(value ?? "").replace(/[&<>"']/g, (ch) => (
|
||||
{ "&": "&", "<": "<", ">": ">", '"': """, "'": "'" }[ch]
|
||||
));
|
||||
}
|
||||
|
||||
function preferredTheme() {
|
||||
try {
|
||||
const stored = global.localStorage.getItem(THEME_KEY);
|
||||
if (stored === "dark" || stored === "light") return stored;
|
||||
} catch (_error) {
|
||||
// Fall through to the system preference.
|
||||
}
|
||||
return global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches
|
||||
? "dark"
|
||||
: "light";
|
||||
}
|
||||
|
||||
function applyTheme(theme, persist) {
|
||||
const normalized = theme === "dark" ? "dark" : "light";
|
||||
document.documentElement.dataset.theme = normalized;
|
||||
document.documentElement.style.colorScheme = normalized;
|
||||
themeButton.textContent = normalized === "dark" ? "☀ 日间" : "🌙 夜间";
|
||||
themeButton.setAttribute("aria-label", normalized === "dark" ? "切换到日间模式" : "切换到夜间模式");
|
||||
if (persist) {
|
||||
try {
|
||||
global.localStorage.setItem(THEME_KEY, normalized);
|
||||
} catch (_error) {
|
||||
// Theme still applies for the current page when storage is unavailable.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function setError(message) {
|
||||
state.error = message || "";
|
||||
}
|
||||
|
||||
function membershipLabel(account) {
|
||||
if (account.role === "admin") return account.membership?.subscribed ? "管理员 · 会员" : "管理员";
|
||||
return account.membership?.subscribed ? "会员" : "普通用户";
|
||||
}
|
||||
|
||||
function enterApp() {
|
||||
const next = new URLSearchParams(global.location.search).get("next");
|
||||
global.location.replace(next && next.startsWith("/") ? next : "/");
|
||||
}
|
||||
|
||||
function formMarkup(options) {
|
||||
const registering = state.mode === "register";
|
||||
const submitLabel = options.submitLabel
|
||||
|| (state.loading ? "正在登录..." : registering ? "注册并进入" : options.add ? "添加并进入" : "登录");
|
||||
return [
|
||||
options.back
|
||||
? '<button class="login-back" type="button" data-login-action="picker">返回账号列表</button>'
|
||||
: "",
|
||||
`<h2 class="login-card-title">${escapeHtml(options.title)}</h2>`,
|
||||
`<p class="login-card-lead">${escapeHtml(options.lead)}</p>`,
|
||||
'<div class="login-tabs" role="tablist">',
|
||||
`<button class="login-tab${state.mode === "login" ? " is-active" : ""}" type="button" data-auth-mode="login">登录</button>`,
|
||||
`<button class="login-tab${state.mode === "register" ? " is-active" : ""}" type="button" data-auth-mode="register">注册</button>`,
|
||||
"</div>",
|
||||
'<form class="login-form" id="loginForm">',
|
||||
'<label class="form-field"><span>账号名</span><input id="loginUsername" type="text" minlength="3" maxlength="30" autocomplete="username" required></label>',
|
||||
`<label class="form-field"><span>密码</span><input id="loginPassword" type="password" minlength="8" maxlength="128" autocomplete="${registering ? "new-password" : "current-password"}" required></label>`,
|
||||
`<label class="form-field" id="loginConfirmField"${registering ? "" : " hidden"}><span>确认密码</span><input id="loginPasswordConfirm" type="password" minlength="8" maxlength="128" autocomplete="new-password"${registering ? " required" : ""}></label>`,
|
||||
state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : '<p class="login-error" hidden></p>',
|
||||
`<button class="button primary login-submit" type="submit"${state.loading ? " disabled" : ""}>`,
|
||||
state.loading ? '<span class="login-spinner" aria-hidden="true"></span>' : "",
|
||||
`<span>${escapeHtml(submitLabel)}</span></button>`,
|
||||
"</form>",
|
||||
'<p class="login-hint">密码连续输错 5 次将锁定 10 分钟。还没有账号？切换到「注册」创建。</p>',
|
||||
].join("");
|
||||
}
|
||||
|
||||
function accountRow(account) {
|
||||
const current = Number(account.user_id) === Number(state.currentUserId);
|
||||
const confirming = Number(state.confirmingId) === Number(account.user_id);
|
||||
const classes = `login-account-row${current ? " is-current" : ""}${confirming ? " is-confirming" : ""}`;
|
||||
if (state.view === "manage" && confirming) {
|
||||
return [
|
||||
`<div class="${classes}" data-user-id="${account.user_id}">`,
|
||||
`<p class="login-confirm-copy">移除「${escapeHtml(account.username)}」的本机记录？</p>`,
|
||||
'<div class="login-confirm-actions">',
|
||||
`<button class="button danger-button" type="button" data-forget-id="${account.user_id}">移除</button>`,
|
||||
'<button class="button" type="button" data-login-action="cancel-forget">取消</button>',
|
||||
"</div></div>",
|
||||
].join("");
|
||||
}
|
||||
const action = state.view === "manage"
|
||||
? `<button class="login-account-remove" type="button" data-confirm-id="${account.user_id}">移除</button>`
|
||||
: current
|
||||
? '<span class="login-account-check" aria-hidden="true">✓</span>'
|
||||
: `<button class="login-account-enter" type="button" data-switch-id="${account.user_id}">进入</button>`;
|
||||
return [
|
||||
`<div class="${classes}" data-user-id="${account.user_id}">`,
