5 Commits

Include renames

Author	SHA1	Message	Date
MarSeventh	6e90b6bf3a	fix: clamp session max age before KV write	2026-06-09 18:56:44 +08:00
MarSeventh	9d84a0b34a	fix: migrate session storage to manage@ prefix and fix D1 adapter routing ... - Change SESSION_PREFIX from 'session@' to 'manage@session@' to prevent sessions from appearing in file index and backups - Add KV expirationTtl for automatic session cleanup on expiry - Fix D1 adapter: route all manage@ keys to settings table instead of files table (fixes blockipList and session storage in wrong table) - Fix D1 list({ prefix: 'manage@' }) not matching settings table (fixes backup not containing settings data) - Exclude manage@session@ keys from settings backup export	2026-04-28 17:04:41 +08:00
MarSeventh	61f210e0cb	feat: 会话安全策略 - 后端支持动态 Secure/MaxAge 配置 ... - 扩展 getSecurityConfig 和 fetchSecurityConfig 默认值，新增 sessionSecure、userSessionMaxAge、adminSessionMaxAge 字段 - 改造 buildSessionCookie 支持 secure 参数 - createSession 根据 authType 动态读取配置计算 maxAge - destroySession 读取 sessionSecure 确保清除 Cookie 属性一致	2026-04-21 10:58:54 +08:00
MarSeventh	9d0cc7d2b8	fix: remove Secure flag from session cookie for HTTP Docker compatibility	2026-04-19 20:16:36 +08:00
MarSeventh	4d2796f54a	refactor: unify auth logic into authCore with authScope parameter ... - Extract shared authentication logic into utils/auth/authCore.js - Replace enableBasicAuth/enableAuthCode flags with clear authScope enum (ADMIN/USER/EITHER) - Move all auth-related files into utils/auth/ subdirectory - Eliminate duplicated admin auth logic between _middleware.js and dualAuth.js - Fix: user session no longer grants access to admin-only endpoints - Fix: dualAuth no longer bypasses authCode when admin is not configured - Update all 17 import references across the codebase - Preserve original function signatures (userAuthCheck, dualAuthCheck) for zero caller changes	2026-04-18 13:24:53 +08:00