Develop - #134
Conversation
📝 WalkthroughWalkthrough本次变更将登录限流调整为每秒 60 次，并补充路由限流测试；同时新增 Markdown lint 配置并整理项目与 Jenkins 文档格式。 Changes登录限流调整
Markdown 配置与文档格式调整
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant AuthRouter
participant loginRateLimiter
participant AuthService
Client->>AuthRouter: POST /api/auth/login
AuthRouter->>loginRateLimiter: 检查 IP 请求次数
loginRateLimiter-->>AuthRouter: 允许请求或返回 429
AuthRouter->>AuthService: 执行登录
AuthService-->>AuthRouter: 返回成功或失败
AuthRouter-->>Client: 返回 200、401 或 429
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35b5e02020
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| // 用户登录 | ||
| router.post('/login', loginRateLimiter, async (req: Request, res: Response) => { | ||
| router.post('/login', async (req: Request, res: Response) => { |
There was a problem hiding this comment.
When an unauthenticated client repeatedly calls /api/auth/login, this removal allows every request to reach AuthService.login; I checked the mounting in server/index.ts, and there is no global API limiter before authRoutes. The per-account lock only triggers after password checks and does not stop password spraying across accounts, unlimited account enumeration, or malformed encrypted-password requests repeatedly invoking RSA decryption and error logging, so restore loginRateLimiter or equivalent protection here.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,20 @@ | |||
| { | |||
There was a problem hiding this comment.
Remove this repository-root backup artifact from the commit because the repository workflow explicitly confines file modifications to src/ and server/; keeping an editor-style .bak file in version control adds an unrelated configuration copy outside the permitted change locations.
AGENTS.md reference: AGENTS.md:L95-L98
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
server/routes/auth.ts (1)
4-10: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win保留
/login的登录限流保护。
/login当前仅使用通用全局限流，不具备loginRateLimiter的“15 分钟最多 5 次登录尝试”策略；登录接口应恢复该专用限流，避免放开密码猜测和凭证填充的风险。建议修改
import { + loginRateLimiter, registerRateLimiter, forgotPasswordRateLimiter, resetPasswordRateLimiter, refreshRateLimiter, generalAuthRateLimiter, } from '../middleware/authRateLimiter'; -router.post('/login', async (req: Request, res: Response) => { +router.post('/login', loginRateLimiter, async (req: Request, res: Response) => {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server/routes/auth.ts` around lines 4 - 10, 在 auth 路由中引入并应用 loginRateLimiter，确保 /login 同时使用其 15 分钟最多 5 次的专用登录限流策略，而不是仅依赖 generalAuthRateLimiter；保持其他认证路由现有的限流配置不变。Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.markdownlint.json.bak:
- Around line 1-20: 将 Markdown lint 配置文件从不受支持的备份文件名改为 markdownlint
可自动发现的配置名，并同步更新 .gitignore 中对应的忽略项；同时删除配置对象中重复的 MD060 键，确保配置可被正确解析并生效。
---
Outside diff comments:
In `@server/routes/auth.ts`:
- Around line 4-10: 在 auth 路由中引入并应用 loginRateLimiter，确保 /login 同时使用其 15 分钟最多 5
次的专用登录限流策略，而不是仅依赖 generalAuthRateLimiter；保持其他认证路由现有的限流配置不变。
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7a83cb53-2c20-4ac4-b4ea-19c8677a67f9
📒 Files selected for processing (3)
.markdownlint.json.bakCLAUDE.mdserver/routes/auth.ts
| { | ||
| "MD010": false, | ||
