feat: 门禁增强 — 输错5次锁定1h + 退出登录

server/api/health.get.ts

@@ -3,7 +3,7 @@ import { listProviders } from '../utils/search'
 import { checkWebTorrent } from '../utils/torrent'
 import { loadSettings } from '../utils/appconfig'
 
-export default defineEventHandler(async () => {
+export default defineEventHandler(async (event) => {
   const [mongo, webTorrent, settings] = await Promise.all([mongoStatus(), checkWebTorrent(), loadSettings()])
   return {
     ok: true,
@@ -13,6 +13,7 @@ export default defineEventHandler(async () => {
     providers: listProviders(),
     enabledProviders: settings.enabledProviders,
     searchProxy: settings.searchProxy ? '已配置' : '未配置',
-    clients: settings.btClients.map((c) => ({ id: c.id, type: c.type, name: c.name, endpoint: `${c.host}:${c.port}`, enabled: c.enabled !== false }))
+    clients: settings.btClients.map((c) => ({ id: c.id, type: c.type, name: c.name, endpoint: `${c.host}:${c.port}`, enabled: c.enabled !== false })),
+    authed: getCookie(event, 'web_unlock') === '1'
   }
 })

server/api/logout.post.ts

@@ -0,0 +1,11 @@
+// 退出登录：清除 HTTP-only 的访问 cookie
+export default defineEventHandler((event) => {
+  if (!process.env.WEBPASSWORD) return { ok: true }
+  setCookie(event, 'web_unlock', '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0
+  })
+  return { ok: true }
+})

server/api/unlock.post.ts

@@ -1,10 +1,20 @@
-// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie
+import { getRequestIP } from 'h3'
+import { gatePassword, isGateEnabled, checkLock, registerFailure, registerSuccess } from '../utils/gate'
+
+// 校验站点访问密码（来自环境变量 WEBPASSWORD），成功后写入 HTTP-only cookie；
+// 同一 IP 输错 5 次锁定 1 小时。
 export default defineEventHandler(async (event) => {
-  const password = process.env.WEBPASSWORD
-  if (!password) return { enabled: false }
+  if (!isGateEnabled()) return { enabled: false }
+
+  const ip = getRequestIP(event, { xForwardedFor: true }) || 'unknown'
+  const lock = checkLock(ip)
+  if (lock.locked) {
+    return { ok: false, locked: true, remainingSec: lock.remainingSec }
+  }
 
   const body = await readBody<{ password?: string }>(event)
-  if (body.password === password) {
+  if (body.password === gatePassword()) {
+    registerSuccess(ip)
     setCookie(event, 'web_unlock', '1', {
       httpOnly: true,
       sameSite: 'lax',
@@ -13,5 +23,10 @@ export default defineEventHandler(async (event) => {
     })
     return { ok: true }
   }
-  throw createError({ statusCode: 401, statusMessage: 'invalid password' })
+
+  const after = registerFailure(ip)
+  if (after.locked) {
+    return { ok: false, locked: true, remainingSec: after.remainingSec }
+  }
+  return { ok: false, locked: false }
 })