security(review): fix invite bypass via smuggled seed flag, login rate limit, server-side logout, attachment preview XSS hardening

- /auth/register: strip client-supplied seed flag (PoC confirmed it bypassed invite code, MAX_USERS quota AND first-user auto-admin, granting admin without any credential); demo-rebuild internal path unaffected - /auth/login: per-IP+username of 5 consecutive failures gets a 10-minute cooldown against in-memory counter (brute-force guard) - /auth/logout: new endpoint revokes the current Bearer token server-side; frontend calls it (best-effort) before local clearToken on sidebar logout - attachment docx/xlsx preview: sanitize generated HTML (strip scripts, event handlers, dangerous protocols) before dangerouslySetInnerHTML render, preventing token theft via malicious previewed documents PoC suite: seed smuggling rejected, 429 on 6th login attempt, token dead after logout, per-user isolation intact (403/401/404 as before); integration 61/61 green
2026-10-17 21:18:55 +08:00
parent 3613b9f5e1
commit 17ab5f0390
20 changed files with 416 additions and 358 deletions
@@ -7,6 +7,30 @@ import type { Attachment } from '@/lib/types';

 export type AttKind = 'image' | 'pdf' | 'text' | 'audio' | 'video' | 'docx' | 'xlsx' | 'other';

+
+// 预览 HTML 加固：docx(mammoth)/xlsx(sheet_to_html) 的转换输出不可信，
+// 剥离脚本/事件属性/危险协议，防止恶意文档在预览时执行脚本偷取本地 token
+function sanitizePreviewHtml(html: string): string {
+  try {
+    const doc = new DOMParser().parseFromString(html, 'text/html');
+    for (const el of Array.from(doc.querySelectorAll('script,style,iframe,frame,object,embed,link,meta,form,input,button,base'))) el.remove();
+    for (const el of Array.from(doc.querySelectorAll('*'))) {
+      for (const attr of Array.from(el.attributes)) {
+        const n = attr.name.toLowerCase();
+        const v = attr.value.trim().toLowerCase();
+        if (n.startsWith('on')) el.removeAttribute(attr.name);
+        else if ((n === 'href' || n === 'src' || n === 'xlink:href') &&
+          (v.startsWith('javascript:') || (v.startsWith('data:') && !v.startsWith('data:image/')))) {
+          el.removeAttribute(attr.name);
+        }
+      }
+    }
+    return doc.body.innerHTML;
+  } catch {
+    return html;
+  }
+}
+
 export function attKind(a: { file_name: string; mime?: string | null }): AttKind {
  const mime = (a.mime || '').toLowerCase();
  const ext = (a.file_name.split('.').pop() || '').toLowerCase();
@@ -68,13 +92,13 @@ export function AttachmentPreview({ att, onClose }: { att: Attachment | null; on
          const mammoth = await import('mammoth/mammoth.browser') as any;
          const html = (await mammoth.convertToHtml({ arrayBuffer: bytes.buffer })).value as string;
          if (cancelled) return;
-          setContent({ kind, html });
+          setContent({ kind, html: sanitizePreviewHtml(html) });
        } else if (kind === 'xlsx') {
          const XLSX = await import('xlsx');
          const wb = XLSX.read(bytes, { type: 'array' });
          const html = XLSX.utils.sheet_to_html(wb.Sheets[wb.SheetNames[0]]);
          if (cancelled) return;
-          setContent({ kind, html });
