26e12594a2
fix(user): revoke all sessions and access tokens on password change
...
- Store user password hash in session during login
- Validate password hash compatibility on requests to prevent session reuse
- Revoke all user access tokens and clear session on ChangePassword
2026-06-13 10:27:28 +08:00
5412c385dc
fix(oauth): remove pending oauth auto-binding and enforce oidc policies
...
- Complete removal of completePendingOAuthBinding logic to prevent unintended account takeovers (AUTH-ROUTE-1).
- Add strict OIDC policy checks (global switch and source active states) across authorization and callback paths (AUTH-POLICY-1).
- Fix OIDC test cases to properly clear the Redis-backed system config cache using composite keys.
2026-06-13 10:06:49 +08:00
895788974c
fix(oauth): secure OAuth state session binding to prevent account takeover
...
Bind OAuth state payloads to the initiating session token and user ID.
Verifies session token hash continuity during callback, and validates that
the user ID completing the binding flow matches the user ID that initiated it.
2026-06-13 09:55:07 +08:00
6a1f89936e
登录界面优化
2026-06-12 11:35:48 +08:00
d9df78d2c7
邮箱注册要求
2026-06-12 10:55:24 +08:00
1fe5118029
登录状态记录
2026-06-12 10:15:29 +08:00
312bc7d4d5
框架表改名 w_{name}
2026-06-11 09:27:15 +08:00
616242fad8
去除 access_token 访问写库逻辑
2026-06-11 09:09:17 +08:00
3023d47eec
解耦任务框架与业务任务
2026-06-11 08:52:44 +08:00
983228227e
AccessToken 默认非管理员权限
2026-06-10 22:50:44 +08:00
57944398e6
质量优化
2026-06-10 13:50:58 +08:00
d05acd804f
精简
2026-06-10 11:33:33 +08:00
673061265c
质量优化
2026-06-09 20:28:05 +08:00
50f39a6983
修复创建账号逻辑
2026-06-09 20:07:25 +08:00
c6eea8111d
fix(revive): rename unused parameters to _ for lint compliance
2026-06-09 15:03:13 +08:00
e06f76436e
refactor: extract magic numbers to named constants for mnd lint compliance
2026-06-09 13:44:29 +08:00
4ac9857fe8
代码质量优化
2026-06-09 12:28:12 +08:00
7a62a78fad
smtp 发件前验证配置
2026-06-09 09:01:14 +08:00
b0023787c5
fix
2026-06-09 08:51:53 +08:00
cd3d0c9f82
重构
2026-06-08 20:38:17 +08:00
02f458856d
用户优化
2026-06-08 20:38:17 +08:00
d99bd5231a
安全加固
2026-06-08 20:38:17 +08:00
0f65202659
个人信息页面增强
2026-06-08 20:38:17 +08:00
b96624a251
模板系统
2026-06-08 20:38:17 +08:00
85f91b1ed7
更新 license .github
2026-06-08 20:38:17 +08:00
e3ef6c9d27
修改路径
2026-06-08 20:38:17 +08:00
5c7c995a95
框架化
2026-06-08 20:38:01 +08:00
72c74803be
优化
2026-06-08 20:38:01 +08:00
474e3da3b7
代码优化
...
界面优化
2026-06-08 20:37:52 +08:00
9d0f9f0576
user
2026-06-08 20:37:40 +08:00
70a13dc107
upload+accessKey
2026-06-08 20:37:40 +08:00
360a26f109
oauth
2026-06-08 20:34:28 +08:00
48d414e197
裁剪
...
swagger
移除 merchant
swagger
改造首页内容为通用后台管理系统定位
- 修改首页标题从 'LINUX DO Credit' 改为 'Modern Platform'
- 更新副标题为 '为二次开发而生'
- 更新首页描述为通用平台的特点
- 更新首页特性标签为 '开箱即用、高度可扩展、工业级基建'
- 修改展示卡片为技术栈和二次开发相关
- 更新开发者示例代码为通用的注册和 API Key 获取示例
- 更新页脚品牌名为 'Modern Platform'
- 调整页脚导航链接为通用平台相关内容
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
去除遗留
裁剪
移除 /api/v1/user/pay-key 相关代码
- 删除后端 UpdatePayKey 处理器函数和 UpdatePayKeyRequest 结构体
- 删除 User 模型中的 PayKey 字段
- 删除 User.VerifyPayKey 方法
- 删除 EncryptPayKeyFailed 错误常量
- 删除 /api/v1/user/pay-key PUT 路由
- 删除 OAuth 返回中的 IsPayKey 字段
- 删除前端 UserService.updatePayKey 方法
- 删除前端所有支付密钥 UI 和逻辑
- 更新相关的导出和注释
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
去除遗留
api 修正
系统配置
前端裁剪
后端裁剪
init
2026-06-08 20:34:28 +08:00
8a782525de
压缩历史至 95081aff
2026-06-08 20:34:27 +08:00
ryan