Skip to content

feat: add auth docs#1766

Open
lichunn wants to merge 5 commits intoopentiny:release/v2.10.xfrom
lichunn:feat/auth-docs
Open

feat: add auth docs#1766
lichunn wants to merge 5 commits intoopentiny:release/v2.10.xfrom
lichunn:feat/auth-docs

Conversation

@lichunn
Copy link
Collaborator

@lichunn lichunn commented Feb 9, 2026

English | 简体中文

PR

PR Checklist

Please check if your PR fulfills the following requirements:

  • The commit message follows our Commit Message Guidelines
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)
  • Built its own designer, fully self-validated

PR Type

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Documentation content changes
  • Other... Please describe:

Background and solution

What is the current behavior?

Issue Number: N/A

What is the new behavior?

Does this PR introduce a breaking change?

  • Yes
  • No

Other information

Summary by CodeRabbit

  • Documentation
    • Added comprehensive Chinese documentation for TinyEngine’s login and authentication features
    • Covers user flows: registration, login, password recovery, post-login access, account/profile and organization switching
    • Describes token-based authentication, request handling and cancellation, concurrency management, auth error handling, multi-tenant behavior and app-center redirection
    • Added corresponding catalog entry in the advanced features list

@github-actions github-actions bot added documentation Improvements or additions to documentation enhancement New feature or request labels Feb 9, 2026
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 9, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Adds a new Chinese documentation page docs/advanced-features/auth-plugin.md describing TinyEngine's authentication (login/registration/password recovery), HTTP request interception and cancellation, token handling, multi-tenant routing, and UI flows; updates docs/catalog.json to register the article.

Changes

Cohort / File(s) Summary
Authentication Documentation
docs/advanced-features/auth-plugin.md
New Chinese doc detailing login/registration/password recovery flows, token handling (localStorage → Authorization header), HTTP interceptor behavior, AbortController-based request cancellation and whitelist, auth error handling (CM004/CM005), dev/prod config, multi-tenant routing, and UI locations.
Documentation Catalog
docs/catalog.json
Catalog entry added: "登录功能" (auth-plugin.md) under advanced features / route-capabilities.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through pages, nibbling keys,

Wove tokens, logins, and tenant trees,
I chased stray requests, then let them go,
Wrote tiny rules in lines that flow,
🥕 A rabbit's guide to auth, aglow.

🚥 Pre-merge checks | ✅ 3 | ❌ 1
❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Merge Conflict Detection ⚠️ Warning ❌ Merge conflicts detected (97 files):

