no message

 var path = require('path');
 var serviceDir = path.join(__dirname, '..');
+var maxAge = 24 * 60 * 60 * 1000;
 exports = module.exports = function () {
     return {
         server: {
@@ -16,7 +17,7 @@ exports = module.exports = function () {
                 options: {}
             },
             staticServer: {
-                maxAge: 24 * 60 * 60 * 1000
+                maxAge: maxAge
             }
         },
         logger: {
@@ -24,6 +25,35 @@ exports = module.exports = function () {
         },
         output: {
 
+        },
+        cookieParser: 'igloo-change-me',
+        session: {
+            secret: 'igloo-change-me',
+            key: 'igloo',
+            cookie: {
+                path: '/',
+                httpOnly: true,
+                secure: false,
+                sameSite: 'strict',
+                maxAge: maxAge
+            },
+            resave: true,
+            saveUninitialized: true
+        },
+        notApiRouteRegexp: /^(?!\/__webpack_hmr\/)|(?!\/*.ico).*$/,
+        redis: {
+            prefix: 'igloo-development',
+            host: '127.0.0.1',
+            port: 6379,
+            pass: ''
+        },
+        proxy: {
+            target: 'http://47.110.158.110:20000',
+            apiRouteRegexp: '/api',
+            authUrl: '/uaa/v1/auth/tokens',
+            refreshUrl: '/uaa/v1/auth/tokens',
+            signOutUrl: '/signOut',
+            signInUrl: '/#login',
         }
     };
 };

@@ -42,14 +42,10 @@ exports = module.exports = function (logger, settings) {
     //     app.use(winstonRequestLogger.create(logger));
     // }
 
+    // parse 
+    app.use(bodyParser.urlencoded({ limit: '10mb', extended: true }));
     // parse request bodies
-    app.use(
-        bodyParser.json({ limit: '10mb' }),
-        bodyParser.urlencoded({
-            limit: '10mb',
-            extended: true
-        })
-    );
+    app.use(bodyParser.json({ limit: '10mb' }));
 };
 
 exports['@require'] = ['igloo/logger', 'igloo/settings'];

+
+// # sessions 
+var session = require('express-session');
+var cookieParser = require('cookie-parser');
+
+exports = module.exports = function (settings, sessions) {
+
+    var app = this;
+    // pass a secret to cookieParser() for signed cookies
+    app.all(settings.notApiRouteRegexp, cookieParser(settings.cookieParser));
+
+    // add req.session cookie support
+    settings.session.store = sessions;
+    app.all(settings.notApiRouteRegexp, session(settings.session));
+
+    // add flash message support
+    app.use(session(settings.session));
+};
+
+exports['@require'] = ['igloo/settings', 'igloo/sessions'];

+//代理RESTful API
+var express = require('express');
+exports = module.exports = function (settings, proxy) {
+
+    var app = this;
+    var router = express.Router();
+    if (settings.proxy) {
+        app.use(settings.proxy.apiRouteRegexp, router);
+        router.all('*', function (req, res, next) {
+            proxy.web(req, res, next);
+        });
+    }
+};
+
+exports['@require'] = ['igloo/settings', 'igloo/restler'];

