From 78ce137458520ee5dead299d4c1694142ee87dd5 Mon Sep 17 00:00:00 2001 From: WuYongJie Date: Tue, 8 Sep 2026 18:10:35 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=9D=E6=8C=81=E5=BD=93=E5=89=8D?= =?UTF-8?q?=E9=A1=B5=E5=88=86=E5=9D=97=E8=AF=BB=E5=8F=96=E9=99=90=E6=B5=81?= =?UTF-8?q?=E9=A2=9D=E5=BA=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../integrations/finance-store-account-password-reveal.md | 2 +- .../services/store-account-password-reveal.contract.ts | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/furniture-3d-system/docs/integrations/finance-store-account-password-reveal.md b/furniture-3d-system/docs/integrations/finance-store-account-password-reveal.md index 6c2f3862..b818a8d7 100644 --- a/furniture-3d-system/docs/integrations/finance-store-account-password-reveal.md +++ b/furniture-3d-system/docs/integrations/finance-store-account-password-reveal.md @@ -81,7 +81,7 @@ Content-Type: application/json ## 限流和超时 -- 单账号数据库滚动窗口：服务全部账号 30 次/分钟、300 次/24 小时；同一人员 10 次/分钟；同一账号 5 次/分钟。当前页批次另按批次标记限制为服务 10 次/分钟、500 次/24 小时、同一人员 5 次/分钟；批次中的每个账号仍受同一账号 5 次/分钟限制。查看和复制共享账号额度，轮换令牌不重置服务身份或额度。 +- 单账号数据库滚动窗口：服务全部账号 30 次/分钟、300 次/24 小时；同一人员 10 次/分钟；同一账号 5 次/分钟。公网 TLS 网关保留 1 KiB 敏感请求正文上限，财务端把 50 行当前页拆成两个最多 25 个账号的批次；批次标记因此按服务 20 次/分钟、1000 次/24 小时、同一人员 10 次/分钟限流，等价于原每页额度。批次中的每个账号仍受同一账号 5 次/分钟限制。查看和复制共享账号额度，轮换令牌不重置服务身份或额度。 - 已认证的成功、404、参数拒绝和解密失败均占额度；429 不延长窗口。额度检查与审计在同一数据库事务中用事务级锁串行化，跨进程/重启共享状态。 - 429 不携带剩余数量或精确窗口，避免推测其他用户行为。客户端不得自动重试密码读取；提示用户稍后再试，持续超限联系管理员。 - 财务客户端设置总超时 10 秒、禁用自动重定向和重试。后端池上限 4、连接获取 1 秒、SQL 执行 1.5 秒/客户端查询 2 秒、锁等待 1 秒，路由运行预算 10 秒。网关必须配置请求体 1 秒和总请求截止，防止慢请求占用。 diff --git a/furniture-3d-system/src/server/services/store-account-password-reveal.contract.ts b/furniture-3d-system/src/server/services/store-account-password-reveal.contract.ts index d8619e90..c173f992 100644 --- a/furniture-3d-system/src/server/services/store-account-password-reveal.contract.ts +++ b/furniture-3d-system/src/server/services/store-account-password-reveal.contract.ts @@ -15,7 +15,10 @@ export const revealVisiblePageInputSchema = z.object({ export const FINANCE_SERVICE_ID = 'finance-store-accounts' export const VISIBLE_PAGE_ACCOUNT_ID = 'visible-page' export const REVEAL_LIMITS = { serviceMinute: 30, serviceDay: 300, requesterMinute: 10, accountMinute: 5 } as const -export const VISIBLE_PAGE_LIMITS = { serviceMinute: 10, serviceDay: 500, requesterMinute: 5 } as const +// The public TLS gateway keeps request bodies below 1 KiB, so a 50-row page is +// sent as two 25-account chunks. These limits preserve the original per-page +// allowance after chunking while accountMinute still applies to every item. +export const VISIBLE_PAGE_LIMITS = { serviceMinute: 20, serviceDay: 1000, requesterMinute: 10 } as const export type RevealInput = z.infer export type RevealStatus = 200 | 403 | 404 | 429 | 503 export type RevealAudit = {