⚔️ designer-demo/package.json (content)
⚔️ docs/advanced-features/conditional-rendering.md (content)
⚔️ docs/advanced-features/loop-rendering.md (content)
⚔️ docs/basic-features/frontend-application-flow.md (content)
⚔️ docs/basic-features/inline-style-variable-binding.md (content)
⚔️ docs/basic-features/internationalization.md (content)
⚔️ docs/basic-features/outline-tree.md (content)
⚔️ docs/basic-features/using-components.md (content)
⚔️ docs/catalog.json (content)
⚔️ mockServer/package.json (content)
⚔️ packages/block-compiler/package.json (content)
⚔️ packages/build/vite-config/package.json (content)
⚔️ packages/build/vite-plugin-meta-comments/package.json (content)
⚔️ packages/builtinComponent/package.json (content)
⚔️ packages/builtinComponent/src/components/BaseForm.vue (content)
⚔️ packages/builtinComponent/src/components/BasePage.vue (content)
⚔️ packages/builtinComponent/src/components/BaseTable.vue (content)
⚔️ packages/builtinComponent/src/meta/BasePage.json (content)
⚔️ packages/builtinComponent/src/meta/BaseTable.json (content)
⚔️ packages/canvas/package.json (content)
⚔️ packages/common/composable/defaultGlobalService.ts (content)
⚔️ packages/common/composable/http/index.ts (content)
⚔️ packages/common/js/canvas.ts (content)
⚔️ packages/common/js/import-map.json (content)
⚔️ packages/common/package.json (content)
⚔️ packages/configurator/package.json (content)
⚔️ packages/configurator/src/model-api-configurator/ModelApiConfigurator.vue (content)
⚔️ packages/configurator/src/model-api-configurator/ParamsBindGrid.vue (content)
⚔️ packages/configurator/src/model-common/ModelSelect.vue (content)
⚔️ packages/configurator/src/model-configurator/ModelConfigurator.vue (content)
⚔️ packages/design-core/package.json (content)
⚔️ packages/design-core/src/login/ForgotPassword.vue (content)
⚔️ packages/design-core/src/login/Index.vue (content)
⚔️ packages/design-core/src/login/Login.vue (content)
⚔️ packages/design-core/src/login/Register.vue (content)
⚔️ packages/design-core/src/login/RegisterSuccess.vue (content)
⚔️ packages/engine-cli/package.json (content)
⚔️ packages/engine-cli/template/designer/package.json (content)
⚔️ packages/i18n/package.json (content)
⚔️ packages/layout/package.json (content)
⚔️ packages/plugins/block/package.json (content)
⚔️ packages/plugins/bridge/package.json (content)
⚔️ packages/plugins/datasource/package.json (content)
⚔️ packages/plugins/help/package.json (content)
⚔️ packages/plugins/i18n/package.json (content)
⚔️ packages/plugins/materials/package.json (content)
⚔️ packages/plugins/materials/src/composable/useResource.ts (content)
⚔️ packages/plugins/model-manager/package.json (content)
⚔️ packages/plugins/model-manager/src/Main.vue (content)
⚔️ packages/plugins/model-manager/src/components/FieldManager.vue (content)
⚔️ packages/plugins/model-manager/src/components/ModelBasicForm.vue (content)
⚔️ packages/plugins/model-manager/src/components/ModelSetting.vue (content)
⚔️ packages/plugins/page/package.json (content)
⚔️ packages/plugins/resource/package.json (content)
⚔️ packages/plugins/robot/package.json (content)
⚔️ packages/plugins/robot/src/Main.vue (content)
⚔️ packages/plugins/robot/src/components/chat/RobotChat.vue (content)
⚔️ packages/plugins/robot/src/composables/core/useConversation.ts (content)
⚔️ packages/plugins/robot/src/composables/core/useMessageStream.ts (content)
⚔️ packages/plugins/robot/src/composables/features/useToolCalls.ts (content)
⚔️ packages/plugins/robot/src/composables/useChat.ts (content)
⚔️ packages/plugins/robot/src/utils/chat.utils.ts (content)
⚔️ packages/plugins/schema/package.json (content)
⚔️ packages/plugins/script/package.json (content)
⚔️ packages/plugins/state/package.json (content)
⚔️ packages/plugins/tree/package.json (content)
⚔️ packages/plugins/tutorial/package.json (content)
⚔️ packages/register/package.json (content)
⚔️ packages/settings/design/package.json (content)
⚔️ packages/settings/events/package.json (content)
⚔️ packages/settings/panel/package.json (content)
⚔️ packages/settings/props/package.json (content)
⚔️ packages/settings/styles/package.json (content)
⚔️ packages/svgs/package.json (content)
⚔️ packages/theme/base/package.json (content)
⚔️ packages/toolbars/breadcrumb/package.json (content)
⚔️ packages/toolbars/clean/package.json (content)
⚔️ packages/toolbars/collaboration/package.json (content)
⚔️ packages/toolbars/fullscreen/package.json (content)
⚔️ packages/toolbars/generate-code/package.json (content)
⚔️ packages/toolbars/lang/package.json (content)
⚔️ packages/toolbars/lock/package.json (content)
⚔️ packages/toolbars/logo/package.json (content)
⚔️ packages/toolbars/media/package.json (content)
⚔️ packages/toolbars/preview/package.json (content)
⚔️ packages/toolbars/redoundo/package.json (content)
⚔️ packages/toolbars/refresh/package.json (content)
⚔️ packages/toolbars/save/package.json (content)
⚔️ packages/toolbars/setting/package.json (content)
⚔️ packages/toolbars/themeSwitch/package.json (content)
⚔️ packages/toolbars/user/package.json (content)
⚔️ packages/toolbars/view-setting/package.json (content)
⚔️ packages/utils/package.json (content)
⚔️ packages/vue-generator/package.json (content)
⚔️ packages/workspace/application-center/package.json (content)
⚔️ packages/workspace/application-center/src/Main.vue (content)
⚔️ packages/workspace/template-center/package.json (content)

