feat: 增强管理员登录安全性，添加IP失败计数器以防止字典攻击，限制请求体大小，优化配置文件权限

entrypoint.sh

@@ -14,7 +14,7 @@ fi
 # was created by a previous container with different ownership (common on
 # HuggingFace Spaces persistent storage after rebuild).
 chown ds2api:ds2api /data/config.json 2>/dev/null || true
-chmod 644 /data/config.json 2>/dev/null || true
+chmod 600 /data/config.json 2>/dev/null || true
 
 # Create chat history file if not exists or is empty
 if [ ! -f /data/chat_history.json ] || [ ! -s /data/chat_history.json ]; then

internal/config/store.go

@@ -151,7 +151,7 @@ func loadConfigFromFile(path string) (Config, error) {
 	cfg.DropInvalidAccounts()
 	if strings.Contains(string(content), `"test_status"`) && !IsVercel() {
 		if b, err := json.MarshalIndent(cfg, "", "  "); err == nil {
-			_ = overwriteFile(path, b, 0o644)
+			_ = overwriteFile(path, b, configFilePerm())
 		}
 	}
 	// 加载成功后刷新可用备份（仅当当前文件合法时才覆盖备份，避免用损坏

internal/config/store_env_writeback.go

@@ -50,10 +50,16 @@ func overwriteFile(path string, b []byte, perm os.FileMode) error {
 	return nil
 }
 
+// configFilePerm 返回配置文件的权限位。
+// 0600 (owner-only read/write) 防止同机其他用户读取明文凭据。
+func configFilePerm() os.FileMode {
+	return 0o600
+}
+
 func writeConfigBytes(path string, b []byte) error {
 	dir := filepath.Dir(path)
 	if dir == "." || dir == "" {
-		return overwriteFile(path, b, 0o644)
+		return overwriteFile(path, b, configFilePerm())
 	}
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return fmt.Errorf("mkdir config dir: %w", err)
@@ -88,13 +94,15 @@ func writeConfigBytes(path string, b []byte) error {
 		// Try removing the old file and renaming again.
 		if removeErr := os.Remove(path); removeErr == nil {
 			if renameErr := os.Rename(tmpName, path); renameErr == nil {
+				_ = os.Chmod(path, configFilePerm())
 				return nil
 			}
 		}
 		// Rename still failing (e.g. cross-filesystem); fall back to direct write.
 		_ = os.Remove(tmpName)
-		return overwriteFile(path, b, 0o644)
+		return overwriteFile(path, b, configFilePerm())
 	}
+	_ = os.Chmod(path, configFilePerm())
 	return nil
 }
 
@@ -104,7 +112,7 @@ func backupConfigFile(path string, content []byte) error {
 	if len(content) == 0 {
 		return nil
 	}
-	return overwriteFile(path+".bak", content, 0o644)
+	return overwriteFile(path+".bak", content, configFilePerm())
 }
 
 // resetConfigToEmpty 把 path 重置为 {}，用于损坏文件无可恢复备份时的兜底。
@@ -123,7 +131,7 @@ func resetConfigToEmpty(path string) {
 // config.json 被截断成半截 JSON）。
 func recoverCorruptConfig(path string, corruptContent []byte) bool {
 	corruptPath := fmt.Sprintf("%s.corrupt.%d", path, time.Now().Unix())
-	if werr := overwriteFile(corruptPath, corruptContent, 0o644); werr != nil {
+	if werr := overwriteFile(corruptPath, corruptContent, configFilePerm()); werr != nil {
 		Logger.Warn("[config] failed to preserve corrupt config for inspection", "path", corruptPath, "error", werr)
 	}
 

internal/httpapi/admin/auth/handler_auth.go

@@ -21,14 +21,21 @@ func (h *Handler) requireAdmin(next http.Handler) http.Handler {
 }
 
 func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
+	ip := clientIP(r)
+	if !defaultLoginLimiter.allowLogin(ip) {
+		writeJSON(w, http.StatusTooManyRequests, map[string]any{"detail": "Too many failed login attempts. Please try again later."})
+		return
+	}
 	var req map[string]any
 	_ = json.NewDecoder(r.Body).Decode(&req)
 	adminKey, _ := req["admin_key"].(string)
 	expireHours := intFrom(req["expire_hours"])
 	if !authn.VerifyAdminCredential(adminKey, h.Store) {
+		defaultLoginLimiter.recordFailure(ip)
 		writeJSON(w, http.StatusUnauthorized, map[string]any{"detail": "Invalid admin key"})
 		return
 	}
+	defaultLoginLimiter.recordSuccess(ip)
 	token, err := authn.CreateJWTWithStore(expireHours, h.Store)
 	if err != nil {
 		writeJSON(w, http.StatusInternalServerError, map[string]any{"detail": err.Error()})

