feat: publish sanitized custom.97 source

controller/twofa.go

@@ -6,7 +6,6 @@ import (
 	"strconv"
 
 	"github.com/QuantumNous/new-api/common"
-	"github.com/QuantumNous/new-api/i18n"
 	"github.com/QuantumNous/new-api/middleware"
 	"github.com/QuantumNous/new-api/model"
 	"github.com/QuantumNous/new-api/service"
@@ -25,7 +24,7 @@ func Setup2FA(c *gin.Context) {
 	if authorization == nil {
 		return
 	}
-	identity, _ := middleware.GetSessionAuthIdentity(c)
+	identity, _ := middleware.GetStepUpIdentity(c)
 	setup, err := service.StartTwoFASetup(identity, authorization)
 	if err != nil {
 		writeSecurityOperationError(c, err)
@@ -36,14 +35,14 @@ func Setup2FA(c *gin.Context) {
 }
 
 func Enable2FA(c *gin.Context) {
-	identity, ok := middleware.GetSessionAuthIdentity(c)
+	identity, ok := middleware.GetStepUpIdentity(c)
 	if !ok {
 		writeSecurityOperationError(c, service.ErrAuthTokenInvalid)
 		return
 	}
 	var req Verify2FARequest
 	if err := common.DecodeJson(c.Request.Body, &req); err != nil {
-		common.ApiErrorMsg(c, "参数错误")
+		common.ApiErrorT(c, "Invalid parameters")
 		return
 	}
 	if err := service.FinishTwoFASetup(identity, req.FlowToken, req.Code); err != nil {
@@ -64,7 +63,7 @@ func Disable2FA(c *gin.Context) {
 	if middleware.RequireSecurityProof(c, service.VerificationOperation{Scope: service.VerificationScopeTwoFADisable}) == nil {
 		return
 	}
-	identity, _ := middleware.GetSessionAuthIdentity(c)
+	identity, _ := middleware.GetStepUpIdentity(c)
 	userId := identity.UserID
 	if err := model.DisableTwoFAForSession(identity); err != nil {
 		writeSecurityOperationError(c, err)
@@ -79,11 +78,7 @@ func Disable2FA(c *gin.Context) {
 	// 记录操作日志
 	recordUserSecurityAudit(c, userId, "user.2fa_disable_self", nil)
 
-	c.JSON(http.StatusOK, gin.H{
-		"success": true,
-		"message": "两步验证已禁用",
-		"data":    authRotationData(bundle),
-	})
+	common.ApiSuccessT(c, "Two-factor authentication disabled", authRotationData(bundle))
 }
 
 // Get2FAStatus 获取用户2FA状态
@@ -108,7 +103,7 @@ func Get2FAStatus(c *gin.Context) {
 			// 获取剩余备用码数量
 			backupCount, err := model.GetUnusedBackupCodeCount(userId)
 			if err != nil {
-				common.SysLog("获取备用码数量失败: " + err.Error())
+				common.SysLog(common.LogText("failed to count backup codes: %s", err.Error()))
 			} else {
 				status["backup_codes_remaining"] = backupCount
 			}
@@ -127,26 +122,20 @@ func RegenerateBackupCodes(c *gin.Context) {
 	if middleware.RequireSecurityProof(c, service.VerificationOperation{Scope: service.VerificationScopeTwoFABackupCodes}) == nil {
 		return
 	}
-	identity, _ := middleware.GetSessionAuthIdentity(c)
+	identity, _ := middleware.GetStepUpIdentity(c)
 	userId := identity.UserID
 	// 生成新的备用码
 	backupCodes, err := common.GenerateBackupCodes()
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"message": "生成备用码失败",
-		})
-		common.SysLog("生成备用码失败: " + err.Error())
+		common.ApiErrorT(c, "Failed to regenerate backup codes")
+		common.SysLog(common.LogText("failed to generate backup codes: %s", err.Error()))
 		return
 	}
 
 	// 保存新的备用码并原子推进用户鉴权版本
 	if err := model.ReplaceBackupCodesForSession(identity, backupCodes); err != nil {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"message": "保存备用码失败",
-		})
-		common.SysLog("保存备用码失败: " + err.Error())
+		common.ApiErrorT(c, "Failed to save backup codes")
+		common.SysLog(common.LogText("failed to save backup codes: %s", err.Error()))
 		return
 	}
 	bundle, err := service.AdvanceCurrentSessionToUserVersion(identity, "twofa_backup_codes_regenerated")
@@ -160,11 +149,7 @@ func RegenerateBackupCodes(c *gin.Context) {
 
 	data := authRotationData(bundle)
 	data["backup_codes"] = backupCodes
-	c.JSON(http.StatusOK, gin.H{
-		"success": true,
-		"message": "备用码重新生成成功",
-		"data":    data,
-	})
+	common.ApiSuccessT(c, "Backup codes regenerated successfully", data)
 }
 
 // Verify2FALogin 登录时验证2FA
@@ -192,17 +177,14 @@ func AdminDisable2FA(c *gin.Context) {
 	userIdStr := c.Param("id")
 	userId, err := strconv.Atoi(userIdStr)
 	if err != nil || userId <= 0 {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"message": "用户ID格式错误",
-		})
+		common.ApiErrorT(c, "Invalid user ID")
 		return
 	}
 
 	// 检查目标用户权限
 	targetUser, err := model.GetUserById(userId, false)
 	if errors.Is(err, gorm.ErrRecordNotFound) {
-		common.ApiErrorI18n(c, i18n.MsgUserNotExists)
+		common.ApiErrorT(c, "User does not exist")
 		return
 	}
 	if err != nil {
@@ -212,20 +194,18 @@ func AdminDisable2FA(c *gin.Context) {
 
 	myRole := c.GetInt("role")
 	if !canManageTargetRole(myRole, targetUser.Role) {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"message": "无权操作同级或更高级用户的2FA设置",
-		})
+		common.ApiErrorT(c, "No permission to change the 2FA settings of users at the same or higher level")
+		return
+	}
+	authorization := requireAdminUserProof(c, service.VerificationScopeAdminUserTwoFADisable, service.AdminUserContext{UserID: userId})
+	if authorization == nil {
 		return
 	}
 
 	// 禁用2FA
 	if err := model.DisableTwoFAWithAuthVersion(userId); err != nil {
 		if errors.Is(err, model.ErrTwoFANotEnabled) {
-			c.JSON(http.StatusOK, gin.H{
-				"success": false,
-				"message": "用户未启用2FA",
-			})
+			common.ApiErrorT(c, "Two-factor authentication is not enabled.")
 			return
 		}
 		writeSecurityOperationError(c, err)
@@ -236,10 +216,10 @@ func AdminDisable2FA(c *gin.Context) {
 		return
 	}
 
-	recordManageAuditFor(c, userId, "user.2fa_disable", nil)
-
-	c.JSON(http.StatusOK, gin.H{
-		"success": true,
-		"message": "用户2FA已被强制禁用",
+	recordManageAuditFor(c, userId, "user.2fa_disable", map[string]any{
+		"username":            targetUser.Username,
+		"verification_method": authorization.Method,
 	})
+
+	common.ApiSuccessT(c, "Two-factor authentication reset", nil)
 }