shaw
0ddd58aaf9
应对管理员访问凭证失守导致的数据外泄风险，新增三层防护： 审计日志（admin-only 可见，用户不可见） - 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理 - 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类 请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取） - 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url 保留以便追责）；非 JSON body 不入库 - 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许， 清空后同步写入留痕记录 会话 IP/UA 绑定（默认开启，可在系统设置关闭） - JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求 重新登录；旧 token 无指纹时放行以平滑升级 敏感操作 step-up 2FA（sudo 窗口 15 分钟） - 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试 - API key 查看按需求暂不加强管控 前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、 step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n
103 lines
2.9 KiB
TypeScript
103 lines
2.9 KiB
TypeScript
/**
|
|
* TOTP (2FA) API endpoints
|
|
* Handles Two-Factor Authentication with Google Authenticator
|
|
*/
|
|
|
|
import { apiClient } from './client'
|
|
import type {
|
|
TotpStatus,
|
|
TotpSetupRequest,
|
|
TotpSetupResponse,
|
|
TotpEnableRequest,
|
|
TotpEnableResponse,
|
|
TotpDisableRequest,
|
|
TotpVerificationMethod
|
|
} from '@/types'
|
|
|
|
/**
|
|
* Get TOTP status for current user
|
|
* @returns TOTP status including enabled state and feature availability
|
|
*/
|
|
export async function getStatus(): Promise<TotpStatus> {
|
|
const { data } = await apiClient.get<TotpStatus>('/user/totp/status')
|
|
return data
|
|
}
|
|
|
|
/**
|
|
* Get verification method for TOTP operations
|
|
* @returns Method ('email' or 'password') required for setup/disable
|
|
*/
|
|
export async function getVerificationMethod(): Promise<TotpVerificationMethod> {
|
|
const { data } = await apiClient.get<TotpVerificationMethod>('/user/totp/verification-method')
|
|
return data
|
|
}
|
|
|
|
/**
|
|
* Send email verification code for TOTP operations
|
|
* @returns Success response
|
|
*/
|
|
export async function sendVerifyCode(): Promise<{ success: boolean }> {
|
|
const { data } = await apiClient.post<{ success: boolean }>('/user/totp/send-code')
|
|
return data
|
|
}
|
|
|
|
/**
|
|
* Initiate TOTP setup - generates secret and QR code
|
|
* @param request - Email code or password depending on verification method
|
|
* @returns Setup response with secret, QR code URL, and setup token
|
|
*/
|
|
export async function initiateSetup(request?: TotpSetupRequest): Promise<TotpSetupResponse> {
|
|
const { data } = await apiClient.post<TotpSetupResponse>('/user/totp/setup', request || {})
|
|
return data
|
|
}
|
|
|
|
/**
|
|
* Complete TOTP setup by verifying the code
|
|
* @param request - TOTP code and setup token
|
|
* @returns Enable response with success status and enabled timestamp
|
|
*/
|
|
export async function enable(request: TotpEnableRequest): Promise<TotpEnableResponse> {
|
|
const { data } = await apiClient.post<TotpEnableResponse>('/user/totp/enable', request)
|
|
return data
|
|
}
|
|
|
|
/**
|
|
* Disable TOTP for current user
|
|
* @param request - Email code or password depending on verification method
|
|
* @returns Success response
|
|
*/
|
|
export async function disable(request: TotpDisableRequest): Promise<{ success: boolean }> {
|
|
const { data } = await apiClient.post<{ success: boolean }>('/user/totp/disable', request)
|
|
return data
|
|
}
|
|
|
|
/**
|
|
* Step-up verification response
|
|
*/
|
|
export interface TotpStepUpResponse {
|
|
verified: boolean
|
|
expires_in: number
|
|
}
|
|
|
|
/**
|
|
* Verify a TOTP code to grant the current session a short-lived step-up
|
|
* (sudo) window for sensitive operations (account export, DB backup download...).
|
|
* @param code - 6-digit TOTP code
|
|
*/
|
|
export async function stepUp(code: string): Promise<TotpStepUpResponse> {
|
|
const { data } = await apiClient.post<TotpStepUpResponse>('/user/totp/step-up', { code })
|
|
return data
|
|
}
|
|
|
|
export const totpAPI = {
|
|
getStatus,
|
|
getVerificationMethod,
|
|
sendVerifyCode,
|
|
initiateSetup,
|
|
enable,
|
|
disable,
|
|
stepUp
|
|
}
|
|
|
|
export default totpAPI
|