e3b93ff96d
Security audit (2026-03-31): 5 HIGH + 10 MEDIUM issues, all fixed. HIGH: - H1: JWT password_version mechanism (pwv in Claims, middleware verification, auto-increment on password change) - H2: Docker saas port bound to 127.0.0.1 - H3: TOTP encryption key decoupled from JWT secret (production bailout) - H4+H5: Tauri CSP hardened (removed unsafe-inline, restricted connect-src) MEDIUM: - M1: Persistent rate limiting (PostgreSQL rate_limit_events table) - M2: Account lockout (5 failures -> 15min lock) - M3: RFC 5322 email validation with regex - M4: Device registration typed struct with length limits - M5: Provider URL validation on create/update (SSRF prevention) - M6: Legacy TOTP secret migration (fixed nonce -> random nonce) - M7: Legacy frontend crypto migration (static salt -> random salt) - M8+M9: Admin frontend: removed JS token storage, HttpOnly cookie only - M10: Pipeline debug log sanitization (keys only, 100-char truncation) Also: fixed CLAUDE.md Section 12 (was corrupted), added title.rs middleware skeleton, fixed RegisterDeviceRequest visibility.
82 lines
2.0 KiB
Rust
82 lines
2.0 KiB
Rust
//! Account 表相关模型
|
||
|
||
use sqlx::FromRow;
|
||
|
||
/// accounts 表完整行 (含 last_login_at)
|
||
#[derive(Debug, FromRow)]
|
||
pub struct AccountRow {
|
||
pub id: String,
|
||
pub username: String,
|
||
pub email: String,
|
||
pub display_name: String,
|
||
pub role: String,
|
||
pub status: String,
|
||
pub totp_enabled: bool,
|
||
pub last_login_at: Option<String>,
|
||
pub created_at: String,
|
||
pub llm_routing: String,
|
||
}
|
||
|
||
/// accounts 表行 (不含 last_login_at，用于 auth/me 等场景)
|
||
#[derive(Debug, FromRow)]
|
||
pub struct AccountAuthRow {
|
||
pub id: String,
|
||
pub username: String,
|
||
pub email: String,
|
||
pub display_name: String,
|
||
pub role: String,
|
||
pub status: String,
|
||
pub totp_enabled: bool,
|
||
pub created_at: String,
|
||
pub llm_routing: String,
|
||
}
|
||
|
||
/// Login 一次性查询行（合并用户信息 + password_hash + totp_secret + 安全字段）
|
||
#[derive(Debug, FromRow)]
|
||
pub struct AccountLoginRow {
|
||
pub id: String,
|
||
pub username: String,
|
||
pub email: String,
|
||
pub display_name: String,
|
||
pub role: String,
|
||
pub status: String,
|
||
pub totp_enabled: bool,
|
||
pub password_hash: String,
|
||
pub totp_secret: Option<String>,
|
||
pub created_at: String,
|
||
pub llm_routing: String,
|
||
pub password_version: i32,
|
||
pub failed_login_count: i32,
|
||
pub locked_until: Option<String>,
|
||
}
|
||
|
||
/// operation_logs 表行
|
||
#[derive(Debug, FromRow)]
|
||
pub struct OperationLogRow {
|
||
pub id: i64,
|
||
pub account_id: Option<String>,
|
||
pub action: String,
|
||
pub target_type: Option<String>,
|
||
pub target_id: Option<String>,
|
||
pub details: Option<String>,
|
||
pub ip_address: Option<String>,
|
||
pub created_at: String,
|
||
}
|
||
|
||
/// Dashboard 统计聚合行
|
||
#[derive(Debug, FromRow)]
|
||
pub struct DashboardStatsRow {
|
||
pub total_accounts: i64,
|
||
pub active_accounts: i64,
|
||
pub active_providers: i64,
|
||
pub active_models: i64,
|
||
}
|
||
|
||
/// Dashboard 今日统计聚合行
|
||
#[derive(Debug, FromRow)]
|
||
pub struct DashboardTodayRow {
|
||
pub tasks_today: i64,
|
||
pub tokens_input: i64,
|
||
pub tokens_output: i64,
|
||
}
|