載入中…
; + if (!token) return載入中…
; + if (!token) return
+ {dataUrl ? (
+ 
+ ) : err ? (
+
+ );
+}
diff --git a/frontend/src/config.ts b/frontend/src/config.ts
new file mode 100644
index 0000000..a1656d4
--- /dev/null
+++ b/frontend/src/config.ts
@@ -0,0 +1,3 @@
+/** 本機 k6 / dev 預設值，可在登入頁覆寫 */
+export const DEFAULT_TENANT = 'k6-tenant';
+export const DEFAULT_INVITE = 'K6INVITE';
diff --git a/frontend/src/context/AuthContext.tsx b/frontend/src/context/AuthContext.tsx
new file mode 100644
index 0000000..9dcc569
--- /dev/null
+++ b/frontend/src/context/AuthContext.tsx
@@ -0,0 +1,96 @@
+import {
+ createContext,
+ useCallback,
+ useContext,
+ useEffect,
+ useMemo,
+ useState,
+ type ReactNode,
+} from 'react';
+import { clearTokens, getToken } from '../api/http';
+import * as permApi from '../api/permission';
+
+interface AuthState {
+ ready: boolean;
+ token: string;
+ uid: string;
+ roles: string[];
+ isAdmin: boolean;
+ syncSession: () => void;
+ refreshRoles: () => Promise{err}
+ ) : ( +產生 QR Code 中…
+ )} +
+ {issuer && (
+
+ + Issuer {issuer} +
+ )} + {account && ( ++ 帳號 {account} +
+ )} ++ 用 Google Authenticator、1Password 等 App 掃描 QR，或手動輸入密鑰（進階設定）。 +
+
+
+ 無法掃描？顯示 otpauth 連結
+{otpauthUrl}
+
+
+
+
+
+ );
+}
diff --git a/frontend/src/layouts/UserLayout.tsx b/frontend/src/layouts/UserLayout.tsx
new file mode 100644
index 0000000..00cbc15
--- /dev/null
+++ b/frontend/src/layouts/UserLayout.tsx
@@ -0,0 +1,43 @@
+import { Link, Outlet, useNavigate } from 'react-router-dom';
+import * as authApi from '../api/auth';
+import { useAuth } from '../context/AuthContext';
+
+export function UserLayout() {
+ const { signOut, isAdmin, uid } = useAuth();
+ const navigate = useNavigate();
+
+ const handleLogout = async () => {
+ try {
+ await authApi.logout();
+ } catch {
+ /* ignore */
+ }
+ signOut();
+ navigate('/login');
+ };
+
+ return (
+
+
+
+ Gateway
+
+
+
+
+
+
+ );
+}
diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx
new file mode 100644
index 0000000..bef5202
--- /dev/null
+++ b/frontend/src/main.tsx
@@ -0,0 +1,10 @@
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import './index.css'
+import App from './App.tsx'
+
+createRoot(document.getElementById('root')!).render(
+
+ {uid}
+
+
+
+
+ );
+}
diff --git a/frontend/src/pages/admin/RolePermissionsPage.tsx b/frontend/src/pages/admin/RolePermissionsPage.tsx
new file mode 100644
index 0000000..a75508c
--- /dev/null
+++ b/frontend/src/pages/admin/RolePermissionsPage.tsx
@@ -0,0 +1,174 @@
+import { useEffect, useMemo, useState } from 'react';
+import { useSearchParams } from 'react-router-dom';
+import * as permApi from '../../api/permission';
+import type { PermissionNode, Role } from '../../api/permission';
+import { ApiError } from '../../api/http';
+
+/** 可勾選的權限節點（有實際 API path 的葉節點） */
+function leafPermissions(nodes: PermissionNode[]): PermissionNode[] {
+ return nodes.filter((n) => n.http_path);
+}
+
+function groupByParent(leaves: PermissionNode[]) {
+ const groups = new Map管理後台
+以 tenant_admin / tenant_owner 角色登入後可使用。
+
+
+
+
+ 目前管理員
+UID: {uid}
+-
+ {roles.map((r) => (
+
- + {r} + + ))} +
+
+ 權限管理
+-
+
- + 角色管理 — 新增 / 改名 / 刪除角色 + +
- + 角色權限 — 勾選 API + 權限 + +
- + 使用者角色 — 指派 tenant_admin 等 + +
+
+ 系統維護
+角色或權限變更後，可手動觸發 policy 重載。
+ + {msg &&{msg}