+          setContent({ kind, html: sanitizePreviewHtml(html) });
        } else {
          // 本地回退的图片/PDF/音视频
          const url = URL.createObjectURL(new Blob([bytes], { type: mime || 'application/octet-stream' }));
@@ -2,7 +2,7 @@ import { useState } from 'react';
 import { NavLink } from 'react-router-dom';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
 import { CalendarDays, Rows3, ChartColumn, GraduationCap, Shapes, SlidersHorizontal, LogIn, LogOut, ShieldCheck, Cloud, User, ScrollText, ClipboardCheck } from 'lucide-react';
-import { serverMe, clearToken, getToken } from '@/lib/api';
+import { serverLogout, serverMe, clearToken, getToken } from '@/lib/api';
 import { LoginDialog } from '@/components/auth/LoginDialog';
 import { cn } from '@/lib/utils';

@@ -123,7 +123,7 @@ export function Sidebar({ open, onClose }: { open: boolean; onClose: () => void
              <button
                className="shrink-0 rounded p-1 text-ink-3 transition-colors hover:bg-surface-3 hover:text-danger"
                title="退出登录"
-                onClick={() => { clearToken(); qc.clear(); window.location.reload(); }}
+                onClick={() => { void serverLogout(); clearToken(); qc.clear(); window.location.reload(); }}
              >
                <LogOut size={13} />
              </button>
@@ -55,6 +55,16 @@ const SERVER_KEY = 'fp-server-url';
 export function getServerUrl() { return localStorage.getItem(SERVER_KEY) || 'https://footpr.linyux.cn'; }
 export function setServerUrl(url: string) { localStorage.setItem(SERVER_KEY, url.replace(/\/+$/, '')); }

+// 服务端登出：吊销当前 Bearer token（尽力而为，网络失败不影响本地清理）
+export async function serverLogout(baseUrl?: string): Promise<void> {
+  try {
+    const t = getToken();
+    if (!t) return;
+    const base = baseUrl || getServerUrl();
+    await fetch(base + '/auth/logout', { method: 'POST', headers: { Authorization: 'Bearer ' + t } });
+  } catch { /* 本地清理兜底 */ }
+}
+
 export class AuthError extends Error {
  constructor(msg: string) { super(msg); this.name = 'AuthError'; }
 }
@@ -183,6 +183,8 @@ const MIME = {

 // 按用户惰性创建命令集（每个用户一个独立 SQLite 档案库）
 const userCommands = new Map();
+const loginFails = new Map(); // 登录防爆破计数：key = IP|username，连续失败进入冷却
+
 const gzipCache = new Map(); // 指纹资产 gzip 预压缩缓存
 let demoUserId;
 function commandsFor(userId) {
@@ -237,9 +239,24 @@ const server = http.createServer(async (req, res) => {
      const body = await readJson(req);
      if (route === '/auth/register') {
        if (!REGISTER_ENABLED) return send(403, false, '注册已关闭');
+        // 加固：seed 是服务端内部播种标志（demo-rebuild 内部调用），客户端请求体一律剥离，
+        // 防止走私该标志绕过邀请码 / MAX_USERS 名额 / 首个用户自动升管理员
+        delete body.seed;
        return send(200, true, register(body));
      }
-      return send(200, true, login(body));
+      // 登录限速：同 IP+同用户名连续失败 5 次 → 该组合冷却 10 分钟（内存计数，重启即清）
+      const lmKey = String(req.socket.remoteAddress || '') + '|' + String(body.username || '').trim().toLowerCase();
+      const lmF = loginFails.get(lmKey);
+      if (lmF && lmF.until > Date.now()) return send(429, false, '尝试次数过多，请 10 分钟后再试');
+      try {
