增强关键接口幂等与限流保护

apps/backend/src/routes/admin/auth.ts

@@ -1,11 +1,17 @@
 import { Router } from 'express'
 
+import { createRateLimitMiddleware, getBodyFieldRateLimitKey } from '../../middleware/rate-limit.js'
 import { getAdminSessionSummary, loginAdmin } from '../../services/admin/admin-auth-service.js'
 import { createJsonHandler, extractBearerToken } from './shared.js'
 
 const router = Router()
 
-router.post('/auth/login', createJsonHandler(
+router.post('/auth/login', createRateLimitMiddleware({
+  scope: 'admin:login',
+  windowMs: 60_000,
+  max: 10,
+  key: getBodyFieldRateLimitKey('username'),
+}), createJsonHandler(
   (req) => loginAdmin(req.body?.username, req.body?.password),
   {
     successMessage: '登录成功',

apps/backend/src/routes/claims.ts

@@ -1,5 +1,6 @@
 import { Router } from "express";
 
+import { createRateLimitMiddleware, getParamRateLimitKey } from "../middleware/rate-limit.js";
 import {
   confirmKuaishouCloudClaimRole,
   getKuaishouCloudClaimDetail,
@@ -14,9 +15,22 @@ import {
 } from "../utils/http.js";
 
 const router = Router();
+const claimReadRateLimit = createRateLimitMiddleware({
+  scope: "claim:read",
+  windowMs: 60_000,
+  max: 120,
+  key: getParamRateLimitKey("token"),
+});
+const claimWriteRateLimit = createRateLimitMiddleware({
+  scope: "claim:write",
+  windowMs: 60_000,
+  max: 30,
+  key: getParamRateLimitKey("token"),
+});
 
 router.get(
   "/:token",
+  claimReadRateLimit,
   createRouteHandler((req) => getKuaishouCloudClaimDetail(req.params.token), {
     errorMessage: "查询快手领取详情失败",
     scope: "[claims/:token]",
@@ -25,6 +39,7 @@ router.get(
 
 router.post(
   "/:token/kuaishou-cloud/verify-ticket",
+  claimWriteRateLimit,
   createRouteHandler(
     (req) => verifyKuaishouCloudClaimTicket(req.params.token, req.body),
     {
@@ -37,6 +52,7 @@ router.post(
 
 router.post(
   "/:token/kuaishou-cloud/confirm-role",
+  claimWriteRateLimit,
   createRouteHandler((req) => confirmKuaishouCloudClaimRole(req.params.token), {
     successMessage: "角色已确认",
     errorMessage: "确认角色失败",
@@ -46,6 +62,7 @@ router.post(
 
 router.post(
   "/:token/kuaishou-cloud/redeem",
+  claimWriteRateLimit,
   createRouteHandler((req) => redeemKuaishouCloudClaim(req.params.token), {
     successMessage: "兑换请求已提交",
     errorMessage: "兑换失败",

apps/backend/src/routes/open-91.ts

@@ -1,13 +1,22 @@
 import { Router } from 'express'
 
+import { createRateLimitMiddleware } from '../middleware/rate-limit.js'
 import { createOpen91Order } from '../services/open-91/order-create-service.js'
 import { queryOpen91Order } from '../services/open-91/order-query-service.js'
 import { buildOpen91ErrorResponse } from '../services/open-91/shared.js'
 import { createRequestId, logIntegration } from '../utils/logger.js'
 
 const router = Router()
+const open91RateLimit = createRateLimitMiddleware({
+  scope: 'open91',
+  windowMs: 60_000,
+  max: 120,
+  onLimit: (_req, res) => {
+    res.status(200).json(buildOpen91ErrorResponse('请求过于频繁，请稍后再试', 429))
+  },
+})
 
-router.post('/orders/create', async (req, res) => {
+router.post('/orders/create', open91RateLimit, async (req, res) => {
   const requestId = createRequestId('91')
   const startedAt = Date.now()
 
@@ -39,7 +48,7 @@ router.post('/orders/create', async (req, res) => {
   }
 })
 
-router.post('/orders/query', async (req, res) => {
+router.post('/orders/query', open91RateLimit, async (req, res) => {
   const requestId = createRequestId('91')
   const startedAt = Date.now()