 浅念
|
39cae26106
|
feat(api): password login, sliding renewal, revocable sessions
- POST /v1/auth/password|refresh|logout per contract operationIds;
long-lived single token (32B hex, DB stores sha256 only), sliding
renewal without rotation, logout sets sessions.revokedAt.
- SessionGuard: Bearer -> session -> user eligibility (disabled/locked/
pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED.
- Anti-enumeration: unknown account / wrong password / status-blocked
share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a
dummy argon2 verify to equalize timing.
- Login rate limiting (P1): in-memory account+IP sliding window,
5 failures / 15 min -> 429; success clears. Contract amendment
(registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts +
openapi Error enum + 429 response on /auth/password; generated types
regenerated and committed. P1a single-instance limiter; P5 needs a
Redis-backed implementation.
- Global ValidationPipe (APP_PIPE) enforces class-validator DTOs ->
400 VALIDATION_FAILED via the existing exception filter.
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 21:17:16 +08:00 |
|
|
浅念
|
b4ee92de96
|
docs(contracts): locale fallback wording on public endpoints
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 18:11:21 +08:00 |
|
|
浅念
|
f6448bd006
|
fix(contracts): quality review fixes for p1a contracts
- status enum active|archived -> active|offline (align requirement docs)
- UploadSessionState session-state semantics documented (no failed state)
- maxLength: clientTaskId 128 / filename 255 / cursor 512
- PublicPhoto width/height required (layout placeholders)
- reusable Unauthorized/InternalError responses (hybrid with inline op-specific codes)
- PublicAlbum.translations -> translation (single resolved object)
- contentType enum [jpeg/png/heic] (heic provisional pending G2)
- minLength 1 on title/name; publicToken pattern ^[0-9a-z]{20,32}$
- CursorPageMeta hasMore/nextCursor invariant documented
- public locale: silent fallback to defaultLocale (tech doc section 11)
- plan: upload_sessions state comment aligned; P1b adds management photo list + account lookup endpoints
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 18:06:54 +08:00 |
|
|
浅念
|
1dae00eaef
|
feat(contracts): p1a endpoint contracts
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 17:31:11 +08:00 |
|
|
浅念
|
656498d748
|
feat(contracts): openapi base, error codes, type generation
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 17:04:12 +08:00 |
|