+        const out = login(body);
+        loginFails.delete(lmKey);
+        return send(200, true, out);
+      } catch (e) {
+        const n = (loginFails.get(lmKey)?.n || 0) + 1;
+        loginFails.set(lmKey, { n, until: n >= 5 ? Date.now() + 10 * 60_000 : 0 });
+        throw e;
+      }
    }

    // ---- 管理（仅 is_admin 登录会话） ----
@@ -391,6 +408,13 @@ const server = http.createServer(async (req, res) => {
      try { auth = authUser(req); }
      catch (e) { return send(e.code || 401, false, e.message); }

+      if (req.method === 'POST' && route === '/auth/logout') {
+        // 服务端吊销当前 Bearer token（前端本地清除前调用；跨设备「登出其一」）
+        const tk = (req.headers['authorization'] || '').slice(7).trim();
+        if (tk) getDb().prepare('DELETE FROM tokens WHERE token=?').run(tk);
+        return send(200, true, { ok: true });
+      }
+
      if (req.method === 'GET' && route === '/auth/me') {
        const row = getDb().prepare('SELECT id, username, is_admin FROM users WHERE id=?').get(auth.user_id);
        return send(200, true, { user_id: auth.user_id, username: row?.username ?? '', is_admin: !!row?.is_admin, device_id: auth.device_id });
@@ -1,4 +1,4 @@
-import{c as ve,d as Ce,f as pe,r as S,ai as ke,aj as Se,j as e,S as _e,B as A,ak as xe,ah as ze,m as me,H as fe,af as Oe,ag as Ie,v as Me,M as Re}from"./index-CORxj09r.js";import{R as he,P as Fe,C as Ke}from"./rotate-ccw-C86TFS4r.js";/**
+import{c as ve,d as Ce,f as pe,r as S,ai as ke,aj as Se,j as e,S as _e,B as A,ak as xe,ah as ze,m as me,H as fe,af as Oe,ag as Ie,v as Me,M as Re}from"./index-DuP8O2p4.js";import{R as he,P as Fe,C as Ke}from"./rotate-ccw-xltE5Sb1.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1 +1 @@
-import{r as g,f as v,j as t,S as j,t as S}from"./index-CORxj09r.js";import{C as c,a as d,b as x}from"./card-B8inxBNO.js";import{u as N,i as u,a as m}from"./useChart-D8BZn-V6.js";import{u as k,i as w,a as C,b as L,c as R,d as $,e as z,f as T}from"./echarts-BIWefrIc.js";k([w,C,L,R,$,z,T]);function q(){const[l,n]=g.useState(""),i=N(),e=v({queryKey:["stats",l||void 0],queryFn:()=>S(l?Number(l):void 0)}).data,p=u("2"),r=u("3"),h=m(()=>({grid:{left:34,right:12,top:14,bottom:24},tooltip:{trigger:"axis"},xAxis:{type:"category",data:(e==null?void 0:e.monthly.map(a=>a.ym.slice(2)))??[],axisLine:{lineStyle:{color:r}},axisTick:{show:!1},axisLabel:{color:r,fontSize:10}},yAxis:{type:"value",splitLine:{lineStyle:{color:"rgba(128,138,155,0.15)"}},axisLabel:{color:r,fontSize:10}},series:[{type:"bar",data:(e==null?void 0:e.monthly.map(a=>a.count))??[],barMaxWidth:18,itemStyle:{color:"#3056d3",borderRadius:[3,3,0,0]}}]}),[e,i]),b=m(()=>{const a=((e==null?void 0:e.by_type)??[]).filter(s=>s.count>0);return{tooltip:{trigger:"item"},legend:{orient:"vertical",right:4,top:"middle",textStyle:{color:p,fontSize:11},itemWidth:10,itemHeight:10},series:[{type:"pie",radius:["48%","72%"],center:["34%","50%"],label:{show:!1},data:a.map(s=>({name:s.label,value:s.count,itemStyle:{color:s.color||"#64748b"}}))}]}},[e,i]),y=m(()=>{const a=((e==null?void 0:e.by_level)??