OneAuth

Commit Graph

Author	SHA1	Message	Date
veypi	a7ffd15601	refactor: Remove multi-tenant org system and simplify auth - Delete org API endpoints (add_member, create, del, get, list, member, patch, tree) - Delete models/org.go and remove Org/OrgMember models - Delete org-related test files (org_crud, org_load_middleware, org_permission, multi_tenant) - Delete org test scripts (03_org_permission.sh, 04_org_load_middleware.sh) - Simplify auth/auth.go by removing org context and role loading logic - Remove org claims from JWT tokens and login/register responses - Redesign Permission model with hierarchical level-based access control - Add auth/design.md with new permission system specification - Update user and role APIs to work without org context	4 weeks ago
veypi	f7c4f1ee86	test: improve test stability and documentation - Add 'clean_run.sh' script to reset database and restart server for clean test environment - Update 'README.md' with detailed troubleshooting guide and pitfalls - Add '04_org_load_middleware.sh' to test LoadOrg middleware functionality - Update 'run_all.sh' to include new middleware test - Fix BASE_URL handling in 'lib.sh' and test scripts to support custom environments - Update '02_resource_perm.sh' to fix admin permission checks - Remove debug logging from 'auth.go'	1 month ago
veypi	e96277ee85	fix(api/settings): wrap batch update in database transaction Use database transaction for batch settings update to ensure atomicity. If any individual update fails, the entire batch will be rolled back, preventing partial configuration updates. - Wrap all updates in db.Transaction() - Return detailed error on failure	1 month ago
veypi	9dc866315f	fix(api/settings): add admin permission check for settings update Add permission check in settings update API to ensure only admin users can modify system settings. This fixes a security vulnerability where any authenticated user could modify critical configurations. - Check 'setting:update' permission before allowing updates - Return 403 Forbidden for non-admin users	1 month ago
veypi	23c7f6cb7a	refactor(auth): 重构认证系统，支持多种验证方式和 OAuth 提供商管理 - 新增验证模块(api/verification)，统一处理短信和邮件验证码发送 - 新增邮件发送功能(libs/email)，支持 SMTP 协议 - 重构短信模块(libs/sms)，简化阿里云和腾讯云短信接口 - 新增 OAuth 提供商管理 API(api/oauth/providers)，支持 CRUD 操作 - 新增系统设置管理 API(api/settings)，支持动态配置更新 - 重构认证方式管理(api/auth/methods)，支持启用/禁用多种登录方式 - 删除旧的 sms_providers 和 sms API 模块，迁移至新验证体系 - 新增数据库模型：verification、email、oauth_provider、oauth_templates、setting - 更新配置文档，增加新功能的使用说明	1 month ago

5 Commits (438a84d9fc375ee3ee0dfea1d1874545fea43b52)