mirror of
https://github.com/truewhile/MeBox.git
synced 2026-09-28 11:16:37 +08:00
truewhile
b0fe40142a
* Rebrand MMTL to MeBox across codebase and assets Rename the project display name, Go module path, environment variable prefix (MEBOX_*), Docker image references, and UI branding from MMTL/mmtl to MeBox/mebox. Replace logo assets with the new MeBox icon and keep legacy SQLite migration support for existing mmtl.db deployments. Co-authored-by: truewhile <truewhile@users.noreply.github.com> * Fix logo icons: use cube-only crop without truncated text Previous icon generation cropped too much of the source image, including partial MeBox wordmark text that was cut off in square icon containers. Regenerate logo-64/192/512, favicon, and SVG from cube-only region. Co-authored-by: truewhile <truewhile@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: truewhile <truewhile@users.noreply.github.com>
38 lines
1.4 KiB
Go
38 lines
1.4 KiB
Go
// Package handler — public authentication routes.
|
|
package handler
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"go.uber.org/zap"
|
|
|
|
"github.com/truewhile/MeBox/internal/middleware"
|
|
"github.com/truewhile/MeBox/internal/service"
|
|
)
|
|
|
|
func registerPublicAuthRoutes(api *gin.RouterGroup, svc *service.Container, log *zap.Logger) {
|
|
// Rate limiter for credential endpoints (login/register): brute-force
|
|
// protection. 30/min per IP tolerates many users behind a single NAT
|
|
// or reverse-proxy IP while still throttling password guessing.
|
|
authLimiter := middleware.NewRateLimiter(30, 1*time.Minute)
|
|
|
|
// Public auth.
|
|
auth := api.Group("/auth")
|
|
{
|
|
auth.POST("/login", middleware.RateLimit(authLimiter), loginHandler(svc))
|
|
auth.POST("/register", middleware.RateLimit(authLimiter), registerHandler(svc))
|
|
// /auth/refresh 用 RefreshHandler.RefreshToken：它从 body 读
|
|
// refresh_token 并签发新 access/refresh 对。旧的 refreshHandler
|
|
// 依赖 AuthRequired 中间件，永远 401，因此弃用。
|
|
//
|
|
// 刷新端点【不】做 IP 限流：刷新本身就是防止掉登录的机制，且已
|
|
// 由一次性轮换的 refresh token 强校验。若按 IP 限流，多个用户/
|
|
// 标签页共用一个反代 IP 时会把正常刷新打成 429，反而导致频繁
|
|
// 掉登录。
|
|
refreshHd := NewRefreshHandler(svc, log)
|
|
auth.POST("/refresh", refreshHd.RefreshToken)
|
|
}
|
|
|
|
}
|