Conversation
@halo-dev/api-client
@halo-dev/components
@halo-dev/richtext-editor
@halo-dev/ui-shared
@halo-dev/ui-plugin-bundler-kit
commit: |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #10228 +/- ##
============================================
+ Coverage 59.55% 65.59% +6.03%
- Complexity 3812 5130 +1318
============================================
Files 677 761 +84
Lines 23248 26741 +3493
Branches 1500 1884 +384
============================================
+ Hits 13846 17541 +3695
+ Misses 8764 8294 -470
- Partials 638 906 +268 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
- Keep the password-change=1 redirect when a verification-required error falls back to the verification page, so the change-password modal reopens after re-verification - Add integration tests covering session-marked verification followed by password change, and rate-limit exhaustion mapped to rate-limit-exceeded - Document the session-keyed verification rate limiter trade-off and drop its unreachable fallback - Update the implementation plan to match the hardened dispatch logic
Split the combined verification form into independent per-method endpoints and templates, following the login page structure: - POST /security-verification/email and /security-verification/totp share the session rate limit, mark-verified and redirect/error mapping through a new public SecurityVerificationFlowService, so method endpoints (community or plugin-provided) reuse it instead of duplicating the plumbing - each method gets its own template file (security-verification_email / security-verification_totp), selected by fragmentTemplateName like the login page; methods switch by URL (?method=) with tabs rendered from availableMethods via th:each, no JS visibility toggling - the attempted method is echoed through the error redirect so a failed TOTP attempt stays on the TOTP form for a retry - drop the redundant explicit CSRF field; Thymeleaf injects one per form - center the cancel link; dedupe email/TOTP verification logic; rename SecurityVerificationService.isAvailable to hasVerificationMethod
Update the plan to match the implemented design: per-method endpoints and independent template files, availableMethods-driven tabs via a plain bean, the shared SecurityVerificationFlowService, and the isAvailable -> hasVerificationMethod rename.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
What this PR does / why we need it:
当前 UC（个人中心）修改密码仅验证原密码，不验证邮箱验证码或 TOTP，攻击者一旦拿到密码即可改密并将用户锁在门外。本 PR 引入 GitHub 式「安全验证」（sudo 模式）：
/security-verification（Thymeleaf 模板，与登录/二步验证页同机制，主题可覆盖）security-verification通知原因类型发送到已验证邮箱（10 分钟过期、5 次尝试、黑名单防爆破）TwoFactorAuthEndpoint抽取为共享TotpVerificationService；验证接口按会话限流（5 次/5 分钟）redirect参数仅接受站内相对路径（拒绝//、\、畸形 URI），防 open redirectWhich issue(s) this PR fixes:
无关联 issue。
Special notes for your reviewer:
docs/superpowers/specs/2026-08-11-security-verification-design.mddocs/superpowers/plans/2026-08-11-security-verification.mdDoes this PR introduce a user-facing change?
修改密码前需先完成安全验证（邮箱验证码或 TOTP 验证码，任选其一）。已验证邮箱与 TOTP 均未配置的用户不受影响。