diff --git a/.gitignore b/.gitignore index 5539fbd..5916b60 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,9 @@ out/ *.log __pycache__/ + +frontend/node_modules/ +frontend/dist/ +frontend/test-results/ +frontend/playwright-report/ +.playwright-cli/ diff --git a/README.md b/README.md index ea94c8f..6c61f1d 100644 --- a/README.md +++ b/README.md @@ -46,12 +46,14 @@ Native 构建与原生二进制上的认证测试是交付要求；JVM 测试通 [项目初始化](docs/bootstrap.md)。使用 JDK 25 执行： ```sh +npm --prefix frontend ci +npm --prefix frontend run build ./gradlew test testAot ./gradlew bootRun ``` 测试需要可用的 Docker，生成器配置了 Grafana LGTM Testcontainer。 -当前只有默认应用和上下文测试，默认 Spring Security 登录页不是可用的 IAM 登录流程。 +当前有隔离的浏览器交互原型与上下文测试，默认 Spring Security 登录页不是可用的 IAM 登录流程。 使用 GraalVM 25 验证原生测试与编译： ```sh @@ -64,3 +66,9 @@ Docker 开发使用 `scripts/gradle-in-docker`，默认持久挂载 Gradle 缓 JVM、AOT、Native 测试及原生应用 HTTP 检查已通过，实测范围与资源数据见 [本地验证结果](docs/bootstrap.md#2026-09-25-本地验证结果)。 AD、MFA 与 Hydra 认证链路仍待实现与验收。 + +## 浏览器流程预览 + +人类登录界面采用 React + Vite，参考 Keycloakify 的内联上下文与原生表单提交方式。 +原型默认关闭，仅测试页面切换与局部交互，不执行真实认证。启动、浏览器测试和边界见 +[浏览器流程原型](docs/browser-preview.md)。 diff --git a/build.gradle b/build.gradle index 5680496..2eace16 100644 --- a/build.gradle +++ b/build.gradle @@ -71,3 +71,15 @@ graalvmNative { } } } + +// Vite owns the HTML and hashed assets; only the controller can serve the page shell. +// Build it with `npm ci && npm run build` in frontend/ before invoking Gradle. +tasks.named('processResources') { + inputs.files(fileTree('frontend/dist')) + doFirst { + if (!file('frontend/dist/index.html').exists()) { + throw new GradleException('Missing UI build: run npm ci && npm run build in frontend/') + } + } + from('frontend/dist') { into 'ui' } +} diff --git a/docs/bootstrap.md b/docs/bootstrap.md index ad12073..fdc51b9 100644 --- a/docs/bootstrap.md +++ b/docs/bootstrap.md @@ -126,3 +126,6 @@ Prometheus 注册器中的 CPU 时间计数器并断言数值有效，避免后 这是一次本地 smoke 测量，启动耗时含检查器轮询，RSS 不是峰值或负载预算，ELF 大小不等于 运行镜像大小。未验证 AD、MFA、Hydra、目录就绪或 OTLP 后端数据查询，也尚未接入 CI。 运行报告生成在 `build/reports/native-smoke/result.json`，不提交运行日志或构建产物。 + +手写 Native 补丁位于 `META-INF/native-image/top.ddupan.iam/iam-login-manual/`， +与 Spring AOT 生成的 `iam-login/` 目录分开，避免 `bootJar` 中同名元数据冲突。 diff --git a/docs/browser-preview.md b/docs/browser-preview.md new file mode 100644 index 0000000..8c8468a --- /dev/null +++ b/docs/browser-preview.md @@ -0,0 +1,79 @@ +# 浏览器登录流程原型 + +参考 Keycloakify：Spring 返回 HTML 时内联当前页面上下文，React 用 `createRoot` 渲染， +表单原生 POST 到 Spring，后端按 session 中的步骤校验并返回 303 重定向。 +每次导航重新挂载 React，带 hash 的 JS/CSS 可长期缓存。局部帮助展开不发请求。 + +这是浏览器交互实验，不是身份验证实现：没有 AD 查询、真实密码、TOTP、WebAuthn 或 +Hydra accept；不会创建 Spring Security 登录身份。演示码 **123456** 仅用于切换页面， +不得作为 MFA 实现复用。默认关闭，显式设置 `iam.ui-preview.enabled=true` 才开放 `/preview`。 +所有其他受保护入口仍需认证，Prometheus 权限保持不变。 + +![浏览器交互原型首页](images/browser-preview.png) + +## 本地体验 + +有 Node 24 和 JDK 25 时： + +```sh +cd frontend +npm ci +npm run build +cd .. +./gradlew bootRun --args='--server.address=127.0.0.1 --server.port=18081 --iam.ui-preview.enabled=true' +``` + +访问 。填写称呼，尝试错误演示码，再用 123456 完成。 +后退链接、刷新、重新体验都走服务端流程。启用 DevTools 的 Network 面板观察 document +POST、303、GET；不要勾选 Disable cache，否则无法观察正常的静态资源缓存。 + +Docker 开发： + +```sh +IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker bootRun \ + --args='--server.address=127.0.0.1 --server.port=18081 --iam.ui-preview.enabled=true' +``` + +`gradle-in-docker` 先用固定 Node 镜像构建前端，再运行 GraalVM 容器。 +Gradle 缓存默认 `$HOME/.cache/iam-login/gradle`，npm 缓存默认 `$HOME/.cache/iam-login/npm`； +可用 `IAM_GRADLE_CACHE` / `IAM_NPM_CACHE` 指定持久目录。Node 仅参与构建，部署无 Node 服务。 +直接调用 Gradle 时先构建前端；缺少 `frontend/dist/index.html` 会明确失败。 +前端 watch 可用 `npm run watch`，修改后仍需让后端重新复制资源并重启；本轮不实现 HMR 桥接。 + +## 验证 + +```sh +IAM_DOCKER_USE_SUDO=1 scripts/gradle-in-docker test testAot nativeTest nativeCompile +python3 scripts/native-smoke.py +build/native/nativeCompile/iam-login --server.address=127.0.0.1 --server.port=18081 \ + --iam.ui-preview.enabled=true +# 另一个终端，应用保持运行 +cd frontend +npm ci +npx playwright install chromium +npm run test:browser +``` + +浏览器测试覆盖原生页面导航、错误重试、局部交互零请求、无 fetch/XHR、静态 JS 缓存、 +移动端布局、脚本结束标记转义，以及完成预览仍不能访问受保护应用。 +额外计时使用 Chromium 模拟 60ms 网络延迟、1.5Mbps 下载和四倍 CPU slowdown， +用于比较首屏和缓存后的页面切换，不代表真实 LAN、Tailscale 或手机性能。 + +## 实现边界 + +- 页面壳在 `frontend/index.html`，Vite 构建后作为私有 classpath 资源 `ui/index.html` 打包， + 不提供静态 index 入口；控制器仅替换一个固定 JSON 数据位置。 +- Java 使用 JSON 序列化后转义 `<`、`>`、`&` 和 Unicode 行分隔符，避免 `` 逃逸； + React 按文本输出动态内容，不通过 HTML 字符串插入用户名。 +- session 持有演示步骤。表单带 Spring Security CSRF token，缺失被拒绝； + 非当前步骤的提交拒绝，未知/过期 session 的后续页面回到初始步骤。 +- 页面与重定向 `no-store`，静态 hash 资源 public/immutable。CSP 不允许内联可执行脚本。 +- 单 session 仅有一个演示流程，多标签页会共享步骤。正式认证需要独立事务、过期策略、 + 主体与因素绑定；本原型不提供这些保证。 +- 当前采取整页切换，不提前实现 fetch 优化。后续根据测量选择需要局部更新的步骤。 +- 首屏依赖 JavaScript，没有 React SSR、Flight、客户端路由、FreeMarker 或模板引擎。 + 关闭 JavaScript 时显示明确提示，不宣称无 JS 可用。 + +来源：[Keycloakify 入口](https://github.com/keycloakify/keycloakify-starter/blob/main/src/main.tsx)、 +[登录表单](https://github.com/keycloakify/keycloakify/blob/main/src/login/pages/Login.tsx)、 +[Vite 构建](https://vite.dev/guide/build)。 diff --git a/docs/images/browser-preview.png b/docs/images/browser-preview.png new file mode 100644 index 0000000..29f6957 Binary files /dev/null and b/docs/images/browser-preview.png differ diff --git a/frontend/index.html b/frontend/index.html new file mode 100644 index 0000000..5e16d5b --- /dev/null +++ b/frontend/index.html @@ -0,0 +1,17 @@ + + + + + + + 登录体验预览 · IAM + + +
