26 lines
896 B
Python
26 lines
896 B
Python
|
import os
|
||
|
|
import secrets
|
||
|
|
from fastapi import APIRouter, HTTPException
|
||
|
|
from pydantic import BaseModel
|
||
|
|
from logger import get_logger
|
||
|
|
|
||
|
|
logger = get_logger("app.auth")
|
||
|
|
router = APIRouter(tags=["Auth"])
|
||
|
|
|
||
|
|
# 定義請求本體格式
|
||
|
|
class GodModeRequest(BaseModel):
|
||
|
|
password: str
|
||
|
|
|
||
|
|
@router.post("/auth/god-mode", summary="驗證上帝模式進階密碼")
|
||
|
|
async def verify_god_mode(req: GodModeRequest):
|
||
|
|
# 從環境變數讀取正確密碼，預設為 "admin999"
|
||
|
|
expected_password = os.getenv("GOD_MODE_SECRET", "swpa@Serc0mm")
|
||
|
|
|
||
|
|
# 使用 compare_digest 防禦計時攻擊
|
||
|
|
if secrets.compare_digest(req.password, expected_password):
|
||
|
|
logger.info("🔓 上帝模式解鎖成功！")
|
||
|
|
return {"status": "success"}
|
||
|
|
|
||
|
|
logger.warning("🔒 嘗試解鎖上帝模式失敗 (密碼錯誤)")
|
||
|
|
raise HTTPException(status_code=401, detail="Invalid authorization code")
|