|
||||
'<div class="login-account-meta">',
|
||||
`<strong>${escapeHtml(account.username)}</strong>`,
|
||||
`<span>${escapeHtml(membershipLabel(account))}${current ? " · 当前" : ""}</span>`,
|
||||
"</div>",
|
||||
action,
|
||||
"</div>",
|
||||
].join("");
|
||||
}
|
||||
|
||||
function pickerMarkup() {
|
||||
const count = state.accounts.length;
|
||||
const managing = state.view === "manage";
|
||||
return [
|
||||
`<h2 class="login-card-title">${managing ? "管理账号记录" : "选择账号"}</h2>`,
|
||||
`<p class="login-card-lead">这台电脑已记录 ${count} 个账号，可直接进入，无需再次输入密码。</p>`,
|
||||
managing
|
||||
? '<button class="login-manage" type="button" data-login-action="picker">完成</button>'
|
||||
: "",
|
||||
`<div class="login-account-list">${state.accounts.map(accountRow).join("")}</div>`,
|
||||
managing
|
||||
? ""
|
||||
: '<button class="login-add" type="button" data-login-action="add">＋ 添加账号</button>',
|
||||
managing
|
||||
? ""
|
||||
: '<button class="login-manage" type="button" data-login-action="manage">管理已记录的账号</button>',
|
||||
state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : "",
|
||||
'<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>账号记录仅保存在这台电脑的浏览器中</p>',
|
||||
].join("");
|
||||
}
|
||||
|
||||
function render() {
|
||||
card.classList.toggle("is-loading", state.loading);
|
||||
if (state.view === "first" || state.view === "add") {
|
||||
card.innerHTML = formMarkup({
|
||||
title: state.view === "add" ? "添加账号" : "欢迎回来",
|
||||
lead: "登录后进入你的复盘空间",
|
||||
add: state.view === "add",
|
||||
back: state.view === "add",
|
||||
});
|
||||
} else {
|
||||
card.innerHTML = pickerMarkup();
|
||||
}
|
||||
bindCard();
|
||||
}
|
||||
|
||||
function bindCard() {
|
||||
card.querySelectorAll("[data-auth-mode]").forEach((button) => {
|
||||
button.addEventListener("click", () => {
|
||||
state.mode = button.dataset.authMode === "register" ? "register" : "login";
|
||||
setError("");
|
||||
render();
|
||||
});
|
||||
});
|
||||
card.querySelectorAll("[data-login-action]").forEach((button) => {
|
||||
button.addEventListener("click", () => {
|
||||
const action = button.dataset.loginAction;
|
||||
if (action === "picker") {
|
||||
state.view = state.accounts.length ? "picker" : "first";
|
||||
state.confirmingId = null;
|
||||
} else if (action === "add") {
|
||||
state.view = "add";
|
||||
state.mode = "login";
|
||||
} else if (action === "manage") {
|
||||
state.view = "manage";
|
||||
} else if (action === "cancel-forget") {
|
||||
state.confirmingId = null;
|
||||
}
|
||||
setError("");
|
||||
render();
|
||||
});
|
||||
});
|
||||
card.querySelectorAll("[data-switch-id]").forEach((button) => {
|
||||
button.addEventListener("click", () => switchAccount(Number(button.dataset.switchId)));
|
||||
});
|
||||
card.querySelectorAll("[data-confirm-id]").forEach((button) => {
|
||||
button.addEventListener("click", () => {
|
||||
state.confirmingId = Number(button.dataset.confirmId);
|
||||
render();
|
||||
});
|
||||
});
|
||||
card.querySelectorAll("[data-forget-id]").forEach((button) => {
|
||||
button.addEventListener("click", () => forgetAccount(Number(button.dataset.forgetId)));
|
||||
});
|
||||
const form = card.querySelector("#loginForm");
|
||||
if (form) form.addEventListener("submit", submitCredentials);
|
||||
}
|
||||
|
||||
async function loadAccounts() {
|
||||
const payload = await api.request("/api/auth/accounts");
|
||||
state.accounts = payload.accounts || [];
|
||||
state.currentUserId = payload.current_user_id ?? null;
|
||||
const params = new URLSearchParams(global.location.search);
|
||||
if (params.get("mode") === "register") state.mode = "register";
|
||||
if (params.get("notice")) setError(params.get("notice"));
|
||||
if (state.accounts.length) state.view = "picker";
|
||||
else state.view = "first";
|
||||
}
|
||||
|
||||
async function submitCredentials(event) {
|
||||
event.preventDefault();
|
||||
const username = document.querySelector("#loginUsername").value.trim();
|
||||
const password = document.querySelector("#loginPassword").value;
|
||||
if (state.mode === "register" && password !== document.querySelector("#loginPasswordConfirm").value) {
|
||||
setError("两次输入的密码不一致。");
|
||||
render();
|
||||
return;
|
||||
}
|
||||
state.loading = true;
|
||||
setError("");
|
||||
render();
|
||||
try {
|
||||
await api.request(`/api/auth/${state.mode}`, "POST", { username, password });
|
||||
enterApp();
|
||||
} catch (error) {
|
||||
state.loading = false;
|
||||
setError(error.message || "账号操作失败");
|
||||
render();
|
||||
}
|
||||
}
|
||||
|
||||
async function switchAccount(userId) {
|
||||
state.loading = true;
|
||||
setError("");
|
||||
render();
|
||||
try {
|
||||
await api.request("/api/auth/switch", "POST", { user_id: userId });
|
||||
enterApp();
|
||||
} catch (error) {
|
||||
state.loading = false;
|
||||
setError(error.message || "该账号需重新验证");
|
||||
render();
|
||||
}
|
||||
}
|
||||
|
||||