+ + + + + diff --git a/frontend/package-lock.json b/frontend/package-lock.json new file mode 100644 index 0000000..57bc869 --- /dev/null +++ b/frontend/package-lock.json @@ -0,0 +1,1280 @@ +{ + "name": "iam-login-ui", + "version": "0.0.1", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "iam-login-ui", + "version": "0.0.1", + "dependencies": { + "react": "19.3.0", + "react-dom": "19.3.0" + }, + "devDependencies": { + "@playwright/test": "1.63.0", + "@types/react": "^19.2.0", + "@types/react-dom": "^19.2.0", + "typescript": "7.0.2", + "vite": "8.3.1" + } + }, + "node_modules/@oxc-project/types": { + "version": "0.151.0", + "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.151.0.tgz", + "integrity": "sha512-J1yXrIlNDZVzE3ada310xeAw7nH8yCAyLPuUIsjKatFPmfn5bS1oW+cM+QsGOtVWd5nhSpbwZWx/rue+r5Z+PA==", + "dev": true, + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/oxc-project" + } + }, + "node_modules/@playwright/test": { + "version": "1.63.0", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.63.0.tgz", + "integrity": "sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "playwright": "1.63.0" + }, + "bin": { + "playwright": "cli.js" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/@rolldown/binding-android-arm-eabi": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.11.tgz", + "integrity": "sha512-A5kXfGKvKWWZE0TtPrfsvT+q4Y5d1QG8gGUzpYjGydM+fARM9MuX90PrXYXe0XbsDVgyxxNzHo6giCj90bsFNw==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-android-arm64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.11.tgz", + "integrity": "sha512-z6cTycz+iJ4PVkuL4HHW4DfTfoeU/2nqYYuSOrTmH7yHK5Y0LCOnA03V4ZNxavyVaU1oOqUgIg2klN/s+USGOA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-darwin-arm64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.11.tgz", + "integrity": "sha512-jShvqNtP6vDC6/A5JOAzbVV+DkgHqhl/ScVCJEbt+TUY6QYz7YnXcrg3sLtFBniro0f/Ld50ZwCWA6f7KYD1nQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-darwin-x64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.11.tgz", + "integrity": "sha512-f2i2xiNWq1Z1l2++q2fuhZRdLAT3aqxD6vRNm1RAxpUoBcdqNB3C0s1Bt+K+PbEx2F5F4gQp6hqKkphCY/xF9w==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-freebsd-x64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.11.tgz", + "integrity": "sha512-4Ir5FSOKIAMr4r0kExpt1s3bMgzJU3rA45AYOHtQpls0oNeqcYBKrWMlckrYH4KCfGLfkfn1tN1dmZPMVsdXow==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm-gnueabihf": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.11.tgz", + "integrity": "sha512-/gnRDM+39BROzAN/k1OZjDPnDMcZxB/0EUxKjONO5yVkNEvlsoMDrxGNKgZi/ttFriS2gwlDNzB65pvNbFOXIQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm64-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.11.tgz", + "integrity": "sha512-PFaK8HwvAHbaKbBcDNQihjMKYvFnA5hiENx/l5tphTDz1E0WFp32l0A7aq7lyUwGsRw/xSrNIy/gIK4thrSCrw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm64-musl": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.11.tgz", + "integrity": "sha512-AskzJUIKRLPxkruR1wLKewGbOw+EYfU/9lOrBFj4AFrEA8hPpKFnODWNu2WLaNs0QNkEb9QIJufmVZZIL/bJlg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-ppc64-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.11.tgz", + "integrity": "sha512-qlUGAheh2yh8afH7QBgx0PrRHN85hKnNd78x8MeMhXivuevgd8vgf6/CstOzmNKY/lLTHvNTrPy98cLnAugzJw==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-s390x-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.11.tgz", + "integrity": "sha512-secpEad+0vCbSfn8upFySkDskv+bGPk3THSDS9Y89yc4rb4kzqHp8Dmyd9BkQW4SnhNXBZCl/6CrO//hZahNJQ==", + "cpu": [ + "s390x" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-x64-gnu": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.11.tgz", + "integrity": "sha512-mOVBT3dPpkWm8XBWPmU4bf+U6dYDLeMo/9ojUmis4N0L5uu10qra5vOyngZ7/PSdoE4G9KvRt4bloRxNjLas7A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-x64-musl": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.11.tgz", + "integrity": "sha512-Is78i9A8Ui4SqcxUwFJ9uMmjDn58IbVTjFWYdQestFEgeuEmHMLGNriXnVJKkwG2YiZjw8cP0zCTyDMdDGtOOg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-openharmony-arm64": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.11.tgz", + "integrity": "sha512-dUCXneZ87INUMyQ0D+C0HrEBNUPNXHaPmU5GTjyKTJEiussw9Kaj5Ln8UztPe4epV/ffvgNBEadksdYhmW6xJA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "openharmony" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-win32-arm64-msvc": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.11.tgz", + "integrity": "sha512-jByxb6qfd+bH1xUd0qnfFnb17i9sWBPY2tOavJ0l3tdr3OTu+Kvtm8cd/JV5nFt657b1VqGltxg9olOEfofXWw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-win32-x64-msvc": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.11.tgz", + "integrity": "sha512-/PzKqzAJ03i19oy2ItPvyvaVjOjBCNnfaJs8yvUdGBKmiESgnrJSQ2awd81QzFbbnAmu7YO9ZnJrDCb9VSJPRA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/pluginutils": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz", + "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/react": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz", + "integrity": "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==", + "dev": true, + "license": "MIT", + "dependencies": { + "csstype": "^3.2.2" + } + }, + "node_modules/@types/react-dom": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.3.0.tgz", + "integrity": "sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==", + "dev": true, + "license": "MIT", + "peerDependencies": { + "@types/react": "^19.3.0" + } + }, + "node_modules/@typescript/typescript-aix-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz", + "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "aix" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz", + "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz", + "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz", + "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz", + "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz", + "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz", + "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-loong64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz", + "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==", + "cpu": [ + "loong64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-mips64el": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz", + "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==", + "cpu": [ + "mips64el" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz", + "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-riscv64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz", + "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==", + "cpu": [ + "riscv64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-s390x": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz", + "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==", + "cpu": [ + "s390x" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz", + "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz", + "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz", + "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz", + "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz", + "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-sunos-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz", + "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "sunos" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz", + "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz", + "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/csstype": { + "version": "3.2.3", + "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz", + "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/detect-libc": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", + "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=8" + } + }, + "node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/fsevents": { + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", + "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^8.16.0 || ^10.6.0 || >=11.0.0" + } + }, + "node_modules/lightningcss": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz", + "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==", + "dev": true, + "license": "MPL-2.0", + "dependencies": { + "detect-libc": "^2.0.3" + }, + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + }, + "optionalDependencies": { + "lightningcss-android-arm64": "1.33.0", + "lightningcss-darwin-arm64": "1.33.0", + "lightningcss-darwin-x64": "1.33.0", + "lightningcss-freebsd-x64": "1.33.0", + "lightningcss-linux-arm-gnueabihf": "1.33.0", + "lightningcss-linux-arm64-gnu": "1.33.0", + "lightningcss-linux-arm64-musl": "1.33.0", + "lightningcss-linux-x64-gnu": "1.33.0", + "lightningcss-linux-x64-musl": "1.33.0", + "lightningcss-win32-arm64-msvc": "1.33.0", + "lightningcss-win32-x64-msvc": "1.33.0" + } + }, + "node_modules/lightningcss-android-arm64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz", + "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-darwin-arm64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz", + "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-darwin-x64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz", + "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-freebsd-x64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz", + "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm-gnueabihf": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz", + "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm64-gnu": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz", + "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm64-musl": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz", + "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-x64-gnu": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz", + "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-x64-musl": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz", + "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-win32-arm64-msvc": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz", + "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-win32-x64-msvc": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz", + "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/nanoid": { + "version": "3.3.19", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz", + "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/picocolors": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", + "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==", + "dev": true, + "license": "ISC" + }, + "node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, + "node_modules/playwright": { + "version": "1.63.0", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.63.0.tgz", + "integrity": "sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "playwright-core": "1.63.0" + }, + "bin": { + "playwright": "cli.js" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/playwright-core": { + "version": "1.63.0", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.63.0.tgz", + "integrity": "sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "playwright-core": "cli.js" + }, + "engines": { + "node": ">=20" + } + }, + "node_modules/postcss": { + "version": "8.5.28", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz", + "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==", + "dev": true, + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.18", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.1" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/react": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/react/-/react-19.3.0.tgz", + "integrity": "sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/react-dom": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.3.0.tgz", + "integrity": "sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q==", + "license": "MIT", + "dependencies": { + "scheduler": "^0.28.0" + }, + "peerDependencies": { + "react": "^19.3.0" + } + }, + "node_modules/rolldown": { + "version": "1.2.11", + "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.11.tgz", + "integrity": "sha512-qpSwIyz0jHQq5qXBTNxFmE6664rJ7O+4TvPFOiOaBSrz8IOHc1koKKSqTM2H6u1UG1+TveuC6vaDHKXFOvb1Kw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@oxc-project/types": "=0.151.0", + "@rolldown/pluginutils": "^1.0.0" + }, + "bin": { + "rolldown": "bin/cli.mjs" + }, + "engines": { + "node": "^20.19.0 || >=22.12.0" + }, + "optionalDependencies": { + "@rolldown/binding-android-arm-eabi": "1.2.11", + "@rolldown/binding-android-arm64": "1.2.11", + "@rolldown/binding-darwin-arm64": "1.2.11", + "@rolldown/binding-darwin-x64": "1.2.11", + "@rolldown/binding-freebsd-x64": "1.2.11", + "@rolldown/binding-linux-arm-gnueabihf": "1.2.11", + "@rolldown/binding-linux-arm64-gnu": "1.2.11", + "@rolldown/binding-linux-arm64-musl": "1.2.11", + "@rolldown/binding-linux-ppc64-gnu": "1.2.11", + "@rolldown/binding-linux-s390x-gnu": "1.2.11", + "@rolldown/binding-linux-x64-gnu": "1.2.11", + "@rolldown/binding-linux-x64-musl": "1.2.11", + "@rolldown/binding-openharmony-arm64": "1.2.11", + "@rolldown/binding-win32-arm64-msvc": "1.2.11", + "@rolldown/binding-win32-x64-msvc": "1.2.11" + } + }, + "node_modules/scheduler": { + "version": "0.28.0", + "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.28.0.tgz", + "integrity": "sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw==", + "license": "MIT" + }, + "node_modules/source-map-js": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", + "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "dev": true, + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", + "dev": true, + "license": "MIT", + "dependencies": { + "fdir": "^6.5.0", + "picomatch": "^4.0.4" + }, + "engines": { + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/typescript": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz", + "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "tsc": "bin/tsc" + }, + "engines": { + "node": ">=16.20.0" + }, + "optionalDependencies": { + "@typescript/typescript-aix-ppc64": "7.0.2", + "@typescript/typescript-darwin-arm64": "7.0.2", + "@typescript/typescript-darwin-x64": "7.0.2", + "@typescript/typescript-freebsd-arm64": "7.0.2", + "@typescript/typescript-freebsd-x64": "7.0.2", + "@typescript/typescript-linux-arm": "7.0.2", + "@typescript/typescript-linux-arm64": "7.0.2", + "@typescript/typescript-linux-loong64": "7.0.2", + "@typescript/typescript-linux-mips64el": "7.0.2", + "@typescript/typescript-linux-ppc64": "7.0.2", + "@typescript/typescript-linux-riscv64": "7.0.2", + "@typescript/typescript-linux-s390x": "7.0.2", + "@typescript/typescript-linux-x64": "7.0.2", + "@typescript/typescript-netbsd-arm64": "7.0.2", + "@typescript/typescript-netbsd-x64": "7.0.2", + "@typescript/typescript-openbsd-arm64": "7.0.2", + "@typescript/typescript-openbsd-x64": "7.0.2", + "@typescript/typescript-sunos-x64": "7.0.2", + "@typescript/typescript-win32-arm64": "7.0.2", + "@typescript/typescript-win32-x64": "7.0.2" + } + }, + "node_modules/vite": { + "version": "8.3.1", + "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.1.tgz", + "integrity": "sha512-/bvH9E9tmCXRGp2uXY3WbOldqpTwFkbha/8ANaEQ6VkxhH60KyqLwgZq6lG2y+4uT55x9+9eUHMpQ7uGnOCKjA==", + "dev": true, + "license": "MIT", + "dependencies": { + "lightningcss": "^1.33.0", + "picomatch": "^4.0.7", + "postcss": "^8.5.28", + "rolldown": "~1.2.9", + "tinyglobby": "^0.2.17" + }, + "bin": { + "vite": "bin/vite.js" + }, + "engines": { + "node": "^20.19.0 || >=22.12.0" + }, + "funding": { + "url": "https://github.com/vitejs/vite?sponsor=1" + }, + "optionalDependencies": { + "fsevents": "~2.3.3" + }, + "peerDependencies": { + "@types/node": "^20.19.0 || >=22.12.0", + "@vitejs/devtools": "^0.7.1", + "esbuild": "^0.27.0 || ^0.28.0", + "jiti": ">=1.21.0", + "less": "^4.0.0", + "sass": "^1.70.0", + "sass-embedded": "^1.70.0", + "stylus": ">=0.54.8", + "sugarss": "^5.0.0", + "terser": "^5.16.0", + "tsx": "^4.8.1", + "yaml": "^2.4.2" + }, + "peerDependenciesMeta": { + "@types/node": { + "optional": true + }, + "@vitejs/devtools": { + "optional": true + }, + "esbuild": { + "optional": true + }, + "jiti": { + "optional": true + }, + "less": { + "optional": true + }, + "sass": { + "optional": true + }, + "sass-embedded": { + "optional": true + }, + "stylus": { + "optional": true + }, + "sugarss": { + "optional": true + }, + "terser": { + "optional": true + }, + "tsx": { + "optional": true + }, + "yaml": { + "optional": true + } + } + } + } +} diff --git a/frontend/package.json b/frontend/package.json new file mode 100644 index 0000000..ebb6bf4 --- /dev/null +++ b/frontend/package.json @@ -0,0 +1,22 @@ +{ + "name": "iam-login-ui", + "private": true, + "version": "0.0.1", + "type": "module", + "scripts": { + "build": "tsc --noEmit && vite build", + "watch": "vite build --watch", + "test:browser": "playwright test" + }, + "dependencies": { + "react": "19.3.0", + "react-dom": "19.3.0" + }, + "devDependencies": { + "vite": "8.3.1", + "typescript": "7.0.2", + "@types/react": "^19.2.0", + "@types/react-dom": "^19.2.0", + "@playwright/test": "1.63.0" + } +} diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts new file mode 100644 index 0000000..58ec8c4 --- /dev/null +++ b/frontend/playwright.config.ts @@ -0,0 +1,8 @@ +import { defineConfig } from "@playwright/test"; +export default defineConfig({ + testDir: "./tests", + use: { + baseURL: process.env.IAM_PREVIEW_URL ?? "http://127.0.0.1:18081", + headless: true, + }, +}); diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx new file mode 100644 index 0000000..deb662b --- /dev/null +++ b/frontend/src/main.tsx @@ -0,0 +1,159 @@ +import { createRoot } from "react-dom/client"; +import { useState, useLayoutEffect, type ReactNode } from "react"; +import "./style.css"; + +type PageContext = { + step: "identity" | "verification" | "complete"; + name: string; + error: string; + action: string; + csrf: { name: string; value: string }; +}; + +const context: PageContext = JSON.parse( + document.getElementById("login-context")!.textContent!, +); + +function Form({ children }: { children: ReactNode }) { + const [pending, setPending] = useState(false); + return ( +
setPending(true)} + aria-busy={pending} + > + + {children} + +
+ ); +} + +function App() { + useLayoutEffect(() => { performance.mark("iam-page-ready"); }, []); + const [showHelp, setShowHelp] = useState(false); + return ( +
+
+ + iam + 预览 + +
+
+
登录交互原型
+
    + {(["identity", "verification", "complete"] as const).map( + (step, i) => ( +
  1. + {i + 1} + {["填写称呼", "模拟验证", "完成"][i]} +
    2. + ), + )} +
+ {context.step === "identity" && ( + <> +

