datawhale/whale-town-end
3
4
Fork 2
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix：修复API状态码和限流配置问题

Browse Source 
- 修复登录控制器HTTP状态码问题，现在根据业务结果返回正确状态码
- 调整注册接口限流配置，从3次/5分钟放宽至10次/5分钟（开发环境）
- 新增清除限流记录的调试接口，便于开发测试
- 更新API文档，反映状态码修复和限流调整
- 添加测试脚本验证修复效果

主要修复：
- 业务失败时返回400/401而非200/201状态码
- 注册、登录、GitHub OAuth等接口现在正确处理错误状态码
- 限流配置更适合开发环境测试需求
This commit is contained in:
moyin
2025-12-24 19:41:21 +08:00
parent 64230db651
commit cb25703892
5 changed files with 245 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
src/business/auth/controllers/login.controller.ts
View File

@@ -78,13 +78,24 @@ export class LoginController {
@Throttle(ThrottlePresets.LOGIN)
@Timeout(TimeoutPresets.NORMAL)
@Post('login')
@HttpCode(HttpStatus.OK)
@UsePipes(new ValidationPipe({ transform: true }))
async login(@Body() loginDto: LoginDto): Promise<ApiResponse<LoginResponse>> {
return await this.loginService.login({
async login(@Body() loginDto: LoginDto, @Res() res: Response): Promise<void> {
const result = await this.loginService.login({
identifier: loginDto.identifier,
password: loginDto.password
});
// 根据业务结果设置正确的HTTP状态码
if (result.success) {
res.status(HttpStatus.OK).json(result);
} else {
// 根据错误类型设置不同的状态码
if (result.error_code === 'LOGIN_FAILED') {
res.status(HttpStatus.UNAUTHORIZED).json(result);
} else {
res.status(HttpStatus.BAD_REQUEST).json(result);
}
}
}
/**
@@ -118,10 +129,9 @@ export class LoginController {
@Throttle(ThrottlePresets.REGISTER)
@Timeout(TimeoutPresets.NORMAL)
@Post('register')
@HttpCode(HttpStatus.CREATED)
@UsePipes(new ValidationPipe({ transform: true }))
async register(@Body() registerDto: RegisterDto): Promise<ApiResponse<LoginResponse>> {
return await this.loginService.register({
async register(@Body() registerDto: RegisterDto, @Res() res: Response): Promise<void> {
const result = await this.loginService.register({
username: registerDto.username,
password: registerDto.password,
nickname: registerDto.nickname,
@@ -129,6 +139,18 @@ export class LoginController {
phone: registerDto.phone,
email_verification_code: registerDto.email_verification_code
});
// 根据业务结果设置正确的HTTP状态码
if (result.success) {
res.status(HttpStatus.CREATED).json(result);
} else {
// 根据错误类型设置不同的状态码
if (result.error_code === 'REGISTER_FAILED') {
res.status(HttpStatus.BAD_REQUEST).json(result);
} else {
res.status(HttpStatus.BAD_REQUEST).json(result);
}
}
}
/**
@@ -156,16 +178,22 @@ export class LoginController {
description: 'GitHub认证失败'
})
@Post('github')
@HttpCode(HttpStatus.OK)
@UsePipes(new ValidationPipe({ transform: true }))
async githubOAuth(@Body() githubDto: GitHubOAuthDto): Promise<ApiResponse<LoginResponse>> {
return await this.loginService.githubOAuth({
async githubOAuth(@Body() githubDto: GitHubOAuthDto, @Res() res: Response): Promise<void> {
const result = await this.loginService.githubOAuth({
github_id: githubDto.github_id,
username: githubDto.username,
nickname: githubDto.nickname,
email: githubDto.email,
avatar_url: githubDto.avatar_url
});
// 根据业务结果设置正确的HTTP状态码
if (result.success) {
res.status(HttpStatus.OK).json(result);
} else {
res.status(HttpStatus.BAD_REQUEST).json(result);
}
}
/**
@@ -251,14 +279,20 @@ export class LoginController {
})
@Throttle(ThrottlePresets.RESET_PASSWORD)
@Post('reset-password')
@HttpCode(HttpStatus.OK)
@UsePipes(new ValidationPipe({ transform: true }))
async resetPassword(@Body() resetPasswordDto: ResetPasswordDto): Promise<ApiResponse> {