} + {error &&{error}
} +
+
+ );
+}
diff --git a/frontend/src/pages/admin/RolesPage.tsx b/frontend/src/pages/admin/RolesPage.tsx
new file mode 100644
index 0000000..29db411
--- /dev/null
+++ b/frontend/src/pages/admin/RolesPage.tsx
@@ -0,0 +1,137 @@
+import { useEffect, useState, type FormEvent } from 'react';
+import { Link } from 'react-router-dom';
+import * as permApi from '../../api/permission';
+import type { Role } from '../../api/permission';
+import { ApiError } from '../../api/http';
+
+export function RolesPage() {
+ const [roles, setRoles] = useState角色權限設定
++ 為自訂角色勾選 API 權限。儲存後會自動重載 policy。系統內建角色（tenant_admin + 等）權限由種子資料定義，建議只調整非系統角色。 +
+ + {error &&{error}
} + {msg &&{msg}
} + +
+
+ {roleId && (
+
+ )}
+
+
+ {selectedRole?.is_system && (
+ 系統角色不建議在此修改；請建立自訂角色（如 support）再指派權限。
+ )} + + {roleId && !selectedRole?.is_system && ( +
+ {groups.map(([parent, items]) => (
+
+
+
+
+ ))}
+
+ )}
+
+ {parent}
+
+ -
+ {items.map((p) => (
+
- + + + ))} +
+
+
+
+
+ );
+}
diff --git a/frontend/src/pages/admin/UserRolesPage.tsx b/frontend/src/pages/admin/UserRolesPage.tsx
new file mode 100644
index 0000000..f56bb93
--- /dev/null
+++ b/frontend/src/pages/admin/UserRolesPage.tsx
@@ -0,0 +1,136 @@
+import { useState, type FormEvent } from 'react';
+import * as permApi from '../../api/permission';
+import type { Role } from '../../api/permission';
+import { ApiError } from '../../api/http';
+import { useAuth } from '../../context/AuthContext';
+
+export function UserRolesPage() {
+ const { uid: myUid } = useAuth();
+ const [uid, setUid] = useState('');
+ const [roles, setRoles] = useState角色管理
+ {error &&{error}
} + + + +| Key | +顯示名稱 | +系統 | +狀態 | ++ |
|---|---|---|---|---|
+ {r.key}
+ |
+ + { + if (e.target.value !== r.display_name) { + rename(r.id, e.target.value); + } + }} + /> + | +{r.is_system ? '是' : '否'} | +{r.status} | ++ {!r.is_system && ( + + 設定權限 + + )} + {!r.is_system && ( + + )} + | +
+
+ );
+}
diff --git a/frontend/src/pages/user/ConfirmPage.tsx b/frontend/src/pages/user/ConfirmPage.tsx
new file mode 100644
index 0000000..dad9ea8
--- /dev/null
+++ b/frontend/src/pages/user/ConfirmPage.tsx
@@ -0,0 +1,95 @@
+import { useEffect, useState, type FormEvent } from 'react';
+import { Link, useNavigate } from 'react-router-dom';
+import * as authApi from '../../api/auth';
+import { ApiError } from '../../api/http';
+import { useAuth } from '../../context/AuthContext';
+
+export function ConfirmPage() {
+ const navigate = useNavigate();
+ const { syncSession, refreshRoles } = useAuth();
+ const [tenant, setTenant] = useState('');
+ const [challengeId, setChallengeId] = useState('');
+ const [email, setEmail] = useState('');
+ const [code, setCode] = useState('');
+ const [error, setError] = useState('');
+ const [loading, setLoading] = useState(false);
+ const [resendMsg, setResendMsg] = useState('');
+
+ useEffect(() => {
+ const raw = sessionStorage.getItem('register_pending');
+ if (!raw) return;
+ const p = JSON.parse(raw) as {
+ tenant: string;
+ challenge_id: string;
+ email: string;
+ };
+ setTenant(p.tenant);
+ setChallengeId(p.challenge_id);
+ setEmail(p.email);
+ }, []);
+
+ const submit = async (e: FormEvent) => {
+ e.preventDefault();
+ setError('');
+ setLoading(true);
+ try {