async function forgetAccount(userId) {
|
||||
try {
|
||||
await api.request("/api/auth/forget", "POST", { user_id: userId });
|
||||
state.accounts = state.accounts.filter((item) => Number(item.user_id) !== Number(userId));
|
||||
state.confirmingId = null;
|
||||
if (!state.accounts.length) state.view = "first";
|
||||
setError("");
|
||||
render();
|
||||
} catch (error) {
|
||||
setError(error.message || "移除失败");
|
||||
render();
|
||||
}
|
||||
}
|
||||
|
||||
themeButton.addEventListener("click", () => {
|
||||
applyTheme(document.documentElement.dataset.theme === "dark" ? "light" : "dark", true);
|
||||
});
|
||||
applyTheme(preferredTheme(), false);
|
||||
|
||||
loadAccounts()
|
||||
.then(render)
|
||||
.catch((error) => {
|
||||
setError(error.message || "无法连接本地服务");
|
||||
state.view = "first";
|
||||
render();
|
||||
});
|
||||
})(window);
|
||||
@@ -246,6 +246,29 @@ body {
|
||||
padding-top: 8px;
|
||||
}
|
||||
|
||||
.m-auth-accounts {
|
||||
display: grid;
|
||||
gap: 8px;
|
||||
margin-bottom: 16px;
|
||||
}
|
||||
|
||||
.m-auth-account {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
min-height: 48px;
|
||||
padding: 0 14px;
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 10px;
|
||||
background: var(--surface);
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
.m-auth-account span {
|
||||
color: var(--action);
|
||||
font-size: var(--font-size-label);
|
||||
}
|
||||
|
||||
.m-auth-brand {
|
||||
text-align: center;
|
||||
margin: 24px 0 20px;
|
||||
|
||||
@@ -15,7 +15,9 @@
|
||||
(() => {
|
||||
let theme = "light";
|
||||
try {
|
||||
theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
|
||||
const stored = localStorage.getItem("xiaobaiTheme");
|
||||
if (stored === "dark" || stored === "light") theme = stored;
|
||||
else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
|
||||
} catch (_error) {
|
||||
theme = "light";
|
||||
}
|
||||
|
||||
@@ -5,10 +5,15 @@
|
||||
|
||||
function readTheme() {
|
||||
try {
|
||||
return global.localStorage.getItem(THEME_KEY) === "dark" ? "dark" : "light";
|
||||
const stored = global.localStorage.getItem(THEME_KEY);
|
||||
if (stored === "dark" || stored === "light") return stored;
|
||||
} catch (_error) {
|
||||
return "light";
|
||||
}
|
||||
if (global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches) {
|
||||
return "dark";
|
||||
}
|
||||
return "light";
|
||||
}
|
||||
|
||||
function applyTheme(theme) {
|
||||
|
||||
@@ -250,6 +250,7 @@
|
||||
'<h2>小白复盘</h2>',
|
||||
'<p>登录后进入你的复盘空间</p>',
|
||||
"</div>",
|
||||
'<div class="m-auth-accounts" id="m-auth-accounts" hidden></div>',
|
||||
'<div class="m-auth-tabs">',
|
||||
'<button class="m-auth-tab active" type="button" data-auth-mode="login">登录</button>',
|
||||
'<button class="m-auth-tab" type="button" data-auth-mode="register">注册</button>',
|
||||
@@ -265,6 +266,7 @@
|
||||
].join("");
|
||||
authMode = "login";
|
||||
bindAuth();
|
||||
loadMobileAccounts();
|
||||
}
|
||||
|
||||
function setAuthMode(mode) {
|
||||
@@ -287,6 +289,34 @@
|
||||
document.getElementById("m-auth-form").addEventListener("submit", submitAuth);
|
||||
}
|
||||
|
||||
async function loadMobileAccounts() {
|
||||
const host = document.getElementById("m-auth-accounts");
|
||||
if (!host || !global.MobileSession.listAccounts) return;
|
||||
try {
|
||||
const payload = await global.MobileSession.listAccounts();
|
||||
const accounts = payload.accounts || [];
|
||||
if (!accounts.length) return;
|
||||
host.hidden = false;
|
||||
host.innerHTML = accounts.map(function (account) {
|
||||
return '<button class="m-auth-account" type="button" data-switch-id="' + account.user_id + '">' +
|
||||
'<strong>' + escapeHtml(account.username) + '</strong>' +
|
||||
'<span>直接进入</span></button>';
|
||||
}).join("");
|
||||
host.querySelectorAll("[data-switch-id]").forEach(function (button) {
|
||||
button.addEventListener("click", async function () {
|
||||
try {
|
||||
await global.MobileSession.switchAccount(Number(button.dataset.switchId));
|
||||
replace(DEFAULT_HASH);
|
||||
} catch (error) {
|
||||
showAuthError(document.getElementById("m-auth-error"), error.message || "该账号需重新验证");
|
||||
}
|
||||
});
|
||||
});
|
||||
} catch (_error) {
|
||||
host.hidden = true;
|
||||
}
|
||||
}
|
||||
|
||||
function showAuthError(element, message) {
|
||||
element.textContent = message;
|
||||
element.classList.remove("m-motion-fade-in");
|
||||
|
||||
@@ -47,5 +47,30 @@
|
||||
return Boolean(state.user && state.user.role === "admin");
|
||||
}
|
||||
|
||||
global.MobileSession = { state: state, me: me, login: login, register: register, logout: logout, isAdmin: isAdmin };
|
||||
async function listAccounts() {
|
||||
return global.MobileAPI.request("/api/auth/accounts");
|
||||
}
|
||||
|
||||
async function switchAccount(userId) {
|
||||
const payload = await global.MobileAPI.request("/api/auth/switch", "POST", {
|
||||
user_id: userId
|
||||
});
|
||||
