fix(dcauth): order_site 白名单补充生产域名 ks.khhao.com

apps/dcauth/README.md

@@ -18,10 +18,10 @@ x86_64-w64-mingw32-windres --codepage=65001 versioninfo.rc \
 CGO_ENABLED=0 GOOS=windows GOARCH=amd64 \
   go build -trimpath -ldflags "-H windowsgui -s -w" \
   -o dist/DCAuth.exe .
-cp dist/DCAuth.exe dist/DCAuth-2.0.0.exe
+cp dist/DCAuth.exe dist/DCAuth-2.0.1.exe
 ```
 
-版本号统一在 `main.go` 的 `clientVersion` 和 `versioninfo.rc` 中维护。`DCAuth.exe` 右键“属性 → 详细信息”会显示文件版本 `2.0.0.0` 和产品版本 `2.0.0`，托盘菜单、设备信息及确认窗口也会显示当前版本。
+版本号统一在 `main.go` 的 `clientVersion` 和 `versioninfo.rc` 中维护。`DCAuth.exe` 右键“属性 → 详细信息”会显示文件版本 `2.0.1.0` 和产品版本 `2.0.1`，托盘菜单、设备信息及确认窗口也会显示当前版本。
 
 Windows ARM64：
 
@@ -114,7 +114,7 @@ macOS 当前仍是开发版：私钥明文保存在 `~/Library/Application Suppo
 登录页创建 challenge 后跳转：
 
 ```text
-dcauth://authorize?app=order_site&challenge_id=...&challenge=...&api=https%3A%2F%2Forder.khhao.com
+dcauth://authorize?app=order_site&challenge_id=...&challenge=...&api=https%3A%2F%2Fks.khhao.com
 ```
 
 客户端校验 app 和 api 白名单后，弹出一次确认框，签名并提交到：
@@ -129,7 +129,7 @@ POST /api/dcauth/authorize
 
 | app | 生产入口 |
 |---|---|
-| `order_site` | `https://order.khhao.com` |
+| `order_site` | `https://ks.khhao.com`（历史入口 `https://order.khhao.com` 仍放行） |
 | `live_hub` | `https://live.khhao.com` |
 | `affiliate_dash` | `https://skin.khhao.com` |
 

apps/dcauth/main.go

@@ -15,7 +15,7 @@ import (
 	"time"
 )
 
-const clientVersion = "2.0.0"
+const clientVersion = "2.0.1"
 
 type appConfig struct {
 	DisplayName string
@@ -26,6 +26,7 @@ var appRegistry = map[string]appConfig{
 	"order_site": {
 		DisplayName: "订单后台",
 		AllowedAPIs: []string{
+			"https://ks.khhao.com",
 			"https://order.khhao.com",
 			"http://localhost",
 			"http://127.0.0.1",

apps/dcauth/main_test.go

@@ -14,6 +14,9 @@ func TestParseAuthorizeURLAllowedOrigins(t *testing.T) {
 		{name: "localhost", api: "http%3A%2F%2Flocalhost", expected: "http://localhost"},
 		{name: "localhost trailing slash", api: "http%3A%2F%2Flocalhost%2F", expected: "http://localhost"},
 		{name: "lan address", api: "http%3A%2F%2F192.168.10.6", expected: "http://192.168.10.6"},
+		{name: "production ks.khhao.com", api: "https%3A%2F%2Fks.khhao.com", expected: "https://ks.khhao.com"},
+		{name: "production uppercase host", api: "https%3A%2F%2FKS.KHHAO.COM", expected: "https://ks.khhao.com"},
+		{name: "legacy production order.khhao.com", api: "https%3A%2F%2Forder.khhao.com", expected: "https://order.khhao.com"},
 	}
 
 	for _, tt := range tests {
@@ -31,9 +34,25 @@ func TestParseAuthorizeURLAllowedOrigins(t *testing.T) {
 }
 
 func TestParseAuthorizeURLRejectsUnknownOrigin(t *testing.T) {
-	raw := "dcauth://authorize?app=order_site&challenge_id=challenge-id&challenge=challenge-value&api=http%3A%2F%2Fexample.com"
-	if _, err := parseAuthorizeURL(raw); err == nil {
-		t.Fatal("parseAuthorizeURL() accepted an unknown origin")
+	tests := []struct {
+		name string
+		api  string
+	}{
+		{name: "unknown host", api: "http%3A%2F%2Fexample.com"},
+		{name: "lookalike suffix", api: "https%3A%2F%2Fks.khhao.com.evil.com"},
+		{name: "lookalike prefix", api: "https%3A%2F%2Fevil-ks.khhao.com"},
+		{name: "unexpected port", api: "https%3A%2F%2Fks.khhao.com%3A8443"},
+		{name: "plain http production host", api: "http%3A%2F%2Fks.khhao.com"},
+		{name: "userinfo trick", api: "https%3A%2F%2Fks.khhao.com%40evil.com"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			raw := "dcauth://authorize?app=order_site&challenge_id=challenge-id&challenge=challenge-value&api=" + tt.api
+			if _, err := parseAuthorizeURL(raw); err == nil {
+				t.Fatalf("parseAuthorizeURL() accepted %q", tt.api)
+			}
+		})
 	}
 }
 

apps/dcauth/versioninfo.rc

@@ -1,6 +1,6 @@
 1 VERSIONINFO
-FILEVERSION 2,0,0,0
-PRODUCTVERSION 2,0,0,0
+FILEVERSION 2,0,1,0
+PRODUCTVERSION 2,0,1,0
 FILEFLAGSMASK 0x3fL
 FILEFLAGS 0x0L
 FILEOS 0x40004L
@@ -13,12 +13,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "Order Site"
             VALUE "FileDescription", "DCAuth device authentication client"
-            VALUE "FileVersion", "2.0.0.0"
+            VALUE "FileVersion", "2.0.1.0"
             VALUE "InternalName", "DCAuth"
             VALUE "LegalCopyright", "Copyright (C) 2026 Order Site"
             VALUE "OriginalFilename", "DCAuth.exe"
             VALUE "ProductName", "DCAuth"
-            VALUE "ProductVersion", "2.0.0"
+            VALUE "ProductVersion", "2.0.1"
         END
     END
     BLOCK "VarFileInfo"

docs/设备认证-dcauth协议.md

@@ -6,7 +6,7 @@
 
 | app | 系统 | 生产入口 |
 |---|---|---|
-| `order_site` | 订单后台 | `https://order.khhao.com` |
+| `order_site` | 订单后台 | `https://ks.khhao.com`（兼容历史域名 `https://order.khhao.com`） |
 | `live_hub` | 直播运营后台 | `https://live.khhao.com` |
 | `affiliate_dash` | 皮肤分销后台 | `https://skin.khhao.com` |