fix: 修复 ip 地址登录系统报错，ts 方法兼容旧版本浏览器

2026-06-24 16:58:49 +08:00
parent 7cf6c31da3
commit 1a91e16ac9
8 changed files with 393 additions and 129 deletions
--- a/easyflow-ui-usercenter/app/src/utils/credential-encryption.ts
+++ b/easyflow-ui-usercenter/app/src/utils/credential-encryption.ts
@@ -28,9 +28,106 @@ interface TransitionPayload {
  oldKeyId: string;
 }

+interface EncryptedCredentialEnvelope {
+  ciphertext: string;
+  encryptedKey: string;
+  iv: string;
+  keyId: string;
+  nonce: string;
+}
+
+interface CredentialCryptoEngine {
+  encryptPayload(
+    material: CredentialKeyMaterial,
+    plaintext: string,
+  ): Promise<EncryptedCredentialEnvelope>;
+  verifyTransition(
+    publicKeyPem: string,
+    transition: CredentialKeyTransition,
+  ): Promise<boolean>;
+}
+
 const PIN_STORAGE_KEY = 'easyflow:credential-key-pin:v1';
 const SECURITY_ERROR = '登录安全校验失败，请刷新或联系管理员';
-const UNSUPPORTED_ERROR = '当前浏览器不支持登录安全加密，请升级浏览器';
+let forgeModulePromise: Promise<any> | null = null;
+
+const webCryptoEngine: CredentialCryptoEngine = {
+  async encryptPayload(material, plaintext) {
+    const aesKey = await window.crypto.subtle.generateKey(
+      { length: 256, name: 'AES-GCM' },
+      true,
+      ['encrypt'],
+    );
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await window.crypto.subtle.encrypt(
+      { iv, name: 'AES-GCM' },
+      aesKey,
+      stringToUtf8Bytes(plaintext),
+    );
+    const rawAesKey = await window.crypto.subtle.exportKey('raw', aesKey);
+    const publicKey = await importRsaPublicKey(material.publicKey, ['encrypt']);
+    const encryptedKey = await window.crypto.subtle.encrypt(
+      { name: 'RSA-OAEP' },
+      publicKey,
+      rawAesKey,
+    );
+    return {
+      ciphertext: bytesToBase64(new Uint8Array(ciphertext)),
+      encryptedKey: bytesToBase64(new Uint8Array(encryptedKey)),
+      iv: bytesToBase64(iv),
+      keyId: material.keyId,
+      nonce: material.nonce,
+    };
+  },
+
+  async verifyTransition(publicKeyPem, transition) {
+    const publicKey = await importSignPublicKey(publicKeyPem);
+    return window.crypto.subtle.verify(
+      { name: 'RSASSA-PKCS1-v1_5' },
+      publicKey,
+      base64ToBytes(transition.signature),
+      stringToUtf8Bytes(transition.payload),
+    );
+  },
+};
+
+const forgeCryptoEngine: CredentialCryptoEngine = {
+  async encryptPayload(material, plaintext) {
+    const forge = await loadForge();
+    const aesKey = forge.random.getBytesSync(32);
+    const iv = forge.random.getBytesSync(12);
+    const cipher = forge.cipher.createCipher('AES-GCM', aesKey);
+    cipher.start({ iv, tagLength: 128 });
+    cipher.update(forge.util.createBuffer(plaintext, 'utf8'));
+    cipher.finish();
+    const ciphertextWithTag = cipher.output.getBytes() + cipher.mode.tag.getBytes();
+    const publicKey = forge.pki.publicKeyFromPem(material.publicKey);
+    const encryptedKey = publicKey.encrypt(aesKey, 'RSA-OAEP', {
+      md: forge.md.sha256.create(),
+      mgf1: {
+        md: forge.md.sha256.create(),
+      },
+    });
+    return {
+      ciphertext: binaryToBase64(ciphertextWithTag),
+      encryptedKey: binaryToBase64(encryptedKey),
+      iv: binaryToBase64(iv),
+      keyId: material.keyId,
+      nonce: material.nonce,
+    };
+  },
+
+  async verifyTransition(publicKeyPem, transition) {
+    const forge = await loadForge();
+    const publicKey = forge.pki.publicKeyFromPem(publicKeyPem);
+    const md = forge.md.sha256.create();
+    md.update(transition.payload, 'utf8');
+    return publicKey.verify(
+      md.digest().bytes(),
+      forge.util.decode64(transition.signature),
+    );
+  },
+};

 /**
 * 加密密码类请求载荷。
@@ -42,44 +139,44 @@ export async function encryptCredentialPayload(
  loadMaterial: () => Promise<CredentialKeyMaterial>,
  payload: Record<string, any>,
 ) {
-  ensureWebCrypto();
  const material = await loadMaterial();
-  await verifyAndPersistPin(material);
-  const aesKey = await window.crypto.subtle.generateKey(
-    { length: 256, name: 'AES-GCM' },
-    true,
-    ['encrypt'],
-  );
-  const iv = window.crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(
-    JSON.stringify({
-      ...payload,
-      nonce: material.nonce,
-      timestamp: Date.now(),
-    }),
-  );
-  const ciphertext = await window.crypto.subtle.encrypt(
-    { iv, name: 'AES-GCM' },
-    aesKey,
-    plaintext,
-  );
-  const rawAesKey = await window.crypto.subtle.exportKey('raw', aesKey);
-  const publicKey = await importRsaPublicKey(material.publicKey, ['encrypt']);
-  const encryptedKey = await window.crypto.subtle.encrypt(
-    { name: 'RSA-OAEP' },
-    publicKey,
-    rawAesKey,
-  );
-  return {
-    ciphertext: bytesToBase64(new Uint8Array(ciphertext)),
-    encryptedKey: bytesToBase64(new Uint8Array(encryptedKey)),
-    iv: bytesToBase64(iv),
-    keyId: material.keyId,
-    nonce: material.nonce,
-  };
+  const engine = getCredentialCryptoEngine();
+  try {
+    await verifyAndPersistPin(material, engine);
+    return await engine.encryptPayload(
+      material,
+      JSON.stringify({
+        ...payload,
+        nonce: material.nonce,
+        timestamp: Date.now(),
+      }),
+    );
+  } catch (error) {
+    if (error instanceof Error && error.message === SECURITY_ERROR) {
+      throw error;
+    }
+    throw new Error(SECURITY_ERROR);
+  }
 }

