From 34eef0fb7be1f9ab479835460faf292d779223da Mon Sep 17 00:00:00 2001 From: Aofei Sheng Date: Thu, 30 Jul 2026 14:51:11 +0800 Subject: [PATCH] refactor(account)!: remove app allowed origins Remove `allowedOrigins` from the OpenAPI contract, API client, and Account app administration UI. Account apps now expose only OAuth redirect URI configuration, while the Account Web origin remains deployment-owned. BREAKING CHANGE: `AccountApp` no longer contains `allowedOrigins`, and admin create and update requests no longer define it. Clients must stop reading or sending this field. Updates #3374 Signed-off-by: Aofei Sheng --- docs/openapi.yaml | 15 -------- spx-gui/src/apis/account/common.ts | 2 -- spx-gui/src/apis/admin/account.ts | 4 --- spx-gui/src/apps/xbuilder/pages/admin/app.vue | 34 +++++-------------- .../src/apps/xbuilder/pages/admin/apps.vue | 13 ++----- .../src/apps/xbuilder/pages/admin/common.ts | 5 --- 6 files changed, 11 insertions(+), 62 deletions(-) diff --git a/docs/openapi.yaml b/docs/openapi.yaml index 263fb44b0..de69afdfd 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -5409,8 +5409,6 @@ paths: $ref: "#/components/schemas/AccountApp/properties/clientType" redirectURIs: $ref: "#/components/schemas/AccountApp/properties/redirectURIs" - allowedOrigins: - $ref: "#/components/schemas/AccountApp/properties/allowedOrigins" responses: "201": description: Account app created. @@ -5489,8 +5487,6 @@ paths: $ref: "#/components/schemas/AccountApp/properties/status" redirectURIs: $ref: "#/components/schemas/AccountApp/properties/redirectURIs" - allowedOrigins: - $ref: "#/components/schemas/AccountApp/properties/allowedOrigins" responses: "200": description: Account app updated. @@ -6667,7 +6663,6 @@ components: - status - redirectURIs - redirectURIPatterns - - allowedOrigins properties: id: $ref: "#/components/schemas/Model/properties/id" @@ -6743,16 +6738,6 @@ components: type: string examples: - - https://app-*.example.com/oauth/callback - allowedOrigins: - description: | - Allowed web origins. - - Production web origins must use `https`, must not include path, query, or fragment, and must be matched - exactly by the server. - type: array - items: - type: string - format: uri AccountAppSecret: type: object diff --git a/spx-gui/src/apis/account/common.ts b/spx-gui/src/apis/account/common.ts index c046ae3d3..4f64d345c 100644 --- a/spx-gui/src/apis/account/common.ts +++ b/spx-gui/src/apis/account/common.ts @@ -70,8 +70,6 @@ export type AccountApp = AccountModel & { redirectURIs: string[] /** Read-only allowed redirect URI patterns */ redirectURIPatterns: string[] - /** Allowed web origins */ - allowedOrigins: string[] } export type AccountAppSecret = { diff --git a/spx-gui/src/apis/admin/account.ts b/spx-gui/src/apis/admin/account.ts index fdb7bb181..0a741f8ae 100644 --- a/spx-gui/src/apis/admin/account.ts +++ b/spx-gui/src/apis/admin/account.ts @@ -194,8 +194,6 @@ export type CreateAccountAppParams = { clientType: AccountAppClientType /** Allowed redirect URIs */ redirectURIs: string[] - /** Allowed web origins */ - allowedOrigins?: string[] } export function createAccountApp(params: CreateAccountAppParams) { @@ -213,8 +211,6 @@ export type UpdateAccountAppParams = { status?: AccountAppStatus /** Allowed redirect URIs */ redirectURIs?: string[] - /** Allowed web origins */ - allowedOrigins?: string[] } export function updateAccountApp(appID: string, params: UpdateAccountAppParams) { diff --git a/spx-gui/src/apps/xbuilder/pages/admin/app.vue b/spx-gui/src/apps/xbuilder/pages/admin/app.vue index be069ef08..69e8104d8 100644 --- a/spx-gui/src/apps/xbuilder/pages/admin/app.vue +++ b/spx-gui/src/apps/xbuilder/pages/admin/app.vue @@ -12,7 +12,6 @@ import CopyButton from '@/components/common/CopyButton.vue' import UIIcon from '@/components/ui/icons/UIIcon.vue' import * as accountAdminApis from '@/apis/admin/account' import { - accountAppAllowedOriginsTip, accountAppClientTypeLabels, accountAppRedirectURIPatternsTip, accountAppRedirectURIsTip, @@ -52,11 +51,9 @@ usePageTitle(() => const displayName = ref('') const status = ref('active') const redirectURIs = ref('') -const allowedOrigins = ref('') const savedDisplayName = ref('') const savedStatus = ref('active') const savedRedirectURIs = ref([]) -const savedAllowedOrigins = ref([]) const appUpdatedAt = ref('') const appFallbackText = computed(() => displayName.value.trim().charAt(0).toUpperCase() || '?') const trimmedDisplayName = computed(() => displayName.value.trim()) @@ -68,28 +65,22 @@ watch( displayName.value = value.displayName status.value = value.status redirectURIs.value = value.redirectURIs.join('\n') - allowedOrigins.value = value.allowedOrigins.join('\n') savedDisplayName.value = value.displayName savedStatus.value = value.status savedRedirectURIs.value = value.redirectURIs - savedAllowedOrigins.value = value.allowedOrigins appUpdatedAt.value = value.updatedAt }, { immediate: true } ) const parsedRedirectURIs = computed(() => parseLines(redirectURIs.value)) -const parsedAllowedOrigins = computed(() => parseLines(allowedOrigins.value)) const isActive = computed(() => status.value === 'active') const isIdentityChanged = computed( () => trimmedDisplayName.value !== '' && trimmedDisplayName.value !== savedDisplayName.value ) const isStatusChanged = computed(() => status.value !== savedStatus.value) -const areEndpointsChanged = computed( - () => - parsedRedirectURIs.value.length > 0 && - (!areStringListsEqual(parsedRedirectURIs.value, savedRedirectURIs.value) || - !areStringListsEqual(parsedAllowedOrigins.value, savedAllowedOrigins.value)) +const areRedirectURIsChanged = computed( + () => parsedRedirectURIs.value.length > 0 && !areStringListsEqual(parsedRedirectURIs.value, savedRedirectURIs.value) ) function areStringListsEqual(a: string[], b: string[]) { @@ -123,14 +114,12 @@ const handleUpdateIdentity = useMessageHandle( { en: 'App identity updated', zh: '应用信息已更新' } ) -const handleUpdateEndpoints = useMessageHandle( +const handleUpdateRedirectURIs = useMessageHandle( async () => { const updated = await accountAdminApis.updateAccountApp(props.appID, { - redirectURIs: parsedRedirectURIs.value, - allowedOrigins: parsedAllowedOrigins.value + redirectURIs: parsedRedirectURIs.value }) savedRedirectURIs.value = updated.redirectURIs - savedAllowedOrigins.value = updated.allowedOrigins appUpdatedAt.value = updated.updatedAt }, { en: 'Failed to update OAuth endpoints', zh: '更新 OAuth 地址配置失败' }, @@ -339,13 +328,13 @@ function deleteSecret(secretID: string) {

{{ $t({ - en: 'Exact destinations and browser origins trusted by this app.', - zh: '此应用信任的精确回调地址和浏览器来源。' + en: 'Exact callback destinations trusted by this app.', + zh: '此应用信任的精确回调地址。' }) }}

-
+