|
|
8597957af4
|
fix(auth): reject wrong OTP codes when Redis is missing (security)
Build and Deploy / build-and-deploy (push) Successful in 5m8s
Bug: verifyOtp 里 dev 态 Redis 未配置时, 写了 /^\d{6}$/.test(code) 作为联调 fallback,
导致任意 6 位数字都能登录(包括恶意构造). 实际表现: 用户输入错误验证码也能直接登录。
修复:
- Redis 未配置时无论 dev/prod 一律拒绝, 不再做"任意 6 位"放行
- dev 联调若需要绕过短信, 用万能码 123456 (已保留, 仅 NODE_ENV !== production)
E2E 验证 (curl + NextAuth credentials callback):
错误码 999999 → /login?error=CredentialsSignin , session=null ✓
万能码 123456 → callbackUrl=/, session 有用户 ✓
新增 tools/test-verify-otp.mjs 作为该 bug 的回归测试。
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-13 15:08:03 +08:00 |
|
|
|
c0bce80dd1
|
chore(tools): asset compression pipeline for TOS bucket upload
Build and Deploy / build-and-deploy (push) Successful in 5m13s
新增 tools/asset-pipeline/ 用于把 public/portraits & videos 压缩成桶友好体积:
- sharp: PNG → WebP q82, 最大宽 1600 (-view 三视图 2400)
- ffmpeg: MP4 → libx264 CRF 28, 最大宽 1920, AAC 96k, faststart
- pack.mjs: tar -czf 整目录 → cyber-star-assets.tar.gz
效果 (146 portraits + 33 videos):
- 立绘: 768.6MB → 26.8MB (-96%)
- 视频: 251.7MB → 76.1MB (-70%)
- 总计: 1020MB → 103MB 压缩到 1/10, 95s 跑完
输出位于仓库外 ../assets-compressed/ 与 ../cyber-star-assets.tar.gz, 不入 git。
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-13 14:26:42 +08:00 |
|
