Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
171 Commits 1 Branch 0 Tags
26bdf00f020248cca36650ed3120dd2d2a7379a7
Commit Graph

13 Commits

Author SHA1 Message Date
canglan
cb5847d650 feat: game UID fully internal + remove multi-identity copy 
- game_uid is now an internal param: auto-generated server-side
  (U + 12 hex) on register/bind-identity/install/admin-create/external
  register; player-supplied game_uid ignored
- Removed all player-facing UID inputs: register page, install page,
  identity bind modal, ticket-create 'your UID' field
- Removed player-facing UID display: identity table column,
  ticket detail/tracking reporter UID
- Removed '同一账号可绑定网易端 + 皮肤站身份' / '可绑定多个来源身份' copy
- Kept target_game_uid (reported player) and admin panel UID management
- settings-page skin-site placeholder updated
 2026-08-21 21:52:40 +08:00
canglan
e1cdff2b4a security: backend validation for all inputs 
- router.param('id'): all :id path params must be positive ints
  (tickets/features/polls/auth/users; external/bans/notifications already
  had parseInt - now consistent)
- notifications: type enum + webhook URL format + SSRF (isPrivateUrl
  exported) + events whitelist + active boolean check on PUT
- bans: type enum + player_name length
- external: all-tickets type/status enums, bans status/type enums,
  page/limit floor protection, ticket field length caps, clients active
  boolean + id validation
- verified: 28 checks (syntax + validation coverage)
 2026-08-21 20:10:05 +08:00
canglan
8c5ce78fd0 chore: add AGPLv3 copyright header to all source files 
- 52 JS files (backend + public/js): header with
  Copyright (C) 2026 Sea Network Technology Studio
  Author: CangLan <admin@sea-studio.top>
  + AGPLv3 notice
- idempotent (skips if header present), all syntax-checked
 2026-08-19 20:27:05 +08:00
canglan
65edbaf157 refactor: session-based external auth, dynamic sources, drop netease UID 
Auth (external API):
- ID: 16-digit random (non-sequential); Secret: SeaReport- + 32 hex
- POST /auth/session: ID+Secret -> Bearer SESSION (24h, single-session,
  old session invalidated on re-issue, disabled client invalidates)
- clientAuth now validates Bearer SESSION via api_sessions JOIN api_clients

Sources (dynamic, no default, open-source friendly):
- sources table + CRUD route (/api/sources, owner; delete guarded by usage)
- users/user_identities.source ENUM -> VARCHAR, seeded netease/skin
- register/admin create/identity bind: validate against enabled sources
- UI: 来源管理 page; source dropdowns loaded dynamically everywhere
  (register, dashboard identity, users admin, bans), labels dynamic

UID removal:
- game_uid/reporter_game_uid no longer required (db default '', validations
  dropped, frontend fields optional)

Docs: EXTERNAL-API.md session flow + new credential format; API.md updated
Verified: 37 checks (syntax, session logic, source CRUD, UID removal, docs)
 2026-08-19 20:08:06 +08:00
canglan
25a766591e feat: admin user management supports multi-identity bind/unbind 
- users list: identity_count column (backend subquery)
- user detail: returns identities array
- POST /users/:id/identities, DELETE /users/:id/identities/:identityId
  (owner protection, dup checks, keep >=1, audit logs)
- users page: identity column in table + manage section in edit modal
- API docs updated
 2026-08-17 01:34:20 +08:00
canglan
559970c5b7 feat: one account can bind both netease + skin identities 
- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
  (netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity
 2026-08-17 01:17:09 +08:00
canglan
42d4cafedd fix: async route rejection crashes process - global async error wrap + email dup check 
- users.js: check email uniqueness before insert (was ER_DUP_ENTRY uncaught crash)
- server.js: wrapAsyncRouter - Express 4 doesn't catch async handler rejections,
  route throws now go to error middleware (500 JSON) instead of uncaughtException
 2026-08-17 01:03:45 +08:00
canglan
09f0d8f2aa fix: 12 issues - admin permission scope, player sidebar nav, SMTP label, user create servers 2026-07-16 23:04:15 +08:00
canglan
8ecefdcb19 fix: remove stale admin_servers column reference from users UPDATE 2026-07-16 03:33:40 +08:00
canglan
a8309aa456 refactor: use user_servers junction table instead of JSON column 2026-07-15 04:55:57 +08:00
canglan
a34314ac9d feat: admin server assignment in user management 2026-07-15 04:53:27 +08:00
canglan
efe6b084be sync: add source field to user list, create, edit, and external API 2026-07-15 04:43:30 +08:00
canglan
247a4e851d feat: MC Report System - MySQL + Express + Vanilla JS SPA 2026-07-12 01:23:19 +08:00