cneicy/new-api-custom
1
0 Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

feat: publish sanitized custom.97 source

Browse Source
This commit is contained in:
cneicy committed 2026-10-27 20:43:39 +08:00
1 parent 8e6ed0317b
commit 86c0276156
1022 files changed
+69903 -19207
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

controller/passkey.go
+43 -76
View File
@@ -37,17 +37,14 @@ func parsePasskeyFinishRequest(c *gin.Context) (*passkeyFinishRequest, error) {
return nil, err
}
if request.FlowToken == "" || len(request.Credential) == 0 {
return nil, errors.New("Passkey 流程参数不完整")
return nil, errors.New("incomplete Passkey flow parameters")
}
return &request, nil
}
func PasskeyRegisterBegin(c *gin.Context) {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
})
common.ApiErrorT(c, "Passkey authentication is disabled.")
return
}
@@ -92,9 +89,9 @@ func PasskeyRegisterBegin(c *gin.Context) {
return
}
identity, ok := middleware.GetSessionAuthIdentity(c)
identity, ok := middleware.GetStepUpIdentity(c)
if !ok {
common.ApiErrorMsg(c, "当前认证方式不支持安全验证")
common.ApiErrorT(c, "The current sign-in method does not support security verification")
return
}
flowToken, expiresAt, err := passkeysvc.CreateSessionDataFlow(
@@ -120,10 +117,7 @@ func PasskeyRegisterBegin(c *gin.Context) {
func PasskeyRegisterFinish(c *gin.Context) {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
})
common.ApiErrorT(c, "Passkey authentication is disabled.")
return
}
@@ -134,7 +128,7 @@ func PasskeyRegisterFinish(c *gin.Context) {
}
request, err := parsePasskeyFinishRequest(c)
if err != nil {
common.ApiErrorMsg(c, "无效的 Passkey 验证请求")
common.ApiErrorT(c, "Invalid Passkey verification request")
return
}
parsedCredential, err := protocol.ParseCredentialCreationResponseBytes(request.Credential)
@@ -152,9 +146,9 @@ func PasskeyRegisterFinish(c *gin.Context) {
credentialRecord = nil
}
identity, ok := middleware.GetSessionAuthIdentity(c)
identity, ok := middleware.GetStepUpIdentity(c)
if !ok {
common.ApiErrorMsg(c, "当前认证方式不支持安全验证")
common.ApiErrorT(c, "The current sign-in method does not support security verification")
return
}
sessionData, security, err := passkeysvc.PopSessionDataFlow(
@@ -190,7 +184,7 @@ func PasskeyRegisterFinish(c *gin.Context) {
passkeyCredential := model.NewPasskeyCredentialFromWebAuthn(user.Id, credential)
if passkeyCredential == nil {
common.ApiErrorMsg(c, "无法创建 Passkey 凭证")
common.ApiErrorT(c, "Unable to create the Passkey credential")
return
}
@@ -206,11 +200,7 @@ func PasskeyRegisterFinish(c *gin.Context) {
}
recordUserSecurityAudit(c, user.Id, "user.passkey_register", nil)
c.JSON(http.StatusOK, gin.H{
"success": true,
"message": "Passkey 注册成功",
"data": authRotationData(bundle),
})
common.ApiSuccessT(c, "Passkey registered successfully", authRotationData(bundle))
}
func PasskeyDelete(c *gin.Context) {
@@ -224,9 +214,9 @@ func PasskeyDelete(c *gin.Context) {
return
}
identity, ok := middleware.GetSessionAuthIdentity(c)
identity, ok := middleware.GetStepUpIdentity(c)
if !ok {
common.ApiErrorMsg(c, "当前认证方式不支持安全验证")
common.ApiErrorT(c, "The current sign-in method does not support security verification")
return
}
if err := model.DeletePasskeyForSession(identity); err != nil {
@@ -240,11 +230,7 @@ func PasskeyDelete(c *gin.Context) {
}
recordUserSecurityAudit(c, user.Id, "user.passkey_delete", nil)
c.JSON(http.StatusOK, gin.H{
"success": true,
"message": "Passkey 已解绑",
"data": authRotationData(bundle),
})
common.ApiSuccessT(c, "Passkey removed successfully", authRotationData(bundle))
}
func PasskeyStatus(c *gin.Context) {
@@ -284,10 +270,7 @@ func PasskeyStatus(c *gin.Context) {
func PasskeyLoginBegin(c *gin.Context) {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
})
common.ApiErrorT(c, "Passkey authentication is disabled.")
