rootandClaude Opus 5.5
b0e5d539ed
- GET /auth/totp/setup returns the pending secret and otpauth URL (created on first call, reused on refresh) for the console to render as a QR code. - Enabling TOTP issues 8 one-time recovery codes (argon2id hashes in admin_recovery_code); login accepts recoveryCode in place of totpCode, disable accepts either, and recovery_codes regenerates with the password. - Passkeys via @simplewebauthn/server: register/list/rename/delete under the console session, public login options/verify that reuse the login rate limit and session cookies. Challenges are one-time rows in webauthn_challenge; RP ID and origins come from WEBAUTHN_RP_ID / WEBAUTHN_ORIGINS, falling back to the request host. Signature counter regressions are rejected. SessionInfo gains passkeyEnabled. - --role rotate-master-key re-encrypts the secret table from SECRET_MASTER_KEY to SECRET_MASTER_KEY_NEW one row per transaction, skips rows already on the new key (resumable, swap keys to roll back), logs progress and audits secret.master_key_rotate. Secrets now record the master key fingerprint in kdf_params.kid. - Runbook: recovery codes, passkey configuration, rotation steps and rollback. Co-Authored-By: Claude Opus 5.5 <[email protected]>
@umt/web
React Router 7 SPA 控制台(ssr:false),沿用 uhd_web 设计系统(token 见 app/app.css,规范见 docs/design/)。只通过 /api/v1 与 server 通信,请求/响应类型一律来自 @umt/contracts,不手写重复 DTO。开发端口 5180,/api 代理到 http://localhost:4380。
命令
在仓库根目录执行:
deno task dev:web:开发服务器(5180)。cd apps/web && deno task build:生产构建到build/client,由 server 的WEB_ROOT同端口托管。cd apps/web && deno task test:单测(app/**/*.test.ts)。deno task test:web:smoke:Playwright 全页面冒烟,前提与环境变量见仓库 README。deno task check:tokens:设计 token 守卫。
目录
app/routes/:页面(routes.ts登记全部路由);app/routes/console/为控制台。app/api/:按资源分的 react-query hook,路径与 schema 取@umt/contracts的Api注册表。app/components/:业务组件与ui/基础组件。- Agent 页的
?mock=1演示模式只在开发构建或后端pi.provider = "fake"时生效,生产构建连真实模型时忽略。