fix: 修复 ip 地址登录系统报错，ts 方法兼容旧版本浏览器

easyflow-ui-admin/app/package.json

@@ -39,6 +39,7 @@
     "fetch-event-stream": "^0.1.6",
     "highlight.js": "^11.11.1",
     "markdown-it": "^14.1.0",
+    "node-forge": "1.3.1",
     "pinia": "catalog:",
     "radash": "^12.1.1",
     "vue": "catalog:",
@@ -48,6 +49,7 @@
     "vue3-json-viewer": "^2.4.1"
   },
   "devDependencies": {
+    "@types/node-forge": "^1.3.14",
     "cssnano": "catalog:",
     "unplugin-element-plus": "catalog:"
   }

easyflow-ui-admin/app/src/utils/credential-encryption.ts

@@ -28,9 +28,106 @@ interface TransitionPayload {
   oldKeyId: string;
 }
 
+interface EncryptedCredentialEnvelope {
+  ciphertext: string;
+  encryptedKey: string;
+  iv: string;
+  keyId: string;
+  nonce: string;
+}
+
+interface CredentialCryptoEngine {
+  encryptPayload(
+    material: CredentialKeyMaterial,
+    plaintext: string,
+  ): Promise<EncryptedCredentialEnvelope>;
+  verifyTransition(
+    publicKeyPem: string,
+    transition: CredentialKeyTransition,
+  ): Promise<boolean>;
+}
+
 const PIN_STORAGE_KEY = 'easyflow:credential-key-pin:v1';
 const SECURITY_ERROR = '登录安全校验失败，请刷新或联系管理员';
-const UNSUPPORTED_ERROR = '当前浏览器不支持登录安全加密，请升级浏览器';
+let forgeModulePromise: Promise<any> | null = null;
+
+const webCryptoEngine: CredentialCryptoEngine = {
+  async encryptPayload(material, plaintext) {
+    const aesKey = await window.crypto.subtle.generateKey(
+      { length: 256, name: 'AES-GCM' },
+      true,
+      ['encrypt'],
+    );
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await window.crypto.subtle.encrypt(
+      { iv, name: 'AES-GCM' },
+      aesKey,
+      stringToUtf8Bytes(plaintext),
+    );
+    const rawAesKey = await window.crypto.subtle.exportKey('raw', aesKey);
+    const publicKey = await importRsaPublicKey(material.publicKey, ['encrypt']);
+    const encryptedKey = await window.crypto.subtle.encrypt(
+      { name: 'RSA-OAEP' },
+      publicKey,
+      rawAesKey,
+    );
+    return {
+      ciphertext: bytesToBase64(new Uint8Array(ciphertext)),
+      encryptedKey: bytesToBase64(new Uint8Array(encryptedKey)),
+      iv: bytesToBase64(iv),
+      keyId: material.keyId,
+      nonce: material.nonce,
+    };
+  },
+
+  async verifyTransition(publicKeyPem, transition) {
+    const publicKey = await importSignPublicKey(publicKeyPem);
+    return window.crypto.subtle.verify(
+      { name: 'RSASSA-PKCS1-v1_5' },
+      publicKey,
+      base64ToBytes(transition.signature),
+      stringToUtf8Bytes(transition.payload),
+    );
+  },
+};
+
+const forgeCryptoEngine: CredentialCryptoEngine = {
+  async encryptPayload(material, plaintext) {
+    const forge = await loadForge();
+    const aesKey = forge.random.getBytesSync(32);
+    const iv = forge.random.getBytesSync(12);
+    const cipher = forge.cipher.createCipher('AES-GCM', aesKey);
+    cipher.start({ iv, tagLength: 128 });
+    cipher.update(forge.util.createBuffer(plaintext, 'utf8'));
+    cipher.finish();
+    const ciphertextWithTag = cipher.output.getBytes() + cipher.mode.tag.getBytes();
+    const publicKey = forge.pki.publicKeyFromPem(material.publicKey);
+    const encryptedKey = publicKey.encrypt(aesKey, 'RSA-OAEP', {
+      md: forge.md.sha256.create(),
+      mgf1: {
+        md: forge.md.sha256.create(),
+      },
+    });
+    return {
+      ciphertext: binaryToBase64(ciphertextWithTag),
+      encryptedKey: binaryToBase64(encryptedKey),
+      iv: binaryToBase64(iv),
+      keyId: material.keyId,
+      nonce: material.nonce,
+    };
+  },
+
+  async verifyTransition(publicKeyPem, transition) {
+    const forge = await loadForge();
+    const publicKey = forge.pki.publicKeyFromPem(publicKeyPem);
+    const md = forge.md.sha256.create();
+    md.update(transition.payload, 'utf8');
+    return publicKey.verify(
+      md.digest().bytes(),
+      forge.util.decode64(transition.signature),
+    );
+  },
+};
 
