jxxghp
4955b7b9ea
fix: harden backend isolation and execution safety
2026-10-16 09:11:28 +08:00
jxxghp
bd1e6eb899
fix(agent): separate public API queries from bound user operations
2026-10-12 07:30:35 +08:00
InfinityPacer
25aaf3a32b
feat(plugin): add agent pet extension contract
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-11 04:08:15 +08:00
freeman
2165475dd0
fix(security): throttle password login after repeated failures
...
The access-token endpoint accepted unlimited password attempts; the
only existing rate limiters are single-instance helpers for outbound
site requests. Add app/application/security/throttle.py, an in-memory
LoginThrottle keyed by (client address, normalized username) that locks
for 30s after five consecutive failures and doubles the lockout up to
15 minutes. The endpoint answers 429 with Retry-After while locked,
counts only real credential failures (an MFA challenge after a correct
password does not count), and clears the record on success.
X-Forwarded-For is deliberately not trusted because there is no
trusted-proxy setting; behind the bundled nginx all requests share one
address, so the key degrades to per-username throttling, which is the
dimension brute-force protection needs. Sync the dependency snapshot
and architecture metrics for the new module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com >
2026-10-09 12:01:04 +08:00
jxxghp
e51fd44964
fix(agent): resolve alternative QQ and Feishu user bindings
...
Keep strict binding lookup as the default and explicitly match alternative channel identifiers for the Agent API gateway. Reject ambiguous active-user matches and cover single-field bindings with database-backed tests.
Refs #6905
2026-10-07 09:16:33 +08:00
jxxghp
b4175a4f88
fix(image): cache site allowlist and include custom image hosts
2026-09-30 01:09:32 +08:00
InfinityPacer
313f894052
perf(memory): import storage and passkey SDKs on demand
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-28 03:46:22 +08:00
jxxghp
bbaec9d6b3
fix: preserve v3 architecture complexity budget
2026-09-23 18:49:00 +08:00
LS
c68288e897
feat(security): 图片代理自动信任已启用的媒体服务器主机 ( #6769 )
...
在局域网部署 Emby/Jellyfin/Plex 的用户，此前需要手动维护
SECURITY_IMAGE_DOMAINS（整表覆盖，会随版本默认值漂移）和
IMAGE_PROXY_ALLOWED_PRIVATE_RANGES，未签名的媒体服务器图片 URL
才能通过图片代理。
- is_safe_image_url_async 新增可选参数 trusted_hosts：URL 的 netloc
（含端口）或 hostname 精确命中时直接放行，不受私网拦截限制；
默认 None，现有调用方行为不变。
- fetch_image（覆盖 /img 与 /cache/image）从已启用媒体服务器的
host / play_host 计算受信主机；读取配置失败时返回空集合，不影响代理。
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com >
2026-09-23 16:34:25 +08:00
jxxghp
8072b7d78f
Refactor application architecture and compatibility boundaries
2026-09-13 12:53:00 +08:00
jxxghp
ed6439bf2e
fix(architecture): close mypy ratchet regressions
2026-09-11 15:24:46 +08:00
jxxghp
a3b78fe8c8
refactor(cookie): keep login helper complexity within budget
2026-09-11 15:00:24 +08:00
jxxghp
06ed22c584
feat(agent): improve browser-assisted site cookie login
2026-09-11 14:31:01 +08:00
jxxghp
82652add91
fix(auth): fix passkey deletion password verification
2026-09-06 10:05:40 +08:00
jxxghp
478e7ee0a4
fix(auth): restore API token compatibility
2026-09-02 20:22:57 +08:00
jxxghp
d512f528be
refactor(api): make collection pagination explicit
2026-09-01 09:13:56 +08:00
jxxghp
fdba2c7d64
refactor(agent): unify tools behind API gateway and provider skills
2026-08-31 16:57:54 +08:00
InfinityPacer
5c70757a81
fix(auth): align v3 authentication contracts
...
按已确认的 V3 AUTH-001 交付门禁合并：后端认证与用户资料契约已完成本地前后端联调，Architecture、Coverage、单测分片和 Pylint 全部通过。
2026-08-31 04:57:34 +08:00
jxxghp
9146c75941
feat(auth): add first-run administrator initialization
2026-08-30 09:05:23 +08:00
jxxghp
5202c04dee
refactor(application): unify sync async decisions
2026-08-29 19:54:08 +08:00
jxxghp
808f2439ef
refactor(startup): add provider reset contracts
2026-08-29 17:57:01 +08:00
jxxghp
d2a860d89a
refactor(startup): govern composition lifecycle ownership
2026-08-29 16:57:53 +08:00
jxxghp
2fe39d856c
refactor(architecture): invert application adapter boundaries
2026-08-28 18:45:47 +08:00
jxxghp
9bff18739d
refactor(runtime): own lifecycle and adapter boundaries
2026-08-28 18:18:07 +08:00
jxxghp
aa8751f775
refactor: close transactional boundary debt batch
2026-08-28 10:36:12 +08:00
jxxghp
3f8d5990e7
refactor(user): freeze host user query ports
2026-08-28 08:44:35 +08:00
jxxghp
ea58c245dd
fix: restore quality gates after module renames
2026-08-27 21:05:36 +08:00
jxxghp
f888aab2c9
refactor: 统一插件迁移与 Passkey 模块命名
2026-08-27 20:38:55 +08:00
jxxghp
49ea278436
fix(site): satisfy login fallback type ratchet
2026-08-27 14:10:46 +08:00
jxxghp
ff355cbe5d
fix(site): follow tracker login page for cookie refresh ( #6473 )
2026-08-27 13:52:37 +08:00
jxxghp
e768eb46fe
refactor: own coalescer flush lifecycle
2026-08-24 03:11:49 +08:00
InfinityPacer
3d7fb44dc7
refactor(database): isolate configuration transactions
2026-08-23 02:29:22 +08:00
jxxghp
7846b24f6c
refactor: inject URL signing runtime configuration
2026-08-23 01:26:09 +08:00
jxxghp
690ebe0c02
refactor: inject token runtime configuration
2026-08-23 01:14:12 +08:00
jxxghp
56cb7294eb
refactor: extract cache network and compatibility entrypoints
2026-08-22 23:13:59 +08:00
jxxghp
a380cf6d49
refactor: migrate auth runtime configuration
2026-08-22 20:53:53 +08:00
jxxghp
8d0a694816
refactor: migrate passkey runtime configuration
2026-08-22 20:35:27 +08:00
jxxghp
be18cace1f
refactor: finish transactional runtime migration
2026-08-22 15:18:16 +08:00
jxxghp
97d2dcd7fb
fix(ci): align architecture and pylint gates
2026-08-22 08:50:25 +08:00
jxxghp
8472bcff43
refactor: 收口 V3 分层架构与插件兼容边界
2026-08-18 13:22:02 +08:00
jxxghp
5128ae9e1e
refactor: 推进后端分层架构治理
2026-08-18 00:29:14 +08:00
InfinityPacer
ca99af10f1
fix(auth): preserve bcrypt password compatibility ( #6339 )
2026-08-17 06:13:18 +08:00
jxxghp
96118e73e7
refactor(string): split utilities by responsibility
2026-08-15 08:03:55 +08:00
Aqr-K
8a11214a43
refactor(db): 修复异步连接池无界增长，并完成 SQLAlchemy 2.0 迁移与分层归位 ( #6320 )
2026-08-15 06:58:38 +08:00
jxxghp
369d7d6448
refactor: reorganize backend module boundaries
2026-08-14 19:53:33 +08:00
