2 Commits

Author	SHA1	Message	Date
LouisHong	65034ec16e	#602 [PR 3] 认证安全与初始化流程 (Auth & Security) (#639) ... * feat(auth): add runtime auth settings endpoint * feat(auth): robust runtime auth settings and security hardening - Added '/api/v1/auth/settings' to enable/disable Web authentication at runtime - Implemented session secret rotation (HMAC invalidation) on any auth toggle - Fixed TOCTOU race condition in settings update via mandatory session validation - Added comprehensive integration tests for auth re-enablement and rate limiting - Improved credential persistence: added 'ENV_FILE' support and atomic 'replace' operations - Refactored auth initialization flow to prevent password overwrites and ensure rollback on failure * fix(auth): harden auth settings race checks * fix(auth): share config writer and propagate rotation failures * fix(auth): order toggle persistence and document worker scope * fix(auth): enhance error handling and logging for auth toggle application --------- Co-authored-by: mumu <42829555+ZhuLinsen@users.noreply.github.com>	2026-03-13 23:15:40 +08:00
Alfred	32162ff745	feat: Web 页面密码验证 (Issue #320, #349) (#351) ... * feat(auth): Web 登录认证与 Settings 保护 (Issue #320, #349) - 新增 ADMIN_AUTH_ENABLED 开关，启用后需登录才能访问 Web UI 和 API - 首次访问时在网页设置初始密码，凭证存储于 data/.admin_password_hash - Settings 页面及 /api/v1/* 在启用认证后需登录访问，保护 API 密钥等敏感配置 - 系统设置中可修改密码，密码输入框支持眼睛图标显示/隐藏 - CLI: python -m src.auth reset_password 可重置密码 - 错误提示统一为中文 - 更新 README、full-guide、CHANGELOG * fix: 凭证文件权限 + ESLint 修复 - src/auth.py: .session_secret 创建后显式 chmod(0o600) - Pagination.tsx: PageButton 移至组件外，避免 render 内创建组件 - useTaskStream.ts: connectRef 解决闭包引用；isConnected 改用 useState；disconnect setState 延后执行 - HomePage.tsx: 初始加载 useEffect 添加 exhaustive-deps 注释 * test(auth): add unit and integration tests for auth (Issue #320, #349) - tests/test_auth.py: password validation, hash verification, session, rate limit, set/change/overwrite password - tests/test_auth_api.py: login, logout, change-password, API protection (401 without session) - scripts/ci_gate.sh: add src/auth.py to py_compile * fix(test): disable auth in system_config_api tests to fix 401 * fix: remove duplicate PageButton declaration in Pagination.tsx Fixes #320 Fixes #349	2026-02-20 21:47:19 +08:00