feat: add ProxySettingsForm component and related functionality

- Implemented ProxySettingsForm.vue to manage proxy settings including enabling/disabling proxy, manual settings, and bypass entries.
- Created useProxySettings composable to handle proxy settings logic, validation, and state management.
- Added network.vue page to integrate ProxySettingsForm into the settings layout.
- Defined types for proxy settings in proxy-settings.ts to ensure type safety across the application.

Author: Halo1236

i18n/locales/en.json

@@ -69,6 +69,64 @@
   "Operation": {
     "Search": "Search"
   },
+  "Proxy": {
+    "Title": "Network proxy",
+    "ScopeIncluded": "The proxy applies only to JumpServer API and background OAuth requests.",
+    "ScopeExcluded": "The system browser and external SSH, RDP, VNC, and database clients are not affected.",
+    "Loading": "Loading proxy settings",
+    "LoadFailed": "Could not load proxy settings",
+    "ConfigRecovered": "Proxy settings were safely recovered to Direct",
+    "Retry": "Retry",
+    "EnableProxy": "Enable proxy",
+    "EnabledDescription": "JumpServer API and background OAuth requests use the proxy configured below.",
+    "DisabledDescription": "The proxy is off. Supported requests connect directly to JumpServer.",
+    "ManualSettings": "Proxy settings",
+    "ProxyType": "Proxy type",
+    "Host": "Host",
+    "HostPlaceholder": "proxy.example.com or IP address",
+    "Port": "Port",
+    "Username": "Username",
+    "Password": "Password",
+    "Optional": "Optional",
+    "PasswordSaved": "Saved",
+    "PasswordKeepPlaceholder": "Leave blank to keep saved password",
+    "PasswordKeepHint": "The password is never displayed. Leave this blank to keep the saved password.",
+    "PasswordOptionalHint": "Username and password must either both be set or both be empty.",
+    "PasswordWillClear": "The saved password will be deleted when you save.",
+    "ClearPassword": "Clear saved password",
+    "ClearPasswordHint": "Clear the username as well before saving a proxy without authentication.",
+    "Bypass": "Bypass list",
+    "BypassDescription": "Enter one host, domain, IP, or CIDR per line or separate entries with commas. Local addresses always bypass the proxy.",
+    "BypassPlaceholder": "localhost\n127.0.0.0/8\n.internal.example.com",
+    "TestTitle": "Connection test",
+    "TestDescription": "Enter a JumpServer site origin. The app requests a fixed well-known endpoint. When the proxy is enabled, a target matched by the bypass list is not treated as a successful proxy test.",
+    "TargetUrl": "JumpServer site address",
+    "TestConnection": "Test connection",
+    "TestSucceeded": "Connection succeeded",
+    "TestFailed": "Connection failed",
+    "Save": "Save",
+    "SaveSucceeded": "Saved and confirmed by the backend",
+    "SaveFailedWithReason": "Save failed: {reason}",
+    "ReadbackFailedWithReason": "The settings were submitted, but backend confirmation failed: {reason}",
+    "Errors": {
+      "HostRequired": "Enter the proxy host.",
+      "HostTooLong": "The proxy host cannot exceed 255 characters.",
+      "InvalidHost": "Enter a host name or IP address without a scheme, path, or credentials.",
+      "InvalidPort": "Port must be an integer from 1 to 65535.",
+      "UsernameTooLong": "The username cannot exceed 256 characters.",
+      "PasswordTooLong": "The password cannot exceed 1024 characters.",
+      "UsernameRequired": "A saved password requires a username. To use no authentication, clear the password too.",
+      "PasswordRequired": "A password is required when a username is set.",
+      "InvalidBypass": "Bypass entries cannot contain a scheme, credentials, spaces, query parameters, or fragments.",
+      "BypassTextTooLong": "The bypass list cannot exceed 32768 characters.",
+      "TooManyBypassEntries": "The bypass list can contain at most 128 entries.",
+      "BypassEntryTooLong": "Each bypass entry cannot exceed 255 characters.",
+      "TargetRequired": "Enter a JumpServer site address.",
+      "TargetTooLong": "The JumpServer site address cannot exceed 2048 characters.",
+      "FixFields": "Fix the highlighted fields before saving.",
+      "InvalidTargetOrigin": "Enter an http/https origin with only a host and optional port. Paths, queries, fragments, and credentials are not allowed."
+    }
+  },
   "Transcode": {
     "Title": "Replay Transcode",
     "Description": "Choose one or multiple .tar recording archive files for MP4 conversion.",