return
}
@@ -296,7 +279,7 @@ func PasskeyLoginBegin(c *gin.Context) {
}
if c.Request.Body != nil && c.Request.ContentLength != 0 {
if common.DecodeJson(c.Request.Body, &request) != nil {
common.ApiErrorMsg(c, "无效的 Passkey 验证请求")
common.ApiErrorT(c, "Invalid Passkey verification request")
return
}
}
@@ -336,16 +319,13 @@ func PasskeyLoginBegin(c *gin.Context) {
func PasskeyLoginFinish(c *gin.Context) {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
})
common.ApiErrorT(c, "Passkey authentication is disabled.")
return
}
request, err := parsePasskeyFinishRequest(c)
if err != nil {
common.ApiErrorMsg(c, "无效的 Passkey 验证请求")
common.ApiErrorT(c, "Invalid Passkey verification request")
return
}
parsedCredential, err := protocol.ParseCredentialRequestResponseBytes(request.Credential)
@@ -378,7 +358,7 @@ func PasskeyLoginFinish(c *gin.Context) {
// 首先通过凭证ID查找用户
credential, err := model.GetPasskeyByCredentialID(rawID)
if err != nil {
return nil, fmt.Errorf("未找到 Passkey 凭证: %w", err)
return nil, fmt.Errorf("passkey credential not found: %w", err)
}
if credential.RPID != nil && *credential.RPID != "" && *credential.RPID != sessionData.RelyingPartyID {
@@ -388,7 +368,7 @@ func PasskeyLoginFinish(c *gin.Context) {
// 通过凭证获取用户
user := &model.User{Id: credential.UserID}
if err := user.FillUserById(); err != nil {
return nil, fmt.Errorf("用户信息获取失败: %w", err)
return nil, fmt.Errorf("failed to load the passkey user: %w", err)
}
if user.Status != common.UserStatusEnabled {
@@ -399,9 +379,9 @@ func PasskeyLoginFinish(c *gin.Context) {
userID, parseErr := strconv.Atoi(string(userHandle))
if parseErr != nil {
// 记录异常但继续验证，因为某些客户端可能使用非数字格式
common.SysLog(fmt.Sprintf("PasskeyLogin: userHandle parse error for credential, length: %d", len(userHandle)))
common.SysLog(common.LogText("PasskeyLogin: userHandle parse error for credential, length: %d", len(userHandle)))
} else if userID != user.Id {
return nil, errors.New("用户句柄与凭证不匹配")
return nil, errors.New("user handle does not match the credential")
}
}
@@ -416,18 +396,18 @@ func PasskeyLoginFinish(c *gin.Context) {
userWrapper, ok := waUser.(*passkeysvc.WebAuthnUser)
if !ok {
common.ApiErrorMsg(c, "Passkey 登录状态异常")
common.ApiErrorT(c, "Invalid Passkey login state")
return
}
modelUser := userWrapper.ModelUser()
if modelUser == nil {
common.ApiErrorMsg(c, "Passkey 登录状态异常")
common.ApiErrorT(c, "Invalid Passkey login state")
return
}
if modelUser.Status != common.UserStatusEnabled {
common.ApiErrorMsg(c, "该用户已被禁用")
common.ApiErrorT(c, "This user account is disabled.")
return
}
@@ -443,7 +423,7 @@ func PasskeyLoginFinish(c *gin.Context) {
func AdminResetPasskey(c *gin.Context) {
id, err := strconv.Atoi(c.Param("id"))
if err != nil {
common.ApiErrorMsg(c, "无效的用户 ID")
common.ApiErrorT(c, "Invalid user ID")
return
}
@@ -457,13 +437,14 @@ func AdminResetPasskey(c *gin.Context) {
common.ApiErrorMsg(c, "no permission")
return
}
authorization := requireAdminUserProof(c, service.VerificationScopeAdminUserPasskeyReset, service.AdminUserContext{UserID: user.Id})
if authorization == nil {
return
}
if _, err := model.GetPasskeyByUserID(user.Id); err != nil {
if errors.Is(err, model.ErrPasskeyNotFound) {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "该用户尚未绑定 Passkey",
})
common.ApiErrorT(c, "No Passkey is registered.")
return
}
writeSecurityOperationError(c, err)
@@ -480,21 +461,16 @@ func AdminResetPasskey(c *gin.Context) {
}
recordManageAuditFor(c, user.Id, "user.reset_passkey", map[string]any{
"username": user.Username,
"id": user.Id,
})
c.JSON(http.StatusOK, gin.H{
"success": true,
"message": "Passkey 已重置",
"username": user.Username,
"id": user.Id,
"verification_method": authorization.Method,
})
common.ApiSuccessT(c, "Passkey reset successfully", nil)
}
func PasskeyVerifyBegin(c *gin.Context) {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
})
common.ApiErrorT(c, "Passkey authentication is disabled.")
return
}
@@ -505,7 +481,7 @@ func PasskeyVerifyBegin(c *gin.Context) {
}
var request passkeyVerifyBeginRequest
if err := common.DecodeJson(c.Request.Body, &request); err != nil {
common.ApiErrorMsg(c, "无效的 Passkey 验证请求")
common.ApiErrorT(c, "Invalid Passkey verification request")
return
}
binding, err := service.BindVerificationOperation(service.VerificationOperation{Scope: request.Scope, Context: request.Context})
@@ -513,7 +489,7 @@ func PasskeyVerifyBegin(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
identity, ok := middleware.GetSessionAuthIdentity(c)
identity, ok := middleware.GetStepUpIdentity(c)
if !ok {
writeSecurityOperationError(c, service.ErrAuthTokenInvalid)
return
@@ -525,10 +501,7 @@ func PasskeyVerifyBegin(c *gin.Context) {
credential, err := model.GetPasskeyByUserID(user.Id)
if err != nil {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "该用户尚未绑定 Passkey",
})
common.ApiErrorT(c, "No Passkey is registered.")
return
}
@@ -573,10 +546,7 @@ func PasskeyVerifyBegin(c *gin.Context) {
func PasskeyVerifyFinish(c *gin.Context) {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
})
common.ApiErrorT(c, "Passkey authentication is disabled.")
return
}
@@ -588,7 +558,7 @@ func PasskeyVerifyFinish(c *gin.Context) {
request, err := parsePasskeyFinishRequest(c)
if err != nil {
common.ApiErrorMsg(c, "无效的 Passkey 验证请求")
common.ApiErrorT(c, "Invalid Passkey verification request")
return
}
parsedCredential, err := protocol.ParseCredentialRequestResponseBytes(request.Credential)
@@ -599,16 +569,13 @@ func PasskeyVerifyFinish(c *gin.Context) {
credential, err := model.GetPasskeyByUserID(user.Id)
if err != nil {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "该用户尚未绑定 Passkey",
})
common.ApiErrorT(c, "No Passkey is registered.")
return
}
identity, ok := middleware.GetSessionAuthIdentity(c)
identity, ok := middleware.GetStepUpIdentity(c)
if !ok {
common.ApiErrorMsg(c, "当前认证方式不支持安全验证")
common.ApiErrorT(c, "The current sign-in method does not support security verification")
return
}
sessionData, security, err := passkeysvc.PopSessionDataFlow(