return applySession(payload);
|
||||
}
|
||||
|
||||
async function forgetAccount(userId) {
|
||||
await global.MobileAPI.request("/api/auth/forget", "POST", { user_id: userId });
|
||||
}
|
||||
|
||||
global.MobileSession = {
|
||||
state: state,
|
||||
me: me,
|
||||
login: login,
|
||||
register: register,
|
||||
logout: logout,
|
||||
listAccounts: listAccounts,
|
||||
switchAccount: switchAccount,
|
||||
forgetAccount: forgetAccount,
|
||||
isAdmin: isAdmin
|
||||
};
|
||||
})(window);
|
||||
|
||||
@@ -1667,3 +1667,445 @@ button.account-role-badge:focus-visible {
|
||||
display: inline-flex;
|
||||
}
|
||||
}
|
||||
|
||||
.login-portal {
|
||||
min-height: 100vh;
|
||||
|
||||
display: flex;
|
||||
|
||||
background: var(--canvas);
|
||||
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
.login-theme-toggle {
|
||||
position: fixed;
|
||||
|
||||
z-index: 2;
|
||||
|
||||
top: 16px;
|
||||
|
||||
right: 20px;
|
||||
|
||||
min-height: 32px;
|
||||
|
||||
padding: 0 12px;
|
||||
|
||||
border: 1px solid var(--border-strong);
|
||||
|
||||
border-radius: var(--size-radius-md);
|
||||
|
||||
background: var(--surface);
|
||||
|
||||
color: var(--text-secondary);
|
||||
|
||||
font-size: var(--font-size-label);
|
||||
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.login-brand {
|
||||
width: clamp(420px, 34vw, 560px);
|
||||
|
||||
flex: 0 0 auto;
|
||||
|
||||
padding: 44px 48px 36px;
|
||||
|
||||
background: var(--login-brand-gradient);
|
||||
|
||||
color: #f4f7ff;
|
||||
}
|
||||
|
||||
.login-brand-mark {
|
||||
display: flex;
|
||||
|
||||
align-items: center;
|
||||
|
||||
justify-content: center;
|
||||
|
||||
width: 56px;
|
||||
|
||||
height: 56px;
|
||||
|
||||
border-radius: 16px;
|
||||
|
||||
background: rgba(255, 255, 255, 0.12);
|
||||
}
|
||||
|
||||
.login-brand-glyph {
|
||||
font-size: 24px;
|
||||
|
||||
font-weight: var(--font-weight-semibold);
|
||||
}
|
||||
|
||||
.login-brand-kicker {
|
||||
margin: 28px 0 8px;
|
||||
|
||||
font-size: var(--font-size-caption);
|
||||
|
||||
letter-spacing: 0.08em;
|
||||
|
||||
opacity: 0.78;
|
||||
}
|
||||
|
||||
.login-brand-title {
|
||||
margin: 0;
|
||||
|
||||
font-size: 36px;
|
||||
|
||||
font-weight: var(--font-weight-semibold);
|
||||
}
|
||||
|
||||
.login-brand-lead {
|
||||
margin: 12px 0 0;
|
||||
|
||||
max-width: 18em;
|
||||
|
||||
font-size: var(--font-size-body);
|
||||
|
||||
line-height: 1.7;
|
||||
|
||||
opacity: 0.86;
|
||||
}
|
||||
|
||||
.login-brand-stats {
|
||||
display: grid;
|
||||
|
||||
grid-template-columns: 1fr 1fr;
|
||||
|
||||
gap: 16px 20px;
|
||||
|
||||
margin: 40px 0 0;
|
||||
}
|
||||
|
||||
.login-stat {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.login-stat dt {
|
||||
color: rgba(244, 247, 255, 0.64);
|
||||
|
||||
font-size: var(--font-size-caption);
|
||||
}
|
||||
|
||||
.login-stat dd {
|
||||
margin: 4px 0 0;
|
||||
|
||||
font-size: 20px;
|
||||
|
||||
font-weight: var(--font-weight-semibold);
|
||||
}
|
||||
|
||||
.login-stat-tag {
|
||||
margin-left: 6px;
|
||||
|
||||
font-size: var(--font-size-caption);
|
||||
|
||||
font-weight: var(--font-weight-regular);
|
||||
}
|
||||
|
||||
.login-stage {
|
||||
flex: 1 1 auto;
|
||||
|
||||
display: grid;
|
||||
|
||||
place-items: center;
|
||||
|
||||
padding: 48px 24px;
|
||||
}
|
||||
|
||||
.login-card {
|
||||
width: 400px;
|
||||
|
||||
max-width: calc(100vw - 48px);
|
||||
|
||||
padding: 32px;
|
||||
|
||||
border: 1px solid var(--border-strong);
|
||||
|
||||
border-radius: var(--size-radius-dialog);
|
||||
|
||||
background: var(--surface);
|
||||
|
||||
box-shadow: var(--shadow-raised);
|
||||
}
|
||||
|
||||
.login-card.is-loading .login-form {
|
||||
pointer-events: none;
|
||||
|
||||
opacity: 0.72;
|
||||
}
|
||||
|
||||
.login-card-title {
|
||||
margin: 0;
|
||||
|
||||
font-size: 22px;
|
||||
|
||||
font-weight: var(--font-weight-semibold);
|
||||
}
|
||||
|
||||
.login-card-lead {
|
||||
margin: 8px 0 0;
|
||||
|
||||
color: var(--text-secondary);
|
||||
|
||||
font-size: var(--font-size-label);
|
||||
|
||||
line-height: 1.6;
|
||||
}
|
||||
|
||||
.login-tabs {
|
||||
display: grid;
|
||||
|
||||
grid-template-columns: 1fr 1fr;
|
||||
|
||||
margin-top: 24px;
|
||||
|
||||
border-bottom: 1px solid var(--line);
|
||||
}
|
||||
|
||||
.login-tab {
|
||||
min-height: 40px;
|
||||
|
||||
border: 0;
|
||||
|
||||
border-bottom: 2px solid transparent;
|
||||
|
||||
background: transparent;
|
||||
|
||||
color: var(--text-secondary);
|
||||
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.login-tab.is-active {
|
||||
border-bottom-color: var(--action);
|
||||
|
||||
color: var(--action);
|
||||
|
||||
font-weight: var(--font-weight-medium);
|
||||
}
|
||||
|
||||
.login-form {
|
||||
display: grid;
|
||||
|
||||
gap: 14px;
|
||||
|
||||
margin-top: 20px;
|
||||
}
|
||||
|
||||
.login-portal .form-field input {
|
||||
height: 38px;
|
||||
}
|
||||
|
||||
