JPEG / PNG，最多 2 MiB；宽高不超过 4096 像素，总像素不超过 1600 万。不支持动画图片。
+ + +正在读取图片…
+
+
+ 拖动圆形预览调整位置，或聚焦预览后使用方向键移动。
+ +本网站每个账号的有效登录上限为 {{ maxActiveSessions }} 个会话，当前 {{ total }} / {{ maxActiveSessions }}。达到上限时会拒绝新的登录；已存在的超额会话保留，可主动退出或等待过期。
+数据截至 {{ dateTime(lastUpdated) }}（UTC+8）
+ +当前登录
{{ clientText(current) }}
服务端未返回当前会话，请刷新确认。
其他有效登录
{{ administrator ? '暂无有效登录' : '暂无其他有效登录' }}
+登录 IP 和客户端来自登录时记录，UA 可被伪造。日期均为 UTC+8；剩余时间按服务端时间计算。
+ +
-
+
修改初始密码 个人中心 邀请朋友
退出
@@ -20,9 +20,10 @@
+
diff --git a/front_vue/src/components/UserIdentity.vue b/front_vue/src/components/UserIdentity.vue
new file mode 100644
index 0000000..21ca35e
--- /dev/null
+++ b/front_vue/src/components/UserIdentity.vue
@@ -0,0 +1,25 @@
+
+
+
+ {{ identity.name }}{{ user?.user_name ? '@' + user.user_name : '' }}{{ identifier ? ' / ID ' + identifier : '' }}
+
+
+
+
diff --git a/front_vue/src/router/index.js b/front_vue/src/router/index.js
index 790c36c..e584a74 100644
--- a/front_vue/src/router/index.js
+++ b/front_vue/src/router/index.js
@@ -15,6 +15,7 @@ const routes = [
{path: '/register', name: 'Register', component: () => import('@/views/Register.vue'), meta: {title: '受邀注册'}},
{path: '/account', name: 'Account', component: () => import('@/views/Account.vue'), meta: {title: '个人中心', requireAuth: true}},
{path: '/account/security', name: 'AccountSecurity', component: () => import('@/views/Account.vue'), meta: {title: '账户安全', requireAuth: true}},
+ {path: '/account/sessions', name: 'AccountSessions', component: () => import('@/views/Account.vue'), meta: {title: '登录管理', requireAuth: true}},
{path: '/invitations', name: 'Invitations', component: () => import('@/views/Invitations.vue'), meta: {title: '邀请朋友', requireAuth: true}},
{path: '/forbidden', name: 'Forbidden', component: () => import('@/views/AccessState.vue'), meta: {title: '功能未开通'}},
{path: '/unavailable', name: 'Unavailable', component: () => import('@/views/AccessState.vue'), meta: {title: '服务暂不可用'}},
diff --git a/front_vue/src/store/index.js b/front_vue/src/store/index.js
index a0cb75b..e127fa7 100644
--- a/front_vue/src/store/index.js
+++ b/front_vue/src/store/index.js
@@ -2,12 +2,14 @@ import {createStore} from 'vuex'
import {config} from '@/global'
const {accountsApi} = require('@/api/accounts.cjs')
const {configureBrowserSession} = require('@/api/browser_client.cjs')
+const {startAccountUpdates} = require('@/utils/account_updates.cjs')
// Remove browser credentials from the former login flow; identity is restored from the HttpOnly cookie.
