qing
7d6ba6de93
feat(gateway): add retry_on_refused for pymsg MsgClient (v0.6.1)
...
- Add MsgConnectionRefusedException to distinguish ECONNREFUSED from other
connection errors; openConnection() now throws it when connect() returns
ECONNREFUSED.
- MsgClient::call() adds retry_on_refused/retry_interval parameters (defaults
false/1.0s), matching Python pymsg.MsgClient.call(retry_on_refused=True).
- Retry loop: only retries on ECONNREFUSED; other exceptions (timeout,
connection reset, business errors) propagate immediately. Throttled logging:
first failure prints immediately, subsequent logs every 5 seconds.
- DbC::call_msg() enables retry_on_refused=true (db is a hard dependency;
gateway blocks waiting for db on startup instead of crashing).
- LogC::_send() explicitly passes retry_on_refused=false (fail-safe; never
block the background log thread when db is unavailable).
- captcha/smtp auxiliary services keep default retry_on_refused=false
(fail-fast; blocking in request threads would exhaust the thread pool).
- Update README with pymsg protocol documentation, downstream retry strategy
table, and v0.6.1 changelog entry.
2026-08-01 13:42:24 +08:00
qing
12ece9020c
feat(libhttp,gateway): add admin-only WebSocket reverse proxy
...
libhttp v3.1:
- add ws_proxy(path, handshake) API with WsProxyHandshakeHandler callback
- implement full-duplex async bidirectional bridging (text+binary frames)
- support ws:// and wss:// backends with SNI, write queues for ordering
- proxy routes take priority over regular ws() routes
- 403 response on handshake rejection, graceful close propagation
gateway v0.6.0:
- add [WsProxy] config section (routes = /path=ws://backend;...)
- handshake callback verifies Token (Authorization/Cookie) is_admin=true
- non-admin / expired / missing token → 403, admin → transparent bridge
- fix LocalTime.hpp C++20 tzdb incompatibility on Apple clang (use strftime/get_time/mktime)
- update example.ini and README docs for both modules
2026-08-01 05:20:14 +08:00
qing
ec1eb1e805
docs(gateway): 补充前端接入图形验证码说明
...
- README.md v0.5.4 变更记录补充前端改动(register.html/register.js 接入图形验证码)
- SECURITY_AUDIT_20260801.md P0-1 修复说明补充第 5 项前端同步,改动文件清单补全
2026-08-01 02:43:06 +08:00
qing
49f0698b9d
fix(gateway,smtp): 修复邮件轰炸漏洞(审计 P0-1)
...
gateway v0.5.3 → v0.5.4:
1. gateway/src/main.cpp
- /register/send_code 强制 CAPTCHA 校验(经 captcha:8009,Token 一次性消费,fail-closed)
- 新增邮箱级双窗口限流(3 次/小时 + 10 次/天,CAPTCHA 通过后才计入配额)
- 新增 _EMAIL_ADDR_RATE_HOUR / _EMAIL_ADDR_RATE_DAY 限流器实例
2. smtp/smtp_v2.py
- 新增邮箱级长期限流兜底(EMAIL_HOURLY_LIMIT / EMAIL_DAILY_LIMIT,默认 3/10)
- 新增全局熔断(SMTP_HOURLY_LIMIT,默认 100 封/小时,防 smtp 账号被封)
- 预占/回滚与 60s 冷却同模式,发送失败不计入配额
3. gateway/docs/SECURITY_AUDIT_20260801.md
- 新增带日期的安全审计报告
- P0-1 标记为已修复 v0.5.4
4. gateway/README.md
- 更新 /register/send_code 接口文档(CAPTCHA 必填 + 5 层防护)
- 更新版本变更日志
防护层次:IP 限流 → CAPTCHA → 邮箱级限流(gateway)→ 60s 冷却 → 邮箱级限流(smtp)→ 全局熔断
2026-08-01 02:37:15 +08:00
qing
5275b8bf75
feat(smtp): 邮箱验证码连续校验失败 5 次自动作废，防枚举 6 位数字码
2026-07-29 21:57:16 +08:00
qing
c5dd8d198d
feat(smtp): 同一邮箱 60 秒发送冷却，gateway 429 透传 + 前端重发倒计时（gateway v0.5.3）
2026-07-29 20:54:56 +08:00
qing
f4a7aca2fa
update: smtp 验证码有效期 60s 调整为 10 分钟，邮件正文从 CODE_TTL 派生
...
60 秒对邮件送达延迟过于紧张；正文有效期文案改为按 TTL 自动生成避免漂移，前端提示与 README 同步。同时移除 .env 排查用的凭证明文调试打印。
2026-07-29 19:32:44 +08:00
qing
6a0551ab34
fix(gateway): 限流错误码统一429、登录用户不存在改401并拉平时序、pymsg超时常量化（v0.5.2）
...
- 三处限流错误码统一为 429（login 400→429 并修 attampts 拼写；register/send_code 403→429）
- 登录用户不存在不再兜底 500：空结果统一走 401，dummy PBKDF2 校验拉平时序防用户枚举
- db 查询失败消息误名修正：Login (Update Step) Failed → (Query Step)
- 超时常量化：DbC::DEFAULT_TIMEOUT=5.0；_TIMEOUT_CAPTCHA/_SMTP_VERIFY=5.0、_SMTP_SEND=20.0
- 文档：gateway/README 数据库节 email→username 重写、建表归 db/create_sqlite3.sql；根 README 版本号与自动建表描述同步
2026-07-29 00:21:13 +08:00
qing
b07dbf2da5
feat(gateway): 登录成功后更新 Users.last_login（v0.5.1）
...
启用 handleLogin 中被注释的 last_login 更新：经 DbC::call_msg 以
"$now" 哨兵（db 日期适配层转为服务端 UTC 时间）写入，失败按惯例
THROW_EX_CUSTOM 抛 500 由 wrapper 统一处理。README 版本节同步
（原仍停留在 0.3.0-security）。
2026-07-28 23:31:20 +08:00
qing
df518d1adb
feat: 注册强制邮箱验证码（gateway v0.5.0 新增 /register/send_code，pymsg 调 smtp）
2026-07-28 17:29:52 +08:00
qing
46b8f750ae
fixbug
2026-07-25 13:07:18 +08:00
qing
fcf3084d0f
更新文档
2026-07-25 02:11:28 +08:00
qing
70d467d052
init
2026-07-20 11:12:29 +08:00
qing