i18n/locales/zh.json

@@ -69,6 +69,64 @@
   "Operation": {
     "Search": "搜索"
   },
+  "Proxy": {
+    "Title": "网络代理",
+    "ScopeIncluded": "代理仅用于 JumpServer API 和 OAuth 后台请求。",
+    "ScopeExcluded": "系统浏览器以及外部 SSH、RDP、VNC 和数据库客户端不受此设置影响。",
+    "Loading": "正在读取代理设置",
+    "LoadFailed": "无法读取代理设置",
+    "ConfigRecovered": "代理配置已安全恢复为直连",
+    "Retry": "重试",
+    "EnableProxy": "启用代理",
+    "EnabledDescription": "JumpServer API 和 OAuth 后台请求将使用下方配置的代理。",
+    "DisabledDescription": "代理已关闭，相关请求将直接连接 JumpServer。",
+    "ManualSettings": "代理配置",
+    "ProxyType": "代理类型",
+    "Host": "主机",
+    "HostPlaceholder": "proxy.example.com 或 IP 地址",
+    "Port": "端口",
+    "Username": "用户名",
+    "Password": "密码",
+    "Optional": "可选",
+    "PasswordSaved": "已保存",
+    "PasswordKeepPlaceholder": "留空保持已保存的密码",
+    "PasswordKeepHint": "密码不会回显；留空将继续使用已保存的密码。",
+    "PasswordOptionalHint": "用户名和密码必须同时填写或同时留空。",
+    "PasswordWillClear": "保存后将删除已保存的密码。",
+    "ClearPassword": "清除已保存的密码",
+    "ClearPasswordHint": "必须同时清空用户名，才能保存无认证代理。",
+    "Bypass": "绕过列表",
+    "BypassDescription": "每行或逗号分隔一个主机、域名、IP 或 CIDR；本机地址始终绕过代理。",
+    "BypassPlaceholder": "localhost\n127.0.0.0/8\n.internal.example.com",
+    "TestTitle": "连接测试",
+    "TestDescription": "输入 JumpServer 站点 origin，应用会请求固定的 well-known 端点。代理开启时，命中绕过列表不会被视为代理测试成功。",
+    "TargetUrl": "JumpServer 站点地址",
+    "TestConnection": "测试连接",
+    "TestSucceeded": "连接成功",
+    "TestFailed": "连接失败",
+    "Save": "保存",
+    "SaveSucceeded": "已保存并从后端确认",
+    "SaveFailedWithReason": "保存失败：{reason}",
+    "ReadbackFailedWithReason": "设置已提交，但无法从后端读取确认：{reason}",
+    "Errors": {
+      "HostRequired": "请输入代理主机。",
+      "HostTooLong": "代理主机不能超过 255 个字符。",
+      "InvalidHost": "请输入不含协议、路径或凭据的主机名或 IP 地址。",
+      "InvalidPort": "端口必须是 1 到 65535 之间的整数。",
+      "UsernameTooLong": "用户名不能超过 256 个字符。",
+      "PasswordTooLong": "密码不能超过 1024 个字符。",
+      "UsernameRequired": "已有密码时必须填写用户名；如需无认证代理，请同时清除密码。",
+      "PasswordRequired": "填写用户名时必须提供密码。",
+      "InvalidBypass": "绕过项不能包含协议、凭据、空格、查询参数或片段。",
+      "BypassTextTooLong": "绕过列表不能超过 32768 个字符。",
+      "TooManyBypassEntries": "绕过列表最多允许 128 项。",
+      "BypassEntryTooLong": "每个绕过项不能超过 255 个字符。",
+      "TargetRequired": "请输入 JumpServer 站点地址。",
+      "TargetTooLong": "JumpServer 站点地址不能超过 2048 个字符。",
+      "FixFields": "请修正标出的字段后再保存。",
+      "InvalidTargetOrigin": "请输入仅含 http/https 协议、主机和可选端口的地址，不能包含路径、参数、片段或凭据。"
+    }
+  },
   "Transcode": {
     "Title": "录像转码",
     "Description": "选择一个或多个录像压缩文件（.tar），将录像转换为 mp4 格式。",

src-tauri/Cargo.lock

@@ -31,6 +31,7 @@ flate2 = "1.1.5"
 font-kit = "0.14"
 anyhow = "1.0.100"
 serde_json = "1.0"
+tempfile = "3.27"
 tar = "0.4"
 base64 = "0.22"
 fast_image_resize = "6.0"
@@ -91,7 +92,8 @@ version = "0.12.25"
 default-features = false
 features = [
   "json",
-  "native-tls"
+  "native-tls",
+  "socks"
 ]
 
 [target.'cfg(any(target_os = "macos", windows, target_os = "linux"))'.dependencies]

src-tauri/Cargo.toml

@@ -1,68 +1,15 @@
-use reqwest::{redirect, Client, ClientBuilder};
-use std::net::IpAddr;
-use url::Url;
+use anyhow::Result;
+use reqwest::Client;
 
