feat(auth): P0 登录与会话（迁移 v16、argon2id、HttpOnly Cookie）
- 迁移机制：schema::migrate 支持 15→16，新增 admin/session/setting 表 - 接口：session/setup/login/logout/password；SameSite=Strict + Origin 校验 + 失败限流 - 会话只存 token 的 sha256；改密清空全部会话 - 前端：/login 独立壳（首次=设置密码），页头登录/退出切换 - 测试：37 passed（迁移 + 登录/会话 4 例） - 文档：README 登录说明、docs/ADMIN-PLAN.md 方案与 P0 记录
This commit is contained in:
stash
Generated
+163
@@ -79,6 +79,18 @@ version = "1.0.104"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
|
||||
|
||||
[[package]]
|
||||
name = "argon2"
|
||||
version = "0.5.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"blake2",
|
||||
"cpufeatures",
|
||||
"password-hash",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "async-stream"
|
||||
version = "0.3.6"
|
||||
@@ -159,12 +171,36 @@ dependencies = [
|
||||
"tracing",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "base64ct"
|
||||
version = "1.8.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
|
||||
|
||||
[[package]]
|
||||
name = "bitflags"
|
||||
version = "2.13.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
|
||||
|
||||
[[package]]
|
||||
name = "blake2"
|
||||
version = "0.10.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
|
||||
dependencies = [
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "block-buffer"
|
||||
version = "0.10.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
|
||||
dependencies = [
|
||||
"generic-array",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "bytes"
|
||||
version = "1.12.1"
|
||||
@@ -242,6 +278,36 @@ dependencies = [
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cpufeatures"
|
||||
version = "0.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "crypto-common"
|
||||
version = "0.1.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
|
||||
dependencies = [
|
||||
"generic-array",
|
||||
"typenum",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "digest"
|
||||
version = "0.10.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
|
||||
dependencies = [
|
||||
"block-buffer",
|
||||
"crypto-common",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "errno"
|
||||
version = "0.3.14"
|
||||
@@ -318,6 +384,27 @@ dependencies = [
|
||||
"slab",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "generic-array"
|
||||
version = "0.14.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
|
||||
dependencies = [
|
||||
"typenum",
|
||||
"version_check",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.2.17"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"libc",
|
||||
"wasi",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "hashbrown"
|
||||
version = "0.14.5"
|
||||
@@ -656,6 +743,17 @@ dependencies = [
|
||||
"windows-link",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "password-hash"
|
||||
version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"rand_core",
|
||||
"subtle",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "percent-encoding"
|
||||
version = "2.3.2"
|
||||
@@ -694,6 +792,15 @@ version = "0.3.34"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
|
||||
|
||||
[[package]]
|
||||
name = "ppv-lite86"
|
||||
version = "0.2.21"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
|
||||
dependencies = [
|
||||
"zerocopy",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.107"
|
||||
@@ -712,6 +819,36 @@ dependencies = [
|
||||
"proc-macro2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rand"
|
||||
version = "0.8.8"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"rand_chacha",
|
||||
"rand_core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rand_chacha"
|
||||
version = "0.3.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
|
||||
dependencies = [
|
||||
"ppv-lite86",
|
||||
"rand_core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rand_core"
|
||||
version = "0.6.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
|
||||
dependencies = [
|
||||
"getrandom",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "redox_syscall"
|
||||
version = "0.5.18"
|
||||
@@ -839,6 +976,17 @@ dependencies = [
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha2"
|
||||
version = "0.10.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"cpufeatures",
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sharded-slab"
|
||||
version = "0.1.7"
|
||||
@@ -891,6 +1039,7 @@ name = "stash"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"argon2",
|
||||
"async-stream",
|
||||
"axum",
|
||||
"clap",
|
||||
@@ -898,9 +1047,11 @@ dependencies = [
|
||||
"include_dir",
|
||||
"mime_guess",
|
||||
"notify",
|
||||
"rand",
|
||||
"rusqlite",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"sha2",
|
||||
"thiserror",
|
||||
"tokio",
|
||||
"tower 0.4.13",
|
||||
@@ -916,6 +1067,12 @@ version = "0.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
|
||||
|
||||
[[package]]
|
||||
name = "subtle"
|
||||
version = "2.6.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "2.0.119"
|
||||
@@ -1145,6 +1302,12 @@ dependencies = [
|
||||
"tracing-log",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "typenum"
|
||||
version = "1.20.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
|
||||
|
||||
[[package]]
|
||||
name = "unicase"
|
||||
version = "2.10.0"
|
||||
|
||||
@@ -27,6 +27,9 @@ notify = "8"
|
||||
|
||||
# 内容库：SQLite 随二进制静态编译，运行时不需要任何外部 DLL
|
||||
rusqlite = { version = "0.32", features = ["bundled"] }
|
||||
argon2 = "0.5"
|
||||
rand = "0.8"
|
||||
sha2 = "0.10"
|
||||
|
||||
[build-dependencies]
|
||||
# build.rs 用它递归复制前端产物到 $OUT_DIR/web
|
||||
|
||||
@@ -31,6 +31,14 @@ cargo run -- --root ./sites --host 0.0.0.0 --port 3000
|
||||
- Rust 工具链（2024 Edition）
|
||||
- Node.js 24，推荐用 [Volta](https://volta.sh/) 管理；`stash-web/package.json` 里已用 `volta` 字段固定版本
|
||||
|
||||
### 登录（v0.1.1 起）
|
||||
|
||||
- 首次打开 `http://127.0.0.1:8080/login` 是**设置密码**（至少 8 位），之后是登录；
|
||||
- 密码用 argon2id 哈希存在 `data/stash.db` 的 `admin` 表，会话是 HttpOnly + SameSite=Strict 的 Cookie（7 天）；
|
||||
- 读接口公开（本地工具可只读使用），写接口（`/api/auth/password` 及后续编辑接口）要求登录；
|
||||
- 忘记密码：删除 `admin` 表里的那一行（或整个库）后重启，会回到「设置密码」；
|
||||
- 方案与后续阶段见 [`docs/ADMIN-PLAN.md`](docs/ADMIN-PLAN.md)。
|
||||
|
||||
## 工作方式
|
||||
|
||||
请求按下面的顺序命中：
|
||||
|
||||
@@ -144,3 +144,17 @@ DELETE /api/items/:id
|
||||
3. 读接口是否也要登录：公开（推荐）/ 全站需登录。
|
||||
4. 内容编辑是否要「草稿 → 发布」两态：先不要（推荐，保持即时生效）/ 要。
|
||||
5. 编辑图片：先只接受 URL（推荐，P2 后期再做上传）/ 首期就要上传。
|
||||
|
||||
## 11. 实施记录
|
||||
|
||||
### P0（已完成，2026-10-29）
|
||||
|
||||
- 迁移机制：`user_version 15 → 16`，`schema::migrate` 逐级升级；v15 老库启动时自动补 `admin` / `session` / `setting` 三表；
|
||||
- 登录：`POST /api/auth/setup`（仅首次）、`/login`、`/logout`、`PATCH /api/auth/password`；argon2id + sha256(token) 落库；
|
||||
- 会话：HttpOnly + SameSite=Strict + Path=/，7 天；改密后所有会话失效；
|
||||
- 防护：Origin 同源校验、连续失败 5 次锁 60 秒；
|
||||
- 前端：`/login` 独立壳（入口按 pathname 分流）、页头登录/退出登录切换；
|
||||
- 测试：后端 37 个单测（新增迁移 2 个 + 登录 4 个），登录流程 e2e 手动脚本验证通过。
|
||||
|
||||
**未做（P1/P2）**：`/admin` 设置页、侧栏/页头编辑、内容就编辑、`setting` 表的读写接口。
|
||||
|
||||
|
||||
+309
@@ -0,0 +1,309 @@
|
||||
//! 登录与会话。
|
||||
//!