These conflicts must be resolved before merging into release/v2.10.x.
Resolve conflicts locally and push changes to this branch.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'feat: add auth docs' directly and accurately summarizes the main change: adding authentication documentation (auth-plugin.md). It is concise, specific, and clearly indicates the primary purpose of the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
⚔️ Resolve merge conflicts (beta)
  • Auto-commit resolved conflicts to branch feat/auth-docs
  • Post resolved changes as copyable diffs in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@docs/advanced-features/auth-plugin.md`:
- Around line 66-77: The whiteList and notAuthList arrays are inconsistent:
whiteList entries use leading slashes while notAuthList entries do not, which is
confusing; fix this by standardizing the pattern so both arrays use absolute
paths (prepend '/' to every entry in notAuthList) or alternatively normalize the
request path before matching (e.g., ensure path starts with '/' once) so the
.includes() checks behave consistently; update the arrays named whiteList and
notAuthList and the matching logic that uses .includes() accordingly.
🧹 Nitpick comments (2)
docs/advanced-features/auth-plugin.md (2)

85-85: Special characters rendering may be affected by Markdown escaping.

The backslash-escaped characters (\*, \_, \|) are Markdown escape sequences. In rendered output, they should display correctly, but the raw text looks cluttered. Consider wrapping the special characters in an inline code span to make it clearer:

Proposed fix
-- 必须包含特殊字符:!@#$%^&\*()\_+-=[]{};":\|,.'<>?。
+- 必须包含特殊字符:`!@#$%^&*()_+-=[]{};":|,.'<>?`

101-106: Document ends abruptly without a concluding newline or closing section.

Line 106 ends mid-sentence without a trailing newline, which is a minor Markdown hygiene issue. Most linters and editors expect a final newline character at the end of a file.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@docs/advanced-features/auth-plugin.md`:
- Around line 9-28: Replace all invalid closing br tags `</br>` in the
auth-plugin.md document with a proper self-closing `<br>` or use blank lines for
paragraph breaks; search for every occurrence of the literal `</br>` in the file
(including the header and all list/feature sections) and update them so Markdown
engines render line breaks consistently while preserving surrounding text and
image links.
🧹 Nitpick comments (1)
docs/advanced-features/auth-plugin.md (1)

66-77: Whitelist snippet should use a copy‑paste‑ready array format.
Consider wrapping these entries in a JavaScript array with commas to reduce ambiguity for readers.

📌 Suggested doc tweak
-   // 登录相关接口
-   '/platform-center/api/user/login'
-   '/platform-center/api/user/register'
-   '/platform-center/api/user/forgot-password'
-   '/platform-center/api/user/me'
-   '/platform-center/api/user/tenant'
-   // AI 相关接口
-   'app-center/api/chat/completions'
-   'app-center/api/ai/chat'
-   'app-center/api/ai/search'
+   const whiteList = [
+     // 登录相关接口
+     '/platform-center/api/user/login',
+     '/platform-center/api/user/register',
+     '/platform-center/api/user/forgot-password',
+     '/platform-center/api/user/me',
+     '/platform-center/api/user/tenant',
+     // AI 相关接口
+     'app-center/api/chat/completions',
+     'app-center/api/ai/chat',
+     'app-center/api/ai/search',
+   ]

