bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(enterprise): add first-login rotation and receipt bridge

Browse source
This commit is contained in:
冰朔 2026-08-16 20:49:13 +08:00
commit 08f514b9d1
9 changed files with 322 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
product-source/hololake-native-desktop/scripts/domain-number-routing.test.mjs
View file

@ -29,6 +29,8 @@ test('the public shell shows five domains and login is domain-routed', () => {
assert.match(frontend, /输入编号进入所属域/)
assert.match(login, /login_host_for_domain/)
assert.match(login, /ENTERPRISE_LOGIN_HOST.*guanghu\.chat/)
assert.match(login, /change_enterprise_first_login_password/)
assert.match(frontend, /第一次使用？先修改一次性密码/)
assert.match(router, /enterprise_resolve_url/)
assert.match(router, /verified_user_route/)
assert.match(router, /FIFTH_DOMAIN.*MAIN_DOMAIN.*BRANCH_DOMAIN.*ZERO_DOMAIN.*ZERO_SENSE_DOMAIN/s)

163
product-source/hololake-native-desktop/src-tauri/src/code_repo_login.rs
View file

@ -45,6 +45,13 @@ pub struct LoginReceipt {
pub domain: String,
}
#[derive(Debug, Clone, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct PasswordRotationReceipt {
pub username: String,
pub password_changed: bool,
}
fn session_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
Ok(app
.path()
@ -84,6 +91,20 @@ fn keychain_has(host: &str, username: &str) -> bool {
.unwrap_or(false)
}
#[cfg(target_os = "macos")]
fn keychain_read(host: &str, username: &str) -> Result<String, String> {
let output = Command::new("/usr/bin/security")
.args(["find-internet-password", "-w", "-s", host, "-a", username])
.output()
.map_err(|_| "HOLOLAKE_LOGIN_KEYCHAIN_READ_FAILED".to_string())?;
if !output.status.success() {
return Err("HOLOLAKE_LOGIN_KEYCHAIN_READ_FAILED".into());
}
String::from_utf8(output.stdout)
.map(|value| value.trim_end().to_string())
.map_err(|_| "HOLOLAKE_LOGIN_KEYCHAIN_READ_FAILED".into())
}
#[cfg(target_os = "macos")]
fn keychain_remove(host: &str, username: &str) {
let _ = Command::new("/usr/bin/security")
@ -102,6 +123,11 @@ fn keychain_has(_host: &str, _username: &str) -> bool {
false
}
#[cfg(not(target_os = "macos"))]
fn keychain_read(_host: &str, _username: &str) -> Result<String, String> {
Err("HOLOLAKE_PERSISTENT_CREDENTIAL_UNAVAILABLE".into())
}
#[cfg(not(target_os = "macos"))]
fn keychain_remove(_host: &str, _username: &str) {}
@ -175,6 +201,143 @@ fn login_host_for_domain(domain: &str) -> Result<&'static str, String> {
}
}
/// 企业新账号第一次登录时在 HoloLake 内完成强制换密。
/// 旧、新密码只存在于本次 HTTPS 请求内；服务端回执不含密码。
#[tauri::command]
pub async fn change_enterprise_first_login_password(
state: State<'_, ZeroPointState>,
username: String,
current_password: String,
new_password: String,
) -> Result<PasswordRotationReceipt, String> {
let Some((human_number, domain)) = zero_point::verified_user_route(&state)? else {
return Err("HOLOLAKE_DOMAIN_ROUTE_REQUIRED".into());
};
if domain == "FIFTH_DOMAIN" {
return Err("HOLOLAKE_FIRST_LOGIN_PASSWORD_CHANGE_ENTERPRISE_ONLY".into());
}
let username = validate_username(&username)?;
if current_password.is_empty() || current_password.len() > 512 {
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
if new_password.len() < 14 || new_password.len() > 128 || new_password == current_password {
return Err("HOLOLAKE_NEW_PASSWORD_POLICY_INVALID".into());