 /**
  * 加密密码类请求载荷。
@@ -42,44 +139,44 @@ export async function encryptCredentialPayload(
   loadMaterial: () => Promise<CredentialKeyMaterial>,
   payload: Record<string, any>,
 ) {
-  ensureWebCrypto();
   const material = await loadMaterial();
-  await verifyAndPersistPin(material);
-  const aesKey = await window.crypto.subtle.generateKey(
-    { length: 256, name: 'AES-GCM' },
-    true,
-    ['encrypt'],
-  );
-  const iv = window.crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(
-    JSON.stringify({
-      ...payload,
-      nonce: material.nonce,
-      timestamp: Date.now(),
-    }),
-  );
-  const ciphertext = await window.crypto.subtle.encrypt(
-    { iv, name: 'AES-GCM' },
-    aesKey,
-    plaintext,
-  );
-  const rawAesKey = await window.crypto.subtle.exportKey('raw', aesKey);
-  const publicKey = await importRsaPublicKey(material.publicKey, ['encrypt']);
-  const encryptedKey = await window.crypto.subtle.encrypt(
-    { name: 'RSA-OAEP' },
-    publicKey,
-    rawAesKey,
-  );
-  return {
-    ciphertext: bytesToBase64(new Uint8Array(ciphertext)),
-    encryptedKey: bytesToBase64(new Uint8Array(encryptedKey)),
-    iv: bytesToBase64(iv),
-    keyId: material.keyId,
-    nonce: material.nonce,
-  };
+  const engine = getCredentialCryptoEngine();
+  try {
+    await verifyAndPersistPin(material, engine);
+    return await engine.encryptPayload(
+      material,
+      JSON.stringify({
+        ...payload,
+        nonce: material.nonce,
+        timestamp: Date.now(),
+      }),
+    );
+  } catch (error) {
+    if (error instanceof Error && error.message === SECURITY_ERROR) {
+      throw error;
+    }
+    throw new Error(SECURITY_ERROR);
+  }
 }
 
-async function verifyAndPersistPin(material: CredentialKeyMaterial) {
+function getCredentialCryptoEngine() {
+  return isWebCryptoAvailable() ? webCryptoEngine : forgeCryptoEngine;
+}
+
+function isWebCryptoAvailable() {
+  return Boolean(window.crypto?.subtle && window.crypto.getRandomValues);
+}
+
+async function loadForge() {
+  forgeModulePromise ||= import('node-forge');
+  const forgeModule = await forgeModulePromise;
+  return forgeModule.default || forgeModule;
+}
+
+async function verifyAndPersistPin(
+  material: CredentialKeyMaterial,
+  engine: CredentialCryptoEngine,
+) {
   const current = readPin();
   if (!current) {
     writePin(material);
@@ -89,7 +186,7 @@ async function verifyAndPersistPin(material: CredentialKeyMaterial) {
     writePin(material);
     return;
   }
-  const nextPin = await verifyTransitionChain(current, material);
+  const nextPin = await verifyTransitionChain(current, material, engine);
   if (!nextPin || nextPin.fingerprint !== material.fingerprint) {
     throw new Error(SECURITY_ERROR);
   }
@@ -99,6 +196,7 @@ async function verifyAndPersistPin(material: CredentialKeyMaterial) {
 async function verifyTransitionChain(
   current: CredentialKeyPin,
   material: CredentialKeyMaterial,
+  engine: CredentialCryptoEngine,
 ) {
   let cursor = { ...current };
   const transitions = material.transitions || [];
@@ -119,7 +217,7 @@ async function verifyTransitionChain(
     ) {
       return null;
     }
-    const verified = await verifyTransition(cursor.publicKey, transition);
+    const verified = await safeVerifyTransition(engine, cursor.publicKey, transition);
     if (!verified) {
       return null;
     }
@@ -132,21 +230,20 @@ async function verifyTransitionChain(
   return cursor;
 }
 
-async function verifyTransition(
-  publicKeyPem: string,
+async function safeVerifyTransition(
+  engine: CredentialCryptoEngine,
+  publicKey: string,
   transition: CredentialKeyTransition,
 ) {
-  const publicKey = await importSignPublicKey(publicKeyPem);
-  return window.crypto.subtle.verify(
-    { name: 'RSASSA-PKCS1-v1_5' },
-    publicKey,
-    base64ToBytes(transition.signature),
-    new TextEncoder().encode(transition.payload),
-  );
+  try {
+    return await engine.verifyTransition(publicKey, transition);
+  } catch {
+    return false;
+  }
 }
 
 function decodeTransitionPayload(payload: string): TransitionPayload {
-  const json = new TextDecoder().decode(base64UrlToBytes(payload));
+  const json = utf8BytesToString(base64UrlToBytes(payload));
   return JSON.parse(json) as TransitionPayload;
 }
 
