wangdl/api-server
2
0
Fork 0
Code Issues 28 Pull Requests Actions Packages Projects Releases Wiki Activity
502 Commits 1 Branch 0 Tags
Commit Graph

3 Commits

Author SHA1 Message Date
wangdl
7da4145d0a feat: admin auth 支持 httpOnly cookie
Some checks failed
Deploy API Server / build (push) Failing after 31s
Details
Deploy API Server / deploy (push) Has been skipped
Details 
- main.ts: 添加 cookie-parser 中间件
- admin-auth.controller.ts: 登录/刷新设置 httpOnly cookie
- admin-auth.controller.ts: 登出清除 cookie
- admin-auth.controller.ts: 刷新支持 cookie 读取 token（兼容旧 body 方式）
- admin-auth.guard.ts: 优先从 cookie 读取 token，兼容 Authorization header

向后兼容: Authorization header 仍可用（iOS/鸿蒙客户端）

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-07-04 11:19:15 +08:00
wangdl
ed2dcb02f6 feat: add AdminApiKey permanent token for automated testing
All checks were successful
Deploy API Server / build-and-deploy (push) Successful in 50s
Details 
- Add AdminApiKey model (keyHash, expiresAt nullable for permanent)
- Extend AdminAuthGuard to accept x-api-key header as fallback auth
- Seed creates test-admin@zhixi.com with permanent SUPER_ADMIN API key
- Key format: zxat_<64 hex chars>, stored as SHA-256 hash

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-18 18:52:04 +08:00
WangDL
5a7c21dd60 feat: implement complete admin authentication system
All checks were successful
Deploy API Server / build-and-deploy (push) Successful in 9s
Details 
- Add AdminRole enum (SUPER_ADMIN/ADMIN/OPERATIONS/DEVELOPER/READONLY) with hierarchy
- Add PasswordService (bcryptjs, 12 rounds), AdminTokenService (type=admin JWT)
- Add AdminAuthService: login/lockout/refresh/logout with audit logging
- Add AdminAuthController: /admin-api/auth/{login,refresh,logout,me}
- Add AdminAuthGuard: validates type=admin, user status, session, lockout
- Add AdminRolesGuard + @AdminRoles() decorator for RBAC
- Add AdminAuditService for audit log persistence
- Add AdminLoginRateLimit (10 req/15min per IP)
- Add prisma/seed.ts for SUPER_ADMIN initialization via env vars
- Update JwtAuthGuard to skip /admin-api/* and /internal/* paths
- Update main.ts to exclude admin-api/internal from global 'api' prefix
- Update jwt.config.ts with admin JWT secrets and expiry config

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-21 15:05:31 +08:00