|
||||
//! - 单管理员：`admin` 表只允许一行，密码用 argon2id 存 PHC 字符串；
|
||||
//! - 会话：随机 32 字节 token 放在 HttpOnly Cookie 里，库里只存它的 sha256；
|
||||
//! - 所有函数都是同步的，调用方负责放到 `spawn_blocking` 里。
|
||||
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
use argon2::{
|
||||
Argon2, PasswordHash, PasswordHasher, PasswordVerifier,
|
||||
password_hash::{SaltString, rand_core::OsRng},
|
||||
};
|
||||
use rusqlite::{Connection, OptionalExtension, params};
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
use crate::{db::map_error, error::StashError};
|
||||
|
||||
/// 会话有效期：7 天
|
||||
pub const SESSION_TTL_SECS: i64 = 7 * 24 * 60 * 60;
|
||||
/// 密码最短长度
|
||||
pub const MIN_PASSWORD_LEN: usize = 8;
|
||||
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Default, serde::Serialize)]
|
||||
pub struct SessionState {
|
||||
pub authenticated: bool,
|
||||
/// 是否已经设置过管理员密码（前端据此显示「登录」还是「首次设置」）
|
||||
pub has_admin: bool,
|
||||
pub username: Option<String>,
|
||||
}
|
||||
|
||||
fn now() -> i64 {
|
||||
SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|duration| duration.as_secs() as i64)
|
||||
.unwrap_or(0)
|
||||
}
|
||||
|
||||
fn hash_token(token: &str) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
hasher.update(token.as_bytes());
|
||||
hasher.finalize().iter().map(|byte| format!("{byte:02x}")).collect()
|
||||
}
|
||||
|
||||
fn random_token() -> String {
|
||||
let bytes: [u8; 32] = rand::random();
|
||||
bytes.iter().map(|byte| format!("{byte:02x}")).collect()
|
||||
}
|
||||
|
||||
fn hash_password(password: &str) -> Result<String, StashError> {
|
||||
let salt = SaltString::generate(&mut OsRng);
|
||||
Argon2::default()
|
||||
.hash_password(password.as_bytes(), &salt)
|
||||
.map(|hash| hash.to_string())
|
||||
.map_err(|error| StashError::Database(format!("密码哈希失败: {error}")))
|
||||
}
|
||||
|
||||
fn verify_hash(password: &str, hash: &str) -> bool {
|
||||
match PasswordHash::new(hash) {
|
||||
Ok(parsed) => Argon2::default()
|
||||
.verify_password(password.as_bytes(), &parsed)
|
||||
.is_ok(),
|
||||
Err(_) => false,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn has_admin(conn: &Connection) -> Result<bool, StashError> {
|
||||
let count: i64 = conn
|
||||
.query_row("SELECT COUNT(*) FROM admin", [], |row| row.get(0))
|
||||
.map_err(map_error)?;
|
||||
Ok(count > 0)
|
||||
}
|
||||
|
||||
fn admin_row(conn: &Connection) -> Result<Option<(String, String)>, StashError> {
|
||||
conn.query_row("SELECT username, password_hash FROM admin WHERE id = 1", [], |row| {
|
||||
Ok((row.get(0)?, row.get(1)?))
|
||||
})
|
||||
.optional()
|
||||
.map_err(map_error)
|
||||
}
|
||||
|
||||
fn validate_password(password: &str) -> Result<(), StashError> {
|
||||
if password.chars().count() < MIN_PASSWORD_LEN {
|
||||
return Err(StashError::InvalidDirectory(format!(
|
||||
"密码至少 {MIN_PASSWORD_LEN} 位"
|
||||
)));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// 首次设置管理员密码；已经设置过则拒绝。
|
||||
pub fn create_admin(conn: &Connection, username: &str, password: &str) -> Result<(), StashError> {
|
||||
validate_password(password)?;
|
||||
if has_admin(conn)? {
|
||||
return Err(StashError::InvalidDirectory("管理员已存在，不能重复初始化".into()));
|
||||
}
|
||||
|
||||
let hash = hash_password(password)?;
|
||||
conn.execute(
|
||||
"INSERT INTO admin (id, username, password_hash, updated_at) VALUES (1, ?1, ?2, ?3)",
|
||||
params![username, hash, now()],
|
||||
)
|
||||
.map_err(map_error)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// 校验密码；成功返回用户名。
|
||||
pub fn verify_login(conn: &Connection, password: &str) -> Result<Option<String>, StashError> {
|
||||
let Some((username, hash)) = admin_row(conn)? else {
|
||||
return Ok(None);
|
||||
};
|
||||
Ok(verify_hash(password, &hash).then_some(username))
|
||||
}
|
||||
|
||||
/// 修改密码：必须提供当前密码；成功后清掉其它会话。
|
||||
pub fn change_password(
|
||||
conn: &mut Connection,
|
||||
current: &str,
|
||||
next: &str,
|
||||
) -> Result<bool, StashError> {
|
||||
validate_password(next)?;
|
||||
let Some((_, hash)) = admin_row(conn)? else {
|
||||
return Err(StashError::InvalidDirectory("尚未设置管理员密码".into()));
|
||||
};
|
||||
if !verify_hash(current, &hash) {
|
||||
return Ok(false);
|
||||
}
|
||||
|
||||
let new_hash = hash_password(next)?;
|
||||
let tx = conn.transaction().map_err(map_error)?;
|
||||
tx.execute(
|
||||
"UPDATE admin SET password_hash = ?1, updated_at = ?2 WHERE id = 1",
|
||||
params![new_hash, now()],
|
||||
)
|
||||
.map_err(map_error)?;
|
||||
tx.execute("DELETE FROM session", []).map_err(map_error)?;
|
||||
tx.commit().map_err(map_error)?;
|
||||
Ok(true)
|
||||
}
|
||||
|
||||
/// 新建会话，返回**原始 token**（只在这里出现一次，库里存哈希）。
|
||||
pub fn issue_session(conn: &Connection) -> Result<String, StashError> {
|
||||
let token = random_token();
|
||||
let issued = now();
|
||||
conn.execute(
|
||||
"INSERT INTO session (token_hash, created_at, expires_at, last_seen_at)
|
||||
VALUES (?1, ?2, ?3, ?2)",
|
||||
params![hash_token(&token), issued, issued + SESSION_TTL_SECS],
|
||||
)
|
||||
.map_err(map_error)?;
|
||||
Ok(token)
|
||||
}
|
||||
|
||||
/// 读取会话状态；token 无效/过期都返回未登录。
|
||||
pub fn state(conn: &Connection, token: Option<&str>) -> Result<SessionState, StashError> {
|
||||
let has = has_admin(conn)?;
|
||||
let Some(token) = token else {
|
||||
return Ok(SessionState {
|
||||
authenticated: false,
|
||||
has_admin: has,
|
||||
username: None,
|
||||
});
|
||||
};
|
||||
|
||||
let token_hash = hash_token(token);
|
||||
let row: Option<(i64,)> = conn
|
||||
.query_row(
|
||||
"SELECT expires_at FROM session WHERE token_hash = ?1",
|
||||
[&token_hash],
|
||||
|row| Ok((row.get(0)?,)),
|
||||
)
|
||||
.optional()
|
||||
.map_err(map_error)?;
|
||||
|
||||
let Some((expires_at,)) = row else {
|
||||
return Ok(SessionState {
|
||||
authenticated: false,
|
||||
has_admin: has,
|
||||
username: None,
|
||||
});
|
||||
};
|
||||
|
||||
if expires_at <= now() {
|
||||