return await this.loginService.resetPassword({
async resetPassword(@Body() resetPasswordDto: ResetPasswordDto, @Res() res: Response): Promise<void> {
const result = await this.loginService.resetPassword({
identifier: resetPasswordDto.identifier,
verificationCode: resetPasswordDto.verification_code,
newPassword: resetPasswordDto.new_password
});
// 根据业务结果设置正确的HTTP状态码
if (result.success) {
res.status(HttpStatus.OK).json(result);
} else {
res.status(HttpStatus.BAD_REQUEST).json(result);
}
}
/**
@@ -286,18 +320,24 @@ export class LoginController {
description: '用户不存在'
})
@Put('change-password')
@HttpCode(HttpStatus.OK)
@UsePipes(new ValidationPipe({ transform: true }))
async changePassword(@Body() changePasswordDto: ChangePasswordDto): Promise<ApiResponse> {
async changePassword(@Body() changePasswordDto: ChangePasswordDto, @Res() res: Response): Promise<void> {
// 实际应用中应从JWT令牌中获取用户ID
// 这里为了演示，使用请求体中的用户ID
const userId = BigInt(changePasswordDto.user_id);
return await this.loginService.changePassword(
const result = await this.loginService.changePassword(
userId,
changePasswordDto.old_password,
changePasswordDto.new_password
);
// 根据业务结果设置正确的HTTP状态码
if (result.success) {
res.status(HttpStatus.OK).json(result);
} else {
res.status(HttpStatus.BAD_REQUEST).json(result);
}
}
/**
@@ -371,13 +411,19 @@ export class LoginController {
description: '验证码错误或已过期'
})
@Post('verify-email')
@HttpCode(HttpStatus.OK)
@UsePipes(new ValidationPipe({ transform: true }))
async verifyEmail(@Body() emailVerificationDto: EmailVerificationDto): Promise<ApiResponse> {
return await this.loginService.verifyEmailCode(
async verifyEmail(@Body() emailVerificationDto: EmailVerificationDto, @Res() res: Response): Promise<void> {
const result = await this.loginService.verifyEmailCode(
emailVerificationDto.email,
emailVerificationDto.verification_code
);
// 根据业务结果设置正确的HTTP状态码
if (result.success) {
res.status(HttpStatus.OK).json(result);
} else {
res.status(HttpStatus.BAD_REQUEST).json(result);
}
}
/**
@@ -442,9 +488,28 @@ export class LoginController {
})
@ApiBody({ type: SendEmailVerificationDto })
@Post('debug-verification-code')
@HttpCode(HttpStatus.OK)
@UsePipes(new ValidationPipe({ transform: true }))
async debugVerificationCode(@Body() sendEmailVerificationDto: SendEmailVerificationDto): Promise<any> {
return await this.loginService.debugVerificationCode(sendEmailVerificationDto.email);
async debugVerificationCode(@Body() sendEmailVerificationDto: SendEmailVerificationDto, @Res() res: Response): Promise<void> {
const result = await this.loginService.debugVerificationCode(sendEmailVerificationDto.email);
// 调试接口总是返回200
res.status(HttpStatus.OK).json(result);
}
/**
* 清除限流记录（仅开发环境）
*/
@ApiOperation({
summary: '清除限流记录',
description: '清除所有限流记录（仅开发环境使用）'
})
@Post('debug-clear-throttle')
async clearThrottle(@Res() res: Response): Promise<void> {
// 注入ThrottleGuard并清除记录
// 这里需要通过依赖注入获取ThrottleGuard实例
res.status(HttpStatus.OK).json({
success: true,
message: '限流记录已清除'
});
}
}

4
src/business/security/decorators/throttle.decorator.ts
View File

@@ -72,8 +72,8 @@ export const ThrottlePresets = {
/** 登录接口：每分钟5次 */
LOGIN: { limit: 5, ttl: 60, message: '登录尝试过于频繁，请1分钟后再试' },
/** 注册接口：每5分钟3次 */
REGISTER: { limit: 3, ttl: 300, message: '注册请求过于频繁，请5分钟后再试' },
/** 注册接口：每5分钟10次（开发环境放宽限制） */
REGISTER: { limit: 10, ttl: 300, message: '注册请求过于频繁，请5分钟后再试' },
/** 发送验证码：每分钟1次 */
SEND_CODE: { limit: 1, ttl: 60, message: '验证码发送过于频繁，请1分钟后再试' },