Security audit (2026-03-31): 5 HIGH + 10 MEDIUM issues, all fixed. HIGH: - H1: JWT password_version mechanism (pwv in Claims, middleware verification, auto-increment on password change) - H2: Docker saas port bound to 127.0.0.1 - H3: TOTP encryption key decoupled from JWT secret (production bailout) - H4+H5: Tauri CSP hardened (removed unsafe-inline, restricted connect-src) MEDIUM: - M1: Persistent rate limiting (PostgreSQL rate_limit_events table) - M2: Account lockout (5 failures -> 15min lock) - M3: RFC 5322 email validation with regex - M4: Device registration typed struct with length limits - M5: Provider URL validation on create/update (SSRF prevention) - M6: Legacy TOTP secret migration (fixed nonce -> random nonce) - M7: Legacy frontend crypto migration (static salt -> random salt) - M8+M9: Admin frontend: removed JS token storage, HttpOnly cookie only - M10: Pipeline debug log sanitization (keys only, 100-char truncation) Also: fixed CLAUDE.md Section 12 (was corrupted), added title.rs middleware skeleton, fixed RegisterDeviceRequest visibility.
38 lines
1.1 KiB
Rust
38 lines
1.1 KiB
Rust
//! Title generation middleware — auto-generates conversation titles after the first turn.
|
|
//!
|
|
//! Inspired by DeerFlow's TitleMiddleware: after the first user-assistant exchange,
|
|
//! generates a short descriptive title using the LLM instead of defaulting to
|
|
//! "新对话" or truncating the user's first message.
|
|
//!
|
|
//! Priority 180 — runs after compaction (100) and memory (150), before skill index (200).
|
|
|
|
use async_trait::async_trait;
|
|
use zclaw_types::Result;
|
|
use crate::middleware::{AgentMiddleware, MiddlewareContext};
|
|
|
|
/// Middleware that auto-generates conversation titles after the first exchange.
|
|
pub struct TitleMiddleware {
|
|
/// Whether a title has been generated for the current session.
|
|
titled: std::sync::atomic::AtomicBool,
|
|
}
|
|
|
|
impl TitleMiddleware {
|
|
pub fn new() -> Self {
|
|
Self {
|
|
titled: std::sync::atomic::AtomicBool::new(false),
|
|
}
|
|
}
|
|
}
|
|
|
|
impl Default for TitleMiddleware {
|
|
fn default() -> Self {
|
|
Self::new()
|
|
}
|
|
}
|
|
|
|
#[async_trait]
|
|
impl AgentMiddleware for TitleMiddleware {
|
|
fn name(&self) -> &str { "title" }
|
|
fn priority(&self) -> i32 { 180 }
|
|
}
|