添加二次认证支持#2
Open
Dustin-Jiang wants to merge 10 commits into
Open
Conversation
Add export_state/restore_state on login to serialize session cookies, headers, and SecondAuthFlow state. Add export_second_auth_state/ restore_second_auth_state on BaseLogin to serialize the full service login context including nested WebVPN MFA continuation. Add initialize_network parameter to BaseLogin.__init__ to skip network probe when restoring from a challenge token.
Split server/server.py into: - server/core/: config, http timeout patch, SessionManager, auth orchestration, AES-GCM MFA challenge token module - server/routers/: auth (MFA endpoints), jwb, jxzxehall, ics - server/schemas.py: Pydantic request models Add stateless MFA flow: business endpoints return HTTP 428 with an encrypted challenge_token when second auth is required. Four new endpoints handle SMS and DingTalk QR continuation without server-side session state. MFA success writes the final session into the existing SessionManager cache. Fix /api/jwb/score using unimported jwb class and nonexistent request.detailed field.
Aligns container runtime with .python-version.
Cover AES-GCM challenge token round-trip, tamper detection, expiry, username binding; login session cookie/header/second-auth-state round-trip; nested WebVPN MFA state restoration.
Document MFA_STATE_KEY/MFA_STATE_TTL environment variables, challenge token flow, and four MFA endpoints. Update AGENTS.md to reflect MFA architecture, uv workflow, and server runtime behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
钉钉登录好像还不太能用，我这暂时测试不了了（）短信验证码测试能用
SDK 二次认证
SecondAuthFlow和SecondAuthMethod实现。second_auth_required，保留现有登录对象和 CAS Session。服务端无状态 MFA
/api/auth/second/sms/send/api/auth/second/sms/verify/api/auth/second/dingtalk/begin/api/auth/second/dingtalk/poll