@lichunn lichunn changed the base branch from develop to release/v2.10.x February 12, 2026 08:30
@github-actions github-actions bot added the release merge to release/ branch, before release period label Feb 12, 2026
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Fix all issues with AI agents
In `@docs/advanced-features/auth-plugin.md`:
- Around line 42-49: Update the docs listing for the login component structure
to reflect that useLogin.ts lives in the js subdirectory: change the entry for
useLogin.ts to indicate its full path
packages/design-core/src/login/js/useLogin.ts (or note “useLogin.ts (in
login/js/)”) while leaving the other component names Index.vue, Login.vue,
Register.vue, ForgotPassword.vue, and RegisterSuccess.vue as-is so readers can
find useLogin.ts under the login/js folder.
- Around line 78-87: The doc and implementation disagree on allowed special
characters; reconcile them by either adding the missing characters to the
validator or updating the docs to match the validator. Locate the
special-character set in the login validator (the string/regex variable in
useLogin.ts, e.g. specialChars or the regex on line ~3) and add the missing "{"
and "]" if you want to match the docs, or update the markdown list in
auth-plugin.md to the exact characters currently used by the validator; ensure
both the docs and the validator contain the identical character sequence.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@docs/advanced-features/auth-plugin.md`:
- Around line 66-77: The code block shows URL entries but is not valid
JavaScript; change it to a real array by replacing the block with a proper
JavaScript array declaration such as const whiteList = [ /* entries */ ] adding
commas between items and preserving comments, closing the array and code fence,
or alternatively label the block as a pseudo-list/plain text if you
intentionally don't want runnable JS; reference the whiteList identifier when
making the change.


- 位置:packages/design-core/src/login/
- 组件结构:</br>
1. Index.vue:登录页面容器</br>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这是给用户/开发者看的文档,不是写源码解读

- 组件结构:</br>
1. Index.vue:登录页面容器</br>
2. Login.vue:登录表单</br>
3. Register.vue:注册表单</br>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

如果要写技术细节,就介绍原理、画图来解释

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@docs/advanced-features/auth-plugin.md`:
- Around line 35-40: The snippet declares abortControllers and an incomplete
abortAllRequests, so either complete the function or mark it as illustrative;
implement abortAllRequests(message = '用户未登录,请求已取消') to iterate over
abortControllers, call abort() on each controller, clear the Map and optionally
log or dispatch the provided message, or replace the incomplete line with a
short comment like "// simplified excerpt — full implementation in source" to
clarify it's not full code; reference abortControllers and abortAllRequests when
making the change.

Comment on lines +35 to +40
```javascript
// 使用 Map 存储所有请求的 AbortController
const abortControllers = new Map()
// 支持取消所有进行中的请求
const abortAllRequests = (message = '用户未登录,请求已取消')
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Complete the code example or clarify it's a snippet.

The JavaScript example shows variable declarations but the abortAllRequests function declaration is incomplete (no function body or parameters shown). Consider either showing the complete implementation or adding a comment indicating this is a simplified excerpt.

📝 Suggested clarification
 4. 并发请求管理
    ```javascript
    // 使用 Map 存储所有请求的 AbortController
    const abortControllers = new Map()
-   // 支持取消所有进行中的请求
-   const abortAllRequests = (message = '用户未登录,请求已取消')
+   // 支持取消所有进行中的请求
+   const abortAllRequests = (message = '用户未登录,请求已取消') => {
+     // ... 具体实现见源码
+   }
    ```

Or alternatively, add a note that this is a conceptual overview:

 4. 并发请求管理
+   
+   系统使用以下机制管理并发请求(简化示例):
+   
    ```javascript
    // 使用 Map 存储所有请求的 AbortController
    const abortControllers = new Map()
    // 支持取消所有进行中的请求
    const abortAllRequests = (message = '用户未登录,请求已取消')
    ```
🤖 Prompt for AI Agents
In `@docs/advanced-features/auth-plugin.md` around lines 35 - 40, The snippet
declares abortControllers and an incomplete abortAllRequests, so either complete
the function or mark it as illustrative; implement abortAllRequests(message =
'用户未登录,请求已取消') to iterate over abortControllers, call abort() on each
controller, clear the Map and optionally log or dispatch the provided message,
or replace the incomplete line with a short comment like "// simplified excerpt
— full implementation in source" to clarify it's not full code; reference
abortControllers and abortAllRequests when making the change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation enhancement New feature or request release merge to release/ branch, before release period

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants