重写

src/components/auth/AuthGate.test.tsx

@@ -125,6 +125,21 @@ test('auth gate keeps platform content visible when phone login is available', a
   expect(authMocks.ensureAutoAuthUser).not.toHaveBeenCalled();
 });
 
+test('auth gate does not auto-create a guest account when dev guest switch is not explicitly enabled', async () => {
+  authMocks.getAuthLoginOptions.mockResolvedValue({
+    availableLoginMethods: [],
+  });
+
+  render(
+    <AuthGate>
+      <div>应用内容</div>
+    </AuthGate>,
+  );
+
+  expect(await screen.findByText('应用内容')).toBeTruthy();
+  expect(authMocks.ensureAutoAuthUser).not.toHaveBeenCalled();
+});
+
 test('auth gate opens a login modal for protected actions and resumes after login', async () => {
   const user = userEvent.setup();
   const onAuthenticated = vi.fn();
@@ -159,3 +174,39 @@ test('auth gate opens a login modal for protected actions and resumes after logi
 
   expect(screen.queryByRole('dialog', { name: '登录账号' })).toBeNull();
 });
+
+test('auth gate shows sms send feedback in the login modal', async () => {
+  const user = userEvent.setup();
+
+  authMocks.getAuthLoginOptions.mockResolvedValue({
+    availableLoginMethods: ['phone'],
+  });
+
+  render(
+    <AuthGate>
+      <ProtectedActionButton onAuthenticated={vi.fn()} />
+    </AuthGate>,
+  );
+
+  await user.click(await screen.findByRole('button', { name: '进入作品' }));
+
+  const dialog = screen.getByRole('dialog', { name: '登录账号' });
+  await user.type(within(dialog).getByLabelText('手机号'), '13800000000');
+  await user.click(within(dialog).getByRole('button', { name: '获取验证码' }));
+
+  await waitFor(() => {
+    expect(authMocks.sendPhoneLoginCode).toHaveBeenCalledWith(
+      '13800000000',
+      'login',
+      {
+        challengeId: undefined,
+        answer: '',
+      },
+    );
+  });
+
+  expect(
+    within(dialog).getByText('验证码已发送，有效期约 5 分钟。'),
+  ).toBeTruthy();
+  expect(within(dialog).getByRole('button', { name: '60s' })).toBeTruthy();
+});

src/components/auth/AuthGate.tsx

@@ -59,7 +59,8 @@ type AuthStatus =
 
 const allowDevGuestAutoAuth =
   import.meta.env.DEV &&
-  import.meta.env.VITE_AUTH_ALLOW_DEV_GUEST !== 'false';
+  // 开发游客兜底必须显式开启，避免抢占正式手机号验证码登录入口。
+  import.meta.env.VITE_AUTH_ALLOW_DEV_GUEST === 'true';
 
 export function AuthGate({ children }: AuthGateProps) {
   const [status, setStatus] = useState<AuthStatus>('checking');

src/components/auth/LoginScreen.tsx

@@ -50,6 +50,7 @@ export function LoginScreen({
   const [code, setCode] = useState('');
   const [captchaAnswer, setCaptchaAnswer] = useState('');
   const [cooldownSeconds, setCooldownSeconds] = useState(0);
+  const [hint, setHint] = useState('');
   const phoneLoginEnabled = availableLoginMethods.includes('phone');
   const wechatLoginEnabled = availableLoginMethods.includes('wechat');
 
@@ -142,12 +143,16 @@ export function LoginScreen({
                     className="platform-button platform-button--secondary h-12 shrink-0 px-4 text-sm disabled:cursor-not-allowed disabled:opacity-55"
                     onClick={() => {
                       void (async () => {
+                        setHint('');
                         try {
                           const result = await onSendCode(phone, {
                             challengeId: captchaChallenge?.challengeId,
                             answer: captchaAnswer,
                           });
                           setCooldownSeconds(result.cooldownSeconds);
+                          setHint(
+                            `验证码已发送，有效期约 ${Math.max(1, Math.round(result.expiresInSeconds / 60))} 分钟。`,
+                          );
                           setCaptchaAnswer('');
                         } catch {
                           // Error state is handled by the parent.
@@ -169,6 +174,12 @@ export function LoginScreen({
                 answer={captchaAnswer}
                 onAnswerChange={setCaptchaAnswer}
               />
+
+              {hint ? (
+                <div className="platform-banner platform-banner--success text-sm">
+                  {hint}
+                </div>
+              ) : null}
             </>
           ) : null}
 

src/services/apiClient.test.ts

@@ -175,6 +175,26 @@ describe('apiClient', () => {
     expect(window.dispatchEvent).not.toHaveBeenCalled();
   });
 