.login-submit {
|
||||
width: 100%;
|
||||
|
||||
height: 40px;
|
||||
|
||||
min-height: 40px;
|
||||
}
|
||||
|
||||
.login-spinner {
|
||||
width: 14px;
|
||||
|
||||
height: 14px;
|
||||
|
||||
border: 2px solid currentColor;
|
||||
|
||||
border-right-color: transparent;
|
||||
|
||||
border-radius: 50%;
|
||||
|
||||
animation: login-spin 0.7s linear infinite;
|
||||
}
|
||||
|
||||
@keyframes login-spin {
|
||||
to {
|
||||
transform: rotate(360deg);
|
||||
}
|
||||
}
|
||||
|
||||
.login-error {
|
||||
margin: 0;
|
||||
|
||||
color: var(--danger);
|
||||
|
||||
font-size: var(--font-size-caption);
|
||||
}
|
||||
|
||||
.login-error[hidden] {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.login-hint,
|
||||
.login-privacy {
|
||||
margin: 16px 0 0;
|
||||
|
||||
color: var(--text-tertiary);
|
||||
|
||||
font-size: var(--font-size-caption);
|
||||
|
||||
line-height: 1.6;
|
||||
}
|
||||
|
||||
.login-portal .login-privacy {
|
||||
display: flex;
|
||||
|
||||
align-items: center;
|
||||
|
||||
gap: 6px;
|
||||
}
|
||||
|
||||
.login-lock {
|
||||
font-size: 12px;
|
||||
}
|
||||
|
||||
.login-back,
|
||||
.login-add,
|
||||
.login-manage,
|
||||
.login-account-enter,
|
||||
.login-account-remove {
|
||||
border: 0;
|
||||
|
||||
background: transparent;
|
||||
|
||||
color: var(--action);
|
||||
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.login-portal .login-back {
|
||||
margin-bottom: 12px;
|
||||
|
||||
padding: 0;
|
||||
|
||||
font-size: var(--font-size-label);
|
||||
}
|
||||
|
||||
.login-portal .login-add {
|
||||
display: block;
|
||||
|
||||
width: 100%;
|
||||
|
||||
min-height: 40px;
|
||||
|
||||
margin-top: 8px;
|
||||
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.login-portal .login-manage {
|
||||
display: block;
|
||||
|
||||
width: 100%;
|
||||
|
||||
min-height: 40px;
|
||||
|
||||
margin-top: 8px;
|
||||
|
||||
text-align: left;
|
||||
|
||||
color: var(--text-secondary);
|
||||
}
|
||||
|
||||
.login-account-list {
|
||||
display: grid;
|
||||
|
||||
gap: 8px;
|
||||
|
||||
margin-top: 20px;
|
||||
}
|
||||
|
||||
.login-account-row {
|
||||
display: flex;
|
||||
|
||||
align-items: center;
|
||||
|
||||
justify-content: space-between;
|
||||
|
||||
min-height: 58px;
|
||||
|
||||
padding: 0 14px;
|
||||
|
||||
border: 1px solid var(--border);
|
||||
|
||||
border-radius: var(--size-radius-md);
|
||||
|
||||
background: var(--surface);
|
||||
}
|
||||
|
||||
.login-account-row.is-current {
|
||||
border-color: var(--action);
|
||||
}
|
||||
|
||||
.login-account-row.is-confirming {
|
||||
display: grid;
|
||||
|
||||
gap: 10px;
|
||||
|
||||
padding: 12px 14px;
|
||||
}
|
||||
|
||||
.login-account-meta {
|
||||
display: grid;
|
||||
|
||||
gap: 2px;
|
||||
}
|
||||
|
||||
.login-account-meta strong {
|
||||
font-weight: var(--font-weight-medium);
|
||||
}
|
||||
|
||||
.login-account-meta span {
|
||||
color: var(--text-tertiary);
|
||||
|
||||
font-size: var(--font-size-caption);
|
||||
}
|
||||
|
||||
.login-account-check {
|
||||
color: var(--action);
|
||||
|
||||
font-size: 16px;
|
||||
}
|
||||
|
||||
.login-confirm-copy {
|
||||
margin: 0;
|
||||
|
||||
font-size: var(--font-size-label);
|
||||
}
|
||||
|
||||
.login-confirm-actions {
|
||||
display: flex;
|
||||
|
||||
gap: 8px;
|
||||
}
|
||||
|
||||
@media (max-width: 900px) {
|
||||
.login-portal {
|
||||
flex-direction: column;
|
||||
}
|
||||
|
||||
.login-brand {
|
||||
width: 100%;
|
||||
|
||||
padding: 20px 20px 16px;
|
||||
}
|
||||
|
||||
.login-brand-lead,
|
||||
.login-brand-stats {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.login-brand-title {
|
||||
font-size: 22px;
|
||||
}
|
||||
|
||||
.login-brand-kicker {
|
||||
margin-top: 12px;
|
||||
}
|
||||
|
||||
.login-stage {
|
||||
padding: 28px 16px 40px;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -53,12 +53,10 @@ async function applyAuthenticatedSession(session) {
|
||||
function showAuthGate(message = "") {
|
||||
state.user = null;
|
||||
state.csrfToken = "";
|
||||
const gate = document.querySelector("#authGate");
|
||||
gate.hidden = false;
|
||||
const errorElement = document.querySelector("#authError");
|
||||
errorElement.textContent = message;
|
||||
errorElement.hidden = !message;
|
||||
document.querySelector("#authUsername").focus();
|
||||
const params = new URLSearchParams();
|
||||
if (message) params.set("notice", message);
|
||||
const query = params.toString();
|
||||
window.location.replace("/login/" + (query ? `?${query}` : ""));
|
||||
}
|
||||
|
||||
async function logoutAccount() {
|
||||
@@ -197,16 +195,8 @@ async function changeAccountPassword(event) {
|
||||
}
|
||||
|
||||
async function switchAccount() {
|
||||
const button = document.querySelector("#switchAccountMenuButton");
|
||||
button.disabled = true;
|
||||
toggleAccountDropdown(false);
|
||||
try {
|
||||
await apiRequest("/api/auth/logout", "POST", {});
|
||||
window.location.reload();