+ await authApi.registerConfirm(tenant, challengeId, code);
+ sessionStorage.removeItem('register_pending');
+ syncSession();
+ await refreshRoles();
+ navigate('/app');
+ } catch (err) {
+ setError(err instanceof ApiError ? err.message : '驗證失敗');
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ const resend = async () => {
+ setResendMsg('');
+ try {
+ await authApi.registerResend(tenant, challengeId);
+ setResendMsg('已重新寄送驗證碼');
+ } catch (err) {
+ setResendMsg(err instanceof ApiError ? err.message : '重送失敗');
+ }
+ };
+
+ if (!challengeId) {
+ return (
+ 使用者角色
+
+ 輸入成員 UID（註冊後可在首頁查看）。指派 tenant_admin{' '}
+ 或 tenant_owner 後，對方重新登入即可進管理後台。
+
{msg}
} + {error &&{error}
} + + {userRoles.length > 0 && ( + <> +目前角色
+-
+ {userRoles.map((ur) => (
+
-
+
+ {ur.display_name} (
{ur.role_key}) + + +
+ ))}
+
指派新角色
+
+
+
+
+
+ )}
+
+
+ );
+ }
+
+ return (
+ 請先完成註冊步驟。
+ 返回註冊 +
+
+ );
+}
diff --git a/frontend/src/pages/user/HomePage.tsx b/frontend/src/pages/user/HomePage.tsx
new file mode 100644
index 0000000..23f2856
--- /dev/null
+++ b/frontend/src/pages/user/HomePage.tsx
@@ -0,0 +1,70 @@
+import { useEffect, useState } from 'react';
+import * as memberApi from '../../api/member';
+import { ApiError } from '../../api/http';
+import { useAuth } from '../../context/AuthContext';
+
+export function HomePage() {
+ const { roles, uid } = useAuth();
+ const [me, setMe] = useStateEmail 驗證
++ 驗證碼已寄至 {email}（開發環境請到 MailHog 查看） +
+ + + {resendMsg &&{resendMsg}
} +{error}
; + if (!me) return載入個人資料…
; + + return ( +
+
+ );
+}
diff --git a/frontend/src/pages/user/LoginPage.tsx b/frontend/src/pages/user/LoginPage.tsx
new file mode 100644
index 0000000..f074f47
--- /dev/null
+++ b/frontend/src/pages/user/LoginPage.tsx
@@ -0,0 +1,75 @@
+import { useState, type FormEvent } from 'react';
+import { Link, useNavigate } from 'react-router-dom';
+import * as authApi from '../../api/auth';
+import { ApiError } from '../../api/http';
+import { DEFAULT_TENANT } from '../../config';
+import { useAuth } from '../../context/AuthContext';
+import * as permApi from '../../api/permission';
+
+export function LoginPage() {
+ const navigate = useNavigate();
+ const { syncSession, refreshRoles } = useAuth();
+ const [tenant, setTenant] = useState(
+ () => localStorage.getItem('tenant_slug') ?? DEFAULT_TENANT,
+ );
+ const [email, setEmail] = useState('');
+ const [password, setPassword] = useState('');
+ const [error, setError] = useState('');
+ const [loading, setLoading] = useState(false);
+
+ const submit = async (e: FormEvent) => {
+ e.preventDefault();
+ setError('');
+ setLoading(true);
+ try {
+ localStorage.setItem('tenant_slug', tenant);
+ await authApi.login(tenant, email, password);
+ syncSession();
+ await refreshRoles();
+ const me = await permApi.getMyPermissions();
+ const admin = permApi.isAdminRole(me.roles ?? []);
+ navigate(admin ? '/admin' : '/app');
+ } catch (err) {
+ setError(err instanceof ApiError ? err.message : '登入失敗');
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ return (
+ 你好，{me.display_name || me.zitadel_email || uid}
+
+
+
+
+ 帳號
+-
+
- UID +
- {me.uid} +
- 登入 Email +
- {me.zitadel_email ?? '—'} +
- 狀態 +
- {me.status} +
+
+ 驗證狀態
+-
+
- 商業聯絡 Email +
- + {me.business_email || me.zitadel_email || '未設定'}{' '} + {me.business_email_verified ? '✓ 已驗證' : '未驗證'} + +