+  it('keeps the current access token when a public request explicitly skips auth', async () => {
+    setStoredAccessToken('still-valid-token');
+    vi.mocked(window.dispatchEvent).mockClear();
+    fetchMock.mockResolvedValueOnce(createResponseMock({ status: 401 }));
+
+    const response = await fetchWithApiAuth(
+      '/api/runtime/custom-world-gallery',
+      { method: 'GET' },
+      {
+        skipAuth: true,
+        skipRefresh: true,
+      },
+    );
+
+    expect(response.status).toBe(401);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(getStoredAccessToken()).toBe('still-valid-token');
+    expect(window.dispatchEvent).not.toHaveBeenCalled();
+  });
+
   it('retries transient get requests before unwrapping the response envelope', async () => {
     fetchMock
       .mockRejectedValueOnce(new TypeError('network unavailable'))

src/services/apiClient.ts

@@ -518,7 +518,8 @@ export async function fetchWithApiAuth(
         } catch {
           clearStoredAccessToken();
         }
-      } else if (response.status === 401) {
+      } else if (response.status === 401 && hasAuthHeader && !options.skipAuth) {
+        // 公开只读请求不能因为服务端异常 401 顺手把正式登录态清空。
         clearStoredAccessToken();
       }
 

src/spacetime/generated/bind_asset_object_to_entity_and_return_procedure.ts

@@ -0,0 +1,23 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import {
+  TypeBuilder as __TypeBuilder,
+  t as __t,
+  type AlgebraicTypeType as __AlgebraicTypeType,
+  type Infer as __Infer,
+} from "spacetimedb";
+
+import {
+  AssetEntityBindingInput,
+  AssetEntityBindingProcedureResult,
+} from "./types";
+
+export const params = {
+  get input() {
+    return AssetEntityBindingInput;
+  },
+};
+export const returnType = AssetEntityBindingProcedureResult

src/spacetime/generated/bind_asset_object_to_entity_reducer.ts

@@ -0,0 +1,21 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import {
+  TypeBuilder as __TypeBuilder,
+  t as __t,
+  type AlgebraicTypeType as __AlgebraicTypeType,
+  type Infer as __Infer,
+} from "spacetimedb";
+
+import {
+  AssetEntityBindingInput,
+} from "./types";
+
+export default {
+  get input() {
+    return AssetEntityBindingInput;
+  },
+};

src/spacetime/generated/confirm_asset_object_and_return_procedure.ts

@@ -0,0 +1,23 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import {
+  TypeBuilder as __TypeBuilder,
+  t as __t,
+  type AlgebraicTypeType as __AlgebraicTypeType,
+  type Infer as __Infer,
+} from "spacetimedb";
+
+import {
+  AssetObjectUpsertInput,
+  AssetObjectProcedureResult,
+} from "./types";
+
+export const params = {
+  get input() {
+    return AssetObjectUpsertInput;
+  },
+};
+export const returnType = AssetObjectProcedureResult

src/spacetime/generated/confirm_asset_object_reducer.ts

@@ -0,0 +1,21 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import {
+  TypeBuilder as __TypeBuilder,
+  t as __t,
+  type AlgebraicTypeType as __AlgebraicTypeType,
+  type Infer as __Infer,
+} from "spacetimedb";
+
+import {
+  AssetObjectUpsertInput,
+} from "./types";
+
+export default {
+  get input() {
+    return AssetObjectUpsertInput;
+  },
+};