internal/httpapi/admin/auth/login_rate_limit.go

@@ -0,0 +1,109 @@
+package auth
+
+import (
+	"net/http"
+	"sync"
+	"time"
+)
+
+// loginRateLimiter 进程级 IP 失败计数器，防止 admin key 字典攻击。
+// 同一 IP 在 window 内连续失败 maxFailures 次后，lockout 期间拒绝所有登录请求。
+// 注意：HF Spaces 多副本部署时，每个副本独立计数，可被绕过。
+type loginRateLimiter struct {
+	mu          sync.Mutex
+	failures    map[string]*loginFailState
+	maxFailures int
+	window      time.Duration // 失败计数累计窗口
+	lockout     time.Duration // 触发后封禁时长
+}
+
+type loginFailState struct {
+	count        int
+	lastFailAt   time.Time
+	lockoutUntil time.Time
+}
+
+var defaultLoginLimiter = newLoginRateLimiter(5, 5*time.Minute, 5*time.Minute)
+
+func newLoginRateLimiter(maxFailures int, window, lockout time.Duration) *loginRateLimiter {
+	return &loginRateLimiter{
+		failures:    map[string]*loginFailState{},
+		maxFailures: maxFailures,
+		window:      window,
+		lockout:     lockout,
+	}
+}
+
+// allowLogin 检查 IP 是否被封禁。返回是否允许尝试登录。
+func (l *loginRateLimiter) allowLogin(ip string) bool {
+	if ip == "" {
+		return true
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := time.Now()
+	state, ok := l.failures[ip]
+	if !ok {
+		return true
+	}
+	if now.Before(state.lockoutUntil) {
+		return false
+	}
+	return true
+}
+
+// recordFailure 记录一次登录失败。达到阈值后进入封禁。
+func (l *loginRateLimiter) recordFailure(ip string) {
+	if ip == "" {
+		return
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	now := time.Now()
+	state, ok := l.failures[ip]
+	if !ok || now.Sub(state.lastFailAt) > l.window {
+		state = &loginFailState{count: 0, lastFailAt: now}
+		l.failures[ip] = state
+	}
+	state.count++
+	state.lastFailAt = now
+	if state.count >= l.maxFailures {
+		state.lockoutUntil = now.Add(l.lockout)
+	}
+}
+
+// recordSuccess 登录成功后重置该 IP 的失败计数。
+func (l *loginRateLimiter) recordSuccess(ip string) {
+	if ip == "" {
+		return
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.failures, ip)
+}
+
+// clientIP 从请求中提取客户端 IP。优先使用 chi 的 RealIP 中间件已设置的 RemoteAddr。
+func clientIP(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
+	if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
+		// 取第一个 IP
+		for i := 0; i < len(ip); i++ {
+			if ip[i] == ',' {
+				return ip[:i]
+			}
+		}
+		return ip
+	}
+	host := r.RemoteAddr
+	for i := len(host) - 1; i >= 0; i-- {
+		if host[i] == ':' {
+			return host[:i]
+		}
+	}
+	return host
+}

internal/httpapi/admin/version/handler_version.go

@@ -3,13 +3,24 @@ package version
 import (
 	"encoding/json"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
 	"ds2api/internal/version"
 )
 
-const latestReleaseAPI = "https://api.github.com/repos/CJackHwang/ds2api/releases/latest"
+// defaultReleaseRepo 是默认用于版本检查的 GitHub 仓库（owner/repo）。
+// 可通过环境变量 DS2API_VERSION_CHECK_REPO 覆盖。
+const defaultReleaseRepo = "luckfun233/ds2api"
+
+func latestReleaseAPIURL() string {
+	repo := strings.TrimSpace(os.Getenv("DS2API_VERSION_CHECK_REPO"))
+	if repo == "" {
+		repo = defaultReleaseRepo
+	}
+	return "https://api.github.com/repos/" + repo + "/releases/latest"
+}
 
 type latestReleasePayload struct {
 	TagName     string `json:"tag_name"`
@@ -27,7 +38,7 @@ func (h *Handler) getVersion(w http.ResponseWriter, _ *http.Request) {
 		"checked_at":      time.Now().UTC().Format(time.RFC3339),
 	}
 