从这里开始

+

+ 体验一次完整的页面切换。先告诉我们怎么称呼你。 +

+ + )} + {context.step === "verification" && ( + <> +

你好，{context.name}

+

+ 这是第二步页面。输入演示码 123456{" "} + 继续，也可以试试输入错误的演示码。 +

+ + )} + {context.step === "complete" && ( + <> + +

体验完成

+

+ {context.name} + ，你已走完页面预览。这没有建立登录身份，也没有向任何应用授权。 +

+ + )} + {context.error && ( +

+ {context.error} +

+ )} +
+ {context.step === "identity" && ( + + )} + {context.step === "verification" && ( + + )} +
+ {context.step === "verification" && ( + + 返回上一步 + + )} +
+ + {showHelp && ( +

不是。这里仅演示页面交互，请勿输入真实密码或 MFA 验证码。

+ )} +
+
+
独立 IAM · 页面体验预览
+
+ ); +} + +createRoot(document.getElementById("root")!).render(); diff --git a/frontend/src/style.css b/frontend/src/style.css new file mode 100644 index 0000000..9df008c --- /dev/null +++ b/frontend/src/style.css @@ -0,0 +1,240 @@ +:root { + font-family: Inter, "Noto Sans SC", system-ui, sans-serif; + color: #182826; + background: #f3f5f1; + font-synthesis: none; + font-size: 16px; +} +* { + box-sizing: border-box; +} +body { + margin: 0; +} +main { + max-width: 520px; + margin: 0 auto; + padding: 40px 20px 28px; +} +header { + margin-bottom: 40px; +} +.brand { + font-size: 32px; + font-weight: 750; + letter-spacing: -2px; + color: #285448; + text-decoration: none; +} +.brand > span:first-child { + font-weight: 400; +} +.badge { + font-size: 11px; + letter-spacing: 1px; + vertical-align: middle; + margin-left: 14px; + padding: 5px 8px; + border: 1px solid #b7c9be; + border-radius: 5px; +} +.card { + background: #fff; + border: 1px solid #dce4dd; + border-radius: 18px; + padding: 36px; + box-shadow: 0 12px 40px #173f2510; +} +.eyebrow { + font-size: 12px; + color: #60746a; + letter-spacing: 2px; +} +.steps { + display: flex; + justify-content: space-between; + padding: 0; + list-style: none; + margin: 25px 0 32px; + gap: 8px; +} +.steps li { + font-size: 12px; + color: #718078; + display: flex; + align-items: center; + gap: 7px; +} +.steps li span { + display: inline-grid; + place-items: center; + width: 23px; + height: 23px; + border: 1px solid #ccd7ce; + border-radius: 50%; + font-size: 11px; +} +.steps [aria-current] { + color: #215542; + font-weight: 650; +} +.steps [aria-current] span { + background: #215542; + color: white; + border-color: #215542; +} +h1 { + font-size: 27px; + letter-spacing: -0.5px; + line-height: 1.35; + margin: 0 0 12px; + overflow-wrap: anywhere; +} +.intro { + font-size: 14px; + color: #60716a; + line-height: 1.8; + margin: 0 0 25px; +} +label { + display: block; + font-size: 14px; + font-weight: 600; +} +input:not([type="hidden"]) { + display: block; + width: 100%; + border: 1px solid #bdccc1; + border-radius: 8px; + padding: 13px 14px; + margin: 9px 0 22px; + font: inherit; + color: inherit; + background: #fff; +} +input:focus { + outline: 3px solid #a9cbbc; + outline-offset: 2px; +} +button { + font: inherit; + cursor: pointer; +} +.primary { + width: 100%; + border: 0; + background: #245b47; + color: #fff; + font-weight: 600; + border-radius: 8px; + padding: 13px; +} +.primary:hover { + background: #194734; +} +.primary:disabled { + opacity: 0.65; + cursor: wait; +} +.error { + color: #9e302b; + background: #fff0ed; + padding: 12px; + border-radius: 8px; + font-size: 14px; + line-height: 1.6; +} +.back { + display: block; + text-align: center; + font-size: 13px; + margin-top: 18px; + color: #476a58; +} +.help { + border-top: 1px solid #e5ebe6; + margin-top: 28px; + padding-top: 20px; +} +.link { + background: none; + border: 0; + color: #5b7064; + padding: 0; + font-size: 13px; +} +.help p { + font-size: 13px; + line-height: 1.8; + color: #6a756e; + margin-bottom: 0; +} +footer { + text-align: center; + color: #7c887e; + font-size: 12px; + margin-top: 28px; +} +.success { + color: #245b47; + font-size: 30px; + margin-bottom: 12px; +} +a:focus-visible, +button:focus-visible { + outline: 3px solid #a9cbbc; + outline-offset: 3px; +} +@media (max-width: 480px) { + main { + padding-top: 24px; + } + header { + margin-bottom: 24px; + } + .card { + padding: 26px 22px; + } + .steps { + gap: 5px; + } + .steps li { + font-size: 11px; + } +} +@media (prefers-color-scheme: dark) { + :root { + background: #14221c; + color: #edf4ee; + } + .card { + background: #1e3027; + border-color: #344b3d; + } + .brand, + .steps [aria-current], + .success { + color: #b9ddc8; + } + .intro, + .eyebrow, + .help p, + .link, + .back { + color: #acbfb2; + } + .steps li { + color: #98aa9e; + } + input:not([type="hidden"]) { + background: #18271f; + border-color: #526657; + } + .help { + border-color: #3a4d40; + } + .error { + background: #492b29; + color: #ffc3b9; + } +} diff --git a/frontend/src/vite-env.d.ts b/frontend/src/vite-env.d.ts new file mode 100644 index 0000000..11f02fe --- /dev/null +++ b/frontend/src/vite-env.d.ts @@ -0,0 +1 @@ +/// diff --git a/frontend/tests/preview.spec.ts b/frontend/tests/preview.spec.ts new file mode 100644 index 0000000..7295140 --- /dev/null +++ b/frontend/tests/preview.spec.ts @@ -0,0 +1,95 @@ +import { test, expect } from "@playwright/test"; + +test("原生 POST 逐页导航，内联上下文，浏览器缓存静态资源", async ({ page }) => { + const xhr: string[] = []; + const posts: string[] = []; + const errors: string[] = []; + page.on("pageerror", (e) => errors.push(e.message)); + page.on("request", (req) => { + if (["fetch", "xhr"].includes(req.resourceType())) xhr.push(req.url()); + if (req.method() === "POST" && req.isNavigationRequest()) + posts.push(req.url()); + }); + await page.goto("/preview"); + await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); + const scriptUrl = await page.locator("script[src]").getAttribute("src"); + await page.getByRole("button", { name: "这是真实登录吗？" }).click(); + await expect(page.getByText("不是。