| "MD012": false, | ||
| "MD013": false, | ||
| "MD024": false, | ||
| "MD025": false, | ||
| "MD026": false, | ||
| "MD032": false, | ||
| "MD033": false, | ||
| "MD036": false, | ||
| "MD060": false, | ||
| "MD022": false, | ||
| "MD031": false, | ||
| "MD040": false, | ||
| "MD041": false, | ||
| "MD034": false, | ||
| "MD058": false, | ||
| "MD047": false, | ||
| "MD060": false | ||
| } No newline at end of file |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
rg -n --hidden \
-g '!node_modules' \
-g '!dist' \
-g '!build' \
'markdownlint|markdownlint-cli2|--config|\.markdownlint' .Repository: Adrian-Cai/Automation_Platform
Length of output: 238
🏁 Script executed:
#!/bin/bash
set -eu
printf 'Files matching markdownlint names:\n'
git ls-files --full-name | grep -E '(^|/)markdownlint|\.markdownlint|markdownlint-cli2|package\.json|\.github' || true
printf '\nTop-level gitignore relevant lines:\n'
cat -n .gitignore | sed -n '24,32p'
printf '\nAny package scripts mentioning markdownlint or lint:\n'
if [ -f package.json ]; then
node -e "const p=require('./package.json'); const s=p.scripts||{}; for (const k in s) if (/markdownlint|lint/i.test(s[k])) console.log(k+': '+s[k])"
fi
printf '\nMarkdownlint config file contents:\n'
if [ -f .markdownlint.json.bak ]; then
cat -n .markdownlint.json.bak
fi
printf '\nAll markdownlint references with line numbers (repo files only):\n'
git ls-files | xargs -r -n 100 grep -In --extended-regexp 'markdownlint|markdownlint-cli2|--config|\.markdownlint\.json\.bak|\.markdownlint\.json|\.markdownlint\.yaml' || trueRepository: Adrian-Cai/Automation_Platform
Length of output: 7345
🌐 Web query:
davidosang markdownlint supported configuration files .markdownlint.json .markdownlint.yaml .markdownlintrc
💡 Result:
The markdownlint tools maintained by David Anson (including markdownlint-cli2 and the vscode-markdownlint extension) support several configuration file formats and naming conventions [1][2][3]. Notably, the .markdownlintrc file format is explicitly not supported [1]. Supported Configuration Files Configuration files for these tools generally fall into two categories, both of which are supported in any directory of a project [1][4][2]. 1..markdownlint.* Files These files allow control over the markdownlint config object and are supported broadly across tools like markdownlint-cli [1][4]. Supported naming conventions (in order of precedence if multiple exist) are [1][4]: -.markdownlint.jsonc -.markdownlint.json -.markdownlint.yaml -.markdownlint.yml -.markdownlint.cjs -.markdownlint.mjs 2..markdownlint-cli2.* Files These files allow complete control of markdownlint-cli2 behavior and are also used by the vscode-markdownlint extension [1][2]. Supported naming conventions (in order of precedence if multiple exist) are [1][4]: -.markdownlint-cli2.jsonc -.markdownlint-cli2.yaml -.markdownlint-cli2.cjs -.markdownlint-cli2.mjs Additionally, package.json can be used to store configuration for markdownlint-cli2 when placed in the current directory [1]. For scenarios where files cannot be stored in the project root, the --config argument can be used to point to any of these supported configuration files [1][4][2].