-	req, err := http.NewRequest(http.MethodGet, latestReleaseAPI, nil)
+	req, err := http.NewRequest(http.MethodGet, latestReleaseAPIURL(), nil)
 	if err != nil {
 		resp["check_error"] = err.Error()
 		writeJSON(w, http.StatusOK, resp)

internal/httpapi/claude/handler_messages.go

@@ -28,6 +28,7 @@ import (
 )
 
 func (h *Handler) Messages(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBodySize)
 	if strings.TrimSpace(r.Header.Get("anthropic-version")) == "" {
 		r.Header.Set("anthropic-version", "2023-06-01")
 	}
@@ -58,7 +59,9 @@ func isClaudeVercelProxyRequest(r *http.Request) bool {
 func (h *Handler) handleClaudeDirect(w http.ResponseWriter, r *http.Request) bool {
 	raw, err := io.ReadAll(r.Body)
 	if err != nil {
-		if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
+		if strings.Contains(strings.ToLower(err.Error()), "too large") {
+			writeClaudeError(w, http.StatusRequestEntityTooLarge, "request body too large")
+		} else if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
 			writeClaudeError(w, http.StatusBadRequest, "invalid json")
 		} else {
 			writeClaudeError(w, http.StatusBadRequest, "invalid body")
@@ -151,7 +154,9 @@ func (h *Handler) handleClaudeDirectStream(w http.ResponseWriter, r *http.Reques
 func (h *Handler) proxyViaOpenAI(w http.ResponseWriter, r *http.Request, store ConfigReader) bool {
 	raw, err := io.ReadAll(r.Body)
 	if err != nil {
-		if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
+		if strings.Contains(strings.ToLower(err.Error()), "too large") {
+			writeClaudeError(w, http.StatusRequestEntityTooLarge, "request body too large")
+		} else if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
 			writeClaudeError(w, http.StatusBadRequest, "invalid json")
 		} else {
 			writeClaudeError(w, http.StatusBadRequest, "invalid body")

internal/httpapi/claude/handler_routes.go

@@ -34,6 +34,10 @@ var (
 	claudeStreamMaxKeepaliveCnt = dsprotocol.MaxKeepaliveCount
 )
 
+// maxRequestBodySize limits total JSON request body size (100 MiB),
+// consistent with OpenAI endpoints.
+const maxRequestBodySize = 100 << 20
+
 func RegisterRoutes(r chi.Router, h *Handler) {
 	r.Get("/anthropic/v1/models", h.ListModels)
 	r.Post("/anthropic/v1/messages", h.Messages)

internal/httpapi/claude/handler_tokens.go

@@ -3,9 +3,11 @@ package claude
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 )
 
 func (h *Handler) CountTokens(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBodySize)
 	a, err := h.Auth.Determine(r)
 	if err != nil {
 		writeClaudeError(w, http.StatusUnauthorized, err.Error())
@@ -15,7 +17,11 @@ func (h *Handler) CountTokens(w http.ResponseWriter, r *http.Request) {
 
 	var req map[string]any
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeClaudeError(w, http.StatusBadRequest, "invalid json")
+		if strings.Contains(strings.ToLower(err.Error()), "too large") {
+			writeClaudeError(w, http.StatusRequestEntityTooLarge, "request body too large")
+		} else {
+			writeClaudeError(w, http.StatusBadRequest, "invalid json")
+		}
 		return
 	}
 	model, _ := req["model"].(string)

internal/httpapi/gemini/handler_generate.go

@@ -28,6 +28,7 @@ import (
 )
 
 func (h *Handler) handleGenerateContent(w http.ResponseWriter, r *http.Request, stream bool) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBodySize)
 	if isGeminiVercelProxyRequest(r) && h.proxyViaOpenAI(w, r, stream) {
 		return
 	}
@@ -55,7 +56,9 @@ func isGeminiVercelProxyRequest(r *http.Request) bool {
 func (h *Handler) handleGeminiDirect(w http.ResponseWriter, r *http.Request, stream bool) bool {
 	raw, err := io.ReadAll(r.Body)
 	if err != nil {
-		if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
+		if strings.Contains(strings.ToLower(err.Error()), "too large") {
+			writeGeminiError(w, http.StatusRequestEntityTooLarge, "request body too large")
+		} else if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
 			writeGeminiError(w, http.StatusBadRequest, "invalid json")
 		} else {
 			writeGeminiError(w, http.StatusBadRequest, "invalid body")
@@ -143,7 +146,9 @@ func (h *Handler) handleGeminiDirectStream(w http.ResponseWriter, r *http.Reques
 func (h *Handler) proxyViaOpenAI(w http.ResponseWriter, r *http.Request, stream bool) bool {
 	raw, err := io.ReadAll(r.Body)
 	if err != nil {
-		if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
+		if strings.Contains(strings.ToLower(err.Error()), "too large") {
+			writeGeminiError(w, http.StatusRequestEntityTooLarge, "request body too large")
+		} else if errors.Is(err, requestbody.ErrInvalidUTF8Body) {
 			writeGeminiError(w, http.StatusBadRequest, "invalid json")
 		} else {
 			writeGeminiError(w, http.StatusBadRequest, "invalid body")

