feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝 - 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名 - challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制 - 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费 - 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿 - 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码 - 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射 - 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config - 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
2026-09-02 13:03:24 +08:00
parent d2e95acd75
commit ff4ec1eb43
45 changed files with 2694 additions and 1435 deletions
@@ -9,6 +9,9 @@ defined('ABSPATH') || exit;

 final class OAuth {

+	private const BIND_PASS_KIND = 'oauth_bind_pass';
+	private const BIND_PASS_TTL = 5 * MINUTE_IN_SECONDS;
+
 	private static $instance = null;
 	private OAuthProviderBroker $broker;

@@ -32,6 +35,7 @@ final class OAuth {
 			}
 		}, 30);
 		add_action('template_redirect', [$this, 'handle_routes'], 8);
+		add_action('rest_api_init', [$this, 'register_rest_routes']);
 		add_action('wp_ajax_aksrt_oauth_unbind', [$this, 'ajax_unbind']);
 	}

@@ -47,6 +51,109 @@ final class OAuth {
 		});
 	}

+	public function register_rest_routes(): void {
+		register_rest_route('aksrt/v1', '/oauth/bind-pass', [
+			'methods'             => 'POST',
+			'callback'            => [$this, 'rest_issue_bind_pass'],
+			'permission_callback' => static function (): bool {
+				return is_user_logged_in();
+			},
+		]);
+	}
+
+	public function rest_issue_bind_pass(\WP_REST_Request $request): \WP_REST_Response {
+		$user_id = get_current_user_id();
+		$nonce = sanitize_text_field((string) $request->get_header('X-WP-Nonce'));
+		if ($user_id <= 0 || $nonce === '' || !wp_verify_nonce($nonce, 'wp_rest')) {
+			return new \WP_REST_Response([
+				'success' => false,
+				'code'    => 'oauth_bind_nonce_invalid',
+				'message' => __('安全验证失败，请刷新页面重试', 'aksrt'),
+			], 403);
+		}
+
+		$payload = $request->get_json_params();
+		$payload = is_array($payload) ? $payload : [];
+		$provider = sanitize_key((string) ($payload['provider'] ?? ''));
+		if (!in_array($provider, OAuthProviderCatalog::enabled_login_keys(), true)) {
+			return new \WP_REST_Response([
+				'success' => false,
+				'code'    => 'oauth_bind_provider_invalid',
+				'message' => __('该第三方登录方式不可用', 'aksrt'),
+			], 400);
+		}
+
+		$url = $this->get_auth_url($provider, 'bind');
+		if ($url === '') {
+			return new \WP_REST_Response([
+				'success' => false,
+				'code'    => 'oauth_bind_provider_invalid',
+				'message' => __('该第三方登录方式不可用', 'aksrt'),
+			], 400);
+		}
+		$redirect = OAuthUrlPolicy::validated_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
+		$url = add_query_arg('redirect_to', $redirect, $url);
+
+		if (!aksrt_is_captcha_enabled_for('bind')) {
+			return new \WP_REST_Response([
+				'success' => true,
+				'data'    => ['url' => $url],
+			], 200);
+		}
+
+		$result = aksrt_require_captcha('bind', $payload);
+		if ($result !== true) {
+			return new \WP_REST_Response([
+				'success' => false,
+				'code'    => is_wp_error($result) ? $result->get_error_code() : 'aksrt_captcha_failed',
+				'message' => is_wp_error($result) ? $result->get_error_message() : __('人机验证失败，请重试', 'aksrt'),
+			], 400);
+		}
+
+		try {
+			$pass = OAuthTransactionStore::issue(self::BIND_PASS_KIND, [
+				'user_id'  => $user_id,
+				'provider' => $provider,
+			], self::BIND_PASS_TTL, true);