-/// 构建用于 JumpServer API 请求的默认 HTTP 客户端
-///
-/// 当前行为故意接受无效证书，因为现有代码支持自签名证书或其他非公开证书
-pub(crate) fn api_client() -> Result<Client, reqwest::Error> {
-    instance_client_builder().build()
-}
-
-/// 构建绑定指定站点 origin 的 HTTP 客户端。
-///
-/// 对于 localhost / 127.0.0.1 / ::1 这类本地回环地址，显式绕过系统代理，
-/// 避免被本机代理软件拦截，导致本地开发站点请求失败。
-pub(crate) fn api_client_for_origin(origin: &str) -> Result<Client, reqwest::Error> {
-    instance_client_builder_for_origin(origin).build()
-}
-
-/// 构建一个用于 OAuth 请求的 HTTP 客户端，该客户端不允许重定向。
-///
-/// 目前，OAuth 代码交换需要禁用重定向处理，同时仍需保持与普通 API 请求相同的证书行为
-pub(crate) fn oauth_client() -> Result<Client, reqwest::Error> {
-    instance_client_builder()
-        .redirect(redirect::Policy::none())
-        .build()
-}
-
-/// 构建绑定指定站点 origin 的 OAuth HTTP 客户端。
-///
-/// OAuth code/token 交换同样需要对本地回环地址绕过代理。
-pub(crate) fn oauth_client_for_origin(origin: &str) -> Result<Client, reqwest::Error> {
-    instance_client_builder_for_origin(origin)
-        .redirect(redirect::Policy::none())
-        .build()
-}
+use crate::service::proxy::ProxyManager;
 
-fn instance_client_builder() -> ClientBuilder {
-    Client::builder().danger_accept_invalid_certs(true)
+/// Build a JumpServer API client from the latest proxy settings.
+pub(crate) fn api_client_for_origin(manager: &ProxyManager, origin: &str) -> Result<Client> {
+    manager.api_client_for_origin(origin)
 }
 
-fn instance_client_builder_for_origin(origin: &str) -> ClientBuilder {
-    let builder = instance_client_builder();
-
-    if should_bypass_proxy(origin) {
-        return builder.no_proxy();
-    }
-
-    builder
-}
-
-fn should_bypass_proxy(origin: &str) -> bool {
-    let Ok(url) = Url::parse(origin) else {
-        return false;
-    };
-
-    let Some(host) = url.host_str() else {
-        return false;
-    };
-
-    if host.eq_ignore_ascii_case("localhost") {
-        return true;
-    }
-
-    host.parse::<IpAddr>()
-        .map(|ip| ip.is_loopback())
-        .unwrap_or(false)
+/// Build an OAuth token client from the latest proxy settings while preserving
+/// the existing no-redirect policy.
+pub(crate) fn oauth_client_for_origin(manager: &ProxyManager, origin: &str) -> Result<Client> {
+    manager.oauth_client_for_origin(origin)
 }

src-tauri/src/api/client.rs

@@ -6,13 +6,15 @@ use crate::{
     },
     utils::tz_offset_string,
 };
+use anyhow::Result;
 use log::info;
 use reqwest::{header::AUTHORIZATION, Client, Method, RequestBuilder, Response};
 use serde::Serialize;
 use url::Url;
 
 pub(crate) use crate::api::response::ApiResponse;
 use crate::api::session::ApiSessionContext;
+use crate::service::proxy::ProxyManager;
 
 pub struct ApiRequestClient {
     client: Client,
@@ -27,21 +29,23 @@ impl ApiRequestClient {
         origin: String,
         bearer_token: String,
         org_id: String,
-    ) -> Result<Self, reqwest::Error> {
+        proxy_manager: &ProxyManager,
+    ) -> Result<Self> {
         Ok(Self {
-            client: api_client_for_origin(&origin)?,
+            client: api_client_for_origin(proxy_manager, &origin)?,
             origin,
             bearer_token,
             org_id,
         })
     }
 
     /// 根据当前 API 会话上下文创建请求客户端
-    pub fn from_session(context: &ApiSessionContext) -> Result<Self, reqwest::Error> {
+    pub fn from_session(context: &ApiSessionContext, proxy_manager: &ProxyManager) -> Result<Self> {
         Self::with_origin(
             context.origin.clone(),
             context.bearer_token.clone(),
             context.org_id.clone(),
+            proxy_manager,
         )
     }
 

src-tauri/src/api/request.rs

@@ -1,8 +1,9 @@
+use crate::service::proxy::ProxyManager;
 use crate::{
     api::session::{ApiSessionContext, ApiSessionStore},
     service::oauth::ensure_fresh_token,
 };
-use tauri::{AppHandle, State};
+use tauri::{AppHandle, Manager, State};
 