[]).filter(s=>s.count>0).slice().reverse();return{grid:{left:64,right:24,top:8,bottom:22},tooltip:{trigger:"axis"},xAxis:{type:"value",splitLine:{lineStyle:{color:"rgba(128,138,155,0.15)"}},axisLabel:{color:r,fontSize:10}},yAxis:{type:"category",data:a.map(s=>s.label),axisLine:{show:!1},axisTick:{show:!1},axisLabel:{color:p,fontSize:11}},series:[{type:"bar",data:a.map(s=>({value:s.count,itemStyle:{color:s.color||"#3056d3",borderRadius:[0,3,3,0]}})),barMaxWidth:14}]}},[e,i]),f=((e==null?void 0:e.metrics)??[]).slice(0,3);return t.jsxs("div",{className:"mx-auto max-w-[1080px] px-3 py-4 sm:px-6 sm:py-5",children:[t.jsxs("div",{className:"mb-4 flex flex-wrap items-center justify-between gap-3",children:[t.jsxs("div",{className:"flex flex-wrap gap-3",children:[t.jsx(o,{label:"总记录",value:(e==null?void 0:e.total)??0}),t.jsx(o,{label:l?l+" 年新增":"本年新增",value:(e==null?void 0:e.total_this_year)??0}),t.jsx(o,{label:"附件总数",value:(e==null?void 0:e.attachment_total)??0}),f.map(a=>t.jsx(o,{label:a.label,value:a.value,unit:a.unit??""},a.key))]}),t.jsx(j,{className:"w-[120px]",value:l,onChange:a=>n(a.target.value),options:[{value:"",label:"全部年份"},...((e==null?void 0:e.years)??[]).map(a=>({value:String(a),label:a+" 年"}))]})]}),!(e!=null&&e.metrics.length)&&t.jsx("div",{className:"mb-4 rounded-md border border-dashed border-line px-4 py-2 text-[12px] text-ink-3",children:"提示：在「统计」配置中注册指标（如志愿时长、读书本数），带单位的数值字段即可在此量化展示。"}),t.jsxs("div",{className:"grid grid-cols-1 lg:grid-cols-2 gap-4",children:[t.jsxs(c,{children:[t.jsx(d,{title:"近 12 个月活跃度"}),t.jsx(x,{children:t.jsx("div",{ref:h,className:"h-[220px]"})})]}),t.jsxs(c,{children:[t.jsx(d,{title:"类型分布"}),t.jsx(x,{children:t.jsx("div",{ref:b,className:"h-[220px]"})})]}),t.jsxs(c,{className:"lg:col-span-2",children:[t.jsx(d,{title:"级别分布"}),t.jsx(x,{children:t.jsx("div",{ref:y,className:"h-[200px]"})})]})]})]})}function o({label:l,value:n,unit:i}){return t.jsxs("div",{className:"min-w-[120px] rounded-lg border border-line bg-surface px-4 py-3 shadow-card",children:[t.jsx("div",{className:"text-[12px] text-ink-3",children:l}),t.jsxs("div",{className:"num mt-0.5 text-[22px] font-semibold leading-tight text-ink-1",children:[n,i&&t.jsx("span",{className:"ml-1 text-[12px] font-normal text-ink-3",children:i})]})]})}export{q as DashboardPage};
+import{r as g,f as v,j as t,S as j,t as S}from"./index-DuP8O2p4.js";import{C as c,a as d,b as x}from"./card-DR9dPxFa.js";import{u as N,i as u,a as m}from"./useChart-DtLH1jYK.js";import{u as k,i as w,a as C,b as L,c as R,d as $,e as z,f as T}from"./echarts-BIWefrIc.js";k([w,C,L,R,$,z,T]);function q(){const[l,n]=g.useState(""),i=N(),e=v({queryKey:["stats",l||void 0],queryFn:()=>S(l?Number(l):void 0)}).data,p=u("2"),r=u("3"),h=m(()=>({grid:{left:34,right:12,top:14,bottom:24},tooltip:{trigger:"axis"},xAxis:{type:"category",data:(e==null?void 0:e.monthly.map(a=>a.ym.slice(2)))??[],axisLine:{lineStyle:{color:r}},axisTick:{show:!1},axisLabel:{color:r,fontSize:10}},yAxis:{type:"value",splitLine:{lineStyle:{color:"rgba(128,138,155,0.15)"}},axisLabel:{color:r,fontSize:10}},series:[{type:"bar",data:(e==null?void 0:e.monthly.map(a=>a.count))??