for (const key of ['token', 'user_name']) localStorage.removeItem(key)
sessionStorage.removeItem('userInfo')
let pendingSession = null
let pendingSessionEpoch = -1
+let accountUpdates = null
const store = createStore({
state: {
@@ -42,6 +44,7 @@ const store = createStore({
},
getters: {getUser: state => state.userInfo},
actions: {
+ publishProfileUpdate() { if (accountUpdates) accountUpdates.publish() },
async refreshSession({commit, state}) {
if (!pendingSession || pendingSessionEpoch !== state.sessionEpoch) {
const epoch = state.sessionEpoch
@@ -50,8 +53,7 @@ const store = createStore({
return state.userInfo
}).catch(error => {
if (epoch !== state.sessionEpoch) return state.userInfo
- commit('REMOVE_INFO')
- if (error.status === 401) return null
+ if (error.status === 401) { commit('REMOVE_INFO'); return null }
throw error
}).finally(() => { if (pendingSession === request) pendingSession = null })
pendingSession = request
@@ -67,4 +69,5 @@ const store = createStore({
},
})
configureBrowserSession(() => store.state.userInfo && store.state.userInfo.csrf_token || '', () => { store.commit('REMOVE_INFO'); window.dispatchEvent(new Event('account-session-expired')) })
+if (typeof window !== 'undefined') accountUpdates = startAccountUpdates(window, () => store.dispatch('refreshSession'))
export default store
diff --git a/front_vue/src/utils/account_updates.cjs b/front_vue/src/utils/account_updates.cjs
new file mode 100644
index 0000000..a798757
--- /dev/null
+++ b/front_vue/src/utils/account_updates.cjs
@@ -0,0 +1,30 @@
+// 标签页只交换资料变化事件，身份与凭据必须通过各自 Cookie 从 /api/auth/me 重新读取。
+function startAccountUpdates(host, refresh) {
+ const key = 'home-server-profile-update'
+ let channel = null
+ const update = () => Promise.resolve(refresh()).catch(() => {})
+ const message = event => { if (event.data && event.data.type === 'profile-updated') update() }
+ const storage = event => { if (event.key === key && event.newValue) update() }
+ const visible = () => { if (host.document.visibilityState === 'visible') update() }
+ try {
+ if (host.BroadcastChannel) {
+ channel = new host.BroadcastChannel(key)
+ channel.addEventListener('message', message)
+ }
+ } catch (_) { /* 浏览器禁用消息通道时使用 storage 事件。 */ }
+ host.addEventListener('storage', storage)
+ host.document.addEventListener('visibilitychange', visible)
+ return {
+ publish() {
+ if (channel) channel.postMessage({type: 'profile-updated'})
+ else { try { host.localStorage.setItem(key, String(Date.now()) + ':' + Math.random()) } catch (_) { /* 隐私模式下仍保留当前标签页状态。 */ } }
+ },
+ dispose() {
+ host.removeEventListener('storage', storage)
+ host.document.removeEventListener('visibilitychange', visible)
+ if (channel) { channel.removeEventListener('message', message); channel.close() }
+ },
+ }
+}
+
+module.exports = {startAccountUpdates}
diff --git a/front_vue/src/utils/accounts_behavior.cjs b/front_vue/src/utils/accounts_behavior.cjs
index dc037ba..d2b1541 100644
--- a/front_vue/src/utils/accounts_behavior.cjs
+++ b/front_vue/src/utils/accounts_behavior.cjs
@@ -28,17 +28,129 @@ function passwordError(password, confirmation, minimum = 15) {
return ''
}
-function profilePayload(value) {
- return {display_name: value.display_name || '', contact_email: value.contact_email || '', contact_mobile: value.contact_mobile || ''}
+function profilePayload(value, before) {
+ const fields = {display_name: (value.display_name || '').trim(), contact_email: value.contact_email || '', contact_mobile: value.contact_mobile || ''}
+ if (before) {
+ const saved = profilePayload(before)
+ for (const key of Object.keys(fields)) if (fields[key] === saved[key]) delete fields[key]
+ }
+ return fields
}
function profileError(value) {
- if (!value.display_name.trim() || Array.from(value.display_name).length > 64) return '显示名称需要 1–64 个字符'
+ if (Array.from((value.display_name || '').trim()).length > 64) return '昵称不能超过 64 个字符'
if (value.contact_email && (value.contact_email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.contact_email))) return '请填写有效的联系邮箱'