- 商業手機 +
- + {me.business_phone || '未設定'}{' '} + {me.business_phone_verified ? '✓' : '未驗證'} + +
- 雙因素 (TOTP) +
- {me.totp_enrolled ? '已啟用' : '未啟用'} +
+
+ 我的角色
+-
+ {roles.length === 0 ? (
+
- 尚無指派角色 + ) : ( + roles.map((r) => ( +
- + {r} + + )) + )} +
+
+ );
+}
diff --git a/frontend/src/pages/user/ProfilePage.tsx b/frontend/src/pages/user/ProfilePage.tsx
new file mode 100644
index 0000000..13846ff
--- /dev/null
+++ b/frontend/src/pages/user/ProfilePage.tsx
@@ -0,0 +1,74 @@
+import { useEffect, useState, type FormEvent } from 'react';
+import * as memberApi from '../../api/member';
+import { ApiError } from '../../api/http';
+
+export function ProfilePage() {
+ const [displayName, setDisplayName] = useState('');
+ const [language, setLanguage] = useState('zh-TW');
+ const [currency, setCurrency] = useState('TWD');
+ const [phone, setPhone] = useState('');
+ const [msg, setMsg] = useState('');
+ const [error, setError] = useState('');
+ const [loading, setLoading] = useState(false);
+
+ useEffect(() => {
+ memberApi.getMe().then((m) => {
+ setDisplayName(m.display_name ?? '');
+ setLanguage(m.language ?? 'zh-TW');
+ setCurrency(m.currency ?? 'TWD');
+ setPhone(m.phone ?? '');
+ });
+ }, []);
+
+ const submit = async (e: FormEvent) => {
+ e.preventDefault();
+ setError('');
+ setMsg('');
+ setLoading(true);
+ try {
+ await memberApi.updateMe({
+ display_name: displayName,
+ language,
+ currency,
+ phone: phone || undefined,
+ });
+ setMsg('已儲存');
+ } catch (err) {
+ setError(err instanceof ApiError ? err.message : '儲存失敗');
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ return (
+ 登入
+ ++ 還沒有帳號？ 註冊 +
+
+
+ );
+}
diff --git a/frontend/src/pages/user/RegisterPage.tsx b/frontend/src/pages/user/RegisterPage.tsx
new file mode 100644
index 0000000..4a0e5da
--- /dev/null
+++ b/frontend/src/pages/user/RegisterPage.tsx
@@ -0,0 +1,97 @@
+import { useState, type FormEvent } from 'react';
+import { Link, useNavigate } from 'react-router-dom';
+import * as authApi from '../../api/auth';
+import { ApiError } from '../../api/http';
+import { DEFAULT_INVITE, DEFAULT_TENANT } from '../../config';
+
+export function RegisterPage() {
+ const navigate = useNavigate();
+ const [tenant, setTenant] = useState(
+ () => localStorage.getItem('tenant_slug') ?? DEFAULT_TENANT,
+ );
+ const [invite, setInvite] = useState(DEFAULT_INVITE);
+ const [email, setEmail] = useState('');
+ const [password, setPassword] = useState('');
+ const [displayName, setDisplayName] = useState('');
+ const [error, setError] = useState('');
+ const [loading, setLoading] = useState(false);
+
+ const submit = async (e: FormEvent) => {
+ e.preventDefault();
+ setError('');
+ setLoading(true);
+ try {
+ localStorage.setItem('tenant_slug', tenant);
+ const data = await authApi.register({
+ tenant_slug: tenant,
+ invite_code: invite,
+ email,
+ password,
+ display_name: displayName || undefined,
+ language: 'zh-TW',
+ });
+ sessionStorage.setItem(
+ 'register_pending',
+ JSON.stringify({
+ tenant,
+ challenge_id: data.challenge_id,
+ email,
+ }),
+ );
+ navigate('/register/confirm');
+ } catch (err) {
+ setError(err instanceof ApiError ? err.message : '註冊失敗');
+ } finally {
+ setLoading(false);
