From 7ed1e2603bc22187ad7569aafbfd8f9462c6ad47 Mon Sep 17 00:00:00 2001
From: "zhaowei.huang" <228127304@qq.com>
Date: Mon, 8 Jun 2026 18:17:42 +0800
Subject: [PATCH] fix(platform): harden auth and build integration

---
 .../src/composables/useProjectionStream.ts             |  4 +++-
 frontends/apps/simple-platform-vue/src/stores/auth.ts  |  6 +++++-
 frontends/apps/simple-platform-vue/vite.config.ts      | 10 +++++++---
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/frontends/apps/simple-platform-vue/src/composables/useProjectionStream.ts b/frontends/apps/simple-platform-vue/src/composables/useProjectionStream.ts
index b1e9f5a..813b57b 100644
--- a/frontends/apps/simple-platform-vue/src/composables/useProjectionStream.ts
+++ b/frontends/apps/simple-platform-vue/src/composables/useProjectionStream.ts
@@ -99,7 +99,9 @@ export function useProjectionStream(opts: ProjectionStreamOptions = {}) {
 
     if (es) return
     try {
-      es = new EventSource(url)
+      // withCredentials：让浏览器把 httpOnly 鉴权 Cookie (simple.auth.token) 随 SSE 一起带上，
+      // 配合后端给 /api/sl/* 反代加的鉴权（EventSource 无法设置 Authorization header，只能靠 Cookie）。
+      es = new EventSource(url, { withCredentials: true })
     } catch {
       scheduleReconnect()
       return
diff --git a/frontends/apps/simple-platform-vue/src/stores/auth.ts b/frontends/apps/simple-platform-vue/src/stores/auth.ts
index d78feb8..f2bb522 100644
--- a/frontends/apps/simple-platform-vue/src/stores/auth.ts
+++ b/frontends/apps/simple-platform-vue/src/stores/auth.ts
@@ -89,7 +89,11 @@ export const useAuthStore = defineStore('auth', {
       (s) =>
       (widgetId: string): 'hidden' | 'readonly' | 'interactive' => {
         const grant = s.effectivePermissions?.visibleWidgets.find((w) => w.widgetId === widgetId)
-        return grant?.visibility ?? 'interactive'
+        if (grant) return grant.visibility
+        // fail-safe：未显式授权的控件不再默认放开为 interactive（曾导致受限账号越权）。
+        // 超级管理员（allowedOps 含 '*'）默认 interactive；其余账号默认 readonly（可见不可改）。
+        const ops = s.effectivePermissions?.allowedOps ?? []
+        return ops.includes('*') ? 'interactive' : 'readonly'
       },
     /**
      * 当前用户在当前 scope 下是否可访问指定页面（route.name）。
diff --git a/frontends/apps/simple-platform-vue/vite.config.ts b/frontends/apps/simple-platform-vue/vite.config.ts
index c4748bc..4ce20f6 100644
--- a/frontends/apps/simple-platform-vue/vite.config.ts
+++ b/frontends/apps/simple-platform-vue/vite.config.ts
@@ -5,12 +5,16 @@ import Components from 'unplugin-vue-components/vite'
 import { ElementPlusResolver } from 'unplugin-vue-components/resolvers'
 import { fileURLToPath, URL } from 'node:url'
 
-export default defineConfig({
+export default defineConfig(({ command }) => ({
   base: '/',
   plugins: [
     vue(),
     AutoImport({ resolvers: [ElementPlusResolver()] }),
-    Components({ resolvers: [ElementPlusResolver()] })
+    // 生产构建时跳过 components.d.ts 生成，避免 Windows 下并发写文件触发 UNKNOWN 错误。
+    Components({
+      resolvers: [ElementPlusResolver()],
+      dts: command === 'serve'
+    })
   ],
   resolve: {
     alias: {
@@ -33,4 +37,4 @@ export default defineConfig({
     sourcemap: false,
     chunkSizeWarningLimit: 1500
   }
-})
+}))