if (value.contact_mobile && !/^[+0-9 -]{1,32}$/.test(value.contact_mobile)) return '请填写有效的联系电话'
return ''
}
+function userIdentity(value = {}) {
+ const clean = text => String(text || '').replace(/[\p{Cc}\p{Cf}]/gu, character => character === '\u200d' ? character : '').trim()
+ const name = clean(value.display_name) || clean(value.user_name) || (value.user_id || value.id ? '用户 ' + (value.user_id || value.id) : '用户')
+ const visible = clean(value.display_name) || clean(value.user_name)
+ let initial = Array.from(visible)[0] || ''
+ if (visible && typeof Intl.Segmenter === 'function') initial = new Intl.Segmenter('zh', {granularity: 'grapheme'}).segment(visible)[Symbol.iterator]().next().value.segment
+ const avatar = /^\/api\/account\/avatars\/[1-9][0-9]*\/[1-9][0-9]*$/.test(value.avatar_url || '') ? value.avatar_url : ''
+ return {name, initial: initial.toUpperCase(), avatar}
+}
+
+function preserveProfileDraft(draft, before, latest) {
+ const next = profilePayload(latest)
+ for (const key of Object.keys(profilePayload(draft, before))) next[key] = draft[key]
+ return next
+}
+
+function selectedSessionIDs(selected, items, current) {
+ const available = new Set(items.map(item => String(item.id)))
+ const currentID = current && String(current.id)
+ return [...new Set(selected.map(String))].filter(id => id !== currentID && available.has(id)).slice(0, 100)
+}
+
+function sessionRemaining(session, receivedAt, now) {
+ const seconds = Number(session.remaining_seconds)
+ if (!Number.isFinite(seconds)) return null
+ return Math.max(0, Math.ceil(seconds - Math.max(0, now - receivedAt) / 1000))
+}
+
+function remainingText(seconds) {
+ if (seconds == null) return '剩余时间未知'
+ if (seconds <= 0) return '已到期，等待刷新确认'
+ const days = Math.floor(seconds / 86400), hours = Math.floor(seconds % 86400 / 3600), minutes = Math.floor(seconds % 3600 / 60)
+ if (days) return `剩余 ${days} 天 ${hours} 小时`
+ if (hours) return `剩余 ${hours} 小时 ${minutes} 分钟`
+ return seconds < 60 ? '剩余不足 1 分钟' : `剩余 ${minutes} 分钟`
+}
+
+function avatarFileError(file) {
+ if (!file || !['image/jpeg', 'image/png'].includes(file.type)) return '头像只支持 JPEG 或 PNG 图片'
+ if (!file.size || file.size > 2 * 1024 * 1024) return '头像文件必须非空，且不能超过 2 MiB'
+ return ''
+}
+
+// 读取有界文件头，先拒绝像素炸弹和 APNG，再交给浏览器解码；实际图片仍由服务端独立校验。
+function avatarMetadata(input) {
+ const bytes = input instanceof Uint8Array ? input : new Uint8Array(input)
+ const data = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+ let width = 0, height = 0, orientation = 1, type = ''
+ if (bytes.length >= 33 && [137, 80, 78, 71, 13, 10, 26, 10].every((value, index) => bytes[index] === value)) {
+ type = 'image/png'
+ if (data.getUint32(8) !== 13 || String.fromCharCode(...bytes.slice(12, 16)) !== 'IHDR') throw new Error('PNG 文件头无效')
+ width = data.getUint32(16); height = data.getUint32(20)
+ for (let offset = 8; offset + 12 <= bytes.length;) {
+ const length = data.getUint32(offset), chunk = String.fromCharCode(...bytes.slice(offset + 4, offset + 8))
+ if (chunk === 'acTL') throw new Error('头像不支持动画 PNG')
+ if (length > bytes.length - offset - 12) throw new Error('PNG 图片内容不完整')
+ offset += length + 12
+ }
+ } else if (bytes.length > 4 && bytes[0] === 255 && bytes[1] === 216) {
+ type = 'image/jpeg'
+ for (let offset = 2; offset + 4 <= bytes.length;) {
+ if (bytes[offset] !== 255) throw new Error('JPEG 图片内容无效')
+ while (bytes[offset] === 255) offset++
+ const marker = bytes[offset++]
+ if (marker === 217 || marker === 218) break
+ if (marker === 1 || marker >= 208 && marker <= 215) continue
+ const length = data.getUint16(offset)
+ if (length < 2 || offset + length > bytes.length) throw new Error('JPEG 图片内容不完整')
+ if ([192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207].includes(marker) && length >= 8) {
+ height = data.getUint16(offset + 3); width = data.getUint16(offset + 5)
+ }
+ if (marker === 225) orientation = avatarOrientation(bytes, offset + 2, length - 2)
+ offset += length
+ }
+ }
+ if (!width || !height) throw new Error('无法识别 JPEG 或 PNG 图片尺寸')