+ }
+ };
+
+ return (
+ 個人資料
+ +
+
+ );
+}
diff --git a/frontend/src/pages/user/SecurityPage.tsx b/frontend/src/pages/user/SecurityPage.tsx
new file mode 100644
index 0000000..72d5b89
--- /dev/null
+++ b/frontend/src/pages/user/SecurityPage.tsx
@@ -0,0 +1,251 @@
+import { useEffect, useState, type FormEvent } from 'react';
+import * as memberApi from '../../api/member';
+import { ApiError } from '../../api/http';
+import { TotpQrPanel } from '../../components/TotpQrPanel';
+
+export function SecurityPage() {
+ const [me, setMe] = useState註冊
+ ++ 已有帳號？ 登入 +
+
+
+
+
+
+
+
+
+
+
+ );
+}
diff --git a/frontend/tsconfig.app.json b/frontend/tsconfig.app.json
new file mode 100644
index 0000000..7f42e5f
--- /dev/null
+++ b/frontend/tsconfig.app.json
@@ -0,0 +1,25 @@
+{
+ "compilerOptions": {
+ "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+ "target": "es2023",
+ "lib": ["ES2023", "DOM"],
+ "module": "esnext",
+ "types": ["vite/client"],
+ "skipLibCheck": true,
+
+ /* Bundler mode */
+ "moduleResolution": "bundler",
+ "allowImportingTsExtensions": true,
+ "verbatimModuleSyntax": true,
+ "moduleDetection": "force",
+ "noEmit": true,
+ "jsx": "react-jsx",
+
+ /* Linting */
+ "noUnusedLocals": true,
+ "noUnusedParameters": true,
+ "erasableSyntaxOnly": true,
+ "noFallthroughCasesInSwitch": true
+ },
+ "include": ["src"]
+}
diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json
new file mode 100644
index 0000000..1ffef60
--- /dev/null
+++ b/frontend/tsconfig.json
@@ -0,0 +1,7 @@
+{
+ "files": [],
+ "references": [
+ { "path": "./tsconfig.app.json" },
+ { "path": "./tsconfig.node.json" }
+ ]
+}
diff --git a/frontend/tsconfig.node.json b/frontend/tsconfig.node.json
new file mode 100644
index 0000000..d3c52ea
--- /dev/null
+++ b/frontend/tsconfig.node.json
@@ -0,0 +1,24 @@
+{
+ "compilerOptions": {
+ "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+ "target": "es2023",
+ "lib": ["ES2023"],
+ "module": "esnext",
+ "types": ["node"],
+ "skipLibCheck": true,
+
+ /* Bundler mode */
+ "moduleResolution": "bundler",
+ "allowImportingTsExtensions": true,
+ "verbatimModuleSyntax": true,
+ "moduleDetection": "force",
+ "noEmit": true,
+
+ /* Linting */
+ "noUnusedLocals": true,
+ "noUnusedParameters": true,
+ "erasableSyntaxOnly": true,
+ "noFallthroughCasesInSwitch": true
+ },
+ "include": ["vite.config.ts"]
+}
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
new file mode 100644
index 0000000..8aef668
--- /dev/null
+++ b/frontend/vite.config.ts
@@ -0,0 +1,15 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+export default defineConfig({
+ plugins: [react()],
+ server: {
+ port: 5173,
+ proxy: {
+ '/api': {
+ target: 'http://localhost:8888',
+ changeOrigin: true,
+ },
+ },
+ },
+});
diff --git a/internal/library/zitadel/client.go b/internal/library/zitadel/client.go
index d60c113..6b40dfb 100644
--- a/internal/library/zitadel/client.go
+++ b/internal/library/zitadel/client.go
@@ -163,22 +163,31 @@ func (c *Client) DeactivateUser(ctx context.Context, userID string) error {
return c.doJSON(ctx, http.MethodPost, c.apiBase+"/v2/users/"+url.PathEscape(userID)+"/deactivate", c.serviceAuth(), map[string]any{}, http.StatusOK, nil)
}
-// TokenResult holds OAuth tokens from a successful password grant.
