admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
npc0-hue
2026-07-11 14:56:10 +08:00
commit 7e05d0a4e7
660 changed files with 78119 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/fix-platform-auth-session-api/proposal.md
+17
View File
@@ -0,0 +1,17 @@
## Why
The platform_web console already calls authentication, current-user, profile, theme, and user update endpoints, but the platform API has those routes deferred. That mismatch makes login/register appear broken and encourages the frontend local fallback to grant a platform administrator session without credentials.
## What Changes
- Add a minimal first-party username/email + password session API for login, registration, logout, and current-user lookup.
- Store password hashes in platform-owned user records and never expose password material to platform_web.
- Default public registration to pending server-admin scope instead of platform administrator privileges.
- Add controlled user update support so the 用户管理 page can change user status through the API.
- Restrict frontend local fallback to development/demo mode and downgrade it away from platform administrator privileges.
## Impact
- Affects `platform/` and `platform_web/`.
- Keeps authentication in platform only; plugins do not receive raw credentials or auth secrets.
- Does not add OAuth, SMS, production persistence, billing, cloud host sales, or unrelated marketplace behavior.