feat: 门禁增强 — 输错5次锁定1h + 退出登录

server/api/health.get.ts

@@ -3,7 +3,7 @@ import { listProviders } from '../utils/search'
 import { checkWebTorrent } from '../utils/torrent'
 import { loadSettings } from '../utils/appconfig'
 
-export default defineEventHandler(async () => {
+export default defineEventHandler(async (event) => {
   const [mongo, webTorrent, settings] = await Promise.all([mongoStatus(), checkWebTorrent(), loadSettings()])
   return {
     ok: true,
@@ -13,6 +13,7 @@ export default defineEventHandler(async () => {
     providers: listProviders(),
     enabledProviders: settings.enabledProviders,
     searchProxy: settings.searchProxy ? '已配置' : '未配置',
-    clients: settings.btClients.map((c) => ({ id: c.id, type: c.type, name: c.name, endpoint: `${c.host}:${c.port}`, enabled: c.enabled !== false }))
+    clients: settings.btClients.map((c) => ({ id: c.id, type: c.type, name: c.name, endpoint: `${c.host}:${c.port}`, enabled: c.enabled !== false })),
+    authed: getCookie(event, 'web_unlock') === '1'
   }
 })

server/api/logout.post.ts

@@ -0,0 +1,11 @@
+// 退出登录：清除 HTTP-only 的访问 cookie
+export default defineEventHandler((event) => {
+  if (!process.env.WEBPASSWORD) return { ok: true }
+  setCookie(event, 'web_unlock', '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0
+  })
+  return { ok: true }
+})

server/api/unlock.post.ts

@@ -1,10 +1,20 @@
-// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie
+import { getRequestIP } from 'h3'
+import { gatePassword, isGateEnabled, checkLock, registerFailure, registerSuccess } from '../utils/gate'
+
+// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie；
+// 同一 IP 输错 5 次锁定 1 小时。
 export default defineEventHandler(async (event) => {
-  const password = process.env.WEBPASSWORD
-  if (!password) return { enabled: false }
+  if (!isGateEnabled()) return { enabled: false }
+
+  const ip = getRequestIP(event, { xForwardedFor: true }) || 'unknown'
+  const lock = checkLock(ip)
+  if (lock.locked) {
+    return { ok: false, locked: true, remainingSec: lock.remainingSec }
+  }
 
   const body = await readBody<{ password?: string }>(event)
-  if (body.password === password) {
+  if (body.password === gatePassword()) {
+    registerSuccess(ip)
     setCookie(event, 'web_unlock', '1', {
       httpOnly: true,
       sameSite: 'lax',
@@ -13,5 +23,10 @@ export default defineEventHandler(async (event) => {
     })
     return { ok: true }
   }
-  throw createError({ statusCode: 401, statusMessage: 'invalid password' })
+
+  const after = registerFailure(ip)
+  if (after.locked) {
+    return { ok: false, locked: true, remainingSec: after.remainingSec }
+  }
+  return { ok: false, locked: false }
 })

server/middleware/auth.ts

@@ -10,6 +10,7 @@ export default defineEventHandler((event) => {
   // 解锁接口、门禁页与 Nuxt 运行所需资源始终放行
   if (
     url === '/api/unlock' ||
+    url === '/api/logout' ||
     url === '/gate' ||
     url.startsWith('/_nuxt') ||
     url.startsWith('/__nuxt') ||

server/utils/gate.ts

@@ -0,0 +1,42 @@
+// 站点门禁的失败次数 / 锁定状态（按客户端 IP，内存存储，单进程有效）
+const MAX_ATTEMPTS = 5
+const LOCK_MS = 60 * 60 * 1000 // 锁定 1 小时
+
+type Attempt = { count: number; lockedUntil: number }
+const attempts = new Map<string, Attempt>()
+
+export function gatePassword(): string {
+  return process.env.WEBPASSWORD || ''
+}
+
+export function isGateEnabled(): boolean {
+  return !!gatePassword()
+}
+
+export function checkLock(ip: string): { locked: boolean; remainingSec: number } {
+  const e = attempts.get(ip)
+  if (!e) return { locked: false, remainingSec: 0 }
+  const now = Date.now()
+  if (e.lockedUntil > now) {
+    return { locked: true, remainingSec: Math.ceil((e.lockedUntil - now) / 1000) }
+  }
+  if (e.lockedUntil > 0) {
+    attempts.delete(ip) // 锁定已过期，重置计数
+  }
+  return { locked: false, remainingSec: 0 }
+}
+
+export function registerFailure(ip: string): { locked: boolean; remainingSec: number } {
+  const e = attempts.get(ip) || { count: 0, lockedUntil: 0 }
+  e.count += 1
+  if (e.count >= MAX_ATTEMPTS) {
+    e.lockedUntil = Date.now() + LOCK_MS
+    e.count = 0
+  }
+  attempts.set(ip, e)
+  return checkLock(ip)
+}
+
+export function registerSuccess(ip: string): void {
+  attempts.delete(ip)
+}