这里仅演示页面交互")).toBeVisible(); + await page.getByLabel("称呼").fill("预览用户"); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page).toHaveURL(/\/preview\/verify$/); + await expect( + page.getByRole("heading", { name: "你好，预览用户" }), + ).toBeVisible(); + await page.getByLabel("演示码").fill("000000"); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("alert")).toContainText("演示码不正确"); + await page.getByLabel("演示码").fill("123456"); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("heading", { name: "体验完成" })).toBeVisible(); + expect(posts).toHaveLength(3); + expect(xhr).toEqual([]); + expect(errors).toEqual([]); + const timing = await page.evaluate(() => ({ + navigation: performance + .getEntriesByType("navigation") + .map((e) => e.toJSON()), + resources: performance.getEntriesByType("resource").map((e) => e.toJSON()), + })); + const script = timing.resources.find((r) => r.name.endsWith(scriptUrl!)); + expect(script?.transferSize).toBe(0); + await test + .info() + .attach("navigation-and-cache.json", { + body: JSON.stringify(timing, null, 2), + contentType: "application/json", + }); + expect( + ( + await page.request.get("/", { headers: { Accept: "application/json" } }) + ).status(), + ).toBe(401); + await page.getByRole("button", { name: "重新体验" }).click(); + await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); +}); + +test("移动端与脚本结束标记作为纯文本显示", async ({ page }) => { + await page.setViewportSize({ width: 390, height: 844 }); + await page.goto("/preview"); + const name = ""; + await page.getByLabel("称呼").fill(name); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("heading")).toHaveText(`你好，${name}`); + expect( + await page.evaluate(() => Reflect.get(window, "__injected")), + ).toBeUndefined(); + expect( + await page.evaluate( + () => document.documentElement.scrollWidth <= innerWidth, + ), + ).toBe(true); + await page.screenshot({ path: "test-results/mobile.png", fullPage: true }); +}); + + +test("受限网络下首屏和缓存后页面切换计时", async ({ page, context }) => { + const cdp = await context.newCDPSession(page); + await cdp.send("Network.enable"); + await cdp.send("Network.emulateNetworkConditions", { + offline: false, latency: 60, downloadThroughput: 1_500_000 / 8, + uploadThroughput: 750_000 / 8, + }); + await cdp.send("Emulation.setCPUThrottlingRate", { rate: 4 }); + await page.goto("/preview"); + await expect(page.getByRole("heading", { name: "从这里开始" })).toBeVisible(); + const cold = await page.evaluate(() => performance.getEntriesByName("iam-page-ready")[0].startTime); + await page.getByLabel("称呼").fill("计时体验"); + const start = performance.now(); + await page.getByRole("button", { name: "继续", exact: true }).click(); + await expect(page.getByRole("heading", { name: "你好，计时体验" })).toBeVisible(); + const warm = performance.now() - start; + const result = { network_latency_ms: 60, download_mbps: 1.5, cpu_slowdown: 4, + cold_navigation_to_react_commit_ms: Math.round(cold), warm_click_to_visible_ms: Math.round(warm) }; + console.log(JSON.stringify(result)); + await test.info().attach("timing.json", { body: JSON.stringify(result, null, 2), contentType: "application/json" }); +}); diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json new file mode 100644 index 0000000..3164401 --- /dev/null +++ b/frontend/tsconfig.json @@ -0,0 +1,13 @@ +{ + "compilerOptions": { + "target": "ES2022", + "lib": ["ES2022", "DOM", "DOM.Iterable"], + "module": "ESNext", + "moduleResolution": "Bundler", + "jsx": "react-jsx", + "strict": true, + "noEmit": true, + "skipLibCheck": true + }, + "include": ["src"] +} diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts new file mode 100644 index 0000000..bd6b3a0 --- /dev/null +++ b/frontend/vite.config.ts @@ -0,0 +1,6 @@ +import { defineConfig } from "vite"; + +export default defineConfig({ + base: "/", + build: { outDir: "dist", emptyOutDir: true }, +}); diff --git a/scripts/frontend-in-docker b/scripts/frontend-in-docker new file mode 100755 index 0000000..c3358a7 --- /dev/null +++ b/scripts/frontend-in-docker @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +set -euo pipefail +repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd) +cache_dir=${IAM_NPM_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/iam-login/npm} +mkdir -p -- "$cache_dir" +cache_dir=$(cd -- "$cache_dir" && pwd) +docker_cmd=(docker) +if [[ ${IAM_DOCKER_USE_SUDO:-0} == 1 ]]; then + docker_cmd=(sudo -n docker) +fi +exec "${docker_cmd[@]}" run --rm --network host \ + --cpus 2 --memory 1g --user "$(id -u):$(id -g)" \ + -e HOME=/npm -e npm_config_cache=/npm \ + -v "$cache_dir:/npm" -v "$repo_root:/workspace" \ + -w /workspace/frontend node@sha256:d8e448a56fc63242f70026718378bd4b00f8c82e78d20eefb199224a4d8e33d8 \ + sh -c 'npm ci --no-audit --no-fund && npm run build' diff --git a/scripts/gradle-in-docker b/scripts/gradle-in-docker index d681d2f..2f882da 100755 --- a/scripts/gradle-in-docker +++ b/scripts/gradle-in-docker @@ -13,6 +13,8 @@ if (($# == 0)); then set -- test fi +"$repo_root/scripts/frontend-in-docker" + # Linux host networking is needed for Testcontainers' published ports. exec "${docker_cmd[@]}" run --rm --network host \ --cpus "${IAM_BUILD_CPUS:-4}" --memory "${IAM_BUILD_MEMORY:-8g}" \ diff --git a/scripts/native-smoke.py b/scripts/native-smoke.py index f5ef364..05d51fe 100755 --- a/scripts/native-smoke.py +++ b/scripts/native-smoke.py @@ -78,6 +78,7 @@ def main(): ready_seconds = time.monotonic() - started assert request('/actuator/prometheus')[0] == 401, 'Anonymous metrics must be rejected' assert request('/')[0] == 401, 'Anonymous application access must be rejected' + assert request('/preview')[0] == 404, 'UI preview must be disabled by default' status, before = request('/actuator/prometheus', authenticated=True) assert status == 200, 'Authenticated Prometheus scrape failed' for _ in range(3): diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java new file mode 100644 index 0000000..04babb3 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/preview/PreviewConfiguration.java @@ -0,0 +1,44 @@ +package top.ddupan.iam.login.preview; + +import java.time.Duration; +import org.springframework.aot.hint.RuntimeHints; +import org.springframework.aot.hint.RuntimeHintsRegistrar; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.ImportRuntimeHints; +import org.springframework.http.CacheControl; +import