ai-chatbot

Author	SHA1	Message	Date
Your Name	d58b706799	security: implement Phase 1 & partial Phase 2 improvements Some checks failed Lint / build (20) (push) Has been cancelled Details - Remove hardcoded admin password, use env var or auto-generate - Fix trustHost to be conditional (Vercel-only by default) - Add HTTP security headers (CSP, X-Frame-Options, HSTS) - Create middleware.ts to activate existing rate limiting - Implement structured logging system - Rewrite error handling in ai-cad service - Update security documentation	2026-05-05 22:49:57 +08:00
Your Name	77c9ac244b	fix: allow DuluPay payment callbacks to bypass auth in proxy.ts Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details The previous commit incorrectly added middleware.ts which conflicts with Next.js 16's proxy.ts. The actual auth gate is in proxy.ts which redirects unauthenticated GET requests to /login. DuluPay's server-to- server callbacks have no session cookie, so they need to be whitelisted. Removes middleware.ts and adds /api/payment/* to proxy.ts whitelist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-25 22:14:25 +08:00
Your Name	15dfb13b57	fix: add middleware to bypass auth for payment callback routes Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details DuluPay payment callbacks were returning 307 redirect to login page because the server-to-server requests have no session cookie. This caused all payment notifications to fail, preventing points from being credited after successful payment. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-25 22:06:16 +08:00
Your Name	00b8755838	修复路由冲突：删除重复的 detect-object 路由 Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details Next.js 16.1.1 不允许重复路由。删除 app/(chat)/api/detect-object/route.ts，保留 app/api/detect-object/route.ts 作为主要API路由。	2026-01-01 12:38:55 +08:00
Your Name	5e402948a2	fix: 修复中间件对API POST请求的错误重定向，直接返回401而不是重定向到登录页面 Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details	2025-12-29 01:34:30 +08:00
Your Name	a8abed6b5b	feat: 添加多层安全防护机制 Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details - 添加速率限制中间件，防止API滥用和DDoS攻击 - 添加可疑请求检测，基于行为模式识别攻击 - 添加输入清理和验证，防止命令注入和XSS攻击 - 更新middleware.ts，集成所有安全功能 - 添加fail2ban安装脚本，防止SSH暴力破解 - 不依赖IP黑名单，适用于所有攻击者安全功能： - API速率限制：每分钟100次请求 - 认证速率限制：每分钟5次请求 - 自动检测可疑请求模式 - 输入清理和验证 - 详细的安全日志记录	2025-12-28 22:45:13 +08:00
Your Name	08a1bd8007	优化中间件和管理员设置 Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details	2025-12-25 23:30:08 +08:00
Your Name	9076b4ab15	优化认证和中间件功能 Some checks failed Lint / build (20) (push) Has been cancelled Details Playwright Tests / test (push) Has been cancelled Details	2025-12-25 23:08:33 +08:00

8 Commits