安全加固：增加后台登录 IP 限流并记录验证结果

2026-08-30 16:47:16 +08:00
parent d24c69141a
commit 6ca54e468e
10 changed files with 527 additions and 6 deletions
@@ -0,0 +1,37 @@
+Security review: admin login brute-force protection
+
+Changed branch/field:
+- apps/backend/src/routes/admin/auth.ts, POST /auth/login middleware chain
+- Added admin:login:ip (20 requests / 60 seconds per client IP)
+- Kept admin:login:account (10 requests / 60 seconds per client IP + username)
+
+Artifacts:
+- MODIFIED_FILE: /Users/yml/codes/order_site/security-artifacts/MODIFIED_FILE.ts
+- DIFF_FILE: /Users/yml/codes/order_site/security-artifacts/DIFF_FILE.patch
+- VERIFICATION.txt: /Users/yml/codes/order_site/security-artifacts/VERIFICATION.txt
+- ROLLBACK.sh: /Users/yml/codes/order_site/security-artifacts/ROLLBACK.sh
+
+BASELINE
+Command: npm test -- --test-name-pattern='createRateLimitMiddleware'
+Input: repository HEAD sources before the route/test edits
+Literal result: tests 371; pass 369; fail 0; skipped 2; exit status 0
+
+MODIFIED
+Command: node --import tsx --test src/middleware/rate-limit.test.ts
+Input: modified rate-limit middleware test source
+Literal result: tests 4; pass 4; fail 0; skipped 0; exit status 0
+
+Command: npm run check
+Input: modified backend source tree
+Literal result: format check passed; SQL guard passed; ESLint passed; TypeScript passed; tests 373; pass 371; fail 0; skipped 2; build completed; exit status 0
+
+ROLLBACK
+Command: security-artifacts/ROLLBACK.sh security-artifacts/rollback-copy
+Input: independent copy containing MODIFIED_FILE.ts and BASELINE_rate-limit.test.ts
+Literal result: restored admin auth route and rate-limit test in security-artifacts/rollback-copy; baseline admin auth SHA-256 d1afed851de0dce8704f4233e1b9339a33a88d1ae9c89d6639aa104be7ff8aff; exit status 0
+Restored behavior/status: rollback-copy/apps/backend/src/routes/admin/auth.ts matches the baseline hash; the working source remains modified.
+
+Original source hash before modification:
+d1afed851de0dce8704f4233e1b9339a33a88d1ae9c89d6639aa104be7ff8aff
+Modified copy hash:
+c70ca222c13245a6e1714f1c90f3592f5c4fd3713a1ef3af5fb4073eb9b9db95