+// TokenResult holds OAuth tokens from a successful password grant, or session-verified
+// identity fields when OAuth ROPG is not configured (ZITADEL v2 default).
type TokenResult struct {
AccessToken string
IDToken string
ExpiresIn int
TokenType string
+ // Subject and Email are set by session-based verification (no OAuth tokens).
+ Subject string
+ Email string
}
-// VerifyPassword checks credentials using the OAuth2 resource-owner password grant.
+// VerifyPassword checks email/password credentials. Uses OAuth2 ROPG when OAuthClientID
+// and OAuthClientSecret are configured; otherwise uses ZITADEL v2 Sessions API (PAT).
func (c *Client) VerifyPassword(ctx context.Context, username, password string) (*TokenResult, error) {
if c == nil {
return nil, ErrNotConfigured
}
- if c.conf.OAuthClientID == "" || c.conf.OAuthClientSecret == "" {
- return nil, fmt.Errorf("zitadel: oauth client credentials are required for password verification")
+ if c.conf.OAuthClientID != "" && c.conf.OAuthClientSecret != "" {
+ return c.verifyPasswordROPG(ctx, username, password)
}
+ return c.verifyPasswordSession(ctx, username, password)
+}
+
+func (c *Client) verifyPasswordROPG(ctx context.Context, username, password string) (*TokenResult, error) {
form := url.Values{}
form.Set("grant_type", "password")
form.Set("client_id", c.conf.OAuthClientID)
diff --git a/internal/library/zitadel/client_test.go b/internal/library/zitadel/client_test.go
index 4b11e7f..e8c6040 100644
--- a/internal/library/zitadel/client_test.go
+++ b/internal/library/zitadel/client_test.go
@@ -119,6 +119,33 @@ func TestVerifyPassword(t *testing.T) {
require.ErrorIs(t, err, zitadel.ErrInvalidCredentials)
}
+func TestVerifyPasswordSession(t *testing.T) {
+ t.Parallel()
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ w.Header().Set("Content-Type", "application/json")
+ switch {
+ case r.Method == http.MethodPost && r.URL.Path == "/v2/sessions":
+ _, _ = w.Write([]byte(`{"sessionId":"sess-1"}`))
+ case r.Method == http.MethodPatch && r.URL.Path == "/v2/sessions/sess-1":
+ _, _ = w.Write([]byte(`{"sessionToken":"tok"}`))
+ case r.Method == http.MethodGet && r.URL.Path == "/v2/sessions/sess-1":
+ _, _ = w.Write([]byte(`{"session":{"factors":{"user":{"id":"user-42","loginName":"alice@example.com"},"password":{"verifiedAt":"2026-01-01T00:00:00Z"}}}}`))
+ default:
+ http.NotFound(w, r)
+ }
+ }))
+ t.Cleanup(srv.Close)
+
+ c, err := zitadel.NewClient(zitadel.Conf{Issuer: srv.URL, APIBase: srv.URL, ServiceUserToken: testPAT})
+ require.NoError(t, err)
+
+ tok, err := c.VerifyPassword(context.Background(), "alice@example.com", "ok")
+ require.NoError(t, err)
+ require.Equal(t, "user-42", tok.Subject)
+ require.Equal(t, "alice@example.com", tok.Email)
+ require.Empty(t, tok.AccessToken)
+}
+
func TestNewClientDisabledWhenIssuerEmpty(t *testing.T) {
t.Parallel()
c, err := zitadel.NewClient(zitadel.Conf{})
diff --git a/internal/library/zitadel/session.go b/internal/library/zitadel/session.go
new file mode 100644
index 0000000..2711816
--- /dev/null
+++ b/internal/library/zitadel/session.go
@@ -0,0 +1,127 @@
+package zitadel
+
+import (
+ "bytes"
+ "context"
+ "encoding/json"
+ "fmt"
+ "io"
+ "net/http"
+ "strings"
+)
+
+// verifyPasswordSession checks credentials via ZITADEL v2 Sessions API (PAT-backed).
