cneicy/new-api-custom
1
0 Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

feat: sync deployed v1.0.0-rc.38-custom.42

Browse Source 
Sync production source including routing, billing, Astra detection and public uptime. Update custom build instructions and license packaging.
This commit is contained in:
cneicy committed 2026-09-26 04:49:11 +08:00
1 parent aa6c3f50f4
commit ceddfd3d6b
828 files changed
+122253 -13702
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

controller/login_verification.go
+27 -9
View File
@@ -30,17 +30,18 @@ func VerifyLogin(c *gin.Context) {
writeSecurityOperationError(c, service.ErrProofMethod)
return
}
bundle, err := service.VerifyLoginCode(request.FlowToken, request.Code, c.ClientIP(), c.Request.UserAgent())
bundle, migration, err := service.VerifyLoginCode(request.FlowToken, request.Code, c.ClientIP(), c.Request.UserAgent())
if err != nil {
writeSecurityOperationError(c, err)
return
}
completeVerifiedLoginResponse(c, bundle, service.VerificationMethodTwoFA)
completeVerifiedLoginResponse(c, bundle, service.VerificationMethodTwoFA, migration)
}
func LoginPasskeyBegin(c *gin.Context) {
var request struct {
FlowToken string `json:"flow_token"`
RPID string `json:"rp_id"`
}
if common.DecodeJson(c.Request.Body, &request) != nil || request.FlowToken == "" {
common.ApiErrorMsg(c, "参数错误")
@@ -56,7 +57,11 @@ func LoginPasskeyBegin(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
credentialRPID := ""
if credential.RPID != nil {
credentialRPID = *credential.RPID
}
wa, rpIDs, err := passkeysvc.BuildLoginWebAuthn(c.Request, request.RPID, credentialRPID)
if err != nil {
writeSecurityOperationError(c, err)
return
@@ -75,7 +80,7 @@ func LoginPasskeyBegin(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
common.ApiSuccess(c, gin.H{"flow_token": token, "expires_at": expiresAt, "options": options})
common.ApiSuccess(c, gin.H{"flow_token": token, "expires_at": expiresAt, "options": options, "rp_ids": rpIDs})
}
func LoginPasskeyFinish(c *gin.Context) {
@@ -104,6 +109,7 @@ func LoginPasskeyFinish(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
c.Set("passkey_rp_id", sessionData.RelyingPartyID)
if security.LoginFlowID != verification.Flow.Id || sessionData.UserVerification != protocol.VerificationRequired {
writeSecurityOperationError(c, model.ErrAuthFlowInvalid)
return
@@ -113,29 +119,33 @@ func LoginPasskeyFinish(c *gin.Context) {
writeSecurityOperationError(c, err)
return
}
wa, err := passkeysvc.BuildWebAuthn(c.Request)
wa, err := passkeysvc.BuildWebAuthnForRPID(c.Request, sessionData.RelyingPartyID)
if err != nil {
writeSecurityOperationError(c, err)
return
}
if credential.RPID != nil && *credential.RPID != "" && *credential.RPID != sessionData.RelyingPartyID {
writeSecurityOperationError(c, service.ErrVerificationFailed)
return
}
validated, err := wa.ValidateLogin(passkeysvc.NewWebAuthnUser(&model.User{Id: identity.UserID}, credential), *sessionData, parsed)
if err != nil {
writeSecurityOperationError(c, err)
return
}
if err := model.UpdatePasskeyAssertionState(identity.UserID, validated, time.Now()); err != nil {
if err := model.UpdatePasskeyAssertionState(identity.UserID, validated, time.Now(), sessionData.RelyingPartyID); err != nil {
writeSecurityOperationError(c, err)
return
}
bundle, err := service.CompleteLoginVerification(request.FlowToken, verification, service.VerificationMethodPasskey, c.ClientIP(), c.Request.UserAgent())
bundle, migration, err := service.CompleteLoginVerification(request.FlowToken, verification, service.VerificationMethodPasskey, c.ClientIP(), c.Request.UserAgent())
if err != nil {
writeSecurityOperationError(c, err)
return
}
completeVerifiedLoginResponse(c, bundle, service.VerificationMethodPasskey)
completeVerifiedLoginResponse(c, bundle, service.VerificationMethodPasskey, migration)
}
func completeVerifiedLoginResponse(c *gin.Context, bundle *service.AuthBundle, method string) {
func completeVerifiedLoginResponse(c *gin.Context, bundle *service.AuthBundle, method string, migration *service.LegacyGitHubMigration) {
identity, err := service.ParseAccessToken(bundle.AccessToken)
if err != nil {
writeAuthSessionError(c, err)
@@ -147,5 +157,13 @@ func completeVerifiedLoginResponse(c *gin.Context, bundle *service.AuthBundle, m
return
}
c.Set("login_verification_method", method)
if migration != nil {
// The legacy GitHub binding was rewritten together with this session.
notificationFailed := service.NotifyAccountSecurityChange(user.Email, "Login account linked: GitHub") != nil
recordLegacyGitHubBindingAudit(c, user, true, map[string]any{
"legacy_id": migration.LegacyID, "provider_user_id": migration.GitHubID,
"verification_method": method, "notification_failed": notificationFailed,
})
}
writeLoginResponse(c, user, bundle)
}