[],barMaxWidth:18,itemStyle:{color:"#3056d3",borderRadius:[3,3,0,0]}}]}),[e,i]),b=m(()=>{const a=((e==null?void 0:e.by_type)??[]).filter(s=>s.count>0);return{tooltip:{trigger:"item"},legend:{orient:"vertical",right:4,top:"middle",textStyle:{color:p,fontSize:11},itemWidth:10,itemHeight:10},series:[{type:"pie",radius:["48%","72%"],center:["34%","50%"],label:{show:!1},data:a.map(s=>({name:s.label,value:s.count,itemStyle:{color:s.color||"#64748b"}}))}]}},[e,i]),y=m(()=>{const a=((e==null?void 0:e.by_level)??[]).filter(s=>s.count>0).slice().reverse();return{grid:{left:64,right:24,top:8,bottom:22},tooltip:{trigger:"axis"},xAxis:{type:"value",splitLine:{lineStyle:{color:"rgba(128,138,155,0.15)"}},axisLabel:{color:r,fontSize:10}},yAxis:{type:"category",data:a.map(s=>s.label),axisLine:{show:!1},axisTick:{show:!1},axisLabel:{color:p,fontSize:11}},series:[{type:"bar",data:a.map(s=>({value:s.count,itemStyle:{color:s.color||"#3056d3",borderRadius:[0,3,3,0]}})),barMaxWidth:14}]}},[e,i]),f=((e==null?void 0:e.metrics)??[]).slice(0,3);return t.jsxs("div",{className:"mx-auto max-w-[1080px] px-3 py-4 sm:px-6 sm:py-5",children:[t.jsxs("div",{className:"mb-4 flex flex-wrap items-center justify-between gap-3",children:[t.jsxs("div",{className:"flex flex-wrap gap-3",children:[t.jsx(o,{label:"总记录",value:(e==null?void 0:e.total)??0}),t.jsx(o,{label:l?l+" 年新增":"本年新增",value:(e==null?void 0:e.total_this_year)??0}),t.jsx(o,{label:"附件总数",value:(e==null?void 0:e.attachment_total)??0}),f.map(a=>t.jsx(o,{label:a.label,value:a.value,unit:a.unit??""},a.key))]}),t.jsx(j,{className:"w-[120px]",value:l,onChange:a=>n(a.target.value),options:[{value:"",label:"全部年份"},...((e==null?void 0:e.years)??[]).map(a=>({value:String(a),label:a+" 年"}))]})]}),!(e!=null&&e.metrics.length)&&t.jsx("div",{className:"mb-4 rounded-md border border-dashed border-line px-4 py-2 text-[12px] text-ink-3",children:"提示：在「统计」配置中注册指标（如志愿时长、读书本数），带单位的数值字段即可在此量化展示。"}),t.jsxs("div",{className:"grid grid-cols-1 lg:grid-cols-2 gap-4",children:[t.jsxs(c,{children:[t.jsx(d,{title:"近 12 个月活跃度"}),t.jsx(x,{children:t.jsx("div",{ref:h,className:"h-[220px]"})})]}),t.jsxs(c,{children:[t.jsx(d,{title:"类型分布"}),t.jsx(x,{children:t.jsx("div",{ref:b,className:"h-[220px]"})})]}),t.jsxs(c,{className:"lg:col-span-2",children:[t.jsx(d,{title:"级别分布"}),t.jsx(x,{children:t.jsx("div",{ref:y,className:"h-[200px]"})})]})]})]})}function o({label:l,value:n,unit:i}){return t.jsxs("div",{className:"min-w-[120px] rounded-lg border border-line bg-surface px-4 py-3 shadow-card",children:[t.jsx("div",{className:"text-[12px] text-ink-3",children:l}),t.jsxs("div",{className:"num mt-0.5 text-[22px] font-semibold leading-tight text-ink-1",children:[n,i&&t.jsx("span",{className:"ml-1 text-[12px] font-normal text-ink-3",children:i})]})]})}export{q as DashboardPage};
@@ -1,4 +1,4 @@
-import{c as $,f as O,j as e,E as H,w as U,u as k,d as C,r as u,g as y,x as W,y as J,B as j,P as E,I as g,z as Y,C as A,A as V,D as B,F as X,m as S,l as Q,T as q,H as Z,J as z,K as M,S as T,M as D}from"./index-CORxj09r.js";import{C as w,a as G,b as F}from"./card-B8inxBNO.js";import{u as ee,i as K,a as P}from"./useChart-D8BZn-V6.js";import{u as se,i as te,b as ae,a as re,c as ne,d as le,e as ie,f as oe}from"./echarts-BIWefrIc.js";/**
