MC_Report

Files

canglan 6056153f57 security: external API - only ID+Secret auth, remove legacy key & JWT

- removed x-external-key (single key) auth path + getExternalKey
- removed JWT passthrough in clientAuth (Bearer no longer accepted)
- removed /auth/login (JWT endpoint) and /my-tickets (JWT-only)
- clientAuth now mandatory: missing/invalid/disabled client -> 401
  (closed the 'no config = allow all' authorization bypass)
- moved /auth/register BEHIND clientAuth (was anonymous abuse surface)
- clients mgmt endpoints keep authenticate + role check (admin UI)
- docs + UI copy updated to single auth method
- verified: 30 checks incl. full-tree scan for legacy key refs

2026-08-19 19:44:34 +08:00

auth.js

fix: notifications page crash + email code dev-mode false error

2026-08-17 04:50:10 +08:00

bans.js

fix: deploy crash + multiple bug fixes + cleanup

2026-08-16 21:21:25 +08:00

captcha.js

fix: captcha uses dark high-contrast colors only

2026-07-17 00:30:18 +08:00

export.js

fix: add appealing to active_count, limit check, export processing count