conn.execute("DELETE FROM session WHERE token_hash = ?1", [&token_hash])
|
||||
.map_err(map_error)?;
|
||||
return Ok(SessionState {
|
||||
authenticated: false,
|
||||
has_admin: has,
|
||||
username: None,
|
||||
});
|
||||
}
|
||||
|
||||
conn.execute(
|
||||
"UPDATE session SET last_seen_at = ?1 WHERE token_hash = ?2",
|
||||
params![now(), token_hash],
|
||||
)
|
||||
.map_err(map_error)?;
|
||||
|
||||
Ok(SessionState {
|
||||
authenticated: true,
|
||||
has_admin: has,
|
||||
username: admin_row(conn)?.map(|(username, _)| username),
|
||||
})
|
||||
}
|
||||
|
||||
pub fn revoke(conn: &Connection, token: &str) -> Result<(), StashError> {
|
||||
conn.execute("DELETE FROM session WHERE token_hash = ?1", [hash_token(token)])
|
||||
.map_err(map_error)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// 清理过期会话（登录时顺手调用即可）。
|
||||
pub fn purge_expired(conn: &Connection) -> Result<(), StashError> {
|
||||
conn.execute("DELETE FROM session WHERE expires_at <= ?1", [now()])
|
||||
.map_err(map_error)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn db() -> Connection {
|
||||
let conn = Connection::open_in_memory().expect("内存库应能打开");
|
||||
conn.execute_batch(
|
||||
"CREATE TABLE admin (
|
||||
id INTEGER PRIMARY KEY CHECK (id = 1),
|
||||
username TEXT NOT NULL,
|
||||
password_hash TEXT NOT NULL,
|
||||
updated_at INTEGER NOT NULL
|
||||
);
|
||||
CREATE TABLE session (
|
||||
token_hash TEXT PRIMARY KEY,
|
||||
created_at INTEGER NOT NULL,
|
||||
expires_at INTEGER NOT NULL,
|
||||
last_seen_at INTEGER NOT NULL
|
||||
);",
|
||||
)
|
||||
.expect("应能建表");
|
||||
conn
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn setup_then_login_and_session() {
|
||||
let conn = db();
|
||||
assert!(!has_admin(&conn).expect("可查"));
|
||||
create_admin(&conn, "admin", "stash-pass-1").expect("首次设置应成功");
|
||||
|
||||
assert!(has_admin(&conn).expect("可查"));
|
||||
assert!(verify_login(&conn, "wrong-pass").expect("可校验").is_none());
|
||||
assert_eq!(
|
||||
verify_login(&conn, "stash-pass-1").expect("可校验").as_deref(),
|
||||
Some("admin")
|
||||
);
|
||||
|
||||
let token = issue_session(&conn).expect("应能建会话");
|
||||
let session = state(&conn, Some(&token)).expect("应能读状态");
|
||||
assert!(session.authenticated);
|
||||
assert_eq!(session.username.as_deref(), Some("admin"));
|
||||
|
||||
// 原始 token 不落库
|
||||
let stored: String = conn
|
||||
.query_row("SELECT token_hash FROM session", [], |row| row.get(0))
|
||||
.expect("应有会话行");
|
||||
assert_ne!(stored, token);
|
||||
assert_eq!(stored, hash_token(&token));
|
||||
|
||||
revoke(&conn, &token).expect("应能撤销");
|
||||
assert!(!state(&conn, Some(&token)).expect("应能读状态").authenticated);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rejects_short_password_and_second_setup() {
|
||||
let conn = db();
|
||||
assert!(create_admin(&conn, "admin", "short").is_err());
|
||||
create_admin(&conn, "admin", "stash-pass-1").expect("首次设置应成功");
|
||||
assert!(create_admin(&conn, "admin", "stash-pass-2").is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn change_password_requires_current_and_clears_sessions() {
|
||||
let mut conn = db();
|
||||
create_admin(&conn, "admin", "stash-pass-1").expect("应能设置");
|
||||
let token = issue_session(&conn).expect("应能建会话");
|
||||
|
||||
assert!(!change_password(&mut conn, "nope", "stash-pass-2").expect("可调用"));
|
||||
assert!(change_password(&mut conn, "stash-pass-1", "stash-pass-2").expect("可调用"));
|
||||
|
||||
assert_eq!(
|
||||
verify_login(&conn, "stash-pass-2").expect("可校验").as_deref(),
|
||||
Some("admin")
|
||||
);
|
||||
assert!(!state(&conn, Some(&token)).expect("可读").authenticated);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn expired_session_is_rejected_and_deleted() {
|
||||
let conn = db();
|
||||
create_admin(&conn, "admin", "stash-pass-1").expect("应能设置");
|
||||
let token = issue_session(&conn).expect("应能建会话");
|
||||
conn.execute("UPDATE session SET expires_at = ?1", [now() - 1])
|
||||
.expect("应能改过期时间");
|
||||
|
||||
assert!(!state(&conn, Some(&token)).expect("可读").authenticated);
|
||||
let count: i64 = conn
|
||||
.query_row("SELECT COUNT(*) FROM session", [], |row| row.get(0))
|
||||
.expect("可查");
|
||||
assert_eq!(count, 0, "过期会话应被删除");
|
||||
}
|
||||
}
|
||||
+79
-22
@@ -8,6 +8,7 @@
|
||||
//! 3. **开发期不做迁移**：表结构还在变，改结构就删掉 `data/stash.db` 重启，
|
||||
//! 启动时会重新建表并灌入内嵌种子。
|
||||
|
||||
pub mod auth;
|
||||
mod catalog;
|
||||
mod schema;
|
||||
|
||||
@@ -21,6 +22,9 @@ use crate::{config::Config, error::StashError};
|
||||
|
||||
pub use schema::SeedReport;
|
||||
|
||||
/// 登录/会话的对外状态（server 层直接用）。
|
||||
pub use auth::SessionState;
|
||||
|
||||
/// 一次查询得到的完整内容目录。
|
||||
///
|
||||
/// 侧栏已改为由这份分类树派生，不再单独下发导航数据。
|
||||
@@ -57,14 +61,14 @@ impl Db {
|
||||
)
|
||||
.map_err(map_error)?;
|
||||
|
||||
// 先校验结构版本，再动任何东西：旧库直接报错，避免用旧表跑新查询
|
||||
let version = schema::check_version(&conn)?;
|
||||
|
||||
schema::apply(&conn)?;
|
||||
|
||||
// 写入当前结构版本，供下次启动比对
|
||||
conn.pragma_update(None, "user_version", schema::SCHEMA_VERSION)
|
||||
.map_err(map_error)?;
|
||||
// 先迁移结构，再动数据：迁移失败会直接报错，不会用半套表跑查询
|
||||
let version = schema::migrate(&conn)?;
|
||||
if version != schema::SCHEMA_VERSION {
|
||||
return Err(StashError::Database(format!(
|
||||
"内容库迁移后版本为 {version}，期望 {}",
|
||||
schema::SCHEMA_VERSION
|
||||
)));
|
||||
}
|
||||
|
||||
// 空库才灌种子：用户删掉内置条目后重启不会被重新塞回来
|
||||
let existing: i64 = conn
|
||||
@@ -115,6 +119,39 @@ impl Db {
|
||||
.lock()
|
||||
.map_err(|_| StashError::Database("数据库连接锁已损坏，请重启进程".into()))
|
||||
}
|
||||
|
||||
// ---------- 登录 / 会话 ----------
|
||||
|
||||
pub fn auth_state(&self, token: Option<&str>) -> Result<SessionState, StashError> {
|
||||
let conn = self.lock()?;
|
||||
auth::state(&conn, token)
|
||||
}
|
||||
|
||||
pub fn setup_admin(&self, username: &str, password: &str) -> Result<(), StashError> {
|
||||
let conn = self.lock()?;
|
||||
