jhzhang/rag
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): 登录速率限制与用户会话隔离增强

Browse Source 
- auth_routes: 新增内存级登录速率限制（5min/10次），防止暴力破解
- auth_routes: 统一 DEV_MODE 判断收归 config.py 集中管理
- auth_routes: update_user 增加用户存在性校验
- gateway: require_role 装饰器恢复实际角色校验（原为占位实现）
- session_routes: get_user_sessions 统一传入 limit=20 参数
- session: get_history SQL 增加 id DESC 排序，修复同秒消息顺序错乱

🤖 Generated with [Qoder][https://qoder.com]
This commit is contained in:
lacerate551
2026-06-08 15:44:37 +08:00
parent 8adb550931
commit 3c262b8d35
4 changed files with 103 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api/session_routes.py
View File

@@ -71,7 +71,7 @@ def get_history(session_id):
user_id = request.current_user["user_id"]
# 验证会话归属
sessions = session_manager.get_user_sessions(user_id)
sessions = session_manager.get_user_sessions(user_id, limit=20)
session_ids = [s["session_id"] for s in sessions]
if session_id not in session_ids:
@@ -92,7 +92,7 @@ def delete_session(session_id):
user_id = request.current_user["user_id"]
# 验证会话归属
sessions = session_manager.get_user_sessions(user_id)
sessions = session_manager.get_user_sessions(user_id, limit=20)
session_ids = [s["session_id"] for s in sessions]
if session_id not in session_ids:
@@ -113,7 +113,7 @@ def clear_history(session_id):
user_id = request.current_user["user_id"]
# 验证会话归属
sessions = session_manager.get_user_sessions(user_id)
sessions = session_manager.get_user_sessions(user_id, limit=20)
session_ids = [s["session_id"] for s in sessions]
if session_id not in session_ids: