feat: 多用户登录 —— 账号存 DB + session cookie + per-user 隔离#129

Merged

mirror29 merged 19 commits into

mainfrom

feat/multi-user-login

Jul 2, 2026

Commits on Jul 2, 2026

feat(db): 新增 users 表迁移 —— 多用户登录账号落库

mirror29
and
claude
committed
feat(paper): /auth/login 端点 + argon2 密码校验 + create_user 脚本

mirror29
and
claude
committed
feat(orchestration): tool 打后端时转发登录用户 sub,agent 写操作按用户隔离

mirror29
and
claude
committed
feat(dashboard): 登录会话 + 登录页 + 中间件鉴权 + subject 从 session 派生

mirror29
and
claude
committed
chore(infra): AUTH_ENABLED 开关(本地免登录/线上强制) + compose 注入

mirror29
and
claude
committed
fix(orchestration): pending-plan 护栏按登录用户查 + 补 resolveRequestToken 单测

mirror29
and
claude
committed
feat(paper): /auth/login 加按邮箱失败节流(抗在线爆破)

mirror29
and
claude
committed
fix(dashboard): 登录 429 透传 —— 被限流时提示'尝试过于频繁'而非'服务不可用'

mirror29
and
claude
committed
fix(paper): 登录节流表改 LRU 淘汰,堵住'刷万级邮箱清表'绕过

mirror29
and
claude
committed
fix(dashboard): chat 会话读/改按 owner 校验,堵越权(IDOR)

mirror29
and
claude
committed
fix(paper): 登录失败节流 check+record 原子化,堵并发爆破

mirror29
and
claude
committed
test(dashboard): 搭最小 vitest + ownsThread 越权(IDOR)回归测试

mirror29
and
claude
committed
ci(dashboard): CI 跑 pnpm test(vitest),让 ownsThread 回归真正生效

mirror29
and
claude
committed
fix(dashboard,shared): session token 加 token_use + 后端拒收 session 凭据

mirror29
and
claude
committed
fix(paper): 登录邮箱 strip 口径统一(节流 key / DB 查询 / 建号存储一致)

mirror29
and
claude
committed
test(orchestration): 证 mastra Memory 按 resourceId 隔离 thread(#130 回归守卫)

mirror29
and
claude
committed
fix(dashboard): 生产强制开登录(AUTH_ENABLED fail-safe)

mirror29
and
claude
committed
fix(paper): 多 worker 启动报警(登录节流/live runner 单进程假设)

mirror29
and
claude
committed
fix(paper): create_user 密码改 getpass/stdin,不留痕

mirror29
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: 多用户登录 —— 账号存 DB + session cookie + per-user 隔离#129

feat: 多用户登录 —— 账号存 DB + session cookie + per-user 隔离#129
mirror29 merged 19 commits into
mainfrom
feat/multi-user-login

Commits on Jul 2, 2026

feat(db): 新增 users 表迁移 —— 多用户登录账号落库

feat(paper): /auth/login 端点 + argon2 密码校验 + create_user 脚本

feat(orchestration): tool 打后端时转发登录用户 sub,agent 写操作按用户隔离

feat(dashboard): 登录会话 + 登录页 + 中间件鉴权 + subject 从 session 派生

chore(infra): AUTH_ENABLED 开关(本地免登录/线上强制) + compose 注入

fix(orchestration): pending-plan 护栏按登录用户查 + 补 resolveRequestToken 单测

feat(paper): /auth/login 加按邮箱失败节流(抗在线爆破)

fix(dashboard): 登录 429 透传 —— 被限流时提示'尝试过于频繁'而非'服务不可用'

fix(paper): 登录节流表改 LRU 淘汰,堵住'刷万级邮箱清表'绕过

fix(dashboard): chat 会话读/改按 owner 校验,堵越权(IDOR)

fix(paper): 登录失败节流 check+record 原子化,堵并发爆破

test(dashboard): 搭最小 vitest + ownsThread 越权(IDOR)回归测试

ci(dashboard): CI 跑 pnpm test(vitest),让 ownsThread 回归真正生效

fix(dashboard,shared): session token 加 token_use + 后端拒收 session 凭据

fix(paper): 登录邮箱 strip 口径统一(节流 key / DB 查询 / 建号存储一致)

test(orchestration): 证 mastra Memory 按 resourceId 隔离 thread(#130 回归守卫)

fix(dashboard): 生产强制开登录(AUTH_ENABLED fail-safe)

fix(paper): 多 worker 启动报警(登录节流/live runner 单进程假设)

fix(paper): create_user 密码改 getpass/stdin,不留痕