auth::create_admin(&conn, username, password)
|
||||
}
|
||||
|
||||
pub fn login(&self, password: &str) -> Result<Option<String>, StashError> {
|
||||
let conn = self.lock()?;
|
||||
auth::purge_expired(&conn)?;
|
||||
auth::verify_login(&conn, password)
|
||||
}
|
||||
|
||||
pub fn issue_session(&self) -> Result<String, StashError> {
|
||||
let conn = self.lock()?;
|
||||
auth::issue_session(&conn)
|
||||
}
|
||||
|
||||
pub fn logout(&self, token: &str) -> Result<(), StashError> {
|
||||
let conn = self.lock()?;
|
||||
auth::revoke(&conn, token)
|
||||
}
|
||||
|
||||
pub fn change_password(&self, current: &str, next: &str) -> Result<bool, StashError> {
|
||||
let mut conn = self.lock()?;
|
||||
auth::change_password(&mut conn, current, next)
|
||||
}
|
||||
}
|
||||
|
||||
/// 把 rusqlite 的错误统一收敛成 `StashError::Database`。
|
||||
@@ -446,37 +483,57 @@ mod tests {
|
||||
assert!(db.data_version().expect("应能读取 data_version") >= 0);
|
||||
}
|
||||
|
||||
/// 全新库（user_version = 0）允许直接建表；当前版本也允许。
|
||||
/// 全新库（user_version = 0）建全量结构；当前版本直接返回；
|
||||
/// 15 会迁移到 16；比程序新的版本拒绝。
|
||||
#[test]
|
||||
fn accepts_fresh_or_current_schema_version() {
|
||||
fn migrates_fresh_previous_and_current_schema() {
|
||||
let conn = Connection::open_in_memory().expect("内存库应能打开");
|
||||
|
||||
assert_eq!(
|
||||
schema::check_version(&conn).expect("全新库应放行"),
|
||||
0,
|
||||
"新库的 user_version 应为 0"
|
||||
schema::migrate(&conn).expect("全新库应能建表"),
|
||||
schema::SCHEMA_VERSION,
|
||||
"新库应直接建到当前版本"
|
||||
);
|
||||
|
||||
conn.pragma_update(None, "user_version", schema::SCHEMA_VERSION)
|
||||
.expect("应能写入版本");
|
||||
let fresh = Connection::open_in_memory().expect("内存库应能打开");
|
||||
fresh
|
||||
.execute_batch(
|
||||
"CREATE TABLE node (key TEXT PRIMARY KEY);
|
||||
PRAGMA user_version = 15;",
|
||||
)
|
||||
.expect("应能造出 v15 老库");
|
||||
assert_eq!(
|
||||
schema::check_version(&conn).expect("当前版本应放行"),
|
||||
schema::migrate(&fresh).expect("v15 应能迁移"),
|
||||
schema::SCHEMA_VERSION
|
||||
);
|
||||
|
||||
let migrated: i64 = fresh
|
||||
.pragma_query_value(None, "user_version", |row| row.get(0))
|
||||
.expect("应能读出版本");
|
||||
assert_eq!(migrated, schema::SCHEMA_VERSION);
|
||||
|
||||
let table: i64 = fresh
|
||||
.query_row(
|
||||
"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name IN ('admin','session','setting')",
|
||||
[],
|
||||
|row| row.get(0),
|
||||
)
|
||||
.expect("应能查表");
|
||||
assert_eq!(table, 3, "迁移后必须有登录/设置三张表");
|
||||
}
|
||||
|
||||
/// 结构变过之后，旧库必须被拒绝并提示删库，而不是用旧表跑新查询。
|
||||
/// 比程序更新的库必须被拒绝，不能按旧结构乱读。
|
||||
#[test]
|
||||
fn rejects_database_from_older_schema() {
|
||||
fn rejects_database_from_newer_schema() {
|
||||
let conn = Connection::open_in_memory().expect("内存库应能打开");
|
||||
conn.pragma_update(None, "user_version", schema::SCHEMA_VERSION - 1)
|
||||
.expect("应能写入旧版本号");
|
||||
conn.pragma_update(None, "user_version", schema::SCHEMA_VERSION + 1)
|
||||
.expect("应能写入新版本号");
|
||||
|
||||
let error = schema::check_version(&conn).expect_err("旧库必须被拒绝");
|
||||
let error = schema::migrate(&conn).expect_err("更新的库必须被拒绝");
|
||||
let message = error.to_string();
|
||||
|
||||
assert!(message.contains("结构版本"), "报错要说明原因: {message}");
|
||||
assert!(message.contains("删除数据库"), "报错要给出处理方式: {message}");
|
||||
assert!(message.contains("升级程序"), "报错要给出处理方式: {message}");
|
||||
}
|
||||
|
||||
/// 回归测试：外部连接提交后，服务端连接读到的 data_version 必须变化。
|
||||
|
||||
+96
-12
@@ -100,6 +100,60 @@ CREATE TABLE IF NOT EXISTS section_block (
|
||||
preview_limit INTEGER, -- 卡片里显示几条；NULL 时用前端默认
|
||||
sort INTEGER NOT NULL DEFAULT 0 -- 卡片顺序
|
||||
);
|
||||
|
||||
-- ========== v16：登录与设置 ==========
|
||||
|
||||
-- 管理员：单用户场景只允许一行
|
||||
CREATE TABLE IF NOT EXISTS admin (
|
||||
id INTEGER PRIMARY KEY CHECK (id = 1),
|
||||
username TEXT NOT NULL,
|
||||
password_hash TEXT NOT NULL, -- argon2id PHC 字符串
|
||||
updated_at INTEGER NOT NULL -- unix 秒
|
||||
);
|
||||
|
||||
-- 会话：只存 token 的 sha256，原始 token 只在 Cookie 里
|
||||
CREATE TABLE IF NOT EXISTS session (
|
||||
token_hash TEXT PRIMARY KEY,
|
||||
created_at INTEGER NOT NULL,
|
||||
expires_at INTEGER NOT NULL,
|
||||
last_seen_at INTEGER NOT NULL
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS session_expiry_idx ON session(expires_at);
|
||||
|
||||
-- 全局设置：一个 key 一段 JSON，version 用于乐观锁
|
||||
CREATE TABLE IF NOT EXISTS setting (
|
||||
key TEXT PRIMARY KEY,
|
||||
value TEXT NOT NULL,
|
||||
version INTEGER NOT NULL DEFAULT 1,
|
||||
updated_at INTEGER NOT NULL
|
||||
);
|
||||
"#;
|
||||
|
||||
/// v15 → v16 的增量（老库升级用；新库直接走 SCHEMA_SQL）。
|
||||
const V16_SQL: &str = r#"
|
||||
CREATE TABLE IF NOT EXISTS admin (
|
||||
id INTEGER PRIMARY KEY CHECK (id = 1),
|
||||
username TEXT NOT NULL,
|
||||
password_hash TEXT NOT NULL,
|
||||
updated_at INTEGER NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS session (
|
||||
token_hash TEXT PRIMARY KEY,
|
||||
created_at INTEGER NOT NULL,
|
||||
expires_at INTEGER NOT NULL,
|
||||
last_seen_at INTEGER NOT NULL
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS session_expiry_idx ON session(expires_at);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS setting (
|
||||
key TEXT PRIMARY KEY,
|
||||
value TEXT NOT NULL,
|
||||
version INTEGER NOT NULL DEFAULT 1,
|
||||
updated_at INTEGER NOT NULL
|
||||
);
|
||||
"#;
|
||||
|
||||
/// 种子导入结果，仅用于启动日志。
|
||||
@@ -115,28 +169,58 @@ pub struct SeedReport {
|
||||
|
||||
/// 当前表结构版本，写在 SQLite 的 `PRAGMA user_version` 里。
|
||||
///
|
||||
/// 开发阶段不做迁移：版本对不上时直接拒绝启动，让用户删库重建，
|
||||
/// 比悄悄用旧表跑新查询（最终表现为 500）好排查得多。
|
||||
/// 结构调整时把这个数字 +1。
|
||||
pub const SCHEMA_VERSION: i64 = 15;
|
||||
/// 从 v16 起有了第一套迁移：`migrate` 会把老库逐级升上来，
|
||||
/// 只有「比程序更新」或「没有迁移路径」的版本才拒绝启动。
|
||||
pub const SCHEMA_VERSION: i64 = 16;
|
||||
|
||||
/// 校验库结构版本：0 表示全新库，允许；其它非当前版本一律拒绝。
|
||||
pub fn check_version(conn: &Connection) -> Result<i64, StashError> {
|
||||
let version: i64 = conn
|
||||
