cneicy/new-api-custom
1
0 Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

feat: sync deployed v1.0.0-rc.38-custom.42
Publish Docker image (Multi-arch) / Build & push (amd64) (push) Failing after 1m40s
Release (Linux, macOS, Windows) / Linux Release (push) Failing after 42m16s
Publish Docker image (Multi-arch) / Build & push (arm64) (push) Canceled after 0s
Release (Linux, macOS, Windows) / macOS Release (push) Canceled after 0s
Release (Linux, macOS, Windows) / Windows Release (push) Canceled after 0s
Publish Docker image (Multi-arch) / Create multi-arch manifests (push) Canceled after 0s

Browse Source 
Sync production source including routing, billing, Astra detection and public uptime. Update custom build instructions and license packaging.
This commit is contained in:
cneicy committed 2026-09-26 04:49:11 +08:00
1 parent c2b44332d6
commit a5f7b8e586
828 files changed
+122253 -13702
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

controller/passkey.go
+53 -28
View File
@@ -26,6 +26,7 @@ type passkeyFinishRequest struct {
}
type passkeyVerifyBeginRequest struct {
RPID string `json:"rp_id"`
Scope string `json:"scope"`
Context json.RawMessage `json:"context,omitempty"`
}
@@ -42,7 +43,7 @@ func parsePasskeyFinishRequest(c *gin.Context) (*passkeyFinishRequest, error) {
}
func PasskeyRegisterBegin(c *gin.Context) {
if !system_setting.GetPasskeySettings().Enabled {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
@@ -118,7 +119,7 @@ func PasskeyRegisterBegin(c *gin.Context) {
}
func PasskeyRegisterFinish(c *gin.Context) {
if !system_setting.GetPasskeySettings().Enabled {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
@@ -142,12 +143,6 @@ func PasskeyRegisterFinish(c *gin.Context) {
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
if err != nil {
writeSecurityOperationError(c, err)
return
}
credentialRecord, err := model.GetPasskeyByUserID(user.Id)
if err != nil && !errors.Is(err, model.ErrPasskeyNotFound) {
writeSecurityOperationError(c, err)
@@ -171,6 +166,12 @@ func PasskeyRegisterFinish(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
wa, err := passkeysvc.BuildWebAuthnForRPID(c.Request, sessionData.RelyingPartyID)
if err != nil {
writeSecurityOperationError(c, err)
return
}
c.Set("passkey_rp_id", sessionData.RelyingPartyID)
if sessionData.UserVerification != protocol.VerificationRequired {
writeSecurityOperationError(c, model.ErrAuthFlowInvalid)
return
@@ -193,6 +194,7 @@ func PasskeyRegisterFinish(c *gin.Context) {
return
}
passkeyCredential.RPID = &sessionData.RelyingPartyID
if err := model.RegisterPasskeyForSession(identity, passkeyCredential); err != nil {
writeSecurityOperationError(c, err)
return
@@ -281,7 +283,7 @@ func PasskeyStatus(c *gin.Context) {
}
func PasskeyLoginBegin(c *gin.Context) {
if !system_setting.GetPasskeySettings().Enabled {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
@@ -289,7 +291,16 @@ func PasskeyLoginBegin(c *gin.Context) {
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
var request struct {
RPID string `json:"rp_id"`
}
if c.Request.Body != nil && c.Request.ContentLength != 0 {
if common.DecodeJson(c.Request.Body, &request) != nil {
common.ApiErrorMsg(c, "无效的 Passkey 验证请求")
return
}
}
wa, rpIDs, err := passkeysvc.BuildLoginWebAuthn(c.Request, request.RPID, "")
if err != nil {
writeSecurityOperationError(c, err)
return
@@ -316,6 +327,7 @@ func PasskeyLoginBegin(c *gin.Context) {
"message": "",
"data": gin.H{
"options": assertion,
"rp_ids": rpIDs,
"flow_token": flowToken,
"expires_at": expiresAt,
},
@@ -323,7 +335,7 @@ func PasskeyLoginBegin(c *gin.Context) {
}
func PasskeyLoginFinish(c *gin.Context) {
if !system_setting.GetPasskeySettings().Enabled {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
@@ -342,12 +354,6 @@ func PasskeyLoginFinish(c *gin.Context) {
