feat(security): 新增网站安全扩展模块并支持修改手机脱敏验证

src/Sms/SMS.php

@@ -14,9 +14,6 @@ class SMS {
 
 	private static $instance = null;
 
-	private const RATE_LIMIT = 60;
-	private const DAILY_LIMIT = 10;
-
 	public static function get_instance(): self {
 		if (null === self::$instance) {
 			self::$instance = new self();
@@ -72,39 +69,27 @@ class SMS {
 			return ['success' => false, 'message' => sprintf(__('短信接口缺少配置：%s', 'aksrt'), implode(', ', $missing))];
 		}
 
-		$phone_hash = md5($phone);
-		$rate_limit = self::RATE_LIMIT;
-		$rate_key = 'aksrt_sms_rate_' . $phone_hash;
-		if (get_transient($rate_key) !== false) {
-			$sent_time = (int) get_transient('aksrt_sms_rate_ts_' . $phone_hash);
-			$remaining = max(1, $rate_limit - (time() - $sent_time));
+		// [防刷机制]验证码发送限制（后台「扩展&增强 → 网站安全」）。
+		$limit = \AKSRT\Extensions\SendLimit::check($phone);
+		if (empty($limit['ok'])) {
 			return [
 				'success' => false,
-				'message' => sprintf(__('请 %d 秒后再试', 'aksrt'), $remaining),
-				'remaining_time' => $remaining,
+				'message' => (string) $limit['message'],
+				'remaining_time' => (int) $limit['remaining'],
 			];
 		}
 
-		$daily_limit = self::DAILY_LIMIT;
-		$daily_key = 'aksrt_sms_daily_' . $phone_hash . '_' . wp_date('Ymd');
-		$daily_count = (int) get_transient($daily_key);
-		if ($daily_count >= $daily_limit) {
-			return ['success' => false, 'message' => __('今日发送次数已达上限', 'aksrt')];
-		}
-
 		$result = $provider->send_code($phone, $code, $config);
 		if (empty($result['success'])) {
 			return ['success' => false, 'message' => (string) ($result['message'] ?? __('验证码发送失败，请稍后重试', 'aksrt'))];
 		}
 
-		set_transient($rate_key, '1', $rate_limit);
-		set_transient('aksrt_sms_rate_ts_' . $phone_hash, time(), $rate_limit);
-		set_transient($daily_key, $daily_count + 1, DAY_IN_SECONDS);
+		$cooldown = \AKSRT\Extensions\SendLimit::record($phone);
 
 		return [
 			'success' => true,
 			'message' => __('验证码短信已发送', 'aksrt'),
-			'remaining_time' => $rate_limit,
+			'remaining_time' => $cooldown > 0 ? $cooldown : 60,
 		];
 	}
 	public function get_provider_status(): array {