+		} catch (\Throwable $e) {
+			return new \WP_REST_Response([
+				'success' => false,
+				'code'    => 'oauth_bind_pass_issue_failed',
+				'message' => __('无法创建绑定会话，请稍后重试', 'aksrt'),
+			], 500);
+		}
+
+		$url = add_query_arg('bind_pass', $pass, $url);
+
+		return new \WP_REST_Response([
+			'success' => true,
+			'data'    => ['url' => $url],
+		], 200);
+	}
+
+	public static function validate_bind_pass(string $token, string $provider, int $user_id, bool $consume = true): bool {
+		if (!aksrt_is_captcha_enabled_for('bind')) {
+			return true;
+		}
+		if ($token === '' || $user_id <= 0) {
+			return false;
+		}
+		$matches = static function (?array $row) use ($provider, $user_id): bool {
+			$payload = is_array($row['payload'] ?? null) ? $row['payload'] : [];
+			return $row !== null
+				&& (int) ($payload['user_id'] ?? 0) === $user_id
+				&& hash_equals(sanitize_key($provider), sanitize_key((string) ($payload['provider'] ?? '')));
+		};
+		$row = OAuthTransactionStore::peek($token, self::BIND_PASS_KIND, true);
+		if (!$matches($row)) {
+			return false;
+		}
+		if (!$consume) {
+			return true;
+		}
+		return $matches(OAuthTransactionStore::claim($token, self::BIND_PASS_KIND, true));
+	}
+
 	public function maybe_flush_rewrite_rules(): void {
 		$version = defined('AKSRT_VERSION') ? AKSRT_VERSION . ':oauth-v2' : 'oauth-v2';
 		if (get_option('aksrt_oauth_routes_flushed') !== $version) {
@@ -186,6 +293,17 @@ final class OAuth {
 		if (!OAuthProviderCatalog::master_enabled() || !in_array($provider, OAuthProviderCatalog::enabled_login_keys(), true)) {
 			$this->redirect_error('provider_disabled', $provider, $action);
 		}
+		$user_id = get_current_user_id();
+		if ($action === 'bind' && $user_id <= 0) {
+			wp_safe_redirect(function_exists('aksrt_get_login_url') ? aksrt_get_login_url() : wp_login_url());
+			exit;
+		}
+		if ($action === 'bind') {
+			$bind_pass = sanitize_text_field((string) ($_GET['bind_pass'] ?? ''));
+			if (!self::validate_bind_pass($bind_pass, $provider, $user_id, true)) {
+				$this->redirect_error('bind_verification_required', $provider, $action);
+			}
+		}
 		if (OAuthProviderCatalog::proxy_mode() === 'client') {
 			$url = OAuthProxyClient::get_instance()->get_proxy_auth_url($provider, $action);
 			if ($url === '') {
@@ -194,11 +312,6 @@ final class OAuth {
 			wp_redirect($url); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
 			exit;
 		}
-		$user_id = get_current_user_id();
-		if ($action === 'bind' && $user_id <= 0) {
-			wp_safe_redirect(function_exists('aksrt_get_login_url') ? aksrt_get_login_url() : wp_login_url());
-			exit;
-		}
 		$redirect = isset($_GET['redirect_to']) ? OAuthUrlPolicy::validated_redirect((string) $_GET['redirect_to'], home_url('/')) : home_url('/');
 		$redirect_uri = home_url('/oauth/callback/');
 		try {
@@ -264,6 +377,12 @@ final class OAuth {
 			wp_safe_redirect(function_exists('aksrt_get_login_url') ? aksrt_get_login_url() : wp_login_url());
 			exit;
 		}
+		if ($action === 'bind') {
+			$bind_pass = sanitize_text_field((string) ($_GET['bind_pass'] ?? ''));
+			if (!self::validate_bind_pass($bind_pass, 'clogin_' . $type, get_current_user_id(), true)) {
+				$this->redirect_error('bind_verification_required', 'clogin_' . $type, $action);
+			}
+		}
 		$redirect = isset($_GET['redirect_to']) ? OAuthUrlPolicy::validated_redirect((string) $_GET['redirect_to'], home_url('/')) : home_url('/');
 		try {
 			$state = OAuthTransactionStore::issue('clogin', [