src/spacetime/generated/index.ts

@@ -0,0 +1,113 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+// This was generated using spacetimedb cli version 2.1.0 (commit 6981f48b4bc1a71c8dd9bdfe5a2c343f6370243d).
+
+/* eslint-disable */
+/* tslint:disable */
+import {
+  DbConnectionBuilder as __DbConnectionBuilder,
+  DbConnectionImpl as __DbConnectionImpl,
+  SubscriptionBuilderImpl as __SubscriptionBuilderImpl,
+  TypeBuilder as __TypeBuilder,
+  Uuid as __Uuid,
+  convertToAccessorMap as __convertToAccessorMap,
+  makeQueryBuilder as __makeQueryBuilder,
+  procedureSchema as __procedureSchema,
+  procedures as __procedures,
+  reducerSchema as __reducerSchema,
+  reducers as __reducers,
+  schema as __schema,
+  t as __t,
+  table as __table,
+  type AlgebraicTypeType as __AlgebraicTypeType,
+  type DbConnectionConfig as __DbConnectionConfig,
+  type ErrorContextInterface as __ErrorContextInterface,
+  type Event as __Event,
+  type EventContextInterface as __EventContextInterface,
+  type Infer as __Infer,
+  type QueryBuilder as __QueryBuilder,
+  type ReducerEventContextInterface as __ReducerEventContextInterface,
+  type RemoteModule as __RemoteModule,
+  type SubscriptionEventContextInterface as __SubscriptionEventContextInterface,
+  type SubscriptionHandleImpl as __SubscriptionHandleImpl,
+} from "spacetimedb";
+
+// Import all reducer arg schemas
+import BindAssetObjectToEntityReducer from "./bind_asset_object_to_entity_reducer";
+import ConfirmAssetObjectReducer from "./confirm_asset_object_reducer";
+
+// Import all procedure arg schemas
+import * as BindAssetObjectToEntityAndReturnProcedure from "./bind_asset_object_to_entity_and_return_procedure";
+import * as ConfirmAssetObjectAndReturnProcedure from "./confirm_asset_object_and_return_procedure";
+
+// Import all table schema definitions
+
+/** Type-only namespace exports for generated type groups. */
+
+/** The schema information for all tables in this module. This is defined the same was as the tables would have been defined in the server. */
+const tablesSchema = __schema({
+});
+
+/** The schema information for all reducers in this module. This is defined the same way as the reducers would have been defined in the server, except the body of the reducer is omitted in code generation. */
+const reducersSchema = __reducers(
+  __reducerSchema("bind_asset_object_to_entity", BindAssetObjectToEntityReducer),
+  __reducerSchema("confirm_asset_object", ConfirmAssetObjectReducer),
+);
+
+/** The schema information for all procedures in this module. This is defined the same way as the procedures would have been defined in the server. */
+const proceduresSchema = __procedures(
+  __procedureSchema("bind_asset_object_to_entity_and_return", BindAssetObjectToEntityAndReturnProcedure.params, BindAssetObjectToEntityAndReturnProcedure.returnType),
+  __procedureSchema("confirm_asset_object_and_return", ConfirmAssetObjectAndReturnProcedure.params, ConfirmAssetObjectAndReturnProcedure.returnType),
+);
+
+/** The remote SpacetimeDB module schema, both runtime and type information. */
+const REMOTE_MODULE = {
+  versionInfo: {
+    cliVersion: "2.1.0" as const,
+  },
+  tables: tablesSchema.schemaType.tables,
+  reducers: reducersSchema.reducersType.reducers,
+  ...proceduresSchema,
+} satisfies __RemoteModule<
+  typeof tablesSchema.schemaType,
+  typeof reducersSchema.reducersType,
+  typeof proceduresSchema
+>;
+
+/** The tables available in this remote SpacetimeDB module. Each table reference doubles as a query builder. */
+export const tables: __QueryBuilder<typeof tablesSchema.schemaType> = __makeQueryBuilder(tablesSchema.schemaType);
+
+/** The reducers available in this remote SpacetimeDB module. */
+export const reducers = __convertToAccessorMap(reducersSchema.reducersType.reducers);
+
+/** The context type returned in callbacks for all possible events. */
+export type EventContext = __EventContextInterface<typeof REMOTE_MODULE>;
+/** The context type returned in callbacks for reducer events. */
+export type ReducerEventContext = __ReducerEventContextInterface<typeof REMOTE_MODULE>;
+/** The context type returned in callbacks for subscription events. */
+export type SubscriptionEventContext = __SubscriptionEventContextInterface<typeof REMOTE_MODULE>;
+/** The context type returned in callbacks for error events. */
+export type ErrorContext = __ErrorContextInterface<typeof REMOTE_MODULE>;
+/** The subscription handle type to manage active subscriptions created from a {@link SubscriptionBuilder}. */
+export type SubscriptionHandle = __SubscriptionHandleImpl<typeof REMOTE_MODULE>;
+
+/** Builder class to configure a new subscription to the remote SpacetimeDB instance. */
+export class SubscriptionBuilder extends __SubscriptionBuilderImpl<typeof REMOTE_MODULE> {}
+
+/** Builder class to configure a new database connection to the remote SpacetimeDB instance. */
+export class DbConnectionBuilder extends __DbConnectionBuilder<DbConnection> {}
+
+/** The typed database connection to manage connections to the remote SpacetimeDB instance. This class has type information specific to the generated module. */
+export class DbConnection extends __DbConnectionImpl<typeof REMOTE_MODULE> {
+  /** Creates a new {@link DbConnectionBuilder} to configure and connect to the remote SpacetimeDB instance. */
+  static builder = (): DbConnectionBuilder => {
+    return new DbConnectionBuilder(REMOTE_MODULE, (config: __DbConnectionConfig<typeof REMOTE_MODULE>) => new DbConnection(config));
+  };
+
+  /** Creates a new {@link SubscriptionBuilder} to configure a subscription to the remote SpacetimeDB instance. */
+  override subscriptionBuilder = (): SubscriptionBuilder => {
+    return new SubscriptionBuilder(this);
+  };
+}
+

