Files
biliup/app/ui/ChangePasswordModal.tsx
Noah d343386fbd feat: 用户管理与分级权限(超级管理员 / 操作员 / 只读观察者) (#1718)
* feat(web): multi-user accounts with fixed admin/operator/viewer roles

- migration 6 adds web_users and copies the existing single admin with
  the same id and password hash, so upgrades need no action and existing
  sessions stay logged in
- table-driven permission middleware on every business route (default
  deny), 403 for missing permission, 401 when logged out
- hooks/override and secrets redacted for non-admins; operators may only
  pick registered bilibili accounts for templates
- /v1/web-users management API, /v1/me and self password change
- login rate limit: 5 consecutive failures lock the username for 30s
- revoked sessions cut long-lived websocket/stream responses

Refs #1717

* feat(cli): add `biliup user list` and `biliup user reset-password`

Refs #1717

* feat(web-ui): user management page, account menu and editable login name

- /users page (super admin only): create users, change role, reset
  password, disable, force logout, delete; table on desktop, cards on
  mobile, with loading/empty/error states
- sidebar filters menu entries by the permissions from /v1/me and shows
  a no-access state for pages the role cannot open
- account menu in the sidebar footer with change password and logout,
  hidden when --auth is off
- 403 responses show a warning toast instead of redirecting
- login page username is editable (default biliup)

Refs #1717

* feat(web-ui): hide actions the current role cannot perform

Streamer add/edit/delete/pause, hook and override editing, template and
upload actions, bilibili account management and config saving are only
rendered for roles that have the matching permission. Account and type
tree requests are skipped for roles that would get 403.

Refs #1717

* fix(web-ui): wait for permissions on restricted pages, surface pause errors

- pages that need a permission not every role has render a spinner until
  /v1/me returns, so roles without it never fire requests doomed to 403
- user management is hidden when --auth is off, with an explanation if
  the page is opened directly
- the pause button goes through the shared response handler, so a 403
  shows the permission toast instead of failing silently
- permission errors sent as plain text keep their message

Refs #1717

* fix(web-ui): keep user actions reachable on tablet and narrow desktop

Refs #1717

* fix(py): handle the user subcommand in the stream-gears entry point

Refs #1717
2026-09-23 14:59:58 +00:00

116 lines
3.4 KiB
TypeScript
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
'use client'
import { useRef, useState } from 'react'
import { Form, Modal, Toast, Typography } from '@douyinfe/semi-ui'
import type { FormApi } from '@douyinfe/semi-ui/lib/es/form'
import { API_BASE } from '../lib/api-streamer'
export const MIN_PASSWORD_LENGTH = 8
type Values = { old_password: string; new_password: string; confirm: string }
/** 修改自己的密码。成功后当前浏览器保持登录,其它设备上的会话全部失效。 */
export default function ChangePasswordModal({
visible,
onClose,
}: {
visible: boolean
onClose: () => void
}) {
const api = useRef<FormApi<Values>>(undefined)
const [saving, setSaving] = useState(false)
const submit = async () => {
let values: Values
try {
values = (await api.current?.validate()) as Values
} catch {
return
}
setSaving(true)
try {
const res = await fetch(`${API_BASE}/v1/me/password`, {
method: 'PUT',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
old_password: values.old_password,
new_password: values.new_password,
}),
})
if (res.status === 401) {
window.location.assign('/login')
return
}
if (!res.ok) {
const body = await res.json().catch(() => null)
const message = body?.message || `修改失败(HTTP ${res.status})`
if (res.status === 400 && message === '当前密码不正确') {
api.current?.setError('old_password', message)
} else {
Toast.error(message)
}
return
}
Toast.success('密码已修改,其它设备上的登录已失效')
onClose()
} catch {
Toast.error('网络错误,请稍后重试')
} finally {
setSaving(false)
}
}
return (
<Modal
title="修改密码"
visible={visible}
onOk={submit}
onCancel={onClose}
okText="保存"
confirmLoading={saving}
style={{ width: 'min(440px, 92vw)' }}
closeOnEsc
>
<Form<Values> getFormApi={(formApi) => (api.current = formApi)} labelPosition="top">
<Form.Input
field="old_password"
label="当前密码"
mode="password"
autoComplete="current-password"
rules={[{ required: true, message: '请输入当前密码' }]}
/>
<Form.Input
field="new_password"
label="新密码"
mode="password"
autoComplete="new-password"
rules={[
{ required: true, message: '请输入新密码' },
{
validator: (_rule: unknown, value: string) =>
new TextEncoder().encode(value ?? '').length >= MIN_PASSWORD_LENGTH,
message: `至少 ${MIN_PASSWORD_LENGTH} 个字符`,
},
]}
/>
<Form.Input
field="confirm"
label="确认新密码"
mode="password"
autoComplete="new-password"
rules={[
{ required: true, message: '请再次输入新密码' },
{
validator: (_rule: unknown, value: string) =>
value === api.current?.getValue('new_password'),
message: '两次输入不一致',
},
]}
/>
</Form>
<Typography.Text type="tertiary" size="small">
保存后当前浏览器保持登录,其它设备需要用新密码重新登录。
</Typography.Text>
</Modal>
)
}