浅念
39cae26106
- POST /v1/auth/password|refresh|logout per contract operationIds; long-lived single token (32B hex, DB stores sha256 only), sliding renewal without rotation, logout sets sessions.revokedAt. - SessionGuard: Bearer -> session -> user eligibility (disabled/locked/ pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED. - Anti-enumeration: unknown account / wrong password / status-blocked share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a dummy argon2 verify to equalize timing. - Login rate limiting (P1): in-memory account+IP sliding window, 5 failures / 15 min -> 429; success clears. Contract amendment (registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts + openapi Error enum + 429 response on /auth/password; generated types regenerated and committed. P1a single-instance limiter; P5 needs a Redis-backed implementation. - Global ValidationPipe (APP_PIPE) enforces class-validator DTOs -> 400 VALIDATION_FAILED via the existing exception filter. Co-Authored-By: Claude Code <noreply@anthropic.com>
44 lines
1.3 KiB
JSON
44 lines
1.3 KiB
JSON
{
|
|
"name": "@photo/api-cn",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"description": "CN NestJS API service (P1a skeleton: bootstrap, /v1/health, request-id, error envelope)",
|
|
"scripts": {
|
|
"build": "tsc -p tsconfig.build.json",
|
|
"build:watch": "tsc -p tsconfig.build.json --watch",
|
|
"start": "tsc -p tsconfig.build.json && node dist/main-cn.js",
|
|
"seed": "tsc -p tsconfig.build.json && node dist/scripts/seed-admin.js",
|
|
"typecheck": "tsc --noEmit",
|
|
"lint": "eslint .",
|
|
"test": "jest",
|
|
"test:e2e": "jest --config jest.e2e.config.ts"
|
|
},
|
|
"dependencies": {
|
|
"@nestjs/common": "^10.4.6",
|
|
"@nestjs/core": "^10.4.6",
|
|
"@nestjs/platform-express": "^10.4.6",
|
|
"@node-rs/argon2": "^2.2.1",
|
|
"@photo/contracts": "workspace:*",
|
|
"@photo/db-cn": "workspace:*",
|
|
"class-transformer": "^0.5.1",
|
|
"class-validator": "^0.15.1",
|
|
"nestjs-pino": "^4.6.1",
|
|
"pino": "^10.0.0",
|
|
"pino-http": "^11.0.0",
|
|
"reflect-metadata": "^0.2.2",
|
|
"rxjs": "^7.8.1"
|
|
},
|
|
"devDependencies": {
|
|
"@nestjs/testing": "^10.4.6",
|
|
"@types/jest": "^29.5.13",
|
|
"@types/node": "^22.10.0",
|
|
"@types/supertest": "^6.0.2",
|
|
"dotenv": "^16.4.5",
|
|
"jest": "^29.7.0",
|
|
"supertest": "^7.0.0",
|
|
"ts-jest": "^29.2.5",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^5.6.0"
|
|
}
|
|
}
|