 #[tauri::command]
 pub fn set_api_session(
@@ -21,14 +22,15 @@ pub fn set_api_org(state: State<'_, ApiSessionStore>, org_id: String) -> Result<
 }
 
 pub(crate) async fn fresh_api_context(
-    _app: &AppHandle,
+    app: &AppHandle,
     state: &ApiSessionStore,
 ) -> Result<ApiSessionContext, String> {
     let mut context = state
         .current_context()
         .ok_or_else(|| "missing current api session".to_string())?;
 
-    let bearer = ensure_fresh_token(&context.origin, Some(&context.bearer_token))
+    let proxy_manager = app.state::<ProxyManager>();
+    let bearer = ensure_fresh_token(&context.origin, Some(&context.bearer_token), &proxy_manager)
         .await
         .map_err(|error| error.to_string())?;
 

src-tauri/src/commands/api_session.rs

@@ -4,16 +4,19 @@ use crate::api::{
 };
 use crate::commands::api_session::fresh_api_context;
 use crate::service::asset::{AssetQuery, AssetService};
+use crate::service::proxy::ProxyManager;
 use log::{error, info};
 use serde_json::{json, Value};
-use tauri::{AppHandle, Emitter, State};
+use tauri::{AppHandle, Emitter, Manager, State};
 
 async fn load_asset_service(
     app: &AppHandle,
     session: &ApiSessionStore,
 ) -> Result<(ApiSessionContext, AssetService), String> {
     let context = fresh_api_context(app, session).await?;
-    let api = ApiRequestClient::from_session(&context).map_err(|error| error.to_string())?;
+    let proxy_manager = app.state::<ProxyManager>();
+    let api = ApiRequestClient::from_session(&context, &proxy_manager)
+        .map_err(|error| error.to_string())?;
 
     Ok((context, AssetService::new(api)))
 }

src-tauri/src/commands/asset_actions.rs

@@ -6,16 +6,19 @@ use crate::service::oauth::{
     build_oauth_client, create_authorization_request, exchange_authorization_code,
     fetch_oauth_config, AuthFlowState,
 };
+use crate::service::proxy::ProxyManager;
 use crate::service::user::UserService;
 
 #[tauri::command]
 pub async fn auth_login(
     app: AppHandle,
     flow_state: State<'_, AuthFlowState>,
+    proxy_manager: State<'_, ProxyManager>,
     site: String,
 ) -> Result<(), String> {
     // 获取 OAuth 配置
-    let config_http_client = api_client_for_origin(&site).map_err(|e| e.to_string())?;
+    let config_http_client =
+        api_client_for_origin(&proxy_manager, &site).map_err(|e| e.to_string())?;
     let oauth_config = match fetch_oauth_config(&site, &config_http_client).await {
         Ok(config) => config,
         Err(e) => {
@@ -49,8 +52,6 @@ pub async fn auth_login(
             log::warn!("emit auth_url failed: {}", e);
         }
 
-        let http_client = oauth_client_for_origin(&site)?;
-
         // 等待 deep link 回调传回 code/state
         let callback = match pending.callback_rx.await {
             Ok(callback) => callback,
@@ -60,6 +61,8 @@ pub async fn auth_login(
             }
         };
 
+        // The user may update proxy settings while the system browser is open.
+        let http_client = oauth_client_for_origin(&proxy_manager, &site)?;
         let tokens = exchange_authorization_code(&client, &http_client, callback).await?;
 
         // 保存 OAuth token，供后续请求自动刷新使用。
@@ -68,7 +71,8 @@ pub async fn auth_login(
         }
 
         // 发起请求
-        let user_service = UserService::new(site.clone(), tokens.access_token.clone())?;
+        let user_service =
+            UserService::new(site.clone(), tokens.access_token.clone(), &proxy_manager)?;
         let (profile, permission_orgs, current_org, xpack_message) = tokio::join!(
             user_service.get_user_profile(),
             user_service.get_permission_orgs(),

src-tauri/src/commands/auth_flow.rs

@@ -1,10 +1,16 @@
 use crate::service::oauth::revoke_and_clear_tokens;
+use crate::service::proxy::ProxyManager;
 use log::warn;
-use tauri::AppHandle;
+use tauri::{AppHandle, State};
 
 #[tauri::command]
-pub async fn logout(_app: AppHandle, _name: String, site: String) -> Result<(), String> {
-    if let Err(e) = revoke_and_clear_tokens(&site).await {
+pub async fn logout(
+    _app: AppHandle,
+    proxy_manager: State<'_, ProxyManager>,
+    _name: String,
+    site: String,
+) -> Result<(), String> {
+    if let Err(e) = revoke_and_clear_tokens(&site, &proxy_manager).await {
         warn!("revoke token failed: {}", e);
     }