浅念
39cae26106
- POST /v1/auth/password|refresh|logout per contract operationIds; long-lived single token (32B hex, DB stores sha256 only), sliding renewal without rotation, logout sets sessions.revokedAt. - SessionGuard: Bearer -> session -> user eligibility (disabled/locked/ pending revoke access); all failures map to 401 AUTH_TOKEN_EXPIRED. - Anti-enumeration: unknown account / wrong password / status-blocked share one 401 AUTH_INVALID_CREDENTIALS; unknown-account path runs a dummy argon2 verify to equalize timing. - Login rate limiting (P1): in-memory account+IP sliding window, 5 failures / 15 min -> 429; success clears. Contract amendment (registered): new ErrorCodes.AUTH_RATE_LIMITED added to errors.ts + openapi Error enum + 429 response on /auth/password; generated types regenerated and committed. P1a single-instance limiter; P5 needs a Redis-backed implementation. - Global ValidationPipe (APP_PIPE) enforces class-validator DTOs -> 400 VALIDATION_FAILED via the existing exception filter. Co-Authored-By: Claude Code <noreply@anthropic.com>
22 lines
1.0 KiB
TypeScript
22 lines
1.0 KiB
TypeScript
// packages/contracts/src/errors.ts
|
|
export const ErrorCodes = {
|
|
AUTH_INVALID_CREDENTIALS: 'AUTH_INVALID_CREDENTIALS',
|
|
AUTH_TOKEN_EXPIRED: 'AUTH_TOKEN_EXPIRED',
|
|
// Task 13 契约修订（已登记）：登录失败基础限速（总纲 P1）需要一个区别于
|
|
// 凭据错误的错误码——429 若复用 AUTH_INVALID_CREDENTIALS 会向客户端撒谎，
|
|
// 复用 VALIDATION_FAILED 则语义错位。与 openapi.yaml Error enum 同步增补。
|
|
AUTH_RATE_LIMITED: 'AUTH_RATE_LIMITED',
|
|
AUTH_FORBIDDEN: 'AUTH_FORBIDDEN',
|
|
ALBUM_NOT_FOUND: 'ALBUM_NOT_FOUND',
|
|
ALBUM_NOT_PUBLIC: 'ALBUM_NOT_PUBLIC',
|
|
ALBUM_UPLOAD_DISABLED: 'ALBUM_UPLOAD_DISABLED',
|
|
MEMBER_CONFLICT: 'MEMBER_CONFLICT',
|
|
UPLOAD_SESSION_CONFLICT: 'UPLOAD_SESSION_CONFLICT',
|
|
UPLOAD_VERIFY_FAILED: 'UPLOAD_VERIFY_FAILED',
|
|
PHOTO_NOT_FOUND: 'PHOTO_NOT_FOUND',
|
|
PHOTO_NOT_PUBLIC: 'PHOTO_NOT_PUBLIC',
|
|
VALIDATION_FAILED: 'VALIDATION_FAILED',
|
|
INTERNAL_ERROR: 'INTERNAL_ERROR',
|
|
} as const;
|
|
export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
|