 浅念
|
65726702f3
|
feat(sync): cn event coverage, bootstrap and outbox sender
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-18 15:21:41 +08:00 |
|
|
浅念
|
24327c5147
|
feat(contracts): p2 realtime, likes, visits and internal sync contracts
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-18 13:34:35 +08:00 |
|
|
浅念
|
47fb81ad31
|
chore(api): p1a final-review hygiene items
- contracts: add NOT_FOUND error code (framework-level 404 for unknown
routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
.env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
(api e2e 120 -> 122)
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-18 08:18:30 +08:00 |
|
|
浅念
|
39cae26106
|
feat(api): password login, sliding renewal, revocable sessions
- POST /v1/auth/password|refresh|logout per contract operationIds;
long-lived single token (32B hex, DB stores sha256 only), sliding
renewal without rotation, logout sets sessions.revokedAt.
- SessionGuard: Bearer -> session -> user eligibility (disabled/locked/
pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED.
- Anti-enumeration: unknown account / wrong password / status-blocked
share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a
dummy argon2 verify to equalize timing.
- Login rate limiting (P1): in-memory account+IP sliding window,
5 failures / 15 min -> 429; success clears. Contract amendment
(registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts +
openapi Error enum + 429 response on /auth/password; generated types
regenerated and committed. P1a single-instance limiter; P5 needs a
Redis-backed implementation.
- Global ValidationPipe (APP_PIPE) enforces class-validator DTOs ->
400 VALIDATION_FAILED via the existing exception filter.
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 21:17:16 +08:00 |
|
|
浅念
|
656498d748
|
feat(contracts): openapi base, error codes, type generation
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 17:04:12 +08:00 |
|