✨ Auth config to limit auth steps

.idea/workspace.xml

@@ -4,7 +4,14 @@
     <option name="autoReloadType" value="ALL" />
   </component>
   <component name="ChangeListManager">
-    <list default="true" id="3fefb2c4-b6f9-466b-a523-53352e8d6f95" name="更改" comment=":sparkles: Account deletion" />
+    <list default="true" id="3fefb2c4-b6f9-466b-a523-53352e8d6f95" name="更改" comment=":sparkles: Account deletion">
+      <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/pkg/internal/models/accounts.go" beforeDir="false" afterPath="$PROJECT_DIR$/pkg/internal/models/accounts.go" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/pkg/internal/models/auth.go" beforeDir="false" afterPath="$PROJECT_DIR$/pkg/internal/models/auth.go" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/pkg/internal/server/api/index.go" beforeDir="false" afterPath="$PROJECT_DIR$/pkg/internal/server/api/index.go" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/pkg/internal/server/api/preferences_api.go" beforeDir="false" afterPath="$PROJECT_DIR$/pkg/internal/server/api/preferences_api.go" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/pkg/internal/services/ticket.go" beforeDir="false" afterPath="$PROJECT_DIR$/pkg/internal/services/ticket.go" afterDir="false" />
+    </list>
     <option name="SHOW_DIALOG" value="false" />
     <option name="HIGHLIGHT_CONFLICTS" value="true" />
     <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />

pkg/internal/models/accounts.go

@@ -20,6 +20,7 @@ type Account struct {
 	ConfirmedAt *time.Time                     `json:"confirmed_at"`
 	SuspendedAt *time.Time                     `json:"suspended_at"`
 	PermNodes   datatypes.JSONMap              `json:"perm_nodes"`
+	AuthConfig  datatypes.JSONType[AuthConfig] `json:"auth_config"`
 
 	AutomatedBy *Account `json:"automated_by" gorm:"foreignKey:AutomatedID"`
 	AutomatedID *uint    `json:"automated_id"`

pkg/internal/models/auth.go

@@ -7,6 +7,10 @@ import (
 	"gorm.io/datatypes"
 )
 
+type AuthConfig struct {
+	MaximumAuthSteps int `json:"maximum_auth_steps" validate:"required,min=1"`
+}
+
 type AuthFactorType = int8
 
 const (

pkg/internal/server/api/index.go

@@ -26,6 +26,8 @@ func MapAPIs(app *fiber.App, baseURL string) {
 
 		preferences := api.Group("/preferences").Name("Preferences API")
 		{
+			preferences.Get("/auth", getAuthConfig)
+			preferences.Put("/auth", updateAuthConfig)
 			preferences.Get("/notifications", getNotificationPreference)
 			preferences.Put("/notifications", updateNotificationPreference)
 		}

pkg/internal/server/api/preferences_api.go

@@ -1,12 +1,45 @@
 package api
 
 import (
+	"git.solsynth.dev/hydrogen/passport/pkg/internal/database"
 	"git.solsynth.dev/hydrogen/passport/pkg/internal/models"
 	"git.solsynth.dev/hydrogen/passport/pkg/internal/server/exts"
 	"git.solsynth.dev/hydrogen/passport/pkg/internal/services"
 	"github.com/gofiber/fiber/v2"
+	"gorm.io/datatypes"
 )
 
+func getAuthConfig(c *fiber.Ctx) error {
+	if err := exts.EnsureAuthenticated(c); err != nil {
+		return err
+	}
+	user := c.Locals("user").(models.Account)
+
+	return c.JSON(user.AuthConfig)
+}
+
+func updateAuthConfig(c *fiber.Ctx) error {
+	if err := exts.EnsureAuthenticated(c); err != nil {
+		return err
+	}
+	user := c.Locals("user").(models.Account)
+
+	var data models.AuthConfig
+	if err := exts.BindAndValidate(c, &data); err != nil {
+		return fiber.NewError(fiber.StatusBadRequest, err.Error())
+	}
+
+	user.AuthConfig = datatypes.NewJSONType(data)
+
+	if err := database.C.Save(&user).Error; err != nil {
+		return fiber.NewError(fiber.StatusInternalServerError, err.Error())
+	} else {
+		services.InvalidAuthCacheWithUser(user.ID)
+	}
+
+	return c.JSON(user.AuthConfig)
+}
+
 func getNotificationPreference(c *fiber.Ctx) error {
 	if err := exts.EnsureAuthenticated(c); err != nil {
 		return err

pkg/internal/services/ticket.go

@@ -54,7 +54,11 @@ func NewTicket(user models.Account, ip, ua string) (models.AuthTicket, error) {
 	if count := CountUserFactor(user.ID); count <= 0 {
 		return ticket, fmt.Errorf("specified user didn't enable sign in")
 	} else {
+		cfg := user.AuthConfig.Data()
 		steps = min(steps, int(count))
+		if cfg.MaximumAuthSteps >= 1 {
+			steps = min(steps, cfg.MaximumAuthSteps)
+		}
 	}
 
 	ticket = models.AuthTicket{