src/spacetime/generated/types.ts

@@ -0,0 +1,140 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import {
+  TypeBuilder as __TypeBuilder,
+  t as __t,
+  type AlgebraicTypeType as __AlgebraicTypeType,
+  type Infer as __Infer,
+} from "spacetimedb";
+
+export const AssetEntityBinding = __t.object("AssetEntityBinding", {
+  bindingId: __t.string(),
+  assetObjectId: __t.string(),
+  entityKind: __t.string(),
+  entityId: __t.string(),
+  slot: __t.string(),
+  assetKind: __t.string(),
+  ownerUserId: __t.option(__t.string()),
+  profileId: __t.option(__t.string()),
+  createdAt: __t.timestamp(),
+  updatedAt: __t.timestamp(),
+});
+export type AssetEntityBinding = __Infer<typeof AssetEntityBinding>;
+
+export const AssetEntityBindingInput = __t.object("AssetEntityBindingInput", {
+  bindingId: __t.string(),
+  assetObjectId: __t.string(),
+  entityKind: __t.string(),
+  entityId: __t.string(),
+  slot: __t.string(),
+  assetKind: __t.string(),
+  ownerUserId: __t.option(__t.string()),
+  profileId: __t.option(__t.string()),
+  updatedAtMicros: __t.i64(),
+});
+export type AssetEntityBindingInput = __Infer<typeof AssetEntityBindingInput>;
+
+export const AssetEntityBindingProcedureResult = __t.object("AssetEntityBindingProcedureResult", {
+  ok: __t.bool(),
+  get record() {
+    return __t.option(AssetEntityBindingSnapshot);
+  },
+  errorMessage: __t.option(__t.string()),
+});
+export type AssetEntityBindingProcedureResult = __Infer<typeof AssetEntityBindingProcedureResult>;
+
+export const AssetEntityBindingSnapshot = __t.object("AssetEntityBindingSnapshot", {
+  bindingId: __t.string(),
+  assetObjectId: __t.string(),
+  entityKind: __t.string(),
+  entityId: __t.string(),
+  slot: __t.string(),
+  assetKind: __t.string(),
+  ownerUserId: __t.option(__t.string()),
+  profileId: __t.option(__t.string()),
+  createdAtMicros: __t.i64(),
+  updatedAtMicros: __t.i64(),
+});
+export type AssetEntityBindingSnapshot = __Infer<typeof AssetEntityBindingSnapshot>;
+
+export const AssetObject = __t.object("AssetObject", {
+  assetObjectId: __t.string(),
+  bucket: __t.string(),
+  objectKey: __t.string(),
+  get accessPolicy() {
+    return AssetObjectAccessPolicy;
+  },
+  contentType: __t.option(__t.string()),
+  contentLength: __t.u64(),
+  contentHash: __t.option(__t.string()),
+  version: __t.u32(),
+  sourceJobId: __t.option(__t.string()),
+  ownerUserId: __t.option(__t.string()),
+  profileId: __t.option(__t.string()),
+  entityId: __t.option(__t.string()),
+  assetKind: __t.string(),
+  createdAt: __t.timestamp(),
+  updatedAt: __t.timestamp(),
+});
+export type AssetObject = __Infer<typeof AssetObject>;
+
+// The tagged union or sum type for the algebraic type `AssetObjectAccessPolicy`.
+export const AssetObjectAccessPolicy = __t.enum("AssetObjectAccessPolicy", {
+  Private: __t.unit(),
+  PublicRead: __t.unit(),
+});
+export type AssetObjectAccessPolicy = __Infer<typeof AssetObjectAccessPolicy>;
+
+export const AssetObjectProcedureResult = __t.object("AssetObjectProcedureResult", {
+  ok: __t.bool(),
+  get record() {
+    return __t.option(AssetObjectUpsertSnapshot);
+  },
+  errorMessage: __t.option(__t.string()),
+});
+export type AssetObjectProcedureResult = __Infer<typeof AssetObjectProcedureResult>;
+
+export const AssetObjectUpsertInput = __t.object("AssetObjectUpsertInput", {
+  assetObjectId: __t.string(),
+  bucket: __t.string(),
+  objectKey: __t.string(),
+  get accessPolicy() {
+    return AssetObjectAccessPolicy;
+  },
+  contentType: __t.option(__t.string()),
+  contentLength: __t.u64(),
+  contentHash: __t.option(__t.string()),
+  version: __t.u32(),
+  sourceJobId: __t.option(__t.string()),
+  ownerUserId: __t.option(__t.string()),
+  profileId: __t.option(__t.string()),
+  entityId: __t.option(__t.string()),
+  assetKind: __t.string(),
+  updatedAtMicros: __t.i64(),
+});
+export type AssetObjectUpsertInput = __Infer<typeof AssetObjectUpsertInput>;
+
+export const AssetObjectUpsertSnapshot = __t.object("AssetObjectUpsertSnapshot", {
+  assetObjectId: __t.string(),
+  bucket: __t.string(),
+  objectKey: __t.string(),
+  get accessPolicy() {
+    return AssetObjectAccessPolicy;
+  },
+  contentType: __t.option(__t.string()),
+  contentLength: __t.u64(),
+  contentHash: __t.option(__t.string()),
+  version: __t.u32(),
+  sourceJobId: __t.option(__t.string()),
+  ownerUserId: __t.option(__t.string()),
+  profileId: __t.option(__t.string()),
+  entityId: __t.option(__t.string()),
+  assetKind: __t.string(),
+  createdAtMicros: __t.i64(),
+  updatedAtMicros: __t.i64(),
+});
+export type AssetObjectUpsertSnapshot = __Infer<typeof AssetObjectUpsertSnapshot>;
+