.pragma_query_value(None, "user_version", |row| row.get(0))
|
||||
fn current_version(conn: &Connection) -> Result<i64, StashError> {
|
||||
conn.pragma_query_value(None, "user_version", |row| row.get(0))
|
||||
.map_err(map_error)
|
||||
}
|
||||
|
||||
/// 把库升到 `SCHEMA_VERSION`，返回升级后的版本。
|
||||
///
|
||||
/// - 0：全新库，建全量结构；
|
||||
/// - 15：补 v16 的登录/设置表；
|
||||
/// - 16：已是最新；
|
||||
/// - 其它：拒绝启动（不猜结构）。
|
||||
pub fn migrate(conn: &Connection) -> Result<i64, StashError> {
|
||||
let mut version = current_version(conn)?;
|
||||
|
||||
if version == 0 {
|
||||
conn.execute_batch(SCHEMA_SQL).map_err(map_error)?;
|
||||
conn.pragma_update(None, "user_version", SCHEMA_VERSION)
|
||||
.map_err(map_error)?;
|
||||
return Ok(SCHEMA_VERSION);
|
||||
}
|
||||
|
||||
if version != 0 && version != SCHEMA_VERSION {
|
||||
if version > SCHEMA_VERSION {
|
||||
return Err(StashError::Database(format!(
|
||||
"内容库结构版本为 {version}，当前程序需要 {SCHEMA_VERSION}。\
|
||||
开发阶段不做自动迁移，请删除数据库后重启（种子会自动重新导入）。"
|
||||
"内容库结构版本为 {version}，比当前程序（{SCHEMA_VERSION}）更新；\
|
||||
请升级程序，或用旧版本打开。"
|
||||
)));
|
||||
}
|
||||
|
||||
if version < 15 {
|
||||
return Err(StashError::Database(format!(
|
||||
"内容库结构版本为 {version}，缺少可用的迁移路径（当前程序支持 15 → {SCHEMA_VERSION}）。\
|
||||
请备份后删除数据库重建。"
|
||||
)));
|
||||
}
|
||||
|
||||
if version == 15 {
|
||||
conn.execute_batch(V16_SQL).map_err(map_error)?;
|
||||
version = 16;
|
||||
}
|
||||
|
||||
conn.pragma_update(None, "user_version", version)
|
||||
.map_err(map_error)?;
|
||||
|
||||
Ok(version)
|
||||
}
|
||||
|
||||
/// 建表（幂等）：每次启动都跑一遍，缺表就补，已有数据不动。
|
||||
/// 建表（幂等）：只在测试里直接用；启动流程走 `migrate`。
|
||||
#[cfg(test)]
|
||||
pub fn apply(conn: &Connection) -> Result<(), StashError> {
|
||||
conn.execute_batch(SCHEMA_SQL).map_err(map_error)
|
||||
}
|
||||
|
||||
+269
-4
@@ -1,10 +1,10 @@
|
||||
use axum::{
|
||||
Json, Router,
|
||||
extract::{OriginalUri, Path, State},
|
||||
http::{HeaderValue, Method, StatusCode, header},
|
||||
http::{HeaderMap, HeaderValue, Method, StatusCode, header},
|
||||
response::sse::{Event, KeepAlive, Sse},
|
||||
response::{Html, IntoResponse, Response},
|
||||
routing::get,
|
||||
routing::{get, patch, post},
|
||||
};
|
||||
use include_dir::{Dir, include_dir};
|
||||
use std::{convert::Infallible, net::SocketAddr, sync::Arc, time::Duration};
|
||||
@@ -36,6 +36,41 @@ pub struct AppState {
|
||||
pub project_updates: broadcast::Sender<Vec<AppProject>>,
|
||||
/// 内容库：分类 / 分组 / 条目的唯一数据源
|
||||
pub db: Arc<Db>,
|
||||
/// 登录失败计数（单用户本地场景，一个进程一份就够）
|
||||
pub login_guard: Arc<std::sync::Mutex<LoginGuard>>,
|
||||
}
|
||||
|
||||
/// 连续登录失败 5 次 → 锁 60 秒。
|
||||
#[derive(Debug, Default)]
|
||||
pub struct LoginGuard {
|
||||
failures: u32,
|
||||
locked_until: Option<std::time::Instant>,
|
||||
}
|
||||
|
||||
impl LoginGuard {
|
||||
fn locked(&mut self) -> bool {
|
||||
if let Some(until) = self.locked_until {
|
||||
if std::time::Instant::now() < until {
|
||||
return true;
|
||||
}
|
||||
self.failures = 0;
|
||||
self.locked_until = None;
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
fn record_failure(&mut self) {
|
||||
self.failures += 1;
|
||||
if self.failures >= 5 {
|
||||
self.locked_until = Some(std::time::Instant::now() + Duration::from_secs(60));
|
||||
self.failures = 0;
|
||||
}
|
||||
}
|
||||
|
||||
fn reset(&mut self) {
|
||||
self.failures = 0;
|
||||
self.locked_until = None;
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ServerHandle {
|
||||
@@ -124,9 +159,12 @@ fn not_found_page(path: &str) -> Response {
|
||||
/// 到底是路由拼错了还是文件真的不存在。
|
||||
const SPA_PREFIXES: &[&str] = &["/c/"];
|
||||
|
||||
/// 精确匹配的前端页面（没有实体文件，返回入口页）
|
||||
const SPA_PAGES: &[&str] = &["/login", "/admin"];
|
||||
|
||||
/// 是否为前端路由路径（没有实体文件，应该返回入口页）。
|
||||
fn is_spa_path(path: &str) -> bool {
|
||||
SPA_PREFIXES.iter().any(|prefix| path.starts_with(prefix))
|
||||
SPA_PAGES.contains(&path) || SPA_PREFIXES.iter().any(|prefix| path.starts_with(prefix))
|
||||
}
|
||||
|
||||
/// `ServeDir` 的兜底：前端路由回落到入口页，其余路径仍是 404 页面。
|
||||
@@ -275,8 +313,228 @@ fn project_event(projects: Vec<AppProject>) -> Event {
|
||||
})
|
||||
}
|
||||
|
||||
// ---------------- 登录 / 会话 ----------------
|
||||
|
||||
const SESSION_COOKIE: &str = "stash_session";
|
||||
|
||||
#[derive(serde::Deserialize)]
|
||||
struct PasswordBody {
|
||||
password: String,
|
||||
}
|
||||
|
||||
#[derive(serde::Deserialize)]
|
||||
struct SetupBody {
|
||||
password: String,
|
||||
username: Option<String>,
|
||||
}
|
||||
|
||||
#[derive(serde::Deserialize)]
|
||||
struct ChangePasswordBody {
|
||||
current: String,
|
||||
next: String,
|
||||
}
|
||||
|
||||
fn cookie_token(headers: &HeaderMap) -> Option<String> {
|
||||
let raw = headers.get(header::COOKIE)?.to_str().ok()?;
|
||||
raw.split(';')
|
||||
.filter_map(|part| part.trim().split_once('='))
|
||||
.find(|(key, _)| *key == SESSION_COOKIE)
|
||||
.map(|(_, value)| value.to_string())
|
||||
}
|
||||
|
||||
fn session_cookie(token: &str) -> String {
|
||||
format!(
|
||||
"{SESSION_COOKIE}={token}; HttpOnly; SameSite=Strict; Path=/; Max-Age={}",
|
||||
crate::db::auth::SESSION_TTL_SECS
|
||||
)
|
||||
}
|
||||
|
||||
fn clear_cookie() -> String {
|
||||
format!("{SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0")
|
||||
}
|
||||
|
||||
fn api_error(status: StatusCode, message: &str) -> Response {
|
||||
(status, Json(serde_json::json!({ "error": message }))).into_response()
|
||||
}
|
||||
|
||||
fn with_cookie(mut response: Response, cookie: String) -> Response {
|
||||
if let Ok(value) = HeaderValue::from_str(&cookie) {
|
||||
response.headers_mut().append(header::SET_COOKIE, value);
|
||||
}
|
||||
response
|
||||
}
|
||||
|
||||
/// 同源校验：跨站请求带 Origin 且 host 不匹配时拒绝。
|
||||
/// 和 Cookie 的 `SameSite=Strict` 互为补充，不依赖浏览器实现。
|
||||
fn same_origin(headers: &HeaderMap) -> bool {
|
||||
let Some(origin) = headers
|
||||
.get(header::ORIGIN)
|
||||
.and_then(|value| value.to_str().ok())
|
||||
else {
|
||||
return true;
|
||||
};
|
||||
let Some(host) = headers.get(header::HOST).and_then(|value| value.to_str().ok()) else {
|
||||
return false;
|
||||
};
|
||||
origin.ends_with(host)
|
||||
}
|
||||
|
||||
fn login_locked(state: &AppState) -> bool {
|
||||
state
|
||||
.login_guard
|
||||
.lock()
|
||||
.map(|mut guard| guard.locked())
|
||||
.unwrap_or(true)
|
||||
}
|
||||
|
||||
fn login_failed(state: &AppState) {
|
||||
if let Ok(mut guard) = state.login_guard.lock() {
|
||||
guard.record_failure();
|
||||
}
|
||||
}
|
||||
|
||||
fn login_ok(state: &AppState) {
|
||||
if let Ok(mut guard) = state.login_guard.lock() {
|
||||
guard.reset();
|
||||
}
|
||||
}
|
||||
|
||||
async fn issue_token(state: &AppState) -> Result<String, Response> {
|
||||
let db = Arc::clone(&state.db);
|
||||
tokio::task::spawn_blocking(move || db.issue_session())
|
||||
.await
|
||||
.map_err(|error| api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()))?
|
||||
.map_err(|error| api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()))
|
||||
}
|
||||
|
||||
async fn read_session(state: &AppState, headers: &HeaderMap) -> Result<crate::db::SessionState, Response> {
|
||||
let token = cookie_token(headers);
|
||||
let db = Arc::clone(&state.db);
|
||||
tokio::task::spawn_blocking(move || db.auth_state(token.as_deref()))
|
||||
.await
|
||||
.map_err(|error| api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()))?
|
||||
.map_err(|error| api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()))
|
||||
}
|
||||
|
||||
/// GET /api/auth/session
|
||||
async fn auth_session(State(state): State<AppState>, headers: HeaderMap) -> Response {
|
||||
match read_session(&state, &headers).await {
|
||||
Ok(session) => Json(session).into_response(),
|
||||
Err(response) => response,
|
||||
}
|
||||
}
|
||||
|
||||
/// POST /api/auth/setup —— 只在还没有管理员时可用
|
||||
async fn auth_setup(
|
||||
State(state): State<AppState>,
|
||||
headers: HeaderMap,
|
||||
Json(body): Json<SetupBody>,
|
||||
) -> Response {
|
||||
if !same_origin(&headers) {
|
||||
return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
|
||||
}
|
||||
|
||||
let username = body.username.unwrap_or_else(|| "admin".into());
|
||||
let password = body.password;
|
||||
let db = Arc::clone(&state.db);
|
||||
let created = tokio::task::spawn_blocking(move || db.setup_admin(&username, &password)).await;
|
||||
|
||||
match created {
|
||||
Ok(Ok(())) => match issue_token(&state).await {
|
||||
Ok(token) => with_cookie(
|
||||
Json(serde_json::json!({ "ok": true })).into_response(),
|
||||
session_cookie(&token),
|
||||
),
|
||||
Err(response) => response,
|
||||
},
|
||||
Ok(Err(error)) => api_error(StatusCode::BAD_REQUEST, &error.to_string()),
|
||||
Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
|
||||
}
|
||||
}
|
||||
|
||||
/// POST /api/auth/login
|
||||
async fn auth_login(
|
||||
State(state): State<AppState>,
|
||||
headers: HeaderMap,
|
||||
Json(body): Json<PasswordBody>,
|
||||
) -> Response {
|
||||
if !same_origin(&headers) {
|
||||
return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
|
||||
}
|
||||
if login_locked(&state) {
|
||||
return api_error(StatusCode::TOO_MANY_REQUESTS, "尝试过多，请一分钟后再试");
|
||||
}
|
||||
|
||||
let password = body.password;
|
||||
let db = Arc::clone(&state.db);
|
||||
let verified = tokio::task::spawn_blocking(move || db.login(&password)).await;
|
||||
|
||||
match verified {
|
||||
Ok(Ok(Some(_username))) => {
|
||||
login_ok(&state);
|
||||
match issue_token(&state).await {
|
||||
Ok(token) => with_cookie(
|
||||
Json(serde_json::json!({ "ok": true })).into_response(),
|
||||
session_cookie(&token),
|
||||
),
|
||||
Err(response) => response,
|
||||
}
|
||||
}
|
||||
Ok(Ok(None)) => {
|
||||
login_failed(&state);
|
||||
api_error(StatusCode::UNAUTHORIZED, "密码错误")
|
||||
}
|
||||
Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
|
||||
Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
|
||||
}
|
||||
}
|
||||
|
||||
/// POST /api/auth/logout
|
||||
async fn auth_logout(State(state): State<AppState>, headers: HeaderMap) -> Response {
|
||||
if let Some(token) = cookie_token(&headers) {
|
||||
let db = Arc::clone(&state.db);
|
||||
let _ = tokio::task::spawn_blocking(move || db.logout(&token)).await;
|
||||
}
|
||||
|
||||
with_cookie(
|
||||
Json(serde_json::json!({ "ok": true })).into_response(),
|
||||
clear_cookie(),
|
||||
)
|
||||
}
|
||||
|
||||
/// PATCH /api/auth/password —— 必须已登录，成功后所有会话失效
|
||||
async fn auth_password(
|
||||
State(state): State<AppState>,
|
||||
headers: HeaderMap,
|
||||
Json(body): Json<ChangePasswordBody>,
|
||||
) -> Response {
|
||||
if !same_origin(&headers) {
|
||||
return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
|
||||
}
|
||||
|
||||
match read_session(&state, &headers).await {
|
||||
Ok(session) if session.authenticated => {}
|
||||
Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
|
||||
Err(response) => return response,
|
||||
}
|
||||
|
||||
let db = Arc::clone(&state.db);
|
||||
let (current, next) = (body.current, body.next);
|
||||
let changed =
|
||||
tokio::task::spawn_blocking(move || db.change_password(¤t, &next)).await;
|
||||
|
||||
match changed {
|
||||
Ok(Ok(true)) => with_cookie(
|
||||
Json(serde_json::json!({ "ok": true })).into_response(),
|
||||
clear_cookie(),
|
||||
),
|
||||
Ok(Ok(false)) => api_error(StatusCode::UNAUTHORIZED, "当前密码不正确"),
|
||||
Ok(Err(error)) => api_error(StatusCode::BAD_REQUEST, &error.to_string()),
|
||||
Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
|
||||
}
|
||||
}
|
||||
|
||||
/// 组装路由：API + 内嵌前端 + 托管目录。
|
||||
///
|
||||
/// 单独抽出来是为了测试能直接对 `Router` 发请求：`start` 要绑定端口、
|
||||
/// 起监听任务，没法在单元测试里用。
|
||||
fn build_router(state: AppState) -> Router {
|
||||
@@ -296,6 +554,11 @@ fn build_router(state: AppState) -> Router {
|
||||