+//RESTful API  client 代理
+
+var rest = require('restler');
+var URL = require('url');
+exports = module.exports = function (logger, settings) {
+
+    var client = {};
+
+    function targetUrl(originUrl) {
+        if (settings.proxy && settings.proxy.target && settings.proxy.apiRouteRegexp) {
+            return settings.proxy.target + originUrl.substring(settings.proxy.apiRouteRegexp.length);
+        } else {
+            logger.error('config miss proxy target');
+        }
+    }
+
+    function getTokens(req) {
+        console.log("##@#@", req.session);
+        if (req.session.token) {
+            var token = {};
+            try {
+                token = JSON.parse(req.session.token);
+            } catch (error) {
+                logger.error("token 字符串不能被解析", error);
+            }
+            return token;
+        } else {
+            logger.error("401 token不存在");
+        }
+    }
+
+    function refreshToken(req, res, next, reqOption) {
+        var token = getTokens(req);
+        var params = {
+            'grant_type': 'refresh_token',
+            'refresh_token': token.refresh_token
+        };
+        if (token.tenant && token.tenant.tenant_id) {
+            params['account'] = token.tenant.tenant_id;
+        }
+        var options = {
+            method: 'post',
+            data: JSON.stringify(params || {}),
+            headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
+            timeout: 60 * 1000
+        }
+        var refreshUrl = settings.proxy.target + settings.proxy.refreshUrl;
+        rest.request(refreshUrl, options)
+            .on('success', function (data, response) {
+                req.session.token = data;
+                req.session.save(function (err) {
+                    if (err)
+                        logger.error(err);
+                    else
+                        requestAction(reqOption.url, req, res, next)
+                })
+            })
+            .on('fail', function (data, response) {
+                logger.error(data);
+                res.send({ 'message': '刷新token失败，请重新登陆' });
+            })
+            .on('error', function (err, response) {
+                logger.error(err);
+                res.send(err);
+            })
+            .on('timeout', function (ms) {
+                logger.error('timeout', ms);
+                res.send({ 'message': '请求超时' });
+            });
+    }
+
+    function handleSuccess(data, response, req, res, next, reqOption) {
+        if (reqOption.url.indexOf(settings.proxy.authUrl) != -1) {
+            req.session.token = data;
+            req.session.save(function (err) {
+                if (err)
+                    logger.error(err);
+                else
+                    res.send(data);
+            })
+        } else {
+            res.send(data);
+        }
+    }
+
+    function handleFail(data, response, req, res, next, reqOption) {
+        if (response.statusCode === 401) {
+            refreshToken(req, res, next, reqOption);
+        } else {
+            res.send(data);
+        }
+    }
+
+    function getOptions(req) {
+        var options = {
+            method: req.method.toLowerCase(),
+            query: req.query,
+            data: JSON.stringify(req.body || {}),
+            headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
+            timeout: 60 * 1000
+        }
+        if (req.session.token) {
+            var token = getTokens(req);
+            options['accessToken'] = token.access_token
+        }
+        return options;
+    }
+
+    function requestAction(url, req, res, next) {
+        var options = getOptions(req);
+        logger.info('options', options);
+        rest.request(url, options)
+            .on('success', function (data, response) {
+                handleSuccess(data, response, req, res, next, { url, options });
+            })
+            .on('fail', function (data, response) {
+                handleFail(data, response, req, res, next, { url, options });
+            })
+            .on('error', function (err, response) {
+                logger.error(err);
+                res.send(err);
+            })
+            .on('timeout', function (ms) {
+                logger.error('timeout', ms);
+                res.send({ 'message': '请求超时' });
+            });
+    }
+
+    client.web = function (req, res, next) {
+        var target = targetUrl(req.originalUrl);
+        requestAction(target, req, res, next);
+    }
+
+
+    return client;
+};
+
+
+exports['@singleton'] = true;
+exports['@require'] = ['igloo/logger', 'igloo/settings'];
\ No newline at end of file

@@ -21,9 +21,10 @@
     "express-session": "^1.16.1",
     "lodash": "^4.17.11",
     "morgan": "~1.6.1",
+    "restler": "^3.4.0",
     "serve-favicon": "~2.3.0",
     "serve-static": "^1.13.2",
     "underscore": "^1.9.1",
     "winston": "^3.2.1"
   }
-}
\ No newline at end of file
+}

 var express = require('express');
 var IoC = require('electrolyte');
 
-exports = module.exports = function (settings) {
+exports = module.exports = function (settings, logger) {
   var app = this;
-  var router = express.Router();
-  var controller = {
-    get: function () {
-
-    }, post: function () {
-
-    }, put: function () {
-
-    }, patch: function () {
-
-    }, head: function () {
-
-    }, patch: function () {
-
-    }, delete: function () {
-
-    }
-  };
-
-  router.get(
-    '/*',
-    controller.get
-  );
-
-  router.post(
-    '/*',
-    controller.post
-  );
-
-  router.put(
-    '/*',
-    controller.put
-  );
-
-  router.patch(
-    '/*',
-    controller.patch
-  );
-
-  router.head(
-    '/*',
-    controller.head
-  );
-
-  router.delete(
-    '/*',
-    controller.delete
-  );
-
-  app.use('/api', router);
   app.use('/', function (req, res, next) {
     res.render('index', { 'csrfToken': 'xxxx' });
     next();
   });
+
+  app.use(settings.proxy.signOutUrl, function (req, res, next) {
+    req.session.token = null;
+    req.session.save(function (err) {
+      if (err)
+        logger.error(err);
+      else
+        res.redirect(settings.proxy.signInUrl);
+    });
+  });
+
 };
 
 exports['@singleton'] = true;
-exports['@require'] = ['igloo/settings'];
+exports['@require'] = ['igloo/settings', 'igloo/logger'];