+ if (width > 4096 || height > 4096) throw new Error('图片宽高均不能超过 4096 像素')
+ if (width * height > 16000000) throw new Error('图片总像素不能超过 1600 万')
+ return {width, height, orientation, type}
+}
+
+function avatarOrientation(bytes, start, length) {
+ if (length < 14 || String.fromCharCode(...bytes.slice(start, start + 6)) !== 'Exif\u0000\u0000') return 1
+ const data = new DataView(bytes.buffer, bytes.byteOffset + start + 6, length - 6)
+ const endian = data.getUint16(0), little = endian === 0x4949
+ if ((!little && endian !== 0x4d4d) || data.getUint16(2, little) !== 42) return 1
+ const directory = data.getUint32(4, little)
+ if (directory + 2 > data.byteLength) return 1
+ const count = data.getUint16(directory, little)
+ for (let index = 0; index < count; index++) {
+ const offset = directory + 2 + index * 12
+ if (offset + 12 > data.byteLength) break
+ if (data.getUint16(offset, little) === 0x112 && data.getUint16(offset + 2, little) === 3 && data.getUint32(offset + 4, little) === 1) {
+ const orientation = data.getUint16(offset + 8, little)
+ return orientation >= 1 && orientation <= 8 ? orientation : 1
+ }
+ }
+ return 1
+}
+
+function avatarCrop(width, height, zoom, offsetX, offsetY, stage = 280) {
+ const scale = stage / Math.min(width, height) * Math.max(1, Math.min(3, zoom))
+ const boundX = (width * scale - stage) / 2, boundY = (height * scale - stage) / 2
+ offsetX = Math.max(-boundX, Math.min(boundX, offsetX)) || 0; offsetY = Math.max(-boundY, Math.min(boundY, offsetY)) || 0
+ return {x: (boundX - offsetX) / scale, y: (boundY - offsetY) / scale, size: stage / scale, offsetX, offsetY, scale}
+}
+
function configValues(schema, draft) {
const values = {}
for (const field of schema.fields || []) {
@@ -82,4 +194,4 @@ function dateTime(value) {
return Number.isNaN(date.getTime()) ? '—' : date.toLocaleString('zh-CN', {timeZone: 'Asia/Singapore', hour12: false})
}
-module.exports = {routeDecision, passwordError, profilePayload, profileError, configValues, configChanges, clearOneTimeSecret, requestID, dateTime}
+module.exports = {routeDecision, passwordError, profilePayload, profileError, userIdentity, preserveProfileDraft, selectedSessionIDs, sessionRemaining, remainingText, avatarFileError, avatarMetadata, avatarCrop, configValues, configChanges, clearOneTimeSecret, requestID, dateTime}
diff --git a/front_vue/src/utils/web_projects_navigation.cjs b/front_vue/src/utils/web_projects_navigation.cjs
index cce34e2..9fa1f5d 100644
--- a/front_vue/src/utils/web_projects_navigation.cjs
+++ b/front_vue/src/utils/web_projects_navigation.cjs
@@ -41,7 +41,7 @@ function normalizeInternalRedirect(value, inheritedHash = '') {
return '/'
}
if (!PROJECT_PATH.test(parsed.pathname)
- && !['/account', '/account/security', '/invitations', '/book/list', '/book/add', '/book/info', '/scanCodePage', '/admin/users', '/admin/web-share', '/admin/config', '/admin/audit-logs'].includes(parsed.pathname)
+ && !['/account', '/account/security', '/account/sessions', '/invitations', '/book/list', '/book/add', '/book/info', '/scanCodePage', '/admin/users', '/admin/web-share', '/admin/config', '/admin/audit-logs'].includes(parsed.pathname)
&& parsed.pathname !== '/applications'
&& parsed.pathname !== '/web-share'
&& !parsed.pathname.startsWith('/web-share/')
diff --git a/front_vue/src/views/Account.vue b/front_vue/src/views/Account.vue
index 4b6c984..25adb64 100644
--- a/front_vue/src/views/Account.vue
+++ b/front_vue/src/views/Account.vue
@@ -8,23 +8,25 @@
编辑个人资料
+个人资料
+展示名称：{{ profile.display_name.trim() || user?.user_name }}。昵称不用于登录，最多 64 个 Unicode 字符。
联系信息仅用于沟通，不用于登录或找回密码。修改资料不会更换已有登录别名。
账号与功能权限
家庭藏书为全站共用库存。管理员身份不自动开通家庭藏书或 WebDAV。
{{ user?.must_change_password ? '修改初始密码' : '修改密码' }}
-修改密码后，所有已有登录态失效，应用凭证停用。你需要重新登录；重新启用应用前请核对来源。
+修改后包括当前设备在内的全部网站登录失效，应用凭据停用，WebDAV 客户端需要更新密码。你需要重新登录；重新启用应用前请核对来源。
登录会话
退出所有设备上的登录会话，也会退出当前设备。忘记密码请联系管理员重置。
登录与应用凭证
登录管理可仅退出指定会话或其他登录。应用凭证与 WebDAV Basic 不计入网站会话数量。忘记密码请联系管理员重置。
退出全部登录
包括当前登录在内的全部网站会话失效，应用凭据停用。WebDAV Basic 的原密码仍可使用。