+import{c as $,f as O,j as e,E as H,w as U,u as k,d as C,r as u,g as y,x as W,y as J,B as j,P as E,I as g,z as Y,C as A,A as V,D as B,F as X,m as S,l as Q,T as q,H as Z,J as z,K as M,S as T,M as D}from"./index-DuP8O2p4.js";import{C as w,a as G,b as F}from"./card-DR9dPxFa.js";import{u as ee,i as K,a as P}from"./useChart-DtLH1jYK.js";import{u as se,i as te,b as ae,a as re,c as ne,d as le,e as ie,f as oe}from"./echarts-BIWefrIc.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1,4 +1,4 @@
-import{c as E,u as P,d as S,r as p,f as q,g as F,j as e,B as f,l as B,ac as L,H as z,J as k,S as M,I as Q,ad as _,ae as K,af as v,ag as T}from"./index-CORxj09r.js";/**
+import{c as E,u as P,d as S,r as p,f as q,g as F,j as e,B as f,l as B,ac as L,H as z,J as k,S as M,I as Q,ad as _,ae as K,af as v,ag as T}from"./index-DuP8O2p4.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1,4 +1,4 @@
-import{c as fe,j as e,a as N,r as s,b as he,u as ve,d as ge,e as je,f as L,g as ye,I as be,S as k,B as w,P as Q,h as te,L as se,G as ae,R as Ne,i as ne,k as ke,l as we,T as Ce,E as le,m as Ee,n as Se,o as _e,C as ze,p as qe,q as Le,s as Re,t as De,v as Ie}from"./index-CORxj09r.js";/**
+import{c as fe,j as e,a as N,r as s,b as he,u as ve,d as ge,e as je,f as L,g as ye,I as be,S as k,B as w,P as Q,h as te,L as se,G as ae,R as Ne,i as ne,k as ke,l as we,T as Ce,E as le,m as Ee,n as Se,o as _e,C as ze,p as qe,q as Le,s as Re,t as De,v as Ie}from"./index-DuP8O2p4.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1,4 +1,4 @@
-import{c as B,d as ve,f as te,r as E,j as e,B as R,ah as Ne,af as L,J as U,S as se,ad as ce,P as q,H as we,a9 as Ce,T as ne,I as W,ag as Se,v as _e}from"./index-CORxj09r.js";import{C as ie,a as ae,b as re}from"./card-B8inxBNO.js";import{R as le,P as ze,C as Re}from"./rotate-ccw-C86TFS4r.js";/**
+import{c as B,d as ve,f as te,r as E,j as e,B as R,ah as Ne,af as L,J as U,S as se,ad as ce,P as q,H as we,a9 as Ce,T as ne,I as W,ag as Se,v as _e}from"./index-DuP8O2p4.js";import{C as ie,a as ae,b as re}from"./card-DR9dPxFa.js";import{R as le,P as ze,C as Re}from"./rotate-ccw-xltE5Sb1.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1,4 +1,4 @@
-import{c as D,u as K,d as I,f as L,r,g as q,j as e,B as p,P as F,N as O,m as _,l as H,T as P,C as R,O as G,H as J,J as i,I as j,Q as U,S as z,U as V,V as W,q as X}from"./index-CORxj09r.js";import{C as Y}from"./card-B8inxBNO.js";/**
+import{c as D,u as K,d as I,f as L,r,g as q,j as e,B as p,P as F,N as O,m as _,l as H,T as P,C as R,O as G,H as J,J as i,I as j,Q as U,S as z,U as V,V as W,q as X}from"./index-DuP8O2p4.js";import{C as Y}from"./card-DR9dPxFa.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1 +1 @@
-import{j as s,a}from"./index-CORxj09r.js";function i({className:r,...e}){return s.jsx("div",{className:a("rounded-lg border border-line bg-surface shadow-card",r),...e})}function t({title:r,extra:e,className:n}){return s.jsxs("div",{className:a("flex min-h-11 flex-wrap items-center justify-between gap-2 border-b border-line px-4 py-1.5",n),children:[s.jsx("h3",{className:"text-[13px] font-semibold text-ink-1",children:r}),e&&s.jsx("div",{className:"flex flex-wrap items-center gap-2",children:e})]})}function c({className:r,...e}){return s.jsx("div",{className:a("p-4",r),...e})}export{i as C,t as a,c as b};