.route("/api/projects/events", get(project_events))
|
||||
.route("/api/catalog", get(catalog_api))
|
||||
.route("/api/catalog/events", get(catalog_events))
|
||||
.route("/api/auth/session", get(auth_session))
|
||||
.route("/api/auth/setup", post(auth_setup))
|
||||
.route("/api/auth/login", post(auth_login))
|
||||
.route("/api/auth/logout", post(auth_logout))
|
||||
.route("/api/auth/password", patch(auth_password))
|
||||
.route("/", get(web_index))
|
||||
.route("/index.html", get(web_index))
|
||||
.route("/favicon.svg", get(web_root_file))
|
||||
@@ -333,6 +596,7 @@ pub async fn start(config: Config) -> Result<ServerHandle, StashError> {
|
||||
config: Arc::new(config.clone()),
|
||||
project_updates,
|
||||
db,
|
||||
login_guard: Arc::new(std::sync::Mutex::new(LoginGuard::default())),
|
||||
};
|
||||
|
||||
let app = build_router(shared_state);
|
||||
@@ -399,6 +663,7 @@ mod tests {
|
||||
config: Arc::new(config),
|
||||
project_updates,
|
||||
db: Arc::new(Db::in_memory()),
|
||||
login_guard: Arc::new(std::sync::Mutex::new(LoginGuard::default())),
|
||||
})
|
||||
}
|
||||
|
||||
|
||||
@@ -773,6 +773,38 @@
|
||||
white-space: nowrap;
|
||||
}
|
||||
|
||||
/* ---------- 登录页 ---------- */
|
||||
|
||||
.login-page {
|
||||
display: grid;
|
||||
place-items: center;
|
||||
min-height: 100vh;
|
||||
min-height: 100dvh;
|
||||
padding: var(--su-space-6);
|
||||
background-color: var(--su-bg-page);
|
||||
}
|
||||
|
||||
.login-card {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: var(--su-space-4);
|
||||
width: min(380px, 100%);
|
||||
}
|
||||
|
||||
.login-brand {
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.login-back {
|
||||
font-size: var(--su-font-size-sm);
|
||||
color: var(--su-text-muted);
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.login-back:hover {
|
||||
color: var(--su-color-primary);
|
||||
}
|
||||
|
||||
/* ---------- 响应式 ---------- */
|
||||
|
||||
@media (max-width: 1100px) {
|
||||
|
||||
@@ -28,6 +28,7 @@ import {
|
||||
import { useProjects } from './useProjects'
|
||||
import { useCatalog } from './useCatalog'
|
||||
import { useViewRoute } from './useViewRoute'
|
||||
import { fetchSession, logout as logoutRequest, type SessionState } from './auth'
|
||||
import { parseViewPath, viewPath, type View } from './data/view'
|
||||
import './App.css'
|
||||
|
||||
@@ -38,9 +39,21 @@ export default function App() {
|
||||
const [keyword, setKeyword] = useState('')
|
||||
// 当前视图由地址栏决定：刷新 / 收藏 / 前进后退都回到同一页（见 useViewRoute.ts）
|
||||
const { view, go } = useViewRoute()
|
||||
const [session, setSession] = useState<SessionState | null>(null)
|
||||
const [scrolled, setScrolled] = useState(false)
|
||||
const searchRef = useRef<HTMLInputElement>(null)
|
||||
|
||||
// 登录态：只用来切换页头按钮与后续的编辑入口
|
||||
useEffect(() => {
|
||||
let alive = true
|
||||
fetchSession().then((next) => {
|
||||
if (alive) setSession(next)
|
||||
})
|
||||
return () => {
|
||||
alive = false
|
||||
}
|
||||
}, [])
|
||||
|
||||
const categories = useMemo(
|
||||
() => withLocalCategory(projects, catalog.categories),
|
||||
[projects, catalog.categories],
|
||||
@@ -244,6 +257,10 @@ export default function App() {
|
||||
)
|
||||
}
|
||||
|
||||
const handleLogout = () => {
|
||||
void logoutRequest().then(() => window.location.assign('/'))
|
||||
}
|
||||
|
||||
return (
|
||||
<>
|
||||
{/* 主题的顶部背景图：固定 65vh，底部渐隐到页面底色 */}
|
||||
@@ -270,7 +287,11 @@ export default function App() {
|
||||
projectCount={projects.length}
|
||||
sampleProject={projects[0]?.name}
|
||||
live={live}
|
||||
authenticated={session?.authenticated === true}
|
||||
username={session?.username ?? undefined}
|
||||
onFocusSearch={() => searchRef.current?.focus()}
|
||||
onLogin={() => window.location.assign('/login')}
|
||||
onLogout={handleLogout}
|
||||
/>
|
||||
}
|
||||
sider={
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
/**
|
||||
* 登录/会话的接口封装。
|
||||
*
|
||||
* 会话是 HttpOnly Cookie，前端拿不到 token，只能问 `/api/auth/session`。
|
||||
*/
|
||||
export type SessionState = {
|
||||
authenticated: boolean
|
||||
has_admin: boolean
|
||||
username?: string | null
|
||||
}
|
||||
|
||||
type Result = { ok: true } | { ok: false; status: number; error: string }
|
||||
|
||||
async function request(
|
||||
method: 'POST' | 'PATCH',
|
||||
url: string,
|
||||
body: unknown,
|
||||
): Promise<Result> {
|
||||
try {
|
||||
const response = await fetch(url, {
|
||||
method,
|
||||
credentials: 'same-origin',
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: JSON.stringify(body),
|
||||
})
|
||||
|
||||
if (response.ok) return { ok: true }
|
||||
|
||||
const payload = (await response.json().catch(() => null)) as { error?: string } | null
|
||||
return {
|
||||
ok: false,
|
||||
status: response.status,
|
||||
error: payload?.error ?? `请求失败（${response.status}）`,
|
||||
}
|
||||
} catch (error) {
|
||||
return { ok: false, status: 0, error: error instanceof Error ? error.message : '网络错误' }
|
||||
}
|
||||
}
|
||||
|
||||
export async function fetchSession(): Promise<SessionState> {
|
||||
try {
|
||||
const response = await fetch('/api/auth/session', { credentials: 'same-origin' })
|
||||
if (!response.ok) return { authenticated: false, has_admin: false }
|
||||
return (await response.json()) as SessionState
|
||||
} catch {
|
||||
return { authenticated: false, has_admin: false }
|
||||
}
|
||||
}
|
||||
|
||||
export function login(password: string): Promise<Result> {
|
||||
return request('POST', '/api/auth/login', { password })
|
||||
}
|
||||
|
||||
export function setup(password: string, username = 'admin'): Promise<Result> {
|
||||
return request('POST', '/api/auth/setup', { password, username })
|
||||
}
|
||||
|
||||
export function logout(): Promise<Result> {
|
||||
return request('POST', '/api/auth/logout', {})
|
||||
}
|
||||
|
||||
export function changePassword(current: string, next: string): Promise<Result> {
|
||||