|
||||
} catch (error) {
|
||||
showToast(error.message || "切换账号失败");
|
||||
button.disabled = false;
|
||||
}
|
||||
window.location.assign("/login/");
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -146,6 +146,7 @@
|
||||
--shadow-float: var(--elevation-float);
|
||||
--duration-fast: 150ms;
|
||||
--duration-normal: 220ms;
|
||||
--login-brand-gradient: linear-gradient(165deg, #0c1e4a, #16307c, #2153cc);
|
||||
|
||||
--font-size-aux: 11.5px;
|
||||
--font-size-caption: 12.5px;
|
||||
@@ -509,6 +510,7 @@
|
||||
--warning-line: #6d5a38;
|
||||
--warning-line-strong: #66502d;
|
||||
--control-shadow: 0 1px 3px rgba(0, 0, 0, .3);
|
||||
--login-brand-gradient: linear-gradient(165deg, #080c18, #0e1730, #14224a);
|
||||
--dialog-backdrop: var(--backdrop);
|
||||
--ladder-level-1: #2d2426;
|
||||
--ladder-level-2: #2b2822;
|
||||
|
||||
@@ -0,0 +1,151 @@
|
||||
const { test, expect } = require("@playwright/test");
|
||||
|
||||
function loginPayload(user) {
|
||||
return {
|
||||
ok: true,
|
||||
authenticated: true,
|
||||
csrf_token: "portal-csrf",
|
||||
user,
|
||||
};
|
||||
}
|
||||
|
||||
async function mockLoginPortal(page, options = {}) {
|
||||
const accounts = options.accounts || [];
|
||||
let currentUserId = options.currentUserId ?? null;
|
||||
await page.route("**/api/**", async (route) => {
|
||||
const url = new URL(route.request().url());
|
||||
const method = route.request().method();
|
||||
if (url.pathname === "/api/auth/accounts") {
|
||||
await route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify({ ok: true, accounts, current_user_id: currentUserId }),
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (url.pathname === "/api/auth/switch" && method === "POST") {
|
||||
const body = route.request().postDataJSON() || {};
|
||||
const account = accounts.find((item) => Number(item.user_id) === Number(body.user_id));
|
||||
if (!account || options.switchFails) {
|
||||
await route.fulfill({
|
||||
status: 401,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify({ error: "该账号需重新验证" }),
|
||||
});
|
||||
return;
|
||||
}
|
||||
currentUserId = account.user_id;
|
||||
await route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify(loginPayload(account)),
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (url.pathname === "/api/auth/forget" && method === "POST") {
|
||||
const body = route.request().postDataJSON() || {};
|
||||
const index = accounts.findIndex((item) => Number(item.user_id) === Number(body.user_id));
|
||||
if (index >= 0) accounts.splice(index, 1);
|
||||
await route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify({ ok: true }),
|
||||
});
|
||||
return;
|
||||
}
|
||||
if ((url.pathname === "/api/auth/login" || url.pathname === "/api/auth/register") && method === "POST") {
|
||||
await route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify(loginPayload({
|
||||
id: 9,
|
||||
username: "new_user",
|
||||
role: "user",
|
||||
membership: { active: false, subscribed: false, is_admin: false },
|
||||
})),
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (url.pathname === "/api/auth/me") {
|
||||
await route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify({
|
||||
ok: true,
|
||||
authenticated: Boolean(currentUserId),
|
||||
csrf_token: "portal-csrf",
|
||||
user: accounts.find((item) => Number(item.user_id) === Number(currentUserId)) || null,
|
||||
}),
|
||||
});
|
||||
return;
|
||||
}
|
||||
await route.fulfill({
|
||||
status: 200,
|
||||
contentType: "application/json",
|
||||
body: JSON.stringify({ ok: true }),
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
const SAVED_ACCOUNTS = [
|
||||
{
|
||||
user_id: 1,
|
||||
username: "alpha_user",
|
||||
role: "admin",
|
||||
membership: { active: true, subscribed: true, is_admin: true },
|
||||
last_used_at: "2026-08-29T01:00:00+00:00",
|
||||
},
|
||||
{
|
||||
user_id: 2,
|
||||
username: "beta_user",
|
||||
role: "user",
|
||||
membership: { active: false, subscribed: false, is_admin: false },
|
||||
last_used_at: "2026-08-28T01:00:00+00:00",
|
||||
},
|
||||
];
|
||||
|
||||
test("first-time login portal asks for a password and hides environment copy", async ({ page }) => {
|
||||
await mockLoginPortal(page, { accounts: [] });
|
||||
await page.goto("/login/");
|
||||
await expect(page.locator(".login-card-title")).toHaveText("欢迎回来");
|
||||
await expect(page.locator("#loginUsername")).toBeVisible();
|
||||
await expect(page.locator(".login-submit")).toHaveText("登录");
|
||||
await expect(page.locator("body")).not.toContainText("内网个人版");
|
||||
await expect(page.locator("body")).not.toContainText("192.168.200.11");
|
||||
});
|
||||
|
||||
test("saved accounts can switch directly and show a re-auth message on failure", async ({ page }) => {
|
||||
await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
|
||||
await page.goto("/login/");
|
||||
await expect(page.locator(".login-card-title")).toHaveText("选择账号");
