
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@deppon/deppon-auth
Advanced tools
@deppon/deppon-auth登录与权限管理包,提供登录守卫、路由解析,以及京 ME(JingME)客户端授权能力。
requestAuthCode 授权(兼容 jm-clues)authMode: 'cookie' | 'jingme' | 'auto'npm install @deppon/deppon-auth
京 ME 场景建议同时安装 SDK(可选 peer):
npm install @jd/jme-sdk-adapter
import { createDepponRouter } from '@deppon/deppon-router';
import { createAuthGuard } from '@deppon/deppon-auth';
const router = createDepponRouter({
routes,
guards: {
beforeEach: createAuthGuard({
cookieKeys: ['TGC', '_TOKENUUMS', 'U'],
checkLogin: cookies => !!(cookies.TGC && cookies._TOKENUUMS),
onRequireLogin: () => {
window.location.href = BASE_API + 'login/login.action';
},
whiteList: ['/login', '/404'],
}),
},
});
import JMESDK from '@jd/jme-sdk-adapter';
import { createAuthGuard, isInJingme } from '@deppon/deppon-auth';
createAuthGuard({
// auto:在京 ME 内走京 ME 授权,否则走 Cookie 登录
authMode: 'auto',
jingmeAuth: {
appKey: 'your-app-key',
sdk: JMESDK,
// 兼容 jm-clues:把授权码直接当作 accessToken
useAuthCodeAsToken: true,
},
cookieKeys: ['TGC', '_TOKENUUMS', 'U'],
checkLogin: cookies => !!(cookies.TGC && cookies._TOKENUUMS),
onRequireLogin: () => {
window.location.href = BASE_API + 'login/login.action';
},
onJingmeLoggedIn: result => {
console.log('京 ME 登录完成', result, isInJingme());
},
});
仅京 ME 场景:
createAuthGuard({
authMode: 'jingme',
jingmeAuth: {
appKey: 'your-app-key',
sdk: JMESDK,
},
});
适合 H5 微应用(如 jm-clues)在 axios 拦截器里等待登录完成:
import JMESDK from '@jd/jme-sdk-adapter';
import {
isInJingme,
initJingmeAuth,
waitForJingmeAccessToken,
getJingmeAccessToken,
injectJingmeIdentity,
} from '@deppon/deppon-auth';
if (isInJingme()) {
initJingmeAuth({
appKey: 'r5qDa7istcFJJ3mtEcoN',
sdk: JMESDK,
useAuthCodeAsToken: true,
swallowError: true,
});
}
await waitForJingmeAccessToken();
const userId = getJingmeAccessToken();
axios.interceptors.request.use(async config => {
await waitForJingmeAccessToken();
return injectJingmeIdentity(config, { platform: 'jm' });
});
环境判定规则(任一命中即为 true):
JDME / JingME / JoyME / JM_PC 等appId=jdme(兼容历史业务)window.jmeSdk / JMESDK.requestAuthCode)import { resolveRoutes } from '@deppon/deppon-auth';
const routes = resolveRoutes(menuTree, {
componentResolver: path => () => import(`@/views/${path}.vue`),
skipNoComponent: true,
});
import { getToken, getCookies, parseToken, parseTokenJSON, base64Decode } from '@deppon/deppon-auth';
| API | 说明 |
|---|---|
isInJingme() | 是否在京 ME 环境 |
initJingmeAuth(options) | 初始化京 ME 授权(单例) |
waitForJingmeAccessToken() | 等待授权完成 |
getJingmeAccessToken() | 读取当前 token |
injectJingmeIdentity(config) | 给请求配置注入身份字段 |
createAuthGuard(options) | 登录守卫,支持 authMode |
resolveRoutes(menuTree, options) | 菜单转路由 |
getToken / parseToken | Cookie / Token 工具 |
initJingmeAuth 主要选项:
appKey - 京 ME 应用 keysdk - JMESDK 实例useAuthCodeAsToken - 把授权码当 token(默认 true,兼容 jm-clues)exchangeAccessToken - 完整三步换票(默认 false)outsideJingme - skip | error(默认 skip)swallowError - 失败是否吞错(默认 true)checkLogin / onRequireLogin@jd/jme-sdk-adapter 为可选 peer,业务侧自行安装并传入 sdkauthMode: 'auto' 可同时兼容 PC Cookie 登录与京 ME 内打开MIT
FAQs
Login and permission management package
The npm package @deppon/deppon-auth receives a total of 225 weekly downloads. As such, @deppon/deppon-auth popularity was classified as not popular.
We found that @deppon/deppon-auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.