org.springframework.security.config.Customizer; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.web.SecurityFilterChain; +import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; + +@Configuration(proxyBeanMethods = false) +@ImportRuntimeHints(PreviewConfiguration.Resources.class) +class PreviewConfiguration implements WebMvcConfigurer { + @Bean + SecurityFilterChain security(HttpSecurity http) throws Exception { + return http.authorizeHttpRequests(auth -> auth + .requestMatchers("/error", "/preview", "/preview/**", "/assets/**", "/actuator/health/**").permitAll() + .anyRequest().authenticated()) + .formLogin(Customizer.withDefaults()) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives( + "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " + + "object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"))) + .build(); + } + + @Override + public void addResourceHandlers(ResourceHandlerRegistry registry) { + registry.addResourceHandler("/assets/**").addResourceLocations("classpath:/ui/assets/") + .setCacheControl(CacheControl.maxAge(Duration.ofDays(365)).cachePublic().immutable()); + } + + static class Resources implements RuntimeHintsRegistrar { + @Override + public void registerHints(RuntimeHints hints, ClassLoader classLoader) { + hints.resources().registerPattern("ui/**"); + } + } +} diff --git a/src/main/java/top/ddupan/iam/login/preview/PreviewController.java b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java new file mode 100644 index 0000000..423f243 --- /dev/null +++ b/src/main/java/top/ddupan/iam/login/preview/PreviewController.java @@ -0,0 +1,146 @@ +package top.ddupan.iam.login.preview; + +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpSession; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.util.Map; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.core.io.ClassPathResource; +import org.springframework.http.HttpStatus; +import org.springframework.http.MediaType; +import org.springframework.http.ResponseEntity; +import org.springframework.security.web.csrf.CsrfToken; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; +import org.springframework.web.server.ResponseStatusException; +import tools.jackson.databind.json.JsonMapper; + +/** An isolated UI experiment. It never creates an authenticated SecurityContext. */ +@RestController +class PreviewController { + private static final String STATE = PreviewController.class.getName() + ".state"; + private static final String SLOT = "__IAM_PAGE_CONTEXT__"; + private final boolean enabled; + private final String shell; + private final JsonMapper json = JsonMapper.builder().build(); + + PreviewController(@Value("${iam.ui-preview.enabled:false}") boolean enabled) throws IOException { + this.enabled = enabled; + this.shell = new ClassPathResource("ui/index.html").getContentAsString(StandardCharsets.UTF_8); + if (shell.indexOf(SLOT) < 0 || shell.indexOf(SLOT) != shell.lastIndexOf(SLOT)) { + throw new IllegalStateException("Expected exactly one UI context slot"); + } + } + + @GetMapping(value = {"/preview", "/preview/verify", "/preview/complete"}, produces = MediaType.TEXT_HTML_VALUE) + ResponseEntity page(HttpServletRequest request, CsrfToken csrf) { + requireEnabled(); + var session = request.getSession(); + synchronized (session) { + var state = state(session); + var path = request.getRequestURI().substring(request.getContextPath().length()); + if (path.equals("/preview")) { + if (!state.step.equals("identity")) state.error = ""; + state.step = "identity"; + } else if (!path.equals(pathFor(state.step))) { + return redirect(pathFor(state.step)); + } + var context = Map.of("step", state.step, "name", state.name, "error", state.error, + "action", switch (state.step) { + case "identity" -> "/preview/identify"; + case "verification" -> "/preview/verify"; + default -> "/preview/restart"; + }, "csrf", Map.of("name", csrf.getParameterName(), "value", csrf.getToken())); + return ResponseEntity.ok().header("Cache-Control", "no-store") + .contentType(MediaType.TEXT_HTML).body(shell.replace(SLOT, htmlSafeJson(context))); + } + } + + @PostMapping("/preview/identify") + ResponseEntity identify(@RequestParam(defaultValue = "") String name, HttpSession session) { + requireEnabled(); + synchronized (session) { + var state = state(session); + requireStep(state, "identity"); + if (name.isBlank() || name.length() > 64) { + state.error = "称呼须为 1 到 64 个字符。"; + return redirect("/preview"); + } + state.name = name.strip(); + state.error = ""; + state.step = "verification"; + return redirect("/preview/verify"); + } + } + + @PostMapping("/preview/verify") + ResponseEntity verify(@RequestParam(defaultValue = "") String code, HttpSession session) { + requireEnabled(); + synchronized (session) { + var state = state(session); + requireStep(state, "verification"); + if (!code.equals("123456")) { + state.error = "演示码不正确，请输入 123456。"; + return redirect("/preview/verify"); + } + state.error = ""; + state.step = "complete"; + return redirect("/preview/complete"); + } + } + + @PostMapping("/preview/restart") + ResponseEntity restart(HttpSession session) { + requireEnabled(); + synchronized (session) { + session.removeAttribute(STATE); + return redirect("/preview"); + } + } + + private void requireEnabled() { + if (!enabled) throw new ResponseStatusException(HttpStatus.NOT_FOUND); + } + + private static void requireStep(State state, String step) { + if (!state.step.equals(step)) throw new ResponseStatusException(HttpStatus.CONFLICT, "页面已过期，请重新打开预览"); + } + + private static State state(HttpSession session) { + var state = (State) session.getAttribute(STATE); + if (state == null) { + state = new State(); + session.setAttribute(STATE, state); + } + return state; + } + + private static String pathFor(String step) { + return switch (step) { + case "verification" -> "/preview/verify"; + case "complete" -> "/preview/complete"; + default -> "/preview"; + }; + } + + private static ResponseEntity redirect(String path) { + return