}
let response = reqwest::Client::builder()
.read_timeout(Duration::from_secs(30))
.use_rustls_tls()
.build()
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?
.post("https://guanghu.chat/api/hololake/enterprise/change-password")
.basic_auth(&username, Some(&current_password))
.json(&serde_json::json!({
"human_number": human_number,
"new_password": new_password,
}))
.send()
.await
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
if response.status() == reqwest::StatusCode::UNAUTHORIZED {
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
if !response.status().is_success() {
return Err(format!(
"HOLOLAKE_FIRST_LOGIN_PASSWORD_CHANGE_FAILED: {}",
response.status()
));
}
Ok(PasswordRotationReceipt {
username,
password_changed: true,
})
}
async fn enterprise_authenticated_post(
app: &AppHandle,
state: &ZeroPointState,
path: &str,
mut payload: serde_json::Value,
) -> Result<serde_json::Value, String> {
let Some((human_number, domain)) = zero_point::verified_user_route(state)? else {
return Err("HOLOLAKE_DOMAIN_ROUTE_REQUIRED".into());
};
if domain == "FIFTH_DOMAIN" {
return Err("HOLOLAKE_ENTERPRISE_RECEIPT_ROUTE_REQUIRED".into());
}
let session = current_login_session_for_domain(app, &domain)?
.ok_or_else(|| "HOLOLAKE_LOGIN_SESSION_REQUIRED".to_string())?;
let password = keychain_read(&session.host, &session.username)?;
payload["human_number"] = serde_json::Value::String(human_number);
let response = reqwest::Client::builder()
.read_timeout(Duration::from_secs(20))
.use_rustls_tls()
.build()
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?
.post(format!("https://guanghu.chat/api/hololake/enterprise/{path}"))
.basic_auth(&session.username, Some(password))
.json(&payload)
.send()
.await
.map_err(|error| format!("HOLOLAKE_LOGIN_NETWORK_FAILED: {error}"))?;
if response.status() == reqwest::StatusCode::UNAUTHORIZED {
return Err("HOLOLAKE_LOGIN_CREDENTIALS_INVALID".into());
}
if !response.status().is_success() {
return Err(format!("HOLOLAKE_ENTERPRISE_RECEIPT_FAILED: {}", response.status()));
}
response
.json()
.await
.map_err(|error| format!("HOLOLAKE_ENTERPRISE_RECEIPT_FAILED: {error}"))
}
#[tauri::command]
pub async fn get_enterprise_entry(
app: AppHandle,
state: State<'_, ZeroPointState>,
) -> Result<serde_json::Value, String> {
enterprise_authenticated_post(&app, &state, "me/entry", serde_json::json!({})).await
}
#[tauri::command]
pub async fn confirm_enterprise_persona_relationship(
app: AppHandle,
state: State<'_, ZeroPointState>,
decision: String,
idempotency_key: String,
) -> Result<serde_json::Value, String> {
enterprise_authenticated_post(
&app,
&state,
"relationship-confirmations",
serde_json::json!({ "decision": decision, "idempotency_key": idempotency_key }),
)
.await
}
#[tauri::command]
pub async fn submit_enterprise_responsibility_receipt(
app: AppHandle,
state: State<'_, ZeroPointState>,
decision: String,
note: String,
responsibility_version: String,
idempotency_key: String,
) -> Result<serde_json::Value, String> {
enterprise_authenticated_post(
&app,
&state,
"responsibility-receipts",
serde_json::json!({
"decision": decision,
"note": note,
"responsibility_version": responsibility_version,
"idempotency_key": idempotency_key,
}),
)
.await
}
/// 登录验证：基本认证打 Forgejo 用户接口，密码错=401 即拒；
/// 通过后凭证进钥匙串，会话（不含密码）落盘。
#[tauri::command]

