refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

* refactor(auth): replace dashboard sessions with stateless tokens * feat(auth): harden session issuance and distributed enforcement * fix(proxy): preserve trusted proxy compatibility defaults * refactor: address dashboard auth review feedback * refactor: remove classic frontend and flatten web app
2026-09-12 07:00:42 +00:00 · 2026-07-20 16:48:43 +08:00
parent 5a6c53d496
commit 31d70fca39
1605 changed files with 17511 additions and 147913 deletions
@@ -0,0 +1,60 @@
+/*
+Copyright (C) 2023-2026 QuantumNous
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+For commercial licensing, please contact support@quantumnous.com
+*/
+const serverErrorMessageKeys = {
+  AUTH_SESSION_LIMIT:
+    'Too many active login sessions. On a device where you are already signed in, open Login sessions and use “Sign out other sessions” to revoke them. If you cannot access a signed-in device, reset your password to sign out all sessions.',
+  AUTH_SESSION_ISSUANCE_LIMIT:
+    'Too many login sessions were created recently. Please wait for the rolling window to pass, then try again.',
+  TELEGRAM_BIND_DISABLED: 'Telegram binding is disabled.',
+  TELEGRAM_BIND_INVALID_REQUEST:
+    'The Telegram authorization request is invalid or expired.',
+  TELEGRAM_BIND_FLOW_INVALID:
+    'This Telegram binding request has expired or has already been used.',
+  TELEGRAM_BIND_SESSION_INVALID:
+    'The login session that started this Telegram binding is no longer valid.',
+  TELEGRAM_BIND_ALREADY_BOUND: 'This Telegram account is already bound.',
+  TELEGRAM_BIND_USER_DELETED: 'This user account no longer exists.',
+  TELEGRAM_BIND_USER_DISABLED: 'This user account is disabled.',
+  TELEGRAM_BIND_INTERNAL_ERROR: 'Telegram binding failed. Please try again.',
+} as const
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object'
+}
+
+function serverErrorPayload(value: unknown): Record<string, unknown> | null {
+  if (!isRecord(value)) return null
+
+  const response = value.response
+  if (isRecord(response) && isRecord(response.data)) {
+    return response.data
+  }
+  return value
+}
+
+export function getServerErrorMessageKey(value: unknown): string | null {
+  const payload = serverErrorPayload(value)
+  if (!payload || typeof payload.code !== 'string') return null
+
+  return (
+    serverErrorMessageKeys[
+      payload.code as keyof typeof serverErrorMessageKeys
+    ] ?? null
+  )
+}