Citations:
- 1: https://github.com/DavidAnson/markdownlint-cli2/blob/d86fbe5cd8e0c85531ea470fb91cf0feb3062ff3/README.md
- 2: https://github.com/DavidAnson/vscode-markdownlint/blob/cc4ce070/README.md
- 3: https://marketplace.visualstudio.com/items?itemName=DavidAnson.vscode-markdownlint
- 4: https://github.com/DavidAnson/markdownlint-cli2
将 Markdown lint 配置文件名改为支持的配置名。
.markdownlint.json.bak 不在 markdownlint 自动发现的配置文件名中；仓库中也未见通过 --config 显式指定该文件。请改为支持的配置名（例如 .markdownlint.json），并同步处理 .gitignore 对该文件的忽略，同时删除 MD060 的重复配置项，避免规则不生效或 JSON 解析失败。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.markdownlint.json.bak around lines 1 - 20, 将 Markdown lint
配置文件从不受支持的备份文件名改为 markdownlint 可自动发现的配置名，并同步更新 .gitignore 中对应的忽略项；同时删除配置对象中重复的
MD060 键，确保配置可被正确解析并生效。
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server/middleware/authRateLimiter.ts`:
- Around line 52-56: 更新 authRateLimiter 中共享的 rateLimit handler，使其使用传入配置的
options.message 返回 429 响应，而不是固定的 “Please try again later”。保留
loginRateLimiter、registerRateLimiter 等配置各自的 message，并补充断言实际 429 响应体包含对应消息的测试。
- Around line 46-56: 登录接口目前仅依赖 loginRateLimiter 的 60 次/秒 IP
限制，防暴力破解强度不足。保留现有限制作为突发流量兜底，同时新增更低阈值或更长窗口的 IP 限制，并叠加基于 IP 与账号/凭据的失败登录次数限制；确保与
AuthService.login 的账号锁定逻辑协同生效。
In `@test_case/backend/middleware/authRateLimiter.test.ts`:
- Around line 39-40: Update the 1-second rate-limit tests, including “should
allow 60 requests within 1 second” and “should block 61st request” for
loginRateLimiter and generalAuthRateLimiter, to control time deterministically
with Vitest fake timers or an injectable Store. Ensure all 60 serial requests
remain within the same window, and advance time explicitly when testing window
expiration or the next request.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 47717910-270a-4de5-95fb-2cefa3aa5cda
📒 Files selected for processing (2)
server/middleware/authRateLimiter.tstest_case/backend/middleware/authRateLimiter.test.ts
| * Limit: 60 requests per 1 second per IP | ||
| * | ||
| * Rationale: | ||
| * - Matches existing account lockout (5 failed attempts) | ||
| * - Prevents distributed brute force attacks across multiple IPs | ||
| * - Complements user-level protection with network-level defense | ||
| * - Prevents automated brute force flooding at extreme rates | ||
| * - Documented threshold: 60 requests per second | ||
| */ | ||
| export const loginRateLimiter = rateLimit({ | ||
| ...baseConfig, | ||
| windowMs: 15 * 60 * 1000, // 15 minutes | ||
| max: 5, | ||
| message: 'Too many login attempts, please try again after 15 minutes', | ||
| windowMs: 1000, // 1 second | ||
| max: 60, | ||
| message: 'Too many login attempts, please try again later', |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file =="
git ls-files | grep -F 'server/middleware/authRateLimiter.ts' || true
echo "== authRateLimiter outline/content =="
if [ -f server/middleware/authRateLimiter.ts ]; then
wc -l server/middleware/authRateLimiter.ts
cat -n server/middleware/authRateLimiter.ts
fi
echo "== search login rate limiter usages / similar limits =="
rg -n "loginRateLimiter|rateLimit\\(|rate-limiter|brute|login|attempt|失败|尝试|brute|credential|rate" server app . --glob '!node_modules' --glob '!dist' --glob '!build' -S | head -200Repository: Adrian-Cai/Automation_Platform
Length of output: 23748
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== auth middleware outline/content =="
wc -l server/middleware/auth.ts
cat -n server/middleware/auth.ts
echo "== auth routes relevant content =="