|
||||
await expect(page.locator(".login-account-row")).toHaveCount(2);
|
||||
const switched = page.waitForRequest((request) => (
|
||||
request.url().includes("/api/auth/switch") && request.method() === "POST"
|
||||
));
|
||||
await page.locator('[data-switch-id="2"]').click();
|
||||
const request = await switched;
|
||||
expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
|
||||
});
|
||||
|
||||
test("failed account switch stays on the portal with the original copy", async ({ page }) => {
|
||||
await mockLoginPortal(page, {
|
||||
accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
|
||||
switchFails: true,
|
||||
});
|
||||
await page.goto("/login/");
|
||||
await page.locator('[data-switch-id="2"]').click();
|
||||
await expect(page.locator(".login-error")).toHaveText("该账号需重新验证");
|
||||
await expect(page).toHaveURL(/\/login\/?/);
|
||||
});
|
||||
|
||||
test("managing accounts removes a local record after inline confirmation", async ({ page }) => {
|
||||
await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
|
||||
await page.goto("/login/");
|
||||
await page.locator('[data-login-action="manage"]').click();
|
||||
await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
|
||||
await page.locator('[data-confirm-id="2"]').click();
|
||||
await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
|
||||
await page.locator('[data-forget-id="2"]').click();
|
||||
await expect(page.locator(".login-account-row")).toHaveCount(1);
|
||||
await expect(page.locator(".login-account-row")).toContainText("alpha_user");
|
||||
});
|
||||
@@ -0,0 +1,132 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import threading
|
||||
import unittest
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from pathlib import Path
|
||||
from tempfile import TemporaryDirectory
|
||||
|
||||
from backend.features.accounts.security import SecretVault, token_hash
|
||||
from backend.features.accounts.service import AccountService
|
||||
from database import ReviewDatabase
|
||||
|
||||
|
||||
class AccountSwitchGrantTests(unittest.TestCase):
|
||||
def setUp(self) -> None:
|
||||
self.temp = TemporaryDirectory()
|
||||
self.database = ReviewDatabase(Path(self.temp.name) / "review.db")
|
||||
self.bound_user_id = 0
|
||||
self.service = AccountService(
|
||||
database=self.database,
|
||||
vault=SecretVault(SecretVault.generate_key()),
|
||||
current_user_supplier=lambda: self.bound_user_id,
|
||||
access_supplier=lambda: self.database.user_access(self.bound_user_id) or {},
|
||||
bind_user=self._bind,
|
||||
personal_field_builder=lambda *args, **kwargs: {},
|
||||
auth_lock=threading.Lock(),
|
||||
)
|
||||
self.device_a = token_hash("device-a-token")
|
||||
self.device_b = token_hash("device-b-token")
|
||||
|
||||
def tearDown(self) -> None:
|
||||
self.temp.cleanup()
|
||||
|
||||
def _bind(self, user_id: int) -> None:
|
||||
self.bound_user_id = int(user_id)
|
||||
|
||||
def _register(self, username: str, device_hash: str = "") -> dict:
|
||||
return self.service.register(username, "Password123", device_hash or self.device_a)
|
||||
|
||||
def test_login_records_accounts_for_the_current_device_only(self) -> None:
|
||||
first = self._register("alpha_user")
|
||||
second = self._register("beta_user")
|
||||
self.service.login("alpha_user", "Password123", self.device_b)
|
||||
|
||||
listed = self.service.list_device_accounts(self.device_a)
|
||||
names = [item["username"] for item in listed["accounts"]]
|
||||
self.assertEqual(names, ["beta_user", "alpha_user"])
|
||||
self.assertEqual(
|
||||
self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
|
||||
"alpha_user",
|
||||
)
|
||||
self.assertEqual(self.service.list_device_accounts("")["accounts"], [])
|
||||
self.assertEqual(first["user"]["username"], "alpha_user")
|
||||
self.assertEqual(second["user"]["username"], "beta_user")
|
||||
|
||||
def test_switch_uses_device_grant_and_keeps_the_original_authorization(self) -> None:
|
||||
first = self._register("alpha_user")
|
||||
self._register("beta_user")
|
||||
switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
|
||||
self.assertEqual(switched["user"]["username"], "alpha_user")
|
||||
remaining = {
|
||||
item["username"]
|
||||
for item in self.service.list_device_accounts(self.device_a)["accounts"]
|
||||
}
|
||||
self.assertEqual(remaining, {"alpha_user", "beta_user"})
|
||||
|
||||
def test_switch_without_a_valid_grant_requires_reauthentication(self) -> None:
|
||||
user = self._register("alpha_user")
|
||||
with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
|
||||
self.service.switch_account(self.device_b, int(user["user"]["id"]))
|
||||
with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
|
||||
self.service.switch_account("", int(user["user"]["id"]))
|
||||
|
||||
def test_forget_only_removes_the_current_device_grant(self) -> None:
|
||||
user = self._register("alpha_user")
|
||||
