xsl/juzi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(h5): apply fourth feedback and tighten local capture validation

Browse Source
This commit is contained in:
xsl
2026-10-12 20:16:41 +08:00
parent e53c809522
commit 92a3965b7d
33 changed files with 3758 additions and 1385 deletions
Download Patch File Download Diff File Expand all files Collapse all files
h5/lib/accounts.js
+3 -3
View File
@@ -87,7 +87,7 @@ module.exports = function createAccounts(root, env = process.env) {
try {
if (req.method !== 'GET' && !sameOrigin(req)) { json(res, 403, { ok: false, message: '请求来源不匹配' }); return true; }
if (pathname === '/api/auth/config' && req.method === 'GET') {
json(res, 200, { ok: true, wechat: available, fallback: 'browser', reason: available ? null : '当前环境尚未开通微信登录，可使用本机浏览器登录' });
json(res, 200, { ok: true, wechat: available, fallback: 'browser', reason: available ? null : '当前环境尚未开通微信登录，可使用游客登录' });
} else if (pathname === '/api/auth/session' && req.method === 'GET') {
json(res, 200, { ok: true, user: publicUser(session(req)) });
} else if (pathname === '/api/auth/browser' && req.method === 'POST') {
@@ -98,7 +98,7 @@ module.exports = function createAccounts(root, env = process.env) {
if (token) {
if (typeof token !== 'string' || !/^[a-f0-9]{64}$/.test(token)) token = null;
user = token && db.users.find(u => u.kind === 'browser' && u.credential === hash(token));
if (!user) { json(res, 401, { ok: false, message: '本机身份已失效，请重新登录' }); return true; }
if (!user) { json(res, 401, { ok: false, message: '游客身份已失效，请重新登录' }); return true; }
} else {
token = random(); user = { id: crypto.randomUUID(), kind: 'browser', credential: hash(token), consent: new Date().toISOString(), reports: [] };
db.users.push(user);
@@ -110,7 +110,7 @@ module.exports = function createAccounts(root, env = process.env) {
} else if (pathname === '/api/auth/wechat' && req.method === 'POST') {
const data = await body(req);
if (data.consent !== true) { json(res, 400, { ok: false, message: '请先阅读并同意协议' }); return true; }
if (!available) { json(res, 503, { ok: false, message: '微信登录尚未配置，请使用本机浏览器登录' }); return true; }
if (!available) { json(res, 503, { ok: false, message: '微信登录尚未配置，请使用游客登录' }); return true; }
if (!rate(req)) { json(res, 429, { ok: false, message: '操作频繁，请稍后重试' }); return true; }
const state = random(), binding = random();
for (const k of Object.keys(db.states)) if (db.states[k].expires < Date.now()) delete db.states[k];