ResponseEntity.status(HttpStatus.SEE_OTHER).header("Location", path) + .header("Cache-Control", "no-store").build(); + } + + String htmlSafeJson(Object value) { + // JSON in a script data block still participates in HTML parsing. + return json.writeValueAsString(value).replace("<", "\\u003c") + .replace(">", "\\u003e").replace("&", "\\u0026") + .replace("\u2028", "\\u2028").replace("\u2029", "\\u2029"); + } + + private static class State { + String step = "identity"; + String name = ""; + String error = ""; + } +} diff --git a/src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login/reachability-metadata.json b/src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login-manual/reachability-metadata.json similarity index 100% rename from src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login/reachability-metadata.json rename to src/main/resources/META-INF/native-image/top.ddupan.iam/iam-login-manual/reachability-metadata.json diff --git a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java index 1619289..abfb7d5 100644 --- a/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java +++ b/src/test/java/top/ddupan/iam/login/IamLoginApplicationTests.java @@ -1,6 +1,7 @@ package top.ddupan.iam.login; import io.micrometer.core.instrument.MeterRegistry; +import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -10,42 +11,114 @@ import org.springframework.boot.opentelemetry.autoconfigure.logging.otlp.OtlpLog import org.springframework.boot.opentelemetry.autoconfigure.logging.otlp.Transport; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.testcontainers.service.connection.ServiceConnection; +import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc; +import org.springframework.http.MediaType; +import org.springframework.mock.web.MockHttpSession; +import org.springframework.test.web.servlet.MockMvc; import org.testcontainers.grafana.LgtmStackContainer; import org.testcontainers.junit.jupiter.Container; import org.testcontainers.junit.jupiter.Testcontainers; import org.testcontainers.utility.DockerImageName; import static org.assertj.core.api.Assertions.assertThat; +import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -@SpringBootTest +@SpringBootTest(properties = "iam.ui-preview.enabled=true") +@AutoConfigureMockMvc @AutoConfigureMetrics @AutoConfigureTracing @Testcontainers class IamLoginApplicationTests { - // Field-based service connections are recreated by the test context in AOT mode. - @Container - @ServiceConnection - static final LgtmStackContainer grafanaLgtm = new LgtmStackContainer( - DockerImageName.parse(TestcontainersConfiguration.LGTM_IMAGE)); + // Field-based service connections are recreated by the test context in AOT mode. + @Container + @ServiceConnection + static final LgtmStackContainer grafanaLgtm = new LgtmStackContainer( + DockerImageName.parse(TestcontainersConfiguration.LGTM_IMAGE)); - @Autowired - OtlpLoggingConnectionDetails loggingConnectionDetails; + @Autowired + OtlpLoggingConnectionDetails loggingConnectionDetails; - @Autowired - @Qualifier("prometheusMeterRegistry") - MeterRegistry prometheus; + @Autowired + @Qualifier("prometheusMeterRegistry") + MeterRegistry prometheus; - @Test - void processCpuTimeCanBeRead() { - assertThat(prometheus.get("process.cpu.time").functionCounter().count()).isFinite().isNotNegative(); - } + @Autowired + MockMvc mvc; - @Test - void loggingConnectionUsesRunningContainer() { - assertThat(grafanaLgtm.isRunning()).isTrue(); - assertThat(loggingConnectionDetails.getUrl(Transport.HTTP)) - .isEqualTo(grafanaLgtm.getOtlpHttpUrl() + "/v1/logs"); - } + @Test + void previewHasInlineContextAndNoCache() throws Exception { + var result = mvc.perform(get("/preview")) + .andExpect(status().isOk()) + .andExpect(header().string("Cache-Control", "no-store")) + .andReturn(); + assertThat(result.getResponse().getContentAsString()).contains("login-context", "identity", "_csrf") + .doesNotContain("__IAM_PAGE_CONTEXT__"); + } + + @Test + void previewRejectsMissingCsrf() throws Exception { + mvc.perform(post("/preview/identify").param("name", "测试")) + .andExpect(status().isForbidden()); + } + + @Test + void previewChecksStepsAndEscapesScriptEndTags() throws Exception { + var session = new MockHttpSession(); + mvc.perform(post("/preview/verify") + .session(session).with(csrf()) + .param("code", "123456")) + .andExpect(status().isConflict()); + mvc.perform(post("/preview/identify") + .session(session).with(csrf()) + .param("name", "")) + .andExpect(status().isSeeOther()); + var html = mvc.perform(get("/preview/verify").session(session)) + .andExpect(status().isOk()).andReturn() + .getResponse().getContentAsString(); + assertThat(html).doesNotContain("") + .contains("\\u003c/script\\u003e"); + } + + @Test + void previewRetriesAndCompletesWithoutAuthenticating() throws Exception { + var session = new MockHttpSession(); + mvc.perform(post("/preview/identify") + .session(session).with(csrf()) + .param("name", "测试")) + .andExpect(redirectedUrl("/preview/verify")); + mvc.perform(post("/preview/verify") + .session(session).with(csrf()) + .param("code", "000000")) + .andExpect(redirectedUrl("/preview/verify")); + var retry = mvc.perform(get("/preview/verify").session(session)) + .andReturn().getResponse(); + assertThat(retry.getContentAsString(StandardCharsets.UTF_8)).contains("演示码不正确"); + mvc.perform(post("/preview/verify") + .session(session).with(csrf()) + .param("code", "123456")) + .andExpect(redirectedUrl("/preview/complete")); + mvc.perform(get("/").session(session) + .accept(MediaType.APPLICATION_JSON)) + .andExpect(status().isUnauthorized()); + assertThat(session.getAttribute("SPRING_SECURITY_CONTEXT")).isNull(); + } + + @Test + void processCpuTimeCanBeRead() { + assertThat(prometheus.get("process.cpu.time").functionCounter().count()).isFinite().isNotNegative(); + } + + @Test + void loggingConnectionUsesRunningContainer() { + assertThat(grafanaLgtm.isRunning()).isTrue(); + assertThat(loggingConnectionDetails.getUrl(Transport.HTTP)) + .isEqualTo(grafanaLgtm.getOtlpHttpUrl() + "/v1/logs"); + } }