+// Used when OAuth resource-owner password grant is unavailable (default in ZITADEL v2).
+func (c *Client) verifyPasswordSession(ctx context.Context, loginName, password string) (*TokenResult, error) {
+ if c.conf.ServiceUserToken == "" {
+ return nil, fmt.Errorf("zitadel: service user token is required for session password verification")
+ }
+ loginName = strings.TrimSpace(loginName)
+ if loginName == "" || password == "" {
+ return nil, ErrInvalidCredentials
+ }
+
+ var created struct {
+ SessionID string `json:"sessionId"`
+ }
+ if err := c.doSessionJSON(ctx, http.MethodPost, c.apiBase+"/v2/sessions", map[string]any{
+ "checks": map[string]any{
+ "user": map[string]any{"loginName": loginName},
+ },
+ }, &created); err != nil {
+ if isSessionUserNotFound(err) {
+ return nil, ErrInvalidCredentials
+ }
+ return nil, err
+ }
+ if created.SessionID == "" {
+ return nil, fmt.Errorf("zitadel: create session: empty session id")
+ }
+
+ if err := c.doSessionJSON(ctx, http.MethodPatch, c.apiBase+"/v2/sessions/"+created.SessionID, map[string]any{
+ "checks": map[string]any{
+ "password": map[string]any{"password": password},
+ },
+ }, nil); err != nil {
+ if isSessionPasswordInvalid(err) {
+ return nil, ErrInvalidCredentials
+ }
+ return nil, err
+ }
+
+ var got struct {
+ Session struct {
+ Factors struct {
+ User struct {
+ ID string `json:"id"`
+ LoginName string `json:"loginName"`
+ } `json:"user"`
+ Password struct {
+ VerifiedAt string `json:"verifiedAt"`
+ } `json:"password"`
+ } `json:"factors"`
+ } `json:"session"`
+ }
+ if err := c.doSessionJSON(ctx, http.MethodGet, c.apiBase+"/v2/sessions/"+created.SessionID, nil, &got); err != nil {
+ return nil, err
+ }
+ if got.Session.Factors.Password.VerifiedAt == "" || got.Session.Factors.User.ID == "" {
+ return nil, ErrInvalidCredentials
+ }
+ return &TokenResult{
+ Subject: got.Session.Factors.User.ID,
+ Email: got.Session.Factors.User.LoginName,
+ }, nil
+}
+
+func (c *Client) doSessionJSON(ctx context.Context, method, endpoint string, body any, out any) error {
+ var r io.Reader
+ if body != nil {
+ raw, err := json.Marshal(body)
+ if err != nil {
+ return fmt.Errorf("zitadel: marshal request: %w", err)
+ }
+ r = bytes.NewReader(raw)
+ }
+ req, err := http.NewRequestWithContext(ctx, method, endpoint, r)
+ if err != nil {
+ return fmt.Errorf("zitadel: new request: %w", err)
+ }
+ if body != nil {
+ req.Header.Set("Content-Type", "application/json")
+ }
+ req.Header.Set("Accept", "application/json")
+ req.Header.Set("Authorization", c.serviceAuth())
+
+ resp, err := c.http.Do(req)
+ if err != nil {
+ return fmt.Errorf("zitadel: %s %s: %w", method, endpoint, err)
+ }
+ defer resp.Body.Close()
+
+ raw, err := io.ReadAll(resp.Body)
+ if err != nil {
+ return fmt.Errorf("zitadel: read response body: %w", err)
+ }