+import{j as s,a}from"./index-DuP8O2p4.js";function i({className:r,...e}){return s.jsx("div",{className:a("rounded-lg border border-line bg-surface shadow-card",r),...e})}function t({title:r,extra:e,className:n}){return s.jsxs("div",{className:a("flex min-h-11 flex-wrap items-center justify-between gap-2 border-b border-line px-4 py-1.5",n),children:[s.jsx("h3",{className:"text-[13px] font-semibold text-ink-1",children:r}),e&&s.jsx("div",{className:"flex flex-wrap items-center gap-2",children:e})]})}function c({className:r,...e}){return s.jsx("div",{className:a("p-4",r),...e})}export{i as C,t as a,c as b};
@@ -1,4 +1,4 @@
-import{c as t}from"./index-CORxj09r.js";/**
+import{c as t}from"./index-DuP8O2p4.js";/**
 * @license lucide-react v0.475.0 - ISC
 *
 * This source code is licensed under the ISC license.
@@ -1 +1 @@
-import{r}from"./index-CORxj09r.js";import{g as f}from"./echarts-BIWefrIc.js";function p(){const[n,o]=r.useState(0);return r.useEffect(()=>{const s=()=>o(t=>t+1);return window.addEventListener("fp-theme-change",s),()=>window.removeEventListener("fp-theme-change",s)},[]),n}function d(n){return getComputedStyle(document.documentElement).getPropertyValue("--text-"+n).trim()||"#454e5c"}function h(n,o){const s=r.useRef(null),[t,i]=r.useState(null),u=r.useRef(n);return u.current=n,r.useEffect(()=>{if(!t)return;const e=f(t);s.current=e,e.setOption(u.current(),{notMerge:!0});const c=new ResizeObserver(()=>e.resize());return c.observe(t),()=>{c.disconnect(),e.dispose(),s.current=null}},[t]),r.useEffect(()=>{var e;(e=s.current)==null||e.setOption(u.current(),{notMerge:!0})},[t,...o]),e=>i(e)}export{h as a,d as i,p as u};
+import{r}from"./index-DuP8O2p4.js";import{g as f}from"./echarts-BIWefrIc.js";function p(){const[n,o]=r.useState(0);return r.useEffect(()=>{const s=()=>o(t=>t+1);return window.addEventListener("fp-theme-change",s),()=>window.removeEventListener("fp-theme-change",s)},[]),n}function d(n){return getComputedStyle(document.documentElement).getPropertyValue("--text-"+n).trim()||"#454e5c"}function h(n,o){const s=r.useRef(null),[t,i]=r.useState(null),u=r.useRef(n);return u.current=n,r.useEffect(()=>{if(!t)return;const e=f(t);s.current=e,e.setOption(u.current(),{notMerge:!0});const c=new ResizeObserver(()=>e.resize());return c.observe(t),()=>{c.disconnect(),e.dispose(),s.current=null}},[t]),r.useEffect(()=>{var e;(e=s.current)==null||e.setOption(u.current(),{notMerge:!0})},[t,...o]),e=>i(e)}export{h as a,d as i,p as u};
@@ -9,7 +9,7 @@
    <link rel="icon" href="/icons/pwa-192.png" />
    <link rel="apple-touch-icon" href="/icons/pwa-192.png" />
    <title>足迹 Footprints</title>
-    <script type="module" crossorigin src="/assets/index-CORxj09r.js"></script>
+    <script type="module" crossorigin src="/assets/index-DuP8O2p4.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/index-D9E2kUSE.css">
  </head>
  <body>