9d4d869d57
- Replace hardcoded JWT secret with randomly generated key persisted to file - Replace hardcoded default password with random password shown in logs - Migrate token storage from localStorage to HttpOnly SameSite=strict cookie - Add IP-based login rate limiter (5 attempts / 15 min, 429 on lockout) - Add token_version for JWT revocation on password change - Add password strength validation (min 6 chars, 3+ unique characters) - Inject decoded user payload into request.state.user in auth middleware - Add /api/auth/me and /api/auth/logout endpoints - Narrow auth middleware exception handling (JWTError only, not all Exception) - Update updated_at timestamp on password change - Remove localStorage token management from frontend (axios, router, store) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
29 lines
797 B
Python
29 lines
797 B
Python
from pydantic import BaseModel, Field, field_validator
|
||
|
||
|
||
class LoginRequest(BaseModel):
|
||
password: str = Field(..., min_length=1, max_length=100)
|
||
|
||
|
||
class LoginResponse(BaseModel):
|
||
message: str = "登录成功"
|
||
|
||
|
||
class ChangePasswordRequest(BaseModel):
|
||
old_password: str = Field(..., min_length=1, max_length=100)
|
||
new_password: str = Field(..., min_length=6, max_length=100)
|
||
|
||
@field_validator("new_password")
|
||
@classmethod
|
||
def validate_password_strength(cls, v: str) -> str:
|
||
if len(v) < 6:
|
||
raise ValueError("密码长度至少6位")
|
||
if len(set(v)) < 3:
|
||
raise ValueError("密码不能过于简单（需包含至少3种不同字符）")
|
||
return v
|
||
|
||
|
||
class AuthStatusResponse(BaseModel):
|
||
authenticated: bool
|
||
user_id: str
|