@@ -418,6 +418,10 @@ http-errors@~1.6.2:
     setprototypeof "1.1.0"
     statuses ">= 1.4.0 < 2"
 
+iconv-lite@0.2.11:
+  version "0.2.11"
+  resolved "https://registry.npm.taobao.org/iconv-lite/download/iconv-lite-0.2.11.tgz#1ce60a3a57864a292d1321ff4609ca4bb965adc8"
+
 iconv-lite@0.4.24:
   version "0.4.24"
   resolved "https://registry.npm.taobao.org/iconv-lite/download/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b"
@@ -602,6 +606,10 @@ proxy-addr@~1.0.10:
     forwarded "~0.1.0"
     ipaddr.js "1.0.5"
 
+qs@1.2.0:
+  version "1.2.0"
+  resolved "https://registry.npm.taobao.org/qs/download/qs-1.2.0.tgz#ed079be28682147e6fd9a34cc2b0c1e0ec6453ee"
+
 qs@4.0.0:
   version "4.0.0"
   resolved "http://registry.npm.taobao.org/qs/download/qs-4.0.0.tgz#c31d9b74ec27df75e543a86c78728ed8d4623607"
@@ -667,6 +675,15 @@ redis@^2.8.0:
     redis-commands "^1.2.0"
     redis-parser "^2.6.0"
 
+restler@^3.4.0:
+  version "3.4.0"
+  resolved "https://registry.npm.taobao.org/restler/download/restler-3.4.0.tgz#741ec0b3d16b949feea2813d0c3c68529e888d9b"
+  dependencies:
+    iconv-lite "0.2.11"
+    qs "1.2.0"
+    xml2js "0.4.0"
+    yaml "0.2.3"
+
 safe-buffer@5.1.2, safe-buffer@~5.1.0, safe-buffer@~5.1.1:
   version "5.1.2"
   resolved "http://registry.npm.taobao.org/safe-buffer/download/safe-buffer-5.1.2.tgz#991ec69d296e0313747d59bdfd2b745c35f8828d"
@@ -675,6 +692,10 @@ safe-buffer@5.1.2, safe-buffer@~5.1.0, safe-buffer@~5.1.1:
   version "2.1.2"
   resolved "https://registry.npm.taobao.org/safer-buffer/download/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
 
+sax@0.5.x:
+  version "0.5.8"
+  resolved "https://registry.npm.taobao.org/sax/download/sax-0.5.8.tgz#d472db228eb331c2506b0e8c15524adb939d12c1"
+
 scripts@0.1.x:
   version "0.1.0"
   resolved "http://registry.npm.taobao.org/scripts/download/scripts-0.1.0.tgz#3eb19713b5ad1f58bc3e39ce63606d6beaa00693"
@@ -885,3 +906,18 @@ winston@^3.2.1:
     stack-trace "0.0.x"
     triple-beam "^1.3.0"
     winston-transport "^4.3.0"
+
+xml2js@0.4.0:
+  version "0.4.0"
+  resolved "https://registry.npm.taobao.org/xml2js/download/xml2js-0.4.0.tgz#124fc4114b4129c810800ecb2ac86cf25462cb9a"
+  dependencies:
+    sax "0.5.x"
+    xmlbuilder ">=0.4.2"
+
+xmlbuilder@>=0.4.2:
+  version "12.0.1"
+  resolved "https://registry.npm.taobao.org/xmlbuilder/download/xmlbuilder-12.0.1.tgz#885f0ab731e0c9bfd4970381513760131cc71a25"
+
+yaml@0.2.3:
+  version "0.2.3"
+  resolved "https://registry.npm.taobao.org/yaml/download/yaml-0.2.3.tgz#b5450e92e76ef36b5dd24e3660091ebaeef3e5c7"