fix: 修复配置开关失效、安全加固与依赖清理 - #75
Open
Zephdyn wants to merge 5 commits into
Open
Conversation
- SHOW_LINKS 开关恒为 true 的问题（原 "=== \"true\" || true"），改为默认开启、可显式关闭 - modules 数组在非 Cloudflare 平台拼接空字符串，改为条件展开 - 环境变量统一为 SITE_SECRET_KEY（兼容旧拼写 SITE_SECRE_KEY），同步修正英文/中文 README - devtools 仅在开发环境启用 - 启用密码保护但未配置强密钥时输出安全警告
- /api/verify 新增登录限流（同 IP 10 分钟最多 5 次），防暴力破解 - 密码比对改用 timingSafeEqual 恒定时间比较，防时序攻击 - authToken Cookie 增加 secure（生产环境）与 path 属性 - API 中间件由"有 Referer 即放行"改为校验 Origin/Referer 与请求主机同源，并用 createError 规范报错 - JWT 增加 issuer/subject 校验，密钥改为运行时读取，避免模块加载时机问题
- 登录密码哈希改用 Web Crypto（前端）与 node:crypto（服务端），移除 crypto-js - 移除 nuxt-lodash：isEmpty 改为原生可选链判断 - 补齐 card.unnamed / meta.fetchError 等 i18n 文案（4 语言） - 显式声明 @intlify/message-compiler 依赖，修复 pnpm 严格模式下 nuxt prepare 失败的问题
- 标签页隐藏时暂停自动刷新倒计时，节省资源 - 移除全局 user-select: none，站点名/URL 可正常复制 - 页面标题、html lang、favicon 改为响应式 useHead，去除重复监听 - UptimeRobot 响应完整类型化，数据解析增加空值保护 - 移除硬编码中文文案，统一走 i18n；移除各组件死代码与未使用导出 - 修复 CSS 变量拼写（--mian-border-color -> --main-border-color）
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更内容
🐛 Bug 修复
SHOW_LINKS开关恒为 true 的问题（原process.env.SHOW_LINK === "true" || true），现在默认开启、可显式关闭SITE_SECRET_KEY（兼容旧拼写SITE_SECRE_KEY），同步修正英文/中文 README🔐 安全加固
/api/verify新增登录限流（同 IP 10 分钟最多 5 次），防暴力破解timingSafeEqual恒定时间比较，防时序攻击authTokenCookie 增加secure（生产环境）与path属性♻️ 依赖与代码质量
crypto-js（改用 Web Crypto / node:crypto）与nuxt-lodash依赖@intlify/message-compiler依赖，修复 pnpm 严格模式下nuxt prepare安装失败的问题user-select: none，文字可正常复制验证
pnpm lint✅pnpm build（cloudflare-pages 预设）✅