+ if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+ return fmt.Errorf("zitadel: %s %s: status %d: %s", method, endpoint, resp.StatusCode, truncateBody(raw))
+ }
+ if out != nil && len(raw) > 0 {
+ if err := json.Unmarshal(raw, out); err != nil {
+ return fmt.Errorf("zitadel: decode response: %w", err)
+ }
+ }
+ return nil
+}
+
+func isSessionUserNotFound(err error) bool {
+ return err != nil && strings.Contains(err.Error(), "status 404")
+}
+
+func isSessionPasswordInvalid(err error) bool {
+ if err == nil {
+ return false
+ }
+ s := err.Error()
+ return strings.Contains(s, "status 400") && strings.Contains(s, "Password is invalid")
+}
diff --git a/internal/logic/auth/login_helper.go b/internal/logic/auth/login_helper.go
index 218511f..5941f2d 100644
--- a/internal/logic/auth/login_helper.go
+++ b/internal/logic/auth/login_helper.go
@@ -60,6 +60,12 @@ func zitadelIdentityFromToken(ctx context.Context, client *zitadel.Client, tok *
if tok == nil {
return nil, errb.SvcThirdParty("empty token result")
}
+ if tok.Subject != "" {
+ return &zitadel.IDTokenClaims{
+ Sub: tok.Subject,
+ Email: tok.Email,
+ }, nil
+ }
if tok.IDToken != "" {
claims, err := zitadel.ParseIDTokenClaims(tok.IDToken)
if err != nil {
diff --git a/internal/logic/auth/register_confirm_logic.go b/internal/logic/auth/register_confirm_logic.go
index 38a7b2a..9e8276a 100644
--- a/internal/logic/auth/register_confirm_logic.go
+++ b/internal/logic/auth/register_confirm_logic.go
@@ -2,6 +2,7 @@ package auth
import (
"context"
+ "strings"
dommember "gateway/internal/model/member/domain/usecase"
"gateway/internal/svc"
@@ -62,5 +63,13 @@ func (l *RegisterConfirmLogic) RegisterConfirm(req *types.RegisterConfirmReq) (*
return nil, err
}
+ // Email 註冊 OTP 已證明使用者擁有該信箱；同步為已驗證的商業聯絡 Email，
+ // 避免完成註冊後仍要在安全設定重驗同一個地址。
+ if email := strings.TrimSpace(strings.ToLower(ch.Target)); email != "" && l.svcCtx.MemberProfile != nil {
+ if err := l.svcCtx.MemberProfile.SetBusinessEmailVerified(l.ctx, tenant.TenantID, ch.UID, email); err != nil {
+ return nil, err
+ }
+ }
+
return issueAuthToken(l.ctx, l.svcCtx, tenant.TenantID, ch.UID)
}
安全設定
+ {msg &&{msg}
} + {error &&{error}
} + +商業聯絡 Email
++ 註冊時驗證的是登入信箱（ZITADEL）；此處為業務聯絡信箱（通知、帳務等）。 + 若與註冊信箱相同，完成註冊 OTP 後會自動標為已驗證。 +
+ {me?.business_email_verified ? ( ++ 已驗證：{me.business_email || me.zitadel_email} +
+ ) : ( + <> + {me?.zitadel_email && ( ++ 登入信箱：{me.zitadel_email} + {me.business_email && me.business_email !== me.zitadel_email + ? ` · 目前商業信箱：${me.business_email}（未驗證）` + : ''} +
+ )} + + {emailChallenge && ( + + )} + + )} +商業手機驗證
+ + {phoneChallenge && ( + + )} +雙因素驗證 (TOTP)
++ 狀態：{totp?.enrolled ? '已啟用' : '未啟用'} + {totp?.enrolled && + ` · 備援碼剩餘 ${totp.backup_codes_remaining} 組`} +
+ {!totp?.enrolled ? ( + <> + + {enrollInfo && ( +{backupCodes.join('\n')}
+ )}
+