From 886c91372bca470344ab52774f226e415503c603 Mon Sep 17 00:00:00 2001 From: Max Date: Sat, 21 Feb 2026 21:45:45 +0800 Subject: [PATCH] Disable /otp/create endpoint to prevent unauthorized OTP code generation; update documentation to reflect server-side creation process only. --- openapi/otp/README.md | 16 ++-------------- openapi/otp/handler.go | 6 ++++-- 2 files changed, 6 insertions(+), 16 deletions(-) diff --git a/openapi/otp/README.md b/openapi/otp/README.md index 571be47e..d37b8b66 100644 --- a/openapi/otp/README.md +++ b/openapi/otp/README.md @@ -58,22 +58,10 @@ Deletes the code. Silent if the code does not exist. | Method | Path | Auth | Description | |---|---|---|---| -| `POST` | `/otp/create` | Bearer token (team context) | Create an OTP code | +| ~~`POST`~~ | ~~`/otp/create`~~ | ~~Bearer token~~ | **Disabled** — use `otp.Create` process instead | | `POST` | `/otp/login` | Public | Verify code, set session cookies | -### POST /otp/create - -Requires a valid access token with team context. The `team_id` is forced from the caller's identity. Validates that the target user/member belongs to the same team. - -**Request:** -```json -{"member_id": "M1", "redirect": "/agents/keeper/entry/xxx"} -``` - -**Response:** -```json -{"code": "abc123def456"} -``` +> **Note:** The `/otp/create` HTTP endpoint is intentionally disabled. Exposing it would allow any team member to generate OTP codes for other members, effectively logging in as them without credentials. OTP codes must be created server-side via the `otp.Create` process only. ### POST /otp/login diff --git a/openapi/otp/handler.go b/openapi/otp/handler.go index 9d88b603..61822b8b 100644 --- a/openapi/otp/handler.go +++ b/openapi/otp/handler.go @@ -33,9 +33,11 @@ type OTPLoginRequest struct { } // Attach registers OTP HTTP routes on the given router group. -// The create endpoint requires authentication; login is public. +// NOTE: /otp/create is disabled — OTP codes should only be created via +// server-side Process (otp.Create) to prevent team members from generating +// codes for other members and logging in as them. func Attach(group *gin.RouterGroup, auth types.OAuth) { - group.POST("/create", auth.Guard, GinOTPCreate) + // group.POST("/create", auth.Guard, GinOTPCreate) group.POST("/login", GinOTPLogin) }