internal/httpapi/gemini/handler_routes.go

@@ -12,6 +12,10 @@ import (
 
 var writeJSON = util.WriteJSON
 
+// maxRequestBodySize limits total JSON request body size (100 MiB),
+// consistent with OpenAI endpoints.
+const maxRequestBodySize = 100 << 20
+
 type Handler struct {
 	Store       ConfigReader
 	Auth        AuthResolver

internal/httpapi/ollama/handler_routes.go

@@ -11,6 +11,10 @@ import (
 
 var WriteJSON = util.WriteJSON
 
+// maxRequestBodySize limits total JSON request body size (100 MiB),
+// consistent with OpenAI endpoints.
+const maxRequestBodySize = 100 << 20
+
 type ConfigReader interface {
 	ModelAliases() map[string]string
 }
@@ -38,6 +42,7 @@ func (h *Handler) ListOllamaModels(w http.ResponseWriter, r *http.Request) {
 	WriteJSON(w, http.StatusOK, config.OllamaModelsResponse())
 }
 func (h *Handler) GetOllamaModel(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBodySize)
 	var payload OllamaModelRequest
 	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
 		http.Error(w, "Invalid JSON body: "+err.Error(), http.StatusBadRequest)

internal/rawsample/rawsample.go

@@ -7,12 +7,15 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"sort"
 	"strings"
 	"time"
 
 	"github.com/google/uuid"
 )
 
+const DefaultMaxSamples = 50
+
 var referenceMarkerRe = regexp.MustCompile(`(?i)\[reference:\s*\d+\]`)
 
 type CaptureRound struct {
@@ -49,6 +52,9 @@ type PersistOptions struct {
 	Request      any
 	Capture      CaptureSummary
 	UpstreamBody []byte
+	// MaxSamples limits how many sample directories are retained in RootDir.
+	// If <= 0, DefaultMaxSamples is used. Excess samples (oldest first) are pruned after persist.
+	MaxSamples int
 }
 
 type SavedSample struct {
@@ -125,6 +131,12 @@ func Persist(opts PersistOptions) (SavedSample, error) {
 		return SavedSample{}, fmt.Errorf("promote sample dir: %w", err)
 	}
 
+	maxKeep := opts.MaxSamples
+	if maxKeep <= 0 {
+		maxKeep = DefaultMaxSamples
+	}
+	pruneExcessSamples(root, maxKeep)
+
 	return SavedSample{
 		SampleID:     sampleID,
 		Dir:          finalDir,
@@ -197,3 +209,42 @@ func analyzeBytes(raw []byte) (containsReferenceMarkers bool, referenceMarkerCou
 	containsFinishedToken = finishedTokenCount > 0
 	return
 }
+
+// pruneExcessSamples removes the oldest sample directories beyond maxKeep.
+// Errors during individual removals are ignored (best-effort cleanup).
+func pruneExcessSamples(rootDir string, maxKeep int) {
+	if maxKeep <= 0 {
+		return
+	}
+	entries, err := os.ReadDir(rootDir)
+	if err != nil {
+		return
+	}
+	type sampleInfo struct {
+		name  string
+		mtime time.Time
+	}
+	var samples []sampleInfo
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			continue
+		}
+		samples = append(samples, sampleInfo{
+			name:  entry.Name(),
+			mtime: info.ModTime(),
+		})
+	}
+	if len(samples) <= maxKeep {
+		return
+	}
+	sort.Slice(samples, func(i, j int) bool {
+		return samples[i].mtime.After(samples[j].mtime)
+	})
+	for _, s := range samples[maxKeep:] {
+		_ = os.RemoveAll(filepath.Join(rootDir, s.name))
+	}
+}

internal/webui/handler.go

@@ -95,6 +95,8 @@ func setStaticContentType(w http.ResponseWriter, fullPath string) {
 }
 
 func (h *Handler) serveFromDisk(w http.ResponseWriter, r *http.Request, staticDir string) {
+	// 防止浏览器对响应内容做 MIME sniffing，避免 XSS 通过类型混淆绕过。
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	root := filepath.Clean(staticDir)
 	path := strings.TrimPrefix(r.URL.Path, "/admin")
 	path = strings.TrimPrefix(path, "/")