-async function verifyAndPersistPin(material: CredentialKeyMaterial) {
+function getCredentialCryptoEngine() {
+  return isWebCryptoAvailable() ? webCryptoEngine : forgeCryptoEngine;
+}
+
+function isWebCryptoAvailable() {
+  return Boolean(window.crypto?.subtle && window.crypto.getRandomValues);
+}
+
+async function loadForge() {
+  forgeModulePromise ||= import('node-forge');
+  const forgeModule = await forgeModulePromise;
+  return forgeModule.default || forgeModule;
+}
+
+async function verifyAndPersistPin(
+  material: CredentialKeyMaterial,
+  engine: CredentialCryptoEngine,
+) {
  const current = readPin();
  if (!current) {
    writePin(material);
@@ -89,7 +186,7 @@ async function verifyAndPersistPin(material: CredentialKeyMaterial) {
    writePin(material);
    return;
  }
-  const nextPin = await verifyTransitionChain(current, material);
+  const nextPin = await verifyTransitionChain(current, material, engine);
  if (!nextPin || nextPin.fingerprint !== material.fingerprint) {
    throw new Error(SECURITY_ERROR);
  }
@@ -99,6 +196,7 @@ async function verifyAndPersistPin(material: CredentialKeyMaterial) {
 async function verifyTransitionChain(
  current: CredentialKeyPin,
  material: CredentialKeyMaterial,
+  engine: CredentialCryptoEngine,
 ) {
  let cursor = { ...current };
  const transitions = material.transitions || [];
@@ -119,7 +217,7 @@ async function verifyTransitionChain(
    ) {
      return null;
    }
-    const verified = await verifyTransition(cursor.publicKey, transition);
+    const verified = await safeVerifyTransition(engine, cursor.publicKey, transition);
    if (!verified) {
      return null;
    }
@@ -132,21 +230,20 @@ async function verifyTransitionChain(
  return cursor;
 }

-async function verifyTransition(
-  publicKeyPem: string,
+async function safeVerifyTransition(
+  engine: CredentialCryptoEngine,
+  publicKey: string,
  transition: CredentialKeyTransition,
 ) {
-  const publicKey = await importSignPublicKey(publicKeyPem);
-  return window.crypto.subtle.verify(
-    { name: 'RSASSA-PKCS1-v1_5' },
-    publicKey,
-    base64ToBytes(transition.signature),
-    new TextEncoder().encode(transition.payload),
-  );
+  try {
+    return await engine.verifyTransition(publicKey, transition);
+  } catch {
+    return false;
+  }
 }

 function decodeTransitionPayload(payload: string): TransitionPayload {
-  const json = new TextDecoder().decode(base64UrlToBytes(payload));
+  const json = utf8BytesToString(base64UrlToBytes(payload));
  return JSON.parse(json) as TransitionPayload;
 }

@@ -170,12 +267,6 @@ async function importSignPublicKey(publicKeyPem: string) {
  );
 }

-function ensureWebCrypto() {
-  if (!window.crypto?.subtle || !window.crypto.getRandomValues) {
-    throw new Error(UNSUPPORTED_ERROR);
-  }
-}
-
 function readPin(): CredentialKeyPin | null {
  const raw = window.localStorage.getItem(PIN_STORAGE_KEY);
  if (!raw) {
@@ -209,7 +300,14 @@ function pemToBytes(pem: string) {
 }

 function base64ToBytes(value: string) {
-  const binary = window.atob(value);
+  return binaryToBytes(base64ToBinary(value));
+}
+
+function base64ToBinary(value: string) {
+  return window.atob(value);
+}
+
+function binaryToBytes(binary: string) {
  const bytes = new Uint8Array(binary.length);
  for (let index = 0; index < binary.length; index += 1) {
    bytes[index] = binary.charCodeAt(index);
@@ -219,16 +317,35 @@ function base64ToBytes(value: string) {

 function base64UrlToBytes(value: string) {
  const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
-  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');
+  let padded = normalized;
+  while (padded.length % 4 !== 0) {
+    padded += '=';
+  }
  return base64ToBytes(padded);
 }

 function bytesToBase64(bytes: Uint8Array) {
+  return binaryToBase64(bytesToBinary(bytes));
+}
+
+function bytesToBinary(bytes: Uint8Array) {
  let binary = '';
-  bytes.forEach((item) => {
-    binary += String.fromCharCode(item);
-  });
+  for (let index = 0; index < bytes.length; index += 1) {
+    binary += String.fromCharCode(bytes[index] ?? 0);
+  }
+  return binary;
+}
+
+function binaryToBase64(binary: string) {
  return window.btoa(binary);
 }

+function stringToUtf8Bytes(value: string) {
+  return new TextEncoder().encode(value);
+}
+
+function utf8BytesToString(bytes: Uint8Array) {
+  return new TextDecoder().decode(bytes);
+}
+
 export type { CredentialKeyMaterial };