4
product-source/hololake-native-desktop/src-tauri/src/lib.rs
View file

@ -70,6 +70,10 @@ pub fn run() {
pncc_server_projection::query_jd_pncc_server_projection,
code_repo_login::check_code_repo_login,
code_repo_login::perform_code_repo_login,
code_repo_login::change_enterprise_first_login_password,
code_repo_login::get_enterprise_entry,
code_repo_login::confirm_enterprise_persona_relationship,
code_repo_login::submit_enterprise_responsibility_receipt,
code_repo_login::sign_out_code_repo_login,
user_pncc_channel::get_user_pncc_channel,
user_pncc_channel::ensure_user_pncc_channel,

39
product-source/hololake-native-desktop/src/main.tsx
View file

@ -219,6 +219,9 @@ function humanError(error: unknown, context: 'knowledge' | 'code' | 'identity' |
if (value.includes('LOGIN_KEYCHAIN_FAILED')) return '本机钥匙串写入失败，凭证未能安全保存。'
if (value.includes('LOGIN_SESSION_CORRUPT')) return '登录会话已损坏，请重新登录。'
if (value.includes('LOGIN_VERIFICATION_FAILED')) return '仓库验证未通过，请稍后再试。'
if (value.includes('NEW_PASSWORD_POLICY_INVALID')) return '新密码至少 14 位，并且不能与一次性密码相同。'
if (value.includes('FIRST_LOGIN_PASSWORD_CHANGE_FAILED')) return '一次性密码未被接受，密码没有修改。'
if (value.includes('FIRST_LOGIN_PASSWORD_CHANGE_ENTERPRISE_ONLY')) return '该换密入口只用于企业四域的新账号。'
if (value.includes('DOMAIN_LOGIN_NOT_PROVISIONED')) return '该域的企业服务器尚未接入，当前不能继续登录。'
if (value.includes('DOMAIN_ROUTE_REQUIRED') || value.includes('ZP_DOMAIN_ROUTE_REQUIRED')) return '编号尚未解析到已登记域，不能开始登录。'
if (value.includes('USER_PNCC_TRUSTED_SUBJECT_REQUIRED')) return '建立人格代码频道前，需要有效的用户编号与仓库账号登录。'
@ -349,6 +352,9 @@ function HoloLakeApp() {
const [userPnccMessage, setUserPnccMessage] = useState('')
const [loginUsername, setLoginUsername] = useState('')
const [loginPassword, setLoginPassword] = useState('')
const [passwordChangeMode, setPasswordChangeMode] = useState(false)
const [newLoginPassword, setNewLoginPassword] = useState('')
const [confirmLoginPassword, setConfirmLoginPassword] = useState('')
const [loginBusy, setLoginBusy] = useState(false)
const [loginRising, setLoginRising] = useState(false)
const [loginMessage, setLoginMessage] = useState('')
@ -733,6 +739,28 @@ function HoloLakeApp() {
} catch (error) { setLoginMessage(humanError(error, 'login')) }
finally { setLoginBusy(false) }
}
const changeFirstLoginPassword = async (event: React.FormEvent) => {
event.preventDefault()
if (newLoginPassword !== confirmLoginPassword) {
setLoginMessage('两次输入的新密码不一致。')
return
}
setLoginBusy(true)
setLoginMessage('')
try {
await invoke('change_enterprise_first_login_password', {
username: loginUsername.trim(),
currentPassword: loginPassword,
newPassword: newLoginPassword,
})
setLoginPassword(newLoginPassword)
setNewLoginPassword('')
setConfirmLoginPassword('')
setPasswordChangeMode(false)
setLoginMessage('密码已更新。请用新密码验证并进入。')
} catch (error) { setLoginMessage(humanError(error, 'login')) }
finally { setLoginBusy(false) }
}
const signOutRepo = async () => {
try { await invoke('sign_out_code_repo_login') } catch { /* 登出以本机清场为准 */ }
setPersonal(previewPersonal)
@ -1038,12 +1066,17 @@ function HoloLakeApp() {
</section>
) : (
<section className={`gate-pod gate-pod-key${loginRising ? ' fade-out' : ''}`} role="dialog">
<form onSubmit={(event) => void performRepoLogin(event)}>
<form onSubmit={(event) => void (passwordChangeMode ? changeFirstLoginPassword(event) : performRepoLogin(event))}>
<input id="repo-login-username" aria-label="账号" autoFocus maxLength={40} value={loginUsername} placeholder="账号" onChange={(event) => setLoginUsername(event.target.value)}/>
<input id="repo-login-password" aria-label="密码" type="password" maxLength={512} value={loginPassword} placeholder="密码" onChange={(event) => setLoginPassword(event.target.value)}/>
<button className="gate-submit" disabled={loginBusy || !loginUsername.trim() || !loginPassword}>{loginBusy ? '正在验证…' : '验证并进入'}</button>
<input id="repo-login-password" aria-label={passwordChangeMode ? '一次性密码' : '密码'} type="password" maxLength={512} value={loginPassword} placeholder={passwordChangeMode ? '一次性密码' : '密码'} onChange={(event) => setLoginPassword(event.target.value)}/>
{passwordChangeMode && <>
<input aria-label="新密码" type="password" minLength={14} maxLength={128} value={newLoginPassword} placeholder="设置新密码（至少 14 位）" onChange={(event) => setNewLoginPassword(event.target.value)}/>
<input aria-label="确认新密码" type="password" minLength={14} maxLength={128} value={confirmLoginPassword} placeholder="再次输入新密码" onChange={(event) => setConfirmLoginPassword(event.target.value)}/>
</>}
<button className="gate-submit" disabled={loginBusy || !loginUsername.trim() || !loginPassword || (passwordChangeMode && (!newLoginPassword || !confirmLoginPassword))}>{loginBusy ? '正在处理…' : passwordChangeMode ? '修改密码' : '验证并进入'}</button>
</form>
{loginMessage && <p className="gate-hint">{loginMessage}</p>}
{zeroPoint?.resolvedDomain !== 'FIFTH_DOMAIN' && <button className="gate-back" type="button" onClick={() => { setPasswordChangeMode((value) => !value); setLoginMessage(''); setNewLoginPassword(''); setConfirmLoginPassword('') }}>{passwordChangeMode ? '返回正常登录' : '第一次使用？先修改一次性密码'}</button>}
<button className="gate-back" type="button" onClick={() => { setGateStage('number'); setGateMessage(''); setLoginMessage('') }}>返回编号验证</button>
</section>
)}