src/spacetime/generated/types/procedures.ts

@@ -0,0 +1,16 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import { type Infer as __Infer } from "spacetimedb";
+
+// Import all procedure arg schemas
+import * as BindAssetObjectToEntityAndReturnProcedure from "../bind_asset_object_to_entity_and_return_procedure";
+import * as ConfirmAssetObjectAndReturnProcedure from "../confirm_asset_object_and_return_procedure";
+
+export type BindAssetObjectToEntityAndReturnArgs = __Infer<typeof BindAssetObjectToEntityAndReturnProcedure.params>;
+export type BindAssetObjectToEntityAndReturnResult = __Infer<typeof BindAssetObjectToEntityAndReturnProcedure.returnType>;
+export type ConfirmAssetObjectAndReturnArgs = __Infer<typeof ConfirmAssetObjectAndReturnProcedure.params>;
+export type ConfirmAssetObjectAndReturnResult = __Infer<typeof ConfirmAssetObjectAndReturnProcedure.returnType>;
+

src/spacetime/generated/types/reducers.ts

@@ -0,0 +1,14 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+/* eslint-disable */
+/* tslint:disable */
+import { type Infer as __Infer } from "spacetimedb";
+
+// Import all reducer arg schemas
+import BindAssetObjectToEntityReducer from "../bind_asset_object_to_entity_reducer";
+import ConfirmAssetObjectReducer from "../confirm_asset_object_reducer";
+
+export type BindAssetObjectToEntityParams = __Infer<typeof BindAssetObjectToEntityReducer>;
+export type ConfirmAssetObjectParams = __Infer<typeof ConfirmAssetObjectReducer>;
+