去除冗余的接口和实现，保留五个模块Service的实现 - #88
Conversation
移动端接入 /api/ielts 全链路：设置/题库/生成/WebRTC 会话、Part1/3 逐轮 state+evaluation、Part2 状态机、整场评估与历史；补充逐轮 WAV 上传、状态恢复与录音回放。 Co-authored-by: Cursor <cursoragent@cursor.com>
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
|
|
||
| @PostMapping("/challenges") | ||
| public ApiResponse<ChallengeResponse> issueChallenge(@Valid @RequestBody EmailRequest request) { | ||
| var challenge = emailAuthService.issueMobileChallenge(request.email()); |
There was a problem hiding this comment.
This native challenge endpoint calls issueMobileChallenge without any human-verification token, while the same service only enforces CAPTCHA in issueChallenge (the web path). Because /api/auth/mobile/email/challenges is publicly permitted, any client can automate requests for arbitrary addresses and trigger unlimited SMTP sends (and associated provider cost/abuse). Please require and verify the CAPTCHA token here as well, or add an equivalent server-side rate limit before issuing the challenge.
| ON session_message (session_id, message_no) | ||
| WHERE audio_url IS NOT NULL; | ||
|
|
||
| -- Final schema additions formerly delivered by V2 and V9-V15. |
There was a problem hiding this comment.
These new auth tables/columns are appended to V1__baseline.sql, but existing deployments that have already applied V1 will not re-run this file under Flyway. As a result, upgrading an existing database leaves app_users, auth_email_challenges, user_sessions, and the related schema changes absent, causing the new auth endpoints to fail at runtime. Please add a new migration (V16+ per the repository convention) instead of modifying the applied V1 baseline.
|
ok |
2 participants
Closes #87
本 PR 提交当前 fork 中的完整代码，并关联 Issue #87。
内容包括：
验证：本地后端和 Web 已启动，真实验证码请求会进入阿里云校验链路；未提供有效阿里云验证码参数时会返回 HUMAN_VERIFICATION_REQUIRED。