return request('PATCH', '/api/auth/password', { current, next })
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
import { Button, Card, FormField, Icon, Input, Notice, Space, Text, Title } from '@stash/ui'
|
||||
import { useEffect, useState } from 'react'
|
||||
import { fetchSession, login, setup, type SessionState } from '../../auth'
|
||||
|
||||
/**
|
||||
* 登录页：首次打开是「设置密码」，之后是「登录」。
|
||||
*
|
||||
* 成功后整页跳回首页（而不是 SPA 内跳转），让服务端重新下发 Cookie 后的首帧
|
||||
* 也带上登录态，避免首屏闪一下未登录 UI。
|
||||
*/
|
||||
export function LoginPage() {
|
||||
const [session, setSession] = useState<SessionState | null>(null)
|
||||
const [password, setPassword] = useState('')
|
||||
const [confirm, setConfirm] = useState('')
|
||||
const [error, setError] = useState('')
|
||||
const [busy, setBusy] = useState(false)
|
||||
|
||||
useEffect(() => {
|
||||
let alive = true
|
||||
fetchSession().then((next) => {
|
||||
if (!alive) return
|
||||
if (next.authenticated) {
|
||||
window.location.assign('/')
|
||||
return
|
||||
}
|
||||
setSession(next)
|
||||
})
|
||||
return () => {
|
||||
alive = false
|
||||
}
|
||||
}, [])
|
||||
|
||||
const isSetup = session !== null && !session.has_admin
|
||||
|
||||
const submit = async () => {
|
||||
setError('')
|
||||
|
||||
if (isSetup && password !== confirm) {
|
||||
setError('两次输入的密码不一致')
|
||||
return
|
||||
}
|
||||
|
||||
setBusy(true)
|
||||
const result = isSetup ? await setup(password) : await login(password)
|
||||
setBusy(false)
|
||||
|
||||
if (result.ok) {
|
||||
window.location.assign('/')
|
||||
return
|
||||
}
|
||||
|
||||
setError(result.error)
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="login-page">
|
||||
<Card padding="lg" className="login-card">
|
||||
<Space gap="sm" className="login-brand">
|
||||
<span className="site-brand-mark" aria-hidden="true">
|
||||
S
|
||||
</span>
|
||||
<span className="site-brand-name">STASH</span>
|
||||
</Space>
|
||||
|
||||
<Title level={2}>{isSetup ? '设置管理员密码' : '登录'}</Title>
|
||||
<Text size="sm" tone="muted">
|
||||
{isSetup
|
||||
? '首次使用：设置一个至少 8 位的密码，之后用它在任意设备上登录。'
|
||||
: '登录后可以编辑侧栏、页头滚动信息与内容。'}
|
||||
</Text>
|
||||
|
||||
{error !== '' && (
|
||||
<Notice tone="error" title="操作失败">
|
||||
{error}
|
||||
</Notice>
|
||||
)}
|
||||
|
||||
<FormField
|
||||
label="密码"
|
||||
htmlFor="password"
|
||||
required
|
||||
hint={isSetup ? '至少 8 位，建议混合字母与数字' : undefined}
|
||||
>
|
||||
<Input
|
||||
id="password"
|
||||
type="password"
|
||||
size="lg"
|
||||
icon="lock_line"
|
||||
placeholder="输入密码"
|
||||
value={password}
|
||||
autoFocus
|
||||
onChange={(event) => setPassword(event.target.value)}
|
||||
onKeyDown={(event) => {
|
||||
if (event.key === 'Enter') void submit()
|
||||
}}
|
||||
/>
|
||||
</FormField>
|
||||
|
||||
{isSetup && (
|
||||
<FormField label="确认密码" htmlFor="confirm" required>
|
||||
<Input
|
||||
id="confirm"
|
||||
type="password"
|
||||
size="lg"
|
||||
icon="keyhole_line"
|
||||
placeholder="再输入一次"
|
||||
value={confirm}
|
||||
onChange={(event) => setConfirm(event.target.value)}
|
||||
onKeyDown={(event) => {
|
||||
if (event.key === 'Enter') void submit()
|
||||
}}
|
||||
/>
|
||||
</FormField>
|
||||
)}
|
||||
|
||||
<Button size="lg" block loading={busy} icon={<Icon name="lock_line" />} onClick={submit}>
|
||||
{isSetup ? '设置并登录' : '登录'}
|
||||
</Button>
|
||||
|
||||
<a className="login-back" href="/">
|
||||
返回首页
|
||||
</a>
|
||||
</Card>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -9,10 +9,18 @@ type SiteHeaderProps = {
|
||||
/** 用于展示的第一个项目名，没有项目时留空 */
|
||||
sampleProject?: string
|
||||
live: boolean
|
||||
/** 是否已登录：决定右侧是「登录」还是「退出登录」 */
|
||||
authenticated: boolean
|
||||
username?: string
|
||||
onFocusSearch: () => void
|
||||
onLogin: () => void
|
||||
onLogout: () => void
|
||||
}
|
||||
|
||||
type InfoGroupProps = Omit<SiteHeaderProps, 'onFocusSearch'> & {
|
||||
type InfoGroupProps = {
|
||||
projectCount: number
|
||||
sampleProject?: string
|
||||
live: boolean
|
||||
'aria-hidden'?: boolean
|
||||
}
|
||||
|
||||
@@ -46,7 +54,16 @@ function InfoGroup({
|
||||
)
|
||||
}
|
||||
|
||||
export function SiteHeader({ projectCount, sampleProject, live, onFocusSearch }: SiteHeaderProps) {
|
||||
export function SiteHeader({
|
||||
projectCount,
|
||||
sampleProject,
|
||||
live,
|
||||
authenticated,
|
||||
username,
|
||||
onFocusSearch,
|
||||
onLogin,
|
||||
onLogout,
|
||||
}: SiteHeaderProps) {
|
||||
return (
|
||||
<div className="site-header-inner">
|
||||
<a className="site-brand" href="/" aria-label="Stash 首页">
|
||||
@@ -81,8 +98,15 @@ export function SiteHeader({ projectCount, sampleProject, live, onFocusSearch }:
|
||||
icon={<Icon name="search_3_line" />}
|
||||
onClick={onFocusSearch}
|
||||
/>
|
||||
{/* TODO(auth): 后端登录接口就绪后接上，目前仅作入口占位 */}
|
||||
<IconButton label="登录" icon={<Icon name="user_3_line" />} />
|
||||
{authenticated ? (
|
||||
<IconButton
|
||||
label={username === undefined ? '退出登录' : `退出登录（${username}）`}
|
||||
icon={<Icon name="exit_line" />}
|
||||
onClick={onLogout}
|
||||
/>
|
||||
) : (
|
||||
<IconButton label="登录" icon={<Icon name="user_3_line" />} onClick={onLogin} />
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
|
||||
@@ -3,9 +3,15 @@ import { createRoot } from 'react-dom/client'
|
||||
import '@stash/ui/style.css'
|
||||
import './index.css'
|
||||
import App from './App.tsx'
|
||||
import { LoginPage } from './components/auth/LoginPage'
|
||||
|
||||
/**
|
||||
* 入口分流：登录页是独立壳（不挂 Layout / 侧栏 / 搜索），
|
||||
* 且必须在 App 的 `useViewRoute` 把地址规范化之前判定，
|
||||
* 所以放在这里用首次加载的 pathname 决定，而不是放进 App 里。
|
||||
*/
|
||||
const isLoginPage = window.location.pathname === '/login'
|
||||
|
||||
createRoot(document.getElementById('root')!).render(
|
||||
<StrictMode>
|
||||
<App />
|
||||
</StrictMode>,
|
||||
<StrictMode>{isLoginPage ? <LoginPage /> : <App />}</StrictMode>,
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user