cat -n server/routes/auth.ts | sed -n '1,180p'
echo "== User entity relevant content =="
cat -n server/entities/User.ts | sed -n '1,120p'
echo "== express-rate-limit package reference =="
if [ -f package.json ]; then
jq -r '.dependencies["express-rate-limit"], .devDependencies["express-rate-limit"]' package.json
fi
rg -n "express-rate-limit|rateLimit\\(|rate-limiter|loginAttempts|last_login|login attempts|失败次数|尝试" server docs --glob '!node_modules' --glob '!dist' --glob '!build' -SRepository: Adrian-Cai/Automation_Platform
Length of output: 19231
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== AuthService login relevant content =="
cat -n server/services/AuthService.ts | sed -n '200,290p'
echo "== UserRepository login attempt relevant content =="
cat -n server/repositories/UserRepository.ts | sed -n '55,95p'
echo "== all loginAttempts usage with context =="
rg -n "loginAttempts|login_attempts|increas|增加登录失败|locked|lockedUntil|locked until|locks|lock|locked until" server/services/AuthService.ts server/repositories/UserRepository.ts server/routes/auth.ts -A 6 -B 6 -SRepository: Adrian-Cai/Automation_Platform
Length of output: 11230
不要把 1 秒 60 次登录限制作为唯一的防暴力破解手段。
当前单个 IP 每秒仍能发送 60 次请求，攻击者可先撞库猜出账户，再对该账号发起失败凭据测试；虽然 AuthService.login 会在同一账号累计错误到达 5 次后锁定 15 分钟，但 IP 维度的 60/1s 限流过高且是全局唯一限流层。请增加较低阈值或较长窗口的 IP 限制，并叠加 IP+ 账号/凭据维度的登录失败次数限制，将 60/1s 仅作为突发漏控。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@server/middleware/authRateLimiter.ts` around lines 46 - 56, 登录接口目前仅依赖
loginRateLimiter 的 60 次/秒 IP 限制，防暴力破解强度不足。保留现有限制作为突发流量兜底，同时新增更低阈值或更长窗口的 IP
限制，并叠加基于 IP 与账号/凭据的失败登录次数限制；确保与 AuthService.login 的账号锁定逻辑协同生效。
Source: MCP tools
| export const loginRateLimiter = rateLimit({ | ||
| ...baseConfig, | ||
| windowMs: 15 * 60 * 1000, // 15 minutes | ||
| max: 5, | ||
| message: 'Too many login attempts, please try again after 15 minutes', | ||
| windowMs: 1000, // 1 second | ||
| max: 60, | ||
| message: 'Too many login attempts, please try again later', |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Find file and related occurrences"
if [ -f server/middleware/authRateLimiter.ts ]; then
wc -l server/middleware/authRateLimiter.ts
cat -n server/middleware/authRateLimiter.ts
else
echo "server/middleware/authRateLimiter.ts not found"
fi
echo
echo "Search for custom rateLimit handlers and message usage"
rg -n "express-rate-limit|rateLimit|rateLimiter|handler|message|options\.(message|msg)" server . -g '*.ts' || true
echo
echo "Check package version/dependency"
if [ -f package.json ]; then
cat package.json | sed -n '1,160p'
fi
if [ -f package-lock.json ]; then
rg -n '"express-rate-limit"|node_modules/express-rate-limit' package-lock.json | sed -n '1,60p' || true
fi
if [ -f pnpm-lock.yaml ]; then
rg -n 'express-rate-limit' pnpm-lock.yaml | sed -n '1,40p' || true
fiRepository: Adrian-Cai/Automation_Platform
Length of output: 50387
让 rateLimiter 的 handler 使用 message 配置。
server/middleware/authRateLimiter.ts 第 23-40 行的共享 handler 始终返回固定的 message: 'Please try again later'，所以 loginRateLimiter/registerRateLimiter 等各自的 message 不会进入 429 响应体。让 handler 读取传入的 options.message，或移除各配置中不会生效的 message，并补充对实际 429 response 内容的断言。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@server/middleware/authRateLimiter.ts` around lines 52 - 56, 更新
authRateLimiter 中共享的 rateLimit handler，使其使用传入配置的 options.message 返回 429
响应，而不是固定的 “Please try again later”。保留 loginRateLimiter、registerRateLimiter
等配置各自的 message，并补充断言实际 429 响应体包含对应消息的测试。
Source: MCP tools
There was a problem hiding this comment.