self.service.login("alpha_user", "Password123", self.device_b)
|
||||
self.service.forget_account(self.device_a, int(user["user"]["id"]))
|
||||
self.service.forget_account(self.device_a, int(user["user"]["id"]))
|
||||
self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
|
||||
self.assertEqual(
|
||||
self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
|
||||
"alpha_user",
|
||||
)
|
||||
|
||||
def test_logout_revokes_only_the_current_account_on_this_device(self) -> None:
|
||||
first = self._register("alpha_user")
|
||||
second = self._register("beta_user")
|
||||
self.service.revoke_current_device_grant(self.device_a, int(second["user"]["id"]))
|
||||
names = {
|
||||
item["username"]
|
||||
for item in self.service.list_device_accounts(self.device_a)["accounts"]
|
||||
}
|
||||
self.assertEqual(names, {"alpha_user"})
|
||||
switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
|
||||
self.assertEqual(switched["user"]["id"], first["user"]["id"])
|
||||
|
||||
def test_password_change_revokes_grants_on_every_device(self) -> None:
|
||||
user = self._register("alpha_user")
|
||||
self.service.login("alpha_user", "Password123", self.device_b)
|
||||
self._bind(int(user["user"]["id"]))
|
||||
self.service.change_password("Password123", "Password456")
|
||||
self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
|
||||
self.assertEqual(self.service.list_device_accounts(self.device_b)["accounts"], [])
|
||||
with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
|
||||
self.service.switch_account(self.device_a, int(user["user"]["id"]))
|
||||
|
||||
def test_device_keeps_at_most_five_accounts(self) -> None:
|
||||
usernames = [f"user_{index}" for index in range(6)]
|
||||
ids = [self._register(name)["user"]["id"] for name in usernames]
|
||||
listed = self.service.list_device_accounts(self.device_a)["accounts"]
|
||||
self.assertEqual(len(listed), 5)
|
||||
kept = {item["user_id"] for item in listed}
|
||||
self.assertNotIn(ids[0], kept)
|
||||
self.assertTrue(set(ids[1:]).issubset(kept))
|
||||
|
||||
def test_expired_grants_are_removed_lazily(self) -> None:
|
||||
user = self._register("alpha_user")
|
||||
past = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat(timespec="seconds")
|
||||
self.database.upsert_switch_grant(
|
||||
self.device_a,
|
||||
int(user["user"]["id"]),
|
||||
past,
|
||||
past,
|
||||
past,
|
||||
)
|
||||
self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
|
||||
with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
|
||||
self.service.switch_account(self.device_a, int(user["user"]["id"]))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -25,6 +25,7 @@ class DatabaseMigrationTests(unittest.TestCase):
|
||||
("0002", "create_job_runs"),
|
||||
("0003", "extend_llm_audit"),
|
||||
("0004", "add_mentor_note"),
|
||||
("0005", "create_account_switch_grants"),
|
||||
],
|
||||
)
|
||||
columns = {
|
||||
@@ -39,7 +40,7 @@ class DatabaseMigrationTests(unittest.TestCase):
|
||||
count = connection.execute(
|
||||
"SELECT COUNT(*) AS count FROM schema_migrations"
|
||||
).fetchone()["count"]
|
||||
self.assertEqual(count, 4)
|
||||
self.assertEqual(count, 5)
|
||||
|
||||
def test_database_with_recorded_0004_and_note_column_starts_without_reapply(
|
||||
self,
|
||||
@@ -60,7 +61,7 @@ class DatabaseMigrationTests(unittest.TestCase):
|
||||
count = connection.execute(
|
||||
"SELECT COUNT(*) AS count FROM schema_migrations"
|
||||
).fetchone()["count"]
|
||||
self.assertEqual(count, 4)
|
||||
self.assertEqual(count, 5)
|
||||
|
||||
def test_old_database_without_0004_upgrades_and_adds_note_column(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as root:
|
||||
@@ -87,7 +88,7 @@ class DatabaseMigrationTests(unittest.TestCase):
|
||||
"PRAGMA table_info(mentor_preferences)"
|
||||
)
|
||||
]
|
||||
self.assertEqual(versions, {"0001", "0002", "0003", "0004"})
|
||||
self.assertEqual(versions, {"0001", "0002", "0003", "0004", "0005"})
|
||||
self.assertIn("note", note_rows)
|
||||
|
||||
def test_database_with_unknown_migration_is_rejected(self) -> None:
|
||||
|
||||
@@ -65,8 +65,11 @@ class GovernanceRegistryTests(unittest.TestCase):
|
||||
public,
|
||||
{
|
||||
("GET", "/api/health"),
|
||||
("GET", "/api/auth/accounts"),
|
||||
("POST", "/api/auth/login"),
|
||||
("POST", "/api/auth/register"),
|
||||
("POST", "/api/auth/switch"),
|
||||
("POST", "/api/auth/forget"),
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
@@ -50,7 +50,13 @@ def _owner(path: str) -> str:
|
||||
|
||||
|
||||
def _role(method: str, path: str) -> str:
|
||||
if path == "/api/health" or path in {"/api/auth/register", "/api/auth/login"}:
|
||||
if path == "/api/health" or path in {
|
||||
"/api/auth/register",
|
||||
"/api/auth/login",
|
||||
"/api/auth/accounts",
|
||||
"/api/auth/switch",
|
||||
"/api/auth/forget",
|
||||
}:
|
||||
return "public"
|
||||
from api_access import required_role
|
||||
|
||||
|
||||
Reference in New Issue
Block a user