2 Commits

Author	SHA1	Message	Date
canglan	6056153f57	security: external API - only ID+Secret auth, remove legacy key & JWT ... - removed x-external-key (single key) auth path + getExternalKey - removed JWT passthrough in clientAuth (Bearer no longer accepted) - removed /auth/login (JWT endpoint) and /my-tickets (JWT-only) - clientAuth now mandatory: missing/invalid/disabled client -> 401 (closed the 'no config = allow all' authorization bypass) - moved /auth/register BEHIND clientAuth (was anonymous abuse surface) - clients mgmt endpoints keep authenticate + role check (admin UI) - docs + UI copy updated to single auth method - verified: 30 checks incl. full-tree scan for legacy key refs	2026-08-19 19:44:34 +08:00
canglan	257cd14051	feat: external API for QQ bot - client id+secret auth, ticket tracking, bans, per-server data ... - db: api_clients table + server_groups.alias + tickets/bans server_name (auto-migrate) - external.js: client_id+secret auth (multi-client, bcrypt, show-once secret), legacy x-external-key compat, JWT pass-through - POST /tickets (optional server), GET /tickets/track?token= (full lifecycle) - GET/POST /bans, reported-players/stats/all-tickets with server filter - GET /servers (alias list), client CRUD (owner/admin, audit logged) - resolveServer: alias | 分组/子服 | server_name - polls.js: server_groups CRUD with alias (add/edit, dup check) - servers page: alias display + edit; new 外部API page: client mgmt + quick docs - API.md: full external API section (auth matrix, server param syntax) - verified: 37 checks incl. resolveServer sandbox (alias/group/fallback)	2026-08-19 19:12:34 +08:00