🧹 Nitpick comments (4)
.markdownlint.json (1)
4-18: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift避免全局关闭整组 Markdown 结构规则。
当前配置会对所有 Markdown 文件关闭重复标题、代码围栏语言、裸 URL、列表/表格间距等检查，后续文档问题可能被静默放过。建议修复当前文档问题，或仅对确有兼容性需求的文件使用局部例外，保留全局规则。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.markdownlint.json around lines 4 - 18, Remove the global disables for the Markdown structure rules in the markdownlint configuration, including MD024, MD031–MD041, MD047, MD058, and MD060. Preserve global linting and address any existing violations in the affected documents, using file-specific exceptions only where compatibility requires them.test_case/backend/routes/auth.route.test.ts (3)
13-13: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win为 mock 回调补齐显式函数签名。
严格 TypeScript 规范要求参数和返回值显式类型；请为两个 mock 回调声明
pwd、AuthService的实际方法签名派生类型以避免隐式any。
test_case/backend/routes/auth.route.test.ts#L13-L13：为decryptLoginPasswordmock 声明参数和返回类型。test_case/backend/routes/auth.route.test.ts#L112-L117：为loginmock 声明参数和Promise返回类型。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test_case/backend/routes/auth.route.test.ts` at line 13, 为 test_case/backend/routes/auth.route.test.ts 的 13-13 行 decryptLoginPassword mock 显式声明 pwd 参数及返回类型，并为 112-117 行 login mock 显式声明 email 等参数和 Promise 返回类型；从 AuthService 对应方法签名派生这些类型，避免隐式 any，并保持现有 mock 行为不变。Source: Coding guidelines
4-6: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win使用内部模块路径别名。
这些
../../../server/...相对导入违反内部导入必须使用@/*或@shared/*别名的约定；请改用仓库现有且可解析的别名，不要调整别名配置。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test_case/backend/routes/auth.route.test.ts` around lines 4 - 6, Update the imports in the auth route tests to use the repository’s existing `@/`* or `@shared/`* aliases instead of ../../../server/... relative paths. Apply the aliases to authRouter, authService, and loginRateLimiter without changing alias configuration or other test behavior.Source: Coding guidelines
1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win将测试文件重命名为 kebab-case。
auth.route.test.ts不符合文件名规范；请改为auth-route.test.ts。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test_case/backend/routes/auth.route.test.ts` at line 1, 将测试文件从 auth.route.test.ts 重命名为符合 kebab-case 规范的 auth-route.test.ts，并同步更新任何引用该文件名的配置或导入。Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.markdownlint.json:
- Around line 4-18: Remove the global disables for the Markdown structure rules
in the markdownlint configuration, including MD024, MD031–MD041, MD047, MD058,
and MD060. Preserve global linting and address any existing violations in the
affected documents, using file-specific exceptions only where compatibility
requires them.
In `@test_case/backend/routes/auth.route.test.ts`:
- Line 13: 为 test_case/backend/routes/auth.route.test.ts 的 13-13 行
decryptLoginPassword mock 显式声明 pwd 参数及返回类型，并为 112-117 行 login mock 显式声明 email
等参数和 Promise 返回类型；从 AuthService 对应方法签名派生这些类型，避免隐式 any，并保持现有 mock 行为不变。
- Around line 4-6: Update the imports in the auth route tests to use the
repository’s existing `@/`* or `@shared/`* aliases instead of ../../../server/...
relative paths. Apply the aliases to authRouter, authService, and
loginRateLimiter without changing alias configuration or other test behavior.
- Line 1: 将测试文件从 auth.route.test.ts 重命名为符合 kebab-case 规范的
auth-route.test.ts，并同步更新任何引用该文件名的配置或导入。
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a5475709-2d2d-40b4-8b9b-6936f2ea8f16
📒 Files selected for processing (6)
.gitignore.markdownlint.jsondocs/Jenkins/JENKINS_CONFIG_GUIDE.mddocs/Jenkins/JENKINS_INTEGRATION.mdtest_case/backend/middleware/authRateLimiter.test.tstest_case/backend/routes/auth.route.test.ts
💤 Files with no reviewable changes (1)
- .gitignore
🚧 Files skipped from review as they are similar to previous changes (1)
- test_case/backend/middleware/authRateLimiter.test.ts
1 participant
Summary by CodeRabbit
功能优化
文档