 浅念
|
c2a9cc51f3
|
feat(contracts): p1b asset upload, management photo list, account lookup
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-18 08:23:59 +08:00 |
|
|
浅念
|
47fb81ad31
|
chore(api): p1a final-review hygiene items
- contracts: add NOT_FOUND error code (framework-level 404 for unknown
routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
.env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
(api e2e 120 -> 122)
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-18 08:18:30 +08:00 |
|
|
浅念
|
39cae26106
|
feat(api): password login, sliding renewal, revocable sessions
- POST /v1/auth/password|refresh|logout per contract operationIds;
long-lived single token (32B hex, DB stores sha256 only), sliding
renewal without rotation, logout sets sessions.revokedAt.
- SessionGuard: Bearer -> session -> user eligibility (disabled/locked/
pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED.
- Anti-enumeration: unknown account / wrong password / status-blocked
share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a
dummy argon2 verify to equalize timing.
- Login rate limiting (P1): in-memory account+IP sliding window,
5 failures / 15 min -> 429; success clears. Contract amendment
(registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts +
openapi Error enum + 429 response on /auth/password; generated types
regenerated and committed. P1a single-instance limiter; P5 needs a
Redis-backed implementation.
- Global ValidationPipe (APP_PIPE) enforces class-validator DTOs ->
400 VALIDATION_FAILED via the existing exception filter.
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 21:17:16 +08:00 |
|
|
浅念
|
b4ee92de96
|
docs(contracts): locale fallback wording on public endpoints
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 18:11:21 +08:00 |
|
|
浅念
|
f6448bd006
|
fix(contracts): quality review fixes for p1a contracts
- status enum active|archived -> active|offline (align requirement docs)
- UploadSessionState session-state semantics documented (no failed state)
- maxLength: clientTaskId 128 / filename 255 / cursor 512
- PublicPhoto width/height required (layout placeholders)
- reusable Unauthorized/InternalError responses (hybrid with inline op-specific codes)
- PublicAlbum.translations -> translation (single resolved object)
- contentType enum [jpeg/png/heic] (heic provisional pending G2)
- minLength 1 on title/name; publicToken pattern ^[0-9a-z]{20,32}$
- CursorPageMeta hasMore/nextCursor invariant documented
- public locale: silent fallback to defaultLocale (tech doc section 11)
- plan: upload_sessions state comment aligned; P1b adds management photo list + account lookup endpoints
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 18:06:54 +08:00 |
|
|
浅念
|
1dae00eaef
|
feat(contracts): p1a endpoint contracts
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 17:31:11 +08:00 |
|
|
浅念
|
656498d748
|
feat(contracts): openapi base, error codes, type generation
Co-Authored-By: Claude Code <noreply@anthropic.com>
|
2026-09-17 17:04:12 +08:00 |
|