feat(captcha): 打通人机验证 11 个场景的前后端完整链路

- 统一验证入口 aksrt_require_captcha()，返回 true|WP_Error，启用场景配置缺失时 fail-closed 拒绝 - 前端公共 API 重构为 window.AKSRTCaptcha（verify/collect/reset/run），单飞锁防并发重复验证，一次性 proof 绑定浏览器 cookie+场景+服务商+主机名 - challenge/exchange REST 端点：challenge 原子占用防票据放大厂商调用，增加频率限制 - 新增 OAuth bind pass：服务端签发 5 分钟一次性令牌，绑定用户+服务商+浏览器，微信扫码延迟消费 - 覆盖场景：评论、登录、注册、绑定第三方、绑定手机、找回密码、修改密码、更改邮箱、资料下载、签到、前台投稿 - 移除 Service 层重复验证与 _auth_code_verified/_defer_login 等客户端可伪造标志，删除下载共享 pass 死代码 - 修复腾讯 TC3 签名 scope、Cloudflare action/cdata/hostname 严格校验、阿里云验签错误码映射 - 后台 Schema 保存对 secret 字段做掩码/保留合并；导入导出过滤 aksrt_captcha_config - 重建 public bundle 与 admin SPA；新增 captcha 运行时/安全/业务契约测试与 harness
2026-09-02 13:03:24 +08:00
parent d2e95acd75
commit ff4ec1eb43
45 changed files with 2694 additions and 1435 deletions
@@ -0,0 +1,109 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+const vm = require('node:vm');
+
+const root = path.resolve(__dirname, '..', '..');
+const runtime = fs.readFileSync(path.join(root, 'assets/js/captcha-front.js'), 'utf8');
+
+function createInput(name, value = '') {
+  return { name, value, remove() {}, nodeType: 1 };
+}
+
+function createHarness() {
+  const fields = new Map();
+  const challenge = createInput('aksrt_captcha_challenge', 'challenge-token');
+  const proof = createInput('aksrt_captcha_proof', '');
+  const verified = createInput('captcha_verified', '0');
+  fields.set(challenge.name, challenge);
+  fields.set(proof.name, proof);
+  fields.set(verified.name, verified);
+
+  const container = {
+    nodeType: 1,
+    contains: () => true,
+    querySelector(selector) {
+      const match = selector.match(/input\[name="([^"]+)"\]/);
+      return match ? fields.get(match[1]) || null : null;
+    },
+    querySelectorAll(selector) {
+      const value = this.querySelector(selector);
+      return value ? [value] : [];
+    },
+    appendChild(field) { fields.set(field.name, field); },
+  };
+  const box = {
+    nodeType: 1,
+    parentElement: container,
+    closest: () => container,
+    contains: () => false,
+    querySelector: () => null,
+    appendChild() {},
+    innerHTML: '',
+  };
+  const mount = {
+    nodeType: 1,
+    dataset: {},
+    parentElement: container,
+    contains: () => true,
+    setAttribute() {},
+  };
+  const scripts = [];
+  const document = {
+    readyState: 'complete',
+    documentElement: { nodeType: 1 },
+    querySelectorAll(selector) { return selector === '[data-aksrt-captcha-config]' ? [mount] : []; },
+    querySelector: () => null,
+    getElementById(id) { return id === 'captcha-box' ? box : verified; },
+    createElement(tag) {
+      if (tag === 'input') return createInput('', '');
+      return { setAttribute() {}, addEventListener() {}, appendChild() {}, style: {}, dataset: {} };
+    },
+    addEventListener() {},
+    head: { appendChild(script) { scripts.push(script); } },
+    body: { appendChild() {} },
+  };
+  mount.getAttribute = () => JSON.stringify({
+    provider: 'tencent', scene: 'login', uid: 'captcha-box', vid: 'captcha-verified',
+    tc: { app_id: '1' }, challenge_url: '/challenge', exchange_url: '/exchange',
+  });
+
+  let providerCallback;
+  const window = {
+    fetch(url) {
+      if (url === '/challenge') return Promise.resolve({ ok: true, json: () => Promise.resolve({ success: true, data: { challenge: 'challenge-token' } }) });
+      if (url === '/exchange') return Promise.resolve({ ok: true, json: () => Promise.resolve({ success: true, data: { proof: 'proof-token' } }) });
+      throw new Error('unexpected URL ' + url);
+    },
+    TencentCaptcha: class {
+      constructor(_id, callback) { providerCallback = callback; }
+      show() { providerCallback({ ret: 0, ticket: 'ticket', randstr: 'rand' }); }
+    },
+    setTimeout,
+    clearTimeout,
+    Promise,
+  };
+  vm.runInNewContext(runtime, { window, document, Promise, MutationObserver: undefined, setTimeout, clearTimeout, console });
+  return { api: window.AKSRTCaptcha, container };
+}
+
+test('captcha run is single-flight until the owning business request resets', async () => {
+  const { api, container } = createHarness();
+  await Promise.resolve();
+  await Promise.resolve();
+  const first = api.run('login', container);
+  const second = api.run('login', container);
+  const firstPayload = await first;
+  assert.equal(firstPayload.aksrt_captcha_proof, 'proof-token');
+
+  let secondSettled = false;
+  second.then(() => { secondSettled = true; });
+  await Promise.resolve();
+  assert.equal(secondSettled, false, 'concurrent caller settled before the owner reset');
+
+  api.reset('login', container);
+  assert.equal(await second, null);
+});