diary-news

xiaji/diary-news

Fork 0

Commit Graph

Author	SHA1	Message	Date
xiaji	b500613d22	feat(auth): 限制同时在线 IP 数 (默认 30, 第 31 拒绝) 背景: 防 token 泄漏被滥用 + 限共享账号人数。 - 新增 app/services/active_ip.py: Redis ZSET 'active_ips' 存 IP,score=last_seen_unix 登录/refresh 时 check_or_register_login_ip(): IP 已在 set → 刷新 score,放行(老用户重连) IP 不在 set + ZCARD < 30 → 加入,放行 IP 不在 set + ZCARD >= 30 → raise 429 每个已认证请求 _resolve_user() 调 touch_ip_dependency() 滑动 TTL,30 天没活动自动从 set 剔除 - get_client_ip() 取真实 IP,优先级 X-Forwarded-For > X-Real-IP > client.host trust_x_forwarded_for 默认 True(生产 Caddy/Nginx 后面) - config 加 3 个开关: site_max_active_ips: int = 30 site_active_ip_idle_days: int = 30 trust_x_forwarded_for: bool = True - admin.py 加 3 个端点: GET /admin/active-ips — 看当前活跃 IP 列表 + last_seen POST /admin/active-ips/kick — 强制踢出指定 IP(body={ip}) DELETE /admin/active-ips/{ip}— 简写踢出 - 注: refresh 也算 IP 占用(拿到 access token 就能用) 但已存在的 IP 直接放行,不会踢自己	2026-06-13 18:22:40 +08:00
Mavis	5109d6f824	fix: API 全部改用显式两步走 await session.execute + result.scalars() 之前 (await ...).scalars() 链式在 SQLAlchemy 2.0 async 下报 'coroutine' has no attribute 'scalars' 错误。改为先 await 拿 result 再 .scalars(),这是 SQLAlchemy 2.0 推荐的 async 写法。	2026-06-07 23:22:56 +08:00
Mavis	60b062daf2	feat: initial MVP - FastAPI backend + Vue3 frontend + docker-compose - backend: FastAPI + SQLAlchemy 2.0(async) + asyncpg + Alembic - 7 API routes: auth/me/articles/sources/bookmarks/subscriptions/admin - models: User/Source/Article/Bookmark/Subscription/ApiToken - services: RSS fetcher (feedparser) + Tencent TMT translator with quota + cache + local NLLB fallback - workers: APScheduler + asyncio pipeline (fetch -> dedupe -> insert -> translate) - seed scripts: create_user, seed_sources (5 RSS: Reuters/BBC/Al Jazeera/NHK/DW) - frontend: Vue 3 + Vite + Naive UI + Pinia + vue-router - pages: Login, Feed (24h), ArticleDetail, Sources, Bookmarks, AdminSources - deploy: docker-compose (postgres/redis/api/worker/frontend/caddy) - docs: README, DEPLOY, architecture, acceptance	2026-06-07 21:51:01 +08:00

Author

SHA1

Message

Date

xiaji

b500613d22

feat(auth): 限制同时在线 IP 数 (默认 30, 第 31 拒绝)

背景: 防 token 泄漏被滥用 + 限共享账号人数。

- 新增 app/services/active_ip.py:
    Redis ZSET 'active_ips' 存 IP,score=last_seen_unix
    登录/refresh 时 check_or_register_login_ip():
        IP 已在 set → 刷新 score,放行(老用户重连)
        IP 不在 set + ZCARD < 30 → 加入,放行
        IP 不在 set + ZCARD >= 30 → raise 429
    每个已认证请求 _resolve_user() 调 touch_ip_dependency()
        滑动 TTL,30 天没活动自动从 set 剔除
- get_client_ip() 取真实 IP,优先级 X-Forwarded-For > X-Real-IP > client.host
    trust_x_forwarded_for 默认 True(生产 Caddy/Nginx 后面)
- config 加 3 个开关:
    site_max_active_ips: int = 30
    site_active_ip_idle_days: int = 30
    trust_x_forwarded_for: bool = True
- admin.py 加 3 个端点:
    GET  /admin/active-ips       — 看当前活跃 IP 列表 + last_seen
    POST /admin/active-ips/kick  — 强制踢出指定 IP(body={ip})
    DELETE /admin/active-ips/{ip}— 简写踢出
- 注: refresh 也算 IP 占用(拿到 access token 就能用)
    但已存在的 IP 直接放行,不会踢自己

2026-06-13 18:22:40 +08:00

Mavis

5109d6f824

fix: API 全部改用显式两步走 await session.execute + result.scalars()

之前 (await ...).scalars() 链式在 SQLAlchemy 2.0 async 下报
'coroutine' has no attribute 'scalars' 错误。改为先 await 拿 result
再 .scalars(),这是 SQLAlchemy 2.0 推荐的 async 写法。

2026-06-07 23:22:56 +08:00

Mavis

60b062daf2

feat: initial MVP - FastAPI backend + Vue3 frontend + docker-compose

- backend: FastAPI + SQLAlchemy 2.0(async) + asyncpg + Alembic
- 7 API routes: auth/me/articles/sources/bookmarks/subscriptions/admin
- models: User/Source/Article/Bookmark/Subscription/ApiToken
- services: RSS fetcher (feedparser) + Tencent TMT translator with quota + cache + local NLLB fallback
- workers: APScheduler + asyncio pipeline (fetch -> dedupe -> insert -> translate)
- seed scripts: create_user, seed_sources (5 RSS: Reuters/BBC/Al Jazeera/NHK/DW)
- frontend: Vue 3 + Vite + Naive UI + Pinia + vue-router
- pages: Login, Feed (24h), ArticleDetail, Sources, Bookmarks, AdminSources
- deploy: docker-compose (postgres/redis/api/worker/frontend/caddy)
- docs: README, DEPLOY, architecture, acceptance

2026-06-07 21:51:01 +08:00

3 Commits