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
if err != nil {
writeSecurityOperationError(c, err)
return
}
sessionData, _, err := passkeysvc.PopSessionDataFlow(
request.FlowToken,
model.AuthFlowPurposePasskeyLogin,
@@ -357,6 +363,12 @@ func PasskeyLoginFinish(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
wa, err := passkeysvc.BuildWebAuthnForRPID(c.Request, sessionData.RelyingPartyID)
if err != nil {
writeSecurityOperationError(c, err)
return
}
c.Set("passkey_rp_id", sessionData.RelyingPartyID)
if sessionData.UserVerification != protocol.VerificationRequired {
writeSecurityOperationError(c, model.ErrAuthFlowInvalid)
return
@@ -369,6 +381,10 @@ func PasskeyLoginFinish(c *gin.Context) {
return nil, fmt.Errorf("未找到 Passkey 凭证: %w", err)
}
if credential.RPID != nil && *credential.RPID != "" && *credential.RPID != sessionData.RelyingPartyID {
return nil, service.ErrVerificationFailed
}
// 通过凭证获取用户
user := &model.User{Id: credential.UserID}
if err := user.FillUserById(); err != nil {
@@ -415,7 +431,7 @@ func PasskeyLoginFinish(c *gin.Context) {
return
}
if err := model.UpdatePasskeyAssertionState(modelUser.Id, credential, time.Now()); err != nil {
if err := model.UpdatePasskeyAssertionState(modelUser.Id, credential, time.Now(), sessionData.RelyingPartyID); err != nil {
writeSecurityOperationError(c, err)
return
}
@@ -474,7 +490,7 @@ func AdminResetPasskey(c *gin.Context) {
}
func PasskeyVerifyBegin(c *gin.Context) {
if !system_setting.GetPasskeySettings().Enabled {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
@@ -516,7 +532,11 @@ func PasskeyVerifyBegin(c *gin.Context) {
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
credentialRPID := ""
if credential.RPID != nil {
credentialRPID = *credential.RPID
}
wa, rpIDs, err := passkeysvc.BuildLoginWebAuthn(c.Request, request.RPID, credentialRPID)
if err != nil {
writeSecurityOperationError(c, err)
return
@@ -544,6 +564,7 @@ func PasskeyVerifyBegin(c *gin.Context) {
"message": "",
"data": gin.H{
"options": assertion,
"rp_ids": rpIDs,
"flow_token": flowToken,
"expires_at": expiresAt,
},
@@ -551,7 +572,7 @@ func PasskeyVerifyBegin(c *gin.Context) {
}
func PasskeyVerifyFinish(c *gin.Context) {
if !system_setting.GetPasskeySettings().Enabled {
if !system_setting.PasskeySettingsSnapshot().Enabled {
c.JSON(http.StatusOK, gin.H{
"success": false,
"message": "管理员未启用 Passkey 登录",
@@ -576,12 +597,6 @@ func PasskeyVerifyFinish(c *gin.Context) {
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
if err != nil {
writeSecurityOperationError(c, err)
return
}
credential, err := model.GetPasskeyByUserID(user.Id)
if err != nil {
c.JSON(http.StatusOK, gin.H{
@@ -605,11 +620,21 @@ func PasskeyVerifyFinish(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
wa, err := passkeysvc.BuildWebAuthnForRPID(c.Request, sessionData.RelyingPartyID)
if err != nil {
writeSecurityOperationError(c, err)
return
}
c.Set("passkey_rp_id", sessionData.RelyingPartyID)
if sessionData.UserVerification != protocol.VerificationRequired {
writeSecurityOperationError(c, model.ErrAuthFlowInvalid)
return
}
if credential.RPID != nil && *credential.RPID != "" && *credential.RPID != sessionData.RelyingPartyID {
writeSecurityOperationError(c, service.ErrVerificationFailed)
return
}
waUser := passkeysvc.NewWebAuthnUser(user, credential)
validatedCredential, err := wa.ValidateLogin(waUser, *sessionData, parsedCredential)
if err != nil {
@@ -617,7 +642,7 @@ func PasskeyVerifyFinish(c *gin.Context) {
return
}
if err := model.UpdatePasskeyAssertionState(user.Id, validatedCredential, time.Now()); err != nil {
if err := model.UpdatePasskeyAssertionState(user.Id, validatedCredential, time.Now(), sessionData.RelyingPartyID); err != nil {
writeSecurityOperationError(c, err)
return
}