@@ -170,12 +267,6 @@ async function importSignPublicKey(publicKeyPem: string) {
   );
 }
 
-function ensureWebCrypto() {
-  if (!window.crypto?.subtle || !window.crypto.getRandomValues) {
-    throw new Error(UNSUPPORTED_ERROR);
-  }
-}
-
 function readPin(): CredentialKeyPin | null {
   const raw = window.localStorage.getItem(PIN_STORAGE_KEY);
   if (!raw) {
@@ -209,7 +300,14 @@ function pemToBytes(pem: string) {
 }
 
 function base64ToBytes(value: string) {
-  const binary = window.atob(value);
+  return binaryToBytes(base64ToBinary(value));
+}
+
+function base64ToBinary(value: string) {
+  return window.atob(value);
+}
+
+function binaryToBytes(binary: string) {
   const bytes = new Uint8Array(binary.length);
   for (let index = 0; index < binary.length; index += 1) {
     bytes[index] = binary.charCodeAt(index);
@@ -219,16 +317,35 @@ function base64ToBytes(value: string) {
 
 function base64UrlToBytes(value: string) {
   const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
-  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');
+  let padded = normalized;
+  while (padded.length % 4 !== 0) {
+    padded += '=';
+  }
   return base64ToBytes(padded);
 }
 
 function bytesToBase64(bytes: Uint8Array) {
+  return binaryToBase64(bytesToBinary(bytes));
+}
+
+function bytesToBinary(bytes: Uint8Array) {
   let binary = '';
-  bytes.forEach((item) => {
-    binary += String.fromCharCode(item);
-  });
+  for (let index = 0; index < bytes.length; index += 1) {
+    binary += String.fromCharCode(bytes[index] ?? 0);
+  }
+  return binary;
+}
+
+function binaryToBase64(binary: string) {
   return window.btoa(binary);
 }
 
+function stringToUtf8Bytes(value: string) {
+  return new TextEncoder().encode(value);
+}
+
+function utf8BytesToString(bytes: Uint8Array) {
+  return new TextDecoder().decode(bytes);
+}
+
 export type { CredentialKeyMaterial };

easyflow-ui-admin/app/src/views/ai/agents/composables/useAgentTryoutRawRounds.ts

@@ -258,7 +258,7 @@ function selectedVariant(round: AgentTryoutRawRound) {
   return (
     round.variants.find(
       (variant) => variant.variantIndex === round.selectedVariantIndex,
-    ) || round.variants.at(-1)
+    ) || round.variants[round.variants.length - 1]
   );
 }
 

easyflow-ui-admin/app/src/views/ai/resource/ResourceModal.vue

@@ -1,18 +1,17 @@
 <script setup lang="ts">
-import type { FormInstance } from 'element-plus';
+import type {FormInstance} from 'element-plus';
+import {ElForm, ElFormItem, ElInput, ElMessage} from 'element-plus';
 
-import { onMounted, ref } from 'vue';
+import {onMounted, ref} from 'vue';
 
-import { EasyFlowFormModal } from '@easyflow/common-ui';
-import { getResourceType } from '@easyflow/utils';
+import {EasyFlowFormModal} from '@easyflow/common-ui';
+import {getResourceType} from '@easyflow/utils';
 
-import { ElForm, ElFormItem, ElInput, ElMessage } from 'element-plus';
-
-import { api } from '#/api/request';
+import {api} from '#/api/request';
 import DictSelect from '#/components/dict/DictSelect.vue';
 import Upload from '#/components/upload/Upload.vue';
-import { $t } from '#/locales';
-import { syncProgrammaticFieldValidation } from '#/utils/form-validation';
+import {$t} from '#/locales';
+import {syncProgrammaticFieldValidation} from '#/utils/form-validation';
 
 const emit = defineEmits(['reload']);
 // vue
@@ -99,7 +98,7 @@ function closeDialog() {
 function beforeUpload(f: any) {
   const fileName = f?.name || '';
   const fileNameParts = fileName.split('.');
-  const fExt = fileNameParts.length > 1 ? fileNameParts.at(-1) || '' : '';
+  const fExt = fileNameParts.length > 1 ? fileNameParts[fileNameParts.length - 1] || '' : '';
   const fName =
     fileNameParts.length > 1 ? fileNameParts.slice(0, -1).join('.') : fileName;
   entity.value.resourceType = getResourceType(fExt);