canglan 6056153f57 security: external API - only ID+Secret auth, remove legacy key & JWT ...

- removed x-external-key (single key) auth path + getExternalKey
- removed JWT passthrough in clientAuth (Bearer no longer accepted)
- removed /auth/login (JWT endpoint) and /my-tickets (JWT-only)
- clientAuth now mandatory: missing/invalid/disabled client -> 401
  (closed the 'no config = allow all' authorization bypass)
- moved /auth/register BEHIND clientAuth (was anonymous abuse surface)
- clients mgmt endpoints keep authenticate + role check (admin UI)
- docs + UI copy updated to single auth method
- verified: 30 checks incl. full-tree scan for legacy key refs

2026-08-19 19:44:34 +08:00

..

bans.js

feat: edit ban entries with modal form

2026-07-18 01:53:24 +08:00

dashboard.js

feat: skin site UUID lookup - auto-fetch UUID from player name

2026-08-17 02:05:21 +08:00

export-page.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

external-api.js

security: external API - only ID+Secret auth, remove legacy key & JWT

2026-08-19 19:44:34 +08:00

feature-detail.js

feat: feature discussion as separate detail page, not inline

2026-07-16 23:50:16 +08:00

features.js

feat: feature discussion as separate detail page, not inline

2026-07-16 23:50:16 +08:00

forgot.js

feat: password reset + data-action delegation for all onclick

2026-07-15 02:45:33 +08:00

home.js

fix: deploy crash + multiple bug fixes + cleanup

2026-08-16 21:21:25 +08:00

install.js

fix: invalid API key after install - force page reload to pick up injected key

2026-08-16 23:01:31 +08:00

login.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

logs.js

feat: system logs - email log + system log with admin UI

2026-08-17 05:14:41 +08:00

notifications.js

fix: notifications page crash + email code dev-mode false error

2026-08-17 04:50:10 +08:00

polls.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

register.js

style: add spacing between code input and submit button

2026-07-17 15:05:01 +08:00

servers.js

feat: external API for QQ bot - client id+secret auth, ticket tracking, bans, per-server data

2026-08-19 19:12:34 +08:00

settings-page.js

feat: skin site UUID lookup - auto-fetch UUID from player name

2026-08-17 02:05:21 +08:00

templates.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

ticket-create.js

feat: one account can bind both netease + skin identities

2026-08-17 01:17:09 +08:00

ticket-detail.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

tickets.js

feat: batch ticket operations (close/delete/change status)

2026-07-17 21:55:15 +08:00

tracking.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

unclaimed.js

fix: restore from regex corruption, JS-bind modal close, data-action delegation

2026-07-15 03:53:16 +08:00

users.js

feat: skin site UUID lookup - auto-fetch UUID from player name

2026-08-17 02:05:21 +08:00

verify.js

fix: deploy crash + multiple bug fixes + cleanup

2026-08-16 21:21:25 +08:00