release: 1.1.0

web-next/src/services/api.ts

@@ -0,0 +1,144 @@
+import type { ApiErrorBody } from "../types/auth";
+
+export const AUTH_EXPIRED_EVENT = "tallynote-auth-expired";
+const UNSAFE_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const AUTH_EXEMPT_PATHS = new Set([
+  "/api/auth/login",
+  "/api/auth/session",
+]);
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+const UPLOAD_REQUEST_TIMEOUT_MS = 120_000;
+
+export interface ApiRequestInit extends RequestInit {
+  timeoutMs?: number;
+}
+
+export class ApiError extends Error {
+  readonly status: number;
+  readonly code?: string;
+  readonly details?: unknown;
+  readonly requestId?: string;
+  readonly retryAfter?: number;
+
+  constructor(status: number, message: string, code?: string, details?: unknown, requestId?: string, retryAfter?: number) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.requestId = requestId;
+    this.retryAfter = retryAfter;
+  }
+}
+
+function readCookie(name: string): string {
+  if (typeof document === "undefined") return "";
+  const prefix = `${name}=`;
+  const value = document.cookie.split(";").map((part) => part.trim()).find((part) => part.startsWith(prefix));
+  if (!value) return "";
+  const raw = value.slice(prefix.length);
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+
+function requestPath(url: string): string {
+  try {
+    return new URL(url, typeof window === "undefined" ? "http://localhost" : window.location.origin).pathname;
+  } catch {
+    return url.split("?", 1)[0] ?? url;
+  }
+}
+
+function emitAuthExpired(message: string): void {
+  if (typeof window !== "undefined") {
+    window.dispatchEvent(new CustomEvent(AUTH_EXPIRED_EVENT, { detail: message }));
+  }
+}
+
+export async function api<T = unknown>(url: string, init: ApiRequestInit = {}): Promise<T> {
+  const { timeoutMs: requestedTimeout, signal: externalSignal, ...requestInit } = init;
+  const method = (init.method ?? "GET").toUpperCase();
+  const headers = new Headers(init.headers);
+  if (init.body && !(init.body instanceof FormData) && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json");
+  }
+  if (UNSAFE_METHODS.has(method)) {
+    const csrf = readCookie("tally_csrf");
+    if (csrf) headers.set("X-CSRF-Token", csrf);
+  }
+
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeoutMs = requestedTimeout ?? (init.body instanceof FormData ? UPLOAD_REQUEST_TIMEOUT_MS : DEFAULT_REQUEST_TIMEOUT_MS);
+  const abortFromCaller = () => controller.abort(externalSignal?.reason);
+  if (externalSignal?.aborted) abortFromCaller();
+  else externalSignal?.addEventListener("abort", abortFromCaller, { once: true });
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+
+  try {
+    const response = await fetch(url, { ...requestInit, credentials: "include", headers, signal: controller.signal });
+    if (response.status === 204) return undefined as T;
+    const contentType = response.headers.get("content-type") ?? "";
+    const data: unknown = contentType.includes("json")
+      ? await response.json().catch(() => ({}))
+      : await response.text().catch(() => "");
+    if (!response.ok) {
+      const body = (data && typeof data === "object" ? data : {}) as ApiErrorBody;
+      const error = body.error;
+      if (response.status === 401 && error?.code === "AUTH_REQUIRED" && !AUTH_EXEMPT_PATHS.has(requestPath(url))) {
+        emitAuthExpired(error.message || "登录已失效，请重新登录");
+      }
+      throw new ApiError(
+        response.status,
+        error?.message || `请求失败（${response.status}）`,
+        error?.code,
+        error?.details,
+        error?.requestId,
+        Number(response.headers.get("retry-after") || 0) || undefined,
+      );
+    }
+    return data as T;
+  } catch (caught) {
+    if (caught instanceof ApiError) throw caught;
+    if (timedOut) throw new ApiError(408, "请求超时，请稍后重试", "REQUEST_TIMEOUT");
+    if (externalSignal?.aborted) throw new ApiError(0, "请求已取消", "REQUEST_CANCELED");
+    throw new ApiError(0, "网络连接失败，请确认服务仍在运行");
+  } finally {
+    clearTimeout(timeout);
+    externalSignal?.removeEventListener("abort", abortFromCaller);
+  }
+}
+
+export const apiGet = <T>(url: string, init?: ApiRequestInit) => api<T>(url, { ...init, method: "GET" });
+export const apiPost = <T>(url: string, body?: unknown, init: ApiRequestInit = {}) => api<T>(url, {
+  ...init,
+  method: "POST",
+  body: body === undefined ? init.body : body instanceof FormData ? body : JSON.stringify(body),
+});
+
+export const apiPut = <T>(url: string, body?: unknown, init: ApiRequestInit = {}) => api<T>(url, {
+  ...init,
+  method: "PUT",
+  body: body === undefined ? init.body : body instanceof FormData ? body : JSON.stringify(body),
+});
+
+export const apiPatch = <T>(url: string, body?: unknown, init: ApiRequestInit = {}) => api<T>(url, {
+  ...init,
+  method: "PATCH",
+  body: body === undefined ? init.body : body instanceof FormData ? body : JSON.stringify(body),
+});
+
+export const apiDelete = <T>(url: string, body?: unknown, init: ApiRequestInit = {}) => api<T>(url, {
+  ...init,
+  method: "DELETE",
+  body: body === undefined ? init.body : body instanceof FormData ? body : JSON.stringify(body),
+});
+
+export const fetchApi = api;
+export const request = api;

web-next/src/services/auth.ts

@@ -0,0 +1,27 @@
+import { api, apiGet, apiPost } from "./api";
+import type { Admin, AuthResponse, AuthStatus, ChangePasswordInput, LoginCredentials } from "../types/auth";
+
+export function getAuthStatus(): Promise<AuthStatus> {
+  return apiGet<AuthStatus>("/api/auth/status");
+}
+
+export function getSession(): Promise<AuthResponse> {
+  return apiGet<AuthResponse>("/api/auth/session");
+}
+
+export function login(credentials: LoginCredentials): Promise<AuthResponse> {
+  return apiPost<AuthResponse>("/api/auth/login", credentials);
+}
+
+export function logout(): Promise<void> {
+  return apiPost<void>("/api/auth/logout");
+}
+
+export function changePassword(input: ChangePasswordInput): Promise<AuthResponse> {
+  return apiPost<AuthResponse>("/api/auth/change-password", input);
+}
+
+export type { Admin, AuthResponse, AuthStatus, ChangePasswordInput, LoginCredentials };
+
+// Keep a typed escape hatch for future authenticated services without exposing fetch details.
+export { api };

web-next/src/services/formErrors.ts

@@ -0,0 +1,13 @@
+import { ApiError } from "./api";
+
+type ValidationIssue = { path?: Array<string | number>; message?: string };
+
+export function apiFieldErrors(caught: unknown): Record<string, string> {
+  if (!(caught instanceof ApiError) || !Array.isArray(caught.details)) return {};
+  const errors: Record<string, string> = {};
+  for (const issue of caught.details as ValidationIssue[]) {
+    const field = issue.path?.[0];
+    if (typeof field === "string" && issue.message && !errors[field]) errors[field] = issue.message;
+  }
+  return errors;
+}

web-next/src/services/index.ts

@@ -0,0 +1,2 @@
+export * from "./api";
+export * from "./auth";