opencode/yao
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disable /otp/create endpoint to prevent unauthorized OTP code generation; update documentation to reflect server-side creation process only.

Browse source
This commit is contained in:
Max 2026-02-21 21:45:45 +08:00
parent 37ab2bc84b
commit 886c91372b
2 changed files with 6 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
openapi/otp/README.md
View file

@ -58,22 +58,10 @@ Deletes the code. Silent if the code does not exist.
| Method | Path | Auth | Description |
|---|---|---|---|
| `POST` | `/otp/create` | Bearer token (team context) | Create an OTP code |
| ~~`POST`~~ | ~~`/otp/create`~~ | ~~Bearer token~~ | **Disabled** — use `otp.Create` process instead |
| `POST` | `/otp/login` | Public | Verify code, set session cookies |
### POST /otp/create
Requires a valid access token with team context. The `team_id` is forced from the caller's identity. Validates that the target user/member belongs to the same team.
**Request:**
```json
{"member_id": "M1", "redirect": "/agents/keeper/entry/xxx"}
```
**Response:**
```json
{"code": "abc123def456"}
```
> **Note:** The `/otp/create` HTTP endpoint is intentionally disabled. Exposing it would allow any team member to generate OTP codes for other members, effectively logging in as them without credentials. OTP codes must be created server-side via the `otp.Create` process only.
### POST /otp/login

6
openapi/otp/handler.go
View file

@ -33,9 +33,11 @@ type OTPLoginRequest struct {
}
// Attach registers OTP HTTP routes on the given router group.
// The create endpoint requires authentication; login is public.
// NOTE: /otp/create is disabled — OTP codes should only be created via
// server-side Process (otp.Create) to prevent team members from generating
// codes for other members and logging in as them.
func Attach(group *gin.RouterGroup, auth types.OAuth) {
group.POST("/create", auth.Guard, GinOTPCreate)
// group.POST("/create", auth.Guard, GinOTPCreate)
group.POST("/login", GinOTPLogin)
}