4 Commits

Author	SHA1	Message	Date
canglan	3441eb9478	chore: pure-random 32-char secret, no default source, legacy migration ... - genSecret: drop SeaReport- prefix, plain 32-char random hex - users.source: no default anywhere (register/admin/external), ADD COLUMN migration now VARCHAR DEFAULT '' (was ENUM netease default) - legacy upgrade path kept: ENUM->VARCHAR MODIFY + user_identities MODIFY + sources seeded netease/skin idempotently - docs updated (credential format, no prefix)	2026-08-19 20:16:16 +08:00
canglan	65edbaf157	refactor: session-based external auth, dynamic sources, drop netease UID ... Auth (external API): - ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex - POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session, old session invalidated on re-issue, disabled client invalidates) - clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients Sources (dynamic, no default, open-source friendly): - sources table + CRUD route (/api/sources, owner; delete guarded by usage) - users/user_identities.source ENUM -> VARCHAR, seeded netease/skin - register/admin create/identity bind: validate against enabled sources - UI: 来源管理 page; source dropdowns loaded dynamically everywhere (register, dashboard identity, users admin, bans), labels dynamic UID removal: - game_uid/reporter_game_uid no longer required (db default '', validations dropped, frontend fields optional) Docs: EXTERNAL-API.md session flow + new credential format; API.md updated Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)	2026-08-19 20:08:06 +08:00
canglan	6056153f57	security: external API - only ID+Secret auth, remove legacy key & JWT ... - removed x-external-key (single key) auth path + getExternalKey - removed JWT passthrough in clientAuth (Bearer no longer accepted) - removed /auth/login (JWT endpoint) and /my-tickets (JWT-only) - clientAuth now mandatory: missing/invalid/disabled client -> 401 (closed the 'no config = allow all' authorization bypass) - moved /auth/register BEHIND clientAuth (was anonymous abuse surface) - clients mgmt endpoints keep authenticate + role check (admin UI) - docs + UI copy updated to single auth method - verified: 30 checks incl. full-tree scan for legacy key refs	2026-08-19 19:44:34 +08:00
canglan	4dfc30ce89	docs: standalone external API doc for bots/third-party ... - docs/EXTERNAL-API.md: auth matrix (ID+Secret / legacy key / JWT), Python+Node quickstart, server alias syntax, 9 endpoints with request/response examples, status flow, error codes, troubleshooting, typical scenarios (QQ bot ticket flow, plugin ban sync) - README + API.md link to the standalone doc - verified: 24 checks, endpoints cross-checked doc vs code	2026-08-19 19:40:25 +08:00