feat: 嵌入 StarLight 皮肤站并同步登录状态

apps/app/src/main.rs

@@ -688,6 +688,13 @@ fn main() {
     );
 
     builder = builder
+        .plugin(
+            tauri::plugin::Builder::<tauri::Wry>::new("skin-site-session")
+                .js_init_script_on_all_frames(include_str!(
+                    "skin_site_bridge.js"
+                ))
+                .build(),
+        )
         .plugin(tauri_plugin_single_instance::init(|app, args, _cwd| {
             if let Some(payload) = args.get(1) {
                 tracing::info!("Handling deep link from arg {payload}");

apps/app/src/skin_site_bridge.js

@@ -0,0 +1,98 @@
+// Runs inside the embedded skin site only. The JWT never leaves that origin.
+(() => {
+  if (location.origin !== 'https://skin.starlight.cool' || window.parent === window) return
+
+  const launcherOrigins = new Set([
+    'http://localhost:5201',
+    'http://tauri.localhost',
+    'https://tauri.localhost',
+    'tauri://localhost',
+  ])
+  let parentOrigin
+  let lastToken
+  let lastCheck = 0
+  let generation = 0
+  let pending
+  let snapshot = { status: 'checking', user: null }
+
+  function publish(status, user = null) {
+    snapshot = { status, user }
+    if (parentOrigin) {
+      window.parent.postMessage({ type: 'starlight-skin-session', ...snapshot }, parentOrigin)
+    }
+  }
+
+  async function checkSession(force = false) {
+    if (!parentOrigin) return
+    let token
+    try {
+      token = localStorage.getItem('loginToken') || ''
+    } catch {
+      publish('error')
+      return
+    }
+    const changed = token !== lastToken
+    if (!changed && (pending || (!force && Date.now() - lastCheck < 60_000))) return
+    const revision = ++generation
+    pending?.abort()
+    pending = undefined
+    lastToken = token
+    lastCheck = Date.now()
+    if (!token) {
+      publish('signed-out')
+      return
+    }
+    if (changed) publish('checking')
+    const controller = new AbortController()
+    pending = controller
+    const timeout = setTimeout(() => controller.abort(), 10_000)
+    try {
+      const response = await fetch('/starlight/user', {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: controller.signal,
+        cache: 'no-store',
+        redirect: 'error',
+      })
+      const body = response.ok ? await response.json() : null
+      // A logout or account switch must win over an older in-flight response.
+      if (revision !== generation || localStorage.getItem('loginToken') !== token) return
+      if (response.status === 401 || response.status === 403 || body?.payload?.banned) {
+        publish('signed-out')
+      } else if (
+        response.ok && typeof body?.payload?.uuid === 'string' &&
+        typeof body.payload.username === 'string' && body.payload.username.length > 0
+      ) {
+        publish('signed-in', { uuid: body.payload.uuid, username: body.payload.username })
+      } else {
+        publish('error')
+      }
+    } catch {
+      if (revision === generation) publish('error')
+    } finally {
+      clearTimeout(timeout)
+      if (revision === generation) pending = undefined
+    }
+  }
+
+  window.addEventListener('message', (event) => {
+    if (event.source !== window.parent || !launcherOrigins.has(event.origin)) return
+    if (event.data?.type !== 'starlight-skin-session-connect') return
+    parentOrigin = event.origin
+    publish(snapshot.status, snapshot.user)
+    void checkSession(true)
+  })
+  // Storage events cover other tabs; polling also covers same-document SPA login/logout.
+  window.addEventListener('storage', () => void checkSession())
+  let timer = setInterval(() => void checkSession(), 1000)
+  window.addEventListener('pagehide', () => {
+    clearInterval(timer)
+    ++generation
+    pending?.abort()
+    pending = undefined
+  })
+  window.addEventListener('pageshow', (event) => {
+    if (!event.persisted) return
+    timer = setInterval(() => void checkSession(), 1000)
+    void checkSession(true)
+  })
+})()

apps/app/src/skin_site_bridge.test.cjs

@@ -0,0 +1,67 @@
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const vm = require('node:vm')
+const test = require('node:test')
+const source = fs.readFileSync(require('node:path').join(__dirname, 'skin_site_bridge.js'), 'utf8')
+
+function harness(origin = 'https://skin.starlight.cool') {
+  let token = null
+  const listeners = {}, messages = [], requests = []
+  let tick
+  let result = async () => ({ ok: true, status: 200, json: async () => ({ payload: { uuid: 'one', username: 'One' } }) })
+  const parent = { postMessage(data, target) { messages.push({ data, target }) } }
+  const context = {
+    location: { origin },
+    window: { parent, addEventListener(type, callback) { listeners[type] = callback } },
+    localStorage: { getItem() { return token } },
+    fetch(...args) { requests.push(args); return result(...args) },
+    AbortController, Date, setTimeout, clearTimeout,
+    setInterval(callback) { tick = callback; return 1 }, clearInterval() {},
+  }
+  vm.runInNewContext(source, context)
+  return {
+    messages, requests, listeners, parent,
+    token(value) { token = value }, result(value) { result = value },
+    async tick() { tick?.(); await new Promise(setImmediate) },
+    async connect(origin = 'http://localhost:5201', source = parent) {
+      listeners.message?.({ source, origin, data: { type: 'starlight-skin-session-connect' } })
+      await new Promise(setImmediate)
+    },
+  }
+}
+
+test('bridge is restricted to the skin origin and an allowlisted parent', async () => {
+  assert.equal(harness('https://evil.example').listeners.message, undefined)
+  const h = harness(); h.token('test-token')
+  await h.connect('https://evil.example'); await h.connect('http://localhost:5201', {})
+  assert.equal(h.requests.length, 0); assert.equal(h.messages.length, 0)
+  await h.connect()
+  assert.equal(h.requests[0][0], '/starlight/user')
+  assert.equal(h.requests[0][1].headers.Authorization, 'Bearer test-token')
+  assert.equal(h.requests[0][1].redirect, 'error')
+  assert.equal(h.messages.at(-1).data.status, 'signed-in')
+  assert.ok(h.messages.every(m => m.target === 'http://localhost:5201'))
+  assert.ok(!JSON.stringify(h.messages).includes('test-token'))
+})
+
+test('logout, invalid token, network error and account switching replace old state', async () => {
+  const h = harness(); await h.connect()
+  assert.equal(h.messages.at(-1).data.status, 'signed-out')
+  h.token('first'); await h.tick(); assert.equal(h.messages.at(-1).data.user.username, 'One')
+  h.result(async () => ({ ok: false, status: 401 }))
+  h.token('expired'); await h.tick(); assert.equal(h.messages.at(-1).data.status, 'signed-out')
+  h.result(async () => { throw Error('offline') })
+  h.token('network-error'); await h.tick(); assert.equal(h.messages.at(-1).data.status, 'error')
+  h.token(null); await h.tick(); assert.equal(h.messages.at(-1).data.status, 'signed-out')
+})
+
+test('a delayed response cannot restore the user after logout', async () => {
+  const h = harness(); let finish
+  h.result(() => new Promise(resolve => { finish = resolve }))
+  h.token('first'); await h.connect()
+  h.token(null); await h.tick()
+  finish({ ok: true, status: 200, json: async () => ({ payload: { uuid: 'one', username: 'One' } }) })
+  await new Promise(setImmediate)
+  assert.equal(h.messages.at(-1).data.status, 'signed-out')
+  assert.ok(!h.messages.some(m => m.data.status === 'signed-in'))
+})